Abstract: A fault tolerant computer system having two virtual machines (VMs), each running on a separate host device, is connected over a network to one or more I/O devices. The system operates to monitor the health of one or more operational characteristics associated with each VM, and in the event that the health of both virtual machines dictates that one or the other of the VMs should be downgraded, but the system is not able to determine which VM should be downgraded and there is an imbalance in a monitored system operational characteristic, the system can defer downgrading one VM for a selected period of time during which the operational characteristic that is in imbalance is monitored. If the imbalance is resolved, the downgrade is cancelled, if an operational fault is confirmed prior to the expiration of the deferral period or if the deferral period expires, then one host is downgraded.

Abstract: A method of allowing egress network frames to bypass the buffer requirement of a checkpoint system. In one embodiment, the method includes the steps of examining a frame, or its attributes, to determine if it is a “candidate frame” and if the frame is a candidate frame, allowing it to be released to the external network without an intervening checkpoint. In another embodiment, the candidate frame is one of a group comprising: any frame targeting a designated network interface; any frame of a designated protocol type; any frame sourced or destined from/to a designated address. In still another embodiment, the method includes the designation of scheduling follow-up checkpoints according to frame disposition to limit or reduce the effects of a fail-over (roll-back) disturbance.

Abstract: A method of delaying checkpointing in a virtual machine system. In one embodiment, the method includes the steps of examining a network frame to determine if it is a deferrable frame and if the frame is a deferrable frame, delaying a checkpoint associated with the frame. In another embodiment, the deferrable frame is one of a group comprising: an IP packet tagged with the ‘more fragments’ attribute; TCP data segments that lack the PSH flag and carry no flags other than ‘ACK’; and TCP segments that contain no data and carry only the ‘ACK’ flag; and any frame originating from or destined to a designated network address or port number. In still another embodiment, the method includes the step of concatenating the delays due to deferrable frames. In still yet another embodiment, the method further includes setting an upper limit to the amount of delay that can be generated.

Abstract: A method for determining a delay in a dynamic, event driven, checkpoint interval. In one embodiment, the method includes the steps of determining the number of network bits to be transferred; determining the target bit transfer rate; calculating the next cycle delay as the number of bits to be transferred divided by the target bit transfer rate. In another aspect, the invention relates to a method for delaying a checkpoint interval. In one embodiment, the method includes the steps of monitoring the transfer of a prior batch of network data and delaying a subsequent checkpoint until the transfer of a prior batch of network data has reached a certain predetermined level of completion. In another embodiment, the predetermined level of completion is 100%.

Abstract: In one aspect, the invention relates to a fault tolerant computing system. The system includes a primary virtual machine and a secondary virtual machine, wherein the primary and secondary virtual machines are in communication, wherein the primary virtual machine comprises a first checkpointing engine and a first network interface, wherein the secondary virtual machine comprises a second network interface, wherein the first checkpointing engine forwards a page of memory of the primary virtual machine to the second virtual machine such that the first checkpointing engine can checkpoint the page of memory without pausing the primary virtual machine.

Abstract: A method of allowing egress network frames to bypass the buffer requirement of a checkpoint system. In one embodiment, the method includes the steps of examining a frame, or its attributes, to determine if it is a “candidate frame” and if the frame is a candidate frame, allowing it to be released to the external network without an intervening checkpoint. In another embodiment, the candidate frame is one of a group comprising: any frame targeting a designated network interface; any frame of a designated protocol type; any frame sourced or destined from/to a designated address. In still another embodiment, the method includes the designation of scheduling follow-up checkpoints according to frame disposition to limit or reduce the effects of a fail-over (roll-back) disturbance.

Abstract: A fault tolerant computer system having two virtual machines (VMs), each running on a separate host device, is connected over a network to one or more I/O devices. The system operates to monitor the health of one or more operational characteristics associated with each VM, and in the event that the health of both virtual machines dictates that one or the other of the VMs should be downgraded, but the system is not able to determine which VM should be downgraded and there is an imbalance in a monitored system operational characteristic, the system can defer downgrading one VM for a selected period of time during which the operational characteristic that is in imbalance is monitored. If the imbalance is resolved, the downgrade is cancelled, if an operational fault is confirmed prior to the expiration of the deferral period or if the deferral period expires, then one host is downgraded.

Abstract: A method of delaying checkpointing in a virtual machine system. In one embodiment, the method includes the steps of examining a network frame to determine if it is a deferrable frame and if the frame is a deferrable frame, delaying a checkpoint associated with the frame. In another embodiment, the deferrable frame is one of a group comprising: an IP packet tagged with the ‘more fragments’ attribute; TCP data segments that lack the PSH flag and carry no flags other than ‘ACK’; and TCP segments that contain no data and carry only the ‘ACK’ flag; and any frame originating from or destined to a designated network address or port number. In still another embodiment, the method includes the step of concatenating the delays due to deferrable frames. In still yet another embodiment, the method further includes setting an upper limit to the amount of delay that can be generated.

Abstract: A method for determining a delay in a dynamic, event driven, checkpoint interval. In one embodiment, the method includes the steps of determining the number of network bits to be transferred; determining the target bit transfer rate; calculating the next cycle delay as the number of bits to be transferred divided by the target bit transfer rate. In another aspect, the invention relates to a method for delaying a checkpoint interval. In one embodiment, the method includes the steps of monitoring the transfer of a prior batch of network data and delaying a subsequent checkpoint until the transfer of a prior batch of network data has reached a certain predetermined level of completion. In another embodiment, the predetermined level of completion is 100%.

Abstract: In one aspect, the invention relates to a fault tolerant computing system. The system includes a primary virtual machine and a secondary virtual machine, wherein the primary and secondary virtual machines are in communication, wherein the primary virtual machine comprises a first checkpointing engine and a first network interface, wherein the secondary virtual machine comprises a second network interface, wherein the first checkpointing engine forwards a page of memory of the primary virtual machine to the second virtual machine such that the first checkpointing engine can checkpoint the page of memory without pausing the primary virtual machine.

Abstract: A computer system configured to provide fault tolerance includes a first host system and a second host system. The first host system is programmed to monitor a number of portions of memory of the first host system that have been modified by a guest running on the first host system and, upon determining that the number of portions exceeds a threshold level, determine that a checkpoint needs to be created. Upon determining that the checkpoint needs to be created, operation of the guest is paused and checkpoint data is generated. After generating the checkpoint data, operation of the guest is resumed while the checkpoint data is transmitted to the second host system.

Abstract: A symmetric multiprocessing fault-tolerant computer system controls memory access in a symmetric multiprocessing computer system. To do so, virtual page structures are created, where the virtual page structures reflect physical page access privileges to shared memory for processors in a symmetric multiprocessing computer system. Access to shared memory is controlled based on physical page access privileges reflected in the virtual paging structures to coordinate deterministic shared memory access between processors in the symmetric multiprocessing computer system. A symmetric multiprocessing fault-tolerant computer system may use duplication or continuous replay.

Abstract: A fault tolerant/fault resilient computer system includes a first coserver and a second coserver. The first coserver includes a first application environment (AE) processor and a first I/O subsystem processor on a first common motherboard. The second coserver includes a second AE processor and a second I/O subsystem processor on a second common motherboard.

Abstract: A fault-tolerant computer system includes at least two servers, each of which is configured to perform a first set of operations. Each of the two servers communicate with a computer that does not perform the first set of operations. In the event of a failure of a component of the system, determining which of the servers will continue to perform the first set of operations based on communication with the computer.

Abstract: A symmetric multiprocessing fault-tolerant computer system controls memory access in a symmetric multiprocessing computer system. To do so, virtual page structures are created, where the virtual page structures reflect physical page access privileges to shared memory for processors in a symmetric multiprocessing computer system. Access to shared memory is controlled based on physical page access privileges reflected in the virtual paging structures to coordinate deterministic shared memory access between processors in the symmetric multiprocessing computer system. A symmetric multiprocessing fault-tolerant computer system may use duplication or continuous replay.

Abstract: A fault-tolerant computer system includes at least two servers, each of which is configured to perform a first set of operations. Each of the two servers communicate with a computer that does not perform the first set of operations. In the event of a failure of a component of the system, determining which of the servers will continue to perform the first set of operations based on communication with the computer.

Abstract: A fault tolerant/fault resilient computer system includes a first coserver and a second coserver. The first coserver includes a first application environment (AE) processor and a first I/O subsystem processor on a first common motherboard. The second coserver includes a second AE processor and a second I/O subsystem processor on a second common motherboard. Each of the AE processors has a clock that operates asynchronously to clocks of the other AE processor, and the AE processors operate in instruction lockstep.

Abstract: Producing a mirror copy using incremental-divergence is performed in a computer system in which write requests are each associated with a reference label. A mirror set may be restored to a state in which the data storage devices contain identical data by copying from the data storage device having “good” data only portions of data which have not been stored on the data storage device having divergent data. Incremental-divergence copying may be accomplished by keeping track of the changes made after a point in which the data storage devices are known to contain identical data.

Abstract: Producing a mirror copy using incremental-divergence is performed in a computer system in which write requests are each associated with a reference label. A mirror set may be restored to a state in which the data storage devices contain identical data by copying from the data storage device having “good” data only portions of data which have not been stored on the data storage device having divergent data. Incremental-divergence copying may be accomplished by keeping track of the changes made after a point in which the data storage devices are known to contain identical data.

Abstract: A fault tolerant/fault resilient computer system includes at least two compute elements connected to at least one controller. Each compute element has clocks that operate asynchronously to clocks of the other compute elements. The compute elements operate in a first mode in which the compute elements each execute a first stream of instructions in emulated clock lockstep, and in a second mode in which the compute elements each execute a second stream of instructions in instruction lockstep. Each compute element may be a multi-processor compute element.