Abstract: A recovery unit in a software fault-tolerant system has primary and secondary processing units (I, II) running replicate application processes (24). Input messages sent to the recovery unit are received at the primary unit (I) and in due course processed by the primary process (24) to produce application messages; however, these application messages produced by the primary process (24) are not normally output from the recovery unit. The input messages received at the primary unit (I) are logged to the secondary unit (II) together with any non-deterministic choices made by the primary process during its processing. The secondary process (24) processes the input messages logged to the secondary unit (II) in the same order as the primary process (24) with any non-deterministic choices made by the primary process in its processing being used by the secondary process in place of the latter making its own non-deterministic choices during processing.

Abstract: A recovery unit in a software fault-tolerant system has primary and secondary processing units (I, II) running replicate application processes (24). Input messages sent to the recovery unit are received at the primary unit (I) and in due course processed by the primary process (24) to produce application messages; however, these application messages produced by the primary process (24) are not normally output from the primary unit I as the recovery-unit output messages. Instead, these application messages are logged from the primary unit (I) to the secondary unit (II) together with state update information. The secondary process (24) run by secondary unit (II) uses this update information to updates its own state so as to track the state of the primary process. The secondary unit (II) outputs the application messages logged to it from the primary unit (I) as the recovery-unit output messages. Should the primary unit (I) fail, the secondary unit (II) takes over the role of the primary.