Abstract: A fault tolerant computer system having two virtual machines (VMs), each running on a separate host device, is connected over a network to one or more I/O devices. The system operates to monitor the health of one or more operational characteristics associated with each VM, and in the event that the health of both virtual machines dictates that one or the other of the VMs should be downgraded, but the system is not able to determine which VM should be downgraded and there is an imbalance in a monitored system operational characteristic, the system can defer downgrading one VM for a selected period of time during which the operational characteristic that is in imbalance is monitored. If the imbalance is resolved, the downgrade is cancelled, if an operational fault is confirmed prior to the expiration of the deferral period or if the deferral period expires, then one host is downgraded.

Abstract: A method of delaying checkpointing in a virtual machine system. In one embodiment, the method includes the steps of examining a network frame to determine if it is a deferrable frame and if the frame is a deferrable frame, delaying a checkpoint associated with the frame. In another embodiment, the deferrable frame is one of a group comprising: an IP packet tagged with the ‘more fragments’ attribute; TCP data segments that lack the PSH flag and carry no flags other than ‘ACK’; and TCP segments that contain no data and carry only the ‘ACK’ flag; and any frame originating from or destined to a designated network address or port number. In still another embodiment, the method includes the step of concatenating the delays due to deferrable frames. In still yet another embodiment, the method further includes setting an upper limit to the amount of delay that can be generated.

Abstract: A method for determining a delay in a dynamic, event driven, checkpoint interval. In one embodiment, the method includes the steps of determining the number of network bits to be transferred; determining the target bit transfer rate; calculating the next cycle delay as the number of bits to be transferred divided by the target bit transfer rate. In another aspect, the invention relates to a method for delaying a checkpoint interval. In one embodiment, the method includes the steps of monitoring the transfer of a prior batch of network data and delaying a subsequent checkpoint until the transfer of a prior batch of network data has reached a certain predetermined level of completion. In another embodiment, the predetermined level of completion is 100%.

Abstract: In one aspect, the invention relates to a fault tolerant computing system. The system includes a primary virtual machine and a secondary virtual machine, wherein the primary and secondary virtual machines are in communication, wherein the primary virtual machine comprises a first checkpointing engine and a first network interface, wherein the secondary virtual machine comprises a second network interface, wherein the first checkpointing engine forwards a page of memory of the primary virtual machine to the second virtual machine such that the first checkpointing engine can checkpoint the page of memory without pausing the primary virtual machine.

Abstract: A fault tolerant computer system having two virtual machines (VMs), each running on a separate host device, is connected over a network to one or more I/O devices. The system operates to monitor the health of one or more operational characteristics associated with each VM, and in the event that the health of both virtual machines dictates that one or the other of the VMs should be downgraded, but the system is not able to determine which VM should be downgraded and there is an imbalance in a monitored system operational characteristic, the system can defer downgrading one VM for a selected period of time during which the operational characteristic that is in imbalance is monitored. If the imbalance is resolved, the downgrade is cancelled, if an operational fault is confirmed prior to the expiration of the deferral period or if the deferral period expires, then one host is downgraded.

Abstract: A method for determining a delay in a dynamic, event driven, checkpoint interval. In one embodiment, the method includes the steps of determining the number of network bits to be transferred; determining the target bit transfer rate; calculating the next cycle delay as the number of bits to be transferred divided by the target bit transfer rate. In another aspect, the invention relates to a method for delaying a checkpoint interval. In one embodiment, the method includes the steps of monitoring the transfer of a prior batch of network data and delaying a subsequent checkpoint until the transfer of a prior batch of network data has reached a certain predetermined level of completion. In another embodiment, the predetermined level of completion is 100%.

Abstract: In one aspect, the invention relates to a fault tolerant computing system. The system includes a primary virtual machine and a secondary virtual machine, wherein the primary and secondary virtual machines are in communication, wherein the primary virtual machine comprises a first checkpointing engine and a first network interface, wherein the secondary virtual machine comprises a second network interface, wherein the first checkpointing engine forwards a page of memory of the primary virtual machine to the second virtual machine such that the first checkpointing engine can checkpoint the page of memory without pausing the primary virtual machine.

Abstract: A method of delaying checkpointing in a virtual machine system. In one embodiment, the method includes the steps of examining a network frame to determine if it is a deferrable frame and if the frame is a deferrable frame, delaying a checkpoint associated with the frame. In another embodiment, the deferrable frame is one of a group comprising: an IP packet tagged with the ‘more fragments’ attribute; TCP data segments that lack the PSH flag and carry no flags other than ‘ACK’; and TCP segments that contain no data and carry only the ‘ACK’ flag; and any frame originating from or destined to a designated network address or port number. In still another embodiment, the method includes the step of concatenating the delays due to deferrable frames. In still yet another embodiment, the method further includes setting an upper limit to the amount of delay that can be generated.

Abstract: A computer system configured to provide fault tolerance includes a first host system and a second host system. The first host system is programmed to monitor a number of portions of memory of the first host system that have been modified by a guest running on the first host system and, upon determining that the number of portions exceeds a threshold level, determine that a checkpoint needs to be created. Upon determining that the checkpoint needs to be created, operation of the guest is paused and checkpoint data is generated. After generating the checkpoint data, operation of the guest is resumed while the checkpoint data is transmitted to the second host system.

Abstract: A symmetric multiprocessing fault-tolerant computer system controls memory access in a symmetric multiprocessing computer system. To do so, virtual page structures are created, where the virtual page structures reflect physical page access privileges to shared memory for processors in a symmetric multiprocessing computer system. Access to shared memory is controlled based on physical page access privileges reflected in the virtual paging structures to coordinate deterministic shared memory access between processors in the symmetric multiprocessing computer system. A symmetric multiprocessing fault-tolerant computer system may use duplication or continuous replay.

Abstract: A fault tolerant/fault resilient computer system includes a first coserver and a second coserver. The first coserver includes a first application environment (AE) processor and a first I/O subsystem processor on a first common motherboard. The second coserver includes a second AE processor and a second I/O subsystem processor on a second common motherboard.

Abstract: Operation of two asynchronous processors are synchronized with an I/O device by receiving, at a first processor having a first clocking system, data from an I/O device. The data is received at a first time associated with the first clocking system, and is forwarded from the first processor to a second processor having a second clocking system that is not synchronized with the first clocking system. The data is processed at the first processor at a second time corresponding to the first time in the first clocking system plus a time offset, and at the second processor at a third time corresponding to the first time in the second clocking system plus the time offset.

Abstract: A fault tolerant/fault resilient computer system includes at least two compute elements connected to at least one controller. Each compute element has clocks that operate asynchronously to clocks of the other compute elements. The compute elements operate in a first mode in which the compute elements each execute a first stream of instructions in emulated clock lockstep, and in a second mode in which the compute elements each execute a second stream of instructions in instruction lockstep. Each compute element may be a multi-processor compute element.

Abstract: A fault tolerant/fault resilient computer system includes at least two compute elements connected to at least one controller. Each compute element has clocks that operate asynchronously to clocks of the other compute elements. The compute elements operate in a first mode in which the compute elements each execute a first stream of instructions in emulated clock lockstep, and in a second mode in which the compute elements each execute a second stream of instructions in instruction lockstep. Each compute element may be a multi-processor compute element.

Abstract: A fault tolerant/fault resilient computer system includes at least two compute elements connected to at least one controller. Each compute element has clocks that operate asynchronously to clocks of the other compute elements. The compute elements operate in a first mode in which the compute elements each execute a first stream of instructions in emulated clock lockstep, and in a second mode in which the compute elements each execute a second stream of instructions in instruction lockstep. Each compute element may be a multi-processor compute element.

Abstract: Data transfer to computing elements is synchronized in a computer system that includes the computing elements and controllers that provide data from data sources to the computing elements. A request for data made by a computing element is intercepted and transmitted to the controllers. At least a first controller responds by transmitting requested data to the computing element and by indicating how a second controller will respond to the intercepted request.

Abstract: Synchronized execution is maintained by compute elements processing instruction streams in a computer system including the compute elements and a controller. Each compute element includes a clock that operates asynchronously with respect to clocks of the other compute elements. Each compute element processes instructions from an instruction stream and counts the instructions processed. Upon processing a quantum of instructions from the instruction stream, the compute element initiates a synchronization procedure and continues to process instructions from the instruction stream and to count instructions processed from the instruction stream. The compute element halts processing of instructions from the instruction stream after processing an unspecified number of instructions from the instruction stream in addition to the quantum of instructions. Upon halting processing, the compute element sends a synchronization request to the controller and waits for a synchronization reply.

Abstract: Data transfer to computing elements is synchronized in a computer system that includes the computing elements and controllers that provide data from data sources to the computing elements. A request for data made by a computing element is intercepted and transmitted to the controllers. At least a first controller responds by transmitting requested data to the computing element and by indicating how a second controller will respond to the intercepted request.

Abstract: The effects of I/O race conditions caused by asynchrony between processors concurrently executing the same software and I/O devices are eliminated by executing an application program and a first associated operating system with firs processors, and executing an I/O processing program and a second associated operating system with an I/O processor. Memory requests from the application program or the first associated operating system are processed with the first processors, and memory requests from the application program to memory addresses associated with I/O devices are trapped and transmitted to the I/O processor. The I/O processor then performs the trapped memory requests with the I/O processing program after waiting for the identical request to be received from each of the first processors to eliminate the effects of race conditions caused by asynchrony between processors concurrently executing the application program or the first associated operating system and I/O devices.

Abstract: In a first aspect, a method of synchronizing at least two computing elements that each have clocks that operate asynchronously of the clocks of the other computing elements includes selecting one or more signals, designated as meta time signals, from a set of signals produced by the computing elements, monitoring the computing elements to detect the production of a selected signal by one of the computing elements, waiting for the other computing elements to produce a selected signal, transmitting equally valued time updates to each of the computing elements, and updating the clocks of the computing elements based on the time updates.In a second aspect, fault resilient or fault tolerant computers are produced by designating a first processor as a computing element, designating a second processor as a controller, connecting the computing element and the controller to produce a modular pair, and connecting at least two modular pairs to produce a fault resilient or fault tolerant computer.