Abstract: A system for enhancing fault tolerances and security of a computing system having a system clock through monitoring the computing system for at least one of a series of security attacks and upon detection of security attacks, switching the system from the system clock to a secure clock.

Abstract: The present invention concerns a communication node accommodating terminals for various kinds of media, and more particularly the invention provides an intranode alternate route generation method and apparatus for generating an alternate route as needed within the node when a failure or congestion occurs in line control equipment in a line accommodating section of the node.

Abstract: A first embodiment of the present invention includes a decoder 320 and a detection circuit 330. The decoder 320 receives data at a packet rate. Each packet includes more than one word so that the packet rate is less than a word rate. The detector circuit 330 monitors a data valid signal from the decoder 320 and asserts an output signal (send idle) upon determination that the data valid signal changes values at a rate higher than the packet rate.

Abstract: A logic unit operable under the Byzantine algorithm for the architectural configuration of a composite assembly which tolerates an amount of F errors in simultaneous manner as to time and a plurality of inputs for in-reading of data into registers of a set of registers, and a plurality of outputs for out-reading of data from the registers, whereby each output is connectable with an input of a further logic unit, whereby the registers are coupled with the inputs and outputs in such a manner that each register is capable of being read-in and being capable of being read-out independently of the position of the logic unit within the assembly, by means of a position invariant, relative identification, as well as a computer unit with such a logic unit, as well as the fault-tolerant assembly of such logic/computer units, and a method of operating a fault tolerant assembly.

Abstract: A system and method for providing fault tolerant applications that are independent of the underlying operating system and hardware system and without the need for application-specific customization. The work units of an application to be made fault tolerant are registered, procedures of the application are defined by a sequence of work units to be executed, and input events and responses are defined. An active FT engine and a standby FT engine are provided to control execution of an active copy of the application and execution of the standby copy of the application, respectively. The FT engines allows the active copy and the standby copy of the application to be synchronized with respect to their internal state information in a lock-step execution of the work units in sequence.

Abstract: A sub-net operation with increased availability and reduced power consumption is achieved in a bus system with a plurality of stations (10, 11, 12) which are coupled to one another via a system of conductors (13, 14). Each of the stations includes a transceiver (21) and a control unit (30). The stations are switched from a quiescent state to a standby state in response to the reception of a first wake-up signal and selected stations are switched to a normal operating state upon reception of a second wake-up signal, whereby stations are selected.

Abstract: A multiprocessor system is disclosed that employs an apparatus and method for caging a redundant component to allow testing of the redundant component without interfering with normal system operation. In one embodiment the multiprocessor system includes at least two system controllers and a set of processing nodes interconnected by a network. The system controllers allocate and configure system resources, and the processing nodes each include a node interface that couple the nodes to the system controllers. The node interfaces can be individually and separately configured in a caged mode and an uncaged mode. In the uncaged mode, the node interface communicates information from either of the system controllers to other components in the processing node. In the caged mode, the node interface censors information from at least one of the system controllers.

Abstract: A novel virtual port method and apparatus for use in the communication between multiple nodes in a network system is disclosed. Particularly, the virtual port concept is implemented in a switching unit having a plurality of physical ports. According to the present invention, at least one virtual port can be defined by the user to represent a corresponding number of group of physical ports. In this case, a single virtual port identification can be used by the network manager to identify all the physical ports belonging to a trunking group. By using one virtual port identification address instead of a group of physical port addresses, a tremendous reduction in processing overhead in the network manager can be achieved.

Abstract: A system for recovering from certain types of system software startup problems employs a user-hidden secondary startup volume stored in the computer. During a normal startup procedure, if an error is detected which would normally result in a startup failure, the computer's startup routine branches to an alternate startup application stored in the secondary volume. This startup application boots the computer from a minimal operating system stored in the secondary volume. As a result, the user is not left with a non-functioning computer. As further features of the invention, the startup application can attempt to automatically fix the detected problem, or it can suggest possible steps to be taken by the user, in order to fix the problem that resulted in the need to use the alternate startup application.

Abstract: Failure rate cost assigning means 81 assigns a cost to each functional unit in functional unit set 1 in accordance with a failure rate thereof. Random cost assigning means 82 assigns a random cost to each functional unit. Duplication cost assigning means 83 assigns to each functional unit a cost in accordance with the number of connective relations that use the functional unit. Connective relations are stored in connective relation storage 5. As a result, the sum of the costs is stored in cost storage section 92. Constraint storage section 93 stores the constraints on connective relations of the functional units. Connective relation generating means 84 interprets the sum of the costs stored in cost storage section 92 as the cost of each functional unit.

Abstract: A memory device includes a memory array and a configurable decoder circuit operatively associated with the memory array and configurable to one of a first state or a second state. In the first state, the configurable decoder circuit is operative, responsive to receipt of an address associated with a portion, e.g., a block, of the memory array, to select the portion while producing a first status signal. In the second state, the configurable decoder circuit is operative, responsive to receipt of an address associated with the portion of the memory array, to prevent selection of the portion while producing a second status signal. The first status signal may indicate, for example, that the portion is valid, while the second status signal may indicate that the portion is invalid.

Abstract: A system and method for detecting connection of an external device, and for identifying the connected external device. The external device comprises: a first identification pin group consisting of one or more connector pins arranged in the longitudinal direction at one end of the connector; a second identification pin group consisting of more than one connector pins arranged in the longitudinal direction at the other end of the connector; and a control pin assigned for one pin on one end of the connector. In the external device, identification information is formed in accordance with a connection of the control pin and at least one pin among the second identification pin group, and a connection or disconnection of the control pin relative to each pin in the pin groups.

Abstract: A fault tolerant computer comprising plural operation controllers is provided, which can judge and separate a damaged element by using a double-redundant structure without using a triple or greater-redundant structure. The computer comprises two judgment sections corresponding to each operation controller in the double-redundant structure, and each judgment section compares an output from the operation controller connected to the present judgment section with an output from the operation controller connected to the other judgment section, wherein one judgment section receives a signal indicating a comparison result from the other judgment section, and collates this signal and a comparison result obtained in the present judgment section with reference to additional diagnosis information so as to judge whether the output from the operation controller connected to the present judgment section is correct.

Abstract: A method for eliminating races commences with the testing of an integrated circuit for races. If a clock signal which is produced by the integrated circuit is deemed to be a cause of races, at least one transistor region is clipped from an output driver of a clock gater which produces the clock signal. The clipping is performed by reconstructing at least one mask which is used to define the output driver during fabrication of the integrated circuit. In a similar fashion, a method for increasing the rise/fall time of clock edges in an integrated circuit commences with the identification of a clock signal with a clock edge having a poor rise/fall time. The rise/fall time of such a clock edge is increased by clipping at least one transistor region from an output driver of a clock gater which produces the clock signal. Once again, the clipping is performed by reconstructing at least one mask which is used to define the output driver during fabrication of the integrated circuit.

Abstract: A method and system for automatically providing termination to a SCSI I/O bus within a data processing system is disclosed. An inline terminator is provided for use within a data processing system. The inline terminator provides a connection between a first controller and an I/O bus utilizing a plurality of connection pins including a device removal detection pin. The inline terminator includes a terminator circuit and a control circuit coupled to the device removal detection pin to detect whether the controller and bus are connected. In one embodiment, the detection pin is a short ground pin on the SCSI bus that is not associated with a signal or differential signal pair. The terminator circuit is activated when the controller and bus are disconnected and deactivated otherwise to automatically terminate the I/O bus.

Abstract: A programmable analog I/O circuit for use in an industrial control system has a first mode of operation as an input circuit and a second mode of operation as an output circuit. In the first mode of operation, a device-side I/O terminal is adapted for receiving an analog input status signal from an analog input device. In the second mode of operation, the device-side I/O terminal is adapted for transmitting an analog output control signal to an analog output device. According to another aspect, a programmable I/O circuit that drives an output device in an industrial control system comprises a plurality of configurable gain stages and a plurality of programmable isolating links. The plurality of programmable isolating links are coupled to the plurality of configurable gain stages and are programmable to determine a series or parallel arrangement of the plurality of configurable gain stages.

Abstract: A method and apparatus for assuring data consistency in a data processing network including local and remote data storage controllers interconnected by independent communication paths. The remote storage controller or controllers normally act as a mirror for the local storage controller or controllers. If, for any reason, transfers over one of the independent communication paths is interrupted, transfers over all the independent communication paths to predefined devices in a group are suspended thereby assuring the consistency of the data at the remote storage controller or controllers. When the cause of the interruption has been corrected, the local storage controllers are able to transfer data modified since the suspension occurred to their corresponding remote storage controllers thereby to reestablish synchronism and consistency for the entire dataset.

Abstract: An array disk subsystem including a command selector for separating a signal from a host into a data item and a command, a data dividing unit for subdividing the data item, an ECC generator for producing an ECC for each of the obtained subdata items, a group of data disks for respectively storing thereon the subdata items and the ECCs, a command interpreting unit for interpreting the command, an I/O counter for counting I/O commands in the command, a backup processor for requesting a backup command based on count information of the I/O counter, and a backup unit responsive to the backup command for sequentially reading the subdata items and the ECCs from the data disks to record therein the subdata items and the ECCs.

Abstract: A bridge for a multi-processor system includes bus interfaces for connection to an I/O bus of a first processing set, an I/O bus of a second processing set, and a device bus. A bridge control mechanism is configured to provide geographic addressing for devices on the device bus and to be responsive to a request from a device on the device bus for direct access to a resource of a processing set to verify that an address supplied by the device falls within a correct geographic range. A different geographic address range can allocated to each of a plurality of device slots on the device bus. A different geographic address range can also be allocated to the processor set resources (e.g., processor set memory). An address decoding mechanism maintain geographic address mappings, and verifies geographic addresses for direct memory access. The geographic address mappings can be configured in random access memory of the bridge. A slot response register is associated with each slot on the device bus.

Abstract: A method of determining whether a requested parameter reconfiguration of a connected call in a switched digital communication network complies with system constraints is described. Bandwidth related parameters, in particular, are subject to reconfiguration after a call is provisioned in order to optimize utilization of network resources. The implementation of a bandwidth reconfiguration involves an assessment of bandwidth utilization by the logical or physical links routing the connected call so that the reconfigured bandwidth does not negatively impact on the connected call. Once the reconfigured parameter is determined to be acceptable the reconfiguration data is propagated to the relevant network elements.

Abstract: A network of microcontrollers for monitoring and diagnosing the environmental conditions of a computer is disclosed. The network of microcontrollers provides a management system by which computer users can accurately gauge the health of their computer. The network of microcontrollers provides users the ability to detect system fan speeds, internal temperatures and voltage levels. The invention is designed to not only be resilient to faults, but also allows for the system maintenance, modification, and growth—without downtime. Additionally, the present invention allows users to replace failed components, and add new functionality, such as new network interfaces, disk interface cards and storage, without impacting existing users. One of the primary roles of the present invention is to manage the environment without outside involvement. This self-management allows the system to continue to operate even though components have failed.

Abstract: A register associated with the architected logic queue of a memory-coherent device within a multiprocessor system contains a flag set whenever an architected operation—one which might affect the storage hierarchy as perceived by other devices within the system—is posted in the snoop queue of a remote snooping device. The flag remains set and is reset only when a synchronization instruction (such as the “sync” instruction supported by the PowerPC™ family of devices) is received from a local processor. The state of the flag thus provides historical information regarding architected operations which may be pending in other devices within the system after being snooped from the system bus. This historical information is utilized to determine whether a synchronization operation should be presented on the system bus, allowing unnecessary synchronization operations to be filtered and additional system bus cycles made available for other purposes.

Abstract: A method and corresponding apparatus provide a backup drive in a computer system having a CPU, a memory, an operating system executing between the CPU and the memory, and a first and second storage device. In accordance with one aspect of the invention, the method includes the steps of designating the first storage device as a primary drive and designating the second storage device as a backup drive. It further includes the step of making the backup drive appear invisible to the operating system. Preferably, the invention accomplishes this step by writing a specified value to the device identification location (address 01FE and 01FF of the boot sector). Thereafter, the invention writes data from the primary drive to the backup drive on a periodic basis, using direct basic input/output service (BIOS) calls. It will be appreciated that, since the drive is “invisible” to the operating system, that direct BIOS calls are required in order to write data to, or read data from, the backup drive.

Abstract: A computer system using a common Basic input/output system for operation with different expansion adapters which comprises a setting block for setting information of whether expansion adapters are mounted in an expansion block, and a controller for determining whether the expansion adapters are set in the expansion block through signals from the setting block in order to disable execution of a Basic input/output system routine of the expansion adapter which is not set, and enable execution of the Basic input/output system routine related to the expansion adapter which is set.

Abstract: A bridge for a multi-processor system provides interfaces to an I/O bus of a first processing set, an I/O bus of a second processing set and a device bus. A bridge control mechanism arbitrates between the first and the second processing sets for access to each others I/O bus and to the device bus in a first, split, mode, and monitors lockstep operation of the first and second processing sets in a second, combined, mode. On detecting a lockstep error in the combined mode, the bridge transfers to an error mode. The bridge control mechanism buffers write accesses in a posted write buffer in the error mode pending resolution of the error.

Abstract: One embodiment of the present invention provides a computer system that allows a processor module to be removed while the computer system is operating. This computer system includes a connector, for connecting the processor module to the computer system. It also includes a power switch coupled between a power source and the connector, for selectively removing power from the processor module in the connector while power is maintained to other components of the computer system. The computer system additionally includes a mechanism that modifies the operating system so that the computer system will continue to function without the processor module. Thus, this embodiment of the present invention allows the processor module to removed, replaced and reinitialized without shutting down the computer system.

Abstract: A system for switching data between the terminals of a communication network includes a memory and management device storing a model of the network and performing management of this model, the model being constituted by a set of objects which are representative of the elements of the network at a given moment and which have properties defining the characteristics of these elements at that moment, a device manipulating the objects adapted to create new objects, modify existing objects, or delete existing objects from the model, and an interface between the memory and management device and the hardware elements of the network.

Abstract: A system and method is disclosed for dynamically restoring communications within a network following an outage comprising a database containing the configuration of switching elements within the network and a plurality of instructions resident on a memory device for operating a control computer, wherein the plurality of instructions includes a code segment for receiving network parameters following the outage, a code segment for selecting restoration switching elements from the database based upon the network parameters, a code segment for generating connect and disconnect commands for the restoration switching elements, and a code segment for sending the connect and disconnect commands to the restoration switching elements, thereby restoring communications within the network.

Abstract: A high availability computer system and methodology including a backplane, having at least one backplane communication bus and a diagnostic bus, a plurality of motherboards, each interfacing to the diagnostic bus. Each motherboard also includes a memory system including main memory distributed among the plurality of motherboards and a memory controller module for accessing said main memory interfacing to said motherboard communication bus. Each motherboard also includes at least one daughterboard, detachably connected to thereto. The motherboard further includes a backplane diagnostic bus interface mechanism interfacing each of the motherboards to the backplane diagnostic bus; a microcontroller for processing information and providing outputs and a test bus controller mechanism including registers therein.

Abstract: Disclosed is a system for communication among a device, a first processor, and a second processor. One of a first data path and second data path is configured. The first data path comprises a bus, such as a local PCI bus, a first remote bridge, and a first local bridge. The bridges may be comprised of PCI to PCI bridges. After configuring the first data path, the device communicates to the first processor by communicating data through the bus to the first remote bridge. The first remote bridge transmits the data to the first local bridge and the first local bridge transmits the data to the first processor. The second data path comprises the bus, a second remote bridge, and a second local bridge. After configuring the second data path, the device communicates to the second processor by communicating data through the bus to the second remote bridge. The second remote bridge transmits the data to the second local bridge and the second local bridge transmits the data to the second processor.

Abstract: A computing system in the form of a cluster of a number of multiprocessing nodes maintains, in a fault tolerant manner, a distribution of configuration data for each of the nodes so that each node has a database containing the configuration data associated with that node. The database, and therefore, the configuration data it contains, associated with any one node is substantially identical to that of any other node. A process running on one of the nodes is responsible for receiving a requests that require modification of the configuration data. Effecting changes to the configuration data, and therefore the distributed databases, includes the steps of first writing the requested change to a master audit log, distributing the change request to all nodes, receiving back from the nodes acknowledgement of the change request being effected at the acknowledging node, and then writing again to the master audit log that the change has been effected throughout the system.

Abstract: A method and corresponding apparatus provide a backup drive in a computer system having a CPU, a memory, an operating system executing between the CPU and the memory, and a first and second storage device. In accordance with one aspect of the invention, the method includes the steps of designating the first storage device as a primary drive and designating the second storage device as a backup drive. It further includes the step of making the backup drive appear invisible to the operating system. Preferably, the invention accomplishes this step by writing a specified value to the device identification location (address 01FE and 01FF of the boot sector). Thereafter, the invention writes data from the primary drive to the backup drive on a periodic basis, using direct basic input/output service (BIOS) calls. It will be appreciated that, since the drive is "invisible" to the operating system, that direct BIOS calls are required in order to write data to, or read data from, the backup drive.

Abstract: A method and apparatus for determining and recovering from a USB micro-controller busy condition, wherein a toggle variable indicative of whether the USB micro-controller is in the busy condition or not is stored in a memory, and a counter is incremented if the toggle variable is set. The counter is checked to determine if the counter has reached a predetermined count, and if so data lines of the USB micro-controller are disconnected from a USB bus coupled to the USB micro-controller for a predetermined amount of time to cause a USB host computer coupled to the USB micro-controller to re-initialize the USB micro-controller. The memory contains a data structure including fields for storing the toggle variable, and a count indicative of how many times the toggle variable has been set for implementing the counter.

Abstract: A method and apparatus for maintaining automatic termination of a bus in the event of failure of a host computer are disclosed. The method includes the steps of (a) powering a first termination control circuit and a first terminating circuit of the first bus controller with the bus; (b) generating a first control signal (1) that is of an enable state if the first bus controller is located at an end of the bus, and (2) that is of a disable state if the first bus controller is located in a middle portion of the bus; (c) coupling the first terminating circuit to the bus if the first control signal is of the enable state; and (d) decoupling the first terminating circuit from the bus if the first control signal is of the disable state.

Abstract: Methods, systems and computer program products are provided for error recovery in a network having a first application associated with a first endpoint node and a second application associated with a second endpoint node. These methods, systems and computer program products non-disruptively switch the first application associated with the first endpoint node to a third endpoint node arbitrarily selected from existing endpoint nodes when the first endpoint node is no longer available to the second application associated with the second endpoint node. The first application is provided on the third endpoint node in substantially the same state as the first application existed on the first endpoint node prior to the unavailability of the first endpoint node. The present invention is preferably carried out where the endpoint nodes are VTAM facilities. Also, the first and third endpoint nodes are VTAM facilities in the same SYSPLEX.

Abstract: A method and system for autoconfiguring redundant arrays of memory storage devices contained within receptacles having one or more slots containing hardware sufficient to accept and electrically communicate with such memory storage devices. The capacities of the memory storage device receptacles for accepting memory storage devices are determined, and used to define an initial positioning of devices in at least one memory storage device receptacle. One or more asymmetrical groupings of memory storage devices is defined to permit an equation of electrically detected relative positions of the memory storage devices with actual physical positions within the receptacle. Thereafter, additional devices are added into the receptacles such that the ability to equate electrically detected relative positions of the devices with physical positions is preserved.

Abstract: In an external storage, an I/O process continues without any intervention of a user of a host system upon failure of a controller. When a failure occurs in a controller, a host system recognizes the failure of the controller. Before the failure is notified to the user and application program to stop the job, the substitute controller reads the SCSI-ID possessed by an SCSI port of the failed controller from a shared memory, registers the SCSI-ID of the SCSI port to the SCSI port associated with the substitute controller, and erases by a port address resetting facility of the substitute controller the SCSI-ID possessed by an SCSI port of the failed controller. Due to such provision, since the SCSI-ID specified at issuance of an I/O request is transferred between the controllers, the user or the host system need not alter the I/O request issuing route.

Abstract: The start-up of a computer system takes place rapidly using a computer system having a recovery system which collects data for the recovery in parallel fashion in a common memory so that the data can be transferred to peripheral units of the computer system. The collection begins with collecting the data into a local memory of a processor and then transferring the data to the common memory before transferring the data to the peripheral units.

Abstract: An alarm detect unit (a path switching apparatus) for selecting an active path comprises a path-alarm detect circuit and a guard timer for a working path as well as a path-alarm detect circuit and a guard timer for a protection path. When an alarm is detected on the active path, alarm information, that is, information on the generation of the alarm, is delayed by a predetermined time by the guard timer of the working or protection path that serves as the active path.By the same token, when an alarm is detected on a standby path, alarm information, that is, information on the recovery of the alarm, is delayed by a predetermined time by the guard timer of the working or protection path that serves as the standby path. Either the working or protection path is then selected as the active path in accordance with pieces of alarm information output by the two guard timers which indicate the line-failure-occurrence states of the active and standby paths.

Abstract: Controller triple modular redundancy is substantially achieved and reliability improved in a system having duplicate controllers that serve peripheral units. Both controllers detect suspected faults in itself and in the other controller. A peripheral unit that suspects a faulty active controller requests a switch of the active controller. A voting circuit processes votes from the controllers and the active controller switch signal from the peripheral units to select the active controller. The signaling paths between the controllers used to convey votes and active controller information are duplicated. The signals on these signaling paths convey information by using oscillating signals of different frequencies.

Abstract: This invention discloses a processor with a plurality of execution units integrated into a chip. The execution unit has an initial failure signal output device which provides an initial failure signal when there is an initial failure in its own execution unit. Further, the execution unit has an operating failure detection device which detects and provides an operating failure signal when there is a passage-of-time failure in its own execution unit. A count device for counting the number of normally operable execution units is provided which receives initial failure signals or passage-of-time failures, as fault information, from faulty execution units if any and which finds, based on the fault information, the number of normally operable execution units. An operable execution unit selection allocation device is provided which allocates, according to the fault information, instructions, only to normally operable execution units.

Abstract: A computer system includes a main processor and a supervisory processor. The main processor provides status signals when a fault condition exists and responds to control signals for fault recovery. The supervisory processor instantiates objects from a fault class in response to the status signals. Objects are polymorphic in that each object has substantially the same methods available at its interface though each object corresponds to a different fault. Methods accomplish fault recovery by providing the control signals. System operation exhibits fewer errors by the supervisory processor and system expansion is more easily accommodated with greater reuse of proven program code than possible with prior supervisory processor software.

Abstract: A computer system has a connector and a circuit card that is inserted in the connector. A mechanism that is associated with the connector and the card has a state for indicating when the card is secured to the connector. A controller of the computer system is configured to monitor the state and provide an indication when the state changes. A processor of the computer system is configured to determine when software of the computer system is interacting with the connector and based on the determining and the indication, regulating interaction of the computer system with the card.

Abstract: The invention relates to a magazine-related bus arrangement, wherein the magazine includes a backplane (1a) having electric contact fields and means for holding a number of circuit boards having edge-related electric contact surfaces in electric coaction with respective contact fields, adapted to enable the exchange of information-carrying signals between one or more first circuit arrays (102) belonging to a first circuit board (10), and one or more other circuit arrays (112) belonging to one or more second circuit boards (11). The logical number of bus-related conductors (m+n) with reserve conductors (n) slightly exceeds the numbers (m) necessarily required for a chosen signalling system and a non-error-tolerant signal exchange.

Abstract: A decoding apparatus and a decoding method are capable of minimizing degradation of the quality of images and sounds when a synchronous signal error occurs. The decoding apparatus includes a frame counter for receiving a bit stream, a synchronous pattern detector, a data error check unit, a synchronous detector, and a frame error determination unit. A synchronous detection error occurrence signal produced by the synchronous detector is not output to an external error processing circuit but is directly transmitted to the frame error determination unit. Even when the timing of an output synchronous pattern detection signal from the synchronous pattern detector and the timing of an output frame position signal from the frame counter do not match each other and a frame synchronous abnormality occurs, if the data itself is normal then decoding processing is executed without performing any error correction processing.

Abstract: In a redundant server network system, failover services for a failed server are provided by a survivor server belonging to a common failover group. At startup of a local server process running on the survivor server, a context is created for the local server and for each remote server belonging to the same failover group as the local server. At startup the context of the local server is also activated. The local server process is configured to operate on and make decisions based upon activated contexts. Each context includes server specific configuration and control information. When the survivor server must provide failover services for a failed server belonging to its same failover group, the context corresponding to the failed remote server is activated.

Abstract: A bus controller for a computer system. The controller comprises a monitor for monitoring request signals and response signals between a first component and a second component each connected to a bus of the computer system; and a terminator controlled by the monitor to terminate a request from one of the first and second components if a response to the request has not issued within a predetermined period of time.

Abstract: A cluster implements a virtual disk system that provides each node of the cluster access to each storage device of the cluster. The virtual disk system provides high availability such that a storage device may be accessed and data access requests are reliably completed even in the presence of a failure. To ensure consistent mapping and file permission data among the nodes, data are stored in a highly available cluster database. Because the cluster database provides consistent data to the nodes even in the presence of a failure, each node will have consistent mapping and file permission data. A cluster transport interface is provided that establishes links between the nodes and manages the links. Messages received by the cluster transports interface are conveyed to the destination node via one or more links. The configuration of a cluster may be modified during operation.