Software fault tolerant computer system

• US 6,625,751 B1
• Filed: 03/14/2000
• Issued: 09/23/2003
• Est. Priority Date: 08/11/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Starovic, Gradimir, Mayhead, Martin P
• Primary Examiner(s): BADERMAN, SCOTT T
• Application Number:
  US09/525,280
• Time in Patent Office: 1,288 Days
• Field of Search: 714/11, 714/10, 714/12, 714/13
• US Class Current: 714/11
• CPC Class Codes: G06F 11/1484 involving virtual machines
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups
• CPC Class Codes: G06F 2201/815 Virtual

Abstract

A software fault tolerant computer system includes a primary virtual machine and a secondary virtual machine. The secondary virtual machine is operable to replicate the primary virtual machine by replicating operations performed on the primary virtual machine. The primary and the secondary virtual machines are further operable to test for equivalent operation of the primary and secondary virtual machines at predetermined stages of operation. This provides software fault tolerance wherein both a unit of replication and a component that implements the fault tolerance mechanisms is a virtual machine (VM). Since a VM as used by the invention has full knowledge of the semantics of application-level code, fault tolerance mechanisms can be provided by the VMs without requiring any increase in application complexity. Co-ordination of replicated states and computations is achieved with characteristics of both active and passive replication.

Claims

1. A fault tolerant computer system comprising a primary virtual machine and a secondary virtual machine, wherein the secondary virtual machine is operable to replicate operations of the primary virtual machine, wherein the primary and the secondary virtual machines are further operable mutually to provide fault tolerance, and wherein a test for liveliness is performed at an epoch boundary, the epoch boundary forming a boundary between sections of code executed by the virtual machines.

2. The fault tolerant computer system of claim 1, wherein the primary and the secondary virtual machines are operable to test for equivalent operation of each other at predetermined stages of operation mutually to provide fault tolerance.

3. The fault tolerant computer system of claim 1, comprising a first processing engine on which the primary virtual machine is operated and a second processing engine on which the secondary virtual machine is operated.

4. The fault tolerant computer system of claim 1, wherein each of the primary and secondary virtual machines is operable to send a heartbeat message to the other of the primary and secondary virtual machines at intervals.

5. The fault tolerant computer system of claim 4, wherein a heartbeat message indicates that virtual machine which sends the heartbeat message is alive, and additionally includes status information.

6. The fault tolerant computer system of claim 4, wherein a test for equivalent operation is performed following receipt of a heartbeat message.

7. The fault tolerant computer system of claim 1, wherein a test for liveliness is performed in response to an input action.

8. The fault tolerant computer system of claim 1, wherein a virtual machine which is found to be in a fault state is terminated.

9. The fault tolerant computer system of claim 1, wherein the primary virtual machine is operable to initiate a new secondary virtual machine where an existing secondary virtual machine is found to be in a fault state.

10. The fault tolerant computer system of claim 1, wherein the secondary virtual machine is operable to be promoted to become a new primary virtual machine when it is found that the old primary virtual machine is faulty.

11. The fault tolerant computer system of claim 1, comprising at least one further secondary virtual machine.

12. The fault tolerant computer system of claim 1, wherein each virtual machine comprises a Java virtual machine.

13. A computer program product operable when run on a computer to provide a virtual machine for a redundant fault tolerant virtual machine architecture including a secondary virtual machine, wherein the secondary virtual machine is operable to form a replica of a primary virtual machine by replicating operations performed on the primary virtual machines, wherein the primary virtual machine is further operable to test for equivalent operation of the secondary virtual machine at predetermined stages of operation, and wherein a test for liveliness is performed at an epoch boundary, the epoch boundary forming a boundary between sections of code executed by the virtual machines.

14. The computer program product of claim 13, wherein each of the primary and secondary virtual machines is operable to issue a heartbeat message at intervals to indicate that it is alive.

15. The computer program product of claim 14, wherein each of the primary and secondary virtual machines is operable to perform a test for equivalent operation following receipt of a heartbeat message.

16. The computer program product of claim 15, wherein the test for liveliness is performed in response to an input action.

17. The computer program product of claim 13, wherein the primary virtual machine is operable to cause the termination of another virtual machine that is found to be in a fault state.

18. The computer program product of claim 13, wherein the primary virtual machine is operable to initiate a new secondary virtual machine where an existing secondary virtual machine is found to be in a fault state.

19. The computer program product of claim 13, wherein the secondary virtual machine can be promoted to become a new primary virtual machine when it is found that an old primary virtual machine is faulty.

20. The computer program product of claim 13, wherein each virtual machine comprises a Java virtual machine.

21. The computer program product of claim 13, comprising a storage medium that stores computer program code implementing the virtual machine.

22. The computer program product of claim 14, comprising a data transmission medium that transmits computer program code implementing the virtual machine.

23. A virtual machine for a redundant fault tolerant virtual machine architecture including another virtual machine, wherein the virtual machine comprises means for forming a replica of the other virtual machine by replicating operations performed on the other virtual machine and means for testing for equivalent operation of the other virtual machine at predetermined stages of operation, and wherein a test for liveliness is performed at an epoch boundary the epoch boundary forming a boundary between sections of code executed by the virtual machines.

24. A method of providing software fault tolerance comprising the provision of replicated virtual machines including at least a primary and a secondary virtual machine, wherein the secondary virtual machine replicates operations performed on the primary virtual machine, and the primary and the secondary virtual machines co-operate so as mutually to provide fault tolerance, the method further comprising performing a test for liveliness at an epoch boundary, the epoch boundary forming a boundary between sections of code executed by the virtual machines.

25. The method of claim 24, wherein the primary and the secondary virtual machines test for equivalent operation of each other at predetermined stages of operation mutually to provide fault tolerance.

26. The method of claim 24, wherein the primary virtual machine operates on a first processing engine and the secondary virtual machine operates on a second processing engine.

27. The method of claim 24, wherein each of the primary and secondary virtual machines sends a heartbeat message to the other of the primary and secondary virtual machines at intervals.

28. The method of claim 24, wherein a heartbeat message indicates that virtual machine which sends the heartbeat message is alive, and additionally includes status information.

29. The method of claim 27, wherein a test for equivalent operation is performed following receipt of a heartbeat message.

30. The method of claim 24, wherein a test for liveliness is performed in response to an input action.

31. The method of claim 24, wherein a virtual machine which is found to be in a fault state is terminated.

32. The method of claim 24, wherein the primary virtual machine initiates a new secondary virtual machine where an existing secondary virtual machine is found to be in a fault state.

33. The method of claim 24, wherein the secondary virtual machine is promoted to become a new primary virtual machine when it is found that an old primary virtual machine is faulty.

34. The method of claim 24, wherein at least one further secondary virtual machine replicates the primary virtual machine.

35. The method of claim 24, wherein each virtual machine comprises a Java virtual machine.

36. A fault tolerant computer system comprising a primary virtual machine and a secondary virtual machine, wherein the secondary virtual machine is operable to replicate operations of the primary virtual machine, wherein the primary and the secondary virtual machines are further operable mutually to provide fault tolerance, wherein each of the primary and secondary virtual machines is operable to send a heartbeat message to the other of the primary and secondary virtual machines at intervals, and wherein a test for equivalent operation is performed following receipt of a heartbeat message.

37. A computer program product operable when run on a computer to provide a virtual machine for a redundant fault tolerant virtual machine architecture including a secondary virtual machine, wherein the secondary virtual machine is operable to form a replica of a primary virtual machine by replicating operations performed on the primary virtual machine, wherein the primary virtual machine is further operable to test for equivalent operation of the secondary virtual machine at predetermined stages of operation, wherein each of the primary and secondary virtual machines is operable to issue a heartbeat message at intervals to indicate that it is alive, and wherein each of the primary and secondary virtual machines is operable to perform a test for equivalent operation following receipt of a heartbeat message.

38. A method of providing software fault tolerance comprising the provision of replicated virtual machines including at least a primary and a secondary virtual machine, wherein the secondary virtual machine replicates operations performed on the primary virtual machine, and the primary and the secondary virtual machines co-operate so as mutually to provide fault tolerance, wherein each of the primary and secondary virtual machines sends a heartbeat message to the other of the primary and secondary virtual machines at intervals, and wherein a test for equivalent operation is performed following receipt of a heartbeat message.