Database Automatic Failover State Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in preventing divergence between primary and standby databases during automatic failover, which can result in data loss and system instability, particularly when the primary database ceases processing transactions due to the absence of a quorum.
Innovation Solution
An automatic failover configuration that includes a primary database, a standby database, and an observer, where the observer ensures that the primary database continues to process transactions even when both the observer and the standby are absent, as long as they became absent sequentially, using a state machine to manage state transitions and prevent divergence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the primary database ceases processing transactions to prevent divergence when standby and observer are absent, then data integrity is maintained, but system availability and productivity deteriorate
Solution Approach 1:
The system changes the operational parameter of the primary database from 'synchronized mode' to 'unsynchronized mode' when both standby and observer are absent. This parameter change allows the primary to continue processing transactions without maintaining strict synchronization, thus resolving the contradiction between data integrity and transaction continuity.
Solution Approach 2:
The system dynamically adjusts the synchronization behavior of the primary database based on the availability of standby and observer. When both are present, synchronized processing occurs; when both are absent, unsynchronized processing is enabled. This dynamic adaptation resolves the contradiction by allowing the system to optimize for data integrity when possible and for productivity when necessary.
2Productivity
If the primary database continues processing transactions without quorum, then system availability is improved, but risk of divergence and data loss increases
Solution Approach 1:
The observer acts as an intermediary that detects when both standby and observer are absent, and triggers the state change to unsynchronized mode. This intermediary mechanism allows the primary to continue processing safely by having a dedicated component monitor the conditions and authorize the relaxed synchronization mode, thus resolving the contradiction between availability and consistency.
Solution Approach 2:
The system performs a preliminary check of standby and observer availability before allowing unsynchronized processing. This preliminary action ensures that the primary only continues processing when it is safe to do so (i.e., when both standby and observer are genuinely absent), preventing unnecessary divergence while maintaining availability when appropriate.
3Reliability
If strict synchronization is maintained between primary and standby, then data integrity is ensured, but system complexity and processing overhead increase
Solution Approach 1:
The system segments the synchronization requirement into two distinct modes: synchronized mode (when standby and observer are present) and unsynchronized mode (when both are absent). This segmentation allows the system to apply appropriate complexity levels for each scenario, reducing overall system complexity by allowing simplified operation under specific conditions while maintaining strict integrity when possible.
Data Source
AI summary
Techniques used in an automatic failover configuration having a primary database system, a standby database system, and an observer for preventing divergence among the primary and standby database systems while increasing the availability of the primary database system. In the automatic failover configuration, the primary database system remains available even in the absence of both the standby and the observer as long as the standby and the observer become absent sequentially. The failover configuration further permits automatic failover only when the observer is present and the standby and the primary are synchronized and inhibits state changes during failover. The database systems and the observer have copies of failover configuration state and the techniques include techniques for propagating the most recent version of the state among the databases and the observer and techniques for using carefully-ordered writes to ensure that state changes are propagated in a fashion which prevents divergence.