Virtual Machine Hot-Swap for Software Failure Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face challenges in minimizing downtime due to software failures, as existing fault tolerance technologies like VMware® Fault Tolerance are only capable of protecting against hardware failures and not software failures, leading to potential extended service interruptions.
Innovation Solution
Implementing a hot-swapping mechanism between primary and stand-by virtual machines on the same host processing system, where the operational status of both machines is monitored, and upon detection of a software failure, the stand-by virtual machine is seamlessly swapped to become the primary, with the failed virtual machine being restarted, ensuring minimal downtime and preventing software bugs from affecting the stand-by server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VMware Fault Tolerance is used to protect against hardware failure, then service availability is improved, but the system cannot protect against software failures leading to extended downtime
Solution Approach 1:
The system segments the virtual machine protection into two distinct modes: hardware fault tolerance using lockstep execution, and software failure protection using hot-swappable standby instances. This segmentation allows each mechanism to specialize in its appropriate failure domain, resolving the contradiction by providing comprehensive protection across both hardware and software failure scenarios.
Solution Approach 2:
The system performs preliminary actions by maintaining a standby virtual machine instance that is pre-configured and ready before software failure occurs. The standby instance is kept synchronized with the primary through configuration management, enabling immediate switchover upon detecting software failure, thus eliminating downtime while maintaining reliability.
2Use of energy by moving object
If a standby virtual machine is maintained in powered off state to protect against hardware failure, then resource consumption is reduced, but service interruption occurs during software failure
Solution Approach 1:
The system dynamically adjusts the operational state of the standby virtual machine based on the type of protection needed. For hardware failure protection, the standby remains powered off to conserve energy. For software failure protection, the system可以快速 activate the standby instance, transitioning from a low-power state to an operational state only when needed, thus balancing energy consumption with rapid response capability.
3Reliability
If the stand-by virtual machine executes identical instructions to the primary, then hardware failure protection is achieved, but software bugs affect both machines simultaneously
Solution Approach 1:
The system extracts the software execution component from the fault tolerance mechanism. Instead of having the standby virtual machine execute identical instructions (which propagates software bugs), the standby instance is kept in a powered-off state with its configuration synchronized to the primary. This extraction allows the standby to provide software failure protection through configuration inheritance without being vulnerable to the same software bugs, while still maintaining hardware failure protection capabilities.
Data Source
AI summary
Methods and systems to limit the duration of a service interruption caused by a failed middleware application server are disclosed. One example method and system includes monitoring the operational status of a first virtual machine operating as a primary server and the operational status of a second virtual machine operating as a stand-by server and, based on the monitored operational status of the first and second virtual machines, performing a hot-swap to cause the second virtual machine to operate as the primary server and the first virtual machine to operate as the stand-by server. The first and second virtual machines are implemented on a same host processing system. After the hot-swap, the first virtual machine is restarted. In some examples, the first virtual machine and the second virtual machine are implemented on a same host processing system. Performing the hot-swap can include causing the first virtual machine to be uncoupled from a network and causing the second virtual machine to be coupled to the network. In some examples, the method also includes causing copy of a first file system used by the primary server to be stored as a second file system for use by the stand-by server.