High reliability fault tolerant computer architecture

A method of performing CPU node failover in a fault tolerant computer system having a plurality of CPU nodes, each CPU node comprising a processor and a memory, wherein one of the CPU nodes is designated a standby CPU node and the remainder are designated as active CPU nodes, at least two IO domains, wherein at least one of the IO domains is designated an active IO domain performing communication functions for the active CPU nodes;

• and a switching fabric connecting each CPU node to each IO domain, the method comprising the steps of:
• establishing a DMA datapath between the memory of an active but failing CPU node and the memory of the standby CPU node;
• transferring memory contents through the DMA datapath from the memory of an active but failing CPU node and the memory of the standby CPU node;
• tracking, by the active but failing CPU node, memory addresses in the active but failing CPU node to which DMA access occurs;
• halting access to memory on the active but failing CPU node and copying any memory data which has been accessed since DMA was begun;
• copying the state of the processor in the active but failing CPU node to the standby CPU node;
• swapping all resource mapping from the active but failing CPU node to the standby CPU node;
• and
• allowing previously designated standby CPU node to be the new active CPU node.

A method of performing IO domain failover in a fault tolerant computer system having a plurality of CPU nodes, each CPU node comprising:

• a processor and a memory, wherein one of the CPU nodes is designated a standby CPU node and the remainder are designated as active CPU nodes;
• at least two IO domains, wherein at least one of the IO domains is designated an active IO domain performing communication functions for the active CPU nodes;
• and a switching fabric connecting each CPU node to each IO domain, the method comprising the steps of:
• enabling a failure trigger for each switching fabric control component in each IO domain, wherein the failure trigger comprises link-down errors, uncorrectable and fatal errors, and software triggers;
• and
• upon failure trigger occurring, stopping drivers using the failing IO domain.

A fault tolerant computer system comprising:

• a plurality of CPU nodes, each CPU node comprising a processor and a memory, wherein one of the CPU nodes is designated a standby CPU node and the remainder are designated as active CPU nodes;
• at least two IO domains, wherein at least one of the IO domains is designated an active IO domain performing communication functions for the active CPU nodes;
• and
• a switching fabric connecting each CPU node to each IO domain,
• wherein if one of a failure, a beginning of a failure, and a predicted failure occurs in an active IO domain, termed the failing active IO domain, the communication functions performed by the failing active IO domain are transferred to the other IO domain.