Increasingly, cloud systems host IT services for critical domains such as public health and electric power. Such cloud systems need to be qualified and validated in accordance with compliance policies or government regulations. Configurations of such qualified cloud systems, including VM placement and software deployment, are limited to a small set of configurations which passed the qualification and validation process. So, on practical qualified cloud systems, on-demand VM migration or replication is not allowed. We address the problem of optimally scheduling physical machine maintenance on qualified cloud systems where VM placement cannot change dynamically. Particularly, we try to minimize the number of maintenance waves, and hence, minimize the qualified cloud systems' exposure to loss of high availability. Moreover, we study how the initial placement of service component replicas can help optimize the maintenance schedule while minimize the hardware cost, which is much higher on qualified cloud systems than regular ones. Evaluations in simulations and our real-world qualified cloud system demonstrate the effectiveness of our algorithms and justify our algorithm selection in the real qualified system. In particular, our approach eliminated impacts on service workload and availability during maintenance, while simultaneously largely reduced maintenance time.

We describe disaster protection and recovery of cloud-hosted enterprise applications both at the cloud infrastructure level and at the application level. We explore scenarios which favor one option over the other, and scenarios where a combination of both are required for effective and end-to-end protection. Through case studies grounded in the experience of implementing disaster recovery for IBM's Cloud Managed Services (CMS) platform, we highlight the complexities of protecting enterprise applications on the cloud. For recovery planning and execution, we present a scheduling algorithm that recovers machines hosted on cloud by taking into account application-level logical dependencies and the business criticalities of the applications.

In this paper, we present a scalable parallel virtual machine planning and fail over method that enables high availability at a VM level in a data center. The solution is implemented and used in IBM's CMS enterprise private cloud as a high availability feature for efficient fail over in large data centers with a large number of servers, VMs, and a large number of disks. The introduced restart system enables dynamic and at-fail over-time planning and execution, and keeps the recovery time within limits of service level agreement (SLA) allowed time budget. The initial serial fail over time is reduced by a factor of up to 11 for parallel implementation, and by a factor of up to 44 for parallel fail over - parallel storage mapping implementation. As part of our future work, we plan to explore the applicability of this planning and fail over solution for Disaster Recovery.

The ability to recover from disasters is an important requirement for many enterprises. With enterprise-class workloads increasingly hosted on the cloud, cloud customers have come to expect disaster recovery (DR) as a necessary feature from cloud platforms. This paper identifies key challenges in providing DR as a service on enterprise cloud platforms, and portrays DR solutions for a managed cloud platform. In particular, we present the reference architecture for DR solutions, and describe our practical experiences in providing a portfolio of DR solutions for the cloud platform. The solutions cover diverse target recovery sites, such as an equivalent cloud site, a dedicated recovery site, and a customer-owned site. From the experiences, we provide insights into and lessons on implementing DR for enterprise-class clouds.

The cost and operational complexity of traditional High Availability solutions has limited their widespread adoption. Virtualization allows availability properties to be associated with the system architecture, rather than depending on the intrinsic reliability of components. This paper introduces an extensible grammar that classifies the states and transitions of virtual machine images. From this grammar, rules for recovery and High Availability can be created which define how virtualization allows for simplified fault tolerance, making HAVENs accessible to the mainstream user.

This paper addresses the general area of computer architectures for safety-critical real time applications. The maximum acceptable probability of failure for these applications ranges from about 10/sup /spl minus/4/ to 10/sup /spl minus/10/ per hour depending on whether it is a military or civil application. Typical examples include commercial and military aircraft fly-by-wire, full authority engine control, satellite and launch vehicle control, ground transport vehicles, etc. Realtime response requirements for these applications are also very demanding, with correct control inputs required every 10 to 100 ms, depending on the application. These dual goals of ultrahigh reliability and real-time response necessitate computer systems that are quite different from other dependable systems in their architecture, design and development methodology, validation and verification, and operational philosophy. This paper highlights these differences by describing each of these aspects of safety-critical systems. Architectural principles and techniques to address these unique requirements are described.>