iIS Process Engine Components
opens a channel to the backup unit, which takes over by recovering all the persistent state information stored in the engine database. The new primary engine unit starts process execution at the point where the old primary engine unit left it. Client sessions with the engine are maintained throughout this failover transition.
NOTE Failover (and recovery of state information) is not instantaneous. In a production system, the state information stored in the engine database can be quite extensive. It includes information on the state of every process instance, the state of every activity and timer in each process instance, the values of process attributes and their lock states, the state of routers and triggers for each activity instance, session activity lists, queue lists, and so on. Accordingly, the amount of time for failover to occur is dependent on the amount of state information in the database and the speed of database access.
Governor The governor is an application that assists in deciding when failover should occur. The governor maintains an open communication channel with both the primary and backup engine units. It uses these channels to determine if a closing of the communication channel between primary and backup engine units is due to engine unit failure or network failure. For example, if the communication channel between the primary and backup engine units closes, but the governor’s communication channel with the primary engine unit remains open, the governor assumes the primary engine unit is still online. However, if neither the governor nor backup engine unit can communicate with the primary engine unit, the governor assumes the primary engine unit has failed, and places the backup engine unit online, making it the new primary engine unit.
(If the primary engine unit has not failed, but cannot communicate with either the governor or backup engine unit, the primary engine unit will drop into STANDBY state, since it has no way of knowing the state of its partner.)
