Method for ensuring operation during node failures and network partitions in a clustered message passing server

A means for guaranteeing the proper behavior as specified by the JMS semantics of clustered message server when the individual computer that comprise the cluster are separated by a network partition. A clustered message server is responsible for the reliable transportation of messages between different distributed computer applications. It employs multiple computers to perform a function that otherwise appears to be performed by a monolithic server running on one computer, but with more capacity and reliability than can be provided by one computer. If a computer in the cluster fails, another computer should automatically assume the role of the failed computer. However, it is not possible for the other machines in the cluster to detect the difference between the failure of one or more computers in the cluster, and the failure of data network connecting those computers. In ordinary clusters, different actions would be required in these two cases, but since they are impossible to distinguish, computer failure is always assumed and network failure is ignored and the consequence non-deterministic. The invention described here provides a means of responding to failures that yields correct behavior as specified by the JMS semantics whether the failure is due to computer failure or network failure.