I have some questions about the COLO. 

1)  Could we dynamic set fault tolerance feature on running VM?

In your document, the primary VM could not  start first (if you start primary VM, the secondary VM will need to start), it means to if I want this VM with fault-tolerance feature, it needs to be set while we boot it.

2)  If primary VM or secondary VM broke, could we start the third VM to keep fault tolerance feature?

Best regard, 

Daniel Cho.