There is only one servlet instance per registered servlet. Normally, when concurrent requests are handled by the web server, threads are spawned which executes the service() method of the servlet. Instance variables are not
thread safe, but local variables within the service() method are. The request object is also "localized" per thread.
According to the Servlet specs, when a servlet implements the SingleThreadModel interface (which is an empty "tag" interface) and concurrent requests are handled by the web server, the container is supposed to create a new servlet instance per request. It is possible that the container will pool these servlet instances. it is also possible that the container will serialize, i.e. queue, the requests per instance. It is possible that the container implementation is a combination of these.
Since there are now multiple servlet instances handling each request, the instance variables are now thread safe.
In either case, however, if any servlet static variables are defined, these will NOT be thread safe unless you explicitly make it so with custom code.