Abstract: A system and method for enhancing the integrity of a system which uses a high performance, low assurance, general purpose microprocessor to execute an avionics software application and uses a high assurance, low performance microprocessor to monitor the output of the general purpose microprocessor, without the need for comparison of outputs from parallel processors executing functionally equivalent versions of the avionics software application. The monitoring microprocessor is used to analyze state transitions of the first microprocessor and to analyze the computed values output by said general purpose microprocessor, against predetermined limitations based upon aircraft limitations.

Abstract: A method, apparatus, system, and machine-readable medium to bound data transmission latency by transmitting error verification data at a point during a data transmission related to a data transmission event is provided. Embodiments may comprise receiving an indication of a data transmission event, such as an end of a packet, and transmitting error verification data to a target device based upon the indication. More specifically, some embodiments transmit error verification data at an end of a packet to balance transmission latency against the bandwidth available from a communication medium.

Abstract: A non-obtrusive activity monitor is proposed for advantageously monitoring and tracing disjunct, concurrent computer system operations in heavily queued computer systems. For each traced and pending computer system operation, the monitor uses a hardware implementation of an event triggered operation graph to trace the path of the computer system operation through the computer system. For each followed path, a unique signature is generated that significantly reduces the amount of trace data to be stored. In a preferred embodiment, the trace information is stored together with a time stamp for debugging and measuring queuing effects and timing behavior in a computer system.

Abstract: A logical partition management apparatus and method for handling system reset interrupts (SRIS) are provided. The apparatus and method provide a SRI handler in the hypervisor that is capable of handling SRIs which may occur at any time during the operation of the multiprocessor computing system. The apparatus and method allow a hypervisor call to be completed before an SRI is handled. In this way, the SRI does not cause a processor of the symmetric multiprocessor (SMP) system to indefinitely hold a lock on a system resource and thus, other processors are not starved due to an inability to access the system resource.

Abstract: A method and apparatus for managing session information. In one embodiment, a communication session is established between a client computer and a server computer. When the client computer and the server computer establish the communication session, the client or the server typically stores information about the communication session, which is referred to as “session information.” The session information is stored in a first log file stored in a persistent volatile memory and in a cache file stored in a volatile memory of the server. The cache file is reconstructed after a server failure by retrieving the session information stored in the first log file.

Abstract: This invention is a system and method for managing the risk that errors in interpreting program code may lead to costly problems. A code difference criterion related to code value and position is used to lower such risk. Satisfying the criterion ensures that one or more other program codes interpreted in a subsequent instance will be sufficiently different enough from a first program code to be interpreted in a first instance that such problems may be avoided. One aspect of satisfying the difference criterion is requiring that every code have a minimum 2 bits difference from any other code.

Abstract: A system and method for synchronizing processors simulated in an architectural simulator for a multiprocessor environment. A synchronous breakpoint is set at a predetermined address location and a code portion targeted for execution on the target multiprocessor environment is launched on the simulator from a fixed location. Upon automatically stepping through a list of processors initialized in the simulator until each of the processors reaches the synchronous breakpoint, run control is returned to the user only after all processors have achieved a synchronous state. Debug operations may ensue thereafter by utilizing a debugger integrated with the architectural simulator.

Abstract: A system and method for handling the generation of an unexpected exception by an application. When the application generates an unexpected exception (i.e., crashes), the application's exception filter launches an outside exception handling program (EHP) that is separate and distinct from the application. Through a special protocol, the application and the EHP collaborate in responding to the unexpected exception. In this protocol, the application and the EHP communicate through kernel objects accessible by handles in a shared memory structure that the application creates before launching of the exception handling program and then shares with the EHP. Through this shared memory, the application also provides the EHP with information about the types of recovery options to offer the user. Through a graphical user interface, the EHP is then responsible for notifying the user of the application that an unexpected exception has occurred.

Abstract: The present invention describes a method and system for achieving high availability in a networked computer system. In particular, the method for achieving high-availability is executed in a networked computer system. The networked computer system includes nodes connected by a network. The method includes using high-availability-aware components to represent hardware and software in the networked computer system, managing the components to achieve a desired level of redundancy, and monitoring health of the networked computer system, including health of components and nodes. The method further includes detecting a failure in the networked computer system. Failures detected by the method include failures of a component and/or node. Finally, the method includes recovering from the failure by performing an appropriate failure recovery procedure.

Abstract: A system and method for the switching of control between redundant controllers is presented. The status of the redundant controllers is monitored to determine if switching of control between controllers is required. The monitoring and switching system is hardware based with control being implemented via a state machine.

Abstract: A method for controlling anomalous dual state of duplicated processors for a fault-tolerant system having a first and a second processors that are connected to each other through network, comprising: a first step of transmitting its own state information of either the first or the second processor to mutually another processor (twin) by using different transmission period to each other; a second step of receiving the heartbeat applied from the other processor and recognizing state information of the twin; and a third step of performing duplication states according to the state information of the twin. By doing that, when the two processors start, the seeds for random numbers are differently allocated to generate different random numbers, and the heartbeat transmission period is continuously changed by using the random numbers to differentiate the transmission and receiving time of the heartbeat between the two processors.

Abstract: A system and method is provided for using a first data channel to pass working data and a second data channel to pass error correction information. For example, this second data channel may be defined along a redundant data path. For example, this error correction information may be forwarded error correction (FEC) information such as Hamming code information or any other type of error correction information. Use of the redundant path to forward FEC information provides several advantages: 1) the FEC information can be used to correct bit errors that occur within the system, making the system high-quality and more reliable and 2) use of the protected path provides an efficient method to constantly monitor the quality of both the working and redundant path. Monitoring is accomplished by using the FEC information on the redundant path in conjunction with the information on the working path to accurately count the number of errors that occur on the working and redundant paths.

Abstract: A multiple disk system comprises plural physical drives organized as plural groups of disks. Each group is accessed as a plurality of logical volumes. One of the logical drives is considered a primary volume and one or more other logical volumes are considered as secondary volumes, which together constitute a mirroring group. Data contained in a memory records such organization. The data is consulted to select a secondary volume when the disk group containing a primary volume fails.

Abstract: Resource access control is provided in a manner that avoids unnecessary resource accesses where a resource is already known to be faulty. The resource can be a memory location, a peripheral or any other addressable system component. A resource access mechanism in a processor controls access to resources. The resource access mechanism includes an address control mechanism having a plurality of address control entries, each address control entry providing fake response identification indicating whether or not a response for the corresponding address is to be faked. The resource access mechanism also includes a fake response generator for selectively generating a faked response for an address in response to the fake response identification of the corresponding address control entry indicating that a response is to be faked.

Abstract: A memory controller controls access to one or more memory units. The memory controller includes access control logic operable to receive a memory access request that references at least one memory address. It further includes a fake response record operable to record a fake response indication for an address for which a response is to be faked. The access control logic is operable on receipt of a memory access request to access the fake response record and to fake a response where a fake response indication for an address indicates that a response is to be faked. By providing such a faked response, an embodiment of the invention is able avoid multiple exceptions for the same memory location in a CPU. Also, by providing such a faked response, multiple bus errors for a memory location can also be avoided where a bus supports Direct Memory Access (DMA). The memory controller can be implemented in an integrated circuit.

Abstract: A system is described capable of excising individual cells in an N-dimensional array and healing the array connectivity without manual intervention. Thus cells that fail can be deleted and the array remain viable, although possibly requiring re-synchronization procedures to be performed. The system allows either replacement of bad cells or bypassing of bad cells, with appropriate cost and operational differences. Both level sensitive and edge sensitive excision mechanisms are described and the consequences of each discussed. The invention applies to processor arrays with one cell per physical chip or many cells per chip, and handles uni-directional or bi-directional data flows, and is generally both interface independent and technology independent.

Abstract: A system and method are provided for recovering from the failure of a mirrored boot device (e.g., disk drive). One method is implemented for a computer system that mirrors two (or more) boot devices. If one of the devices fails, a set of compensating activities is performed, which may include removing the failed device from the list of devices from which the system may boot, deleting mirror state data from the device and removing the failed device from the mirroring scheme. After the failed device is repaired or replaced, a set of reintegrating activities is performed, which may include including the device in the mirroring scheme, restoring mirror state data to the device and adding the device to the list of boot devices. Even if the system includes only two mirrored boot devices and one of them fails, it can continue operation and can reboot successfully without using stale data.

Abstract: The highly reliable distributed system is composed of a communication protocol processing unit which comprises a mailbox for storing a communication message, and executes communication protocol processing between data of an application program and a network controller using the network controller performing network communication of the message in the mailbox; an error detection coding unit; an error detection decoding unit which reconverts data converted from communication data by the error detection coding unit to the original data, and detects that the content of the data is damaged if it is damaged; and a data comparing unit for checking whether or not two kinds of data agree with each other.

Abstract: A method for analyzing software, including defining a plurality of coverage models for testing a non-sequential program responsive to an interleaving of the program, each of the coverage models having a respective coverage level. The plurality of coverage models are then arranged in a hierarchy of increasing coverage level and the program is tested using at least a subset of the coverage models in a sequence according to the hierarchy so as to achieve a predetermined overall level of coverage.

Abstract: A method for fault tolerance in concurrently executing computer programs is presented. The present invention controls the re-execution of concurrent programs in order to avoid a recurrence of synchronization failure. The invention (i) traces an execution, (ii) detects a synchronization failure, (iii) determines a control strategy, and (iv) re-executes under control. Control is achieved by tracing information during an execution and using this information to add synchronizations during the re-execution.