Abstract: A sampling-error phase compensating device and a method thereof for sequentially sampling data signals and outputting sampled data signals.

Abstract: Systems and methods for error recovery in an integer execution unit of a multi-core processor are disclosed. In an exemplary embodiment a method may comprise checking parity for a transaction in an execution data path having parallel data registers. The method may also comprise copying one of the parallel data registers to a corrupt data register if parity fails.

Abstract: A system and method for providing singleton services in a cluster of servers, where one server is designated as a cluster master, other servers are designated as migratable servers and where all servers in the cluster heartbeat their liveness information against a database. The cluster master monitors the heartbeats of all migratable servers. Upon failure of a migratable server's heartbeat, the cluster master first attempts to restart the migratable server on the same machine and if that does not succeed, the cluster master migrates the migratable server to a different machine in the cluster. In accordance with an embodiment, all migratable servers monitor the heartbeats of the cluster master. Upon failure of the cluster master's heartbeating, one migratable server takes over the role of being cluster master.

Abstract: Redundancy is provided in a memory device having a configurable data bus organization by associating a redundant memory location with a defective memory location and configuring a size of the redundant memory location based on the current data bus organization of the memory device.

Abstract: A fault tolerant (FT) computer system includes a primary system and a secondary system. The primary system includes a first CPU; a first FT control section connected with the first CPU; and a first south bridge connected electrically and operatively with the first FT control section. The secondary system includes a second CPU; a second FT control section connected with the second CPU; and a second south bridge connected electrically with the second FT control section and not connected operatively with the second FT control section. The first FT control section and the second FT control section are connected by a link section, and the primary system and the secondary system operate in synchronization with each other by using the link section, except for the second south bridge.

Abstract: Embodiments of a multi-processor platform including multiple, cooperating operating systems are described. Multiple operating systems, each of which may be of a different type or nature, run on different partitions of the multi-processor platform, yet coexist and cooperate. In various embodiments, different specialized operating systems, suitable for particular tasks, run on different partitions of the platform. In one embodiment, a host operating system, using a driver, boots and partitions a portion of the platform running other operating systems, and then communicates with, and shares work with, the other operating systems. In one embodiment, the multi-processor platform includes a host operating system and multiple specialized operating systems, such as real-time operating systems, operating alongside the host operating system. Other embodiments are described and claimed.

Abstract: An apparatus provides hot standby operation with normal and standby processors, each of which includes vital inputs electrically interconnected with the vital inputs of the other processor, vital outputs, and an application routine inputting the vital inputs and outputting the vital outputs. Communication ports communicate with communication ports of the other processor. A health routine provides a health status after communication is established with the other processor. A vital relay includes an input controlled by a vital output and an output to a vital input of the other processor. A synchronization routine provides a synchronization status through the communication ports. The application routine outputs the vital outputs when the synchronization status is set. The standby processor includes a reset routine, which resets the standby processor when the health status of that processor is not provided. A vital “OR” circuit outputs from the vital outputs of the normal and standby processors.

Abstract: In a symbol timing detector, a correlator calculates a correlation value for a received radio packet signal. A peak detector compares the correlation value with a threshold value to be used, and sends, upon a correlation value detected larger than the threshold value, a detection signal to a symbol synchronous processor. A threshold value to be used for the peak detector is set different, after the first peak detected, between a predetermined estimation period and a period other than the former. A first peak is detected with a threshold value under a severer condition in the period other than the estimation period, and the next peak detection timing is estimated upon the first peak detected. A synchronization detecting position is determined, when no correlation peak is detected at the estimated timing, to output a sync detection signal.

Abstract: Method and system of determining whether a user program has made a system level call and thus whether the user program is uncooperative with fault tolerant operation. Some exemplary embodiments may be a processor-based method comprising providing information from a first processor to a second processor (the information indicating that a user program executed on the first processor has not made a system level call in a predetermined amount of time), and determining by the first processor, using information from the second processor, whether a duplicate copy of the user program substantially simultaneously executed in the second processor has made a system level call in the predetermined amount of time.

Abstract: A linear, half-rate clock and data recovery (CDR) circuit for recovering clock information embedded in a received data signal. The half-rate CDR circuit comprises a phase detector that may receive the data signal and generate a phase error signal representative of the phase difference between the received data signal and a clock signal produced by a voltage-controlled oscillator (VCO) of the CDR circuit. The half-rate CDR typically changes the frequency of the clock signal and generates a clock signal that is aligned with the baud center of the received data signal. More specifically, when the half-rate CDR circuit is in a locked condition, both the rising and falling edges of the clock signal are aligned with the baud center of the received data signal. The half-rate CDR preferably generates a clock signal with an average frequency that is half the data rate of a received data signal.

Abstract: In an aspect of the present invention, a computer system includes a plurality of computer nodes and an inter-node connecting unit configured to connect the plurality of computer nodes. Each of the plurality of computer nodes includes a local memory configured to store fault data of the computer node and a main memory. When a coupling command is issued to the plurality of computer nodes to build up a multi-processor in which the plurality of computer nodes are coupled, each of the plurality of computer nodes writes the fault data of the computer node in a predetermined address of the main memory of the computer node.

Abstract: A programmable controller includes two CPU units each having a detachably attached special-function module for carrying out a calculation process, each of the two CPU units recognizing conditions of the other CPU unit, one of them becoming an active unit and the other becoming a standby unit such that when the active unit fails and goes down the standby unit is switched to become active and resumes operations. The special-function module attached to the active CPU unit becomes an active module and carries out control processes with the active CPU unit and the other special-function module attached to the standby CPU unit becomes a standby module.

Abstract: There is disclosed a system equipped with information processors of control and standby systems interconnected to communicate with each other. The information processor of the control system executes a POST operation and a starting operation (S101 to S103), and instructs execution of a POST operation to the information processor of the standby system after completion of the starting operation (S104). Meanwhile, the information processor of the standby system monitors an operation of the control system (S106), executes the POST operation upon reception of the instruction from the control system (S107), and requests synchronization with its own device to the information processor of the control system upon completion of the POST operation (S108). The information processor of the control system copies information regarding the starting operation executed by its own device upon reception of the synchronization request, thereby starting a synchronous operation with the device (S109 to S110).

Abstract: A method and system of loosely lock-stepped non-deterministic processors. Some exemplary embodiments may be a processor-based method comprising executing fault tolerant copies of a user program, one copy of the user program executed in a first processor performing non-deterministic execution, and a duplicate copy of the user program executing in a second processor performing non-deterministic execution, with the executing in the first processor and second processor not in cycle-by-cycle lock-stepped.

Abstract: A system, method, and computer program product for reporting and recovering from an internal processor error in a multiprocessor system supporting system management mode. In accordance with the method of the present invention one or more replacement agents are allocated such as during system startup within the multiprocessor system. Machine specific error-reporting registers are monitored for one or more active processor agents during system operation. In response to detecting a faulty agent via the monitoring, a system management interrupt (SMI) request is issued to one or both the faulty agent and a selected replacement agent. In response to receiving the SMI request, the operating state of the faulty agent is copied to the selected replacement agent in system management mode. Operating system processing is then resumed using the replacement agent.

Abstract: A system and method for reintegration of a redundant controller after occurrence of a fault is provided, comprising synchronizing outputs of a primary controller with outputs of secondary controllers. The controller is placed in a different mode of operation in which its output is not used in system control. A meta-controller is activated to drive the primary controller to the same states at which the secondary or redundant controllers operate. A voting mechanism is used to determine a fault in an output to a controlled device. Control of the device using the secondary outputs is effected. The primary controller recalculates the primary output, based upon the primary output; a feedback signal; and, the secondary outputs. Control using the primary output is permitted when the primary output is within an allowable range of the secondary outputs.

Abstract: Remote access to a platform management system, for example via an intelligent platform management interface (IPMI), is maintained despite a failure affecting a local area network (LAN) controller. Failover to a second, operational LAN controller can be achieved by monitoring the status of the LAN controllers, and using a selector to couple a different LAN controller to a platform controller if the LAN controller currently coupled to the platform controller fails.

Abstract: A multimedia processing system and method thereof are provided. The system and method provide for synchronizing a first clock of a multimedia decoder of a first multimedia processing device to a second clock of a multimedia encoder of a second multimedia processing device, synchronizing a first timing reference of the multimedia decoder to a second timing reference of the multimedia encoder, receiving, at a network interface of the first multimedia processing device, an encoded multimedia data stream from a network interface of the second multimedia processing device, wherein the encoded multimedia data stream is encoded by the multimedia encoder based on the second clock and the second timing reference, and decoding the encoded multimedia data stream at the multimedia decoder based on the first clock and the first timing reference.

Abstract: An information processing apparatus of the present invention includes first and second computer elements which execute the same instructions substantially simultaneously and which are substantially synchronized with each other. The first computer element includes first and second memory elements, which are written by the first and second computer elements, respectively, during a first state. The information processing apparatus has a control element which makes the first computer element read from the second memory element during a second state. Another information processing apparatus has the first and second computer elements, and first and second memory areas which are provided in the first computer element. The first and second memory areas are written by the first computer element and the second computer element, respectively, during a first state. A control element makes the first computer element read from the second memory area during a second state.

Abstract: A fault-tolerant computer uses multiple commercial processors operating synchronously, i.e., in lock-step. In an exemplary embodiment, redundancy logic isolates the outputs of the processors from other computer components, so that the other components see only majority vote outputs of the processors. Processor resynchronization, initiated at predetermined time, milestones, and/or in response to processor faults, protects the computer from single event upsets. During resynchronization, processor state data is flushed and an instance of these data in accordance with processor majority vote is stored. Processor caches are flushed to update computer memory with more recent data stored in the caches. The caches are invalidated and disabled, and snooping is disabled. A controller is notified that snooping has been disabled. In response to the notification, the controller performs a hardware reset of the processors. The processors are loaded with the stored state data, and snooping and caches are enabled.

Abstract: In a network that includes a first database located on a first client and a second database located on a second client, a user or administrator initiates a restore operation. A dynamic mirror relationship existing between the first and second clients is terminated and a backup version of a database which the user or administrator wishes to recreate is identified. One of the first or second clients receives information concerning the location of the backup version of the database, as well as the role designation of the database at the time the backup operation was performed, from a restore server. The backup version of the database is retrieved from the storage location and recreated on each of the first and second clients, and the dynamic mirror relationship is reestablished between the first and second clients.

Abstract: An apparatus, and a corresponding method, are used for seeding differences in lock stepped processors, the apparatus implemented on two or more processors operating in a lock step mode. Each of the two or more processors comprise a processor-specific resource operable to seed the differences, a processor logic to execute a code sequence, in which an identical code sequence is executed by the processor logic of each of the two or more processors, and an output to provide a result of execution of the code sequence. The processor outputs, based on execution of the code sequence is provided to a lock step logic operable to read and compare the output of each of the two or more processors.

Abstract: A dual-processing unit with single clock source CPUs safety I/O module having a safety timer crosscheck diagnostic to enable each CPU to verify the accuracy of the clock source of the other CPU. The diagnostic works by having the first CPU act as a controlling CPU and the second CPU act as a monitoring CPU. Both CPUs are synchronized to begin one cycle of their respective safety functions at the same time. As part of the diagnostic, the controlling CPU is set to be interrupted after a pre-determined time period while the monitoring CPU is set to be interrupted slightly after that. When the controlling CPU is interrupted after the pre-determined time has passed as determined by that CPU's clock source, it sends a signal to the monitoring CPU which then verifies that the perceived time is within an expected range. To verify that the clock source of the monitoring CPU is accurate, the first CPU swaps roles to become the monitoring CPU while the second CPU becomes the controlling CPU.

Abstract: A system, apparatus, computer program product and method of performing functional validation testing in a system are provided. Generally, functional validation testing includes data acquisition and data validation testing. During the functional validation testing two devices may be exchanging data. The exchange of data by the two devices may be referred to as data acquisition. The data from one device and the data from the other device may be compared to each other. This may be referred to as data validation. When data is exchanged during data acquisition, it is also stored in appropriate locations in a pool of buffers in memory. During the data acquisition, checks are made to determine if the system is entering an idle cycle. If so, the data validation test is performed by using the data in the pool of buffers in memory.

Abstract: A method of self-synchronizing clocks in a multiple chip system, by assigning one chip as the master chip and the other chips as slave chips. A training signal is sent from master chip to the slave chips to determine the latency from the master chip to a slave chip, and then a synchronization signal is sent out to synchronize the “time zero” of the chips.

Abstract: An apparatus is disclosed for deterministically performing active-active failover of redundant servers in response to a failure of a link on which each server provides a heartbeat to the other server. Each of the servers is configured to take over the identity of the other server on a common network in response to detecting a failure of the other server's link heartbeat. Each server provides a status indicator to a storage controller indicating whether the other server's link heartbeat stopped. The storage controller determines the link has failed if both of the status indicators indicate the other server's heartbeat stopped, and responsively kills one of the servers. The storage controller also receives a heartbeat directly from each server. If only one direct heartbeat stops when the status indicators indicate the link heartbeats stopped, then the storage controller detects one server has failed and inactivates the failed server.

Abstract: An apparatus, operating on an advanced multi-core processor architecture, and a corresponding method, are used to enhance recovery from loss of lock step in a multi-processor computer system. The apparatus for recovery from loss of lock step includes multiple processor units operating in the computer system, each of the processor units having at least two processor units operating in lock step, and at least one idle processor unit operating in lock step; and a controller coupled to the two processor units operating in lock step and the idle processor unit. The controller includes mechanisms for copying an architected state of each of the two lock step processor units to the idle processor unit.

Abstract: According to one embodiment, a method comprises assigning a first processor of a multi-processor system a role of spare processor for at least a second processor, and responsive to detecting loss of lockstep (LOL) for any of the at least a second processor, the first processor replaces the processor for which the LOL is detected. The method further comprises reestablishing lockstep for the processor for which the LOL is detected, and assigning the processor having its lockstep reestablished the role of spare processor for at least the first processor.

Abstract: Described is a synchronization technique that may be used to coordinate processing between endpoints using the connecting message fabric. Processors in a data storage system communicate using the message switch of the message fabric. Each processor is an endpoint within a data storage system. A first endpoint may mark the beginning of the synchronization period by specifying a processing point at which other processors and the first endpoint are to coordinate from the perspective of the first endpoint. Synchronization is performed using local state information about the processing state of each endpoint as reported by each endpoint. The first endpoint waits for successful synchronization within a timeout period in accordance with the first endpoint's local state information. If successful synchronization does not occur prior to the timeout period, the first endpoint broadcasts a message with a new synchronization point to other endpoints.

Abstract: According to one embodiment, a method comprises system firmware instructing a system's operating system to idle a processor, and responsive to the instructing, the operating system idling the processor and returning control over the processor to the system firmware. According to one embodiment, a method comprises detecting loss of lockstep (LOL) for a processor module in a system, and responsive to the detecting LOL for the processor module, system firmware instructing an operating system to idle the processor module.

Abstract: Described are a system and method for providing an interface to synchronize data transfers across clock domains. A first pulse converter receives a request signal in a first clock domain and converts the request signal into a synchronization signal in a second clock domain. A second pulse converter receives the synchronization signal in the second clock domain from the first pulse converter and converts the synchronization signal into an acknowledgment signal in the first clock domain. The pulse converters cooperate thus to perform a self-acknowledging handshake that synchronizes writes and reads to and from a FIFO memory, thereby effectuating the transfer of data across two clock domains.

Abstract: A node, within a networked computer system, is capable of supporting communications with other nodes relating to operating multiple application instances in a master-slave configuration. Each node periodically generates and sends a Heartbeat message that indicates the operational status and configuration information for one or more application instances being managed by the node. When a node receives a Heartbeat message from a remote node, it determines whether new configuration information should be obtained for each of the application instances the node is managing, and establishes a connection with a remote node that can access the new configuration information. The connection is an HTTP connection, in one embodiment. The node then requests and receives that new configuration information from the remote node. In one embodiment, the new configuration information is received in an XML format.

Abstract: A cross compare solution running in a multiprocessor configuration, using a multi-port RAM with built-in logic. This provides for a fast and simple data cross compare medium. The multi-port RAM unit can be plugged into the motherboard of the main processor unit, requiring no external hardware or wiring. A method and a system for cross compare has a first layer of buffers with a first storage area for storing information from the first processor and a second storage area for storing information from the second processor, and a second layer of buffers with a third and fourth storage areas, where each storage area stores information from the first and second storage areas. The first, second, third, and fourth storage areas have one or more buffers allocated only for its respective storage area.

Abstract: A processor is provided that implements a replay mechanism to recover from soft errors. The processor includes a protected execution unit, a check unit to detect errors in results generated by the protected execution unit, and a replay unit to track selected instructions issued to the protected execution unit. When the check unit detects an error, it triggers the replay unit to reissue the selected instructions to the protected execution unit. One embodiment of the replay unit provides an instruction buffer that includes pointers to track issue and retirement status of in-flight instructions. When the check unit indicates an error, the replay unit resets a pointer to reissue the instruction for which the error was detected.

Abstract: A method for operating a data processing system and a redundancy data processing unit for executing the method is disclosed. Two or more active data processing units are assigned to each redundancy data processing unit. The redundancy data processing unit stores a copy of the active data stock of each active data processing unit assigned to it. Each of the active data processing units periodically ascertains changes in its current active data relative to the copy of its active data stored in the redundancy data processing unit and transfers correction data describing any changes. By means of the transferred correction data, the redundancy data processing unit updates its stored copy of the active data and, in the event of the failure of an assigned active data processing unit, assumes the function of the failed data processing unit based upon its stored data copy from the failed data processing unit.

Abstract: Various embodiments of systems and methods are disclosed for initially synchronizing redundant data (e.g., a mirror, a replica, or a set of parity information) with an original volume. State information identifies which regions of the original volume are currently valid, and only valid regions of the original volume are used to generate the values of the redundant data during the initial synchronization. For example, if the redundant data is a set of parity information, synchronizing the redundant data involves calculating one or more parity values based on the valid regions of the volume. If the redundant data is a duplicate copy (e.g., a mirror or replica) of the volume, synchronizing the redundant data involves copying the valid regions of the volume to the duplicate copy of the volume. If the original volume includes any invalid regions, unnecessary copying and/or processing for those regions can be avoided during the initial synchronization.

Abstract: A method for checkpointing a multithreaded application program, based on the egalitarian and competitive active replication strategy. The invention enables different threads to be checkpointed at different times in such a way that the checkpoints restore a consistent state of the threads at a new or recovering replica, even though the threads operate concurrently and asynchronously. Separate checkpoints are generated for the local state of each thread and for the data that are shared between threads and are protected by mutexes. The checkpoint of the shared data is communicated in a special message that also determines the order in which the claims of mutexes are granted to the threads. A source-code preprocessor tool is described for inserting code into an application program to checkpoint the state of the thread during normal operation and to restore the state of the thread from the checkpoint subsequently.

Abstract: A method, a system, and a network entity enable a detection of a connection fault and perform the switch-over in less than 50 ms. CV packets are being sent, for example, 1/10 ms (1 CV packet per 10 ms) or 1/15 ms (1 CV packet per 15 ms). The interval of the CV packets, consequently the frequency for sending CV packet, can be any interval that makes the switch-over time for a protected substantially real-time connection achievable. Moreover, the interval (the frequency) should be such that the interval makes the fault detection from the fault event to occur in less than 50 ms and triggers the switch-over to occur also in less than 50 ms from the occurrence of the fault event.

Abstract: Techniques are disclosed, for use in a computer system including a plurality of processing units coupled over a system fabric, to identify a lockstep error associated with a first packet to be transmitted over the system fabric; set a viral indicator in the first packet to indicate the lockstep error; and transmit the modified packet over the system fabric.

Abstract: High availability for a fibre channel switch in a storage area network can be implemented using redundant supervisors. An active supervisor can identify high availability characteristics associated with a message and determine whether the message should be mirrored onto a redundant supervisor, logged, and/or made persistent. Messages can be logged in a pending transaction buffer and stored using persistent storage services. Mirroring can be performed using synchronization queues that allow messages to be passed asynchronously to a redundant supervisor while maintaining full synchronization between supervisors and causing little delay to operation of the active supervisor.

Abstract: A method of managing a communications system is disclosed. The method begins with the creation of a resource control block corresponding to a resource of the communications system. The communications system includes, for example, a processor and a resource coupled to the processor. The resource control block maintains information regarding the resource. The method also provides for the maintenance of the resource control block. The processor is configured to maintain the resource control block, and the resource control block is maintained by the processor in response to communications (e.g., a keep-alive message) between the processor and the resource. This embodiment can also include the creation of a processor resource control block corresponding to the processor that is created by the controller in response to a power-up message from the resource. The resource can be, for example, a hardware component of the communications system.

Abstract: An arbitration mechanism is provided for arbitrating between redundant controllers having outputs electrically connected together and provided as input to at least one device under control. The arbitration mechanism includes logic for automatically determining which controller of the redundant controllers is active controller, and a hardware output interlock for the redundant controllers to ensure that output controlled by only the active controller is enabled as input to the at least one device. The arbitration mechanism also includes logic for monitoring the active controller for failure, and upon detection of failure, for automatically switching active control to another controller of the redundant controllers transparent to the at least one device.

Abstract: A systems and methods described herein may be incorporated into a “service marketplace” system that matches users with potential information or service providers and establishes a real-time communications connection between the user and a selected information provider. In one embodiment, an alternate is selected for the user when the service provider that the user is trying to connect with cannot be reached. In an alternative embodiment, the alternates can be used in conjunction with the service provider that does connect with the user in order to provide a second opinion or possibly deeper background information. In one embodiment, the service providers can either be a live person at the other end of the connection or a recording.

Abstract: A device is provided which includes a first microprocessor core to generate a first output signal; a second microprocessor core to generate a second output signal; a switching fabric having a first input/output port; and lockstep logic, coupled between the first input/output port of the switching fabric and the first and second microprocessor cores, to detect whether the first output signal differs from the second output signal.

Abstract: In one aspect of the present invention, a circuit is provided which implements an instruction set architecture defining a first instruction group, a second instruction group to enter a high-reliability mode of operation, and a third instruction group to enter a non-high-reliability mode of operation. The circuit includes means for causing the circuit to enter the high-reliability mode of operation in response to receiving the second instruction group; means for causing the circuit to enter the non-high-reliability mode of operation in response to receiving the third instruction group; first execution means for executing the first instruction group in the high-reliability mode of operation if the circuit is in the high-reliability mode of operation; and second execution means for executing the first instruction group in the non-high-reliability mode of operation if the circuit is in the non-high-reliability mode of operation.

Abstract: A video distribution system is implemented on a hierarchical parallel processing system that has clusters that are automatically formed from nodes of computer processing systems. Each cluster has a cluster supervising processor or group leader system that controls cluster configuration, fault detection and isolation, and data distribution. The group leader is determined according to a priority determined during the configuring of the hierarchical parallel processing system. The clusters are able to be reconfigured to allow removal and addition of nodes without impact on operation of the parallel processor system. The cluster provide a node status or heartbeat message that which provides detection and isolation of failure of nodes and disk storage devices within a cluster. The nodes within the cluster are able to join or leave a cluster and not affect performance.

Abstract: An at least dual-channel homogeneous-redundancy-based electronic device, preferably a dual-channel homogeneous-redundancy-based central processing unit of a stored-program control, that has at least one certified channel and at least one non-certified channel. The at least one, and certified channel is a channel that is sufficiently free of systematic errors. Components that have not been proven sufficiently free of systematic errors can be used in the at least one non-certified channel.

Abstract: A timing signal generating system has a clock signal generating circuit, a synchronizing circuit, a phase code recognizing circuit, and a calibration circuit. The clock signal generating circuit generates at least one first clock signal upon receipt of at least one reference clock signal by controlling an output phase thereof with a digital code signal. The synchronizing circuit hands over signals between a group of circuits operated by the first clock signal and an internal circuit operated by a second clock signal. The phase code recognizing circuit recognizes a phase code when the phases of the first clock signal and of the second clock signal are in a particular relationship. The calibration circuit calibrates a relationship between a value of the recognized phase code and a phase difference between the first and second clock signals. The synchronizing circuit is controlled by using phase code data calibrated by the calibration circuit.

Abstract: An apparatus is disclosed for deterministically performing active-active failover of redundant servers in response to a failure of a link on which each server provides a heartbeat to the other server. Each of the servers is configured to take over the identity of the other server on a common network in response to detecting a failure of the other server's link heartbeat. Each server provides a status indicator to a storage controller indicating whether the other server's link heartbeat stopped. The storage controller determines the link has failed if both of the status indicators indicate the other server's heartbeat stopped, and responsively kills one of the servers. The storage controller also receives a heartbeat directly from each server. If only one direct heartbeat stops when the status indicators indicate the link heartbeats stopped, then the storage controller detects one server has failed and inactivates the failed server.

Abstract: A Dynamic Storage Subsystem Morphing (DSSM) mechanism (40) is connected to a plurality of storage subsystem resources, which reserve some storage area each non-donor ECU (12), ready for a “slot-down/up” access by a respective non-donor ECU having a storage subsystem (24) breakdown. The slot-down process enables the use of a high physical address range by the non-donor processor provided with addressing capabilities sufficient only for addressing lower ranges.