Abstract: A safety device for a stored-program control includes a controller which exchanges data with a stored-program control and, via a bus controller and a bus system, with the peripheral to be controlled. A memory is provided, in which safety-relevant data of the stored-program control is stored, which is accessible to the controller.

Abstract: A microprocessor based system automatically detects the occurrence of certain conditions in the microprocessor. The conditions may include a determination of data corruption in the microprocessor. If a determination is made that data is corrupted, the microprocessor may be reloaded from a non-volatile memory. During a reload, a microcontroller controls the microprocessor. The non-volatile memory may be a flash memory or non-volatile random access memory.

Abstract: A method and system for automated multisite testing. Specifically, in one embodiment, a method is disclosed for determining a testing order of plurality of testing operations of a test flow in a multisite testing environment. The method begins by automatically walking through the test flow by performing recursion on the plurality of testing operations. Next, the method automatically assigns a plurality of relative priorities to the plurality of testing operations. The plurality of relative priorities determine the testing order used when executing each of the plurality of testing operations in said test flow. Each of the plurality of testing operations is executed only once when testing a plurality of devices under test (DUTs) in the multisite testing environment.

Abstract: Methods and associated hub arrangements are described for use in diagnosis and recovery in high performance digital loops such as, for example, those seen in Fiber Channel systems. In one system having a hub configured for interconnection of a plurality of stations as part of a digital system such that digital data flows between the stations based on operational status of the system, an arrangement forms part of the hub which arrangement is connectable at points within the hub and between at least two different pairs of the stations for monitoring certain characteristics of the data in a way which provides for non-invasive identification of one or more conditions related to the operational status of the system.

Abstract: A system and method for automatically managing a distributed software test execution, management and reporting system that includes a network of test computers for executing a plurality of test jobs and at least one client computer for controlling the test computers is disclosed. The method and system include providing the test computers with a service program for automatically registering availability of the computer and the attributes of the computer with the client computer. The execution requirements of each test job are compared with the attributes associated with the available computers, and the test jobs are dispatched to the computers having matching attributes. The method and system further include providing the service programs with a heartbeat function such that the service programs transmit signals at predefined intervals over the network to indicate activity of each test job running on the corresponding computer.

Abstract: A method and system is provided for monitoring the health of processes running on a router. A behavior of a process is monitored and the process is killed if the behavior is abnormal. The behavior may be abnormal if the process is non-responsive, cannot start, or repeatedly crashes. The system may include a timer to measure a predetermined time interval for the process to perform a desired action, a counter to count a number of times the process fails to perform the desired action before the timer expires, and a controller to kill the process when the counter exceeds a maximum number of failures. Alternatively, the timer could measure an amount of uptime, the counter could count the number of times the process crashes, and the controller could kill the process when a crash rate calculated from the number of times the process crashes per the amount of uptime exceeds a maximum crash rate.

Abstract: The present invention provides systems and methods for preventing software errors caused by address range or alignment errors. In architecture, a representative system includes a compiler that parses a program and further comprises a logic that generates a verification value for a block of code in the program, a logic that stores the verification value in the block of code, and a logic that inserts verification value instruction code into the block of code. The present invention can also be viewed as a method for preventing software errors in a program. A representative method operates by generating a verification value for a block of code in the program, and storing the verification value in the block of code. During execution of the program, a runtime verification value is generated for the block of code, and the block of code is executed if the verification value equals the runtime verification value, and generates an error message if the verification value does not equals the runtime verification value.

Abstract: A method and apparatus in a data processing system for managing sessions for a secure access to the data processing system. A request for a secure connection is received. The secure connection is established, wherein information used to facilitate the secure connection is generated. The information is stored for a selected period of time, wherein the selected period of time is selected to optimize server resources.

Abstract: A stack frame associated with a procedure that can alter or affect a shared resource where the procedure is associated with a child stack and is declared by a parent stack is marked isolated. Isolated stack frames are allotted an additional predefined interval of processing time before commands such as terminate and interrupt applied to the child stack are executed. If the command is a terminate command, after the additional allotted time interval has passed, both child and parent stacks are terminated. If the command is an interrupt command, after the additional allotted time interval has passed, the child stack is interrupted. If the command is a resource-terminated command, an operator is permitted to allocate more resource time to the task or may terminate both parent and child stacks. If a parent stack is terminated, all child stacks of the parent are terminated.

Abstract: Various components are provided to manage a clustered environment. These components include a System Registry that provides a global data storage; a Configuration manager that stores data locally on nodes of the clustered environment and globally within the System Registry; a Liveness component to provide status of communications paths of the cluster; a Group Services component that provides services to one or more other components of the clustered environment; and a Resource Management component that communicates with one or more resource controllers of the clustered environment. Each of the components of the clustered environment has one or more data and/or functional dependencies on one or more other components of the environment. However, relationships between the components are created such that the data and functional dependencies form an acyclic graph (i.e., a cycle of dependency relationships is avoided).

Abstract: A system for effecting recovery of a network involving a plurality of computing apparatuses with each respective computing apparatus hosting at least one respective service, includes: (a) at least one control unit substantially embodied in hardware and coupled with each computing apparatus; and (b) at least one control program substantially embodied in software and distributed among at least one of the computing apparatuses. The system responds to a computing apparatus becoming inoperative by effecting a recovery operation. The recovery operation includes distributing the services hosted by the inoperative computing apparatus as distributed services among operating computing apparatuses and returning the distributed services to the inoperative computing apparatus after the inoperative computing apparatus becomes operative. The at least one control unit and the at least one control program cooperate to effect the recovery operation.

Abstract: A counter counts pulses of a clock generated by an oscillator. A control register clears the counted value, in response to a reset signal sent from an external circuit. In the case where the counted value exceeds a limit value, an output control circuit outputs a reset signal for instructing to execute the reset process, to the external circuit. This reset signal is provided also to the control register. The control register controls the counter to count the pulses of the clock, in response to the reset signal. Then, abnormal operations occurring in the external circuit during the execution of the reset process can be detected.

Abstract: The activation of programmed sequences to be executed iteratively is monitored by the sequences themselves. Each monitoring program sequence includes the additional function of monitoring at least one other sequence. The sequences can be in the form of routines, e.g. interrupt routines, and main program loops normally implemented in a programmed system. For instance, each programmed sequence performs the monitoring function by incrementing a value in a respective counter associated with each programmed sequence it monitors and by checking, for each counter, that the corresponding value has not reached a predetermined threshold. Each monitored programmed sequence resets the counter associated therewith. A failure in the activation of a particular programmed sequence is detected when a counter associated with that sequence reaches a predetermine threshold. The invention also relates to a computer program and a programmed apparatus implementing this concept.

Abstract: A method for monitoring the functioning of a control unit for the activation of output stages, for example, in a motor vehicle, is provided. The control unit includes a main computing element having at least one microprocessor, and at least one auxiliary computing element having at least one microprocessor. The main computing element and the at least one auxiliary computing element may access a common memory element. The present system enables monitoring of the control unit that is as simple as possible but is nonetheless secure and reliable, by providing that during normal operation of the control unit, the content of a specifiable memory location of the memory element be queried by at least one of the auxiliary computing elements at presettable times, given a functioning main computing element, the content having previously been written with a presettable value by the same.

Abstract: A method, implemented on a computer having a fixed amount of memory and CPU resources, for analyzing a sequence of data units derived from a dynamic system to which new data units may be added by classifying the data units, is disclosed. The method comprises determining the similarity of the data units being part of the sequence of data units by calculating the distance between all pairs of data units in a data space. The method further comprises classifying the data units by assigning labels to the data units such that, if the distance of a data unit which is to be classified to any other data unit exceeds a threshold, a new label is assigned to the data unit to be classified. Also, if the threshold is not exceeded, the label of the data unit being closest to the data unit to be classified is assigned to the data unit to be classified.

Abstract: An engine control ECU includes a microcomputer, which includes CPU, RAM, ROM, FPU and I/O. The FPU performs floating-point calculations and the CPU carries out operations other than the floating-point calculations. The CPU checks whether non-numeric exists, and performs backup processing when the non-numeric is found. In the backup processing, the RAM data is initialized by writing default values harmless to control as the RAM data. In addition to or alternative to the initialization, the CPU disables a floating-point calculation of the FPU. Without using the FPU, the CPU performs engine control operations by using integer data instead of floating-point data.

Abstract: An integrated circuit, a client computer system, and a method for using a watchdog timer as a check before changing the system state of a computer system. The integrated circuit includes a first bus interface logic for coupling to a first external bus, a watchdog timer, and logic configured to receive a request for a system reset. The watchdog timer is coupled to receive a reset input upon a predetermined change in a system state. The watchdog timer is further configured to provide an indication in response to an expiration of the watchdog timer. The logic is configured to query the watchdog timer for the expiration of the watchdog timer in response to receiving the request for the system reset.

Abstract: A microprocessor runaway monitoring control circuit with which self-diagnosis of a watchdog timer WDT can be carried out safely and cheaply even during operation of the microprocessor (CPU). A microprocessor 101 supplies first and second watchdog clearing signals WD1 and WD2 to first and second watchdog timers WDT1 and WDT2, and when the both of the watchdog clearing signals WD1 and WD2 stop, the microprocessor 101 is reset by way of a logical connector circuit 122. The microprocessor 101 has failure diagnosing means 103 which intentionally stops the first watchdog clearing signal WD1 and diagnoses the response of the first watchdog timer WDT1 on the basis of a monitor signal MN1 and stops the second watchdog clearing signal WD2 and diagnoses the response of the second watchdog timer WDT2 on the basis of a monitor signal MN2, whereby diagnosis of the watchdog timers WDT1, WDT2 is carried out without the microprocessor 101 being stopped.

Abstract: In a monitor apparatus for a sequential-function-chart-type programmable controller, a standard value of an active time of an arbitrary step in a sequential-function-chart program is stored, and the active time of the arbitrary step is measured during execution of the program. An anomalous state of the arbitrary step is detected through comparison between the measured active time and the reference value. Further, data indicating whether each step in the sequential-function-chart program has been executed are stored. The program is displayed such a manner that an anomalous step, a step or steps which have been executed, and a step or steps which have not yet been executed are distinguished from one another.

Abstract: A simultaneous and redundantly threaded, pipelined processor executes the same set of instructions simultaneously as two separate threads to provide fault tolerance. One thread is processed ahead of the other thread so that the instructions in one thread are processed through the processor's pipeline ahead of the corresponding instructions from the other thread. The thread, whose instructions are processed earlier, places its committed stores in a store queue. Subsequently, the second thread places its committed stores in the store queue. A compare circuit periodically scans the store queue for matching store instructions. If otherwise matching store instructions differ in any way (address or data), then a fault has occurred in the processing and the compare circuits initiates fault recovery. If comparison of the two instructions reveals they are identical, the compare circuit allows only a single store instruction to pass to the data cache or the system main memory.

Abstract: In one embodiment, a telecommunications device includes a synchronization bus and a controller coupled to the bus that generates a system clock signal according to a primary reference clock signal and communicates the system clock signal using the bus. The controller detects a loss of the primary reference clock signal and, in response, continues generating the system clock signal, determines acceptability of a secondary reference clock signal, switches from the primary reference clock signal to the secondary reference clock signal if the secondary reference clock signal is acceptable, and in response to the switch generates the system clock signal according to the secondary reference clock signal.

Abstract: A distributed computer environment (DCE) is disclosed that provides event globalizing of at least one event at one server in the DCE to other servers within said DCE as well as maintains a record of specific event activity over the DCE. The maintenance of the records is performed by storing a global event file comprising a list of events and a corresponding list of servers in order to identify which of the servers should receive which events, storing a local event registry comprising a list of events and a corresponding list of local event consumers in order to identify which of the local event consumers should receive which events, identifying specific events within the list of events to be monitored for a specific purpose, monitoring said specific events as they occur over the DCE, notifying a specific local event consumer of the occurrence of the specific events, and recording a log of event activity involving only the specific events.

Abstract: A simultaneous and redundantly threaded, pipelined processor executes the same set of instructions simultaneously as two separate threads to provide fault tolerance. One thread is processed ahead of the other thread so that the instructions in one thread are processed through the processor's pipeline ahead of the corresponding instructions from the other thread. The thread, whose instructions are processed earlier, places its uncached reads in a read queue. Subsequently, the second thread places its uncached reads in the read queue. A compare circuit periodically scans the read queue for matching uncached read instructions. If otherwise matching instructions differ in their target address, then a fault has occurred in the processing and the compare circuits initiates fault recovery. If comparison of the two instructions reveals they are identical, the compare circuit allows only a single uncached read instruction to pass to the system main memory.

Abstract: A system for collecting events relating to multiple distributed physical systems includes multiple event collection cards (100), each receiving events from one of the distributed physical systems. Each event collection card includes a time stamp clock (120) configured to provide a time stamp when each event is received, an event memory (110) configured to store the received events, a sync interface unit (130) configured to receive a sync signal, a sync control unit (125) configured to synchronize the time stamp clock (120) to the sync signal received by the sync interface (130), and a collection control unit (115) configured to time stamp the collected events according to the time stamp clock (120) synchronized to the sync signal, and to store the time stamped events in the event memory (110).

Abstract: A system and method for verifying cache coherency in a multi-node, NUMA system includes a transaction modification unit configured to receive event traces generated by a simulation tool. The modification unit modifies transactions that are propagated to another node in the NUMA system and thus result in two bus transactions, a home node transaction (HNT) and a foreign node transaction (FNT). More specifically, the modification unit merges a FNT and its corresponding HNT into a single merge transaction (MT) under a prescribed set of merging rules. The MT has properties of the both the FNT and the HNT. The FNT and HNT are deleted from the event trace and replaced by their corresponding MT to create a modified event trace that is suitable for coherency checking by a single system coherency checker.

Abstract: A method for controlling energy systems such as multiple boiler systems to meet an energy need includes a controller configured as a sequencer with the remaining controllers act as individual boiler controllers which periodically send status messages to the sequencer. The energy need is determined by measurements at the sequencer which maintains runtimes of the boilers. The sequencer periodically sends control commands to the boiler controllers to add or delete boilers. The control commands give consideration to the run times of the boilers.

Abstract: An on-chip watchdog circuit (100) is provided that generates an output signal (175) when an error signal (112) generated by a circuit under test (110) is detected. The on-chip watchdog circuit (100) comprises a logic gate (125) that is connected to a clock signal and receives a signal in response to the error signal 112 generated by the circuit under test (110). A gate output circuit (140) is connected to an output of the logic gate (125). An RC circuit (150) is connected to the gate output circuit (140). A comparator (170) is connected to the RC circuit (150). The comparator (170) is also connected to a voltage divider (160) and provides the output signal (175) in response to the error signal (112) generated by the circuit under test (110), and the on-chip watchdog circuit (100) and the circuit under test (110) are integrated on a same semiconductor microchip.

Abstract: A computer system including a first repeater; a second repeater coupled to the first repeater; and a third repeater coupled to the first repeater. The second repeater is also coupled to a first client and a second client. The second repeater contains a distributed arbiter that predicts whether the first repeater will send a transaction to the second repeater.

Abstract: In an information processing system, a failed bus operation is detected. In response to the detecting, a primary power plan is cycled in the information processing system.

Abstract: A multi-processor computer system permits various types of partitions to be implemented to contain and isolate hardware failures. The various types of partitions include hard, semi-hard, firm, and soft partitions. Each partition can include one or more processors. Upon detecting a failure associated with a processor, the connection to adjacent processors in the system can be severed, thereby precluding corrupted data from contaminating the rest of the system. If an inter-processor connection is severed, message traffic in the system can become congested as messages become backed up in other processors. Accordingly, each processor includes various timers to monitor for traffic congestion that may be due to a severed connection. Rather than letting the processor continue to wait to be able to transmit its messages, the timers will expire at preprogrammed time periods and the processor will take appropriate action, such as simply dropping queued messages, to keep the system from locking up.

Abstract: The present invention is a method for predicting polymer latex properties for an emulsion polymer latex based on statistical relationships between the polymer latex properties and process parameters for the emulsion polymerization process.

Abstract: A system is provided for asymmetrically maintaining system operability that includes a first processing element and a second processing element coupled to the first processing element by a communication link. The first processing element is operable to perform at least one function. The second processing element is operable to perform at least one function of the first processing element in the event the first processing element fails, and further operable to expect and receive keepalive inquiries at an expected rate from the first processing element and to send responses in response to the inquiries to the first processing element. The second processing element is further operable to take remedial action after not receiving any inquiries within a first predetermined time period.

Abstract: In a computer system which allows simultaneous operation of multiple processes, a software watchdog process operates to monitor a primary process through operating system calls. If the response to an operating system call shows that the primary process is not operating or is over utilizing CPU time, then the primary process is restarted. The software watchdog process may also check and correct configuration and data files before restarting the primary process. Alternatively, rather than using operating system calls, the software watchdog process and primary process may communication through a loop back TCP/IP address for monitoring purposes.

Abstract: Methods and systems for generating computer-executable code are provided. Feature diagrams are utilized to help produce deterministic statecharts. Design choices and changes are accomplished by entering modifications to feature diagrams. The feature diagrams are associated with statecharts and as the feature diagrams are modified corresponding changes are made to the associated statecharts, producing deterministic statecharts. Once all the chosen modifications to the feature diagram(s) have been performed, the resulting, newly-created statechart(s) will be deterministic and can be advantageously utilized to generate computer-executable code. Computer-executable code can be generated that is useful for implemented real-time control systems, including real-time systems for controlling semiconductor equipment.

Abstract: An invention is provided for asynchronous transfer of control. An asynchronous interrupt exception is received, and in response, the value of a reference counter is determined. The value of the reference counter is based on the execution of synchronized code. Generally, the reference counter is initialized to a predetermined number, and altered based on the execution of synchronized code. When the asynchronous interrupt exception is received, the method is asynchronously interrupted when the value of the reference counter is equal to the predetermined number.

Abstract: A automated run-to-run controller for controlling manufacturing processes comprises set of processing tools, a set of metrology tools for taking metrology measurements from the processing tools, and a supervising station for managing and controlling the processing tools. The supervising station comprises an interface for receiving metrology data from the metrology tools and a number of variable parameter tables, one for each of the processing tools, collectively associated with a manufacturing process recipe. The supervising station also includes one or more internal models which relate received metrology data to one or more variables for a processing tool, and which can modify variables stored in the variable parameter table to control the process tools using feedback and/or feed-forward control algorithms. Feed-forward control algorithms may, in certain embodiments, be used to adjust process targets for closed loop feedback control.

Abstract: In an ECU for vehicles, a clock IC operates with sub power and measures time continuously irrespective of whether a microcomputer is operating. The microcomputer determines whether the clock IC has been reset on the basis of a history indicating that the sub power has fallen below a data holding voltage of an SRAM which also operates on the sub power. Alternatively, the microcomputer determines whether the clock IC has been reset by checking data held in the SRAM. The microcomputer determines failure of a water temperature sensor from a soak time calculated from time data from the clock IC and a detection value of the water temperature sensor on restarting of the engine. When the clock IC has been reset, the microcomputer prohibits this failure determination of the water temperature sensor.

Abstract: A method of detecting illegal execution of code sequences includes the steps of: setting an active identifier to a first sequence identifier of a first code sequence, executing at least part of the first code sequence, calling, from the first code sequence, a second code sequence having a second sequence identifier, providing (20) a caller sequence identifier and a callee sequence identifier, checking (21) whether the callee sequence identifier is the same as the second sequence identifier, checking (23) whether the caller sequence identifier is the same as the active identifier, and generating (27) an alarm signal if either of the checks provide incorrect results.

Abstract: An arrangement and method for switching a single destination data channel to a different destination without losing any data messages. Such a switch is required, for example, when a switch is made to a standby control unit and the messages originally destined for the original active control unit must be sent to the standby. Received messages are drained from the source prior to making the switch. Appropriate data is copied from the active unit to the standby so that the standby unit is in a state to start accepting newly queued messages from the source.

Abstract: A watchdog monitor coupled to a device bus includes in at least one executable software the ability to produce, during each frame interval, a strobe addressing a predetermined number to the monitor. The monitor responds to the interrupt and to lack of arrival of the correct predetermined number by generating a fault flag. The monitor also runs an internal counter which is reset at each interrupt signal; the count of the internal counter exceeds a threshold count if an interrupt fails to arrive. Such a timed failure results in setting of a frame fault flag. The monitor further runs an internal clock independent of the system clock. A further missing pulse detector initiates a counter at each monitor clock pulse, and raises a flag if the monitor clock counter counts a duration exceeding the monitor inter-clock-pulse interval.

Abstract: A single processor system features independent multiple watchdog units allocated to a processor unit of the system, the watchdog units operable to monitor for system faults and, upon detecting a fault, further operative to place the processor system into a predetermined fault reaction state. The multiple watchdog units are each provided with respective different watchdog calls which are output to the processor unit depending upon program execution.

Abstract: A system comprises a first device and a second device. The first device operates in a power management environment and has a sleep status signal for indicating a sleep status to the second device. The sleep status indicates if the first device is in a sleep state or normal operation state. The second device is coupled to the first device and checks for malfunctions of the first device. The second device only checks for malfunctions of the first device if the first device is in the normal operation state.

Abstract: A microcomputer is not stopped to be monitored even in a state in which a wrong standby signal is detected. A watchdog circuit 34 outputs a starting signal to a microcomputer 30. An output signal Q of a determination circuit 36 is reset by this starting signal. If the determination circuit does not detect a standby signal st when a clock signal CK is input from the started microcomputer, the output signal Q is set. However, if the determination circuit detects the standby signal st, the output signal is held in a reset state. Even if the standby signal st is input, because an AND circuit 38 does not output a standby signal ST due to the reset of the output signal Q, the watchdog circuit is prevented from entering a standby mode by the standby signal st.

Abstract: A method and system for handling real-time indications of resource scheduling conflicts. In one embodiment, the method includes a computer system including a user interface, display, processor, and some form of memory. Contained within the memory is a resource scheduling process that analyzes resource data, scheduling criteria, and work parameters to create a working schedule. In conjunction with the creation of a working schedule, the scheduling process detects resource conflicts that can inhibit the schedule's functionality. Once detected an identification process conveys the error to the user concurrently with the schedule process to provide the user with a real-time indication of resource conflicts. The indication is presented in an unobtrusive manner so as to not interfere or impede the scheduling process. In addition, should the specific resource causing the conflict be identifiable, the indication process conveys that information in a similar real-time methodology.

Abstract: A microcomputer is not stopped to be monitored even in a state in which a wrong standby signal is detected.

Abstract: In a computer system having a first repeater and a second repeater, the first repeater coupled to the second repeater by a bus, the first repeater operable to transmit a transaction and a control signal to the second repeater, a method, performed by the second repeater, of generating an error comprising: predicting, in a first cycle, that a transaction should be transmitted from the first repeater to the second repeater; determining if a control signal was received within a predetermined number of cycles of the first cycle; and if the control signal is not received within the predetermined number of cycles of the first cycle, then generating an error.

Abstract: A method and system for forming a new cluster of servers having state data that is consistent with the state data of a cluster that previously existed. The previous cluster preserves its state data by recording transactions to a log file in conjunction with a sequence number maintained by each node. The node that recorded the transaction then increments its copy of the sequence number and attempts to replicate the transaction to other nodes of the cluster. If the transaction is replicated, each other node commits the transaction and increments its sequence number. If the node fails before it can replicate the transaction, then no other nodes will increment their sequence numbers, whereby the next logged transaction has the same sequence number as the previously logged, but orphaned replicated transaction. When a new node forms a cluster, it unrolls the log file so as to become consistent with the state of the previous cluster.

Abstract: A method is provided to prevent flash memory in a computer system from being miswritten. According to this method, a control parameter records the normal paths of a process module. Then a judge module decides whether or not the flash memory is to be written. When the judge module decides the flash memory is to be written, a prepare module conducts preparations for the flash memory. Then a check module is provided to confirm the normal paths from the process module in response to the control parameter, and a write module is provided to write the flash memory when the check module confirms the normal paths from the process module. An error module may be provided to restart the process module or the computer system or provide a warning signal when the check module does not confirm the normal paths from the process module.

Abstract: A method and an apparatus for controlling the operation of a digital processing system. In one example of a method of the invention, a first status indicator is received for a first software program which is executing on the digital processing system, and it is determined whether the first software program is in a first state. In response to determining that the first software program is not in the first state, then a first predetermined function is performed. In one embodiment, several additional status indicators may be received, one for each of several software programs which are executing on the system. For each additional status indicator, it is determined whether the corresponding software program is in the first state, and if it is not in the first state, then a corresponding, predetermined function is performed, such as (for example) relaunching the corresponding software.

Abstract: According to the life-and-death monitoring method of monitoring, by any of a plurality of host computers connected to a common network, a life-or-death state of other host computer, a life-and-death monitoring packet including a table having a management order of a host computer to be managed, and an address and a check flag of the host computer is transmitted from a management host computer to any of the host computers to be managed, the host computer to be managed which has received the life-and-death monitoring packet checks a check flag of the table in which its own address is registered, and the host computer to be managed which has completed the checking transmits the life-and-death monitoring packet to a subsequent host computer to be managed according to the management order of the table.