Abstract: A microcomputer is not stopped to be monitored even in a state in which a wrong standby signal is detected. A watchdog circuit 34 outputs a starting signal to a microcomputer 30. An output signal Q of a determination circuit 36 is reset by this starting signal. If the determination circuit does not detect a standby signal st when a clock signal CK is input from the started microcomputer, the output signal Q is set. However, if the determination circuit detects the standby signal st, the output signal is held in a reset state. Even if the standby signal st is input, because an AND circuit 38 does not output a standby signal ST due to the reset of the output signal Q, the watchdog circuit is prevented from entering a standby mode by the standby signal st.

Abstract: The present invention provides a system, apparatus, and method for managing a data storage system in n-way active controller configuration, such that a controller can detect the failure of and reset more than just a single other controller. To accomplish this, a controller sends a ping message to at least a subset of the other controllers, and waits for any of the other controllers to respond to the ping message within a first predetermined amount of time. If any of the other controllers do not respond to the ping message within the first predetermined amount of time, it is determined that the non-responding controller has failed. The controller will reset any failed controller.

Abstract: Disclosed is a method and device adapter for managing devices in a data processing system that includes a plurality of device adapters connected for independent communication with at least one shared device (e.g. disk data storage device). The method comprises the steps of: issuing a command from a first of the plurality of adapters to the at least one shared device; setting, in the first adapter, first and second timeouts associated with the command; on expiration of the first timeout value, issuing a message from said first adapter to other(s) of the plurality of adapters to request the other adapter(s) to notify the first adapter of any work requested of the shared device by the other adapter(s); and on expiration of the second timeout value, initiating a recovery operation in the data processing system.

Abstract: A watchdog circuit (WD) monitors the function of the processor (MC) in that the processor (MC) outputs a cyclically repeating test signal to the watchdog circuit (WD), and the watchdog circuit (WD) generates a reset signal (RST) for the processor (MC) if the test signal (WDS) does not appear in a time slot (S1, S2) specified by the watchdog circuit (WD). The width of the time slot (S1, S2) can be increased in the starting phase of a program sequence of the processor (MC).

Abstract: A system for measuring timing margins in an interface between a core and an input/output device on a chipset. In order to measure the amount of available variation in data and strobe signals, delay lines are introduced so that the data and strobe signals may be varied in relation to each other. By incrementally changing the delay and hence the time difference between the two signals, it is possible to determine the allowable variation when the device fails to operate. By providing delays on both sides, it is possible to determine the timing margin on both the setup and hold of the signals.

Abstract: A watchdog circuit (WD) monitors the function of the processor (MC) in that the processor (MC) outputs a cyclically repeating test signal to the watchdog circuit (WD), and the watchdog circuit (WD) generates a reset signal (RST) for the processor (MC) if the test signal (WDS) does not appear in a time slot (S1, S2) specified by the watchdog circuit (WD). The width of the time slot (S1, S2) can be increased in the starting phase of a program sequence of the processor (MC).

Abstract: A session manager has a session timeout mechanism to selectively timeout client-server sessions. The session timeout mechanism has multiple timeout buckets to hold corresponding groups of sessions according to the sessions' timeout periods. Sessions located in different ones of the timeout buckets are set to timeout at different times. The session manager also has a session timeout clock that is incremented every predetermined time unit (e.g., every minute). The session timeout clock maintains a pointer to one of the timeout buckets and advances that pointer with each clock increment. The session timeout clock advances the pointer through all of the timeout buckets, one bucket at a time. The session timeout clock advances the pointer repeatedly through all the buckets. The cycle time for the session timeout clock to reference every timeout bucket is equal to the incremental time unit multiplied by the number of buckets.

Abstract: A failure supervising method and apparatus are disclosed. Simply with a WDT by which a system is interrupted after the WDT goes time out, the system would stop in a serious case where the failure cannot be recovered from by the interruption alone. A plurality of stages of WDTs are operatively interlocked, and the interlocked WDTs interrupt the system strongly progressively in each of the stages. A small failure recoverable by an interrupt is recovered by an interrupt, a middle failure not recoverable by other than a non-maskable interrupt is recovered by a non-maskable interrupt, and a serious failure not recoverable by other than reactivation is recovered by resetting the system.

Abstract: An on-chip watchdog circuit is provided that generates an output signal when an error signal generated by a circuit under test is detected. The on-chip watchdog circuit comprises a logic gate that is connected to a clock signal and receives a signal in response to the error signal generated by the circuit under test. A gate output circuit is connected to an output of the logic gate. An RC circuit is connected to the gate output circuit. A voltage divider is connected to the RC circuit. A comparator is connected to the voltage divider and provides the output signal in response to the error signal generated by the circuit under test, and the on-chip watchdog circuit and the circuit under test are integrated on a same semiconductor microchip.

Abstract: A method and an apparatus for controlling the operation of a digital processing system. In one example of a method of the invention, a first status indicator is received for a first software program which is executing on the digital processing system, and it is determined whether the first software program is in a first state. In response to determining that the first software program is not in the first state, then a first predetermined function is performed. In one embodiment, several additional status indicators may be received, one for each of several software programs which are executing on the system. For each additional status indicator, it is determined whether the corresponding software program is in the first state, and if it is not in the first state, then a corresponding, predetermined function is performed, such as (for example) relaunching the corresponding software.

Abstract: A processor for executing several functions. The processor has access to an addressable space including memories for program and for data and input/output registers. The method of operation includes the allocation of a right of access to each function, the dividing of the addressable space and of partitions, each associated with the access right of a function, and the dividing of the time of use of the processor into cyclic time slices associated with the access right of a function. At the start of each new time slice, it is confirmed that the processor has terminated the execution of the previous function. The method further includes the activation of the tasks of the corresponding function. During each access by a processor to an addressable area, the access right of the current time slice is compared with that associated with the accessed are, with an error signal being transmitted in case of an inconsistency.

Abstract: The invention relates to a method for resetting a processor, and a watchdog for generating a reset pulse to a processor which can initialize itself and which sends acknowledgement pulses at predetermined intervals to the watchdog comprising transmission means (5) for generating and transmitting reset pulses to the processor. The watchdog comprises counter means (7) for counting the number of reset pulses generated during initialization and for setting a predetermined limit value to reset pulses. The watchdog further comprises measuring means (4) for measuring the interval between acknowledgement pulses sent by the processor. In addition, the watchdog comprises transmission means (5) for transmitting a reset pulse when the interval between acknowledgement pulses differs from a predetermined interval.

Abstract: The invention relates to a method for transporting data between application programs assigned to different interconnected computers of a computer network, the method being based on a connectionless and packet-oriented transport method capable of transporting the data packets between application programs. When a data packet is transmitted from the application program of a source computer to that of the destination computer, a retransmission timer (RT) and an acknowledgement timer (QT) are initiated. After the data packet has been initially received, it is transferred to the application program of the destination computer. Each time the destination computer receives a data packet, an acknowledgement packet is transmitted back to the source computer, confirming receipt of the data packet.

Abstract: The present invention relates to a method and apparatus for ensuring fault detection and system recovery in a multiprocessor computing system. This system comprises a multitude of processing element modules, input/output processor modules and shared memory modules. Each module within the system includes an identical period sanity timer capable to reset the module once a predetermined limit count is reached. If a global clear signal is not received from the operating system scheduler by all modules prior to the expiry of the sanity timers, a system-wide reset is effected. Each processing element module within the system further includes a watchdog timer capable to reset the module once a predetermined limit count is reached. If a process is not run by the operating system scheduler on the processing element before the expiry of the watchdog timer, effectively clearing the watchdog timer, the processing element is reset and removed from service.

Abstract: A new control circuit for a watchdog timer which is incorporated on the same integrated circuit as a microprocessor or microcontroller. The control circuit permits either permanent or software enablement or disablement of the watchdog timer depending on the operating mode of the microprocessor.

Abstract: A method and an apparatus for controlling the operation of a digital processing system. In one example of a method of the invention, a request is repeatedly generated for the digital processing system, and a response to the request is normally provided by the digital processing system when it is not in a default state (e.g. when not crashed). If the digital processing system is in a default state then no response is provided, and a control device automatically restarts the digital processing system. In another example of a method of the invention, a status indicator is, when the system is not in a fault state, repeatedly sent to a control device. This status indicator resets a counter in the control device, thereby preventing the counter from reaching a predetermined value. If the counter reaches the predetermined value, then the control device automatically restarts the digital processing system.

Abstract: An apparatus and method are disclosed for initiating automatic recovery from a signal loss. A frequency division circuit receives a system clock signal, and generates an output signal having a lower frequency than the clock signal. An input detection circuit receives an asynchronous input signal from an external source and outputs a third output signal that indicates whether or not the asynchronous input signal is present or absent within a prescribed detection interval. A recovery circuit receives the system clock signal and the third output signal, and outputs a recovery signal that indicates a loss of the asynchronous input signal over a predetermined length of time. The recovery signal is used as a trigger to initiate a recovery process by the system.

Abstract: The present invention utilizes a test circuit for receiving a reference clock signal and a sense clock signal and subsequently determining whether or not the reference and sense clock signals are either correct multiples of each other and/or in phase with each other. The test circuit may be located on the same chip with the microprocessor and the clock circuitry. The clock circuitry may include a phase locked loop (“PLL”) circuit for receiving the reference clock signal and producing a sense clock signal for use by the remainder of the chip, wherein the sense clock signal is a multiple of the reference clock signal. The test circuit may count the number of cycles of the sense clock signal occurring within a predetermined amount of time, which may be proportional to the reference clock period. Alternatively, the sense clock signal and the reference clock signal may be passed through an XOR circuit and then the number of cycles counted within a predetermined time period.

Abstract: Untrusted executable code programs (applets or controls) are written in native, directly executable code. The executable code is loaded into a pre-allocated memory range (sandbox) from which references to outside memory are severely restricted by checks (sniff code) added to the executable code. Conventional application-program interface (API) calls in the untrusted code are replaced with translation-code modules (thunks) that allow the executable code to access the host operating system, while preventing breaches of the host system's security. Static links in the code are replaced by calls to thunk modules. When an API call is made during execution, control transfers to the thunk, which determines whether the API call is one which should be allowed to execute on the operating system.

Abstract: A processor-oriented device provides a watchdog timer having a test mode programmable reset. When the device is placed in a test mode by pulling a test mode hardware pin during a reset of the timer and then an appropriate write key is provided to the timer, a watchdog timer reset count is writeable, allowing for a programmable duration for a watchdog timer reset. The watchdog timer reset count may be a reset duration value maintained by a watchdog timer reset counter. Based on both a test mode signal from watchdog timer test mode enable logic and a write key, watchdog timer reset write enable logic enables writes to the watchdog timer reset count.

Abstract: A microcomputer (10) is proposed, which includes a central processing unit (11), a non-volatile memory (13), a volatile memory (14), a monitoring circuit (12) and also an input/output unit (16). Two different operating states are possible in the microcomputer (10). In the first operating state, the microcomputer executes a program which is located in the non-volatile memory (13). In the second operating state, the microcomputer (10) executes a program which is located in the volatile memory (14). The monitoring circuit (12) effects a resetting of the microcomputer (10) whenever it does not receive a monitoring signal for a predetermined time (watchdog timer). The microcomputer is distinguished in that it includes an element for suppressing monitoring signals which are always active whenever the microcomputer (10) is operating in the second operating state.

Abstract: Reliably detecting malfunction of an abnormality-monitoring circuit during operation of a processing unit. An electronic control unit provided with a CPU level-inverts and outputs an actuating signal during each iteration of a base routine. An abnormality-monitoring circuit clocks a fall interval of the actuating signal as charging voltage of a gradually discharged capacitor, and outputs a reset signal to the CPU when this charging voltage falls to a defined value. When a check-starting condition is fulfilled, the CPU inhibits a subsequent level inversion of the actuating signal until a predetermined time elapses after a prior level inversion. When the signal inhibition is canceled, when the charging voltage VC of the capacitor is not within a reference range (VL-VH), the CPU determines the abnormality-monitoring circuit to have malfunctioned.

Abstract: In a data processing system, the startup time (Tj) of the system (S) is measured for configurations (j) and parameters are determined relative to the maximum quantity (n) of various types of hardware from measurements performed on the system, so as to be able to deduce, by calculation and from a formula containing the parameters, the startup time (Tq) relative to any configuration (q) of the data processing system (S).

Abstract: An electronic control unit for a car in which a control portion operates in accordance with signals given from a plurality of input portions including a car ignition switch to thereby perform drive control of a predetermined output portion, the control portion having a sleep function by which the control portion stops when the control portion in not required to operate, comprises a watchdog circuit for watching the operation of the control portion; and a conditioning circuit for defining a condition for starting the watchdog circuit; the conditioning circuit being constituted by an OR circuit for performing the logical sum OR among at least two signal inputs from the input portions and a signal input indicating the fact that the control portion is operating.

Abstract: A command execution monitoring system includes a first unit which retains control parameters of an operation control command sent by one of host computers, the control parameters including an operation completion time. A second unit sequentially receives command entries sent for input/output devices by the host computers and retains the command entries in a table, each entry including a relative elapsed time measured from a time the entry is retained in the table. A third unit sets a time-out period of one of the host computers at the operation completion time retained by the first unit, so that execution of each of the entries in the table of the second unit is monitored based on a comparison between each of the relative elapsed times of the entries and the operation completion time.

Abstract: A microcontroller-based device according to the present invention provides a watchdog timer having an emulator support mode for disabling and reconfiguring time-outs. When the watchdog timer is placed in the emulator support mode, the watchdog timer is inhibited from counting. In a disclosed embodiment, the watchdog timer is inhibited from counting by deasserting a count enable signal. A watchdog time-out is thus prevented from occurring during the emulator support mode. Also, during the emulator support mode, the watchdog timer control register is writable, allowing the emulator to disable a watchdog timer, enable the timer, or program a new time-out value for the timer. The watchdog timer control register is writable regardless of the state of the enable bit of the timer.

Abstract: A system and method for providing a trusted machine state in a data processing system is disclosed. The data processing system includes a memory. The trusted machine state is stored in a first portion of the memory. The method and system include saving the trusted machine state in a second portion of the memory and reinitializing a portion of the memory. The portion of memory is separate from the second of memory. The method and system further include restoring the trusted machine state in the memory. According to the method and system disclosed herein, the data processing system may recover from failures and resume operation. Moreover, a non-disruptive code load, in which a new program can be loaded without disrupting system operations, may be performed.

Abstract: Even in the case of a full hang state where a command to reset software is entirely ineffective, memory dump can be stored even if there is no in-circuit emulator. An HDD itself monitors a command execution time, that is, the time between reception of a command from a host computer and completion of the process of the command. If the HDD judges that it has taken an abnormally long time, a memory dump will be automatically stored on a reserved area on a disk. The memory dump can be read out from the disk at any time so that an analysis can be made.

Abstract: A watchdog timer for a computer with a CPU and a peripheral controller. The watchdog timer includes a program in the peripheral controller and a corresponding program in the peripheral interrupt service routine of the CPU. When the watchdog timer function is enabled, the peripheral controller will interrupt the CPU periodically and check the response from the CPU. If the CPU is not responding, or wrong data is returned from the CPU, the peripheral controller will generate a reset signal to reset the CPU and reboot the system.

Abstract: In a method of checking an apparatus, failure time intervals of sections of an apparatus are divided into a plurality of failure time interval groups, each of which is indicated by a specific failure time interval. A plurality of check programs are classified into a plurality of groups corresponding to the plurality of failure time interval groups based on the failure time interval of the section corresponding to each of the plurality of check programs. A group execution time interval of each of the plurality of groups is determined based on the specific failure time interval. Then, each of the plurality of groups is executed based on the group execution time interval.

Abstract: Each member system of a distributed collection of self-monitoring hardware systems includes receiving logic operative to receive a wellness token from a first other hardware system of the distributed collection of hardware systems. Each member system also includes modification logic, communicatively coupled to the receiving logic, operative to modify the wellness token to create a modified wellness token in a manner that reflects the wellness of the member hardware system, and transmitting logic, communicatively coupled to the modification logic, operative to transmit the modified wellness token to a second other hardware system of the distributed collection of hardware systems.

Abstract: Accompanied by turning on power, power ON reset pulse from a power ON reset generation circuit is input to CPU and a fail determining circuit. After receiving the power ON reset pulse, the fail determining circuit intentionally outputs a fail detection signal. The CPU intentionally stops output of PRUN signal after confirming that fail detection signal. WDT confirms that output of the PRUN signal from the CPU is stopped in a predetermined time interval T and outputs PRUN abnormality signal. A reset pulse generation circuit confirms that PRUN abnormality signal is supplied from the WDT and outputs a reset pulse. A fail determining circuit receives a reset pulse and stops output of fail detection signal. When the fail determining circuit stops output of the fail detection signal, the CPU determines that the WDT, the reset pulse generation circuit and the fail determining circuit are in normal state.

Abstract: Method and system aspects for monitoring computer system operations are provided. A computer system including a processor, the processor supporting firmware and a running operating system, and a service processor coupled to the processor, is monitored by initiating surveillance of the computer system in the firmware when an architected function occurs in the operating system. Monitoring additionally includes providing a pulse indicator from the firmware to the service processor and determining a status of computer system operations with the service processor based on a frequency of the pulse indicator.

Abstract: A computer system, program product and method enhances the operation of a communications protocol by monitoring timers associated with the protocol to determine the transmission requirements placed on a transmit queue. The number of frames to be enqueued at a particular system tick is dynamically modified to prevent queue overload. In one embodiment the expiration of timers is adjusted to prevent queue overload. In another embodiment, frame transmission at timer expiry is adjusted to prevent queue overload.

Abstract: There is provided a hot-carrier-delay-degradation estimation method of estimating, based on the actual operation of an LSI, deterioration in reliability thereof due to the influence of hot carriers. At a delay calculation step, there are calculated, for the cells of an LSI serving as the object of timing verification, delays, input slew and output load capacitances based on circuit information and a delay library containing delay parameters. At a delay degradation library generation step, there is generated a delay degradation library containing delay parameters at the time when the LSI has operated for a predetermined period of time.

Abstract: A CPU (central processing unit) including an instruction processor and a data processor is connected with a ROM (read only memory) bus, a RAM (random access memory) bus, and an IO (input-output) bus for inputting/outputting data independently of the ROM and RAM buses. A rewritable register included in a memory access controller stores a set value of the number of wait cycles in an access to a ROM, a set value of the number of wait cycles in an access to a RAM, and a set value for switching an input path in the data processor. These set values can be varied according to a cycle time of a CPU clock signal. In accordance with these set values, insertion of wait cycles in the instruction processor and the data processor is controlled, and it is determined whether or not an input of the data processor is latched.

Abstract: A timer is periodically reset by a software agent executing on a processor. If the timer is not reset within a predetermined period of time, an interrupt is generated. An interrupt handler then periodically resets the timer, and if the timer is not reset within an additional predetermined period of time, the computer system is partially reset.

Abstract: A power-on reset circuit comprises an oscillation circuit, an oscillation end detection circuit, a voltage stabilizer for generating a predetermined voltage (VDD2) from a power-supply voltage (VDD), and a start-up circuit. The power-on reset circuit further comprises a latched circuit. While the power is rising, the latched circuit becomes of an initial state and outputs a signal for arranging the latched circuit to a power-on reset state. When a value of the VDD becomes more than the value of the VDD2, by which the VDD2 becomes of a stable state, the initial state of the latched circuit is canceled, while as the VDD becomes stable, the oscillation circuit starts the oscillation in order to arrange the latched circuit to a set state, thus outputting a signal for canceling the power-on reset state.

Abstract: A system, method and apparatus including a logic module, preferably embodied as an electronic card that operates in combination with a PC to correct errors caused by deficiencies existing in logic residing on the PC's motherboard, such as the PC's BIOS. The preferred logic card includes a transceiver module, a memory module (e.g. an EPROM or Masked ROM) containing storage elements and executable code stored as pages. The preferred logic card also includes a page register module in communication with the transceiver and the memory, and a paging mechanism that cooperates with the page register and the transceiver for allowing only a predetermined number of bytes (pages) of executable code to be accessible for operation in the PC's main-memory in order to correct errors caused by deficiencies existing in logic residing on the PC's motherboard.

Abstract: A technique for protecting an electronic system having a programmable input/output interface from erroneous operation due to static electricity includes the steps of: (a) setting an internal timer for continuously resetting a program state of the input/output interface at a predetermined time interval; (b) storing a present program state of the input/output interface after setting the timer; (c) resetting the stored program state of the input/output interface when a value of a driven timer corresponds to a value of the set timer after storing the present program state of the input/output interface; (d) repeatedly resetting the program state of the input/output interface by driving again the timer after resetting the program state of the input/output interface.

Abstract: Failures in a fault-tolerant computer system which includes two or more input/output processors connected to a data communication system are detected by monitoring data communication. The computer system is able to detect failures associated with a primary input/output processor, as well as with a standby input/output processors, and is also able to discriminate between failures of the input/output processors and communication failures in the data communication network itself. In addition to using heartbeat-like transmissions, various other categories of data communication are also used to detect failures. The system is able to detect failures when the input/output processors are on a common network segment, allowing the processors to monitor identical data traffic, as well as when the processors are on different segments where, as a result of filtering behavior of network elements such as active hubs, the processors may not be able to monitor identical data traffic.

Abstract: A timeout monitoring system including plural timeout value setting mechanisms, each of which sets a timeout value as a result of the start-up. Also included is plural timeout monitoring mechanisms, each of which do not start the timeout value setting mechanism at the following stage but stop it, when the timeout value set by the timeout value setting mechanism at the preceding stage is not set again even after a specific time has elapsed. A watchdog timer outputs an abnormality notice, when the timeout value set by the timeout value setting mechanism at the last stage is not set again even after a specific time has elapsed. Hierarchizing the software of the watchdog timer makes it possible to set a suitable timeout value in the watchdog timer for a higher-speed sensing of timeout and monitor the timeouts of plural systems at plural levels, which improves the monitoring capability.

Abstract: Apparatus and a method for monitoring the time for a computer to process a process associated with an interrupt asserted on a system bus. When the interrupt is asserted, a time stamp value and data associated with the interrupt are stored in one of a plurality of registers. The data associated with the interrupt include an identification of the type of interrupt, the bus, and a device asserting the interrupt. Whenever a time stamp value and associated data are stored in a register, a flag is set ON to indicate information is stored therein. The time stamp value and associated data are stored in an overflow register if every other register is in use. A latency value for the interrupt is determined from the difference between the time stamp value stored in a register and the time when processing of the interrupt process is complete.