Apparatus for recovery from failures in a multiprocessing system

• US 4,503,535 A
• Filed: 06/30/1982
• Issued: 03/05/1985
• Est. Priority Date: 06/30/1982
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Johnson, David B., Carson, David G., Peterson, Craig B., Cornish, Anthony L., Budde, David L.
• Primary Examiner(s): Smith, Jerry
• Assistant Examiner(s): Fleming, Michael R.
• Application Number:
  US06/393,906
• Time in Patent Office: 979 Days
• Field of Search: 364/200, 364/900, 371/11, 371/9, 371/10, 371/8
• US Class Current: 714/47.3
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0784 Routing of error reports, e.g. with a specific transmission path or data flow
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1637 using additional compare functionality in one or some but not all of the redundant processing components
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/1666 where the redundant component is memory or memory area
• CPC Class Codes: G06F 11/2002 where interconnections or communication control functionality are redundant flexible arrangements for bus networks involving redundancy H04L12/40176
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare

Abstract

A number of intelligent nodes (bus interface units-BIUs and memory control units-MCUs) are provided in a matrix composed of processor buses (105) with corresponding error-reporting and control lines (106); and memory buses (107) with corresponding error-reporting and control lines (108). Error-detection mechanisms deal with information flow occuring across area boundaries. Each node (100, 101, 102, 103) has means for logging errors and reporting errors on the error report lines (106, 108). If an error recurs the node at which the error exists initiates an error message which is received and repropagated on the error report lines by all nodes. The error message identifies the type of error and the node ID at which the error was detected. Confinement area isolation logic in a node isolates a faulty confinement area of which the node is a part, upon the condition that the node ID in an error report message identifies the node as a node which is a part of a faulty confinement area. Logic in the node reconfigures at least part of the system upon the condition that the node ID in the error report message identifies the node as a node which is part of a confinement area which should be recofigured to recover from the error reported in the error report message.

Claims

1. In a data processing system including, a number of bus interface unit (BIU) nodes and memory control unit (MCU) nodes and in which a switching matrix provides electrical interconnections between horizontal MACD buses and vertical ACD buses connected in said matrix by means of said BIU nodes located at the intersections of said MACD and ACD busses, said memory control unit (MCU) nodes connected to said MACD busses,

means for detecting an error,

an error-reporting matrix including horizontal Bus Error Report Lines (BERLs) and vertical Module Error Report Lines (MERLs),

said BERLs being associated with said MACD buses such that all BIU and MCU nodes sharing an MACD bus are connected with a pair of BERLs,

said MERLs being associated with said ACD buses such that all nodes sharing an ACD bus are connected with a MERL, and,

error-reporting means in a particular node connected to said means for detecting an error,

said error-reporting means including means for receiving error messages transmitted over at least said one BERL, and means for reporting error messages over at least said one BERL, said error messages identifying the type of error and the locations (ID) at which the error was detected, a recovery mechanism in said particular node comprising:

a recovery machine;

said recovery machine including first means for causing said particular node to become quiescent for a first timeout period to thereby wait for transients to subside, said first means including means for disabling the reporting of errors by said error-reporting means for the duration of said first timeout period;

said recovery machine including second means for causing said particular node to enter a second timeout period;

means for storing memory accesses;

means for generating memory accesses;

means connected to said second means, operative during said second timeout period, for retrying a memory access stored in said storing means;

permanent error determining means connected to said means for detecting an error, to said recovery means, and to said error reporting means, operative upon the condition that an error recurs during said second timeout period, for causing said error-reporting means in said particular node to propagate a permanent-error error report message, said error message identifying the type of error and the location (ID) at which the permanent error was detected; and

,

error report logging means in said particular node connected to at least one of said error report lines, for logging received error report messages propagated to said particular node.

2. The combination in accordance with claim 1 further comprising:

first registering means in said node for registering the ID of a resource with which said node is paired to provide a redundant resource;

comparison means connected to said first registering means and to said error reporting means for comparing said location ID in said received error report message with said registered ID of said resource; and

,

means responsive to said comparison means for activating said node upon the condition that said received error report message identifies, as a faulty resource, said resource with which said node is paired, to thereby cause said node to become active and take over operation for said faulty resource.

3. The combination in accordance with claim 2:

second registering means in said node for registering status information indicating that said node is or is not paired with a redundant resource;

third registering means in said node for registering the ID of said node;

said comparison means including means connected to said third registering means for comparing said location ID in said received error report message with said registered ID of said node; and

,

means connected to said comparison means and to said registering means for locking a damaged resource upon the conditions that said location ID in said error report message, logged after said second timeout period, identifies said particular node as a node which is part of a confinement area in which a module has failed and said second registering means indicates that said node is not paired with a redundant resource;

said locking means incuding means for generating a message which causes the affected resource to be marked as unavailable to further acceses to it.

4. The combination in accordance with claim 3 wherein said means for locking damaged resources further comprising:

means for monitoring memory access signals on said ACD bus, such that said BIU tracks the progress of memory access operations that span a memory bus to which said BIU is attached and a memory bus of another BIU with which said BIU is paired;

means responsive to the occurrence of this error situation (perm module error, my module, not married, MMA write, my half complete), the BIU which completed its part of the MMA write access must lock the memory location on its bus;

and wherein said means for generating a message included in said locking means which causes the affected resource to be marked as unavailable to further acceses to it includes means for issuing a Force Bad ECC (FBE) request on the MACD bus connected to said BIU, to thereby cause the MCU on said MACD bus to write a special ECC code into the addressed location,

whereby any subsequent requests to said addressed location are rejected because the special ECC code is interpreted as an uncorrectable error by said node thereby preventing any further accesses to said location.

5. The combination in accordance with claims 1, 2, 3, or 4 further comprising:

an arbitration mechanism in said node for use in arbitrating among access requests contending for use of said MACD bus;

signaling means for signaling between said nodes sharing said MACD bus;

each one of said nodes being assigned a unique logical node number;

said arbitration mechanism providing the means for granting access to said MACD bus to one of said nodes in response to a request for access to said bus, said arbitration mechanism in each of said nodes comprising;

an access request FIFO including a number of time-order slots for storing received access requests in the order that they are made; and

,

arbiter means responsive to said request for access to said MACD bus and to said signaling means connected between said nodes, for keeping multiple requests separated into said time-order slots in said FIFO such that all requests made by multiple nodes, in a particular time-order slot, are serviced before any requests in the next time-order slot; and

,

wherein said means connected to said second means, operative during said second timeout period, for retrying accesses which are outstanding, further comprises;

means for separating pending access requests into a first group which includes write-access types of requests and a second group which includes read-access types of requests;

means for placing an access request of said first group into a first time-order slot of said access request FIFO; and

,

means for placing an access request of said second group in said second slot of said access request FIFO;

so that all accesses in the first group will be completed before any access in the second group is completed;

whereby all writes will occur before reads, to thereby guarantee that all of the read requests will be responded to with consistent information.

6. The combination in accordance with claim 1 further comprising:

a memory module;

means connecting one of said MCU nodes to said memory module;

a first one of said MACD busses being a primary bus;

a second one of said MACD busses being a backup bus;

bus switching means connected to said one MCU node, to said primary bus, and to said backup bus, said bus switching means being operative such that when in a first state said bus switching means connects said primary bus to said one MCU node and when in a second state said bus switching means connects said backup bus to said one MCU node, said switching means being initially in said first state;

error report logging means in said one MCU node connected to at least one of said bus error report lines (BERLs), for logging error report messages propagated to said one MCU node;

said error report logging means in said one MCU node including comparison means for issuing a comparison signal upon the condition that an error report message received during said second timeout period identifies an error that is the same as an error identified in an error report message heceived before said first timeout period; and

,

resource reconfiguration means in said one MCU node connected to said logging means and to said bus switching means;

said resource reconfiguration means including means responsive to said comparison signal for setting said bus switching means to said second state to thereby switch said memory module to said backup bus such that said one MCU node identifies said backup bus as a new primary bus, to thereby provide for recovery from a permanent error occurring in the primary memory bus confinement area.