Method of handling errors in software

• US 5,291,494 A
• Filed: 11/18/1992
• Issued: 03/01/1994
• Est. Priority Date: 08/01/1989
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Digital Equipment Corporation (HP Inc.)
• Inventors: Bissett, Thomas D., Bruckert, William F., Melvin, James
• Primary Examiner(s): Beausouel, Jr., Robert W.
• Assistant Examiner(s): CHUNG, PHUNG M
• Application Number:
  US07/978,053
• Time in Patent Office: 468 Days
• Field of Search: 371/11.3, 371/16.1, 371/19.1, 371/12, 371/68.3, 364/281, 364/9 MS, 364/268.4 MS, 364/268.9 MS, 364/269.2 MS, 364/266.4
• US Class Current: 714/24
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1415 at system level
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2205 using arrangements specific to the hardware being tested
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment

Abstract

The software error handling determines the nature of the fault and takes different action depending upon the nature of the fault. If the fault prevents the data processing system from continued reliable operation, then the element causing the fault is immediately disabled. Otherwise, the element which is the source of the fault is treated so that it does no harm to the system and causes no further faults. The element can then be completely handled during normal software status checks.

Claims

1. In a data processing system containing a plurality of individually identifiable data processing modules which allow the data processing system to execute data processing operations, a method of recovery from faults occurring in the modules comprising the steps of:

detecting a presence of a fault caused by one of the data processing modules during the execution of one of the data processing operations; and

performing a fault processing routine in the data processing system including the substeps of

identifying as a faulting module the one of the data processing modules that caused the detected fault,

identifying a nature of the fault,

determining, from the nature of the fault, whether the data processing system is capable of continuing operation reliably despite the presence of the fault,

disabling the faulting module from further operation with the data processing system if the data processing system is not capable of continuing operation reliably because of the fault, and

preventing the faulting module from causing additional faults without disabling the faulting module if the data processing system is capable of continuing operation reliably despite the fault.

2. The method according to claim 1 further including the step of

resuming execution of data processing operations by said data processing system after disabling the faulting module from further operation with the data processing system.

3. The method according to claim 1 further including the step of

resuming execution of data processing operations by said data processing system after preventing said faulting module from causing additional faults.

4. The method according to claim 1 further including the step of

reconfiguring said data processing system to bypass said faulting module after the faulting module has been disabled from further operation with the data processing system.

5. The method according to claim 1 wherein said step of disabling the faulting module from further operation with the data processing system includes the substep of

disabling all signal paths between said data processing system and said faulting module.

6. The method according to claim 1 wherein the faulting one of the data processing modules is a CPU module which includes a CPU, and

wherein the step of determining whether the data processing system is capable of continuing operation reliably despite the presence of the fault includes the substep of

determining whether the fault was caused by the CPU module.

7. The method according to claim 6 wherein the step of disabling the faulting module from further operation with the data processing system if the data processing system is not capable of continuing operation reliably because of the fault includes the substep of

disabling the CPU module if the fault was caused by the CPU module and the fault indicates a malfunction of the CPU.

8. The method according to claim 1 wherein the faulting one of the modules is a memory module which includes a memory, and

wherein the step of determining whether the data processing system is capable of continuing operation reliably despite the presence of the fault includes the substep of

determining whether the fault was caused by the memory module.

9. The method according to claim 8 wherein the step of disabling the faulting module from further operation with the data processing system if the data processing system is not capable of continuing operation reliably because of the fault includes the substep of

disabling the memory module if the fault was caused by the memory module and the fault indicates a malfunction of the memory.

10. The method according to claim 1 wherein said step of determining whether the data processing system is capable of continuing operation reliably includes the substeps of

comparing a number of times the faulting module has caused a fault to a predetermined threshold number, and

deeming that the data processing system is not capable of continuing operation reliably if a number of faults caused by the faulting module exceeds said predetermined number.

11. The method of claim 1 wherein the data processing system includes a memory, and

wherein the step of preventing said faulting module from causing additional faults if the data processing system is capable of continuing operation reliably despite the fault includes the substep of

preventing said faulting module from changing a content of the memory.

12. The method of claim 1 wherein the data processing system includes a memory, and

wherein the step of preventing said faulting module from causing additional faults if the data processing system is capable of continuing operation reliably despite the fault includes the substep of

generating a predetermined code if the faulting module attempts to read from said memory.

13. The method of claim 1 wherein the step of preventing said faulting module from causing additional faults if the data processing system is capable of continuing operation reliably despite the fault includes the substep of

setting a status indicator to indicate that the faulting module has caused a fault.

14. The method of claim 13 wherein the substep of setting said status indicator includes the substeps of:

executing prescheduled status checks of the status indicator; and

causing the data processing system to disable the faulting module during said status checks.

15. The method of claim 14 further including the step of:

ensuring that all faults caused by the faulting module have been reported prior to said prescheduled status checks.

16. The method of claim 15 wherein said step of ensuring that all faults caused by the faulting module have been reported prior to said prescheduled status checks includes the substep of:

executing a data processing operation that cannot be completed until prior fault reporting has been completed.

17. The method of claim 1 wherein the data processing system has a module address table correlating virtual device addresses referred to in the data processing operations to physical device addresses of actual ones of said data processing modules;

and

wherein the substep of preventing said faulting module from causing additional faults if the data processing system is capable of continuing operation reliably despite the fault includes the substep of

setting the physical device addresses corresponding to the virtual addresses of the faulting module to a value which corresponds to a physical device that does not generate faults.

18. The method of claim 14 wherein the data processing system has a module address table correlating virtual device addresses referred to in the data processing operations to physical device addresses of actual ones of said data processing modules;

and

wherein the substep of preventing said faulting module from causing additional faults if the data processing system is capable of continuing operation reliably despite the fault includes the substep of

setting the physical device addresses corresponding to the virtual addresses of the faulting module to a value which corresponds to a physical device that does not generate faults.

19. The method of claim 14 wherein the substep of executing prescheduled status checks of the status indicator includes the substep of checking a stored module status table.

20. The method of claim 1 wherein each data processing module includes a fault record for storing data regarding transactions occurring in the data processing system during the execution of the data processing instructions;

and

wherein said substep of identifying the faulting data processing module includes the substep of

evaluating the fault record to identify the faulting one of the data processing modules.

21. The method of claim 1 further including the step of

generating an interrupt indicating the presence of the fault.

22. The method of claim 21 including the step of performing an interrupt processing routine after a processing of a currently executing one of the data processing operations is complete, wherein the step of performing the fault processing routine occurs during the interrupt processing routine.

23. A method of recovering from faults occurring in a data processing system comprising the steps of:

detecting a presence of a fault in a first data processor of a pair of data processors in the data processing system, each of said data processors including a central processing unit, (CPU), means for controlling a memory, and a system bus interconnecting said CPU and said memory control means;

performing a fault processing routine in the data processing system including the substeps of;

identifying as a faulting data processor one of the pair of data processors in which the fault occurred;

identifying a nature of the fault;

determining from the nature of the fault whether the faulting data processor is capable of continuing operation reliable despite the presence of the fault;

disabling the pair of data processors from further operation with the data processing system if the faulting data processor is not capable of continuing operation reliably because of the fault; and

preventing the faulting data processor from causing additional faults without disabling the faulting data processor if the data processing system is capable of continuing operation reliably despite the fault.

24. The method according to claim 23 further including the step of:

resuming execution of data processing operations by said data processing system after said step of disabling the pair of data processors having the faulting data processor from further operation with the data processing system.

25. The method according to claim 23 further including the step of:

resuming execution of data processing operations by said data processing system after preventing said faulting data processor of the pair of data processors from causing additional faults.

26. The method according to claim 23 wherein during the step of detecting a presence of a fault, each of said pair of data processors is processing identical instructions.

27. A method of recovering from faults occurring in a data processing system comprising the steps of:

detecting a presence of a fault in a first zone of a dual zone data processing system with each zone including a pair of data processors, and each of said data processors including a CPU, means for controlling a memory, and a system bus interconnecting said CPU and said memory control means;

performing a fault processing routine in the data processing system including the substeps of;

identifying as a faulting zone the zone of the dual zone data processing system in which the fault occurred;

identifying a nature of the fault;

determining from the nature of the fault whether the data processing system is capable of continuing operation reliably despite the presence of a fault;

disabling the faulting zone from further operation with the data processing system if the faulting zone is not capable of reliably continuing operation with the data processing system because of the fault in the faulting zone; and

preventing the faulting zone from causing additional faults without disabling the faulting zone if the data processing system is capable of reliably continuing operation with the faulting zone despite the fault in the faulting zone.

28. The method according to claim 27 further including the step of:

resuming execution of data processing operations by said data processing system after disabling the faulting zone from further operation with the data processing system.

29. The method according to claim 27 further inclusing the step of:

resuming execution of data processing operations by said data processing system after preventing said faulting zone from causing additional faults.

30. The method according to claim 27 wherein during the step of detecting a presence of a fault, each data processing system of each zone is processing identical instructions and each of said pair of data processors of each data processing system is processing identical instructions.

31. The method according to claim 27 wherein each of said data processors, of each of said zones, further includes means for communicating between a first one of said CPUs in a first one of said zones and a corresponding first one of said CPUs in a second one of said zones.