A maintenance arrangement responds to a false signal condition, produced by a data handling system, by recycling the timing generator controlling the data handling system to cause the signals in question to be repeated. In order to determine whether the false signal condition occurred only momentarily or remains present during the recycle operation, two types of detecting circuits are provided. Error detecting circuits respond if the false signal condition has a single occurrence, and does not remain present during the recycle operation and thus is interpreted as an error condition caused by the spurious introduction of noise pulses or the like, and fault detecting circuits respond if the false signal condition continues to be present or reappearing during the recycle operation to indicate a fault condition and to request other equipment to service the data handling system. Also, the maintenance arrangement designates the group of signals resulting in the false signal condition by storing group-identifying information in the memory of the data handling system so that the servicing equipment can determine the source of the problem. A register of the data handling system storing information relating to the group of signals resulting in the false condition is inhibited from being altered by the maintenance arrangement, which sets a freeze indicator in such a register so that all other information stored therein is preserved for use by the servicing equipment.
A quick freeze method and a clean freeze method allow for the halting of operation of all computing sections within a computing system upon detection of an error. In the quick freeze method, a first computing section detecting an error immediately halts operation. The first computing section notifies all adjacent computing sections of the detection of the error. Each computing section in the computing system, upon receiving notification of the detection of the error, immediately halts operation and notifies all adjacent computing sections of the detection of the error. In the clean freeze method, when a first computing section detects an error, all computing sections are notified of the detection of the error. When all computing sections of the computing system have been notified, all the computing sections within the computing system halt operation simultaneously. In order to allow for versatility, a computing system may be designed to allow the selection, at configuration, of either the clean freeze or the quick freeze method of halting operation of the computing system.
In order to gather, store temporarily and deliver (if needed) central processor safestore information, a multiphase clock is employed to capture (one full clock cycle behind) the safestore information which typically includes all software visible registers in all (or selected) data manipulation chips of the CPU by routing the safestore information through temporary storage (under the influence of the multiphase clock) in a cache data array and into a special purpose XRAM module. Thus, upon the sensing of a fault, valid safestore information is available in the XRAM for analysis and, if appropriate, resumption of operation at a sequential point just previous to that at which the fault occurred.
A channel unit is provided between a central computer and a peripheral and includes a plurality of registers for data transfer therebetween. In the event that an error occurs in one of the registers, a processor provided in the channel unit terminates a normal data transfer operation and freezes all the registers. A content of each of the freezed registers is stored, as the error information, into a memory which is provided in the channel unit. The central computer is advised of the error occurrence and issues a reset signal which releases the freezing of the registers. The channel unit receives an instruction, from the central computer, for transferring the error information stored in the memory. The error information stored in the memory is transferred to the central computer, via a data channel, in response to the instruction applied.
Error detection and fault isolation mechanisms generally require separate capture latches to capture every occurrence of an error (for example from a parity checker or timeout counter) and an associated mask latch to temporarily or permanently block further detection of the same error. In the claimed invention, the mask latch is replaced by a single error control mechanism which is able to set and reset the error capture latches. The detected error is held in the capture latch, thus preventing further error capture, until a signal from the single error control mechanism resets the latch.
A method and apparatus for recovery from a fault occurring within a computing system using a hardware recovery module comprising a microprocessor dedicated for recovery control and a memory for storing system states. A recovery counter counts machine instructions executed since a previously recorded initial checkpoint. Each time the CPU transfers information directly from an I/O controller or the cache memory the recovery module stores the data being transferred. Each time an interrupt is made to the CPU, the recovery module is notified of the interrupt, and it thereupon stores the count of machine instructions executed since the previously recorded initial checkpoint and information identifying the interrupt. When a fault is detected, the system is restored to the system state existing at the beginning of the checkpoint, and the processor synthetically executes the machine instructions originally executed after the initial checkpoint in a sequence substantially similar to the original sequence. During synthetic execution, the recovery module simulates the original inputs, suppresses outputs, and records completion of pre-fault I/O requests. Synthetic execution is abandoned when the instruction point at which the fault was detected is reached, true execution resumes, and the recovery module thereafter simulates the completion of pre-fault I/O requests.
