Fault recovery in systems utilizing redundant processor arrangements

Claim 2

Apparatus for use in a system comprised of a first processing system and a second processing system, the first and second processing systems being redundant processing systems whereby one of the first and second processing systems is an active processing system and the other one of the first and second processing systems is a standby processing system, the apparatus being used to prevent endless switchovers between the active processing system and the standby processing system, a switchover being an event wherein the active processing system becomes the standby processing system and vice versa, wherein the first processing system is associated with a first watch dog timer (WDT) and the second processing system is associated with a second WDT, wherein each of the first and second processing systems attempts to reset the WDT associated therewith within a predetermined period of time, and wherein the WDT associated with each processing system sends a restart signal to that processing system if the WDT has not been reset thereby, the apparatus comprising: each of the WDTs further comprising means for outputting a YESORNO-OK signal which indicates whether or not the WDT has issued a restart signal and for applying the YESORNO-OK signal from both of the WDTs to switchover control logic means; the switchover control logic means being means, in response to the YESORNO-OK signals from both of the WDTs, for generating at least one switchover signal to cause a switchover wherein the active processing system becomes the standby processing system and vice versa if the YESORNO-OK signal from the WDT associated with the active processing system indicates that the active processing system has issued a restart signal and the YESORNO-OK signal from the WDT associated with the standby processing system indicates that the standby processing system has not issued a restart signal and, if the standby processing system has also issued a restart signal, the switchover control logic means being means for generating a reboot signal to cause a reboot of the system; the switchover control logic means further comprising: timer means for generating a timing signal at a predetermined time interval; and switchover counter means, responsive to at least one of the at least one switchover signal, for counting the number of switchovers which occur, the switchover counter means being further responsive to the timing signal for clearing the count of switchovers; wherein the switchover counter means further comprises means for generating the reboot signal to cause a reboot of the system whenever the count of switchovers maintained by the switchover counter means exceeds a predetermined amount.

Claim 3

The apparatus of claim 1 wherein the switchover control logic means comprises first switchover control logic means associated with the first processing system and second switchover control logic means associated with the second processing system.

Claim 4

The apparatus of claim 2 wherein the YESORNO-OK signal output from each WDT is applied to the first and second switchover control logic means.

Claim 5

The apparatus of claim 3 wherein one of the first and second switchover control logic means comprises means, after the system is rebooted, for generating a signal to cause the processing system associated therewith to be the active processing means.

Claim 6

Apparatus for use in a system comprised of a first processing system and a second processing system, the first and second processing systems being redundant processing systems whereby one of the first and second processing systems is an active processing system and the other one of the first and second processing systems is a standby processing system, the apparatus being used to prevent endless switchovers between the active processing system and the standby processing system, a switchover being an event wherein the active processing system becomes the standby processing system and vice versa, wherein the first processing system is associated with a first watch dog timer (WDT) and the second processing system is associated with a second WDT, wherein each of the first and second processing systems attempts to reset the WDT associated therewith within a predetermined period of time, and wherein the WDT associated with each processing system sends a restart signal to that processing system if the WDT has not been reset thereby, the apparatus comprising: each of the WDTs further comprising means for outputting a YESORNO-OK signal which indicates whether or not the WDT has issued a restart signal and for applying the YESORNO-OK signal from the first and second WDT to both the first and second switchover control logic means; the first and second switchover control logic means being means, in response to the YESORNO-OK signals from both of the WDTs, the generating at least one switchover signal to cause a switchover wherein the active processing system becomes the standby processing system and vice versa if the YESORNO-OK signal from the WDT associated with the active processing system indicates that the active processing system has issued a restart signal and the YESORNO-OK signal from the WDT associated with the standby processing system indicates that the standby processing system has not issued a restart signal and, if the standby processing system has also issued a restart signal, the switchover control logic means being means for generating a reboot signal to cause a reboot of the system; the first and second switchover control logic means further comprising: timer means for generating a timing signal at a predetermined time interval; and switchover counter means, responsive to at least one of the at least one switchover signal, for counting the number of switchover which occur, the switchover counter means being further responsive to the timing signal for clearing the count of switchovers; wherein the switchover counter means further comprises means for generating the reboot signal to cause a reboot of the system whenever the count of switchovers maintained by the switchover counter means exceeds a predetermined amount.

Claim 7

Apparatus for use in a system comprised of a first processing system and a second processing system, the first and second processing systems being redundant processing systems whereby one of the first and second processing systems is an active processing system and the other one of the first and second processing systems is a standby processing system, the apparatus being used to prevent endless switchovers between the active processing system and the standby processing system, a switchover being an event wherein the active processing system becomes the standby processing system and vice versa, wherein the first processing system is associated with a first watch dog timer (WDT) and the second processing system is associated with a second WDT, wherein each of the first and second processing systems attempts to reset the WDT associated therewith within a predetermined period of time, and wherein the WDT associated with each processing system sends a restart signal to that processing system if the WDT has not been reset thereby, the apparatus comprising: each of the WDTs further comprising means for outputting a YESORNO-OK signal which indicates whether or not the WDT has issued a restart signal and for applying the YESORNO-OK signal from the first and second WDT to both the first and second switchover control logic means; the first and second switchover control logic means being means, in response to the YESORNO-OK signals from both of the WDTs, the generating at least one switchover signal to cause a switchover wherein the active processing system becomes the standby processing system and vice versa if the YESORNO-OK signal from the WDT associated with the active processing system indicates that the active processing system has issued a restart signal and the YESORNO-OK signal from the WDT associated with the standby processing system indicates that the standby processing system has not issued a restart signal and, if the standby processing system has also issued a restart signal, the switchover control logic means being means for generating a reboot signal to cause a reboot of the system; the first and second switchover control logic means further comprising: timer means for generating a timing signal at a predetermined time interval; and switchover counter means, responsive to at least one of the at least one switchover signal, for counting the number of switchover which occur, the switchover counter means being further responsive to the timing signal for clearing the count of switchovers; wherein the switchover counter means further comprises means for generating the reboot signal to cause a reboot of the system whenever the count of switchovers maintained by the switchover counter means exceeds a predetermined amount.