Method and apparatus for robust initialization of devices

The present invention relates generally to system initialization and, specifically to, robust initialization of multiple devices in a system.

Currently, when a computerized system is initialized, a number of boot programs associated with different devices are loaded into memory or are present in read only memory (ROM). A controller is initially started and loaded with a boot program commonly referred to as an “initial program load” (IPL). Upon execution of the IPL program, the controller enables the other devices to be initialized by their respective boot programs. The controller does not resume normal operation until the initialization of the system is complete and the IPL program finishes execution. The lack or loss of control over the IPL procedures results in the loss of system functionality when the file system or memory containing the IPL program is corrupted preventing complete initialization of the system.

Disadvantageously, when the system fails to properly initialize another IPL must occur. Accordingly, there is a need in the art for a method and apparatus for decreasing the time of outages due to IPL program failures while increasing system integrity and availability.

FIG. 1 . is a block diagram of a computer system having a controller and multiple devices in accordance with an embodiment of the invention; and

FIG. 2 . is a flow diagram of the steps of robust initialization of a system with multiple devices in accordance with an embodiment of the invention.

To overcome the problems described above, a boot marker and watch dog timer are used to identify what device is being initialized. Upon initialization failure of the current device, the watch dog timer enables the boot marker to be updated and the next device initialized. Thus assuring the IPL program will end execution and system execution returned to the controller.

In FIG. 1, a block diagram of a computer system 100 having a controller and multiple devices in accordance with an embodiment of the invention is shown. The system 100 has an input device 102 coupled by a data bus and address bus to a controller 104 and a Random Access Memory 108 (RAM). The controller 104 is coupled to the input device 102 , read only memory (ROM) 106 , RAM 108 , an activity or watch dog timer 110 , device one 112 , device two 114 , and device three 116 . In the current embodiment the devices are shown as residing within the system, but in alternate embodiments the devices may selectively be independent single board computers coupled to the controller by an external bus. The above elements are all coupled together by an address bus and a data bus. Additionally, stored in the RAM 106 is an area 118 for a plurality of boot routines 124 , 128 , 130 , 132 , boot marker 120 , and a boot list table 122 .

Upon initialization or power-up of the system, the controller 104 loads a program from ROM 106 to enable access to an input device. An IPL program for initializing the system is accessed and loaded via the input device 102 . The input device 102 shown is a tape unit, but in alternate embodiments other devices, such as disk drives, CD drives, punch card readers, electrical switches, or mechanical switches, may be used to load the IPL program.

The IPL program is stored by the controller 104 in RAM 108 . The IPL program contains the boot routines or programs for initializing the other devices of the computer system. The plurality of boot routines from the IPL program are stored in a boot routine area of memory 118 with each boot routine having an unique identifier (i.e. starting memory address for the routine). In an alternate embodiment, a power supply is coupled to the RAM or the use of complementary metal oxide semiconductor CMOS RAM enable the system while powered down to maintain the IPL program removing the need to load the IPL program from tape during system initialization, thus reducing outage time.

The boot list 122 is created in memory corresponding to the boot routines in the boot routine area of memory 118 . The boot list 122 identifies the order the boot routines are initialized and maintains the status (success or failure) of each routine. The boot marker 120 is a pointer into the boot list that identifies the next boot routine to be executed.

In alternate embodiments, link lists or other data structures are used to identify the boot routines and the pointer into that data structure is the boot marker. Therefore, the boot routine area, boot list, and boot marker may selectively be implemented as one structure, rather than the three data structures shown in the present embodiment.

The first routine to boot in the present embodiment is the controller 104 . The controller 104 updates the boot marker to be associated with the next device in the boot list (device two 114 ). Upon initialization with the IPL program, the controller 104 loads and executes the boot program controller routine 124 . Upon successful initialization, the boot list 122 is updated and the status of routine one 126 is marked as “pass” (i.e. 1=pass, 0=fail). After initialization of the controller 104 , the watch dog timer 110 is started, device two 114 is initialized with the “boot program device # 2 ” routine 130 , and the boot marker 120 is updated with the next device in the boot list 122 (device one 112 ). The initialization of device two 114 is completed before the watch dog timer 110 expires.

Upon successful initialization of device two 114 , the status in the boot list 122 is marked as “pass” 134 , the watch dog timer 110 is reset, and device one 112 is initialized. The initialization of device one 112 results in the boot marker 120 being updated to device three 116 . The initialization of device one 112 does not occur before the watch dog timer 110 expires.

The watch dog timer 110 expires and the controller 104 ends the initialization attempt of device one 112 . The controller 104 marks the status for device one 112 in the boot list 122 as “fail” 136 . The next device initialization, identified by the boot marker 120 (device three 116 ) is started and the watch dog timer 110 is reset. The boot marker 120 is updated to identify the next routine to run, but there are no more devices to initialize. Therefore, the boot marker 120 is pointed to the routine marked as failed 136 in the boot list 122 in a second attempt to successfully initialize the device. Device three initializes before the watch dog timer expires and the status of “pass” 138 is entered into the boot list 122 .

The boot marker points to the failed device one 112 resulting in a second attempt at initialization. Initialization of device one 112 is started and the watch dog timer 110 is reset. There are no other initialization failures, so the boot marker is set to an “end of list” code. If device one 112 properly initializes, then the status of routine two 128 is updated in the boot list 122 to reflect “pass”. If device one 112 fails a second time and the watch dog timer expires, then the status is updated (or maintained) as “fail”.

After all devices have been initialized or two attempts have been made to initialize failed devices, the IPL program completes execution and the controller 104 is released to perform other functions. Thus, the failure of a device does not prevent the system from initializing resulting in outages being limited to only the failed device.

Turning to FIG. 2, a flow diagram of the steps of robust initialization of a system with multiple devices in accordance with an embodiment of the invention is shown. In step 202 , a IPL program is loaded via the input device 102 , FIG. 1 into RAM 108 by the controller 104 . The IPL program contains boot routines for the devices that make up the system and are placed into a table of boot routines 118 in RAM 108 and the boot list 122 in step 204 , FIG. 2 . The boot marker 120 , FIG. 1, is initialized in step 206 , FIG. 2 to identify the first boot routine to be executed.

In step 210 , the boot marker 120 , FIG. 1, is checked to verify that there are devices to initialize. If the boot marker 120 identifies a device to initialize, then the initialization routine is executed for that device in step 212 and the watch dog timer 110 , FIG. 1, is started in step 214 , FIG. 2 .

If the watch dog timer 110 , FIG. 1, has not expired in step 216 , then the completion of device initialization is checked in step 218 . If device initialization is complete in step 218 , then in step 224 the status is marked as pass in the boot list 122 , FIG. 1, and in step 222 , FIG. 2, the boot marker is updated to the next device in the boot list 122 , FIG. 1 . If initialization of the device is not complete then step 216 , FIG. 2, and 218 are repeated until either the watch dog timer 110 , FIG. 1, expires or the device successfully initializes. If the watch dog timer 110 , FIG. 1, expires in step 216 , FIG. 2, then in step 220 , FIG. 2, the initialization status of the device is marked as a “fail” in the status field of the boot list 122 , FIG. 1, and in step 222 , FIG. 2 the boot marker is updated to identify the next device to be initialize. After the boot marker has been updated in step 222 , a check for more devices to be initialized occurs in step 210 .

If in step 210 , an attempt to initialize all devices has been completed, then in step 226 a check is made for any initialization failures. In step 228 , an attempt is made to reboot the first identified failed device in the boot list 122 , FIG. 1, and in step 230 , FIG. 2, the watch dog timer 110 , FIG. 1, is started.

The watch dog timer 110 is checked in step 232 , FIG. 2, and if it has not expired, then in step 234 , the initialization of the device is checked for completion. If the watch dog timer 110 , FIG. 1, has not expired in step 232 and initialization of the device is not complete in step 234 , then step 232 and 234 are repeated.

If the watch dog timer 110 , FIG. 1, is expired in step 232 , FIG. 2, then in step 236 the status in the boot list 122 , FIG. 1, is marked as “Fail” for a second time and in step 240 , FIG. 2, the boot marker 120 , FIG. 1, is updated to identify the next device that previously failed initialization. In an alternate embodiment, a distinction between fail and fail for a second time is recorded in the boot list. If in step 234 , FIG. 2, the initialization of the device is complete, then in step 238 , the status in the boot list 122 , FIG. 1 is identified as “pass” and in step 240 the boot marker, 120 , FIG. 1, is updated to point to the next device that failed initialization. Once the boot marker 120 is updated in step 240 , FIG. 2, step 226 is repeated. In step 226 , if there are no devices that have failed initialization once, then the process is complete. Thus, the system is able to increase system availability and reduce the effects of device failure during initialization.

While the invention has been particularly shown and described with reference to a particular embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention and it is intended that all such changes come within the scope of the following claims.