Abstract:
A method and apparatus for robust initialization of a digital control apparatus that is coupled to a plurality of devices (e.g.,  112, 114 , and  116 ) having a plurality of boot routines ( 118 ) in memory (e.g.,  108 ) with each of the boot routines being associated with one of the devices. A boot marker ( 120 ) in memory (e.g.,  108 ) that is capable of selectively associating a boot routine with a device (e.g.,  112, 114 , or  116 ) and a controller ( 104 ) that initializes the devices based on which of the boot routines is associated with the boot marker.

Description:
FIELD OF THE INVENTION 
     The present invention relates generally to system initialization and, specifically to, robust initialization of multiple devices in a system. 
     BACKGROUND OF THE INVENTION 
     Currently, when a computerized system is initialized, a number of boot programs associated with different devices are loaded into memory or are present in read only memory (ROM). A controller is initially started and loaded with a boot program commonly referred to as an “initial program load” (IPL). Upon execution of the IPL program, the controller enables the other devices to be initialized by their respective boot programs. The controller does not resume normal operation until the initialization of the system is complete and the IPL program finishes execution. The lack or loss of control over the IPL procedures results in the loss of system functionality when the file system or memory containing the IPL program is corrupted preventing complete initialization of the system. 
     Disadvantageously, when the system fails to properly initialize another IPL must occur. Accordingly, there is a need in the art for a method and apparatus for decreasing the time of outages due to IPL program failures while increasing system integrity and availability. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG.  1 . is a block diagram of a computer system having a controller and multiple devices in accordance with an embodiment of the invention; and 
     FIG.  2 . is a flow diagram of the steps of robust initialization of a system with multiple devices in accordance with an embodiment of the invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     To overcome the problems described above, a boot marker and watch dog timer are used to identify what device is being initialized. Upon initialization failure of the current device, the watch dog timer enables the boot marker to be updated and the next device initialized. Thus assuring the IPL program will end execution and system execution returned to the controller. 
     In FIG. 1, a block diagram of a computer system  100  having a controller and multiple devices in accordance with an embodiment of the invention is shown. The system  100  has an input device  102  coupled by a data bus and address bus to a controller  104  and a Random Access Memory  108  (RAM). The controller  104  is coupled to the input device  102 , read only memory (ROM)  106 , RAM  108 , an activity or watch dog timer  110 , device one  112 , device two  114 , and device three  116 . In the current embodiment the devices are shown as residing within the system, but in alternate embodiments the devices may selectively be independent single board computers coupled to the controller by an external bus. The above elements are all coupled together by an address bus and a data bus. Additionally, stored in the RAM  106  is an area  118  for a plurality of boot routines  124 ,  128 ,  130 ,  132 , boot marker  120 , and a boot list table  122 . 
     Upon initialization or power-up of the system, the controller  104  loads a program from ROM  106  to enable access to an input device. An IPL program for initializing the system is accessed and loaded via the input device  102 . The input device  102  shown is a tape unit, but in alternate embodiments other devices, such as disk drives, CD drives, punch card readers, electrical switches, or mechanical switches, may be used to load the IPL program. 
     The IPL program is stored by the controller  104  in RAM  108 . The IPL program contains the boot routines or programs for initializing the other devices of the computer system. The plurality of boot routines from the IPL program are stored in a boot routine area of memory  118  with each boot routine having an unique identifier (i.e. starting memory address for the routine). In an alternate embodiment, a power supply is coupled to the RAM or the use of complementary metal oxide semiconductor CMOS RAM enable the system while powered down to maintain the IPL program removing the need to load the IPL program from tape during system initialization, thus reducing outage time. 
     The boot list  122  is created in memory corresponding to the boot routines in the boot routine area of memory  118 . The boot list  122  identifies the order the boot routines are initialized and maintains the status (success or failure) of each routine. The boot marker  120  is a pointer into the boot list that identifies the next boot routine to be executed. 
     In alternate embodiments, link lists or other data structures are used to identify the boot routines and the pointer into that data structure is the boot marker. Therefore, the boot routine area, boot list, and boot marker may selectively be implemented as one structure, rather than the three data structures shown in the present embodiment. 
     The first routine to boot in the present embodiment is the controller  104 . The controller  104  updates the boot marker to be associated with the next device in the boot list (device two  114 ). Upon initialization with the IPL program, the controller  104  loads and executes the boot program controller routine  124 . Upon successful initialization, the boot list  122  is updated and the status of routine one  126  is marked as “pass” (i.e. 1=pass, 0=fail). After initialization of the controller  104 , the watch dog timer  110  is started, device two  114  is initialized with the “boot program device # 2 ” routine  130 , and the boot marker  120  is updated with the next device in the boot list  122 (device one  112 ). The initialization of device two  114  is completed before the watch dog timer  110  expires. 
     Upon successful initialization of device two  114 , the status in the boot list  122  is marked as “pass”  134 , the watch dog timer  110  is reset, and device one  112  is initialized. The initialization of device one  112  results in the boot marker  120  being updated to device three  116 . The initialization of device one  112  does not occur before the watch dog timer  110  expires. 
     The watch dog timer  110  expires and the controller  104  ends the initialization attempt of device one  112 . The controller  104  marks the status for device one  112  in the boot list  122  as “fail”  136 . The next device initialization, identified by the boot marker  120  (device three  116 ) is started and the watch dog timer  110  is reset. The boot marker  120  is updated to identify the next routine to run, but there are no more devices to initialize. Therefore, the boot marker  120  is pointed to the routine marked as failed  136  in the boot list  122  in a second attempt to successfully initialize the device. Device three initializes before the watch dog timer expires and the status of “pass”  138  is entered into the boot list  122 . 
     The boot marker points to the failed device one  112  resulting in a second attempt at initialization. Initialization of device one  112  is started and the watch dog timer  110  is reset. There are no other initialization failures, so the boot marker is set to an “end of list” code. If device one  112  properly initializes, then the status of routine two  128  is updated in the boot list  122  to reflect “pass”. If device one  112  fails a second time and the watch dog timer expires, then the status is updated (or maintained) as “fail”. 
     After all devices have been initialized or two attempts have been made to initialize failed devices, the IPL program completes execution and the controller  104  is released to perform other functions. Thus, the failure of a device does not prevent the system from initializing resulting in outages being limited to only the failed device. 
     Turning to FIG. 2, a flow diagram of the steps of robust initialization of a system with multiple devices in accordance with an embodiment of the invention is shown. In step  202 , a IPL program is loaded via the input device  102 , FIG. 1 into RAM  108  by the controller  104 . The IPL program contains boot routines for the devices that make up the system and are placed into a table of boot routines  118  in RAM  108  and the boot list  122  in step  204 , FIG.  2 . The boot marker  120 , FIG. 1, is initialized in step  206 , FIG. 2 to identify the first boot routine to be executed. 
     In step  210 , the boot marker  120 , FIG. 1, is checked to verify that there are devices to initialize. If the boot marker  120  identifies a device to initialize, then the initialization routine is executed for that device in step  212  and the watch dog timer  110 , FIG. 1, is started in step  214 , FIG.  2 . 
     If the watch dog timer  110 , FIG. 1, has not expired in step  216 , then the completion of device initialization is checked in step  218 . If device initialization is complete in step  218 , then in step  224  the status is marked as pass in the boot list  122 , FIG. 1, and in step  222 , FIG. 2, the boot marker is updated to the next device in the boot list  122 , FIG.  1 . If initialization of the device is not complete then step  216 , FIG. 2, and  218  are repeated until either the watch dog timer  110 , FIG. 1, expires or the device successfully initializes. If the watch dog timer  110 , FIG. 1, expires in step  216 , FIG. 2, then in step  220 , FIG. 2, the initialization status of the device is marked as a “fail” in the status field of the boot list  122 , FIG. 1, and in step  222 , FIG. 2 the boot marker is updated to identify the next device to be initialize. After the boot marker has been updated in step  222 , a check for more devices to be initialized occurs in step  210 . 
     If in step  210 , an attempt to initialize all devices has been completed, then in step  226  a check is made for any initialization failures. In step  228 , an attempt is made to reboot the first identified failed device in the boot list  122 , FIG. 1, and in step  230 , FIG. 2, the watch dog timer  110 , FIG. 1, is started. 
     The watch dog timer  110  is checked in step  232 , FIG. 2, and if it has not expired, then in step  234 , the initialization of the device is checked for completion. If the watch dog timer  110 , FIG. 1, has not expired in step  232  and initialization of the device is not complete in step  234 , then step  232  and  234  are repeated. 
     If the watch dog timer  110 , FIG. 1, is expired in step  232 , FIG. 2, then in step  236  the status in the boot list  122 , FIG. 1, is marked as “Fail” for a second time and in step  240 , FIG. 2, the boot marker  120 , FIG. 1, is updated to identify the next device that previously failed initialization. In an alternate embodiment, a distinction between fail and fail for a second time is recorded in the boot list. If in step  234 , FIG. 2, the initialization of the device is complete, then in step  238 , the status in the boot list  122 , FIG. 1 is identified as “pass” and in step  240  the boot marker,  120 , FIG. 1, is updated to point to the next device that failed initialization. Once the boot marker  120  is updated in step  240 , FIG. 2, step  226  is repeated. In step  226 , if there are no devices that have failed initialization once, then the process is complete. Thus, the system is able to increase system availability and reduce the effects of device failure during initialization. 
     While the invention has been particularly shown and described with reference to a particular embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention and it is intended that all such changes come within the scope of the following claims.