Fault-tolerant architecture for in-circuit programming

Abstract

The present invention provides a method and apparatus for providing fault-tolerance for in-circuit programming systems. The invention operates by storing a minimal set of code to initialize the in-circuit programming process in a protected memory so that if the in-circuit programming process fails, the in-circuit programming process can be restarted from the protected memory. This type of fault-tolerance is especially important in systems which allow the code which accomplishes the in-circuit programming to be modified by the in-circuit programming process. One embodiment of the present invention provides a multiplexer to selectively switch between a normal boot code sequence and a protected boot code sequence, as well as a watchdog timer to monitor the in-circuit programming process to determine whether the in-circuit programming process is not progressing properly.

What is claimed is:  
     
         1 . A method for providing for error recovery during in-circuit programming of a computer system, comprising: 
 setting an in-circuit programming status to an incomplete value, indicating the in-circuit programming process is in progress;    initiating the in-circuit programming process;    when the in-circuit programming process terminates, setting the in-circuit programming status to a complete value indicating the in-circuit programming process is complete; and    during initialization of the system, executing a first boot code sequence if the in-circuit programming status has a complete value, the first boot code sequence being programmable through the in-circuit programming process, and executing a second boot code sequence if the in-circuit programming status has an incomplete value, the second boot code sequence being protected from the in-circuit programming process.    
     
     
         2 . The method of  claim 1 , wherein the second boot code sequence is protected from the in-circuit programming process, and is separately programmable using a special in-circuit programming process.  
     
     
         3 . The method of  claim 1 , wherein the in-circuit programming process includes testing a section of code loaded by the in-circuit programming process.  
     
     
         4 . The method of  claim 1 , including the steps of: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions; and    restarting the in-circuit programming process if the delay exceeds a timeout value.    
     
     
         5 . The method of  claim 1 , including: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions;    reinitializing the computer system and restarting the in-circuit programming process if the delay exceeds a timeout value.    
     
     
         6 . The method of  claim 1 , including: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions;    reinitializing the computer system and restarting the in-circuit programming process if the delay exceeds a timeout value, wherein the timeout value is downloaded twice from a remote host, and the two values are compared against each other to verify that they match to ensure that the timeout values are downloaded properly.    
     
     
         7 . The method of  claim 1 , including: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions;    reinitializing the computer system and restarting the in-circuit programming process if the delay exceeds a timeout value, wherein a first timeout value is downloaded from a remote host and is compared against a second timeout value which is permanently stored in the computer system to ensure that the first time out value is at least as large as the second timeout value, and if not using the second timeout value as the timeout value.    
     
     
         8 . The method of  claim 1 , wherein the step of executing the second boot code sequence includes executing a jump instruction to a boot vector that points to the start of the second boot code sequence.  
     
     
         9 . The method of  claim 1 , including the step of: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions, wherein the monitoring is performed by a remote host from which the in-circuit programming code is down-loaded.    
     
     
         10 . The method of  claim 1 , including the step of: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions, wherein the monitoring is performed using a watch dog timer coupled to the computer system.    
     
     
         11 . The method of  claim 1 , wherein the computer system is coupled to a remote host through which the in-circuit programming code is downloaded, and including the step of using the remote host to determine a timeout value for a transmission of in-circuit programming code.  
     
     
         12 . The method of  claim 1 , including the step of using the computer system to determine a timeout value for a transmission of in-circuit programming code.  
     
     
         13 . The method of  claim 1 , including the step of determining a timeout value for transmissions of in-circuit programming code based upon system performance during prior downloading of data to the processor.  
     
     
         14 . The method of  claim 1 , wherein the computing system is a device controller.  
     
     
         15 . The method of  claim 1 , including the step of receiving in-circuit programming instructions from a remote host through a computer network.  
     
     
         16 . The method of  claim 1 , including the step of receiving in-circuit programming instructions from a remote host through an Internet.  
     
     
         17 . The method of  claim 1 , wherein the in-circuit programming status is protected from the in-circuit programming process.  
     
     
         18 . The method of  claim 1 , including the step of storing an address of a remote host from which the in-circuit programming code is downloaded.  
     
     
         19 . The method of  claim 1 , including the step of storing an address of a remote host from which the in-circuit programming code is down loaded so that the address is protected from the in-circuit programming process.  
     
     
         20 . An apparatus for providing error recovery during in-circuit programming of a computer system, comprising: 
 a processor;    a first boot code sequence coupled to the processor;    a second boot code sequence coupled to the processor;    an in-circuit programming status indicator coupled to the processor, the status indicator being set to an incomplete value during in-circuit programming, and being set to a complete value after in-circuit programming is complete; and    selector mechanism coupled to the first boot code sequence and the second boot code sequence, for selecting a boot code sequence for computer system initialization, the selector mechanism selecting the first boot code sequence if the in-circuit programming status indicator is set to a complete value, and selecting the second boot code sequence if the in-circuit programming status indicator is set to an incomplete value.    
     
     
         21 . The apparatus of  claim 20 , wherein the selector mechanism includes a multiplexer coupled to the processor for selecting between the first boot code sequence and the second boot code sequence.  
     
     
         22 . The apparatus of  claim 20 , wherein the first boot code sequence and the second boot code sequence are contained within the same memory module.  
     
     
         23 . The apparatus of  claim 20 , wherein the first boot code sequence is programmable through the in-circuit programming process and the second boot code sequence is protected from the in-circuit programming process.  
     
     
         24 . The apparatus of  claim 20 , wherein the first boot code sequence resides within a flash memory and the second boot code sequence resides within a read only memory.  
     
     
         25 . The apparatus of  claim 20 , wherein the in-circuit programming status is protected from the in-circuit programming process.  
     
     
         26 . The apparatus of  claim 20 , including a remote host address coupled to the processor, the remote host address including a network address of a remote host from which the in-circuit programming code is downloaded.  
     
     
         27 . The apparatus of  claim 20 , including a remote host address coupled to the processor, the remote host address including a network address of a remote host from which the in-circuit programming code is down loaded, the remote host address residing in a memory that is protected from the in-circuit programming process.  
     
     
         28 . The apparatus of  claim 20 , including a network interface coupled to the processor, the network interface being coupled to a network through which the in-circuit programming code is downloaded.  
     
     
         29 . The apparatus of  claim 20 , including a watch dog timer coupled to the processor, the watch dog timer monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions.  
     
     
         30 . The apparatus of  claim 20 , including a watch dog timer coupled to the processor, the watch dog timer monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions, the watch dog timer causing the in-circuit programming process to be restarted if the delay exceeds a timeout value.  
     
     
         31 . The apparatus of  claim 20 , including a watch dog timer coupled to the processor, the watch dog timer monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions, the watch dog timer causing the computer system to be reinitialized and the in-circuit programming process to be restarted if the delay exceeds a timeout value.  
     
     
         32 . The apparatus of  claim 20 , wherein the processor is coupled to a remote host through which the in-circuit programming code is downloaded, the remote host monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions.  
     
     
         33 . The apparatus of  claim 20 , wherein: 
 the processor is coupled to a remote host through which the in-circuit programming code is downloaded; and    the remote host determines a timeout value for transmissions of in-circuit programming code.    
     
     
         34 . The apparatus of  claim 20 , wherein the processor determines a timeout value for transmissions of in-circuit programming code.  
     
     
         35 . The apparatus of  claim 20 , including a timeout value for transmissions of in-circuit programming code coupled to the apparatus which is determined based upon system performance during prior downloading of data to the processor.  
     
     
         36 . A method for providing for error recovery during in-circuit programming of a computer system, comprising: 
 monitoring the in-circuit programming process in order to detect a delay in transmission of in-circuit programming instructions from a remote host; and    restarting the in-circuit programming process if the delay exceeds a timeout value.    
     
     
         37 . The method of  claim 34 , including the step of reinitializing the computer system if the delay exceed the timeout value.  
     
     
         38 . The method of  claim 34 , wherein the step of monitoring is performed by a remote host from which the in-circuit programming code is downloaded.  
     
     
         39 . The method of  claim 34 , wherein the step of monitoring is performed by using a watch dog timer coupled to the computer system.  
     
     
         40 . The method of  claim 34 , wherein the computer system is coupled to a remote host through which the in-circuit programming code is downloaded, and including the step of using the remote host to determine a timeout value for a transmission of in-circuit programming code.  
     
     
         41 . The method of  claim 34 , including the step of using the computer system to determine a timeout value for a transmission of in-circuit programming code.  
     
     
         42 . The method of  claim 34 , including the step of using the computer system to determine a timeout value for a transmission of in-circuit programming code.  
     
     
         43 . The method of  claim 34 , including the step of determining a timeout value for transmissions of in-circuit programming code based upon system performance during prior downloading of data to the processor.