Automatic Recovery for Network Appliances

The present invention is in the area of methods and apparatus for safeguarding network appliances in the event a catastrophic failure occurs, and it is particular relevant to auxiliary servers with no long term data-storage requirements and with no user interfaces like keyboard, mouse and monitor and so forth.

A computer network may have one or more small auxiliary servers with no long-term data-storage facilities and no keyboard or monitor. Typically, this type of auxiliary server has a small hard drive for its own operating software, and it may be used for data transfer functions such as Internet access, electronic mail, fax service, and remote access. Such a small auxiliary server is commonly known as a network appliance.

Although network appliances have a lower failure rate than major file servers, they may be monitored by a software-controlled device commonly referred to as a watchdog. In case a network appliance fails, its watchdog will sense the failure and attempt to reboot the CPU of the network appliance using the operating software stored on a resident hard disk. If the reboot is successful, the network appliance will resume operation. However, in the event that a part of the operating software or the appliance's application software is corrupted, the watchdog will be unable to restore proper operation of the network appliance. Consequently, that network appliance remains unavailable until a person that is responsible for its maintenance notices the failure and replaces the corrupted software.

What is clearly needed is a method to restore automatically proper operation of a network appliance that has failed as a result of corrupted operating or application software that is stored on the resident hard disk. Such a method eliminates the need for human intervention and, therefore, will significantly reduce the time that a network appliance is nonfunctional. This disclosure describes such an automatic recovery system.

In a preferred embodiment an automatic recovery system for a network appliance having a central processing unit (CPU), a mass storage device, and a non-volatile storage device is provided, comprising a system-independent watchdog processor coupled to the CPU and to the storage devices; a primary boot partition on the mass storage device, comprising primary operating software and primary application software for execution by the CPU in booting the network appliance and placing it in operation performing its application; a secondary boot partition on the mass storage device, comprising secondary operating software and secondary application software; and an automatic recovery routine on the non-volatile storage device. The watchdog processor, executing the automatic recovery routine, in the event of appliance failure initiates a reboot attempt from the secondary boot partition.

In some embodiments the primary and the secondary boot partitions are on the same mass storage device, and in others on separate mass storage devices. The watchdog processor is independent of the CPU of the appliance, and the automatic recovery software is stored in a non-volatile device, so the watchdog processor has access to it and can execute it even if the appliance is down. In some embodiments the watchdog processor and the non-volatile storage device may be in the same IC.

Preferrably the secondary operating software and the primary operating software are identical, but this is not a requirement. In preferred embodiments the watchdog processor attempts to reboot the appliance first from the primary boot partition, and counts reboot attempts. After a preset number of attempts in a preset time, boot attempts are switched to the secondary partition.

In other aspects of the invention network appliances are provided equipped with the recovery system described, and in other aspects, methods for recovery are provided.

FIG. 1 is a block diagram illustrating a network appliance equipped with an automatic recovery system according an embodiment of the present invention.

FIG. 2 is a block diagram illustrating a possible partitioning of a hard disk of an automatic recovery system for a network appliance according an embodiment of the present invention.

FIG. 1 is a block diagram illustrating a network appliance 13 equipped with an automatic recovery system according an embodiment of the present invention. Network appliance 13 controls a network ports 29 and 30 between a network 23 and client 27, and it may operate according to any of several network protocols known in the art. There is no requirement to have two ports 29 and 30, and if there is more than one port, they can have the same or all different protocols in any combination.

Network appliance 13 comprises, but is not limited to, a Central Processing Unit (CPU) 25, a disk-type storage device (HDD) 41 which configuration includes a primary bootable partition and a read-only secondary bootable partition, a watchdog device 21 that may take the form of a small system-independent microprocessor, a software recovery routine 19 that resides within the network appliance independently from hard disk 41, and a BIOS ROM 15 as well as network interface adapters 29 and 30.

Watchdog device 21 may be an integrated circuit (IC) that is integrated into any of the other ICs or it may exist as additional elements in network appliance 13. Software recovery routine 19 may be stored in the system BIOS ROM, a ROM, a battery backed-up RAM, or any other nonvolatile storage device.

It is known to the inventor and in the art that in the event of failure of a network appliance, its watchdog device will sense the failure and will signal CPU 25, by means of its system bus, an I/O port, an interrupt, a register, memory, or any other suitable method, to reboot CPU 25 by executing software programs that are stored on hard disk 41. However, this method of restoring proper operation of a network appliance has a serious problem. This problem lies in the fact that a part of the CPU's operating software or the appliance's application software, both stored on hard disk 41, can be corrupted, for example by a glitch in power during update of a file allocation table, and consequently, watchdog device 21 will be unable to reboot CPU 25 and restore proper operation of the network appliance. Consequently, a network appliance with corrupted software remains unavailable until a human notices the failure and intervenes.

FIG. 2 is a block diagram illustrating a method to create an automatic recovery system by means of uniquely partitioning the recording space of hard disk 41 (FIG. 1) according an embodiment of the present invention. As shown in FIG. 2, the recording space of hard disk 41 (FIG. 1) is partitioned in this embodiment into a data partition 43, a primary boot partition 55 that retains both operating software 45 and application software 47, and a secondary boot partition 57, or shadow partition, that retains operating software 49 that is an exact duplicate of operating software 45, and application software 51 that is an exact duplicate of application software 47. Such a secondary partition 57 could also be stored on a second drive, and the invention is not limited to storing the duplicate software on the same drive.

An automatic recovery routine (see item 19 in FIG. 1) according to this embodiment of the present invention, keeps track of the number of reboots that occur within a certain time period. The number of performed reboots indicates whether watchdog device 21 is successful in rebooting the network appliance in event of a failure. If the number of reboots is greater than a preset threshold number in a given period of time, that result indicates failing reboot cycles which most likely are caused by a corrupted primary partition 55. In response, the automatic recovery routine attempts to reboot CPU 25 using duplicate operating software 49 and if successful re-installs duplicate application software 51 stored in shadow partition 57 to restore proper operation of network appliance 13. In some embodiments the application software 51 may be in compressed form, and be decompressed as needed. In other embodiments, the recovery system may also reinstall portions or all of the code in the first boot partition. Due to this automatic recovery system, a total catastrophic failure of a network appliance can be avoided and therefore will cause only a relatively brief period of disruption of service to clients.

It will be apparent to those with skill in the art that there are many possible variations for the storage of an automatic recovery routine and secondary operation and application software. For example, a second hard disk may be used to store bootable operation software as well as application software. In addition, the watchdog may be configured to automatically send error messages to a remote monitoring station on the network when an appliance fails.

It will be apparent to those with skill in the art that there will be many alterations that might be made in the embodiments of the invention described herein without departing from the spirit and scope of the invention. Some of the variations have already been mentioned. Others include the fact that the primary and secondary operating software and application software do not necessarily have to be exact copies, but do have to be capable of performing the requisite functions of operation and application.