A multi-station machine for necking-in the open end of a metal container body includes a plurality of necking spindle assemblies mounted at circumferentially spaced locations on a tooling disc turret in coaxial alignment with corresponding base pad spindle assemblies mounted to a base pad turret. The turrets are co-rotatable with a main turret shaft. Cam controlled tooling activating assemblies are mounted on the tooling disc turret to control the necking-in movement of an eccentric roll and an external forming roll in each necking spindle in synchronism with the delivery of vacuum suction through the base pad spindles which clamps the container bottom walls to the respective base pads. A sequential latching arrangement associated with the tooling activating assemblies prevents tool-to-tool contact between the outer forming rolls with the eccentric rolls in the absence of container bodies on station. The vacuum manifold arrangement features the supply of high volume, low suction vacuum to a small number of stations in the vicinity of the infeed location to rapidly locate the container bodies on the base pads. A low volume, high suction vacuum supply tothe downstream spindles ensuress proper clamping suction to properly maintain the containers on the base pads during necking. In the absence of contains at various stations, the high volume, low suction vacuum is subject to leakage only at a small number of stations at the infeed while vacuum leakage in the remainder of the stations is insufficient to lower clamping pressure to unacceptable levels.

Metal can bodies are frequently formed with a cylindrical side wall projecting from an integral bottom wall, by a drawing and ironing (D&I) process, as is well known. Beverage cans have a nominal diameter of, for example, two and eleven sixteenths inches (a "211" can). The open end is necked and flanged to, for example, a neck diameter of "206" (two and six sixteenths inches) on the standard 211 can or even to a "204" neck (two and four sixteenths). After the can is filled with a beverage, a can end or lid is sealed onto it by double-seaming.
The purpose of necking the can is to allow the use of a smaller diameter end. The neck enables the flange, and therefore the can end, to be of smaller diameter than if there were no neck, which means further metal reduction and thereby cost savings in metal. Necking also minimizes the radial extent of the flange which is formed at the end of the necked portion and thus helps to resist flange cracking. The neck may also provide a convenient way for a carrier to engage a plurality of cans.
There are various ways of necking a beverage can. One known method involves the use of static necking dies wherein the can is conveyed through a number of stations. At each station, a die ring is relatively reciprocated into contact with the open end while the can bottom is non-rotatably held with a base pad assembly. At each successive station, the static necking die is of progressively smaller diameter to progressively neck the can to the desired diameter.
Other necking methods involve rolling or spinning the neck and/or flange, using an external spinning roll cooperating with an internal member within the can body. In these methods, the can body is supported rigidly by an internal mandrel or the like. The internal member may be a spinning roll, pilot, or mandrel supporting the can body. In one such method, the neck and flange are formed simultaneously in a can body supported internally and rigidly by a mandrel or chuck of an expanding/collapsing type, the neck and flange profile being formed by external spinning rolls cooperating with this mandrel.
In another such method, the can body is supported internally by an anvil and endwise by a spinning pilot; the neck and flange are formed by a profiled, external spinning roll which deforms the can body into a groove on the pilot and anvil, and the roll is moved axially of the can body.
The problems associated with the rolling or spin forming of the neck as used in the prior art identified hereinabove concern the weak and relatively unsupported upper side wall metal of the open end of the can body. Such metal is usually very thin (e.g., about 0.004--0.006 inches), highly worked during ironing and highly grain oriented. Merely placing a tool with the desired profile inside the can and applying a similarly shaped roller to the outside of the can while it is spinning does not give the metal adequate or complete support to prevent wrinkling, cracking, buckling, crushing or tearing during the forming operation. This uncontrolled or unsupported application of radial side force on the thin metal side wall of the open end is unacceptable in connection with operations performed at multiple stations wherein the rate of production of the cans during necking may be as high as 1,500-2,000 cans per minute.
A spin flow necking process and apparatus are disclosed in U.S. Pat. No. 4,781,047, issued Nov. 1, 1988 to Bressan et al, which is assigned to Ball Corporation and is exclusively licensed to the assignee of the present application, Reynolds Metals Company. The disclosure of this patent is hereby incorporated by reference herein in its entirety. It concerns a process where an external free roll is moved inward and axially against the outside wall of the open end of a rotating trimmed can to form a conical neck at the open end thereof. A spring loaded holder supports the interior wall of the can and moves axially under the forming force of the free roll. This is a single operation where the can rotates and the free roll rotates so that a smooth conical necked end is produced. In practice the can is then flanged.
The term "spin flow necking" is used in this application to refer to such processes and apparatus, the essential difference between spin flow necking and other types of spin necking being the axial movement of both the external roll and the internal support.
Spin flow necking as described above offers the potential of making a 204, 202, 200, or even smaller neck on a standard 211 can, in a single multiple-station machine. Spin flow necking also offers can wall thickness reductions because of the lower necking load requirements imposed on the can during necking. Spin flow necking also has the potential for minimizing flange width variations, and the resulting can has a smooth profile and an attractive appearance. However, to make spin flow necking truly effective as a viable production process, it is necessary to incorporate a large number of spin flow necking stations in a machine having can handling capabilities permitting a throughput of approximately 1,500-2,000 cans per minute. Such a machine must be capable of rapidly and reliably feeding cylindrical can bodies onto the spin flow necking assemblies at a high production speed and must be capable of supporting the can bottom walls both quickly and in true alignment with the spin flow necking tooling. Such a machine must also preferably have the capability of preventing tool-to-tool contact between the surfaces of the spin flow necking tools during periods of disruption in can supply to prevent early wear and replacement of these extensive tools. To our knowledge, there is no previously known method or machine for providing adequate support or complete positive control over the cans during spin flow necking so that these requirements can be met.
It is accordingly one object of the present invention to provide a combination of an external roller and an internal holder which cooperate to overcome the problems of metal damage during a necking operation by means of spin flow necking.
Another object of the invention is to disclose a holder which co-acts with a forming roller to provide continuous support for the metal being spin flow formed into a neck in a machine having multiple spin flow necking stations for necking metal cans at each station down to a desired necked diameter.
Another object is to provide a spin flow necking machine capable of handling a large number of can bodies successively fed to the machine by ensuring that the can bodies are quickly and reliably retained in the machine in true alignment with the spin flow necking tooling and with sufficient clamping force applied to the can end walls to support the can during necking.
Another object is to ensure that the can bodies are easily and rapidly mounted in centering alignment with the spin flow necking tooling.
Still another object is to ensure that spin flow necking occurs at each station with adequate and complete support to the can to prevent wrinkling, cracking, buckling, crushing or tearing of the can side wall.
Still another object is to prevent uncontrolled or unsupported application of radial side force on the can open end by the spin flow forming roller.
Yet another object is to provide a multi-station spin flow necking machine having lower necking load requirements.
Still another object is to provide a multi-station spin flow necking machine which has high production throughput at manufacturing speeds in excess of 1,500 cans per minute.
Another object is to provide a multi-station spin flow necking machine which is capable of rugged and reliable operation in a hostile can making environment of a 24-hour a day aluminum fines atmosphere.

Spin flow necking apparatus and method of handling cans therein


Water-proof protective gaiter for a boot having a tubular shape, of the type comprising, on the one hand, a lower portion (1) covering at least partially the upper (2) of a boot (3) in a front area of insertion of the user's foot, then of closure, whose lower end circumference (4, 4A) is designed to adopt the contour of said upper (2), and, on the other, an upper portion (6) designed to enclose the lower leg of said user. An at least partially peripheral flap (8) forming an extension of said circumference (4) extends from at least a portion of the end circumference (4) of the lower portion (1) of the gaiter, so as to extend the range of protection of the gaiter beyond this circumference.

A gaiter of this type is sold commercially by the Berghaus Company and forms a supple boot designed to be put on over the shoe. It comprises an upper portion made of a water-tight fabric extending to a point below the user's knee, its main feature lying in the fact that the upper portion is extended by a lower portion which, in the manner of an outer shoe, encloses the entire shoe upper, including the sole thereof, by means of a plate designed to cover the sole which forms an extension of the circumference of the lower end of the gaiter itself and serves as the aforementioned enclosure means.
Although it probably gives good results, this gaiter has the disadvantage of being relatively complex and costly to manufacture. In addition, the presence of the plate on the boot sole, although incorporating open work, eliminates from the sole a portion of its ground-grabbing areas and makes it difficult to use with a ski boot, by virtue of the presence thereon of special binding means and, in addition, difficult to use with a hiking boot designed to incorporate studs for walking on ice. Furthermore, the size of the boot must be adhered to, thus requiring the stocking of inventory. Finally, and above all, this gaiter is especially difficult to put in place on the boot.
There also exists a gaiter made of a water-tight fabric, in which the circumference of the lower end is fitted with means for enclosing the upper tightly, which are constituted by an elastic strip mounted on the inner edge thereof, so as to envelop elastically the corresponding portion of the upper, connection to the sole being achieved by a cable of adjustable length extending beneath the arch and being clearly easier to put in place.
Nevertheless, this gaiter, which is more easily manufactured than the preceding one, has the disadvantage of a lack of water-tightness at the contact surface between the upper and the lower elastic strip, since, by virtue of the simple presence of this elastic strip, the fabric composing the gaiter forms, at this point, gathers which facilitate the penetration and ascending movement of water and snow between the gaiter and the boot.
Based on this same embodiment, it would be possible to conceive of an extension of the circumference of the lower end of the gaiter toward the front of the boot in order to yield enhanced protection; however, this cannot be considered because, beyond a certain limit, the elasticity itself of the strip will produce a contraction effect because it slides on the front upper part of the upper toward the instep, thereby making forward extension completely useless.
Austrian Patent No. 387 893 describes a gaiter limited to protection of a low-cut shoe or of the lower portion only of the upper of a high-cut boot. As in the first example cited, this gaiter takes the form of an outer boot enclosing virtually all of the boot upper, with the exception of the tip, in order to leave one binding connection free in the case of a cross-country ski boot, and extending at least partially beneath the sole of this boot. In this instance also, the presence of the lower portion of the gaiter covering the sole even partially complicates manufacture and, moreover, forms an area subject to wear.
German Model of Utility No. 94 26 769.4 differs basically from the preceding patent by virtue of the fact that the upper portion of the gaiter extends beyond the upper of the boot to be protected; however, the lower portion thereof extends in the same manner at least partially beneath the sole, accompanied by the same disadvantages as those previously mentioned.


A method and apparatus for protecting exposed pipeline joints on weight coated pipelines used in offshore applications. The method allows quick installation on a lay barge where pipeline sections are being welded together for offshore installation. The method does not require a long cure time before handling. The method protects the corrosion coating on pipeline joint sections not covered with weight coat by forming a pliable sheet of polyethylene into a cylindrical cover material sleeve over the exposed pipeline joint connection. Polyurethane chemicals are reacted to form a high density foam which fills an annular space between the pipe and the cover material sleeve. The cover material sleeve and the foam form a composite system to protect the joint connection whereby the foam provides continuous compressive reinforcements and impact resistance and the sleeve provides puncture resistance and protection from water jetting/post trenching operations plus abrasion resistance.

1. Field of the Invention
This invention relates to pipeline joint protection. More specifically, the invention provides a method and an apparatus for protecting exposed pipe joints on weight coated pipelines used in offshore applications.
2. Description of the Related Art
It has been a common practice in the offshore pipeline industry to use weight coated pipe for pipelines which were to be located on ocean floors or other underwater surfaces. The weight coats traditionally used have been made of dense materials, frequently concrete, applied several inches thick around the circumference of the pipe. The weight coats were to protect the pipeline and also to provide sufficient weight to maintain the pipeline submerged in a non-buoyant condition.
The weight coats usually have been applied to the full length of the pipe except for a short distance, usually about one foot from the end of each pipe section. The end portion of the pipe remained without the weight coat to facilitate welding sections of the weight coated pipe together to make up the pipeline.
Sections of pipe have been placed on a barge and welded sequentially onto preceding sections forming a pipeline extending from the barge. The newly formed pipeline was on rollers and as the barge moved forward, the pipeline would be carried over the rollers, lowered, and laid on the bed of the body of water.
The portions of the pipe without the weight coat had a corrosion coating applied to the surface of the pipe to prevent the pipe from corroding due to exposure to the elements. Generally, the corrosion coatings used were heat shrinking tape or a fusion bonded epoxy. After the sections of pipe were welded together various techniques were used to protect the corrosion coating on the exposed portions of pipe around each joint.
One technique was to wrap sheet metal over the weight coating adjacent the exposed portion of the pipe and band the sheet metal in place with metal bands. Generally, a 26 to 28 gauge zinc coated sheet metal was used. The space between the pipe and sheet metal was then filled with a molten mastic which would solidify as it cooled. However, in most cases, the pipeline had to be in a condition for handling immediately after the sleeves were filled so that the laying of the pipeline could proceed without delays. The mastic filling did not set or harden to a sufficiently strong material within the required time to allow further processing of the pipe and the mastic would leech out into the water if the pipeline was lowered before the mastic was adequately cured.
An additional problem associated with this technique was that the banding used to hold the sheet metal in place, as well as the sheet metal itself, would corrode after the pipejoint was underwater for a period of time. Once the banding corroded, the sharp ends of the sheet metal would come loose from the pipe. This created a particular problem in areas where commercial fishing was taking place. The sharp sheet metal ends would cut fishing nets which were being dragged over the pipeline by fishing trawlers. The destruction of fishing nets by the loose sheet metal created severe financial problems for fishing industries. In some cases, corrosion resistance banding, such as stainless steel banding, was used to avoid this problem, but it was more expensive and also subject to eventual failure.
Other techniques replaced the mastic filler with other types of materials. In the method disclosed in U.S. Pat. No. 5,328,648, the exposed portion of pipe was covered with a mold which was then filled with a filler material. The filler materials were granular or particulate matter such as gravel or iron ore which would not pack solidly or uniformly. Elastomeric polyurethanes or polyureas were then injected into the mold in an attempt to fill the interstices between the granular fill materials. After the polymer components had reacted completely the mold would be removed from the surface of the infill.
This method could be difficult to use when the joint protection system was applied aboard the lay barge because the filler material, often gravel, had to be loaded and carried onto the barge. Additionally, there was often a lack of uniformity in the finished infill resulting from uneven polymer distribution in the filler material which created voids. Such voids could leave the corrosion coating exposed and subject to damage from fishing trawler nets or other objects moving through the water which might encounter the submerged pipeline.
Another technique, disclosed in U.S. Pat. 4,909,669, involved wrapping the exposed portions of pipe with a thermoplastic sheet. The sheet overlapped the ends of the weight coat adjacent the exposed joint and was then secured in place by screws, rivets, or straps. To increase the rigidity and impact resistance this joint protection system required the installation of reinforcing members such as plastic bars or tubes to the interior of the sheet. The reinforcement bars or tubes either had to be precut and stored on the barge or else cut to the required fitting form as part of the installation process on the barge. This required additional handling and made the installation process more difficult.
Another method of reinforcing this joint protection system was to fill the lower portion of the annular space between the pipe and the plastic sheet with a material such as pre-formed foam half shells. When foam half shells were used in the lower portion of the annular space to provide support, the upper portion of the joint and the corrosion coating was in effect protected only by the plastic sheet enclosing the upper portion which had no foam covering. This could cause a particular problem if the pipelines were located where they would encounter the drag lines or trawler boards attached to the nets of fishing trawlers. The corrosion coating on the upper portion of the pipe joint could become damaged by this type of towed object.
An additional problem with this joint protection system occurred when pipelines were laid in shallow waters, i.e., less than about 200 feet deep. Pipelines in shallow waters were often buried by using high pressure water jets which were directed at the ocean floor where the pipelines were to be buried. The water jets would wash out a trench into which the pipelines would be dropped for burial. The joint protection system could be damaged when the water jets came in contact with the pipeline joint because the plastic sheet over the top of the pipejoint was not reinforced.

Protection of pipeline joint connections


Virtualization software establishes multiple execution environments within a virtual machine, wherein software modules executing in one environment cannot access private memory of another environment. A separate set of shadow memory address mappings is maintained for each execution environment. For example, a separate shadow page table may be maintained for each execution environment. The virtualization software ensures that the shadow address mappings for one execution environment do not map to the physical memory pages that contain the private code or data of another execution environment. When execution switches from one execution environment to another, the virtualization software activates the shadow address mappings for the new execution environment. A similar approach, using separate mappings, may also be used to prevent software modules in one execution environment from accessing the private disk space or other secondary storage of another execution environment.

1. Field of the Invention
This invention relates to isolating the code and/or data of one or more software modules within a computer system.
2. Description of the Related Art
The invention may be implemented as one or more computer programs or as one or more computer program modules embodied in one or more computer readable media. The computer readable media may be based on any existing or subsequently developed technology for embodying computer programs in a manner that enables them to be read by a computer. For example, the computer readable media may comprise one or more CDs (Compact Discs), one or more DVDs (Digital Versatile Discs), some form of flash memory device, a computer hard disk and/or some form of internal computer memory, to name just a few examples. An embodiment of the invention, in which one or more computer program modules is embodied in one or more computer readable media, may be made by writing the computer program modules to any combination of one or more computer readable media. Such an embodiment of the invention may be sold by enabling a customer to obtain a copy of the computer program modules in one or more computer readable media, regardless of the manner in which the customer obtains the copy of the computer program modules. Thus, for example, a computer program implementing the invention may be purchased electronically over the Internet and downloaded directly from a vendor's web server to the purchaser's computer, without any transference of any computer readable media. In such a case, writing the computer program to a hard disk of the web server to make it available over the Internet may be considered a making of the invention on the part of the vendor, and the purchase and download of the computer program by a customer may be considered a sale of the invention by the vendor, as well as a making of the invention by the customer.
This invention may be implemented in a wide variety of computer systems, having a wide variety of hardware platforms and configurations and a wide variety of software platforms and configurations. If a computer system includes multiple software entities or software modules, or at least has the potential to contain multiple software modules, then the integrity of the computer system may be improved by implementing this invention to protect the code and/or data of one or more of the software modules from other software modules in the system.
Over the years, a variety of techniques have been used for executing multiple software modules within a computer system. Early computer systems could execute multiple software programs, but they could only execute one program at a time. Such computers might load one program into memory and execute it to completion or other termination, before proceeding to a subsequent program that would then be loaded into memory and executed. As another example, various multitasking operating systems (OSs) enable multiple programs (or selected portions thereof) to be loaded into memory at one time and executed in an alternating manner, according to a scheduling algorithm. Also, some processors include multithreading capabilities, which enable multiple threads of one or more programs to be executed simultaneously on a single processor. Finally, multiprocessor computer systems have also become commonplace, in which each of multiple processors can execute one or more threads all at the same time. This invention may be advantageously implemented in any of these types of systems, as well as other possible computer systems in which multiple software modules may be executed.
Such computer systems generally attempt to isolate the code and data of the different software modules within the computer system from each other, so that, for example, one software module cannot interfere with the execution of another software module by altering its code or data. Such isolation may be provided for code and/or data that is stored on a hard drive (or other secondary data storage means) and/or that is resident in main memory (or other primary data storage means). In this patent, the term "data" is generally used in a broad sense, to include data that is operated on by the instructions (code) of a software module as well as the contents of a stack and any other possible forms of data that are associated with a software module. As one example of the isolation of code and data, many systems implement a virtual addressing mechanism, in which different software modules within the system have different virtual address spaces, with each virtual address space generally being mapped to different portions of the physical address space of the computer system, so that the virtual addresses of a given software module are generally only mapped to physical addresses that contain the code or data of that particular software module. Virtual addressing mechanisms are described in greater detail below. A given software module may attempt to access every memory location in its own virtual address space, accessing every memory location to which it has access, and it will still only be able to access its own code and data (assuming that there is no shared memory). Thus, providing a virtual addressing mechanism provides some isolation between the code and data of multiple software modules in a computer system. Various other protection mechanisms may also be implemented in such computer systems to isolate the code and/or data of multiple software modules from one another.
Although the invention may be implemented in a wide variety of computer systems, having a wide variety of hardware and software platforms and configurations, the following description is generally limited to a single hardware platform for brevity. In particular, this description is generally limited to computer systems that include one or more processors having the "x86" architecture, which is described in the IA-32 Intel Architecture Software Developer's Manual ("the IA-32 Manual") from Intel Corporation. Also for brevity, the following description is generally limited to computer systems running a Windows OS from Microsoft Corp. or a Linux OS, although there are certainly other OSs that operate on the x86 platform. A Windows OS from Microsoft Corp. may be a Windows XP OS or a Windows 2000 OS, for example, while a Linux OS may be a distribution from Novell, Inc. (SUSE Linux), Mandrakesoft S.A. or Red Hat, Inc. Based on the following description related to the x86 architecture and a Windows or Linux OS, a person of skill in the art will be able to implement the invention in a wide variety of other computer systems.
The x86 architecture provides two primary memory protection mechanisms that may be used by an OS (or other system software) to try to isolate the code and data of multiple tasks or processes that execute on the processor, namely a segmentation mechanism and a paging mechanism. The IA-32 Manual may be consulted for a detailed description of these protection mechanisms. The Windows and Linux OSs use the paging mechanism, but they generally don't take advantage of the segmentation mechanism. Instead, these OSs define segments that include the entire addressable range of the processor, so that the segmentation protection mechanism becomes ineffective in providing isolation between the code and data of multiple tasks. Thus, for simplicity, this discussion focuses on the paging mechanism of the x86 processor, which implements a virtual addressing mechanism as described briefly above and in greater detail below.
Very briefly for now, for Windows and Linux OSs, different user processes are generally given different virtual address spaces. The OS creates a different set of page tables (and a page directory) for each virtual address space, which maps the respective virtual addresses to physical addresses. Thus, the page tables for a given user process map that process's virtual addresses to the physical addresses that contain the code and data for that process. The page tables for the user processes also contain mappings for code and data of the OS, but the user processes cannot use these mappings because the user processes are executed at a Current Privilege Level (CPL) of 3 and these mappings are set to require a supervisor privilege level (a CPL of 0, 1 or 2). Otherwise, the page tables for a given user process generally only contain mappings to physical memory pages that contain that process's code and data. Therefore, a user process can generally only access its own code and data. Executing the user processes at a CPL of 3, also prevents the processes from modifying their own page tables. Otherwise, a process could add entries to its page tables that map to any physical address in the system, so that the process could give itself access to the code and data of other software modules, including other user processes and the OS.
Windows and Linux OSs generally provide adequate protection for the software modules in a computer system, so long as all of the software modules are well designed and well behaved, meaning that they are not attempting to circumvent the protection mechanism. Thus, many processes may be running concurrently in such a computer system, with the OS giving each process a share of the system resources, including processor time, memory space and hard disk space, without any of the processes interfering with the code or data of the other processes.
FIG. 1 illustrates a simple computer system 2A having multiple software modules. The computer system 2A includes system hardware 100A, an OS 20A, a first application 40A and a second application 40B. The system hardware 100A may be conventional hardware based on, for example, the x86 platform, and the OS 20A may be, for example, a Windows OS or a Linux OS. The applications 40A and 40B may be any applications designed to run on the system hardware 100A and the OS 20A. The OS 20A also includes a set of drivers 29A, which may be conventional drivers for the OS 20A, possibly including one or more drivers from a company that is different from the OS vendor (a third party vendor).
The OS 20A, in conjunction with the system hardware 100A, attempts to isolate the code and data of the applications 40A and 40B from one another. For example, the OS 20A and the system hardware 100A may implement a virtual addressing mechanism, as described above. As illustrated in FIG. 1, implementing such a protection mechanism may be characterized as establishing an isolation barrier 80B between the applications 40A and 40B, preventing (or at least hindering) one application from accessing the code and data of the other application. There may also be some code and/or data that is shared explicitly or transparently between the applications 40A and 40B. Techniques are known for allowing such sharing of code and data, while maintaining isolation between the applications 40A and 40B. For example, the OS 20A may mark physical memory pages that contain shared code or data as read only, such as when using a copy-on-write (COW) technique. The isolation barrier 80B may be referred to as an "OS isolation barrier" because it is implemented by the OS 20A, in conjunction with the system hardware 100A. The OS 20A, again in conjunction with the system hardware 100A, also establishes an OS isolation barrier 80A between the OS 20A and all applications in the system, including the applications 40A and 40B, so that the applications are prevented (or hindered) from directly accessing the code and data of the OS 20A. In the case of a Windows or Linux OS running on an x86 platform, the OS isolation barrier 80A is established by executing the applications in the system at a CPL of 3 and requiring a supervisor privilege level to access memory pages containing the code and data of the OS 20A.
Although the Windows and Linux OSs provide adequate isolation between software modules for computer systems that contain only well designed and well behaved software modules, malicious software modules have been known to wreak havoc in such computer systems by circumventing the protection mechanisms and engaging in all sorts of mischief. In particular, such malicious software modules have been known to breach the OS isolation barriers 80B and 80A, and corrupt the code and/or data of other applications in the system, and/or of the OS itself. Numerous security vulnerabilities have been discovered in the Windows OSs and, to a lesser extent, in the Linux distributions, and many of these vulnerabilities have been exploited by hackers using different types of malicious software, such as viruses, worms, etc. Microsoft Corp. acknowledges in its '006 patent (referenced below) that "open operating systems that allow users to easily install hardware and software . . . are inherently untrustworthy" (the '006 patent, paragraph [0004]). Poorly designed or implemented software may inadvertently bypass these protection mechanisms too and may also wreak havoc in a computer system. Although the description in this patent generally relates to malicious software, it also applies to software that inadvertently has the same or similar effects as malicious software.
Thus, hackers that exploit the vulnerabilities described above do so for a variety of reasons and with a variety of goals, some being relatively benign and others being quite destructive or disruptive. As one example, a malicious software module may be written and deployed that searches for sensitive data on a computer's hard drive or in its memory and transmits any such sensitive data back to the hacker that launched the malicious code. If the malicious software manages to execute at supervisor level (with a CPL of 0, 1 or 2), which is a common occurrence, then the malicious software may access a variety of system resources that are supposed to be safeguarded. For example, the malicious software can create its own page table entries, and obtain access to any address within the physical address space of the processor. The malicious software can then scan the entire physical memory for sensitive data, including memory that contains code and data of other software modules. A wide variety of other possibilities also exist.
Security threats such as these have been gaining greater notoriety, and it is widely accepted that something should be done to improve the security of the ubiquitous personal computer, and, in particular, there is a recognized need to improve the security for the vast number of computers based on the x86 architecture. Many people believe that software changes alone will not provide adequate protection. Accordingly, many different companies are working toward solutions that involve substantial changes to both the system hardware and the system software of a computer system. Many such security measures will also require substantial changes to application level software as well. Some of the security measures that have been or are being pursued by various companies are described below.
U.S. Pat. No. 6,507,904 (Ellison et al., "Executing Isolated Mode Instructions in a Secure System Running in Privilege Rings", "the '904 patent"), which was assigned to Intel Corporation, describes a computer system in which a processor operates in either a normal execution mode or an isolated execution mode. Among other features, the computer system includes an isolated region in system memory that is protected by both the processor and a chipset of the computer system. Access to the isolated region is permitted only when using special bus cycles, referred to as isolated read and write cycles. The isolated read and write cycles may only be issued by the processor when it is executing in the isolated execution mode. Execution in the isolated execution mode is restricted, so that access to the isolated memory region is also restricted, accordingly.
U.S. Pat. No. 6,820,177 (Poisner, "Protected Configuration Space in a Protected Environment", "the '177 patent"), which was also assigned to Intel Corporation, describes a computer system in which the physical address space encompasses a protected configuration space and a non-protected configuration space. Attempts to access addresses within the protected configuration space are redirected to protected configuration hardware that is external to the system memory. This protected configuration hardware holds control values, provides control information, and performs operations pertaining to a protected operating environment. Attempts to access the protected configuration space are permitted only if they are made by a processor, and only if they are made using a "protected command." Restricting access to the protected configuration hardware purportedly enables the system to maintain a protected operating environment. The protected operating environment may include blocks of protected memory, which are apparently protected from any attempted access by non-processor devices.
U.S. Pat. No. 6,986,006 (Willman et al., "Page Granular Curtained Memory via Mapping Control", "the '006 patent"), which was assigned to Microsoft Corporation, describes a method by which access to trusted memory is restricted using a paging mechanism, by not including mapping entries in page tables that map to physical memory pages that contain the trusted memory. The memory pages that contain the page tables are then restricted to read-only access when the processor is operating in a non-trusted mode to prevent non-trusted software from adding a new mapping entry or modifying an existing mapping entry to map to trusted memory. If non-trusted software attempts to write to a memory page containing a page table, a context switch is initiated into a page table entry edit module, which is trusted software. The page table entry edit module then ensures that the attempted write does not establish a mapping into trusted memory. The '006 patent does not specifically indicate how non-trusted software is prevented from changing the memory pages containing page tables to read/write access or from corrupting or supplanting the page table entry edit module to enable the non-trusted software to establish a mapping to trusted memory. The '006 patent does indicate, however, that the memory controller or other hardware may be able to restrict access to certain pages of physical memory under the control of the page table entry edit module. A new hardware platform or substantial changes to an existing hardware platform would presumably be necessary to implement such a restriction.
U.S. Pat. No. 7,058,768 (Willman et al., "Memory Isolation Through Address Translation Data Edit Control", "the '768 patent"), which is a continuation-in-part of the '006 patent and which was also assigned to Microsoft Corporation, is similar to the '006 patent, although the '768 patent uses different terminology and it goes into greater detail in some areas. The '768 patent describes a computer system that includes a trusted environment and an untrusted environment. A trusted component in the trusted environment purportedly ensures that, when the system is executing in the untrusted environment, no active address translation map includes an address mapping that maps to isolated memory, so that the isolated memory is not accessible to untrusted components. Again, the '768 patent does not specify how the trusted environment is established or maintained, but implementing the computer system described in the '768 patent presumably requires substantial hardware changes.
U.S. Patent Application Publication No. 2004/0205203 (Peinado et al., "Enforcing Isolation Among Plural Operating Systems", "the '203 application"), which was also assigned to Microsoft Corporation, describes a method for restricting the physical addresses that are accessible to Direct Memory Access (DMA) devices in a computer system in which multiple OSs run. In this method, a security kernel maintains a DMA exclusion vector that specifies which physical addresses are accessible to different DMA devices. A hardware device, referred to as a regulator, enforces the physical address restrictions specified in the DMA exclusion vector. The '203 application also briefly mentions the possibility of using a shadow page table technique to prevent one OS from accessing the private data of another OS, and the '203 application mentions the more general possibility of employing an "adjunct memory access control scheme."
U.S. Pat. No. 6,651,171 (England et al., "Secure Execution of Program Code", "the '171 patent"), which was also assigned to Microsoft Corporation, describes a system in which hardware enforces a restricted memory arrangement. Multiple curtained memory rings are arranged in a hierarchical manner, similar to the protection rings of the x86 architecture. Different code and data are associated with each of the memory rings. Software in more-privileged rings can access code and data in less-privileged rings, but software in less-privileged rings cannot access code or data in more-privileged rings. Also, there may be multiple subrings within a given ring. Software within a given ring can also access code and data within its own ring, except that it cannot access code or data within a different subring.
U.S. Patent Application Publication No. 2003/0093686 (Barnes et al., "Memory Management System and Method Providing Linear Address Based Memory Access Security", "the '686 application"), which was assigned to Advanced Micro Devices, Inc., describes a Memory Management Unit (MMU) that includes a Security Check Unit (SCU) that receives a linear address generated during the execution of a current instruction. The linear address has a corresponding physical address residing within a selected memory page. The SCU uses the linear address to access one or more security attribute data structures located in the memory to obtain a security attribute of the selected memory page. The SCU compares a numerical value conveyed by a security attribute of the current instruction to a numerical value conveyed by the security attribute of the selected memory page, and produces an output signal dependent upon a result of the comparison. The MMU accesses the selected memory page dependent upon the output signal. The security attribute of the selected memory page and the security attribute of the current instruction may each include a security identification (SCID) value indicating a security context level of the selected memory page or the current instruction, respectively.
U.S. Pat. No. 6,823,433 (Barnes et al., "Memory Management System and Method for Providing Physical Address Based Memory Access Security", "the '433 patent"), which was also assigned to Advanced Micro Devices, Inc., discloses a MMU that is similar to the MMU disclosed in the '686 application. A security unit in the MMU of the '433 patent uses a physical address, instead of a linear address, to access security attribute data structures to obtain a security attribute of a selected memory page. Otherwise, the disclosure of the '433 patent is substantially similar to the disclosure of the '686 application.
U.S. Pat. No. 7,073,059 (Worley, J R. et al., "Secure Machine Platform that Interfaces to Operating Systems and Customized Control Programs", "the '059 patent"), which was assigned to Hewlett Packard Company, describes a "Secure Platform" (SP), which includes a software layer that executes at a privileged level on a modern processor architecture, such as the IA-64 processor architecture from Intel Corporation. The SP interfaces with one or more OSs and customized control programs, and allows them to access non-privileged machine instructions and registers. However, the OSs and customized control programs purportedly have no direct access to privileged instructions and registers and firmware interfaces. Instead, the SP allows the OSs and customized control programs to invoke software routines that provide control of the hardware, without exposing the privileged machine instructions and registers. The SP also organizes the resources of the system into one or more disjoint, mutually isolated partitions, called "domains." A single OS and all user-level processes managed by that OS together comprise a domain, and each domain is allocated a separate portion of virtual memory, along with other system resources. The SP employs the region registers and region identifiers, along with protection keys, of the IA-64 processor architecture to partition memory between the different domains.
With respect to the ubiquitous x86 platform, each of the possible security measures described above would require substantial hardware changes or an entirely new hardware platform. They would also require substantial changes to existing software platforms, including system software and possibly application software. Applications in some of these implementations might also have limited access to input/output devices because of a limited supply of trusted device drivers. A widespread transition from the x86 platform to a new hardware platform will likely be a slow, gradual process. The amount of money that is invested in computer hardware and software based on the x86 architecture throughout the world is enormous. Many individuals, businesses, schools, governments and other organizations will be reluctant to scrap their current x86 systems, along with all the software that currently runs on x86 systems, and replace them with new technology. Even if a new, more secure and widely accepted hardware platform were available today, it would still take a long time for the new hardware to become anywhere near as widespread as the x86 platform is today. In the meantime, a large number and proportion of computers would remain vulnerable to the security threats described above.
Also, even those individuals and organizations that quickly adopt the new hardware and software technology may still be susceptible to adverse effects resulting from lingering vulnerabilities of x86 computers. For example, a malicious software module may attack an x86-based server computer running a web application. If the malicious software takes down the server computer, any client computer attempting to access the web application will be adversely affected no matter how secure the client computer is. As another example, a malicious software module may infect a large number of x86 computers connected to the Internet. The many instances of the malicious software module on all the x86 computers may then mount a coordinated denial of service attack on a particular website on the Internet. In this case, the server computer(s) that are hosting the website and any bonafide client computers trying to access the website may be adversely affected by the attack, again, regardless of the technology implemented in either the server computer(s) or the bonafide client computers.
As a final example, even if an individual or organization has spent the money to replace all of its own computers and software with the new technology, sensitive information of the individual or organization may still reside on some external computer that remains vulnerable to the security threats described above. Suppose, for example, that an individual forks out the money to buy a new computer system based on a new hardware and software platform, so that all the sensitive information on the individual's computer system is now relatively secure. Suppose further, however, that the individual's bank (or any other organization that has sensitive information of the individual, such as some small company running an obscure Internet website from which the individual has made a purchase) has thus far continued to use its x86 computers instead of investing in the new technology. Again, if malicious software is able to exploit a vulnerability in the bank's computer system, a hacker may be able to steal sensitive information of the individual no matter what technology the individual is using.
What is needed, therefore, is a security measure that can be implemented more quickly and easily, without requiring such a large investment in new computer hardware and software. More particularly, what is needed is a solution that provides better isolation for the code and/or data of software modules within a computer system, but that can be implemented in software, without any hardware changes and with, at most, only minor software changes.
There are some proposed security measures that may be implemented primarily in software. In particular, there are some such measures that use virtualization technology to create multiple virtual machines (VMs), where different software modules run in different VMs. It is widely recognized that a well-designed and implemented virtualization layer can generally provide much greater isolation between multiple VMs than a general OS can provide between multiple software modules. For example, U.S. Pat. No. 6,922,774 (Meushaw et al., "Device for and Method of Secure Computing Using Virtual Machines", "the '774 patent"), which was assigned to the National Security Agency of the U.S. Government, describes a computer system that includes a Virtual Machine Monitor (VMM) that allows a user to create a number of VMs. The system includes a user-definable number of non-sensitive VMs and a user-definable number of sensitive VMs, all of which are isolated from one another by the virtualization technology. Each sensitive VM provides access to a secure area in a computer system that is accessible only through encrypted and/or authenticated connections. An encryption VM is created for and connected to each sensitive VM, where each encryption VM provides encryption capabilities, as well as possibly digital signature and key exchange capabilities. The computer system may also include a server connected to each VM in the system, where the server may be another VM or a stand-alone device. Each VM in the system can send information to the server, and the server can send information to any VM in the system, except as limited by user-definable rules for when a transfer is, or is not, appropriate to be transferred from one VM to another. Thus, the server allows information to be transferred from one VM to another when appropriate while maintaining isolation between VMs.
Another proposed security measure that takes advantage of the isolation provided by implementing multiple VMs was described in a technical paper entitled "Terra: A Virtual Machine-Based Platform for Trusted Computing," which was submitted to and presented at the Symposium on Operating Systems Principles, October 19-22, 2003, by Tal Garfinkel, Ben Pfaff, Jim Chow, Mendel Rosenblum and Dan Boneh ("the Terra paper"). The Terra paper describes a trusted VMM that partitions a single tamper-resistant, general-purpose platform into multiple isolated VMs. Existing applications and OSs can each run in a standard (open-box) VM that provides the semantics of today's open platforms. Applications can also run in their own closed-box VMs that provide the functionality of running on a dedicated closed platform. Among various other aspects of the proposed security measure, VMs on a single physical machine communicate with one another over virtualized standard input/output interfaces such as network interface cards, serial ports, etc.
FIG. 2 illustrates a general computer system 2B in which multiple VMs are implemented to isolate multiple software modules from one another. The computer system 2B includes system hardware 100B, which may be conventional hardware, such as hardware based on the x86 platform. The system hardware 100B may be substantially the same as the system hardware 100A of FIG. 1, or it may be substantially different. A virtualization software 200A executes on the system hardware 100B and supports a plurality of VMs, such as a first VM 300A and a second VM 300B, in a known manner. The virtualization software 200A may comprise a VMM, for example, such as a VMM as implemented in a virtualization product of VMware, Inc., the assignee of this patent. Such a VMM and other possible units of the virtualization software 200A are described in greater detail below.
In supporting the VM 300A, the virtualization software 200A virtualizes a virtual system hardware 310A, which may be based on an existing hardware platform, such as the x86 platform. An OS 20B, along with a set of drivers 29B, run on the virtual system hardware 310A. The OS 20B may be any OS designed to run on the hardware platform virtualized in the virtual hardware 310A. For example, if the virtual hardware 310A is based on the x86 platform, the OS 20B may be a Windows OS or a Linux OS. The set of drivers 29B may be conventional drivers for the OS 20B. A first application 40C and a second application 40D run on the OS 20B. The applications 40C and 40D may be any applications designed to run on the platform of the virtual hardware 310A and the OS 20B. Similar to the OS 20A of FIG. 1, the OS 20B, in conjunction with the virtual system hardware 310A, attempts to isolate the code and data of the applications 40C and 40D from one another, establishing an OS isolation barrier 80B between the applications 40C and 40D. Also similar to the OS 20A of FIG. 1, the OS 20B, again in conjunction with the virtual system hardware 310A, also establishes an OS isolation barrier 80A between the OS 20B and all applications in the VM 300A, including the applications 40C and 40D. Thus, the VM 300A may be substantially the same as the computer system 2A, except that the virtual system hardware 310A is virtual hardware, virtualized by the virtualization software 200A, instead of physical hardware.
In supporting the VM 300B, the virtualization software 200A virtualizes a virtual system hardware 310B, which may be based on an existing hardware platform, such as the x86 platform. An OS 20C, along with a set of drivers 29C, run on the virtual system hardware 310B. The OS 20C may be any OS designed to run on the hardware platform virtualized in the virtual hardware 310B. For example, if the virtual hardware 310B is based on the x86 platform, the OS 20C may be a Windows OS or a Linux OS. The set of drivers 29C may be conventional drivers for the OS 20C. A first application 40E and a second application 40F run on the OS 20C. The applications 40E and 40F may be any applications designed to run on the platform of the virtual hardware 310B and the OS 20C. Again, similar to the OS 20A of FIG. 1, the OS 20C, in conjunction with the virtual system hardware 310B, attempts to isolate the code and data of the applications 40E and 40F from one another, establishing an OS isolation barrier 80B between the applications 40E and 40F. Also similar to the OS 20A of FIG. 1, the OS 20C, again in conjunction with the virtual system hardware 310B, establishes an OS isolation barrier 80A between the OS 20C and all applications in the VM 300B, including the applications 40E and 40F. Thus, again, the VM 300B may be substantially the same as the computer system 2A, except that the virtual system hardware 310B is virtual hardware, virtualized by the virtualization software 200A, instead of physical hardware.
The virtualization software 200A isolates the VMs in the computer system 2B from one another. For example, the virtualization software 200A allows software within the VM 300A to access portions of physical memory in the system hardware 100B and it allows software within the VM 300B to access other portions of the physical memory. The virtualization software 200A maps attempted memory accesses from the respective VMs 300A and 300B to different portions of the physical memory, ensuring that no memory address generated by software in one VM can access code or data of another VM. In a similar manner, the virtualization software 200A maps attempted hard disk accesses from the respective VMs 300A and 300B to different portions of one or more hard disks in the system hardware 100B, ensuring that one VM cannot access the hard disk space of another VM.
The virtualization software 200A also takes other precautions to isolate the VMs in the computer system 2B from one another, and from the virtualization software 200A, itself. For example, U.S. patent application Ser. No. 10/917,713 (Agesen et al., "Restricting Memory Access to Protect Data when Sharing a Common Address Space", "the '713 application"), which has been assigned to the same assignee as this patent, and which is hereby incorporated herein by reference, describes methods that may be used to enable a VMM to occupy a portion of a linear address space of a VM, while preventing the VM from accessing the memory of the VMM. There are also various other methods that may be used to enable virtualization software to coexist with VMs in a virtual computer system, while protecting or isolating the virtualization software from software within the VMs. The virtualization software 200A may also prevent software within the VMs 300A and 300B from directly accessing certain hardware resources to further isolate the VMs from one another and from the virtualization software 200A. For example, the virtualization software 200A may prevent software within the VMs 300A and 300B from directly accessing a Direct Memory Access (DMA) device to prevent the possibility that the DMA device could be used to access either the hard disk space or the memory of other VMs or of the virtualization software itself. Various other precautions may also be taken, depending on the particular implementation. In addition to the precautions described thus far, the underlying system hardware may provide further support for isolating the VMs from each other and from the virtualization software. For example, Intel Corporation has implemented its Virtualization Technology (Intel VT), and Advanced Micro Devices, Inc. has implemented its AMD Virtualization (AMD-V) or Secure Virtual Machine (SVM), which provide hardware enhancements to facilitate the implementation of virtual computer systems.
Thus, the virtualization software 200A, in conjunction with the system hardware 100B, may be said to establish a first isolation barrier 280B between the VMs 300A and 300B and a second isolation barrier 280A between the virtualization software 200A and all VMs in the computer system 2B, including the VMs 300A and 300B. The isolation barriers 280A and 280B may be referred to as "virtualization barriers" because they are implemented by the virtualization software 200A, in conjunction with the system hardware 100B. The isolation barriers 280A and 280B may also be referred to as virtualization barriers because they are established through the virtualization of hardware resources, such as the virtualization of system memory.
It is widely recognized that virtualization techniques can generally provide better security and more effective isolation between multiple software modules than general OSs provide. Thus, the virtualization barriers 280A and 280B of FIG. 2 can generally provide much better isolation between the multiple VMs 300A and 300B and the virtualization software 200A than the OS isolation barriers 80A and 80B of FIG. 1 provide between the multiple applications 40A and 40B and the OS 20A. This improved isolation can be attributed to a variety of factors, depending on the particular situation. For example, OSs, such as the OS 20A, generally provide an Application Programming Interface (API) for use by applications, such as the applications 40A and 40B. These APIs can be used by application software first to discover and then to exploit vulnerabilities within the OS. Virtualization software, in contrast, generally has no such interface, or at least a more limited and/or restricted interface, for use by the software within a VM. Also, virtualization software generally does not need to rely on the integrity of third party device drivers. In contrast, general OSs often allow third party device drivers to execute at a most privileged level on the system hardware, so that they can access restricted hardware resources. If such a device driver contains malicious software, the driver can compromise the integrity of the entire computer system. Also, virtualization software is generally smaller and, in some ways, less complex than a general OS, such as a Windows or Linux OS, which generally leads to a smaller number of vulnerabilities that may be exploited to compromise the integrity of the computer system. Thus, virtualization software is likely to have fewer vulnerabilities than a general OS, and, more importantly, by the very nature of virtualizing a computer system, the virtualization software is much more isolated from software within a VM than a general OS is from other software within a computer system, making it much harder to discover and exploit any possible vulnerabilities.
Although computer systems that establish multiple VMs and that run different software modules within the different VMs generally provide better isolation for the software modules than do general OSs, such virtual computer systems have other limitations. First, if the software within a VM becomes corrupted by malicious software, the same problems described above relative to non-virtualized computer systems can occur within the affected VM. All software modules within the particular VM may be compromised by the malicious software. This scenario may be seen in FIG. 2. Suppose a malicious software module is able to execute within the VM 300A. If the malicious software is able to circumvent the OS isolation barriers 80A and/or 80B within that VM, then the malicious software can corrupt the OS 20B and/or the applications 40C and 40D. The virtualization barriers 280A and 280B will generally contain the malicious software within the VM 300A, however, so that it is not able to corrupt the virtualization software 200A or the software within the VM 300B. Thus, while the computer system 2B of FIG. 2 is able to limit the corruption to the VM 300A, the software within the VM 300A may be no more secure than the software within the computer system 2A of FIG. 1, depending on the circumstances. Of course, more VMs can be created within the virtual computer system 2B of FIG. 2 to further isolate the software modules within the computer system, but this increased isolation aggravates a second limitation of these virtual computer systems.
Multiple VMs within a computer system are generally similar to multiple physical computer systems. The multiple VMs generally have, at most, only limited communication and interaction with one another. For example, in the computer system of the '774 patent, the multiple VMs in the system can communicate with each other by sending information to a server, which can send the information on to another VM in the system, except as limited by user-definable rules. In the computer system described in the Terra paper, VMs on a single physical machine can communicate with one another over virtualized standard input/output interfaces such as network interface cards, serial ports, etc. Many software modules within a computer system, however, require more effective interaction or communication with other software modules. For example, multiple software modules may need to use shared memory to facilitate fast and efficient communication of data, or a software module may need to call a subroutine of another software module.
Another disadvantage of a computer system in which multiple VMs are used to isolate multiple software modules is that setting up and using such a system generally takes significantly more time and effort than a computer system in which multiple software modules and a general OS run directly on physical hardware. Individuals and organizations may be reluctant to adopt a multiple VM solution or they may not use such a solution consistently enough. Anytime such a solution is not used, and multiple software modules are run directly on a physical computer system or within a single VM, the risk of corruption by a malicious software module is increased.
What is needed therefore is a computer system for executing multiple software modules that provides improved security, such as is provided by the virtualized computer systems described above, while also providing more efficient and effective communication and/or interaction between multiple software modules. It would also be advantageous if such a computer system were easy to configure, use and maintain.

Isolating data within a computer system using private shadow mappings


An improved structure of nano-scaled and nanostructured Si particles is provided for use as anode material for lithium ion batteries. The Si particles are prepared as a composite coated with MgO and metallurgically bonded over a conductive refractory valve metal support structure.

Silicon is a promising material for high capacity anodes in lithium ion batteries (LIB). When alloyed with lithium, the specific capacity (mAh/g) of silicon is an order of magnitude higher than conventional graphite anode materials. However, silicon exhibits a large volume change (up to 400% expansion and contraction) during lithiation (charging) and delithiation (discharging), respectively. For bulk silicon, this creates structural stress gradients within the silicon and results in fractures and mechanical stress failure (pulverization) thereby decreasing effective electrical contact and lifetime of the silicon anode.
Considerable efforts have been undertaken to overcome this intrinsic issue by controlling the morphology and limiting the size of silicon particles to a size below which silicon is less likely to fracture, approximately 50 nm.
Various attempts to avoid the physical damage caused by silicon's expansion/contraction have included nanoscaled and nanostructured silicon in forms such as thin films; nanowires; nanotubes; nanoparticles; mesoporous materials; and nanocomposites. Most of these approaches do not provide viable, cost effective solutions.
One promising method utilizes Si—MgO composites formed by mechanical alloying/solid phase reaction of SiO2 and magnesium according to the reaction:2Mg(s)+SiO2(s)→2MgO(s)+Si(s)  (Formula I)The MgO matrix has shown to buffer the effects of volumetric changes; however, these composites have relatively low electrical conductivity rendering them poorly effective as anode material.
Sub-micron scale, electrochemically active particles dispersed on conductive substrates and supports have long been used for electrochemical cells including fuel cells and batteries. This support structure is an important component with regard to cell efficiency and lifetime. Valve (or refractory) metals particularly, (specifically: Titanium, Niobium, Tantalum, and their alloys) have been used as substrates for electrochemically active materials for over 70 years in application of chemical processing and cathodic protection. These applications utilize the formation of a passivating oxide film over the exposed valve metal areas, as a means of creating a conductive and electrochemically stable support structure for the active material.
Mg has long been used as a magnesiothermic reducing agent for purification of refractory metals. This process is common in production of high capacity, high surface tantalum powders for capacitor applications occurring via the vapor/solid phase reaction:5Mg(g)+Ta2O5(s)→5MgO(s)+2Ta(s)  (Formula II)The resulting magnesium oxide forms a surface coating over the host Ta particles, and is removed using mineral acids.
In one aspect the present invention provides electrically active electrode material for use with a lithium ion cell, the electrochemically active material electrode material comprising a valve metal substrate material formed of filaments or particles of a valve metal not larger than about 10 microns in cross section, and coated with metallurgically bonded silicon particles.
In a preferred embodiment, the valve metal is selected from the group consisting of tantalum, niobium, an alloy of tantalum, an alloy of niobium, hafnium, titanium and aluminum.
In another preferred embodiment, the valve metal filaments have a thickness of less than about 5-10 microns, and preferably have a thickness below about 1 micron.
In one aspect the silicon coating is comprised of nanoscaled nanoparticles.
In another aspect the silicon particles are coated on the valve metal substrate in a stabilizing MgO matrix.
In still another aspect, electrically active electrode material as above described is formed into an anode.
The present invention also provides a method of forming an electrode substrate useful for forming a lithium ion battery comprising the steps of: (a) providing valve metal substrate material formed of filaments or particles of a valve metal not larger than about 10 microns in cross section; and, (b) coating the valve metal substrate material with metallurgically bonded silicon formed by a magnesiothermic reaction of magnesium with silica and the valve metal.
In one aspect of the method, the magnesiothermic reaction is conducted under vacuum or in an inert gas at elevated temperature, preferably an elevated temperature selected from a group consisting of 800-1200° C., 900-1100° C. and 950-1050° C.
In another aspect of the method, the magnesiothermic reaction is conducted for time selected from 2-10 hours, 4-8 hours and 5-6 hours.
In yet another aspect of the method includes the step of removing at least some of the magnesium oxide following the reaction by acid etching.
In one preferred aspect of the method, the valve metal is selected from the group consisting of tantalum, niobium, an alloy of tantalum, an alloy of niobium, hafnium, titanium and aluminum.
In another preferred aspect of the method, the filaments or fibers have a thickness of less than about 5-10 microns, and preferably a thickness below about 1 micron.
In another aspect of the method, the electrochemically active material comprises silicon nanoparticles.
The present invention also provides a lithium ion battery comprising a case containing an anode and a cathode separated from one another, and an electrolyte, wherein the anode is formed of electrically active electrode material comprising the steps of: (a) providing valve metal substrate material formed of filaments or particles of a valve metal not larger than about 10 microns in cross section; and, (b) coating the valve metal substrate material with metallurgically bonded silicon formed by a magnesiothermic reaction of magnesium with silicon and the valve metal.
In yet another aspect of the cell, the valve metal is selected from the group consisting of tantalum, niobium, an alloy of tantalum, an alloy of niobium, hafnium, titanium and aluminum.

This patent is subject to a terminal disclaimer.

Nano-scale/nanostructured Si coating on valve metal substrate for lib anodes


Various embodiments are generally directed to an apparatus, method and other techniques to communicate configuration information during a neighbor aware network (NAN) discovery window to establish a fine timing measurement (FTM) procedure with one or more stations, the configuration information comprising at least one of a channel, a FTM start time, and an ordered list of the one or more stations, and perform the FTM procedure with the one or more other stations by communicating information in one or more FTM frames during a burst period.

Advances in technology have resulted in smaller and more powerful computing devices. For example, there currently exist a variety of portable personal computing devices, including wireless computing devices, such as portable wireless telephones, personal digital assistants (PDAs), wearable computer devices, and paging devices that are small, lightweight, and easily carried by users. More specifically, portable wireless telephones, such as cellular telephones and internet protocol (IP) telephones, can communicate voice and data packets over wireless networks. Further, many such wireless telephones can include other types of devices that may be incorporated in the wireless telephones. For example, a wireless telephone can also include a digital still camera, a digital video camera, a digital audio recorder, and an audio file player. Also, such wireless telephones can process instructions, such as a web browser application that can be used to access the Internet. Memories, such as a memory within a wireless telephone or other electronic device, may store instructions in addition to other data.
As wireless devices become less expensive and more common, networks can experience increased traffic, potentially burdening the networks, slowing performance of the wireless devices, and frustrating users. Accordingly, network setup and network resource allocation (e.g., how traffic is routed within the network) can be relatively important considerations in designing and implementing wireless devices and wireless networks.
Global navigation satellite systems (GNSSs), such as the global positioning system (GPS) and other like satellite positioning systems have enabled navigation services for mobile handsets in outdoor environments. Likewise, particular techniques for obtaining estimates of positions of mobile device in indoor environments may enable enhanced location based services in particular indoor venues such as residential, governmental or commercial venues. For example, a range between a mobile device and a transceiver positioned at fixed location may be measured based, at least in part, on a measurement of a round trip time (RTT) measured between transmission of a first message from a first device to a second device and receipt of a second message at the first device transmitted in response to the request message.

Techniques for conducting fine timing measurements


The invention relates to a device (10; 10a) for controlling pharmaceutical products (1) in particular, hard gelatin capsules, by means of a radiation source (11) preferably designed as an X-ray source, comprising a storage device (13) which receives the products (1) in an uncontrolled manner, and from which the products (1) are transferred to a transport element (15) in which the products (1) are arranged such that they form at least one row. The products (1) are transported in a clocked manner in the radiation area (25) of the radiation source (11) which exposes the products (1) to radiation, preferably perpendicular to the longitudinal direction thereof. A first stopping device (20) for separating the products (1) in the row is arranged upstream of the radiation source (11) in the direction of transportation (18) of the products (1), and at least one sensor element (28, 28a) coupled to an evaluation device (30) captures the radiation which passed through the products (1). According to the invention, at least two products (1) are separated from the row by means of the first stopping device (20) and are simultaneously positioned in the radiation area (25) and the image of the product (1) is captured by means of the at least one sensor element (28; 28a).

The invention relates to a device for controlling pharmaceutical products, in particular, hard gelatin capsules, by means of a radiation source preferably designed as an X-ray source, comprising a storage device which receives the products in an uncontrolled manner, and from which the products are transferred to a transport element in which the products are arranged such that they form at least one row, wherein the products are transported in a clocked manner in the radiation area (25) of the radiation source (11) which exposes the products to radiation, preferably perpendicular to the longitudinal direction thereof, wherein a first stopping device for separating the products in the row is arranged upstream of the radiation source in the direction of transportation of the products and wherein at least one sensor element coupled to an evaluation device captures the radiation which passed through the products.
Such a device is known from the subsequently published German patent application DE 10 2010 038 544 A1 of the applicant. The net weight of filling material located in hard gelatin capsules can, e.g., be determined using the known device with the aid of a radiation source designed as an X-ray source. In addition, the device is suited, e.g., to detecting undesirable foreign particles or the like in the hard gelatin capsules. In one variant to the embodiment disclosed in FIG. 6 of the addressed document, the pharmaceutical products arrive at a shaft-shaped transport device, in which the pharmaceutical products (hard gelatin capsules) are arranged in a row one above the other, from a storage element that accommodates the pharmaceutical products in an uncontrolled manner. In order to be able to separate respectively one pharmaceutical product from the row, a stopping device in the form of a ratchet pawl is provided, with which the respectively lowest hard gelatin capsule of the row can be separated. Only this hard gelatin capsule is evaluated with regard to the properties mentioned above (net weight or foreign particles) by the image of the X-rays on the side of the hard gelatin capsule opposite to the X-ray source being captured by means of an image recording sensor and being supplied to an evaluation device. A disadvantage with the known device is the relatively low output thereof.

Device for controlling pharmaceutical products


A high voltage transformer, especially for use in a microwave oven is provided. The high voltage transformer includes: a primary coil to which a commercial power supply is connected; a secondary coil for inducing a high voltage necessary for driving a magnetron of the microwave oven, with respect to the primary coil; a heater coil for inducing voltage necessary for heating a negative electrode of the magnetron, with respect to the primary coil; a core for forming a common magnetic path for the primary and secondary coils and the heater coil; and an insulation support including a side insulating member disposed between the primary, secondary and heater coils and the core, a bottom insulating member disposed between the bottom of the secondary coil and the core and a lead wire support integrally combined with the side insulating member and the bottom insulating member and formed with holes through which lead wires of the secondary coil pass. Accordingly, the insulation characteristic of the coils with respect to the core is improved and the coils can be prevented from being damage. Further, the probability of an electric shock due to exposure of terminals, especially at a high voltage side, of the transformer can be reduced and an assembly efficiency thereof can be increased.

The present invention relates to a high voltage transformer, and more particularly, to a high voltage transformer for use in a microwave oven.
A microwave oven cooks foods by dielectrically heating the foods by microwaves emitted from a magnetron thereof.
As shown in FIG. 1, a microwave oven generally includes a body frame 1 having a cooking room 5 and a component room 6, an external case 2 for surrounding the body frame 1, a door 3 for closing/opening the cooking room 5 and a control panel 4 for a user operation. Installed in the component room 6 are, a magnetron 7 for emitting a microwaves, a high voltage transformer 8 for generating a necessary voltage between positive and negative electrodes of the magnetron 7, a high voltage capacitor 9 for charging and discharging a high-voltage output of a secondary side of the high voltage transformer 8 to supply the high-voltage output to the positive electrode of the magnetron 7, and a cooling fan 10 for preventing the magnetron 7 from overheating Here, since the high voltage transformer 8 generates the necessary voltage to the positive and negative electrodes of the magnetron 7 from a commercial power source (AC 110/220 V), and especially generates the high voltage to the positive electrode of the magnetron 7 at the secondary side thereof, a superior insulation for the high voltage is required for the high voltage transformer 8 and it is necessary to handle the transformer carefully.
As shown in FIG. 5, a conventional high voltage transformer for a microwave oven includes a shell type core having an I-type core member 34a and an E-type core member 34b, primary and secondary coils 31 and 32 which are inserted into the core, and a heater coil 33 installed between the primary and secondary coils 31 and 32. Pass cores 42 and 42' are installed between the primary coil 31 and the heater coil 33 to fill up a space inside the core. For insulation with respect to the inner walls of the core, the primary and secondary coils 31 and 32 and the heater coil 33 are wrapped up in insulators 38 and 38', 39 and 39', 40 and 40', and 41 and 41', respectively. The pass cores 42 and 42' are insulated by mica sheets 43 and 43'.
Terminal boards 36 and 37 each having terminals 36a and 36a' and 37a and 37a' are attached to the primary and secondary coils 31 and 32 by an insulating tape (not shown), respectively. Lead wires 31a and 31a' and 32a and 32a' for the respective coils 31 and 32 are soldered to the terminals 36a and 36a' and 37a and 37a', respectively. The terminals 36a and 36a' of the primary terminal board 36 are connected to the external commercial power source and the terminals 37a and 37a' of the secondary terminal board 37 are connected to the high voltage capacitor.
In the above-described high voltage transformer, since the terminals, especially the secondary terminals at which the high voltage is induced are exposed to the outside, there is a probability of an electric shock, for example, in the state that the external case 2 is disassembled from the microwave oven for repair, as shown in FIG. 1.
Furthermore, for the installation of the terminal boards during assembling the high voltage transformer, the steps of soldering the lead wires of the coils to the terminals of the terminal boards, primarily attaching the insulating tape to the portions of the coils to which the terminal boards are attached and then fixing the terminal boards to the coils using the insulating tape are required. However, the taping processes are boresome and time-consuming.

High voltage transformer with side insulation support and formed with through-holes for lead wires


Disclosed are methods, systems, and non-transitory computer-readable medium for assigning wearable items in a subscription electronics transactions platform. For example, a method may include: generating a grid based on information regarding historically shipped wearable items, wherein the grid comprises at least a first cell and a second cell; determining an average percentage indicating how many wearable items have been used and an average predictive wearability metric for wearable items indicative of a propensity of a user to use the wearable items per number of wearable items shipped for each cell; generating a mapping configured to convert a predictive wearability metric to a squashed predictive wearability metric; and converting a first predictive wearability metric to a first squashed wearability metric based on the generated mapping.

It is a challenge for rental clothing subscription services to optimize the selection and delivery of clothing in a way that maximizes both user satisfaction and business objectives. In particular, it can be difficult to determine optimization objectives of wearable item selection that are aligned with multiple types of business objectives. Some systems and methods for wearable item selection optimize wearable item selection based on users who have had positive and high wearability experiences (e.g., instances in which the users have used the selected wearable items) because wearability prediction for such users to wear high-quality garments may be relatively higher compared to other users. Therefore, it may in the best interest for such systems and methods to optimize wearable item selection such that high-quality garments are shipped to relatively satisfied users in order to maximize overall wearability. This may allow relatively satisfied users to remain satisfied, but may similarly cause relatively dissatisfied users to remain relatively dissatisfied. Accordingly, there is a need for an improved method of optimizing wearable item selection in electronic clothing subscription platforms.
The background description provided herein is for the purpose of generally presenting the context of the disclosure. Unless otherwise indicated herein, the materials described in this section are not prior art to the claims in this application and are not admitted to be prior art, or suggestions of the prior art, by inclusion in this section.

Systems and methods for optimizing wearable item selection in electronic clothing subscription platform


A DC-DC converter converts an input voltage into an output voltage and includes an input terminal, an output terminal, a power stage, a switch driving circuit, a charge pump, and a capacitor. The power stage includes a high-side switch, a low-side switch and an inductor. The switch driving circuit generates a high-side switch driving signal and a low-side switch driving signal. The charge pump generates a first polarity current according to the high-side switch driving signal, and generates a second polarity current having an opposite polarity to the first polarity current according to the low-side switch driving signal. The capacitor generates a first voltage by integrating the first and second polarity currents generated by the charge pump. The switch driving circuit generates the high-side switch driving signal and the low-side switch driving signal according to a difference between the first voltage and a reference voltage.

A ripple-control DC-DC conversion is a method in which a voltage ripple at a power stage is inputted to a comparator and a comparator output signal is used as a switch driving signal, and the switching is a self-excited operation. Thus, since it is not require a clock supplied thereto from the outside and hence the operating speed is not limited by a clock frequency, the conversion has a feature of rapid response to load variation. Besides, the conversion has an advantage of reducing the circuit size because it does not require using a pulse width modulation (PWM) modulator or a compensator.
An example of a conventional ripple-control DC-DC converting circuit is described below. A high-side switch and a low-side switch, which complementarily operate, step down an input voltage applied to an input terminal to a voltage lower than the input voltage. The stepped-down voltage is smoothed by an inductor and a capacitor and is outputted from an output terminal.
When an output voltage is directly fed back, a loop operation is unstable due to a phase rotation of 180° by the inductor and the capacitor. In order to solve the problem, in the conventional ripple-control DC-DC converting circuit, a ripple voltage is generated by passing a difference voltage between the stepped-down voltage and the output voltage through a low-pass filter composed of a resistor Rf and another capacitor Cf. The ripple voltage is fed back and is compared with a reference voltage in a comparator. An output voltage of the comparator is used as a driving signal for the high-side switch, and a signal obtained by inverting a comparator output with an inverter is used as a driving signal for the low-side switch.
When the time constant Rf*Cf of the low-pass filter is set sufficiently large, the waveform of the ripple voltage is similar to the waveform of an inductor current, so that the phase rotation in the open loop amounts to 90°. As a result, the feedback loop operates stably.
As mentioned above, the conventional ripple-control DC-DC converter has an advantage that the stable operation can be achieved by a simple circuit but has a disadvantage that the time constant of the low-pass filter needs to be set large.
For example, in a ripple-control DC-DC converter that operates with a relatively high switching frequency of 4 MHz, an external resistor and a capacitor constituting the low-pass filter have large values of Rf=100 kΩ and Cf=150 pF. In order to apply the conventional technique to a DC-DC converter having a switching frequency lower than 4 MHz, elements having values larger than above are required, and it is very difficult to incorporate the low-pass filter into a DC-DC converter IC.


The present invention provides a heat exchanger capable of circulating a given amount of refrigerant without being affected by an operation state of a heat pump cycle. The heat exchanger comprises a liquid chamber in which liquid is stored, and a refrigerant chamber disposed in the liquid chamber. The heat exchanger also comprises a liquid supply port for supplying the liquid to the liquid chamber, a liquid discharge port for discharging the liquid in the liquid chamber, a refrigerant supply port for supplying the refrigerant to the refrigerant chamber, and a refrigerant discharge port for discharging the refrigerant in the refrigerant chamber. A liquid refrigerant storing section having a predetermined capacity in the refrigerant chamber and storing the liquid refrigerant is formed in the heat exchanger.

The present invention relates to a heat exchanger in which two different mediums come into contact with different duct walls to exchange heat, and the present invention also relates to a heat pump type air conditioning apparatus using the heat exchanger.
Conventionally, heat of a refrigerant which is heated utilizing a heat pump cycle is transmitted to liquid such as water through a heat exchanger, and the heated water is utilized as a heat source. For example, a heat pump cycle disclosed in Japanese Patent Application Laid-open No. 2002-98430 includes a first high-pressure side heat exchanger and a second high-pressure side heat exchanger, and the second high-pressure side heat exchanger exchanges heat between a high pressure refrigerant which flows out from the first high-pressure side heat exchanger and a second fluid with a lower temperature than that of a first fluid which exchanges heat in the first high-pressure side heat exchanger. A quantity of heat that can be taken out is equal to a sum of a quantity of heat that can be taken out by the first high-pressure side heat exchanger and a quantity of heat that can be taken out by the second high-pressure side heat exchanger. Therefore, the quantity of heat (enthalpy) that can be taken out by the heat pump is reduced, and coefficient of performance COP of the heat pump can be prevented from being deteriorated.

Heat exchanger, and heat pump type air conditioning apparatus using heat exchanger