Continuously available computer memory systems

• US 5,848,230 A
• Filed: 11/26/1996
• Issued: 12/08/1998
• Est. Priority Date: 05/25/1995
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Tandem Computers Incorporated (HP Inc.)
• Inventors: Walker, Mark S.
• Primary Examiner(s): Le, Dieu-Minh
• Application Number:
  US08/756,702
• Time in Patent Office: 742 Days
• Field of Search: 395/182.05, 395/182.04, 395/182.09, 395/182.11, 395/182.12, 395/182.2, 711/5, 711/114, 711/119, 364/228.3, 364/230, 364/230.4, 371/21.1, 371/40.2, 371/40.13
• US Class Current: 714/6.32
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2015 Redundant power supplies power supply failure G06F1/30
• CPC Class Codes: G06F 11/2058 using more than 2 mirrored copies
• CPC Class Codes: G06F 11/2082 Data synchronisation
• CPC Class Codes: G06F 11/2092 Techniques of failing over between control units
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups

Abstract

A highly reliable computer memory storage system that is divided into subsystems, each of which is provided in triplicate: a primary subsystem, a backup subsystem and a spare subsystem. Upon detection of a non-recoverable failure in a primary subsystem, the backup subsystem substantially immediately assumes the tasks of the primary subsystem while the spare subsystem is integrated into the operation of the computer memory storage system. The triple replication of all subsystems and mechanisms for detecting failures in at least the primary and secondary subsystems provides an overall memory system which is highly reliable and substantially never requires servicing. In an alternative embodiment, three subsystems can share a load equally, for example a cooling or power supply load requirement. Upon failure, of any one or two of such three redundant subsystems, the remaining subsystems(s) is built with sufficient extra capacity that remaining subsystem(s) can still supply the total power or cooling requirements of the system.

Claims

1. A memory system configurable for attachment to a host computer, comprising:

first, second and third data storage subsystems;

first, second and third controller subsystems, each operatively coupled to the first, second and third data storage subsystems for effecting read/write operations to the storage subsystems;

first, second and third cooling subsystems, each disposed to cool the entire memory system; and

first, second and third power supply subsystems, each operatively coupled to all of the storage subsystems, the controller subsystems and the cooling subsystems to supply power to the subsystems,

wherein upon a failure of one of the three controller subsystems, another one of the three controller subsystems takes control of read/write operations to the three storage systems, and upon a failure of said another one of the three controller subsystems, a remaining one of the three controller subsystems takes control of read/write operations to the three storage subsystems.

2. The memory system of claim 1, further comprising circuitry, operatively coupled to the first, second and third cooling subsystems for altering the operation of at least one of the cooling subsystems to compensate for the failure of another one of the cooling subsystems.

3. The memory system of claim 1, further comprising circuitry, operatively coupled to the first, second and third power supply subsystems, for altering the operation of at least one of the power supply subsystems to compensate for the failure of another one of the power supply subsystems.

4. The memory system of claim 1, wherein the first and second data storage subsystems include redundant data storage devices and the third data storage subsystem includes at least one spare storage device and wherein the controller subsystems are capable of causing the at least one spare storage device to assume the storage functions of a redundant data storage device.

5. The memory system of claim 1, wherein all of the subsystems are non-serviceable.

6. The memory system of claim 1, wherein the data storage subsystems are serviceable and all the other subsystems are non-serviceable.

7. The memory system of claim 1, further comprising an electrical isolation device operatively coupled to and forming a part of each controller subsystem and receptive to instructions, wherein upon receipt of an isolation instruction the receiving isolation device electrically isolates the associated controller subsystem from communication with the host computer.

8. The memory system of claim 1, wherein the data storage subsystems include magnetic disk drives.

9. The memory system of claim 1, wherein the data storage subsystems are serviceable and all the other subsystems are non-removable.

10. A memory system configurable for attachment to a host computer, comprising:

a redundant data storage subsystem;

a spare data storage subsystem;

first, second and third controller subsystems, each operatively coupled to the redundant data storage subsystem and to the spare data storage subsystem for effecting read/write operations to the storage subsystems;

first, second and third cooling subsystems, each disposed to cool the memory system; and

first, second and third power supply subsystems, each coupled to all of the data storage subsystems, the controller subsystems and the cooling subsystems to supply power to the subsystems,

wherein upon a failure of one of the three controller subsystems, another one of the three controller subsystems takes control of read/write operations to the three storage systems, and upon a failure of said another one of the three controller subsystems, a remaining one of the three controller subsystems takes control of read/write operations to the three storage subsystems.

11. The memory system of claim 10, wherein the redundant data storage subsystem includes a plurality of storage devices operative as a RAID storage system.

12. The memory system of claim 10, wherein the redundant data storage subsystem and the spare data storage subsystem include magnetic disk drives.

13. The memory system of claim 10, further comprising circuitry, operatively coupled to the first, second and third cooling subsystems for altering the operation of at least one of the cooling subsystems to compensate for the failure of another one of the cooling subsystems.

14. The memory system of claim 10, further comprising circuitry, operatively coupled to the first, second and third power supply subsystems, for altering the operation of at least one of the power supply subsystems to compensate for the failure of another one of the power supply subsystems.

15. The memory system of claim 10, wherein the redundant data storage subsystem includes redundant data storage devices and wherein the spare data storage subsystem includes at least one spare data storage device and further wherein the controller subsystems are capable of causing at least one spare data storage device to assume the storage functions of a redundant data storage device.

16. The memory system of claim 10, wherein all of the subsystems are non-serviceable.

17. The memory system of claim 10, wherein the data storage subsystems are serviceable and all of the other subsystems are non-serviceable.

18. The memory system of claim 10, further comprising an electrical isolation device operatively coupled to and forming a part of each controller subsystem and receptive to instructions, wherein upon receipt of an isolation instruction the receiving isolation device electrically isolates the associated controller subsystem from communication with the host computer.

19. The memory system of claim 10, wherein the data storage subsystems are serviceable and all the other subsystems are non-removable.

20. A method for operating a memory system for a host computer, wherein the memory system includes redundant data storage subsystems, at least one spare data storage subsystem, first, second and third controller subsystems, first, second and third cooling subsystems and first, second and third power supply subsystems, the method comprising the steps of:

a. initially operating the memory system under control of the first controller subsystem;

b. detecting a failure in the first controller subsystem;

c. disabling effective communication between the first controller subsystem and the host computer;

d. continuing further communication between the host computer and the second controller subsystem, wherein the memory system is operated under control of the second controller subsystem;

e. detecting a failure in the second controller subsystem;

f. disabling effective communication between the second controller subsystem and the host computer; and

g. continuing further communication between the host computer and the third controller subsystem, wherein the memory system is operated under control of the third controller subsystem.

21. The method of claim 20, wherein all of the subsystems are non-serviceable.

22. The method of claim 20, wherein the data storage subsystems are serviceable and all the other subsystems are non-serviceable.

23. The method of claim 20, wherein the data storage subsystems include magnetic disks.