Apparatus and method for storage controller to deterministically kill one of redundant servers integrated within the storage controller chassis

• US 7,320,083 B2
• Filed: 04/23/2004
• Issued: 01/15/2008
• Est. Priority Date: 04/23/2003
• Status: Active Grant

• Current Assignee: Dot Hill Systems Corporation (Seagate Technology Holdings Plc)
• Original Assignee: Dot Hill Systems Corporation (Seagate Technology Holdings Plc)
• Inventors: Davies, Ian Robert, Pecone, Victor Key, Kalwitz, George Alexander
• Primary Examiner(s): Baderman; Scott
• Assistant Examiner(s): Contino; Paul F
• Application Number:
  US10/831,688
• Publication Number:
  US 20050021605A1
• Time in Patent Office: 1,362 Days
• Field of Search: 714/4, 714/3
• US Class Current: 714/3
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/2005 using redundant communication controllers
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: G06F 11/201 between storage system components
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2046 where the redundant components share persistent storage G06F11/2043 takes precedence
• CPC Class Codes: G06F 11/2051 in regular structures
• CPC Class Codes: G06F 11/2092 Techniques of failing over between control units
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

An apparatus and method for deterministically killing one of redundant servers on a common network is disclosed. The apparatus includes a chassis that encloses the servers and a storage controller, status indicators generated by the servers to the storage controller, and kill controls, generated by the storage controller to respective ones of the servers, each for killing a respective one of the servers. The status indicators and kill controls are wholly enclosed in the chassis. The kill controls deterministically disable the killed server on the network independently of the state of the server to be killed. That is, the server does not need to be able to respond to a command to be disabled on the network. In one embodiment, the kill controls comprise reset signals. After the storage controller deterministically kills one of the servers, the other server takes over the identity of the killed server on the network.

Claims

1. A network storage appliance, comprising:

a first server, comprising a first I/O port having a first unique ID for communicating on a network;

a second server, comprising a second I/O port having a second unique ID for communicating on said network;

a storage controller, coupled to said first and second servers; and

a control path, between said storage controller and said first server, for said storage controller to deterministically inactivate said first I/O port independent of the operational state of said first server, wherein said second server is configured to assume said first unique ID on said second I/O port for communicating on said network after said storage controller inactivates said first I/O port.

2. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port independent of the intelligence of said first server.

3. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port regardless of whether said first I/O port is operational.

4. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port regardless of whether an interface controller comprising said first I/O port is operational.

5. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port regardless of whether a central processing unit comprised in said first server controlling said first I/O port is operational.

6. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port by causing said first I/O port not to participate on said network using said first unique ID.

7. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port by causing said first I/O port not to respond to said first unique ID on said network.

8. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port by causing said first I/O port not to transmit packets with said first unique ID on said network.

9. The network storage appliance of claim 1, wherein said second server assumes said first unique ID on said second I/O port for communicating on said network in response to said storage controller inactivating said first I/O port.

10. The network storage appliance of claim 9, further comprising:

a status indicator, provided by said storage controller to said second server, for communicating inactivation of said first I/O port, wherein said second server assumes said first unique ID on said second I/O port for communicating on said network in response to said storage controller indicating on said status indicator said storage controller inactivating said first I/O port.

11. The network storage appliance of claim 1, wherein said second server assumes said first unique ID on said second I/O port for communicating on said network in response to determining a failure of said first server.

12. The network storage appliance of claim 11, wherein said second server determining said failure of said first server comprises said second server detecting a failure of a heartbeat of said first server.

13. The network storage appliance of claim 12, further comprising:

a link, coupling said first and second servers, for communicating said heartbeat.

14. The network storage appliance of claim 11, wherein said second server waits a predetermined amount of time between determining said failure of said first server and assuming said first unique ID on said second I/O port for communicating on said network.

15. The network storage appliance of claim 1, wherein said first server comprises an interface controller comprising said first I/O port, wherein said storage controller is configured to reset said interface controller via said control path to inactivate said first I/O port.

16. The network storage appliance of claim 1, further comprising:

a backplane, configured to receive said first and second servers and said storage controller, wherein said backplane comprises at least a portion of said control path between said storage controller and said first server.

17. The network storage appliance of claim 16, wherein said control path comprises a reset signal generated by said storage controller and received by said first server.

18. The network storage appliance of claim 1, wherein said control path comprises:

a bus, coupling said storage controller and said first server, wherein said storage controller transmits a command on said bus to inactivate said first I/O port; and

control logic, coupled to said bus, for generating a reset signal to inactivate said first I/O port in response to said storage controller transmitting said command on said bus.

19. The network storage appliance of claim 18, wherein said first server comprises said control logic.

20. The network storage appliance of claim 19, wherein said control logic comprises a programmable logic device.

21. The network storage appliance of claim 18, wherein said storage controller transmitting said command on said bus comprises said storage controller writing to a predetermined address in an address space of said bus.

22. The network storage appliance of claim 18, wherein said storage controller transmitting said command on said bus comprises said storage controller writing a predetermined value on said bus.

23. The network storage appliance of claim 18, further comprising:

a backplane, configured to receive said first and second servers and said storage controller, comprising at least a portion of said bus.

24. The network storage appliance of claim 1, wherein said first and second servers, said storage controller, and said control path are enclosed in a single chassis.

25. The network storage appliance of claim 1, wherein said storage controller is configured to control a plurality of storage devices and to transfer data between said plurality of storage devices and said first and second servers.

26. The network storage appliance of claim 1, wherein said storage controller comprises a redundant array of inexpensive disks (RAID) controller.

27. The network storage appliance of claim 1, wherein said storage controller inactivates said first I/O port in response to determining a failure of said first server.

28. The network storage appliance of claim 27, wherein said determining said failure of said first server comprises determining a failure of said first server to generate a heartbeat indication to said storage controller.

29. The network storage appliance of claim 27, wherein said determining said failure of said first server comprises determining a failure of a central processing unit of said first server.

30. The network storage appliance of claim 27, wherein said determining said failure of said first server comprises determining a failure of said first I/O port of said first server.

31. The network storage appliance of claim 27, wherein said determining said failure of said first server comprises determining a component of said first server exceeded a predetermined temperature.

32. The network storage appliance of claim 1, wherein said storage controller inactivates said first I/O port in response to determining a condition in which each of said first and second servers is unable to transmit a heartbeat indication to the other.

33. The network storage appliance of claim 32, wherein said condition comprises a failure in a heartbeat communication link between said first and second servers.

34. The network storage appliance of claim 1, wherein said second server assumes said first unique ID on said second I/O port in addition to said second unique ID for communicating on said network in response to said storage controller deterministically inactivating said first I/O port.

35. The network storage appliance of claim 1, wherein said second server assumes said first unique ID on said second I/O port in place of said second unique ID for communicating on said network in response to said storage controller deterministically inactivating said first I/O port.

36. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique world wide names.

37. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique internet protocol (IP) addresses.

38. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique MAC addresses.

39. The network storage appliance of claim 1, wherein said first and second I/O ports comprise FibreChannel ports.

40. The network storage appliance of claim 1, wherein said first and second I/O ports comprise Ethernet ports.

41. The network storage appliance of claim 1, wherein said first and second I/O ports comprise Infiniband ports.

42. The network storage appliance of claim 1, wherein said storage controller is configured to inactivate said first I/O port by causing power to be removed from said first server.

43. The network storage appliance of claim 1, further comprising:

a second storage controller, coupled to said first and second servers; and

a second control path, between said second storage controller and said first server, for said second storage controller to deterministically inactivate said first I/O port, wherein said second server is configured to assume said first unique ID on said second I/O port for communicating on said network after said second storage controller inactivates said first I/O port.

44. The network storage appliance of claim 43, wherein said second storage controller is configured to deterministically inactivate said first I/O port via said second control path if said second storage controller determines said first storage controller has failed.

45. A method for deterministically killing one of redundant servers, comprising:

determining, by a storage controller integrated into a single chassis with redundant servers,

whether a heartbeat of one of the servers has stopped; and

generating, by the storage controller, a control signal wholly internal to the chassis for disabling the one of the servers whose heartbeat has stopped, independent of the operational state of the one of the servers, in response to said determining the one of the servers heartbeat has stopped.

46. The method of claim 45, wherein said disabling the one of the servers comprises the storage controller disabling one or more I/O ports of the one of the servers from participating on a network common to the servers.

47. The method of claim 46, further comprising:

taking over the identity on the network of the disabled server, by the other server, after said generating.

48. The method of claim 45, wherein said disabling the one of the servers is accomplished involuntarily with respect to the one of the servers whose heartbeat has failed.

49. An apparatus for deterministically killing one of redundant servers, comprising:

a chassis, for enclosing the servers and a storage controller;

status indicators, generated by the servers to said storage controller, wherein said status indicators are wholly enclosed in said chassis; and

kill controls, generated by said storage controller to respective ones of the servers, each for killing a respective one of the servers, independent of the operational state of said respective one of the servers, wherein said kill controls are wholly enclosed in said chassis.

50. The apparatus of claim 49, wherein said storage controller generates a signal on one of said kill controls to kill one of the servers in response to a corresponding one of said status indicators indicating a failure of said one of the servers.

51. The apparatus of claim 49, wherein said kill controls comprise reset signals for resetting respective ones of the servers.