Apparatus and method for a server deterministically killing a redundant server integrated within the same network storage appliance chassis

• US 7,401,254 B2
• Filed: 07/16/2004
• Issued: 07/15/2008
• Est. Priority Date: 04/23/2003
• Status: Expired due to Fees

• Current Assignee: Dot Hill Systems Corporation (Seagate Technology Holdings Plc)
• Original Assignee: Dot Hill Systems Corporation (Seagate Technology Holdings Plc)
• Inventors: Davies, Ian Robert
• Primary Examiner(s): Baderman; Scott T
• Assistant Examiner(s): SCHELL, JOSEPH O
• Application Number:
  US10/893,486
• Publication Number:
  US 20050246568A1
• Time in Patent Office: 1,460 Days
• Field of Search: 714/9, 714/11, 714/4, 714/55, 714/56, 714/36, 710/32
• US Class Current: 714/11
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/2005 using redundant communication controllers
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

An apparatus for deterministically killing one of redundant servers integrated into a network storage appliance chassis along with at least one storage controller is disclosed. Each server can generate a kill signal on a backplane of the chassis to the other server in response to a stopped heartbeat of the other server in order to disable the I/O ports of the other server on a network so the live server can reliably take over the identity of the other server on the network. Unlike conventional kill paths, such as an Ethernet cable connecting the two servers in separate chassis, the present invention does not require the failed server to be operational since the kill path is substantially a direct reset to the I/O ports of the failed server. One server raises a shield before killing the other server to avoid both servers killing each other simultaneously.

Claims

1. A network storage appliance, comprising:

a chassis;

a first server, enclosed in said chassis, comprising a first I/O port having a first unique ID for communicating on a network;

a second server, enclosed in said chassis, comprising a second I/O port having a second unique ID for communicating on said network;

at least one storage controller, enclosed in said chassis, coupled to said first and second servers, for transferring data between storage devices and said first and second servers;

a control path, enclosed in said chassis, between said first and second servers, for said second server to deterministically inactivate said first I/O port from communicating on said network, wherein said second server is configured to assume said first unique ID for communicating on said network after said second server inactivates said first I/O port; and

a shield circuit, coupled to said control path, for selectively preventing said second server from inactivating said first I/O port, wherein said first server selectively enables said shield circuit to prevent said second server from inactivating said first I/O port.

2. The network storage appliance of claim 1, wherein said second server is configured to assume said first unique ID in addition to said second unique ID on said second I/O port for communicating on said network after said second server inactivates said first I/O port.

3. The network storage appliance of claim 1, wherein said second server further comprises a third I/O port for communicating on said network, wherein said second server is configured to assume said first unique ID on said third I/O port for communicating on said network after said second server inactivates said first I/O port.

4. The network storage appliance of claim 3, wherein said third I/O port is passive on said network until said second server assumes said first unique ID on said third I/O port for communicating on said network after said second server inactivates said first I/O port.

5. The network storage appliance of claim 1, further comprising:

a backplane, enclosed in said chassis, wherein said control path is comprised in said backplane.

6. The network storage appliance of claim 5, wherein said first and second servers and storage controller comprise a plurality of blades for plugging into said backplane.

7. The network storage appliance of claim 5, wherein said control path is etched in said backplane.

8. The network storage appliance of claim 6, wherein said plurality of blades are hot-pluggable into said backplane.

9. The network storage appliance of claim 1, wherein said control path is non-user-removable.

10. The network storage appliance of claim 1, wherein said second server is configured to deterministically inactivate said first I/O port via said control path in response to detecting that a heartbeat from said first server has stopped.

11. The network storage appliance of claim 10, further comprising:

a status path, enclosed in said chassis, between said first and second servers, for said first server to communicate said heartbeat to said second server.

12. The network storage appliance of claim 11, further comprising:

a backplane, enclosed in said chassis, wherein said status path is comprised in said backplane.

13. The network storage appliance of claim 10, wherein said second server is configured to deterministically inactivate said first I/O port via said control path in response to detecting that said heartbeat from said first server has stopped on a communications link external to said chassis coupling said first and second server.

14. The network storage appliance of claim 1, wherein said first server enables said shield circuit to prevent said second server from inactivating said first I/O port prior to said first server inactivating said second I/O port from communicating on said network.

15. The network storage appliance of claim 14, further comprising:

a second control path, enclosed in said chassis, between said first and second servers, for said first server to deterministically inactivate said second I/O port from communicating on said network after enabling said shield circuit.

16. The network storage appliance of claim 1, wherein said control path comprises:

control logic, for generating a reset signal to inactivate said first I/O port from communicating on said network in response to said second server transmitting a signal to said control logic.

17. The network storage appliance of claim 16, wherein said control logic comprises a programmable logic device.

18. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port independent of whether said first server is operational.

19. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port without intelligence of said first server.

20. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port regardless of whether said first I/O port is operational.

21. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port regardless of whether an interface controller comprising said first I/O port is operational.

22. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port regardless of whether a central processing unit comprised in said first server controlling said first I/O port is operational.

23. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server inactivating said first I/O port without requiring said first server to be in a predetermined state.

24. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server causing said first I/O port not to participate on said network using said first unique ID.

25. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server causing said first I/O port not to respond to said first unique ID on said network.

26. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server causing said first I/O port not to transmit packets with said first unique ID on said network.

27. The network storage appliance of claim 1, wherein said second server inactivates said first I/O port from communicating on said network and assumes said first unique ID for communicating on said network in response to determining a failure of said first server.

28. The network storage appliance of claim 27, wherein said second server determining said failure of said first server comprises said second server detecting a failure of a heartbeat of said first server.

29. The network storage appliance of claim 1, wherein said at least one storage controller comprises at least one redundant array of inexpensive disks (RAID) controller.

30. The network storage appliance of claim 1, wherein said second server inactivates said first I/O port in response to determining a condition in which each of said first and second servers is unable to transmit a heartbeat to the other.

31. The network storage appliance of claim 30, wherein said condition comprises a failure in a heartbeat communication link between said first and second servers.

32. The network storage appliance of claim 31, wherein said heartbeat communication link between said first and second servers comprises an Ethernet cable.

33. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique world wide names.

34. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique internet protocol (IP) addresses.

35. The network storage appliance of claim 1, wherein said first and second unique IDs comprise unique MAC addresses.

36. The network storage appliance of claim 1, wherein said second server deterministically inactivating said first I/O port comprises said second server causing power to be removed from said first server.

37. The network storage appliance of claim 1, wherein said at least one storage controller comprises redundant storage controllers.

38. The network storage appliance of claim 37, wherein said redundant storage controllers are configured to transfer data between said storage devices and each of said first and second servers.

39. The network storage appliance of claim 37, wherein two of said plurality of blades each comprise:

one of said redundant servers; and

a portion of one of said redundant storage controllers.

40. The network storage appliance of claim 1, further comprising:

a second control path, enclosed in said chassis, between said first and second servers, for said first server to deterministically inactivate said second I/O port from communicating on said network, wherein said first server is configured to assume said second unique ID for communicating on said network after said first server inactivates said second I/O port.

41. The network storage appliance of claim 40, further comprising:

a backplane, enclosed in said chassis, wherein said first and second control paths are comprised in said backplane.

42. The network storage appliance of claim 40, wherein said second server is configured to deterministically inactivate said first I/O port via said control path in response to detecting that a heartbeat from said first server has stopped.

43. The network storage appliance of claim 42, further comprising:

a status path, enclosed in said chassis, between said first and second servers, for said first server to communicate said heartbeat to said second server.

44. The network storage appliance of claim 43, further comprising:

a backplane, enclosed in said chassis, wherein said first and second control paths and said status path are comprised in said backplane.

45. The network storage appliance of claim 43, wherein said first server is configured to deterministically inactivate said second I/O port via said second control path in response to detecting that a heartbeat from said second server has stopped.

46. The network storage appliance of claim 45, further comprising:

a second status path, enclosed in said chassis, between said first and second servers, for said second server to communicate said heartbeat to said first server.

47. The network storage appliance of claim 46, further comprising:

a backplane, enclosed in said chassis, wherein said first and second control paths and said first and second status path are comprised in said backplane.

48. The network storage appliance of claim 1, wherein said control path comprises a path with an extremely low failure rate.

49. The network storage appliance of claim 1, wherein said chassis comprises a chassis for mounting in a 19 inch wide rack.

50. The network storage appliance of claim 1, wherein said second server is configured to deterministically inactivate said first I/O port from communicating on said network by transmitting a predetermined sequence of states on said control path to said first server.

51. A network storage appliance, comprising:

a first server, comprising a first I/O port having a first unique ID for communicating on a network;

a second server, comprising a second I/O port having a second unique ID for communicating on said network;

at least one storage controller, coupled to said first and second servers, for transferring data between storage devices and said first and second servers;

a backplane, wherein said first and second servers and storage controller comprise a plurality of blades for plugging into said backplane;

a control path, comprised in said backplane, between said first and second servers, for said second server to deterministically inactivate said first I/O port from communicating on said network, wherein said second server is configured to assume said first unique ID for communicating on said network after said second server inactivates said first I/O port; and

a shield circuit, coupled to said control path, for selectively preventing said second server from inactivating said first I/O port, wherein said first server selectively enables said shield circuit to prevent said second server from inactivating said first I/O port.

52. The network storage appliance of claim 51, wherein said plurality of blades are hot-pluggable into said backplane.

53. The network storage appliance of claim 51, wherein said backplane comprises a plurality of high-speed local buses for transferring data between said plurality of blades.

54. The network storage appliance of claim 53, wherein said plurality of high-speed local buses comprise PCIX buses.

55. The network storage appliance of claim 51, wherein said first and second servers comprises x86 architecture personal computer servers.

56. An apparatus for deterministically performing active-active failover of network storage appliance redundant servers, each of the servers comprising:

an I/O port having a unique ID for communicating on a network;

a kill output, for attempting to inactivate said I/O port of the other server from communicating on said network; and

a shield, coupled to inactivate said I/O port in response to said kill output of the other server if said shield is enabled;

wherein only one of said servers enables its shield prior to attempting to inactivate said I/O port of the other server in response to detection of a stopped heartbeat of the other server.

57. The apparatus of claim 56, wherein a first server inactivates said I/O port of a second server and assumes said unique ID of the second server for communicating on said network.

58. The apparatus of claim 56, wherein said only one of said redundant servers that enables its shield prior to attempting to inactivate said I/O port of the other server is predetermined.

59. The apparatus of claim 58, wherein said only one of said redundant servers that enables its shield prior to attempting to inactivate said I/O port of the other server is predetermined based on which of a plurality of blade slots in a chassis of the network storage appliance said redundant servers are plugged into.

60. The apparatus of claim 56, wherein said only one of said redundant servers that enables its shield prior to attempting to inactivate said I/O port of the other server is negotiated between said redundant servers.

61. The apparatus of claim 56, wherein said redundant servers comprise a plurality of blades, wherein the network storage appliance further comprises:

a backplane, for receiving said plurality of blades, and for facilitating data transfers between the plurality of blades.

62. The apparatus of claim 61, wherein said backplane comprises:

control paths, between said redundant servers, each for coupling said kill output of one of said servers to said shield of the other server.

63. The apparatus of claim 61, further comprising:

a chassis, for enclosing said plurality of blades and said backplane.

64. The apparatus of claim 63, further comprising:

at least one storage controller, enclosed in said chassis, for transferring data between said servers and storage devices coupled to said at least one storage controller.

65. A method for deterministically killing one of redundant servers integrated along with at least one storage controller into a network storage appliance chassis, each of the servers having an I/O port with a unique ID on a network, the method comprising:

determining, by one of the servers, that a heartbeat of the other server has stopped;

generating, by the one of the servers, a control signal wholly internal to the chassis to disable the I/O port of the other server from communicating on the network, in response to said determining the heartbeat of the other server has stopped; and

enabling a shield, by the one of the servers, for preventing the other server from disabling the I/O port of the one of the servers from communicating on the network, prior to said generating the control signal.

66. The method of claim 65, further comprising:

assuming, by the one of the servers, the unique ID of the I/O port of the other server for communicating on the network, after said generating the control signal to disable the I/O port of the other server.

67. The method of claim 65, wherein said generating the control signal comprises generating the control signal on a backplane enclosed in the chassis into which a plurality of hot-pluggable blades comprising the servers and storage controller are plugged.

68. The method of claim 65, wherein the I/O port of the other server is disabled from communicating on the network in response to said generating the control signal independent of whether the other server is operational.