Storage system and control method of storage system

• US 8,312,314 B2
• Filed: 05/13/2011
• Issued: 11/13/2012
• Est. Priority Date: 06/26/2007
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Takada, Masanori, Nakamura, Shuji, Shimada, Kentaro
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US13/107,163
• Publication Number:
  US 20110246818A1
• Time in Patent Office: 550 Days
• Field of Search: 714 2- 4, 714/4.1, 714/4.11, 714/4.12, 714/4.3, 714/4.5, 714/5.1, 714/5.11, 714/6.13, 714/6.32, 714/44, 714/56
• US Class Current: 714/6.13
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: G06F 11/2092 Techniques of failing over between control units

Abstract

A fault-tolerant storage system is provided. The storage system is composed of a controller having a plurality of processors and other units. When an error occurs in any one of the components in the controller, the storage system cuts off an I/O path of the controller, specifies the failed component in the cutoff status, and invalidates the failed component. After invalidating the failed component, the storage system determines whether it is operable only with the normal components, cancels (releases) the cutoff of the I/O path when it determines that it is operable, and resumes operation by rebooting.

Claims

1. A storage system, comprising:

a host interface coupled to a host computer;

a disk drive which provides a logical device to the host computer;

a disk interface coupled to the disk drive;

a cache memory;

a switch LSI; and

a plurality of controllers coupled to the switch LSI;

wherein;

the host interface, the disk interface, the cache memory, and the switch LSI are coupled to each other;

the host interface stores a first routing information which includes an identifier of the logical device and an identifier of the controller in charge of the logical device, and transfers an access request from the host computer to the controller in charge of the logical device by referring to the first routing information;

the disk interface stores a second routing information which includes an identifier of the disk drive and an identifier of the controller in charge of the disk drive, and transfers the access request from the disk drive to the controller in charge of the disk drive by referring to the second routing information;

the cache memory stores a volume allocation information which includes an identifier of the logical device, an identifier of the disk drive, an identifier of the controller for managing the volume, and an identifier of the controller for failover; and

if an error occurs in an error controller which is one of the plurality of controllers, the switch LSI cuts off an I/O path between the error controller and the other devices, and

an alternative controller, which receives an error occurrence notice, updates the first routing information and the second information by referring to the volume allocation information.

2. The storage system according to claim 1, wherein:

the controller stores a control information for the controller in charge of the logical device and the controller in charge of the disk drive and processes the access request by referring to the control information;

the cache memory further stores a control information of the logical device and the disk drive for backup; and

if the error occurs in the error controller, the alternative controller reads the control information of the error controller from the cache memory and writes the control information of the error controller into the control information of the alternative controller.

3. The storage system according to claim 2, wherein if the error occurs in the error controller, the error controller determines whether it is able to continue operating by an error handling.

4. The storage system according to claim 3, wherein if the error controller determines that it is able to continue operating, the error controller performs failback processing.

5. The storage system according to claim 4, wherein the error controller determines whether it is able to continue operating by specifying a failed component in the error controller.

6. The storage system according to claim 5, wherein the switch LSI cancels the cutoff between the error controller and the other devices if there is an operable component in the error controller.

7. The storage system according to claim 6, wherein:

the controller further comprises one or more signal lines and a non-volatile memory;

the one or more signal lines report the error occurrence notice, and each of the signal lines provides an additional path to report the error occurrence notice other than the I/O path;

the non-volatile memory stores an error component management information which is referred to when determining whether the controller having a failed processor core is operable; and

wherein the controller having the failed processor core is operable;

if a component includes a plurality of elements and the one or more elements are operable;

or

if a component includes one element and the one element is operable.

8. A method for controlling a storage system, the storage system comprises:

a host interface coupled to a host computer;

a disk drive which provides a logical device to the host computer;

a disk interface coupled to the disk drive;

a cache memory;

a switch LSI; and

a plurality of controllers coupled to the switch LSI;

wherein the host interface, the disk interface, the cache memory, and the switch LSI are coupled to each other;

wherein the host interface stores a first routing information which includes an identifier of the logical device and an identifier of the controller in charge of the logical device, and transfers an access request from the host computer to the controller in charge of the logical device by referring to the first routing information;

wherein the disk interface stores a second routing information which includes an identifier of the disk drive and an identifier of the controller in charge of the disk drive, and transfers the access request from the disk drive to the controller in charge of the disk drive by referring to the second routing information; and

wherein the cache memory stores a volume allocation information which includes an identifier of the logical device, an identifier of the disk drive, an identifier of the controller for managing the volume, and an identifier of the controller for failover;

the method comprising the steps of

cutting off an I/O path between the error controller and the other devices by the switch LSI if an error occurs in an error controller, which is one of the plurality of controllers; and

updating the first routing information and the second routing information by an alternative controller which receives an error occurrence notice by referring to the volume allocation information.

9. The method according to claim 8, wherein the controller stores a control information for the controller in charge of the logical device and the disk drive;

wherein the cache memory further stores a control information of the logical device and the disk drive for backup; and

the method further comprising the steps of;

processing the access request by the controller in charge of the logical device by referring to the control information; and

if the error occurs in the error controller;

reading the control information of the error controller from the cache memory by the alternative controller; and

writing the control information of the error controller by the alternative controller into the control information of the alternative controller.

10. The method according to claim 9, further comprising the step of if the error occurs in the error controller, determining whether the controller having a failed processor core is able to continue operating by an error handling.

11. The method according to claim 10, further comprising the step of performing failback processing by the error controller, if the error controller determines that it is able to continue operating.

12. The method according to claim 11, further comprising the step of:

determining whether the controller having a failed processor core is able to continue operating by specifying a failed component in the error controller.

13. The method according to claim 12, further comprising the step of:

canceling the cutoff between the error controller and the other devices by the switch LSI, if there is an operable component in the error controller.

14. The method according to claim 13, wherein the controller further comprises one or more signal lines and a non-volatile memory;

wherein the non-volatile memory stores an error component management information which is referred to when determining whether the controller having a failed processor core is operable; and

wherein the controller having the failed processor core is operable;

if a component includes a plurality of elements and the one or more elements are operable;

or

if a component includes one element and the one element is operable;

the method further comprising the step of;

reporting the error occurrence notice by the one or more signal lines, each of the signal lines providing an additional path to report the error occurrence notice other than the I/O path.