A method and system for non-susceptible takeover of services of a dual-controller storage system

Abstract

The application relates to the technical field of data storage, and discloses a service non-susceptible takeover method and system of a dual-controller storage system, which comprises collecting heartbeat physical features, health event streams and service load portraits, and normalizing a unified time scale into a multi-modal data stream; the heartbeat physical features and the health event streams are spliced, then subjected to time causal mask convolution to obtain a causal feature sequence, bidirectional cross attention is performed on the causal feature sequence and the load portraits to obtain space-time interaction features and output fault risks; when a pre-takeover threshold is reached, a master and a backup negotiate and synchronously connect a state snapshot, and a silent session is registered; in a semi-takeover, a backup control is returned to read a delay and a cache hit closed loop speed regulation; when an emergency switching threshold or a hard timeout is reached, a backup control is activated according to sequence number consistency verification. The application realizes service non-susceptible takeover through fault prediction, state pre-implantation and closed loop speed regulation, and reduces service interruption.

Description

Technical Field

[0001] This invention relates to the field of data storage technology, and specifically to a method and system for seamless business takeover of a dual-controller storage system. Background Technology

[0002] In a dual-controller storage system, the primary controller and the backup controller typically work together to handle front-end service access, back-end disk I / O scheduling, and service recovery in the event of a controller failure. When the primary controller fails, the backup controller taking over the services is a crucial mechanism for ensuring high availability of the storage system.

[0003] Existing dual-controller takeover solutions mostly rely on heartbeat timeouts to trigger arbitration for switching. After detecting a loss of heartbeat, the backup controller confirms the primary controller's failure through arbitration, then takes over the virtual address, imports the configuration, mounts the backend disk, and restores I / O services. This type of solution typically uses the occurrence of a failure as the trigger, resulting in accumulated delays in the detection, arbitration, resource takeover, and service recovery stages, which can easily cause service interruptions.

[0004] Some improvement solutions introduce cached mirroring, session persistence, or weighted health metrics to shorten recovery time after a switchover. However, cached mirroring and session persistence are more effective for state recovery after a failure and cannot eliminate the waiting time before failure detection and takeover initiation. Simple weighted health metrics cannot express the temporal correlation between the heartbeat physical layer state, controller hardware events, and service load profiles, which can easily lead to problems such as delayed fault risk identification or mismatched switchover timing.

[0005] Furthermore, existing switchover processes typically migrate resources at a fixed rate, lacking feedback adjustment based on the real-time load and read / output processing capabilities of the standby controller. When migration load, front-end service load, and the current resource status of the standby controller overlap, the fixed process may cause congestion or jitter in the standby controller, affecting the continuity of the takeover process.

[0006] Therefore, this application provides a method and system for seamless service takeover in a dual-controller storage system to solve the above-mentioned technical problems. Summary of the Invention

[0007] The purpose of this invention is to provide a seamless service takeover method and system for a dual-controller storage system, in order to solve the technical problems of existing dual-controller storage systems relying on post-fault detection and static switching processes during the takeover process, resulting in long service interruption times and significant impact on services during the takeover process.

[0008] To address the aforementioned technical problems, this invention provides a method for seamless service takeover in a dual-controller storage system, comprising: Synchronously collect physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event stream, and front-end business input and output load profile, and segment and normalize them into multimodal data streams according to a unified time scale; After concatenating the heartbeat physical layer features with the controller health state event stream, a causal convolution process with a temporal causal mask is performed to obtain a causal feature sequence. The causal feature sequence is subjected to bidirectional cross-attention processing with the front-end business input-output load profile to obtain spatiotemporal interaction features. Output the fault risk level and risk category confidence level of the future time window based on the spatiotemporal interaction characteristics; When the fault risk level reaches the pre-takeover threshold, the main controller and the standby controller negotiate resource capabilities to form a preliminary draft of the session set to be migrated and the redirection mapping table. Synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and register silent ready sessions on the standby controller; During the semi-takeover process, the migration rate is adjusted according to the read input / output processing delay and cache hit status returned by the backup controller. When the fault risk level reaches the emergency switchover threshold or the heartbeat interruption reaches the hard timeout, the backup controller is activated to take over the service according to the consistency verification result of the input and output sequence numbers.

[0009] In some specific embodiments, the synchronous acquisition of physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event stream, and front-end service input / output load profile further includes: Level jitter, inter-symbol interference margin, and link bit error rate are extracted from the reflected signals of non-transparent bridges interconnecting high-speed peripheral components to form heartbeat physical layer characteristics; The event type, event timestamp, and severity weight are extracted from the controller error correction record, the central processing unit cache soft error record, the serial connection small computer system interface link retraining record, and the power ripple over-limit alarm record to form a controller health status event stream. Statistical analysis is performed on a session-by-session basis, including read / write ratio, average request size, request size variance, randomness, maximum latency jitter, queue depth change rate, and suspended command timeout rate, to create a front-end business input / output load profile. The heartbeat physical layer features, controller health status event stream, and front-end business input / output load profiles are aligned into a multimodal data stream using a unified time scale.

[0010] In some specific embodiments, the heartbeat physical layer features are concatenated with the controller health state event stream, and then causal convolution processing with a temporal causal mask is performed to obtain a causal feature sequence, which further includes: The heartbeat physical layer features and the controller health status event stream are concatenated into a window concatenation vector according to the same time window; Multiply the convolution kernel weights element-wise with the lower triangular temporal causal mask matrix, and set the elements in the convolution kernel weights that are in future time steps to zero. Based on the zeroed-out convolution kernel weights, a causal convolution operation is performed on the window concatenation vector to obtain a causal feature sequence formed by physical layer degradation features and hardware error events.

[0011] In some specific embodiments, the causal feature sequence and the front-end business input / output load profile are subjected to bidirectional cross-attention processing to obtain spatiotemporal interaction features, which further include: The first query vector is obtained by querying and projecting the front-end business input and output load profile. The first key vector and the first value vector are obtained by key projection and value projection of the causal feature sequence. The first attention output from the front-end business input and output load profile to the causal feature sequence is calculated. The second query vector is obtained by projecting the causal feature sequence through the query. The second key vector and the second value vector are obtained by projecting the front-end business input-output load profile through key projection and value projection. The second attention output from the causal feature sequence to the front-end business input-output load profile is calculated. After splicing the first attention output and the second attention output, linear projection is performed to obtain the spatiotemporal interaction features.

[0012] In some specific embodiments, the output of the fault risk level and risk category confidence level of the future time window according to the spatiotemporal interaction characteristics further includes: Perform fault risk classification processing on spatiotemporal interaction features, map them to normal, sub-healthy, pre-takeover and emergency risk levels according to preset classification boundaries, and output the confidence level of each risk category; When the confidence level of the pre-takeover category reaches the pre-takeover threshold or the confidence level of the emergency category reaches the emergency switchover threshold, the risk level and risk category identifier that have reached the threshold will be written into the trigger field of the negotiation message; If neither the pre-takeover confidence level nor the emergency confidence level reaches the pre-takeover threshold nor the emergency switchover threshold, continue to perform multimodal data stream acquisition and fault risk level output.

[0013] In some specific embodiments, the primary controller and the backup controller perform resource capability negotiation to form a preliminary draft of the set of sessions to be migrated and a redirection mapping table, which further includes: The main controller writes the current risk level, risk category identifier, session identifier, session priority, most recent input / output sequence number, and multipath association code into a negotiation message and sends it to the backup controller; The standby controller reads the CPU idle rate, available memory, and back-end disk I / O throughput margin, and matches the risk category identifier with a preset set of manageable categories; When resources meet the takeover conditions and the risk category matches, the standby controller returns to readiness and the upper limit of acceptance capacity. When resources do not meet the takeover conditions, the standby controller restores the priority lower limit of the takeover session and the degraded preparation; The main controller filters active sessions based on the response content and generates a set of sessions to be migrated and a draft of the redirection mapping table.

[0014] In some specific embodiments, the connection state snapshot is synchronized to the standby controller according to the set of sessions to be migrated, and the standby controller registers silent-ready sessions, further including: The main controller reads the Transmission Control Protocol sequence number, acknowledgment number, window size, protocol options, Internet Small Computer System Interface task label, command sequence number, and incomplete command description block from the set of sessions to be migrated, and encapsulates them into a connection state snapshot; The main controller writes a snapshot of the connection state to the pre-allocated memory of the standby controller via a remote direct memory access channel; The standby controller reproduces the transmission control protocol control block and the Internet minicomputer system interface session structure field by field, and registers the reproduced session as a silent ready session. The silent ready session maintains a paused state for data packet sending and backend command submission.

[0015] In some specific embodiments, adjusting the migration rate during the half-takeover process according to the read input / output processing latency and cache hit status returned by the backup controller further includes: The master controller sends a copy of the non-destructive input / output request to be read to the backup controller. The backup controller performs the read and caches the read data in the backup controller, and postpones sending the read response to the master controller. The main controller continues to process write requests and synchronization commands along the original business path; The backup controller sends back the average read input / output processing latency and buffer hit status according to the feedback cycle; The main controller inputs the difference between the expected delay and the average read input / output processing delay into the proportional-integral control process, and updates the current migration rate according to the proportional gain, integral gain, previous cycle migration rate, and the delay difference of the previous cycle. When the average read input / output processing latency is lower than the first threshold and the cache hit status meets the preset hit conditions, the main controller expands the scope of partial takeover. When the average read input / output processing latency reaches the second threshold or abnormal jitter occurs, the main controller reduces the current migration rate, suspends migration, or cancels some semi-takeover sessions and returns to single-controller processing.

[0016] In some specific embodiments, activating the backup controller takeover service according to the input / output sequence number consistency verification result further includes: The main controller sends the activation primitive, the last dirty write buffer, and the latest input / output sequence number to the standby controller, and then enters silent companion mode; The standby controller marks the silent ready session as an active pending confirmation session, reads the input / output sequence number consistency check matrix in the shared memory of the high-speed peripheral component interconnect non-transparent bridge, and compares the input / output sequence numbers and data checksums submitted but not confirmed by the main controller with the input / output queues cached by the standby controller item by item. When the comparison results show that the serial numbers are consecutive and the data checksum matches, the backup controller activates the transmission control protocol connection. When a sequence number gap is detected, the backup controller activates the transmission control protocol connection and sends an acknowledgment message with selective acknowledgment options to the host. The acknowledgment message carries the range of the missing data segment. The main controller shuts down the network interface after receiving confirmation that the takeover is complete.

[0017] Based on the same concept, the present invention also provides a service seamless takeover system for a dual-controller storage system, comprising: The data acquisition and preprocessing module is configured to synchronously acquire physical layer features of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event streams, and front-end business input and output load profiles, and segment and normalize them into multimodal data streams according to a unified time scale; The causal convolution module is configured to concatenate the heartbeat physical layer features with the controller health state event stream and then perform causal convolution processing with a temporal causal mask to obtain a causal feature sequence. The cross-attention module is configured to perform bidirectional cross-attention processing on the causal feature sequence and the front-end business input / output load profile to obtain spatiotemporal interaction features. The risk output module is configured to output the fault risk level and risk category confidence level for future time windows based on spatiotemporal interaction characteristics. The negotiation module is configured to negotiate resource capabilities between the main controller and the standby controller when the fault risk level reaches the pre-takeover threshold, forming a set of sessions to be migrated and a draft of the redirection mapping table. The state synchronization module is configured to synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and the standby controller registers silent ready sessions. The semi-pilot speed control module is configured to adjust the migration rate during the semi-pilot process according to the read input / output processing delay and buffer hit status returned by the backup controller. The instantaneous takeover module is configured to activate the standby controller takeover service based on the consistency verification result of the input and output sequence numbers when the fault risk level reaches the emergency switch threshold or the heartbeat interruption reaches the hard timeout.

[0018] Compared with existing technologies, its advantages are as follows: This invention discloses a service seamless takeover method and system for a dual-controller storage system. It synchronously collects the physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, the health status event stream of the controller, and the front-end service input and output load profile, and forms a multimodal data stream according to a unified time scale. Fault risk judgment can simultaneously utilize link physical degradation, controller hardware events, and service load changes, avoiding the risk identification lag caused by relying solely on heartbeat timeout or a single health indicator.

[0019] After concatenating the heartbeat physical layer features with the controller health status event stream, causal convolution processing with a temporal causal mask is performed. The causal feature sequence is formed by the physical layer state and hardware events in the current window and the historical window. Data from future moments will not participate in the formation of current risk features, which can express the propagation relationship between physical layer degradation, hardware event accumulation and controller failure risk in time sequence.

[0020] By performing bidirectional cross-attention processing on the causal feature sequence and the front-end business input and output load profile, the spatiotemporal interaction features include both the selective reading of physical health status by business load and the reverse impact of physical health status on changes in business load. This enables the failure risk level and risk category confidence to reflect the interaction between controller status and business pressure.

[0021] When the fault risk level reaches the pre-takeover threshold, the resource capacity negotiation between the primary controller and the backup controller is performed first. Based on the resource status of the backup controller, a preliminary draft of the set of sessions to be migrated and the redirection mapping table is formed. The takeover preparation is started before the final fault confirmation, and the scope of sessions to be migrated can match the carrying capacity of the backup controller, reducing the concentrated load impact on the backup controller caused by the static full switch.

[0022] According to the synchronous transmission control protocol status and Internet minicomputer system interface session status of the session set to be migrated, and the silent ready session is registered by the backup controller, the backup controller already has the necessary state basis for connecting endpoints and session scheduling before the final takeover. During the final switch, there is no need to re-establish the front-end connection or re-login to the session, which can reduce the risk of interruption perceived by the business side.

[0023] During the semi-takeover process, only copies of read-type non-destructive input / output requests are redirected to the standby controller, while write requests and synchronization commands are kept to be processed along the original business path of the primary controller. The read path and cache path of the standby controller can be verified before takeover, and the consistency of the write path is still maintained by the primary controller, reducing the data consistency risk during the semi-takeover phase.

[0024] Based on the average read input / output processing latency and buffer hit status reported back from the standby controller, the current migration rate is updated through a proportional-integral control process. The migration rate is formed by feedback from the actual processing capacity of the standby controller. When the processing status of the standby controller meets the expansion conditions, the semi-takeover range is expanded. When the processing latency increases or abnormal jitter occurs, the migration rate is reduced, migration is paused, or some semi-takeover sessions are canceled, thereby enabling the migration process to have closed-loop regulation capability.

[0025] During the final switchover, the input / output sequence number consistency verification matrix is ​​used to compare the input / output sequence numbers and data checksums submitted but not confirmed by the main controller with the input / output queues cached by the backup controller. Before activating the service, the backup controller can confirm the consistency of the input / output boundaries and cached data, reducing the risk of data gaps and cache inconsistencies at the moment of switchover.

[0026] When a sequence number gap is detected, the backup controller activates the transmission control protocol connection and sends an acknowledgment message with selective acknowledgment options to the host. The acknowledgment message carries the range of missing data segments. The missing data segments can be handled by partial retransmission, avoiding direct connection disconnection or session reconstruction due to a partial sequence number gap.

[0027] After the main controller sends the activation primitive, it enters a silent companion mode and continues to forward incoming traffic until the backup controller sends back confirmation of takeover completion. The data plane maintains the traffic acceptance path before the backup controller completes the activation confirmation, which can reduce the risk of packet loss and service path breakage in the final takeover window. Attached Figure Description

[0028] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating some specific embodiments of the service seamless takeover method for a dual-controller storage system according to the present invention; Figure 2 This is a schematic diagram of the service seamless takeover system of a dual-controller storage system according to some specific embodiments of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms "a," "the," and "the" as used in the embodiments of this application are also intended to include the plural forms, unless the context clearly indicates otherwise, and "multiple" generally includes at least two.

[0031] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0032] It should be understood that although the terms first, second, third, etc., may be used in the embodiments of this application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, first may also be referred to as second without departing from the scope of the embodiments of this application, and similarly, second may also be referred to as first.

[0033] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0034] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0035] It should be noted that any symbols and / or numbers present in the specification that are not marked in the accompanying drawings are not reference numerals.

[0036] Reference Figure 1 A method for seamless service takeover in a dual-controller storage system, comprising: S101 synchronously collects the physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, the health status event stream of the controller, and the front-end business input and output load profile, and segments and normalizes them into multimodal data streams according to a unified time scale; S102, after concatenating the heartbeat physical layer features with the controller health status event stream, perform causal convolution processing with a temporal causal mask to obtain a causal feature sequence; S103, perform bidirectional cross-attention processing on the causal feature sequence and the front-end business input / output load profile to obtain spatiotemporal interaction features; S104, outputs the fault risk level and risk category confidence level of the future time window according to the spatiotemporal interaction characteristics; S105, When the fault risk level reaches the pre-takeover threshold, the main controller and the standby controller perform resource capability negotiation to form a preliminary draft of the session set to be migrated and the redirection mapping table. S106, Synchronize the connection state snapshot to the standby controller according to the set of sessions to be migrated, and register the silent ready sessions on the standby controller. S107, during the semi-takeover process, adjusts the migration rate according to the read input / output processing delay and buffer hit status returned by the backup controller; S108: When the fault risk level reaches the emergency switching threshold or the heartbeat interruption reaches the hard timeout, the backup controller is activated to take over the service according to the consistency verification result of the input and output sequence numbers.

[0037] To provide a clearer explanation, the steps in the embodiments of the present invention are described in detail below: S101 synchronously collects the physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, the health status event stream of the controller, and the front-end business input and output load profile, and segments and normalizes them into multimodal data streams according to a unified time scale; Furthermore, level jitter, inter-symbol interference margin, and link bit error rate are extracted from the reflected signals of the non-transparent bridge interconnection of high-speed peripheral components to form heartbeat physical layer characteristics; The event type, event timestamp, and severity weight are extracted from the controller error correction record, the central processing unit cache soft error record, the serial connection small computer system interface link retraining record, and the power ripple over-limit alarm record to form a controller health status event stream. Statistical analysis is performed on a session-by-session basis, including read / write ratio, average request size, request size variance, randomness, maximum latency jitter, queue depth change rate, and suspended command timeout rate, to create a front-end business input / output load profile. The heartbeat physical layer features, controller health status event stream, and front-end business input / output load profiles are aligned into a multimodal data stream using a unified time scale.

[0038] In this embodiment, the dual-controller storage system can be a dual-controller disk array. The main controller and the backup controller are interconnected via a high-speed peripheral component interconnect non-transparent bridge. The front end provides Internet Minicomputer System Interface (IMSI) target services, and the back end connects to a serially connected IMSI disk cluster. The main controller's operating system has three acquisition probes. The first acquisition probe reads reflected signal eye diagram sampling values ​​and error rate statistics registers from the high-speed peripheral component interconnect non-transparent bridge driver interface, forming physical layer sampling records at sampling intervals of 1ms to 100ms. The second acquisition probe filters controller health status events from the error correction subsystem, host bus adapter driver logs, and power monitoring logs, encapsulating them into structured event records according to event type, event timescale, and severity weight. The third acquisition probe is located at the IMSI target layer, maintaining a sliding window with each session formed by the combination of initiator, target, and logic unit as the granularity. The sliding window length can be 5s, and the window step can be 500ms. Within each sliding window, the third acquisition probe counts the ratio of read requests to write requests, calculates the average and variance of request sizes, obtains the random ordering degree based on the continuity of adjacent logical block addresses, forms the maximum latency jitter based on the difference between the maximum and average processing latency within the window, forms the queue depth change rate by dividing the difference in queue depth between two sampling points before and after the window by the time interval, and forms the timeout ratio of the number of timed-out suspended commands to the total number of suspended commands.

[0039] The data output from the three acquisition probes all carry timestamps from the same clock source. The main controller writes physical layer sampling records, structured event records, and session load records into a streaming preprocessing buffer. The streaming preprocessing buffer slices the data according to a unified time window. Missing physical layer sampling values ​​within a window are filled with the previous valid sampling value, missing discrete events within a window are filled with empty event codes, and session load records without active input / output requests within a window are filled with zero load vectors. Normalization can use the moving average and moving standard deviation, or a pre-configured maximum and minimum range. The normalized heartbeat physical layer features form the first modality data, the normalized controller health status event stream forms the second modality data, and the normalized front-end business input / output load profile forms the third modality time series. After unified time-stamp alignment, the three modalities proceed to subsequent steps under the same window index.

[0040] S102, after concatenating the heartbeat physical layer features with the controller health status event stream, perform causal convolution processing with a temporal causal mask to obtain a causal feature sequence; Furthermore, the heartbeat physical layer features and the controller health status event stream are concatenated into a window concatenation vector according to the same time window; Multiply the convolution kernel weights element-wise with the lower triangular temporal causal mask matrix, and set the elements in the convolution kernel weights that are in future time steps to zero. Based on the zeroed-out convolution kernel weights, a causal convolution operation is performed on the window concatenation vector to obtain a causal feature sequence formed by physical layer degradation features and hardware error events.

[0041] In this embodiment, the heartbeat physical layer features and the controller's health status event stream are concatenated into a windowed concatenation vector on the time axis. The main controller inputs multiple consecutive windowed concatenation vectors into a causal convolutional processing layer. The convolutional kernel's time span is configurable, for example, 8, 16, or 32. In the causal convolutional processing, the convolutional kernel weight matrix is ​​multiplied element-wise by the lower triangular temporal causal mask matrix, setting the elements in the convolutional kernel weights that are in future timeframes to zero. The causal convolutional processing outputs a causal feature vector, and the calculation relationship can be expressed as: ; in, Represents the causal feature vector of the current window; Indicates the current window's previous position. The window concatenation vector of each window; Indicates the first The convolution kernel weight matrix at each time step; Indicates the time span of the convolution kernel; This represents the summation operation; This means for all; and These represent the row and column indices of the convolution kernel weight matrix, respectively.

[0042] Through the above calculations, the causal feature vector for the current window only reads the physical layer samples and hardware event records prior to the current window. The causal feature vector consists of multiple channels, each recording the temporal propagation relationship between changes in the reflected signal from the non-transparent bridge interconnecting high-speed peripheral components, changes in the bit error rate, accumulated error correction events, buffer soft error events, and link retraining events. The causal feature sequence is output in window order.

[0043] In this embodiment, dilated causal convolution can also be used to expand the coverage length of the historical window. Dilated causal convolution reads the concatenated vector of the historical window according to the dilation rate, increasing the ability to model long-term correlations between physical layer degradation and hardware events while maintaining temporal causal mask constraints. If the sampling value of the non-transparent bridge interconnecting high-speed peripheral components is missing within a certain window, the main controller retains a missing flag in the streaming preprocessing buffer and uses the missing flag as an auxiliary channel input to the causal convolution processing. The causal convolution processing reads the missing flag during convolution calculation and reduces the contribution of the imputation value to the causal feature vector. If the controller health status event stream is empty in multiple consecutive windows, the causal convolution processing still outputs the causal feature vector formed by the heartbeat physical layer features and keeps the channel corresponding to the empty event encoding as a low-weight input.

[0044] S103, perform bidirectional cross-attention processing on the causal feature sequence and the front-end business input / output load profile to obtain spatiotemporal interaction features; Furthermore, the first query vector is obtained by projecting the front-end business input and output load profile through query, and the first key vector and the first value vector are obtained by projecting the causal feature sequence through key and value. The first attention output from the front-end business input and output load profile to the causal feature sequence is calculated. The second query vector is obtained by projecting the causal feature sequence through the query. The second key vector and the second value vector are obtained by projecting the front-end business input-output load profile through key projection and value projection. The second attention output from the causal feature sequence to the front-end business input-output load profile is calculated. After splicing the first attention output and the second attention output, linear projection is performed to obtain the spatiotemporal interaction features.

[0045] In this embodiment, the causal feature sequence is represented as follows: The front-end business input / output load profile sequence is represented as follows: The first query vector is obtained by projecting the front-end business input / output load profile. The first key vector is obtained by key projection and value projection of the causal feature sequence. and the first value vector The first attention output is calculated from the front-end business input / output load profile to the causal feature sequence. The calculation relationship can be expressed as: ; in, This represents the first attention output from the front-end business input / output load profile to the causal feature sequence; This represents the first query vector obtained by projecting the front-end business input / output load profile. This represents the first key vector obtained by key projection from the causal feature sequence; This represents the first value vector obtained by value projection from the causal feature sequence; Indicates the attention head dimension; This represents the normalized exponential function; Indicates matrix transpose; This represents the square root operation.

[0046] The second query vector is obtained by projecting the causal feature sequence through the query. The second key vector is obtained by key projection and value projection of the front-end business input and output load profile. Second value vector The second attention output is calculated from the causal feature sequence to the front-end business input / output load profile. The calculation relationship can be expressed as: ; in, The second attention output represents the causal feature sequence to the front-end business input / output load profile; This represents the second query vector obtained by projecting the causal feature sequence into the query vector; This represents the second key vector obtained by key projection from the front-end business input / output load profile; This represents the second value vector obtained by value projection from the front-end business input / output load profile; Indicates matrix transpose; This represents the square root operation.

[0047] After concatenating the first attention output and the second attention output, linear projection is performed to obtain the spatiotemporal interaction features. The calculation relationship can be expressed as: ; in, Indicates the spatiotemporal interaction characteristics of the current window; Indicates the first attention output of the current window; This indicates the second attention output of the current window; This indicates splicing by channel; This indicates the output projection matrix.

[0048] The spatiotemporal interaction features include the selective reading results of the load profile on the physical health status, as well as the inverse influence of the physical health status on the load profile. After the spatiotemporal interaction features are entered into the subsequent risk output step, the risk classification process reads the channel values, time positions, and attention weight summaries of the spatiotemporal interaction features to generate the fault risk level and risk category confidence.

[0049] In this embodiment, an attention weight cache can also be set after bidirectional cross-attention processing. The attention weight cache records the weight summary from the load profile to the causal feature, the weight summary from the causal feature to the load profile, the window index of the maximum weight, and the modal channel of the maximum weight within each control cycle. This attention weight cache can be read by the debugging interface as a runtime log to verify whether the fault risk level is jointly formed by observable physical layer features, hardware events, and the load profile. The attention weight cache maintains the main data flow unchanged, recording intermediate calculation results from the first and second attention outputs. The recording trigger condition can be that the fault risk level reaches a sub-healthy level or a pre-takeover level.

[0050] S104, outputs the fault risk level and risk category confidence level of the future time window according to the spatiotemporal interaction characteristics; Furthermore, the spatiotemporal interaction features are subjected to fault risk classification processing, mapped to normal, sub-healthy, pre-takeover and emergency risk levels according to preset classification boundaries, and the confidence level of each risk category is output. When the confidence level of the pre-takeover category reaches the pre-takeover threshold or the confidence level of the emergency category reaches the emergency switchover threshold, the risk level and risk category identifier that have reached the threshold will be written into the trigger field of the negotiation message; If neither the pre-takeover confidence level nor the emergency confidence level reaches the pre-takeover threshold nor the emergency switchover threshold, continue to perform multimodal data stream acquisition and fault risk level output.

[0051] Fault risk classification can be performed using a lightweight classification network or a rule-based classification layer. After reading spatiotemporal interaction features, the fault risk classification process outputs a risk vector, where each dimension represents the unnormalized score of the risk level (normal, sub-healthy, pre-takeover, and emergency). The main controller performs a normalization index calculation on the risk vector to obtain the confidence level for each risk category. Preset classification boundaries may include a confidence threshold of 0.65 for the pre-takeover category and a confidence threshold of 0.85 for the emergency category; these thresholds are exemplary and can be configured via the storage system maintenance interface in actual deployment. Within the current control cycle, if the confidence level for the pre-takeover category reaches 0.65 and the confidence level for the emergency category does not reach 0.85, the main controller marks the risk level as pre-takeover and writes the risk category identifier, risk level, and trigger timestamp into the trigger field of the negotiation message; if the confidence level for the emergency category reaches 0.85, the main controller marks the risk level as emergency and sets the emergency switchover trigger field; if neither threshold is reached, the main controller only saves the risk vector and attention weight summary and continues into the next control cycle.

[0052] Spatiotemporal causal attention networks can be quantized and deployed on embedded processors or hardware accelerators. During the training phase, training samples can be constructed using dual controllers to store system operation logs, fault injection records, and maintenance event records. The input to the training samples is a multimodal data stream, and the objective is to identify the risk level and risk category within a future time window. The training objective can employ classification cross-entropy loss, and parameter updates can use batch gradient descent or adaptive moment estimation. The training stopping condition is that the validation set loss changes by less than a preset magnitude over five consecutive training epochs. The trained causal convolution weights, projection matrices, and classification layer parameters are saved as a model parameter file and loaded into the main controller. During the inference phase, the main controller reads the current window data sequentially according to the above steps and outputs the risk level and risk category confidence scores. During the evaluation phase, independent operation logs can be used to verify the consistency between the risk level output and maintenance events. The evaluation results are used to select thresholds and model versions, isolated from business switching paths.

[0053] S105, When the fault risk level reaches the pre-takeover threshold, the main controller and the standby controller perform resource capability negotiation to form a preliminary draft of the session set to be migrated and the redirection mapping table. Furthermore, the main controller writes the current risk level, risk category identifier, session identifier, session priority, most recent input / output sequence number, and multipath association code into a negotiation message and sends it to the backup controller; The standby controller reads the CPU idle rate, available memory, and back-end disk I / O throughput margin, and matches the risk category identifier with a preset set of manageable categories; When resources meet the takeover conditions and the risk category matches, the standby controller returns to readiness and the upper limit of acceptance capacity. When resources do not meet the takeover conditions, the standby controller restores the priority lower limit of the takeover session and the degraded preparation; The main controller filters active sessions based on the response content and generates a set of sessions to be migrated and a draft of the redirection mapping table.

[0054] In this embodiment, the primary controller sends negotiation messages via a private link between controllers. The session identifier in the negotiation message can be a combination of the initiator name, target name, logical unit number, and connection identifier; the session priority can be determined by the service volume service level, queue depth, and most recent I / O response time; the most recent I / O sequence number records the boundaries of I / O requests submitted but not yet fully acknowledged by the primary controller; and the multipath association code records the path affiliation between the host-side multipath device and the storage volume. Upon receiving the negotiation message, the standby controller reads the current CPU idle rate, available memory, backend disk I / O throughput margin, and local queue congestion flag, and matches the risk category identifier with the set of fault types supported by the standby controller. Resources meeting the takeover conditions can be represented as a CPU idle rate higher than 20%, available memory higher than the estimated occupancy of the session state snapshot to be migrated, and backend disk I / O throughput margin higher than the estimated throughput of the read offload requests to be migrated.

[0055] When the standby controller responds with readiness, the primary controller adds all active sessions to the migration set in order of session priority and most recent input / output sequence number, and writes the session identifier, standby controller receive queue, target memory pool address, and migration status into the initial draft of the redirection mapping table. When the standby controller responds with degrade readiness, the primary controller filters sessions according to the lower limit of the takeover session priority, adding only sessions with priorities reaching the lower limit to the migration set; sessions not reaching the lower limit continue to be processed by the primary controller. If the standby controller does not return a response within the negotiation timeout period, the primary controller retains the current business path and continues to run the aforementioned steps. After outputting the risk level again in the next control cycle, it re-determines whether to trigger negotiation. Through the above negotiation, the migration set includes both session objects and the order in which each session enters subsequent state synchronization and semi-takeover speed adjustment.

[0056] In this embodiment, risk category confidence ranking and resource estimates can also be added to the negotiation message. The main controller places the risk category with the highest confidence in the message header and writes the expected state snapshot size, recent write queue depth, and read request ratio of high-priority sessions into the extended field. After reading the extended field, the standby controller can specify the upper limit of batch acceptance capacity, for example, accepting 20 session state snapshots per feedback cycle.

[0057] S106, Synchronize the connection state snapshot to the standby controller according to the set of sessions to be migrated, and register the silent ready sessions on the standby controller. Furthermore, the main controller reads the Transmission Control Protocol sequence number, acknowledgment number, window size, protocol options, Internet Small Computer System Interface task label, command sequence number, and incomplete command description block from the set of sessions to be migrated, and encapsulates them into a connection state snapshot; The main controller writes a snapshot of the connection state to the pre-allocated memory of the standby controller via a remote direct memory access channel; The standby controller reproduces the transmission control protocol control block and the Internet minicomputer system interface session structure field by field, and registers the reproduced session as a silent ready session. The silent ready session maintains a paused state for data packet sending and backend command submission.

[0058] In this embodiment, the main controller can encapsulate the connection state snapshot using a structure composed of type, length, and value. The Transmission Control Protocol (TCP) layer state includes a 5-tuple, receive next sequence number, send next sequence number, send window, receive window, congestion window, selective acknowledgment flag, timestamp option, and retransmission timer state. The Internet Minicomputer System (IMS) interface layer state includes a task tag, command sequence number, expected command sequence number, status sequence number, incomplete command description block, logical unit number, and session recovery flag. Before encapsulating the connection state snapshot, the main controller freezes the state read points of the sessions to be migrated and writes new input / output requests generated after the read points into the incremental cache. The main controller writes the connection state snapshots in batches to the pre-allocated kernel memory of the backup controller via a remote direct memory access channel. After writing is complete, a snapshot completion flag and batch number are sent on the private link.

[0059] After receiving the snapshot completion flag, the standby controller reads the connection state snapshot from the pre-allocated kernel memory according to the batch number. The standby controller session manager recreates the Transmission Control Protocol (TCP) control block based on the TCP layer state and the session structure and task queue based on the Internet Minicomputer System Interface (IMSI) layer state. The recreated session enters a silent ready state. In the silent ready state, the standby controller can accept copies of read requests forwarded by the primary controller and complete local read path verification. The standby controller temporarily suspends sending responses to the host and keeps write commands in a paused state at the backend command layer. If a connection state snapshot field is missing, the standby controller returns a field missing flag and a missing field identifier to the primary controller, and the primary controller resends a complete connection state snapshot of the session. If the standby controller memory pool capacity is insufficient, the standby controller returns the available capacity and the batch number to be released, and the primary controller postpones the synchronization of lower-priority sessions according to the priority order of the session set to be migrated.

[0060] In this embodiment, the registration result of the silent ready session can also be written to the state cache. The state cache records the session identifier, snapshot batch number, transmission control protocol control block reproduction result, Internet minicomputer system interface session structure reproduction result, silent ready timestamp, and exception flag. The state cache can be read through the maintenance interface to verify whether the connection state pre-synchronization has been completed. The records in the state cache are not visible to the host and keep the host connection state unchanged. This implementation makes the internal algorithm and state transition process detectable, facilitating the confirmation in engineering deployment whether the backup controller has met the preconditions for takeover.

[0061] S107, during the semi-takeover process, adjusts the migration rate according to the read input / output processing delay and buffer hit status returned by the backup controller; Furthermore, the main controller sends a copy of the non-destructive input / output request to be read to the backup controller, which performs the read and caches the read data in the backup controller, and postpones sending the read response to the main controller. The main controller continues to process write requests and synchronization commands along the original business path; The backup controller sends back the average read input / output processing latency and buffer hit status according to the feedback cycle; The main controller inputs the difference between the expected delay and the average read input / output processing delay into the proportional-integral control process, and updates the current migration rate according to the proportional gain, integral gain, previous cycle migration rate, and the delay difference of the previous cycle. When the average read input / output processing latency is lower than the first threshold and the cache hit status meets the preset hit conditions, the main controller expands the scope of partial takeover. When the average read input / output processing latency reaches the second threshold or abnormal jitter occurs, the main controller reduces the current migration rate, suspends migration, or cancels some semi-takeover sessions and returns to single-controller processing.

[0062] In this embodiment, the primary controller maintains the external service entry point during the semi-takeover phase. For read-type non-destructive input / output requests, the primary controller copies the request descriptor while processing along the original service path, and sends the request copy to the backup controller according to the initial draft of the redirection mapping table. Upon receiving the request copy, the backup controller reads backend disk data or hits local cache data, stores the read result in the backup controller's cache queue, and sends back the processing completion flag, processing latency, and cache hit status via a private link. The backup controller temporarily suspends sending read responses to the host. For write requests, synchronization commands, refresh commands, and commands involving data consistency, the primary controller continues processing along the original service path and writes newly added dirty cache entries to the incremental cache. This process allows the backup controller to verify the read path, cache path, and backend disk path before the switchover, while preventing inconsistencies in the write path during the semi-takeover phase.

[0063] The closed-loop speed regulation adopts a proportional-integral control process. Let the first... The average read input / output processing delay of the backup controller feedback within each control cycle is: The desired latency target is The cycle duration is Then the periodic delay difference can be expressed as Current migration rate The update relationship can be represented as: ; in, Indicates the migration rate of the current control cycle; This indicates the migration rate of the previous control cycle; Indicates proportional gain; Indicates integral gain; This represents the difference in cycle delay for the current control cycle; This represents the difference in cycle delay between the previous control cycle; Indicates the duration of the control cycle.

[0064] Furthermore, the sub-steps of the proportional-integral control process include: The main controller calculates the expected delay and subtracts the average read input / output processing delay in each control cycle to obtain the cycle delay difference. The candidate migration rate is obtained by summing the product of the proportional gain and the difference between the period delays, the product of the integral gain and the difference between the period delays of the previous period, and the migration rate of the previous period. Perform upper and lower bound pruning on the candidate migration rates, convert the pruned candidate migration rates into the number of migration sessions per second, and write them into the retrieval order of the set of sessions to be migrated.

[0065] In this embodiment, if the following is adopted: The delay error is defined by inverting the signs of the proportional and integral terms according to the control direction. This reduces the migration rate when the average read input / output processing delay exceeds the target delay, and increases the migration rate when the average read input / output processing delay is below the target delay. The candidate migration rate, after being pruned to upper and lower limits, is written into the retrieval order of the session set to be migrated. The upper limit can be 100 sessions per second, and the lower limit can be 0 sessions per second; these values ​​are exemplary implementation parameters. The main controller retrieves sessions from the session set to be migrated according to the pruned current migration rate and synchronizes the remaining session states, incremental cache, and dirty cache data to the standby controller.

[0066] When the average read input / output processing latency is below the first threshold and the cache hit status meets the preset hit condition within three consecutive feedback cycles, the main controller expands the semi-takeover scope. This can increase the number of sessions entering read offloading or increase the batch of connection status snapshots pushed in each cycle. The first threshold can be configured to 3ms, and the preset hit condition can be configured to a cache hit ratio of not less than 80%. When the average read input / output processing latency reaches the second threshold or the jitter amplitude exceeds the set range in consecutive feedback cycles, the main controller reduces the current migration rate, pauses migration, or cancels some semi-takeover sessions. The second threshold can be configured to 10ms, and abnormal jitter can be represented as the difference between the maximum and minimum values ​​of the average read input / output processing latency within three consecutive feedback cycles exceeding 5ms. When canceling some semi-takeover sessions, the main controller selects sessions from low to high priority in the session set to be migrated, changes the migration status of the selected sessions to single-controller processing, and notifies the backup controller to release the cache and memory pool occupied by the corresponding silent ready session.

[0067] In this embodiment, the inputs and outputs of the proportional-integral control process can also be written to the migration speed control log. The migration speed control log records the control cycle number, average read input / output processing delay, desired delay target, cycle delay difference, previous cycle migration rate, candidate migration rate, current migration rate after pruning, buffer hit status, and changes in the semi-controller range. The migration speed control log is stored in the main controller's operation log area and can be read through the maintenance interface to verify whether the migration rate is formed by feedback data from the standby controller.

[0068] S108: When the fault risk level reaches the emergency switching threshold or the heartbeat interruption reaches the hard timeout, the backup controller is activated to take over the service according to the consistency verification result of the input and output sequence numbers.

[0069] Furthermore, the main controller sends the activation primitive, the last dirty write buffer, and the latest input / output sequence number to the standby controller, and enters silent companion mode; The standby controller marks the silent ready session as an active pending confirmation session, reads the input / output sequence number consistency check matrix in the shared memory of the high-speed peripheral component interconnect non-transparent bridge, and compares the input / output sequence numbers and data checksums submitted but not confirmed by the main controller with the input / output queues cached by the standby controller item by item. When the comparison results show that the serial numbers are consecutive and the data checksum matches, the backup controller activates the transmission control protocol connection. When a sequence number gap is detected, the backup controller activates the transmission control protocol connection and sends an acknowledgment message with selective acknowledgment options to the host. The acknowledgment message carries the range of the missing data segment. The main controller shuts down the network interface after receiving confirmation that the takeover is complete.

[0070] In this embodiment, the final handover triggering conditions include the fault risk level reaching the emergency handover threshold and the heartbeat interruption reaching a hard timeout. The emergency handover threshold can be triggered by the emergency class confidence output by the fault risk classification processing, and the hard timeout can be configured to 100ms. When either triggering condition is met, the master controller sends an activation primitive to the standby controller on the private link. The activation primitive includes a list of sessions to be activated, the last dirty write cache batch number, the latest input / output sequence number, and an activation timestamp. After sending the activation primitive, the master controller enters a silent companion mode, keeping the network interface open. All data traffic arriving at the master controller is forwarded to the standby controller according to the forwarding rules until the standby controller returns a confirmation of takeover completion.

[0071] The input / output sequence number consistency check matrix resides in the shared memory of the non-transparent bridge of the high-speed peripheral component interconnection and can employ a circular buffer structure. Each entry in the circular buffer records the input / output sequence number, data checksum, session identifier, and write timestamp of any input / output sequence number submitted but not yet acknowledged by the master controller. The circular buffer size can be configured to 256 or according to the prefetch depth and the maximum number of concurrent commands.

[0072] Furthermore, the sub-step of comparing the input / output sequence numbers and data checksums submitted but not confirmed by the main controller with the input / output queues cached by the backup controller includes: The standby controller reads the sequence number and data checksum from the input / output sequence number consistency check matrix according to the circular buffer read pointer; The read sequence number is compared item by item with the head sequence number of the cached input / output queue of the backup controller; When a gap occurs, the standby controller constructs a selective acknowledgment interval according to the gap start sequence number and end sequence number, and writes the selective acknowledgment interval into an acknowledgment message and sends it to the host.

[0073] In this embodiment, after the standby controller marks a silent ready session as an active pending confirmation session, it reads matrix entries according to the circular buffer read pointer. It compares the sequence numbers in the matrix with the head sequence numbers of the standby controller's cached input / output queues item by item, and compares the data checksums in the matrix with the checksums of the corresponding data blocks in the cached input / output queues item by item. When the comparison results show that the sequence numbers are consecutive and the data checksums match, the standby controller converts the active pending confirmation session into an active session, enables the Transmission Control Protocol (TCP) connection transmission capability, and takes over the scheduling of Internet Minicomputer System (IMS) interface sessions.

[0074] When a sequence number gap is detected, the backup controller still activates the Transmission Control Protocol (TCP) connection and constructs a Selective Acknowledgment (CAC) interval based on the gap's start and end sequence numbers. The backup controller writes the CAC interval into the CAC acknowledgment option of the TCP acknowledgment message. After the acknowledgment message is sent to the host, the host only retransmits the missing data segment indicated by the CAC interval. Upon receiving the retransmitted data segment, the backup controller updates its cached input / output queues and continues to execute Internet Small Computer System (IIS) interface session scheduling. If the data checksum does not match and still does not match after retransmission, the backup controller marks the corresponding session as a checksum-abnormal session and requests the master controller to retransmit the last dirty write cache batch. After retransmission, the sequence number and data checksum comparison is re-executed. Upon receiving confirmation of takeover completion from the backup controller, the master controller closes the network interface and stops silent forwarding. After taking over the service, the backup controller continues to output a takeover status log, recording the number of active sessions, the CAC interval, the retransmission completion flag, the checksum-abnormal flag, and the takeover completion timestamp.

[0075] The following description, using specific examples, elaborates on this embodiment.

[0076] In an exemplary control cycle, the dual-controller storage system has a primary controller A and a backup controller B, interconnected via a high-speed peripheral component interconnect non-transparent bridge. The front-end sessions include Session 1, Session 2, and Session 3. During the synchronous acquisition step, the primary controller A acquires the reflected signal from the high-speed peripheral component interconnect non-transparent bridge within a sliding window, obtaining a level jitter of 0.18, an inter-symbol interference margin of 0.42, and a link bit error rate of 0.003. It reads from the error correction subsystem that the memory-correctable error count increases by 2, and reads from the serial connection minicomputer system interface driver log that one link retraining event occurs. For Session 1, statistics show a read-to-write ratio of 4:1, an average request size of 64KB, a request size variance of 16KB, a randomness degree of 0.7, a maximum latency jitter of 4ms, a queue depth change rate of 3 commands per second, and a suspended command timeout ratio of 0.02. The primary controller A writes the above data into a unified time window and normalizes it to form first-modal data, second-modal data, and third-modal time series.

[0077] In causal convolution processing, the main controller A concatenates the first and second modal data into a window concatenation vector. Assuming the convolution kernel's time span is 4, the causal convolution processing reads the concatenation vectors of the current window and the previous three windows. After element-wise multiplication of the convolution kernel weight matrix with the lower triangular temporal causal mask matrix, only the weights of the current and historical windows are retained. The main controller A calculates the causal feature vector according to the causal convolution calculation method and assembles the causal feature vectors from consecutive control cycles into a causal feature sequence.

[0078] In the bidirectional cross-attention processing, the main controller A projects the front-end service input / output load profile sequence of Session 1 to obtain the first query vector, and projects the causal feature sequence to obtain the first key vector and the first value vector respectively, and calculates the first attention output according to the first attention output calculation method; the main controller A then back-projects the causal feature sequence and the front-end service input / output load profile, and calculates the second attention output according to the second attention output calculation method; subsequently, the two sequences are concatenated and linearly projected to generate spatiotemporal interaction features. If the attention weight summary shows that the link bit error rate channel, the link retraining event channel, and the maximum latency jitter channel of Session 1 have high weights, the main controller A writes the corresponding summary into the attention weight cache.

[0079] In the fault risk classification process, the system reads spatiotemporal interaction characteristics and outputs the confidence levels for normal, sub-healthy, pre-takeover, and emergency risk levels. For example, the confidence levels for the four categories are 0.05, 0.18, 0.72, and 0.05, respectively. The pre-takeover confidence level of 0.72 reaches the pre-takeover threshold of 0.65. The main controller A marks the risk level as pre-takeover and writes the risk category identifier, risk level, and trigger timestamp into the negotiation message trigger field.

[0080] During the negotiation process, the primary controller A writes the session identifiers, priorities, most recent I / O sequence numbers, and multipath association codes of sessions 1, 2, and 3 into a negotiation message and sends it to the backup controller B. The backup controller B reads the CPU idle rate (35%), available memory (2GB), and backend disk I / O throughput (400MB / s), and matches the risk category identifier with the set of manageable categories. The backup controller B determines that the resources meet the takeover conditions and the risk category matches, responding with readiness and the maximum capacity to accept 20 session state snapshots per feedback cycle. Based on this, the primary controller A writes sessions 1, 2, and 3 into the set of sessions to be migrated and generates a draft redirection mapping table containing the backup controller B's receive queue and memory pool addresses.

[0081] During connection state synchronization, the main controller A reads the Transmission Control Protocol (TCP) sequence number 1000, acknowledgment number 800, window size 64KB, protocol options, Internet Minicomputer System Interface (IMSI) task label T1, command sequence number 50, and incomplete command description block from session 1, and encapsulates this information into a connection state snapshot. The main controller A writes this snapshot to the pre-allocated memory of the backup controller B via a remote direct memory access channel. The backup controller B reproduces the TCP control block and IMSI session structure field by field, registers session 1 as a silently ready session, and records the snapshot batch number, reproduction result, and silent ready timestamp in its state cache.

[0082] During the semi-takeover speed adjustment process, the main controller A sends a copy of the read-type non-destructive I / O request from session 1 to the backup controller B. The backup controller B performs the read and buffers the read data, temporarily delaying the transmission of the read response to the host. Within the feedback cycle, the backup controller B reports back an average read I / O processing latency of 2ms and a buffer hit rate of 85%. Assuming a target latency of 5ms, a previous cycle migration rate of 10 sessions per second, a proportional gain of 2, an integral gain of 1, a cycle length of 0.1s, and a previous cycle latency difference of 1ms, the cycle latency difference is calculated as 3ms by subtracting the average read I / O processing latency from the target latency. The candidate migration rate equals the previous cycle migration rate plus the proportional and integral terms, resulting in 14.3 sessions per second. The main controller A prunes the candidate migration rate to the range of 0 to 100 sessions per second, obtaining the current migration rate of 14.3 sessions per second, and writes the current migration rate into the retrieval order of the session set to be migrated. Since the average read input / output processing latency is below the first threshold of 3ms and the cache hit rate reaches 80%, the main controller A expands the semi-takeover scope and adds session 2 to the read offload. If the average read input / output processing latency reaches 10ms in subsequent feedback cycles, the main controller A reduces the current migration rate or cancels the low-priority semi-takeover session.

[0083] During the final handover process, if the emergency confidence level reaches 0.88 in subsequent control cycles, the primary controller A sends the activation primitive, the last dirty write buffer, and the latest input / output sequence number to the backup controller B, and enters silent companion mode. The backup controller B marks sessions 1 and 2 as active, pending confirmation sessions, reads sequence numbers 1000, 1001, and 1003 from the input / output sequence number consistency check matrix, and finds that sequence number 1002 is missing. The backup controller B constructs a selective confirmation interval based on the gap start sequence number 1002 and end sequence number 1002, writes the selective confirmation interval into an confirmation message, and sends it to the host. After the host retransmits the data segment with sequence number 1002, the backup controller B updates the cached input / output queue and activates the Transmission Control Protocol (TCP) connection. After completing the Internet Minicomputer System (IMS) interface session scheduling takeover, the backup controller B returns a takeover completion confirmation to the primary controller A. The primary controller A then closes the network interface and stops silent companion forwarding.

[0084] For the purpose of simplicity, the method steps disclosed in the above embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0085] like Figure 2 As shown, the present invention also provides a service seamless takeover system for a dual-controller storage system, comprising: The data acquisition and preprocessing module 201 is configured to synchronously acquire the physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, the health status event stream of the controller, and the front-end business input and output load profile, and divide and normalize them into multimodal data streams according to a unified time scale; The causal convolution module 202 is configured to concatenate the heartbeat physical layer features with the controller health state event stream and then perform causal convolution processing with a temporal causal mask to obtain a causal feature sequence. The cross-attention module 203 is configured to perform bidirectional cross-attention processing on the causal feature sequence and the front-end business input-output load profile to obtain spatiotemporal interaction features. Risk output module 204 is configured to output the fault risk level and risk category confidence level of future time windows according to the spatiotemporal interaction characteristics; Negotiation module 205 is configured to negotiate resource capabilities between the main controller and the standby controller when the fault risk level reaches the pre-takeover threshold, forming a set of sessions to be migrated and a draft of the redirection mapping table. The state synchronization module 206 is configured to synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and the standby controller registers silent ready sessions. The semi-pipe speed control module 207 is configured to adjust the migration rate during the semi-pipe process according to the read input / output processing delay and buffer hit status returned by the backup controller. The instantaneous takeover module 208 is configured to activate the standby controller takeover service according to the consistency verification result of the input and output sequence numbers when the fault risk level reaches the emergency switching threshold or the heartbeat interruption reaches the hard timeout.

[0086] It is worth noting that although only some basic functional modules are disclosed in the embodiments of this invention, it does not mean that the composition of this system is limited to the above-mentioned basic functional modules. On the contrary, based on the above-mentioned basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with existing technology to form an infinite number of embodiments or technical solutions. That is to say, this system is open rather than closed. The fact that this embodiment only discloses a few basic functional modules should not be considered as the scope of protection of this invention being limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above devices are described separately according to their functions as various units and modules. Of course, in implementing this invention, the functions of each unit and module can be implemented in one or more software and / or hardware.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for seamless service takeover in a dual-controller storage system, characterized in that, include: Synchronously collect physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event stream, and front-end business input and output load profile, and segment and normalize them into multimodal data streams according to a unified time scale; After concatenating the heartbeat physical layer features with the controller health state event stream, a causal convolution process with a temporal causal mask is performed to obtain a causal feature sequence. The causal feature sequence is subjected to bidirectional cross-attention processing with the front-end business input-output load profile to obtain spatiotemporal interaction features. Output the fault risk level and risk category confidence level of the future time window based on the spatiotemporal interaction characteristics; When the fault risk level reaches the pre-takeover threshold, the main controller and the standby controller negotiate resource capabilities to form a preliminary draft of the session set to be migrated and the redirection mapping table. Synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and register silent ready sessions on the standby controller; During the semi-takeover process, the migration rate is adjusted according to the read input / output processing delay and cache hit status returned by the backup controller. When the fault risk level reaches the emergency switchover threshold or the heartbeat interruption reaches the hard timeout, the backup controller is activated to take over the service according to the consistency verification result of the input and output sequence numbers.

2. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, Synchronously collect physical layer characteristics of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event stream, and front-end business input / output load profiles, further including: Level jitter, inter-symbol interference margin, and link bit error rate are extracted from the reflected signals of non-transparent bridges interconnecting high-speed peripheral components to form heartbeat physical layer characteristics; The event type, event timestamp, and severity weight are extracted from the controller error correction record, the central processing unit cache soft error record, the serial connection small computer system interface link retraining record, and the power ripple over-limit alarm record to form a controller health status event stream. Statistical analysis is performed on a session-by-session basis, including read / write ratio, average request size, request size variance, randomness, maximum latency jitter, queue depth change rate, and suspended command timeout rate, to create a front-end business input / output load profile. The heartbeat physical layer features, controller health status event stream, and front-end business input / output load profiles are aligned into a multimodal data stream using a unified time scale.

3. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, After concatenating the heartbeat physical layer features with the controller health state event stream, a causal convolution process with a temporal causal mask is performed to obtain a causal feature sequence, which further includes: The heartbeat physical layer features and the controller health status event stream are concatenated into a window concatenation vector according to the same time window; Multiply the convolution kernel weights element-wise with the lower triangular temporal causal mask matrix, and set the elements in the convolution kernel weights that are in future time steps to zero. Based on the zeroed-out convolution kernel weights, a causal convolution operation is performed on the window concatenation vector to obtain a causal feature sequence formed by physical layer degradation features and hardware error events.

4. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, The causal feature sequence is subjected to bidirectional cross-attention processing with the front-end business input / output load profile to obtain spatiotemporal interaction features, which further include: The first query vector is obtained by querying and projecting the front-end business input and output load profile. The first key vector and the first value vector are obtained by key projection and value projection of the causal feature sequence. The first attention output from the front-end business input and output load profile to the causal feature sequence is calculated. The second query vector is obtained by projecting the causal feature sequence through the query. The second key vector and the second value vector are obtained by projecting the front-end business input-output load profile through key projection and value projection. The second attention output from the causal feature sequence to the front-end business input-output load profile is calculated. After splicing the first attention output and the second attention output, linear projection is performed to obtain the spatiotemporal interaction features.

5. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, Based on the spatiotemporal interaction characteristics, the system outputs the fault risk level and risk category confidence level for future time windows, further including: Perform fault risk classification processing on spatiotemporal interaction features, map them to normal, sub-healthy, pre-takeover and emergency risk levels according to preset classification boundaries, and output the confidence level of each risk category; When the confidence level of the pre-takeover category reaches the pre-takeover threshold or the confidence level of the emergency category reaches the emergency switchover threshold, the risk level and risk category identifier that have reached the threshold will be written into the trigger field of the negotiation message; If neither the pre-takeover confidence level nor the emergency confidence level reaches the pre-takeover threshold nor the emergency switchover threshold, continue to perform multimodal data stream acquisition and fault risk level output.

6. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, The primary controller and the backup controller negotiate resource capabilities to generate a preliminary draft of the session set to be migrated and the redirection mapping table, which further includes: The main controller writes the current risk level, risk category identifier, session identifier, session priority, most recent input / output sequence number, and multipath association code into a negotiation message and sends it to the backup controller; The standby controller reads the CPU idle rate, available memory, and back-end disk I / O throughput margin, and matches the risk category identifier with a preset set of manageable categories; When resources meet the takeover conditions and the risk category matches, the standby controller returns to readiness and the upper limit of acceptance capacity. When resources do not meet the takeover conditions, the standby controller restores the priority lower limit of the takeover session and the degraded preparation; The main controller filters active sessions based on the response content and generates a set of sessions to be migrated and a draft of the redirection mapping table.

7. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, Synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and register silent-ready sessions on the standby controller, further including: The main controller reads the Transmission Control Protocol sequence number, acknowledgment number, window size, protocol options, Internet Small Computer System Interface task label, command sequence number, and incomplete command description block from the set of sessions to be migrated, and encapsulates them into a connection state snapshot; The main controller writes a snapshot of the connection state to the pre-allocated memory of the standby controller via a remote direct memory access channel; The standby controller reproduces the transmission control protocol control block and the Internet minicomputer system interface session structure field by field, and registers the reproduced session as a silent ready session. The silent ready session maintains a paused state for data packet sending and backend command submission.

8. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, During the semi-takeover process, the migration rate is adjusted according to the read input / output processing latency and buffer hit status returned by the backup controller, further including: The master controller sends a copy of the non-destructive input / output request to be read to the backup controller. The backup controller performs the read and caches the read data in the backup controller, and postpones sending the read response to the master controller. The main controller continues to process write requests and synchronization commands along the original business path; The backup controller sends back the average read input / output processing latency and buffer hit status according to the feedback cycle; The main controller inputs the difference between the expected delay and the average read input / output processing delay into the proportional-integral control process, and updates the current migration rate according to the proportional gain, integral gain, previous cycle migration rate, and the delay difference of the previous cycle. When the average read input / output processing latency is lower than the first threshold and the cache hit status meets the preset hit conditions, the main controller expands the scope of partial takeover. When the average read input / output processing latency reaches the second threshold or abnormal jitter occurs, the main controller reduces the current migration rate, suspends migration, or cancels some semi-takeover sessions and returns to single-controller processing.

9. The service seamless takeover method for a dual-controller storage system according to claim 1, characterized in that, Activating the standby controller to take over the service based on the consistency verification results of the input and output sequence numbers further includes: The main controller sends the activation primitive, the last dirty write buffer, and the latest input / output sequence number to the standby controller, and then enters silent companion mode; The standby controller marks the silent ready session as an active pending confirmation session, reads the input / output sequence number consistency check matrix in the shared memory of the high-speed peripheral component interconnect non-transparent bridge, and compares the input / output sequence numbers and data checksums submitted but not confirmed by the main controller with the input / output queues cached by the standby controller item by item. When the comparison results show that the serial numbers are consecutive and the data checksum matches, the backup controller activates the transmission control protocol connection. When a sequence number gap is detected, the backup controller activates the transmission control protocol connection and sends an acknowledgment message with selective acknowledgment options to the host. The acknowledgment message carries the range of the missing data segment. The main controller shuts down the network interface after receiving confirmation that the takeover is complete.

10. A service seamless takeover system for a dual-controller storage system, characterized in that, include: The data acquisition and preprocessing module is configured to synchronously acquire physical layer features of the heartbeat of the non-transparent bridge interconnection of high-speed peripheral components, controller health status event streams, and front-end business input and output load profiles, and segment and normalize them into multimodal data streams according to a unified time scale; The causal convolution module is configured to concatenate the heartbeat physical layer features with the controller health state event stream and then perform causal convolution processing with a temporal causal mask to obtain a causal feature sequence. The cross-attention module is configured to perform bidirectional cross-attention processing on the causal feature sequence and the front-end business input / output load profile to obtain spatiotemporal interaction features. The risk output module is configured to output the fault risk level and risk category confidence level for future time windows based on spatiotemporal interaction characteristics. The negotiation module is configured to negotiate resource capabilities between the main controller and the standby controller when the fault risk level reaches the pre-takeover threshold, forming a set of sessions to be migrated and a draft of the redirection mapping table. The state synchronization module is configured to synchronize connection state snapshots to the standby controller according to the set of sessions to be migrated, and the standby controller registers silent ready sessions. The semi-pipe speed control module is configured to adjust the migration rate during the semi-pipe process according to the read input / output processing delay and buffer hit status returned by the backup controller. The instantaneous takeover module is configured to activate the standby controller takeover service based on the consistency verification result of the input and output sequence numbers when the fault risk level reaches the emergency switch threshold or the heartbeat interruption reaches the hard timeout.

Images