Storage system, and control method of storage system

Abstract

To provide a storage system capable of performing a data loss prevention process before data loss occurs in cache memory.SOLUTION: In a disclosed storage system 100 in an embodiment, a controller 1 includes: a failure prediction monitoring unit 101 that acquires information about the state of a DIMM 11, and monitors and detects pre-failure of the DIMM 11 based on the acquired information; and a control unit 104 that is configured to, when the failure prediction monitoring unit 101 detects failure prediction, copy or move the cache data that has lost redundancy to a predetermined backup location.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to a storage system and a control method for a storage system. [Background technology]

[0002] Conventionally, storage systems that achieve data redundancy by using multiple drives composed of magnetic disk devices and the like are known. In such storage systems, by also making controller boards (hereinafter simply referred to as "controllers") equipped with main memory, cache memory, and the like redundant, it is possible to achieve redundancy of cache data before it is saved in the drives. However, in a storage system configured in this way, for example, if one of the redundant controllers becomes inoperable, the redundancy of the cache data is no longer maintained.

[0003] Patent Document 1 discloses a disk array subsystem in which two memory controllers included in each of two redundantly configured clusters independently determine the addresses at which cache data is stored. By configuring the disk array subsystem in this way, data transferred from the host controller is stored in pages with different addresses in the two memory controllers. In other words, the directory configurations managed by the two memory controllers each have different contents.

[0004] According to the disk array subsystem described in Patent Document 1, when recovering data, it is not necessary to make the management contents of the respective directories of the two memory controllers in the cluster consistent. Therefore, the disk array subsystem described in Patent Document 1 can recover data redundancy in the cluster by writing dirty data stored in the other memory controller, i.e., data that has not been written to the disk, to an arbitrary storage address in the cache memory in the failed memory controller. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-92318 Summary of the Invention [Problem to be solved by the invention]

[0006] Incidentally, memory modules equipped with both cache memory and main memory are sometimes used as memory modules mounted on controllers. In such memory modules, if a number of errors, such as correctable errors, occur consecutively within a short period of time and the number of such errors exceeds a threshold error count, the controller will be blocked. If a failure also occurs in the other redundant controller when one controller is blocked, i.e., cache data redundancy is lost, the cache data will be lost. In other words, data loss will occur.

[0007] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to enable processing to prevent data loss before cache data loss actually occurs. [Means for solving the problem]

[0008] A storage system according to one aspect of the present invention includes a plurality of controllers, each having a cache memory and configured to be redundant with respect to one another, and a drive in which cache data in the cache memory is stored. The controller of the storage system according to one aspect of the present invention includes a failure sign monitoring unit that acquires information regarding the state of the cache memory and monitors and detects signs of an irreparable failure in the cache memory based on the acquired information, and a control unit that, when the failure sign monitoring unit detects a sign of failure, copies or moves the cache data that has lost redundancy to a predetermined backup destination. [Effects of the Invention]

[0009] According to at least one aspect of the present invention, it becomes possible to take steps to prevent data loss in a memory module before the data loss actually occurs. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a conventional controller equipped with a plurality of memory modules. [Figure 2] FIG. 1 is a diagram illustrating an example of a state transition of a conventional DIMM. [Figure 3] 10 is a flowchart illustrating an example of a conventional procedure for monitoring an error state of a DIMM by a CPU. [Figure 4] FIG. 1 is a diagram illustrating an example of a configuration of a conventional storage system having a redundant configuration. [Figure 5] FIG. 1 is a diagram illustrating an example of a state transition of redundancy in a conventional controller. [Figure 6] 1 is a block diagram showing an example of the configuration of a storage system according to an embodiment of the present invention. [Figure 7] FIG. 10 is a diagram illustrating an example of information stored in a DIMM according to an embodiment of the present invention. [Figure 8] FIG. 4 is a diagram illustrating an example of the configuration of a management table according to an embodiment of the present invention. [Figure 9] FIG. 4 is a diagram showing an example of the configuration of a directory table according to an embodiment of the present invention. [Figure 10] 10 is a flowchart illustrating an example of a control processing procedure of a storage system according to an embodiment of the present invention. [Figure 11] 10 is a flowchart illustrating an example of a procedure for a data loss avoidance process when speed of avoiding data loss is prioritized according to an embodiment of the present invention. [Figure 12]10 is a flowchart showing an example of a procedure for a data loss avoidance process in a case where importance is placed on the reliability (certainty) of data loss avoidance according to an embodiment of the present invention. [Figure 13] 10 is a flowchart illustrating an example of a procedure for a first redundancy recovery process according to an embodiment of the present invention. [Figure 14] 10 is a flowchart illustrating an example of a procedure for a second redundancy restoration process according to an embodiment of the present invention. [Figure 15] 10 is a flowchart illustrating an example of a procedure for a third redundancy restoration process according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In each drawing, the same components are designated by the same reference numerals. The following description and drawings are examples for explaining the present invention, and for clarity of explanation, appropriate omissions and simplifications have been made. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0012] <Problems to be solved by the present invention> Before going into the description of one embodiment of the present invention, first, the problem to be solved by the present invention will be described with reference to FIGS.

[0013] FIG. 1 is a diagram showing an example of the configuration of a conventional controller equipped with multiple memory modules. The controller 1A shown in FIG. 1 has CPUs (Central Processing Units) 10A-1 and 10A-2. The controller 1A also has DIMMs (Dual Inline Memory Modules) 11A-1 to 11A-8 as memory modules. The DIMMs 11A-1 to 11A-8 function as cache memories and also serve as main memories. The DIMMs 11A-1 to 11A-4 are controlled by the CPU 10A-1, and the DIMMs 11A-5 to 11A-8 are controlled by the CPU 10A-2.

[0014] DIMM11A-1 to DIMM11A-8 each have a temperature sensor (not shown). DIMM11A-1 to DIMM11A-4 output temperature information measured by the temperature sensor to CPU10A-1, and DIMM11A-5 to DIMM11A-8 output temperature information measured by the temperature sensor to CPU10A-2.

[0015] DIMM11A-1 to DIMM11A-4 also output the number of DIMM errors (hereinafter simply referred to as errors) that have occurred to CPU10A-1. DIMM errors include correctable errors that can be corrected by the CPU. DIMM11A-5 to DIMM11A-8 also output the number of DIMM errors that have occurred to CPU10A-2. In the following description, when it is not necessary to distinguish between CPU10A-1 and CPU10A-2, they will be collectively referred to as "CPU10A." When it is not necessary to distinguish between DIMM11A-1 to DIMM11A-8, they will be collectively referred to as "DIMM11A."

[0016] The number of errors that occur in DIMM 11A is counted by an error counter (not shown) or the like until a timer (not shown) expires. That is, the number of errors that occur output from DIMM 11A to CPU 10A is the number of errors that occur up until the timer expires. The timer is set to, for example, one day (24 hours). Alternatively, the number of errors that occur is the number of errors that occur at the time when the number of errors that occur exceeds a predetermined threshold error number.

[0017] The controller 1A also includes a DC-DC converter 12A and an environmental MCU (Micro Controller Unit) 13A. The DC-DC converter 12A converts a DC voltage supplied from a power supply (not shown) into a DC voltage suitable for each of the CPUs 10A-1 and 10A-2, and DIMMs 11A-1 to 11A-8, and supplies the converted DC voltages to the CPUs 10A-1, 10A-2, and DIMMs 11A-1 to 11A-8, respectively.

[0018] The environment MCU 13A checks whether there is an abnormality in the temperature, voltage, etc. of the controller 1A. The environment MCU 13A also acquires information on the magnitude of the DC voltage supplied from the DC-DC converter 12A to each of the DIMMs 11A-1 to 11A-8, and outputs the information to the CPU 10A-1 or CPU 10A-2.

[0019] When the CPU 10A accesses and reads the DIMM 11A, it performs a parity check such as a CRC (Cyclic Redundancy Check) or an ECC (Error Correcting Code). If a DIMM error is detected, the CPU 10A corrects the error. The CPU 10A also controls the blocking of the controller 1A depending on the type of error and the number of occurrences.

[0020] 2 is a diagram showing an example of the state transition of the DIMM 11A. First, when the power of the device (not shown) equipped with the controller 1A is turned on, the DIMM 11A is initialized. An uncorrectable error (denoted as "UCER" in the figure) may occur during the initialization stage, in which case the DIMM 11A transitions to an abnormal state and becomes inoperable.

[0021] When DIMM 11A starts operating normally, a correctable error (denoted as "CERR" in the diagram) occurs in DIMM 11A, which has a low probability of indicating that DIMM 11A is abnormal, or a correctable error that has a high probability of indicating that DIMM 11A is abnormal. If the number of occurrences of these correctable errors exceeds a predetermined threshold error number, DIMM 11A transitions to an abnormal state and becomes inoperable.

[0022] FIG. 3 is a flowchart showing an example of the procedure for the error status monitoring process of the DIMM 11A by the CPU 10A. First, CPU 10A detects an error in DIMM 11A (step S1). Next, CPU 10A determines whether the error is a correctable error (step S2). If it is determined in step S2 that the error is a correctable error (YES in step S2), CPU 10A corrects the error (step S3). Next, CPU 10A determines whether the number of times the error has occurred is equal to or greater than a predetermined threshold number of errors (step S4). If it is determined in step S4 that the number of times the error has occurred is less than the threshold number of errors (NO in step S4), CPU 10A returns the process to step S1.

[0023] On the other hand, if it is determined in step S4 that the number of errors is equal to or greater than the threshold error number (YES in step S4), or if the determination in step S2 is NO, that is, if the error is an uncorrectable error that cannot be corrected, the CPU 10A blocks the controller 1A (step S5). After the processing of step S5, the error status monitoring processing of the DIMM 11A by the CPU 10A ends.

[0024] 4 is a diagram showing an example of the configuration of a conventional storage system 100A having a redundant configuration. The storage system 100A includes a host 3A-1, a host 3A-2, controllers 1A-0 to 1A-3, and a drive 2. The host 3A-1 is connected to the controller 1A-0 and the controller 1A-2, and the host 3A-2 is connected to the controller 1A-1 and the controller 1A-3. The host 3A-1 instructs the controller 1A-0 and the controller 1A-2 to read and write data, and the host 3A-2 instructs the controller 1A-1 and the controller 1A-3 to read and write data. The configuration of the controllers 1A-0 to 1A-3 is the same as the configuration of the controller 1A shown in FIG. 1.

[0025] Furthermore, cluster CL1 is configured by controller 1A-0 and controller 1A-1, and cluster CL2 is configured by controller 1A-2 and controller 1A-3. That is, in cluster CL1, redundancy is achieved by controller 1A-0 and controller 1A-1, and in cluster CL2, redundancy is achieved by controller 1A-2 and controller 1A-3. Cluster CL1 and cluster CL2 are connected to different power supplies (not shown), and cluster CL1 and cluster CL2 are also configured to be redundant.

[0026] In cluster CL1, when both controller 1A-0 and controller 1A-1 are operating normally, controller redundancy is maintained. On the other hand, in cluster CL1, when either controller 1A-0 or controller 1A-1 is not operating, controller redundancy is not maintained. Similarly, in cluster CL2, when both controller 1A-2 and controller 1A-3 are operating normally, controller redundancy is maintained. On the other hand, in cluster CL2, when either controller 1A-2 or controller 1A-3 is not operating, controller redundancy is not maintained.

[0027] Furthermore, the controllers 1A-0 to 1A-3 are each connected to a drive 2A. The drive 2A is made up of a plurality of drives 2A-1 to 2A-n (n is a natural number of 2 or greater).

[0028] FIG. 5 is a diagram showing an example of a conventional controller redundancy state transition. Assume that in each of clusters CL1 and CL2, controller redundancy is present (maintained), and a failure occurs in the DIMM 11A of one of the controllers 1A, causing that controller 1A to become inoperable. In this case, the cluster transitions to a state where there is no controller redundancy. In a state where there is no controller redundancy, a redundancy restoration process is performed by the CPU 10A. This redundancy restoration process typically takes several tens of minutes.

[0029] Then, suppose that the other controller also becomes inoperable while the redundancy restoration process is being executed. In this case, the dirty data held in each of the two controllers, i.e., the data not saved in drive 2A, is lost. In other words, data loss occurs. For example, if correctable errors accidentally occur consecutively over time in each of the different controllers, both controllers will become inoperable, resulting in data loss. The storage system according to the present invention monitors for signs of an unrecoverable failure that could lead to the blocking of a controller, and performs processing to prevent data loss if such a sign is detected.

[0030] <Storage system configuration> Next, the configuration of a storage system according to an embodiment of the present invention will be described with reference to Fig. 6. Fig. 6 is a block diagram showing an example of the configuration of a storage system 100 according to this embodiment.

[0031] As shown in FIG. 6, the storage system 100 has four controllers (controller boards): controller 1-0 to controller 1-3. The internal configuration of the controller is illustrated only for controller 1-0. In the storage system 100, controllers 1-0 and 1-1 form a cluster CL1, and controllers 1-2 and 1-3 form a cluster CL2. In the following description, when it is not necessary to distinguish between controllers 1-0 to 1-3, they will be collectively referred to as "controller 1," and when it is not necessary to distinguish between clusters CL1 and CL2, they will be collectively referred to as "cluster CL" (an example of a "first cluster" and a "second cluster").

[0032] The configuration of the controller 1 will be described with reference to the controller 1-0. The controller 1-0 includes a CPU 10-0, a DIMM 11-0, a DC-DC converter 12-0, an environment MCU 13-0, a CFM (Cache Flash Memory) 14-0, a switch 16-0 (denoted as "SW" in the figure), and a PCH (Platform Controller Hub) 17-0.

[0033] The CPU 10-0 is connected to a front end 15-0 (denoted as "FE" in the figure) via a host I / F (Interface) 51-0, and the front end 15-0 is connected to a host (not shown) via a communication network (not shown). The CPU 10-0 is also connected to a CPU (not shown) of a controller 1-2 in cluster CL2 via a mutual communication network 52-0, and is also connected to a CPU (not shown) of a controller 1-3 in cluster CL2 via a mutual communication network (not shown).

[0034] Furthermore, the CPU 10-0 is connected to a switch 16-0, and the switch 16-0 is connected to a backplane 4 via a drive I / F 53-0. The backplane 4 is a circuit board on which buses and the like that connect the clusters CL are formed, and drives 2 configured as HDDs (Hard Disk Drives) or SSDs (Solid State Drives) and the like are arranged on the backplane 4. The drives 2 include drives 2-1 to 2-n.

[0035] Furthermore, CPU10-0 is connected to PCH17-0, which is connected to environment MCU13-0 and CFM14-0. Environment MCU13-0 outputs information on the magnitude of the voltage supplied to DIMM11-0 to CPU10-0 via PCH17-0. CFM14-0 (an example of a cache data evacuation memory) is a memory to which cache data stored in DIMM11-0 is evacuated.

[0036] The DIMM 11-0 is a memory module that functions as both a main memory and a cache memory. Cache data is stored in the DIMM 11-0 as a cache memory. The DIMM 11-0 is also equipped with a temperature sensor, and outputs temperature information measured by the temperature sensor to the CPU 10-0.

[0037] Furthermore, the DIMM11-0 stores a program for causing the storage system 100 to execute control processing of the storage system according to this embodiment. The program is stored in the form of computer-readable program code, and the CPU 10-1 sequentially executes operations in accordance with the program code. In other words, the DIMM11-0 is also used as an example of a computer-readable non-transitory recording medium that stores a program to be executed by a computer.

[0038] The DC-DC converter 12-0 converts a DC voltage supplied from a power supply (not shown) into a DC voltage suitable for each of the CPU 10-0 and the DIMM 11-0, and supplies the converted DC voltage to the CPU 10-0 and the DIMM 11-0, respectively. Examples of various information stored in the DIMM 11-0 will be described in detail with reference to FIG. 7 below. In the following description, when it is not necessary to distinguish between the CPUs 10-0 to 10-4 (not shown), they will be collectively referred to as "CPU 10." In the following description, when it is not necessary to distinguish between the DIMMs 11-0 to DIMM 11-3 (not shown), they will be collectively referred to as "DIMM 11."

[0039] The CPU 10-0 includes a failure symptom monitor 101-0, a management table 102-0, a directory table 103-0, and a control unit 104-0. The failure symptom monitoring unit 101-1 detects the symptoms of an unrecoverable failure that could lead to the blocking of the controller 1, based on the occurrence pattern of correctable errors, temperature information of the DIMM 11-0, information on the voltage supplied to the DIMM 11-0, etc. The number of correctable errors that have occurred, the temperature information, and information on the voltage supplied to the DIMM 11-0 are stored in a management table 102-0. The configuration of the management table 102-0 (102) will be described in detail later with reference to FIG. 8.

[0040] The fault sign monitoring unit 101-0 detects fault signs by, for example, analyzing the occurrence pattern of correctable errors per unit time. Correctable error occurrence patterns include, for example, short-term occurrence patterns, long-term occurrence patterns, bit patterns, etc.

[0041] A short-term occurrence pattern is a pattern indicated by, for example, the number of correctable errors occurring in one second. A long-term occurrence pattern is a pattern indicated by, for example, the number of correctable errors occurring in one day. Note that the period for acquiring the correctable error occurrence pattern is not limited to these periods. A bit pattern indicates an error occurrence pattern when correctable errors occur in multiple data queues. A state in which correctable errors occur in multiple data includes a state in which errors occur simultaneously in multiple data within one element of a memory cell, and a state in which an error occurs in one bit in each of two or more elements.

[0042] The failure sign monitoring unit 101-0 predefines occurrence patterns of correctable errors that lead to unrecoverable failures such as blockage of the controller 1, and notifies the control unit 104-0 that a failure sign has been detected if the acquired occurrence pattern corresponds to the defined occurrence pattern. Furthermore, the failure sign monitoring unit 101-0 detects a failure sign if the acquired temperature, supply voltage, etc. of the DIMM 11 are outside the threshold ranges preset as values ​​during normal operation.

[0043] In conventional storage systems, error analysis is performed when a controller 1 suspected of having a hardware failure or the like is retrieved from the user. However, errors often do not reoccur in the repaired controller 1, and in such cases, the cause of the controller 1 blockage or hardware failure cannot be identified. In contrast, the storage system 100 according to this embodiment acquires correctable error information, DIMM 11 temperature information, and supply voltage information before the controller 1 is blocked, making it possible to identify the cause of the controller 1 blockage or hardware failure using this information.

[0044] Furthermore, the storage system 100 according to this embodiment can obtain information such as the usage environment and usage trends of the controller 1 for each user using the information obtained by the failure sign monitoring unit 101-0. Then, based on this obtained information, it is possible to take measures to prevent the occurrence of a failure before it occurs. For example, if the temperature or supply voltage of the DIMM 11 is the cause of the failure, a maintenance person or the like can take preventative measures to ensure that these do not exceed the normal range. Furthermore, a maintenance person or the like can take measures such as replacing a controller 1 that has a high probability of failure with a new controller 1 as a preventative measure.

[0045] The management table 102-0 is a table that stores the number of correctable errors that have occurred in each DIMM that constitutes the DIMM 11-0, temperature information, and supply voltage information.

[0046] The directory table 103-0 is management information for each area (cache segment) into which the cache area of ​​the DIMM 11-0 is subdivided, and the directory table 103-0 has entries corresponding to each cache segment. Each entry includes a cache address, a logical volume number, a logical volume address, an attribute entry, etc. An example of the configuration of the directory table 103-0 will be described in detail later with reference to FIG. 9.

[0047] The information stored in the directory table 103-0 can be referred to and obtained from the CPUs in other clusters CL2, such as the CPU in the controller 1-2 within the cluster CL2 connected via the mutual communication network 52-0.

[0048] In the following description, when it is not necessary to distinguish the failure prediction monitoring units 101-0 to 101-3 (not shown) respectively, these are collectively referred to as the "failure prediction monitoring unit 101". Also, when it is not necessary to distinguish the management tables 102-0 to 102-3 (not shown) respectively, these are collectively referred to as the "management table 102". Also, when it is not necessary to distinguish the directory tables 103-0 to 103-3 (not shown) respectively, these are collectively referred to as the "directory table 103". Furthermore, when it is not necessary to distinguish the control units 104-0 to 104-3 (not shown) respectively, these are collectively referred to as the "control unit 104".

[0049] <Stored Information of DIMM> Here, referring to FIG. 7, the information stored in the DIMM 11 will be described. FIG. 7 is a diagram showing an example of the stored information of the DIMM 11. As shown in FIG. 7, information such as host I / F control information, drive I / F control information, cache data (Clean), and cache data (Dirty) is stored in the DIMM 11. "Clean" and "Dirty" of the cache data are information indicating the attributes of the cache data. The cache data with the attribute of "Dirty" (hereinafter also referred to as "Dirty data") is data that has not yet been destaged, that is, data that has not been written to the drive 2. The cache data with the attribute of "Clean" (hereinafter referred to as "Clean data") indicates data that has been destaged and the values of the cache data and the data written to the drive 2 match.

[0050] If one of the redundantly configured controllers 1 becomes inoperable while dirty data exists, the redundancy of the cache data is lost. Furthermore, if the other controller 1 becomes inoperable in this state, data loss occurs. Therefore, in this embodiment, the control unit 104 executes processing to prevent data loss when the failure symptom monitoring unit 101 detects a failure symptom.

[0051] Continuing the explanation, returning to Fig. 6, the control unit 104-0 performs the following operations such as the first redundancy recovery process to the third redundancy recovery process as a process for preventing data loss. First redundancy recovery process: A process of copying (duplicating) dirty data to the DIMM 11 (an example of a backup destination) of another controller 1 of another cluster CL. Second redundancy recovery process: Dirty data is destaged (moved) to drive 2 (an example of a backup destination) and converted to clean data. Third redundancy recovery process: A process of storing (saving) dirty data in the CFM 14 (an example of a saving destination) in the own controller 1.

[0052] The first redundancy restoration process takes the longest time to execute, but is a process that can reliably restore redundancy. The second redundancy restoration process takes the shortest time to complete the avoidance process, and is also a process that can reliably restore redundancy. The third redundancy restoration process is a process that may not be able to restore redundancy if the other controller 1 also becomes inoperable during the execution of the avoidance process, resulting in data loss. However, the third redundancy restoration process has the second shortest time to complete. The control unit 104 can determine the execution order of the first to third redundancy restoration processes based on an index or other factor to determine whether to place more importance on the speed at which the avoidance process is completed, or the reliability of being able to reliably restore redundancy.

[0053] <Management table configuration> Next, the configuration of the management table 102 will be described with reference to Fig. 8. Fig. 8 is a diagram showing an example of the configuration of the management table 102. In the example shown in Fig. 8, the management table 102 stores the number of errors that have occurred in each of DIMM11-0 to DIMM11-n, temperature information for each of DIMM11-0 to DIMM11-n, and supply voltage information for each of DIMM11-0 to DIMM11-n. The number of errors that have occurred is the number of correctable errors that have occurred, and is reset when one day set in the timer has elapsed or when the number of errors that have occurred reaches or exceeds a threshold number of errors.

[0054] <Directory table configuration> Next, the configuration of the directory table 103 will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the configuration of the directory table 103. On the left side of Fig. 9, a directory table 103-0 of the controller 1-0 that constitutes cluster CL1 and a directory table 103-1 of the controller 1-1 that constitutes cluster CL1 are shown. On the right side of Fig. 9, a directory table 103-2 of the controller 1-2 that constitutes cluster CL2 and a directory table 103-3 of the controller 1-3 that constitutes cluster CL2 are shown.

[0055] Each directory table 103 has the following items: "cache address," "logical volume number," "logical volume address," "attribute," and "duplicated CTL#." The "cache address" item stores information about the cache address, which is the address in memory of the cache segment to which each entry in the directory table 103 corresponds. The "logical volume number" item stores information about the logical volume number of the cache data stored in the cache segment to which each entry corresponds. The "logical volume address" item stores information about the logical volume address of the data stored in the cache segment to which each entry corresponds.

[0056] The "Attributes" field stores attribute information for the cache data stored in the cache segment corresponding to each entry. Cache data attributes include "Clean" and "Dirty." A "-" in the "Attributes" field indicates that no cache data is stored in the cache segment.

[0057] The "Duplexed CTL#" item in the directory table 103 stores identification information of the other controller 1 that is the target of duplication (redundancy). Therefore, the CPU 10 of each controller 1 can grasp information on the storage destination of the duplicated cache data, information on the attributes of the cache data, etc., based on the information written in the directory table 103.

[0058] 9, the cache data stored at cache address "0" of controller 1-0 of cluster CL1 is made redundant (duplicated) with the cache data stored at cache address "0" of controller 1-2 of cluster CL2. The cache segments at cache address "0" of controller 1-0 and controller 1-2 each store cache data with logical volume number "1", logical volume address "1024", and attribute "Dirty".

[0059] Similarly, the cache data stored at cache address "2" of controller 1-0 of cluster CL1 is made redundant with the cache data stored at cache address "2" of controller 1-3 of cluster CL2. Furthermore, the cache data stored at cache address "3" of controller 1-0 of cluster CL1 is made redundant with the cache data stored at cache address "3" of controller 1-3 of cluster CL2.

[0060] <Storage system control method> Next, a control method by the storage system 100 according to this embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of the procedure for control processing by the storage system 100.

[0061] First, the failure sign monitoring unit 101 of the CPU 10 of the controller 1 starts counting on a timer and an error counter (step S11). The process of step S11 is executed at a timing that is preset as the start timing for failure sign monitoring of the DIMM 11. After counting is started in step S11, the timer is reset, for example, after one day has passed.

[0062] Next, the failure symptom monitoring unit 101 acquires temperature information and supply voltage information of the DIMM 11 (step S12). The process of step S12 is performed periodically while the failure symptom monitoring unit 101 is performing monitoring.

[0063] Next, the failure symptom monitoring unit 101 determines whether the timer has expired (step S13). If it is determined in step S13 that the timer has expired (YES in step S13), the failure symptom monitoring unit 101 determines whether the number of generated errors is less than the threshold number of errors (step S14). If it is determined in step S14 that the number of generated errors is less than the threshold number of errors (YES in step S14), the failure symptom monitoring unit 101 determines whether the correctable error occurrence pattern, the temperature of the DIMM 11, and the voltage supplied to the DIMM 11 satisfy the data loss avoidance conditions (step S15).

[0064] The data loss avoidance conditions are conditions that necessitate the execution of data loss avoidance processing. As described above, the data loss avoidance conditions related to correctable errors in the DIMM 11 are defined by short-term occurrence patterns, long-term occurrence patterns, bit patterns, etc. The data loss avoidance conditions related to the temperature and supply voltage of the DIMM 11 are defined by threshold ranges stipulated by values ​​during normal operation, etc. If the temperature and supply voltage of the DIMM 11 acquired by the failure symptom monitoring unit 101 are outside the threshold ranges, the data loss avoidance conditions are met.

[0065] If it is determined in step S15 that the data loss avoidance condition is met (YES in step S15), the control unit 104 executes data loss avoidance processing (step S16). The data loss avoidance processing will be described in detail later with reference to FIGS. 11 and 12.

[0066] On the other hand, if it is determined in step S15 that the data loss avoidance conditions are not met (NO in step S15), the failure symptom monitoring unit 101 reports error information to the control unit 104 (step S17). Next, the failure symptom monitoring unit 101 resets the timer and the error counter (step S18). After processing step S18, the process returns to step S11.

[0067] If it is determined in step S13 that the timer has not expired (NO in step S13), the failure symptom monitoring unit 101 determines whether the number of error occurrences is equal to or greater than the threshold error number (step S19). If it is determined in step S19 that the number of error occurrences is less than the threshold error number (NO in step S19), the process returns to step S12 and is repeated.

[0068] On the other hand, if it is determined in step S19 that the number of errors has reached or exceeded the threshold error number (YES in step S19), or if the determination in step S14 is NO, the control unit 104 blocks the controller 1 (step S20). After the processing of step S20, the control processing by the storage system 100 ends.

[0069] Next, the data loss avoidance processing executed in step S16 of Fig. 10 will be described with reference to Fig. 11 and Fig. 12. Fig. 11 is a flowchart showing an example of the procedure for data loss avoidance processing when emphasis is placed on the speed (speed) of data loss avoidance. Fig. 12 is a flowchart showing an example of the procedure for data loss avoidance processing when emphasis is placed on the reliability (certainty) of data loss avoidance. It is assumed that the user or the like has set in advance which of the speed-oriented processing shown in Fig. 11 or the reliability-oriented processing shown in Fig. 12 will be executed as the data loss avoidance processing.

[0070] [Data loss prevention process (speed-focused)] First, with reference to FIG. 11, a data loss avoidance process in which speed in avoiding data loss is prioritized will be described. First, the failure symptom monitoring unit 101 of the CPU 10 of the controller 1 checks whether or not there is dirty data in all DIMMs 11 in the controller itself (step S31). Next, the failure symptom monitoring unit 101 checks whether or not the cache data being checked has a dirty attribute and has lost redundancy (step S32). Data that has lost redundancy is cache data that has lost its redundancy due to the other controller 1 in a redundant configuration being blocked.

[0071] If it is determined in step S32 that the cache data to be checked is not data with a dirty attribute and no redundancy has been lost (NO in step S32), the process proceeds to step S17 in Fig. 10. That is, the failure symptom monitoring unit 101 reports information about the detected error to the control unit 104.

[0072] On the other hand, if it is determined in step S32 that the cache data to be checked has a dirty attribute and has lost redundancy (YES in step S32), the failure symptom monitoring unit 101 determines whether there is free space in the cache area of ​​the DIMM 11 of another controller 1 of another cluster CL (step S33). In Fig. 11 and the following Fig. 12, the cluster CL is represented as "CL" and the controller 1 is represented as "CTL".

[0073] If it is determined in step S33 that there is free space in the cache area (YES in step S33), the control unit 104 executes a first redundancy restoration process (step S34). The first redundancy restoration process will be described in detail later with reference to FIG. 13.

[0074] On the other hand, if it is determined in step S33 that there is no free space in the cache area (step S33: NO), the failure symptom monitoring unit 101 determines whether all the controllers 1 in the cluster CL to which the controller 1 belongs are blocked (step S35). If it is determined in step S35 that all the controllers 1 are not blocked, that is, that there is an operating controller 1 (step S35: NO), the control unit 104 executes a second redundancy recovery process (step S36). The second redundancy recovery process will be described in detail with reference to FIG. 14 below.

[0075] On the other hand, if it is determined in step S35 that all of the controllers 1 are blocked (YES in step S35), the control unit 104 executes a third redundancy recovery process (step S37). The third redundancy recovery process will be described in detail with reference to FIG. 15, which will be described later. After the first redundancy recovery process is executed in step S34, after the second redundancy recovery process is executed in step S36, or after the third redundancy recovery process is executed in step S37, the failure sign monitoring unit 101 reports error information to the control unit 104 (step S38). In other words, the failure sign monitoring unit 101 reports information about the detected error to the control unit 104. After the error information is reported in step S38, the data loss prevention process by the storage system 100 ends.

[0076] [Data loss prevention processing (emphasis on reliability)] Next, with reference to FIG. 12, a data loss prevention process when emphasis is placed on the reliability of redundancy recovery will be described. First, the failure symptom monitoring unit 101 of the CPU 10 of the controller 1 checks whether or not there is dirty data in all DIMMs 11 in the controller itself (step S41). Next, the failure symptom monitoring unit 101 checks whether or not the cache data being checked has a dirty attribute and has lost redundancy (step S42).

[0077] If it is determined in step S42 that the cache data to be checked is not data with a dirty attribute and no redundancy has been lost (NO in step S42), the process of step S17 in FIG. 10 is performed.

[0078] On the other hand, if it is determined in step S42 that the cache data to be checked is data with a dirty attribute and that has lost redundancy (YES in step S42), the failure symptom monitoring unit 101 determines whether all the controllers 1 in the cluster CL to which the controller 1 belongs are blocked (step S43).If it is determined in step S43 that all the controllers 1 are not blocked, that is, that there is an operating controller 1 (NO in step S43), the control unit 104 executes a second redundancy recovery process (step S44).

[0079] On the other hand, if it is determined in step S43 that all of the controllers 1 are blocked (YES in step S43), the control unit 104 executes a third redundancy recovery process (step S45). After the second redundancy recovery process is executed in step S44, or after the third redundancy recovery process is executed in step S45, the failure sign monitoring unit 101 reports error information to the control unit 104 (step S46). In other words, the failure sign monitoring unit 101 reports information about the detected error to the control unit 104. After the error information is reported in step S46, the data loss prevention process by the storage system 100 ends.

[0080] [First redundancy recovery process] Next, the first redundancy recovery process will be described with reference to FIG. 13. FIG. 13 is a flowchart showing an example of the procedure of the first redundancy recovery process. In the first redundancy recovery process, the control unit 104 moves the dirty data that has lost redundancy to the DIMM 11 of the controller 1 of another cluster CL (step S51). After the processing of step S51, the first redundancy recovery process by the control unit 104 ends. The first redundancy recovery process is a process that is executed with the highest priority in the data loss prevention process when speed is important, and the speed at which it takes to recover redundancy is faster than the other two redundancy recovery processes. Then, unless the controller 1 that is the cache data save destination is blocked during the execution of the redundancy recovery process, the redundancy of the cache data is recovered by executing the first recovery process.

[0081] [Second redundancy recovery process] Next, the second redundancy recovery process will be described with reference to FIG. 14. FIG. 14 is a flowchart showing an example of the procedure of the second redundancy recovery process. In the second redundancy recovery process, the control unit 104 destages dirty data that has lost redundancy to drive 2 (step S61). After the processing of step S61, the second redundancy recovery process by the control unit 104 ends. The second redundancy recovery process is a recovery process that is executed with the highest priority in data loss prevention processing when reliability is emphasized, and is a recovery process that is executed second in data loss prevention processing when speed and reliability are emphasized. The second redundancy recovery process, which destages cache data to drive 2, takes longer to execute than the other two redundancy recovery processes, but can reliably restore the redundancy of the cache data.

[0082] [Third redundancy recovery process] Next, the third redundancy restoration process will be described with reference to FIG. 15. FIG. 15 is a flowchart showing an example of the procedure of the third redundancy restoration process. In the third redundancy restoration process, the control unit 104 copies dirty data that has lost redundancy to the CFM 14 (see FIG. 1) of the controller 1 itself (step S71). After the process of step S71, the third redundancy restoration process by the control unit 104 ends. The third redundancy restoration process is the third restoration process executed in the data loss prevention process in the case where priority is given to speed and reliability. If the third restoration process is executed and both the controller 1 itself and the other controller 1 in the redundant configuration are blocked after the execution of the third restoration process, that is, if a system failure occurs, redundancy cannot be restored. However, if a system failure does not occur, redundancy can be restored using the cache data copied to the CFM 14. Note that in both the case where priority is given to speed and the case where priority is given to reliability of redundancy restoration, the order of the first redundancy restoration process to the third redundancy restoration process may be set to an order other than the order described above.

[0083] The controller 1 of the storage system 100 according to the embodiment described above includes a failure sign monitoring unit 101 that acquires information about the state of the DIMM 11 and, based on the acquired information, monitors and detects signs of an irreparable failure in the DIMM 11, and a control unit 104 that, when the failure sign monitoring unit 101 detects a sign of failure, copies or destages cache data that has lost redundancy to a specified backup destination. Therefore, according to this embodiment, it is possible to save cache data to a backup destination before a situation occurs in which multiple controllers 1 in the same cluster are blocked in succession, thereby preventing data loss.

[0084] Furthermore, in the above-described embodiment, even while the number of correctable errors occurring in the DIMM 11 does not exceed the threshold number of errors, the failure symptom monitoring unit 101 acquires correctable error information, temperature information of the DIMM 11, and supply voltage information. Therefore, even if an error does not recur when the controller 1 is investigated after being collected from the user, it is possible to identify the cause of a blockage or the like of the controller 1 based on the information collected by the failure symptom monitoring unit 101. Furthermore, based on this information collected by the failure symptom monitoring unit 101, it is possible to take preventive measures such as adjusting or repairing the part causing the abnormality in the temperature or supply voltage of the DIMM 11, or replacing the controller 1.

[0085] In the above-described embodiment, an example was given in which the memory module was configured with a DIMM, but the present invention is not limited to this. The memory module may be configured with a memory other than a DIMM, or may be configured with a non-volatile memory.

[0086] Furthermore, the above-described embodiment provides a detailed and specific description of the system configuration in order to clearly explain the present invention, and is not necessarily limited to a system having all of the configurations described.

[0087] 6, the control lines or information lines indicated by solid lines or arrows are those considered necessary for explanation, and do not necessarily show all control lines or information lines in the product. In reality, it can be considered that almost all components are interconnected.

[0088] Furthermore, in this specification, processing steps describing chronological processing include not only processing that is performed chronologically in the order described, but also processing that is not necessarily performed chronologically but is performed in parallel or individually (for example, parallel processing or processing by objects). [Explanation of symbols]

[0089] 1...controller, 2...drive, 10...CPU, 11...DIMM, 12...DC-DC converter, 13...environment MCU, 14...CFM, 100...storage system, 101...failure prediction monitoring unit, 102...management table, 103...directory table, 104...control unit, CL1...cluster, CL2...cluster

Claims

1. A storage system having a plurality of controllers each having a cache memory and configured to be redundant with each other, and a drive in which cache data of the cache memory is stored, The controller a failure sign monitoring unit that acquires information about the state of the cache memory and monitors and detects signs of an irreparable failure in the cache memory based on the acquired information; a control unit that, when the failure sign monitoring unit detects the failure sign, copies or moves the cache data that has lost redundancy to a predetermined save destination. Storage system.

2. The cache data that has lost redundancy is the cache data that is not duplicated because another controller that is configured as redundant for the controller is in an inoperable state. The storage system according to claim 1 .

3. The failure sign monitoring unit acquires information on a pattern of occurrence of correctable errors in the cache memory as information on the state of the cache memory, and detects the failure sign when the occurrence pattern satisfies a predefined condition. The storage system according to claim 2 .

4. The occurrence pattern is a pattern indicated by the number of occurrences of the correctable errors per unit time, or a bit pattern of the correctable errors. The storage system according to claim 3 .

5. The failure sign monitoring unit acquires information about the temperature of the cache memory as information about the state of the cache memory, and detects the failure sign if the temperature exceeds a predetermined threshold range. The storage system according to claim 3 .

6. The failure sign monitoring unit acquires information about a voltage supplied to the cache memory as information about the state of the cache memory, and detects the failure sign if the supply voltage exceeds a predetermined threshold range. The storage system according to claim 3 .

7. The predetermined save destination for the cache data that has lost redundancy is a cache data save memory in the own controller, the cache memory of another controller in a second cluster that is configured redundantly with respect to a first cluster that includes the own controller and another controller that is configured redundantly with respect to the own controller, or the drive.

7. The storage system according to claim 5.

8. When the speed of restoring the redundancy of the cache data is important, the control unit preferentially selects a first redundancy restoration process, which is a process of replicating the cache data that has lost redundancy in the cache memory of the other controller of the second cluster. The storage system according to claim 7.

9. When the reliability of the redundancy of the cache data is important, the control unit preferentially selects a second redundancy restoration process, which is a process of moving the cache data that has lost redundancy to the drive. The storage system according to claim 7.

10. A control method for a storage system having a plurality of controllers each having a cache memory and configured to be redundant with each other, and a drive in which cache data of the cache memory is stored, comprising: a step in which the controller acquires information about the state of the cache memory, and monitors and detects a sign of an irreparable failure in the cache memory based on the acquired information; and a procedure of copying or moving the cache data that has lost redundancy to a predetermined save destination when the sign of the failure is detected. A method for controlling a storage system.

Images