Storage Systems

Abstract

To reduce power consumption of a storage system.SOLUTION: A plurality of storage controllers shift from a normal operation mode to a degenerated operation mode in accordance with a command from a management device. In the normal operation mode, each storage controller works in a normal operation state. In the change from the normal operation mode to the degenerated operation mode in accordance with the command from the management device, a storage controller designated by the management device in the plurality of storage controllers changes from the normal operation state to a standby state. The other storage controllers other than the designated storage controller change from the normal operation state to a degenerated operation state. The storage controller in the standby state starts and changes to the degenerated operation state in response to the stop of a storage controller in the degenerated operation state due to a failure in the degenerated operation mode.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a storage system. [Background technology]

[0002] Reducing power consumption in storage systems is one of the technical challenges. There is a particularly strong demand for solutions to this problem in enterprise storage systems, which consist of controllers equipped with CPUs and drive boxes equipped with storage drives. Availability is a key factor in such storage systems, so they are equipped with multiple controllers capable of delivering higher performance than the actual application load, providing high redundancy.

[0003] Background art of the present disclosure is U.S. Patent Application Publication No. 2012 / 0137172, which discloses that in a dual-controller storage system, when reliability requirements are low, some components within the storage system are stopped in order to reduce power consumption at the expense of lower reliability. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] U.S. Patent Application Publication No. 2012 / 0137172 Summary of the Invention [Problem to be solved by the invention]

[0005] In a storage system equipped with multiple storage controllers, a technology is desired that can reduce power consumption while maintaining availability. [Means for solving the problem]

[0006] One aspect of the present invention is a storage system including a plurality of storage controllers, the plurality of storage controllers changing from a normal operation mode to a degraded operation mode in response to an instruction from a management device, and each storage controller of the plurality of storage controllers transitioning between a plurality of states, the plurality of states including a normal operation state in which data input / output is performed between one or more host devices and one or more storage drives in the normal operation mode, a degraded operation state in which data input / output is performed between the one or more host devices and one or more storage drives in the degraded operation mode, and a stopped state, and in the normal operation mode, each storage controller of the plurality of storage controllers operates in the normal operation state, and in a change from the normal operation mode to the degraded operation mode in response to an instruction from the management device, a storage controller of the plurality of storage controllers designated by the management device transitions from the normal operation state to the stopped state, and storage controllers other than the designated storage controller transition from the normal operation state to the degraded operation state, and in the degraded operation mode, a storage controller in the degraded operation state stops due to a failure, and the stopped storage controller starts up and transitions to the degraded operation state. [Effects of the Invention]

[0007] According to one aspect of the present invention, in a storage system equipped with multiple storage controllers, it is possible to reduce power consumption while ensuring availability. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating a configuration of an information system according to an embodiment of the present specification. [Figure 2] 1 shows an example of the configuration of a storage system including multiple modules. [Figure 3] 3 illustrates other components of the storage system shown in FIG. 2. [Figure 4] 10A and 10B show schematic diagrams of a degenerate operating mode of one module. [Figure 5] 1 shows the paths through the module between the host device and the drive box in different degraded operating modes. [Figure 6] An example will be shown in which a module changes one controller from a normal operating state to a stopped state in response to an instruction from a management device. [Figure 7] 1 shows programs stored in the management device. [Figure 8] The programs stored in each controller are shown below. [Figure 9] 1 shows the state transition of a module managed by a management device. [Figure 10] 10 shows a flowchart of an example of processing by a degenerate operation transition control program of the management device. [Figure 11] 10 shows a flowchart of an example of processing by a degeneration operation release control program of the management device. [Figure 12] 10 shows a flowchart of an example of processing by a duplication recovery control program of the management device. [Figure 13] 10 shows the state transition of the controller in the module state transition described with reference to FIG. 9. [Figure 14A] 10 shows an example of a combination of controller states when a module is in a degeneration preparation state. [Figure 14B] 10 shows an example of a combination of controller states when a module is in a degeneration preparation state. [Figure 15] 10 is a flowchart showing an example of processing by a degeneration preparation control program A of the controller. [Figure 16] 10 is a flowchart showing an example of processing by a degeneration preparation control program B of the controller. [Figure 17] 10 is a flowchart illustrating an example of processing by a degeneration transition control program of a controller. [Figure 18] 10 is a flowchart illustrating an example of processing by a degeneration completion confirmation program of a controller. [Figure 19] 10 is a flowchart illustrating an example of processing of an emergency startup control program of the controller. [Figure 20]10 is a flowchart illustrating an example of processing of a normal startup control program of the controller. [Figure 21] 10 is a flowchart illustrating an example of processing by a degeneration cancellation control program of the controller; DETAILED DESCRIPTION OF THE INVENTION

[0009] The following describes embodiments with reference to the drawings. Note that the embodiments are merely examples for realizing the present invention and do not limit the technical scope of the present invention. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0010] In the following explanation, various types of information may be described using the expression "xxx table," but the various types of information may be expressed using data structures other than tables. To indicate that it is not dependent on the data structure, the "xxx table" may be referred to as "xxx information." Also, in the following explanation, numbers are used as identification information for elements, but other types of identification information (for example, names, identifiers) may be used.

[0011] In addition, in the following description, when describing elements of the same type without distinguishing between them, common reference symbols (or reference signs) may be used, and when describing elements of the same type with distinction between them, reference symbols (or element IDs) may be used.

[0012] The program is executed by a processor (e.g., a CPU (Central Processing Unit)) included in the storage controller to perform the specified processing using storage resources (e.g., main memory) and / or a communication interface device as appropriate, so the subject of the processing may be the storage controller or the processor. The storage controller may also include hardware circuits that perform some or all of the processing. The computer program may be installed from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium.

[0013] 1 is a diagram showing the configuration of an information system according to an embodiment of the present specification. The information system includes a storage system, a host device 10, a management device 31, and a management terminal 32. The storage system includes a module 20 and a drive box 40. The module 20 includes multiple nodes 21, and in the example configuration shown in FIG. 1, one module 20 includes two nodes 21.

[0014] Each node 21 includes multiple controllers (also called storage controllers) 210, and in the configuration example shown in Fig. 1, the number of controllers 210 included in one node 21 is two. In Fig. 1, one node is indicated by the reference numeral 21 as an example, and one controller is indicated by the reference numeral 210 as an example.

[0015] Each node 21 further includes one or more power supply units (PSUs) 220 and one or more cooling fans 230. The PSUs and cooling fans are shuttable components shared by the controller within the node. FIG. 1 shows two PSUs 220 and one fan 230 as an example. Two PSUs 220 and one fan 230 2 0 has a redundant configuration, and each PSU2 2 1, one PSU is shown as an example with reference numeral 2. 2 0. The components of each node 21 are contained in, for example, one frame.

[0016] The controller 210 executes input / output processing of host data between the host device 10 and the drive box 40 in response to a data input / output command from the host device 10. It includes a CPU 211 which is a processor, a memory (main memory) 212, a host interface (I / F) 213, a management interface 214, an internal communication interface 215, and a drive interface 216. The number of various elements constituting the controller 210 may be one or more.

[0017] The CPU 211 controls the entire controller 210 and operates based on a program stored in the memory 212. The memory 212 is configured, for example, by a semiconductor memory such as a Synchronous Dynamic Random Access Memory (SDRAM). The memory may be configured by combining a volatile memory with a non-volatile memory such as a Storage Class Memory (SCM).

[0018] The host interface 213 is controlled by the CPU 211, and performs transmission and reception of I / O requests and I / O data with the host device 10 via the storage area network (SAN) 11. The host interface 213 may include multiple ports and communicate with multiple host devices via the multiple ports.

[0019] The management interface 214 is controlled by the CPU 211, and receives control commands from the management device 31 via the management network (NW) 34, and transmits responses to the control commands. A user 33 operates the management device 31 via a management terminal 32. The management terminal 32 and the management device 31 may have a computer configuration including, for example, a processor, memory, a communication interface, and an input / output device. The internal communication interface 215 is controlled by the CPU 211, and performs data communication with other controllers 210 via an internal communication switch (SW) 23.

[0020] The drive interface 216 is controlled by the CPU 211, and performs operations such as sending and receiving I / O data to and from drives (also called storage drives) 41 in the drive box 40. The drive box 40 has multiple drives (storage drives) 41, such as SSDs and HDDs, mounted within a frame, and includes an internal switch, as well as a processor and memory used for transfer processing, to connect the multiple drives 41 to the controller 210. The drives 41 receive, store, and hold host data from the host device 10 via the controller 210.

[0021] To ensure the availability of the data stored in the drive box 40, a RAID may be formed between the built-in drives 41, or a RAID may be formed between multiple drive boxes 40. One drive 41 may belong to one or multiple parity groups. Although one drive box 40 is shown in FIG. 1, each controller 210 may be able to communicate with multiple drive boxes. The drives 41 may be configured as an AFA (All Flash Array) equipped with nonvolatile semiconductor memory, and all or part of them may be replaced with hard disk drives (HDDs).

[0022] 1 shows an example of the configuration of a storage system, and the number of nodes in a module and the number of controllers in a node can be set by design. Also, all controllers in the storage system do not need to be managed separately by nodes or modules.

[0023] FIG. 2 shows an example of the configuration of a storage system including a plurality of modules 20. The configuration of each module 20 is as described with reference to FIG. 1. In FIG. 2, for ease of explanation, some of the components shown in FIG. 1 are omitted. In the example configuration of FIG. 2, the storage system includes two modules 20, and each module 20 includes two nodes. All of the controllers 210 can communicate with each other via the internal communication interface 215 and the internal communication switch 23. In addition, the management device 31 can communicate with all of the controllers 210 via the management network 34.

[0024] 3 shows other components of the storage system shown in FIG. 2. The host device 10 can communicate with all of the controllers 210 via the storage area network 11. The two modules 20 are each connected to a different drive box 40. In one embodiment of this specification, each drive box 40 is connected to only one module 20 and is accessed from only the corresponding module 20. Each module 20 may be connected to multiple drive boxes 40. One module 20 and one or more drive boxes 40 connected to it form a unit for expanding or reducing the storage system.

[0025] The following describes power saving processing in a storage system according to an embodiment of this specification. Because availability is important in storage systems, more controllers than required by the I / O load requirements of applications may be installed. In one embodiment of this specification, rather than running all controllers at all times, some controllers are set to a standby state and activated when a failure occurs, thereby enabling power consumption reduction. A controller may have one or more standby states, such as stopping the supply of power to the controller or maintaining only some functions while power is supplied. Each standby state stops data input / output between the host device and the drive box (drive), and consumes less power than a state in which data input / output is performed. In the example described below, the standby state stops the supply of power to the controller.

[0026] 4 is a schematic diagram illustrating the degraded operation mode of one module 20. In one embodiment of this specification, the degraded operation mode is determined on a module-by-module basis. In the example described here, only one module is accessible to each drive box 40. By controlling the degraded operation mode for each module 20, host access can be maintained appropriately.

[0027] FIG. 4 shows a normal operation mode 201A in which all controllers are performing input and output of host data, a first degenerate operation mode 202A in which some controllers are on standby while others are performing input and output, and a second degenerate operation mode 202B in which some controllers are on standby while others are performing input and output.

[0028] As described above, the module 20 includes two nodes, node 21A and node 21B. Node 21A and node 21B each include two controllers 210A and 210B, two PSUs 220, and one fan 230. The number of controllers included in one node is two.

[0029] In normal operation mode 201A (2N4C mode), all four controllers in module 20 are performing input / output. 0 And the fan 230 is operating.

[0030] In the first degenerate operation mode 202A (2N2C mode), one controller 210A in one node 21A performs input / output, while the other controller 210B is stopped (an example of a standby state). Furthermore, one controller 210A in another node 21B performs input / output, while the other controller 210B is stopped. All PSUs 22 0 The fan 230 is in operation. The first degenerate operating mode 202A has higher fault tolerance than the second degenerate operating mode 202B in terms of redundancy.

[0031] In the second degenerate operation mode 202B (1N2C mode), one node 21A performs input / output. That is, in the node 21A, all controllers 210A and 210B perform input / output, and further, all PSUs 22 0 The fan 230 is operating. On the other hand, the node 21B is stopped. That is, in the node 21B, all the controllers 210A and 210B are stopped, and further, all the PSUs 22 0The fan 230 is stopped. The second degenerate operating mode 202B is superior to the first degenerate operating mode 202A in terms of power consumption.

[0032] The module 20 transitions from the normal operation mode 201A to a first degenerate operation mode 202A or a second degenerate operation mode 202B in accordance with a blocking instruction from a user 33 via a management device 31. The user can specify or pre-set the degenerate operation mode to transition to from among multiple degenerate operation modes. As described above, the first degenerate operation mode 202A is superior in terms of availability but inferior in terms of power consumption compared to the second degenerate operation mode 202B. When availability is more important than power reduction effects, the first degenerate operation mode 202A is selected by a user instruction.

[0033] FIG. 5 shows paths between the host device 10 and the drive box 40 via the module 20 in different degenerate operating modes. The controller 210 communicates with the host device 10 via a host path and with the drive or drive box via a drive path. The host path and the drive path are logical communication paths. In the example shown in FIG. 5, the host device 10 accesses logical units 101A, 101B, and 101C to write and read host data.

[0034] The data of the logical unit 101A is physically stored in the drive box 40A. Only the module 20A controls the IO from the host device 10 to the drive box 40A. The module 20A is in a first degenerate operation mode 202A, and each of the different node Therefore, the host device 10 can access the logical unit 101A.

[0035] The data of the logical unit 101B is physically stored in the drive box 40B. Only the module 20B controls the IO from the host device 10 to the drive box 40B. The module 20B is in the second degenerate operation mode 202B and has a common nodeTherefore, the host device 10 can access the logical unit 101B.

[0036] The data of logical unit 101C is physically stored in drive box 40C. Only module 20C controls the I / O from host device 10 to drive box 40C. Module 20C is in another degenerate operation mode 202C, with three controllers operating. Therefore, the host device 10 can access logical unit 101C.

[0037] As explained with reference to Figure 5, in the degenerate operation mode of the module, at least one controller is operating. This ensures a path between the host device 10 and the drive box that physically stores the volume data. In this way, in the degenerate operation mode, there is a host path between the module and all host devices that access the drive box via the module in the normal operation mode (combination of active controllers). Similarly, there is a drive path between the module and the drive box (all drives).

[0038] Fig. 6 shows an example in which the module 20 changes one controller from a normal operating state to a stopped state in response to an instruction from the management device 31. In the example of Fig. 6, the controller 210A of the node 21A changes from a normal operating state to a stopped state. Fig. 6 shows a blocking instruction from the management device 31 to one controller 210, but an instruction to transition to degenerate mode is sent to all controllers 210 that are in operation.

[0039] Module 2 0 is, the state changes from state 204 to state 205. In state 204, one controller 210B of node 21B is stopped, and all other controllers are operating normally. It is assumed that controller 210B of node 21B has just changed to a stopped state. In state 205 after the change, controller 210A of node 21A is stopped, and controller 210B of node 21B is stopped. The other two controllers are operating normally.

[0040] The memory 212 of each controller 210 includes a control information area 510 and a cache area 520. The control information area 510 is an area for storing control information that the controller 210 references in order to perform processing. The cache area 520 is an area for temporarily storing host data (user data) from the host device 10, and the cache data includes write data and may also include read data.

[0041] The cache data stored in the cache area 520 includes dirty data (dirty cache) 521 and clean data 522. The dirty data 521 is newer data than the data at the same address in the drive box 40, and is data that should be updated at the same address in the drive box 40. The clean data 522 is the same data as the data at the same address in the drive box 40.

[0042] A logical volume in a storage system can be exclusively accessed and controlled only by a controller (a controller in charge) that has been assigned volume control rights. A logical volume is a logical device in a storage system that stores host data or data used within the storage system. In state 204 of Figure 6, controller 210A of node 21A has volume control rights for logical volume 25.

[0043] The control information 511 is held by one controller within a node, and the other controller always refers to the control information 511 held by another controller within the same node, or holds and refers to cache data of that control information 511. Note that all controllers may hold and manage common control information.

[0044] 6, the controller 210A in node 21A holds control information 511. The other controller 210B references the control information 511 of the controller 210A, or holds and references its cache data. Note that before the controller 210B of node 21B stopped, the controller 210B of node 21B was referencing the control information 511 of the controller 210A in node 21B, or was holding and referencing its cache data.

[0045] The control information 511 is made redundant between different nodes 21 in the same module 20 (represented by dashed lines in FIG. 6). That is, the controllers 210 of different nodes each hold common control information 511. Updates to the control information 511 in one controller 210 are reflected in the control information 511 of the other controller 210. In state 204 in FIG. 6, the controller 210A of node 21A and the controller of node 21B store common control information 511.

[0046] The dirty data 521 in the cache area 520 is made redundant between different nodes 21 in the same module 20 (represented by dashed lines in FIG. 6). That is, the controllers 210 of different nodes each hold common dirty data 521. Updates to the dirty data 521 in one controller 210 are reflected in the dirty data 521 in the other controller 210. In state 204 in FIG. 6, the controller 210A of node 21A and the controller of node 21B store common dirty data 521. Note that the dirty data does not have to be duplicated.

[0047] The controller 210A of the node 21A stops in response to a blocking instruction from the management device 31. Before stopping, this controller 210A passes control information 511 and logical volume control right to the other controller 210B of the same node 21A. The controller 210A of the node 21A destages the dirty data 521 to the logical volume 25 or passes it to the controller 210B of the node 21A. In order to store the data from the controller 210A in the memory 212, the controller 210B of the node 21A deletes at least a portion of the clean data 522 to create free space, if necessary.

[0048] After the above-mentioned necessary data migration from controller 210A of node 21A to controller 210B is complete, controller 210A of node 21A stops. Controller 210B of node 21A and controller 210A of node 21B now have a relationship similar to that between the two controllers 210A of nodes 21A and 21B. In other words, control information 511 and dirty data 521 are shared between the two controllers. Furthermore, controller 210B of node 21A has volume control authority 530 for logical volume 25 and can access logical volume 25.

[0049] The state 205 resulting from the above processing is the state of the first degenerate operation mode 202A (2N2C mode). In state 205, the dirty data 521 and control information 511 are shared between the two operating controllers, thereby improving fault tolerance. Also, access to the logical volume 25 is maintained. Note that the above two pieces of information do not necessarily have to be shared.

[0050] Next, a method for stopping the controller 210B of node 21A in place of the controller 210A of node 21A from the state 204 shown in Fig. 6 will be described. Unlike the controller 210A of the same node, the controller 210B does not hold the original control information 511 to be managed. Therefore, there is no need to move the control information 511.

[0051] The volume control right 530 held by the controller 210B is moved to the controller 210A of the same node 21A. The dirty data 521 of the controller 210B is moved to the controller 210A of the same node 21A, or destaged to the corresponding logical volume 25. In this way, by stopping the controller that does not store the control information 511 to be managed, it becomes unnecessary to move the control information 511. Furthermore, it becomes unnecessary to switch the relationship with the controller 210A of the other node 21B.

[0052] To transition from the normal operation mode in which all four controllers are operating to the first degenerate operation mode 202A (2N2C mode), for example, the controller 210B that does not manage the control information 511 may be selected from each of the nodes 21A and 21B and stopped. This makes it possible to reduce additional processing for moving the control information 511 and synchronizing the control information 511 and dirty data 521.

[0053] A transition from the normal operation mode, in which all four controllers are operating, to the second degenerate operation mode 202B (1N2C mode) blocks one of the nodes. For example, in FIG. 6, it is assumed that node 21B is blocked. The volume control 530 of the controller 210A of node 21B is moved to the controller 210A of node 21A, for example. The dirty data 521 of the controller 210A of node 21B is destaged to the logical volume 25 or moved to the controller 210A of node 21A. The volume control 530 and the dirty data 521 may each be moved to either controller of node 21A.

[0054] The volume control 530 of the controller 210B of the node 21B is moved, for example, to the controller 210B of the node 21A. The dirty data 521 of the controller 210B of the node 21B is destaged to the logical volume 25 or moved to the controller 210B of the node 21A. The volume control 530 and the dirty data 521 may each be moved to either controller of the node 21A.

[0055] By the above process, the node 21A that continues to operate maintains the volume control right 530 and also maintains the sharing of the control information 511. The management device 31 transmits a blocking instruction to each of the controllers to be blocked, and the controllers that receive the instruction each execute the blocking process (stop process) as described above.

[0056] 7 shows programs stored in the management device 31. A memory 310 of the management device 31 stores, in a program area 311, a degenerate operation transition control program 313, a degenerate operation release control program 315, and a duplex recovery control program 317. The processing of these programs will be described in detail later.

[0057] 8 shows the programs stored in each controller 210. The memory 212 of the controller 210 stores in a program area 250 a degeneration preparation control program A 251, a degeneration preparation control program B 252, a degeneration transition control program 253, a degeneration completion confirmation program 254, an emergency startup control program 255, a normal startup control program 256, and a degeneration cancellation control program 257. The processing of these programs will be described in detail later.

[0058] FIG. 9 shows the state transition of the module 20 managed by the management device 31. The normal operation state ST11 is a state in which the module 20 is operating in normal operation mode. At this time, all controllers are running. The management device 31 instructs the module 20 to transition from the normal operation mode to a specific degenerate operation mode. If the module 20 cannot transition to the degenerate operation mode, the module state transitions from the normal operation state ST11 to a degeneration failure state ST18.

[0059] When the module 20 can transition to the degenerate operation mode, the module state changes from a normal operation state ST11 to a degenerate preparation state ST12, and then to a degenerate operation state ST14 via a degenerate setting state ST13. In the degenerate operation state ST14, the module 20 operates in the specified degenerate operation mode.

[0060] If a failure occurs in one of the operating controllers 210 in the degenerate operation state ST14, the module state changes to the duplication recovery state ST15. In this state, duplication recovery processing is executed. That is, one of the stopped controllers 210 is started up and shares the control information 511 and dirty cache with the other operating controller 210. When duplication is restored, the module state returns from the duplication recovery state ST15 to the degenerate operation state ST14.

[0061] When the management device 31 issues an instruction to cancel degeneration to the module 20 in the degenerate operation state ST14, the module state transitions from the degenerate operation state ST14 to the degenerate release state ST16. Thereafter, the module state transitions from the degenerate release state ST16 to the normal operation state ST11 via the post-degeneration cleanup state ST17.

[0062] The following describes the processing of the management device 31 during the module state transition shown in Fig. 9. As described above, the management device 31 executes the degenerate operation transition control program 313, the degenerate operation release control program 315, and the duplex recovery control program 317.

[0063] 10 is a flowchart showing an example of processing by the degenerate operation transition control program 313 of the management device 31. The degenerate operation transition control program 313 controls and manages the transition of the module 20 from the normal operation state ST11 to the degenerate operation state ST14 in accordance with settings made by the user.

[0064] First, in response to a degeneration transition instruction accompanied by a specification of a degenerate operation mode from the user 33, the degenerate operation transition control program 313 determines whether the target module 20 is capable of degenerate operation (S301). For example, if communication with the module is impossible or if a response indicating degeneration failure is received from any controller, it is determined that degeneration is impossible. If degeneration is not possible (S301: NO), the degenerate operation transition control program 313 transitions the module state from the normal operation state ST11 to the degeneration failure state ST18 in the management information it holds (S311).

[0065] If degeneration is possible (S301: YES), the degenerate operation transition control program 313 determines the controllers 210 to be stopped in the degenerate operation mode (S302). The degenerate operation transition control program 313 holds information on the degenerate operation mode specified by the user. As described with reference to Figures 4 to 6, a combination of controllers 210 that maintain an operating state is defined for each degenerate operation mode.

[0066] Next, the degeneration operation transition control program 313 issues a degeneration preparation command to all operating controllers 210 of the module 20 (S303), and transitions the module state in the management information to the degeneration preparation state ST12 (S304). In preparation for degeneration, the controllers 210 that continue to operate (do not stop) create free space in their memory to store data, including control information 511, that is to be moved from the controller 210 that is to stop.

[0067] In preparation for degeneration, the controller 210 that is stopped destages dirty data to a drive box or moves it to a controller 210 that continues to operate. For example, dirty data may be destaged if the destination does not have free space to store it, and moved to the destination if free space can be secured. In one example, in preparation for degeneration, the control information 511 is not moved. Details of the processing of the controller 210 in module state transitions will be described later.

[0068] The degeneration operation transition control program 313 determines whether all of the operating controllers 210 have transitioned from the degeneration preparation state to the degeneration standby state based on the state transition notification from the controllers 210 in response to the degeneration preparation command (S305). If one or more controllers 210 cannot transition to the degeneration standby state (S305: NO and S306: YES), the program transitions the module state to the degeneration failure state ST18 (S311).

[0069] If all operating controllers 210 transition to a degenerate standby state (S305: YES), the degenerate operation transition control program 313 issues a degenerate transition command to all operating controllers 210 (S307), and transitions the module state in the management information to a degenerate setting state ST13 (S308).

[0070] Next, the degenerate operation transition control program 313 determines whether the controller to be stopped has stopped and all other operating controllers are in a degenerate operation state based on state transition notifications from all operating controllers (S309). If all operating controllers are in a degenerate operation state (S309: YES), the module state in the management information is transitioned to a degenerate operation state ST14 (S310). The degenerate operation transition control program 313 may present the change in module state to the user 33 on a display device.

[0071] 11 is a flowchart showing an example of processing by the degenerate operation release control program 315 of the management device 31. The degenerate operation release control program 315 controls and manages the release of the degenerate operation of the module 20 in response to a degenerate release instruction from a user. In other words, the degenerate operation release control program 315 controls and manages the transition from the degenerate operation state ST14 to the normal operation state ST11.

[0072] The degenerate operation release control program 315 determines whether all active controllers are in a degenerate operation state (S401). The degenerate operation release control program 315 may acquire state information from the active controller 210, or may refer to the immediately preceding controller state information stored in the management information.

[0073] Next, the degenerate operation release control program 315 issues a start-up command to the stopped controller 210 (S402). Next, the degenerate operation release control program 315 transitions the module state of the management information it holds from the degenerate operation state ST14 to the degenerate release state ST16.

[0074] Next, the degenerate operation release control program 315 determines whether all controllers are operating (S404). The degenerate operation release control program 315 waits for all controllers 210 that issued the startup command to start up (S404: NO). If all controllers 210 are operating (S404: YES), the degenerate operation release control program 315 issues a post-degenerate cleanup command to all operating controllers 210 (S405).

[0075] Next, the degeneration operation release control program 315 transitions the module state in the management information from the degeneration release state ST16 to the post-degeneration cleanup state ST17 (S406). Next, the degeneration operation release control program 315 determines whether all operating controllers 210 are in the normal operation state based on notifications of state transitions from all operating controllers 210 (S407). The degeneration operation release control program 315 waits for all operating controllers 210 to change to the normal operation state (S407: NO). If all operating controllers 210 are in the normal operation state (S407: YES), the degeneration operation release control program 315 transitions the module state in the management information it holds from the post-degeneration cleanup state ST17 to the normal operation state ST11.

[0076] 12 is a flowchart showing an example of processing by the duplication recovery control program 317 of the management device 31. The duplication recovery control program 317 controls and manages the transition between the degenerate operation state ST14 and the duplication recovery state ST15. If a failure occurs in the active controller 210 during degenerate operation, the stopped controller 210 is started up and takes over from the failed controller 210, thereby restoring duplication.

[0077] When a failure occurs in the module 20 in the degenerate operating state ST14, the duplex recovery control program 317 selects the controller 210 to be started (S1201).

[0078] The selection of the controller to be started is performed, for example, as follows: If a failure occurs in one operating controller 210 in the first degenerate operation mode 202A (2N2C mode), the stopped controller 210 in the node 21 of the failed controller 210 is selected (2N2C mode). If the selected stopped controller 210 cannot restore redundancy, a stopped controller 210 in a node 21 different from the node 21 of the failed controller 210 is further selected (1N2C mode).

[0079] In the second degenerate operation mode 202B (1N2C mode), if a failure occurs in one controller 210, one of the stopped controllers 210 in a node 21 different from the node 21 of the failed controller 210 is selected (2N2C mode). If the selected stopped controller 210 cannot restore redundancy, another stopped controller 210 in a node 21 different from the node 21 of the failed controller 210 is further selected (2N2C mode).

[0080] Next, the duplication recovery control program 317 issues a startup command to the startup target controller (S1202). Next, the duplication recovery control program 317 transitions the module state from the degenerate operation state ST14 to the duplication recovery state ST15 in the management information held therein.

[0081] Next, the duplex recovery control program 317 determines whether the target controller is in a degraded operating state based on a state transition notification from the target controller (S1204). The duplex recovery control program 317 waits for the target controller to transition to a degraded operating state (S1204: NO). If the target controller is in a degraded operating state (S1204: YES), the duplex recovery control program 317 transitions the module state in the held management information from duplex recovery state ST15 to degraded operating state ST14 (S1205).

[0082] In the following, Module 20 13 shows the state transition of the controller 210 in the module state transition described with reference to FIG.

[0083] When the module state is the normal operation state ST11, the controller state is the normal operation state ST21. When the module state is the degeneration failure state ST18, the state of one of the controllers is the degeneration failure state ST29.

[0084] In the transition of the module state from the normal operation state ST11 to the degenerate operation state ST14, the state of the controller 210 that is stopped changes in the order of the normal operation state ST21, the degenerate preparation state ST22, the degenerate standby state ST23, and the stopped state ST25. The state of the controller 210 that remains in operation changes in the order of the normal operation state ST21, the degenerate preparation state ST22, the degenerate standby state ST23, and the degenerate operation state ST24.

[0085] In the transition of the module state between the degenerate operation state ST14 and the duplex recovery state ST15, the controller state of the controller 210 that has been instructed to start transitions from the stop state ST25 to the degenerate operation state ST24.

[0086] When the module 20 transitions from the degenerate operation state ST14 to the normal operation state ST11 in response to an instruction from the management device 31, the controller 210 that was running transitions from the degenerate operation state ST24 to the normal operation state ST21 via the post-degenerate cleanup state ST28. On the other hand, the stopped controller 210 transitions from the stopped state ST25 to the normal operation state ST21 via the degenerate release wait state ST27 and the post-degenerate cleanup state ST28.

[0087] 14A and 14B show an example of a combination of controller states when module 20 is in a degeneration preparation state ST12. In the state of Fig. 14A, one controller of node 21A is in a degeneration preparation state ST22, and the other controller is in a normal operation state ST21. One controller of node 21B is in a normal operation state ST21, and the other controller is in a degeneration standby state ST23.

[0088] 14B, one controller of node 21A is in a normal operation state ST21, and the other controller is in a degeneration preparation state ST22. One controller of node 21B is in a degeneration standby state ST23, and the other controller is in a normal operation state ST21.

[0089] The processing operation of each controller 210 will be described below with reference to a flowchart. The controller 210 internally manages the status of its own device, and notifies the management device 31 of its current status either in response to a request from the management device 31 or spontaneously.

[0090] 15 is a flowchart showing an example of processing by the degeneration preparation control program A251 of the controller 210. The degeneration preparation control program A251 is a program executed by the controller 210 that is stopped in a degeneration operation state. The degeneration preparation control program A251 transitions the controller 210 from the normal operation state ST21 to a degeneration failure state ST29 or a degeneration preparation state ST22.

[0091] First, the degeneration preparation control program A251 determines whether the controller 210 in question can transition to a degenerate operating state based on a preset failure condition (S501). An example of a failure condition that determines that the transition is impossible is when the controller 210 has a failure in communication with another controller 210. If transition to a degenerate operating state is impossible (S501: NO), the degeneration preparation control program A251 transitions the state of the controller 210 in question to a degeneration failure state (S507). The state transition is notified to the management device 31.

[0092] If none of the failure conditions are met and transition to the degenerate operating state is possible (S501: YES), the degeneration preparation control program A251 transitions the controller state to the degeneration preparation state (S502). The state transition is notified to the management device 31.

[0093] Next, the degeneration preparation control program A251 determines the transfer destination of the logical volume control right held by its own controller 210 (S503). The degeneration preparation control program A251 acquires information about controllers 210 that will continue to operate from the management device 31 or other controllers 210, and selects from among them the transfer destination of the logical volume control right. The selection method is arbitrary, and may be, for example, in accordance with a user specification via the management device 31, or may be selected so as to level the load on the controllers 210.

[0094] Next, the degeneration preparation control program A251 transfers the logical volume control right to the determined migration destination controller 210 (S504). Specifically, by updating the control information 511, the controller 210 that holds the control right is updated.

[0095] Next, the degeneration preparation control program A251 saves the dirty cache (S505). Data is saved by destaging the dirty cache to the drive box 40 or copying it to another controller 210 that continues to operate. Destaging only applies to data in logical volumes that the controller 210 in question has control over. Other data is destaged by the other controller 210 of the duplicated pair. Next, the degeneration preparation control program A251 transitions the controller state to a degeneration standby state (S506). The state transition is notified to the management device 31.

[0096] 16 is a flowchart showing an example of processing by the degeneration preparation control program B252 of the controller 210. The degeneration preparation control program B252 is a program executed by the controller 210, which continues to operate in a degenerate operating state. The degeneration preparation control program B252 transitions the controller 210 from the normal operating state ST21 to a degeneration failure state ST29 or a degeneration preparation state ST22.

[0097] First, the degeneration preparation control program B252 determines whether the controller 210 in question can transition to a degenerate operating state based on a preset failure condition (S601). This step is the same as step S501 in FIG. 15. If transition to a degenerate operating state is not possible (S601: NO), the degeneration preparation control program B252 transitions the state of the controller 210 in question to a degeneration failure state (S608). The state transition is notified to the management device 31. If transition to a degenerate operating state is possible (S601: YES), the degeneration preparation control program B252 transitions the controller state to a degeneration preparation state (S602). The state transition is notified to the management device 31.

[0098] Next, the degeneration preparation control program B252 saves the dirty cache (S603). When the corresponding controller 210 that holds the other of the duplicated dirty caches stops and the dirty cache is to be destaged, the degeneration preparation control program B252 destages the data of the logical volume for which the corresponding controller 210 holds control to the drive box 40. The degeneration preparation control program B252 also receives the necessary copy of the dirty cache from the controller 210 that is to stop.

[0099] Next, the degeneration preparation control program B252 determines whether its own controller 210 is the destination to which the control information 511 will be transferred from the controller 210 to be stopped (S604). The destination to which the control information 511 will be transferred is set in advance in each controller 210 or the management device 31 for the combination of the controller 210 to be stopped and the controller 210 to be kept operational. If set in the management device 31, the management device 31 indicates the destination.

[0100] If the local controller 210 is not the destination of the control information 511 (S604: NO), this flow ends. If the local controller 210 is the destination of the control information 511 (S604: YES), the degeneration preparation control program B252 calculates the memory area required to store the received control information 511, and calculates the amount of clean cache to abandon in order to secure the insufficient memory area (S605).

[0101] In addition to the control information 511, the clean cache may be discarded in order to evacuate the dirty cache of another controller 210, and the clean cache is discarded to secure the memory space required for the control information 511, assuming that dirty cache is stored.

[0102] The degeneration preparation control program B252 discards (discards) the required amount of clean cache to secure the required free space (S606). Next, the degeneration preparation control program B252 transitions the controller state to the degeneration standby state ST23 (S607). The state transition is notified to the management device 31.

[0103] 17 is a flowchart showing an example of processing by the degeneration transition control program 253 of the controller 210. The degeneration transition control program 253 is executed by the controller 210 to be stopped. The degeneration transition control program 253 transitions the controller 210 from the degeneration standby state ST23 to the stopped state ST25. The state transition is notified to the management device 31.

[0104] The degeneration transition control program 253 transitions the controller state to a stopped state in the management information it holds (S701). Next, the degeneration transition control program 253 determines whether migration of the control information 511 is necessary (S702). If the controller 210 holds and manages the original control information 511, migration of the control information 511 is necessary.

[0105] If migration of the control information 511 is necessary (S702: YES), the degeneration transition control program 253 determines the migration destination of the control information 511 (S703). The degeneration transition control program 253 determines the migration destination in accordance with a specification from the management device 31, or selects a migration destination that has been specified in advance for the combination of controllers 210 operating in degeneration operation. The degeneration transition control program 253 sends the control information 511 to the migration destination controller 210 (S704). Thereafter, the degeneration transition control program 253 turns off the power to that controller 210 to stop it (S705). If migration of the control information 511 is not necessary, steps S703 and S704 are skipped. Note that when all controllers 210 of the node 21 are stopped, the power supply controller (not shown) of the node 21 stops peripheral devices such as the fan 230.

[0106] FIG. 18 is a flowchart showing an example of processing by the degeneration completion confirmation program 254 of the controller 210. Degeneration completion confirmation program 254 is executed by the controller 210 that is in operation. The degeneration completion confirmation program 254 transitions the controller 210 from the degeneration standby state ST23 to the degeneration operating state ST24.

[0107] The degeneration completion confirmation program 254 determines whether the controller 210 is the control information migration destination (S801). The migration destination determination is as explained in step 703. If the controller 210 is the control information migration destination (S801: YES), the degeneration completion confirmation program 254 determines whether the control information migration has been completed (S802). The degeneration completion confirmation program 254 waits for the migration to be completed (S802: NO).

[0108] When the migration is complete (S802: YES ), the degeneration completion confirmation program 254 transitions the controller state in the management information to a degenerate operating state (S803). The degeneration completion confirmation program 254 notifies the management device 31 of the transition to the degenerate operating state. Note that if the controller 210 is not the control information transfer destination (S801: NO), step S802 is skipped.

[0109] 19 is a flowchart showing an example of processing by the emergency startup control program 255 of the controller 210. The emergency startup control program 255 is started during degenerate operation in response to an instruction from the management device 31 or another controller 210 in response to a stop of the controller 210 operating in the module 20. The emergency startup control program 255 transitions the controller 210 from the stopped state ST25 to the degenerate operating state ST24. The emergency startup control program 255 executes processing to restore duplication of the control information 511 and the like.

[0110] The emergency startup control program 255 transitions the controller state in the management information from the stopped state ST25 to the activated state (S901). The state transition is notified to the management device 31. Next, the emergency startup control program 255 replicates the control information 511 (S902). That is, the emergency startup control program 255 copies the control information 511 from another controller 210 that is in operation. In addition to the control information 511, the dirty cache may also be replicated.

[0111] Next, the emergency startup control program 255 determines the logical volume control right to be transferred to that controller 210 (S905). The determination information for the allocation of logical volume control right is as described above. The emergency startup control program 255 transfers the control right of the determined logical volume to that controller 210 (S906). Specifically, the information on the control right in the control information 511 is updated. Next, the emergency startup control program 255 transitions the controller state in the management information to the degenerate operating state ST24 (S907). The state transition is notified to the management device 31.

[0112] 20 is a flowchart showing an example of processing by the normal startup control program 256 of the controller 210. The normal startup control program 256 is started in response to a degeneration cancellation instruction from the management device 31 in a normal state without any failures. The normal startup control program 256 transitions the controller 210 from the stopped state ST25 to the degeneration cancellation standby state ST27.

[0113] The normal activation control program 256 transitions the controller state in the management information from the stopped state ST25 to the degeneration release standby state ST27 (S1001). The state transition is notified to the management device 31.

[0114] 21 is a flowchart showing an example of processing by the degeneration cancellation control program 257 of the controller 210. The degeneration cancellation control program 257 is executed after the normal startup control program 256. 20 Degeneracy of operationExecute the process to release the state. Node 2 0 The state transitions to the normal operation state ST11, and the four controllers 210 operate.

[0115] The degeneration release control program 257 is executed by the controller 210 in the degenerate operating state ST24 and by the controller 210 that has been changed by the normal startup control program 256 from the stopped state ST25 to the degeneration release standby state ST27.

[0116] The degeneration cancellation control program 257 is activated in response to an instruction from the management device 31. The degeneration cancellation control program 257 transitions the controller 210 from the degeneration operation state ST24 or the degeneration cancellation standby state ST27 to the normal operation state ST21 via the post-degeneration cleanup state ST28.

[0117] The degeneration cancellation control program 257 transitions the controller state in the management information to a post-degeneration cleanup state (S1101). The state transition is notified to the management device 31. Next, the degeneration cancellation control program 257 determines whether control information migration, that is, sending of control information 511 to another controller, is necessary (S1102). The controller 210 that holds and manages the control information 511 in the normal operating state ST11 is designated in advance, and this information is provided by the management device 31 or is held by each controller 210.

[0118] If migration is necessary (S1102: YES), the degeneration cancellation control program 257 determines the control information migration destination as described above (S1103). The degeneration cancellation control program 257 migrates the control information (S1104). If migration is not necessary (S1102: NO), steps S1103 and S1104 are skipped.

[0119] Next, if there is a logical volume control right held by the degeneration release control program 257, it determines the logical volume control right to be migrated from among them (S1105). The determination of the controller 210 holding the logical volume control right is as described above. The degeneration release control program 257 executes the migration of the necessary logical volume control right (S1106). Next, the degeneration release control program 257 transitions the controller state in the management information held by the program 257 to the normal operating state (S1107). The state transition is notified to the management device 31.

[0120] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0121] Furthermore, the above-mentioned components, functions, processing units, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. Furthermore, the above-mentioned components, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the programs, tables, and files that realize each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card or SD card.

[0122] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0123] 10 Host Device 20 modules 21 nodes 32 Management terminal 41 Drive 210 Controller 211 CPU 212 memory 213 Host Interface 216 Drive Interface 220 PSU 230 fans

Claims

1. A storage system, including multiple storage controllers; the plurality of storage controllers change from a normal operation mode to a degenerate operation mode in response to an instruction from a management device, Each storage controller of the plurality of storage controllers transitions between a plurality of states; The multiple states are: a normal operation state in which data input / output is performed between one or more host devices and one or more storage drives in the normal operation mode; a degenerate operating state in which data is input / output between one or more host devices and one or more storage drives in the degenerate operating mode; a standby state in which data input / output between the host device and the storage drive is stopped and which consumes less power than the normal operating state and the degenerate operating state; In the normal operation mode, each storage controller of the plurality of storage controllers operates in the normal operation state, When changing from the normal operation mode to the degenerated operation mode in response to an instruction from the management device, a storage controller designated by the management device among the plurality of storage controllers transitions from the normal operation state to the standby state, and storage controllers other than the designated storage controller transition from the normal operation state to the degenerated operation state, When the storage controller in the degenerate operation state in the degenerate operation mode stops due to a failure, the storage controller in the standby state transitions to the degenerate operation state, the plurality of storage controllers are contained in modules; The number of storage controllers included in the module is four, the module includes a first node and a second node; two storage controllers of the four storage controllers are included in the first node, and two other storage controllers of the four storage controllers are included in the second node; the four storage controllers are capable of performing data input / output between a common host device and a common storage drive in the normal operating state and the degenerate operating state; each of the first node and the second node includes a component shared by the two storage controllers of each node; The standby state is a stopped state in which power supply is stopped, a storage system, wherein each of the first node and the second node stops the component when the two storage controllers of each node are in the stopped state;

2. A storage system, including multiple storage controllers; the plurality of storage controllers change from a normal operation mode to a degenerate operation mode in response to an instruction from a management device, Each storage controller of the plurality of storage controllers transitions between a plurality of states; The multiple states are: a normal operation state in which data input / output is performed between one or more host devices and one or more storage drives in the normal operation mode; a degenerate operating state in which data is input / output between one or more host devices and one or more storage drives in the degenerate operating mode; a standby state in which data input / output between the host device and the storage drive is stopped and which consumes less power than the normal operating state and the degenerate operating state; In the normal operation mode, each storage controller of the plurality of storage controllers operates in the normal operation state, When changing from the normal operation mode to the degenerated operation mode in response to an instruction from the management device, a storage controller designated by the management device among the plurality of storage controllers transitions from the normal operation state to the standby state, and storage controllers other than the designated storage controller transition from the normal operation state to the degenerated operation state, When the storage controller in the degenerate operation state in the degenerate operation mode stops due to a failure, the storage controller in the standby state transitions to the degenerate operation state, the plurality of storage controllers are contained in modules; The number of storage controllers included in the module is four, the module includes a first node and a second node; two storage controllers of the four storage controllers are included in the first node, and two other storage controllers of the four storage controllers are included in the second node; the four storage controllers are capable of performing data input / output between a common host device and a common storage drive in the normal operating state and the degenerate operating state; the degenerate operation mode is one of a first degenerate operation mode and a second degenerate operation mode, The first degenerate operation mode is placing one storage controller of the first node in the standby state and another storage controller of the first node in the degenerate operation state; placing one storage controller of the second node in the standby state and another storage controller of the second node in the degenerate operation state; The second degenerate operating mode places two storage controllers of the first node in the standby state and two storage controllers of the second node in the degenerate operating state.

3. A storage system, including multiple storage controllers; the plurality of storage controllers change from a normal operation mode to a degenerate operation mode in response to an instruction from a management device, Each storage controller of the plurality of storage controllers transitions between a plurality of states; The multiple states are: a normal operation state in which data input / output is performed between one or more host devices and one or more storage drives in the normal operation mode; a degenerate operating state in which data is input / output between one or more host devices and one or more storage drives in the degenerate operating mode; a standby state in which data input / output between the host device and the storage drive is stopped and which consumes less power than the normal operating state and the degenerate operating state; In the normal operation mode, each storage controller of the plurality of storage controllers operates in the normal operation state, When changing from the normal operation mode to the degenerated operation mode in response to an instruction from the management device, a storage controller designated by the management device among the plurality of storage controllers transitions from the normal operation state to the standby state, and storage controllers other than the designated storage controller transition from the normal operation state to the degenerated operation state, When the storage controller in the degenerate operation state in the degenerate operation mode stops due to a failure, the storage controller in the standby state transitions to the degenerate operation state, the plurality of storage controllers are contained in modules; The number of storage controllers included in the module is four, the module includes a first node and a second node; two storage controllers of the four storage controllers are included in the first node, and two other storage controllers of the four storage controllers are included in the second node; the four storage controllers are capable of performing data input / output between a common host device and a common storage drive in the normal operating state and the degenerate operating state; One or more logical volumes are managed, Control rights for each of the one or more logical volumes are granted to a storage controller in charge of the plurality of storage controllers, Data input / output of each logical volume of the one or more logical volumes is exclusively controlled by the storage controller in charge, When the storage controller in charge transitions to the standby state in the degraded operation mode, the granted control right is transferred to the storage controller in the degraded operation state.

4. A storage system, including multiple storage controllers; the plurality of storage controllers change from a normal operation mode to a degenerate operation mode in response to an instruction from a management device, Each storage controller of the plurality of storage controllers transitions between a plurality of states; The multiple states are: a normal operation state in which data input / output is performed between one or more host devices and one or more storage drives in the normal operation mode; a degenerate operating state in which data is input / output between one or more host devices and one or more storage drives in the degenerate operating mode; a standby state in which data input / output between the host device and the storage drive is stopped and which consumes less power than the normal operating state and the degenerate operating state; In the normal operation mode, each storage controller of the plurality of storage controllers operates in the normal operation state, When changing from the normal operation mode to the degenerated operation mode in response to an instruction from the management device, a storage controller designated by the management device among the plurality of storage controllers transitions from the normal operation state to the standby state, and storage controllers other than the designated storage controller transition from the normal operation state to the degenerated operation state, When the storage controller in the degenerate operation state in the degenerate operation mode stops due to a failure, the storage controller in the standby state transitions to the degenerate operation state, In the normal operation mode, some storage controllers of the plurality of storage controllers hold and manage control information of the storage system, and other storage controllers of the plurality of storage controllers acquire the control information from the some storage controllers; A storage system, wherein when one storage controller of the partial storage controllers transitions to the standby state in the degenerate operation mode, the control information of the one storage controller is migrated to the storage controller in the degenerate operation state.

5. The storage system of claim 4, A storage system in which, when the free memory space of a storage controller to which the control information is migrated is insufficient to store the control information, an area for storing the control information is secured by abandoning a clean cache in the memory.

Images