JP2001222384A - Storage device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently execute a restoration processing of faults in terms of time by minimizing lowering of normal reading and writing processings in the case of the fault regarding a storage medium with redundancy to the faults of two or more storage media. SOLUTION: This storage medium is provided with a control means 150 to control a data restoring means by switching a first processing mode in which access requests to plural storage devices 158 to 172 to store data divided into optional units and error restoration data of the divided data are received, data restoration frequency to restore the divided data is set by the data restoring means 156, the level of importance of the faults are judged for each of the generated faults based on output of a monitoring means and the divided data is restored in response to the data restoration frequency and the degrees of importance of the faults by the data restoring means and a second mode in which restoration of the divided data is temporarily interrupted so that accesses are enabled to the storage devices.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a storage device for reading and writing data in parallel using a plurality of independent storage media as a set.

[0002]

2. Description of the Related Art As a conventional technique, as a technique for increasing the capacity of a storage device and transferring data at a high speed, data is divided into bit units, byte units, or arbitrary units by using a plurality of storage media as a set. There is known a method in which each data is distributed and stored in each storage medium, and data is simultaneously read from each storage medium when data is read. In this method, data for parity check is generated from the data distributed to each storage medium, and this is stored in another storage medium. When a failure occurs, the data is restored using the data of the normal storage medium and the data for parity check, thereby improving the reliability of the storage device. Examples of these techniques are described in JP-A-1-250128. Further, there is known a technique in which when a failure occurs in a storage medium, not only data is restored for normal reading, but also data of the failed medium is restored to a separately prepared normal storage medium. This technique can increase the availability of a storage device by storing restored data in a spare medium and reading data from the spare medium for the next access. For example, Japanese Patent Laid-Open No. 2-1
Japanese Patent No. 35555 discloses an example of this type of storage device.

[0003]

The above-mentioned known apparatus can repair a failure of a fixed number of storage media by having parity data, and can also perform failure recovery by having a spare storage medium. I can do it. However, the failure recovery operation requires an operation of reading out all data of a normal storage medium and data for parity check, repairing the failure data, and writing the data to a spare storage medium. Therefore, during the recovery from a failure, each storage medium is occupied, and even if a normal read / write processing request is received from a higher-level device, it is waited for, and as a result, the performance of the storage device is reduced. Also,
The above-mentioned known apparatus handles the failure recovery of one storage medium and the failure recovery of a plurality of failures without distinction even though there is redundancy with respect to the failure of a plurality of storage media. For this reason, if emphasis is placed on failure recovery, normal read / write processing cannot be performed despite the occurrence of one failure, and there is a problem that normal read / write processing is reduced. On the other hand, normal read / write processing is emphasized. When there are a plurality of faults, a fault recovery time is not guaranteed in the case of a plurality of faults, and there is a problem that the possibility that the entire device will break down increases.

An object of the present invention is to provide a storage device which is redundant with respect to a failure of two or more storage media, by minimizing a decrease in normal read / write processing at the time of failure, and by setting a failure recovery time within a predetermined time. To ensure high reliability.

[0005]

In order to solve the above-mentioned problems, a plurality of storage devices for storing data and copy data thereof, and defective data stored in one of the plurality of storage devices are stored in the storage device. Data restoration means for restoring using copy data having no defect, monitoring means for monitoring the processing of the plurality of storage devices and issuing a signal when a defect occurs in any of the plurality of storage devices, and host Receives an access request to multiple storage devices from the unit, sets the data recovery frequency at which the data recovery unit recovers data, and determines the importance of each defect that has occurred based on the output of the monitoring unit A first mode in which the data repair means repairs the data in response to the data repair frequency and the importance of the defect; and a repair mode for repairing the divided data so that the storage device can be accessed. The switching between temporarily suspend the second mode and a control means for controlling the data recovery means. Also, a plurality of storage devices for storing a plurality of data groups and copy data of each data group of the plurality of data groups, and data stored in the data storage device in which a defect has occurred are stored in the data group to which the data belongs. And a control device for performing a repair process based on data stored in the copy data storage device in which no defect occurs, wherein the control device performs the repair process in the first time slot when a read / write request from the host unit is received. In the second time period, the processing of the read / write request from the host unit is performed prior to the restoration processing.

[0006]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail. In the embodiment, a magnetic disk will be described as an example of a storage medium. FIG. 1 is a flowchart showing the procedure of a failure recovery process according to the present invention. FIG. 2 is a configuration diagram of an embodiment in which the present invention is applied to a storage device that can withstand two data disk failures. FIG. 3 is a failure recovery table for the failed disk in FIG. FIG. 4 is a flowchart showing a procedure of a failure recovery process in the storage device of FIG. FIGS. 5, 6, 7, 8 and 9 are diagrams showing details of the failure recovery processing selection block in the processing procedure of FIG.

[0007] A flowchart showing the processing procedure of the failure recovery of FIG. It is assumed that a failure has occurred in the storage device (step 10). First, it is determined whether the fault that has occurred can be recovered (step 20). If the data cannot be repaired, the failure recovery process is terminated and data loss occurs (step 30). If repair is possible, it is determined whether the storage device is in a state in which it is necessary to concentrate on the recovery from the redundancy of the storage device, the elapsed time of the recovery from the failure, and the processing state of the normal read / write processing (step 40). If you have enough time,
When the urgency of failure recovery is low and a normal processing request such as read / write is received from the host device, the failure recovery processing is stopped and normal processing such as read / write is performed first. The failure recovery processing is performed in the remaining time, and the read / write processing during the failure recovery processing is canceled or queued (step 50). Conversely, if there is no room and the urgency of failure recovery is high, priority is given to failure recovery processing, and all normal processing such as reading and writing is canceled or queued (step 60). Also, if there is some combination between the urgency of disaster recovery and the importance of normal processing such as reading and writing, disaster recovery processing corresponding to each condition is prepared in advance in the form of a program, and the conditions change. If so, the program can be switched to an appropriate process by replacing the program (step 70). Next, when the failure recovery processing ends or is interrupted, it is checked whether or not the failure recovery processing still remains (step 80). When all the failure recovery is completed, the storage device returns to the normal state. If the fault recovery process still remains, the process returns to the beginning (20), and the above steps are repeated until the fault recovery ends.

Next, the configuration of the embodiment of the present invention shown in FIG. 2 will be described. In FIG. 2, reference numeral 150 denotes an input / output-fault recovery control circuit which receives an input / output command from a higher-level device, executes the command, or responds to the higher-level device. Further, when a failure has occurred in the storage medium, an appropriate failure recovery method is selected from the number of disks during the recovery, the time required for the recovery, the frequency of the recovery or the amount of the recovery. Reference numeral 154 denotes a failure recovery table of the failure storage medium, which will be described in detail with reference to FIG. Reference numeral 152 denotes a timer for knowing the fault occurrence time, the elapsed time during the fault recovery, and the unit time, and determines the fault recovery method using the time measured here as one condition. Reference numeral 156 denotes a failure data recovery / recovery circuit for finding, restoring, and writing to the spare storage disk. The failure data recovery / recovery circuit reads data from all disks except the failed disk, and uses the read data to repair the failed data. The data is transferred to the device or written to a spare storage disk. Data disk groups 158 to 168 store divided data. FIG.
In the above, six disks are shown as the number of data disks, but the number is generally arbitrary. 170 and 172 are 158
This is a disk for storing ECC data corresponding to data divided into 168 and 168. When a fault occurs, the fault data is restored using this data and the normal data in 158 to 168. However, if more data disks fail than the redundancy of the storage device, the data cannot be repaired, resulting in data loss. In FIG. 2, the ECC data is 2
In other words, even if two data disks have failed, the failed data can be repaired. However, in general, an EC that can withstand two or more disk failures
There is also a C generation method, and the number of failed disks that do not lead to data loss, that is, the redundancy can be further increased.
Specifically, the ECC generation method is realized by using a Reed-Solomon code capable of multiple erasure correction. The Reed-Solomon code and the error correction method using the same are described in the related art (for example, described in "New Edition Digital Audio" published by Doi and Iga, published by Radio Engineering Co., Ltd.), and thus description thereof is omitted. . Reference numerals 174 and 176 denote spare storage media for storing the restored data. When the contents of the failed disk are stored, access to the data from the next time becomes the spare storage media. This number of disks is also generally arbitrary.

The failure recovery table for the failed disk shown in FIG. 3 will be described. The failure recovery table 154 determines the identification number (1) of the spare storage disk, the identification number (2) of the failed disk, the failure time (3), the address of the failed data (4), and the presence or absence of the failure recovery. It consists of a flag (5).

Next, based on the flowchart of FIG.
And the operation of FIG. First, assume that a failure has occurred in the data disk 162 in FIG. 2 (100). The fault data recovery / recovery circuit 156 detects the fault, and
The occurrence of a fault is notified to the fault recovery control circuit 150. The input / output-fault recovery control circuit 150, which has been notified from the fault data recovery / recovery circuit 156, checks the fault recovery table 154 to determine whether there is a free space (102). Next, the input / output-fault recovery control circuit 150 confirms that this fault is a new fault (104). If it is a new fault, I / O-
The fault recovery control circuit 150 is used for the fault data recovery and recovery circuit 15.
6 instructs to write an initial value in a corresponding column in the failure recovery table 154. The failure data recovery / recovery circuit 156 writes the identification number S1 of the spare disk 174 in the column of the spare storage medium in the failure recovery table 154, and the identification number # 2 of the failed data disk 162 in the column of the failure storage medium. Write. Next, timer 15
2 is written in the column of failure time, and the address of the failed disk 162 is written in the address column. Finally, the failure data recovery / recovery circuit 156 initializes a recovery determination flag of each address (106). If it is not a new fault, the process proceeds to the next step without performing the process of step 106. In the next step, the input / output-fault recovery control circuit 150 determines the status of the fault, selects and executes a normal read / write process or a fault recovery process suitable for the fault (108). Details of this step will be described with reference to FIGS. Next, when the failure recovery processing ends or is interrupted, it is checked whether the failure recovery processing still remains (11).
0). When all of the failure recovery is completed, the storage device returns to the normal state. If the failure recovery process still remains, the process returns to the beginning (102), and the above steps are repeated until the failure recovery is completed. Regardless of the failure recovery method, the failure data recovery / recovery circuit 156 monitors the continuation or termination of the failure recovery. If the next failure occurs before the failure recovery is completed, the failure data recovery / recovery circuit 156 starts processing as described above (102).
If the number of failed disks for which the failure recovery is not completed exceeds the redundancy of the device, recovery from the failure is impossible, so the I / O-fault recovery control circuit 150 reports the data loss to the higher-level device (114). If disaster recovery is over,
Erase unnecessary data in the failure recovery table 154,
It returns to a normal state (112).

Next, step 108 in FIG. 4 will be described with reference to FIG.
This will be described with reference to FIG. In FIG. 5, the input / output-failure recovery control circuit 150 looks at the failure recovery table 154, counts the number of disks for which recovery has not been completed, and compares the number of failure disks with a threshold (step 120). If the number of failed disks is less than a predetermined threshold, the I / O-failure recovery control circuit 150 determines that there is enough redundancy, gives priority to normal reading and writing, and performs the failure recovery process at other times. Do. Those in the middle of the failure recovery processing are canceled or queued (step 122). If the number of failed disks is larger than the threshold value, the I / O-failure recovery control circuit 150 determines that there is no margin in the redundancy, gives priority to the failure recovery processing, and cancels or queues all normal processing such as reading and writing. (Step 12
4). When recovering from a failure, the recovery and storage are completed in a relatively short time, such as one track, and the storage device is released for normal processing after the completion. However, if a normal read / write processing instruction is received during recovery from a failure, the failure recovery work is immediately stopped and released for normal read / write processing. When reading data for which failure recovery has not been completed during normal read / write processing, the failed data is repaired with the ECC data and the normal data used to generate it, sent to the upper-level device, and simultaneously stored in the spare disk. In the recovery table 154, the recovery determination flag of the corresponding address in the recovery table 154 is determined to have been recovered. If this flag indicates that the recovery has been completed, the next access to this data will be made to the spare disk. In the case of data writing, after the ECC data is created, data to be stored in the failed disk is written to the spare disk, and the recovery determination flag is set to "recovered". The threshold value is necessarily 1 since the redundancy is two in the example of FIG. However, when two or more multiplex erasure-correctable Reed-Solomon codes are used, the threshold can take any integer less than or equal to the redundancy. The fault recovery stores the address of the data previously recovered by the input / output-fault recovery control circuit 150, and starts from the next address. At the time of failure recovery, the previously stored data address stored previously is used. If the next address is not flagged in the failure recovery table 154 and the failure recovery is not completed, the data at that address is repaired. . To restore the data, the normal data used to generate the ECC data from the normal disk and the ECC data is read, and the faulty data recovery and recovery circuit 156 is read.
Perform using. The repaired data is written to a spare disk, and the flag in the failure recovery table 154 is set to "recovered". Access to the data that has been restored will be made to the spare disk. The address of the restored data is stored in the failure data restoration and recovery circuit 156, and the input / output
The fault recovery control circuit 150 proceeds to the next fault recovery process. In the embodiment of FIG. 5, when the number of failed disks is equal to or less than the threshold value, the normal read / write processing is prioritized over the recovery from the failure, so that a decrease in the read / write performance of the storage device can be suppressed. Further, in a state where the system is dedicated to the recovery from the failure, the repair can be performed in the shortest time, so that the reliability can be maintained. In the above embodiment, the failure recovery method is selected by paying attention to only the number of failed disks, but the condition may include the total number of failed recovery times in addition to the number of failed disks.

Next, step 108 in FIG. 4 will be described with reference to FIG. In FIG. 6, the input / output-failure recovery control circuit 150 looks at the failure recovery table 154, counts the number of disks for which recovery has not been completed, and compares the number of failed disks with a threshold value (step 130). If it is below the threshold, then the input / output-fault recovery control circuit 15
In the case of 0, the current time is read from the timer 152, and the total of the fault recovery time calculated from the current time and the fault occurrence time in the fault recovery table 154 is compared with a preset time limit (step 132). Therefore, when the total of the fault recovery times is smaller than the preset time limit, it can be considered that there is a margin for the fault recovery, so that the input / output-fault recovery control circuit 150 It gives priority to normal read / write processing, and instructs the data in the failed disk to be repaired in the remaining time and stored in the spare disk. Those in the middle of the failure recovery processing are canceled or queued (step 134). If the number of disks for which recovery has not been completed is greater than the threshold value, or if the difference between the current time and the failure time is greater than a preset time limit, it can be considered that there is no margin for recovery from failure. , The failure recovery control circuit 150
Normal reading and writing from the higher-level device is canceled or queued.
An instruction is given to perform the recovery from the failure first (step 13
6). In the embodiment shown in FIG. 6, when the time required for the recovery from the failure exceeds the time limit, the recovery is dedicated to the failure recovery processing, so that the recovery time can be set within a fixed time, and the reliability can be improved.

Next, step 108 in FIG. 4 will be described with reference to FIG.
This will be described with reference to FIG. 7, the input / output-failure recovery control device 150 acquires the current time from the timer 152,
It is determined whether or not the time is a time zone in which normal read / write processing is frequently performed (step 140). If not, the input / output / fault recovery control circuit 150 cancels or queues the normal read / write from the host device, and gives priority to the fault data recovery / recovery circuit 156 for fault recovery. Command. If the number of failed disks in step 142 exceeds the threshold value even during that time, priority is given to the failure recovery processing in the same manner (step 14).
6). Only when normal read / write processing is large and the number of failed disks is below the threshold, normal read / write is given priority,
Failure recovery is performed in the remaining time (step 144). In the embodiment of FIG. 7, when it is known in advance that the use of the storage device differs depending on the time zone,
Since the failure recovery can be applied to a time period during which the normal read / write processing is small, the failure recovery can be smoothly performed without the normal read / write processing hindering the failure recovery processing. In the above-described embodiments of FIGS. 5 to 7, two types of failure recovery processing, that is, priority is given to failure recovery or normal reading / writing is performed. However, this may be increased according to the situation.

Next, step 108 in FIG. 4 will be described with reference to FIG.
This will be described with reference to FIG. In FIG. 8, when the number of failed disks in step 150 exceeds the threshold value, priority is given to recovery from failure, and normal reading and writing are stopped (step 158). If the number of failed disks is equal to or less than the threshold value and the time period for normal read / write processing in step 152 is not a time zone, only read processing is performed, and the rest of the time is prioritized for failure recovery (step 156). If the number of failed disks is equal to or less than the threshold value and there is a lot of normal read / write processing, priority is given to normal read / write processing, and failure recovery is performed at other times (step 154). In the embodiment of FIG. 8, the number of failed disks is equal to or less than the threshold value. However, in a time zone in which normal read / write processing is small, particularly in a time zone in which only reading is performed, reading processing is exceptionally permitted. It is possible to suppress the performance degradation of the storage device without hindering the failure recovery processing.

Next, step 108 in FIG. 4 will be described with reference to FIG. In FIG. 9, when the number of failed disks exceeds the threshold value in step 160, or when the number of failed disks is less than the threshold value and the total failure recovery time in step 162 exceeds the time limit, priority is given to failure recovery. Then, normal reading / writing is stopped (step 172).
The input / output-failure recovery control circuit 150 reads the unit time from the timer 152 when the number of failed disks is equal to or less than the threshold value and the total of the failure recovery times is less than the time limit, and performs a normal read / write processing frequency within the time. Is compared with a preset threshold value (step 164). If the frequency of normal reading and writing is greater than the threshold, it is within the time limit,
Since it can be considered that there is room for failure recovery, normal read / write processing is prioritized, and failure recovery is performed at other times (step 166). On the other hand, when the normal read / write processing frequency is smaller than the threshold value and the frequency is infinitely close to or far from the threshold value, there is a difference in the frequency. The frequency of the failure recovery processing per unit time or the ratio of the amount of failure recovery is dynamically set according to the magnitude of the frequency (step 168).
The failure recovery processing is executed according to the set frequency of failure recovery processing or the ratio of the amount of failure recovery (step 17).
0). In the embodiment of FIG. 9, the frequency of the failure recovery processing or the ratio of the amount of failure recovery is set in accordance with the magnitude of the normal read / write processing frequency, so that the failure recovery processing is executed efficiently in terms of time. .

In the above embodiments, a magnetic disk is taken as an example of a storage medium.
A floppy (registered trademark) disk or semiconductor memory can be used as a storage medium. In addition, instead of the above-described embodiment, the condition for selecting the failure recovery method may be the job content of the higher-level device, the importance of a file in the storage device, or the like. A flexible failure recovery process can be performed by a combination of these conditions and a failure recovery method.

[0017]

According to the present invention, when the number of failed storage media is smaller than the redundancy of the storage device, normal read / write processing is given priority over recovery from the failure, so that the load on the storage device is heavy. In addition, it is possible to minimize a decrease in response performance in normal read / write processing. Further, when the margin of the redundancy is reduced, the normal read / write processing is automatically stopped and the priority is given to the processing of the failure recovery, so that the reliability of the storage device does not decrease. Further, since the failure recovery processing method is changed depending on the total of the failure recovery processing times of the respective failure storage media, a storage device with higher reliability can be realized. Further, since the frequency of the failure recovery processing or the ratio of the amount of failure recovery is set in accordance with the magnitude of the normal read / write processing frequency, the failure recovery processing can be executed efficiently in terms of time. As described above, according to the present invention, an appropriate failure recovery method can be selected in accordance with various conditions relating to the failure recovery, so that there is a remarkable effect that optimal failure recovery processing can be performed.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a processing procedure of the present invention.

FIG. 2 is a configuration diagram of a storage device of the present invention.

FIG. 3 is a configuration diagram of a failure recovery table of a failed disk according to the present invention.

FIG. 4 is a flowchart showing a processing procedure of FIG. 2;

FIG. 5 shows a flowchart of a failure recovery processing selection block in FIG. 4;

FIG. 6 shows another flowchart of the failure recovery processing selection block in FIG.

FIG. 7 shows another flowchart of the failure recovery processing selection block in FIG.

FIG. 8 shows another flowchart of the failure recovery processing selection block in FIG.

FIG. 9 shows another flowchart of the failure recovery processing selection block in FIG.

[Explanation of symbols]

150 input / output-fault recovery control circuit, 154 fault recovery table, 152 timer, 156 fault data recovery recovery circuit, 158 data disks # 0, 160 data disks # 1, 162 data disk # 2, 164
... Data disks # 3, 166 ... Data disks # 4,
168 data disks # 5, 170 ECC data disks E1, 172 ECC data disks E2, 17
4: spare disk S1, 176 ... spare disk S2

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) G06F 12/16 320 G06F 12/16 320L

Claims (2)

[Claims] A plurality of storage devices for storing data and copy data thereof, and the defective data stored in any of the plurality of storage devices are used by using copy data having no defect. A data restoration unit for repairing the data, a monitoring unit for monitoring the processing of the plurality of storage devices, and outputting a signal when a defect occurs in any of the plurality of storage devices; Receiving the access request, the data repair unit sets a data repair frequency for repairing the data, and for each defect that has occurred, determines the importance of the defect based on the output of the monitoring unit. A first mode in which the data repair means repairs the data in response to a data repair frequency and a degree of importance of the defect; and the divided mode so that the storage device can be accessed. Control means for controlling the data restoration means by switching to a second mode for temporarily suspending the restoration of the restored data. 2. A storage device for storing a plurality of data groups and copy data of each data group of the plurality of data groups, and data stored in a data storage device having a defect, to which the data belongs. A control unit for performing a repair process based on data stored in the copy data storage device in which a defect does not occur in the data group, wherein the control device performs the repair process in a first time period from a host unit; A storage device wherein the processing is performed prior to the processing of a read / write request, and the processing of the read / write request from the host unit is performed prior to the restoration processing in a second time period.