JP2001243022A - Disk controller and disk processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a disk processor for surely selecting and starting a non- defective disk device at the time of starting an information processing system. SOLUTION: A disk processor is provided with plural disk devices 2 (21 and 22), plural disk power source control means 3 (31 and 32) respectively provided on each disk device 2, a disk control part 1 for operating the control of writing and reading in the plural disk devices 2 and the detection of the disk device 2 in which any failure is generated from the inside parts of the plural disk devices 2, and a disk power source controlling part 4 for controlling the disk power source control means 3 for the disk device 2 in which any failure is generated according to an instruction from the disk control part 1.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a disk control device and a disk processing device, and more particularly, to a disk control device and a disk processing device capable of reliably selecting and starting up a disk device free from a failure upon system restart. About.

[0002]

2. Description of the Related Art User data (application programs and their data) are stored on a disk device (for example, a magnetic disk device) used as an auxiliary storage (or an external storage) of an information processing system such as a computer. You. Therefore, for example, if a disk device storing the application program fails during execution of the application program, the system may be stopped or data may be lost. Therefore, in order to prevent a system stop or data loss due to a disk device failure, data is multiplexed by mirroring (double writing) the disk device.

The multiplexed disk device is controlled as follows by, for example, a mirror control driver (program).

As shown in FIG. 11A, the same data ABC is written in the mirrored (duplexed) disk devices # 1 and # 2. When the information processing system is started in this state, for example, one of the disk devices # 1
Is booted. Thereafter, it is assumed that the data ABC is changed to the data XYZ during the operation of the information processing system in a state where no failure occurs, as shown in FIG. 11B. In this case, the mirror control driver updates not only the disk device # 1 but also the data ABC in the other disk device # 2 to the data XYZ.

Thereafter, as shown in FIG. 11C, the data XYZ is changed to data OPQ, and the mirror control driver attempts to write the data into the disk devices # 1 and # 2. However, the data XY of the disk device # 2
Although Z could be updated to the data OPQ, the update of the data XYZ of the disk device # 1, for example, failed for some reason. Therefore, the mirror control driver detects the occurrence of a failure in the disk device # 1, and disconnects the failed disk device (hereinafter, a failed device) # 1 from the information processing system. That is, access from the application to the failed device # 1 is prohibited. Therefore, after the occurrence of the failure, the data of the failed device # 1 is not updated, and the old data before the update remains as it is.

[0006] Thereafter, the system administrator who knows the occurrence of the failure shuts off the power of the information processing system and stops the information processing system. The system administrator specifies the location of the failure, replaces the failed device (disk) in the failed device # 1, turns on the power again, and restarts the information processing system.

[0007]

In the above-described example, when the disk device preset to be started (booted) when the information processing system is powered on and started up is the failed device # 1. When the power is turned on again, the failed device # 1 is booted as shown in FIG. In this case, the mirror control driver updates the (new or correct) data OPQ of the disk device # 2 to the data XYZ based on the (old or incorrect) data XYZ of the failed device # 1 booted. As a result, a correct program or data of the disk device # 2 is lost.

For this reason, the above-described mirroring technique for a conventional application (program) cannot be applied to an operating system (OS) as it is. That is, if the disk device booted when the system power is turned on is the failed device # 1, the operating system will be updated to an old or incorrect one, and the legitimacy and integrity of the operating system cannot be guaranteed. Therefore, mirroring of the operating system has not been conventionally performed.

In the above-described control by the mirror control driver using the disk device, when the failed device # 1 is separated, information on the state after the separation (separation information) is stored in the mirror control driver internal information. Only managed as. That is, disk device # 2
Does not hold the disconnection information, and there is no means for passing the disconnection information to the operating system (or maintenance tool). Therefore, when the information processing system is restarted, there is no means for knowing which disk device # 2 has been operating correctly without any failure before the maintenance tool stopped.

[0010] In particular, a BI that is first activated when the power is turned on in a small computer such as a personal computer
The OS (Basic Input Output System) has no interface with the mirror control driver (and other programs). Therefore, the mirror control driver
The OS cannot be notified of the faulty device # 1. Also,
The BIOS is usually incorporated by the computer maker at the time of manufacture of the computer, so it cannot be changed practically. Therefore, it is not possible to change the disk device of the setting booted when the power is turned on by using the BIOS.

According to the study of the present inventor, when the power of the information processing system is turned on again, the faulty device # 1 that has been disconnected first is booted as follows.
The cause is how to disconnect the faulty device # 1. That is, the separation of the conventional failed device # 1 is simply performed based on the internal information of the mirror control driver.
This is because the operation of the failed device # 1 is not physically stopped, and only the access to the failed device # 1 is prohibited.

[0012] In the conventional personal computer, it is not possible to specify which disk device is to be started when the power of the information processing system is turned on again for the reasons described above. Therefore, when replacing a failed disk in response to the occurrence of a failure, it is indispensable to back up the data of the normal disk device # 2 before the replacement. This was troublesome for the user.

It is an object of the present invention to provide a disk control device that reliably selects and starts a disk device free from a failure when the information processing system is started.

It is another object of the present invention to provide a disk processing device which reliably selects and starts a disk device free from a failure when the information processing system is started.

[0015]

FIG. 1 is a block diagram of the principle of the present invention, showing the configuration of a disk control device and a disk processing device according to the present invention.

The disk controller of the present invention controls writing and reading to and from a plurality of disk devices 2 (21 and 22) and detects a failed disk device 2 from among the plurality of disk devices 2. A disk control unit 1;
A disk power control unit that controls power supply to the failed disk device according to an instruction from the disk control unit;

According to the disk control device of the present invention, the disk power control unit 4 supplies power to the disk device 2 in accordance with an instruction from the disk control unit 1 that has detected the failed disk device 2. Control. That is, it shuts off. As a result, after the interruption, the failed disk device 2 is not only prohibited from being accessed by the application (separated from the information processing system), but also cannot be physically operated. Therefore, when the information processing system is turned on again and restarted, it is possible to prevent the failed disk device 2 from being booted. That is, it is possible to reliably select and start up a disk device without any trouble at the time of starting the information processing system. Therefore, it is possible to prevent the data of the disk device 2 in which no failure has occurred from being erroneously updated based on the data stored in the disk device 2 in which the failure has occurred.

The disk processing apparatus according to the present invention includes a plurality of disk devices 2 (21 and 22), a disk power control means 3 (31 and 32) provided for each of the plurality of disk devices 2, and a plurality of disk devices. Control of writing and reading to and from the plurality of disk drives 2
A disk control unit 1 for detecting a failed disk device 2 from among them; and a disk power control unit for controlling a disk power control unit 3 for the failed disk device 2 in accordance with an instruction from the disk control unit 1. Unit 4.

According to the disk processing apparatus of the present invention, the disk control unit 1 that has detected the failed disk device 2
In accordance with the instruction from, the disk power control means 3 of the disk device 2 is controlled. That is, it is shut off. As a result, the failed disk device 2
As described above, after the interruption, the access from the application is prohibited, and the operation is physically disabled. For this reason, when the information processing system is restarted by turning on the power again, it is possible to prevent the failed disk device 2 from being booted, and to ensure that the disk device having no failure at the time of starting the information processing system. Get selected and get up. Therefore, the failed disk device 2
Can be prevented from being erroneously updated based on the data stored in the disk device 2 in which no failure has occurred.

[0020]

FIG. 2 is a configuration diagram of an information processing system, showing the configuration of an information processing system according to the present invention. This information processing system includes a mirror control driver 1 as a disk control unit 1, a plurality of disk devices 2 (21 and 22),
A disk power control means 3 (31 and 32), a disk power control unit 4, an application 5, a maintenance tool 6, a system power supply 7, and a fault lamp 8 (81 and 82) are provided.

In this information processing system, a plurality of disk devices 2 are prepared and used for data multiplexing processing, for example, for data mirroring (duplication) in this case. The disk device 2 is, for example,
It comprises a magnetic disk device, an optical disk device, a magneto-optical disk device and the like. Mirroring is a mirror control driver 1
Is performed using a plurality of disk devices 2. That is, the mirror control driver 1 performs multiplexing processing on a plurality of disk devices 2. Specifically, the mirror control driver 1
As shown in (A), in addition to the conventional data and application program (5), according to the present invention, the operating system (OS) of the information processing system is
Mirroring is performed using the two disk devices 21 and 22. Therefore, in this information processing system, data to be mirrored includes an application program (and data used by it), a system program such as an operating system (and data used by it), and the like. A plurality of sets of disk devices 21 and 22 for mirroring are provided.

As shown in FIG. 3A, in the two disk devices 21 and 22, a predetermined mark (data) is stored at the head. This mark indicates a BIOS (not shown) that is first started when the system power supply 7 is turned on.
Is notified that the operating systems are stored in the disk devices 21 and 22 and are mirrored. The started BIOS first starts an OS loader (not shown) stored in the disk device 21 or 22. The OS loader loads the main body of the operating system into a main memory (not shown) and starts it.

For each of the plurality of disk devices 2 (21 and 22), the corresponding disk power control means 3 (31
And 32) are provided. The disk power control means 3 includes a disk power controller 4 (of the disk power controller 4).
Controlled by 1). The disk power controller 4 (the disk power controller 41 of the disk power controller 4)
In accordance with a predetermined instruction (control command) from, the disk power supply control means 3 of the failed disk device 2 is shut off. Each disk power control means 3
For example, it comprises a power switch. Disk power control means 3
Is turned on, receives power from a system power supply 7 described later, and supplies it to the corresponding disk device 2,
When it is off, the supply of power from the system power supply 7 is cut off (no power is supplied to the corresponding disk device 2). Therefore, the disk power control means 3 controls the power of each of the plurality of disk devices 2 independently (ie, supplies and shuts off) independently of the control of the system power 7 (ie, turning on and off (stopping)). ) Means.

Each of the plurality of disk devices 2 (21 and 22) is provided with a corresponding fault lamp 8 (81 and 82). The fault lamp 8 is a means for displaying the state of the corresponding disk device 2 and is controlled by the mirror control driver 1. That is, the mirror control driver 1 turns on (turns on) the fault lamp 8 of the failed disk device 2 and displays (notifies) the occurrence of the failure to the system administrator. Thereby, the system administrator can correctly recognize the failed disk device 2. Therefore, it is possible to prevent the disk from being erroneously exchanged for the disk device 2 having no failure.

The mirror control driver 1 controls writing and reading to and from the two disk devices 21 and 22. That is, data mirroring is performed. Mirroring is performed using two disk devices 21 and 22. That is, in the data read (read) processing, the mirror control driver 1 reads data from only one of the disk devices 21 or 22 in response to a read request from the application 5. Therefore, the read operation is performed only on one of the two disk devices 21 and 22. In the data write (write) process, the mirror control driver 1 writes the same data to both disk devices 21 and 22 in response to a write request from the application 5. Therefore,
The writing operation is performed simultaneously on both of the two disk devices 21 and 22.

For example, the disk devices 21 and 22 (# 1
And # 2) have the same data ABC written therein (see FIG. 10A). In this state, when the data ABC is changed to the data XYZ by the application 5, as shown in FIG.
Is the data A in both the disk devices 21 and 22
The BCs are simultaneously updated to the data XYZ by a write operation.

As described above, in this information processing system, the changed data is transferred to the two disk devices 21 and 22 irrespective of which of the disk devices 21 and 22 is booted when the system power supply 7 is turned on. Mirroring is performed by writing to both of them at the same time.
When the system power supply 7 is turned on, it is undefined which of the disk devices 21 and 22 is to be booted. The writing of the changed data is not performed collectively when the system power supply 7 is turned off, but is sequentially performed on both of the two disk devices 21 and 22 during the operation of the information processing system.

The mirror control driver 1 detects a failed disk device 2 from the plurality of disk devices 2 and disconnects the failed disk device 2 from the information processing system. That is, the mirror control driver 1
Prohibits the application 5 from requesting access to the failed disk device 2 without executing the request. The access request is executed using the corresponding data of the disk device 2 in which no failure has occurred. The mirror control driver 1 detects that a failure has occurred in the disk device 2. For example, if the mirror control driver 1 cannot execute the read process or the write process on a certain disk device 2 even though the mirror device driver 1 attempts to perform the read process or the write process, the disk device 2 is determined to have failed. .

When a failure occurs in any of the plurality of disk devices 2, the mirror control driver 1 changes the state of the power supply (disk power control means 3) of the failed disk device 2 to the system power supply 7. And control independently. The control of the disk power control means 3 is actually performed by the disk power controller 4 (of the disk power controller 4).
1). For this purpose, the mirror control driver 1
Issues a predetermined control command to (the disk power controller 41 of) the disk power controller 4.

After a failure has occurred in any of the plurality of disk devices 2, the mirror control driver 1, as described later, requests the data from the failed disk device 2 in response to a request from the maintenance tool 6. Is performed.

The system power supply 7 is a power supply for the information processing system, and supplies a stabilized power formed from, for example, a commercial power supply to the information processing system. Therefore, turning on / off the power to the information processing system depends on turning on / off the system power supply 7. However, in the present invention, the disk power control means 3 of the disk device 2 is controlled by (the disk power controller 41 of) the disk power control unit 4 independently of the system power supply 7.

The disk power control section 4 includes a disk power controller 41, a state memory 42, a forced power supply section (switch) 43, and an OR gate circuit 44.

The disk power controller 41 controls the disk power control means 3 (31 and 32) using the state memory 42. That is, the disk power controller 4
1 receives the request (control command) from the mirror control driver 1 and controls the disk power control means 3 according to the command, and writes the state information into the state memory 42. Therefore, in the command, the disk power control unit 31 or 32 corresponding to the failed disk device 21 or 22 is specified. Therefore, the disk power control means 31 or 32 specified by the control command is shut off, and the status information indicating that the power is shut off is stored in the state memory 4.
2 is written. The disk power controller 41
It is composed of predetermined hardware, and operates by turning on the system power supply 7 and a control command.

The state memory 42 includes a plurality of disk devices 2
This is a memory provided separately. The state memory 42
The information (status information) about the ON / OFF state of the disk power control means 3 for each of the plurality of disk devices 2 is held. The status information is managed by the disk power controller 4. That is, the disk power control unit 4 stores the status information for each of the plurality of disk devices 2 in the status memory 42.
Write to. For example, when the corresponding disk power control means 3 of the disk device 2 is turned on, the status information of the disk device 2 (or the disk power control means 3) is "G or 1 (good or turned on)". . When it is shut off, it is set to “NG or 0 (defective or shut off)”.

The state memory 42 is a nonvolatile memory. Thus, even when the system power supply 7 is turned off (and turned on), the state information stored in the state memory 42 is not lost. Therefore, when the system power supply 7 is stopped and thereafter turned on, the disk power supply control unit 4 or the disk power supply controller 41 sets the disconnected disk power supply control means 3 of the failed disk device 2 to the interrupted state. , And retains state information before and after the system power supply 7 is turned off and on again. That is, status information can be passed from the mirror control driver 1 and the disk power control unit 4 before the system power supply 7 is cut off to the mirror control driver 1 and the disk power control unit 4 after the cutoff (re-input). As the nonvolatile memory, for example, an EPROM (read only memory capable of erasing ultraviolet rays) is used.

The disk power supply controller 4 or the disk power supply controller 41 refers to the state memory 42 and, when the system power supply 7 is turned on again, as described later, controls the system power supply of the (failed) disk device 2. 7
The state of the disk power control means 3 at the time of the interruption or after the failure (interruption state) is reconstructed.

If, for example, a failure occurs in the disk device 21 and the disk power supply control means 31 is shut off, as shown in FIG. 3C, when the application 5 updates the data XYZ to the data OPQ, The mirror control driver 1 reads the data XYZ of the disk device 22
Is updated to the data OPQ, but the data XYZ of the disk device 21 is not updated to the data OPQ. That is, after the occurrence of the failure, the data of the disk device 21 is not updated, and the old data before the update remains.

The forced power-on section 43 forcibly turns on each of the disk power control means 3 for the plurality of disk devices 2. That is, when the disk power control unit 4 becomes uncontrollable, the forced power supply unit 43 forcibly turns on each of the disk power control units 3 (31 and 32).
I do. Specifically, for example, the disk power controller 4
1 is a case where a hardware failure has occurred. In this case, the system administrator manually inputs a predetermined command from outside the information processing apparatus. Thus, the signal (“1” or high level) forcibly turning on each of the disk power control units 31 and 32 by the forced power on unit 43
Is output. The signal for shutting off the disk power control means 3 is set to "0" or low level.

The output signal of the forced power supply section 43 is OR (O
R) Input to the gate circuit 44. OR gate circuit 44
, The output of the disk power controller 41 is also input. Therefore, the output of the OR gate circuit 44 is a signal for turning on the disk power control means 3 when a power on signal is output from either the disk power controller 41 or the forced power on section 43, and otherwise, Is a signal for shutting off the disk power control means 3.

The maintenance tool 6 performs processing for maintenance of the information processing system, and performs, for example, maintenance of a plurality of disk devices 2 as part of this processing. The system administrator who sees the lighting of the fault lamp 8 replaces the disk in the failed part of the failed disk device 2 and then executes the maintenance tool 6 to perform the inspection process and the copy process of the new disk device 2. to start. Maintenance Tool 6
Issues a predetermined control command to the mirror control driver 1 when activated. Further, the mirror control driver 1 sends a predetermined control command to the disk power controller 4 or the disk power controller 4 based on the command.
Issue to 1.

The disk power supply controller 41 of the disk power supply controller 4 responds to the turning on of the system power supply 7 by
Substantially in parallel with the start of the OS, prior to the start of the operating system, the state of the disk power control means 3 when the system power supply 7 is cut off or after a failure occurs is reconstructed. That is, the failed disk device 2 is known based on the state memory 42, and the interrupted disk power control means 3 is turned on for the failed disk device 2. Further, the disk power controller 41 of the disk power controller 4 starts the status memory 42 with the power of the disk power controller 3 of the failed disk device 2.
The status information of the disk device 2 in the above is updated from cutoff to insertion. Therefore, when the failed disk device 2 is disconnected, regardless of whether the system power supply 7 is turned on or off, the corresponding disk power control means 3
Is stored in the state memory 42 and the disk power control means 3 when the system power supply 7 is turned off.
Is reconstructed.

The information on the failure of the disk device 2 is managed and held by the mirror control driver 1, but disappears when the system power supply 7 is cut off. On the other hand, the state memory 42 holds state information about turning on and off of the corresponding disk power control means 3. According to the present invention, the disconnection of the disk power supply control means 3 is executed according to the failure of the corresponding disk device 2, so that the disk device 2
And the interruption of the disk power control means 3 always correspond. Therefore, after the system power supply 7 is turned off, the state memory 42
In the case where the system power supply 7 is kept turned on, the mirror control driver 1 can obtain information on the failure of the disk device 2 based on the above.

Next, the maintenance tool 6 checks the failed disk device 2 after turning on the disk power control means 3 of the failed disk device 2 (which has been newly replaced). This inspection is performed by, for example, verifying that predetermined data is written to the disk device 2 and then read to check whether the data is correct data.

Thereafter, when the inspection is completed correctly, the disk power controller 41 of the disk power controller 4 receiving the notification of the completion from the maintenance tool 6 makes the status memory 4
2, the disk device 2 in which the failure has not occurred is known, and the data stored in the disk device 2 in which the failure has not occurred is copied to the disk device 2 in which the failure has occurred.

For example, when the power of the information processing system is turned on again and the information processing system is restarted, the failed disk device 21 (disk # 1) is booted as shown in FIG. The disk device 22 (disk # 2), which has not failed, is booted. Therefore, the mirror control driver 1 updates (copies) the (old or incorrect) data XYZ of the disk device 21 to the data OPQ based on the (new or correct) data OPQ of the booted disk device 22.

When an error occurs in the inspection or copying, or when the inspection or copying is interrupted, the disk power controller 41 of the disk power controller 4 controls the disk power controller 3 for the disk device 2. It shuts off and the state memory 42
Is updated from the input to the shut-off.

The mirror control driver 1 blinks the fault lamp 8 during the copying, and turns off the fault lamp 8 after the copying is completed. Therefore,
The fault lamp 8 is turned on when the corresponding disk device 2 has failed, is turned on during the inspection, blinks during the copy, and is turned off when the copy is normally completed.

The mirror control driver 1, application 5, and maintenance tool 6 execute respective processing programs existing on a main memory (not shown) on a CPU (central processing unit, not shown). Is realized by:
In the information processing system of the present invention, these processing programs are also mirrored in the disk device 2.

FIG. 4 is a flowchart of the failure processing according to the present invention.

To operate the information processing system, the system power is turned on by the system administrator (step S1). The BIOS is started in response to the input.

In response to the input, the disk power controller 41 operates to reconstruct the state of the disk device 2 with reference to the state memory 42 (step S2). This processing will be described later with reference to FIG. After this, BIOS
Boots the normal disk device 21. Also, BIO
The OS loader is activated by S, whereby the main body of the operating system is activated, whereby the mirror control driver 1 is activated, and the application 5 can operate. The process in step S2 is completed immediately after the system power supply 7 is turned on, and is completed before the normal startup of the disk device 21 and the OS loader by the BIOS.

Thereafter, during the operation of the information processing system, the application 5 requests the mirror control driver 1 to read the data ABC, and in response, the mirror control driver 1 sends the data ABC to, for example, the disk device 2.
1 (step S3).

The application 5 performs a process using the read data ABC, and as a result, the data ABC is changed to data XYZ (step S4).

The application 5 requests the mirror control driver 1 to update the data ABC (write data XYZ), and in response, the mirror control driver 1 writes the data XYZ to both the disk devices 21 and 22 (step S5). That is, mirroring is performed. Steps S3 to S5 are repeated as appropriate.

Thereafter, during the operation of the information processing system, for example, a failure such as a data write failure occurs.
For example, it is assumed that an error has occurred in the disk device 21 (step S
6).

The mirror control driver 1 disconnects the failed disk device 21 from the information processing system (step S7). This processing will be described later with reference to FIG.

When the operation of the information processing system is completed, the system power supply 7 is turned off (step S8).

The information processing system is maintained by the system administrator (step S9). This processing will be described later with reference to FIG. In this maintenance process, since the disk power control means 31 of the failed disk device 21 has already been shut off, the information processing system is stopped (system power supply 7) as shown in FIG.
This can be performed not only during the shutdown of the information processing system, but also during the operation of the information processing system (while the system power supply 7 is turned on). Actually, it is often performed during the operation of the information processing system.

FIG. 5 is a flow chart of the separation process according to the present invention.

The mirror control driver 1 disconnects from the information processing system by prohibiting subsequent access from the application 5 to the failed disk device 21 (step S71).

The mirror control driver 1 operates the fault lamp 81 corresponding to the failed disk device 21.
Is turned on (step S72).

At the request of the mirror control driver 1,
The disk power controller 41 is configured to control the disk power controller 31 corresponding to the failed disk device 21.
Is interrupted (step S73).

The disk power controller 41 writes status information on the interrupted disk power control means 31 to the status memory 42 (step S74). Steps S72 to S74 constitute a failure process.

FIG. 6 is a flowchart of a maintenance process according to the present invention.

The system administrator removes the failed magnetic disk (slot) from the failed disk device 21 (step S91).

The system administrator inserts a new magnetic disk (slot) into the failed disk device 21 (step S92). Steps S91 and S92 constitute a magnetic disk exchange process.

When the system administrator activates the maintenance tool 6, the maintenance tool 6 starts predetermined maintenance processing.
The maintenance tool 6 checks the disk device 21 in which a new magnetic disk has been inserted (step S9).
3). This processing will be described later with reference to FIG.

The mirror control driver 1 copies the data of the disk device 22 that has been operating correctly without failure to the disk device 21 in which the new magnetic disk has been inserted (step S94). This processing will be described later with reference to FIG. Note that the inspection process in step S93 and the copy process in step S94 constitute a recovery process.

FIG. 7 is an inspection processing flow according to the present invention.

After the replacement processing, the system administrator activates the maintenance tool 6 (step S931).

The disk power controller 41 receives a request from the maintenance tool 6 via the mirror control driver 1
Turns on the disk power control means 31 of the disk device 21 that has been shut down in response to the failure (step S932).

The disk power controller 41 updates the status information in the status memory 42 to “G” in the status information of the NG disk power controller 31 and notifies the maintenance tool 6 of the update (step S933).

The maintenance tool 6 having received the notification performs an inspection by performing the above-described verification on the disk device 21 corresponding to the disk power control unit 31 whose status information has been updated from “NG” to “G” ( Step S93
4).

The maintenance tool 6 checks whether the verification has been completed normally (step S935). When the processing is completed normally, the inspection processing is completed, and the normal completion is notified to the mirror control driver 1.

If the operation is not completed normally, the maintenance tool 6
Notifies the mirror control driver 1 of the abnormal end, and the notified mirror control driver 1 turns on the fault lamp 81 corresponding to the disk device 21 (step S
936).

At the request of the maintenance tool 6 (or the mirror control driver 1), the disk power controller 41
Turns off the disk power control unit 31 corresponding to the disk device 21 (step S937).

The disk power controller 41 writes the status information about the interrupted disk power control means 31 to the status memory 42 (step S938). In addition,
Steps S936 to S938 constitute failure processing.

FIG. 8 shows a copy processing flow according to the present invention.

Following the inspection processing, the mirror control driver 1 which has been notified of the normal end of the inspection from the maintenance tool 6
Copies the data stored in the other disk device 22 to the disk device 21 corresponding to the disk power control unit 31 whose status information has been updated from "NG" to "G" (step S941).

The mirror control driver 1 blinks (alternately turns on and off) the fault lamp 81 corresponding to the disk device 21 (step S942).

The mirror control driver 1 checks whether the copy processing has been completed normally (step S943).

When the process is normally completed, the mirror control driver 1 turns off (turns off) the blinking fault lamp 81 (step S944).

If the process has not been completed normally, the mirror control driver 1 turns on the fault lamp 81 corresponding to the disk device 21 (step S945).

Upon request from the mirror control driver 1,
The disk power supply controller 41 operates the disk device 2
Then, the disk power control means 31 corresponding to No. 1 is shut down (step S946).

The disk power controller 41 writes status information on the interrupted disk power control means 31 to the status memory 42 (step S947). In addition,
Steps S945 to S947 constitute a failure process.

FIG. 9 is a flowchart of a disk state rebuilding process according to the present invention.

When the system power supply 7 is turned on (step S1), the BIOS is started (step S21).

When the system power supply 7 is turned on (step S1), the disk power supply controller 41 reads out the state information on all the disk devices 21 and 22 stored in the state memory 42 (step S22). Therefore, the disk state rebuilding processing of FIG. 9 is executed in step S2.

The disk power controller 41 shuts off the disk power controller 31 whose status information is "NG" (step S23). Incidentally, the disk power control means 31 is also turned on in response to the turning on of the system power supply 7, and the disk power control means 31 whose status information is "G" is maintained in the turned on state.

The BIOS boots (starts up) the disk device 22 corresponding to the supplied disk power control means 32 (step S24).

The disk power controller 41 notifies the mirror control driver 1 of the disk power control means 31 whose status information is “NG” (interrupted), and the mirror control driver 1 having received the notification notifies the mirror control driver 1 that the status information is “NG”. , The corresponding fault lamp 81 is turned on (turned on) for the disk device 21 corresponding to the disk power control means 31 (step S25). Steps S22 to S25 constitute a failure process.

FIG. 10 is an explanatory diagram of a multiplexing process according to the present invention, which is compared with FIG.

As shown in FIG. 10A, the same data ABC is stored in the mirrored (duplexed) disk device 2.
Is written. When the information processing system is started in this state (step S1), after rebuilding the disk state (step S2), for example, one of the disk devices 21
(Disk # 1) is booted.

Thereafter, as shown in FIG. 10B, the data ABC is read from the disk device 21 (step S3), and is changed to data XYZ by the application 5 (step S4). The mirror control driver 1 includes not only the disk device 21 but also the other disk device 22
The data ABC on (disk # 2) is also data XYZ
(Step S5).

Thereafter, as shown in FIG. 10C, the mirror control driver 1 attempts to update the data XYZ to the data OPQ (steps S3 to S5). Cannot be written to (step S6). The mirror control driver 1 that has detected the occurrence of the failure disconnects the failed disk device (hereinafter, failure device) 21 from the information processing system (step S7). That is, the mirror control driver 1
Prohibits the application 5 from accessing the failed device 21, turns on the fault lamp 81, shuts off the disk power control means 31 (by the disk power controller 41), and records this in the state memory 42. After the occurrence of the failure, the data of the failed device 21 is not updated, and the old data before the update remains.

After that, the system administrator who has noticed the occurrence of the failure by looking at the fault lamp 81 performs maintenance while the information processing system is operating (while the system power supply 7 is turned on) (step S9). That is, the system administrator specifies the location of the failure and replaces the failed device (disk) in the failed device # 1 (steps S91 and S92).
The maintenance tool 6 is started.

The inspection processing of FIG. 7 is performed by the activated maintenance tool 6, and the copy processing of FIG. 8 is performed by the mirror control driver 1. That is, the mirror control driver 1 uses the (old or incorrect) data OPQ of the disk device 22 based on the (new or correct) data OPQ of the disk device 22 that is operating normally (the corresponding disk power control means 32 is not shut off). D) Update data XYZ to data OPQ. Thereby, based on the correct program or data of the disk device 22, the incorrect program or data of the disk device 21 can be updated to the correct one.

On the other hand, the system power supply 7 may be shut down without performing maintenance on the failed disk device 21. In this case, the disk device 21 stores an erroneous program or data, but the disk power control unit 31 is shut off according to the present invention.

The system power supply 7 is turned on again to operate the information processing system. When the power is turned on again, the state of the disk power control means 3 is reconstructed, and based on this, as shown in FIG. 10D, the failed disk device 21 is not booted and the failed disk device 22 is not booted.
(Only) is booted (steps S21 to S2)
5). Therefore, loss of the correct program or data of the disk device 22 is prevented.

Thereafter, in the same manner as described above, the maintenance tool 6 is started by the system administrator who has performed maintenance on the failed disk device 21, and the inspection process shown in FIG. 7 is performed. Copy processing is performed. This prevents the correct program or data in the disk device 22 from being lost and prevents the disk device 2
One erroneous program or data can be updated to a correct one.

[0101]

As described above, according to the present invention,
In an information processing system, disconnecting a failed disk device among a plurality of disk devices and shutting off its disk power control means not only prohibits access to the failed disk device from an application, but also Since it is possible to put the information processing system into a state in which it cannot be physically operated, it is possible to prevent a failed disk device from being booted when the information processing system is restarted and the information processing system is restarted. As a result, it is possible to prevent erroneous updating of data in a disk device in which a failure has not occurred based on data stored in a disk device in which a failure has occurred.

[Brief description of the drawings]

FIG. 1 is a principle configuration diagram of the present invention.

FIG. 2 is a configuration diagram of an information processing system.

FIG. 3 is an explanatory diagram of a multiplexing process.

FIG. 4 is a failure processing flow.

FIG. 5 is a flowchart of a disconnection process.

FIG. 6 is a flowchart of a maintenance process.

FIG. 7 is an inspection processing flow.

FIG. 8 is a copy processing flow.

FIG. 9 is a flowchart of a reconstruction process.

FIG. 10 is an explanatory diagram of a multiplexing process.

FIG. 11 is an explanatory diagram of a conventional technique.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Disk control part 2 Disk device 3 Disk power control means 4 Disk power control part 5 Application 6 Maintenance tool

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Noboru Takemura 98, Unoki-nu, Unoki-cho, Kawakita-gun, Ishikawa Pref. Inside PFU Inc. (72) Inventor Yuya Yamakawa, Unagi-nu 98, Unoki-cho, Kawakita-gun, Ishikawa Address No. 2 PFU Co., Ltd. (72) Inventor Kazuhiro Shimada 98 Uno-ki, Unoki-cho, Kawakita-gun, Ishikawa Pref. 98-2 Inventor Pfu Co., Ltd. (98) Inventor Yoshiki Fushimi 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa F-term in Fujitsu Limited (Reference) 5B065 BA01 CC08 EA12 ZA02 5D044 AB01 CC04 HH17 HL02 HL08

Claims (11)

[Claims] 1. A disk control unit for controlling writing and reading to and from a plurality of disk devices and detecting a failed disk device from among the plurality of disk devices, and in accordance with an instruction from the disk control unit And a disk power control unit for controlling power supply to the failed disk device. 2. A plurality of disk devices; a disk power control means provided for each of the plurality of disk devices; a control of writing and reading to and from the plurality of disk devices; A disk controller that detects a failed disk device; and a disk power controller that controls the disk power controller for the failed disk device in accordance with an instruction from the disk controller. A disk processing device characterized by the above-mentioned. 3. The disk processing device according to claim 2, wherein the disk control unit performs a multiplexing process on the plurality of disk devices. 4. The disk processing device according to claim 2, wherein said disk processing device further comprises means for displaying a status of said disk device for each of said plurality of disk devices. 5. The disk processing device further comprises a system power supply of the information processing system, wherein the disk power control unit shuts off the disk power control means for the failed disk device, At the time of stoppage and subsequent injection,
3. The disk processing apparatus according to claim 2, wherein the interrupted disk power control means is maintained in the interrupted state for the failed disk device. 6. The disk processing device is further provided separately from the plurality of disk devices, and retains state information on the on / off state of the disk power control means for each of the plurality of disk devices. 3. The disk processing apparatus according to claim 2, further comprising: a state memory configured to write the state information of each of the plurality of disk devices to the state memory. 7. The disk processing device further includes a maintenance tool for maintaining the plurality of disk devices, and the disk power controller controls the failure based on the status memory in response to a request from the maintenance tool. 7. The disk processing device according to claim 6, wherein the disk device in which the failure has occurred is notified, and the interrupted disk power control means is turned on for the failed disk device. 8. The disk power control unit updates the status information of the disk device in the status memory from cut-off to power-on when the disk power control unit of the failed disk device is turned on. The disk processing apparatus according to claim 7, wherein: 9. After the disk power control means of the failed disk device is turned on, the maintenance tool checks the failed disk device, and thereafter, the disk control unit performs a check based on the status memory. 8. The disk processing device according to claim 7, wherein the disk device in which the failure has not occurred is known to copy the data stored in the disk device in which the failure has not occurred to the disk device in which the failure has occurred. 10. When an error occurs in the inspection or copying, or when the inspection or copying is interrupted, the disk power control unit shuts off the disk power control means for the disk device. 10. The disk processing apparatus according to claim 9, wherein the status information about the disk device in the status memory is updated from input to shut off in response to the request. 11. The disk processing device further comprises a forced power-on unit for forcibly turning on each of the disk power control units for the plurality of disk devices, and the disk power control unit becomes uncontrollable. 3. The disk processing apparatus according to claim 2, wherein the forced power-on unit forcibly powers on each of the disk power control units.