JPS6023375B2 - Dynamic device reconfiguration control method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention provides a dynamic device reconfiguration control method, in particular, when a failure occurs in a magnetic recording device with a removable medium, an operator can replace the medium with any other suitable device. , relates to a dynamic device reconfiguration control method in which the system automatically recognizes the device as a replacement device.

As the scale and capacity of computer systems increase, the degree of impact caused by failures also tends to increase.

Therefore, while improving system reliability, techniques for reconfiguring equipment, such as restoring functionality or localizing the effects when a failure occurs, are becoming increasingly important. In particular, in the case of a failure in a magnetic recording device such as a magnetic disk device whose volume, or recording medium, can be replaced, if the recorded information is not destroyed, processing may be able to continue as is by reconfiguring it. Important factors include consistency of processing, operability for operators, and availability to enable efficient and flexible use of equipment. As mentioned above, dynamic device reconfiguration refers to reconfiguration that attempts to recover functionality even if a device failure occurs without interrupting the system and without abnormally terminating input/output requests to the secure device. That is, dynamic device reconfiguration is planned and processed as follows. For example, if an error is detected during execution of an input/output operation to a medium exchangeable device such as a magnetic disk device, recovery is attempted by retrying a fixed number of times. However, if the error cannot be recovered even after retrying, the system determines that the device has a permanent failure and gives up on recovery with that device. At this time, if the medium in that device is removable, an empty device of the same type is searched for, and the medium on the device in which the error occurred is transferred to the empty device. When the media is transferred, the system automatically aligns the magnetic head with the argument or write position at the time the error occurred, such as by using a positioning seek command, and updates the channel program (CCW) that caused the error.
) to run on the new device. In this way, unless the cause of the error is due to the medium, the input/output request can be processed as if no failure had occurred. In the process described above, in conventional device reconfiguration control, when allocating a replacement device (hereinafter referred to as "TO device"), the logic on the system side searches for and allocates it, and then
The operator was instructed to change the medium from the TO device (hereinafter referred to as "TO device") to the TO device.

In particular, when selecting a TO device, in order to avoid conflicts with device allocation from various jobs, which are processing units for resource allocation, and to perform conflict control, it is necessary to select an empty device or system in advance in order to perform serialization with device allocation processing. I was trying to find the spare equipment I had secured. However, in the conventional device reconfiguration control as described above, there are problems in the following cases, which are difficult to solve.

That is, this is the case when a configuration is adopted in which a device to be reconfigured is shared by a plurality of systems.

FIG. 1 is a conceptual diagram of a system configuration of a plurality of systems that are loosely coupled, and shows a state in which an auxiliary storage device is shared by a plurality of systems. In the figure, 1 is the central processing unit (CPU), 2 is the channel device (CH), and 3 is the input/output control device (IOC).
, 4 represent shared auxiliary storage. In the system configuration shown in Figure 1, if a failure occurs in the auxiliary storage device 4 shared by multiple systems (hereinafter referred to as "intersystem shared device"), in the conventional device reconfiguration control method, each This is because the system has independent device allocation logic, and the occurrence of a failure can only be detected after input/output processing is executed, resulting in a time lag in failure detection in each system. There are problems in that it is not possible to uniformly select the TO device in the entire system, and it is not possible to serialize the device allocation process in the pond system. The following method may also be considered as other device reconfiguration control.

In this method, when a failure occurs, the machine number plug, which determines the address of the device that forms part of the access path for executing input/output, is replaced together with the medium at the same time, thereby omitting the procedure of securing a replacement device. According to this method, although the physical device changes, the input/output device address to be accessed does not change, so it appears to the operating system as if the same device is being accessed. However, in this method, in order to keep the input/output device address the same as before the failure and to prevent it from overlapping with other input/output device addresses, the replacement range is a host device that is the same as the hard drive device, for example, the same magnetic disk switch. It is limited to devices under the device (also called string switch). For this reason, it is necessary to prepare a spare device that can be replaced on a string-by-string basis, and there is a problem in that a splitting loss occurs and a large amount of waste must be accepted. The present invention solves the above drawbacks and
The purpose of this invention is to enable dynamic device reconfiguration control that does not limit the range of exchange, regardless of whether the device is shared between systems or not, and to improve the availability of devices and the reliability of the system.

Therefore, in the dynamic device reconfiguration control method of the present invention, in a dynamic device reconfiguration control method that restores the function of a magnetic recording device equipped with a replaceable magnetic recording medium in the event of a failure, When a removed magnetic recording medium is reinstalled in another unused magnetic recording device of the same type, a hardware interrupt from the new magnetic recording device into which the medium has been installed is triggered. means for reading the medium identifier and/or volume serial number of the medium; and means for checking whether the medium identifier, etc. matches the medium identifier, etc. installed in the magnetic recording device in which the failure has occurred; The present invention is characterized by comprising means for recognizing and assigning the magnetic recording device that caused the medium loading completion interrupt as a replacement device to replace the failed device. This will be explained below with reference to the drawings. FIG. 2 is an explanatory diagram illustrating the hardware operation of the present invention using a magnetic disk device in a two-system system configuration as an example, and FIG. 3 is an illustration of the configuration of an embodiment of the dynamic device reconfiguration control method of the present invention. An explanatory diagram for explanation is shown.

In the figure, VOL is the volume label, VSN is the volume serial number, EQC is the device check, IRQ is the intervention request,
PCI is pack exchange interrupt or media loading completion interrupt,
UNIT is a device, 5 is a system 0 system, 6 is a system 1 system that is loosely coupled with the system 0 system, 7 is an input/output Z force (1/0) processing unit provided for each system, and 8 is the same type. 9 represents a group of magnetic recording devices, and 9 represents an operator console device, respectively. Now in the example of Figures 2 and 3,
Input/output from access source 10 of system 0 system 5 (1/0)
There is a request 2, the 1/0 request reception processing unit 11 accepts the request, and the 1/0 request execution processing unit 12 operates to send the device “UNIT; Suppose that a failure in the magnetic disk drive device is detected (EQC in FIG. 2).

The 1/0 request pending processing unit 13 in the 1/0 processing unit 7 of the system 0 system 5 stores the 1/0 event that encountered the failure as pending completion of reconfiguration of the failure device “UNIT=A”. At the same time, the operator is instructed to change the medium to any empty device that is not yet installed (FIG. 3, 14). Also, if the operator accesses "UNIT=A" from another system, for example system 1 system 6, while the operator is removing the medium, an intervention request, that is, a not ready (N
ot-Ready) state hardware report (Figure 2 I)
RQ) is made, so in this case as well, the 1/0 event is held pending as it waits for an operator intervention request (Fig. 3, 13).
).

If the operator selects any uninstalled device, e.g. UNIT=B
When a media replacement operation is performed to enable access to the medium, a pack replacement interrupt, that is, a hardware interrupt indicating that media loading is complete, is sent to the 1/0 processing unit 7 of each of the systems 0 and 1. The information is reported to the PCI reception processing unit 15 located at (FIG. 2 PCI).

The VOL reading processing unit 16 in the 1/○ processing unit 7 of each system that receives the pack exchange interrupt reads the volume label VOL of the attached medium (Read in FIG. 2). If a new error occurs during volume label reading processing in the VOL reading processing unit 16,
Since the volume cannot be identified, the unload processing unit 19
In other words, control is transferred to a processing section for removing the medium. When the volume label can be read normally, the volume serial number VSN in the volume label read by the VSN verification processing unit 17 and the volume information of other devices already installed are stored in the diagram. Volume serial number VSN in the omitted control table
Compare and find a match.

The volume serial number VSN is assigned to uniquely identify a medium in the system, so if a matching volume serial number VSN does not exist, it means that a new medium unrelated to the failure has been installed. However, if there is a matching volume serial number VSN, it means that the media installation is related to dynamic device reconfiguration. In the above, if there is no match, control is transferred to the normal mount processing unit 20, that is, the new volume mounting processing unit. If the volume serial numbers match, the old device with the same volume serial number, ie, UNIT=A, is recognized as the FROM device, and the pack exchange interrupt device, ie, UNIT=B is recognized as the TO device, and it is determined that a device exchange for dynamic device reconfiguration has been performed. Then, the next U
Control is transferred to the NIT verification processing section 18.

Since the TO device is arbitrarily selected by the operator, the UNIT verification processing unit 18 checks its suitability, for example, whether the TO device and the FROM device are the same type of device, or (ii) whether they are in an operable state. Is there (iii
) Check whether the TO device can be allocated, such as whether the job has already been allocated.

If the TO device is rejected, control is transferred to the unload processing unit 19 to notify the operator of the TO device's ineligibility and to remove the medium. If it passes as a TO device, it waits for a certain period of time to synchronize with other systems. After that, in order to confirm that the TO device passes the test in the pond system, a TEST I/0 operation for checking the ready status is issued (TEST I/○ in FIG. 2).
As a result of TEST I/○ operation, an intervention request (N
If the ot-Ready state is detected, it means that the TQ device is unsuitable in another system, so control is transferred to the unload processing unit 19 and a normality report (Re
If the TO device is in the ``ady'' state), it means that the eligibility of the TO device in the entire system has been confirmed, and the processing by the replacement device securing processing section 21 begins. The replacement device securing processing unit 21 performs processing to keep the TO device in use and not allocating it to other jobs, and then transfers control to the swap processing unit 22 to secure one of the FROM device and TO device. /0 table switching or 1/0 held in FROM device
Performs processing such as reconnecting the event to the 1/0 event queue of the TO device.

Next, the 1/0 request execution processing unit 12 gives the TO device an opportunity to schedule an input/output request, and causes the TO device to re-execute the 1/0 event that encountered the failure. If the result is normal,
1/0 from the end notification processing unit 23 to the access source 10
Provides notification that the request was successfully processed. Note that the VOL reading processing section 16 or the UNIT verification processing section 18
The unload processing unit 19 to which the control has been transferred outputs each error message to the operator console device 9 to notify the operator of the abnormality, and also stops the rotation of the loaded medium and unloads it so that it can be removed. .

Each system 5 or 6 waits until the medium is loaded into a new device again and a pack exchange interrupt PCI occurs. By configuring as described above, the dynamic device reconfiguration control of the present invention can be realized by automatically allocating a replacement device in response to a pack replacement interrupt.

It goes without saying that the device to which the present invention is applied is not limited to a magnetic disk device, but may be any magnetic recording device in which the device and the recording medium can be separated and the medium can be uniquely identified. As explained above, according to the present invention,
Device reconfiguration control for the inter-system shared device, which could not be achieved with the conventional method of searching for a replacement device in the system and replacing the medium with that device, becomes possible, and as a result, the availability of the device is improved.

In addition, the operator's operability is very good because all that is required is to replace the soot body in any empty device. Compared to a system in which machine number plugs are replaced at the same time, the range of possible replacements is wider, so the availability of the equipment is higher and there is less loss in terms of securing spare equipment for replacement. In addition, even if the pack is replaced at any time, irrespective of the occurrence of a failure and whether or not an input/output operation is being executed, the system will process the system without any inconsistency.

[Brief explanation of the drawing]

Fig. 1 is a conceptual diagram of the system configuration of multiple systems that are loosely coupled, Fig. 2 is an explanatory diagram explaining the hardware operation in an embodiment of the present invention, and Fig. 3 is a dynamic device regeneration diagram of the present invention. An explanatory diagram illustrating the configuration of an embodiment of the configuration control method is shown. In the figure, numeral 4 represents an auxiliary storage device shared between systems, 5 or 6 each system, 7 a 1/0 processing section, 8 a group of magnetic recording devices of the same type, and 9 an operator console device. ★'Dimensional size 2 size size 3 size size

Claims (1)

[Claims] 1. In a dynamic device reconfiguration control method that restores functionality in the event of a failure of a magnetic recording device equipped with a replaceable magnetic recording medium, the magnetic recording medium removed from the failed magnetic recording device is placed in another unused state. When the medium is reinstalled into a magnetic recording device of the same type in the same type of magnetic recording device, the medium identifier and/or volume serial number of the medium is read, triggered by a hardware interrupt from the new magnetic recording device to which the medium is installed. means for checking whether the medium identifier, etc. matches the medium identifier, etc. installed in the magnetic recording device in which the failure has occurred, and if they match, the magnetic recording device that caused the medium installation completion interrupt is A dynamic device reconfiguration control method comprising: means for recognizing and assigning a replacement device as an alternative to the failed device.