Distributed Subsystem Sparing

The present invention relates generally to RAID systems and in particular to a method for sharing spares across two or more arrays in a multiple array system.

A data processing system typically comprises a central processing unit (CPU) and a storage subsystem linked through an appropriate interface and control system. The subsystem includes a plurality of storage units such as high capacity direct access storage devices (DASDs). An economical alternative to high-end DASD is a subsystem comprising redundant arrays of inexpensive disks (RAID). A number of RAID architectures are described in a foundational article entitled "A Case for Redundant Arrays of Inexpensive Disks (RAID)", by D. A. Patterson et al., Report No. UCB/CSD 87/391, December 1987, incorporated herein by reference.

A number of early storage subsystems provided redundant secondary devices for duplicating data as a back up to primary devices in the event of drive failure. Such redundancy improves system reliability, but substantially decreases the data capacity of the subsystem because substantial space is required for duplicated data.

In a more efficient redundancy method, data is "striped" or distributed across the plural devices of a storage array rather than being written to a single storage device. For example, a storage system may include N+P devices. Each device further includes a plurality of predefined data regions that may be the size of a disk block, multiple disk blocks, a track, a cylinder, etc. An incoming data stream comprises N logically consecutive data blocks which are distributed to corresponding addresses of N array devices. The blocks are the same size as the predefined data regions and are distributed such that no two blocks of data from the same transfer unit reside on the same device. Parity information is generated for the N blocks and is stored on a separate device P. A group of data blocks and corresponding parity are called a parity group and are represented as (N+P). The size of the parity group is determined by the number of devices, N+P, in the subsystem.

In the event of a single device failure, no more than one data block of each parity group will be lost, due to the manner in which stored data and parity are distributed. The lost data can be reconstructed from the remaining data and parity blocks residing on other devices. The combination of striping and parity thus assures that a single device failure will not result in unrecoverable data loss. Data distribution over a plurality of failure independent DASDs is disclosed in commonly assigned U.S. Pat. No. 4,092,732 to Ouchi. Benefits of data striping are discussed further in a paper entitled "Disk Striping" by K. Salem and H. Garcia-Molina published in the IEEE 1986 Int'l. Conf. on Data Engineering, pp. 336-342.

Data striping and parity are features of RAID levels two, three, four and five. In RAID levels two and three, a subsystem includes N synchronized data devices and at least one dedicated parity device. Data must be transferred synchronously to the N+P devices in fixed "data transfer units" having exactly N data blocks. A data block is the size of a predefined data region in the storage devices. In contrast, the devices in RAID four and five subsystems are asynchronous, allowing data to be transferred in units of less than N blocks. Level four has a dedicated parity device. In RAID five, parity is distributed across the N+P failure independent drives.

Device arrays representative of RAID three, four and five are shown below. Data regions are assumed to be 512 bytes for illustration purposes only. ##STR1##

The RAID three array comprises N=4 data devices, d1-d4, and a single dedicated parity device, ck1. Each data transfer unit consists of N*512 bytes, which are synchronously distributed across the N=4 data devices. For example, four data blocks, a0-a3, form data transfer unit D0. These blocks are distributed to corresponding address locations on the N data devices, as shown. Parity block P0, also 512 bytes, is simultaneously written to device ck1. Blocks a0-a3 and P0 form a first parity group in the first row of the array (addresses 0-511 of each device). Each subsequent row similarly holds a parity group. Note that no two blocks from the same parity group reside on the same device.

The RAID four array comprises N=4 data devices and one dedicated parity device. Data blocks D0-D15 are distributed asynchronously to the subsystem array. Parity information is generated for each row of data and is stored on drive ck. Each row forms a parity group. For example, a first parity group includes data blocks D0-D3 and parity block P0.

The RAID five array consists of five devices. Data blocks D0-D19 are distributed asynchronously across all five devices. There is no dedicated check device, since parity is distributed across all of the devices of the array, as shown. Again, each row forms a parity group. E.g., data blocks D0-D3 and parity block P0 form the first parity group. An example of a subsystem with distributed data and distributed parity is disclosed in commonly assigned U.S. Pat. No. 4,761,785 to Clark et al.

Data striping is desirable in storage subsystems for large data transfers because it provides faster transfer rates by accessing multiple disks at the same time, rather than writing large amounts of data to a single devices. Parity schemes provide the additional benefit of improved system reliability.

For convenience, a device array is treated as a matrix of columns and rows. The "columns" comprise the array devices, N+P, which are further subdivided into M predefined data regions. Each region of a device is identified by a unique range of physical addresses. For example, in the RAID 5 system shown above, addresses 0-511 delimit the first region of each device, addresses 512-1023 delimit the second region, and so forth. Corresponding regions of the array comprise "rows". This nomenclature permits one to define a subsystem array as an M X (N+P) array. A sample M X (N+P) RAID 4 array having three columns (N+P, N=2, P=1) and M=3 "rows" is shown in Example 1.

In a distributed data subsystem with parity, a single device failure results in the loss of a maximum of M blocks of information. A DATA block is restored from the remaining data and parity blocks of its parity group. For example, if device d1 of Example 1 were to fail, blocks D0, D2 and D4 would be lost. Block D0 is reconstructed by reading blocks D1 and P0 on failure independent devices d2 and d3, and recreating the lost block according to known recovery procedures. Lost PARITY blocks are restored by generating new parity information from the remaining data blocks of the parity group. For example, if device ck1 of Example 1 fails, parity block P0 is regenerated from data blocks D0 and D1 on intact devices d1 and d2.

Data restoration requires sufficient available (i.e. spare) regions within the array to hold newly restored blocks of information. One method for assuring that sufficient space is available is to provide a "dedicated spare", i.e. an additional device within the array dedicated to data restoration. A dedicated spare must include at least M spare regions for holding the maximum of M blocks of reconstructed data that are lost in a device failure. A RAID 5 array including M=3 parity groups and a spare device is shown in Example 2, below. The array is referred to as an (N+P+S) configuration.

A single device failure and recovery has depleted the array in Example 3 of spare space. If the subsystem includes multiple arrays of devices, dedicated spares may be shared among the arrays. Thus if a second device failure now occurs in the array of Example 3, lost data may be rebuilt in the dedicated spare of another array. When all spare space has been depleted in the subsystem, manual drive replacement becomes necessary.

If the array of Example 3 were a single-array subsystem, a second device failure would require immediate drive replacement. Reliability can be enhanced by providing a second dedicated spare, thereby doubling the amount of spare space. The resulting system may be represented as A=(N+P+S, S=2) and is capable of recovering from two nonconcurrent device failures before depleting its available spare space. (The failure of a second device which is concurrent with the data recovery process from a first device failure will result in the permanent loss of some data). A RAID 5 (N+P+S, S=2) dedicated sparing array is shown in Example 4.

An alternative to the dedicated sparing approach is a "distributed sparing" scheme, wherein spare regions are distributed across multiple devices. Distributed sparing improves performance in arrays having asynchronously accessible devices, since data can be reconstructed on several devices at the same time. Commonly assigned U.S. Pat. No. 5,258,984 describes a distributed sparing method in which at least one spare region is provided for each parity group of an array. An example of a RAID 5 (N+P+S, S=1) array with distributed sparing is shown in Example 5, below.

Distributed sparing offers a number of advantages over a dedicated sparing approach. One advantage is that all devices within the array are in use, improving overall system performance. For example, four devices are in use in the distributed sparing array of Example 5, whereas only three devices are operating in the dedicated sparing array of Example 2. Moreover, since dedicated spare devices are inoperative until data restoration is required, there is no assurance that spare devices will function properly when needed. By having all devices in use, the risk of latent drive malfunctions is avoided. Another advantage, as previously mentioned, is improved system performance due to parallel data reconstruction.

A problem with distributed sparing arrays is that of sharing spares between multiple subsystem arrays. This problem is discussed in greater detail below.

It is desirable for all arrays of a subsystem to share available spare space, thereby delaying the need for manual drive replacement as long as possible and improving overall system fault tolerance.

To illustrate, a subsystem might include the following RAID 5 arrays: A.sub.1 =(N.sub.1 +P), A.sub.2 =(N.sub.2 +P+S.sub.2, S.sub.2 =1) and A.sub.3 =(N.sub.3 +P+S.sub.3, S.sub.3 =2). Without the ability to share spares between these arrays, spare space within the subsystem is not used efficiently. For example, the A.sub.2 array would require drive replacement after two device failures even if spare space is still available in array A.sub.3. Furthermore, A.sub.1 could not recover from a device failure because it lacks spares altogether. As such, the subsystem described does not use spare space efficiently.

Distributed spare sharing is not as straightforward as sharing dedicated spare space. One problem is that of dealing with differences in array dimensions. To illustrate, consider the RAID 5 shown below. ##STR8## If a failure occurs in device d1 of array A.sub.1, three blocks of information must be reconstructed (i.e., D0, D3 and P2). Array A.sub.1 does not have any spare regions, but because at least three spares are available on both A.sub.2 or A.sub.3, the data lost in A.sub.1 may be reconstructed in either array. A problem arises, however, if a device failure results in the loss of more data blocks than available spare space. To illustrate, it will be assumed that two device failures have occurred on array A.sub.3, as shown below, depleting the spares within that array. Failed devices are indicated by a column of X's and reconstructed data is designated in boldface.

A.sub.3 after a device failure in d6, ##STR9## A.sub.3 after a device failure in d5, ##STR10## Upon a third device failure it would be desirable to reconstruct the lost data within the spare space of another subsystem array. For example, if device d1 of array A.sub.3 fails, five blocks of information are lost (i.e., D0, D4, D8, P3 and P4). Thus five spare regions are needed for data reconstruction. But there are only three spares are available in the subsystem, i.e. on array A.sub.2. Since three spares are insufficient for reconstruction of five blocks, the option of spare sharing between A.sub.3 and A.sub.2 is eliminated in this situation.

In short, distributed sparing schemes do not allow efficient use of subsystem spare space unless spares can be shared between arrays. However, arrays with distributed spares often vary from one another in dimensions. Consequently, the number of spares available in each array having distributed spares will also vary. Ultimately, there is no assurance that sufficient spares will exist on one array to accommodate the loss of information on another array, i.e. arrays must be compatible in order for spare sharing to work.

What is needed is a method for configuring a storage subsystem comprising a plurality of arrays to assure compatibility of arrays for sharing distributed spare space across array boundaries. Spare sharing uses the spare space within a subsystem more efficiently.

Another consideration related to distributed spare sharing is that of remapping the logical to physical address of the reconstructed data from its original location within a first array to its new location within the spare space of a second array. Remapping involves updating a table in subsystem memory to reflect the new array, device, cylinder and head address of each block of restored data or parity. Such remapping is easily implemented according to methods known by those having ordinary skill in storage management.

It is therefore a principal object of the present invention in a storage subsystem comprising at least a first and a second array of storage devices, wherein a first array includes distributed spares, wherein a second array has experienced a device failure and has no spare space available for data reconstruction, to provide a subsystem configured to assure compatibility between the two arrays so that distributed spare sharing may take place.

It is a further object of the invention to improve overall subsystem fault tolerance by using spare all space within a distributed sparing subsystem more efficiently than similar, presently known subsystems.

Another object of the present invention is to provide a method for sharing of distributed spares between two or more subsystem arrays, each having a different number of devices.

A further object of the present invention is to increase the reliability of a subsystem comprising a plurality of arrays without causing a corresponding decrease in data capacity.

Accordingly, the present invention is a method for configuring a storage subsystem comprising at least two device arrays to enable sharing of distributed spare space across array boundaries.

At least a first array, A.sub.1, is configured as an (N.sub.1 +P.sub.1 +S.sub.1) group. That is, N.sub.1 +P.sub.1 +S.sub.1 devices or "columns" are provided, and each column is further subdivided into M regions for holding blocks of information. The array accommodates M (N.sub.1 +P.sub.1) parity groups distributed across the M "rows" or stripes of the array, preferably such that no two blocks of a parity group reside on the same device. Each row further includes S.sub.1 blocks of reserved spare space such that at least S.sub.1 *M spares are reserved in the first array. The spares are distributed across the N.sub.1 +P.sub.2 +S.sub.1 devices rather than being reserved on a single device. The number of spares provided per row, S.sub.1, is greater than zero.

At least a second array, A.sub.2, includes N.sub.2 +P.sub.2 +S.sub.2 devices which are similarly subdivided into M regions. A maximum of M (N.sub.2 +P.sub.2) parity groups are distributed across the second array, one per "row", preferably such that no two blocks from the same group reside on the same storage device. Array A.sub.2 includes S.sub.2 *M distributed spares, where the value of S.sub.2 may be zero or greater.

In the event of a device failure in A.sub.2, a maximum of M blocks of data and/or parity will be lost and will require reconstruction. Reconstruction is performed according to presently known methods, depending on the particular redundancy scheme of the subsystem. For example, according to one commonly used method, parity is generated by exclusive OR-ing the data blocks of a parity group. A data block may be restored by retrieving the remaining blocks of its parity group, including parity, and logically XOR-ing them to create a new data block. A parity block is reconstructed by retrieving the intact data blocks of the same group and XOR-ing them to create a new parity block.

A maximum of M spare regions are needed to hold the newly constructed blocks. According to the present invention, the first and second arrays, A.sub.1 and A.sub.2, have specifically been configured to have a same number of rows, assuring that at least M spare regions, each large enough to hold a data block, will be available on the first array to accommodate the reconstructed information (provided that all spare space within the first array has not been depleted first by device failures on that array). The reconstructed blocks of A.sub.2 are stored in M distributed spares of A.sub.1, and the mapping tables associated with each array are updated to reflect the new physical block addresses.

Storage subsystems may comprise a plurality of arrays. The present invention is directed to permitting sharing of distributed spares between at least two arrays of a multiple-array subsystem. In the ideal subsystem, however, each array is configured to have M rows or stripes, regardless of array type, so that distributed spares available in any array can be shared with any other array of the subsystem.

The foregoing and other objects, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments of the invention, and from the accompanying figures of the drawing:

FIGS. 1(a)-(b) are two examples of storage subsystems connected to a CPU through an appropriate interface;

FIG. 2 represents the states of two device arrays in a storage subsystem with a device failure on Array A1;

FIG. 3 is shows the states of the arrays of FIG. 2 after data restoration according to a presently known method;

FIG. 4 represents the states of two device arrays in a storage subsystem with a device failure on Array A2;

FIG. 5 is a flow diagram illustrating the distributed spare sharing method of the present invention;

FIG. 6 shows the state of the arrays of FIG. 4 after data restoration according to the present invention;

FIG. 7 represents the states of two device arrays in a storage subsystem with a device failure on Array A1;

FIG. 8 shows the states of the arrays of FIG. 7 after data recovery from the first device failure and with a second device failure in Array A1; and

FIG. 9 shows the state of the arrays of FIG. 8 after data recovery from the second device failure according to the present invention.

The distributed spare sharing method of the present invention will now be described with initial reference to FIGS. 1(a) and 1(b), which show two alternative architectures for linking a host computer central processing unit (CPU) 11 to an array subsystem. In FIG. 1(a), a host CPU 11 includes main memory 12 and a storage adapter 13 through which it communicates with the subsystem. The subsystem comprises a storage control unit 14, including a microprocessor 15, and two or more storage device arrays 17,18. The system shown may, for example, be an IBM AS/400 mid-range computer linked to an IBM 9337 subsystem through a SCSI interface. The IBM 9337 supports both standard and RAID 5 array architectures. The device arrays 17, 18 may be a plurality of 31/2 inch magnetic disk drives linked to the storage control unit 14 through a SCSI interface.

Alternatively, the host computer may link directly to an array subsystem without a separate storage control unit 14, as shown in FIG. 1(b). In this configuration, the CPU includes main memory 12, and a storage adapter 15 with a microprocessor 15 for controlling direct communication with the device arrays 17,18. The adapter may, for example, be a Mylex DAC960P RAID adapter connected to a plurality of 31/2 inch device arrays through multiple channel SCSI interfaces 16. RAID may also be implemented in the configuration of FIG. 1(b) through software, e.g. Oasis for OS/2.

FIG. 2 represents a pair of arrays in a storage subsystem according. A first array, A1, is an (N.sub.1 +P.sub.1 +S.sub.1, N.sub.1 =4, P.sub.1 =1, S.sub.1 =1) array comprising six storage devices or "columns", d1-d6. Each device is subdivided into M=6 regions for storing blocks of information. Six regions are selected for illustration purposes only, as the devices may be partitioned into any predetermined number of regions, depending on region size and device storage capacity. The corresponding regions in the six devices form rows r1-r6.

A second array, A2, is an (N.sub.2 +P.sub.2, N.sub.2 =3, P.sub.1 =1) array and includes four devices, d1-d4. These device columns are similarly subdivided into regions to form six rows, r1-r6, across the devices. (According to the array nomenclature described above, the second array may also be referred to as an (N.sub.1 +P.sub.2 +S.sub.2) array, wherein S.sub.2 =0). Note that the number of rows in arrays A1 and A2 is the same. This consistency is a key requirement of the present invention, as will be seen shortly, since it permits subsystem arrays of different sizes to share distributed spare space.

In the preferred embodiment of the present invention, each row of arrays A1 and A2 holds a distributed parity group, and no two blocks of a parity group reside on the same device. Such distribution facilitates data restoration in the event of a device failure, as already discussed. For example, row r1 of array A1 holds an (N.sub.1 +P.sub.1) parity group comprising four data blocks, a1-a4, and a parity block, Pa. A corresponding spare region, S, has been reserved in device d6 of the same row. Parity groups, a-g, are preferably distributed in offset fashion across the array to effect distribution of parity blocks Pa-Pg, as shown. The "distributed parity" arrangement permits faster parallel data reconstruction in the event of a device failure. However, it should be understood that the present invention applies to subsystem arrays with distributed parity (e.g. RAID 5), arrays with dedicated parity devices (e.g. Raid levels 1-4), non-RAID arrays with redundancy, or any combination of the above. The only requirements imposed by the present invention are that at least one array includes distributed spares and that at least two arrays have a same number of rows to allow spare sharing.

Array A1 is configured to have one spare region available per row. According to the present invention, the spares are distributed across the array rather than residing in a single, dedicated device. Array A2 has no spares.

An "X" shown over device d1 of array A1 represents a failure in that device just prior to data restoration procedures. The failure causes the loss of blocks a4, Pb, e1, f2 and g3, which are reconstructed according to presently known restoration methods. The reconstructed blocks are relocated to the spare regions of array A1, as shown in FIG. 3. For example, data block a1 is preferably reconstructed by retrieving blocks a1-a3 from the intact devices and logically XOR-ing them to obtain a new a4 data block. The newly constructed block is then placed the spare region of row r1 as shown. Parity block Pb is similarly reconstructed by retrieving data blocks b1-b4 into memory and logically XOR-ing them to obtain a new parity block, Pb. The restored block Pb is then placed in the spare region of row r2, as shown. Note that neither the device failure nor the data reconstruction has affected array A2. But the spare regions of array A1 are now depleted.

It will now be assumed that no device failure has occurred on array A1, and that a first failure has occurred in device d2 of array A2, as shown in FIG. 4. A failure in d2 results in the loss of data blocks h2, j3, m1, n2 and o3, and of parity block Pk. However, since array A2 has no distributed spares, these blocks can not be restored by presently known methods unless a dedicated spare device is available in the array to hold the newly constructed blocks. Assuming that no spare drives are available, array A2 would require manual drive replacement of d2. The present spare sharing method provides an alternative to drive replacement under these and similar circumstances.

FIG. 5 is a flow diagram illustrating the preferred method of the present invention for a subsystem comprising at least two arrays of storage devices, each array having a same number of rows. Each array, 41-43, is monitored for device failures as represented by decision block 45. Upon the detection of a failed device, the array experiencing the failure is assessed to determine if it has spares available 46. If spares are available, the conventional restoration process 47 takes place. That is, lost data and parity blocks are reconstructed according to presently known methods, placed in the spare regions of the array itself, and the address of each restored block is remapped to reflect a change in drive location within the array. If there are no spares available within the array, the subsystem is checked 48 for available space on a dedicated spare device. If spare space is found, the lost blocks are restored, placed in the spares of the dedicated device, and block addresses are remapped 47 to reflect a change in drive location. If no dedicated spares are available, the remaining arrays of the subsystem are checked 49 for available distributed spares. If spare space is found in another array, the data is reconstructed and placed within those distributed spares, and the block addresses are remapped 47 to reflect the change in array and drive location. Only when all spares of the subsystem are depleted will manual device replacement 50 become mandatory. It will be readily apparent that the sequence of FIG. 5 may be implemented in either hardware or software, e.g. by modifying the error recovery software of an existing subsystem. Additionally, the order of decision blocks 46, 48 and 49 may be interchanged without substantially impacting the efficient use of spare space within the subsystem.

Applying the method of FIG. 5 to the subsystem of FIG. 4, it is apparent that no distributed spares are available in array A2 42, and it will be assumed that no dedicated spares are available in the array 46. A scan 49 of the subsystem arrays indicates that unused distributed spares are available in array A1 42. Thus the blocks originally residing on failed device d2 of array A2 are reconstructed according to presently known methods and are relocated 47 to the spare space of array A1, as shown in FIG. 6. For example, reconstructed data block h2 is placed in row r1, device d1 of array A1. Similarly, block j3 is placed in row r2, device d5 of A1, and so on. Relocation of blocks lost in array A2 to corresponding rows of array A1 is convenient, but is not a requirement of the present invention. For example, data block h2 could have been placed in the spare space of row r6, rather than the spare space of row r1, and its new location mapped accordingly. Use of the spare regions in array A1 to restore data/parity from a failed drive of array A2 is possible because both arrays have the same number of rows and array A1 is configured to include one spare region per row. If array A1 were alternatively configured as an (N.sub.1 +P.sub.1 +S.sub.1, S.sub.1 =2) array, the subsystem could tolerate a second drive failure in A1 or A2 before drive replacement would be required.

FIG. 7 shows a pair of subsystem arrays similar to those of FIG. 3 with the exception that array A2 now includes spares. Array A2 has an (N.sub.2 +P.sub.2 +S.sub.2, N.sub.2 =3, P.sub.2 =1, S.sub.1 =1) configuration comprising five devices, d1-d5, and having six distributed spares (one per row). Note that arrays A1 and A2 still have a same number of rows. According to the preferred sharing method of FIG. 5, if a device failure occurs on array A1 as indicated, a determination is made as to the availability of spares within that array. Since spares are indeed available, blocks a4, Pb, e1, f2 and g3 of failed device d4 are reconstructed and placed into these spares as shown in FIG. 8. The spares of array A1 are now depleted.

If a second device failure now occurs in array A1, e.g. on device D1, a determination is again made of spare availability within the array. This time, however, since there are no spares available. Next, the availability of dedicated spare space within the subsystem is determined. Assuming there is none, the availability of spares in other subsystem arrays is now assessed. Spares are identified on array A2, so the data and parity blocks of the failed device will be reconstructed and placed in these spares as shown in FIG. 9. For example, reconstructed block al is placed in row r1, device d5, of array A2. Block b2 is similarly reconstructed and placed in row r2, device d4 of array A2, and so on. Again, restoration of lost blocks in array A1 to corresponding rows of array A2 is for convenience only, and not a requirement of the present invention. After restoration, the spares of both arrays are depleted. Consequently, a third device failure on either array will require device replacement.

It will now be assumed that a plurality of arrays were present in the subsystem of FIG. 7, each having a same number of rows and some having unused distributed spares. Under these conditions, the second device failure is handled differently from the preceding example. Each array is checked, in sequence, to determine whether spare space is available therein. The checking sequence is predefined and may be arbitrary. If unused spare space is found in the array, lost data is reconstructed and placed in the spare space in the same manner as described for array A2 in FIG. 8. If unused spare space is not found, the next array in sequence is checked for unused spares until available spares are found or all of the arrays have been checked without success. Such a subsystem is able to recover from subsequent, nonconcurrent device failures until all spares within the arrays have been depleted.

The invention has now been described with reference to specific subsystems. However, the present invention may be applied to any subsystem having at least two arrays, at least a first array including distributed spares, and at least a second array having a same number of rows as the first. This and other extensions may be made without departing from the spirit and scope of the present invention as set forth in the following claims.