JPH09325917A - Computer system - Google Patents

Abstract

(57) [Abstract] [Problem] When the asynchronous copy method is applied,
Provided is a computer system which enables a secondary storage device to recognize whether or not data is lost when a primary control device becomes unusable due to a failure or disaster. In response to a write request from a central processing unit, a primary control device 110a transfers only position information of write target data to a secondary control device 110b. The sub control device 110b holds the position information until the data is actually written. When the primary storage device 130a becomes inaccessible due to a failure or disaster, the sub control device 11
By reading the position information from 0b, the presence / absence of lost data and its position and time are determined. [Effect] When the primary storage device becomes unusable due to a failure or disaster, the presence or absence of lost data can be determined from the sub control device, and appropriate measures can be taken.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention comprises a primary storage system connected to a central processing unit and comprising a storage unit and a control unit, and a remote secondary storage system connected to the primary storage system. Computer system. More specifically, a computer with an improved data guarantee method for remote duplication between a storage device under the primary storage device system, that is, a primary storage device and a storage device under the secondary storage device system, that is, a secondary storage device. Regarding the system.

[0002]

2. Description of the Related Art A technique for performing double writing between different control devices by transferring data between control devices without going through a central processing unit, that is, remote double writing, is USP5.
155845. In this conventional technique, when the primary control device receives a command designating primary / secondary from the central processing unit, the data stored in the primary storage device is copied to the secondary storage device. At the same time, in response to a write request from the central processing unit to the main control unit, the write data is stored in the main storage unit, the write data is transferred to the sub control unit, and then the write is completed to the central processing unit. To report. This is called synchronous copy. Remote duplication is realized by the above operation. By performing the remote double writing, when the data in the primary storage device becomes inaccessible due to a disaster or a failure, it becomes possible to take over the work by the secondary storage device.

[0003]

In the above synchronous copy, the connection distance between the primary control device and the secondary control device is several hundred km.
If it is long, it takes a long time to transfer data from the primary control device to the secondary control device, so that the access performance to the central processing unit deteriorates. To solve this problem, an asynchronous copy method is considered in which the write completion is reported to the central processing unit before the write data is transferred to the sub control unit, and the write data is transferred to the sub control unit after that. To be However, in the asynchronous copy method, at a certain moment, a state occurs in which data has been written in the primary storage device and writing has not been completed in the secondary storage device. At this time, if the primary control device becomes unusable due to a failure or disaster, the secondary storage device has no means for recognizing whether or not data is lost. Therefore, there is a problem in that it cannot be determined whether the secondary storage device can be used. Therefore, a first object of the present invention is to apply the asynchronous copy method, and when the primary controller becomes unusable due to a failure or disaster,
It is to provide a computer system in which whether or not data is lost can be recognized by a secondary storage device.

When it is possible to recognize that data has been lost, it is necessary to recover the lost data. As a method of recovering lost data, there is a method of regularly backing up data at a certain point of time to tape, recovering the data from the backup data if necessary, and returning the job progress to that point of time. . In order to recover data in this way, you must know the time at which the data was lost. Therefore, a second object of the present invention is to provide a computer system in which the time when the lost data is written from the central processing unit to the primary storage device can be recognized by the sub control device.

[0005]

According to a first aspect of the present invention, there is provided a primary storage system connected to a central processing unit and comprising a storage unit and a control unit, and a remote storage system connected to the primary storage system. In the computer system configured with the secondary storage device system described above, the control device under the primary storage device system, that is, the primary control device, writes write data to the secondary storage device when a write request is received from the central processing unit. After the position information is transferred without being transferred, the write completion is reported to the central processing unit, and the write processing for the secondary storage device is executed at an appropriate time later, and the secondary storage system The lower control device, that is, the sub control device holds the position information transferred from the primary control device, and when the actual write process is executed later, the position information is stored. When the primary control device becomes unusable due to abandonment, disaster, or the like, the presence or absence of lost data can be detected by the position information stored in the sub control device. I will provide a. In the computer system according to the first aspect, since the asynchronous copy method is used, it is possible to improve the access performance to the central processing unit. In addition, since the position information transferred from the primary control device is stored in the secondary control device, when the primary control device becomes unusable due to a failure or disaster, whether the data is lost or not is determined by the position information. Can be recognized by the secondary storage device.

According to a second aspect of the present invention, in the computer system having the above-mentioned configuration, the primary control unit, in addition to the position information, sets a time at which a write request is issued from the central processing unit to the sub control unit. By transferring, the data update order of the central processing unit is stored in the sub control unit, and when the main control unit becomes unusable due to a disaster or the like, from the time stored in the sub control unit. A computer system characterized by determining a backup file to be recovered and performing data recovery. In the computer system according to the second aspect, when the primary control device becomes unusable due to a disaster or the like, the contents of the primary storage device and the secondary storage device do not match at any time depending on the time stored in the secondary control device. I know if it has become. Therefore, when the work is taken over by the secondary storage system, it is possible to recover from the data at the proper backup time.

According to a third aspect of the present invention, in the computer system having the above configuration, when the central processing unit accesses the area corresponding to the position information with respect to the sub control unit, the sub unit The control device provides a computer system characterized by reporting an error end to the central processing unit. In the computer system according to the third aspect, it is possible to prevent access to old generation data.

In a fourth aspect, the present invention comprises a primary storage system connected to a central processing unit and comprising a storage unit and a control unit, and a remote secondary storage system connected to the primary storage system. In the configured computer system, the control device, that is, the main control device under the primary storage device system, and the control device, that is, the sub control device under the secondary storage device system, each have two states, that is, two states, as a double writing state. It manages a double-write matching state and a double-write mismatching state, and when the primary control device receives a write request from the central processing unit and the primary storage device to be written is in the dual-write matching state, The double write state of each of the primary storage device and the secondary storage device is transited to a double write disagreement state, and write data is transferred to the secondary storage device. Instead, the write completion is reported to the central processing unit, the write processing to the secondary storage device is executed at an appropriate time later, and all the unupdated data to the secondary control device is updated later. When the primary control unit becomes unusable due to a disaster or the like, it is possible to detect the presence or absence of data loss by the double writing state stored in the sub control unit. A computer system characterized by the above. In the computer system according to the fourth aspect, since the asynchronous copy method is used, it is possible to improve the access performance to the central processing unit. In addition, as the double writing state, the state of matching or mismatching is managed by the primary control device and the secondary control device for each storage device, so when the primary control device becomes unusable due to a failure or disaster, data will be Whether or not the data has disappeared can be recognized by the secondary storage device based on the double writing state.

According to a fifth aspect of the present invention, in the computer system having the above configuration, when the primary control device and the secondary control device are transited to the double write disagreement state,
The times at which the double-write inconsistency state is recorded in the primary control device and the secondary storage device respectively, and when the primary control device becomes unusable due to a disaster or the like, the secondary storage device does not have the double-write inconsistency. Provided is a computer system characterized by performing data recovery from a backup file corresponding to the time when the double-write inconsistency has occurred. In the computer system according to the fifth aspect, when the primary control device becomes unusable due to a disaster or the like, the contents of the primary storage device and the secondary storage device do not match depending on the time stored in the secondary control device. I know if it has become. Therefore, when the work is taken over by the secondary storage system, it is possible to recover from the data at the proper backup time.

According to a sixth aspect of the present invention, in the computer system having the above-mentioned configuration, the time transferred to the sub-control unit together with the positioning information or the double-write inconsistency state is a write processing request time. And a computer system provided by the central processing unit. In the computer system according to the sixth aspect,
The error with the external time can be eliminated.

According to a seventh aspect of the present invention, in the computer system having the above-mentioned configuration, the time to be transferred to the sub-control unit in association with the positioning information or the double-write mismatch state is from the central processing unit. There is provided a computer system characterized by using an internal time of the primary control device as a time when a write request is made. In the computer system according to the seventh aspect, since it is not necessary to give the time from the central processing unit, the configuration can be simplified.

According to an eighth aspect of the present invention, in the computer system having the above configuration, the position information is transferred to the sub-control unit only when it is determined that the position information is a write access. Provide the system.
In the computer system according to the eighth aspect, the position information is transferred only at the time of write access, but the data mismatch between the primary storage device and the secondary storage device occurs only at the time of write system access, so it is wasteful. Communication can be avoided.

According to a ninth aspect, the present invention is characterized in that, in the computer system having the above-mentioned configuration, the double-write inconsistency state is notified to the sub-control unit only when it is determined that it is a write access. To provide a computer system. In the computer system according to the eighth aspect,
Although the double-write inconsistency state is notified only during a write access, data inconsistency between the primary storage device and the secondary storage device occurs only during a write access, so useless communication can be avoided.

According to a tenth aspect of the present invention, in the storage device system having the above structure, when the central processing unit accesses the secondary storage device in the double-write disagreement state, the secondary storage device is accessed. The control device provides a computer system characterized by reporting an error end to the central processing unit. In the computer system according to the tenth aspect, it is possible to prevent access to old generation data.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION

First Embodiment FIG. 1 shows the configuration of a computer system according to the first embodiment of the present invention. In the following description, the primary and secondary are distinguished by the symbols a and b, but when the primary and secondary are not distinguished, the symbols a and b may be omitted.

The computer system 1 comprises a primary computer system 140a and a secondary computer system 140b which is connected to the primary computer system 140a and is remote. The primary computer system 140a includes a primary central processing unit 100a and a primary storage system 170a. The sub computer system 140b comprises a sub central processing unit 100b and a primary storage system 170b. The primary storage system 170a includes a primary control device 110a and a primary storage device 130a. The secondary storage system 170b is a secondary control device 1
10b and a secondary storage device 130b.

Whether the primary / secondary is determined by the user,
Generally, a storage device that operates in normal times is defined as a primary storage device, and a storage device that backs it up is defined as a secondary storage device. Then, depending on the primary or secondary of the storage device 130, the primary and secondary of the control device 110, the central processing unit 100, and the computer system 140 are decided for convenience or logically. A primary storage device and a secondary storage device may coexist under one control device 110, but in this case, the control device 110
Is a primary control device for the primary storage device and a secondary control device for the secondary storage device.

The control unit 110 is connected to the central processing unit 100 and other control units 110 by a link 150. The link management mechanism 120 uses the link 150 to be used.
Switch, etc. The cache 170 stores data written from the central processing unit 100 or the storage device 13.
This is a memory for temporarily storing data read from 0. If the data accessed by the central processing unit 100 exists in the cache 170, the storage device 130 is not accessed. Processor 160
Controls data transfer among the storage device 130, the cache 170, the central processing unit 100, and the other control device 110. The directory 180 is a memory for storing management information of the cache 170. Processor 160
By accessing the directory 180
Performs hit / miss judgment, etc.

The hit / miss judgment means the central processing unit 100.
Is a process of determining whether the target data exists in the cache 170 (hit) or not (miss) from the position of the data for which the access request is made, that is, the storage device address, the data address, and the data length.

The storage device 130 is a magnetic disk device. However, a magnetic tape device or an optical disk device may be used. FIG. 2 is an explanatory diagram of the magnetic disk device.
The magnetic disk device 250 includes a plurality of disks 240 for recording data, a head 230 for reading / writing data on the disks 240, and a controller interface 220. Disk 240 is 1
A circular recording unit that the head 230 can access while rotating is called a track 200. There are a plurality of tracks 200 on the disk 240. Each track is sector 26
It is divided into areas of a certain size called 0, and the sector becomes the minimum unit (slot) of data access. When a certain track 200 becomes an access target, the head 230 is moved to a position where the track 200 can be read / written. This operation is called seek. In this disk device 250, a plurality of heads 230 move simultaneously. The heads 230 are numbered in ascending order from the top and are called head numbers. Disk 240 is 1
A collection of tracks 200 accessible by all heads 230 during rotation is called a cylinder 210. The cylinders 210 are numbered in ascending order from the inside of the disk 240, which is called a cylinder number.

A hit / miss judgment table is stored in the directory 180. FIG. 3 is an example of the structure of the hit / miss determination table. The hit / miss determination table 340 is composed of the following tables. Device address correspondence table 300: There is an entry for each disk device 250, and each entry stores a pointer to the cylinder number correspondence table 310 corresponding to the disk device. Cylinder number correspondence table 310: There is an entry for each cylinder of one disk device, and each entry stores a pointer to the track number correspondence table 320 corresponding to that cylinder. Track number correspondence table 320: There is an entry for each track of one cylinder, and each entry stores a pointer to the slot management table 330 corresponding to that track. Slot management table 330: cache management information for one track and has the following information. Data existence / non-existence map 331: information indicating which sector on the track exists in the cache 170. Cache address 332: Address information in which when the sector on the track exists in the cache 170, the data is stored. Pointer 333: Information used when performing queue management and the like. Time 334: Primary storage device 130a for the slot
It is information for managing the time when there is a write on the sub controller 110b side. RVOL dirty status 335: The relevant slot is the secondary storage device 1
It is information indicating whether or not 30b has not been updated. Track address 336: Address of the track. Head address 337: Address of the head that accesses the track.

A device address correspondence table 3 based on the positioning information designated by the central processing unit 100, that is, the storage device address, cylinder number, and track number of the access target.
00, cylinder number correspondence table 310, track number correspondence table 320, and slot management table 330. If the corresponding bit of the data presence / absence map 331 is on, it is determined to be a hit, and if it is off, it is determined to be a miss. Further, when performing data transfer, by adding an offset corresponding to the target sector to the cache address 332.
Calculate the cache address to be transferred.

In order to realize remote duplicate writing by asynchronous copy, the directory 180 has an RVOL dirty management table for managing unupdated data (which is called RVOL dirty data) to the secondary storage device 130b.

FIG. 4 is a configuration diagram of the RVOL dirty management table. This RVOL dirty management table 400 is for storage device VOL1,
It has an entry for each VOL2, .... RVOL information 401 and RVOL dirty list head 40 are included in one entry.
2 are stored. The RVOL information 401 holds an address of the secondary control device 110b and an address of the secondary storage device 130b when the storage device is positive. If the storage device 130 does not form a primary / secondary pair, a special value is stored. The RVOL dirty list head 402 is an RVOL dirty list 4 for managing unupdated slots.
Refers to 10. NU if there is no unupdated data
The LL value is stored. The RVOL dirty list 410 is a list structure of the slot management table 330 of unupdated slots using the pointer 333 in the slot management table 330.

The RVOL dirty management table 400 is registered at the time of a write access from the central processing unit 100 to the primary storage device 130a or when it is determined to be a write access. The central processing unit 100 accesses the primary storage device 130a according to the defined protocol. There are various protocols, but in a large-scale computer system centered on a mainframe, for example, C
The KD protocol is commonly used. This CKD
In the protocol, prior to the data access command,
In addition to the positioning information, a positioning command including information indicating the access form (read or write access) is issued. Therefore, whether it is a write access or not is known when the positioning command is received.
Register the RVOL dirty management table 400. Further, in workstations and personal computers, the FBA protocol including the positioning information in the data access command is used. In the case of this FBA protocol, the RVOL dirty management table 400 is registered after receiving the data access command.

FIG. 5 is a flowchart of the registration processing of the RVOL dirty management table 400. In step 510, as described above, it is judged whether or not it is a write access, and if it is not a write access, the processing is ended, and if it is found that it is a write access, the routine proceeds to step 520. In step 520, an entry of the RVOL dirty management table 400 is obtained from the address of the storage device 130 to be accessed, and the RVOL information 401 of the entry is referenced to form the primary / secondary pair of the storage device 130 to be accessed. Check if If a pair has not been formed, the processing ends, and if a pair has been formed, step 530.
Proceed to. In step 530, the address of the sub control device 110b is obtained from the RVOL information 401, and the sub control device 1
The positioning information is transferred to 10b. This allows
It is possible to notify the sub control device 110b that there is unreflected data in the sub storage device 130b. In step 540, the write target slot is registered in the RVOL dirty management table 400. That is, a new slot management table 330 is inserted before the slot management table 330 indicated by the RVOL dirty list header 402.

In the step 530, the process of transferring the positioning information to the sub control unit 110b is preferably performed in parallel with the process of receiving the write data from the central processing unit in order to reduce the apparent overhead. . For example, using the CKD protocol, after the positioning information is received by the positioning command, a child job is generated and the positioning information transfer process is executed, and the own job executes the write command process chained to the positioning command. In the own job, after the command chain is completed, the completion of the child job is waited, and then the write processing completion is reported to the central processing unit 100.

In step 530, the current time may be transferred to the sub control device 110b in addition to the positioning information. This makes it possible for the sub control device 110b side to later check at which point the data was lost. Furthermore, when transferring the current time, the internal time of the primary control device 110a may be transferred, but in order to eliminate the error from the external time, for example, the time is stored in the positioning command parameter from the central processing unit 100. Then, the time may be transferred. For example, according to the RVOL dirty information 600 shown in FIG. 6, the positioning information and the time are set from the primary control device 110a to the secondary control device 11a.
0b. This RVOL dirty information 600 is RV
It is composed of a command code 601, which indicates the transfer of OL dirty information, a secondary storage device address 610, dirty data position information 620, and a time 630.

FIG. 7 is a flowchart of the deletion processing of the RVOL dirty management table 400. It is assumed that there is an asynchronous double-write job that exclusively executes RVOL write corresponding to the installed primary storage device 130a in order to realize efficient remote double-write of the asynchronous copy system. This asynchronous double-writing job is a job that repeats a run and a sleep at regular intervals, and the RVOL dirty management table 4 during the run.
00 deletion processing is executed. In step 710, the primary storage device 130 corresponding to the asynchronous double writing job that is being executed.
The RVOL dirty list header 402 of the RVOL dirty management table 400 of a is referred to, and if the value is NULL, there is no RVOL dirty data, so the processing ends. If the value of the RVOL dirty list header 402 is not NULL, there is RVOL dirty data, so step 72
Go to 0. In step 720, RVOL dirty management table 4
The write command for the secondary storage device 130b is generated from the RVOL information 401 of 00 and the information of the slot management table 330, and the RVOL write processing is executed. The write command generation method is described in, for example, USP555845. In step 730, the slot management table 330 that has been written is deleted from the RVOL dirty list 410. When the process is completed, it sleeps for a while.

The above is the processing on the side of the primary control device 110a. Next, processing on the side of the sub control device 110b will be described.

The main processing of the secondary control device 110b is to hold the RVOL dirty information 600 from the time the RVOL dirty information 600 is transferred from the primary control device 110a until the data is written. is there. In order to realize this processing, the sub controller 110b also has a table structure basically the same as the RVOL dirty data management table 400 shown in FIG. The slot management table 330 connected to the RVOL dirty list 410 represents slots that have not been reflected in the secondary storage device 130b. The RVOL information 401 is not used in the sub control device 110b.

Registration in the RVOL dirty data management table 400 is performed when the RVOL dirty information 600 is transferred from the primary controller 110a. That is, the command code 6 determines whether the RVOL dirty data information 600 is transferred.
If the RVOL dirty information 600 is determined to be transferred, the RVOL dirty management table 400 and the RV dirty management table 400 and RV of the corresponding secondary storage device 130b are read from the storage device address 610.
Request the OL dirty list 410. Further, the hit / miss judgment is executed from the dirty data position information 620 to obtain the target slot management table 330. Then, the slot management table 330 is registered in the RVOL dirty list 410, and the RVOL dirty status 335 of the slot management table 330 is set to “dirty”.

The slot management table 330 is deleted when the main controller 110a writes to the target slot. That is, in response to a write request from the primary control device 110a, hit-miss determination is performed based on the positioning information, the RVOL dirty status 335 of the obtained slot management table 330 is referenced, and if "dirty",
After executing the write processing, the slot management table 330 is deleted from the RVOL dirty list 410 and the RVOL dirty information 335 is changed to “no dirty”.

As described above, the position information of the unupdated data in the secondary storage device 130b and the time when the data is unupdated are the primary control device 110a and the secondary control device 1.
10b will be held respectively.

FIG. 8 shows a lost data list for recording position information and lost time of lost data. The lost data list 1100 includes a storage device address 1110,
It consists of the number of lost data 1120, a data address 1130 for each lost data, and the time of loss 1140.

When the number of lost data exceeds a predetermined threshold value, the entire storage device 130 becomes invalid and the storage device 1
The entire 30 may be recovered. This can prevent the lost data list 1100 from becoming huge. It is preferable that the threshold can be set by a maintenance staff or the like.

The sub-control unit 110b is the central processing unit 10.
In response to a read request for the lost data list 1100 from 0, the lost data list 1100 is created by the following procedure. (1) From the requested storage device address to the corresponding RV
The OL dirty management table 400 is searched. (2) If the value of the RVOL dirty list head 402 of the retrieved RVOL dirty management table 400 is NULL, there is no lost data, so “0” is recorded in the lost data count 1120. (3) If the value of the RVOL dirty list head 402 points to the RVOL dirty list 410, the track address 336 and the head address 337 of the slot management table 330 connected to the RVOL dirty list 410 are stored in the data address 1130. , Time 334 to time 1140
To be stored. This is repeated while tracing the RVOL dirty list 410 to count the number of lost data. (4) Lost data count was 1
It is stored in 120. (5) The designated storage device address is stored in the storage device address 1110.

When the lost data list 1100 is completed as described above, the sub control unit 110b causes the central processing unit 100 to operate.
The lost data list 1100 is returned to. Therefore, the maintenance staff can check the presence or absence of the lost data by reading the lost data list 1100. And
If the data is lost, the data address 113
Data can be recovered from zero. Also, at time 11
It is also possible to retrieve the 40 oldest ones and recover the data from that generation of backup files.

FIG. 9 is a flow chart showing the access permission / inhibition decision processing 800 in the sub control unit 110b when the main control unit is inaccessible. In step 810, the hit / miss judgment of the access target slot is executed to obtain the slot management table 330. Step 8
20, the data of the slot is changed from the RVOL dirty status 335 of the slot management table 330 to the secondary storage device 13
It is determined whether it is not reflected in 0b. If it has not been reflected, the data has been lost, and the process proceeds to step 830. If not reflected, the data has not disappeared, and the process proceeds to step 840.

In step 830, the central processing unit 100
Report an abnormal end to. In step 840, access is permitted.

The description of the first embodiment has been completed, but the main points of the first embodiment will be summarized as follows. (1) Before actually performing the write processing from the primary control device 110a, the positioning information and time are transferred to the secondary control device 110b. The sub control device 110b holds the positioning information and the time until the actual writing. (2) When the primary storage device 130a becomes inaccessible due to a failure, disaster, or the like, the presence or absence of lost data is determined from the secondary control device 110b. If there is lost data,
The backup file to be recovered is determined from the time of the lost data. (3) If the lost data is accessed, the access is not permitted and an abnormal end is reported.

In the conventional remote duplication of the asynchronous copy system, since it is not possible to judge the presence or absence of lost data, if the data is not recovered despite the presence of the lost data, data corruption will occur. . On the other hand, if the data is recovered even though there is no lost data, the recovery work is wasted and the data returns several generations ago, which is extremely costly. In addition, the storage device 1
You have to recover the entire 30 and it is inefficient. On the other hand, in the remote copying of the asynchronous copy method according to the first embodiment, the contents of the primary storage device 130a and the secondary storage device 130b first match before the operation at the secondary site is started. Check whether or not they exist, and if they do not match, recover the data from the backup file at an appropriate time before starting operation. Therefore, it is possible to avoid the garbled data and the wasteful data recovery. From the above,
Even if the primary storage device 110a becomes inaccessible due to a disaster or failure, the secondary storage device 130b can be used to take over the work at the secondary site, and the system down time can be minimized.

-Second Embodiment- In the first embodiment, one from the central processing unit 100 is used.
Sub-control unit 11 for each write request (for each CC chain)
Since the positioning information was transferred to 0b, the primary control device 1
The number of communications between 10a and the sub control device 110b increases, and the performance deteriorates. To solve this, in the second embodiment, only when the contents of the primary storage device 130a and the secondary storage device 130b match or do not match, the fact is notified to the secondary control device 110b, and the primary control device 110a and the secondary control device 110b The number of communications between the devices 110b is reduced.

The storage device 130 is in two states of double writing match or double writing mismatch. Here, the double-writing match means that the contents of the primary storage device 130a and the secondary storage device 130b match. Further, the double-write mismatch means that the contents of the primary storage device 130a and the secondary storage device 130b do not match. These double-written states correspond to those of the primary controller 130a and the secondary controller 130b.
It is stored in the RVOL information 401 of the RVOL dirty management table 400. Further, the time when the double writing does not match is also stored in the RVOL information 401.

FIG. 10 is a flowchart of the disagreement state change processing 900 for changing the state from double-writing coincidence to double-writing disagreement. In step 910, it is checked whether the access is a write type. If it is not a write access, the change of the double-write state does not occur, so the processing ends. If it is a write access, the process proceeds to step 920. In step 920, the storage device 1 to be accessed
It is judged from the RVOL information 401 whether 30 form a primary / secondary pair. If the pair has not been formed, the change of the double writing state does not occur, so the processing ends. If a pair has been formed, the process proceeds to step 930. In step 930, it is judged from the RVOL information 401 whether or not the current double-write state is the double-write match. If they do not coincide with each other, the change of the double-writing state does not occur, so that the process ends. If the double writing matches, the process proceeds to step 940. In step 940, the sub-control device 110b is notified that the double writing does not match. From the viewpoint of efficiency, it is preferable to perform the notification processing and the write processing from the central processing unit 100 in parallel. In step 950, the RVOL information 401 is changed to the state of double-writing disagreement.

The disagreement state change processing 900
Thus, not only the notification of double-writing disagreement but also the time may be notified to the sub control device 110b. In this case, the time when the write access is received from the central processing unit 100 is transferred to the sub control device 110b, and the time is also recorded in the RVOL information 401. In addition, at this time, the positive control device 110a
It may be the internal time or the time given from the central processing unit 100.

FIG. 11 is a flow chart of the matching state change processing 1000 for changing the state from double writing mismatch to double writing matching. This matching status change processing 1000
Is executed when the asynchronous double-write job described in the first embodiment writes unupdated data to the secondary storage device 130b. In step 1000, the unupdated data is written to the secondary storage device 130b as described in the first embodiment. In step 1010, the slot management table 330 that has been written as described in the first embodiment.
From the RVOL dirty list 410. Step 102
At 0, by tracing the RVOL dirty list 410, it is determined whether or not there is unupdated data for the secondary storage device 130b. If the slot management table 330 is still connected to the RVOL dirty list 410, the double writing does not match, and the process ends. If the slot management table 330 is not connected to the RVOL dirty list 410, the double writing inconsistency has been resolved, and the process proceeds to step 1030. In step 1030, the sub-control device 110b is notified that the double writing match has occurred. In step 1040, the state of the RVOL information 401 is changed to double writing match.

FIG. 12 is a view showing an example of status change notification information used for notification of status change from the primary controller 110a to the secondary controller 110b. This status change notification information 1
300 stores a command code 1301 indicating a status change notification command, a target secondary storage device address 1310, a time 1320 at which the status was changed, and a status code 1330 indicating a new status code. .

The above is the processing on the side of the positive control device 110a. Next, processing on the side of the sub control device 110b will be described.

Upon receipt of the status change notification information 1300, the sub control unit 110b receives the target sub storage unit 130.
The RVOL information 401 corresponding to b is changed to the state designated by the state code 1330. The RVOL dirty list 410 is not used in the sub control device 110b.

FIG. 13 shows the primary / secondary state information 1 for notifying the central processing unit 100 of the dual writing state of the storage device 130.
200 is shown. The primary / secondary state information 1200 is composed of a storage device address 1210, a double writing state 1220 indicating double writing match or double writing mismatch, and a state change time 1230 indicating the time when double writing mismatch occurs. .

The sub control unit 110b is the central processing unit 10.
In response to a read request for the primary and secondary status information from 0, the primary and secondary status information 1200 is created by the following procedure. (1) Corresponding RVOL from the specified storage device address
Search the dirty management table 400, and from the RVOL information 401,
The double writing state is obtained and stored in the double writing state 1220. (2) If the double writing does not match, the time recorded in the RVOL information 401 is stored in the state change time 1230. When the primary / secondary state information 1200 is completed as described above, the secondary control device 110b informs the central processing unit 100 of the primary / secondary state information 1.
Return 200. Therefore, the maintenance personnel should set the primary and secondary status information 1
By reading 200, the double writing state can be confirmed. Then, in the case of double-writing disagreement, it is possible to select the backup file having the closest generation from the time when the disagreement occurs and recover the data. The method of this second embodiment is useful when individual data recovery is not possible or unnecessary.

If an access request is issued from the central processing unit 100 to the secondary storage device 130b in which the double writing does not match,
The secondary control device 110b obtains the corresponding RVOL dirty management table 400 from the requested storage device address, and based on the RVOL information 401, whether the storage device 130 forms a primary / secondary pair, and If you are forming a sub-pair, check whether there is a double-write mismatch. Then, in the case of double writing disagreement, access is denied in order to prevent transfer of the old generation data.

The description of the second embodiment is completed above, but the main points of the second embodiment will be summarized as follows. (1) The control device 110 holds a double writing state that indicates whether the contents of the primary and secondary storage devices 130 match or do not match. (2) In the double-write state, double-write mismatch occurs when there is unupdated data in the secondary storage device 130b, and double-write match occurs when there is no unupdated data. (3) When the primary storage device 130a cannot be accessed due to a failure or disaster, the double-write state is read from the secondary control device 110b, and the backup file of the generation closest to the time when the double-write mismatch occurs. You can recover data from it. (4) Secondary storage device 130b in which double writing does not match
Access from the central processing unit 100 is denied.

In the second embodiment, before starting the operation at the secondary site, the maintenance staff checks whether the contents of the primary storage device 130a and the secondary storage device 130b match or do not match. And if they don't match, recover the data from the backup file at the appropriate time and then
Start operation. As described above, even if the primary storage device 110a becomes inaccessible due to a disaster or failure, the secondary storage device 130b can be used to take over the work at the secondary site, and the system downtime is minimized. You can

-Difference between the first embodiment and the second embodiment- (1) In the first embodiment, the response time of the write processing from the central processing unit 100 may be degraded. on the other hand,
In the second embodiment, there is almost no deterioration in response performance. (2) In the recovery of lost data after a failure or disaster, it is possible to recover lost data units in the first embodiment, whereas it is necessary to recover the entire storage device in the second embodiment.

[0057]

According to the computer system of the present invention, when unupdated data is created in the secondary storage device, the fact that the positioning information or the dual writing state of the primary and secondary data does not match is notified from the primary control device to the secondary control device. Since the notification is sent, when the primary storage device becomes unusable due to a failure or disaster, the presence or absence of lost data can be determined from the sub control device, and appropriate measures can be taken.

[Brief description of drawings]

FIG. 1 is a configuration diagram of a computer system according to a first embodiment of the present invention.

FIG. 2 is a configuration diagram of a magnetic disk device.

FIG. 3 is a configuration diagram of a hit / miss determination table.

FIG. 4 is a configuration diagram of an RVOL dirty management table.

FIG. 5 is a flowchart showing a registration process of an RVOL dirty management table.

FIG. 6 is a configuration diagram of RVOL dirty information.

FIG. 7 is a flowchart showing an RVOL dirty management table deletion process.

FIG. 8 is a configuration diagram of a lost data list.

FIG. 9 is a flowchart showing an access permission / prohibition determination process.

FIG. 10 is a flowchart showing a disagreement state change process.

FIG. 11 is a flowchart showing a matching state changing process.

FIG. 12 is a configuration diagram of state change notification information.

FIG. 13 is a configuration diagram of primary / secondary state information.

[Explanation of symbols]

 100 ... Central processing unit 110 ... Control device 130 ... Storage device 160 ... Processor 170 ... Cache 180 ... Directory

Claims (10)

[Claims] 1. A computer system comprising a primary storage system connected to a central processing unit and comprising a storage device and a control device, and a remote secondary storage system connected to the primary storage system, When the control device under the primary storage system, that is, the primary control device, receives the write request from the central processing unit, the write data is not transferred to the secondary storage device, but the position information is transferred to the secondary storage device. The write completion is reported to the central processing unit, and the write processing for the secondary storage device is executed at an appropriate time later, and the control device under the secondary storage device system, that is, the secondary control device, is the primary control device. The position information transferred from is retained, and when the actual write process is executed later,
The position information is discarded, and the presence or absence of lost data can be detected by the position information stored in the sub control device when the primary control device becomes unusable due to a disaster or the like. And computer system. 2. The computer system according to claim 1, wherein the primary control device transfers, to the sub control device, a time at which a write request is issued from the central processing unit, in addition to the position information. A backup that stores the data update order of the central processing unit in the sub control unit and should be recovered from the time stored in the sub control unit when the main control unit becomes unusable due to a disaster or the like. A computer system characterized by determining files and performing data recovery. 3. The computer system according to claim 1, wherein when the central processing unit accesses the area corresponding to the position information with respect to the sub control unit,
The computer system, wherein the sub-control unit reports an error end to the central processing unit. 4. A computer system comprising a primary storage system connected to a central processing unit and comprising a storage device and a control device, and a remote secondary storage system connected to the primary storage system, wherein: The control device under the primary storage device system, that is, the primary control device, and the control device under the secondary storage device system, that is, the sub-control device, respectively have two states of double writing, that is, a double writing matching state and a double writing state. When the primary control device receives a write request from the central processing unit, if the primary storage device to be written is in the double-write inconsistent state, the primary storage device and the primary storage device and the primary storage device are managed. The central processing is performed without causing the write data to be transferred to the secondary storage device by transitioning the dual write state of each of the secondary storage devices to the double write disagreement state. To the storage device, the write completion is reported, the write processing to the secondary storage device is executed at an appropriate time later, and double write match occurs when all the unupdated data to the secondary control device is updated later. When the normal control device becomes unusable due to a disaster,
A computer system characterized in that the presence or absence of data loss can be detected by the double-writing state stored in the sub-control unit. 5. The computer system according to claim 4, wherein when the primary control device and the sub control device are transited to the double-write inconsistent state, the time when the double-write inconsistent state is set is If it is recorded in the primary control device and the secondary storage device respectively, and if the primary storage device becomes unusable due to a disaster or the like, and the secondary storage device is in the double-write mismatch state, the double-write mismatch A computer system characterized by performing data recovery from a backup file corresponding to the time when the status is reached. 6. The computer system according to claim 2 or 5, wherein the time transferred to the sub-control unit in association with the positioning information or the double-write disagreement state is a write processing request time, A computer system provided from the central processing unit. 7. The computer system according to claim 2 or 5, wherein the time to be transferred to the sub-control unit in association with the positioning information or the double write disagreement state is written from the central processing unit. A computer system characterized in that the internal time of the positive control device is used as the requested time. 8. The computer system according to claim 2, wherein the position information is transferred to the sub control device only when it is determined that a write access has been made. 9. The computer system according to claim 5, wherein the double-write inconsistency state is notified to the sub-control device only when it is determined that a write access has occurred. 10. The storage device system according to claim 4, wherein when the central processing unit accesses the secondary storage device in the double write disagreement state,
The computer system, wherein the sub-control unit reports an error end to the central processing unit.