Cluster computing system and its failover method

1. Field of the Invention

The present invention relates to a cluster computing system and its failover method, where the cluster computing system is a duplex clustering system that has an active system and a standby system, and that can operate both systems without inconsistencies even in the event of a failure of networks that connect the sites of the two systems and recover from the failure.

2. Related Background Art

A cluster computing system is a system that operates a plurality of servers as one system in order to enhance the availability and reliability of the system. A function in which an alternate server takes over data and processing in the event of a failure in such a cluster computing system is called a “failover,” which is an important technology in improving the reliability of the system.

Generally, a cluster computing system has one storage apparatus system shared by a plurality of host computers or a plurality of storage apparatuses each separately accessible by one of a plurality of host computers. In a configuration called a duplex system, one of a plurality of host computers operates as an active host computer and performs operation processing, such as data read/write to and from the storage apparatuses, while other host computers are in a standby state as standby host computers. The active host computer and the standby host computers monitor the status of each other, such that when a failure occurs on one of the host computers, the other host computer detects the failure and takes over the operation processing. A cluster computing system using a technology to perform private communications (heartbeat communications) by selectively using links between sites is disclosed as a cluster computing system described above.

The configuration and operations of a typical prior art cluster computing system are described below with reference to FIGS. 17-20 .

FIG. 17 is the general system configuration of a cluster computing system in which a storage apparatus system is shared by host computers.

FIG. 18 is a diagram illustrating a situation in which a failure occurs in a host computer A in the system shown in FIG. 17 .

FIG. 19 is the general system configuration of a cluster computing system in which a separate storage apparatus system is provided at each site.

FIG. 20 is a diagram illustrating a situation in which a failure occurs in a storage apparatus system A of a site A in the system shown in FIG. 19 .

In a cluster computing system in which a storage apparatus system is shared by host computers, a host computer A 10 , which is an active host computer, and a host computer B 11 , which is a standby host computer, are connected to a storage apparatus system 50 by interface cables A 40 and B 41 , respectively, to perform I/O requests.

The host computer A 10 that performs operation processing and the host computer B 11 that is in a standby state have heartbeat communications with each other via an IP network 30 , which connects them, in order to monitor the status of each other.

A disk volume that is logical (hereinafter called a “logical disk volume”) that the storage apparatus system 50 has is accessed by the host computer A 10 under normal operating state.

If a failure occurs on the host computer A 10 as shown in FIG. 18 , the standby host computer B 11 detects the failure through the IP network 30 and begins operations; the host computer B 11 takes over the processing of the host computer A 10 and accesses the storage apparatus system 50 .

A cluster computing system having such a configuration can maintain operation processing even if a failure occurs on one of the host computers.

However, if a failure occurs on the storage apparatus system itself that stores the data necessary for operation processing, the operation processing cannot be continued in such a cluster computing system.

For this reason, a configuration shown in FIG. 19 , in which an active host computer and a standby host computer have separate storage apparatuses, may be considered.

In a cluster computing system with the configuration shown in FIG. 19 , a site A 100 , which is active, and a site B 101 , which is standby, have a storage apparatus system A 51 and a storage apparatus system B 52 , respectively. Remote copying takes place at all times between the two storage apparatus systems A 51 and B 52 . Remote copying is a technology in which a plurality of storage apparatus systems installed at physically remote locations copy data (dual writing) without the intervention of any host computers.

For performing remote copying, the storage apparatus systems are connected to each other by a dedicated line or a public telephone line (or a Fibre Channel (FC) network 90 in FIG. 19 ), such that a copy source logical disk volume of the storage apparatus system A 51 of the active site A 100 is copied to a copy destination logical disk volume of the storage apparatus system B 52 of the standby site B 101 .

In this way, the storage apparatus system B 52 operates as a backup system for the storage apparatus system A 51 , thereby maintaining the consistency of data.

When a failure occurs in the storage apparatus system A 51 as shown in FIG. 20 , the host computer A 10 detects the failure and reports via an IP network 30 , which connects the sites, to the host computer B 11 that a failure has occurred in the storage apparatus system A 51 .

In the meantime, the storage apparatus system B 52 of the site B 101 also detects via the FC network 90 that a failure has occurred in the storage apparatus system A 51 , which is the remote copy source.

Upon receiving the report from the host computer A 10 and checking the status of the storage apparatus system B 52 via an interface cable B 41 , the host computer B 11 recognizes that a failure has occurred in the storage apparatus system A 51 of the site A 100 and performs an operation to take over the operation processing.

When the storage apparatus system A 51 of the site A 100 recovers to a state where it can execute operation processing after the operation processing has been taken over by the site B 101 from the site A 100 , the storage apparatus system B 52 , to which is connected the host computer B 11 that took over the operation processing, is set as a remote copy source, while the recovered storage apparatus system A 51 is reset as a remote copy destination; by performing remote copying in this manner, data can be recovered to the storage apparatus system A 51 without suspending the operation of the entire system.

In the prior art configuration in which different sites have their own storage apparatus system as shown in FIG. 19 , operation processing can be continued even when a failure occurs in the active storage apparatus system itself, unlike the system shown in FIG. 17 where a plurality of host computers shares a storage apparatus system.

In a cluster computing system, host computers must constantly monitor each other in order to be able to take over operation processing. In the system shown in FIG. 19 , the heartbeat communications on the IP network that connects the host computers and the remote copying on the FC network that connects the storage apparatus systems are utilized to check the status of the counterpart sites and recognize any occurrence of failure. The system, however, may not recover smoothly from failures, depending on the mode of failure occurrence.

Referring to FIGS. 21 and 22 , a description is made as to situations in which the system does not recover smoothly from failures, depending on the mode of failure occurrence.

FIG. 21 is a diagram illustrating a situation in which a failure occurs on the IP network 30 and the FC network 90 in the configuration shown in FIG. 19 .

FIG. 22 is a diagram illustrating a situation in which a failure occurs at the site A in the configuration shown in FIG. 19 .

One mode of failure occurrence is a situation in which, as shown in FIG. 21 , both the IP network 30 that connects the host computer A 10 of the site A 100 with the host computer B 11 of the site B 101 , and the FC network 90 that connects the storage apparatus system A 51 of the site A 100 with the storage apparatus system B 52 of the site B 101 become disconnected (hereinafter called a “total disconnection of networks between sites” or simply a “total inter-site network disconnection state”).

In such a situation, since there is no means of communication between the sites, the sites cannot monitor the status of each other.

Another mode of failure occurrence is a situation in which, as shown in FIG. 22 , both the host computer A 10 and the storage apparatus system A 51 of the site A 100 fail simultaneously, for example, which causes the entire system within the site A 100 to fail (hereinafter called a “site failure”).

From the perspective of the host computer B 11 of the site B 101 , since it cannot obtain information from the site A 100 in either situation, the host computer B 11 cannot determine whether the problem is a total disconnection of networks between sites shown in FIG. 21 or a site failure shown in FIG. 22 .

Generally in conventional cluster computing systems, when a total disconnection of networks between sites occurs and the sites become incapable of monitoring each other, the site that did not fail cannot obtain information about the counterpart site at all; this situation leaves the following three options available based on logic:

(1) a state in which operation processing is executed at both sites regardless of the status of counterpart sites (i.e., a split brain state);

(2) a state in which operation processing is halted at both sites regardless of the status of counterpart sites; and

(3) a state in which operation processing is continued only at the site that had been executing operation processing until then.

For example, when the (1) split brain state results from a total disconnection of networks between sites shown in FIG. 21 , the host computers at both sites update data in the logical disk volumes in their respective storage apparatus systems, which causes data in the remote copy source and data in the remote copy destination to be inconsistent.

In reality, if in the total disconnection of networks between sites in FIG. 21 the host computer A 10 of the site A 100 determines that a site failure has occurred at the site B 101 and continues to operate, while the host computer B 11 of the site B 101 also determines that a site failure has occurred at the site A 100 , the (1) split brain state results.

Consequently, although the site B 101 must remain in a standby state while the site A 100 remains active in the total disconnection of networks between sites in FIG. 21 , the site B 101 cannot control logically since it cannot differentiate the total disconnection of networks between sites from the site failure in FIG. 22 . In the situation in FIG. 22 , unless the site B 101 begins operation upon confirming a failure, it would result in (2) state.

Consequently, the prior art in general entails the problem of not being able to ensure the reliability of the system as a whole unless the standby site B 101 can differentiate the total disconnection of networks between sites from the site failure.

Also, when the cluster computing system is provided with a plurality of routes or links to be selected between sites, such a cluster computing system may be more sound and more reliable than ordinary cluster computing systems without such selectable links. However, even such a system cannot cope with hazards such as large-scale fire of a site itself or of a communication route between sites when the communication condition is extremely poor.

The present invention has been conceived to solve the above problem, and relates to a cluster computing system that has an active system and a standby system, and that can operate both systems without inconsistencies even in the event of a failure of networks that connect the sites of the two systems, regardless of the mode of failure, and recover from the failure.

The above problem occurs due to the fact that checking the status of counterpart sites in a cluster computing system having a plurality of sites relies on a network between host computers or on a network between storage apparatus systems. When such network communications are interrupted, the sites are incapable of checking the status of each other.

Networks between sites, such as IP networks and FC networks, for monitoring the status of counterpart sites are wire cables. However, when using wire cables, the possibility of all cables becoming simultaneously disconnected (a total disconnection of networks between sites) as a result of an earthquake or cable fire cannot be denied. A disconnection of wire cables can significantly undermine the effectiveness of disaster recovery, which is a feature of cluster computing systems.

In accordance with an embodiment of the present invention, failure reports to counterpart sites take place using wireless communications apparatuses in order to eliminate the shortcoming entailed in using another wire cable as a means to monitor status.

According to this configuration, a cluster computing system according to the present embodiment may operate in a similar manner as a conventional cluster computing system would in the absence of failure, while enhancing the reliability of the system by ensuring a communication means between counterpart sites through wireless communications even in situations where an ordinary cluster computing system would not be able to maintain appropriate operation, such as when a wire cable as a means of monitoring status is disconnected.

In other words, in accordance with the embodiment of the present invention, by using an infrastructure (e.g., satellite communications, wireless LAN) different from wire cables, which entail a high possibility of disconnection, failure reports using wireless communications apparatuses, which have minimal possibility of simultaneous failure with wire cables, are provided as an alternative to information exchange between sites using wire cables. As a result, a system in which failure reports can be sent to a counterpart site even after a total disconnection of networks between sites occurs can be realized. Consequently, in any of the three logics indicated earlier, appropriate operation (i.e., taking over operation processing when a failure occurs) in a cluster computing system can be realized.

However, wireless communications entail problems in terms of unstable communications, such as electromagnetic interference and operational errors. For this reason, instead of permanent connections to constantly monitor the status of counterpart sites as in status monitoring in conventional cluster computing systems, the connection of the wireless communications used in the present embodiment may be limited to situations only when operation processing is to be taken over after a total disconnection of networks between sites occurs, thereby minimizing problems entailed in wireless communications.

Due to the fact that failure reports by wireless communications apparatuses used in a system in accordance with the embodiment of the present invention do not entail exchange of complicated data or permanent connections as in status monitoring in conventional networks between sites, and are instead limited to reporting an occurrence of failure when a failure occurs, a measure to monitor status according to the present embodiment has a configuration different from conventional configurations.

Other objects, features and advantages of the invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

FIG. 1 shows a diagram of a system configuration of a cluster computing system in accordance with a first embodiment of the present invention.

FIG. 2 shows a diagram of the internal configuration of a host computer A.

FIG. 3 shows a diagram of the internal configuration of a storage apparatus system A.

FIG. 4 shows a diagram of the internal configuration of a wireless communications apparatus A.

FIG. 5 shows a diagram illustrating a situation in which a total disconnection of networks between sites occurs in the cluster computing system according to the present invention.

FIG. 6 shows a diagram illustrating a situation in which a total disconnection of networks between sites and a storage apparatus system failure occur simultaneously in the cluster computing system according to the present invention.

FIG. 7 shows a diagram illustrating a situation in which a site failure occurs in the cluster computing system according to the present invention.

FIG. 8 shows a diagram illustrating a situation in which a total disconnection of networks between sites and a site failure occur simultaneously in the cluster computing system according to the present invention.

FIG. 9 shows a flowchart illustrating the main operation of the host computer A of a site A.

FIG. 10 shows a flowchart illustrating the main operation of the wireless communications apparatus A 160 of the site A.

FIG. 11 shows a flowchart illustrating the main operation of a host computer B of a site B.

FIG. 12 shows a flowchart illustrating the main operation of a wireless communications apparatus B of the site B.

FIG. 13 shows a flowchart indicating side-by-side the operations of the host computer A and the wireless communications apparatus A for a “processing in the event of a storage apparatus system failure of the site A.”

FIG. 14 shows a flowchart indicating side-by-side the operations of the host computer B and the wireless communications apparatus B in the site B for the “processing in the event of inability to obtain information from the site A.”

FIG. 15 shows a flowchart of the operation of the wireless communications apparatus A after a site failure of the site A.

FIG. 16 shows a diagram of a system configuration of a cluster computing system in accordance with a second embodiment of the present invention.

FIG. 17 shows a diagram of a system configuration of a general cluster computing system in which a storage apparatus system is shared by host computers.

FIG. 18 shows a diagram illustrating a situation in which a failure occurs in a host computer A in the system shown in FIG. 17 .

FIG. 19 shows a diagram of a system configuration of a general cluster computing system in which a separate storage apparatus system is provided for each site.

FIG. 20 shows a diagram illustrating a situation in which a failure occurs in a storage apparatus system A of a site A in the system shown in FIG. 19 .

FIG. 21 shows a diagram illustrating a situation in which a failure occurs on an IP network 30 and an FC network 90 in the configuration shown in FIG. 19 .

FIG. 22 shows a diagram illustrating a situation in which a failure occurs at the site A in the configuration shown in FIG. 19 .

First Embodiment

Preferred embodiments of the present invention are described below with reference to the accompanying drawings.

First, a cluster computing system in accordance with a first embodiment of the present invention is described with reference to FIGS. 1 through 15 .

(I) The System Configuration of Cluster Computing System:

First, referring to FIGS. 1-4 , a system configuration of the cluster computing system according to the first embodiment of the present invention is described.

FIG. 1 is a diagram of the system configuration of a cluster computing system according to the first embodiment of the present invention.

FIG. 2 is a diagram of the internal configuration of a host computer A.

FIG. 3 is a diagram of the internal configuration of a storage apparatus system A.

FIG. 4 is a diagram of the internal configuration of a wireless communications apparatus A.

The cluster computing system in accordance with the first embodiment of the present invention includes a site A 100 , which is an active system, and a site B 101 , which is a standby system, as shown in FIG. 1 .

In a configuration similar to the prior art, a host computer A 10 , which is an active host computer, and a host computer B 11 , which is a standby host computer, are connected to storage apparatus systems 51 and 52 , respectively, by interface cables A 40 and B 41 , respectively, to perform I/O requests.

Also, the host computer A 10 that performs operation processing and the host computer B 11 that is in a standby state have, via an IP network 30 that connects them, heartbeat communication in order to monitor the status of each other.

Furthermore, the cluster computer system in accordance with the present embodiment is provided with a remote copy function, such that a copy source logical disk volume 21 of the storage apparatus system A 51 of the active site A 100 is copied to a copy destination logical disk volume 22 of the storage apparatus system B 52 of the standby site B 101 through an inter-storage network such as an FC network 90 .

The host computer A 10 of the site A 100 as the host computer of the active system executes operation processing such as read/write to and from the storage apparatus system A 51 connected to the host computer A 10 by the interface cable A 40 . In the meantime, the host computer B 11 of the site B 101 is in a standby state as the standby host computer.

A wireless communications apparatus A 160 is further connected to the host computer A 10 of the site A 100 via an interface cable AR 180 , while a wireless communications apparatus B 161 is connected to the host computer B 11 of the site B 101 via an interface cable BR 181 .

The wireless communications apparatuses A 160 and B 161 are housed in disaster-resistant containers, which are similar to black boxes that house airplane voice recorders, in order to prevent any failure from affecting the wireless communications apparatuses A 160 and B 161 even in the event of a site failure caused by an earthquake, fire or terrorism, for example, such that a report of site status can be made to the counterpart site even after a site failure occurs.

The wireless communications apparatus A 160 of the site A 100 has a function, based on an instruction from the host computer A 10 or on a self-judgment that the host computer A 10 has failed, to call the wireless communications apparatus B 161 of the site B 101 and to report to the host computer A 10 whether such a call has succeeded. The wireless communications apparatus A 160 also monitors the status of the host computer A 10 via the interface cable AR 180 . As a result, even if a site failure occurs at the site A 100 , the wireless communications apparatus A 160 can detect the failure via the interface cable AR 180 and can call the wireless communications apparatus B 161 for the site B 101 to take over the operation processing the site A 100 had been performing until then. On the other hand, the wireless communications apparatus B 161 of the site B 101 has functions to receive calls from the wireless communications apparatus A 160 of the site A 100 and to report to the host computer B 11 whether such a call has been received; and like the wireless communications apparatus A 160 , the wireless communications apparatus B 161 also monitors the status of the host computer B 11 via the interface cable BR 181 .

In this way, the wireless communications apparatuses A 160 and B 161 according to the present invention have particular programs to perform various functions, such as, for example, a function to begin a call based on an instruction from a host computer, a function to monitor the status of the host computer and to spontaneously begin a call based on the status, and a function to report the result of the call to the host computer, and are apparatuses that perform unique operations according to the present invention.

The wireless communications route may be satellite communications or wireless LAN functions. Furthermore, public communications network used in communication routes for mobile telephones may also be used.

As shown in FIG. 2 , the host computer A 10 includes a CPU 10 a , a memory 10 b , an input device 10 c , a display device 10 d , a wireless communications apparatus interface 10 e , and an IP interface 10 f.

The wireless communications apparatus interface 10 e is an interface for communicating with the wireless communications apparatus A 160 , while the IP interface 10 f is an interface for communicating with the other site. These may be the same communications interface.

As shown in FIG. 3 , the storage apparatus system A 51 comprises a controller 51 a , a control memory 51 b , a cache memory 51 c , an FC interface 51 d , and a plurality of disk apparatuses 51 e , 51 f , 51 g , etc.

The controller 51 a has a function to control various parts of the storage apparatus system A 51 . The cache memory 51 c is a memory for caching data in order to make access to the disk apparatuses 51 e , etc. at higher speeds, and the control memory 51 b is a memory for caching control data used by the controller 51 a . The FC interface 51 d connects the storage apparatus system A 51 to the other storage apparatus system B 52 using a Fibre Channel.

As shown in FIG. 4 , the wireless communications apparatus A 160 includes a controller 160 a , a memory 160 b , a send/receive circuit 160 c , a host monitoring section 1 60 d , and a host interface 160 e.

The controller 160 a has the internal control of the wireless communications apparatus A 160 ; the controller 160 a receives commands sent from the host computer A 10 via the host interface 160 e and reports from the host monitoring section 160 d , interprets them, and issues commands to the outside.

The host monitoring section 160 d monitors the host computer A 10 via the host interface 160 e and reports the results to the controller 160 a.

The send/receive circuit 160 c performs baseband processing, carrier processing and high frequency processing, which are processing performed by ordinary wireless communications apparatuses, in order to send commands and data from the controller 160 a to the outside and to receive commands and data from the outside and convey them to the controller 160 a.

(II) Operation of Cluster Computing System at the Time of Failure:

The following is a description, using FIGS. 5-13 , of the operation of the cluster computing system according to the present embodiment when a failure occurs.

(II-1) Summary of Failure Modes and Operations:

First, referring to FIGS. 5-8 , failure modes and operations of the cluster computing system according to the present embodiment are described.

FIG. 5 is a diagram illustrating a situation in which a total disconnection of networks between sites occurs in the cluster computing system according to the present invention.

FIG. 6 is a diagram illustrating a situation in which a total disconnection of networks between sites and a storage apparatus system failure occur simultaneously in the cluster computing system according to the present invention.

FIG. 7 is a diagram illustrating a situation in which a site failure occurs in the cluster computing system according to the present invention.

FIG. 8 is a diagram illustrating a situation in which a total disconnection of networks between sites and a site failure occur simultaneously in the cluster computing system according to the present invention.

A total disconnection of networks between sites is a situation indicated in FIG. 5 , as described above, when both the IP network 30 , which connects the host computer A 10 of the site A 100 with the host computer B 11 of the site B 101 , and the FC network 90 , which connects the storage apparatus system A 51 of the site A 100 with the storage apparatus system B 52 of the site B 101 , are both disconnected.

In such a case, the active system continues operation while the standby system continues to stand by, according to the cluster computing system of the present invention.

When a storage apparatus system failure occurs in a state of total disconnection of networks between sites, as shown in FIG. 6 , the site A 100 communicates via the wireless communications apparatus A 160 with the site B 101 , and the standby system begins operation for the first time.

A site failure is a situation in which the entire system of the site A 100 fails as shown in FIG. 7 , due to, for example, the host computer A 10 and the storage apparatus system A 51 of the site A 100 failing simultaneously.

In this case, the site A 100 communicates via the wireless communications apparatus A 160 with the site B 101 and the standby system begins operation.

FIG. 8 indicates a situation in which a total disconnection of networks between sites and a site failure occur simultaneously.

As in the situation shown in FIG. 7 , the site A 100 communicates via the wireless communications apparatus A 160 with the site B 101 and the standby system begins operation in this situation as well.

In the situations shown in FIGS. 7 and 8 , the wireless communications apparatus A 160 of the site A 100 detects a site failure and communicates this to the wireless communications apparatus B 161 of the site B 101 , and the standby system begins operation.

The operation of the site B 101 is the same in both situations illustrated in FIGS. 7 and 8 ; since information cannot be obtained from the site A 100 , the wireless communications apparatus B 161 waits for a call from the wireless communications apparatus A 160 . When a failure occurs at the site A 100 , the wireless communications apparatus B 161 receives a failure report and issues to the host computer B 11 a command to begin operations, and operation begins in the site B 101 .

(II-2) Main Operation of Host Computer A 10 of Site A 100 :

The main operation of the host computer A 10 of the site A 100 is described below with reference to FIG. 9 .

FIG. 9 is a flowchart illustrating the main operation of the host computer A 10 of the site A 100 .

The host computer A 10 of the site A 100 performs operation processing as the host computer of the active system and uses networks between the sites, e.g., the IP network 30 and the FC network 90 , to monitor the status of the site B 101 .

If in this state a failure that makes the operation processing impossible to be continued by the host computer A 10 of the site A 100 occurs in the system within the site A 100 , information to this effect is communicated via the networks between the sites and the operation processing is taken over by the host computer B 11 of the site B 101 .

This series of operations is performed in conventional cluster computing systems and is called a “normal cluster management processing” (S 600 ) in this embodiment.

When a total disconnection of networks between sites occurs during the normal cluster management processing and the host computer A 10 becomes unable to obtain information about the site B 101 using the networks between the sites (i.e., inter-site networks) (S 601 : Yes), the host computer A 10 of the site A 100 that had been performing operation processing until then shifts to a processing to continue to perform operation processing (hereinafter called a “management processing to give priority to active system,” S 602 ).

In conventional cluster computing systems, when a total disconnection of networks between sites occurs, host computers at both sites determine that a site failure has occurred at the counterpart site and either the site that had been performing operation processing until then would halt the operation processing (in which case, the operation processing would be halted at both sites) or the site that had been in a standby state until then would take over the operation processing (in which case, a split brain state would result); however, according to the cluster computing system of the present invention, even if a total disconnection of networks between sites occurs, the active system continues to execute the operations it had been executing until then. In the meantime, the site that had been in a standby state maintains its standby state.

Due to the fact that information can be communicated via wireless communications even if a total disconnection of networks between sites occurs, the “management processing to give priority to active system” takes place based on the concept that the active system should continue to perform processing while the standby system should begin operation processing only if and when it is instructed to do so by the active system.

If the host computer A 10 detects through the interface cable A 40 that a failure has occurred in the storage apparatus system A 51 during the “management processing to give priority to active system” (S 603 : Yes), or if it cannot obtain information from the storage apparatus system A 51 due to a failure of the interface cable A 40 itself, the host computer A 10 shifts to a “processing in the event of a storage apparatus system failure” (S 3000 H) since the host computer A 10 can no longer continue the operation processing it had been performing until then.

(II-3) Main Operation of Wireless Communications Apparatus A 160 of Site A 100 :

The main operation of the wireless communications apparatus A 160 of the site A 100 is described below with reference to FIG. 10 .

FIG. 10 is a flowchart illustrating the main operation of the wireless communications apparatus A 160 of the site A 100 .

As described above with reference to FIG. 1 , the wireless communications apparatus A 160 of the site A 100 is connected to the host computer A 10 via the interface cable AR 180 .

The wireless communications apparatus A 160 is normally in a standby state for a command (hereinafter called a “command standby state”) (S 700 ). At the same time, the wireless communications apparatus A 160 monitors the status of the host computer A 10 via the interface cable AR 180 and constantly monitors information about the host computer A 10 obtained through the interface cable AR 180 .

When the wireless communications apparatus A 160 receives a call instruction command, described later, via the interface cable AR 180 from the host computer A 10 of the site A 100 during the command standby state (S 702 : Yes), the wireless communications apparatus A 160 shifts to a “processing in the event of a storage apparatus system failure” (S 3000 R).

On the other hand, if the wireless communications apparatus A 160 cannot obtain information about the host computer A 10 via the interface cable AR 180 due to a site failure of the site A 100 during the command standby state (S 701 : No), the wireless communications apparatus A 160 shifts to a “processing in the event of a site failure” (S 5000 R).

(II-4) Main Operation of Host Computer B 11 of Site B 101 :

The main operation of the host computer B 11 of the site B 101 is described blow with reference to FIG. 11 .

FIG. 11 is a flowchart illustrating the main operation of the host computer B 11 of the site B 101 .

As described earlier, the host computer B 11 of the site B 101 is in a standby state as the host computer of the standby system and uses networks between the sites, e.g., the IP network 30 and the FC network 90 , to monitor the status of the site A 100 .

If in this state a failure that makes the operation processing impossible to be continued at the site A 100 occurs in the system within the site A 100 , the host computer B 11 of the site B 101 takes over the operation processing of the site A 100 . In other words, a management processing (the normal cluster management processing) that is similar to that of a conventional cluster computing system takes place (S 800 ).

If it becomes impossible for the host computer B 11 to monitor the status of the site A 100 using the IP network 30 and/or the FC network 90 due to a total disconnection of networks between sites or a site failure of the site A 100 during the normal cluster management processing (S 801 : Yes), the host computer B 11 shifts to a “processing in the event of inability to obtain information from the site A 100 ” (S 4000 H).

(II-5) Main Operation of Wireless Communications Apparatus B 161 of Site B 101 :

The main operation of the wireless communications apparatus B 161 of the site 101 is described below with reference to FIG. 12 .

FIG. 12 is a flowchart illustrating the main operation of the wireless communications apparatus B 161 of the site B 101 .

The wireless communications apparatus B 161 of the site B 101 is normally in the command standby state (S 900 ).

If the wireless communications apparatus B 161 receives a standby instruction command from the host computer B 11 during the command standby state (S 901 : Yes), the wireless communications apparatus B 161 shifts to a “processing in the event of inability to obtain information from the site A 100 ” (S 4000 R).

(II-6) Operation of Processing in Event of Storage Apparatus System Failure of Site A 100 :

The operation of the “processing in the event of a storage apparatus system failure of the site A 100 ” is described below with reference to FIG. 13 .

FIG. 13 is a flowchart indicating side-by-side the operations of the host computer A 10 and the wireless communications apparatus A 160 for the “processing in the event of a storage apparatus system failure of the site A.”

Let us assume that a failure occurs in the storage apparatus system A 51 of the site A 100 after a total disconnection of networks between sites has occurred, as shown in FIG. 6 .

The operation of the host computer A 10 takes place when the host computer A 10 in S 1000 shifts to the flow for a “processing in the event of a storage apparatus system failure” (S 3000 H).

The host computer A 10 of the site A 100 issues the call instruction command to the wireless communications apparatus 160 via the interface cable AR 180 . The call instruction command is a command to instruct a call to the wireless communications apparatus B 161 .

Upon receiving the call instruction command (S 701 , S 1501 ), the wireless communications apparatus A 160 begins a call to the wireless communications apparatus B 161 of the site B 101 and sends a packet containing its own verification ID to identify itself (S 1502 ).

The wireless communications apparatus A 160 repeats the call to the wireless communications apparatus B 161 until it connects with the wireless communications apparatus B 161 (S 1503 : No); if the call connects with the wireless communications apparatus B 161 even once (S 1503 : Yes), the call is immediately disconnected (S 1504 ).

When the call from the wireless communications apparatus A 160 to the wireless communications apparatus B 161 succeeds, it signifies that a request to take over operation processing has been communicated.

As described later, since the site B 101 begins operation processing if a call from the wireless communications apparatus A 160 connects with the wireless communications apparatus B 161 even once and it receives the verification ID of the wireless communications apparatus A 160 , the site A 100 can terminate the “processing in the event of a storage apparatus system failure” at this point.

(II-7) Operation in Site B 101 for Processing in the Event of Inability to Obtain Information from Site A 100 :

The operation in the site B 100 for the “processing in the event of inability to obtain information from the site A 100 ” is described below with reference to FIG. 14 .

FIG. 14 is a flowchart indicating side-by-side the operations of the host computer B 11 and the wireless communications apparatus B 161 in the site B 101 for the “processing in the event of inability to obtain information from the site A 100 .”

The failure mode can be a total disconnection of networks between sites as shown in FIG. 5 , a site failure as shown in FIG. 7 , or both as shown in FIG. 8 .

The operation of the host computer B 11 is the operation that takes place when the host computer B 11 in S 2000 shifts to the “processing in the event of inability to obtain information from the site A” (S 4000 H).

The host computer B 11 of the site B 101 issues a standby instruction command to the wireless communications apparatus B 161 (S 1600 ). The standby instruction command is a command for the wireless communications apparatus B 161 to stand by for a call from the wireless communications apparatus A 160 .

When the wireless communications apparatus B 161 receives the standby instruction command from the host computer B 11 via the interface cable BR 181 (S 901 , S 1604 ), the wireless communications apparatus B 161 goes into a standby state to wait for a call from the wireless communications apparatus A 160 (S 1605 ). The standby state is the only state in which the wireless communications apparatus B 161 accepts calls from outside; if a call were to be made from the outside in states other than the standby state, the wireless communications apparatus B 161 would ignore the call and maintain the current state. This prevents operational errors.

If there is a call from the wireless communications apparatus A 160 during the standby state (S 1606 : Yes), the wireless communications apparatus B 161 uses the verification ID to check that the call is from the wireless communications apparatus A 160 (S 1607 ); if it is confirmed that the call is from the wireless communications apparatus A 160 , the wireless communications apparatus B 161 issues an operation processing start instruction command to the host computer B 11 via the interface cable BR 181 (S 1608 ). The operation processing start instruction command is a command for the wireless communications apparatus B 161 to instruct the host computer B 11 to begin operation processing.

Upon receiving the operation processing start instruction command (S 1602 : Yes), the host computer B 11 recognizes for the first time that a trouble that makes the operation processing impossible to continue at the site A 100 has occurred at the site A 100 , and begins operation processing (S 1603 ). When the host computer B 11 begins the operation processing, this signifies that the operation processing that had been performed by the host computer A 10 of the site A 100 has been taken over by the host computer B 11 of the site B 101 .

(II-8) The Operation of the Wireless Communications Apparatus A 160 after a Site Failure of the Site A 100 :

Let us assume that a site failure occurs at the site A 100 , i.e., a failure caused by an earthquake, fire or terrorism, for example, occurs on the entire system within the site A 100 , as in FIG. 6 . Furthermore, a total disconnection of networks between sites may occur in addition to the site failure, as shown in FIG. 8 .

The operation of the wireless communications apparatus A 160 after a site failure of the site A 100 is described below with reference to FIG. 15 .

FIG. 15 is a flowchart of the operation of the wireless communications apparatus A 160 after a site failure of the site A 100 occurred.

However, we will assume that the failure has not affected the wireless communications apparatus A 160 , since it is in a black box blocked from the rest of the system.

The operation of the wireless communications apparatus A 160 is the operation that takes place when the wireless communications apparatus A 160 in S 1000 shifts to the “processing in the event of a site failure” (S 5000 R).

Due to the fact that the wireless communications apparatus A 160 of the site A 100 monitors the status of the host computer A 10 via the interface cable AR 180 , the wireless communications apparatus A 160 determines that a site failure has occurred at the site A 100 , begins a call to the wireless communications apparatus B 161 , and sends a packet containing its own verification ID to identify itself (S 1700 ).

The wireless communications apparatus A 160 repeats the call to the wireless communications apparatus B 161 until it connects with the wireless communications apparatus B 161 (S 1701 : No); if the call connects with the wireless communications apparatus B 161 once (S 1701 : Yes), the call is immediately disconnected (S 1702 ). When a call from the wireless communications apparatus A 160 to the wireless communications apparatus B 161 is accepted even once, it is deemed that taking over of the operation processing is completed.

The following processing by the host computer B 11 and the wireless communications apparatus B 161 of the site B 101 is the same as the “processing in the event of a storage apparatus system failure” (S 3000 H, S 3000 R).

Since the host computer B 11 of the site B 101 becomes incapable of monitoring the status of the site A 100 using the IP network 30 and/or the FC network 90 in the total disconnection of networks between sites and in the site failure (S 801 : Yes), the host computer B 11 shifts to the “processing in the event of inability to obtain information from the site A” (S 4000 H).

The host computer B 11 issues a standby instruction command to the wireless communications apparatus B 161 (S 1600 ), and the wireless communications apparatus B 161 waits for a call from the wireless communications apparatus A 160 (S 1605 , S 1606 ). When the wireless communications apparatus B 161 receives a call and verification ID from the wireless communications apparatus A 160 , the wireless communications apparatus B 161 issues an operation processing start instruction command to the host computer B 11 (S 1608 ), and the host computer B 11 begins operations (S 1603 ).

Second Embodiment

A cluster computing system in accordance with a second embodiment of the present invention is described below with reference to FIG. 16 .

FIG. 16 is a diagram of a system configuration of the cluster computing system according to the second embodiment of the present invention.

In the first embodiment, the site A 100 and the site B 101 had separate storage apparatus systems to perform remote copying.

In the present embodiment, a site A 100 including a wireless communications apparatus A 160 and a site B 101 including a wireless communications apparatus B 161 share a storage apparatus system 50 . When a failure occurs at the site A 100 in this system configuration, by having the wireless communications apparatus A 160 communicate with the wireless communications apparatus B 161 , communication takes place between an active system and a standby system and failure recovery processing can be performed, as in the first embodiment.

As described above, according to the present invention, by adding to a conventional cluster computing system having a remote copy function a function to report failures to a counterpart site using wireless communications apparatuses, a failure of a counterpart site can be recognized even after a total disconnection of networks between sites occurs. Consequently, even if a failure occurs at a site performing operation processing after the occurrence of a total disconnection of networks between sites, a proper judgment can be made as to whether the other site should take over the operation processing.

Instead of strengthening the disaster recovery function by simply providing redundant wire cables, which are used as a means to monitor status in conventional systems, the present invention strengthens the disaster recovery function by adding a means to report status using wireless communications based on an infrastructure different from wire cables.

In this way, according to the present invention, a cluster computing system can be provided that has an active system and a standby system, and that can operate both systems without inconsistencies even in the event of a failure of networks that connect the sites of the two systems, regardless of the mode of failure, and recover from the failure.

While the description above refers to particular embodiments of the present invention, it will be understood that many modifications may be made without departing from the spirit thereof. The accompanying claims are intended to cover such modifications as would fall within the true scope and spirit of the present invention.

The presently disclosed embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims, rather than the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.