Computer system comprising at least two computers for continuous operation of said system

The present invention relates to a computer system of the type comprising at least two computers.

More in particular, the present invention relates to a computer system comprising at least two computers, in particular two servers, connected to each other in such a manner as to appear as a single unit to an external user.

The present invention also relates to a method for continuous operation of a computer system comprising at least two computers.

The growing importance of "Information Technology" infrastructures has led to an increasing need for systems capable of ensuring highly reliable inbound and outbound services, beginning from servers. The reliability of a system is related to its capability of restoring or maintaining its normal operation when a fault occurs, e.g. a failure or malfunction of any of its components or other components connected thereto, whether hardware or software, and of ensuring a certain degree of data congruence in such a situation.

In the past, and to some extent still today, the need for highly reliable servers always clashed with the complexity of the hardware and software required and with the purchase and maintenance costs thereof.

In recent years, conventional "single server" systems, i.e. systems using a single server, have been significantly improved in terms of capability of withstanding some kinds of malfunctions. By introducing redundant power supply and cooling subsystems, data protection mechanisms with RAID (Redundant Array of Independent Disks) technology, and "intelligent" memory and processor management systems, the manufacturers have tried to limit the damage caused by failures of delicate parts.

However, in spite of all this technological advance, a single server is still subject to many risks of failure or malfunction, which may prevent services from being provided. The most serious limitation is that it is not possible to foresee the time required for restoring the normal operation of the system. As a matter of fact, said time in turn depends on assistance times, which may vary according to daytime or night time, whether the day of occurrence is a workday or a holiday, and depending on the distance that the operator or technician must cover to reach the installation site. The risk is further augmented by the time required for obtaining any necessary spare parts, also considering that this technology is evolving rapidly and some components often become difficult to find on the market after just a few years. For this reason, some companies decide - somewhat paradoxically - to purchase two complete servers, one of which is kept as a spare server for emergency situations.

Another conventional approach to the problem of providing a highly reliable system is the cluster technology. The cluster technology allows to join together two or more servers, which must necessarily be equal, within a single logic unit. However, the complexity and cost of a cluster having more than two nodes are such that this configuration will not even be taken into consideration herein.

From a physical point of view, all servers (nodes) belonging to a cluster are connected together through a dedicated connection, typically a LAN, and can access the same disk pools, e.g. with SCSI SATA / ATA or Fiber Channel technology. All nodes have one local disk or two Raid 1 (mirroring) disks, not shared among them, which host the operating system and applications, or a part thereof, while user data is stored in the shared pool.

With the cluster technology, resources like network name, IP address, applications, services and disk space are virtualized. These virtual units can be active on one cluster node only, and are moved automatically from one node to another when a malfunction occurs or when maintenance work must be carried out.

The users of the services are automatically directed to the node where the corresponding virtual units are located. There are also special applications which operate simultaneously on both nodes of the cluster.

A cluster solves the reliability issue from a continuity point of view ("business continuity"), but it cannot solve the problem of continuous processing: when a node fails, in fact, all tasks running on that node will stop, with serious consequences such as the disconnection of all connected users. The services are then moved to another node, where they will be activated in the same way as they are activated at server start-up. All of the most common operating systems offer cluster options having similar functionality: among these options, the one provided by Microsoft® is the most known and widespread; this is why it has been used for the examples contained herein.

A cluster solution represents a big quality jump with respect to a single server solution as far as technology is concerned, but it has nonetheless a number of critical points. The cost of the operating system and of the clustering software is very high, being more than five times the cost of the software required for a single server; setup costs are also higher, since this is quite a delicate operation. Management costs are high as well, due to the complexity and delicacy involved in the management of two nodes, wherein a single mistake could cause the loss of all user data. Therefore, the solution to these problems is not within the grasp of a typical system administrator.

In addition to the above-mentioned drawback related to excessive costs, the cluster also suffers from a limitation due to the fact that the user data and application data is stored in a pool of disks which can be viewed directly (DAS) from any node through an SCSI or Fiber Channel bus. The failure of any component connected to this bus may block the entire bus and therefore the whole cluster ("single point of failure").

Moreover, one disk of the cluster pool is used as a "quorum disk", and contains everything that is needed to ensure the proper operation of the cluster itself. Should data on this disk become corrupted, the whole cluster will be blocked ("single point of failure").

The object of the present invention is to provide a computer system which is less costly in comparison with conventional cluster systems, while at the same time being more reliable than the aforementioned single server systems.

Therefore, the present invention discloses a computer system as described in claim 1. Preferred embodiments of the system according to the invention are set out in the dependent claims 2 to 16. The present invention also relates to a method for continuous operation of a computer system as described in claim 17, preferred embodiments of which being set out in the dependent claims 18 to 24.

To better understand the invention and to fully appreciate the advantages thereof , a number of non-limiting examples of embodiment of the invention will be described below with reference to the annexed drawings, wherein: <ul id="ul0001" list-style="dash" compact="compact"><li><figref idref="f0001">Fig. 1</figref> schematically shows an example of embodiment of a computer system according to the invention comprising two computers, in particular two servers;</li><li><figref idref="f0002">Fig. 2</figref> is a perspective view of the assembled computer system of <figref idref="f0001">Fig. 1</figref>;</li><li><figref idref="f0003">Fig. 3</figref> shows an operating diagram of the functional states of the computer system of <figref idref="f0001">Fig. 1</figref>.</li></ul>

<figref idref="f0001">Fig. 1</figref> shows a diagram of a computer system 100 according to an embodiment of the invention. Computer system 100 comprises at least a first server SRV1 and a second server SRV2 connected to first server SRV1, thus appearing as a single unit to an external user of the system. It should be noted that, even though the teachings of the invention are particularly suited to server systems, they are also applicable to other types of electronic computers, to which the level of reliability thus obtained may turn out to be useful as well.

According to the described example, first server SRV1 is of a per se conventional type and comprises a first motherboard 1, a first control and processing unit 2, a first memory 3, e.g. a RAM memory, and a first RAID type controller module 4, RAID being the acronym of "Redundant Array of Independent Disks".

For instance, motherboard 1 may be an Intel SE7320EP2 board capable of loading a conventional BIOS (Basic Input/Output System) such as, for example, an AMI BIOS. As known, a BIOS is software determining the operations that the respective computer can execute without accessing to disk-resident applications.

As is apparent to those skilled in the art, the RAID controller module 4 is devoted to disk management; it also clears any failure situations through reorganization of the disks.

Furthermore, first server SRV1 also includes a first LAN interface module 5 which allows server SRV1 to access a LAN (Local Area Network) and then an external network such as an Internet network.

<figref idref="f0001">Fig. 1</figref> also diagrammatically shows a first power unit 6, such as a power supply connected to a public power mains, used for supplying server SRV1 with the proper power voltage. Said first power unit 6 can be controlled through appropriate signals in order to cut off the power to server SRV1, thus turning it off.

First server SRV1 is also provided with a first electronic management block 7 to which, as detailed below, a part of the management of any faults or failures in the system 100 is assigned. Advantageously, first electronic management block 7 consists of hardware modules and, for example, integrated logic circuits, which are more reliable than software modules.

Second server SRV2 can be provided in the same way as first server SRV1. Therefore, second server SRV2 may comprise modules and blocks which are analogous to the corresponding components of first server SRV1; they are indicated in <figref idref="f0001">Fig. 1</figref> by the same reference numerals used for first server SRV1, with the addition of an apostrophe " ' ". It should be noted that both servers SRV1 and SRV2 are independent of each other, and that only one at the time can operate.

Computer system 100 also comprises an interconnection module 8 having a first input port P1 connected to first server SRV1, in particular to first management block 7, a second port P2 connected to second server SRV2, in particular to second management block 7', and a third port P3 connected to a storage block 9.

For example, interconnection module 8 is an INFINIBAND technology connection which allows both first server SRV1 and second server SRV2 to access storage block 9. The exchange of signals of different types between first management block 7 and second management block 7', and thus between two servers SRV1,SRV2, is implemented through a dedicated LAN which communicates with an RS232 serial interface provided on each server SRV1,SRV2.

Storage block 9 comprises memory modules, e.g. comprising hard disks, wherein the data of system 100 is stored. The example of <figref idref="f0001">Fig. 1</figref> diagrammatically shows a pool of eight hard disks HD1-HD8 capable of storing at least the operating system, e.g. on a first hard disk HD1, which can be loaded by each of two servers SRV1,SRV2, as well as any other software applications or data which can be used by servers SRV1,SRV2 themselves.

By way of example, first hard disk HD1 may store the following operating systems: Microsoft Windows Server 2003 Enterprise Edition, Microsoft Windows 2000 Advanced Server, Red Hat Linux Enterprise, SUSE LINUX Enterprise Server and Novell Netware.

Advantageously, every memory module of storage block 9 is provided with a disk management module EC1-EC8, such as an electronic circuit implementing a control logic, which handles the respective hard disk HD1-HD8. For example, hard disks HD1-HD8 may be SATA or SAS technology units, in particular being HDU SATA II disks; they are mounted into a respective hot-swap type tray together with the respective disk management module EC1-EC8.

It is important to remark that the pool of disks HD1-HD8 is not proprietary to one server SRV1,SRV2, being on the contrary common to both servers SRV1,SRV2; however, it may only be accessed by one server SRV1,SRV2 at a time. Furthermore, the pool of disks HD1-HD8 is provided with a respective redunded power unit 10.

Storage block 9 is connected to third port P3 of the interconnection block through an Infiniband connection.

With reference to <figref idref="f0002">Fig. 2</figref>, computer system 100 may, as far as its external structure is concerned, be equipped with a single chassis 20 housing first server SRV1, second server SRV2 and storage module 9. In addition, each server SRV1,SRV2 may be fitted with an Infiniband backplane acting as an interconnection module 8.

Furthermore, both first server SRV1 and second server SRV2 are provided with a respective application for troubleshooting servers SRV1,SRV2. In particular, each motherboard 1,1' of the respective server SRV1,SRV2 can process a per se conventional "watch-dog" software application, thus being able to detect the occurrence of any anomalous events, such as a failure, in the other server SRV2,SRV1. With this type of application, which may be analogous to the one implemented in prior-art cluster servers, one or the other server SRV1,SRV2 periodically sends a polling or monitoring signal to the other server SRV2,SRV1. If no response is received to the polling signal, server SRV1,SRV2 which sent said signal can infer that a fault has occurred in the other server SRV2,SRV1.

The detectable malfunctions or failures are of different type and may include, for example: malfunction of a CPU 2,2' of servers SRV1, SRV2, failure of a server SRV1, SRV2, failure of a hard disk HD1-HD8, failure of a RAID control module 4,4', failure of a power unit 6,6' or 10, operating system hang, connection hang, disconnected cables, breakdown hub port, malfunction of a user-definable application.

Below an example of operation of computer system 100 will be described with reference to <figref idref="f0003">Fig. 3</figref>.

During a start-up step, not shown, both first server SRV1 and second server SRV2 are turned on and therefore receive power from the respective power units 6,6'.

As a consequence of start-up, both servers SRV1,SRV2 load the respective BIOS. In addition, system 100 is so set up that only one of two servers SRV1,SRV2, e.g. first server SRV1, can access and control storage block 9 through interconnection module 8, thus having access to the contents of hard disks HD1-HD8.

Therefore, first server SRV1 has access to first disk HD1 and loads the operating system, thus entering an active state 112. In said active state 112, first server SRV1 can access all disks in storage block 9 in order to use any software applications residing therein and to process them through its own control and processing unit 2 in a conventional manner.

On the contrary, after having loaded the BIOS, second server SRV2 does not access to storage block 9 and will not load the operating system, thus entering a stand-by state 104.

The different behaviour of two servers SRV1 and SRV2 after start-up, i.e. access enabled or denied to storage block 9, is imposed by respective management block 7 and 7'.

During the normal operation of first server SRV1, second server SRV2 in monitoring state 106 sends polling signals, through its own watch-dog application, to the watch-dog application of first server SRV1 (monitoring state 114), so that any fault conditions of first server SRV1 can be detected. Said polling signals are sent by second server SRV2 to interconnection block 8 and then to first server SRV1. Moreover, each disk management block EC1-EC8 sends signals to and receives signals from first server SRV1 through interconnection block 8.

If an anomalous event is detected in first server SRV1, the system 100 will deny access to and control of storage block 9 to first server SRV1, while at the same time will enable access to second server SRV2.

In particular, the access to the storage block to server SRV1 is denied by advantageously turning off first server SRV1 itself. More in detail, management block 7 is informed about the fault by the watch-dog of first server SRV1 and, by acting on power unit 6, it controls the switching in such a way as to cut off the voltage supply to first server SRV1 (state 116). Subsequently server SRV1 will enter state 118, from which it will return to its initial state 101.

Furthermore, by allowing second server SRV2 to access storage block 9, said server is forced to reboot, i.e. to load the operating system from first hard disk HD1 (state 110), and to enter an active state 102, thus taking full control of storage block 9. The step of transferring the storage block control to second server SRV2 is handled by second management block 7'.

At this point, second server SRV2, which now has access to storage block 9, can read or update the data previously stored therein by first server SRV1 and process the applications residing in said block 9 as necessary. Thus, the faulty system condition caused by the failure occurred in first server SRV1 will be cleared as soon as second server SRV2 has completed the reboot sequence, since computer system 100 can continue to operate.

Should the faulty condition of server SRV1 be solved, the control of system 100 will return to server SRV1 (state 108).

It should be noted that states 101, 104 and 106 are represented by a rectangle filled with right-slanted lines, state 102 is represented by a rectangle filled with left-slanted lines, and states 112 and 114 are represented by a rectangle filled with vertical lines. This corresponds to a signalling system which can be seen externally by a user of computer system 100, thus providing said user with a visual indication of the state of operation of two servers SRV1,SRV2. For example, right-slanted lines correspond to a LED's first blinking frequency, left-slanted lines correspond to a LED's second blinking frequency, which is different and higher than the first one, and vertical lines correspond to an illuminated LED.

It is important to remark that the transfer of the control of block 9 for the storage of system resource(i.e. not just of a specific disk) from a server SRV1,SRV2 to another server SRV2,SRV1 is clearly in contrast with the way cluster servers operate, which on the contrary transfer said resources from one server to another.

It should be noted that both first server SRV1 and second server SRV2 are identified by the same IP address. Therefore, an external user contacting system 100 through a client computer will not be affected by the above-described procedure for transferring the resource control from one server to the other.

For the purpose of preventing an undesired failure of one or both managements blocks 7 and 7' from causing both servers SRV1 and SRV2 to be connected to storage block 9, it has been advantageously provided that the disk management modules EC1-EC8 cause hard disks HD-HD8 to connect to servers SRV1,SRV2 selectively through interconnection module 8, i.e. they connect to only one server SRV1,SRV2 in any operating condition.

It should be noted that, even though reference has been made in the above description to just two servers SRV1,SRV2, the teachings of the present invention are also applicable to a larger number of servers, wherein one or more servers are normally in the active state and the other servers are in the stand-by state, i.e. a state in which only the BIOS has been loaded. Said normally active servers are turned off as a consequence of the detection of one or more faults in the same way as described above.

Computer system 100 turns out to be particularly suited to the following applications: File Server, Application Server, Mail Server, Back End Server, Front End Parallel Processing, Internet Security, VideoSurveillance, Storage Server and CTI (Computer Telephony Integration).

The invention offers several advantages in comparison with conventional systems, in particular with high-reliability cluster server systems. In particular, the above-described computer system 100 is less costly than normal cluster servers, while at the same time offering levels of performance in terms of response time, which is dependent on the reboot time of the server to be brought into the active state, which are similar to those provided by conventional clusters.

The lower costs of the computer system according to the invention is due to the fact that it does not require the purchase of software (operating system or application) dedicated to the management of the cluster mode, nor does it require that the same software be purchased for both servers.

The Applicant has experimentally demonstrated that the response time of system 100 following the detection of a fault is within approximately 120 s. Furthermore, the types of detectable faults are not fewer than those which can be detected by cluster servers, as the same software applications may be used.

Another advantage is offered by the use of distributed management blocks (such as blocks 7 and 7' and EC1-EC8) which are preferably provided as hardware, thus ensuring a higher degree of reliability compared with a software management module while not requiring the risky use of a quorum disk containing all system management modes, unlike cluster servers.

The computer system comprising at least two computers and the related method for continuous operation of said system described herein by way of example may be subject to many possible variations without departing from the novelty spirit of the inventive idea; it is also clear that in the practical implementation of the invention the illustrated details may have different shapes or be replaced with other technically equivalent elements.

It can therefore be easily understood that the present invention is not limited to the above-described computer system comprising at least two computers and the related method for continuous operation for said system, but may be subject to many modifications, improvements or replacements of equivalent parts and elements without departing from the novelty spirit of the inventive idea, as clearly specified in the following claims.