STORAGE APPARATUS, CONTROL METHOD, AND CONTROL PROGRAM

A storage-apparatus has a plurality of storage-devices and a controller for controlling data read from and write to the plurality of storage-devices, the controller includes a determination-unit and a restore-processing-unit, when a new storage-device has failed in a non-redundant state being a redundant group state without redundancy, in which some of the storage-devices had failed out of the plurality of storage-devices, the determination-unit configured to determine whether execution of compulsory restore of the redundant group is possible or not on the basis of a failure cause of the plurality of failed storage-devices, and if the determination unit determines that the execution of compulsory restore of the redundant group is possible, the restore-processing-unit configured to incorporate a plurality of storage-devices including a newly failed storage-device in the non-redundant state into the redundant group and to compulsorily restore the storage-apparatus to an available state.

DESCRIPTION OF EMBODIMENT

In the following, a detailed description is given of a storage apparatus, a control method, and a control program according to an embodiment of the present disclosure with reference to the drawings. In this regard, this embodiment does not limit the disclosed technique.

Embodiment

First, a description is given of a RAID apparatus according to the embodiment.FIG. 1is a diagram illustrating a configuration of a RAID apparatus according to the embodiment. As illustrated inFIG. 1, a RAID apparatus2includes two control modules (CM)21constituting a redundant system, and a device enclosure (DE)22.

The CM21is a controller that controls data read from the RAID apparatus2, and data write to the RAID apparatus2, and includes a channel adapter (CA)211, a CPU212, a memory213, and a device interface (DI)214. The CA211is an interface with a host1, which is a computer using the RAID apparatus2, and accepts an access request from the host1, and makes a response to the host1. The CPU212is a central processing unit that controls the RAID apparatus2by executing an input/output control program stored in the memory213. The memory213is a storage device for storing the input/output control program to be executed on the CPU212and data. The DI214is an interface with the DE22, and instructs the DE22to read and write data.

The DE22includes four disks221, and stores data to be used by the host1. In this regard, here, a description is given of the case where the DE22includes four disks221, and constitutes RAIDS (3+1), that is to say, the case where three units store data for each stripe, and one unit stores parity data. However, the DE22may include the disks221of other than four units. The disk221is a magnetic disk unit that uses a magnetic disk as a data recording medium.

Next, a description is given of a functional configuration of an input/output control program executed on the CPU212.FIG. 2is a diagram illustrating a functional configuration of the input/output control program executed on the CPU. As illustrated inFIG. 2, an input/output control program3includes a table storage unit31, a state management unit32, a compulsory restore unit33, a staging unit34, a write-back unit35, and a control unit36.

The table storage unit31is a storage unit that stores data desired for controlling the RAID apparatus. The data stored in the table storage unit31is stored in the memory213illustrated inFIG. 1. Specifically, the table storage unit31stores RLU_TBL which stores information on the RAID apparatus2, such as a state of the apparatus, a RAID level, and so on, and PLU_TBL which stores information on disks, such as a state of the unit, a capacity, and so on.

Also, the table storage unit31stores information on slice_bitmap as SLU_TBL. Here, slice_bitmap is information indicating an area into which data is written in a state in which the RAID apparatus2lost redundancy, and represents a state of a predetermined-size area specified by logical block address (LBA) by one bit.

FIG. 3is a diagram illustrating an example of slice_bitmap, and illustrates the case of using one-byte slice_bitmap for one volume=0 to 0x1000000LBA (8 GB). For example, the least significant bit of slice_bitmap is assigned to 1 GB in the range whose LBA=0 to 0x1FFFFF, and the most significant bit of slice_bitmap is assigned to 1 GB in the range whose LBA=0xE00000 to 0xFFFFFF. In this regard, a numeric character string having beginning characters of 0x denotes a hexadecimal number. Also, a bit value “1” of slice_bitmap indicates that data has been written into a corresponding area in a state in which the RAID apparatus2is without redundancy. A bit value “0” of slice_bitmap indicates that data has not been written into a corresponding area in a state in which the RAID apparatus2is without redundancy. Also, here, a description has been given of the case of using one-byte slice_bitmap. However, in the case of using four-byte slice_bitmap, it becomes possible to divide the entire area into 32 equal parts to manage the area.

The state management unit32detects a failure in the disk221and the RAID apparatus2, and manages the disk221and the RAID apparatus2using PLU_TBL and RLU_TBL. The states managed by the state management unit32includes “AVAILABLE”, which indicates an available state with redundancy, “BROKEN”, which indicates a failed state, and “EXPOSED”, which indicates a state without redundancy. Also, the states managed by the state management unit32include, “TEMPORARY_USE”, which indicates a RAID compulsory restore state, and so on. Also, when the state management unit32changes the state of the RAID apparatus2, the state management unit32sends a configuration change notification to the write-back unit35.

When the RAID apparatus2becomes a failed state, that is to say, when the state of the RAID apparatus2becomes “BROKEN”, the compulsory restore unit33determines whether the first disk and the last disk are restorable. If restorable, the compulsory restore unit33performs compulsory restore on both of the disks. Here, the “first disk ” is a disk that has failed first from the state in which all the disks221are normal, and is also referred to as a suspected disk. Also, the “last disk” is a newly failed disk when there is no redundancy in the RAID apparatus2, and if the last disk fails, the RAID apparatus2becomes a failed state. In RAIDS, if two disks fail, the RAID apparatus2becomes the failed state, and thus a disk that has failed in the second place is the last disk.

FIG. 4is a diagram illustrating an example of a RAID state that is not allowed to be restored by a RAID compulsory restore function. InFIG. 4, “BR” indicates that the state of the disk is “BROKEN”.FIG. 4illustrates that in RAIDS, when one disk fails, and the RAID apparatus2is in the state of “EXPOSED”, if a second disk fails with a compare error, a compulsory restore of the RAID apparatus2is not possible. Here, the compare error is an error that is discovered by writing predetermined data into a disk, then reading that data, and comparing the data with the written data.

In the case of a failure caused by a hardware factor, such as a compare error, it is not possible for the compulsory restore unit33to perform RAID compulsory restore. On the other hand, in the case of a transient failure, such as an error caused by a temporarily high load on a disk, and so on, the compulsory restore unit33performs RAID compulsory restore. In this regard, when the compulsory restore unit33performs RAID compulsory restore, the compulsory restore unit33changes the state of the RAID apparatus2to “TEMPORARY_USE”.

The staging unit34reads data stored in the RAID apparatus2on the basis of a request from the host1. However, if the state of the RAID apparatus2is a state in which RAID compulsory restore has been performed, the staging unit34checks the value of slice_bitmap corresponding to the area from which data read is requested before the RAID apparatus2reads the stored data.

And if the value of slice_bitmap is “0”, the area is not an area into which data has been written when the RAID apparatus2lost redundancy, and thus the staging unit34reads the requested data from the disk221to respond to the host1.

On the other hand, if the value of slice_bitmap is “1”, the staging unit34reads the requested data from the disk221to respond to host1, and performs data consistency processing with the area from which the data has been read. That is to say, the staging unit34performs data consistency processing on the area into which data was written when the RAID apparatus2lost redundancy. Specifically, the staging unit34updates the data of the suspected disk to the latest data as to the area into which data is written when the RAID apparatus2lost redundancy using the data of the other disk for each stripe. This is because the suspected disk is a failed disk in the first place, and thus old data is stored in the area into which data was written when the RAID apparatus2lost redundancy. In this regard, a description is given later of the details of the processing flow of the data inconsistency processing by the staging unit34.

The write-back unit35writes data into the RAID apparatus2on the basis of a request from the host1. However, if the RAID apparatus2is in a state without redundancy, the write-back unit35sets the bit corresponding to the data write area among the bits of slice_bitmap to “1”.

Also, if it is desired to read data from the disk221in order to calculate a parity at the time of writing the data, the write-back unit35performs data consistency processing on the area into which data has been written when the RAID apparatus2lost redundancy. A description is given later of the details of the processing flow of the data inconsistency processing by the write-back unit35.

The control unit36is a processing unit that performs overall control of the input/output control program3. Specifically, the control unit36performs transfer of control among the functional units and data exchange between the functional units and the storage units, and so on so as to function the input/output control program3as one program.

Next, a description is given of a processing flow of processing for performing RAID compulsory restore usingFIG. 5AandFIG. 5B.FIG. 5Ais a flowchart illustrating a processing flow of processing for performing RAID compulsory restore only on the last disk.FIG. 5Bis a flowchart illustrating a processing flow of processing for performing RAID compulsory restore on the last disk and first disk.

As illustrated inFIG. 5A, the RAID apparatus detects a failure in one disk, that is to say, a failure of the first disk, and sets the state of the RAID apparatus to “RLU_EXPOSED” (operation S1). After that, the RAID apparatus detects a failure of another disk, that is to say, a failure of the last disk, and sets the state of the RAID apparatus to “RLU_BROKEN” (operation S2).

And the RAID apparatus performs RAID compulsory restore (operation S3). That is to say, the RAID apparatus determines whether the last disk is restorable or not (operation S4). If not restorable, the processing is terminated with keeping the RAID failure as it is. On the other hand, if restorable, the RAID apparatus restores the last disk, and the state of the RAID apparatus is set to “RLU_EXPOSED” (operation S5).

After that, when the first disk is replaced, the RAID apparatus rebuilds the first disk, and sets the state to “RLU_AVAILABLE” (operation S6). And when the last disk is replaced, the RAID apparatus rebuilds the last disk, and sets the state to “RLU_AVAILABLE” (operation S7). Here, the reason that the RAID apparatus sets the state of to “RLU_AVAILABLE” again is to change the state during the rebuild.

On the other hand, in the processing for performing RAID compulsory restore on the last disk and the first disk, as illustrated inFIG. 5B, the RAID apparatus2detects a failure in one disk221, that is to say, detects a failure in the first disk. And the RAID apparatus2sets the state to “RLU_EXPOSED” (operation S21). And when write-back is performed in the state of “RLU_EXPOSED”, the RAID apparatus2updates a bit corresponding to the area that has been written back among the bits of slice_bitmap (operation S22).

After that, the RAID apparatus2detects a failure in another disk221, that is to say, a failure in the last disk, and sets the state of the RAID apparatus2to “RLU_BROKEN” (operation S23).

And the RAID apparatus2performs RAID compulsory restore (operation S24). That is to say, the RAID apparatus2determines whether the last disk is restorable or not (operation S25), and if not restorable, the processing is terminated with keeping the RAID failure as it is.

On the other hand, if restorable, the RAID apparatus2determines whether the first disk is restorable or not (operation S26). If not restorable, the RAID apparatus2restores the last disk, and sets the state to “RLU_EXPOSED” (operation S27). After that, when the first disk is replaced, the RAID apparatus2rebuilds the first disk, and sets the state to “RLU_AVAILABLE” (operation S28). And if the last disk is replaced, the RAID apparatus2rebuilds the last disk, and sets the state to “RLU_AVAILABLE” (operation S29). Here, the reason that the RAID apparatus2sets to “RLU_AVAILABLE” again is to change the state during the rebuild.

On the other hand, if the first disk is restorable, the RAID apparatus2restores the first disk, and sets the state of the first disk to “PLU_TEMPORARY_USE” (operation S30). And the RAID apparatus2restores the last disk, and sets the state of the last disk to “PLU_AVAILABLE” (operation S31). And the RAID apparatus2sets the state of the apparatus to “RLU_TEMPORARY_USE” (operation S32).

After that, when the first disk is replaced, the RAID apparatus2rebuilds the first disk. Alternatively, the RAID apparatus2performs RAID diagnosis (operation S33). And the RAID apparatus2sets the state to (RLU_AVAILABLE). And when the last disk is replaced, the RAID apparatus2rebuilds the last disk, and sets the state to (RLU_AVAILABLE) (operation S34). Here, the reason that the RAID apparatus2sets to “RLU_AVAILABLE” again is to change the state during the rebuild.

In this manner, by determining whether the first disk and the last disk are restorable or not, and restoring both of the disks if restorable, it is possible for the RAID apparatus2to perform RAID compulsory restore with redundancy.

Next, a description is given of state transition of the RAID apparatus.FIG. 6is a diagram illustrating state transition of a RAID apparatus (RLU state). As illustrated inFIG. 6, in the case of performing RAID compulsory restore only on the last disk, when all the disks are operating normally, the state of the RAID apparatus is “AVAILABLE”, which is a state with redundancy (ST11). And if one disk, that is to say, the first disk fails, the state of the RAID apparatus is changed to “EXPOSED”, which is a state without redundancy (ST12).

After that, when another disk, that is to say, the last disk fails, the state of the RAID apparatus is changed to “BROKEN”, which indicates a failed state (ST13). And if the last disk is restored by RAID compulsory restore, the state of the RAID apparatus is changed to “EXPOSED”, which is a state without redundancy (ST14). After that, if the first disk is replaced, the state of the RAID apparatus is changed to “AVAILABLE” which is a state with redundancy (ST15).

On the other hand, in the case of performing RAID compulsory restore on the last disk and the first disk, when all the disks221are normally operating, the state of the RAID apparatus2is “AVAILABLE”, which is a state with redundancy (ST21). And if one disk211, that is to say, the first disk fails, the state of the RAID apparatus is changed to “EXPOSED”, which is a state without redundancy (ST22).

After that, when another disk221, that is to say, the last disk fails, the state of the RAID apparatus2is changed to “BROKEN”, which indicates a failed state (ST23). And if the last disk and the first disk are restored by RAID compulsory restore, the state of the RAID apparatus2is changed to “TEMPORARY_USE”, which is a state with redundancy and allowed to be used temporarily (ST24). After that, if the first disk is replace or RAID diagnosis is performed, the state of the RAID apparatus2is changed to “AVAILABLE”, which is a state with redundancy (ST25).

In this manner, by restoring the last disk and the first disk by RAID compulsory restore to change the state to “TEMPORARY_USE”, it is possible for the RAID apparatus2to operate in a state with redundancy after RAID compulsory restore.

Next, a description is given of a processing flow of write-back processing when the state of the RAID apparatus2is “EXPOSED”.FIG. 7is a flowchart illustrating a processing flow of write-back processing in the case where the state of the RAID apparatus2is “EXPOSED”.

As illustrated inFIG. 7, the write-back unit35determines whether a configuration change notification has been received or not after the previous write-back processing (operation S41). As a result, if a configuration change notification has not been received, the state of the RAID apparatus2is kept as “EXPOSED”, and the write-back unit35proceeds to operation S43. On the other hand, if a configuration change notification has been received, there has been a change of the state of the RAID apparatus2, and thus the write-back unit35determines whether the RAID apparatus2has redundancy or not (operation S42).

As a result, if there is redundancy, the state of the RAID apparatus has not been “EXPOSED”, and thus the write-back unit35initializes slice_bitmap (operation S44). On the other hand, if there is no redundancy, the write-back unit35sets the bit of slice_bitmap corresponding to the write request range to “1” (operation S43).

And the write-back unit35performs data write processing on the disk221(operation S45), and makes a response of the result to the host1(operation S46).

In this manner, when the state of the RAID apparatus2is “EXPOSED”, the write-back unit35sets the corresponding bit of slice_bitmap of the write request range to “1”, and thus it is possible for the RAID apparatus2to identify a target area of the data consistency processing in the state of RAID compulsory restore.

Next, a description is given of a processing flow of staging processing after RAID compulsory restore usingFIG. 8andFIG. 9. Here, the staging processing after RAID compulsory restore is staging processing when the state of the RAID apparatus2is “RLU_TEMPORARY_USE”.

FIG. 8is a flowchart illustrating a processing flow of staging processing after RAID compulsory restore.FIG. 9is a diagram illustrating an example of the staging processing after RAID compulsory restore. As illustrated inFIG. 8, the staging unit34determines whether value of slice_bitmap in the disk-read request range is “0” or “1” (operation S61).

As a result, if the value of slice_bitmap is “0”, the disk-read request range is not an area into which the RAID apparatus2performed data write in the state without redundancy, and thus the staging unit34performs disk read of the requested range in the same manner as before (operation S62). And the staging unit34makes a response of the read result to the host1(operation S63).

On the other hand, if the value of slice_bitmap is “1”, the disk-read request range is an area into which the RAID apparatus2performed data write in the state without redundancy, and thus the staging unit34performs disk read for each stripe corresponding to the requested range (operation S64).

For example, inFIG. 9, it is assumed that when the host1makes a staging request in the range LBA=0x100 to 0x3FF, data was stored in four disks, namely disk0to disk3in the form of three stripes, namely stripe0to stripe2as storage data51. Here, out of the storage data51, data0, data4, and data8are stored in disk0, which is the suspected disk, data1, data5, and parity2are stored in disk1, data2, parity1, and data6are stored in disk2, and parity0, data3, and data7are stored in disk3.

Also, it is assumed that a shaded portion of the storage data51is data corresponding to LBA=0x100 to 0x3FF. Also, assuming that slice_bitmap=0x01, fromFIG. 3, an area in the range LBA=0x100 to 0x3FF was an area into which data is written in a state in which the RAID apparatus2lost redundancy, and thus three stripes of data are all read as read data52. That is to say, an unshaded portion of the storage data51, namely data0, data1, and data8are read together with the parity data and the other data.

And the staging unit34determines whether disk read is normal or not (operation S65). If normal, the processing proceeds to operation S70. On the other hand, if not normal, the staging unit34determines whether a suspected disk error has occurred or not (operation S66). As a result, in the case of an error other than the suspected disk, it is not possible to assure the data, the staging unit34creates PIN data for the requested range (operation S67), and makes an abnormal response to the host1together with the PIN data (operation S68). Here, the PIN data is data indicating data inconsistency.

On the other hand, if the suspected disk error, the staging unit34restores the data of the suspected disk from the other data and the parity data (operation S69). That is to say, the target area is an area into which the RAID apparatus2has written data in a state without redundancy, and thus the suspected disk might not store the latest data. Thus, the staging unit34updates the data of the suspected disk to the latest data.

For example, inFIG. 9, in error-occurred data53, an error part531corresponding to the error-occurred LBA=0x10 in data0is restored from the corresponding parts532,533, and534in the other data1and data2, which are used for parity generation, and parity0. Specifically, the staging unit34generates the data of the error part531by performing an exclusive-OR operation on the data of the corresponding part532,533, and534in data1, data2, and parity0.

And the staging unit34determines whether there is data consistency or not by performing compare check (operation S70). Here, the compare check is checking whether all the bits of the result of performing exclusive-OR operation on all the data for each stripe are 0 or not. For example, inFIG. 9, a determination is made of whether all the bits of the result of performing exclusive-OR operation on data0, data1, data2, and parity0are 0 or not.

And if there is not data consistency, the staging unit34restores the data of the suspected disk from the other data and the parity data in the same stripe, and updates the suspected disk (operation S71). For example, inFIG. 9, in the restored data54, the result of the exclusive-OR operation on data1, data2, and parity0is data0, and the result of the exclusive-OR operation on data5, parity1, and data3is data4. Also, the result of the exclusive-OR operation on parity2, data6, and data7is data8.

And the staging unit34sends a normal response to the host1together with the data (operation S72).

In this manner, if a read area is an area into which data has been written in a state in which the RAID apparatus2lost redundancy, by the staging unit34performing matching processing of the suspected disk, it is possible for the RAID apparatus2to assure the data at higher level.

Next, a description is given of the processing flow of write-back processing after RAID compulsory restore usingFIG. 10toFIG. 12. Here, the write-back processing after RAID compulsory restore is write-back processing when the state of the RAID apparatus2is “RLU_TEMPORARY_USE”.

FIG. 10is a flowchart illustrating the processing flow of write-back processing after RAID compulsory restore.FIG. 11is a diagram for describing kinds of write back. AndFIG. 12is a diagram illustrating an example of write-back processing after RAID compulsory restore. As illustrated inFIG. 10, the write-back unit35determines a kind of write-back (operation S81). Here, as illustrates inFIG. 11, the kinds of write-back include “Bandwidth”, “Readband”, and “Small”.

“Bandwidth” is the case where data to be written into the disk has a sufficiently large size for parity calculation, and the case where it is not desired to read data from the disk for parity calculation. For example, as illustrated inFIG. 11, there are data x, data y, and data z whose size is 128 LBA for write data, and the parity is calculated from data x, data y, and data z.

“Readband” is the case where the size of the data to be written into the disk is insufficient for parity calculation, and it is desired to read data from the disk for parity calculation. For example, as illustrated inFIG. 11, there are data x and data y having a size of 128 LBA for write data, and old data z is read from the disk to calculate the parity.

“Small” is the case where the size of the data to be written into the disk is insufficient for parity calculation in the same manner as “Readband”, and it is desired to read data from the disk for parity calculation. However, if the size of data to be written into the disk is 50% or more of the data desired for parity calculation, the write-back processing is “Readband”, and if the size of data to be written into the disk is less than disk 50% of the data desired for parity calculation, the write-back processing is “Small”. For example, as illustrated inFIG. 11, if there is data x having a size of 128 LBA for write data, the parity is calculated from data x to be written and the old data x and the old parity in the disk.

Referring back toFIG. 10, if the kind of write-back is “Bandwidth”, it is not desired to read data from the disk, the write-back unit35creates parity in the same manner as before (operation S82). And the write-back unit35writes the data and the parity into the disk (operation S83), and makes a response to the host1(operation S84).

On the other hand, if the kind of write-back is not “Bandwidth”, the write-back unit35determines whether slice_bitmap of the disk-write requested range of is hit, that is to say, whether the value of slice_bitmap is “0” or “1” (operation S85).

As a result, if slice_bitmap is not hit, that is to say, if the value of slice_bitmap is “0”, the disk-write requested range is not an area into which data is written in a state in which the RAID apparatus2lost redundancy, and thus the write-back unit35performs the same processing as before. That is to say, the write-back unit35creates a parity (operation S82), writes the data and the parity into the disk (operation S83), and makes a response to the host1(operation S84).

On the other hand, if slice_bitmap is hit, the write-back requested range is an area into which data is written in a state in which the RAID apparatus2lost redundancy, and thus the write-back unit35performs disk read for each stripe corresponding to the requested range (operation S86). Here, the case where slice_bitmap is hit is the case where the value of slice_bitmap is “1”.

For example, inFIG. 12, it is assumed that when the host1makes a write-back request in the range of LBA=0x100 to 0x3FF, the data was stored in four disks, namely disk0to disk3in the form of three stripes, namely stripe0to stripe2as storage data61. Here, it is assumed that the kind of write-back in stripe0is “Small”, the kind of write-back in stripe1is “Bandwith”, and the kind of write-back in stripe2is “Readband”. Also, out of storage data61, data0, data4, and data8are stored in disk0, which is a suspected disk, data1, data5, and parity2are stored in disk1, data2, parity1, and data6are stored in disk2, and parity0, data3, and data7are stored in disk3.

Also, it is assumed that a shaded portion of the storage data61is data corresponding to LBA=0x100 to 0x3FF. Also, assuming that slice_bitmap=0x01, fromFIG. 3, an area in the range of LBA=0x100 to 0x3FF was an area into which data is written in a state in which the RAID apparatus2lost redundancy, and thus, data of stripe0and stripe2are read as read data62. That is to say, an unshaded portion of the storage data61, namely data0, data1, and data8are read together with the parity data and the other data. In this regard, the kind of write-back in stripe1is “Bandwith”, and thus stripe1is not read.

And the write-back unit35determines whether disk read is normal or not (operation S87). If normal, the processing proceeds to operation S92. On the other hand, if not normal, the write-back unit35determines whether the suspected disk error has occurred or not (operation S88). As a result, in the case of an error other than the suspected disk, it is not possible to assure the data, thus the write-back unit35creates PIN data for the requested range (operation S89), and makes an abnormal response to the host1together with the PIN data (operation S90).

On the other hand, if the suspected disk error, the write-back unit35restores the data of the suspected disk from the other data and the parity data (operation S91). That is to say, the target area is an area into which the RAID apparatus2has written data in a state without redundancy, and thus the suspected disk might not store the latest data. Thus, the write-back unit35updates the data of the suspected disk to the latest data.

For example, inFIG. 12, in error occurred data63, an error part631corresponding to the error-occurred LBA=0x10 in data0is restored from the corresponding parts632,633, and634in the other data1and data2, which are used for parity generation, and parity0. Specifically, the write-back unit35generates the data of the error part631by performing an exclusive-OR operation on the data of the corresponding part632,633, and634in data1, data2, and parity0.

And the write-back unit35determines whether there is data consistency or not by performing compare check (operation S92). For example, inFIG. 12, a determination is made of whether all the bits of the result of performing exclusive-OR operation on data0, data1, data2, and parity0are 0 or not.

As a result, if there is data consistency, the write-back unit35issues disk write (operation S96) in order to write update data into the disk. And the write-back unit35makes a normal response to the host1(operation S97).

On the other hand, if there is not data consistency, the write-back unit35restores the data of the suspected disk from the other data and the parity data in the same stripe, and updates the suspected disk (operation S93). For example, inFIG. 12, assuming that data inconsistency has been detected at LBA=0x20 of stripe2, the write-back unit35determines the result of the exclusive-OR operation of parity2, data6, and data7in the restored old data64to be data8.

And the write-back unit35issues disk write (operation S94), and writes the restored data and update data into the disk. For example, inFIG. 12, the kind of write-back for stripe0is “Small”, and data inconsistency has not been detected, and thus data2and parity0of the update data is written into the disk. Also, the kind of write-back for stripe2is “Readband”, and data inconsistency has been detected, thus data8of the suspected disk, and data6, data7, and parity2of the update data are written into the disk. And the write-back unit35makes a normal response to the host1(operation S95).

In this manner, if a write-back area is an area into which data write has been performed in a state in which the RAID apparatus2lost redundancy, by the write-back unit35performing matching processing of the suspected disk, it is possible for the RAID apparatus2to assure the data at higher level.

As described above, in the embodiment, when the RAID apparatus2becomes a failed state, the compulsory restore unit33determines whether the first disk and the last disk are restorable or not. If they are restorable, both of the disks are compulsorily restored. Accordingly, it is possible for the RAID apparatus2to have redundancy after RAID compulsory restore, and thus to improve data assurance.

Also, in the embodiment, when the RAID apparatus2writes data in a state without redundancy, the write-back unit35sets the corresponding bit to the data write area in slice_bitmap bits to “1”. And when the staging unit34reads data, the staging unit34determines whether the value of the corresponding bit to the data read area in slice_bitmap bits is “1” or not. If the bit is “1”, the staging unit34reads data for each stripe from the disk221. And the staging unit34checks data consistency of the data for each stripe. If there is not consistency, the staging unit34restores the data of the suspected disk from the other data and the parity data. Also, when the write-back unit35writes data in the case where the kind of write-back is other than “Bandwidth”, the write-back unit35determines whether the value of the corresponding bit to the data write area in slice_bitmap bits is “1” or not. And if the bit is “1”, the write-back unit35reads the data from the disk221for each stripe. And the write-back unit35checks data consistency of the data for each stripe. If there is no consistency, the write-back unit35restores the data of the suspected disk from the other data and the parity data. Accordingly, it is possible for the RAID apparatus2to improve data consistency of the data, and data assurance.

In this regard, in the embodiment, a description has been mainly given of the case of RAIDS. However, the present disclosure is not limited to this, and for example, it is possible to apply the present disclosure to a RAID apparatus having redundancy, such as RAID1, RAID1+0, RAID6, and so on in the same manner. In the case of RAID6, if two disks fail, redundancy is lost. And by regarding these two disks as suspected disks, it is possible to apply the present disclosure in the same manner.