# US 10,372,354 B1 · High reliability in storage array systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,354 B1 - Document ID: US10372354B1 - Status: Granted - Kind: B1 - Application number: 15/624,288 - Filed: 2017-06-15 - Granted: 2019-08-06 - Earliest claimed: 2017-06-15 - Assignees: Nutanix, Inc. - Applicants: Nutanix, Inc. - Inventors: Abhiram Parvathareddy; Raghav Koteshwar Tulshibagwale - Web page: https://patentgrep.com/patent/US10372354B1 ## CPC - G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors} - G06F 3/0683: {Plurality of storage devices} - G06F 3/0634: {by changing the state or mode of one or more devices} - G06F 3/065: {Replication mechanisms} - G06F 3/0653: {Monitoring storage devices or systems} - G06F 3/0665: {at area level, e.g. provisioning of virtual or logical volumes} - G06F 3/0689: {Disk arrays, e.g. RAID, JBOD} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A storage system for providing zero data loss during failover and failback. A storage system comprises a dual controller that includes a first controller to process a first set of storage I/O operations and a first hardware timer. Redundancy is provided by a second controller that processes a second set of storage I/O operations. The second controller has a corresponding second hardware timer. Both the first controller and second controller each employ respective dual channel drive interfaces. The dual channel drives are arranged in an array. Each controller executes instructions to access at least two different portions of any one of the plurality of dual channel drives. In a failover scenario, when a controller suspects failure of a peer, a lockless signaling protocol is invoked. After a delay for a hardware timer timeout period, the protocol signals an intention to take over resources as soon as mutual exclusion is guaranteed. ## Claims ### Claim 1 A system comprising: a first controller having a first timer and a first drive interface; a second controller having a second timer and second drive interface; and a set of dual channel drives electrically coupled to both the first drive interface and the second drive interface, wherein the first controller writes a controller status to a status area on one or more of the set of dual channels drives based on at least the first timer, and the second controller reads the status area based on at least the second timer to determine if the first controller reported operational status during a first time period of the first timer corresponding to a second time period of the second timer. ### Claim 2 (depends on 1) The system of claim 1, wherein the first timer and the second timer are separate hardware timers. ### Claim 3 (depends on 1) The system of claim 1, wherein the first controller and the second controller correspond to separate hardware. ### Claim 4 (depends on 1) The system of claim 1, wherein the first drive interface comprises at least a first plurality of physical hardware interface connections and the second drive interface comprises at least a second plurality of physical hardware interface connections. ### Claim 5 (depends on 1) The system of claim 1, wherein the first controller is a sole owner of the set of dual channel drives. ### Claim 6 (depends on 1) The system of claim 1, wherein the set of dual channel drives comprise two physical connections for connection to respective drive interfaces. ### Claim 7 (depends on 6) The system of claim 6, wherein at least some of the set of dual channel drives are initially assigned to a first redundancy group. ### Claim 8 (depends on 6) The system of claim 6, wherein the first controller writes controller status information to two or more of the set of dual channel drives. ### Claim 9 (depends on 6) The system of claim 6, wherein the second controller reads controller status information from two or more of the set of dual channel drives to implement a consensus scheme. ### Claim 10 (depends on 1) The system of claim 1, wherein the second controller resets the second timer in response to determining that the first controller reported operational status during a corresponding time period. ### Claim 11 (depends on 1) The system of claim 1, wherein the first controller issues an instruction to pause the second timer for timeout period. ### Claim 12 (depends on 1) The system of claim 1, wherein the second controller signals an intention to take ownership of the set of dual channel drives in response to failing to determine that the first controller provided controller status information reporting an operational status. ### Claim 13 (depends on 1) The system of claim 1, wherein the status area on the one or more of the set of dual channels drives are separate from user data areas. ### Claim 14 A method comprising: writing a controller state to a status area on one or more of a set of dual channel drives based on at least a first timer by a first controller having a first drive interface electrically coupled to the set of dual channel drives; reading a controller state from the status area on one or more of the set of dual channel drives based on at least a second timer by a second controller having a second drive interface electrically coupled to the set of dual channel drives; and determining if the first controller reported operational status during a first time period of the first timer corresponding to a second time period of the second timer. ### Claim 15 (depends on 14) The method of claim 14, wherein the first timer and the second timer are separate hardware timers. ### Claim 16 (depends on 14) The method of claim 14, wherein the first controller and the second controller correspond to separate hardware. ### Claim 17 (depends on 14) The method of claim 14, wherein the first drive interface comprises at least a first plurality of physical hardware interface connections and the second drive interface comprises at least a second plurality of physical hardware interface connections. ### Claim 18 (depends on 14) The method of claim 14, wherein the first controller is a sole owner of the set of dual channel drives. ### Claim 19 A non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor performs a set of acts comprising: writing a controller state to a status area on one or more of a set of dual channel drives based on at least a first timer by a first controller having a first drive interface electrically coupled to the set of dual channel drives; reading a controller state from the status area on one or more of the set of dual channel drives based on at least a second timer by a second controller having a second drive interface electrically coupled to the set of dual channel drives; and determining if the first controller reported operational status during a first time period of the first timer corresponding to a second time period of the second timer. ### Claim 20 (depends on 19) The computer readable medium of claim 19, wherein the first timer and the second timer are separate hardware timers.