Apparatus and method for deterministically performing active-active failover of redundant servers in a network storage appliance

A network storage appliance for deterministically performing active-active failover of redundant servers enclosed therein, comprising:

• a chassis;
• two redundant servers, enclosed in said chassis, each having at least one unique ID for communicating on a network;
• at least one storage controller, enclosed in said chassis, coupled to said redundant servers, for transferring data between storage devices and said servers;
• and
• first and second status paths, enclosed in said chassis, each for providing a heartbeat from one of the servers to the other server;
• wherein each of said servers is configured to deterministically disable the other server from communicating on said network in response to detecting that said heartbeat of the other server has stopped, and to assume said at least one unique ID of the other server for communicating on said network thereafter, wherein at least one of said two redundant servers includes a shield circuit for preventing the other server from disabling the at least one of said two redundant servers from communicating on the network, wherein said at least one of said two redundant servers is configured to enable said shield circuit prior to deterministically disabling the other server from communicating on said network.

An apparatus for deterministically performing active-active failover of two redundant servers integrated with at least one storage controller into a network storage appliance chassis, each of the servers being configured to communicate with computers on a network, the apparatus comprising:

• a backplane, enclosed in the chassis, configured to receive a plurality of hot-pluggable blades comprising the servers and storage controller;
• two heartbeat paths, comprised in said backplane, each for conveying a respective heartbeat signal from one of the servers to the other server;
• two kill paths, on said backplane, each for conveying a signal from an inactivating one of the two redundant servers to the other server for inactivating the other server from communicating on the network in response to the inactivating server detecting said heartbeat of the other server has stopped;
• and
• a shield circuit, comprised in the inactivating server, for preventing the other server from inactivating the inactivating server from communicating on the network, wherein the inactivating server is configured to enable said shield circuit prior to inactivating the other server from communicating on the network;
• wherein the inactivating server is configured to take over the identity of the inactivated server on the network after inactivating the other server.

A method for deterministically performing failover of first and second redundant servers integrated into a network storage appliance chassis, the method comprising:

• receiving, by the first server, a first heartbeat signal from the second server via a first signal path in a backplane of the chassis;
• receiving, by the second server, a second heartbeat signal from the first server via a second signal path in a backplane of the chassis;
• detecting, by the first server, that the first heartbeat signal has stopped;
• generating, by the first server, a kill signal to control logic of the second server to disable the second server from communicating on a network, in response to said detecting the first heartbeat signal has stopped;
• taking over the identity of the second server on the network, by the first server, after said generating the kill signal;
• and
• enabling, by the first server, a shield circuit, prior to said generating the kill signal, to prevent the second server from disabling the first server from communicating on the network.