Patent Application
20100318826
Mission-critical and high-availability computer applications, e.g., government and commerce sites on the World Wide Web, often require high levels of redundancy to minimize down time due to equipment failures. This applies not only to data-handling elements such as processors, media (including disks and solid-state memory), and communications devices (including input/output devices and network interface devices), but to energy transfer devices, such as power supplies (which bring electrical energy into the computer) and cooling devices such as fans (which remove heat energy from the computer). For example, a system can provide more power supplies than needed so that if one fails, the system can continue operating without interruption.
Minimal redundancy addresses only a single point of failure. In the above example, if a second power supply fails before the first is repaired or replaced, the entire computer may fail. In many cases, this interruption may be rare enough to be tolerable, in other cases, it may not be acceptable. In the latter case, additional power supplies can be used to provide more redundancy, but at some point the costs (economic and bulk) outweigh the benefits. What is needed is a way to enhance up time for a given level of initial redundancy.
Herein, related art is described to facilitate understanding of the invention. Related art labeled “prior art” is admitted prior art; related art not labeled “prior art” is not admitted prior art.
The FIGURE depicts implementations/embodiments of the invention and not the invention itself.
The present invention provides for changing the power states of data-handling devices (DHDs) to meet a redundancy criterion for energy-transfer devices (ETDs). For example, when redundancy is lost because of the failure of one of three or more power supplies, the power states of processors and other DHDs can be lowered so that power needs can be met even in the event a second power supply fails. Likewise, if the ambient temperature increases to the point where the current set of fans is no longer redundant, DHD power states can be reduced to restore redundancy. On the other hand, if the ambient temperature goes down, the invention can provide for increasing power states in exchange for reduced excess redundancy.
A computer system AP1 includes essentially similar servers 11 and 12, as shown in
Power-state controller 37 is responsive to thermal and power regulation logic 40, which controls the operation of power supplies 21 and fans 23 respectively via power-supply controller 27 and fan controller 31. Logic 40 includes a redundancy assessor 41, which evaluates the level of redundancy for power supplies 21 and fans 23 according to a redundancy policy 43, one of several management-defined policies implemented for server AP1.
Server AP1 includes six power supplies 23, although this number varies across embodiments. Power-supply controller 27 can switch each functional power-supply between active and reserve status. Normally, four power supplies can supply enough power for server 11; in this case, five can be active and one left inactive in reserve. If one fails, the other four suffice to continue operation while the reserve power-supply is activated. System operation is not interrupted but redundancy is lost. If another power supply fails, system operation will be interrupted. The invention avoids this interruption by reducing power states so that three power supplies can provide continued operation of the system.
Power-supply monitor 25 monitors the “health” of power supplies 21, and detects when a power supply fails. Power sensor 29 tracks the power output by power supplies 21. The power sensor data can be used to detect a high-demand situation in which redundancy can be lost due to increased loads on power supplies 21.
Server 11 includes six fans 23. Fan controller 31 can switch fans on and off individually and control fan speed for those fans that are on. Fan monitor 33 monitors the health of fans 23 to detect failure or impaired operation. Thermal sensors 35 or “thermometers” track internal and ambient temperatures for use in regulating the speed of fans 23.
Thermal and power regulation logic 40 receives inputs from thermal sensors 35 for use in regulating fan speeds. It also receives data from power sensor 29 indicating the actual power consumption by server 11. Assessment of the redundancy state of server 11 is made by redundancy assessor 41 of logic 40.
Redundancy assessor 41 is responsible for implementing redundancy policy 43. Redundancy policy 43 is typically set by a system administrator. This policy 43 specifies desired levels of redundancy and the actions that can be taken to achieve those levels. Redundancy assessor 41 is coupled to power supply monitor 25 and to fan monitor 33 so that it is informed of the numbers of active, inactive, and failed power supplies and fans. In addition, redundancy assessor 41 is coupled to server 12 for implementing policies that take the state of an external server into account. (For example, a lower local redundancy may be required for server 11 if server 12 has high redundancy than if server 12 has low redundancy.)
Some simple redundancy policies ignore external servers and treat power and cooling independently. One power policy is to lower power states of data-handling components to restore redundancy in the event of a power-supply failure. A comparable cooling policy would be to lower power states in the event of a fan failure to restore redundancy. More complex policies can take such factors as performance demands and the redundancy available in other servers such as server 12, into account. For example, a policy might accept a limited duration of sub-standard redundancy when high performance was required.
Other policies accept lower cooling system redundancy when power-supply redundancy is high, and vice versa. The justification would be that a certain overall likelihood of failure might be tolerable. For example, a policy might tolerate a single point of failure for power-supplies 21 when the redundancy of fans 23 is high because the overall likelihood of failure is sufficiently low, while if both power supplies and fans lacked redundancy, the changes of a failure would be too high and redundancy would have to be restored to at least one of these subsystems. Another policy gives up redundancy in one subsystem when redundancy in another subsystem is low on the theory, that the low redundancy of the first subsystem is not the most likely cause of failure. As these examples demonstrate, the invention provides for a wide range of redundancy policies.
A method ME1 of the invention is flow charted in the lower portion of
Method segment MS3 can involve the detection of a change in temperature. For example, an increase in ambient temperature affects the cooling power of fans 21. Redundancy can be lost when a fan counted as redundant becomes required to achieve sufficient cooling for operation to continue because the air used for cooling has increased in temperature. Logic 40 can call for a decrease in power state to restore redundancy in this case. Likewise, a decrease in ambient temperature can increase cooling efficiency of the fans, increasing redundancy. A redundancy policy can specify a level of excess redundancy that, when detected, can result in an increase in a power state to achieve higher performance. In this sense, the redundancy criterion can specify a maximum as well as a minimum redundancy level; the maximum indicating when redundancy can be reduced by increasing power state levels for data-handling devices.
Once a change affecting redundancy is detected at method segment MS3, the resulting redundancy is evaluated against the redundancy criterion established at method segment MS1. If the changed condition does not meet the criterion, power states can be changed at method segment MS5 to meet the criterion.
In one scenario, a power supply fails. System operation is not interrupted, but redundancy is lost. The power states of the data-handling devices cannot be lowered fast enough to prevent operation from being interrupted. Thus, power states are lowered, e.g., from P0 to P3, in advance of any failure to restore redundancy. If a second failure occurs, the system can continue uninterrupted. When the failed power supply is replaced (physically, or by activation of a reserve power supply) the power states of the data-handling devices can be raised again, e.g., from P3 to P0.
The Advanced Configuration and Power Interface (ACPI) specification is an open industry standard first released in December 1996 developed by HP, Intel, Microsoft, Phoenix, and Toshiba that defines common interfaces for hardware recognition, motherboard and device configuration and power management. ACPI brought power management features previously only available in portable computers to desktop computers and servers. For example, systems may be put into extremely low consumption states; in such a state, a device such as a real-time clock, a keyboard, or a modem can trigger a “general-purpose event” (GPEs, similar to interrupts), to quickly wake the system.
The present invention can apply to systems that have sufficient resources to handle at least two failures relating to energy-transfer devices. Typically, three or more power supplies and three or more fans would be available, but some embodiments require fewer such components. Multi-computer-systems can have policies that interact across computers so that the redundancy of one computer can be taken into account in setting the redundancy of another computer. Different numbers of fans and different types of cooling devices (e.g., liquid heat exchangers) can be employed. These and other modification to and variations upon the disclosed embodiments are provided for by the present invention, the scope of which is defined by the following claims.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/US08/54164 | 2/15/2008 | WO | 00 | 8/11/2010 |
