Method for controlling information processing system and information processing system

Abstract

A storage system is composed of storage apparatuses each separately installed at three sites for the purpose of disaster recovery, wherein data stored in one of the storage apparatuses designated as a replication source is also managed in one of the other two storage apparatuses designated as a replication destination, such that in the event of a failover execution request from an information processing apparatus, data stored in the storage apparatus designated as the replication source is managed also in the storage apparatus of the other two storage apparatuses designated as a spare.

Description

BACKGROUND OF THE INVENTION

[0001] 1. Field of the Invention

[0002] The present invention relates to a method for controlling an information processing system and to an information processing system.

[0003] 2. Related Background Art

[0004] Disaster recovery in information processing systems is drawing attention. As a technology to realize disaster recovery, a technology for performing dual writing without the intervention of host computers among a plurality of storage apparatuses installed at physically remote sites (this technology is hereinafter called “remote copy”) is known. In remote copy, a first storage apparatus and a second storage apparatus are each connected through a dedicated telephone line or public telephone line. The second storage apparatus, which is a replication destination storage apparatus, has a logical volume that corresponds to a replication source logical volume of the first storage apparatus, which is a replication source storage apparatus, and data in the logical volume of the first storage apparatus is controlled to be written to the logical volume of the second storage apparatus. Through such control, when there is an update of data in the first storage apparatus from a host computer, the updated data is written to the first logical volume, as well volume 111 to the second logical volume 121, and data that is the discrepancy between the first logical volume 111 and the second logical volume 121 can be stored in the second logical volume 121.

[0005] When it is determined that performing an initial copy from the first logical volume 111 to the third logical volume 131 would be better even if it is determined that data can be written to the second logical volume 121, a processing to continue the initial copy from the first logical volume 111 to the third logical volume 131 may take place. This processing would take place, for example, when the initial copy processing from the first logical volume 111 to the third logical volume 131 would be shorter and when the first logical volume 111 and the third logical volume 131 can form a pair.

[0006] <S604 to S601>

[0007] When an initial copy (a re-initializing replication processing) to make contents of the second logical volume 121 consistent with contents of the first logical volume 111 is completed in the failback-in-progress state S604, the status transfers to the normal state S601.

[0008] <S604 to S603>

[0009] When data cannot be written to the second logical volume 121 in the failback-in-progress state S604 (i.e., a failure to write to the replication destination logical volume), the status transfers to the failover state S603.

[0010] As described above, a re-initializing replication processing to make contents of the second logical volume 121 consistent with contents of the first logical volume 111 takes place in the failback-in-progress state S604, but a remote copy from the first logical volume 111 to the third logical volume 131 is also taking place. Consequently, when data cannot be written to the second logical volume 121, the re-initializing replication processing to make contents of the second logical volume 121 consistent with contents of the first logical volume 111 is suspended, and a processing to perform only the remote copy from the first logical volume 111 to the third logical volume 131 takes place.

[0011] <S604 to S600>

[0012] When data cannot be written to the third logical volume 131 in the failback-in-progress state S604 (i.e., a failure to write to the current logical volume), the status transfers to the normal initial copy-in-progress state S600.

[0013] When data cannot be written to the third logical volume 131 in the failback-in-progress state S604, the remote copy from the first logical volume 111 to the third logical volume 131 is suspended, and a processing to continue the re-initializing replication processing to make contents of the second logical volume 121 consistent with contents of the first logical volume 111 takes place.

[0014] As described above, in the normal state S601, the failover state S603, the failback-in-progress state S604 and in the duplication failover-in-progress state S605, redundancy (a duplicated state) of the first logical volume 111 is maintained, such that contents that are identical to contents of the first logical volume 111 exist in either the second logical volume 121 or the third logical volume 131. According to the present invention, redundancy is secured even in the failback-in-progress state S604, such that the redundancy of the first logical volume 111 is maintained throughout the process from the failover state S603 to the normal state S601 via the failback-in-progress state S604. Similarly, even when there is a failback execution request based on an instruction from an administrator, the redundancy of the first logical volume 111 is maintained throughout the process involving failover and failback, beginning with the normal state S601, to the duplication failover-in-progress state S605, to the failover state S603, to the failback-in-progress state S604, and ending with the normal state S601.

[0015] [Tables]

[0016] FIGS. 7 and 8 show tables referred to in the following description. The tables include tables of a current position in initial copy 710, an initial copy degree of priority 720, a replication destination storage apparatus 730, a replication destination logical volume 740, a current remote copy destination storage apparatus 750, a current remote copy destination logical volume 760, a differential bitmap 770, and a failover status 780. These tables are stored in the memory of the channel adaptor 201, the shared memory 104, or in the disk drives 210, for example.

[0017] The current position in initial copy 710 stores the block number representing data to be replicated next in an initial copy processing. Consequently, when all blocks in the third logical volume 131 that correspond to the blocks in the first logical volume 111 have the value “1,” it indicates that the initial copy has finished.

[0018] In the initial copy degree of priority 720 is set the degree of priority placed on the logical volume on which an initial copy processing is to be executed. For example, when the third logical volume 131 is to be given priority in an initial copy, “1” is set for the third logical volume 131; when there is no need to give priority to an initial copy to the second logical volume 121, “0” can be set for the second logical volume 121.

[0019] In the present embodiment, ID numbers are assigned to various storage apparatuses and logical volumes in order to identify each of the storage apparatuses 110,120 and 130, as well as each of the logical volumes 111,121 and 131. When an ID number that specifies the second storage apparatus 120 is registered in the replication destination storage apparatus 730, the second storage apparatus 120 is set as the replication destination storage apparatus. When an ID number that specifies the second logical volume 121 is registered in the replication destination logical volume 740, the second logical volume 121 is set as the replication destination logical volume. In this way, by registering ID numbers in the replication destination storage apparatus 730 and the replication destination logical volume 740, a replication destination storage apparatus and a replication destination logical volume can be set. According to the present embodiment, the ID number of the second storage apparatus 120 is registered in the replication destination storage apparatus 730, and the ID number of the second logical volume 121 is registered in the replication destination logical volume 740. Of course, the ID number of the storage apparatus 130 and the ID number of the logical volume 131 can also be registered in the replication destination storage apparatus 730 and the replication destination logical volume 740, respectively.

[0020] Similarly, ID numbers of the storage apparatus and the logical volume to which data is currently being replicated are registered in the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760. Based on the ID numbers registered in these tables, a storage apparatus (e.g., the first storage apparatus 110) or a system administrator can specify the logical volume to which data is currently being replicated and the storage apparatus that has the logical volume.

[0021] The differential bitmap 770 indicates the difference between contents of the first logical volume 111 and contents of the logical volume designated to store write data sent from the first logical volume 111. Through this, the first storage apparatus 110 can determine whether contents of the first logical volume 111 and contents of the logical volume designated to store write data sent from the first logical volume 111 are consistent. For example, by setting blocks of data that are different in contents of the first logical volume 111 and of the second logical volume 121 to “1,” while blocks of data that are consistent in the contents between the two logical volumes are set to “0,” the determination can be made easily.

[0022] In the failover status 780 are registered values that identify various states described earlier. For example, a value of “0” is registered for the normal state or normal initial copy-in-progress state, a value of “1” is registered for the failback-in-progress state, a value of “2” is registered for the duplication failover-in-progress state, and a value of “3” is registered when automatic failback is blocked. Based on these values, a storage apparatus (e.g., the first storage apparatus 110) or a system administrator can check the current status. When there is a plurality of replication source logical volumes other than the first logical volume 111, the failover status table can be provided in each of the logical volumes 111,121 and 131 and/or in each of the storage apparatuses 110,120 and 130 having the corresponding logical volumes.

[0023] In a failover destination management table 800 are registered all of the storage apparatuses 110,120 and 130, as well as usage status of each of their logical volumes. Consequently, when a failover takes place, candidate logical volumes can be selected by checking this list.

[0024] In each failover destination management table entry 810 of the failover destination management table 800 are registered, for example, an ID number of a storage apparatus (Storage Apparatus) 820 that corresponds to the entry, an ID number indicating a logical volume (Logical Volume) 830 of the storage apparatus, and a status (Status) 840 that indicates whether a failover to the logical volume can take place. In Status 840, “2” is registered if a certain logical volume cannot be set as a spare logical volume (i.e., invalid); “1” is registered if a failover cannot take place due to the fact data cannot be written to a certain logical volume; and “0” is registered if data can be written to a certain logical volume. Situations in which “2” would be registered in Status 840 are situations in which the corresponding logical volume is already set as the replication destination logical volume or the corresponding logical volume already forms a pair with another logical volume.

[0025] If at least one or more logical volumes (spare logical volumes) other than the first logical volume 111 and the second logical volume 121 is provided on a certain storage apparatus, a spare volume management table 850 can be provided to manage those logical volumes. According to the present embodiment, the third logical volume 131 and the fourth logical volume are the spare logical volumes.

[0026] In each spare volume management table entry 860 of the spare volume management table 850 are recorded, for example, a usage status (“Usage Status”) 870 of the entry, an ID number of a storage apparatus (“Storage Apparatus”) 880 corresponding to the entry, and an ID number indicating a logical volume (“Logical Volume”) 890 of the storage apparatus.

[0027] In Usage Status 870 of the spare volume management table entry 860, for example, “0” is registered if the logical volume that corresponds to the entry is usable; “1” is registered if the corresponding logical volume is in use; “2” is registered if the corresponding logical volume is unusable; and “3” is registered if the corresponding logical volume is out of order.

[0028] If a value that indicates that the logical volume that corresponds to an entry is in use is set in Usage Status 870, appropriate ID numbers are registered in Storage Apparatus 880 and Logical Volume 890 of the entry 860. More specifically, Storage Apparatus 880 of the entry 860 may register the ID number of a storage apparatus that sends data to the storage apparatus equipped with the logical volume corresponding to the entry. Similarly, Logical Volume 890 of the entry 860 may register the ID number of a logical volume having the data of which the corresponding logical volume stores.

[0029] With the spare volume management table 850, the first storage apparatus 110 can ascertain the status of each logical volume. Furthermore, the first storage apparatus 110 can quickly specify usable logical volumes among the spare logical volumes.

[0030] Tables can be stored in the first storage apparatus 110, which is the replication source storage apparatus, to the extent possible according to the present embodiment example, or the tables can be stored in other storage apparatuses.

[0031] The following summarizes the values set in various tables for each of the states illustrated in FIG. 6:

[0032] (1) The Normal Initial Copy-In-Progress State S600:

[0033] The failover status 780: “0” (normal initial copy-in-progress state)

[0034] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: the second logical volume 121

[0035] The current position in initial copy 710: in progress

[0036] (2) The Normal State S601 (Initial Copy Completed):

[0037] The failover status 780: “0” (normal state)

[0038] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: the second logical volume 121

[0039] The current position in initial copy 710: completed

[0040] (3) The Failover Initial Copy-In-Progress State S602:

[0041] The failover status 780: “0” (normal initial copy-in-progress state) or “3” (automatic failback infeasible state)

[0042] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: a logical volume other than the second logical volume 121

[0043] The current position in initial copy 710: completed

[0044] (4) The Failover State S603 (Initial Copy Completed):

[0045] The failover status 780: “0” (normal initial copy-in-progress state) or “3” (automatic failback infeasible state)

[0046] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: a logical volume other than the second logical volume 121

[0047] The current position in initial copy 710: completed

[0048] (5) The Failback-In-Progress State S604:

[0049] The failover status 780: “1” (failback-in-progress state)

[0050] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: the second logical volume 121

[0051] The current position in initial copy 710: in progress

[0052] (6) The Duplication Failover-In-Progress State S605:

[0053] The failover status 780: “2” (duplication failover-in-progress state)

[0054] The current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760: the second logical volume 121

[0055] The current position in initial copy 710: in progress

[0056] FIGS. 9 and 10 indicate a flowchart of a data write processing that is executed when a write request is sent from the information processing apparatus 140 to the first storage apparatus 110. In S901, the first storage apparatus 110 receives a data write request from the information processing apparatus 140. In S902, the first storage apparatus 110 writes the data to the first logical volume 111. In S903, the first storage apparatus 110 checks the failover status 780. If as a result of checking the failover status 780 is found to have a value other than “1,” which indicates a failback-in-progress state, the copy destination (data replication destination) is determined as a logical volume (current) designated in the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, and the processing proceeds to S906.

[0057] If the failover status 780 is found to be “1,” which indicates a failback-in-progress state, the copy destination is determined in S904 as the logical volume 121, which is the replication destination designated in the replication destination storage apparatus 730 and the replication destination logical volume 740.

[0058] Next, when data is copied to the logical volume 121 or 131 other than the first logical volume 111 in S906, the bit on the differential bitmap 770 that corresponds to a block of data written to the logical volume 121 or 131 is set to the on position, or “1.” In S907, whether the block number whose bit is in the on position, or “1,” is different from the current position in initial copy 710 (i.e., the block number<the current position in initial copy 710) is checked to determine if the initial copy is completed; if it is determined that the initial copy is completed (S907: No), the processing skips to S1000 in FIG. 10.

[0059] If it is determined in S907 that the initial copy is not completed (S907: Yes), the first storage apparatus 110 sends the write data to the storage apparatus 120 or 130 having the logical volume 121 or 131 (copy destination) determined in S904 or S905 (S908). Next, the first storage apparatus 110 waits for a copy completion report or an error report from the storage apparatus 120 or 130 to which the write data was sent (S909).

[0060] If the first storage apparatus 110 receives a copy error report in S910 (S910: No), the processing skips to S913; if the first storage apparatus 110 receives a copy completion report (S910: Yes), the processing proceeds to S911.

[0061] In S911, whether the copy destination is the replication destination logical volume is determined. If it is determined that the copy destination is not the second logical volume 121, which is the replication destination logical volume (S911: No), the processing skips to S1000; if it is determined that the copy destination is the second logical volume 121 (S911: No), the processing proceeds to S912.

[0062] In S912, the bit in the differential bitmap 770 that corresponds to the block of data written is set to the off state, or “0.” This signifies that copying the data in the block ended normally. In other words, it signifies that contents of the first logical volume 111, which is the replication source logical volume, and contents of the second logical volume 121, which is the replication destination logical volume, are consistent.

[0063] In S913, whether the status is a failback-in-progress state is checked using the failover status 780. If it is determined that the status is not in a failback-in-progress state (i.e., if the failover status 780 is “o”) (S913: No), a failover destination determination processing, described later, is executed and the processing skips to S1000. On the other hand, if it is determined in S913 that the status is in a failback-in-progress state (i.e., if the failover status 780 is “1”) (S913: Yes), the processing proceeds to S915; in S915, the value “1” (a failback-in-progress state) in the failover status 780 is replaced by the value “0” (a normal state). In S916, the current position in initial copy 710 of the logical volume indicated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760 is set to the largest block number plus 1 (i.e., the current copy position indicates completion of current remote copy); in S917, the copy destination is decided as a logical volume (current remote copy destination) indicated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, and the processing returns to S908.

[0064] In S1000, the first storage apparatus 110 checks the failover status 780 and determines whether the copy destination logical volume is in a failback-in-progress state. If it is determined in S1000 that the copy destination logical volume is not in a failback-in-progress state, or not “1” (S1000: No), the processing skips to S1010. On the other hand, if it is determined in S1000 that the copy destination logical volume is in a failback-in-progress state, or “1” (S1000: Yes), the processing proceeds to S1001. In S1001, the first storage apparatus 110 sends data to the storage apparatus 130 that has the logical volume 131, so that data can be written to the logical volume 131 (current remote copy destination) indicated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760. Next, in S1002 the storage apparatus 110 waits for a copy completion report or an error report from the storage apparatus 130, to which data was sent.

[0065] In S1003, if the first storage apparatus 110 receives a completion report (S1003: Yes), the data write processing is terminated. On the other hand, if the first storage apparatus 110 receives an error report (S1003: No), the processing proceeds to S1004.

[0066] In S1004, the failover destination management table entry 810 that corresponds to the logical volume to which data could not be written is searched. In S1005, Status 840 of the failover destination management table entry 810 found is set to “1,” which signifies that the corresponding logical volume is out of order. In S1006, ID numbers of the second storage apparatus 120, which is the replication destination storage apparatus, and the second logical volume 121, which is the replication destination logical volume, are set in the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, respectively. In S1007, the failover status 780 is set to “0,” which signifies a normal state, and the data write processing is terminated.

[0067] In S1010, the first storage apparatus 110 checks the failover status 780 and determines whether the copy destination logical volume is in a duplication failover-in-progress state (i.e., whether the value is “2”). If it is determined to be in a state other than a duplication failover-in-progress state (S1010: No), the data write processing is terminated. On the other hand, if it is determined that the copy destination logical volume is in a duplication failover-in-progress state (S1010: Yes), the processing proceeds to S1011. In S1011, the first storage apparatus 110 sends the data received from the information processing apparatus 140 to the storage apparatus 120, which is the replication destination storage apparatus, so that the data can be written to the second logical volume 121, which is the replication destination logical volume. In S1012, the first storage apparatus 110 waits for a data write completion report or an error report from the storage apparatus 120, which is the replication destination storage apparatus.

[0068] If the first storage apparatus 110 receives a completion report in S1013 (S1013: Yes), the data write processing is terminated. On the other hand, if the first storage apparatus 110 receives an error report in S1013 (S1013: No), the processing proceeds to S1014. In S1014, the failover status 780 is set to automatic failback infeasible (i.e., the value of “3”), and the data write processing is terminated.

[0069] In the above processing, the data write request from the information processing apparatus 140 can be in units of single blocks or in units of a plurality of blocks.

[0070] FIG. 11 is a flowchart of a failover destination determination processing that is called from the data write processing (S914) or from a processing to begin failover (S1603), which is described later. First, in S1101, whether the processing is called from the processing to begin failover (S1603), described later, is determined. If it is called from the processing to begin failover (S1101: Yes), the processing skips to S1105. On the other hand, if the processing is not called from the processing to begin failover (S1101: No), the processing proceeds to S1102.

[0071] In S1102, whether the logical volume to which data could not be written is the second logical volume 121, which is the replication destination logical volume, is determined. If it is the second logical volume 121 (S1102: Yes), the processing skips to S1105; if it is not the second logical volume 121 (Si102: No), the processing proceeds to S1103.

[0072] In S1103, the failover destination management table entry 810 that corresponds to the logical volume to which data could not be written (i.e., the current remote copy destination) is searched in the failover destination management table 800, and the corresponding Status 840 is set to “I,” which signifies out of order, in S1104.

[0073] In S1105, the failover destination management table 800 is investigated and a usable logical volume (i.e., one whose value in Status 840 is “0”) is searched. Next, for example, when the logical volume 131 is found, whether the logical volume 131 found in S1105 can be used is queried to the storage apparatus 130, which has the logical volume 131 (S1106).

[0074] If it is reported in S1107 that the logical volume 131 cannot be used (S1107: No), the processing returns to S1105 and searches for another entry (i.e., a logical volume). On the other hand, if it is reported in S1107 that the logical volume 131 can be used (S1107: Yes), the processing proceeds to S1108. ID numbers of the logical volume reported as usable and the storage apparatus having the logical volume are set in the current remote copy destination logical volume 760 and the current remote copy destination storage apparatus 750, respectively. Next, in S1109, the current position in initial copy 710 is set to “0,” which signifies the beginning of the logical volume; and in S1110, the initial copy degree of priority 720 is set to “0,” which is low.

[0075] Next, in S1111, whether the logical volume to which data could not be written (i.e., to which a remote copy could not be performed) is the second logical volume 121, which is the replication destination logical volume, is determined. If it is not the second logical volume 121 (S1111: No), the failover destination determination processing is terminated; if it is the second logical volume 121 (S1111: Yes), the processing proceeds to S1112. In S1112, only bits that correspond to blocks whose data could not be written (i.e., on which a remote copy could not be performed) are set to “1” in the differential bitmap 770, while the rest are initialized to “0,” and the failover destination determination processing is terminated.

[0076] FIG. 12 shows a flowchart of an initial copy processing to make contents of the logical volume 111, which is the replication source, consistent with contents of the second logical volume 121, which is the replication destination. The initial copy processing is executed in the background asynchronously with I/O requests from the information processing apparatus 140. Further, the initial copy processing is periodically activated by the timer 207, but the activation time interval may vary depending on the value of the initial copy degree of priority 720. If the initial copy degree of priority 720 is “1,” which is high, the time interval should be set to a value that would end the initial copy in a short period of time, even if this impacts response time for I/O requests from the information processing apparatus 140. For example, the value can be set to once every 10 msec. On the other hand, if the initial copy degree of priority 720 is “0,” which is low, the time interval should be set to a value that would have almost no impact on the response time for I/O requests from the information processing apparatus 140. For example, the value can be set to once every second.

[0077] First, in S1201, the failover status 780 is referred to, and whether a failback is in progress is determined. If it is determined in S1201 that a failback is not in progress, or not “1” (S1201: No), the processing proceeds to S1203. In S1203, the logical volume 131, which is designated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, is determined as the initial copy destination, and the processing proceeds to S1204. On the other hand, if it is determined in S1201 that a failback is in progress, or “1” (S1201: Yes), the processing proceeds to S1202; in S1202, the initial copy destination is determined as the second logical volume 121, which is the replication destination logical volume, and the processing proceeds to S1204.

[0078] The current position in initial copy 710 is obtained in S1204, and whether the initial copy is completed is determined in S1205. If it is determined in S1205 that the initial copy is completed (i.e., when the value of the current position in initial copy 710 equals the largest block number of the logical volume, which is the initial copy destination, plus 1) (S1205: Yes), the processing skips to S1215. On the other hand, if it is determined in S1205 that the initial copy is still in progress (S1205: No), the processing proceeds to S1206.

[0079] In S1206, whether the initial copy destination is the replication destination logical volume, which is the second logical volume 121, is determined; if it is determined that it is not the replication destination logical volume (S1206: No), the processing skips to S1209. On the other hand, if it is determined that it is the replication destination logical volume (S1206: Yes), the processing proceeds to S1207.

[0080] In S1207, whether the bit on the differential bitmap 770 that corresponds to the block number on which the initial copy is to take place is in the on state, or “1,” is determined; if it is determined that it is in the on state, or “1” (S1207: Yes), the processing proceeds to S1209; if it is determined that it is in the off state, or “0” (S1207: No), the processing proceeds to S1208, where the current position in initial copy 710 is incremented by one and the processing returns to S1204.

[0081] In S1209, the block on which to perform the initial copy is read from the first logical volume 111. Next, in S1210, data in the block on which the initial copy is to be performed is sent to the storage apparatus (i.e., the remote copy destination) that has the logical volume, which is the initial copy destination, to be written.

[0082] In S1211, whether data can be written in the initial copy is determined; if it is determined that data can be written (S1211: Yes), the processing proceeds to S1212; if it is determined that data cannot be written (S1211: No), the initial copy processing is terminated.

[0083] If data cannot be written, a failover can either be executed or not executed. If a failover is not executed, an initial copy processing is retried by the timer 207 on the logical volume to which the initial copy failed.

[0084] In S1212, whether the logical volume that is the initial copy destination is the second logical volume 121, which is the replication destination, is determined; if it is determined that it is not the second logical volume 121 (S1212: No), the processing skips to S1214; if it is determined that it is the second logical volume 121 (S1212: Yes), the bit on the differential bitmap 770 that corresponds to the block number on which the initial copy is to take place is set to the off state, or “0” (S1213), and the processing proceeds to S1214.

[0085] In S1214, the current position in initial copy 710 is incremented by one and the initial copy processing is terminated.

[0086] In S1215, the initial copy degree of priority is set to “0,” which is low. The failover status 780 is referred to in S1216 and whether a failback is in progress is checked. If it is determined in S1216 that a failover status 780 is in a state other than a failback-in-progress state, or not “1” (S1216: No), the processing proceeds to S1220. On the other hand, if it is determined in S1216 that it is in a failback-in-progress state, or “1,” the processing proceeds to S1217, where the failover status 780 is set to a normal state, or “0.” Next, in S1218, the current position in initial copy 710 is set to the largest block number of the logical volume, which is the initial copy destination, plus 1. Next, in S1219, ID numbers of the storage apparatus 120, which is the replication destination storage apparatus, and the logical volume 121, which is the replication destination logical volume, are set in the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, respectively, and the processing proceeds to S1220.

[0087] In S1220, whether the failover status 780 indicates a duplication failover-in-progress state, or “2,” is determined; if it is determined to indicate a duplication failover-in-progress state (S1220: Yes), the processing proceeds to S1221, where the failover status 780 is set to an automatic failback infeasible state, or “3,” and the initial copy processing is terminated. On the other hand, if it is determined in S1220 that the failover status 780 does not indicate a duplication failover-in-progress state (S1220: No), the initial copy processing is terminated.

[0088] FIG. 13 is a flowchart of a failback determination processing to determine whether an access (i.e., data write) to the second logical volume 121 is possible during a failover, and to begin a failback. The failback determination processing is activated by a system administrator or periodically by the timer 207. For example, if the failback determination processing is set to be periodically activated once every minute, the timer 207 instructs the first storage apparatus 110 to activate the failback determination processing once every minute.

[0089] First, the failover status 780 is referred to in S1301 to determine whether a failback is already in progress. If as a result of the determination made in S1301, it is determined that a failback is in progress, or “1” (S1301: Yes), the failback determination processing is terminated.

[0090] If as a result of the determination made in S1301, it is determined that a failback is not in progress, or not “1” (S1301: No), the processing proceeds to S1302. In S1302, whether the failover status 780 is set to an automatic failback infeasible state, or “3,” and whether the current failback determination processing has been activated by the timer 207 are determined. If as a result of the determination made in S1302, it is determined that the failover status 780 is set to the automatic failback infeasible state, or “3,” and that the current failback determination processing has been activated by the timer 207 (S1302: Yes), the failback determination processing is terminated; otherwise, the processing proceeds to S1303.

[0091] In S1303, whether the logical volume designated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760 is the second logical volume 121, which is the replication destination logical volume, is determined. If it is determined in S1303 that it is the second logical volume 121 (S1303: Yes), the failback determination processing is terminated. On the other hand, if it is determined in S1303 that it is not the second logical volume 121 (S1303: No), the processing proceeds to S1304; in S1304, a block with the smallest block number among blocks whose bits are 1 in the differential bitmap 770 is selected, and the block is read from the first logical volume 111. In S1305, data in the block is sent to the second storage apparatus 120, which is the replication destination storage apparatus that has the second logical volume 121, which is the replication destination logical volume, to be written to the second logical volume 121.

[0092] In S1306, whether data can be written to the second logical volume 121, which is the replication destination logical volume, is determined. If it is determined in S1306 that data cannot be written (S1306: No), a failback is determined to be infeasible and the failback determination processing is terminated. On the other hand, if it is determined in S1306 that data can be written to the second logical volume 121, which is the replication destination logical volume (S1306: Yes), it is determined that a failback is feasible and the processing proceeds to S1307. In S1307, the bit that corresponds to the block in the differential map 770 is set to the off state, or “0,” and the processing proceeds to S1308.

[0093] In S1308, the current position in initial copy 710 is investigated and whether an initial copy is currently in progress is determined. If it is determined in S1308 that the initial copy is completed (i.e., when the value of the current position in initial copy 710 equals the largest block number of the logical volume plus 1) (S1308: No), the processing skips to S1311. On the other hand, if it is determined in S1308 that the initial copy is still in progress (S1308: Yes), ID numbers of the storage apparatus 120 and the second logical volume 121, which are the replication destination, are set in the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760, respectively. In S1310, the current position in initial copy 710 is initialized to “0,” which signifies the beginning of the logical volume, and the failback determination processing is terminated

[0094] In S1311, the failover status 780 is set to a failback-in-progress state, or “1”; and in S1312, the current position in initial copy 710 is initialized to “0,” which signifies the beginning of the logical volume, and the failback determination processing is terminated.

[0095] As described above, a failback is determined to be feasible if a data write is successful once according to the present embodiment example, but a failback may be determined to be feasible based on other criteria. For example, a failback can be determined to be feasible if data write is successful consecutively a certain number of times.

[0096] Furthermore, according to the present embodiment example, a failback processing takes place when it is determined that a failback is feasible to the second logical volume 121. In this case, a determination may be made as to whether an initial copy processing in order to failback to the second logical volume 121 or an initial copy processing in order to failover to the third logical volume 131 should take place first. For example, by determining whether it would require less time for an initial copy for a failback to the second logical volume 121 or for a failover to the third logical volume 131 (for example, this determination can be made by comparing the number of blocks that must be transferred for initial copy), the one that requires less time for initial copy can be selected. This can further shorten the time during which redundancy of the logical volume 111 is not guaranteed.

[0097] FIG. 14 is a flowchart of a failover destination collection processing that is activated once every 24 hours by the timer 207. The failover destination collection processing can alternatively be set to collect failover destinations when a failover becomes necessary.

[0098] First, in S1401, one of the spare storage apparatuses connected to the first storage apparatus 110 via the networks 150 is selected, and the processing proceeds to S1402. To be able to make this selection, the first storage apparatus 110 may have a list in advance of all spare storage apparatuses connected via the networks 150, or it may create a list of all storage apparatuses when it becomes necessary by broadcasting via the networks 150 and obtaining responses from spare storage apparatuses currently connected.

[0099] In S1402, a “collection command” is sent to the spare storage apparatus selected. The spare storage apparatus that received the collection command executes a processing to declare spare logical volumes, described later, and sends back a list of spare logical volumes (i.e., logical volumes usable as failover destinations) provided on the spare storage apparatus. However, if a failure has occurred on the spare storage apparatus that received the collection command, it cannot respond to the first storage apparatus 110. Furthermore, if the storage apparatus that received the collection command does not have any spare logical volumes, an error message is sent to the first storage apparatus 110.

[0100] In S1403, whether there was no response or an error message in response to the collection command is determined; if it is determined that there was no response or an error message (S1403: Yes), the processing skips to S1407. On the other hand, if there was a response from the spare storage apparatus (S1403: No), the processing proceeds to S1404.

[0101] In S1404, ID numbers of logical volumes are obtained from the list of spare logical volumes. In S1405, the ID numbers are registered in the failover destination management table 800. At the same time, the ID number of the spare storage apparatus selected is set in Storage Apparatus 820, each of the ID numbers of the logical volumes on the list received is set in Logical Volume 830, and the value “0” that signifies that the logical volume indicated in Logical Volume 830 is not out of order is set in Status 840. If the failover destination management table 800 becomes full, the failover destination collection processing is terminated (S1406: Yes). On the other hand, if it is determined in S1406 that the failover destination management table 800 is not full (S1406: No), the processing proceeds to S1407.

[0102] In S1407, whether there are any spare storage apparatuses that have not yet been selected is determined. If it is determined in S1407 that there are spare storage apparatuses that have not yet been selected (S1407: Yes), the processing returns to S1401. If it is determined in S1407 that there are no spare storage apparatuses that have not yet been selected (S1407: No), the processing proceeds to S1408. In S1408, a value “2,” which signifies that the corresponding entry 810 is invalid, is set in Status 840 of the entries 810 for any of the spare logical volumes whose entry 810 has not been set.

[0103] The logical volumes to which a failover is feasible are specified through the failover destination collection processing. Consequently, when data cannot be written to the second logical volume 121 or the third logical volume 131, the processing that was being performed (for example, an initial copy or remote copy) on the second logical volume 121 or the third logical volume 131 can be quickly taken over by another logical volume to which a failover is feasible.

[0104] FIG. 15 is a flowchart of a processing for a system administrator to raise the initial copy degree of priority 720.

[0105] First, the system administrator activates this processing in order to raise the initial copy degree of priority 720. When the initial copy degree of priority 720 is set to “1,” which is high, in S1501, the processing to increase the initial copy degree of priority is terminated. Similarly, a processing can be designed to allow the system administrator to activate a processing to lower the initial copy degree of priority 720.

[0106] FIG. 16 is a flowchart of a processing to begin failover that is activated by a system administrator to request an execution of a failover.

[0107] First, in S1601, whether the status is in the normal state S601 is determined. For the normal state S601 to be established, the failover status 780 is set to the normal status, or “0”; the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760 must indicate the second storage apparatus 120 and the second logical volume 121, respectively; and the current position in initial copy 710 must be the largest block number in the second logical volume 121 plus 1. If as a result of the determination made in S1601, it is determined that the status is the normal state S601 (S1601: Yes), the processing proceeds to S1602; if it is determined that the status is not the normal state S601 (S1601: No), the processing to begin failover is terminated. In S1602, the failover status 780 is set to the duplication failover-in-progress state, or “2”; the failover destination determination processing is executed in step S1603, and the processing to begin failover is terminated.

[0108] FIG. 17 is a flowchart of a processing executed in the first storage apparatus 110 to check the usage status of the logical volume 121 or 131, when a storage apparatus other than the first storage apparatus 110 queries the usage status of the logical volume 121 or 131, which is provided on the storage apparatus 120 or 130 other than the first storage apparatus 110, in S2103 of an update processing for the spare volume management table 850, described later.

[0109] First, in S1701 whether the ID number of the spare logical volume queried matches the ID number of the second logical volume 121, which is set as the replication destination logical volume, is determined; if they are determined to match (S1701: Yes), the processing skips to S1704; if they are determined not to match (S1701: No), the processing proceeds to S1702.

[0110] In S1702, whether the ID number of the spare logical volume queried matches with the logical volume designated by the current remote copy destination storage apparatus 750 and the current remote copy destination logical volume 760 is determined; if they are determined to match (S1702: Yes), the processing skips to S1704; if they are determined not to match (S1702: No), the processing proceeds to S1703; in S1703, a response that the logical volume queried is “unused” is sent back to the storage apparatus that made the query, and the usage status check processing is terminated. In S1704, a response that the logical volume queried is “in use” is sent back to the storage apparatus that made the query, and the usage status check processing is terminated.

[0111] Various processing executed in the first storage apparatus 110 have been described above, but the following processings are executed in the second storage apparatus 120 or the third storage apparatus 130.

[0112] FIG. 18 is a flowchart of a processing to declare spare logical volumes, which is activated upon receipt of the collection command.

[0113] First, in S1801, all entries 860 whose value in Usage Status 870 is “0” (free) or “1” (in use as a spare logical volume) are searched in the spare volume management table 850 and a list of ID numbers of applicable logical volumes is created. In S1802, the list created is sent to the first storage apparatus 110 that sent the collection command, and the processing to declare spare logical volumes is terminated.

[0114] FIG. 19 is a flowchart of a processing to report usage status of spare logical volumes, which is activated by a query made in S1106 of the failover destination determination processing.

[0115] First, the first storage apparatus 110 queries the usage status of a logical volume whose value in Usage Status 870 is other than “2” (which signifies invalid) and that is designated by ID numbers in Storage Apparatus 880 and Logical Volume 890. Based on the query, in S1910, the applicable spare storage apparatus searches for a logical volume that satisfies the conditions from among the entries 860 in the spare volume management table 850. In S1902, the value of Usage Status 870 of the entry 860 found is sent to the first storage apparatus 110, and the processing proceeds to S1903.

[0116] In S1903, if the value of Usage Status 870 of the entry 860 found is not “0,” which signifies that the corresponding logical volume is free (S1903: No), the processing to report usage status of spare logical volumes is terminated. On the other hand, if the value of Usage Status 870 is “0,” which signifies that the corresponding logical volume is free (S1903: Yes), the processing proceeds to S1904.

[0117] In S1904, Usage Status 870 is set to “1,” which signifies that the corresponding logical volume is in use. Next, in S1905, the ID number of the corresponding logical volume and the ID number of the storage apparatus having the logical volume are registered in Logical Volume 890 and Storage Apparatus 880, respectively, of the corresponding spare volume management table entry 860. Next, the processing to report usage status of spare logical volumes is terminated.

[0118] FIG. 20 is a flowchart of a remote write processing that is executed when there is a data write (remote copy) request from the first storage apparatus 110 to write data in the first storage volume 111. Specifically, a data write (remote copy) request to the first storage apparatus 110 is issued in S908 and S1001 of the data write processing, in S1210 of the initial copy processing, and in S1305 of the failback determination processing.

[0119] First, in S2001, the second storage apparatus 120 or the third storage apparatus 130 receives data to be written via the network 115; and in S2002, the data is written to the second logical volume 121 or the third logical volume 131. In S2003, the second storage apparatus 120 or the third storage apparatus 130 determines whether the data write has ended normally. If it is determined in S2003 that it ended normally (S2003: Yes), the processing proceeds to S2004. Next, in S2004, the second storage apparatus 120 or the third storage apparatus 130 reports to the first storage apparatus 110, which requested the remote copy, that the data write has ended normally, and terminates the remote write processing.

[0120] On the other hand, if it is determined in S2003 that data cannot be written (S2003: No) in either the second or third storage apparatus 120 or 130, the processing proceeds to S2005. In S2005, the second storage apparatus 120 or the third storage apparatus 130 reports to the first storage apparatus 110, which requested the remote copy, that the data write has ended abnormally, and the remote write processing is terminated.

[0121] FIG. 21 is a flowchart of an update processing for the spare volume management table 850, which is activated once every six hours by the timer 207. This processing is performed by each of the storage apparatuses 120 and 130 to periodically manage the usage status of their respective logical volumes and to update their respective spare volume management table 850.

[0122] First, in S2101, one of the entries 860 is selected from the spare volume management table 850. In S2102, the usage status of the entry 860 is checked; if it is determined that the usage status has a value other than “1” (i.e., the corresponding logical volume is in use as a spare logical volume) (S2102: No), the processing skips to S2106.

[0123] If as a result of checking the usage status of the entry 860 in S2102 the value is determined to be “1” (S2102: Yes), the processing proceeds to S2103. In S2103, the first storage apparatus 110 designates the ID number of Logical Volume 890 provided on the storage apparatus indicated by the ID number in Storage Apparatus 880, and queries the storage apparatus of the usage status of the logical volume designated.

[0124] In S2104, if a response that the logical volume is “in use” is sent to the first storage apparatus 110 (S2104: Yes), the processing skips to S2106. On the other hand, if the response is that the logical volume is “unused” (S2104: No), the processing proceeds to S2105. In S2105, Usage Status 870 is set to “0” (free, signifying that the logical volume is usable as a spare logical volume) and the processing proceeds to S2106.

[0125] In S2106, whether the value of Usage Status 870 is “0” (free, signifying that the logical volume is usable as a spare logical volume) or “3” (signifying that the logical volume is out of order) is determined; if as a result of the determination the value of Usage Status 870 is found to be other than “0” or “3” (S2106: No), the processing skips to S2111. On the other hand, if as a result of the determination the value of Usage Status 870 is found to be “0” or “3” (S2106: Yes), the processing proceeds to S2107. In S2107, whether access can be made to the spare logical volume is determined. This determination can be based on, for example, an I/O request issued to the spare logical volume, where a determination of “access feasible” is made when the processing ends abnormally, while a determination of “access infeasible” is made when the processing does not end normally.

[0126] If it is determined in S2108 that access is feasible (S2108: Yes), the processing proceeds to S2110. In S2110, the value of Usage Status 870 is set to “0” (free), and the processing proceeds to S2111. On the other hand, if it is determined in S2108 that access is infeasible (S2108: No), the processing proceeds to S2109. In S2109, the value of Usage Status 870 is set to “3” (out of order), and the processing proceeds to S2111.

[0127] In S2111, whether there are any more entries 860 left is determined; if as a result of the determination more entries are found to be remaining (S2111: Yes), the processing returns to S2101; if as a result of the determination no more entries are found to be remaining (S2111: No), the update processing for the spare volume management table 850 is terminated.

[0128] Although candidates of failover destination spare logical volumes are automatically selected through the failover destination collection processing according to the present embodiment example, an administrator may manually set the failover destination management table 800 in advance and decide on a failover destination spare logical volume using the failover destination management table 800.

[0129] This concludes the description of the embodiments, but the embodiment examples serve only to facilitate the understanding of the present invention and do not limit the interpretation of the present invention. Many modifications can be made without departing from the present invention, and the present invention includes equivalents derived therefrom.

[0130] As described above, a control method for an information processing system and an information processing system can be provided according to the present invention.

[0131] While the description above refers to particular embodiments of the present invention, it will be understood that many modifications may be made without departing from the spirit thereof. The accompanying claims are intended to cover such modifications as would fall within the true scope and spirit of the present invention.

[0132] The presently disclosed embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims, rather than the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.

Claims

1. A method for controlling an information processing system essentially composed of a first storage apparatus equipped with a first logical volume, a second storage apparatus equipped with a second logical volume, a third storage apparatus equipped with a third logical volume, an information processing apparatus that accesses the first storage apparatus, a first communication module that communicatively connects the first storage apparatus with the second storage apparatus, and a second communication module that communicatively connects the first storage apparatus with the third storage apparatus, the method comprising the steps of: executing a replication management processing from the first logical volume to the second logical volume, wherein, upon receiving a data write request from the information processing apparatus, the first storage apparatus stores data in the first logical volume according to the data write request and also sends the data to the second storage apparatus, and upon receiving the data, the second storage apparatus stores the data in the second logical volume; and executing a replication management processing from the first logical volume to the third logical volume, wherein, upon receiving a request to execute a failover from the information processing apparatus, the first storage apparatus sends the data to the third storage apparatus, and upon receiving the data, the third storage apparatus stores the data in the third logical volume.

2. A method for controlling an information processing system according to claim 1, further comprising the step of executing an initializing replication processing from the first logical volume to the second logical volume, when a content of the first logical volume is not consistent with a content of the second logical volume, wherein the first storage apparatus sends all data of the first logical volume to the second storage apparatus prior to executing the replication management processing from the first logical volume to the second logical volume, and, the second storage apparatus stores in the second logical volume the all data of the first logical volume to make the content of the second logical volume consistent with the content of the first logical volume.

3. A method for controlling an information processing system according to claim 1, further comprising the step of executing an initializing replication processing from the first logical volume to the third logical volume, when a content of the first logical volume is not consistent with a content of the third logical volume, wherein the first storage apparatus sends all data of the third logical volume to the third storage apparatus prior to executing the replication management processing from the first logical volume to the third logical volume, and the third storage apparatus stores in the third logical volume the all data of the first logical volume to make the content of the third logical volume consistent with the content of the first logical volume.

4. A method for controlling an information processing system according to claim 3, wherein, when the data cannot be written in the second logical volume during executing the replication management processing from the first logical volume to the second logical volume, the initializing replication processing from the first logical volume to the third logical volume is automatically started.

5. A method for controlling an information processing system according to claim 3, wherein, when the data cannot be written in the second logical volume during executing the initializing replication management processing from the first logical volume to the third logical volume, the initializing replication management processing from the first logical volume to the third logical volume is continued.

6. A method for controlling an information processing system according to claim 3, wherein, when the data cannot be written in the second logical volume during executing the replication management processing from the first logical volume to the second logical volume, the initializing replication processing from the first logical volume to the third logical volume is automatically started.

7. A method for controlling an information processing system according to claim 4, further comprising the step of automatically starting an initializing replication processing from the first logical volume to a fourth logical volume of a fourth storage apparatus, when the data cannot be written in the third logical volume during executing the initializing replication management processing from the first logical volume to the third logical volume, wherein the first storage apparatus sends the data to the fourth storage apparatus, and the fourth storage apparatus stores the data in the fourth logical volume.

8. A method for controlling an information processing system according to claim 5, further comprising the step of automatically starting an initializing replication processing from the first logical volume to a fourth logical volume of a fourth storage apparatus, when the data cannot be written in the third logical volume during executing the initializing replication management processing from the first logical volume to the third logical volume, wherein the first storage apparatus sends the data to the fourth storage apparatus, and the fourth storage apparatus stores the data in the fourth logical volume.

9. A method for controlling an information processing system according to claim 6, further comprising the step of automatically starting an initializing replication processing from the first logical volume to a fourth logical volume of a fourth storage apparatus, when the data cannot be written in the third logical volume during executing the initializing replication management processing from the first logical volume to the third logical volume, wherein the first storage apparatus sends the data to the fourth storage apparatus, and the fourth storage apparatus stores the data in the fourth logical volume.

10. A method for controlling an information processing system according to claim 1, further comprising the step of automatically starting an initializing replication processing from the first logical volume to a fourth logical volume of a fourth storage apparatus, when the data cannot be written in the third logical volume during executing the replication management processing from the first logical volume to the third logical volume, wherein the first storage apparatus sends the data to the fourth storage apparatus, and the fourth storage apparatus stores the data in the fourth logical volume.

11. A method for controlling an information processing system according to claim 3, further comprising the step of automatically starting an initializing replication processing from the first logical volume to a fourth logical volume of a fourth storage apparatus, when the data cannot be written in the third logical volume during executing the initializing replication management processing from the first logical volume to the third logical volume, wherein the first storage apparatus sends the data to the fourth storage apparatus, and the fourth storage apparatus stores the data in the fourth logical volume.

12. A method for controlling an information processing system according to claim 7, wherein the initializing replication processing from the first logical volume to the fourth logical volume is automatically started, when the data cannot be written in the third logical volume, the first storage apparatus queries the fourth storage apparatus about a usage status of the fourth logical volume, and the first storage apparatus receives a notification from the fourth storage apparatus indicating that the fourth logical volume is usable.

13. A method for controlling an information processing system according to claim 4, wherein the replication processing from the first logical volume to the third logical volume starts after completing the initializing replication processing from the first logical volume to the third logical volume.

14. A method for controlling an information processing system according to claim 5, wherein the replication processing from the first logical volume to the third logical volume starts after completing the initializing replication processing from the first logical volume to the third logical volume.

15. A method for controlling an information processing system according to claim 6, wherein the replication processing from the first logical volume to the third logical volume starts after completing the initializing replication processing from the first logical volume to the third logical volume.

16. A method for controlling an information processing system according to claim 1, further comprising the steps of: judging whether or not data can be written in the second logical volume during executing the replication processing from the first logical volume to the third logical volume; and starting a re-initializing replication processing, when a determination is made that data can be written in the second logical volume, wherein the first storage apparatus sends all data of the first logical volume to the second storage apparatus, and the second storage apparatus stores in the second logical volume the all data of the first logical volume.

17. A method for controlling an information processing system according to claim 1, further comprising the steps of: judging whether or not data can be written in the second logical volume during executing the replication processing from the first logical volume to the third logical volume; and comparing a content of the first logical volume with a content of the second logical volume, when a determination is made that data can be written in the second logical volume; and starting a re-initializing replication processing from the first logical volume to the second logical volume, when a difference is detected between the content of the first logical volume and the second logical volume, wherein the first storage apparatus sends to the second storage apparatus data that is not present in the second logical volume, and the second storage apparatus stores in the second logical volume the data that is not present in the second logical volume.

18. A method for controlling an information processing system according to claim 4, further comprising the steps of: judging whether or not data can be written in the second logical volume during executing the initializing replication processing from the first logical volume to the third logical volume; and starting a re-initializing replication processing, when a determination is made that data can be written in the second logical volume, wherein the first storage apparatus sends all data of the first logical volume to the second storage apparatus, and the second storage apparatus stores in the second logical volume the all data of the first logical volume.

19. A method for controlling an information processing system according to claim 5, further comprising the steps of: judging whether or not data can be written in the second logical volume during executing the initializing replication processing from the first logical volume to the third logical volume; and starting a re-initializing replication processing, when a determination is made that data can be written in the second logical volume, wherein the first storage apparatus sends all data of the first logical volume to the second storage apparatus, and the second storage apparatus stores in the second logical volume the all data of the first logical volume.

20. A method for controlling an information processing system according to claim 6, further comprising the steps of: judging whether or not data can be written in the second logical volume during executing the initializing replication processing from the first logical volume to the third logical volume; and starting a re-initializing replication processing, when a determination is made that data can be written in the second logical volume, wherein the first storage apparatus sends all data of the first logical volume to the second storage apparatus, and the second storage apparatus stores in the second logical volume the all data of the first logical volume.

21. A method for controlling an information processing system according to claim 16, wherein the step of judging whether or not data can be written in the second logical volume includes the step of judging whether or not data can be written twice consecutively in the second logical volume.

22. A method for controlling an information processing system according to claim 17, wherein the step of judging whether or not data can be written in the second logical volume includes the step of judging whether or not data can be written twice consecutively in the second logical volume.

23. A method for controlling an information processing system according to claim 18, wherein the step of judging whether or not data can be written in the second logical volume includes the step of judging whether or not data can be written twice consecutively in the second logical volume.

24. A method for controlling an information processing system according to claim 19, wherein the step of judging whether or not data can be written in the second logical volume includes the step of judging whether or not data can be written twice consecutively in the second logical volume.

25. A method for controlling an information processing system according to claim 20, wherein the step of judging whether or not data can be written in the second logical volume includes the step of judging whether or not data can be written twice consecutively in the second logical volume.

26. A method for controlling an information processing system according to claim 18, further comprising a selection step of selecting one of the initializing replication processing from the first logical volume to the third logical volume and the re-initializing replication processing from the first logical volume to the second logical volume to be executed first.

27. A method for controlling an information processing system according to claim 19, further comprising a selection step of selecting one of the initializing replication processing from the first logical volume to the third logical volume and the re-initializing replication processing from the first logical volume to the second logical volume to be executed first.

28. A method for controlling an information processing system according to claim 20, further comprising a selection step of selecting one of the initializing replication processing from the first logical volume to the third logical volume and the re-initializing replication processing from the first logical volume to the second logical volume to be executed first.

29. A method for controlling an information processing system according to claim 26, wherein the selection step includes the steps of comparing a time period required for the initializing replication processing from the first logical volume to the third logical volume with a time period required for the re-initializing replication processing from the first logical volume to the second logical volume, judging which one of the time periods is shorter, and executing the selection step based on a judgment result provided by the step of judging.

30. A method for controlling an information processing system according to claim 27, wherein the selection step includes the steps of comparing a time period required for the initializing replication processing from the first logical volume to the third logical volume with a time period required for the re-initializing replication processing from the first logical volume to the second logical volume, judging which one of the time periods is shorter, and executing the selection step based on a judgment result provided by the step of judging.

31. A method for controlling an information processing system according to claim 28, wherein the selection step includes the steps of comparing a time period required for the initializing replication processing from the first logical volume to the third logical volume with a time period required for the re-initializing replication processing from the first logical volume to the second logical volume, judging which one of the time periods is shorter, and executing the selection step based on a judgment result provided by the step of judging.

32. A method for controlling an information processing system according to claim 16, further comprising the step of starting the replication processing from the first logical volume to the second logical volume after completing the re-initializing replication processing from the first logical volume to the second logical volume.

33. A method for controlling an information processing system according to claim 17, further comprising the step of starting the replication processing from the first logical volume to the second logical volume after completing the re-initializing replication processing from the first logical volume to the second logical volume.

34. A method for controlling an information processing system according to claim 18, further comprising the step of starting the replication processing from the first logical volume to the second logical volume after completing the re-initializing replication processing from the first logical volume to the second logical volume.

35. A method for controlling an information processing system according to claim 19, further comprising the step of starting the replication processing from the first logical volume to the second logical volume after completing the re-initializing replication processing from the first logical volume to the second logical volume.

36. A method for controlling an information processing system according to claim 20, further comprising the step of starting the replication processing from the first logical volume to the second logical volume after completing the re-initializing replication processing from the first logical volume to the second logical volume.

37. A method for controlling an information processing system according to claim 16, wherein, when data cannot be written in the second logical volume during executing the re-initializing replication management processing from the first logical volume to the second logical volume, only the replication management processing from the first logical volume to the third logical volume is continued.

38. A method for controlling an information processing system according to claim 17, wherein, when data cannot be written in the second logical volume during executing the re-initializing replication management processing from the first logical volume to the second logical volume, only the replication management processing from the first logical volume to the third logical volume is continued.

39. A method for controlling an information processing system according to claim 16, wherein, when data cannot be written in the third logical volume during executing the re-initializing replication management processing from the first logical volume to the second logical volume, the re-initializing replication management processing from the first logical volume to the second logical volume is continued.

40. A method for controlling an information processing system according to claim 17, wherein, when data cannot be written in the third logical volume during executing the re-initializing replication management processing from the first logical volume to the second logical volume, the re-initializing replication management processing from the first logical volume to the second logical volume is continued.

41. An information processing system comprising: a first storage apparatus equipped with a first logical volume; a second storage apparatus equipped with a second logical volume; a third storage apparatus equipped with a third logical volume; an information processing apparatus that accesses the first storage apparatus; a first communication module that communicatively connects the first storage apparatus with the second storage apparatus; a second communication module that communicatively connects the first storage apparatus with the third storage apparatus; a first module that executes a replication management processing from the first logical volume to the second logical volume, wherein, upon receiving a data write request from the information processing apparatus, the first storage apparatus stores data in the first logical volume according to the data write request and also sends the data to the second storage apparatus, and upon receiving the data, the second storage apparatus stores the data in the second logical volume; and a second module that executes a replication management processing from the first logical volume to the third logical volume, wherein, upon receiving a request to execute a failover from the information processing apparatus, the first storage apparatus sends the data to the third storage apparatus, and upon receiving the data, the third storage apparatus stores the data in the third logical volume.