Failover processing in a storage system

1. A method for supporting failover between networked storage systems, coupled between a first storage system and a second storage system and a set of one or more storage systems, comprising:

providing a single homogeneous environment distributed across a plurality of processors, cards, and storage systems;

identifying member candidates using a standard protocol;

creating Failover Sets, each Failover Set comprising one or more of said member candidates;

using a database to store and synchronize a configuration on all member candidates in a Failover Set;

for each Failover Set, designating one of the member candidates as a Primary, designating one of the member candidates as a Secondary, and designating remaining member candidates as Alternates;

performing startup processing of the member candidates; and

providing policies for run-time member behavior including fault characterization and detection, health monitoring, compatibility requirements, corrective action during failover, member restart and re-integration, and member failure limit exceeded condition.

2. The method of claim 1 wherein said storage systems include a single chassis-based product.

3. The method of claim 1 wherein said storage systems include a single stack-based product.

4. The method of claim 1 wherein said storage systems include two or more chassis-based products.

5. The method of claim 1 wherein said storage systems include two or more stack-based products.

6. The method of claim 1 wherein redundant network links between said networked storage systems are employed by:

a Discovery Service to identify said member candidates and verify connectivity by confirming information exchanged in each network;

an Arbitration Service to ensure that a member candidate's role is Primary, a member candidate's role is Secondary, and remaining member candidates' roles are Alternates, by supplying a member role in information exchanged in each network;

a Boot Service to coordinate said member role during startup using the type of boot by exchanging said member role in each network; and

a Policy Manager within a Failover Service to distinguish between a communications link failure between member candidates and a real member failure by sending a self-test using the redundant network to determine if said member candidate is functioning according to a specification.

7. The method of claim 6 wherein said network links include different network protocols.

8. The method of claim 6 wherein user configuration and management requests are load balanced across all of said member candidates.

9. The method of claim 6 wherein multi-path programming for attached host and storage devices is load balanced across all of said member candidates and comprises:

a port failover policy which is used to intelligently match server storage requests to compatible storage devices comprising;

an Active-Active policy where all paths to an exported virtual device can transfer commands and data simultaneously; and

an Active-Passive policy where only one path to said exported virtual device can transfer commands and data at a time.

10. A system for supporting failover between networked storage systems, coupled between a first storage system and a second storage system and a set of one or more storage systems, comprising:

a Services Framework to provide a single homogeneous environment distributed across a plurality of processors, cards, and storage systems;

a set of configuration and management software called Services that execute on top of the Services Framework comprising:

a Discovery Service to identify member candidates using a standard protocol; and

a Failover Service to organize the members into various compositions call Failover Sets, including Single, Hierarchical and N-way compositions;

a database management system to store and synchronize the configuration on all members in the failover set;

an Arbitration Service to determines that one member's role is Primary, one member's role is Secondary, and the remaining member's roles are Alternates;

a Boot Service to coordinate the member role during startup using the type of boot; and

a Policy Manager within the Failover Service to provide policies for run-time member behavior including fault characterization and detection, health monitoring, compatibility requirements, corrective action during failover, member restart and re-integration, and the member failure limit exceeded condition.