Storage system having multiple management controllers for detecting a failure

1. A storage system comprising:

a first storage controller; and

a second storage controller,

wherein the first storage controller includes:

a first communication interface;

a first input and output controller configured to perform input and output processing on host data; and

a first management controller,

wherein the second storage controller includes:

a second communication interface coupled to the first communication interface;

a second input and output controller configured to perform input and output processing on host data; and

a second management controller,

wherein the first management controller is configured to verify an integrity software for executed by the first management controller and verify an integrity of software for executed by the first input and output controller,

wherein the second management controller is configured to verify an integrity software for executed by the second management controller and verify an integrity of software for executed by the second input and output controller, and

wherein the first management controller is configured to:

verify the integrity of the software for executed by the second input and output controller, which is stored in the second input and output controller, instead of the second management controller, upon detecting failure is from the second management controller,

retrieve a backup of the software for executed by the second input and output controller from the second input and output controller, and

replace the software for executed by the second input and output controller with the backup of the software for executed by the second input and output controller.

2. The storage system according to claim 1 ,

wherein the first management controller and the second management controller are configured to perform the following processing independently from the input and output processing of the first input and output controller and the second input and output controller while the first input and output controller and the second input and output controller are in operation:

verifying, by the first management controller, the software for executed by the first management controller and the software for executed by the first input and output controller;

verifying, by the second management controller, the software for executed by the second management controller and the software for executed by the second input and output controller; and

verifying, by the first management controller in place of the second management controller, the software for executed by the second input and output controller when the failure is detected from the second management controller.

3. The storage system according to claim 1 ,

wherein the first management controller is configured to:

receive a heartbeat signal from the second management controller; and

determine that the failure occurs in the second management controller when the heartbeat signal from the second management controller is stopped for more than a predetermined period.

4. The storage system according to claim 1 ,

wherein the first input and output controller includes a first storage device storing initial phase software and a second storage device storing late phase software,

wherein the initial phase software includes an initial phase activation program and a late phase verification program,

wherein the first management controller is configured to verify the initial phase software, and

wherein the first input and output controller is configured to:

start the late phase verification program in accordance with the initial phase activation program after the initial phase software is verified; and

verify the late phase software in accordance with the late phase verification program.

5. The storage system according to claim 1 ,

wherein the first input and output controller holds initial phase software and late phase software,

wherein the initial phase software includes an initial phase activation program and a late phase verification program,

wherein the first management controller is configured to verify the initial phase software after verifying software to be executed by the first management controller,

wherein the first input and output controller is configured to start programs included in the initial phase software in accordance with the initial phase activation program in parallel to verifying the late phase software in accordance with the late phase verification program after the initial phase software is verified.

6. The storage system according to claim 5 ,

wherein the first input and output controller includes a first storage device storing the initial phase software and a second storage device storing the late phase software.

7. The storage system according to claim 1 ,

wherein the software to be executed by the first management controller includes a plurality of cores, and

wherein the first management controller is configured to recover a core from which tampering is detected with a backup core.

8. The storage system according to claim 1 ,

wherein the software to be verified and executed by the first management controller includes an operating system.

9. A method of managing a storage system including a first storage controller and a second storage controller, the first storage controller including a first communication interface, a first input and output controller configured to perform input and output processing on host data and a first management controller, the second storage controller including a second communication interface coupled to the first communication interface, a second input and output controller configured to perform input and output processing on host data and a second management controller, and the method comprising:

verifying, by the first management controller, an integrity of software for executed by the first management controller and an integrity of software for executed by the first input and output controller;

verifying, by the second management controller, an integrity of software for executed by the second management controller and an integrity of software for executed by the second input and output controller;

verifying, by the first management controller instead of the second management controller, the integrity of the software for executed by the second input and output controller, which is stored in the second input and output controller, upon detecting a failure from the second management controller;

retrieving, by the first management controller, a backup of the software for executed by the second input and output controller from the second input and output controller; and

replacing, by the first management controller, the software for executed by the second input and output controller with the backup of the software for executed by the second input and output controller.