IBM Storwize V7000 Unified Problem Determination Manual page 221

There are two power supply units in the control enclosure. Each one contains an
integrated battery. Both power supply units and batteries provide power to both
control canisters. Each battery has a sufficient charge to power both node canisters
for the duration of saving critical data to the local drive. In a fully redundant
system with two batteries and two canisters, there is enough charge in the batteries
to support saving critical data from both canisters to a local drive twice. In a
system with a failed battery, there is enough charge in the remaining battery to
support saving critical data from both canisters to a local drive once.
If the ac power to a control enclosure is lost, the canisters do not start saving
critical data to a local drive until approximately 10 seconds after the loss of ac
power is first detected. If the power is restored within this period, the system
continues to operate. This loss in power is called a brown out. As soon as the
saving of the critical data starts, the system stops handling I/O requests from the
host applications, and Metro Mirror and Global Mirror relationships go offline. The
system powers off when the saving of the critical data completes.
If both node canisters shut down without writing the cache and state data to the
local drive, the system is unable to restart without an extended service action. The
system configuration must be restored. If any cache write data is lost, volumes
must be restored from a backup. It is, therefore, important not to remove the
canisters or the power supply units from the control enclosures unless directed to
do so by the service procedures. Removing either of these components might
prevent the node canister from writing its cache and state data to the local drive.
When the ac power is restored to the control enclosure, the system restarts without
operator intervention. How quickly it restarts depends on whether there is a
history of previous power failures.
When the ac power is restored after a power outage that causes both canisters to
save their critical data, the system restarts only when the batteries have sufficient
charge to power both canisters for the duration of saving the critical data again. In
a fully redundant system with two batteries, this condition means that after one ac
power outage and a saving of critical data, the system can restart as soon as the
power is restored. If a second ac power outage occurs before the batteries have
completed charging, then the system starts in service state and does not permit
I/O operations to be restarted until the batteries are half charged. The recharging
takes approximately 30 minutes.
In a system with a failed battery, an ac power failure causes both canisters to save
critical data and completely discharges the remaining battery. When the ac power
is restored, the system starts in service state and does not permit I/O operations to
be restarted until the remaining battery is fully charged. The recharging takes
approximately 1 hour.
A battery is considered failed for the following conditions:
v When the system can communicate with it and it reports an error.
v When the system is unable to communicate with the battery. Failed
communication exists because the power supply, which contains the battery, has
been removed or because the power supply has failed in a manner that makes
communication with the battery impossible.
There are conditions other than loss of ac power that can cause critical data to be
saved and the nodes to go into service state and not permit I/O operations. The
node canister saves critical data if they detect there is no longer sufficient battery
Chapter 5. Control enclosure
197