IBM Storwize V7000 Unified Problem Determination Manual page 203

do so by the service procedures. Removing either of these components might
prevent the node canister from writing its cache and state data to the local drive.
When the ac power is restored to the control enclosure, the system restarts without
operator intervention. How quickly it restarts depends on whether there is a
history of previous power failures.
When the ac power is restored after a power outage that causes both canisters to
save their critical data, the system restarts only when the batteries have sufficient
charge to power both canisters for the duration of saving the critical data again. In
a fully redundant system with two batteries, this condition means that after one ac
power outage and a saving of critical data, the system can restart as soon as the
power is restored. If a second ac power outage occurs before the batteries have
completed charging, then the system starts in service state and does not permit
I/O operations to be restarted until the batteries are half charged. The recharging
takes approximately 30 minutes.
In a system with a failed battery, an ac power failure causes both canisters to save
critical data and completely discharges the remaining battery. When the ac power
is restored, the system starts in service state and does not permit I/O operations to
be restarted until the remaining battery is fully charged. The recharging takes
approximately 1 hour.
A battery is considered failed for the following conditions:
v When the system can communicate with it and it reports an error.
v When the system is unable to communicate with the battery. Failed
communication exists because the power supply, which contains the battery, has
been removed or because the power supply has failed in a manner that makes
communication with the battery impossible.
There are conditions other than loss of ac power that can cause critical data to be
saved and the nodes to go into service state and not permit I/O operations. The
node canister saves critical data if they detect there is no longer sufficient battery
charge to support a saving of critical data. This situation happens when, for
example, both batteries have two-thirds of a charge. The total charge that is
available in the enclosure is sufficient to support a saving of critical data once;
therefore, both canisters are in active state and I/O operations are permitted. If one
battery fails though, the remaining battery has only two-thirds of a charge, and the
total charge that is available in the enclosure is now insufficient to perform a
saving of the critical data if the ac power fails. Data protection cannot be
guaranteed in this case. The nodes save the critical data by using the ac power and
enter service state. The nodes do not handle I/O operations until the remaining
battery has sufficient charge to support the saving of the critical data. When the
battery has sufficient charge, the system automatically restarts.
Important: Although Storwize V7000 Unified is resilient to power failures and
brown outs, always install Storwize V7000 Unified in an environment where there
is reliable and consistent ac power that meets the Storwize V7000 Unified
requirements. Consider uninterruptible power supply units to avoid extended
interruptions to data access.
Chapter 5. Control enclosure
183