RACF won't start in SSI if database disk is unavailable

Running on a z/VM 6.3.0 system in an SSI cluster, the customer's primary RACF database disk became unusable.
Symptoms of the unusable database disk include:
- When attempting to LOGON to a valid userid, the logon failed with message
RPIMGR040T User profile for user ID userid is not defined.
and on the operator console message
ICH408I USER(userid ) GROUP( ) NAME(???)
LOGON/JOB INITIATION - USER AT TERMINAL tid NOT RACF-DEFINED
- When attempting to LISTUSER a valid userid the LISTUSER failed
with message
ICH30001I UNABLE TO LOCATE USER ENTRY userid
Because no userid currently logged onto the system had any RACF authority, because every userid defined to the system was defined to RACF (including RACFVM, RACMAINT, MAINT, MAINT630, etc) and because the operator userid was not logged on, the customer IPL'd z/VM to attempt to recover. After IPL'ing z/VM, RACFVM would not startup. Messages
ICH503I RACF DATA SET NOT FOUND
ICH502A SPECIFY NAME FOR RACF DATA SET SEQUENCE nnn OR NONE
were issued to the operator console, but the operator reply was not accepted because the RACFVM machine was sittng in a VM READ after message
RPIVPHSD004E Error getting information for virtual device 200
The RPIVPHSD004E message is issued by code added to support RACF in an SSI environment. Basically, the code design is that in an SSI cluster both the primary and backup RACF database disks must be available for RACF to start.

VM65972