JP6913797B2 - Information processing device - Google Patents

Description

Embodiments of the present invention relate to an information processing device.

As an external storage device used in a computer system, an SSD (Solid State Drive) equipped with a non-volatile semiconductor memory such as a NAND flash memory is attracting attention. Flash memory has advantages such as high speed and light weight as compared with a magnetic disk device. In the SSD, there are a plurality of flash memory chips, a controller that controls read / write of each flash memory chip in response to a request from the host device, and a buffer for data transfer between each flash memory chip and the host device. It has a memory, a power supply circuit, and a connection interface to the host device.

JP-A-2009-217603 Japanese Unexamined Patent Publication No. 2008-090539 Japanese Unexamined Patent Publication No. 2002-351621 Japanese Unexamined Patent Publication No. 2006-18848 Japanese Unexamined Patent Publication No. 07-78102 Japanese Unexamined Patent Publication No. 2004-151785 Japanese Unexamined Patent Publication No. 2005-190075 Japanese Unexamined Patent Publication No. 2008-90539 Japanese Unexamined Patent Publication No. 2001-75813 Patent No. 4489127 Patent No. 4635092

ATA / ATAPI Command Set --2 (ACS-2) d2015r6 Feb.22.2011 http://www.t13.org/Documents/UploadedDocuments/docs2011/d2015r6-ATAATAPI_Command_Set_-_2_ACS-2.pdf ・ Pages 73-74, Pages 290 to 306: SELF-MONITORING, ANALYSIS, AND REPORTING TECHNOLOGY (SMART) ・ Pages 98 to 99, 50: Data Set Management Command ・ Pages 342 to 365: SCT Command Transport CrystalDiskInfo manual (software for monitoring the health status of non-volatile storage devices using SMART information) http://crystalmark.info/software/CrystalDiskInfo/manual-ja/http://crystalmark.info/software/CrystalDiskInfo/manual-en/ Smartmontools (non-volatile storage device health monitoring software based on SMART information) http://sourceforge.net/apps/trac/smartmontools/wiki Samsung SSD Magician USER GUIDE http://www.samsungssd.com/faq Intel Solid State Drive Toolbox http://downloadcenter.intel.com/Detail_Desc.aspx?lang=jpn&DwnldID=18455 http://downloadcenter.intel.com/Detail_Desc.aspx?lang=eng & DwnldId = 18455 S.M.A.R.T. attributes meaning http://www.ariolic.com/activesmart/smart-attributes/ S.M.A.R.T. attributes meaning http://www.siguardian.com/products/siguardian/on_line_help/s_m_a_r_t_attribute_meaning.html Self-Monitoring, Analysis and Reporting Technology :: Attributes http://smartlinux.sourceforge.net/smart/attributes.php Serial ATA International Organization: Serial ATA Revision 3.1RC Clean DRAFT 2010.09.29 pp. 554-558 13.9 Phy Event Counters (Optional)

One embodiment of the present invention constructs a system so as not to perform a writing operation on the non-volatile storage device when the non-volatile storage device approaches the end of its life, and prevents further deterioration of reliability of the non-volatile storage device. An object of the present invention is to provide an information processing device that prevents data destruction in a non-volatile storage device.

In order to achieve the above object, the information processing apparatus according to the embodiment includes a non-volatile semiconductor memory, a volatile semiconductor memory, a controller circuit for controlling the non-volatile semiconductor memory and the volatile semiconductor memory, and an interface. It includes a semiconductor storage device including a circuit, and a host device that can be connected to the semiconductor storage device and is configured to transmit write and read commands to the semiconductor storage device. The non-volatile semiconductor memory includes a memory cell for storing data, and the data recorded in the memory cell can be electrically erased by using the plurality of the memory cells as a first unit. At least one of the non-volatile semiconductor memory and the volatile semiconductor memory is the first information that specifies the physical address of the non-volatile semiconductor memory corresponding to the logical address information received from the host device via the interface circuit. Is configured to be recordable. When the controller circuit receives a write instruction from the host device via the interface circuit, the controller circuit generates a correction code using the data received from the host device, and the data and the data are stored in the non-volatile semiconductor memory. When the correction code is recorded and the read command is received from the host device via the interface circuit, the data read from the non-volatile semiconductor memory using the first information and the corresponding correction code are used. Therefore, the read data can be corrected. The non-volatile semiconductor memory is configured to store second information, third information, fourth information, fifth information, and sixth information. The second information is based on the total usage time of the semiconductor storage device. The third information is based on the total amount of write data received in response to the write instruction received from the host device. The fourth information is based on the total amount of data read from the non-volatile semiconductor memory in response to a read instruction received from the host device. The fifth information relates to the number of data that the controller circuit could not correct the data read from the non-volatile semiconductor memory by using the corresponding correction code. The sixth information is information indicating, in the first unit, information according to the number of memory cells determined that data cannot be written in the non-volatile semiconductor memory. The non-volatile semiconductor memory stores a first operating system and a second operating system that prohibits transmission of write commands to the semiconductor storage device. The host device is configured to read and execute the first operating system from the semiconductor storage device. The host device acquires a plurality of information including the second information to the sixth information from the semiconductor storage device, and calculates the remaining life of the semiconductor storage device based on at least one of the acquired plurality of information. Then, the calculated remaining life can be displayed on the display device connected to the host device. The host device acquires a threshold value corresponding to each of the plurality of information from the semiconductor storage device, calculates the remaining life based on the threshold value corresponding to at least one of the acquired plurality of information, and performs the calculation. When it is determined that the semiconductor storage device has reached the end of its life based on the remaining life, the user is notified that the second operating system will be started the next time the information processing device is started. It is configured to read the second operating system from the semiconductor storage device and start the second operating system.

FIG. 1 is a block diagram showing a functional configuration example of the computer system of the first embodiment. FIG. 2 is a block diagram showing a functional configuration example of a computer system when the control tool is stored in the SSD. FIG. 3 is a block diagram showing an example of a functional configuration of a computer system when the control tool is stored in another external storage device. FIG. 4 is a block diagram showing a functional configuration example of a computer system when the control tool is installed from the WEB. FIG. 5 is a block diagram showing a functional configuration example of a computer system when the control tool is installed from an optical drive. FIG. 6 is a block diagram showing a functional configuration example of a computer system when the control tool is installed from a USB memory. FIG. 7 is a block diagram showing a functional configuration example of a computer system when the normal OS and the emergency OS are stored in the SSD. FIG. 8 is a block diagram showing a functional configuration example of a computer system when the normal OS and the emergency OS are stored in a non-volatile storage device other than the SSD whose reliability has deteriorated. FIG. 9 is a block diagram showing a functional configuration example of a computer system when the emergency OS is installed from a storage medium on the WEB. FIG. 10 is a block diagram showing a functional configuration example of a computer system when the emergency OS is installed from an optical drive. FIG. 11 is a block diagram showing a functional configuration example of a computer system when the emergency OS is installed from a USB memory. FIG. 12 is a block diagram showing a hierarchical function configuration example of the host. FIG. 13 is a diagram showing an external configuration of a computer system. FIG. 14 is a diagram showing another appearance configuration of a computer system. FIG. 15 is a block diagram showing an example of the internal configuration of the NAND memory chip. FIG. 16 is a circuit diagram showing a configuration example of one plane included in the NAND memory chip. FIG. 17 is a diagram showing a threshold value distribution in the quaternary data storage method. FIG. 18 is a functional block diagram showing an example of the internal configuration of the SSD. FIG. 19 is a diagram showing SSD management information. FIG. 20 is a diagram showing the relationship between the LBA and the SSD management unit. FIG. 21 is a flowchart showing a procedure for identifying a physical address from an LBA. FIG. 22 is a flowchart showing an example of SSD reading operation. FIG. 23 is a flowchart showing an example of SSD reading operation. FIG. 24 is a flowchart showing an example of SSD writing operation. FIG. 25 is a flowchart showing an example of SSD writing operation. FIG. 26 is a flowchart showing an operation example of organizing the NAND memory of the SSD. FIG. 27 is a flowchart showing an operation example of the SSD when the deletion notification is received. FIG. 28 is a flowchart showing an operation example when an SSD error occurs. FIG. 29 is a flowchart showing the operation procedure of the control tool. FIG. 30 is a diagram showing an example of a management table of statistical information X01 to X19, X23, and X24. FIG. 31 is a graph showing the relationship between the raw value of statistical information and the defective rate of SSD. FIG. 32 is a flowchart showing another operation procedure of the control tool. FIG. 33 is a flowchart showing another operation procedure of the control tool. FIG. 34 is a flowchart showing the processing at the end of the life of the control tool. FIG. 35 is a flowchart showing another process at the end of the life of the control tool. FIG. 36 is a flowchart showing another process at the end of the life of the control tool. FIG. 37 is a flowchart showing an operation procedure at the time of starting the computer system. FIG. 38 is a diagram showing a host configuration when the emergency OS is equipped with a backup function. FIG. 39 is a flowchart showing an operation procedure including a backup operation at the time of starting the computer system. FIG. 40 is a diagram showing the stored contents of the NAND memory and the stored contents of the file management table. FIG. 41 is a diagram showing a functional configuration example of a computer system when a USB storage is used as a backup storage device. FIG. 42 is a diagram showing an example of a functional configuration of a computer system when an optical storage medium is used as a backup storage device. FIG. 43 is a diagram showing a functional configuration example of a computer system when a storage server is used as a backup storage device. FIG. 44 is a diagram showing the concept of data movement when creating an emergency boot disk. FIG. 45 is a flowchart showing an operation procedure when creating an emergency boot disk. FIG. 46 is a diagram showing the concept of data movement when creating an emergency boot disk including an emergency tool. FIG. 47 is a flowchart showing an operation procedure when creating an emergency boot disk including an emergency tool. FIG. 48 is a diagram showing an example of a screen for guiding the backup process to the user. FIG. 49 is a flowchart showing another operation procedure of the control tool. FIG. 50 is a flowchart showing another operation procedure at the time of starting the computer system. FIG. 51 is a diagram showing an example of time-series data of statistical information. FIG. 52 is a diagram showing changes over time in statistical information. FIG. 53 is a diagram conceptually showing a process of obtaining a predicted life based on a change over time of statistical information. FIG. 54 is a diagram showing an example of a guidance screen to the user when the SSD has reached the end of its useful life. FIG. 55 is a block diagram showing an example of a functional configuration of a computer system when the boot loader is restored. FIG. 56 is a flowchart showing an operation procedure of the boot loader restoration process at the time of reaching the end of its life. FIG. 57 is a diagram showing a rewrite difference log of the boot loader. FIG. 58 is a flowchart showing a backup operation procedure by the emergency OS. FIG. 59 is a block diagram showing an example of a functional configuration of a computer system when the boot loader is restored. FIG. 60 is a flowchart showing an operation procedure of the boot loader restoration process by the emergency OS. FIG. 61 is a flowchart showing the overall operation procedure of the eighth embodiment.

Non-volatile semiconductor memory, such as NAND flash memory, erases data once in block units and then writes data, and writes / reads data in page units. / Some have fixed write / read units. On the other hand, a unit in which a host device such as a personal computer writes / reads data to a secondary storage device such as a hard disk is called a sector. The sector is defined independently of the unit of erasing / writing / reading of the semiconductor storage device. For example, the unit of erasing / writing / reading of the non-volatile semiconductor memory may be larger than the unit of writing / reading of the host device.

Further, when a secondary storage device of a personal computer is configured by using flash memory, a block (bad block, bad block) that cannot be used as a storage area due to many errors or the like, or an area that cannot be read (bad area). Etc. may occur. When the number of such bad blocks or bad areas exceeds the upper limit, new bad blocks or bad areas cannot be registered, so the data stored in the buffer memory (cache memory) and the write request It cannot be guaranteed that both of the existing data will be written to the flash memory. Therefore, when the number of defective blocks or the number of defective areas exceeds a predetermined value, there is a problem that data cannot be written suddenly even though there is free space in the flash memory.

As a solution to this, the number of bad clusters and the number of bad blocks generated in the NAND flash memory are managed, and data is written from the host device to the NAND flash memory according to the number of bad clusters and the number of bad blocks. There is a method of switching the operation mode at the time. A cluster is a management unit as a logical address in SSD. The cluster size is a natural number multiple of 2 or more of the sector size, and the cluster address is composed of a bit string higher than a predetermined bit of the LBA.

In this method, the operation mode of SSD is divided into the following three modes, for example.

-WB mode (Write Back Mode): A normal operation mode in which data is once written to the cache memory and then ejected to the NAND flash memory based on predetermined conditions.

-WT mode: (Write Through Mode): An operation mode in which the data written in the cache memory with one write request is written to the NAND flash memory each time. By writing to the NAND flash memory each time, the data written from the host is guaranteed as much as possible. The SSD transitions to the WT mode when the number of remaining entries in the bad cluster table or the bad block table becomes a predetermined number or less.

-RO mode (Read Only Mode): A mode that prohibits all processing involving writing to the NAND flash memory. By returning an error to all write requests from the host and not writing, the data already written from the host can be guaranteed as much as possible when the SSD reaches the end of its life. The SSD transitions to the RO mode when the number of remaining entries in the bad cluster table or the bad block table becomes a predetermined number or less, or when the free block becomes insufficient.

In the WB mode and the WT mode, the SSD receives and processes both a read request and a write request from the host. On the other hand, in the RO mode, the SSD receives a read request from the host and processes it, but does not process the write request from the host and returns an error.

When an SSD is connected to a host with an operating system (OS) such as Windows®, the host sends a write request to the SSD, and when the write request is processed successfully, the host Recognize SSD as an available external storage device.

On the other hand, when the SSD that has transitioned to the RO mode is connected to a host equipped with Windows (registered trademark), if the host sends a write request to the SSD, the SSD returns an error to the host, so the host sends the SSD. It may not be recognized as an available external storage device. Therefore, even if a readable RO mode SSD is connected to the host, there is a possibility that the previously recorded data cannot be read from the SSD.

In this way, when the SSD has reached the end of its life, or when the SSD is nearing the end of its life, writing to the SSD should be prohibited. However, in a normal operating system (OS) installed in a computer system, writing to the SSD occurs at boot time, and writing to the SSD unintended by the user occurs in the background. Therefore, when the SSD has reached the end of its life, or when the SSD is nearing the end of its life, the reliability of the SSD is further deteriorated under the condition that a normal OS is installed in the computer system, and the data already written. May be destroyed.

Therefore, in the present embodiment, when it is determined that the SSD has reached the end of its life, when the boot loader is rewritten and the system is restarted, for example, an emergency OS as emergency software that does not write to SSD2 is started. By doing so, the reliability deterioration of the SSD is prevented, and the data already written is prevented from being destroyed. As the emergency OS, an OS that only reads the SSD at boot time and does not write to the SSD in the background unintended by the user is adopted.

The information processing apparatus according to the embodiment will be described in detail with reference to the accompanying drawings. The present invention is not limited to these embodiments.

(First Embodiment)
FIG. 1 shows the configuration of the first embodiment of the computer system. The computer system 1 includes an SSD 2 as a non-volatile storage device, a host device 3, and a memory interface 19 connecting the SSD 2 and the host device 3. In this embodiment, SSD (Solid State Drive) is used as the non-volatile storage device, but for example, a hard disk drive, a hybrid disk drive, an SD card, a USB memory, a NAND flash memory mounted directly on the motherboard, and the like. It may be a non-volatile storage device of. Further, in the present embodiment, the ATA (Advanced Technology Attachment) interface is used as the interface 19, but other interfaces such as USB (Universal Serial Bus), SAS (Serial Attached SCSI), Thunderbolt (registered trademark), and PCI Express are used. You may. The CPU (control circuit) 4 is a central processing unit in the host device 3, and various calculations and controls in the host device 3 are performed by the CPU 4. The CPU 4 controls an optical drive 10 such as an SSD 2 or a DVD-ROM via a south bridge 7. The CPU 4 controls the main memory 6 via the north bridge 5. As the main memory 6, for example, a DRAM may be adopted.

The user controls the host device 3 through an input device such as the keyboard 14 and the mouse 15, and the signal from the keyboard 14 and the mouse 15 is processed by the CPU 4 via the USB (Universal Serial Bus) controller 13 and the south bridge 7. NS. The CPU 4 sends image data, text data, and the like to the display (display device) 9 via the north bridge 5 and the display controller 8. The user can visually recognize the image data, the text data, and the like from the host device 3 through the display 9.

The CPU 4 is a processor provided to control the operation of the computer system 1 and executes an operating system (OS) 100 loaded from the SSD 2 into the main memory 6. Further, when the optical drive 10 enables the loaded optical disc to execute at least one of the read process and the write process, the CPU 4 executes those processes. The CPU 4 also executes the system BIOS stored in the BIOS (Basic Input / Output System) -ROM 11. The system BIOS is a program for controlling hardware in the computer system 1. In addition, the CPU 4 controls the LAN (Local Area Network) controller 12 via the south bridge 7.

The north bridge 5 is a bridge device that connects to the local bus of the CPU 4. The north bridge 5 also has a built-in memory controller that controls access to the main memory 6. The north bridge 5 also has a function of executing communication with the display controller 8.

The main memory 6 temporarily stores programs and data, and functions as a working memory of the CPU 4. The main memory 6 includes a storage area 6A for storing the OS 100 and a storage area 6B for storing the control tool 200. As is generally known, the OS manages the input / output device of the host device 3, manages the disk and memory, and controls the software to make the hardware of the host device 3 available. , A program that manages the entire host device 3.

The display controller 8 is a video playback controller that controls the display 9 of the computer system 1. The south bridge 7 is a bridge device that connects to the local bus of the CPU 4. The south bridge 7 controls SSD2, which is a storage device for storing various software and data, via the ATA interface 19.

In the computer system 1, the SSD 2 is accessed in units of logical sectors. A write command (write request), a read command (read request), a flash command, and the like are input to the SSD 2 via the ATA interface 19.

The south bridge 7 also has a function for accessing and controlling the BIOS-ROM 11, the optical drive 10, the LAN controller 12, and the USB controller 13. A keyboard 14 and a mouse 15 are connected to the USB controller 13.

For example, as shown in FIG. 2, the control tool 200 is stored in the area 16B of the NAND flash memory (NAND memory) 16 of the SSD 2 when the host device 3 is turned off, but the control tool 200 is stored in the area 16B of the host 3. At startup or program startup, the NAND memory 16 is loaded from the area 16B into the area 6B on the main memory 6. On the other hand, when a plurality of non-volatile storage devices are connected to the host 3, the SSD control tool 200 is stored in the area 20B of the non-volatile storage device 20 different from the SSD 2 as shown in FIG. , The area 20B may be loaded into the area 6B on the main memory 6 when the host device 3 is started or the program is started. In particular, when the non-volatile storage device 20 is used as a system drive for storing the OS and the SSD2 is used as a data drive for storing user data such as documents, still image data, and moving image data, the system drive 20 is used. Is used as a drive that mainly stores the OS and application programs, and is used as a drive that stores user data in the data drive 2. From the viewpoint of clearly separating the roles of the drive 2 and the drive 20, as a system drive. It is desirable to store the control tool in the non-volatile storage device 20.

From the viewpoint of saving the user's labor for setting up the control tool 200, the computer system 1 is shipped with the control tool 200 stored in the SSD 2 or the non-volatile storage device 20, as shown in FIGS. 2 and 3, for example. , It is desirable to line up at the store and get it in the hands of the user. On the other hand, from the viewpoint of allowing the user to select whether or not to install the control tool and providing the user with the latest control tool, the control tool 200 can be downloaded from the WEB, or can be downloaded from a DVD-ROM or a DVD-ROM. It is desirable that the device can be stored in the SSD 2 or the non-volatile storage device 20 by installing from an external storage medium such as a USB memory.

FIG. 4 is an example of downloading from the WEB. The control tool 200 is stored in the area 22B of the storage medium 22 in the WEB server 21, and the control tool 200 is a NAND of the SSD 2 via a network such as the Internet, a local network, or a wireless LAN, for example, via a LAN controller 12. It is downloaded (or installed) to the area 16B on the memory 16. In the case of FIG. 3, the control tool 200 is downloaded or installed in the area 20B on the non-volatile storage device 20.

FIG. 5 is an example of installation from optical media such as a DVD-ROM or a CD-ROM. The control tool 200 is stored in an optical media 23 such as a DVD-ROM or a CD-ROM, and when the optical media 23 is set in the optical drive 10, the control tool 200 can use the SSD 2 NAND memory via the optical drive 10. It is installed in area 16B (or area 20B) on 16. FIG. 6 is an example of installation from a USB memory. The control tool 200 is stored in the area 24B of the USB memory 24, and when the USB memory 24 is connected to the USB controller 13, the control tool 200 can use the area 16B (the area 16B) on the NAND memory 16 of the SSD 2 via the USB controller 13. Or it is installed in area 20B). Of course, instead of the USB memory 24, another external memory such as an SD card may be used. From the viewpoint of ease of availability by the user, it is desirable that the optical media 23 and the USB memory 24 are packaged and sold together with the SSD 2 as an accessory at the time of shipment of the SSD 2. On the other hand, the optical media 23 and the USB memory 24 may be sold independently as software products, or may be attached as an appendix to a magazine or a book.

In the present embodiment, there are two types of OS 100, a normal OS (first operating system) 100A and an emergency OS (second operating system) 100B. Normally, OS100A is an operating system used when the reliability of SSD2 is not deteriorated. As described above, in the normal OS, writing to the SSD occurs at boot time, and writing to the SSD unintended by the user occurs in the background. As shown in FIG. 7, the normal OS 100A is stored in the area 16D of the NAND memory 16 when the host device 3 is turned off. The emergency OS100B is an operating system used when the reliability of SSD2 deteriorates, and does not write to SSD2 (write is not supported). That is, the emergency OS only reads the SSD at boot time and does not write to the SSD in the background unintended by the user. The emergency OS 100B may be able to write to a non-volatile storage device other than SSD 2 when the reliability is deteriorated. Further, the emergency OS 100B may allow the writing of the data to the SSD 2 as an exception when it is necessary to write some data such as the system information of the emergency OS to the SSD 2, but the data is the amount of data. Is desirable to be sufficiently small with respect to the capacity of the NAND memory 16. More preferably, in order to prevent the user from accidentally sending a write command and writing data to SSD2, the emergency OS100B prohibits the normal write command to SSD2 and causes SSD2. On the other hand, when it is necessary to write data exceptionally, write to SSD2 is permitted only by commands using special commands such as SCT Command Transport described in INCITS ACS-2 and other vendor-specific commands. It is desirable to do so.

As shown in FIG. 7, the emergency OS 100B is stored in the area 16E of the NAND memory 16 when the host device 3 is turned off. Since the emergency OS 100B is not used in the normal state of SSD2, from the viewpoint of preventing the destruction of the emergency OS data in the area 16E, the area 16E is set so that it cannot be rewritten from the host device 3 when the normal OS is used. It is desirable to be there. For example, during normal operation of OS100A, it is desirable that LBA is not assigned to area 16E in the management information of SSD2 described later. In this case, LBA is assigned to area 16E after emergency OS operation is required. Assigned. Alternatively, it is desirable that the area 16E is write-protected by the normal OS 100A during normal operation of the OS 100A.

From the viewpoint of reducing access to SSD2 as much as possible when the reliability of SSD2 is deteriorated, it is desirable that the amount of data in the area 16E in which the emergency OS100B is stored is significantly smaller than the capacity of the NAND memory 16. As the emergency OS100B, for example, an OS such as MS-DOS (trademark) or Linux may be customized to prohibit writing to SSD2, or a backup function of SSD2 may be added. , Software originally developed for SSD2 may be used.

When the computer system 1 is started, such as when the power of the computer system 1 is turned on or the OS is restarted, the host device 3 reads the boot loader 300 written in the area 16C of the NAND memory 16 and reads the boot loader 300. Based on the information of 300, it is determined whether the normal OS 100A or the emergency OS 100B is loaded into the area 6A in the host device 3. For that purpose, the boot loader 300 holds the OS pointer information OSPT indicating the LBA of the OS to be read. When the boot loader 300 is read, the host device 3 may read from the LBA indicated by the OS pointer information OSPT as a starting point, and write the read data to the area 6A on the main memory 6. In the initial state, the boot loader 300 is configured to load the OS 100A at normal times. After the reliability of SSD2 deteriorates, the control tool 200 stored in the area 6B on the main memory 6 rewrites the boot loader 300 stored in the area 16C on the NAND memory 16 and reads the boot loader so as to read the emergency OS 100B. Rebuild 300. As the boot loader 300, for example, a master boot record (MBR) may be adopted, or a GUID partition table (GPT) may be adopted.

When a plurality of non-volatile storage devices are connected to the host device 3, the OS may be stored in the non-volatile storage device 20 different from the SSD 2. For example, as shown in FIG. 8, both the normal OS and the emergency OS may be stored in the non-volatile storage device 20, the normal OS is stored in the SSD 2, and the emergency OS is the non-volatile storage device. It may be stored in the 20 or the normal OS may be stored in the non-volatile storage device 20 and the emergency OS may be stored in the SSD 2. In particular, when the non-volatile storage device 20 is used as a system drive for storing the OS and the SSD2 is used as a data drive for storing user data such as documents, still image data, and moving image data, the system drive 20 is used. Is used as a drive that mainly stores the OS and application programs, and is used as a drive that stores user data in the data drive 2. From the viewpoint of clearly separating the roles of the drive 2 and the drive 20, as a system drive. It is desirable that the non-volatile storage device 20 stores the normal OS, and more preferably, the non-volatile storage device 20 as a system drive also stores the emergency OS.

From the viewpoint of saving the user's labor for setting up the emergency OS, the computer system 1 is shipped with the emergency OS stored in the SSD 2 or the non-volatile storage device 20, as shown in FIGS. 7 and 8, for example. , It is desirable to line up at the store and get it in the hands of the user. On the other hand, from the viewpoint of allowing the user to select whether or not to install the emergency OS and providing the user with the latest emergency OS, the emergency OS can be downloaded from the WEB or DVD-. It is desirable to be able to store in the SSD 2 or the non-volatile storage device 20 by installing from an external storage medium such as a ROM or a USB memory.

FIG. 9 is an example of downloading from the WEB. The emergency OS is stored in the area 22E of the storage medium 22 in the WEB server 21, and the emergency OS is a NAND of SSD2 via a network such as the Internet, a local network, or a wireless LAN, for example, via a LAN controller 12. It is downloaded or installed in the area 16E on the memory 16. In the case of FIG. 8, it is downloaded or installed in the area 20E on the non-volatile storage device 20.

FIG. 10 is an example of installation from optical media such as a DVD-ROM or a CD-ROM. The emergency OS is stored in the area 23E of the optical media 23 such as a DVD-ROM or a CD-ROM, and when the optical media 23 is set in the optical drive 10, the emergency OS is SSD2 via the optical drive 10. It is installed in the area 16E (or area 20E) on the NAND memory 16. FIG. 11 is an example of installation from a USB memory. The emergency OS is stored in the area 24E of the USB memory 24, and when the USB memory 24 is connected to the USB controller 13, the emergency OS can be stored in the area 16E (area 16E) on the NAND memory 16 of the SSD 2 via the USB controller 13. Or it is installed in the area 20E). Of course, instead of the USB memory 24, another external memory such as an SD card may be used. From the viewpoint of ease of availability by the user, it is desirable that the optical media 23 and the USB memory 24 are packaged and sold together with the SSD 2 as an accessory at the time of shipment of the SSD 2. On the other hand, the optical media 23 and the USB memory 24 may be sold independently as software products, or may be attached as an appendix to a magazine or a book. From the viewpoint of ease of installation, it is desirable that the emergency OS and the control tool are stored in the same external memory such as the optical media 23 and the USB memory 24.

FIG. 12 shows a hierarchical structure of the computer system 1 at the software level. The control tool 200 and other software (software other than the control tool 200) loaded on the main memory 6 do not normally communicate directly with the SSD 2, but communicate with the SSD 2 via the OS 100 loaded on the main memory 6. .. When the control tool 200 or other software needs to send an instruction such as a read request or a write request to the SSD 2, the control tool 200 or other software sends a file-based access request to the OS 100. The OS 100 refers to the file management table included in the OS 100, identifies the logical address (LBA) of the SSD 2 corresponding to the file for which the access request has been made, and transmits the interface-specific instruction including the corresponding LBA to the SSD 2. When a response is returned from SSD2, the OS 100 identifies which software the converted interface-specific response is for, and returns a response to the specified software.

Next, a configuration example of the computer system 1 will be described. The computer system 1 can be realized as, for example, a desktop computer or a notebook-type portable computer. FIG. 13 is a schematic view of a desktop computer as a computer system 1. The desktop computer includes a computer main body 31, a display 9, a keyboard 14, a mouse 15, and the like. The computer main body 31 includes a motherboard 30, SSD 2, a power supply device 32, and the like on which major hardware is mounted. The SSD 2 is physically connected to the motherboard 30 via a SATA cable and electrically connected to the CPU 4 also mounted on the motherboard via a south bridge 7 mounted on the motherboard 30. The power supply device 32 generates various power supplies used in the desktop computer, and supplies power to the motherboard 30, SSD 2, and the like via a power cable.

FIG. 14 is a schematic view of a portable computer as a computer system 1. The portable computer is composed of a computer main body 34, a display unit 35, and the like. The display unit 35 incorporates, for example, a display device 9 composed of an LCD (Liquid Crystal Display). The display unit 35 is freely rotatably attached to the computer main body 34 between an open position where the upper surface of the main body 34 is exposed and a closed position which covers the upper surface of the main body 34. The main body 34 has a thin box-shaped housing, and a power switch 36, a keyboard 14, a touch pad 33, and the like are arranged on the upper surface thereof. Further, the main body 34 also includes an SSD2, a motherboard, a power supply device, and the like, like a desktop computer.

The information processing device to which the present invention is applied may be an image pickup device such as a still camera or a video camera, a tablet computer, a smartphone, a game device, a car navigation system, or the like, in addition to the computer system 1. May be good.

Next, the NAND memory 16 which is a main component of the SSD 2 will be described. FIG. 15 shows an example of the internal configuration of the NAND memory chip 80 that constitutes the NAND memory 16. The NAND memory 16 is composed of one or more NAND memory chips 80. The NAND memory chip 80 has a memory array in which a plurality of memory cells are arranged in a matrix. The memory cell transistor constituting the memory cell array is composed of a MOSFET (Metal Oxide Semiconductor Field Effect Transistor) having a laminated gate structure formed on a semiconductor substrate. The laminated gate structure includes a charge storage layer (floating gate electrode) formed on a semiconductor substrate with a gate insulating film interposed therebetween, and a control gate electrode formed on a floating gate electrode with an intergate insulating film interposed therebetween. I'm out. The memory cell transistor changes the threshold voltage according to the number of electrons stored in the floating gate electrode, and stores data according to the difference in the threshold voltage. In the present embodiment, a case where each memory cell is a writing method of a 2-bit / cell quaternary storage method using an upper page and a lower page will be described, but each memory cell uses a single page. When the writing method is a 1-bit / cell binary storage method, or the writing method is a 3-bit / cell 8-value storage method using the upper page, middle page, and lower page, or 4 bits / cell or more. The essence of the present invention does not change even when the writing method of the multi-value storage method is adopted. In addition, the memory cell transistor is not limited to a structure having a floating gate electrode, and the threshold voltage can be adjusted by trapping electrons at the nitrided interface as a charge storage layer such as MONOS (Metal-Oxide-Nitride-Oxide-Silicon) type. Structure may be used. Similarly, the MONOS type memory cell transistor may be configured to store one bit or may be configured to store multiple values. Further, the non-volatile storage medium may be a semiconductor storage medium in which memory cells are three-dimensionally arranged as described in JP-A-2010-161199 and JP-A-2011-29586.

As shown in FIG. 15, the NAND memory chip 80 includes a memory cell array 82 in which memory cells for storing data are arranged in a matrix. The memory cell array 82 includes a plurality of bit lines, a plurality of word lines, and a common source line, and memory cells in which data can be electrically rewritten are arranged in a matrix at the intersection of the bit lines and the word lines. A bit line control circuit 83 for controlling the bit line and a word line control circuit 85 for controlling the word line voltage are connected to the memory cell array 82. That is, the bit line control circuit 83 reads the data of the memory cell in the memory cell array 82 via the bit line, and applies a write control voltage to the memory cell in the memory cell array 82 via the bit line to the memory cell. Write.

A column decoder 84, a data input / output buffer 89, and a data input / output terminal 88 are connected to the bit line control circuit 83. The data of the memory cell read from the memory cell array 82 is output to the outside from the data input / output terminal 88 via the bit line control circuit 83 and the data input / output buffer 89. Further, the write data input to the data input / output terminal 88 from the outside is input to the bit line control circuit 83 by the column decoder 84 via the data input / output buffer 89, and is written to the designated memory cell. ..

Further, the memory cell array 82, the bit line control circuit 83, the column decoder 84, the data input / output buffer 89, and the word line control circuit 85 are connected to the control circuit 86. The control circuit 86 controls the memory cell array 82, the bit line control circuit 83, the column decoder 84, the data input / output buffer 89, and the word line control circuit 85 according to the control signal input to the control signal input terminal 87. Generates signal and control voltage. The circuit portion of the NAND memory chip 80 other than the memory cell array 82 is called a NAND controller (NANDC) 81.

FIG. 16 shows the configuration of the memory cell array 82 shown in FIG. The memory cell array 82 is a NAND cell type memory cell array, and is configured to include a plurality of NAND cells. One NAND cell is composed of a memory string MS composed of memory cells connected in series and selection gates S1 and S2 connected to both ends thereof. The selection gate S1 is connected to the bit line BL, and the selection gate S2 is connected to the source line SRC. The control gates of the memory cells MC arranged in the same row are commonly connected to the word lines WL0 to WLm-1. Further, the first selection gate S1 is commonly connected to the select line SGD, and the second selection gate S2 is commonly connected to the select line SGS.

The memory cell array 82 contains one or more planes, and the planes contain a plurality of blocks. Each block is composed of a plurality of NAND cells, and data is erased in this block unit.

Further, a plurality of memory cells connected to one word line constitute one physical sector. Data is written and read for each physical sector (this physical sector has nothing to do with the LBA logic sector described later). In the case of the 2-bit / cell writing method (4 values), for example, 2 pages of data are stored in one physical sector. On the other hand, in the case of the 1-bit / cell writing method (binary value), for example, one page of data is stored in one physical sector, and in the case of the 3-bit / cell writing method (8-value), for example, three pages of data are stored in one physical sector. Data is stored.

During the read operation, the program verification operation, and the program operation, one word line is selected and one physical sector is selected according to the physical address received from the SSDC 41 described later. Switching of pages in this physical sector is performed by the physical address. In the present embodiment, the NAND memory 16 is a 2-bit / cell writing method, and the SSDC 41 treats that two pages, an upper page and a lower page, are assigned to the physical sector as physical pages, and they are treated as such. Physical addresses are assigned to all pages.

The 2-bit / cell quaternary NAND memory is configured so that the threshold voltage in one memory cell can have four different distributions. FIG. 17 shows the 2-bit quaternary data (data “11”, “01”, “10”, “00”) stored in the memory cell of the quaternary NAND cell type flash memory and the threshold voltage distribution of the memory cell. Shows the relationship. Incidentally, in FIG. 17, V _A1, for the physical sector of the upper page unwritten in already written only lower page, a voltage applied to the selected word line when reading two data, V _A1V is to A1 Indicates the verify voltage applied to confirm whether or not the writing is completed when the writing is performed.

_{Also, V A2, V B2, V} C2 , the lower pages and the upper page for the physical sector of the already written, a voltage applied to the selected word line when reading four _{data, V A2V,} V _B2V, V _C2V indicates a verify voltage applied to confirm whether or not the writing is completed when writing to each threshold voltage distribution. Further, Vread1 and Vread2 indicate a read voltage that is applied to a non-selected memory cell in the NAND cell when reading data and makes the non-selected memory cell conductive regardless of the retained data. Further, Vev1 and Vev2 are erasure verification voltages applied to the memory cell to confirm whether or not the erasure is completed when erasing the data in the memory cell, and have negative values. Its size is determined in consideration of the influence of interference of adjacent memory cells. The magnitude relationship of each voltage mentioned above is
_{Vev1 <V A1 <V A1V <} Vread1
_{Vev2 <V A2 <V A2V <} V B2 <V B2V <V C2 <V C2V <Vread2
Is.

The erase verification voltages Vev1, Vev2, and Vev3 are negative values as described above, but the voltage actually applied to the control gate of the memory cell MC in the erase verify operation is not a negative value but zero or positive. The value. That is, in the actual erase verification operation, a positive voltage is applied to the back gate of the memory cell MC, and a voltage having a positive value smaller than zero or the back gate voltage is applied to the control gate of the memory cell MC. In other words, the erase verification voltages Vev1, Vev2, and Vev3 are voltages having equivalently negative values.

The upper limit of the threshold voltage distribution ER of the memory cell after erasing the block is also a negative value, and data “11” is assigned. The memory cells of the data "11", "01", "10", and "00" in the lower page and the upper page write state have positive threshold voltage distributions ER2, A2, B2, and C2, respectively (A2, B2, The lower limit of C2 is also a positive value), the threshold voltage distribution A2 of the data "01" has the lowest voltage value, the threshold voltage distribution C2 of the data "00" has the highest voltage value, and the voltages of various threshold voltage distributions. The values have a relationship of A2 <B2 <C2. The memory cell of the data “10” in the lower page written state and the upper page unwritten state has a positive threshold voltage distribution A1 (the lower limit value of A1 is also a positive value). The threshold voltage distribution shown in FIG. 17 is merely an example, and the present invention is not limited thereto. For example, in FIG. 17, the threshold voltage distributions A2, B2, and C2 are all described as having a positive threshold voltage distribution, but the threshold voltage distribution A2 is a negative voltage distribution, and the threshold voltage distributions B2 and C2 are positive voltages. The distribution of is also included in the scope of the present invention. Further, even if the threshold voltage distributions ER1 and ER2 are positive values, the present invention is not limited thereto. Further, in the present embodiment, the correspondence relationships of the data of ER2, A2, B2, and C2 are "11", "01", "10", and "00", respectively. For example, "11" and "01", respectively. , "00", "10", and other correspondences may be used.

The 2-bit data of one memory cell is composed of lower page data and upper page data, and the lower page data and upper page data are written to the memory cell by separate write operations, that is, two write operations. When the data is marked as "* @", * represents the upper page data and @ represents the lower page data.

First, the writing of the lower page data will be described with reference to the first and second stages of FIG. It is assumed that all the memory cells have the threshold voltage distribution ER in the erased state and store the data "11". As shown in FIG. 17, when the lower page data is written, the threshold voltage distribution ER of the memory cell has two threshold voltage distributions (“1” or “0”) according to the value of the lower page data (“1” or “0”). It is divided into ER1 and A1). When the value of the lower page data is "1", the threshold voltage distribution ER in the erased state is maintained, so that ER1 = ER, but ER1> ER may be used.

On the other hand, when the value of the lower page data is "0", a high electric field is applied to the tunnel oxide film of the memory cell, electrons are injected into the floating gate electrode, and the threshold voltage Vth of the memory cell is raised by a predetermined amount. Let me. Specifically, the verify potential _VA1V is set, and the writing operation is repeated until the _{verify voltage VA1V or higher becomes the threshold voltage.} As a result, the memory cell changes to the write state (data “10”). If the threshold voltage is not reached even after repeating the write operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is equal to or greater than a predetermined value), writing to the physical page results in a "write error".

Next, the writing of the upper page data will be described with reference to the second to third rows of FIG. The writing of the upper page data is performed based on the writing data (upper page data) input from the outside of the chip and the lower page data already written in the memory cell.

That is, as shown in the second to third stages of FIG. 17, when the value of the upper page data is "1", a high electric field is not applied to the tunnel oxide film of the memory cell, and the threshold voltage of the memory cell is prevented. Prevents the rise of Vth. As a result, the memory cell of the data "11" (threshold voltage distribution ER1 in the erased state) maintains the data "11" as it is (ER2), and the memory cell of the data "10" (threshold voltage distribution A1) is the data "11". 10 ”is maintained as it is (B2). However, in terms of ensuring the voltage margin between the distribution, by adjusting the lower limit of the threshold voltage distribution with a large positive verify voltage V _B2V than above verify voltage V _A1V, thereby the width of the threshold voltage distribution It is desirable to form a threshold voltage distribution B2 with a narrowed threshold. If the site voltage is not reached even after repeating the lower limit value adjustment a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to the predetermined value), writing to the physical page results in a "write error".

On the other hand, when the value of the upper page data is "0", a high electric field is applied to the tunnel oxide film of the memory cell, electrons are injected into the floating gate electrode, and the threshold voltage Vth of the memory cell is increased by a predetermined amount. Let me. Specifically, the verify potentials _VA2V and _VC2V are set, and the writing operation is repeated until the _{verify voltage VA1V or higher becomes the threshold voltage.} As a result, the memory cell of the data "11" (threshold voltage distribution ER1 in the erased state) changes to the data "01" of the threshold voltage distribution A2, and the memory cell of the data "10" (A1) has the threshold voltage distribution C2. The data changes to "00". At this time, the verify voltages V _A2V and _VC2V are used to adjust the lower limit values of the threshold voltage distributions A2 and C2. If the site voltage is not reached even after repeating the write operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to the predetermined value), writing to the physical page results in a "write error".

On the other hand, in the erasing operation, the erasing verification potential Vev is set, and the erasing operation is repeated until the threshold voltage becomes equal to or less than the verify voltage Vev. As a result, the memory cell changes to the write state (data “00”). If the site voltage is not reached even after repeating the erasing operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is equal to or greater than a predetermined value), erasing the physical page results in an "erasing error".

The above is an example of a data writing method in a general quaternary storage method. Even in the multi-bit storage method of 3 bits or more, the operation of dividing the threshold voltage distribution into 8 or more ways according to the higher page data is added to the above operation, so that the basic operation is the same.

Next, a configuration example of SSD2 will be described. As shown in FIG. 18, the SSD 2 is an interface controller (IFC) that transmits and receives signals between a NAND flash memory (hereinafter abbreviated as NAND memory) 16 as a non-volatile semiconductor memory and a host device 3 via an ATA interface 19. ) 42, RAM (Random Access Memory) 40 as a semiconductor memory having a cache memory (CM) 46 that functions as an intermediate buffer between the interface controller 42 and the NAND memory 16, and management, control, and management of the NAND memory 16 and RAM 40. It includes an SSD controller (SSDC) 41 that controls the interface controller 42, and a bus 43 that connects these components.

As the RAM 40, DRAM (Dynamic Random Access Memory), SRAM (Static Random Access Memory), FeRAM (Ferroelectric Random Access Memory), MRAM (Magnetoresistive Random Access Memory), PRAM (Phase Change Random Access Memory) and the like can be adopted. can. The RAM 40 may be included in the SSDC 41.

The NAND memory 16 is composed of a plurality of NAND memory chips 80, stores user data designated by the host device 3, stores a management table for managing user data, and backs up management information managed by the RAM 40. I remember it in. The NAND memory 16 has a memory cell array 82 in which a plurality of memory cells are arranged in a matrix, and each memory cell can store multiple values using upper and lower pages. The NAND memory 16 is composed of a plurality of memory chips, and each memory chip is configured by arranging a plurality of blocks which are units of data erasure. Further, in the NAND memory 16, data is written and read for each page. The block is composed of multiple pages.

The RAM 40 has a cache memory (CM) 46 that functions as a cache for data transfer between the host device 3 and the NAND memory 16. Further, the RAM 40 functions as a management information storage memory and a work area memory. The management table managed by the area 40A of the RAM 40 is a management table in which various management tables stored in the area 40M of the NAND memory 16 are expanded when SSD2 is started, and the area of the NAND memory 16 is periodically or when the power is turned off. It is saved and saved at 40M.

The functions of the SSDC 41 are realized by a processor that executes a system program (firmware) stored in the NAND memory 16 and various hardware circuits, and the write request, cache flash request, read request, etc. from the host device 3 are realized. Data transfer control between host device 3-NAND memory 16 for various commands, update / management of various management tables stored in RAM 40 and NAND memory 16, ECC coding of data written in NAND memory 16, and reading from NAND memory 16. Performs ECC decryption of data.

When issuing a read request or a write request to the SSD 2, the host device 3 inputs an LBA (Logical Block Addressing) as a logical address via the ATA interface 19. The LBA is a logical address in which a logical sector (size: for example, 512B) is numbered serially from 0. Further, when issuing a read request or a write request to the SSD 2, the host device 3 inputs the logical sector size to be the target of the read request or the write request together with the LBA.

The IFC 42 has a function of receiving read requests, write requests, other requests and data from the host device 3, transmitting the received requests and data to the SSDC 41, and transmitting data to the RAM 40 under the control of the SSDC 41.

FIG. 19 shows the structure of the management information used in SSD2. As described above, these management information are stored non-volatilely in the area 40M of the NAND memory 16. The management information stored in the area 40M is expanded and used in the area 40A of the RAM 40 when the SSD2 is started. The management information 44 of the area 40A is saved and stored in the area 40M periodically or when the power is turned off. When the RAM 40 is a non-volatile RAM such as MRAM or FeRAM, the management information 44 may be stored only in the RAM 40, and in this case, the management information 44 is not stored in the NAND memory 16. In order to reduce the amount of writing to the NAND memory 16, it is desirable that the data stored in the management information 45 is a compressed version of the data stored in the area 40A of the RAM 40. Further, in order to reduce the frequency of writing to the NAND memory 16, it is desirable to add the update information (difference information) of the management information 44 stored in the area 40A of the RAM 40 to the management information 45. ..

As shown in FIG. 19, the management information includes a free block table (FBT) 60, a bad block table (BBT) 61, an active block table (ABT) 62, and a track table (track-based theory conversion table) 63. Also includes a cluster table (a theory conversion table for each cluster) 64 and statistical information 65.

As shown in FIG. 20, the LBA is a logical address in which a logical sector (size: for example, 512B) is numbered serially from 0. In the present embodiment, as a management unit of the logical address (LBA) of SSD2, a cluster address composed of a bit string from the lower (s + 1) th bit of the LBA to the upper bit string and a bit string from the lower (s + t + 1) bit of the LBA to the upper bit string. Define the track address to be configured. That is, the logical sector is the minimum access unit from the host device 3. A cluster is a management unit that manages "small data" inside an SSD, and is defined so that the cluster size is a natural number multiple of the logical sector size. A track is a management unit that manages "large data" inside the SSD, and is defined so that the track size is two or more natural numbers of the cluster size. Therefore, the track address is the LBA divided by the track size, the in-track address is the remainder of the LBA divided by the track size, the cluster address is the LBA divided by the cluster size, and the in-cluster address is the LBA. Is the remainder of dividing by the cluster size. In the following description, for convenience, the track size is equal to the size of data that can be recorded in one physical block (if the physical block contains redundant bits for ECC processing performed by SSDC41, the size is excluded), and the size of the cluster The size is equal to the size of data that can be recorded on one physical page (if the physical page contains redundant bits for ECC processing performed by SSDC 41, the size is excluded).

The free block table (FBT) 60 manages the IDs of physical blocks (free blocks: FB) that are not assigned for use in the NAND memory that can be newly allocated for writing when writing to the NAND memory 16. Further, the number of erasures is managed for each physical block ID, and when the physical block is erased, the number of erasures of the block is incremented.

The bad block table (BBT) 61 manages the ID of the bad block (BB) as a physical block (physical block) that cannot be used as a storage area due to many errors. Similar to the FBT 60, the number of erasures may be managed for each physical block ID.

The active block table (ABT) 62 manages an active block (AB), which is a physical block to which a use is assigned. Further, the number of erasures is managed for each physical block ID, and when the physical block is erased, the number of erasures of the block is incremented.

The track table 63 manages the correspondence between the track address and the physical block ID in which the track data corresponding to the track address is stored.

The cluster table 64 manages the correspondence between the cluster address, the physical block ID in which the cluster data corresponding to this cluster address is stored, and the page address in the physical block in which the cluster data corresponding to this cluster address is stored. ..

Various parameters (X01 to X24) related to the reliability of SSD2 are stored in the statistical information 65.

The statistical information 65 includes a total number of bad blocks (statistical information X01), a total number of erases (statistical information X02), an average value of the number of erases (statistical information X03), a cumulative value of the number of write error occurrences of the NAND memory (statistical information X04), Cumulative number of erase error occurrences of NAND memory (statistical information X05), total number of read logical sectors (statistical information X06), total number of write logical sectors (statistical information X07), total number of ECC uncorrectable (statistical information X08), n bits ~ M-bit ECC correction unit total count (statistical information X09), SATA communication R error occurrence count (statistical information X10), SATA communication error occurrence count (statistical information X11), RAM 40 error occurrence count (statistical information X12), Total usage time of SSD2 (statistical information X13), cumulative time when the temperature exceeds the maximum recommended operating temperature (statistical information X14), cumulative time when the temperature falls below the minimum recommended operating temperature (statistical information X15), command Response time maximum value (statistical information X16), command response time average value (statistical information X17), NAND memory response time maximum value (statistical information X18), NAND response time average value (statistical information X19), current temperature (Statistical information X20), maximum temperature (statistical information X21), minimum temperature (statistical information X22), statistical information increase rate (statistical information X23), NAND rearrangement failure flag (statistical information X24), and the like are included.

The total number of bad blocks (statistical information X01) will be described. Every time one physical block of the NAND memory 16 in SSD2 is added to the bad block, the statistical information X01 is incremented by 1. It is desirable that the statistical information X01 is reset to zero at the time of manufacturing SSD2 (before the inspection process), and blocks that are found to have an error in the inspection process or a small inter-distribution margin of the threshold distribution are bad in advance. It is even more desirable to add it to the block. The statistical information X01 may be calculated directly from the BBT 61 without being stored in the statistical information 65. The larger the statistical information X01, the worse the reliability.

The total number of erasures (statistical information X02) will be described. The statistical information X02 shows the cumulative value of the number of erases of all the blocks of the NAND memory 16 in the SSD 2. The statistical information X02 is incremented by 1 each time one physical block of the NAND memory 16 in the SSD 2 is erased. It is desirable that the statistical information X02 is reset to zero at the time of manufacturing SSD2 (before the inspection process). Statistical information X02 may be calculated directly from FBT60, BBT61, and ABT62 without being stored in statistical information 65. The larger the statistical information X02, the worse the reliability.

The average value of the number of erasures (statistical information X03) will be described. Statistical information X03 indicates the average value per block of the number of times all blocks of the NAND memory 16 in SSD2 are erased. Some blocks, such as a block for storing management information, may be excluded from the aggregation target of the statistical information X03. It is desirable that the statistical information X03 is reset to zero at the time of manufacturing SSD2 (before the inspection process). Statistical information X03 may be calculated directly from FBT60, BBT61, and ABT62 without being stored in statistical information 65. The larger the statistical information X03, the worse the reliability.

The cumulative value of the number of write error occurrences of the NAND memory (statistical information X04) will be described. The statistical information X04 is incremented by 1 each time a write error occurs in the NAND memory 16 in the SSD 2 in 1 write unit (may be added in block units). It is desirable that the statistical information X04 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X04, the worse the reliability.

The cumulative value of the number of occurrences of erase errors in the NAND memory (statistical information X05) will be described. It is desirable that the statistical information X05 is reset to zero at the time of manufacturing SSD2 (before the inspection process). Statistical information X05 is added by 1 every time an erase error occurs in one block in the NAND memory 16 in SSD2. A plurality of blocks may be collectively used as an erasing unit, and 1 may be added to the statistical information X05 each time an erasing error occurs in one erasing unit. The larger the statistical information X05, the worse the reliability.

The total number of read logical sectors (statistical information X06) will be described. The statistical information X06 is the total number of logical sectors of the data transmitted by the IFC 42 to the host device 3 as read data. It is desirable that the statistical information X06 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X06, the worse the reliability.

The total number of write logical sectors (statistical information X07) will be described. The statistical information X07 is the total number of logical sectors of the data received from the host device 3 as the write data by the IFC 42. It is desirable that the statistical information X07 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X07, the worse the reliability.

The total number of times the ECC cannot be corrected (statistical information X08) will be described. If the error bit cannot be repaired by ECC correction, the statistical information X08 is incremented by 1 for each read unit. The estimated value of the number of error bits for which the error could not be corrected may be added, or the number of blocks for which the error could not be corrected may be added. It is desirable that the statistical information X08 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X08, the worse the reliability.

The n-bit to m-bit ECC correction unit total count (statistical information X09) will be described. n and m are natural numbers, and 0 ≦ n ≦ m ≦ the maximum number of correctable bits. When ECC correction is performed on an ECC correction unit (for example, a physical page), if all error bits are normally repaired and the number of repaired error bits is n or more and m or less, "1 ECC correction unit is used. "n-bit to m-bit ECC correction unit total count" is added by 1. When a maximum of 64 bits can be corrected per correction unit by ECC correction, for example, "1 bit to 8 bit ECC correction unit total count", "9 bit to 16 bit ECC correction unit total count", and "17 bit to 24 bit ECC correction". "Total unit count" "25 bit to 32 bit ECC correction unit total count" "33 bit to 40 bit ECC correction unit total count" "41 bit to 48 bit ECC correction unit total count" "49 bit to 56 bit ECC correction unit total count" Eight parameters of "number" and "57-bit to 64-bit ECC correction unit total count" are prepared, and if the ECC correction is performed normally, one of these eight parameters is set for each ECC correction of one ECC correction unit. 1 is incremented. It is desirable that the statistical information X09 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X09, the worse the reliability.

The number of R error occurrences (statistical information X10) of SATA communication will be described. The statistical information X10 is incremented by 1 each time an R error (Reception Error, R_ERR) in the SATA standard occurs. If there is any error such as a CRC error in the frame sent and received between the host and SSD, it is counted as an R error. As the statistical information X10, any of the SATA standard Phy Event Counters counters may be adopted. It is desirable that the statistical information X10 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger the statistical information X10, the worse the reliability.

The number of error occurrences of SATA communication (statistical information X11) will be described. Every time another abnormality in SATA communication (other than R error) occurs, it is incremented by 1. For example, although the ATA interface 19, IFC42, and SSDC41 are designed as the SATA Generation 3 standard, the communication standard actually negotiated with the SSD 2 and the host device 3 is a slower communication standard such as Generation 2. If there is, it is regarded as an error in SATA communication, and the statistical information X11 is incremented by 1. It is desirable that the statistical information X11 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger this value is, the worse the reliability is.

The number of error occurrences (statistical information X12) of the RAM 40 will be described. For example, when the RAM 40 is equipped with an ECC circuit or an error detection circuit, the statistical information X12 is incremented by 1 when the SSDC 41 receives a signal indicating that the ECC cannot be corrected or a signal indicating that an error has been detected from the RAM 40. It is desirable that the statistical information X12 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger this value is, the worse the reliability is.

The total usage time of SSD2 (statistical information X13) will be described. While the power of SSD2 is ON, the SSDC 41 increments the elapsed time by counting the clock or receiving time information from the internal clock circuit. Alternatively, the SSDC 41 may periodically receive the time information of the host device 3 from the host device 3 and increment the difference of the time information. It is desirable that the statistical information X13 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger this value is, the worse the reliability is.

The cumulative time (statistical information X14) exceeding the maximum value of the recommended operating temperature will be described. For example, when a thermometer is mounted in the SSD2 such as on the substrate of the SSD2, in the SSDC41, in the NAND memory 16, the SSDC41 periodically receives temperature information from the thermometer. When the received temperature exceeds the recommended operating temperature (for example, 100 ° C.), the SSDC 41 determines the number of hours of operation above the estimated operating temperature based on the time information acquired from the clock, internal clock, and host device 3. Increment. It is desirable that the statistical information X14 is reset to zero at the time of manufacturing SSD2 (before the inspection process). The larger this value is, the worse the reliability is.

The cumulative time (statistical information X15) below the minimum recommended operating temperature will be described. When the thermometer is mounted in the SSD 2, the SSDC 41 periodically receives temperature information from the thermometer. When the received temperature falls below the recommended operating temperature (for example, -40 ° C), the SSDC 41 has been operating at the estimated operating temperature or higher based on the time information acquired from the clock, the internal clock, and the host device 3. Is incremented. It is desirable that the SSD2 be reset to zero at the time of manufacture (before the inspection process). The larger this value is, the worse the reliability is.

The maximum value of the command response time (statistical information X16) will be described. The statistical information X16 is the maximum value of the time (or the number of clocks) required from receiving the command from the host device 3 to responding to the host device 3 (or completing the command execution). If a response time longer than X16 occurs, this response time is overwritten with X16. Statistical information X16 may be retained for each command. It is desirable that X16 is reset to zero at the time of manufacturing SSD2 (before the inspection process) or at the time of shipping SSD2.

The average value of the response time of the command (statistical information X17) will be described. The statistical information X17 is an average value of the time (or the number of clocks) required from receiving the command from the host device 3 to responding to the host device 3 (or completing the command execution). For example, it can be obtained by holding a fixed number of response time lists in the RAM 40 and calculating the average value of the response time lists. Statistical information X17 may be retained for each command. It is desirable that X17 is reset to zero at the time of manufacturing SSD2 (before the inspection process) or at the time of shipping SSD2.

The maximum response time value (statistical information X18) of the NAND memory will be described. The statistical information X18 is the maximum value of the time (or the number of clocks) required from when the SSDC 41 commands the NAND memory 16 to when a response is obtained (or when a command execution completion notification is received). If a response time longer than X18 occurs, this response time is overwritten with X18. Statistical information X18 may be retained for each command. It is desirable that X18 is reset to zero at the time of manufacturing SSD2 (before the inspection process) or at the time of shipping SSD2.

The average response time value (statistical information X19) of NAND will be described. The statistical information X19 is an average value of the time (or the number of clocks) required from when the SSDC 41 commands the NAND memory 16 to when a response is obtained (or when a command execution completion notification is received). For example, it can be obtained by holding a fixed number of response time lists in the RAM 40 and calculating the average value of the response time lists. Statistical information X19 may be retained for each command. It is desirable that X19 is reset to zero at the time of manufacturing SSD2 (before the inspection process) or at the time of shipping SSD2.

The current temperature (statistical information X20) will be described. When a thermometer is mounted in SSD2, SSDC 41 periodically receives temperature information from the thermometer. The SSDC 41 holds the temperature last received from the thermometer as the current temperature in the statistical information X20. If this value is extremely large (for example, 85 ° C. or higher), the reliability of SSD2 is adversely affected, and if this temperature is extremely low (for example, -10 ° C. or lower), the reliability of SSD2 is adversely affected. do.

The maximum temperature (statistical information X21) will be described. The SSDC 41 holds the maximum value of the current temperature X20 as the maximum temperature in the statistical information X21. If this value is extremely large (for example, 85 ° C. or higher), the reliability of SSD2 is adversely affected. When the SSDC 41 receives a current temperature higher than the X21 from the thermometer, the SSDC 41 rewrites the X21 to the current temperature. It is desirable that X21 is reset to a temperature sufficiently lower than the operating temperature of SSD2 (for example, −40 ° C.) at the time of manufacturing SSD2 (before the inspection process) or shipping SSD2.

The minimum temperature (statistical information X22) will be described. The SSDC 41 holds the minimum value of the current temperature X20 as the minimum temperature in the statistical information X22. If this value is extremely small (for example, −40 ° C. or lower), the reliability of SSD2 is adversely affected. When the SSDC 41 receives a current temperature smaller than the X22 from the thermometer, the SSDC 41 rewrites the X22 to the current temperature. It is desirable that the X22 is reset to a temperature sufficiently higher than the operating temperature of the SSD2 (for example, 120 ° C.) at the time of manufacturing the SSD2 (before the inspection process) or at the time of shipping the SSD2.

The rate of increase in statistical information (statistical information X23) will be described. The latest information of statistical information X01 to X19 (for example, a value before a certain time, a value when SSD2 is powered on, a value when SSD2 is powered down last time, etc.) is separately stored. Statistical information X23 is defined, for example, by any of the following.

Statistical information increase rate = (latest statistical information)-(old information)
Statistical information increase rate = ((Latest statistical information)-(Old information)) / (Elapsed time since the old information was acquired)
Statistical information increase rate = ((Latest statistical information)-(Old information)) / (Number of NAND accesses since the old information was acquired)
It is desirable that the SSD2 be reset to zero at the time of manufacture (before the inspection process). The larger this value is, the worse the reliability is.

The NAND rearrangement failure flag (statistical information X24) will be described. If the statistical information X24 is 1, it is not possible to secure a sufficient number of free blocks for operation even by NAND arrangement. It is desirable that the SSD2 be reset to zero at the time of manufacture (before the inspection process). The larger this value is, the worse the reliability is.

As the statistical information 65, all the above-mentioned parameters may be stored, or only a part or any one of them may be stored. It is desirable that the statistical information 65 holds the latest information in the area 40A on the RAM 40 and periodically backs up to the area 40M on the NAND memory 16. On the other hand, it may be stored in only one of the RAM 40 and the NAND memory 16, or the statistical information is transmitted to the host device 3 and stored in the host device 3 and the storage device connected to the host device 3. You may do so.

(LBA forward conversion)
Next, a procedure for specifying a physical address from the LBA in SSD 2 (LBA forward translation) will be described with reference to FIG. When the LBA is specified, the SSDC 41 calculates the track address, cluster address, and intra-cluster address from the LBA.

The SSDC 41 first searches the track table 63 and identifies the physical block ID corresponding to the calculated track address (steps S100 and S101). The SSDC 41 determines whether or not the specified physical block ID is valid (step S102), and if the physical block ID is not null but a valid value (step S102: Yes), the physical block ID is ABT62. Search for whether or not the entry is made in (step S103). When the physical block ID is entered in ABT62 (step S104: Yes), the NAND memory corresponding to the specified LBA is the position shifted by the address in the track from the start position of the physical block specified by this physical block ID. It becomes the physical position on 16 (step S105). In such a case, the cluster table 64 is not required to specify the physical position on the NAND memory 16 corresponding to the LBA, and such an LBA is referred to as a “track-managed LBA”. In step S104, if the physical block ID is not entered in ABT62 (step S104: No), the designated LBA does not have the corresponding physical address, and such a state is referred to as "unwritten state". Call (step S106).

In step S102, if the physical address corresponding to the specified track address is null and has an invalid value (step S102: No), the SSDC 41 calculates the cluster address from the LBA, searches the cluster table 64, and calculates the cluster address. The physical block ID corresponding to the cluster address and the page address in the corresponding physical block are acquired from the cluster table 64 (step S107). The position shifted by the address in the cluster from the start position of the physical page specified by the physical block ID and the page address in the physical block is the physical position on the NAND memory 16 corresponding to the specified LBA. In such a case, the physical position on the NAND memory 16 corresponding to the LBA cannot be specified only from the track table 63, and a reference to the cluster table 64 is required. It is called "cluster-managed LBA" (step S108).

(Read operation)
Next, the read operation in SSD 2 will be described with reference to FIGS. 22 and 23. The read operation described in this embodiment is for the 60h READ FPDMA QUEUED described in INCITS ACS-2, but other write commands such as 25h READ DMA EXT may be adopted, and the difference in the types of read commands is. It does not affect the essence of the invention. When the SSD 2 receives a read instruction from the host device 3 (step S110), the SSDC 41 adds the read instruction to the read instruction queue on the RAM 40 (step S111), and informs the host device 3 that the read instruction has been accepted. Reply.

On the other hand, when an instruction exists in the read instruction queue on the RAM 40, the SSDC 41 determines whether or not the read process can be executed (step S120), and the read process can be executed. When it is determined that the data has been determined, the physical position of the data is specified from the LBA received from the host device 3 according to the LBA forward lookup conversion procedure shown in FIG. 21 (step S121). The SSDC 41 reads data from the physical page at the specified position (step S123), performs ECC decoding using the ECC redundant bits of the read data (step S124), and transmits the decoded data to the host device 3 via the IFC 42. It is transmitted (step S125) and the statistical information 65 is updated. The data read from the NAND memory 16 may be once written to the RAM 40, the data written to the RAM 40 may be decoded and transmitted to the host device 3, or the decoded data may be once written to the RAM 40 and sent to the RAM 40. The written data may be transmitted to the host device 3.

In step S124, the SSDC 41 attempts to decode by ECC, but if it cannot be decoded, the physical block including the page that could not be decoded is deleted from the ABT 62 and registered in the BBT 61, and the ECC of the statistical information 65 cannot be corrected. The total number of ECC correction units (statistical information X08) is added. At that time, the data of the block is copied to the free block assigned from the FBT 60, the physical block ID of the free block is registered in ABT 62, and the physical blocks of the track table 63 and the cluster table 64 are copied from the copy source physical block ID to the copy destination. It is desirable to rewrite it to the physical block ID.

(Write operation)
Next, the writing operation in SSD 2 will be described with reference to FIGS. 24 and 25. The write operation described in this embodiment is the case of 61h WRITE FPDMA QUEUED described in INCITS ACS-2, but other write commands such as 35h WRITE DMA EXT may be adopted, and the difference in the types of write commands is. It does not affect the essence of the invention. When the SSD 2 receives a write instruction from the host device 3 (step S130), the SSDC 41 adds the write instruction to the read instruction queue on the RAM 40 (step S131), and informs the host device 3 that the write instruction has been accepted. Reply.

On the other hand, when an instruction exists in the write instruction queue on the RAM 40, the SSDC 41 determines whether or not the write process can be executed (step S140), and the write process can be executed. When it is determined that the data has become writable, the host device 3 is notified that the data can be written, the write data is received from the host device 3, the received data is ECC-encoded, and the encoded data is stored in the cache memory 46 of the RAM 40. The unencoded data may be stored in the cache memory 46 and encoded when written to the NAND memory 16.

Next, the SSDC 41 reads the FBT 60 (step S141) and acquires the physical block ID of the free block from the FBT 60. If the free block does not exist (step S142: No), the SSDC 41 organizes the NAND memory 16 (NAND arrangement) described later (step S143), and after this arrangement, reads the FBT 60 (step S144) and frees it from the FBT 60. Acquire the physical block ID of the block. The SSDC 41 performs an erasing operation on the free block that has acquired the physical block ID. When an erasure error occurs, the physical block ID is added to the BBT 61, deleted from the FBT 60, and restarted from S141 to reacquire the free block. Even if a physical block has an erase error once, it may be erased normally without an erase error if the erase operation is performed again. Therefore, from the viewpoint of preventing an unnecessary increase in the number of bad blocks. , FBT60 and ABT62 are provided with an item of the number of erase error occurrences for each block as statistical information X05 for each block, and when a block erase error occurs, this is incremented, and the number of erase error occurrences for each block is a predetermined value. In the above cases, it is desirable to register the block in BBT61. More preferably, in order to make only physical blocks in which erasure errors occur consecutively into bad blocks, the SSDC 41 has an item of "number of consecutive erasure errors per block" instead of the "number of erasure error occurrences per block". , When a block erase error occurs, it is incremented, and when erase is performed without error, it is reset to zero, and when the "number of continuous erase error for each block" exceeds the specified value. It is desirable to register the block in BBT61.

Next, in order to search whether or not the LBA specified by the write instruction is in the unwritten state, the SSDC 41 obtains valid data corresponding to the LBA according to the forward conversion conversion procedure shown in FIG. 21 above. It is determined whether or not the data has been stored in the NAND memory 16 (steps S145 and S146).

When the LBA is in the unwritten state (step S146: Yes), the SSDC 41 writes the received data stored in the cache memory 46 to the free block (step S147), and the written free block (new physical block). ID and the number of times of erasing the data are registered in the ABT 62, and the ID of the physical block to which the data has been written is deleted from the FBT 60 (step S151). At this time, the LBA of the received data is divided by a section (track section) for each track, and it is determined whether or not the track section is filled with data to determine whether to manage the track or cluster (track management). Step S152). That is, if the inside of the track section is filled with data, track management is performed, and if the inside of the track section is not filled with data, cluster management is performed. In the case of cluster management, the cluster table 64 is rewritten to associate the new physical block ID with the LBA (step S153), and the track table 63 is rewritten to associate the LBA with an invalid physical block ID (for example, null). In the case of track management, the track table is rewritten and the new physical block ID is associated with the LBA (step S154).

On the other hand, in step S146, when the LBA is not in the unwritten state, the SSDC 41 reads all the data in the corresponding physical block from the NAND memory 16 based on the physical block ID obtained by the forward translation and writes it to the RAM 40. (Step S148). Then, the data stored in the cache memory 46 and the data read from the NAND memory 16 and written in the RAM 40 are combined on the RAM 40 (step S149), and the combined data is written in the free block (step S150).

If a write error occurs in step S150, the physical block ID is added to the BBT 61, deleted from the FBT 60, and restarted from step S141 to reacquire the free block. Even if a physical block has a write error once, it may be possible to write normally without a write error when the write operation is performed again. Therefore, from the viewpoint of preventing an unnecessary increase in the number of bad blocks. , FBT60 and ABT62 are provided with an item of the number of write error occurrences for each block as statistical information X04 for each block, and when a block write error occurs, this is incremented, and the "number of write error occurrences for each block" is set. It is desirable to register the block in the BBT 61 when the value exceeds a predetermined value. More preferably, in order to make only physical blocks in which write errors occur consecutively into bad blocks, the SSDC 41 has an item of "number of continuous write errors per block" instead of the above-mentioned "number of write error occurrences per block". , When a block write error occurs, it is incremented, and when writing is performed without error, it is reset to zero, and when the "number of continuous write errors per block" exceeds the specified value. It is desirable to register the block in BBT61.

The SSDC 41 registers the ID of the written free block (new physical block) and the number of erasures thereof in the ABT 62, and deletes the ID of the written physical block from the FBT 60 (step S151). When the LBA is cluster-managed, the old physical block ID in the cluster table 64 is rewritten to the new physical block ID (steps S152 and S153). In the case of track management, the old physical block ID of the track table is rewritten to the new physical block ID (steps S152 and S154). Further, the SSDC 41 adds the old physical block ID and its erasure count to the FBT 60, and deletes the old physical block ID and its erasure count from the ABT 62 (step S155). The SSDC 41 reflects the contents of the above writing process in the statistical information 65.

(NAND arrangement)
Since the capacity of the total LBA of the SSD 2 is designed to be smaller than the total capacity of the NAND memory 16 of the SSD 2, the free blocks will not be exhausted as long as the writing operation continues to be written in track units. On the other hand, when a large number of writes in cluster units occur for unwritten LBA, a physical block having a capacity larger than that of the cluster is allocated to one write in cluster units, which is larger than the data capacity to be written. NAND memory 16 physical blocks will be required, which may deplete free blocks. When the free blocks are exhausted, new free blocks can be secured by rearranging the NAND memory 16 as shown below.

The NAND arrangement in SSD2 will be described with reference to FIG. Not all clusters stored in the physical block are valid clusters, and invalid clusters that do not correspond to valid clusters are not associated with LBA. A valid cluster is a cluster that stores the latest data, and an invalid cluster is a cluster in which data of the same LBA is written to another location and is no longer referenced. The physical block has free data for the invalid cluster, and the free block can be secured by collecting the data of the valid cluster and rewriting it into a different block by performing NAND organization.

First, the physical block IDi = 0 and the accumulated free area S = 0 (step S160). The SSDC 41 determines whether or not a physical block having this ID i = 0 has been entered in the track table 63 (step S161). If it is entered in the track table, i is incremented by 1 (step S162), and the same determination is made for the physical block having the ID of the next number (step S161). That is, when the physical block ID is included in the track table 63, the data of this physical block is track management and is not included in the NAND organization target.

When the physical block with ID = i is not track-managed (step S161: No), the SSDC 41 then refers to the cluster table 64 and acquires all the addresses of the effective clusters included in the physical block with ID = i (step S161: No). S163). Then, the SSDC 41 obtains the size v for the total capacity of the acquired effective cluster (step S164), and when v <physical block size (step S165), adds the ID of the current physical block to the NAND organization target block list. (Step S166). Further, the SSDC 41 adds the acquired cluster capacity v of the current physical block to the acquired cluster accumulated amount S to update the acquired cluster accumulated amount S (step S167).

If v <physical block size is not satisfied in step S165, or if the accumulated cluster amount S acquired in step S168 has not reached the physical block size, the SSDC 41 increments i by +1 (step S162) and IDs of the next number. The procedure of steps S161 to S167 is executed in the same manner as described above for the physical block having. Then, in step S168, the procedure of steps S161 to S167 is repeated until the accumulated acquired cluster amount S reaches the physical block size.

Then, in step S168, when the accumulated acquired cluster amount S reaches the physical block size, the SSDC 41 reads the data of all effective clusters for all the physical blocks on the NAND organization target block list from the NAND memory 16 and puts it in the RAM 40. Writing (step S169), further erasing processing is performed on all physical blocks on the NAND organization target block list (step S170), and all the physical blocks that have been erased are deleted from ABT 62 and added to FBT 60 (step). S171). At that time, the number of erasures is incremented. The target of the erasing operation performed in step S170 may be limited to the block to which data is written in step S172, and it is desirable to perform such an erasing operation from the viewpoint of suppressing the number of times the block is erased.

When an erasure error occurs, the physical block ID is added to the BBT 61 and deleted from the FBT 60. Even if a physical block has an erase error once, it may be erased normally without an erase error if the erase operation is performed again. Therefore, from the viewpoint of preventing an unnecessary increase in the number of bad blocks. , FBT60 and ABT62 are provided with an item of "number of erase error occurrences for each block" for each block, and when a block erase error occurs, this is incremented so that the number of erase error occurrences for each block becomes a predetermined value or more. In such a case, it is desirable to register the block in BBT61. More preferably, in order to make only physical blocks in which erasure errors occur consecutively into bad blocks, the SSDC 41 has an item of "number of consecutive erasure errors per block" instead of the "number of erasure error occurrences per block". , When a block erase error occurs, it is incremented, and when erase is performed without error, it is reset to zero, and when the "number of continuous erase error for each block" exceeds the specified value. It is desirable to register the block in BBT61.

Then, the SSDC 41 acquires a new free block from the FBT 60, writes the data written in the RAM 40 to the acquired free block (step S172), and determines the physical block ID of the free block in which the data is written and the number of times the block is erased. The block ID of the block to which the data is written is deleted from the FBT 60 in addition to the ABT 62 (step S173). Further, the SSDC 41 updates the cluster address, the physical block ID, and the page address in the physical block in the cluster table 64 so as to correspond to the current NAND arrangement (step S174). The SSDC 41 reflects the processing contents of the NAND arrangement in the statistical information 65.

If a write error occurs in step S172, the physical block ID is added to the BBT 61, deleted from the FBT 60, and the free block is reacquired. Even if a physical block has a write error once, it may be possible to write normally without a write error when the write operation is performed again. Therefore, from the viewpoint of preventing an unnecessary increase in the number of bad blocks. , FBT60 and ABT62 are provided with an item of "number of write error occurrences per block" in each block, and when a block write error occurs, this is incremented so that "number of write error occurrences per block" exceeds a predetermined value. When this happens, it is desirable to register the block in BBT61. More preferably, in order to make only physical blocks in which write errors occur consecutively into bad blocks, the SSDC 41 has an item of "number of continuous write errors per block" instead of the above-mentioned "number of write error occurrences per block". , When a block write error occurs, it is incremented, and when writing is performed without error, it is reset to zero, and when the "number of continuous write errors per block" exceeds the specified value. It is desirable to register the block in BBT61.

In the procedure of FIG. 26, NAND arrangement was performed with priority given to packing data in the free block, but in step S164, v was obtained by subtracting the capacity of the cluster acquired from the physical block size, and in step S165. It is determined whether or not v> 0, and if v> 0, the process proceeds to step S168, and if v> 0, the process proceeds to step S162. May be done.

Next, the deletion notification in SSD 2 will be described with reference to FIG. 27. The deletion notification is an instruction transmitted from the host device 3 to the external storage device when the data is deleted by the OS 100 on the host device 3. An example of the deletion notification is the Data Set Management Command (commonly known as the trim (TRIM) command) described in INCITS ATA / ATAPI Command Set-2 (ACS-2). This is done by notifying the external storage device of the logical address area (LBA area) in which the deleted data exists as an LBA Range Entry consisting of a set of LBA and the number of sectors when the data is deleted on the OS100. This is a method in which the area can be treated as a free area even on an external storage device. With the deletion notification, SSD2 can newly secure a free block. The function of the trim command may be realized not only by the Data Set Management Command but also by other commands such as the SCT Command Transport described in INCITS ACS-2 and other vendor-specific commands. When the OS 100 is an emergency OS, it is desirable that the emergency OS prohibits the issuance of the deletion notification from the viewpoint of reducing writing to the NAND memory. On the other hand, since the deletion notification process only rewrites the management information 45 of the NAND memory 16 at most, the deletion notification may be permitted even in the emergency OS.

When the SSD 2 receives the deletion notification from the host device 3 (step S180), the SSDC 41 performs LBA forward conversion of the LBA included in the deletion notification according to the procedure shown in FIG. 21 above. When the LBA included in the deletion notification is track management (step S181: Yes), the SSDC 41 adds the physical block ID to the FBT 60 and deletes it from the ABT 62 (step S184). On the other hand, when the LBA included in the deletion notification is cluster management (step S181: No), the SSDC 41 deletes all the clusters corresponding to the physical blocks from the cluster table 64 (step S182), and in the track table 63, the LBA An appropriate valid value (for example, FFFF) is entered in the physical block ID corresponding to the track corresponding to (step S183), the physical block ID is added to the FBT 60, and the physical block ID is deleted from the ABT 62 (step S184). In SSD2, a free block can be secured not only by NAND rearrangement but also by deletion notification processing.

By such NAND arrangement, it is usual that a sufficient number of free blocks can be secured for writing. If a sufficient number of free blocks cannot be secured for writing even by NAND rearranging, the NAND rearrangement failure flag of the statistical information 65 is set to 1, and the SSD 2 sets the free blocks by the acquisition of the statistical information 65 by the host device 3. It is desirable to be able to notify the host device 3 that it could not be secured. From the viewpoint of giving a grace period from the time when the NAND rearrangement failure flag becomes 1 until SSD2 actually stops working,
(Number of free blocks secured by NAND arrangement) <(Number of free blocks required for writing) + (Margin)
It is desirable to set the NAND rearrangement failure flag to 1 when the condition of is satisfied.

The above NAND arrangement is not only when a write request is received from the host device 3, but also when a predetermined time has elapsed since the last command was received from the host, or when the host device 3 shifts to a standby, idle, or sleep state. May be executed when SSD2 receives an instruction to start NAND organization through SCT Command Transport or other vendor command described in ACS-2, etc. May be good. When the OS 100 is an emergency OS, from the viewpoint of reducing writing to the NAND memory, when a predetermined time has elapsed since the last command was received from the host device 3, the host device 3 is in a standby, idle, or sleep state. It is desirable not to perform the above NAND rearrangement when the command to shift to is received. Furthermore, when the OS 100 is an emergency OS, it is desirable that the emergency OS prohibits the issuance of an instruction to start NAND arrangement from the viewpoint of reducing writing to the NAND memory 16.

(Error handling)
Next, error processing related to the NAND memory 16 in the SSD 2 will be described with reference to FIG. 28. Various processes such as the process for the write request from the host device 3 and the NAND rearrangement process are usually performed as described above, but when a write error occurs in the write operation (program operation) for the NAND memory 16, the NAND memory 16 is erased. When an erase error occurs in the operation (erase operation), an ECC error (error correction processing failure) may occur during the read operation for the NAND memory 16, and exception handling for these may occur.

When any of the above errors occur (step S190), the SSDC 41 adds the physical block in which the error occurred to the BBT 61 (step S191), and deletes the physical block in which the error occurred from the ABT 62 and the FBT 60 (step S191). After step S192), the physical block in which the error occurred is made inaccessible. At this time, the data of the physical block in which the error occurred may be copied to another physical block. The SSDC 41 reflects the above error processing in the statistical information 65.

In the above, an example of error processing has been shown for read processing, write processing, and NAND rearrangement processing, but error processing is not limited to these examples, and for all read processing, write processing, and erase processing for the NAND memory 16. Applicable.

(Control tool)
While using SSD2, the reliability of each block of the NAND memory 16 deteriorates, the number of bad blocks increases, and the sum of the number of free blocks and the number of active blocks decreases. Further, when SSD2 is used, it is not possible to secure a sufficient number of free blocks for performing write processing even if NAND arrangement is performed, and this is the life of SSD2. The following shows the processing of the control tool 200 when the life of SSD2 has reached the end.

When the control tool 200 is started, it resides in the main memory 6 and monitors the statistical information 65 of the SSD 2. In order to constantly monitor the statistical information 65 of SSD2, the startup program of the control tool 200 is registered in the startup program of the normal OS100A, and the normal OS100A is read from the area 16D (or 20D) to the area 6A. It is desirable that the control tool 200 be read from the area 16B (or area 20B) when or immediately thereafter. For example, when the OS 100 is Windows (registered trademark), the control tool 200 is registered in, for example, the startup menu of Windows (registered trademark), registered as a service, or registered in the registry of Windows (registered trademark). By setting the control tool 200 as a resident program at the time of startup, the control tool 200 can be automatically started.

As shown in FIG. 29, for example, the control tool 200 acquires statistical information 65 from SSD 2 at regular time intervals (for example, every minute). As a method for acquiring statistical information, for example, SMART READ DATA (B0h (D0h)), which is a command of SMART (Self-Monitoring Analysis and Reporting Technology), which is a memory self-diagnosis function described in INCITS ACS-2. Alternatively, the SCT Command Transport described in ACS-2 or other vendor-specific commands may be used.

FIG. 30 shows a table relating to statistical information 65 (statistical information X01 to X19, X23, X24) managed by SSD2. When SMART is used, as shown in FIG. 30, an attribute ID (attribute ID) is assigned to each of the components (X01 to X19, X23, X24, etc.) of the statistical information 65, but only a part of these components. Of course, it may be assigned to. For the components of these statistical information 65, SMAB is adopted as the best value after standardization, and SMAL = SMAB * AMALR (0 ≤ AMALR <1) (SMAL is an integer and rounded off) as the lower limit of reliability guarantee after standardization. , Converted from a small number to an integer by either rounding up to the nearest whole number or rounding up to the nearest whole number)
attribute value = SMAL + SMAB × (1-AMALR) × (RMAX-raw value) / RMAX
attribute Threshold = 30 (fixed value)
RMAX = Upper limit of raw statistical information that can guarantee reliability
Based on the raw value = the raw value of the statistical information, the SSDC 41 calculates the attribute value of the smart information (“Value” in FIG. 30) and sends it to the control tool 200. The attribute Threshold is the “Threshold” in FIG. 26 and the raw value is the “Raw Data” in FIG.

The best value SMAB after standardization may be any natural number, and for example, SMAB = 100 may be adopted. AMALR may be any number satisfying 0 ≦ AMALR <1, and for example, AMALR = 0.3 may be adopted. Further, RMAX, AMALR and SMAB can adopt different values for each of X01 to X19, X23 and X24. When SMAB = 100 and AMALR =; 0.3 is adopted, the best value of attribute value for the statistical information to be adopted is 100 (for example, 100 immediately after shipment), and it gradually decreases as the reliability deteriorates. Then, when the reliability of SSD2 cannot be guaranteed (when the raw value of the statistical information becomes equal to or higher than RMAX), the attribute value reaches a value of 30 or less. As a means for the host 3 to detect whether or not the Attribute Value exceeds the Threshold, the command B0h / DAh SMART RETURN STATUS described in ACS-2 is used, and the Attribute Value is set to the Threshold from the Output of the command. You may decide whether or not it is exceeded.

For RMAX, for example, as shown in FIG. 31, it is desirable to derive the relationship between the raw value of statistical information and the defective rate of SSD2 at the development stage, and adopt the raw value of statistical information when the defective rate exceeds the permissible value as RMAX. .. For example, at the development stage of SSD2, a wear test is performed to verify whether the written data is correctly stored for a certain period of time or more while repeating the writing operation at a high temperature for a large number (for example, 100) of test SSD2 groups. At the same time, the statistical information may be continuously monitored, and the raw value of the statistical information at the time when the defective rate reaches a certain ratio may be adopted as RMAX. For example, if the worn SSD2 is left in a high temperature state for a period of time or longer, then the temperature of the SSD2 is lowered, a read operation is performed on the SSD2, and the read data cannot be ECC-corrected (or a certain number of data cannot be ECC-corrected). In the case of), this may be defined as a defect of SSD2, and the value obtained by dividing the number of defects by the number of SSD2s subjected to the same test may be adopted as the defect rate. The value of the statistical information raw whose defect rate is statistically significantly lower than the acceptable defect rate may be adopted as RMAX. Give RMAX some margin,
RMAX'with RMAX'= RMAX-margin may be adopted as RMAX.

The “Worst” of FIG. 30 may be adopted as a specification for the control tool 200 to diagnose the life of the SSD 2. "Worst" is calculated in SSDC41 as the worst value of attribute value. For example, in the case of X01 to X19 and X23, Worst is, for example, the minimum value of the attribute value after SSD2 is shipped (or manufactured). Alternatively, as Worst, the minimum value of the attribute value within a certain time range in the past may be adopted as Worst Value, or the past that has been communicated or processed a certain number of times (a certain amount of data) can be traced back to the past. The minimum value from to the present may be adopted as the worst value.

The “Raw Data” (Raw Value) of FIG. 30 may be adopted as a specification for the control tool 200 to diagnose the life of the SSD 2. Raw values of statistical information (eg, X01-X19, X23, X24) are transmitted from SSD2 to the control tool 200 as Raw Data. In this case, the control tool 200 acquires RMAX by already holding RMAX in the control tool 200, reading it separately from SSD2, or reading it from another storage device, compares RMAX and Raw Data, and Raw Data> RMAX. Alternatively, when Raw Data ≥ RMAX, it is determined that SSD2 has reached the end of its life. For example, in the case of the NAND rearrangement failure flag, if this is 1, it is determined that SSD2 has reached the end of its life. For example, in the case of the total number of bad blocks, when this exceeds a predetermined value, it is determined that SSD2 has reached the end of its life. It is not always necessary to output the raw value of the statistical information as raw data. For example, the SSDC 41 transmits the value obtained by performing the four rules of the raw value of the statistical information as raw data to the control tool 200, and also performs the four rules of RMAX. The judgment may be made by comparing with the value. Further, even if the SSDC 41 transmits the data obtained by encrypting the raw value of the statistical information as Raw Data to the control tool 200, and the SSDC 41 decodes the data and compares the decrypted data with the RMAX to make a judgment. good.

As described above, the control tool 200 determines whether or not the SSD2 has reached the end of its life (whether or not the SSD2 is in an abnormal state), and when it is determined that the SSD2 has reached the end of its life (the SSD2 is abnormal). When it is determined that the state is reached), the process proceeds to the end-of-life processing (step S205) described later. The statistical information 65 may take various forms other than the statistical information X01 to X19, X23, and X24, and the present invention is also applicable to these. Further, although there is a positive correlation between X01 to X19, X23, and X24 and the defect rate, the present invention is also applicable to statistical information in which there is a negative correlation between the defect rate and the defect rate. For example, the lowest temperature that SSD2 experienced after shipping. In that case, instead of RMAX, the lower limit value RMIN that can guarantee reliability may be adopted, and when the statistical information falls below RMIN, it may be determined that SSD2 has reached the end of its life.

In FIG. 29, when S.M.A.R.T is used, the control tool 200 acquires statistical information at regular time intervals (for example, every 1 minute) (step S200: Yes). The control tool 200 issues B0h / D0h SMART READ DATA described in ACS-2, which is a statistical information acquisition command (step S201), receives data including statistical information from SSD2 (step S202), and receives the received data. Is diagnosed (step S203). The diagnostic method is as described above. In step S204, when the control tool 200 determines that the SSD2 has reached the end of its life (step S204: Yes), the control tool shifts to the process at the end of its life (step S205). Even if the SSD2 has not reached the end of its life, it is desirable to shift to the process of step S205 even when the statistical information exceeds the predetermined RMAX or shows an abnormal value that cannot be achieved in normal operation.

Information other than the statistical information 65 may be used to shift to the end-of-life processing. For example, as shown in FIG. 32, when the control tool 200 acquires (monitors) the response information (see FIG. 12) received from the SSD 2 by the OS 100 from the OS 100 (step S210) and is an error response (step S211). , It is determined that SSD2 has reached an abnormal state, and the process proceeds to the end-of-life processing (step S212). The response to be monitored may be a response to any command, but for example, monitoring only the response to a write command to SSD2 such as 61h WRITE FPDMA QUEUED or 35h WRITE DMA EXT described in ACS-2 reduces the load on the CPU 4. Desirable from the point of view. In particular, when SSD2 is an SSD that adopts the invention of Japanese Patent Application Laid-Open No. 2009-217603 presented as Patent Document 1, when SSD2 reaches the end of its life, a response to a command to write to SSD2 will be returned with an error. Therefore, it is possible to determine the end of life without acquiring statistical information. It goes without saying that the present invention can be applied even when SSD 2 is not an SSD that employs the invention of Japanese Patent Application Laid-Open No. 2009-217603 presented as Patent Document 1.
When SSD2 is in a state of returning an error to a write command, and when writing such as rewriting the boot loader of SSD2 or writing to an emergency OS, which will be described later, a special write command is used in the ReadOnly mode state of Patent Document 1. SSDC41 is configured so as not to return an error for (for example, SCT Command Patent described in ACS-2 or other vendor-specific commands), and writes to SSD2 using the special write command described above. Is desirable. It is not necessary for writing to a storage device other than SSD2. Alternatively, when the normal OS time is an OS that uses only a certain write command (for example, 61h WRITE FPDMA QUEUED) as a write command, when the SSDC 41 reaches the ReadOnly mode of Patent Document 1, the write command (for example, 61h WRITE FPDMA QUEUED) is used. Configure SSDC41 to return an error for 61h WRITE FPDMA QUEUED), configure SSDC41 not to return an error for another write command (eg 30h WRITE SECTOR (S)), and another write command (For example, 30h WRITE SECTOR (S)) may be used to write the boot loader, emergency OS, etc. to SSD2.

Of course, the command to be monitored may be a command other than the write command. For example, the B0H / D4H SMART EXECUTE OFF-LINE IMMEDIATE response (Outputs) or report described in ACS-2 may be used as the command response, or the 90h EXECUTE DEVICE DIAGNOSTIC response may be used.

Even if a certain command response is an error, if the same command is sent again, it may not be an error. In this case, SSD2 may not have reached the end of its life, so if a reproducible command error occurs. From the viewpoint of performing the processing at the end of the service life only, it is desirable to perform the processing at the end of the service life when a command error occurs multiple times. Further, from the viewpoint of strictly determining the error reproducibility, it is desirable to perform the processing at the end of the life when the command error occurs a plurality of times in succession. Alternatively, as shown in FIG. 33, when a command response is returned with an error during command monitoring to SSD2 (steps S220, S221: Yes), the control tool 200 or OS100 sends the command to SSD2 again (command retry). ) (Step S222), and when the retryed command fails (Step S223: Yes), the processing at the end of the life may be performed (Step S224).

(Processing at the end of life)
Next, the processing at the end of the life (processing at the time of abnormal state) will be described. In the first embodiment, the processing at the end of the life when the normal OS and the emergency OS are already stored in the SSD 2 will be described. As shown in FIGS. 7 to 11, the normal OS 100A, the emergency OS 100B, and the boot loader 300 are written to the SSD 2 by the manufacturer of the computer system 1 before the shipment of the computer system 1, or are written in the SSD 2 of the computer system 1, for example. After shipping, the user installs with an installation disk such as DVD-ROM, USB memory, SSD, etc., or after shipping the computer system 1, the user downloads the installation image from the WEB and installs using the downloaded installation image. Written to SSD2. In the NAND memory 16, as shown in FIG. 7, the boot loader 300 is written in the area 16C, the normal OS100A is written in the area 16D, and the emergency OS100B is written in the area 16E. LBAs are assigned to 16C, 16D, and 16E, respectively. It is assumed that LBA16C is assigned to the area 16C, LBA16D is assigned to the area 16D, and LBA16E is assigned to the area 16E. Similarly, LBA is assigned to the above-mentioned OS pointer information OSPT (pointer information indicating the LBA of the OS to be read) held in the boot loader 300, and the LBA assigned to the OSPT is referred to as LBAOSPT. LBAOSPT is included in LBA16C.

The control tool 200 rewrites the boot loader 300 so that when the computer system 1 is started from the next time onward, the emergency OS 100B is read into the area 6A on the main memory 6 of the host device 3 instead of the normal OS 100A. When the OS 100A is normally used as the OS 100 by the CPU 4, the host device 3 may write to the SSD 2, which further shortens the life of the SSD 2 or writes data written to the SSD 2 or already written to the SSD 2. There is a possibility of destroying the stored data. On the other hand, according to the present embodiment, the emergency OS 100B is read into the area 6A on the main memory 6 instead of the normal OS 100A, and when the CPU 4 is using the emergency OS 100B as the operating, the host 3 writes to the SSD 2. Since the operation is prohibited, the data of the SSD 2 can be read or the user data stored in the SSD 2 can be stored in another storage medium before the data of the SSD 2 is destroyed or the SSD 2 becomes unreadable. It will be possible to back up.

For example, when the life end processing is called in step S205 of FIG. 29, the control tool 200 rewrites the boot loader 300 as shown in FIG. 34, and when the computer system 1 is started from the next time onward, it is not the normal OS 100A but an emergency. At the time, the OS 100B is read into the area 6A on the main memory 6. For example, the control tool 200 writes LBA16E as write data to LBAOSPT. As a result, when the computer system 1 is started from the next time onward, the CPU 4 reads the OS pointer information OSPT and sends a read command to the LBA 16E which is the LBA indicated by the OS pointer information OSPT to read the emergency OS 100B. Can be done. Before and after rewriting the boot loader 300, the control tool 200 may display through the display 9 that "SSD has reached the end of its life. The emergency OS will be enabled."

In FIG. 34, only the boot loader 300 was rewritten as the process at the end of the life, but as shown in FIG. 35, the control tool 200 sends a reset command to the computer system 1 after the boot loader is rewritten in step S240. Alternatively, the computer system 1 may be restarted by sending a reset command to the OS during normal operation (step S241).

Also, as shown in FIG. 36, after rewriting the boot loader in step S250, through the display 9, the message "The SSD has reached the end of its life. The emergency OS is enabled. Do you want to restart now?" The text display and the OK button may be displayed (step S251), and when the OK button is pressed by, for example, the mouse 15 or the keyboard 14 (step S252: Yes), the computer system 1 may be restarted (step S251). S253). Also, instead of displaying the OK button, the text display "SSD has reached the end of its life. Enable the emergency OS. Do you want to restart now? Y: Yes, n: No" on the command prompt screen. , And when the enter key is input from the keyboard 14, the computer system 1 may be restarted.

FIG. 37 shows an operation procedure when the computer system 1 is restarted. When the computer system 1 is restarted, the CPU 4 reads the boot loader 300 and the OS pointer information OSPT from the SSD 2 using the LBA and the LBA OSPT corresponding to the area 16C (step S260). Next, the CPU 4 uses the boot loader 300 to perform a required boot process, analyzes the OS pointer information OSPT, and identifies the LBA indicated by the OS pointer information OSPT. Then, the CPU 4 reads the OS specified by the OS pointer information OSPT from the SSD 2 by transmitting a read instruction for the specified LBA to the SSD 2. Therefore, when the LBA indicated by the OS pointer information OSPT specifies the area 16D which is the storage area of the normal OS100A (step S261: Yes), the normal time OA100A is read from the area 16D and the area on the main memory 6 is read. When written in 6A (step S262) and the LBA indicated by the OS pointer information OSPT specifies the area 16E which is the storage area of the emergency OS100B (step S261: No), the emergency OA100B is read from the area 16E. Is written to the area 6A on the main memory 6 (step S263). In this way, when the OS pointer information OSPT of the boot loader 300 is rewritten to read the emergency OS 100B by the processing at the end of the life by the control tool 200, the emergency OA100B is read from the area 16E and is stored in the main memory 6. Will be written in the area 6A of.

(Backup function)
From the viewpoint of facilitating the user to easily back up the user data of SSD2 to another storage device, it is desirable to add a user data backup function to the emergency OS 100B. When it is considered that SSD2 has reached the end of its life, it is considered that the data retention characteristics of SSD2 have deteriorated. Therefore, it is necessary to save the user data on SSD2 to another backup storage device as soon as possible. Is.

FIG. 38 is a diagram showing a configuration of the host device 3 when the emergency OS 100B is equipped with a backup function. A backup storage device (other SSD, hard disk drive, etc.) 150 is connected to the host device 3 via an interface 19 (which employs a SATA interface in this embodiment). The backup storage device 150 does not need to be installed at the time of shipment of the computer system 1. For example, when an SSD purchased separately by the user is used as the backup storage device 150, the SATA port of the SSD is connected to the motherboard via a SATA cable. It is preferable to connect to 30 (see FIG. 13) and connect the power port of SSD2 to the power supply 32 via the power cable.

FIG. 39 shows an example of the procedure for starting the emergency OS 100B when the backup function is added to the emergency OS 100B. The operation of steps S270 to S273 in FIG. 39 is the same as the operation of steps S260 to S263 in FIG. 37. In FIG. 39, steps S274 to S276 are added to the boot procedure of the computer system 1 shown in FIG. 37. After starting the emergency OS100B, the processing after step S274 is automatically performed when, for example, the user selects the backup function from the program menu of the emergency OS100B via the keyboard 14 or the mouse 15, or when the emergency OS100B is started. Is started on. Before the backup process, it is desirable to display the message "Do you want to back up?" And the OK button on the display 9 so that the user can freely select the backup timing. When the OK button is selected with the mouse 15 or the keyboard 14, the process proceeds to Yes in step S275. Alternatively, the message "Do you want to back up? Yes: Y, No: N" is displayed on the display 9 via the command prompt, and the Y button and the enter key are pressed from the keyboard 14 to proceed to Yes in step S275. good. In this way, when the backup function is selected (step S275: Yes), the emergency OS 100B starts the backup process.

As the contents of the backup process, for example, the emergency OS 100B writes the data read from the SSD 2 to the same LBA (LBA on the backup storage device 150) as the LBA of the data read from the SSD 2 (LBA of the SSD 2). LBA unit backup). For example, the data of LBA = 0h on SSD2 is copied to LBA = 0h on the backup storage device 150 (step S276). Further, the data of LBA = 234c5h on SSD2 is copied to LBA = 234c5h on the backup storage device 150. To copy the data, send, for example, the 60h READ FPDMA QUEUED or 25h READ DMA EXT command described in ACS-2 to SSD2 by specifying the LBA and sector length, receive the read data from SSD2, and write it to the main memory 6. For example, 61h WRITE FPDMA QUEUED or 35h WRITE DMA EXT described in ACS-2 is transmitted to the backup storage device 150 by specifying the LBA and sector length, and the data written in the main memory 6 is transmitted to the backup storage device 150. Is executed by. The backup process may be performed on the entire LBA area, but may be performed only on a part of the LBA area.

At the time of this backup process, the emergency OS 100B may copy all the files of the SSD 2 to the backup storage device 150. In many operating systems, the user does not directly specify the LBA to access the data, but uses the file ID (file name) to access the data. For example, SSD2 stores a file management table 140 that associates a file ID with an LBA and a sector length, as shown in FIG. 40. LBA is also assigned to the file management table 140 by the management information 44. In the normal state, the OS 100A converts the file ID received from the other software shown in FIG. 12 into an LBA based on the file management table 140 and transmits the LBA to the SSD 2, or the LBA received from the SSD 2 also has the file management table 140. It is converted to a file ID and sent to other software. In the backup process, the emergency OS 100B reads the file management table 140 from SSD2 and reads the LBA data supported by the file management table 140 for each file ID (60h READ FPDMA QUEUED, 25h READ DMA EXT command, etc.). ) Is transmitted to the SSD 2, the read data is received from the SSD 2, and the data is written to the main memory 6. Further, the emergency OS 100B reads the file management table (not shown) of the backup storage device 150, writes the data written in the main memory 6 to the LBA to which the file ID is not yet assigned, and writes the written LBA and the file. All LBAs of all files of SSD2 are acquired so as to associate names, all data of the acquired LBAs are read, the read data is written to the backup storage device 150, and the written LBAs are associated with the file ID for backup. The file management table (not shown) of the storage device 150 is rewritten. The backup process may be performed on all files, but may be performed on only some files.

Further, when writing the backup data to the backup storage device 150, the data read from the SSD 2 may be compressed and written. In addition, the management information of SSD2 including the file management table 140 is read, the information of the used area and the file is acquired, and the ROM image about the data of SSD2 is created and created based on the acquired information. The ROM image may be stored in another backup storage device 150.

In the above description, the case where the SATA device is connected by the SATA interface is adopted as the backup storage device, but it goes without saying that other backup storage devices may be used. For example, as shown in FIG. 41, a USB storage device 151 such as a USB memory or a USB-compatible SSD may be adopted as the backup storage device, and as shown in FIG. 42, a DVD-R or DVD may be used as the backup storage device. A writable optical drive 152 such as a-RW or Blu-ray® Disc may be used, and as shown in FIG. 43, a network storage connected via the Internet or LAN as a backup storage device. Server 153 may be adopted. The backup function can also be applied to other embodiments.

As shown in FIG. 7, it is assumed that the storage area 16E of the emergency OS 100B is associated with the LBA in the management information 44. On the other hand, in order to prevent the data in the area 16E from being inadvertently rewritten by the user, the emergency OS is recorded in the storage area 16E without allocating the LBA at the time of shipment of the SSD2, and when the life is reached. At the time of processing, the control tool 200 may send an SCT Command Transport or a vendor-specific command to the SSD 2, so that the SSDC 41 rewrites the management information 44 and allocates the LBA to the area 16E. Alternatively, when the control tool 200 sends an SCT Command Transfer including the LBA Range of the area 16E to which the LBA is allocated or a vendor-specific command to the SSD2, the SSDC 41 manages the management information 44 so that the area 16E is not allocated to the LBA. Is rewritten, and the control tool 200 may send an SCT Command Transport or a vendor-specific command to the SSD 2 at the time of processing at the end of the life, so that the SSDC 41 rewrites the management information 44 and allocates the LBA to the area 16E.

As described above, according to the first embodiment, the control tool 200 determines whether or not the SSD2 has reached the end of its life and whether or not the SSD2 is in a normal state, and it is determined that the SSD2 has reached the end of its life. When it is determined that the SSD2 is in an abnormal state, the boot loader 300 is rewritten so that the emergency OS that does not support the write operation is started, and when the computer system 1 is restarted, the emergency OS By prohibiting the write operation for SSD2 or not explicitly performing the write operation for SSD2, the reliability deterioration of SSD2 can be prevented, and the data to be written to SSD2 and the SSD have already been written. It prevents the written data from being destroyed, and enables the user to easily read the user data from the SSD 2 or back it up to another storage device.

(Second Embodiment)
In the first embodiment, the case where both the normal OS 100A and the emergency OS 100B are stored in the NAND memory 16 of the SSD 2 has been described. In the second embodiment, the case where the normal OS 100A is stored in the SSD 2 and the emergency OS 100B is not stored in the SSD 2 will be described. In the second embodiment, before and after the rewriting process of the boot loader 300 (see step S240 of FIGS. 34 and 35) at the time of the end-of-life processing shown in step S224 of FIG. 33, the control tool 200 performs the emergency OS 100B. , The external storage device 20 (see FIG. 8) different from SSD2 is installed in the area 16E of the NAND memory 16 of SSD2. From the viewpoint of preventing the data for the emergency OS from being destroyed by the user inadvertently rewriting the area 16E in which the emergency OS of the SSD2 is stored, the free area of the SSD2 is reduced by securing the area 16E. From the viewpoint of prevention, it is desirable to adopt the second embodiment.

Further, for example, as shown in FIG. 9, the control tool 200 downloads the data of the emergency OS 100B or the installation program from the WEB server 21 before and after the rewriting of the boot loader 300, and based on the downloaded data, the NAND memory of the SSD2. The emergency OS 100B is installed in the 16 area 16E. Alternatively, the control tool 200 may display the address of the WEB server storing the emergency OS data or the installation program to the user through the display 9.

Alternatively, as shown in FIGS. 10 and 11, before and after rewriting the boot loader 300, the control tool 200 has external storage media (optical media such as a DVD-ROM, USB memory, SD card, SSD, etc.) 23, 24. The emergency OS 100B may be installed in the area 16E of the NAND memory 16 of the SSD2. Alternatively, before and after rewriting the boot loader 300, the control tool 200 sets an external storage medium (optical media such as a DVD-ROM, USB memory, SD card, SSD, etc.) in which the installation program of the emergency OS 100B is stored. In addition, a message may be displayed to the user through the display 9.

Since writing to the NAND memory 16 occurs when the emergency OS 100B is installed in the NAND memory 16, the amount of data in the emergency OS is the same as that of the NAND memory 16 from the viewpoint of preventing reliability deterioration and data corruption of the NAND memory 16. It is desirable that it is significantly smaller than the capacity.

(Third Embodiment)
In the third embodiment, the life end processing when the normal OS 100A and the emergency OS 100B are stored in the non-volatile storage device 20 different from the SSD 2 will be described. As shown in FIG. 8, when the normal OS 100A and the emergency OS 100B are stored in the non-volatile storage device 20 different from the SSD 2 and not stored in the SSD 2, or one of them is stored in the SSD 2. The present invention is also applicable when one of them is stored in the non-volatile storage device 20. In that case, the control tool 200 may need to rewrite not only the boot loader of the SSD 2 but also the boot loader of the non-volatile storage device 20.

When the normal OS 100A and the emergency OS 100B are stored in the non-volatile storage device 20 different from the SSD 2, the control tool 200 rewrites the boot loader 300 stored in the non-volatile storage device 20 to obtain the boot loader of the SSD 2. It is not rewritten.

When the normal OS 100A is stored in the SSD 2 and the emergency OS 100B is stored in the non-volatile storage device 20, the control tool 200 may rewrite the boot loaders of both the SSD 2 and the non-volatile storage device 20. desirable. If the computer system 1 is started while the non-volatile storage device 20 is removed from the host device 3, the OS should not be started normally from the viewpoint of preventing inadvertent write access to the SSD 2. It is desirable that a boot loader be configured.

When the emergency OS 100B is stored in the SSD 2 and the normal OS 100A is stored in the non-volatile storage device 20, it is desirable to rewrite the boot loaders of both the SSD 2 and the non-volatile storage device 20, but it is non-volatile. The boot loader of the storage device 20 may be simply rewritten. In this case, even if the computer system 1 is started with the non-volatile storage device 20 removed from the host device 3, the boot loader 300 of the SSD 2 is read out and the area 16E of the NAND memory 16 of the SSD 2 is urgently read. When the OS can be started.

(Fourth Embodiment)
In the fourth embodiment, a case where the normal OS 100A is installed on the SSD 2 but the emergency OS is not installed on the SSD 2 will be described. From the viewpoint of suppressing access to SSD2 whose reliability has deteriorated as much as possible, it is desirable to start the emergency OS100B from a storage device different from SSD2. The control tool 200 of the present embodiment has a function of creating a boot disk for emergency boot with an emergency OS installed at the time of processing at the end of life.

As the boot disk for emergency boot, various non-volatile storage devices such as USB memory, SD card, optical media such as CD / DVD, SSD, and hard disk drive can be adopted. In this embodiment, a case where a USB memory is adopted as a boot disk for emergency boot will be described.

Data (image data) including emergency OS data for creating a boot disk for emergency boot includes, for example, SSD2, other SSDs, USB memory, SD cards, optical media such as DVD-ROM drives, and optical media such as DVD-ROM drives. It may be stored in the storage medium of the WEB server. In this embodiment, a case where SSD2 is adopted as a storage medium for storing image data for emergency OS installation will be introduced. That is, the installation source image data is stored in the SSD 2 itself whose reliability has deteriorated.

When installing the emergency OS, image data is read from SSD2, but once the installation is performed, the image data is not read. Further, it is desirable that the control tool 200 has a function that allows the user to arbitrarily create a boot disk for emergency boot from a stage before the SSD 2 reaches the end of its life.

FIG. 44 shows a conceptual diagram of data movement when creating an emergency boot disk. Further, FIG. 45 shows an operation procedure of the control tool 200 when creating an emergency boot disk. The control tool 200 confirms whether or not the USB memory is connected to the USB controller 13 of the host device 3 at the start of the processing at the end of the life, and if not, "creates a USB memory for booting the emergency OS." It is desirable to display a message to the user via the display 9 stating "Please connect the USB memory."

As shown in FIG. 44, when the USB memory 24 is connected, the control tool 200 extracts the emergency OS data from the installation image data 400 stored in the area 16Q of the NAND memory 16 of the SSD2 (in an emergency). If the OS data is compressed / encrypted, it is decrypted) and copied (installed) to the area 24R of the USB memory 24 (step S280). Next, the control tool 200 refers to the storage area 24R of the emergency OS 100B so that the emergency OS 100B installed in the USB memory 24 is read when the boot loader 310 stored in the USB memory 24 is read. The boot loader 310 is rewritten (step S281). Specifically, the control tool 200 writes, for example, the LBA corresponding to the storage area 24R in the OS pointer information OSPT311 of the boot loader 310.

When both the USB memory 24 and the SSD 2 are connected to the host device 3, the boot loader 310 and the boot loader 310 are rewritten or the settings of the BIOS-ROM 11 are changed so that the boot loader 310 of the USB memory 24 is started preferentially. It is desirable to be done (step S282). It is not necessary to execute step S282.

From the viewpoint of preventing the OS100A from starting from the SSD 2 and inadvertently causing write access to the SSD 2 when the USB memory 24 is not connected to the host device 3, in step S282, the SSD 2 to the normal time It is desirable to rewrite the boot loader 300 of SSD2 so that OS100A does not start. For example, by writing an LBA other than the storage area 16D of the normal OS 100A to the OS pointer information OSPT 301 of the boot loader 300 or writing an invalid LBA, the OS 100A is loaded even if the boot loader 300 of the SSD 2 is read. Can be prevented. Alternatively, the data of OS100A may be rewritten at normal times.

In this way, when the SSD2 reaches the end of its life or the SSD2 becomes in an abnormal state, the data of the SSD2 can be read out or the data of the SSD2 can be read while suppressing the deterioration of the reliability of the SSD2 and the data destruction of the SSD2. It is possible to create a boot disk for booting an OS that can be backed up to a non-volatile storage device.

Further, as shown in FIG. 46, an OS such as MS-DOS (trademark), Linux (trademark), Windows (registered trademark) PE (trademark) is adopted as the emergency OS100B, and the emergency OS is installed in the USB memory 24. At the same time, the emergency tool 210 having a function of backing up the data of the SSD 2 may be installed in the area 24S of the USB memory 24 so that the emergency tool 210 can be executed from the emergency OS 100B. It is desirable that the emergency tool 210 has a backup function similar to that described in the first embodiment.

FIG. 47 shows the operation at the time of starting the host device 3. When the host device 3 is started, the emergency OS 100B is read from the USB memory 24 and written to the main memory 6, so that the emergency OS 100B is started from the USB memory 24 (step S290). Next, the emergency tool 210 is read from the USB memory 24 and written to the main memory 6, so that the emergency tool 210 is started from the USB memory 24 (step S291). It is desirable that the emergency tool 210 is automatically started after the emergency OS 100B is started, such as when the emergency tool 210 is registered in the startup of the emergency OS 100B.

As shown in FIG. 48, the emergency OS 100B displays a backup menu as one of the menu items that can be selected by the user, or displays a message "Do you want to back up?" And an OK button via the display 9. Alternatively, it is desirable that the user arbitrarily activates the backup function by displaying the message "Do you want to back up?" And putting the keyboard 14 in the input standby state (step S292). The emergency OS 100B may automatically start backup.

When the backup function activation is selected by the keyboard 14 or the mouse 15 (step S293), the emergency tool 210 is activated. The emergency tool 210 copies the data of SSD2 to the backup storage device 150 (step S293). As the backup method, the same method as that described in the first embodiment may be adopted, and for example, an LBA unit backup or a file unit backup may be adopted.

(Fifth Embodiment)
According to the above-described embodiment, the user can easily read the user data from the SSD 2 or back it up to another storage device while suppressing the deterioration of the reliability of the SSD 2 and the data destruction of the SSD 2. A fifth embodiment further provides a method for suppressing deterioration in reliability of SSD2. SSD2 may be equipped with a function to perform a refresh process in the background in order to repair data corruption due to aged deterioration or the influence of read disturb. In this function, the block of the NAND memory 16 is periodically read, and the data of the block having a large number of data errors is written to another block. This makes it possible to reduce the effects of aging deterioration and read disturb, but on the other hand, there is also a problem that the reliability deterioration of SSD2 is accelerated because extra blocks are erased and written.

In this embodiment, the control tool 200 or the emergency OS 100B uses a refresh control command (SCT Command Transport described in ACS-2, other vendor-specific commands, or other commands) to stop the refresh execution. Command SSDC41. The SSDC 41 receives a refresh control command to stop the refresh process or set a long refresh execution interval (for example, 1 minute) (for example, 2 minutes). When making the SSDC 41 set a long refresh execution interval, it is desirable to explicitly specify the refresh execution interval in the refresh control command.

FIG. 49 shows an operation when the control tool 200 issues a refresh control command. In this case, the control tool 200 may issue a refresh control command at the time of the end-of-life processing shown in step S205 of FIG. 29. The control tool 200 rewrites the boot loader 300 described with reference to FIG. 34 (step S300), and then transmits a refresh control command to SSD2 (step S301).

FIG. 50 shows an operation when the emergency OS 100B issues a refresh control command. In this case, when the system is started, the CPU 4 reads the boot loader 300 including the OS pointer information OSPT from the NAND memory 16 of the SSD 2 (step S310) as described with reference to FIG. 37, and identifies the LBA indicated by the OS pointer information OSPT. Then, the CPU 4 reads the OS specified by the OS pointer information OSPT from the SSD 2 by transmitting a read instruction for the specified LBA to the SSD 2. When the LBA indicated by the OS pointer information OSPT specifies the area 16D which is the storage area of the OS100A in the normal state (step S311: Yes), the OA100A in the normal time is read from the area 16D and becomes the area 6A on the main memory 6. When written (step S312) and the LBA indicated by the OS pointer information OSPT specifies the area 16E which is the storage area of the emergency OS100B (step S311: No), the emergency OA100B is read from the area 16E and is mainly used. It is written to the area 6A on the memory 6 (step S313). When the emergency OA100B is activated, the emergency OA100B transmits a refresh control command to SSD2 (step S314).

As described above, in the fifth embodiment, the control tool controls the background write processing in SSD2 such as the refresh processing in the prohibition direction at the time of the end-of-life processing, so that the SSD is trusted. It is possible to suppress sexual deterioration.

(Sixth Embodiment)
In the first embodiment, the control tool 200 periodically acquires statistical information as shown in FIG. 29, and processes when the SSD2 reaches the end of its life or just before the SSD2 reaches the end of its life. Was done. The control tool 200 may predict the life of the SSD 2 based on the acquired statistical information and notify the user through the display 9, which will be described below.

When the control tool 200 periodically acquires statistical information according to the processing procedure shown in FIG. 29, the control tool 200 stores the acquired data in the main memory 6 in the format shown in FIG. 51, for example. I will add it. The statistical information time series data may be periodically backed up in a non-volatile storage device such as SSD2. Further, as for the statistical information time series data, old data may be deleted every time the latest data is added.

Further, the control tool 200 may display the statistical information time series data of the main memory 6 as a graph to the user via the display 9 in the display format as shown in FIG. 52, for example.

In the present embodiment, the life of SSD2 is predicted based on this statistical information time series data. As shown in FIG. 53, the control tool 200 sets the Attribute Value of a certain Attribute ID as the variable Y, sets the time as the variable X, and sets the current time from the time A at a time before a predetermined time T from the current time. The fitting function Y = f (X) is obtained using all the data of (X, Y) in the period up to the time C. That is, using f, the predicted value from X to Y = f (X)) can be obtained). There are various methods for deriving f. For example, using parameter a and parameter b, f (X) = aX + b, and at least two for all data (X, Y) from time A to time C. F may be determined by finding a and b using the multiplication method.

^{Then, f -1} (Y), which is the inverse function of f (X), is obtained. When f (X) = aX + b, f ^-1 (Y) = (Y · b) / a is obtained. The predicted life arrival time of SSD2 is f ^-1 (Y = Threshold). The fitting function X = g (Y) may be obtained for all the data from time A to time C (X, Y), and the estimated life arrival time of SSD2 may be set to g (Y = Threshold). Further, f (X) and g (Y) may be fitted to a function other than the linear function such as a quadratic function.

In this embodiment, the life is predicted using the Attribute Value (= Y) and Threshold of SMART, but the raw data Raw Value is used as Y to obtain f (X) and g (Y), and the expected life is reached. The time may be f ^-1 (Y = RMAX) or g (Y = RMAX), or f ^-1 (Y = RMIN) or g (Y = RMIN). In addition, the life may be predicted by statistical information obtained by using means other than SMART information.

The control tool 200 notifies the user of the predicted life arrival time thus obtained through the display 9. As a notification method, for example, a text display such as "estimated life arrival time: September 09, 1999" may be displayed, or as shown in FIG. 54, "the SSD life is less than 30 days remaining. You may display a warning screen such as "Please back up the SSD data immediately and replace it with a new SSD." Alternatively, when the remaining life of the SSD reaches a predetermined number of days, the color of the icon displayed on the display may be changed by changing the color of the icon of the control tool 200.

(7th Embodiment)
In the first embodiment, as shown in FIG. 38, when the normal OS 100A and the emergency OS 100B are stored in the NAND memory 16 of the SSD 2, the function of backing up the data of the SSD 2 to the backup storage device 150. Was explained. When the control tool 200 rewrites the boot loader 300 as the end-of-life processing (step S205 in FIG. 29) (step S230 in FIG. 34) and adopts, for example, the above-mentioned LBA unit backup as the backup function, the SSD 2 is subsequently hosted. In order to ensure that the OS 100A normally starts when the computer system 1 is powered on while the backup storage device 150 is connected to the host device 3 after being separated from the backup storage device 150, the backup storage device 150 is used. It is desirable to restore the boot loader copied by the backup process to the state of the boot loader 300 of SSD2 before the process at the end of the life. In this embodiment, a method of rewriting the boot loader of the backup storage device 150 at the time of backup operation will be described.

FIG. 55 shows the functional configurations of the computer system 1 and the backup storage device 150 before and after the backup operation. In the restoration boot loader area 16V of the NAND memory 16 of the SSD 2, boot loader restoration information 350 for returning the boot loader 300 to the state before rewriting by the control tool 200 is stored. The area 16V may be allocated by the control tool 200 at the end of life processing, may be allocated at startup of the control tool 200, or may be allocated when the control tool 200 is installed on SSD2. LBA is assigned to the allocated area 16V according to the management information 45 of SSD2 (see FIG. 18).

FIG. 56 shows an operation procedure of the processing at the end of the life in the present embodiment. In the end-of-life processing, the backup storage device 150 does not have to be connected to the host device 3. The control tool 200 writes the backup information of the boot loader 300, that is, the boot loader restoration information 350, to the restoration boot loader area 16V at the time of the end-of-life processing, that is, before rewriting the boot loader 300 (step S320). As the information to be written in the area 16V, for example, the data (image) of the boot loader 300 stored in the area 16C may be copied as it is, or the rewrite difference information of the boot loader may be recorded.

When recording the difference information in the area 16V, a rewrite difference log in which the correspondence between the data before rewriting and the rewritten LBA, as shown in FIG. 57, may be adopted as the difference information. When the rewrite difference log is adopted, the control tool 200 writes the rewritten LBA of the boot loader 300 stored in the area 16C to the "rewritten LBA" of the rewrite difference log, and the data before rewriting of the same LBA. Is written in the "data before rewriting" of the rewriting difference log. For example, when the logical sector, which is the minimum unit of LBA, is 512 bytes, one element of the "data before rewriting" of the rewrite difference log may be 512 bytes of data, or the data before rewriting is compressed. Alternatively, the data may be data other than 512 bytes that has been losslessly converted. When restoring the boot loader 300 from the new boot loader to the old boot loader using the rewrite difference log, write "data before rewriting" to the LBA indicated by the "rewritten LBA" of the rewrite difference log in the area 16C. You can restore to the old bootloader with.

After that, the control tool 200 rewrites the boot loader 300, and when the computer system 1 is started from the next time onward, the emergency OS 100B is read into the main memory 6 instead of the normal OS 100A, as described in the first embodiment. (Step S321).

In order to facilitate the search for the restoration boot loader area 16V during the backup operation described later, it is desirable that the control tool 200 writes the head LBA of the restoration boot loader area 16V to the boot loader area 16C (step S322). It is not always necessary to write the head LBA of the boot loader area 16V for restoration in the boot loader area 16C, and a specific data pattern is written at the head of the area 16V, and the area is searched by searching this specific data pattern at the time of backup described later. 16V may be specified, or the area 16V may be specified by fixingly associating the area 16V with a predetermined specific LBA and accessing the specific LBA at the time of backup described later. Alternatively, the region 16V may be specified by other methods.

After step S321, the computer system 1 may be restarted as in the first embodiment, or the SSD2 refresh control command may be transmitted as in the fifth embodiment. Further, the restoration boot loader area 16V may be secured in a storage device other than SSD2.

FIG. 58 shows a backup operation by the emergency OS 100B. At the time of backup, if the backup storage device 150 is not connected to the host device 3, the user connects the backup storage device 150 to the host device 3. At that time, the control tool 200 may display the message "Please connect the backup device" to the user on the display 9.

The emergency OS loaded from the area 16E of the NAND memory 16 to the area 6A of the main memory 6 copies the data of the SSD 2 to the backup storage device 150 in the same manner as in the first embodiment (step S330). For example, when LBA unit backup is adopted as the backup method and the entire LBA area of SSD2 is copied to the backup storage device 150, the normal OS 100A stored in the area 16D is the area 150D of the backup storage device 150. Other user data copied to the area 16U and stored in the area 16U is copied to the area 150U. The boot loader 300 stored in the boot loader area 16C may or may not be copied to the area 100C of the backup storage device 150. The emergency OS 100B stored in the area 16E may or may not be copied to the area 150E of the backup storage device 150. Further, the boot loader restoration information 350 stored in the restoration boot loader area 16V does not have to be copied to the backup storage device 150.

The emergency OS 100B creates a boot loader 320 to be stored in the backup storage device 150 based on the boot loader restoration information 350 and the data of the boot loader 300, and writes the created boot loader 320 to the area 150C of the backup storage device 150. When the boot loader 320 is loaded at the time of starting the computer system 1 from the next time onward, the OS 100A is normally loaded into the area 6A of the main memory 6 (step S331).

When the data (image) of the boot loader 300 stored in the area 16C is copied to the restoration boot loader area 16V as it is in the boot loader backup process in step S320 of FIG. 56, the restoration is performed in step S331 of FIG. The boot loader restoration information 350 of the boot loader area 16V may be copied as it is to the area 150C of the backup storage device 150.

Further, in the boot loader backup process in step S320 of FIG. 56, when the rewrite difference information of the boot loader area 16C is recorded in the restoration boot loader area 16V, that is, the boot loader area 16C is rewritten from the old boot loader data to the new boot loader data. When the difference information of rewriting the new and old boot loader data at the time is recorded in the boot loader area 16V for restoration, the emergency OS 100B sets the data (new boot loader data) of the boot loader area 16C and the restoration in step S331 of FIG. 58. The boot loader restoration information 350, which is the difference data stored in the boot loader area 16V, is read into the main memory 6, the new boot loader data is restored to the old boot loader data based on the boot loader restoration information 350, and the restored old boot loader data is used for backup. Write to the area 150C of the storage device 150.

After performing the above backup process, the SSD2 that has reached the end of its life is separated from the host device 3 by removing the SSD2 from the IF0, and the backup storage device 150 is connected to the IF1 to host the backup storage device 150. When the computer system 1 is started in the state of being connected to, the host device 3 reads the boot loader 320 of the backup storage device 150, and the host device 3 uses the information of the boot loader 320 to store the area 150D of the backup storage device 150 in the main memory 6. By loading into the area 6A of, the OS is normally started. When the backup storage device 150 is compatible with the interface IF0, the backup storage device 150 may be replaced with the SSD2, and the backup storage device 150 may be connected to the interface IF0. When the backup storage device 150 does not support the interface IF0, the backup storage device 150 may be replaced with the SSD2, and the backup storage device 150 may be connected to the interface IF0 via the interface conversion device.

In this way, even when the SSD 2 reaches the end of its life, the computer system 1 can restore the user data and the normal OS stored in the SSD 2 to the backup storage device, and the user can make extra settings. The SSD 2 can be replaced with the backup storage device 150, and the backup storage device 150 can be used as a system drive instead of the SSD 2 without having to reinstall the OS at normal times.

(8th Embodiment)
In the present embodiment, when the host device to which the SSD2 is connected is started when the SSD2 returns from the abnormal state (life end state) to the normal state (health state), the normal OS is started instead of the emergency OS. To do so.

As statistical information, for example, the current temperature X20 and the maximum temperature X21 indicate that the larger the value, the worse the reliability, and even if the value increases to a value that adversely affects the reliability, it returns to the normal value again. When adopting parameters having recoverable characteristics, for those statistical information, for example, RMAX = 85 ° C. is adopted as RMAX.
Statistical value> RMAX
Or statistical information value ≥ RMAX
When the condition such as that the temperature becomes out of the guaranteed operation is satisfied, the control tool 200 rewrites the boot loader 300, and when the computer system 1 is started from the next time onward, the emergency OS 100B is the main memory 6 instead of the normal OS 100A. To be read by.

After booting, the emergency OS100B monitors the value of statistical information and monitors it.
When the statistical information value ≤ RMAX-MAX margin or the statistical information value <RMAX-MAX margin and the statistical information returns to the normal value again, the boot loader 300 is rewritten to start the computer system 1 from the next time onward. Occasionally, a boot loader restoration process is executed so that the normal OS 100A is read into the main memory 6 instead of the emergency OS 100B.

Although the MAX margin is a value of zero or more, it is desirable that the MAX margin is a value larger than zero in order to prevent the boot loader 300 from being frequently rewritten. If the statistical information is the current temperature or the maximum temperature, for example, MAX margin = 5 ° C. When SMART information is used for acquisition of statistical information and determination of conditions, Attribute Value and Threshold may be used, or Raw Value and RMAX may be used. Further, when the statistical information returns from the abnormal state to the normal state during normal OS startup, the control tool 200 may perform the boot loader restoration process.

As statistical information, it is shown that the smaller the values are, the worse the reliability is, such as the current temperature X20 and the minimum temperature X22, and even if the values decrease to the values that adversely affect the reliability, they recover to the normal values again. When adopting a parameter having characteristics that can be used, RMIN = -10 ° C is adopted as the RMIN, and RMIN = -10 ° C is adopted.
Statistical value <RMIN
Or statistical information value ≤ RMIN
For example, when the condition that the temperature is out of the guaranteed operation is satisfied, the control tool 200 rewrites the boot loader 300, and when the computer system 1 is started from the next time onward, the emergency OS 100B is the main memory instead of the normal OS 100A. To be read by.

After booting, the emergency OS100B monitors the value of statistical information and monitors it.
When the value of statistical information ≥ RMIN + MIN margin or the value of statistical information> RMIN + MIN margin and the statistical information returns to the normal value again, by rewriting the boot loader 300, the next time the computer system 1 is started, an emergency The boot loader restoration process is executed so that the OS 100A is normally read into the main memory 6 instead of the OS 100B.

Although the MIN margin is a value of zero or more, it is desirable that the MIN margin is a value larger than zero in order to prevent the boot loader 300 from being frequently rewritten. When the statistical information is the current temperature or the minimum temperature, for example, MIN margin = 5 ° C. When SMART information is used for acquisition of statistical information and determination of conditions, Attribute Value and Threshold may be used, or Raw Value and RMIN may be used.

Next, the details of the operation of the control tool 200 in the end-of-life processing will be described. When returning from the abnormal state (life end state) to the normal state (health state), it is desirable that the boot loader 300 is restored to the boot loader before being rewritten by the life end end process by the boot loader restoration process described above. FIG. 59 shows the functional configuration of the computer system 1 before and after the boot loader restoration process. In the restoration boot loader area 16V of the NAND memory 16 of the SSD 2, boot loader restoration information 350 for returning the boot loader 300 to the state before rewriting by the control tool 200 is stored. The area 16V may be allocated by the control tool 200 at the end of life processing, may be allocated at startup of the control tool 200, or may be allocated when the control tool 200 is installed on SSD2. LBA is assigned to the allocated area 16V according to the management information 45 of SSD2 (see FIG. 18). Further, the area 16V of the present embodiment may be the same as the area 16V shown in FIG. 55 and may be used for restoring the boot loader at the time of backup, or may be different from the area 16V shown in FIG. 55. good.

The procedure for processing at the end of life is the same as that shown in FIG. That is, the control tool 200 writes the backup information of the boot loader 300, that is, the boot loader restoration information 350, to the restoration boot loader area 16V at the time of processing at the end of the life (step S320). As the information to be written in the area 16V, for example, the data (image) of the boot loader 300 stored in the area 16C may be copied as it is, or the rewrite difference information of the boot loader may be recorded. After that, the control tool 200 rewrites the boot loader 300 so that when the computer system 1 is started from the next time onward, the emergency OS 100B is read into the main memory 6 instead of the normal OS 100A (step S321).

Further, in order to facilitate the search for the restoration boot loader area 16V during the backup operation described later, it is desirable that the control tool 200 writes the head LBA of the restoration boot loader area 16V to the boot loader area 16C (step S322). ). It is not always necessary to write the head LBA of the boot loader area 16V for restoration in the boot loader area 16C, and a specific data pattern is written at the head of the area 16V, and the area is searched by searching this specific data pattern at the time of backup described later. 16V may be specified, or the area 16V may be specified by fixingly associating the area 16V with a predetermined specific LBA and accessing the specific LBA at the time of backup described later. Alternatively, the region 16V may be specified by other methods.

After step S321, the computer system 1 may be restarted as in the first embodiment, or the SSD2 refresh control command may be transmitted as in the fifth embodiment. Further, the restoration boot loader area 16V may be secured in a storage device other than SSD2.

FIG. 60 shows the boot loader restoration process by the emergency OS 100B. When the computer system 1 is started by using the emergency OS after the end of life processing (after the abnormal processing), the emergency OS 100B monitors the statistical information by using, for example, SMART READ DATA described above, and the statistical information. Determines whether or not has returned to a normal value (step S340). When the statistical information returns to the normal value based on the above-mentioned judgment criteria (step S340: Yes), the emergency OS 100B is subjected to the boot loader restoration information 350 stored in the restoration boot loader area 16V and the boot loader stored in the boot loader area 16C. Based on the data of 300, a boot loader for processing so that the OS 100A is normally loaded into the area 6A of the main memory 6 is created, and the created boot loader is written to the boot loader area 16C (step S341). As a result, when the boot loader 300 is loaded at the time of starting the computer system 1 from the next time onward, the OS 100A is normally loaded into the area 6A of the main memory 6.

When the data (image) of the boot loader 300 stored in the area 16C is copied to the restoration boot loader area 16V as it is in the boot loader backup process in step S320 of FIG. 56, the restoration is performed in step S341 of FIG. The boot loader restoration information 350 of the boot loader area 16V may be copied as it is to the area 150C of the backup storage device 150.

Further, in the boot loader backup process in step S320 of FIG. 56, when the rewrite difference information of the boot loader area 16C is recorded in the restoration boot loader area 16V, that is, the boot loader area 16C is rewritten from the old boot loader data to the new boot loader data. When the difference information of rewriting the new and old boot loader data at the time is recorded in the boot loader area 16V for restoration, the emergency OS 100B sets the data (new boot loader data) of the boot loader area 16C and the restoration in step S341 of FIG. 60. The boot loader restoration information 350, which is the difference data stored in the boot loader area 16V, is read into the main memory 6, the new boot loader data is restored to the old boot loader data based on the boot loader restoration information 350, and the restored old boot loader data is used for backup. Write to the area 150C of the storage device 150.

As described above, in the present embodiment, as shown in FIG. 61, when the statistical information changes from the normal state to the abnormal state, the abnormal time arrival process that operates so that the abnormal time OS is started is executed, and the statistical information is obtained. When the abnormal state returns to the normal state, the boot loader restoration process that operates so that the OS is normally started is executed.

In this way, even if the SSD 2 is temporarily in an abnormal state, after the SSD 2 returns to the normal state (health state), the computer system 1 starts the OS in the normal state, and the user Can handle SSD2 in the same way as before processing at the end of its life without performing extra settings or reinstalling the OS at normal times.

Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other embodiments, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are also included in the scope of the invention described in the claims and the equivalent scope thereof.

1 Computer system, 3 Host device, 6 Main memory, 16 NAND memory, 20 Non-volatile storage device, 100A Normal OS, 100B Emergency OS, 200 Control tool, 210 Emergency tool, 300 Bootloader, 350 Bootloader restore information.

Claims (8)

A non-volatile semiconductor memory having a memory cell for storing data and having a plurality of the memory cells as a first unit and capable of electrically erasing the data recorded in the memory cell, a volatile semiconductor memory, and the above. A non-volatile semiconductor memory, a controller circuit for controlling the volatile semiconductor memory, an interface circuit, and the like.
With a semiconductor storage device
A host device that can be connected to the semiconductor storage device and is configured to transmit write and read commands to the semiconductor storage device.
It is an information processing device equipped with
At least one of the non-volatile semiconductor memory and the volatile semiconductor memory is the first information that specifies the physical address of the non-volatile semiconductor memory corresponding to the logical address information received from the host device via the interface circuit. Is configured to be recordable,
When the controller circuit receives a write instruction from the host device via the interface circuit, the controller circuit generates a correction code using the data received from the host device, and the data and the data are stored in the non-volatile semiconductor memory. When the correction code is recorded and the read command is received from the host device via the interface circuit, the data read from the non-volatile semiconductor memory using the first information and the corresponding correction code are used. The read data is configured to be correctable.
The non-volatile semiconductor memory is
Second information based on the total usage time of the semiconductor storage device,
Third information based on the total amount of write data received in response to the write instruction received from the host device, and
Fourth information based on the total amount of data read from the non-volatile semiconductor memory in response to the read instruction received from the host device, and
Fifth information regarding the number of data that the controller circuit could not correct the data read from the non-volatile semiconductor memory even if the corresponding correction code was used, and
Among the non-volatile semiconductor memories, the sixth information showing information according to the number of memory cells determined to be unable to write data in the first unit, and
A first operating system and a second operating system that prohibits sending write commands to the semiconductor storage device are stored.
The host device is
The first operating system is read from the semiconductor storage device and executed.
A plurality of information including the second information to the sixth information is acquired from the semiconductor storage device, and the remaining life of the semiconductor storage device is calculated based on at least one of the acquired plurality of information, and the calculation is performed. The remaining life is configured to be displayable on the display device connected to the host device.
A threshold value corresponding to each of the plurality of information is acquired from the semiconductor storage device, and the remaining life is calculated based on the threshold value corresponding to at least one of the acquired plurality of information.
When it is determined that the semiconductor storage device has reached the end of its life based on the calculated remaining life, the user is informed that the second operating system will be started the next time the information processing device is started. An information processing device configured to notify and read the second operating system from the semiconductor storage device and start the second operating system. The information processing device according to claim 1, wherein the host device determines that the semiconductor storage device has reached the end of its life when the remaining life is less than a predetermined value. When the semiconductor storage device stores a boot loader for booting the first operating system and the host device determines that the semiconductor storage device has reached the end of its life, the second operating system is started. The information processing apparatus according to claim 1 or 2, wherein the boot loader is rewritten so as to be performed. The invention according to any one of claims 1 to 3, wherein the host device backs up data stored in the non-volatile storage device to a backup storage device that can be connected to the host device. Information processing equipment. A first aspect of the present invention, wherein the host device transmits a command for prohibiting write processing in the background to the non-volatile storage device when it is determined that the semiconductor storage device has reached the end of its life. The information processing device according to any one of claims 4. The information processing according to any one of claims 1 to 5, wherein the host device displays a warning screen on the display device when it is determined that the semiconductor storage device has reached the end of its life. Device. The information processing device according to claim 6, wherein the warning screen includes a message prompting the backup of data stored in the semiconductor storage device. The information processing device according to any one of claims 1 to 7, wherein each of the second to fifth information has an attribute ID.

Images