JP7362863B2 - information processing equipment - Google Patents

Description

Embodiments of the present invention relate to an information processing device.

2. Description of the Related Art SSDs (Solid State Drives) equipped with nonvolatile semiconductor memory such as NAND flash memory are attracting attention as external storage devices used in computer systems. Flash memory has advantages over magnetic disk devices, such as high speed and light weight. Inside the SSD, there are multiple flash memory chips, a controller that performs read/write control of each flash memory chip in response to requests from the host device, and a buffer that transfers data between each flash memory chip and the host device. It is equipped with memory, a power supply circuit, a connection interface to the host device, etc.

Japanese Patent Application Publication No. 2009-217603 Japanese Patent Application Publication No. 2008-090539 Japanese Patent Application Publication No. 2002-351621 Japanese Patent Application Publication No. 2006-18848 Japanese Patent Application Publication No. 07-78102 Japanese Patent Application Publication No. 2004-151785 Japanese Patent Application Publication No. 2005-190075 Japanese Patent Application Publication No. 2008-90539 Japanese Patent Application Publication No. 2001-75813 Patent No. 4489127 Patent No. 4635092

ATA/ATAPI Command Set - 2 (ACS-2) d2015r6 Feb.22.2011http://www.t13.org/Documents/UploadedDocuments/docs2011/d2015r6-ATAATAPI_Command_Set_-_2_ACS-2.pdf ・Pages 73 to 74, Pages 290 to 306: SELF-MONITORING, ANALYSIS, AND REPORTING TECHNOLOGY (SMART) ・Pages 98 to 99, 50: Data Set Management Command (Trim Command) ・Pages 342 to 365: SCT Command Transport CrystalDiskInfo manual (software to monitor the health status of non-volatile storage devices using SMART information) http://crystalmark.info/software/CrystalDiskInfo/manual-ja/http://crystalmark.info/software/CrystalDiskInfo/manual-en/ Smartmontools (software that monitors the health status of non-volatile storage devices using SMART information) http://sourceforge.net/apps/trac/smartmontools/wiki Samsung SSD Magician USER GUIDEhttp://www.samsungssd.com/faq Intel Solid State Drive Toolboxhttp://downloadcenter.intel.com/Detail_Desc.aspx?lang=jpn&DwnldID=18455http://downloadcenter.intel.com/Detail_Desc.aspx?lang=eng &DwnldId=18455 S.M.A.R.T. attributes meaninghttp://www.ariolic.com/activesmart/smart-attributes/ S.M.A.R.T. attributes meaninghttp://www.siguardian.com/products/siguardian/on_line_help/s_m_a_r_t_attribute_meaning.html Self-Monitoring, Analysis and Reporting Technology :: Attributeshttp://smartlinux.sourceforge.net/smart/attributes.php Serial ATA International Organization: Serial ATA Revision 3.1RC Clean DRAFT 2010.09.29 Pages 554-558 13.9 Phy Event Counters (Optional)

One embodiment of the present invention is to construct a system so as not to perform a write operation on the nonvolatile storage device when the nonvolatile storage device approaches the end of its life, to prevent further reliability deterioration of the nonvolatile storage device, An object of the present invention is to provide an information processing device that prevents data destruction in a nonvolatile storage device.

In order to achieve the above object, an information processing device according to an embodiment includes a nonvolatile semiconductor memory, a volatile semiconductor memory, a controller circuit for controlling the nonvolatile semiconductor memory and the volatile semiconductor memory, and an interface. and a host device that is connectable to the semiconductor memory device and configured to send write and read commands to the semiconductor memory device. The nonvolatile semiconductor memory includes memory cells for storing data, and can electrically erase data recorded in the memory cells using a plurality of the memory cells as a first unit. At least one of the nonvolatile semiconductor memory and the volatile semiconductor memory includes first information specifying a physical address of the nonvolatile semiconductor memory corresponding to logical address information received from the host device via the interface circuit. is configured so that it can be recorded. When the controller circuit receives a write command from the host device via the interface circuit, the controller circuit generates a correction code using the data received from the host device, and stores the data and the data in the nonvolatile semiconductor memory. When a correction code is recorded and a read command is received from the host device via the interface circuit, the data read from the nonvolatile semiconductor memory using the first information and the corresponding correction code are read. Accordingly, the read data can be corrected. The nonvolatile semiconductor memory is configured to store second information, third information, fourth information, fifth information, and sixth information. The second information is based on the total usage time of the semiconductor storage device. The third information is based on the total amount of write data received in response to the write command received from the host device. The fourth information is based on the total amount of data read from the nonvolatile semiconductor memory in response to a read command received from the host device. The fifth information relates to the number of pieces of data that could not be corrected even when the controller circuit used the corresponding correction code to read the data from the nonvolatile semiconductor memory. The sixth information is information indicating, in the first unit, information corresponding to the number of memory cells in the nonvolatile semiconductor memory that are determined to be unable to write data. The nonvolatile semiconductor memory stores first software and second software that prohibits sending a write command to the semiconductor storage device. The host device is configured to read and execute the first software from the semiconductor storage device. The host device acquires a plurality of information including the second information to the sixth information from the semiconductor storage device, and calculates the remaining life of the semiconductor storage device based on at least one of the acquired information. configured to do so. The host device reads the second software from the semiconductor storage device and executes the second software when determining that the semiconductor storage device has reached the end of its life based on the calculated remaining life. It is composed of

FIG. 1 is a block diagram showing an example of the functional configuration of a computer system according to the first embodiment. FIG. 2 is a block diagram illustrating an example of a functional configuration of a computer system when a control tool is stored in an SSD. FIG. 3 is a block diagram showing an example of the functional configuration of a computer system when the control tool is stored in another external storage device. FIG. 4 is a block diagram showing an example of the functional configuration of a computer system when a control tool is installed from the web. FIG. 5 is a block diagram showing an example of the functional configuration of a computer system when a control tool is installed from an optical drive. FIG. 6 is a block diagram showing an example of a functional configuration of a computer system when a control tool is installed from a USB memory. FIG. 7 is a block diagram showing an example of the functional configuration of a computer system when a normal OS and an emergency OS are stored in an SSD. FIG. 8 is a block diagram illustrating an example of a functional configuration of a computer system in which a normal OS and an emergency OS are stored in a nonvolatile storage device other than an SSD with degraded reliability. FIG. 9 is a block diagram showing an example of the functional configuration of a computer system when an emergency OS is installed from a storage medium on the web. FIG. 10 is a block diagram showing an example of the functional configuration of a computer system when an emergency OS is installed from an optical drive. FIG. 11 is a block diagram showing an example of the functional configuration of a computer system when an emergency OS is installed from a USB memory. FIG. 12 is a block diagram showing an example of a hierarchical functional configuration of a host. FIG. 13 is a diagram showing the external configuration of the computer system. FIG. 14 is a diagram showing another external configuration of the computer system. FIG. 15 is a block diagram showing an example of the internal configuration of a NAND memory chip. FIG. 16 is a circuit diagram showing a configuration example of one plane included in a NAND memory chip. FIG. 17 is a diagram showing the threshold distribution in the four-value data storage method. FIG. 18 is a functional block diagram showing an example of the internal configuration of the SSD. FIG. 19 is a diagram showing management information of the SSD. FIG. 20 is a diagram showing the relationship between LBA and SSD management units. FIG. 21 is a flowchart showing a procedure for specifying a physical address from an LBA. FIG. 22 is a flowchart illustrating an example of a read operation of the SSD. FIG. 23 is a flowchart illustrating an example of a read operation of the SSD. FIG. 24 is a flowchart illustrating an example of write operation of the SSD. FIG. 25 is a flowchart illustrating an example of write operation of the SSD. FIG. 26 is a flowchart illustrating an example of the operation of organizing the NAND memory of the SSD. FIG. 27 is a flowchart illustrating an example of the operation of the SSD when a deletion notification is received. FIG. 28 is a flowchart showing an example of the operation when an error occurs in the SSD. FIG. 29 is a flowchart showing the operation procedure of the control tool. FIG. 30 is a diagram showing an example of a management table for statistical information X01 to X19, X23, and X24. FIG. 31 is a graph showing the relationship between the raw value of statistical information and the defective rate of SSD. FIG. 32 is a flowchart showing another operation procedure of the control tool. FIG. 33 is a flowchart showing another operation procedure of the control tool. FIG. 34 is a flowchart showing the process when the control tool reaches its lifespan. FIG. 35 is a flowchart showing another process when the control tool reaches its lifespan. FIG. 36 is a flowchart showing another process when the control tool reaches its lifespan. FIG. 37 is a flowchart showing the operating procedure when starting up the computer system. FIG. 38 is a diagram showing the configuration of a host when the emergency OS is equipped with a backup function. FIG. 39 is a flowchart showing an operation procedure including a backup operation when the computer system is started. FIG. 40 is a diagram showing the storage contents of the NAND memory and the storage contents of the file management table. FIG. 41 is a diagram showing an example of the functional configuration of a computer system when a USB storage is used as a backup storage device. FIG. 42 is a diagram showing an example of the functional configuration of a computer system when an optical storage medium is used as a backup storage device. FIG. 43 is a diagram showing an example of the functional configuration of a computer system when a storage server is used as a backup storage device. FIG. 44 is a diagram showing the concept of data movement when creating an emergency boot disk. FIG. 45 is a flowchart showing the operational procedure when creating an emergency boot disk. FIG. 46 is a diagram showing the concept of data movement when creating an emergency boot disk including emergency tools. FIG. 47 is a flowchart showing the operational procedure when creating an emergency boot disk containing emergency tools. FIG. 48 is a diagram showing an example of a screen that guides the user to backup processing. FIG. 49 is a flowchart showing another operation procedure of the control tool. FIG. 50 is a flowchart showing another operation procedure when starting up the computer system. FIG. 51 is a diagram showing an example of time-series data of statistical information. FIG. 52 is a diagram showing changes in statistical information over time. FIG. 53 is a diagram conceptually illustrating a process for calculating a predicted lifespan based on changes in statistical information over time. FIG. 54 is a diagram illustrating an example of a guidance screen to the user when the SSD reaches the end of its life span. FIG. 55 is a block diagram showing an example of the functional configuration of a computer system when performing boot loader restoration processing. FIG. 56 is a flowchart illustrating the operating procedure of the boot loader restoration process when the lifespan is reached. FIG. 57 is a diagram showing a boot loader rewrite difference log. FIG. 58 is a flowchart showing the backup operation procedure by the emergency OS. FIG. 59 is a block diagram showing an example of the functional configuration of a computer system when performing boot loader restoration processing. FIG. 60 is a flowchart showing the operation procedure of boot loader restoration processing by the emergency OS. FIG. 61 is a flowchart showing the overall operating procedure of the eighth embodiment.

Non-volatile semiconductor memories include those such as NAND flash memory, which erase data once in blocks and then write data, and those that write/read in page units. /Some devices have fixed units of writing/reading. On the other hand, a unit in which a host device such as a personal computer writes/reads data to/from a secondary storage device such as a hard disk is called a sector. A sector is defined independently of the erase/write/read unit of a semiconductor memory device. For example, the erase/write/read unit of a nonvolatile semiconductor memory may be larger than the write/read unit of a host device.

In addition, when configuring the secondary storage device of a personal computer using flash memory, there may be blocks that cannot be used as storage areas due to many errors (bad blocks, bad blocks), or areas that cannot be read (bad areas). etc. may occur. If the number of such bad blocks or bad areas exceeds the upper limit, new bad blocks or bad areas cannot be registered, so the data stored in the buffer memory (cache memory) and write requests are It is not possible to guarantee that both of the original data will be written to the flash memory. Therefore, when the number of defective blocks or the number of defective areas exceeds a predetermined value, there is a problem in that data writing suddenly becomes impossible even though there is free space in the flash memory.

As a solution to this problem, the number of bad clusters and bad blocks generated in the NAND flash memory is managed, and data writing from the host device to the NAND flash memory is controlled according to the number of bad clusters and bad blocks. There is a way to switch the operating mode. A cluster is a management unit as a logical address in an SSD. The cluster size is a natural number multiple of 2 or more than the sector size, and the cluster address is made up of a bit string starting from a predetermined bit of the LBA.

In this method, the operation mode of the SSD is divided into the following three modes, for example.

- WB mode (Write Back Mode): A normal operation mode in which data is written once in the cache memory and then flushed out to the NAND flash memory based on predetermined conditions.

- WT mode: (Write Through Mode): An operation mode in which data written to the cache memory with a single write request is written to the NAND flash memory each time. By writing to the NAND flash memory each time, the data written by the host is guaranteed as much as possible. The SSD transitions to the WT mode when the number of remaining entries in the bad cluster table or the bad block table becomes a predetermined number or less.

- RO mode (Read Only Mode): A mode that prohibits all processing that involves writing to the NAND flash memory. By returning an error to all write requests from the host and preventing writing, the data that has already been written by the host can be guaranteed as much as possible when the SSD approaches the end of its lifespan. The SSD transitions to the RO mode when the number of remaining entries in the bad cluster table or bad block table becomes less than or equal to a predetermined number, or when there is a shortage of free blocks.

In the WB mode and the WT mode, the SSD receives and processes both read requests and write requests from the host. On the other hand, in the RO mode, the SSD accepts and processes read requests from the host, but does not process write requests from the host and returns an error.

When an SSD is connected to a host equipped with an operating system (OS) such as Windows (registered trademark), the host sends a write request to the SSD, and when the write request is successfully processed, the host Recognize the SSD as a usable external storage device.

On the other hand, when the SSD that has transitioned to RO mode is connected to a host running Windows (registered trademark) and the host sends a write request to the SSD, the SSD returns an error to the host, so the host It may not be recognized as an available external storage device. Therefore, even if an SSD in RO mode that allows reading is connected to a host, there is a possibility that previously recorded data cannot be read from the SSD.

In this way, when the SSD reaches the end of its lifespan, or when the SSD approaches the end of its lifespan, writing to the SSD should be prohibited. However, in a normal operating system (OS) installed in a computer system, writing to the SSD occurs at boot time, and writing to the SSD that is not intended by the user occurs in the background. For this reason, when the SSD reaches the end of its lifespan, or when the SSD approaches the end of its lifespan, the reliability of the SSD will further deteriorate under conditions where a normal OS is installed in the computer system. may be destroyed.

Therefore, in this embodiment, when it is determined that the SSD has reached the end of its lifespan, when the boot loader is rewritten and the system is restarted, for example, an emergency OS is started as emergency software that does not write to the SSD 2. This prevents deterioration in the reliability of the SSD and prevents data that has already been written from being destroyed. The emergency OS is one that only performs read operations on the SSD at boot time and does not write to the SSD in the background that is not intended by the user.

DESCRIPTION OF THE PREFERRED EMBODIMENTS Information processing apparatuses according to embodiments will be described in detail below with reference to the accompanying drawings. Note that the present invention is not limited to these embodiments.

(First embodiment)
FIG. 1 shows the configuration of a first embodiment of a computer system. The computer system 1 includes an SSD 2 as a nonvolatile storage device, a host device 3, and a memory interface 19 connecting the SSD 2 and the host device 3. In this embodiment, an SSD (Solid State Drive) is used as the nonvolatile storage device, but other devices such as a hard disk drive, hybrid disk drive, SD card, USB memory, and NAND flash memory directly mounted on the motherboard are also available. It may also be a non-volatile storage device. Further, in this embodiment, an ATA (Advanced Technology Attachment) interface is used as the interface 19, but other interfaces such as USB (Universal Serial Bus), SAS (Serial Attached SCSI), Thunderbolt (registered trademark), or PCI Express may also be used. You can. A CPU (control circuit) 4 is a central processing unit in the host device 3, and various calculations and controls in the host device 3 are performed by the CPU 4. The CPU 4 controls the SSD 2 and an optical drive 10 such as a DVD-ROM via the south bridge 7. The CPU 4 controls the main memory 6 via the north bridge 5. As the main memory 6, for example, a DRAM may be used.

A user controls the host device 3 through input devices such as a keyboard 14 and a mouse 15, and signals from the keyboard 14 and mouse 15 are processed by the CPU 4 via a USB (Universal Serial Bus) controller 13 and a south bridge 7. Ru. The CPU 4 sends image data, text data, etc. to the display (display device) 9 via the north bridge 5 and display controller 8. The user can view image data, text data, etc. from the host device 3 via the display 9.

The CPU 4 is a processor provided to control the operation of the computer system 1, and executes an operating system (OS) 100 loaded into the main memory 6 from the SSD 2. Further, when the optical drive 10 enables execution of at least one of a read process and a write process on the loaded optical disc, the CPU 4 executes those processes. The CPU 4 also executes a system BIOS stored in a BIOS (Basic Input/Output System)-ROM 11. Note that the system BIOS is a program for controlling hardware within the computer system 1. In addition, the CPU 4 controls a LAN (Local Area Network) controller 12 via the south bridge 7.

The north bridge 5 is a bridge device connected to the local bus of the CPU 4. The north bridge 5 also has a built-in memory controller that controls access to the main memory 6. The north bridge 5 also has a function of communicating with the display controller 8.

The main memory 6 temporarily stores programs and data and functions as a working memory for the CPU 4. The main memory 6 includes a storage area 6A that stores the OS 100 and a storage area 6B that stores the control tool 200. As is generally known, the OS manages the input/output devices of the host device 3, manages disks and memory, and performs controls to enable software to use the hardware of the host device 3. , is a program that manages the entire host device 3.

Display controller 8 is a video playback controller that controls display 9 of computer system 1 . The south bridge 7 is a bridge device connected to the local bus of the CPU 4. The south bridge 7 controls the SSD 2, which is a storage device that stores various software and data, via the ATA interface 19.

The computer system 1 accesses the SSD 2 in units of logical sectors. A write command (write request), a read command (read request), a flash command, etc. are input to the SSD 2 via the ATA interface 19.

The south bridge 7 also has a function for controlling access to the BIOS-ROM 11, optical drive 10, LAN controller 12, and USB controller 13. A keyboard 14 and a mouse 15 are connected to the USB controller 13.

For example, as shown in FIG. 2, the control tool 200 is stored in the area 16B of the NAND flash memory (NAND memory) 16 of the SSD 2 when the host device 3 is powered off; At startup or program startup, it is loaded from area 16B of NAND memory 16 to area 6B on main memory 6. On the other hand, when multiple non-volatile storage devices are connected to the host 3, the SSD control tool 200 is stored in the area 20B of the non-volatile storage device 20 separate from the SSD 2, as shown in FIG. , it may be loaded from the area 20B to the area 6B on the main memory 6 when the host device 3 or the program is started. In particular, when the nonvolatile storage device 20 is used as a system drive for storing an OS and the SSD 2 is used as a data drive for storing user data such as documents, still image data, and video data, the system drive 20 is used as a drive to mainly store the OS and application programs, and data drive 2 is used as a drive to store user data. Preferably, the control tools are stored in non-volatile storage 20.

From the viewpoint of saving the user's effort in setting up the control tool 200, the computer system 1 may be shipped with the control tool 200 stored in the SSD 2 or the non-volatile storage device 20, as shown in FIGS. 2 and 3, for example. , it is desirable that it be on store shelves and in the hands of users. On the other hand, from the viewpoint of allowing the user to select whether or not to install the control tool, and from the viewpoint of providing the user with the latest control tool, the control tool 200 can be downloaded from the web, or from a DVD-ROM or It is desirable to be able to store it in the SSD 2 or nonvolatile storage device 20 by installing it from an external storage medium such as a USB memory.

FIG. 4 is an example of downloading from the WEB. The control tool 200 is stored in an area 22B of the storage medium 22 in the WEB server 21, and the control tool 200 is connected to the NAND of the SSD 2 via a network such as the Internet, a local network, or a wireless LAN, for example via the LAN controller 12. It is downloaded (or installed) to area 16B on memory 16. In the case of FIG. 3, the control tool 200 is downloaded or installed in the area 20B on the nonvolatile storage device 20.

FIG. 5 shows an example of installation from optical media such as DVD-ROM and CD-ROM. The control tool 200 is stored in an optical medium 23 such as a DVD-ROM or CD-ROM, and when the optical medium 23 is set in the optical drive 10, the control tool 200 is stored in the NAND memory of the SSD 2 via the optical drive 10. It is installed in area 16B (or area 20B) on 16. FIG. 6 is an example of installation from a USB memory. The control tool 200 is stored in the area 24B of the USB memory 24, and when the USB memory 24 is connected to the USB controller 13, the control tool 200 is stored in the area 16B ( or area 20B). Of course, instead of the USB memory 24, other external memory such as an SD card may be used. From the viewpoint of ease of acquisition by users, it is desirable that the optical media 23 and the USB memory 24 be packaged and sold together with the SSD 2 as accessories when the SSD 2 is shipped. On the other hand, the optical media 23 and the USB memory 24 may be sold alone as software products, or may be attached as supplements to magazines or books.

In this embodiment, there are two types of OS 100: a normal OS (first operating system) 100A and an emergency OS (second operating system) 100B. The normal OS 100A is an operating system used when the reliability of the SSD 2 has not deteriorated. As described above, during normal operation, the OS writes to the SSD at boot time, and also writes to the SSD that are not intended by the user in the background. Normally, the OS 100A is stored in the area 16D of the NAND memory 16 when the host device 3 is powered off, as shown in FIG. The emergency OS 100B is an operating system used when the reliability of the SSD 2 deteriorates, and does not write to the SSD 2 (writing is not supported). That is, the emergency OS only performs read operations on the SSD at boot time, and does not write to the SSD in the background, which is not intended by the user. Note that the emergency OS 100B may be able to write to nonvolatile storage devices other than the SSD 2 when reliability has deteriorated. In addition, if it is necessary to write some data such as system information of the emergency OS to the SSD 2, the emergency OS 100B may allow writing of the data to the SSD 2 as an exception. It is desirable that this is sufficiently small compared to the capacity of the NAND memory 16. More preferably, in order to prevent the user from accidentally sending a write command and writing data to the SSD 2, the emergency OS 100B prohibits normal write commands to the SSD 2, and prevents the user from writing data to the SSD 2. However, if it is necessary to write data exceptionally, allow writing to the SSD2 only by using special commands, such as SCT Command Transport described in INCITS ACS-2 or other vendor-specific commands. It is desirable to do so.

As shown in FIG. 7, the emergency OS 100B is stored in the area 16E of the NAND memory 16 when the host device 3 is powered off. Since the emergency OS 100B is not used when the SSD 2 is in a normal state, in order to prevent the emergency OS data from being destroyed in the area 16E, the area 16E is set so that it cannot be rewritten from the host device 3 when the OS is normally used. It is desirable to be present. For example, during normal operation of the OS 100A, it is desirable that no LBA is assigned to the area 16E in the management information of the SSD 2, which will be described later. Assigned. Alternatively, when the normal OS 100A is operating, it is desirable that the area 16E is write-protected by the normal OS 100A.

From the viewpoint of reducing accesses to the SSD 2 as much as possible when the reliability of the SSD 2 is degraded, it is desirable that the amount of data in the area 16E where the emergency OS 100B is stored is significantly smaller than the capacity of the NAND memory 16. As the emergency OS 100B, for example, an OS such as MS-DOS (trademark) or Linux that has been customized to prohibit writing to the SSD 2 or has a backup function for the SSD 2 added may be adopted. , software independently developed for SSD2 may be used.

When the computer system 1 is started, such as when the power of the computer system 1 is turned on or the OS is restarted, the host device 3 reads the boot loader 300 written in the area 16C of the NAND memory 16, and executes the boot loader. Based on the information 300, it is determined which of the normal OS 100A and the emergency OS 100B will be loaded into the area 6A of the host device 3. To this end, the boot loader 300 is made to hold OS pointer information OSPT indicating the LBA of the OS to be read. When reading the boot loader 300, the host device 3 may read the data starting from the LBA indicated by the OS pointer information OSPT, and write the read data to the area 6A on the main memory 6. In the initial state, the boot loader 300 is configured to normally load the OS 100A. After the reliability of the SSD 2 deteriorates, the control tool 200 stored in the area 6B on the main memory 6 rewrites the bootloader 300 stored in the area 16C on the NAND memory 16, and writes the bootloader to read the emergency OS 100B. Rebuild 300. As the boot loader 300, for example, a master boot record (MBR) or a GUID partition table (GPT) may be used.

When a plurality of nonvolatile storage devices are connected to the host device 3, the OS may be stored in the nonvolatile storage device 20 different from the SSD 2. For example, as shown in FIG. 8, both the normal OS and the emergency OS may be stored in the non-volatile storage device 20, or the normal OS is stored in the SSD 2 and the emergency OS is stored in the non-volatile storage device. Alternatively, the normal OS may be stored in the nonvolatile storage device 20 and the emergency OS may be stored in the SSD 2. In particular, when the nonvolatile storage device 20 is used as a system drive for storing an OS and the SSD 2 is used as a data drive for storing user data such as documents, still image data, and video data, the system drive 20 is used as a drive to mainly store the OS and application programs, and data drive 2 is used as a drive to store user data. It is desirable that a normal OS is stored in the nonvolatile storage device 20, and more preferably, an emergency OS is also stored in the nonvolatile storage device 20 as a system drive.

From the perspective of saving the user's effort in setting up the emergency OS, the computer system 1 may be shipped with the emergency OS stored in the SSD 2 or the non-volatile storage device 20, as shown in FIGS. 7 and 8, for example. , it is desirable that it be on store shelves and in the hands of users. On the other hand, from the perspective of allowing the user to choose whether or not to install the emergency OS, and from the perspective of providing the latest emergency OS to the user, the emergency OS can be downloaded from the web or from a DVD-ROM. It is desirable to be able to store it in the SSD 2 or nonvolatile storage device 20 by installing it from an external storage medium such as a ROM or USB memory.

FIG. 9 is an example of downloading from the WEB. The emergency OS is stored in the area 22E of the storage medium 22 in the WEB server 21, and the emergency OS is connected to the NAND of the SSD 2 via a network such as the Internet, a local network, or a wireless LAN, for example, via the LAN controller 12. It is downloaded or installed in area 16E on memory 16. In the case of FIG. 8, the program is downloaded or installed in the area 20E on the nonvolatile storage device 20.

FIG. 10 is an example of installation from optical media such as DVD-ROM or CD-ROM. The emergency OS is stored in the area 23E of the optical media 23 such as a DVD-ROM or CD-ROM, and when the optical media 23 is set in the optical drive 10, the emergency OS is stored in the SSD 2 via the optical drive 10. is installed in area 16E (or area 20E) on NAND memory 16. FIG. 11 is an example of installation from a USB memory. The emergency OS is stored in the area 24E of the USB memory 24, and when the USB memory 24 is connected to the USB controller 13, the emergency OS is stored in the area 16E ( or area 20E). Of course, instead of the USB memory 24, other external memory such as an SD card may be used. From the viewpoint of ease of acquisition by users, it is desirable that the optical media 23 and the USB memory 24 be packaged and sold together with the SSD 2 as accessories when the SSD 2 is shipped. On the other hand, the optical media 23 and the USB memory 24 may be sold alone as software products, or may be attached as supplements to magazines or books. From the viewpoint of ease of installation, it is desirable that the emergency OS and control tools are stored in the same external memory, such as the optical medium 23 or the USB memory 24.

FIG. 12 shows the hierarchical structure of the computer system 1 at the software level. The control tool 200 and other software (software other than the control tool 200) loaded on the main memory 6 usually do not communicate directly with the SSD 2, but communicate with the SSD 2 via the OS 100 loaded on the main memory 6. . When the control tool 200 or other software needs to send a command such as a read request or a write request to the SSD 2, the control tool 200 or other software sends an access request in file units to the OS 100. The OS 100 refers to the file management table included in the OS 100, specifies the logical address (LBA) of the SSD 2 corresponding to the file for which access is requested, and sends a command unique to the interface including the corresponding LBA to the SSD 2. When a response is returned from the SSD 2, the OS 100 specifies to which software the converted response specific to the interface corresponds, and returns a response to the specified software.

Next, a configuration example of the computer system 1 will be explained. The computer system 1 can be implemented as, for example, a desktop computer or a notebook-type portable computer. FIG. 13 is a schematic diagram of a desktop computer as the computer system 1. The desktop computer includes a computer main body 31, a display 9, a keyboard 14, a mouse 15, and the like. The computer main body 31 includes a motherboard 30 on which major hardware is mounted, an SSD 2, a power supply device 32, and the like. The SSD 2 is physically connected to a motherboard 30 via a SATA cable, and is electrically connected to a CPU 4 also mounted on the motherboard via a south bridge 7 mounted on the motherboard 30. The power supply device 32 generates various kinds of power used in the desktop computer, and supplies power to the motherboard 30, SSD 2, etc. via a power cable.

FIG. 14 is a schematic diagram of a portable computer as the computer system 1. The portable computer includes a computer main body 34, a display unit 35, and the like. The display unit 35 incorporates a display device 9 configured of, for example, an LCD (Liquid Crystal Display). The display unit 35 is attached to the computer main body 34 so as to be freely rotatable between an open position where the top surface of the main body 34 is exposed and a closed position where the top surface of the main body 34 is covered. The main body 34 has a thin box-shaped casing, and a power switch 36, a keyboard 14, a touch pad 33, etc. are arranged on the top surface of the main body 34. Further, the main body 34 also includes an SSD 2, a motherboard, a power supply device, etc., like a desktop computer.

In addition to the computer system 1, the information processing device to which the present invention is applied may be an imaging device such as a still camera or a video camera, a tablet computer, a smartphone, a game device, a car navigation system, etc. Good too.

Next, the NAND memory 16, which is the main component of the SSD 2, will be explained. FIG. 15 shows an example of the internal configuration of a NAND memory chip 80 that constitutes the NAND memory 16. The NAND memory 16 includes one or more NAND memory chips 80. The NAND memory chip 80 has a memory cell array in which a plurality of memory cells are arranged in a matrix. Memory cell transistors constituting the memory cell array are composed of MOSFETs (Metal Oxide Semiconductor Field Effect Transistors) with a stacked gate structure formed on a semiconductor substrate. The stacked gate structure includes a charge storage layer (floating gate electrode) formed on a semiconductor substrate with a gate insulating film interposed therebetween, and a control gate electrode formed on the floating gate electrode with an inter-gate insulating film interposed therebetween. I'm here. A memory cell transistor has a threshold voltage that changes depending on the number of electrons stored in the floating gate electrode, and stores data depending on the difference in threshold voltage. In this embodiment, a case will be described in which each memory cell uses an upper page and a lower page to write in a 2-bit/cell quaternary storage method, but each memory cell uses a single page. 1 bit/cell binary storage writing method, 3 bit/cell 8-value storage writing method using upper page, middle page, and lower page, or 4 bit/cell or more The essence of the present invention does not change even when a multi-level storage writing method is adopted. In addition, memory cell transistors are not limited to structures with floating gate electrodes, but also include MONOS (Metal-Oxide-Nitride-Oxide-Silicon) types, which can adjust the threshold voltage by trapping electrons in the nitride interface as a charge storage layer. It may have a similar structure. Similarly, the MONOS type memory cell transistor may be configured to store one bit or may be configured to store multiple values. Furthermore, the nonvolatile storage medium may be a semiconductor storage medium in which memory cells are arranged three-dimensionally, as described in Japanese Patent Application Laid-open No. 2010-161199 and Japanese Patent Application Laid-Open No. 2011-29586.

As shown in FIG. 15, the NAND memory chip 80 includes a memory cell array 82 in which memory cells for storing data are arranged in a matrix. The memory cell array 82 includes a plurality of bit lines, a plurality of word lines, and a common source line, and electrically rewritable memory cells are arranged in a matrix at the intersections of the bit lines and word lines. A bit line control circuit 83 for controlling bit lines and a word line control circuit 85 for controlling word line voltage are connected to this memory cell array 82. That is, the bit line control circuit 83 reads data from the memory cells in the memory cell array 82 via the bit lines, and applies a write control voltage to the memory cells in the memory cell array 82 via the bit lines to write data to the memory cells. Write.

A column decoder 84, a data input/output buffer 89, and a data input/output terminal 88 are connected to the bit line control circuit 83. The memory cell data read from the memory cell array 82 is output to the outside from the data input/output terminal 88 via the bit line control circuit 83 and the data input/output buffer 89. Also, write data input from the outside to the data input/output terminal 88 is inputted to the bit line control circuit 83 by the column decoder 84 via the data input/output buffer 89, and is written to the designated memory cell. .

Furthermore, the memory cell array 82 , bit line control circuit 83 , column decoder 84 , data input/output buffer 89 , and word line control circuit 85 are connected to a control circuit 86 . The control circuit 86 controls the memory cell array 82 , the bit line control circuit 83 , the column decoder 84 , the data input/output buffer 89 , and the word line control circuit 85 in accordance with the control signal input to the control signal input terminal 87 . Generates signals and control voltages. The circuit portion of the NAND memory chip 80 other than the memory cell array 82 is called a NAND controller (NANDC) 81.

FIG. 16 shows the configuration of memory cell array 82 shown in FIG. 15. The memory cell array 82 is a NAND cell type memory cell array, and includes a plurality of NAND cells. One NAND cell is composed of a memory string MS consisting of memory cells connected in series, and selection gates S1 and S2 connected to both ends of the memory string MS. The selection gate S1 is connected to the bit line BL, and the selection gate S2 is connected to the source line SRC. The control gates of memory cells MC arranged in the same row are commonly connected to word lines WL0 to WLm-1. Further, the first selection gate S1 is commonly connected to the selection line SGD, and the second selection gate S2 is commonly connected to the selection line SGS.

Memory cell array 82 includes one or more planes, and each plane includes multiple blocks. Each block is composed of a plurality of NAND cells, and data is erased in units of this block.

Further, a plurality of memory cells connected to one word line constitute one physical sector. Data is written and read in each physical sector (this physical sector is unrelated to the LBA logical sector described later). In the case of a 2-bit/cell write method (four values), for example, two pages of data are stored in one physical sector. On the other hand, in the case of the 1 bit/cell write method (binary), for example, one page worth of data is stored in one physical sector, and in the case of the 3 bit/cell write method (eight values), for example, three pages of data are stored in one physical sector. Data is stored.

During a read operation, a program verify operation, and a program operation, one word line is selected and one physical sector is selected according to a physical address received from the SSDC 41, which will be described later. Page switching within this physical sector is performed using physical addresses. In this embodiment, the NAND memory 16 has a 2-bit/cell write method, and the SSDC 41 treats the physical sector as having two pages, an upper page and a lower page, allocated as physical pages, and A physical address is assigned to every page.

A 2-bit/cell 4-value NAND memory is configured so that the threshold voltage in one memory cell can have four distributions. FIG. 17 shows the 2-bit 4-value data (data “11”, “01”, “10”, “00”) stored in the memory cells of the 4-value NAND cell type flash memory and the threshold voltage distribution of the memory cells. It shows the relationship between In FIG. 17, V _A1 is the voltage applied to the selected word line when reading two data from a physical sector where only the lower page has been written and the upper page has not been written, and V _A1V is the voltage applied to the selected word line when reading two data. This shows the verify voltage that is applied to check whether the writing is completed when writing is performed.

Further, V _A2 , V _B2 , and V _C2 are voltages applied to the selected word line when reading four pieces of data for a physical sector in which a lower page and an upper page have been written, and V _A2V , V _B2V , V _C2V indicates a verify voltage applied to confirm whether writing is completed when writing to each threshold voltage distribution. Further, Vread1 and Vread2 indicate read voltages that are applied to unselected memory cells in the NAND cell when reading data, and make the unselected memory cells conductive regardless of the data held therein. Further, Vev1 and Vev2 are erase verify voltages that are applied to the memory cell to confirm whether the erasure is completed when erasing data in the memory cell, and have negative values. Its size is determined in consideration of the influence of interference between adjacent memory cells. The magnitude relationship of each voltage mentioned above is
Vev1<V _A1 <V _A1V <Vread1
Vev2<V _A2 <V _A2V <V _B2 <V _B2V <V _C2 <V _C2V <Vread2
It is.

Note that although the erase verify voltages Vev1, Vev2, and Vev3 are negative values as described above, the voltage actually applied to the control gate of the memory cell MC in the erase verify operation is not a negative value but a zero or positive value. It is a value. That is, in an actual erase verify operation, a positive voltage is applied to the back gate of the memory cell MC, and a voltage of zero or a positive value smaller than the back gate voltage is applied to the control gate of the memory cell MC. In other words, erase verify voltages Vev1, Vev2, and Vev3 are voltages that equivalently have negative values.

The upper limit value of the threshold voltage distribution ER of the memory cells after block erasure is also a negative value, and data "11" is assigned. Memory cells with data “11”, “01”, “10”, and “00” in the lower page and upper page write states have positive threshold voltage distributions ER2, A2, B2, and C2, respectively (A2, B2, (The lower limit value of C2 is also a positive value), the threshold voltage distribution A2 with data "01" has the lowest voltage value, the threshold voltage distribution C2 with data "00" has the highest voltage value, and the voltage of various threshold voltage distributions The values have a relationship of A2<B2<C2. A memory cell with data “10” in a lower page written state and an upper page unwritten state has a positive threshold voltage distribution A1 (the lower limit value of A1 is also a positive value). Note that the threshold voltage distribution shown in FIG. 17 is just an example, and the present invention is not limited thereto. For example, in FIG. 17, the explanation has been made assuming that the threshold voltage distributions A2, B2, and C2 are all positive threshold voltage distributions, but the threshold voltage distribution A2 is a negative voltage distribution, and the threshold voltage distributions B2 and C2 are positive voltage distributions. A case where the distribution is also included in the scope of the present invention. Furthermore, even if the threshold voltage distributions ER1 and ER2 are positive values, the present invention is not limited thereto. Furthermore, in this embodiment, the correspondence relationships between the data of ER2, A2, B2, and C2 are "11", "01", "10", and "00", respectively, but for example, "11" and "01" respectively , "00", and "10".

The 2-bit data of one memory cell consists of lower page data and upper page data, and the lower page data and upper page data are written to the memory cell by separate write operations, that is, by two write operations. When data is marked as "*@", * represents upper page data and @ represents lower page data.

First, writing of lower page data will be explained with reference to the first to second rows of FIG. 17. It is assumed that all memory cells have a threshold voltage distribution ER in the erased state and store data "11". As shown in FIG. 17, when lower page data is written, the threshold voltage distribution ER of the memory cell is divided into two threshold voltage distributions ( It is divided into ER1 and A1). When the value of the lower page data is "1", the threshold voltage distribution ER in the erased state is maintained, so ER1=ER, but ER1>ER may also be true.

On the other hand, if the value of the lower page data is "0", a high electric field is applied to the tunnel oxide film of the memory cell, electrons are injected into the floating gate electrode, and the threshold voltage Vth of the memory cell is increased by a predetermined amount. let Specifically, a verify potential V _A1V is set, and the write operation is repeated until a threshold voltage equal to or higher than this verify voltage V _A1V is reached. As a result, the memory cell changes to the write state (data "10"). If the threshold voltage is not reached even after repeating the write operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to a predetermined value), writing to the physical page results in a "write error."

Next, writing of upper page data will be explained with reference to the second to third rows in FIG. Writing of upper page data is performed based on write data (upper page data) input from outside the chip and lower page data already written in the memory cells.

That is, as shown in the second to third rows of FIG. 17, when the value of the upper page data is "1", a high electric field is not applied to the tunnel oxide film of the memory cell, and the threshold voltage of the memory cell is Prevents Vth from increasing. As a result, the memory cell with data "11" (threshold voltage distribution ER1 in the erased state) maintains the data "11" (ER2), and the memory cell with data "10" (threshold voltage distribution A1) maintains the data "11" as it is (ER2). 10” (B2). However, in order to ensure a voltage margin between each distribution, the lower limit value of the threshold voltage distribution is adjusted using a positive verify voltage _VB2V that is larger than the above-mentioned verify voltage _VA1V , thereby increasing the width of the threshold voltage distribution. It is desirable to form a threshold voltage distribution B2 in which the threshold voltage distribution B2 is narrowed. If the ground voltage is not reached even after repeating the lower limit value adjustment a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to a predetermined value), writing to the physical page will result in a "write error."

On the other hand, if the value of the upper page data is "0", a high electric field is applied to the tunnel oxide film of the memory cell, electrons are injected into the floating gate electrode, and the threshold voltage Vth of the memory cell is increased by a predetermined amount. let Specifically, verify potentials V _A2V and V _C2V are set, and the write operation is repeated until the verify voltage V _A1V or higher reaches a threshold voltage. As a result, the memory cell with data "11" (threshold voltage distribution ER1 in erased state) changes to data "01" with threshold voltage distribution A2, and the memory cell with data "10" (A1) changes to data "01" with threshold voltage distribution C2. The data changes to “00”. At this time, the verify voltages V _A2V and V _C2V are used to adjust the lower limit values of the threshold voltage distributions A2 and C2. If the ground voltage is not reached even after repeating the write operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to a predetermined value), writing to the physical page results in a "write error."

On the other hand, in the erase operation, an erase verify potential Vev is set, and the erase operation is repeated until the threshold voltage is equal to or lower than the verify voltage Vev. As a result, the memory cell changes to the write state (data "00"). If the ground voltage is not reached even after repeating the erase operation a predetermined number of times (or if the number of memory cells that do not reach the threshold voltage is greater than or equal to a predetermined value), erasing the physical page results in an "erase error."

The above is an example of a data writing method in a general four-value storage method. Even in the case of a multi-bit storage system of 3 bits or more, the basic operation is the same, since the above operation only requires the addition of an operation of dividing the threshold voltage distribution into 8 or more ways according to higher-order page data.

Next, a configuration example of the SSD 2 will be explained. As shown in FIG. 18, the SSD 2 includes a NAND flash memory (hereinafter referred to as NAND memory) 16 as a nonvolatile semiconductor memory, and an interface controller (IFC) that transmits and receives signals to and from the host device 3 via an ATA interface 19. ) 42, a RAM (Random Access Memory) 40 as a semiconductor memory having a cache memory (CM) 46 functioning as an intermediate buffer between the interface controller 42 and the NAND memory 16, and management and control of the NAND memory 16 and the RAM 40. It includes an SSD controller (SSDC) 41 that controls the interface controller 42, and a bus 43 that connects these components.

As the RAM 40, DRAM (Dynamic Random Access Memory), SRAM (Static Random Access Memory), FeRAM (Ferroelectric Random Access Memory), MRAM (Magnetoresistive Random Access Memory), PRAM (Phase Change Random Access Memory), etc. can be adopted. can. RAM40 may be included in SSDC41.

The NAND memory 16 is composed of a plurality of NAND memory chips 80, and stores user data designated by the host device 3, stores a management table for managing user data, and backs up management information managed in the RAM 40. or memorize it. The NAND memory 16 has a memory cell array 82 in which a plurality of memory cells are arranged in a matrix, and each memory cell can perform multi-level storage using an upper page and a lower page. The NAND memory 16 is constituted by a plurality of memory chips, and each memory chip is constituted by arranging a plurality of blocks, which are units of data erasure. Furthermore, in the NAND memory 16, data is written and read on a page-by-page basis. A block is made up of multiple pages.

The RAM 40 includes a cache memory (CM) 46 that functions as a data transfer cache between the host device 3 and the NAND memory 16. Further, the RAM 40 functions as a management information storage memory and a work area memory. The management table managed in the area 40A of the RAM 40 is the various management tables stored in the area 40M of the NAND memory 16 that are expanded when the SSD 2 is started, and the management table managed in the area 40A of the RAM 40 is expanded at the time of starting the SSD 2, etc. Saved to 40M.

The functions of the SSDC 41 are realized by a processor that executes a system program (firmware) stored in the NAND memory 16 and various hardware circuits, and handles write requests, cache flush requests, read requests, etc. from the host device 3. Data transfer control between the host device 3 and the NAND memory 16 for various commands, updating and management of various management tables stored in the RAM 40 and the NAND memory 16, ECC encoding of data written to the NAND memory 16, reading from the NAND memory 16 Executes ECC decoding of data, etc.

When the host device 3 issues a read request or a write request to the SSD 2, it inputs an LBA (Logical Block Addressing) as a logical address via the ATA interface 19. LBA is a logical address that is serially numbered from 0 to a logical sector (size: 512B, for example). Further, when the host device 3 issues a read request or a write request to the SSD 2, it inputs the logical sector size to be the target of the read request or write request together with the LBA.

The IFC 42 has a function of receiving read requests, write requests, other requests and data from the host device 3, transmitting the received requests and data to the SSDC 41, and transmitting data to the RAM 40 under the control of the SSDC 41.

FIG. 19 shows the configuration of management information used in the SSD 2. As described above, this management information is non-volatilely stored in the area 40M of the NAND memory 16. The management information stored in the area 40M is expanded to the area 40A of the RAM 40 and used when the SSD 2 is started. The management information 44 in the area 40A is saved in the area 40M periodically or when the power is turned off. If the RAM 40 is a nonvolatile RAM such as MRAM or FeRAM, the management information 44 may be stored only in the RAM 40, and in this case, the management information 44 is not stored in the NAND memory 16. In order to reduce the amount of data written to the NAND memory 16, it is desirable that the data stored in the management information 45 be compressed data stored in the area 40A of the RAM 40. Furthermore, in order to reduce the frequency of writing to the NAND memory 16, it is desirable to add update information (difference information) to the management information 44 stored in the area 40A of the RAM 40 to the management information 45. .

As shown in FIG. 19, the management information includes a free block table (FBT) 60, a bad block table (BBT) 61, an active block table (ABT) 62, and a track table (logical-physical conversion table for each track) 63. , a cluster table (logical-physical conversion table for each cluster) 64, and statistical information 65.

As shown in FIG. 20, the LBA is a logical address that is serially numbered from 0 to a logical sector (size: 512B, for example). In this embodiment, the logical address (LBA) of the SSD 2 is managed as a cluster address consisting of a bit string from the lower (s+1) bit to the upper bit of the LBA, and a cluster address consisting of the bit string from the lower (s+t+1) bit to the upper bit of the LBA. Define the track address to be configured. That is, a logical sector is the minimum unit of access from the host device 3. A cluster is a management unit for managing "small data" within the SSD, and the cluster size is determined to be a natural number times the logical sector size. Further, a track is a management unit for managing "large data" within the SSD, and the track size is determined to be a natural number times 2 or more of the cluster size. Therefore, a track address is the LBA divided by the track size, an intra-track address is the remainder of the LBA divided by the track size, a cluster address is the LBA divided by the cluster size, and an intra-cluster address is the remainder of the LBA divided by the track size. is the remainder when divided by the cluster size. In the following explanation, for convenience, the track size is assumed to be equal to the data size that can be recorded in one physical block (if the physical block includes redundant bits for ECC processing performed by the SSDC 41, this size is excluded), and the size of the cluster is The size is equal to the size of data that can be recorded in one physical page (if the physical page includes redundant bits for ECC processing performed by the SSDC 41, this size is excluded).

The free block table (FBT) 60 manages IDs of unassigned physical blocks (free blocks: FBs) of the NAND memory that can be newly allocated for writing when writing to the NAND memory 16. Furthermore, the number of times of erasure is managed for each physical block ID, and when a physical block is erased, the number of times of erasure of the block is incremented.

The bad block table (BBT) 61 manages IDs of bad blocks (BB) as physical blocks that cannot be used as storage areas due to many errors. Similarly to the FBT 60, the number of times of erasure may be managed for each physical block ID.

The active block table (ABT) 62 manages active blocks (AB), which are physical blocks to which usages are assigned. Furthermore, the number of times of erasure is managed for each physical block ID, and when a physical block is erased, the number of times of erasure of the block is incremented.

The track table 63 manages the correspondence between a track address and a physical block ID in which track data corresponding to this track address is stored.

The cluster table 64 manages the correspondence between a cluster address, a physical block ID in which cluster data corresponding to this cluster address is stored, and a page address within the physical block in which cluster data corresponding to this cluster address is stored. .

The statistical information 65 stores various parameters (X01 to X24) related to the reliability of the SSD 2.

The statistical information 65 includes the total number of bad blocks (statistical information X01), the total number of erases (statistical information X02), the average number of erases (statistical information X03), the cumulative value of the number of NAND memory write errors (statistical information Cumulative value of the number of NAND memory erase errors (statistical information X05), total number of logical sectors read (statistical information X06), total number of logical sectors written (statistical information X07), total number of times ECC cannot be corrected (statistical information X08), n bit ~Total m-bit ECC correction unit count (statistical information X09), number of R errors in SATA communication (statistical information X10), number of errors in SATA communication (statistical information Total usage time of SSD2 (statistics information X13), cumulative amount of time that the temperature exceeds the maximum recommended operating temperature (statistics information maximum response time (statistical information X16), average command response time (statistical information X17), maximum NAND memory response time (statistical information X18), average NAND response time (statistical information X19), current temperature (statistical information X20), maximum temperature (statistical information X21), minimum temperature (statistical information X22), statistical information increase rate (statistical information X23), NAND sorting failure flag (statistical information X24), etc.

The total number of bad blocks (statistical information X01) will be explained. Each time one physical block of the NAND memory 16 in the SSD 2 is added to the bad block, the statistical information X01 is incremented by one. It is desirable that the statistical information It is even better to add it to the block. The statistical information X01 may be calculated directly from the BBT 61 without being stored in the statistical information 65. The larger the statistical information X01 is, the worse the reliability is.

The total number of erasures (statistical information X02) will be explained. Statistical information X02 indicates the cumulative number of times of erasure of all blocks of the NAND memory 16 in the SSD 2. The statistical information X02 is incremented by 1 each time one physical block of the NAND memory 16 in the SSD 2 is erased. It is desirable that the statistical information X02 be reset to zero when the SSD 2 is manufactured (before the inspection process). The statistical information X02 may be calculated directly from the FBT60, BBT61, and ABT62 without being stored in the statistical information 65. The larger the statistical information X02 is, the worse the reliability is.

The average number of erasures (statistical information X03) will be explained. Statistical information X03 indicates the average value of the number of times of erasure of all blocks of the NAND memory 16 in the SSD 2 per block. Some blocks, such as blocks storing management information, may be excluded from the statistical information X03 aggregation targets. It is desirable that the statistical information X03 be reset to zero when the SSD 2 is manufactured (before the inspection process). The statistical information X03 may be calculated directly from the FBT60, BBT61, and ABT62 without being stored in the statistical information 65. The larger the statistical information X03 is, the worse the reliability is.

The cumulative value of the number of write errors in the NAND memory (statistical information X04) will be explained. The statistical information X04 is incremented by 1 each time a write error occurs in the NAND memory 16 in the SSD 2 in units of write (addition may be made in units of blocks). It is desirable that the statistical information X04 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X04 is, the worse the reliability is.

The cumulative value of the number of times erasure errors occur in the NAND memory (statistical information X05) will be explained. It is desirable that the statistical information X05 be reset to zero when the SSD 2 is manufactured (before the inspection process). Each time an erase error occurs in one block in the NAND memory 16 in the SSD 2, 1 is added to the statistical information X05. A plurality of blocks may be grouped together as an erase unit, and each time an erase error occurs in one erase unit, 1 may be added to the statistical information X05. The larger the statistical information X05 is, the worse the reliability is.

The total number of read logical sectors (statistical information X06) will be explained. Statistical information X06 is the total number of logical sectors of data transmitted by the IFC 42 to the host device 3 as read data. It is desirable that the statistical information X06 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X06 is, the worse the reliability is.

The total number of write logical sectors (statistical information X07) will be explained. Statistical information X07 is the total number of logical sectors of data received by the IFC 42 from the host device 3 as write data. It is preferable that the statistical information X07 is reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X07 is, the worse the reliability is.

The total number of uncorrectable ECC times (statistical information X08) will be explained. If the error bit cannot be repaired by ECC correction, the statistical information X08 is incremented by 1 for each read unit. The estimated value of the number of error bits for which error correction could not be made may be added, or the number of blocks for which error correction could not be made may be added. It is preferable that the statistical information X08 is reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X08 is, the worse the reliability is.

The n-bit to m-bit ECC correction unit total count (statistical information X09) will be explained. n and m are natural numbers, and 0≦n≦m≦maximum number of correctable bits. When ECC correction is performed on an ECC correction unit (for example, a physical page), if all error bits are repaired normally and the number of error bits repaired is greater than or equal to n and less than or equal to m, then " Add 1 to the total number of n-bit to m-bit ECC correction units. If a maximum of 64 bits can be corrected per correction unit by ECC correction, for example, "Total number of 1-bit to 8-bit ECC correction units", "Total number of 9-bit to 16-bit ECC correction units", "17-bit to 24-bit ECC correction "Total number of units" "Total number of 25-bit to 32-bit ECC correction units" "Total number of 33-bit to 40-bit ECC correction units" "Total number of 41-bit to 48-bit ECC correction units" "Total number of 49-bit to 56-bit ECC correction units If the ECC correction is performed normally, one of these eight parameters will be set for each ECC correction of one ECC correction unit. 1 is incremented. It is desirable that the statistical information X09 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X09 is, the worse the reliability is.

The number of R error occurrences in SATA communication (statistical information X10) will be explained. The statistical information X10 is incremented by 1 each time an R error (Reception Error, R_ERR) according to the SATA standard occurs. If there is any error such as a CRC error in a frame transmitted and received between the host and the SSD, it is counted as an R error. As the statistical information X10, any of the Phy Event Counters of the SATA standard may be adopted. It is desirable that the statistical information X10 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger the statistical information X10 is, the worse the reliability is.

The number of errors occurring in SATA communication (statistical information X11) will be explained. It is incremented by 1 each time another abnormality in SATA communication (other than R error) occurs. For example, even though the ATA interface 19, IFC 42, and SSDC 41 are designed according to the SATA Generation 3 standard, the communication standard actually negotiated with the SSD 2 and host device 3 is a slower communication standard such as Generation 2. If so, it is regarded as an error in SATA communication, and statistical information X11 is incremented by one. It is desirable that the statistical information X11 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The number of errors occurring in the RAM 40 (statistical information X12) will be explained. For example, when the RAM 40 is equipped with an ECC circuit or an error detection circuit, when the SSDC 41 receives a signal indicating that ECC correction could not be performed or a signal indicating that an error was detected from the RAM 40, the statistical information X12 is incremented by one. It is desirable that the statistical information X12 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The total usage time of the SSD 2 (statistical information X13) will be explained. While the SSD 2 is powered on, the SSDC 41 increments the elapsed time by counting clocks or receiving time information from an internal clock circuit. Alternatively, the SSDC 41 may periodically receive the time information of the host device 3 from the host device 3, and may increment the difference in the time information. It is desirable that the statistical information X13 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The cumulative time (statistical information X14) during which the recommended operating temperature exceeds the maximum value will be explained. For example, if a thermometer is mounted inside the SSD 2, such as on the board of the SSD 2, inside the SSDC 41, or inside the NAND memory 16, the SSDC 41 regularly receives temperature information from the thermometer. If the received temperature exceeds the recommended operating temperature (for example, 100°C), the SSDC 41 calculates the number of hours it has been operating at or above the estimated operating temperature based on the clock, internal clock, and time information obtained from the host device 3. Increment. It is desirable that the statistical information X14 be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The cumulative amount of time (statistical information X15) during which the recommended operating temperature has fallen below the minimum value will be explained. If a thermometer is installed in the SSD 2, the SSDC 41 regularly receives temperature information from the thermometer. If the received temperature is lower than the recommended operating temperature (for example -40°C), the SSDC 41 calculates the number of hours it has been operating at or above the estimated operating temperature based on the clock, internal clock, and time information obtained from the host device 3. is incremented. It is desirable that the value be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The command response time maximum value (statistical information X16) will be explained. The statistical information X16 is the maximum value of the time (or number of clocks) required from receiving a command from the host device 3 to responding to the host device 3 (or completing command execution). If a response time exceeding X16 occurs, this response time is overwritten to X16. Statistical information X16 may be held for each command. It is desirable that X16 be reset to zero when the SSD 2 is manufactured (before the inspection process) or when the SSD 2 is shipped.

The command response time average value (statistical information X17) will be explained. The statistical information X17 is the average value of the time (or number of clocks) required from receiving a command from the host device 3 to responding to the host device 3 (or completing command execution). For example, it can be obtained by retaining a certain number of response time lists in the RAM 40 and calculating the average value of the response time lists. Statistical information X17 may be held for each command. It is desirable that X17 be reset to zero when the SSD 2 is manufactured (before the inspection process) or when the SSD 2 is shipped.

The maximum response time (statistical information X18) of the NAND memory will be explained. The statistical information X18 is the maximum value of the time (or number of clocks) required from when the SSDC 41 issues a command to the NAND memory 16 until it receives a response (or receives a command execution completion notification). If a response time exceeding X18 occurs, this response time is overwritten to X18. Statistical information X18 may be held for each command. It is desirable that X18 be reset to zero when the SSD 2 is manufactured (before the inspection process) or when the SSD 2 is shipped.

The NAND response time average value (statistical information X19) will be explained. The statistical information X19 is the average value of the time (or number of clocks) required from when the SSDC 41 issues a command to the NAND memory 16 until it receives a response (or receives a command execution completion notification). For example, it can be obtained by retaining a certain number of response time lists in the RAM 40 and calculating the average value of the response time lists. Statistical information X19 may be held for each command. It is desirable that X19 be reset to zero when the SSD 2 is manufactured (before the inspection process) or when the SSD 2 is shipped.

The current temperature (statistical information X20) will be explained. If a thermometer is installed in the SSD 2, the SSDC 41 periodically receives temperature information from the thermometer. The SSDC 41 holds the temperature last received from the thermometer as the current temperature in the statistical information X20. If this value is extremely high (e.g. 85°C or higher), it will have a negative impact on the reliability of SSD2, and if this temperature is extremely low (e.g. -10°C or lower), it will have a negative impact on the reliability of SSD2. do.

The maximum temperature (statistical information X21) will be explained. The SSDC 41 holds the maximum value of the current temperature X20 as the highest temperature in the statistical information X21. If this value is extremely large (for example, 85° C. or higher), the reliability of the SSD 2 will be adversely affected. When the SSDC 41 receives a current temperature larger than X21 from the thermometer, it rewrites X21 to the current temperature. It is desirable that X21 be reset to a temperature that is sufficiently lower than the operating temperature of the SSD 2 (for example, −40° C.) when the SSD 2 is manufactured (before the inspection process) or when the SSD 2 is shipped.

The lowest temperature (statistical information X22) will be explained. The SSDC 41 holds the minimum value of the current temperature X20 as the lowest temperature in the statistical information X22. If this value is extremely small (for example, −40° C. or lower), the reliability of the SSD 2 will be adversely affected. When the SSDC 41 receives a current temperature smaller than X22 from the thermometer, it rewrites X22 to the current temperature. It is desirable that X22 be reset to a temperature that is sufficiently higher than the operating temperature of the SSD 2 (for example, 120° C.) when manufacturing the SSD 2 (before the inspection process) or shipping the SSD 2.

The statistical information increase rate (statistical information X23) will be explained. Information that is not the latest statistical information X01 to X19 (for example, the value before a certain time, the value when the SSD 2 was powered on, the value when the SSD 2 was powered down last time, etc.) is separately held. The statistical information X23 is defined, for example, as one of the following.

Statistical information increase rate = (latest statistical information) - (old information)
Statistical information increase rate = ((latest statistical information) - (old information)) / (time elapsed since obtaining old information)
Statistical information increase rate = ((latest statistical information) - (old information)) / (number of NAND accesses since obtaining old information)
It is desirable that the value be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

The NAND sorting failure flag (statistical information X24) will be explained. If the statistical information X24 is 1, it will not be possible to secure a sufficient number of free blocks for operation even by NAND sorting. It is desirable that the value be reset to zero when the SSD 2 is manufactured (before the inspection process). The larger this value is, the worse the reliability is.

As the statistical information 65, all the parameters mentioned above may be stored, or only some or one of them may be stored. It is desirable that the latest statistical information 65 is kept in the area 40A on the RAM 40 and periodically backed up to the area 40M on the NAND memory 16. On the other hand, the statistical information may be saved only in either the RAM 40 or the NAND memory 16, or the statistical information may be sent to the host device 3 and saved in the host device 3 or a storage device connected to the host device 3. You can do it like this.

(LBA forward conversion)
Next, a procedure for specifying a physical address from an LBA in the SSD 2 (LBA forward lookup conversion) will be described using FIG. 21. When an LBA is specified, the SSDC 41 calculates a track address, a cluster address, and an intra-cluster address from the LBA.

The SSDC 41 first searches the track table 63 and identifies the physical block ID corresponding to the calculated track address (steps S100 and S101). The SSDC 41 determines whether the identified physical block ID is valid (step S102), and if the physical block ID is not null but a valid value (step S102: Yes), this physical block ID is the ABT62. A search is made to see if it has been entered (step S103). If the physical block ID is entered in the ABT 62 (step S104: Yes), the NAND memory corresponding to the specified LBA is shifted from the start position of the physical block specified by this physical block ID by the intra-track address. 16 (step S105). In such a case, the cluster table 64 is not required to specify the physical location on the NAND memory 16 corresponding to the LBA, and such an LBA is referred to as a "track-managed LBA." In step S104, if the physical block ID is not entered in the ABT 62 (step S104: No), the specified LBA does not have a corresponding physical address, and such a state is referred to as an "unwritten state". (Step S106).

In step S102, if the physical address corresponding to the specified track address is null and has an invalid value (step S102: No), the SSDC 41 calculates the cluster address from the LBA, searches the cluster table 64, and calculates the cluster address. The physical block ID corresponding to the cluster address and the corresponding intra-physical block page address are acquired from the cluster table 64 (step S107). The position shifted by the intra-cluster address from the top position of the physical page specified by the physical block ID and the physical block page address becomes the physical position on the NAND memory 16 corresponding to the specified LBA. In such a case, the physical location on the NAND memory 16 corresponding to the LBA cannot be specified from the track table 63 alone, but requires reference to the cluster table 64, and such an LBA is "cluster-managed LBA" (step S108).

(Read operation)
Next, the read operation in the SSD 2 will be explained using FIGS. 22 and 23. The read operation described in this embodiment is the case of 60h READ FPDMA QUEUED described in INCITS ACS-2, but other write commands such as 25h READ DMA EXT may also be adopted, and the difference in the types of read commands is It does not affect the essence of the invention. When the SSD 2 receives a read command from the host device 3 (step S110), the SSDC 41 adds this read command to the read command queue on the RAM 40 (step S111), and notifies the host device 3 that the read command has been received. Reply.

On the other hand, if the instruction exists in the read instruction queue on the RAM 40, the SSDC 41 determines whether or not the read process is executable (step S120), and sets the read process executable. If it is determined that the physical location of the data has been reached, the physical location of the data is specified from the LBA received from the host device 3 according to the LBA forward conversion procedure shown in FIG. 21 (step S121). The SSDC 41 reads data from the physical page at the specified position (step S123), decodes the read data using ECC redundancy bits (step S124), and sends the decoded data to the host device 3 via the IFC 42. The information is transmitted (step S125), and the statistical information 65 is updated. Note that the data read from the NAND memory 16 may be written to the RAM 40, and the data written to the RAM 40 may be decoded and sent to the host device 3. Alternatively, the decoded data may be written to the RAM 40 and then transferred to the RAM 40. The written data may be sent to the host device 3.

In step S124, the SSDC 41 attempts decoding using ECC, but if decoding fails, the physical block containing the page that could not be decoded is deleted from the ABT 62 and registered in the BBT 61, and the ECC of the statistical information 65 cannot be corrected. The total number of ECC correction units (statistical information X08) is added. At that time, the data of the block is copied from the FBT 60 to the allocated free block, the physical block ID of the free block is registered in the ABT 62, and the physical blocks of the track table 63 and cluster table 64 are changed from the copy source physical block ID to the copy destination. It is desirable to rewrite it to a physical block ID.

(Write operation)
Next, a write operation in the SSD 2 will be explained using FIGS. 24 and 25. The write operation described in this embodiment is the case of 61h WRITE FPDMA QUEUED described in INCITS ACS-2, but other write commands such as 35h WRITE DMA EXT may also be adopted, and the difference in the types of write commands is It does not affect the essence of the invention. When the SSD 2 receives a write command from the host device 3 (step S130), the SSDC 41 adds this write command to the read command queue on the RAM 40 (step S131), and notifies the host device 3 that the write command has been accepted. Reply.

On the other hand, if the instruction exists in the write command queue on the RAM 40, the SSDC 41 determines whether or not the write process is executable (step S140), and makes the write process executable. If it is determined that the write is possible, it notifies the host device 3 that writing is possible, receives write data from the host device 3, encodes the received data with ECC, and stores the encoded data in the cache memory 46 of the RAM 40. Note that unencoded data may be stored in the cache memory 46 and encoded when written to the NAND memory 16.

Next, the SSDC 41 reads the FBT 60 (step S141) and acquires the physical block ID of the free block from the FBT 60. If there is no free block (step S142: No), the SSDC 41 organizes the NAND memory 16 (NAND organize), which will be described later (step S143), reads the FBT 60 (step S144), and frees the block from the FBT 60. Get the physical block ID of the block. The SSDC 41 performs an erase operation on the free block for which the physical block ID has been acquired. If an erase error occurs, the physical block ID is added to the BBT 61, deleted from the FBT 60, and the process starts over from S141 to reacquire a free block. Note that even if a physical block has had an erase error once, it may be possible to erase it normally without an erase error if the erase operation is performed again. , an item for the number of block erase error occurrences as statistical information X05 is provided for each block in the FBT60 and ABT62, and this is incremented when a block erase error occurs, so that the number of block erase error occurrences is a predetermined value. It is desirable to register the block in the BBT 61 when the number of blocks exceeds the limit. More preferably, in order to convert only physical blocks in which erase errors occur continuously into bad blocks, the SSDC 41 provides an item "number of consecutive erase errors for each block" instead of the "number of times erase errors occur for each block". , This is incremented when a block erase error occurs, and reset to zero when erase is performed without error, and when the "number of consecutive block erase errors" exceeds a predetermined value. It is desirable to register the block in the BBT 61 at the same time.

Next, in order to search whether the LBA specified in the write command is in an unwritten state, the SSDC 41 searches for valid data corresponding to the LBA according to the forward conversion procedure shown in FIG. It is determined whether the data has been stored in the NAND memory 16 (steps S145, S146).

If the LBA is in an unwritten state (step S146: Yes), the SSDC 41 writes the received data stored in the cache memory 46 to the free block (step S147), and writes the written free block (new physical block). The ID of the physical block and the number of erasures thereof are registered in the ABT 62, and the ID of the physical block to which writing has been performed is deleted from the FBT 60 (step S151). At this time, the LBA of the received data is divided into sections for each track (track section), and by determining whether the track section is filled with data, it is determined whether to perform track management or cluster management ( Step S152). That is, when the track section is filled with data, track management is used, and when the track section is not filled with data, cluster management is used. In the case of cluster management, the cluster table 64 is rewritten to associate a new physical block ID with an LBA (step S153), and the track table 63 is further rewritten to associate an invalid physical block ID (for example, null) with an LBA. In the case of track management, the track table is rewritten to associate the new physical block ID with the LBA (step S154).

On the other hand, in step S146, if the LBA is not in an unwritten state, the SSDC 41 reads all data in the corresponding physical block from the NAND memory 16 based on the physical block ID obtained by forward conversion, and writes it to the RAM 40. (Step S148). Then, the data stored in the cache memory 46 and the data read from the NAND memory 16 and written to the RAM 40 are combined on the RAM 40 (step S149), and the combined data is written to the free block (step S150).

Note that if a write error occurs in step S150, the physical block ID is added to the BBT 61, deleted from the FBT 60, and restarted from step S141 to reacquire a free block. Note that even if a physical block has had a write error once, it may be possible to write normally without a write error if the write operation is performed again. , an item for the number of block write errors as statistical information X04 is provided for each block in the FBT60 and ABT62, and this is incremented when a block write error occurs, so that the "number of block write errors" is It is desirable to register the block in the BBT 61 when the value exceeds a predetermined value. More preferably, in order to convert only physical blocks in which write errors occur continuously into bad blocks, the SSDC 41 includes an item "Number of consecutive write errors per block" instead of "Number of write errors occurring per block". , This is incremented when a block write error occurs, and reset to zero when writing is performed without error, and when the "number of consecutive write errors for each block" exceeds a predetermined value. It is desirable to register the block in the BBT 61 at the same time.

The SSDC 41 registers the ID of the written free block (new physical block) and the number of erasures thereof in the ABT 62, and deletes the ID of the written physical block from the FBT 60 (step S151). If the LBA is cluster managed, the old physical block ID in the cluster table 64 is rewritten to the new physical block ID (steps S152, S153). In the case of track management, the old physical block ID in the track table is rewritten to a new physical block ID (steps S152, S154). Further, the SSDC 41 adds the old physical block ID and the number of times of erasure to the FBT 60, and deletes the old physical block ID and the number of times of erasure from the ABT 62 (step S155). The SSDC 41 reflects the contents of the above writing process in the statistical information 65.

(NAND arrangement)
Since the capacity of all LBAs of the SSD 2 is designed to be smaller than the total capacity of the NAND memory 16 of the SSD 2, free blocks will not be exhausted as long as write operations continue in track units. On the other hand, if many cluster-based writes occur to an unwritten LBA, a physical block with a larger capacity than the cluster will be allocated for each cluster-based write, so the data capacity will be larger than the data capacity to be written. 16 physical blocks of NAND memory will be required, which may lead to exhaustion of free blocks. When free blocks are exhausted, new free blocks can be secured by organizing the NAND memory 16 as described below.

NAND organization in the SSD 2 will be explained using FIG. 26. Not all clusters stored in a physical block are valid clusters, and invalid clusters that do not correspond to valid clusters are not associated with LBAs. A valid cluster is a cluster that stores the latest data, and an invalid cluster is a cluster where data of the same LBA has been written to another location and is no longer referenced. The physical block will have free data for the invalid clusters, and free blocks can be secured by collecting data from valid clusters and rewriting them into different blocks by performing NAND rearrangement.

First, the physical block IDi is set to 0, and the cumulative amount of free space S is set to 0 (step S160). The SSDC 41 determines whether the physical block with ID i=0 is entered in the track table 63 (step S161). If it is entered in the track table, i is incremented by 1 (step S162), and the same determination is made for the physical block having the next ID number (step S161). That is, if the physical block ID is included in the track table 63, the data of this physical block is track management, and therefore is not included in the NAND sorting target.

If the physical block with ID=i is not track managed (step S161: No), the SSDC 41 then refers to the cluster table 64 and acquires all addresses of valid clusters included in the physical block with ID=i (step S161: No). S163). Then, the SSDC 41 calculates the size v for the total capacity of the acquired effective cluster (step S164), and when v<physical block size (step S165), adds the ID of the current physical block to the NAND sorting target block list. (Step S166). Furthermore, the SSDC 41 adds the acquired cluster capacity v of the current physical block to the acquired cluster cumulative amount S, and updates the acquired cluster cumulative amount S (step S167).

In step S165, if v<physical block size, or in step S168, if the acquired cluster cumulative amount S has not reached the physical block size, the SSDC 41 increments i by 1 (step S162) and assigns the ID of the next number. The procedures of steps S161 to S167 are executed in the same manner as described above for the physical block having the same value. Then, in step S168, the procedure of steps S161 to S167 is repeated until the acquired cluster cumulative amount S reaches the physical block size.

Then, in step S168, if the acquired cluster cumulative amount S reaches the physical block size, the SSDC 41 reads data of all valid clusters for all physical blocks on the NAND rearrangement target block list from the NAND memory 16 and stores it in the RAM 40. Writing (step S169), and erasing all physical blocks on the NAND sorting target block list (step S170), deleting all the physical blocks that have been erased from the ABT 62 and adding them to the FBT 60 (step S170). S171). At that time, the number of times of erasure is incremented. Note that the target of the erase operation performed in step S170 may be limited to the target block in which data is written in step S172, and it is desirable to perform it in this way from the viewpoint of suppressing the number of times the block is erased.

If an erase error occurs, the physical block ID is added to the BBT 61 and deleted from the FBT 60. Note that even if a physical block has had an erase error once, it may be possible to erase it normally without an erase error if the erase operation is performed again. , the FBT 60 and ABT 62 are provided with a "Number of block erase error occurrences" item for each block, and this is incremented when a block erase error occurs, so that the number of block erase error occurrences exceeds a predetermined value. It is desirable to register the block in the BBT 61 in such a case. More preferably, in order to convert only physical blocks in which erase errors occur continuously into bad blocks, the SSDC 41 includes an item "number of consecutive erase errors for each block" instead of the "number of times erase errors occur for each block". , This is incremented when a block erase error occurs, and reset to zero when erasing is performed without error, and when the "number of consecutive block erase errors" exceeds a predetermined value. It is desirable to register the block in the BBT 61 at the same time.

Then, the SSDC 41 acquires a new free block from the FBT 60, writes the data written in the RAM 40 to the acquired free block (step S172), and records the physical block ID of the free block into which the data has been written and the number of times the block has been erased. The block ID of the block added to the ABT 62 and further written with data is deleted from the FBT 60 (step S173). Further, the SSDC 41 updates the cluster address, physical block ID, and page address within the physical block in the cluster table 64 to correspond to the current NAND arrangement (step S174). The SSDC 41 reflects the processing contents of the NAND arrangement described above in the statistical information 65.

Note that if a write error occurs in step S172, the physical block ID is added to the BBT 61, deleted from the FBT 60, and a free block is acquired again. Note that even if a physical block has had a write error once, it may be possible to write normally without a write error if the write operation is performed again. , the FBT60 and ABT62 are provided with a "Number of write errors for each block" item for each block, and this is incremented when a block write error occurs, so that the "Number of write errors for each block" exceeds a predetermined value. It is desirable to register the block in the BBT 61 when the block becomes the same. More preferably, in order to convert only physical blocks in which write errors occur continuously into bad blocks, the SSDC 41 includes an item "Number of consecutive write errors per block" instead of "Number of write errors occurring per block". , This is incremented when a block write error occurs, and reset to zero when writing is performed without error, and when the "number of consecutive write errors for each block" exceeds a predetermined value. It is desirable to register the block in the BBT 61 at the same time.

Note that in the procedure of FIG. 26, NAND organization is performed that prioritizes packing data into free blocks, but in step S164, v is obtained by subtracting the capacity of the obtained cluster from the physical block size, and in step S165, v is calculated by subtracting the capacity of the obtained cluster from the physical block size. NAND sorting that prioritizes securing free blocks by determining whether v>0 or not, and moving to step S168 if v>0, and moving to step S162 if v>0. You may also do this.

Next, deletion notification in the SSD 2 will be explained using FIG. 27. The deletion notification is a command sent from the host device 3 to the external storage device when data is deleted by the OS 100 on the host device 3. An example of a deletion notification is a Data Set Management Command (commonly known as a TRIM command) described in INCITS ATA/ATAPI Command Set-2 (ACS-2). When data is deleted on the OS 100, the logical address area (LBA area) where the deleted data exists is notified to the external storage device as an LBA Range Entry consisting of a combination of LBA and number of sectors. This method allows the area on the external storage device to be treated as a free area. The deletion notification allows the SSD 2 to newly secure a free block. Note that the function of the trim command may be realized not only by the Data Set Management Command but also by other commands such as the SCT Command Transport described in INCITS ACS-2, or other vendor-specific commands. If the OS 100 is an emergency OS, it is desirable that the emergency OS prohibits the issuance of deletion notifications from the viewpoint of reducing writes to the NAND memory. On the other hand, in the deletion notification process, only about 45 pieces of management information are rewritten in the NAND memory 16, so the deletion notification may be permitted even in the emergency OS.

When the SSD 2 receives a deletion notification from the host device 3 (step S180), the SSDC 41 performs forward LBA lookup conversion on the LBA included in the deletion notification according to the procedure shown in FIG. 21 above. If the LBA included in the deletion notification is track management (step S181: Yes), the SSDC 41 adds the physical block ID to the FBT 60 and deletes it from the ABT 62 (step S184). On the other hand, if the LBA included in the deletion notification is cluster management (step S181: No), the SSDC 41 deletes all clusters corresponding to the physical block from the cluster table 64 (step S182), and stores the LBA in the track table 63. An appropriate valid value (for example, FFFF) is entered in the physical block ID corresponding to the track corresponding to the track (step S183), and the physical block ID is added to the FBT 60 and deleted from the ABT 62 (step S184). In the SSD 2, free blocks can be secured not only by NAND sorting but also by deletion notification processing.

Such NAND organization usually makes it possible to secure a sufficient number of free blocks for writing. If a sufficient number of free blocks cannot be secured for writing even after NAND sorting, the NAND sorting failure flag of the statistical information 65 is set to 1, and the SSD 2 acquires free blocks through the acquisition of the statistical information 65 by the host device 3. It is desirable to be able to notify the host device 3 that it has not been secured. From the perspective of providing a grace period between when the NAND sorting failure flag becomes 1 and when the SSD2 actually stops working,
(Number of free blocks secured by organizing NAND) < (Number of free blocks required for writing) + (Margin)
It is desirable to set the NAND sorting failure flag to 1 when the following conditions are met.

The above NAND arrangement is performed not only when a write request is received from the host device 3, but also when a predetermined period of time has passed since the last command was received from the host, or when a command is issued from the host device 3 to transition to standby, idle, or sleep state. It may be executed when the SSD 2 receives a command to start NAND organization from the host device 3 through the SCT Command Transport described in ACS-2 or other vendor commands. Good too. Note that if the OS 100 is an emergency OS, from the perspective of reducing writes to the NAND memory, when a predetermined period of time has elapsed since the last command was received from the host device 3, the host device 3 will send the host device 3 to the standby, idle, or sleep state. It is desirable that the above NAND arrangement is not performed when a command to shift to is received. Furthermore, if the OS 100 is an emergency OS, from the viewpoint of reducing writes to the NAND memory 16, it is desirable that the emergency OS prohibits issuing a command to start NAND sorting.

(Error handling)
Next, error processing regarding the NAND memory 16 in the SSD 2 will be described using FIG. 28. Various processes such as processing in response to a write request from the host device 3 and NAND organizing processing are normally performed as described above, but if a write error occurs in a write operation (program operation) to the NAND memory 16, erasure to the NAND memory 16 is performed. When an erase error occurs in an operation (erase operation), an ECC error (error correction processing failure) may occur during a read operation to the NAND memory 16, and exception handling for these cases is required.

When any of the above errors occurs (step S190), the SSDC 41 adds the physical block in which the error occurred to the BBT 61 (step S191), and deletes the physical block in which the error occurred from the ABT 62 and FBT 60 (step S190). In step S192), the physical block in which the error has occurred is no longer accessible. At this time, the data of the physical block in which the error has occurred may be copied to another physical block. The SSDC 41 reflects the above error processing in the statistical information 65.

In the above, an example of error processing was shown for read processing, write processing, and NAND organizing processing, but error processing is not limited to these examples, and can be applied to all read processing, writing processing, and erasing processing for the NAND memory 16. Applicable.

(control tool)
As the SSD 2 is used, the reliability of each block of the NAND memory 16 deteriorates, the number of bad blocks increases, and the sum of the number of free blocks and the number of active blocks decreases. Furthermore, if the SSD 2 is used, even if NAND organization is performed, it will not be possible to secure a sufficient number of free blocks for writing processing, and this is the end of the SSD 2's lifespan. Below, the processing of the control tool 200 when the life span of the SSD 2 has been reached will be described.

When the control tool 200 is activated, it resides in the main memory 6 and monitors the statistical information 65 of the SSD 2. In order to constantly monitor the statistical information 65 of the SSD 2, the startup program of the control tool 200 is registered in the startup program of the normal OS 100A, and the normal OS 100A is read from the area 16D (or 20D) to the area 6A. Preferably, control tool 200 is read from region 16B (or region 20B) at or shortly thereafter. For example, if the OS 100 is Windows (registered trademark), the control tool 200 may be registered in the Windows (registered trademark) startup menu, as a service, or in the Windows (registered trademark) registry. By setting the control tool 200 as a resident program at startup, the control tool 200 can be automatically started.

For example, as shown in FIG. 29, the control tool 200 acquires statistical information 65 from the SSD 2 at regular intervals (for example, every minute). As a method for acquiring statistical information, for example, SMART READ DATA (B0h (D0h)), which is a command of S.M.A.R.T (Self-Monitoring Analysis and Reporting Technology), which is a memory self-diagnosis function, described in INCITS ACS-2. Alternatively, SCT Command Transport described in ACS-2 or other vendor-specific commands may be used.

FIG. 30 shows a table regarding statistical information 65 (statistical information X01 to X19, X23, and X24) managed by the SSD 2. When using SMART, as shown in FIG. 30, an attribute ID is assigned to each component of the statistical information 65 (X01 to X19, X23, X24, etc.), but only some of these components Of course, it is also possible to assign it to Regarding the components of these statistical information 65, after normalization, SMAB is adopted as the best value, and the lower limit of reliability guarantee after normalization is SMAL=SMAB*AMALR (0≦AMALR<1) (SMAL is an integer, rounded off. , is converted from a decimal to an integer by either rounding up the decimal point or rounding up the decimal point).
attribute value = SMAL + SMAB×(1-AMALR)×(RMAX-raw value)/ RMAX
attribute Threshold=30 (fixed value)
RMAX = upper limit of raw statistical information values whose reliability can be guaranteed
Raw value = Based on the raw value of the statistical information, the SSDC 41 calculates the attribute value (“Value” in FIG. 30) of the smart information and sends it to the control tool 200. The attribute Threshold is "Threshold" in FIG. 26, and the raw value is "Raw Data" in FIG. 26.

The best value SMAB after normalization may be any natural number; for example, SMAB=100 may be adopted. AMALR may be any number satisfying 0≦AMALR<1; for example, AMALR=0.3 may be adopted. Furthermore, RMAX, AMALR, and SMAB can each adopt different values for each of X01 to X19, X23, and X24. When SMAB = 100 and AMALR = ;0.3 is adopted, the best value of the attribute value for the statistical information to be adopted is 100 (for example, 100 immediately after shipping), and it gradually decreases as reliability deteriorates. Then, when the SSD 2 cannot guarantee reliability (when the raw value of the statistical information becomes equal to or greater than RMAX), the attribute value reaches a value of 30 or less. In addition, as a means for the host 3 to detect whether the Attribute Value exceeds the Threshold, the B0h/DAh SMART RETURN STATUS command described in ACS-2 is used, and the Attribute Value exceeds the Threshold from the output of the command. It may be determined whether or not the limit has been exceeded.

For RMAX, it is desirable to derive the relationship between the raw value of statistical information and the defective rate of SSD2 at the development stage, for example as shown in Figure 31, and to use the raw value of statistical information when the defective rate exceeds the allowable value as RMAX . For example, during the development stage of SSD2, a wear test was conducted on a large number (for example, 100) of test SSD2 groups to verify whether the written data would continue to be stored correctly for a certain period of time while repeating write operations at high temperatures. At the same time, the statistical information may be continuously monitored, and the raw value of the statistical information at the time when the defective rate reaches a certain percentage may be adopted as RMAX. For example, if a worn SSD 2 is left in a high temperature state for a certain amount of time, then the temperature of the SSD 2 is lowered, a read operation is performed on the SSD 2, and the read data cannot be ECC corrected (or the data that cannot be ECC corrected exceeds a certain number). ), this may be defined as a defect in the SSD 2, and the value obtained by dividing the number of defects by the number of SSDs 2 that have undergone the same test may be adopted as the defect rate. A value of the raw statistical information in which the defective rate is statistically significantly lower than the allowable defective rate may be adopted as RMAX. By adding some margin to RMAX,
RMAX'=RMAX-margin may be adopted as RMAX.

“Worst” in FIG. 30 may be adopted as a specification for the control tool 200 to diagnose the lifespan of the SSD 2. "Worst" is calculated by the SSDC 41 as the worst value of the attribute value. For example, in the case of X01 to X19 and X23, Worst is the minimum value of the attribute value after, for example, the SSD 2 is shipped (or manufactured). Alternatively, the minimum value of the attribute value within a certain time range in the past may be adopted as the worst value, or the worst value may be adopted as the worst value, or the worst value may be adopted as the worst value. The minimum value from 1 to 3 to the present may be adopted as the worst value.

“Raw Data” (Raw Value) in FIG. 30 may be adopted as a specification for the control tool 200 to diagnose the lifespan of the SSD 2. Raw values of statistical information (for example, X01 to X19, X23, and X24) are sent from the SSD 2 to the control tool 200 as Raw Data. In this case, the control tool 200 acquires RMAX by already holding RMAX in the control tool 200, reading it separately from the SSD 2, or reading it from another storage device, compares RMAX and Raw Data, and compares RMAX with Raw Data. Or, when Raw Data≧RMAX, it is determined that the SSD2 has reached the end of its lifespan. For example, in the case of the NAND sorting failure flag, if this flag is 1, it is determined that the SSD 2 has reached the end of its lifespan. For example, in the case of the total number of bad blocks, if this exceeds a predetermined value, it is determined that the SSD 2 has reached the end of its life. It is not necessarily necessary to output the raw value of statistical information as raw data; for example, the SSDC 41 transmits a value obtained by performing four arithmetic operations on the raw value of statistical information to the control tool 200 as raw data, and also performs four arithmetic operations on RMAX. The determination may be made by comparing with the value. Alternatively, the SSDC 41 may send data obtained by encrypting the raw values of statistical information to the control tool 200 as Raw Data, the SSDC 41 may decrypt this data, and make a determination by comparing the decrypted data with RMAX. good.

As described above, the control tool 200 determines whether the SSD 2 has reached the end of its lifespan (whether the SSD 2 is in an abnormal state), and if it is determined that the SSD 2 has reached the end of its lifespan (the SSD 2 is in an abnormal state). (if it is determined that the condition is the same), the process moves to the life-span reaching process (step S205), which will be described later. The statistical information 65 can take various forms other than the statistical information X01 to X19, X23, and X24, and the present invention is also applicable to these. Further, although there is a positive correlation between X01 to X19, X23, and X24 and the defective rate, the present invention is also applicable to statistical information that has a negative correlation with the defective rate. For example, it is the lowest temperature that the SSD 2 experienced after being shipped. In that case, instead of RMAX, a lower limit value RMIN that can guarantee reliability may be adopted, and it may be determined that the SSD 2 has reached the end of its lifespan when the statistical information falls below RMIN.

In FIG. 29, when using S.M.A.R.T, the control tool 200 acquires statistical information at regular intervals (for example, every minute) (step S200: Yes). The control tool 200 issues B0h/D0h SMART READ DATA described in ACS-2, which is a statistical information acquisition command (step S201), receives data including statistical information from the SSD 2 (step S202), and uses this received data. is diagnosed (step S203). The diagnostic method is as described above. In step S204, when the control tool 200 determines that the SSD 2 has reached the end of its lifespan (step S204: Yes), the control tool shifts to a lifespan reaching process (step S205). Even if the SSD 2 has not reached the end of its lifespan, it is desirable to proceed to the process of step S205 even if the statistical information exceeds a predetermined RMAX or shows an abnormal value that cannot occur in normal operation.

Information other than the statistical information 65 may be used to proceed to the process when the life span is reached. For example, as shown in FIG. 32, the control tool 200 acquires (monitors) response information (see FIG. 12) that the OS 100 receives from the SSD 2 from the OS 100 (step S210), and if the response is an error response (step S211) , it is determined that the SSD 2 has reached an abnormal state, and the process moves to the end-of-life process (step S212). The response to be monitored may be a response to any command, but for example, monitoring only responses to write commands to the SSD 2 such as 61h WRITE FPDMA QUEUED and 35h WRITE DMA EXT described in ACS-2 will reduce the load on the CPU 4. Desirable from this point of view. In particular, if the SSD 2 is an SSD that adopts the invention disclosed in Japanese Patent Application Laid-open No. 2009-217603 presented as Patent Document 1, when the SSD 2 reaches the end of its lifespan, responses to write commands to the SSD 2 will return with an error. Therefore, it is possible to determine whether the life span has been reached without obtaining statistical information. Note that the present invention is of course applicable even when the SSD 2 is not an SSD adopting the invention disclosed in Japanese Patent Application Laid-Open No. 2009-217603 presented as Patent Document 1.
In addition, when the SSD 2 is in a state where an error is returned in response to a write command, when performing writing such as rewriting the boot loader of the SSD 2 or writing an emergency OS, which will be described later, use a special write command in the ReadOnly mode state of Patent Document 1. Configure the SSDC 41 so that it does not return an error for (for example, SCT Command Transport described in ACS-2 or other vendor-specific commands), and write to the SSD 2 using the special write command described above. This is desirable. Note that this is not necessary for writing to storage devices other than the SSD2. Alternatively, if the normal OS is an OS that uses only a certain write command (for example, 61h WRITE FPDMA QUEUED), when the SSDC 41 reaches the ReadOnly mode of Patent Document 1, the write command (for example, 61h WRITE FPDMA QUEUED), configure the SSDC 41 to return an error for another write command (e.g. 30h WRITE SECTOR(S)), and configure the SSDC 41 to return an error for another write command (e.g. 30h WRITE SECTOR(S)). (For example, 30h WRITE SECTOR(S)) may be used to write a boot loader, emergency OS, etc. to the SSD 2.

Of course, the command to be monitored may be a command other than the write command. For example, the response (Outputs) or report of B0H/D4H SMART EXECUTE OFF-LINE IMMEDIATE described in ACS-2 may be used as a command response, or the response of 90h EXECUTE DEVICE DIAGNOSTIC may be used.

Even if a certain command response is an error, if you send the same command again, it may not be an error. In this case, the SSD2 may not have reached the end of its lifespan, so if a reproducible command error occurs. From the point of view of performing the end-of-life processing only when a command error occurs multiple times, it is desirable to perform the end-of-life processing. Furthermore, from the viewpoint of strictly determining error reproducibility, it is desirable to perform end-of-life processing when a command error occurs multiple times in succession. Alternatively, as shown in FIG. 33, if a command response is returned with an error while monitoring the command to the SSD 2 (steps S220, S221: Yes), the control tool 200 or the OS 100 sends the same command to the SSD 2 again (command retry). ) (Step S222), and if the retried command results in an error (Step S223: Yes), a process may be performed at the end of life (Step S224).

(Processing at the end of life)
Next, the process when the lifespan is reached (process when the abnormal state occurs) will be explained. In the first embodiment, a description will be given of a process when the life span is reached in a case where the normal OS and the emergency OS are already stored in the SSD 2. As shown in FIGS. 7 to 11, the normal OS 100A, the emergency OS 100B, and the boot loader 300 are, for example, written in the SSD 2 by the manufacturer of the computer system 1 before shipping the computer system 1, or After the computer system 1 is shipped, the user installs it using an installation disk such as a DVD-ROM, USB memory, or SSD, or after the computer system 1 is shipped, the user downloads an installation image from the web and installs using the downloaded installation image. Written to SSD2. In the NAND memory 16, as shown in FIG. An LBA is assigned to each of the areas 16C, 16D, and 16E. It is assumed that LBA16C is allocated to area 16C, LBA16D is allocated to area 16D, and LBA16E is allocated to area 16E. An LBA is similarly assigned to the aforementioned OS pointer information OSPT (pointer information indicating the LBA of the OS to be read) held within the boot loader 300, and the LBA assigned to the OSPT is referred to as LBAOSPT. LBAOSPT is included in LBA16C.

The control tool 200 rewrites the boot loader 300 so that the next time the computer system 1 is started up, the emergency OS 100B instead of the normal OS 100A is read into the area 6A on the main memory 6 of the host device 3. Normally, when OS100A is used by CPU4 as OS100, host device 3 may write to SSD2, which may further shorten the lifespan of SSD2 or erase the data written to SSD2 or the data already written. There is a possibility that the data stored in the file will be destroyed. On the other hand, according to this embodiment, the emergency OS 100B is read into the area 6A on the main memory 6 instead of the normal OS 100A, and when the CPU 4 is using the emergency OS 100B as an operating system, the host 3 writes data to the SSD 2. Therefore, before the data on the SSD 2 is destroyed or the SSD 2 becomes unreadable, read the data on the SSD 2 or transfer user data stored on the SSD 2 to another storage medium. It is possible to back up.

For example, when the end-of-life process is called in step S205 in FIG. 29, the control tool 200 rewrites the bootloader 300 as shown in FIG. At this time, the OS 100B is read into the area 6A on the main memory 6. For example, the control tool 200 writes LBA16E as write data to LBAOSPT. As a result, when the computer system 1 is started next time, the CPU 4 reads the OS pointer information OSPT and sends a read command to LBA16E, which is the LBA indicated by the OS pointer information OSPT, thereby reading out the emergency OS 100B. Can be done. Before and after rewriting the bootloader 300, the control tool 200 may display on the display 9 the message "The SSD has reached the end of its lifespan. Emergency OS will be enabled."

In FIG. 34, only the bootloader 300 is rewritten as the process when the lifespan is reached, but as shown in FIG. 35, the control tool 200 sends a reset command to the computer system 1 after rewriting the bootloader in step S240. Alternatively, the computer system 1 may be restarted by sending a reset command to the normal OS (step S241).

Further, as shown in FIG. 36, after the bootloader is rewritten in step S250, a message saying "The SSD has reached the end of its lifespan. Enabling the emergency OS. Do you want to restart now?" is displayed on the display 9. The text display and the OK button may be displayed (step S251), and when the OK button is pressed, for example, by the mouse 15 or the keyboard 14 (step S252: Yes), the computer system 1 may be restarted (step S251). S253). Also, instead of displaying the OK button, the text "SSD has reached the end of its lifespan. Enable emergency OS. Do you want to restart now? y: Yes, n: No" is displayed on the command prompt screen. The computer system 1 may be restarted when "y" and the enter key are input from the keyboard 14.

FIG. 37 shows the operating procedure when the computer system 1 is restarted. When the computer system 1 is restarted, the CPU 4 reads the boot loader 300 and the OS pointer information OSPT from the SSD 2 using the LBA and LBAOSPT corresponding to the area 16C (step S260). Next, the CPU 4 performs necessary boot processing using the boot loader 300, analyzes the OS pointer information OSPT, and specifies the LBA indicated by the OS pointer information OSPT. Then, the CPU 4 reads the OS specified by the OS pointer information OSPT from the SSD 2 by transmitting a read command for the specified LBA to the SSD 2. Therefore, when the LBA indicated by the OS pointer information OSPT specifies the area 16D which is the storage area of the normal OS 100A (step S261: Yes), the normal OA 100A is read from the area 16D and is read from the area 16D in the main memory 6. 6A (step S262), and when the LBA indicated by the OS pointer information OSPT specifies area 16E, which is the storage area of the emergency OS 100B (step S261: No), the emergency OA 100B is read from the area 16E. and is written to the area 6A on the main memory 6 (step S263). In this way, when the OS pointer information OSPT of the boot loader 300 is rewritten to read the emergency OS 100B by the end-of-life processing by the control tool 200, the emergency OA 100B is read from the area 16E and stored in the main memory 6. It will be written in the area 6A.

(backup function)
From the viewpoint of making it easier for the user to back up user data in the SSD 2 to another storage device, it is desirable to add a user data backup function to the emergency OS 100B. When the SSD2 is considered to have reached the end of its lifespan, the data retention characteristics of the SSD2 are considered to have deteriorated, so it is necessary to evacuate user data on the SSD2 to another backup storage device as soon as possible. It is.

FIG. 38 is a diagram showing the configuration of the host device 3 when the emergency OS 100B is equipped with a backup function. A backup storage device (another SSD, hard disk drive, etc.) 150 is connected to the host device 3 via an interface 19 (a SATA interface is used in this embodiment). The backup storage device 150 does not need to be installed when the computer system 1 is shipped. For example, if the user uses a separately purchased SSD as the backup storage device 150, connect the SSD's SATA port to the motherboard via a SATA cable. 30 (see FIG. 13), and the power port of the SSD 2 is preferably connected to the power source 32 via a power cable.

FIG. 39 shows an example of the startup procedure of the emergency OS 100B when a backup function is added to the emergency OS 100B. The operations in steps S270 to S273 in FIG. 39 are the same as the operations in steps S260 to S263 in FIG. 37. In FIG. 39, steps S274 to S276 are added to the startup procedure of the computer system 1 shown in FIG. 37. After the emergency OS 100B is started, the processing from step S274 onward is performed automatically when the user selects the backup function from the program menu of the emergency OS 100B using the keyboard 14 or mouse 15, or when the emergency OS 100B starts. will be started on. Before the backup process, it is desirable to display a message "Do you want to back up?" and an OK button on the display 9 so that the user can freely select the timing for backing up. When the OK button is selected using the mouse 15 or keyboard 14, the process advances to Yes in step S275. Alternatively, the message "Do you want to back up? Yes: Y, No: N" may be displayed on the display 9 via the command prompt, and you can proceed to Yes in step S275 by pressing the Y button and the enter key on the keyboard 14. good. In this manner, when the backup function is selected (step S275: Yes), the emergency OS 100B starts backup processing.

As for the content of the backup process, for example, the emergency OS 100B writes the data read from the SSD 2 to the same LBA (LBA on the backup storage device 150) as the LBA of the data read from the SSD 2 (LBA of the SSD 2). backup in LBA units). For example, data with LBA=0h on the SSD 2 is copied to LBA=0h on the backup storage device 150 (step S276). Furthermore, the data at LBA=234c5h on the SSD 2 is copied to LBA=234c5h on the backup storage device 150. To copy data, send the 60h READ FPDMA QUEUED or 25h READ DMA EXT command described in ACS-2 to the SSD 2, specifying the LBA and sector length, receive the read data from the SSD 2, and write it to the main memory 6. , for example, send 61h WRITE FPDMA QUEUED or 35h WRITE DMA EXT described in ACS-2 to the backup storage device 150 by specifying the LBA and sector length, and send the data written in the main memory 6 to the backup storage device 150. It is executed by The backup process may be performed for all LBA areas, or may be performed for only some LBA areas.

Note that during this backup process, the emergency OS 100B may copy all files on the SSD 2 to the backup storage device 150. In many OSes, a user does not access data by directly specifying an LBA, but uses a file ID (file name) to access data. For example, as shown in FIG. 40, the SSD 2 stores a file management table 140 that associates file IDs with LBAs and sector lengths. LBAs are also assigned to the file management table 140 according to the management information 44. Normally, the OS 100A converts the file ID received from other software shown in FIG. 12 into an LBA based on the file management table 140 and sends it to the SSD 2. It then converts it to a file ID and sends it to other software. In the backup process, the emergency OS 100B reads the file management table 140 from the SSD 2, and issues commands (60h READ FPDMA QUEUED, 25h READ DMA EXT command, etc.) to read the data of the LBA corresponding to the file management table 140 for each file ID. ) is sent to the SSD 2, and read data is received from the SSD 2 and written to the main memory 6. Furthermore, the emergency OS 100B reads the file management table (not shown) of the backup storage device 150, writes the data written in the main memory 6 to the LBA to which a file ID has not been assigned yet, and combines the written LBA and the file Acquire all LBAs of all files on the SSD 2 so that names are associated with each other, read all data of the acquired LBAs, write the read data to the backup storage device 150, and create a backup file so that the written LBAs and file IDs are associated with each other. The file management table (not shown) in the storage device 150 is rewritten. Backup processing may be performed on all files, or may be performed on only some files.

Furthermore, when writing backup data to the backup storage device 150, the data read from the SSD 2 may be compressed and written. In addition, it reads the management information of the SSD 2 including the file management table 140, obtains the information on the used areas and files, and creates a ROM image for the data of the SSD 2 based on the obtained information. The created ROM image may be stored in another backup storage device 150.

In the above description, the backup storage device is a SATA device connected via a SATA interface, but it goes without saying that other backup storage devices may be used. For example, as shown in FIG. 41, a USB storage device 151 such as a USB memory or a USB compatible SSD may be used as a backup storage device, and as shown in FIG. 42, a DVD-R or DVD may be used as a backup storage device. - A writable optical drive 152 such as RW or Blu-ray (registered trademark) Disc may be adopted, and as shown in FIG. 43, a network storage connected via the Internet or LAN as a backup storage device may be used. A server 153 may also be employed. Further, the backup function is also applicable to other embodiments.

As shown in FIG. 7, it is assumed that the storage area 16E of the emergency OS 100B is associated with the LBA in the management information 44. On the other hand, in order to prevent the data in the area 16E from being inadvertently rewritten by the user, an emergency OS should be recorded in the storage area 16E without allocating an LBA when the SSD 2 is shipped, and During processing, the control tool 200 may send an SCT Command Transport or a vendor-specific command to the SSD 2, so that the SSDC 41 rewrites the management information 44 and assigns the LBA to the area 16E. Alternatively, when the control tool 200 sends an SCT Command Transport or a vendor-specific command including the LBA Range of the area 16E to which the LBA is allocated to the SSD 2, the SSDC 41 changes the management information 44 so that the area 16E is not allocated to the LBA. The SSDC 41 may rewrite the management information 44 and allocate the LBA to the area 16E by having the control tool 200 send an SCT Command Transport or a vendor-specific command to the SSD 2 during the end-of-life processing.

According to the first embodiment, the control tool 200 determines whether the SSD 2 has reached the end of its lifespan and whether the SSD 2 is in a normal state, and determines that the SSD 2 has reached the end of its lifespan. or if the SSD 2 is determined to be in an abnormal state, the boot loader 300 is rewritten so that an emergency OS that does not support write operations is started, and when the computer system 1 is restarted, the emergency OS is activated, prohibiting write operations to the SSD2, or preventing write operations to the SSD2 from being performed explicitly, thereby preventing deterioration of the reliability of the SSD2, To prevent written data from being destroyed and to enable a user to easily read user data from an SSD 2 or back it up to another storage device.

(Second embodiment)
In the first embodiment, a case has been described in which both the normal OS 100A and the emergency OS 100B are stored in the NAND memory 16 of the SSD 2. In the second embodiment, a case will be described in which the normal OS 100A is stored in the SSD 2 and the emergency OS 100B is not stored in the SSD 2. In the second embodiment, the control tool 200 installs the emergency OS 100B before and after the rewriting process of the bootloader 300 (see steps S240 in FIGS. 34 and 35) during the lifespan reaching process shown in step S224 in FIG. , is installed in the area 16E of the NAND memory 16 of the SSD 2 from an external storage device 20 (see FIG. 8) that is different from the SSD 2. In order to prevent the emergency OS data from being destroyed due to the user inadvertently rewriting the area 16E in which the emergency OS of the SSD 2 is stored, it is possible to prevent the free space of the SSD 2 from decreasing by securing the area 16E. From the viewpoint of prevention, it is desirable to adopt the second embodiment.

Further, as shown in FIG. 9, for example, the control tool 200 downloads the data or installation program of the emergency OS 100B from the WEB server 21 before and after rewriting the boot loader 300, and installs the data in the NAND memory of the SSD 2 based on the downloaded data. The emergency OS 100B is installed in the area 16E of No. 16. Alternatively, the control tool 200 may display to the user through the display 9 the address of the web server that stores the emergency OS data or installation program.

Alternatively, as shown in FIGS. 10 and 11, the control tool 200 can control the external storage media (optical media such as DVD-ROM, USB memory, SD card, SSD, etc.) 23, 24 before and after rewriting the bootloader 300. The emergency OS 100B may be installed in the area 16E of the NAND memory 16 of the SSD 2. Alternatively, the control tool 200 may set an external storage medium (optical media such as a DVD-ROM, USB memory, SD card, SSD, etc.) in which the emergency OS 100B installation program is stored before and after rewriting the boot loader 300. Additionally, a message may be displayed to the user through the display 9.

When the emergency OS 100B is installed in the NAND memory 16, writing to the NAND memory 16 occurs, so from the perspective of preventing reliability deterioration and data destruction of the NAND memory 16, the amount of data of the emergency OS is limited to the amount of data in the NAND memory 16. It is desirable that it be significantly smaller than the capacity.

(Third embodiment)
In the third embodiment, a description will be given of a process when the life span is reached when the normal OS 100A and the emergency OS 100B are stored in a nonvolatile storage device 20 different from the SSD 2. As shown in FIG. 8, there are cases where the normal OS 100A and the emergency OS 100B are stored in a non-volatile storage device 20 separate from the SSD 2 and are not stored in the SSD 2, or when one of them is stored in the SSD 2 and the other is stored in the SSD 2. The present invention is also applicable when one of the two is stored in the nonvolatile storage device 20. In that case, the control tool 200 may need to rewrite not only the boot loader of the SSD 2 but also the boot loader of the nonvolatile storage device 20.

When the normal OS 100A and the emergency OS 100B are stored in a non-volatile storage device 20 different from the SSD 2, the control tool 200 rewrites the boot loader 300 stored in the non-volatile storage device 20, and updates the boot loader of the SSD 2. No rewriting will be performed.

If the normal OS 100A is stored in the SSD 2 and the emergency OS 100B is stored in the non-volatile storage device 20, the control tool 200 can rewrite the boot loader of both the SSD 2 and the non-volatile storage device 20. desirable. If the computer system 1 is started with the non-volatile storage device 20 removed from the host device 3, in order to prevent write access to the SSD 2 from occurring inadvertently, it is necessary to prevent the OS from starting normally. It is desirable that the bootloader be configured.

If the emergency OS 100B is stored in the SSD 2 and the normal OS 100A is stored in the nonvolatile storage device 20, it is desirable to rewrite the bootloader of both the SSD 2 and the nonvolatile storage device 20. It is sufficient to simply rewrite the boot loader of the storage device 20. In this case, even if the computer system 1 is started with the nonvolatile storage device 20 removed from the host device 3, the boot loader 300 of the SSD 2 is read and the emergency memory is read from the area 16E of the NAND memory 16 of the SSD 2. The OS can be started.

(Fourth embodiment)
In the fourth embodiment, a case will be described in which the normal OS 100A is installed on the SSD 2, but the emergency OS is not installed on the SSD 2. From the viewpoint of suppressing access to the SSD 2 whose reliability has deteriorated as much as possible, it is desirable to start the emergency OS 100B from a storage device other than the SSD 2. The control tool 200 of this embodiment has a function of creating a startup disk for emergency startup on which an emergency OS is installed during the end-of-life process.

As the startup disk for emergency startup, various non-volatile storage devices can be employed, such as a USB memory, an SD card, optical media such as a CD/DVD, an SSD, and a hard disk drive. In this embodiment, a case will be described in which a USB memory is used as a boot disk for emergency boot.

Data (image data) including emergency OS data for creating a startup disk for emergency startup can be stored in optical media such as SSD2, other SSDs, USB memory, SD cards, DVD-ROM drives, etc. It may be stored in a storage medium of a web server or the like. In this embodiment, a case will be introduced in which an SSD 2 is employed as a storage medium in which image data for emergency OS installation is stored. In other words, the installation source image data is stored in the SSD 2 itself, which has deteriorated in reliability.

When installing the emergency OS, image data is read from the SSD 2, but once the installation is performed, the image data is no longer read. Further, it is desirable that the control tool 200 has a function that allows the user to arbitrarily create a startup disk for emergency startup even before the SSD 2 reaches the end of its lifespan.

FIG. 44 shows a conceptual diagram of data movement when creating an emergency boot disk. Further, FIG. 45 shows the operating procedure of the control tool 200 when creating an emergency boot disk. When the control tool 200 starts the end-of-life process, it checks whether a USB memory is connected to the USB controller 13 of the host device 3, and if it is not connected, the control tool 200 displays the message ``Create a USB memory for emergency OS startup.'' It is desirable to display a message to the user via the display 9 saying, "Please connect the USB memory."

As shown in FIG. 44, when the USB memory 24 is connected, the control tool 200 extracts the emergency OS data from the installation image data 400 stored in the area 16Q of the NAND memory 16 of the SSD 2 (in an emergency If the OS data is compressed and encrypted, it is decrypted) and copied (installed) to the area 24R of the USB memory 24 (step S280). Next, the control tool 200 refers to the storage area 24R of the emergency OS 100B so that the emergency OS 100B installed in the USB memory 24 is read when the boot loader 310 stored in the USB memory 24 is read. The boot loader 310 is rewritten (step S281). Specifically, the control tool 200 writes, for example, the LBA corresponding to the storage area 24R into the OS pointer information OSPT311 of the boot loader 310.

When both the USB memory 24 and the SSD 2 are connected to the host device 3, the boot loader 310 and the boot loader 310 may be rewritten or the settings of the BIOS-ROM 11 may be changed so that the boot loader 310 of the USB memory 24 is started with priority. It is desirable to do so (step S282). Note that step S282 does not have to be executed.

In order to prevent the normal OS 100A from starting from the SSD 2 and inadvertently causing a write access to the SSD 2 when the USB memory 24 is not connected to the host device 3, in step S282, the normal OS from the SSD 2 is It is desirable to rewrite the boot loader 300 of the SSD 2 so that the OS 100A does not start. For example, by writing an LBA other than the storage area 16D of the normal OS 100A to the OS pointer information OSPT 301 of the boot loader 300, or writing an invalid LBA, the normal OS 100A may be loaded even if the boot loader 300 of the SSD 2 is read. can be prevented. Alternatively, the data in the normal OS 100A may be rewritten.

In this way, when the SSD 2 reaches the end of its service life or when the SSD 2 becomes abnormal, the data on the SSD 2 can be read out, or the data on the SSD 2 can be transferred to other It is possible to create a boot disk for booting an OS that can be backed up to a non-volatile storage device.

Further, as shown in FIG. 46, an OS such as MS-DOS (trademark), Linux (trademark), Windows (registered trademark) PE (trademark) is adopted as the emergency OS 100B, and the emergency OS is installed in the USB memory 24. At the same time, an emergency tool 210 having a function of backing up data on the SSD 2 may be installed in the area 24S of the USB memory 24, so that the emergency tool 210 can be executed from the emergency OS 100B. It is desirable that the emergency tool 210 has a backup function similar to that described in the first embodiment.

FIG. 47 shows the operation of the host device 3 at startup. When the host device 3 is started, the emergency OS 100B is read from the USB memory 24 and written to the main memory 6, thereby starting the emergency OS 100B from the USB memory 24 (step S290). Next, the emergency tool 210 is read from the USB memory 24 and written into the main memory 6, thereby starting the emergency tool 210 from the USB memory 24 (step S291). It is desirable that the emergency tool 210 is automatically started after the emergency OS 100B is started, such as by being registered in the startup of the emergency OS 100B.

As shown in FIG. 48, the emergency OS 100B displays a backup menu as one of the menu items that the user can select, or displays a message "Do you want to back up?" and an OK button via the display 9. It is preferable that the user arbitrarily enable the backup function by displaying the message "Do you want to back up?" and placing the keyboard 14 in a standby state for input (step S292). Note that the emergency OS 100B may automatically start backup.

When activating the backup function is selected using the keyboard 14 or mouse 15 (step S293), the emergency tool 210 is activated. The emergency tool 210 copies the data on the SSD 2 to the backup storage device 150 (step S293). As the backup method, a method similar to that described in the first embodiment may be adopted, and for example, LBA unit backup or file unit backup may be adopted.

(Fifth embodiment)
The embodiment described above makes it possible for a user to easily read user data from the SSD 2 or back it up to another storage device while suppressing deterioration in the reliability of the SSD 2 and data destruction in the SSD 2. The fifth embodiment further provides a method for suppressing reliability deterioration of the SSD 2. The SSD2 may be equipped with a function that performs refresh processing in the background in order to repair data corruption due to aging or read disturb. This function performs a process of periodically reading blocks of the NAND memory 16 and writing data from a block with a large number of data errors into another block. Although this makes it possible to reduce the effects of aging and read disturb, there is also the problem that the reliability of the SSD 2 deteriorates more quickly because extra blocks are erased and written.

In this embodiment, the control tool 200 or the emergency OS 100B uses a refresh control command (SCT Command Transport described in ACS-2, other vendor-specific commands, and other commands) to stop the execution of refresh. Command the SSDC 41. In response to the refresh control command, the SSDC 41 stops the refresh process or sets the refresh execution interval (eg, 1 minute) to be longer (eg, 2 minutes). If the SSDC 41 is to set a long refresh interval, it is desirable to explicitly specify the refresh interval in the refresh control command.

FIG. 49 shows the operation when the control tool 200 issues a refresh control command. In this case, the control tool 200 may issue a refresh control command during the lifespan reaching process shown in step S205 in FIG. 29. The control tool 200 rewrites the boot loader 300 described in FIG. 34 (step S300), and then sends a refresh control command to the SSD 2 (step S301).

FIG. 50 shows the operation when the emergency OS 100B issues a refresh control command. In this case, at the time of system startup, the CPU 4 reads the boot loader 300 including the OS pointer information OSPT from the NAND memory 16 of the SSD 2 (step S310), and specifies the LBA indicated by the OS pointer information OSPT. Then, the CPU 4 reads the OS specified by the OS pointer information OSPT from the SSD 2 by transmitting a read command for the specified LBA to the SSD 2. When the LBA indicated by the OS pointer information OSPT specifies the area 16D which is the storage area of the normal OS 100A (step S311: Yes), the normal OA 100A is read from the area 16D and stored in the area 6A on the main memory 6. is written (step S312), and when the LBA indicated by the OS pointer information OSPT specifies area 16E, which is the storage area of the emergency OS 100B (step S311: No), the emergency OA 100B is read from the area 16E and the main It is written to the area 6A on the memory 6 (step S313). When the emergency OA 100B is activated, the emergency OA 100B transmits a refresh control command to the SSD 2 (step S314).

In this manner, in the fifth embodiment, the control tool prohibits background write processing in the SSD 2, such as refresh processing, during the end-of-life processing, thereby increasing the reliability of the SSD. It becomes possible to suppress sexual deterioration.

(Sixth embodiment)
In the first embodiment, the control tool 200 periodically acquires statistical information as shown in FIG. I did it. The control tool 200 may predict the lifespan of the SSD 2 based on the acquired statistical information and notify the user through the display 9. This will be explained below.

When periodically acquiring statistical information according to the processing procedure shown in FIG. 29, the control tool 200 stores time-series data of the statistical information in the main memory 6 in the format shown in FIG. I'll add more notes. The statistical information time series data may be periodically backed up to a nonvolatile storage device such as the SSD 2, for example. Moreover, the statistical information time-series data may delete old data every time the latest data is added.

Further, the control tool 200 may display the statistical information time series data in the main memory 6 in a graph to the user via the display 9, for example, in a display format as shown in FIG.

In this embodiment, the lifetime of the SSD 2 is predicted based on this statistical information time series data. As shown in FIG. 53, the control tool 200 uses the Attribute Value of a certain Attribute ID as a variable Y, the time as a variable X, and the current time from a time A that is a certain predetermined time T before the current time. A fitting function Y=f(X) is determined using all data of (X, Y) for the period up to time C. That is, using f, the predicted value of Y from X=f(X)) can be obtained. There are various ways to derive f, but for example, use parameters a and b to set f(X)=aX+b, and calculate the minimum square for all data of (X, Y) from time A to time C. f may be determined by finding a and b using multiplication.

Then, f ⁻¹ (Y), which is an inverse function of f(X), is found. If f(X)=aX+b, find f ⁻¹ (Y)=(Y・b)/a. The estimated time when the SSD 2 reaches the end of its life is f ⁻¹ (Y=Threshold). Note that a fitting function X=g(Y) may be determined for all data of (X, Y) from time A to time C, and the estimated time when the SSD 2 reaches its lifespan may be set as g(Y=Threshold). Furthermore, f(X) and g(Y) may be fitted to a function other than a linear function, such as a quadratic function.

In this embodiment, the lifespan is predicted using SMART's Attribute Value (=Y) and Threshold, but the raw data Raw Value is used as Y to calculate f(X) and g(Y), and the expected lifespan is reached. The time may be set to f ⁻¹ (Y=RMAX) or g (Y=RMAX), or f ⁻¹ (Y=RMIN) or g (Y=RMIN). Furthermore, lifespan may be predicted using statistical information obtained using means other than SMART information.

The control tool 200 notifies the user of the estimated lifetime arrival time obtained in this way through the display 9. As a notification method, for example, it may be displayed in text such as "Estimated lifespan reached: September 9, 1999", or as shown in Figure 54, "The lifespan of the SSD is less than 30 days remaining. A warning screen such as "Please immediately back up the data on the SSD and replace it with a new SSD" may be displayed. Alternatively, when the remaining life of the SSD reaches a predetermined number of days, the color of the icon displayed on the display may be changed, such as by changing the color of the icon of the control tool 200.

(Seventh embodiment)
In the first embodiment, as shown in FIG. 38, when the normal OS 100A and the emergency OS 100B are stored in the NAND memory 16 of the SSD 2, the function backs up the data of the SSD 2 to the backup storage device 150. explained. The control tool 200 rewrites the boot loader 300 (step S230 in FIG. 34) as a lifespan reaching process (step S205 in FIG. 29), and as a backup function, for example, when adopting the above-mentioned LBA unit backup, the SSD 2 is then transferred to the host device. In order to normally start the OS 100A when the computer system 1 is powered on with the backup storage device 150 connected to the host device 3 and the backup storage device 150 It is desirable to restore the boot loader copied by the backup process to the state of the boot loader 300 of the SSD 2 before the end-of-life process. In this embodiment, a method of rewriting the boot loader of the backup storage device 150 during backup operation will be described.

FIG. 55 shows the functional configuration of the computer system 1 and the backup storage device 150 before and after the backup operation. In the restoration bootloader area 16V of the NAND memory 16 of the SSD 2, bootloader restoration information 350 for returning the bootloader 300 to the state before being rewritten by the control tool 200 is stored. The area 16V may be allocated by the control tool 200 during end-of-life processing, may be allocated when the control tool 200 is started, or may be allocated when the control tool 200 is installed in the SSD 2. The allocated area 16V has an LBA allocated to it according to the management information 45 of the SSD 2 (see FIG. 18).

FIG. 56 shows the operational procedure of the process when the life span is reached in this embodiment. In the end-of-life process, the backup storage device 150 does not need to be connected to the host device 3. The control tool 200 writes the backup information of the boot loader 300, that is, the boot loader restoration information 350, to the restoration boot loader area 16V during the end-of-life processing, that is, before rewriting the boot loader 300 (step S320). As the information to be written in the area 16V, for example, the data (image) of the boot loader 300 stored in the area 16C may be copied as is, or boot loader rewriting difference information may be recorded.

When recording the difference information in the area 16V, a rewrite difference log in which the correspondence between the data before rewriting and the rewritten LBA is recorded, as shown in FIG. 57, for example, may be used as the difference information. When adopting the rewrite differential log, the control tool 200 writes the rewritten LBA of the bootloader 300 stored in the area 16C to the “rewritten LBA” of the rewrite differential log, and stores the data of the same LBA before rewriting. is written to the "data before rewriting" in the rewriting differential log. For example, if the logical sector, which is the minimum unit of LBA, is 512 bytes, one element of "data before rewriting" in the rewriting differential log may be 512 bytes of data, or the data before rewriting may be compressed. Alternatively, the data may be reversibly converted data other than 512 bytes. When restoring the bootloader 300 from the new bootloader to the old bootloader using the rewrite difference log, write "pre-rewrite data" to the LBA indicated by "rewritten LBA" in the rewrite difference log in area 16C. You can restore to the old bootloader.

Thereafter, the control tool 200 rewrites the boot loader 300, and the next time the computer system 1 is started, the emergency OS 100B is read into the main memory 6 instead of the normal OS 100A, as described in the first embodiment. (step S321).

In order to facilitate the search for the restoration bootloader area 16V during a backup operation to be described later, the control tool 200 preferably writes the first LBA of the restoration bootloader area 16V in the bootloader area 16C (step S322). It is not necessarily necessary to write the first LBA of the restoration boot loader area 16V in the boot loader area 16C, but it is possible to write a specific data pattern at the beginning of the area 16V and search for this specific data pattern at the time of backup, which will be described later. 16V may be specified, or the area 16V may be fixedly associated with a predetermined specific LBA, and the area 16V may be specified by accessing the specific LBA during backup, which will be described later. Alternatively, the region 16V may be specified using other methods.

After step S321, the computer system 1 may be restarted as in the first embodiment, or a refresh control command for the SSD 2 may be sent as in the fifth embodiment. Further, the restoration boot loader area 16V may be secured in a storage device other than the SSD 2.

FIG. 58 shows a backup operation by the emergency OS 100B. At the time of backup, if the backup storage device 150 is not connected to the host device 3, the user connects the backup storage device 150 to the host device 3. At this time, the control tool 200 may display a message on the display 9 to the user asking "Please connect the backup device."

The emergency OS loaded from the area 16E of the NAND memory 16 to the area 6A of the main memory 6 copies the data of the SSD 2 to the backup storage device 150 in the same manner as in the first embodiment (step S330). For example, when LBA unit backup is adopted as the backup method and all LBA areas of the SSD 2 are copied to the backup storage device 150, the normal OS 100A stored in the area 16D is stored in the area 150D of the backup storage device 150. Other user data that has been copied to area 16U and is stored in area 16U is copied to area 150U. The boot loader 300 stored in the boot loader area 16C may or may not be copied to the area 100C of the backup storage device 150. The emergency OS 100B stored in the area 16E may or may not be copied to the area 150E of the backup storage device 150. Further, the boot loader restoration information 350 stored in the restoration boot loader area 16V does not need to be copied to the backup storage device 150.

The emergency OS 100B creates a bootloader 320 to be stored in the backup storage device 150 based on the bootloader restoration information 350 and the data of the bootloader 300, and writes the created bootloader 320 to the area 150C of the backup storage device 150. If the boot loader 320 is loaded at the next startup of the computer system 1, the normal OS 100A is loaded into the area 6A of the main memory 6 (step S331).

In the boot loader backup process in step S320 in FIG. 56, if the data (image) of the boot loader 300 stored in the area 16C is copied as is to the restoration boot loader area 16V, in step S331 in FIG. The boot loader restoration information 350 of the boot loader area 16V may be copied as is to the area 150C of the backup storage device 150.

In addition, in the bootloader backup process in step S320 of FIG. 56, if the rewriting difference information of the bootloader area 16C is recorded in the restoration bootloader area 16V, that is, the bootloader area 16C is rewritten from the old bootloader data to the new bootloader data. If the difference information for rewriting the new and old bootloader data at the time is recorded in the restoration bootloader area 16V, the emergency OS 100B, in step S331 of FIG. The bootloader restoration information 350, which is the differential data stored in the bootloader area 16V, is read into the main memory 6, the new bootloader data is restored to the old bootloader data based on the bootloader restoration information 350, and the restored old bootloader data is used for backup. Write to area 150C of storage device 150.

After performing the above backup process, disconnect the SSD 2 that has reached the end of its lifespan from the host device 3 by removing the SSD 2 from IF0, and connect the backup storage device 150 to IF1 to transfer the backup storage device 150 to the host device 3. When the computer system 1 is started while connected to the computer, the host device 3 reads the boot loader 320 of the backup storage device 150, and based on the information in the boot loader 320, the host device 3 stores the area 150D of the backup storage device 150 in the main memory 6. The normal OS is started by loading it into the area 6A. If the backup storage device 150 is compatible with the interface IF0, the backup storage device 150 may be replaced with the SSD 2 and the backup storage device 150 may be connected to the interface IF0. If the backup storage device 150 is not compatible with the interface IF0, the backup storage device 150 may be replaced with the SSD 2, and the backup storage device 150 may be connected to the interface IF0 via an interface conversion device.

In this way, even if the SSD 2 reaches the end of its lifespan, the computer system 1 can restore the user data and normal OS stored on the SSD 2 to the backup storage device, and the user can It is possible to replace the SSD 2 with the backup storage device 150 and use the backup storage device 150 as a system drive instead of the SSD 2 without reinstalling the OS during normal operation.

(Eighth embodiment)
In this embodiment, when the host device to which the SSD 2 is connected is started when the SSD 2 returns from an abnormal state (end of life state) to a normal state (healthy state), the normal OS is started instead of the emergency OS. Do it like this.

As statistical information, for example, current temperature x20 and maximum temperature x21, the larger the value, the worse the reliability.Even if the value increases to a value that has a negative impact on reliability, it will return to normal again after that. When adopting parameters having characteristics that can be recovered, for example, RMAX = 85 ° C. is adopted as RMAX for those statistical information,
Statistical information value > RMAX
or Statistical information value≧RMAX
When a condition such as temperature outside guaranteed operation is established, the control tool 200 rewrites the boot loader 300 so that the next time the computer system 1 is started, the emergency OS 100B is used in the main memory 6 instead of the normal OS 100A. so that it is read out.

After startup, the emergency OS 100B monitors the values of statistical information,
When the statistical information value ≦ RMAX - MAX margin or the statistical information value < RMAX - MAX margin and the statistical information returns to its normal value, the computer system 1 can be booted from the next time by rewriting the boot loader 300. Sometimes, bootloader restoration processing is executed so that the normal OS 100A is read into the main memory 6 instead of the emergency OS 100B.

The MAX margin is a value greater than or equal to zero, but in order to prevent frequent rewriting of the boot loader 300, the MAX margin is desirably a value greater than zero. If the statistical information is the current temperature or the maximum temperature, for example, MAX margin = 5°C. When using SMART information to obtain statistical information and determine conditions, Attribute Value and Threshold may be used, or Raw Value and RMAX may be used. Furthermore, if the statistical information returns from an abnormal state to a normal state during normal OS startup, the control tool 200 may perform the boot loader restoration process.

As statistical information, such as current temperature x20 and minimum temperature x22, the smaller the value, the worse the reliability is, and even if the value decreases to a value that has a negative impact on reliability, it will recover to the normal value after that. When adopting parameters with characteristics that allow for
Statistical information value < RMIN
Or statistical information value ≦ RMIN
For example, when a condition occurs where the temperature is outside guaranteed operation, the control tool 200 rewrites the bootloader 300 so that the next time the computer system 1 is started, the emergency OS 100B is used as the main memory instead of the normal OS 100A. so that it is read out.

After startup, the emergency OS 100B monitors the values of statistical information,
When the value of statistical information ≧ RMIN + MIN margin or the value of statistical information > RMIN + MIN margin and the statistical information returns to its normal value, by rewriting the boot loader 300, the next time the computer system 1 is started up, the emergency Bootloader restoration processing is executed so that the normal OS 100A is read into the main memory 6 instead of the OS 100B.

The MIN margin is a value greater than or equal to zero, but in order to prevent frequent rewriting of the boot loader 300, it is desirable that the MIN margin be a value greater than zero. If the statistical information is the current temperature or the lowest temperature, for example, MIN margin=5°C. When using SMART information to obtain statistical information and determine conditions, Attribute Value and Threshold may be used, or Raw Value and RMIN may be used.

Next, details of the operation of the control tool 200 in the end-of-life processing will be described. When returning from an abnormal state (end-of-life state) to a normal state (healthy state), it is desirable that the boot loader 300 be restored to the boot loader before being rewritten in the end-of-life process by the boot loader restoration process described above. FIG. 59 shows the functional configuration of the computer system 1 before and after the boot loader restoration process. In the restoration bootloader area 16V of the NAND memory 16 of the SSD 2, bootloader restoration information 350 for returning the bootloader 300 to the state before being rewritten by the control tool 200 is stored. The area 16V may be allocated by the control tool 200 during end-of-life processing, may be allocated when the control tool 200 is activated, or may be allocated when the control tool 200 is installed in the SSD 2. The allocated area 16V has an LBA allocated to it according to the management information 45 of the SSD 2 (see FIG. 18). Furthermore, the area 16V of this embodiment may be the same as the area 16V shown in FIG. 55 and used for restoring the boot loader during backup, or it may be different from the area 16V shown in FIG. good.

The procedure for processing when the lifespan is reached is the same as that shown in FIG. 56. That is, the control tool 200 writes the backup information of the boot loader 300, that is, the boot loader restoration information 350, to the restoration boot loader area 16V during the end-of-life processing (step S320). As the information to be written in the area 16V, for example, the data (image) of the boot loader 300 stored in the area 16C may be copied as is, or boot loader rewriting difference information may be recorded. After that, the control tool 200 rewrites the boot loader 300 so that the next time the computer system 1 is started up, the emergency OS 100B is read into the main memory 6 instead of the normal OS 100A (step S321).

Furthermore, in order to facilitate the search for the restoration bootloader area 16V during a backup operation to be described later, it is desirable that the control tool 200 write the first LBA of the restoration bootloader area 16V in the bootloader area 16C (step S322). ). It is not necessarily necessary to write the first LBA of the restoration boot loader area 16V in the boot loader area 16C, but it is possible to write a specific data pattern at the beginning of the area 16V and search for this specific data pattern at the time of backup, which will be described later. 16V may be specified, or the area 16V may be fixedly associated with a predetermined specific LBA, and the area 16V may be specified by accessing the specific LBA during backup, which will be described later. Alternatively, the region 16V may be specified using other methods.

After step S321, the computer system 1 may be restarted as in the first embodiment, or a refresh control command for the SSD 2 may be sent as in the fifth embodiment. Further, the restoration boot loader area 16V may be secured in a storage device other than the SSD 2.

FIG. 60 shows boot loader restoration processing by the emergency OS 100B. After the end-of-life processing (after abnormality processing), when the computer system 1 is booting using the emergency OS, the emergency OS 100B monitors statistical information using, for example, the above-mentioned SMART READ DATA, and displays the statistical information. It is determined whether the value has returned to a normal value (step S340). When the statistical information returns to the normal value based on the above-mentioned criteria (step S340: Yes), the emergency OS 100B restores the boot loader restoration information 350 stored in the restoration boot loader area 16V and the boot loader stored in the boot loader area 16C. Based on the data of 300, a boot loader that normally processes the OS 100A to be loaded into the area 6A of the main memory 6 is created, and the created boot loader is written into the boot loader area 16C (step S341). As a result, when the boot loader 300 is loaded the next time the computer system 1 is started, the normal OS 100A is loaded into the area 6A of the main memory 6.

In the boot loader backup process in step S320 in FIG. 56, if the data (image) of the boot loader 300 stored in the area 16C is copied as is to the recovery boot loader area 16V, in step S341 in FIG. The boot loader restoration information 350 of the boot loader area 16V may be copied as is to the area 150C of the backup storage device 150.

In addition, in the bootloader backup process in step S320 of FIG. 56, if the rewriting difference information of the bootloader area 16C is recorded in the restoration bootloader area 16V, that is, the bootloader area 16C is rewritten from the old bootloader data to the new bootloader data. If the difference information for rewriting the new and old bootloader data is recorded in the restoration bootloader area 16V, the emergency OS 100B, in step S341 of FIG. The bootloader restoration information 350, which is the differential data stored in the bootloader area 16V, is read into the main memory 6, the new bootloader data is restored to the old bootloader data based on the bootloader restoration information 350, and the restored old bootloader data is used for backup. Write to area 150C of storage device 150.

In this way, in this embodiment, as shown in FIG. 61, when the statistical information changes from a normal state to an abnormal state, an abnormality arrival process is executed to start the abnormality OS, and the statistical information is changed from a normal state to an abnormal state. When the abnormal state returns to the normal state, a boot loader restoration process is executed so that the normal OS is started.

In this way, even if the SSD 2 is temporarily in an abnormal state, after the SSD 2 returns to a normal state (healthy state), the computer system 1 will start the OS during normal operation, and the user can handle the SSD 2 in the same way as before the end-of-life processing without performing extra settings or reinstalling the OS during normal operation.

Although several embodiments of the invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and changes can be made without departing from the gist of the invention. These embodiments and their modifications are included within the scope and gist of the invention, as well as within the scope of the invention described in the claims and its equivalents.

1 computer system, 3 host device, 6 main memory, 16 NAND memory, 20 non-volatile storage device, 100A normal OS, 100B emergency OS, 200 control tool, 210 emergency tool, 300 boot loader, 350 boot loader restoration information.

Claims (6)

A non-volatile semiconductor memory including memory cells for storing data and capable of electrically erasing data recorded in the memory cells using a plurality of the memory cells as a first unit; a volatile semiconductor memory; a nonvolatile semiconductor memory, a controller circuit for controlling the volatile semiconductor memory, and an interface circuit;
a semiconductor memory device comprising;
a host device that is connectable to the semiconductor storage device and configured to send write and read commands to the semiconductor storage device;
An information processing device comprising:
At least one of the nonvolatile semiconductor memory and the volatile semiconductor memory includes first information specifying a physical address of the nonvolatile semiconductor memory corresponding to logical address information received from the host device via the interface circuit. It is configured to be able to record
When the controller circuit receives a write command from the host device via the interface circuit, the controller circuit generates a correction code using the data received from the host device,
When the data and the correction code are recorded in the non-volatile semiconductor memory and a read command is received from the host device via the interface circuit, the data is read from the non-volatile semiconductor memory using the first information. configured to be able to correct the read data based on the read data and the corresponding correction code,
The nonvolatile semiconductor memory includes:
second information based on the total usage time of the semiconductor storage device;
third information based on the total amount of write data received in response to the write command received from the host device;
fourth information based on the total amount of data read from the nonvolatile semiconductor memory in response to a read command received from the host device;
fifth information regarding the number of pieces of data that could not be corrected by the controller circuit even if the data read from the nonvolatile semiconductor memory was used with the corresponding correction code;
sixth information indicating, in the first unit, information corresponding to the number of memory cells in which it is determined that data cannot be written in the nonvolatile semiconductor memory;
configured to remember
first software and second software that prohibits sending a write command to the semiconductor storage device,
The host device includes:
reading and executing the first software from the semiconductor storage device;
acquiring a plurality of information including the second information to the sixth information from the semiconductor storage device, and calculating the remaining life of the semiconductor storage device based on at least one of the acquired information;
The device is configured to read the second software from the semiconductor storage device and execute the second software when determining that the semiconductor storage device has reached the end of its lifetime based on the calculated remaining lifetime. Information processing device. The information processing apparatus according to claim 1, wherein the host device determines that the semiconductor storage device has reached the end of its life when the remaining life is less than a predetermined value. 3. The information processing apparatus according to claim 1, wherein the host device backs up data stored in the semiconductor storage device to a backup storage device connectable to the host device. Any one of claims 1 to 3, wherein the host device displays a warning screen on a display device connected to the host device when determining that the semiconductor storage device has reached the end of its lifespan. The information processing device described in . 5. The information processing apparatus according to claim 4, wherein the warning screen includes a message urging backup of data stored in the semiconductor storage device. The information processing apparatus according to any one of claims 1 to 5, wherein each of the second to fifth information includes an attribute ID.

Images