Solid-state electronic disk soft-destroying method, device and system

Abstract

The application relates to the technical field of storage, and particularly discloses a solid-state electronic disk soft failure method, device and system, which are mainly used for solving the systematic vulnerability problems of key metadata single-point failure, power-on deadlock, single recovery strategy and insufficient redundancy protection of core components of the existing solid-state electronic disk in extreme application scenarios. The method comprises the following steps: abnormity sensing, real-time monitoring of metadata integrity, a PCIe link and power-on progress, and generation of an abnormal data packet; decision arbitration according to abnormal matching of a recovery strategy, generation of an instruction packet; execution layer scheduling of hardware to complete a repair or cleaning operation, and feedback of a result. Through the above scheme, the solid-state electronic disk deep failure can be intelligently sensed, accurately arbitrated and effectively recovered without physical intervention, and the reliability, availability and safety of the solid-state electronic disk are significantly improved.

Description

Technical Field

[0001] This invention belongs to the field of storage technology, specifically relating to a method, apparatus, and system for soft destruction of a solid-state electronic disk. Background Technology

[0002] In existing technologies, the operation of solid-state drives (SSDs) heavily relies on a sophisticated metadata management system. This system typically includes a system log (SysLog) for recording the overall status and configuration information of the SSD, a block information table (BsInfo) detailing the lifecycle and health status of NAND flash blocks, and a valid capacity table (VFC) for tracking the amount of valid data. These metadata tables work together to ensure that data can be correctly written, read, erased, and garbage collected (GC). When an SSD fails, its built-in firmware usually attempts to resolve the issue through a series of pre-defined recovery procedures, such as using a watchdog timer to detect system deadlock and trigger a reset, or attempting ECC (Error Correction Code) correction when partial data corruption is detected. For more serious failures, such as those requiring firmware re-flashing or hardware component replacement, traditionally, physical maintenance methods are relied upon for repair. This recovery paradigm, based on firmware self-testing combined with a hardware watchdog and, when necessary, physical intervention, is considered a reasonable solution that balances cost-effectiveness and reliability in consumer-grade or general enterprise applications.

[0003] Traditional solid-state drives (SSDs) rely on a single point of failure for critical metadata, making them highly susceptible to irreversible damage even from partial data corruption. For example, a corrupted SysLog table can cause inconsistencies between the SSD's internal state and the actual data, leading to data corruption in subsequent read and write operations. Similarly, corruption in the BsInfo table can result in misjudgments of block states, causing the garbage collection mechanism to incorrectly delete blocks still containing valid user data. Corruption in the VFC table can lead to incorrect calculations of available capacity, ultimately exhausting free blocks and triggering a writable state. In these situations, the lack of effective software-level redundancy or intelligent repair mechanisms means that corruption in any critical metadata table can directly render the entire SSD unusable, resulting in the permanent loss of user data.

[0004] Existing recovery mechanisms for firmware anomalies, such as system reset based on watchdog timers, have revealed serious shortcomings when dealing with "power-on deadlock" issues caused by deep firmware defects. When a solid-state drive (SSD) gets stuck during the power-on recovery process due to firmware anomalies, although the watchdog timer can force a system reset, its design typically involves indiscriminately re-executing the same power-on recovery process. This makes the SSD highly susceptible to a vicious cycle of "reset-get stuck-reset again," resulting in an unsolvable deadlock state.

[0005] The reason for this lies in the fact that traditional watchdog mechanisms only focus on whether the system stops responding, rather than intelligently identifying the root cause of the failure and choosing to skip the problem process or perform a fundamental repair. In such cases, the only solution is often to manually disassemble the solid-state drive and re-flash the firmware using specialized equipment. However, in industrial scenarios (such as hermetically sealed radiation-proof / waterproof enclosures), the inoperability of physical maintenance renders this seemingly "last resort" recovery method completely ineffective, resulting in business interruption losses of hundreds of thousands to tens of millions of dollars or the direct failure of strategic missions, exposing a serious technological gap.

[0006] Furthermore, the host's response to unresponsive solid-state drives is too simplistic, lacking a layered and intelligent recovery mechanism. Existing systems often struggle to accurately distinguish between temporary delays caused by internal garbage collection (GC) and actual physical disk failure.

[0007] The "one-size-fits-all" approach leads to frequent host resets, which not only fails to effectively solve the problem but may also exacerbate the consumption of free blocks within the solid-state drive (SSD), even triggering emergency garbage collection (GC) and accelerating the transition to a writable state, further reducing system reliability and availability. When core boot components such as the Boot block or firmware image (FWImage) suffer partial damage, traditional SSDs will fail to boot altogether. Furthermore, dual redundancy designs are rarely used for critical metadata such as SysLog, making single points of failure a systemic vulnerability.

[0008] Therefore, current solid-state drives (SSDs) still heavily rely on physical operations for emergency recovery from deep firmware anomalies or critical metadata corruption. They lack stable and reliable self-recovery capabilities that can be achieved through software and remote control when the host is disconnected or physical maintenance is not feasible.

[0009] Current solid-state drive (SSD) architectures and recovery strategies fail to effectively meet the stringent requirements of metadata reliability, anomaly self-recovery capabilities, and maintainability without physical intervention in extreme, high-value application scenarios. Considerations of efficiency and cost in traditional designs have led to issues such as single points of failure in metadata, blind firmware reset cycles, and a lack of remote software repair channels. These problems have escalated into unacceptable systemic risks in specific application scenarios. Summary of the Invention

[0010] The purpose of this invention is to provide a method, apparatus and system for soft destruction of solid-state electronic disks, which aims to solve the systemic vulnerability of existing solid-state electronic disks in extremely high-value and high-security application scenarios due to single point of failure of critical metadata, power-on deadlock, single host recovery strategy and lack of redundant protection of core boot components.

[0011] To achieve the above-mentioned objective, the present invention provides a method for soft-destroying a solid-state electronic disk, comprising the following steps:

[0012] Anomaly detection steps: The anomaly detection layer inside the solid-state electronic disk monitors the integrity of key metadata, PCIe link status and power-on process progress in real time. When an anomaly is detected, it generates a structured anomaly data packet containing the anomaly type, physical address of occurrence, anomaly level, timestamp, anomaly fluctuation trend and anomaly occurrence cycle.

[0013] Decision arbitration steps: The decision arbitration layer inside the solid-state electronic disk receives the structured anomaly data packet and classifies it into recoverable anomalies or unrecoverable anomalies according to the anomaly type, severity, and recovery probability; The decision arbitration layer matches the corresponding recovery strategy by looking up a table and generates a recovery instruction packet carrying the operation type, target physical address, and operation parameters;

[0014] Feedback execution steps: The execution layer inside the solid-state electronic disk receives the recovery instruction package, and the hardware unit is guided by firmware instruction scheduling to complete metadata copy switching, user data erasure, control table reconstruction or system reset operations; after execution, the execution layer outputs a recovery result signal and returns a status code to the host controller through the master controller.

[0015] The key metadata includes the SysLog dual-copy system log table, the BsInfo block information table, and the VFC effective capacity table.

[0016] During power-on initialization, the anomaly perception layer loads in parallel the first copy of SysLog, the second copy of SysLog, the BsInfo table, and the VFC table located in an independent physical storage area.

[0017] The integrity of the first SysLog copy, the second SysLog copy, and the BsInfo copy is verified using a hardware-level CRC32 checker, and the auto-incrementing serial numbers of the first SysLog copy and the second SysLog copy are extracted for version comparison.

[0018] The SysLog dual-copy verification loading and version comparison includes:

[0019] The solid-state electronic disk controller issues two NAND read commands to access the predefined physical pages of the first SysLog copy and the second SysLog copy in parallel;

[0020] The CRC32 hardware checker inside the controller is used to perform real-time verification of the SysLog first replica data stream and the SysLog second replica data stream.

[0021] If both the first and second copies of SysLog pass the verification, their respective auto-incrementing sequence numbers are compared to determine the latest version and then loaded.

[0022] If only one of the SysLog first copy or SysLog second copy passes the verification, then that copy is marked as having a downgraded valid state.

[0023] If both the first and second copies of SysLog fail CRC checks, a SysLog dual-copy corruption flag is generated.

[0024] The BsInfo table reading process and ECC error correction and statistics mechanism specifically include: the solid-state electronic disk soft destruction system sequentially reads the BsInfo data blocks according to the pre-compiled static address table and transmits them to the DRAM buffer in segments; after reading each segment of data, it calls the BCH or LDPC decoder built into the main controller to perform error detection and correction, and records the number of BitErrors in the segment; if error correction fails or the error rate after correction exceeds a preset threshold, the segment is marked as "unavailable"; if the BsInfo main table reading fails, it automatically attempts to access the backup table; if both the main table and the backup table are unavailable, it is marked as "BsInfo total loss" and an "unrecoverable exception" status code is uploaded.

[0025] The decision arbitration layer performs classification analysis and recovery strategy selection based on the abnormal information uploaded by the perception layer. Specifically, this includes: classifying the abnormal information into recoverable and unrecoverable anomalies according to their severity and recoverability; for recoverable anomalies, the decision arbitration layer matches a recovery strategy by looking up a table, and the strategies include, but are not limited to, reducing the write command rate, adjusting the garbage collection (GC) scheduler delay slots, dynamically remapping the NAND channel allocation strategy, or triggering PCIe link retraining; for unrecoverable anomalies, the decision arbitration layer matches a recovery strategy by looking up a table, and the strategies include, but are not limited to, triggering the metadata reset initialization process, skipping the power-on self-test process, or degrading the channel operation; if the abnormal state exceeds a preset number of consecutive occurrences, the decision arbitration layer automatically upgrades the strategy level; the decision arbitration layer generates a recovery instruction package and sends it to the execution layer through a dedicated channel.

[0026] The three-level adaptive deceleration control system in the recoverable anomaly handling includes:

[0027] The command rate limiter is configured to take over the NVMe command scheduling interface and reduce the queuing rate to a preset ratio range when a high-concurrency write scenario is detected.

[0028] The GC scheduler delay slot adjustment module is configured to use a segmented slot triggering model, which automatically increases the GC task insertion interval when it detects an increase in host I / O pressure.

[0029] The channel arbitrator dynamic remapping module is configured to dynamically adjust the NAND channel allocation strategy and temporarily shut down some GC threads in severe congestion scenarios.

[0030] The unrecoverable anomaly response mechanism includes: if the SysLog single copy is detected to be corrupted, another valid copy is automatically selected and loaded;

[0031] If both copies of SysLog are corrupted, a reset initialization process is triggered. The reset initialization process includes clearing the user data area (setting all logical block addresses LBA to 0), rebuilding the SysLog table (initial sequence number SN=0), the BsInfo table (marking all blocks as FREE), and the VFC table (all block valid values=0), and writing the newly created three tables into the two copies of the SysLog block.

[0032] The hardware trigger recovery mechanism includes: when the watchdog timer built into the controller overflows naturally when the system is stuck or in an infinite loop, it outputs the WDT_RESET_TRIGGER signal, triggering an on-chip soft reset or a full chip reset, and clearing the intermediate state data in memory.

[0033] After the controller starts the self-recovery process, it automatically enters the debug serial port interrupt state. The on-chip serial port command parser bypasses the main control firmware path through the embedded initialization instruction sequence and directly controls the internal Flash operation logic unit, sending the command chain to the Flash subsystem.

[0034] The NAND controller calls the erase voltage generator module, controls the erase voltage to rise to a preset level according to the instruction address, and the pulse controller controls the erase pulse width and verifies whether the data read after erasure is all 0xFF, ensuring that all critical metadata pages are cleared.

[0035] The recovery and reconstruction process includes starting the minimum bootable configuration, loading the secure boot program, temporary configuration mapping table and blank SysLog pages, and the controller re-establishing the system state by scanning the distribution of empty Flash pages / blocks, entering the "secure running state", and waiting for the host to rewrite the mapping table.

[0036] The reinforcement mechanism includes:

[0037] The triple-redundant SysLog replica architecture adds a set of backup replicas in an independent channel and adopts a 2-out-of-1 verification mechanism.

[0038] The NAND hot erase random perturbation algorithm inserts pseudo-random write operations during the initial erase process to prevent residual images.

[0039] Restart dynamic encryption verification; all initialization pages are encrypted and verified using the Secure-HMAC algorithm.

[0040] The present invention also provides a solid-state electronic disk soft-destruction device, characterized in that it comprises:

[0041] The anomaly detection module is configured to monitor the integrity of key metadata, PCIe link status and power-on process progress inside the solid-state electronic disk in real time, and generate structured anomaly data packets when an anomaly is detected.

[0042] The decision arbitration module is configured to receive the structured anomaly data packet, classify it into recoverable anomalies or unrecoverable anomalies according to the anomaly type, severity and recovery probability, and generate a recovery instruction packet by matching the recovery strategy through a table lookup method.

[0043] The execution module is configured to receive the recovery instruction package and, under the guidance of firmware instructions, direct the hardware unit to complete metadata copy switching, user data erasure, control table reconstruction, or system reset operations.

[0044] The anomaly detection module includes:

[0045] The metadata integrity monitoring unit is configured to load the first copy of SysLog, the second copy of SysLog, the BsInfo table, and the VFC table in parallel during power-on initialization, and perform integrity verification and version comparison through a hardware-level CRC32 checksum.

[0046] The link status monitoring unit is configured to monitor the PCIe link status and generate a communication anomaly flag when the number of consecutive NAK signals exceeds a preset threshold or the number of link training failures exceeds a preset number.

[0047] The power-on process progress monitoring unit is configured to monitor the time it takes for the system to enter normal working state via a software timer after the solid-state electronic disk is powered on and started.

[0048] The SysLog dual-replica verification loading and version comparison mechanism is implemented by the metadata integrity monitoring unit, and its configuration is as follows:

[0049] Two NAND read commands are issued to access the predefined physical pages of the SysLog dual replicas in parallel, and the read page contents are loaded into the internal cache RAM via DMA;

[0050] The CRC32 hardware checker inside the controller is used to perform real-time verification on the two replica data streams.

[0051] If any copy passes the verification, the auto-incrementing sequence number is extracted from the specified location of the copy and written to the corresponding register;

[0052] If both copies pass the verification, the auto-incrementing sequence number is compared to determine the latest version, and the latest version SysLog is loaded.

[0053] If only one copy passes the verification, it is marked as a "downgraded valid" copy.

[0054] If both copies fail CRC checks, a "SysLog dual copy corruption" flag is generated, the fault level is set to "unrecoverable", and the error is reported to the decision arbitration module.

[0055] The BsInfo table reading process and ECC error correction statistics mechanism are implemented by the metadata integrity monitoring unit, which is configured as follows:

[0056] According to the pre-compiled static address table, the BsInfo data blocks are read sequentially and transmitted to the DRAM buffer in segments;

[0057] After reading each data segment, the built-in BCH or LDPC decoder of the main controller is called to perform error detection and correction, and the number of BitErrors in the segment is recorded. If the error correction fails or the error rate after correction exceeds the preset threshold, the segment is marked as "unavailable". If the BsInfo main table fails to be read, the backup table is automatically accessed. If both the main table and the backup table are unavailable, it is marked as "BsInfo completely lost" and an "unrecoverable exception" status code is uploaded.

[0058] The recovery strategy selection mechanism of the decision arbitration module is configured as follows:

[0059] The abnormal information is classified into recoverable abnormalities and unrecoverable abnormalities based on its severity and recoverability.

[0060] For recoverable anomalies, the decision arbitration module matches recovery strategies by looking up a table. These strategies include, but are not limited to, reducing the write command rate, adjusting the garbage collection scheduler delay slots, dynamically remapping the NAND channel allocation strategy, or triggering PCIe link retraining.

[0061] For unrecoverable anomalies, the decision arbitration module matches recovery strategies by looking up a table. These strategies include, but are not limited to, triggering the metadata reset initialization process, skipping the power-on self-test process, or degrading the channel operation.

[0062] If the abnormal state occurs more than a preset number of times consecutively, the decision arbitration module automatically upgrades the policy level; the decision arbitration module generates a recovery instruction package and sends it to the execution module through a dedicated channel.

[0063] The execution module is configured to automatically select another valid copy to load when the single copy of SysLog is detected to be corrupted; if both copies of SysLog are corrupted, a reset initialization process is triggered. The reset initialization process includes clearing the user data area (setting all logical block addresses LBA to 0), rebuilding the SysLog table (initial sequence number SN=0), the BsInfo table (marking all blocks as FREE), and the VFC table (all block valid values=0), and writing the newly created three tables into the two copies of the SysLog block.

[0064] The execution module further includes:

[0065] The watchdog timer is configured to overflow naturally when the system is stuck or in an infinite loop, outputting the WDT_RESET_TRIGGER signal to trigger an on-chip soft reset or full chip reset and clear intermediate memory data.

[0066] The serial port command parser is configured to automatically enter the debug serial port interrupt state after the controller starts the self-recovery process. It bypasses the main control firmware path through the embedded initialization instruction sequence, directly controls the internal Flash operation logic unit, and sends the command chain to the Flash subsystem.

[0067] The erase voltage generator is configured to control the erase voltage to rise to a preset level according to the instruction address. The pulse controller controls the erase pulse width and verifies whether the data read after erasure is all 0xFF, ensuring that all critical metadata pages are cleared.

[0068] The execution module is also configured to, after performing erasure and forced initialization, start the minimum bootable configuration, load the secure boot program, temporary configuration mapping table and blank SysLog page, re-establish the system state by scanning the distribution of Flash empty pages / blocks, enter the "secure running state", and wait for the host to rewrite the mapping table.

[0069] The present invention also provides a solid-state electronic disk soft-destruction system, comprising:

[0070] One or more solid-state electronic disks, each of which integrates a solid-state electronic disk soft destruction device;

[0071] A host controller is used to send read / write requests to the solid-state drive and, upon receiving a status code returned by the solid-state drive, to determine the recovery effect based on the status code.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] The solid-state electronic disk soft destruction method, device, and system described in this invention construct a multi-layered self-recovery system with hardware-firmware collaboration. Based on Shannon redundancy coding theory, intelligent fault tolerance and recovery for metadata corruption is achieved through dual-copy redundancy of key metadata such as SysLog and an auto-incrementing serial number (SN) version control mechanism. A three-level defense mechanism is established. When both copies of metadata are unavailable, the system will automatically trigger a "reset initialization" process. During this process, the user data area will undergo random perturbation erasure, performing nonlinear multi-round erasure of NAND page-level cells based on a random voltage perturbation mode to ensure that residual information is unreconstructable, thereby meeting data security erasure standards. Attached Figure Description

[0074] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0075] Figure 1 This is a schematic diagram of the solid-state electronic disk soft-destruction system of the present invention.

[0076] Figure 2 This is a schematic diagram of the internal structure of the solid-state electronic disk soft destruction device of the present invention.

[0077] Figure 3 This is a flowchart illustrating the solid-state electronic disk soft destruction method of the present invention. Detailed Implementation

[0078] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the embodiments of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0079] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0080] Example 1:

[0081] This embodiment constructs a multi-layered self-recovery system with hardware-firmware collaboration. Through dual-copy redundancy and auto-incrementing serial number (SN) version control mechanisms for key metadata such as SysLog, intelligent fault tolerance and recovery against metadata corruption are achieved. This system is specifically designed for NVMe solid-state drives, aiming to achieve "fault self-healing" under extreme environments. A three-tiered defense mechanism is established; when both copies of the metadata become unavailable, the system automatically triggers a "reset initialization" process. During this process, the user data area undergoes random perturbation erasure. This mechanism performs non-linear, multi-round erasure of NAND page-level cells based on a random voltage perturbation mode, ensuring that residual information is unreconstructable, thereby meeting data security erasure standards.

[0082] The detailed working mechanism of the anomaly detection layer described in this invention is as follows:

[0083] The storage contents of the three control tables—SysLog, BsInfo, and VFC—in the NAND flash memory are monitored in real time. Each time the solid-state drive powers on for initialization or during the recovery process, the unit loads dual copies of these three tables in parallel.

[0084] Specifically, for SysLog, the controller issues two NAND read commands (READPAGE, 0x13h) to access the physical pages of two predefined SysLog replicas.

[0085] After reading, the contents of each copy page are loaded into the internal cache RAM via DMA. Then, the controller's internal CRC32 hardware checker performs real-time verification on the two copy data streams. The CRC32 checker uses a generator polynomial (0x04C11DB7) conforming to the IEEE 802.3 standard and generates the CRC value for a 512B data segment in a single cycle using a parallel polynomial shift register structure. If the copy verification passes (the CRC32 calculation result matches the pre-stored checksum at the end of the page), a 4-byte auto-incrementing sequence number field SN_N is extracted from a specified byte offset (e.g., the 8th byte relative to the page start address) and written to a dedicated status register A.

[0086] If the SysLog second copy verification passes, the sequence number SN_M is extracted and written to register B. If both copies pass verification, the unit compares SN_N with SN_M:

[0087] If SN_N is greater than SN_M, it means that the first copy of SysLog is the latest version, and the first copy of SysLog is determined to be the primary copy;

[0088] If SN_M is greater than SN_N, the second copy of SysLog is determined to be the primary copy; if SN_N is equal to SN_M, the copy content is considered to be consistent, and either copy can be loaded.

[0089] If only one copy passes verification, it is marked as a "downgraded valid" copy, and the warning level is recorded.

[0090] If both copies fail CRC checks, the unit immediately generates a "SysLog dual copy damaged" flag, sets the fault level to "unrecoverable", and reports it to the decision arbitration layer.

[0091] The key metadata includes the first copy of the system log table SysLog, the second copy of the system log table SysLog, the block information table BsInfo, and the effective capacity table VFC, but does not include other extended metadata.

[0092] The BsInfo table describes the lifecycle and health status of blocks in NAND flash memory and is distributed across multiple NAND blocks. The unit employs a predetermined address sequence sequential reading combined with an ECC hardware / software collaborative error correction and error rate analysis strategy.

[0093] Specifically, the system sequentially reads BsInfo data blocks based on the static address table (Block_IDList) generated during compilation. Each data block is transmitted in segments by page, and simultaneously loaded into the DRAM buffer using multi-channel DMA. After reading each 256-byte segment, the system calls the BCH (Bose-Chaudhuri-Hocquenghem) or LDPC (Low-DensityParity-Check) decoder built into the main controller for error detection and correction. If error correction is successful, the number of BitErrors in that segment is recorded (e.g., the BCH decoder can correct up to 24 bits of random errors). If error correction fails (exceeding the error correction capability, e.g., the number of BitErrors is greater than 24), the segment is marked as "unusable". The unit counts the number E of segments that failed error correction for each BsInfo table (a total of N data segments). If the E / N ratio is greater than 10%, the entire BsInfo table is marked as "structurally damaged". If the E / N ratio is less than or equal to 10%, but multiple boundary pages are damaged, it is marked as "recoverable but unstable". If the BsInfo primary table read fails, the system automatically attempts to access the backup table, whose physical address is stored by the master controller in an OTP (One-Time Programmable) register or a SysParam page. If the backup table is available and passes ECC verification, it is loaded instead of the primary table. If both the primary and backup tables are unavailable, it is marked as "BsInfo Total Loss" and an "Unrecoverable Exception" status code is uploaded.

[0094] Link status monitoring: The PCIe link status decoder analyzes ACK / NAK signals, link negotiation status (LinkTraining), and lane synchronization status from the host in real time. This decoder, integrated into the PCIe physical layer (PHY), monitors the LCRC checksum status, DLLP (DataLinkLayerPacket) timeout, and FlowControlCredits status of link layer data packets. If the number of consecutive NAK signals exceeds a preset threshold (e.g., more than 50 NAK packets received consecutively within 100ms), or the number of link training failures exceeds 5, it is considered a link anomaly. The unit generates a "communication anomaly" flag, along with detailed information such as the anomaly period length and the lane number where the anomaly occurred.

[0095] Power-on process progress monitoring: Each time the solid-state drive (SSD) powers on, the unit starts a 55-second software timer (slightly shorter than the 60-second cycle of the hardware watchdog). This software timer runs on the main control CPU via firmware and periodically checks key system initialization flags, such as whether the LBA mapping table is successfully loaded, whether the FTL (FlashTranslationLayer) module is initialized, or whether SysLog loading is complete. If the recovery process fails to enter normal operation within 55 seconds, it is considered a "boot freeze." The unit then sets the WDT_INIT_FLAG flag to 1 and reports it to the arbitration layer for processing via an internal interrupt mechanism.

[0096] The anomaly perception layer outputs the following results: When each monitored indicator is abnormal, the unit generates structured anomaly information. This information includes: anomaly type (e.g., "metadata corruption," "link failure," "startup freeze"), occurrence address (e.g., "SysLog table type," "block number 0x1A2B," "physical channel 3"), anomaly level ("recoverable" or "unrecoverable"), timestamp, fluctuation trend, and anomaly occurrence cycle. This information is transmitted via an internal bus (e.g., APB bus or dedicated shared register) and sent to the decision arbitration layer via interrupt or event flags.

[0097] The detailed working mechanism of the decision arbitration layer described in this invention is as follows:

[0098] Anomaly Analysis: The decision arbitration layer receives structured anomaly data packets uploaded by the anomaly perception layer and parses the anomaly type field (e.g., "GC delay", "SysLog double loss", "link unavailable", "startup stuck"). Based on a preset severity and recovery probability matrix, the anomalies are divided into two categories: recoverable anomalies (the system still has valid copies / paths available) and unrecoverable anomalies (the current state has no available resources or functions locked). The matrix is ​​a two-dimensional lookup table, where the row index is the anomaly type, the column index is the anomaly level (minor, moderate, severe), and the table entries are suggested recovery actions or strategy IDs.

[0099] Strategy Selection: The decision arbitration layer matches corresponding strategies through a table lookup. For example, if a "GC latency" anomaly is parsed, the "reduced write command (NVMeThrottle)" and "delayed GC trigger" strategies are matched. If a "single replica corruption" anomaly is parsed, the "immediate replica switch" strategy is matched. If a "SysLog double loss" anomaly is parsed, the "trigger reset initialization" process is matched. If a "boot freeze" anomaly is parsed, the "skip power-on self-test process and proceed to initialization" strategy is matched. If a "link instability" anomaly is parsed, the "trigger link retraining or channel degradation" strategy is matched. The decision arbitration layer also has a strategy escalation mechanism: if the same anomaly occurs more than 3 times consecutively within a preset time window, the strategy level will be automatically upgraded (e.g., from soft recovery to hard reset strategy, or from reduced speed adjustment to forced reset initialization). Finally, the decision arbitration layer generates a RecoveryCommandPackage, which includes the operation type (e.g., 0x01 for metadata reconstruction, 0x02 for data erasure, 0x03 for firmware jump), the target address (e.g., NAND physical page address, register address), and operation parameters (e.g., number of erases, rate limiting ratio). The command package is sent to the execution layer via a dedicated message queue or DMA channel.

[0100] The execution layer of this invention operates as follows: Firmware control mechanism: The firmware in the execution layer continuously monitors the countdown of the watchdog register. The controller has a built-in hardware watchdog timer independent of the main CPU, with a countdown period of 55 seconds. During solid-state disk initialization or main controller operation, the firmware needs to write a specific "feed" sequence (e.g., 0xA55A) to the watchdog register every 5 seconds to reset the countdown. If the system enters a deadlock or infinite loop, and the firmware fails to "feed" the watchdog in time, the timer will overflow naturally, outputting the WDT_RESET_TRIGGER signal. This signal is directly connected to the reset controller, triggering an on-chip soft reset or full chip reset, and clearing all intermediate state data in volatile memory to ensure the system starts from a deterministic state. In addition, if a "reset initialization" instruction is received from the arbitration layer or the software is marked as WDT_INIT_FLAG=1, the firmware bootloader will conditionally skip the standard power-on self-test process (e.g., skip time-consuming and potentially deadlock-causing steps such as memory integrity checks, Flash parameter loading, and LBA mapping table construction) and directly execute initialization processes such as user data erasure and control table reconstruction in the next reset cycle (i.e., after the system is reset by the watchdog or after a soft reset).

[0101] Data Erasure and Reconstruction: The execution layer issues a CHIP_ERASE (0xC4h) command to the target NAND block (e.g., the physical block containing the SysLog replica) by invoking the erase voltage generator inside the NAND controller. The erase voltage generator applies a high-voltage erase level of 18V (±0.5V) for 3ms (±0.1ms). After a single erase operation, the NAND controller automatically reads all page data of the target block and compares whether all data is 0xFF. If the comparison fails (non-0xFF data exists), the execution layer will retry the erase operation, performing a maximum of 3 erase attempts. After a successful erase, the system firmware writes a blank metadata table: the SysLog table is reconstructed, with its initial sequence number SN set to 0; all block statuses in the BsInfo table are marked as FREE; and the effective capacity counter in the VFC table is set to 0. Immediately after writing, CRC32 and SHA-256 (SecureHashAlgorithm 256-bit) checks are performed to ensure the integrity and security of the newly written metadata. The SHA-256 check is implemented through a hardware acceleration module to prevent data tampering during the writing process.

[0102] Emergency Serial Command Channel: If the host interface is disconnected or the PCIe link is broken, the built-in serial controller (UART_Controller) of the solid-state drive can serve as an independent emergency command receiving channel. The UART_Controller operates at a baud rate of 115200bps and receives predefined emergency command packets. For example, receiving the "wdt3" command will trigger a secure erase procedure. This command is sent directly to the on-chip serial command parser (UART_CMD_PARSER) via the serial interface data line. The parser bypasses the main execution path of the main control firmware and directly controls the internal Flash operation logic unit. Specifically, it will trigger the shutdown of the main control power supply (controlled by the power management unit via PWM signal) and the erasure of all user memory blocks (sent the BLOCK_ERASE_ALL command via the NAND controller). After erasure, the system will sample and read the page contents of 128 randomly selected physical blocks to verify that they must be 0xFF. If the verification fails, the emergency channel can trigger three repeated erase attempts.

[0103] Feedback Results: Upon successful recovery, the execution layer outputs a high-level signal for 200ms via a general-purpose input / output (GPIO_0) pin on the main control chip, indicating the completion of the recovery operation. Simultaneously, an LED indicator connected to the main control chip flashes at 0.5Hz to indicate "recovery in progress," and then remains constantly lit after recovery is complete. The main control chip also returns a status code to the host via the NVMe status register (e.g., 0xE1 for successful recovery, 0xF0 for failed recovery). This status code is received by the anomaly detection layer to verify the recovery effect and determine whether to proceed to the next round of fault handling or report the final status to the host.

[0104] The "random perturbation erase" mechanism described in this invention, when the decision arbitration layer determines that irreversible data erasure is required (e.g., both SysLog copies are corrupted and trigger a reset initialization process), will invoke the erase voltage generator and page programmer inside the NAND controller to work together. Traditional block erase operations typically involve simply applying a high voltage to set all cells to "1" (0xFF).

[0105] First, a standard CHIP_ERASE (0xC4h) operation is performed. After erasure, the system does not immediately consider the data to be cleared, but instead enters the random perturbation stage. In this stage, the NAND controller generates a series of pseudo-random number sequences. These pseudo-random numbers are converted into tiny, non-linear voltage perturbation patterns, which are applied to the bit lines and word lines of the target NAND page-level cell.

[0106] Specifically, for each NAND page, the controller performs multiple rounds (e.g., 3-5 rounds) of "perturbation programming." In each round, the system uses a random number generator to produce a random byte sequence of length matching the page size. This sequence is not written directly to the NAND cell, but is converted into a weak, short-pulse programming voltage (e.g., 10%–20% of the normal programming voltage) and applied to the NAND cell within a very short time window (e.g., 100 nanoseconds) to randomly alter its threshold voltage distribution. This non-linear, multi-round random perturbation results in a high degree of randomness and unpredictability in the physical characteristics (e.g., residual charge or threshold voltage distribution) of the NAND cell, even when the stored content is set to 0xFF. After each perturbation programming, the system performs a random page read to verify that the read data matches the previously written random sequence and evaluates the cell's response consistency. If the consistency is poor, the number of perturbation rounds is increased or the perturbation voltage is increased. Ultimately, through multiple rounds of random perturbation, any potential residual information (such as reproducible charge distributions due to cell degradation, data remnants, or uneven physical properties) will be completely disrupted and smoothed out, thus ensuring that residual information is unreconstructable under any advanced data recovery technique.

[0107] The "triple redundancy SysLog replica architecture" in the hardening mechanism described in this invention is specifically implemented as follows: In addition to the original two SysLog replicas (SysLog first replica and SysLog second replica), this invention adds a set of backup SysLog third replicas, which are stored on a NAND channel or plane physically independent of the SysLog first replica and SysLog second replica, to maximize its resistance to single-point failures. During each SysLog update, the controller writes to all three replicas simultaneously. When the system powers on or needs to load SysLog, the controller reads the three replicas in parallel and performs a CRC32 check on each replica. If two of the three replicas pass the check and their auto-incrementing sequence numbers are consistent, the "2-out-of-1 check" principle is adopted, and the two consistent replicas are considered valid, and the latest version is loaded. If only one replica passes the check, that replica is considered "degraded valid," the system will record a warning and continue to attempt to use that replica. If all three replicas fail the check or cannot achieve 2-out-of-1 consistency, the highest priority "SysLog total loss" flag is triggered, and the reset initialization process is initiated.

[0108] The "NAND thermal erase random perturbation algorithm" in the hardening mechanism described in this invention is specifically implemented as follows: During the aforementioned random perturbation erase, this invention further enhances randomness. In a traditional erase cycle, the erase voltage (Vpp) is typically stable. However, the thermal erase random perturbation algorithm periodically (e.g., every 50 microseconds) applies a small, rapidly changing random noise component (e.g., ±0.5V) to the word line voltage of the NAND block within a 3ms ± 0.1ms period of applying an 18V erase voltage. Simultaneously, the bit line voltage is also subjected to similar but independent random noise perturbations. This "thermal" perturbation is not for programming data, but rather to provide additional random shocks to the floating gate charge distribution within the NAND cell during the erase process. This aims to maximally destroy any charge distribution "memory" or "residual" that might be formed due to a specific programming / erasing history. By introducing randomness during the physical erase phase, even in extreme recovery laboratory environments, it becomes difficult to infer old data by analyzing the physical characteristics of the NAND cell.

[0109] The "reboot dynamic encryption verification" in the hardening mechanism described in this invention is specifically implemented as follows: All initialization pages generated and written during the reset initialization process (e.g., the header information of the initial SysLog page and BsInfo page) undergo a dynamic encryption verification process before being written to the NAND flash memory. Specifically, the system uses a 256-bit one-time key built into the ROM (or a key generated and securely stored via TRNG, TrueRandomNumberGenerator), combined with the Secure-HMAC (Keyed-HashMessageAuthenticationCode) algorithm, to generate a message authentication code for the content of the initialization page. The HMAC value is written to the NAND flash memory along with the initialization page content. Each time the solid-state drive boots or loads these initialization pages, the system recalculates the HMAC value and compares it with the stored HMAC value. If the comparison is inconsistent, the initialization page is considered to have been tampered with or forged, and the system immediately enters secure mode and triggers the highest level of unrecoverable abnormal response, and may even activate a hardware-level self-destruct mechanism (e.g., physically severing critical NAND channels) to prevent forged or malicious data from being loaded, thereby ensuring the absolute security of the system boot environment. This dynamic encryption and verification process is implemented through a hardware accelerator, minimizing its impact on system startup time.

[0110] This invention addresses deep-seated technical challenges in extremely high-value application scenarios, such as single-point-of-failure in solid-state drives (SSDs), power-on deadlock, simplistic host-side recovery strategies, and lack of redundant protection for core boot components, by constructing a multi-layered, adaptive, hardware-firmware collaborative self-recovery system. The described method, device, and system achieve intelligent sensing, precise arbitration, and effective recovery without physical intervention, significantly improving the reliability, availability, and security of SSDs in data centers, industrial control, and other fields.

[0111] To facilitate a better understanding of the present invention by those skilled in the art, specific examples are provided below to further illustrate the invention.

[0112] This embodiment primarily tests a soft-destruction system for a solid-state electronic disk (SSD) of this invention deployed in a critical industrial control system. The system comprises a 3.84TB industrial-grade NVMe SSD, which embeds the soft-destruction device described in this invention. Testing was conducted under complex electromagnetic interference and prolonged high-load operation.

[0113] Test scenario:

[0114] After six months of continuous operation, a simulated mains power supply transient anomaly caused data corruption in one of the SysLog dual replicas (SysLog first replica) during a write operation. Furthermore, some physical block metadata in the BsInfo table exhibited a high BitError rate due to NAND flash memory wear, exceeding the error correction capabilities of ECC. Simultaneously, the simulated high I / O load increased the internal GC latency of the solid-state drive, resulting in a rise in the average latency of host I / O requests.

[0115] Anomaly Detection and Structured Marking: Metadata Integrity Monitoring Unit: During power-on initialization, two copies of SysLog are loaded in parallel. The first SysLog copy fails verification, while the second SysLog copy succeeds with a serial number (SN) of 1024. The unit marks the first SysLog copy as "corrupted" and the second SysLog copy as "degraded valid." Simultaneously, during the loading of the BsInfo table, a BitError rate exceeding 0.1% was detected in 256 physical block metadata segments, with 32 segments failing ECC correction. The total number of failed correction segments (E) accounted for 12.5% ​​of the total number of segments (E / N > 10%), and the unit marked the BsInfo table as "structurally corrupted."

[0116] Link status monitoring unit: No PCIe link anomaly detected.

[0117] Power-on process progress monitoring unit: WDT_INIT_FLAG not triggered.

[0118] Structured abnormal data packets: The perception module generates multiple structured abnormal data packets containing "SysLog single copy corrupted, SysLog first copy, unrecoverable, timestamp XXXX", "BsInfo structure corrupted, main table, unrecoverable, timestamp YYYY", and "GC delay, medium, recoverable, timestamp ZZZZ", and reports them to the decision arbitration module.

[0119] Decision arbitration and strategy matching:

[0120] The decision arbitration module receives and parses the abnormal data packet:

[0121] For "SysLog single copy corruption": Matching strategy "Switch to valid copy immediately".

[0122] Regarding the "BsInfo structure corruption" issue: the matching strategy is "attempt to load a backup BsInfo table; if this fails, trigger a reset and initialization." The system first loads the backup BsInfo table, and the backup table verification passes.

[0123] For "GC latency": Matching strategy "Three-level adaptive deceleration control system activated".

[0124] The decision arbitration module generates a recovery instruction package, which includes instructions such as "load the second copy of SysLog", "load the standby BsInfo table", "start the command rate limiter to reduce the write rate to 75%", and "adjust the GC scheduler delay slot to extend the GC interval to 20ms".

[0125] Resumption of command execution and feedback:

[0126] The execution module receives and executes instructions:

[0127] Successfully loaded the second copy of SysLog; system status restored to the latest version.

[0128] The backup BsInfo table was successfully loaded, and the solid-state electronic disk file system mapping was rebuilt.

[0129] The command rate limiter is activated, reducing the NVMe write command queuing rate by 25% and decreasing the host average write latency from 4.5ms to 2.2ms.

[0130] The GC scheduler was adjusted, increasing the GC task interval from 5ms to 20ms, and reducing the average percentage of NANDBUSY signals from 92% to 75%.

[0131] Recovery criteria: Within 30 consecutive seconds, the average depth of the CQ queue decreased from 36 to 12, the moving average I / O latency decreased from 4.5ms to 1.8ms, and the average percentage of NANDBUSY signals decreased from 92% to 65%, all of which met the recovery criteria.

[0132] The execution module removes the rate limit and restores the normal GC frequency.

[0133] Feedback: GPIO_0 outputs a high level, the LED flashes and then stays on, and the main controller returns a status code 0xE1 (recovery successful) through the NVMe status register. Upon receiving the status code, the host controller determines that the system has self-healed.

[0134] In this embodiment, the solid-state electronic disk of the present invention, when faced with complex metadata corruption and performance congestion, successfully avoids system downtime and data loss and restores normal operation through a multi-layered self-recovery mechanism. The entire recovery process requires no manual intervention and takes approximately 150 seconds.

[0135] Comparative Example 1:

[0136] To further highlight the superiority of the technical solution of this invention, this comparative analysis examines the performance of a traditional industrial-grade NVMe solid-state drive without the integrated software crash device under the same test scenario. This traditional solid-state drive only possesses basic ECC error correction capabilities and a firmware watchdog reset mechanism.

[0137] The test scenario was the same as the implementation example: After 6 months of continuous operation, a transient power supply failure occurred, causing a single copy of the SysLog to become corrupted (traditional SSDs typically have only one SysLog copy), and some metadata in the BsInfo table was corrupted beyond the ECC error correction capability. Simultaneously, high I / O load increased the internal GC latency of the solid-state drive, resulting in an increase in the average latency of host I / O requests.

[0138] Anomaly detection (traditional SSD):

[0139] During power-on initialization, traditional SSDs attempt to load a copy of the SysLog. If the copy is corrupted, the CRC check fails. Traditional firmware lacks a redundant copy mechanism and directly determines the SysLog is corrupted.

[0140] When loading the BsInfo table, ECC error correction failure was detected in some metadata segments. However, due to the lack of a higher-level structural damage detection and backup table mechanism, the firmware attempted to perform FTL mapping using the corrupted BsInfo table.

[0141] High I / O load leads to GC latency, causing the NANDBUSY signal inside the SSD to remain high for an extended period, resulting in an increase in the average latency of host I / O.

[0142] Traditional firmware processing logic:

[0143] SysLog corruption: Traditional firmware cannot initialize the FTL properly and cannot build the LBA mapping table due to the inability to load critical system configurations and states. Solid-state drives report failure to boot or entry into "read-only" mode.

[0144] A corrupted BsInfo table can lead to FTL mapping errors, resulting in user data read / write errors or even data loss.

[0145] GC latency: Traditional firmware lacks adaptive speed reduction and GC scheduling optimization mechanisms, and I / O congestion continues to worsen, causing host I / O request timeouts, system lag, or host-side reports of SSD disconnection.

[0146] Watchdog Reset: Due to firmware malfunction or being trapped in an infinite loop, the hardware watchdog timer overflows, triggering a forced reset of the solid-state drive (SSD). However, after the reset, due to persistent corruption of SysLog and BsInfo, the SSD repeatedly fails to initialize, falling into a vicious cycle of "reset-deadlock".

[0147] Results and Impact: The traditional solid-state drive ultimately failed to boot, and was reported as a "permanent failure." The host controller continuously received "device not ready" or "command timed out" status codes.

[0148] System impact: The entire industrial control system shut down due to a core storage device failure, resulting in business interruption.

[0149] Data loss: Due to the corruption of SysLog causing the FTL to fail to initialize, and the corruption of the BsInfo table causing mapping errors, all user data is inaccessible and faces permanent loss.

[0150] Recovery costs: It requires manual physical intervention, replacement of solid-state drives, and may require professional third-party data recovery services, which is time-consuming, labor-intensive, and costly.

[0151] The data comparison is shown in Table 1 below:

[0152] The following table compares the key performance indicators of embodiments of the present invention with those of conventional SSDs under the same failure scenario:

[0153] Table 1:

[0154] Indicator Items Embodiment 1 of the present invention Traditional SSD Comparison 1 Improvements (compared to conventional SSDs) Fault type SysLog single-copy corruption, BsInfo structure corruption, GC congestion SysLog single-copy corruption, BsInfo structure corruption, GC congestion N / A System downtime (MTTD) 0 seconds (no downtime, self-recovery) Permanent shutdown (unable to start) Significantly shorten Data accessibility 100% (Data is complete and usable after self-recovery) 0% (Data unavailable, permanently lost) Ensure data availability recovery operation Automatic firmware logic processing Manual hardware replacement may require data recovery. Fully automated, no manual intervention required Recovery costs Extremely low firmware overhead. Expensive (hardware replacement, data recovery services) Significantly reduced Mean Time to Recovery (MTTR) 150 seconds (Adaptive speed reduction + metadata recovery complete) N / A (Equipment is beyond repair and cannot be recovered) Achieve quantifiable and rapid recovery Average host I / O latency After recovery: 1.8ms (2.2ms when the speed was limited) Timeout continues, unable to respond Restoring stable performance Average percentage of NANDBUSY signals After recovery: 65% (75% when speed limit was applied) Device unresponsive if 5% or higher than 95% Alleviating resource congestion System stability High (continues to run after self-healing) Low (repeated resets - deadlock) Greatly improve

[0155] The present invention provides a solid-state electronic disk soft destruction method, device and system that innovatively solves deep-seated technical problems such as single point of failure of solid-state electronic disk metadata, power-on deadlock, single recovery strategy on the host side and lack of redundancy protection of core boot components in extremely high-value application scenarios through its multi-level, adaptive, hardware and firmware collaborative self-recovery system.

[0156] This invention differs from existing solid-state drives (SSDs) that use single-point storage or simple redundancy for critical metadata such as SysLog and BsInfo. During power-on initialization or recovery process startup, this invention sends two NAND read commands through the SSD controller to load two copies of SysLog located in independent physical storage areas in parallel. Real-time integrity verification is achieved using a hardware-level CRC32 checksum, and the auto-incrementing serial number (SN) is extracted for version comparison. If both copies pass verification, the latest version is loaded; if only one copy is valid, it is marked as "downgraded valid"; if both copies are damaged, an "unrecoverable anomaly" is directly reported. This mechanism, through parallel hardware access and version control, solves the system paralysis problem caused by single-point failures in traditional metadata.

[0157] Meanwhile, addressing the deficiency in existing technologies where there are no effective remedial measures for BsInfo table corruption, this invention sequentially reads BsInfo data blocks according to a pre-compiled static address table, calls the main controller's built-in BCH or LDPC decoder for error detection and correction, and calculates the percentage of segments failing error correction (E / N). When E / N > 10%, it marks "structural corruption," and automatically switches to the backup table (physical address stored in the OTP register or SysParam page) when the main table fails to read. Only when both the main and backup tables are unavailable is "BsInfo total loss" determined. This mechanism improves the fault tolerance of the block information table through quantified error correction statistics and main / backup switching.

[0158] This invention overcomes the limitations of traditional solid-state electronic disks (SSDs) that rely solely on a watchdog timer. It simultaneously monitors the integrity of critical metadata, PCIe link status, and power-on process progress. The PCIe link is monitored in real-time by parsing ACK / NAK signals and link training status. A "communication anomaly" flag is generated when consecutive NAK signals exceed a threshold or training failures exceed a preset number. The power-on process monitors the system initialization flag using a 55-second software timer (shorter than the hardware watchdog's 60-second cycle). If the timer expires, the WDT_INIT_FLAG flag is set. All anomalies generate structured data packets containing the anomaly type, occurrence address, anomaly level, and timestamp, providing complete data support for subsequent accurate arbitration.

[0159] This invention classifies anomalies into recoverable anomalies (such as GC latency and single-copy corruption) and unrecoverable anomalies (such as SysLog double loss and BsInfo total loss) based on their severity and recoverability. Differentiated strategies are matched by looking up a table. Recoverable anomalies are handled by soft recovery methods such as "reducing write command rate, adjusting GC scheduler delay slots, and dynamically remapping NAND channels". Unrecoverable anomalies are handled by hard recovery methods such as "metadata reset initialization, skipping power-on self-test, and channel degradation operation". When an anomaly occurs consecutively beyond a preset number of times, the strategy level is automatically upgraded (e.g., from soft recovery to hard reset) to achieve precise strategy adaptation.

[0160] Among them, recoverable anomalies include: SysLog single copy corruption, PCIe link transient failure, and garbage collection delay; unrecoverable anomalies include: SysLog dual copy corruption, BsInfo table total loss, and firmware deadlock.

[0161] This invention addresses the resource conflict between internal GC and high-frequency I / O requests from the host in existing solid-state drives (SSDs). It constructs a three-level closed-loop control system: command rate limiting, scheduling latency, and channel remapping. The command rate limiting regulator takes over the NVMe command scheduling interface, dynamically reducing the enqueue rate under high concurrency scenarios. The GC scheduler latency slot adjustment module adopts a segmented slot triggering model, automatically increasing the GC task interval when host I / O pressure increases. The channel arbitrator dynamic remapping module temporarily shuts down some GC threads during severe congestion, prioritizing NAND bandwidth allocation to the host. Through parallel judgment using multiple indicators such as average CQ queue depth, moving average I / O latency, and NANDBUSY signal percentage, the rate limiting is automatically lifted after the recovery criteria are met, balancing recovery efficiency and system performance. This invention adds a set of independent channel backup SysLog replicas to the traditional dual-replica system. During updates, all three replicas are written simultaneously, and during loading, they are checked in parallel. If two replicas pass the check and their serial numbers match, the system is considered valid. If only one replica is valid, it is marked as "degraded." Only when all three replicas fail is an unrecoverable exception triggered. Through physical isolation and majority voting mechanisms, the risk of total metadata loss due to a single channel failure is reduced.

[0162] In summary, this invention addresses the systemic vulnerability of existing solid-state drives (SSDs) in extremely high-value, high-security application scenarios by constructing a comprehensive, innovative hardware and firmware collaborative system: The anomaly detection layer utilizes parallel verification and version adaptive selection of key metadata (dual SysLog copies, BsInfo table), ECC error correction statistics in the BsInfo table, and primary / backup switching, combined with multi-dimensional monitoring and structured tagging of the PCIe link and power-on process, overcoming the limitations of traditional single-point monitoring; the decision arbitration layer implements dynamic classification and table lookup matching differentiated strategies based on anomaly severity and recovery probability, and innovatively designs a three-level self-regulation mechanism to address GC and host I / O resource contention. To adapt to the deceleration control system and solve the problem of the single recovery strategy in traditional systems, the recovery layer adopts random disturbance erasure technology (multiple rounds of nonlinear voltage disturbance after standard erasure) to ensure that the data is not reconstructable. Combined with hardware watchdog triggering reset initialization and UART serial port emergency channel, it achieves self-recovery without physical intervention. At the same time, through a hardware hardened architecture with triple redundant SysLog replicas and 2-to-1 checksum, NAND hot erase random disturbance and restart dynamic encryption check, the risk resistance of core components is further improved. The whole system can achieve intelligent perception, accurate arbitration and effective recovery of deep faults in solid-state electronic disks without physical intervention, significantly improving its reliability, availability and security.

[0163] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0164] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for soft failure of a solid state disk, the method comprising: The method comprises the following steps: An abnormality sensing step: an abnormality sensing layer inside the solid-state electronic disk monitors key metadata integrity, PCIe link status and power-on process progress in real time, and generates a structured abnormality data packet containing abnormality type, occurrence physical address, abnormality level, timestamp, abnormality fluctuation trend and abnormality occurrence period when an abnormality is detected; A decision arbitration step: a decision arbitration layer inside the solid-state electronic disk receives the structured abnormality data packet, and classifies it into a recoverable abnormality or an unrecoverable abnormality according to abnormality type, severity and recovery possibility; The decision arbitration layer matches a corresponding recovery strategy through a lookup table, and generates a recovery instruction packet carrying operation type, target physical address and operation parameter; An execution feedback step: an execution layer inside the solid-state electronic disk receives the recovery instruction packet, and guides a hardware unit to complete metadata copy switching, user data erasing, control table reconstruction or system reset operation through firmware instruction scheduling; After the execution is completed, the execution layer outputs a recovery result signal, and returns a status code to a host controller through a host; The unrecoverable abnormality response mechanism comprises: If a single copy of a SysLog is detected to be damaged, another valid copy is automatically selected for loading; If both copies of the SysLog are damaged, a reset initialization process is triggered, which comprises emptying a user data area, setting all logical block addresses (LBAs) to 0, reconstructing a SysLog table, setting an initial serial number (SN) to 0, reconstructing a BsInfo table, setting all blocks to FREE and VFC, setting all block valid amounts to 0, and writing the newly created three tables into double copies of SysLog blocks; The user data area is emptied by random disturbance erasing, which comprises generating a pseudo-random number sequence by a NAND controller inside the solid-state electronic disk and converting it into a tiny, nonlinear voltage disturbance pattern, applying it to the bit line and word line of the target NAND page-level cell through a page programmer, and performing multiple rounds of disturbance programming operation to ensure that the residual information cannot be reconstructed.

2. A soft kill method for a solid state electronic disc according to claim 1, wherein, The key metadata comprises double copies of a system log table (SysLog), a block information table (BsInfo) and a valid capacity table (VFC); The abnormality sensing layer loads the first copy of the SysLog, the second copy of the SysLog, the BsInfo table and the VFC table in parallel from independent physical storage areas during power-on initialization; Integrity verification is performed on the first copy of the SysLog, the second copy of the SysLog and the BsInfo copy through a hardware-level CRC32 checker, and the self-incrementing serial numbers of the first copy of the SysLog and the second copy of the SysLog are extracted for version comparison.

3. A soft kill method for a solid state electronic disc according to claim 2, wherein, The SysLog double copy verification and version comparison comprise: The solid-state electronic disk controller issues two NAND read commands to access the predefined physical pages of the first copy of the SysLog and the second copy of the SysLog in parallel; The CRC32 hardware checker inside the controller is used to perform real-time verification on the data stream of the first copy of the SysLog and the data stream of the second copy of the SysLog; If both the SysLog first copy and the SysLog second copy pass the verification, the respective self-incrementing sequence numbers are compared to determine the latest version and are loaded; If only the SysLog first copy or the SysLog second copy passes the verification, the SysLog first copy or the SysLog second copy is marked as a degraded valid state; If both the SysLog first copy and the SysLog second copy fail the CRC verification, a SysLog double-copy damage flag is generated.

4. The solid state electronic disk soft fail method of claim 2, wherein, The BsInfo table reading process and the ECC error correction statistical mechanism specifically include: The solid-state electronic disk soft failure system sequentially reads the BsInfo data block according to a pre-compiled static address table and transmits the data block to a DRAM buffer in segments; After reading each segment of data, a built-in BCH or LDPC decoder of the host is called to perform error detection and correction, and the BitError quantity of the segment is recorded; If the error correction fails or the error rate after the error correction exceeds a preset threshold, the segment is marked as "unavailable"; If the BsInfo main table reading fails, the backup table is automatically accessed; If both the main table and the backup table are unavailable, "BsInfo full damage" is marked, and an "unrecoverable exception" status code is uploaded.

5. A soft kill method for a solid state electronic disc according to claim 1, wherein, The decision arbitration layer specifically includes the following steps of: The decision arbitration layer specifically includes the following steps of: The decision arbitration layer specifically includes the following steps of: If the exception state continuously exceeds a preset number of times, the decision arbitration layer automatically upgrades the strategy level; The decision arbitration layer generates a recovery instruction package and issues the recovery instruction package to the execution layer through a dedicated channel. The three-level adaptive speed reduction control system in the recoverable exception processing specifically includes:

6. A soft fail method for a solid state disk according to claim 5, wherein, A command speed limiting regulator configured to take over an NVMe command scheduling interface and reduce the queuing rate to a preset proportion range when a high-concurrency write-in scenario is detected; A GC scheduler delay slot adjustment module configured to use a segmented slot trigger model to automatically increase the GC task insertion interval when the host I / O pressure is monitored to be increased; A channel arbitrator dynamic remapping module configured to dynamically adjust the NAND channel allocation strategy and temporarily close part of the GC threads in a serious congestion scenario. The three-level adaptive speed reduction control system in the recoverable exception processing specifically includes:

7. A solid state electronic disk soft kill device, characterized by, An exception sensing module for monitoring the key metadata integrity, PCIe link state and power-on process progress of the solid-state electronic disk in real time, generating a structured exception data package when an exception is detected; A decision arbitration module for receiving the structured exception data package, classifying the exception data package into a recoverable exception or an unrecoverable exception according to the exception type, severity and recovery possibility, and matching a recovery strategy through a table lookup method to generate a recovery instruction package; and The three-level adaptive speed reduction control system in the recoverable exception processing specifically includes: The non-recoverable abnormal response mechanism includes: If a single copy of SysLog is detected to be damaged, another valid copy is automatically selected for loading; If both copies of SysLog are damaged, a reset initialization process is triggered, which includes clearing the user data area, setting all logical block addresses (LBAs) to 0, rebuilding the SysLog table, setting the initial serial number (SN) to 0, setting the BsInfo table, marking all blocks as FREE and VFC, setting the valid amount of all blocks to 0, and writing the newly created three tables to the double SysLog blocks; The user data area is cleared by random disturbance erasure, which includes generating a pseudo-random number sequence by the NAND controller inside the solid-state electronic disk after performing a standard block erase operation, converting it into a tiny, nonlinear voltage disturbance pattern, applying it to the bit lines and word lines of the target NAND page-level cells through the page programmer, and performing multiple rounds of disturbance programming operations to ensure that the residual information cannot be reconstructed; The execution module receives the recovery instruction package and guides the hardware unit to complete metadata copy switching, user data erasure, control table reconstruction, or system reset operation through firmware instruction scheduling.

8. A solid state electronic disc soft fail device according to claim 7, wherein, The abnormality sensing module includes: A metadata integrity monitoring unit that loads the first copy of SysLog, the second copy of SysLog, the BsInfo table, and the VFC table in parallel during power-on initialization, and performs integrity verification and version comparison through a hardware-level CRC32 checker; A link state monitoring unit that monitors the PCIe link state and generates a communication abnormality flag when the number of consecutive NAK signals detected exceeds a preset threshold or the number of link training failures exceeds a preset number; A power-on process progress monitoring unit that monitors the time taken by the system to enter a normal working state after the solid-state electronic disk is powered on through a software timer.

9. A solid state electronic disk soft kill system, characterized by, It includes: One or more solid-state electronic disks, each integrated with the solid-state electronic disk soft destruction device of claim 7 or 8; A host controller that sends read and write requests to the solid-state electronic disk and determines the recovery effect based on the status code returned by the solid-state electronic disk when receiving the status code.

Images