Programming failure data protection method and system

Abstract

The present disclosure relates to the technical field of storage, and discloses a programming failure data protection method and system. User data and first check data thereof are written into a data super block composed of physical blocks on multiple wafers, and the two constitute a first check stripe; a check storage space composed of non-volatile flash blocks is set, second check data is generated and circularly written for a predetermined number of data super blocks recently written, the newly written second check data covers the earliest written second check data, and the covering is not conditional on post-writing scanning verification; when a programming failure is detected, for the data super block whose second check data is not covered, the failed cell is recovered by using the first and second check data, and for the data super block whose second check data is covered, recovery is performed by using the first check data. Thus, while maintaining the block-level programming failure protection capability, the storage space occupied by the check data is greatly reduced, and the user capacity loss is reduced.

Description

Technical Field

[0001] This disclosure relates to the field of storage technology, and in particular to a data protection technology for programming failures of non-volatile flash memory. Background Technology

[0002] The descriptions in this section are intended to provide background information for the implementation of this disclosure and should not be construed as an admission or implication that they constitute prior art.

[0003] Solid-state drive (SSD) controllers perform non-volatile flash memory programming in two phases: data transfer and persistent programming. During data transfer, data is moved from the controller cache to the internal flash memory cache. During persistent programming, the data in the flash memory cache is written to the non-volatile medium. In storage controllers without dynamic random access memory (DRAM) cache, to improve write performance, the corresponding cache space is typically released after data transfer to the flash memory cache. If programming fails during the persistent programming phase, the original data is lost because the cache space occupied by the original data has been released. To protect data from programming failures, related technologies employ static redundancy arrays (SRA). Pages with the same page number from each physical block within a superblock are grouped into a parity stripe, and the parity data is stored together with user data in user space. In the event of a programming failure, the remaining data within the stripe and the parity data are used to recover the failed data. However, this method requires dedicated storage space in user space to store the parity data. Furthermore, in order to obtain sufficient protection and recovery capabilities against programming failures at the block level or multi-plane physical block level in scenarios such as multi-stage programming, it is often necessary to persistently store corresponding verification data for all data superblocks. The scale of the verification data that needs to be persistently stored is huge and grows linearly with the storage capacity, resulting in a huge loss of the user's available capacity. Summary of the Invention

[0004] This disclosure provides a method and system for protecting programming failure data, which can solve the technical problem of how to reduce the storage space occupied by verification data while ensuring the protection and recovery capabilities of programming failure data.

[0005] According to one aspect of this disclosure, a method for protecting data in case of programming failure is provided, applied to a storage controller including non-volatile flash memory, comprising: The user data and the first verification data of the user data are written together into the data superblock. The data superblock is composed of multiple physical blocks located on multiple chips respectively. The first verification data and the user data protected by the first verification data constitute the first verification stripe. A verification storage space is set up, which consists of one or more non-volatile flash memory blocks. Second verification data is generated for the user data contained in a predetermined number of recently written data superblocks and written into the verification storage space. The second verification data and the user data protected by the second verification data constitute a second verification stripe. As a new data superblock is written, the second verification data of the newly written data superblock is cyclically written into the verification storage space, overwriting the earliest written second verification data in the verification storage space. The overwriting is not conditional on scanning and verifying the corresponding data superblock after writing. When a programming failure is detected in a data superblock, for data superblocks whose second check data has not yet been overwritten, the first check data and the second check data are used to recover the failed units in the data superblock; for data superblocks whose second check data has been overwritten, the first check data is used to recover the failed units in the data superblock.

[0006] In a preferred embodiment, at least one of the first and second verification stripes spans multiple wafer fabrication layers. Each stripe member of the verification stripe is a multi-plane physical block located on different wafers. The first or second verification data is obtained by performing verification operations on each stripe member at the multi-plane physical block granularity. The first verification stripe is a page-level verification stripe, and the second verification stripe is a physical block-level or multi-plane physical block-level verification stripe. The stripe depth of the first verification stripe is greater than the stripe depth of the second verification stripe, such that the proportion of the first verification data relative to the user data it protects is less than the proportion of the second verification data relative to the user data it protects. In a preferred embodiment, the first check stripe and the second check stripe are based on different groups; for a data superblock whose second check data has not yet been covered, when there are two failed units in the data superblock, the first check data and the second check data are used to recover the two failed units.

[0007] In a preferred embodiment, for a data superblock whose second verification data has not yet been overwritten, when a programming failure occurs in the physical block where the first verification data is located, the failed unit in the data superblock is recovered using the second verification data.

[0008] In a preferred embodiment, the verification storage space is composed of a plurality of single-layer cell flash memory blocks, and the plurality of single-layer cell flash memory blocks constituting the verification storage space are not organized into a superblock.

[0009] In a preferred embodiment, the program also includes maintaining a programming persistence acknowledgment table, which records the programming status of data superblocks, physical blocks, and pages in transit; Before overwriting the second verification data in the verification storage space, a judgment is made according to the programming persistence confirmation table. The second verification data is overwritten only if it is possible to destroy all subsequent programming stages of any data unit in the second verification stripe corresponding to the second verification data, and if the paired page on the same word line as the data unit has been successfully programmed. The predetermined quantity is determined based on the interleaving depth of the multi-stage programming of the non-volatile flash memory.

[0010] In a preferred embodiment, the method further includes establishing and maintaining a mapping relationship, wherein the mapping relationship records the correspondence between the storage address of the second check data in the check storage space and the location information of the second check stripe, wherein the location information includes a superblock identifier and a page number; the mapping relationship includes one or more mapping nodes, each mapping node recording the storage status of the second check data corresponding to a continuous second check stripe; In the same programming operation that writes the second verification data into the verification storage space, the location information corresponding to the second verification data is written into the spare area of ​​the non-volatile flash memory page where the second verification data is located. The location information includes superblock identifier, starting page number, number, stripe width, cycle generation of the verification storage space, stripe member valid bitmap, and verification value. After the second verification data and its location information are written and successfully programmed, the mapping node in the mapping relationship corresponding to the second verification data is marked as valid; After an abnormal power outage, the mapping relationship is reconstructed based on the read location information by scanning the spare areas of each non-volatile flash memory page in the verification storage space. When loading the second verification data, the query results of the mapping relationship and the location information in the spare area will be checked for consistency. The consistency check includes the comparison of the loop generation. If they are inconsistent, it is determined that the second verification data loading has failed.

[0011] In a preferred embodiment, the programming status is monitored during the writing process to the data superblock, and when the first programming failure is detected in the data superblock or the programming failure warning condition is met, the remaining writes to the data superblock are performed with redundancy upgrade. The redundancy upgrade includes at least one of the following: increasing the number of copies of the second check data for the remaining writes of the data superblock; switching the remaining writes of the data superblock to single-level cell programming mode; stopping further writes to the data superblock and transferring to a new data superblock.

[0012] In a preferred embodiment, when a physical block in a data superblock experiences a programming failure, and after the failed unit in the data superblock has been recovered, the physical block that experienced the programming failure is decommissioned from the data superblock, and the remaining physical blocks in the data superblock form a first check stripe for subsequent writing to the data superblock. The width of the first check stripe is smaller than the width of the first check stripe of the data superblock before decommissioning, which increases the proportion of the first check data in the first check stripe relative to the user data it protects, thereby enhancing the protection capability against programming failures for subsequent writing of data to the data superblock.

[0013] According to another aspect of this disclosure, a programming failure data protection system is provided, comprising: Memory, used to store computer-executable instructions; and, A processor, coupled to the memory, is configured to implement the steps of the method described above when executing the computer-executable instructions.

[0014] In the embodiments of this disclosure, user data and its first verification data are written together into a data superblock consisting of multiple physical blocks located on multiple wafers to form a first verification stripe. A verification storage space consisting of non-volatile flash memory blocks is set up. Second verification data is generated for a predetermined number of recently written data superblocks and written to the verification storage space in a cyclic manner with the writing of new data superblocks, overwriting the earliest written second verification data. When a programming failure of a data superblock is detected, the first verification data and the second verification data are used to recover the failed unit for data superblocks whose second verification data has not been overwritten, and the first verification data is used to recover the failed unit for data superblocks whose second verification data has been overwritten. This can maintain the block-level programming failure protection and recovery capability of the data superblock while only storing the second verification data of a small number of recently written data superblocks, thereby greatly reducing the storage space occupied by the verification data, reducing or even avoiding the loss of user available capacity, and balancing data protection capability and user capacity.

[0015] Furthermore, by organizing at least one of the first and second verification stripes across multiple wafers, making each stripe member a multi-plane physical block located on different wafers, and performing verification operations on each stripe member at the granularity of the multi-plane physical block to obtain corresponding verification data, it is possible to recover the failed unit even when a stripe member on a certain wafer experiences a programming failure, and to restore the verification stripe and execution data by organizing the multi-plane physical block as the granularity.

[0016] Furthermore, by basing the first and second check stripes on different groups, and by using the first and second check data to recover two failed units in a data superblock where the second check data has not yet been overwritten, the ability to recover multiple failed units in the recently written data superblock can be improved, further reducing the risk of data loss.

[0017] Furthermore, by using the second verification data to recover the failed unit in the data superblock where the second verification data has not yet been overwritten, when the physical block where the first verification data is located experiences a programming failure, data recovery can still be completed even if the physical block where the verification data itself is located fails, thereby improving the integrity of data protection.

[0018] Furthermore, by making the verification storage space consist of several single-level cell flash memory blocks, and not organizing these single-level cell flash memory blocks into a superblock, the reliability of verification data storage can be improved, and the verification storage space can be flexibly managed in blocks.

[0019] Furthermore, by maintaining a programming persistence verification table that records the programming status of superblocks, physical blocks, and pages of data in transit, a judgment is made based on this table before overwriting the second verification data. The second verification data is only overwritten if it can destroy all subsequent programming stages of any data unit in the corresponding second verification strip and if the paired pages on the same word line as the data unit have been successfully programmed. The predetermined number is determined based on the interleaving depth of multi-stage programming of non-volatile flash memory. This avoids prematurely overwriting the second verification data while the data is still within the multi-stage programming vulnerability window, ensuring sufficient recovery capability in case of programming failure while minimizing and maximizing the retention window of the second verification data.

[0020] Furthermore, by establishing a mapping relationship between the storage address of the second verification data in the verification storage space and the location information of the second verification stripe, the positioning information including the superblock identifier, starting page number, number of superblocks, stripe width, cycle generation, valid bitmap of stripe members, and verification value is written to the spare area of ​​the corresponding non-volatile flash memory page during the same programming operation of writing the second verification data. The corresponding mapping node is marked as valid only after the second verification data and its positioning information are successfully programmed. After an abnormal power failure, the mapping relationship is reconstructed by scanning the spare areas of each non-volatile flash memory page in the verification storage space. When loading the second verification data, the query result is checked for consistency with the positioning information and cycle generation in the spare area. This can restore the block-level protection capability of the superblock that was recently written after an abnormal power failure and ensure the consistency between the mapping relationship and the second verification data, avoiding mapping mismatch caused by cycle overwriting.

[0021] Furthermore, by monitoring the programming status during the writing process to the data superblock, and when the first programming failure is detected in the data superblock or the programming failure warning condition is met, performing at least one redundancy upgrade on the remaining write, including increasing the number of second verification data copies, switching to single-level cell programming mode, or stopping writing and transferring to a new data superblock, it is possible to avoid data loss due to reprogramming failures that exceed the recovery capacity of data superblocks that have already exposed defective tendencies, without affecting the write performance and capacity usage of other normal data superblocks.

[0022] Furthermore, by retiring the physical block that has failed in programming after the failure is recovered, and then using the remaining physical blocks to form a first check stripe with a smaller stripe width for subsequent writing of the data superblock, the data superblock can continue to be used after the bad block is retired, and the protection against programming failures of subsequent written data is enhanced because the proportion of the first check data in the stripe is increased.

[0023] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Various aspects and embodiments of this disclosure can be combined in different ways. This part of the disclosure is not intended to identify key or essential features of the claimed subject matter, nor is it intended to aid in determining the scope of the claimed subject matter. Attached Figure Description

[0024] Figure 1 This is a schematic flowchart of a programming failure data protection method according to an embodiment of the present disclosure. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this disclosure clearer, the disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] Example 1 This embodiment provides a method for protecting data in case of programming failure, applied to a storage controller containing non-volatile flash memory. In this embodiment, the non-volatile flash memory is taken as NAND flash memory, including but not limited to single-layer cell, multi-layer cell, three-layer cell, four-layer cell, and 3D NAND flash memory types. The storage controller can be a solid-state drive controller without off-chip dynamic random access memory cache. In this type of controller, the on-chip data cache is relatively small. To improve the number of chips simultaneously in programming mode and write performance, the data cache space within the controller is usually released after data transfer to the internal cache of the non-volatile flash memory is completed. The side effect of this is that if a programming failure occurs during the persistent programming phase, the original data in the cache space within the controller may have already been occupied by new writes, resulting in data loss. Therefore, it is necessary to provide protection and recovery capabilities for data in case of programming failure. The overall flow of the method in this embodiment is as follows: Figure 1 As shown, the process mainly includes four stages: writing the first verification data, generating and writing the second verification data, cyclically overwriting the second verification data, and recovering from programming failures. Each stage is described in detail below.

[0027] Step 101: Write the user data and its first verification data into the data superblock. In this embodiment, the data superblock consists of multiple physical blocks located on multiple chips. Each chip can independently perform erase, program, and read operations. The physical block is the basic unit for erasing non-volatile flash memory, and the page is the basic unit for programming non-volatile flash memory. Assume a data superblock consists of... It consists of physical blocks, each physical block contains Pages, of which and The specific values ​​are determined by the type and organization of the non-volatile flash memory used. This embodiment uses it as an exemplary specification and does not constitute a limitation, where M and N are both positive integers. During writing, user data organized across multiple logical pages is grouped into a first parity stripe. The first parity stripe can be organized across multiple logical pages on a multi-layer cell, resulting in a large stripe depth. This makes the proportion of the first parity data relative to the user data it protects relatively low, and the user capacity it persistently occupies less. A parity operation is performed on the user data within the first parity stripe to obtain the first parity data. The parity operation is taken as an example of an XOR operation, that is, the first parity data is equal to the result of bitwise XORing of each user data within the first parity stripe. The first parity data and the user data it protects together constitute the first parity stripe, and are persistently written into the non-volatile medium where the data superblock is located along with the user data. Because the first check stripe has a large stripe depth, multiple logical pages within the same physical block may reside in the same first check stripe. Therefore, the first check data is mainly used to provide basic, static recovery capabilities for isolated page-level failures (such as programming failures of individual pages), but it is insufficient to recover from programming failures across the entire physical block or the entire multi-plane physical block. Strong recovery capabilities for programming failures across the entire block or the entire multi-plane physical block are provided by the second check data, as described later. The introduction of the first check data enables the data superblock itself to possess the aforementioned basic page-level recovery capabilities for all its written data. Its input is the user data within the first check stripe, and its output is the user data written to the data superblock and the first check data.

[0028] Step 102: Set up a verification storage space, and generate second verification data for the user data contained in the recently written predetermined number of data superblocks, and write it to the verification storage space. In this embodiment, the verification storage space consists of one or more non-volatile flash memory blocks, and its capacity is pre-allocated to accommodate the second verification data of the predetermined number of data superblocks. This predetermined number is denoted as . This represents the number of most recently written data superblocks in the verification storage space that consistently retain their second checksum data. Considering the short time between a programming failure and the successful recovery of the failed data, newly written data during this period will only consume a small number of data superblocks. Therefore, the second checksum data required for data recovery must reside within these few most recently written data superblocks. A smaller value is sufficient to meet the recovery requirements. This embodiment uses... Taking a value of 6 as an example, the second parity data of the six most recently written superblocks is retained in the parity storage space, but... The specific value is not a limitation of this method; those skilled in the art can flexibly choose it based on factors such as the programming characteristics of non-volatile flash memory, failure recovery latency, and capacity budget. The generation of the second check data also uses an XOR operation as an example: a second check stripe is organized around the user data contained in the most recently written data superblock, and the user data within the second check stripe is XORed bitwise to obtain the second check data; the second check data and the user data it protects together constitute the second check stripe. The input to this step is the user data of the most recently written data superblock, and the output is the second check data written to the check storage space. Thus, the same user data is simultaneously protected by both the first check data that is persistently stored with it and the second check data that is independently stored in the check storage space.

[0029] Step 103: As a new data superblock is written, the second parity data of the newly written data superblock is cyclically written to the parity storage space, overwriting the earliest written second parity data in the parity storage space. In this embodiment, the non-volatile flash memory blocks in the parity storage space are managed using a circular queue to achieve cyclic writing and cyclic release of space. Specifically, free addresses are sequentially allocated from the parity storage space for the second parity data of the newly written data superblock; when the free addresses are exhausted, the earliest written non-volatile flash memory blocks in the parity storage space are cyclically erased to release new free addresses. The erased non-volatile flash memory blocks contain the earliest written second parity data, thus completing the overwriting of the earliest written second parity data. In this way, no matter how much data the host writes, the second parity data of the most recently written predetermined number of data superblocks is always continuously retained in the parity storage space. It is important to note that the overwriting of the earliest written second check data in this step is not conditional upon performing a post-write scan verification of the corresponding data superblock. In other words, the controller does not need to perform a post-write readback scan or check for verification on a data superblock before overwriting its second check data; instead, it directly overwrites based on the progress of the cyclic write operation. This cyclic overwriting method, which is not conditional upon post-write scan verification, ensures that the cyclic release of second check data is closely integrated with the write process, eliminating the need for additional scan verification procedures. This simplifies the management process of second check data while maintaining block-level protection capabilities with minimal storage space. The input to this step is the second check data of the newly written data superblock, and the output is the updated check storage space, which always contains the second check data of the predetermined number of most recently written data superblocks.

[0030] Step 104: When a programming failure is detected in a data superblock, the failed unit is recovered. In this embodiment, the master controller monitors the programming status during the writing process to the data superblock. When a physical block returns a programming failure during the persistent programming phase, it is considered that the data superblock has experienced a programming failure, and all pages of data on the physical block where the programming failure occurred are at risk of loss. Recovery is handled in two separate scenarios. The first scenario is that for a data superblock whose second verification data has not yet been overwritten, i.e., the data superblock is still within the range of the predetermined number of most recently written data superblocks retained in the verification storage space, the first verification data persistently stored with the user data can be obtained, as well as the second verification data that has not yet been overwritten can be obtained from the verification storage space. Therefore, the failed unit in the data superblock is recovered using the first and second verification data, thereby providing block-level strong recovery capability for programming failures across the entire physical block or the entire multi-plane physical block range in the data superblock. The second scenario involves a data superblock whose second check data has been overwritten. This means the superblock has been rolled out of the check storage space and its second check data has been overwritten by newly written second check data. In this case, the check storage space no longer contains the second check data corresponding to the superblock. Therefore, only the first check data, persistently stored with the user data, is used for basic recovery of isolated page-level failures within the superblock, providing basic, static page-level protection. It no longer possesses strong recovery capabilities for programming failures across the entire physical block or multi-plane physical block. In the recovery process for either scenario, for the check stripe containing the failed unit, user data within that strip (excluding the location of the failed unit) is loaded sequentially and a check operation is performed. Then, the corresponding check data is loaded and the check operation is performed again. Finally, the recovered failed unit data is obtained from the result of the check operation. This recovery process is repeated for each recoverable failed unit within the physical block (or multi-plane physical block) where the programming failure occurred. In the first scenario, recovery can continue until all data within the physical block or multi-plane physical block is recovered. In the second scenario, recovery is limited to recovering isolated page-level failures. The input to this step is the location information of the programming failure, as well as the corresponding user data and verification data. The output is the recovered failed unit data, thereby protecting the programming failure data.

[0031] Steps 101 to 104 above constitute a complete technical solution. Those skilled in the art can achieve protection of programming failure data by following these four steps: First, the data superblock itself possesses a block-level recovery basis through first verification data; second, the recently written data superblocks are further protected by continuously retaining a predetermined number of recently written data superblocks' second verification data in the verification storage space; and when a programming failure is detected, recovery is performed using either double verification or single verification depending on whether the second verification data has been overwritten. Compared to a solution that statically stores the second verification data of all data superblocks in user space, this method only requires dynamically retaining the second verification data of a small number of recently written data superblocks with a very small amount of storage space, significantly reducing the storage space occupied by verification data while maintaining block-level protection capabilities. Taking a certain model of non-volatile flash memory solid-state drive (SSD) as an example, if only the second parity data of the most recently written superblocks is dynamically retained, then under the same block-level protection capability, approximately 99% of the parity data storage space can be saved compared to the solution of statically storing all parity data, with almost no impact on the user's usable capacity; for an SSD with a capacity of approximately 256GB, only about 0.125% of the space is required. Furthermore, since the parity storage space occupies a very small amount, if it is allocated from the SSD's redundant space, which is generally between 6% and 20%, then there can be no loss of the user's usable capacity. Several optional improvements to this solution are explained below.

[0032] In some optional implementations, at least one of the first and second check stripes can span multiple wafers. Each member of the check stripe is a multi-plane physical block located on different wafers. The corresponding first or second check data is obtained by performing check operations on each stripe member at the granularity of the multi-plane physical block. Specifically, a multi-plane physical block refers to a combination of physical blocks composed of multiple physical blocks on multiple planes within the same wafer, which can be programmed and erased as a whole. Examples of multi-plane physical blocks include dual-plane physical blocks and quad-plane physical blocks. When multi-plane physical blocks are used as stripe members and XOR operations are performed at the granularity of the multi-plane physical block, the members of a check stripe are distributed across different wafers. Therefore, if a programming failure occurs on a multi-plane physical block on one wafer, recovery can be achieved using members and check data from other wafers at the granularity of the multi-plane physical block. It should be noted that organizing the verification stripes at the multi-plane physical block granularity is not a necessary condition for implementing this method. The verification stripes can also be organized at the page granularity, or only one of the first and second verification stripes can be organized using the multi-plane physical block method across multiple wafers. Those skilled in the art can flexibly choose according to the parallel capability and scheduling strategy of the non-volatile flash memory.

[0033] Building upon the above scheme, the first and second check stripes can be further configured to be based on different groupings. That is, the grouping method of user data in the second check stripe is independent of the grouping method of the first check stripe, ensuring that the same failed unit forms check relationships with different other units in the first and second check stripes. When using different groupings, for a data superblock whose second check data has not yet been covered, if there are two failed units in the superblock, the first and second check data can be used to recover these two failed units. Specifically, since the two failed units belong to different groupings in the first and second check stripes, a recovery relationship sufficient to solve for the two unknown failed units can be established using two independent check relationships. This allows for the recovery of two failed units beyond the limitation of a single check relationship only being able to recover one failed unit. Even without using a second check stripe with different groupings, a single failed unit can be recovered using only the first check data; therefore, the aforementioned different groupings are not a necessary condition for implementing this method.

[0034] Optionally, for a data superblock whose second check data has not yet been overwritten, if the physical block containing the first check data itself experiences a programming failure, the second check data can be used to recover the failed unit in the data superblock. When the first check data is written to the data superblock along with the user data, the physical block carrying the first check data may also experience a programming failure. When the location of the first check data cannot be used for recovery due to a programming failure, as long as the second check data in the data superblock has not been overwritten, the second check data stored in the check storage space can be used to recover the failed unit, thus providing further fallback protection. It should be noted that this fallback recovery method is an optional supplement in the specific case of the first check data itself failing; when the first check data is available, recovery can still be directly completed using the first check data.

[0035] To further reduce the overhead of the verification storage space and simplify its management, the verification storage space can be composed of several single-level cell flash memory blocks, and these single-level cell flash memory blocks constituting the verification storage space are not organized into superblocks. Each storage cell of a single-level cell flash memory block stores only one bit of information, which has higher programming reliability compared to multi-level cell flash memory blocks. Using it to carry the second verification data helps to improve the reliability of the second verification data itself. At the same time, since the required capacity of the verification storage space is very small, managing the single-level cell flash memory blocks as independent blocks instead of organizing them into superblocks can simplify the management logic of space allocation and cyclic erasure. It should be noted that using single-level cell flash memory blocks and not organizing them into superblocks are both optional implementation methods. The verification storage space can also be composed of multi-level cell flash memory blocks, or the non-volatile flash memory blocks can be organized into superblocks for management. Those skilled in the art can flexibly choose according to the trade-off between reliability and management complexity.

[0036] Example 2 This embodiment, based on Embodiment 1, further improves the timing of overwriting the second verification data in the verification storage space, ensuring that the retention window for the second verification data neither ends prematurely nor unnecessarily occupies space. The main difference between this embodiment and Embodiment 1 is that a gating judgment based on the programmed persistent state is introduced before cyclically overwriting the second verification data.

[0037] In non-volatile flash memory, the completion of data transfer from the controller to the non-volatile flash cache does not equate to data persistence; the non-volatile flash may still be in the process of being programmed. Especially in multi-stage programming, such as the multiple programming methods used in three- or four-level cell flash memory, a failure in a later programming stage of a word line may also corrupt data in lower pages on the same word line that have already been successfully programmed and released from the cache. Therefore, a parity stripe that appears to have been written can still be retroactively corrupted by a subsequent programming failure if the subsequent programming stage of the word line containing its data unit or the paired page has not yet been safely completed. If cyclic overwriting is performed solely based on the number of written data superblocks, a second parity stripe may be physically still within the vulnerability window, while its second parity data has already been overwritten, resulting in a programming failure at this point without any second parity data available.

[0038] To this end, this embodiment also includes maintaining a programming persistence verification table, which records the programming status of data superblocks, physical blocks, and pages in transit. Specifically, the programming persistence verification table records the programming status of each data superblock, physical block, and page in transit, with examples including data transfer completed, programming execution initiated, status returned as waiting, programming successful, programming failed, and physical block closed. Furthermore, the programming persistence verification table can also record information such as the chip, plane, and channel identifiers related to the above-mentioned programming unit, the number of the programming command, and the storage address of the corresponding second verification data in the verification storage space, so as to locate the corresponding programming unit and verification data during judgment.

[0039] Before overwriting the second parity data in the parity storage space, a determination is made based on the programming persistence confirmation table. The second parity data is only overwritten if all subsequent programming stages capable of destroying any data unit in the second parity stripe corresponding to the second parity data, as well as the paired pages on the same word line as the data unit, have been successfully programmed. Otherwise, the second parity data is not overwritten and remains in the parity storage space until the above conditions are met. In other words, the progress of cyclic overwriting is gated by the fully committed programming frontier of each open data superblock. Only after all subsequent programming stages capable of destroying any data unit in a second parity stripe and the paired pages have been confirmed as successfully programmed, does the second parity data corresponding to that second parity stripe enter an overwriteable state. Through this gating based on programming persistence confirmation, the retention window of the second parity data is anchored to the multi-stage programming progress of the non-volatile flash memory, thereby avoiding overwriting the second parity data while the parity stripe is still in the volatile window.

[0040] Furthermore, in this embodiment, the predetermined quantity is determined based on the interleaving depth of multi-stage programming of non-volatile flash memory. The interleaving depth of multi-stage programming reflects how many pages are in transit at a given moment, having already been written into the programming stage but with subsequent programming stages yet to be completed. Deriving the predetermined quantity based on this interleaving depth ensures that the number of data superblocks retained in the verification storage space precisely covers all verification stripes within the volatile window, rather than relying on an empirically fixed constant. It should be noted that the aforementioned programming persistence verification table and the determination of the predetermined quantity based on the interleaving depth are both optional improvements. Without introducing the programming persistence verification table, the method can still be implemented normally by performing cyclic overwriting based on the number of written data superblocks as described in Embodiment 1. Introducing the aforementioned gating judgment helps to further improve the sufficiency of the second verification data retention window in multi-stage programming scenarios.

[0041] Example 3 This embodiment, based on Embodiment 1, further improves the recording method of the correspondence between the second verification data and the second verification strip it protects. This ensures that the block-level protection capability of the most recently written window remains effective after an abnormal power outage and guarantees the consistency between the recorded mapping relationship and the second verification data. The main difference between this embodiment and Embodiment 1 lies in the methods of establishing, persisting, and reconstructing the mapping relationship.

[0042] This embodiment also includes establishing and maintaining a mapping relationship. This mapping relationship records the correspondence between the storage address of the second parity data in the parity storage space and the position information of the second parity stripe. The position information includes the superblock identifier and the page number. Specifically, the mapping relationship can be organized using mapping nodes. Each mapping node records the storage status of the second parity data corresponding to a continuous second parity stripe. Further, the mapping node can use a superblock identifier, starting page number, starting storage address, and number to record the position information of a continuous second parity stripe within a data superblock. Here, the superblock identifier represents the sequence number of the data superblock written to the user space, the starting page number represents the starting page within the data superblock, the starting storage address represents the starting address in the parity storage space, and the number represents the number of pages. Thus, one mapping node can record the correspondence between the position of a continuous second parity data segment within a data superblock in the parity storage space and the position of its corresponding second parity stripe. The mapping nodes can also be managed using a circular queue to achieve circular writing and circular release, thereby always recording the position relationship between the second parity data of the most recently written data superblock and the second parity stripe. After allocating a storage address for the newly written second check data, a corresponding mapping relationship is constructed and recorded in the mapping relationship through a table update operation. Before cyclically erasing the earliest written non-volatile flash memory block in the check storage space, a table delete operation is used to delete the mapping node pointing to the earliest written non-volatile flash memory block in the mapping relationship. When the second check data needs to be loaded, a table query is initiated based on the superblock identifier and page number, the storage address is obtained from the query result, and then the second check data is read from the check storage space accordingly.

[0043] Considering that if the above mapping relationship is only stored in the volatile memory of the main controller, the mapping relationship of the most recently written window will be lost after an abnormal power failure, making it impossible to recover the data in the programming state before the power failure, this embodiment further persists the information used to reconstruct the mapping relationship in the non-volatile flash memory page where the second verification data itself is located. Specifically, in the same programming operation of writing the second verification data into the verification storage space, the positioning information corresponding to the second verification data is written into the spare area of ​​the non-volatile flash memory page where the second verification data is located. The positioning information includes the superblock identifier, starting page number, number, stripe width, cycle generation of the verification storage space, stripe member valid bitmap, and check value. Among them, the stripe width represents the number of members contained in the second verification stripe, the cycle generation represents the generation in which the verification storage space is cyclically written, the stripe member valid bitmap is used to characterize the validity of each member of the second verification stripe, and the check value, taking the cyclic redundancy check value or error correction check value as an example, is used to verify the correctness of the positioning information. Since the location information and the second verification data are written together in the same programming operation, the location information is permanently saved along with the second verification data.

[0044] To ensure atomic consistency between the mapping relationship and the second verification data, this embodiment employs a two-stage method to mark the validity of the mapping relationship. Specifically, the second verification data and its location information in the spare area of ​​the non-volatile flash memory page are first written. After the programming operation is successful, the mapping node corresponding to the second verification data in the mapping relationship is marked as valid. In this way, the corresponding mapping node is only considered valid after the second verification data and its location information have indeed been successfully programmed, thereby avoiding the situation where the mapping node has been recorded but the corresponding second verification data has not yet been reliably stored.

[0045] After an abnormal power outage, the mapping relationship is reconstructed by scanning the spare areas of each non-volatile flash memory page in the verification storage space and based on the read location information. Since the capacity of the verification storage space is very small, during power-on recovery, only the spare areas of the small verification storage space need to be scanned. The entire mapping relationship can be reconstructed based on the location information such as the superblock identifier, starting page number, number of pages, stripe width, cycle generation, and stripe member valid bitmap, thereby restoring the block-level protection capability of the most recently written window without scanning the entire disk.

[0046] When loading the second verification data, a consistency check is performed between the query result of the mapping relationship and the location information and cycle generation in the spare area. If they are inconsistent, the loading of the second verification data is deemed to have failed. Specifically, since the verification storage space uses cyclic erasure, there may be old mapping node remnants or generation mismatches between the mapping node and the second verification data. Therefore, after reading the second verification data based on the query result of the mapping relationship, the superblock identifier, page number, storage address, and cycle generation information pointed to by the query result are compared with the location information and cycle generation recorded in the spare area of ​​the page where the second verification data is located. If they match, the second verification data is deemed valid and used for subsequent recovery. If they do not match, the loading of the second verification data is deemed to have failed, in order to avoid using second verification data that has become invalid or mismatched due to cyclic overwriting. It should be noted that the above-mentioned improvements, such as writing the location information into the spare area, using a cyclic generation and stripe member valid bitmap, marking the mapping node as valid in a two-stage manner, and performing consistency verification during loading, are all optional improvements. Without introducing mapping reconstruction after power failure, maintaining the mapping relationship as described in Embodiment 1 can still achieve this method during normal operation. Introducing the above improvements helps to ensure that the block-level protection capability of the most recently written window remains effective after an abnormal power failure, and ensures the consistency between the mapping relationship and the second verification data in the cyclic coverage scenario.

[0047] Example 4 Based on Embodiment 1, this embodiment further improves the handling method when the data superblock exposes a defect tendency during the writing process, and the handling method of the data superblock after the physical block programming failure is completed and recovery is achieved, and provides a system for implementing the above methods.

[0048] During the writing process to the data superblock, the programming status is monitored. When the first programming failure is detected within the data superblock or a programming failure warning condition is met, redundancy upgrades are performed on the remaining writes to the data superblock. Specifically, the controller continuously monitors the programming status of each physical block during the writing process to the data superblock. Once the first programming failure is detected within a data superblock, or a pre-set programming failure warning condition is met, it is considered that the data superblock has exposed a defect tendency, and the probability of subsequent writes failing again is significantly increased. Therefore, redundancy protection is improved for the remaining unwritten portion of the data superblock. Redundancy upgrades include at least one of the following: increasing the number of copies of the second check data for the remaining writes of the data superblock, i.e., generating and storing more copies of the second check data for the remaining user data written to the data superblock to improve the recovery capability against subsequent programming failures; switching the remaining writes of the data superblock to a single-level cell programming mode, i.e., programming the remaining writes by storing only one bit of information per storage cell to improve the programming reliability of the remaining writes; stopping further writing to the data superblock and transferring to a new data superblock, i.e., no longer writing new user data to the data superblock that has exposed defects, but instead continuing to write to a new data superblock. The above redundancy upgrades are triggered locally on the data superblock and based on the actual detected defect signals, and do not affect normal error-free data superblocks, thus not changing the write performance and capacity usage under normal circumstances. It should be noted that the above redundancy upgrades are optional improvements. Without performing redundancy upgrades, the dual-check protection described in Embodiment 1 can still achieve this method; introducing redundancy upgrades helps to further reduce the risk of data unrecoverability due to subsequent programming failures when the data superblock has exposed defect tendencies.

[0049] Based on the above scheme, a further configuration can be made: when a physical block in the data superblock experiences a programming failure, and after the failed unit in the data superblock has been recovered, the physical block that experienced the programming failure is decommissioned from the data superblock, and the remaining physical blocks in the data superblock form a first check stripe for subsequent writing to the data superblock. Specifically, after the recovery of the failed unit is completed as described in Embodiment 1 and the salvaged data is transferred and saved, the physical block that experienced the programming failure is marked as no longer needed and decommissioned from the data superblock. The remaining physical blocks in the data superblock are then recombined to form a first check stripe for subsequent writing to the data superblock. The width of the first check stripe is smaller than the width of the first check stripe of the data superblock before decommissioning, increasing the proportion of the first check data within the first check stripe relative to the user data it protects, thereby enhancing the protection against programming failures for subsequent writing of data to the data superblock. It should be noted that the above-mentioned retirement and reorganization of the first check stripe of the programming failure physical block is an optional improvement. The data superblock that has failed programming can also be handled in other ways without retirement and reorganization. Introducing this retirement and reorganization helps to improve the protection capability of subsequent written data while preserving the remaining usable physical blocks of the data superblock.

[0050] This embodiment also provides a programming failure data protection system for implementing the methods described in any of Embodiments 1 to 4 above. The system includes a memory and a processor. The memory stores computer-executable instructions; the processor is coupled to the memory and is used to implement the steps in the methods described in the above embodiments when executing the computer-executable instructions. In this embodiment, the processor can be implemented by the processing core in the memory controller, and the memory can be implemented by a storage component for storing computer-executable instructions. The system may also include a non-volatile flash memory controller for converting commands such as erasing, programming, and reading of the verification storage space into non-volatile flash memory bus commands, and corresponding modules for managing the user storage space and the verification storage space, wherein the management of the user storage space can be implemented using conventional methods in the art. Those skilled in the art should understand that the specific forms of the memory and processor described above do not constitute a limitation on this solution; any component capable of storing and executing computer-executable instructions that implement the above methods can be used to constitute this system.

[0051] Accordingly, one embodiment of this disclosure also provides a computer-readable storage medium storing computer-executable instructions (or computer programs) that, when executed by a processor, implement the steps in the above-described method embodiments. The computer-readable storage medium may include any type of volatile or non-volatile memory, or any combination thereof, storing computer program code. Specifically, the computer-readable storage medium may include, but is not limited to: magnetic storage devices (e.g., magnetic tape, hard disk, floppy disk), optical storage devices (e.g., optical disc (CD), digital versatile optical disc (DVD)), magneto-optical storage devices (e.g., magneto-optical disc), semiconductor memory (e.g., read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc.) or other storage technologies. The computer-readable storage medium in this disclosure refers to a non-transitory readable storage medium, excluding the transient propagation signal itself (e.g., modulated data signals, carrier waves, etc.).

[0052] Furthermore, one embodiment of this disclosure provides a computer program product including a computer program or computer-executable instructions carried on a non-transitory computer-readable medium, wherein the computer program or computer-executable instructions, when executed by a processor, cause the processor to perform the steps in the above-described method embodiments.

[0053] It should be noted that the terms "first," "second," etc., used in this specification are only used to distinguish similar objects, and the elements defined by them do not necessarily require or imply any actual relationship or order between these elements, nor are they used to describe a specific order or sequence.

[0054] The terms “comprising,” “including,” or any other variations thereof, as used herein, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0055] The phrase "execute according to a certain element" as used in this specification means at least according to that element, including both "execute only according to that element" and "execute according to that element and other elements".

[0056] Those skilled in the art will understand that variations of the method steps described above can be obtained based on the embodiments of this disclosure without any inventive effort. For example, the sequence numbers of the steps described in the method embodiments of this specification do not themselves constitute a limitation on the execution order of these steps. Unless there is an explicit specific limitation in the context, the steps may be executed in a different order than that shown in the embodiments (e.g., executing the steps with larger sequence numbers first, then the steps with smaller sequence numbers), or they may be executed in parallel. Furthermore, other steps may be inserted between multiple steps with consecutively numbered sequence numbers.

[0057] After reading this disclosure, those skilled in the art can make various alterations or modifications to it, and these equivalent forms also fall within the scope of protection claimed by this disclosure.

Claims

1. A method for protecting data in case of programming failure, applied to a storage controller containing non-volatile flash memory, characterized in that, include: The user data and the first verification data of the user data are written together into the data superblock. The data superblock is composed of multiple physical blocks located on multiple chips respectively. The first verification data and the user data protected by the first verification data constitute the first verification stripe. A verification storage space is set up, which consists of one or more non-volatile flash memory blocks. Second verification data is generated for the user data contained in a predetermined number of recently written data superblocks and written into the verification storage space. The second verification data and the user data protected by the second verification data constitute a second verification stripe. As a new data superblock is written, the second verification data of the newly written data superblock is cyclically written into the verification storage space, overwriting the earliest written second verification data in the verification storage space. The overwriting is not conditional on scanning and verifying the corresponding data superblock after writing. When a programming failure is detected in a data superblock, for data superblocks whose second verification data has not been overwritten, the first verification data and the second verification data are used to recover the failed units in the data superblock. For a data superblock whose second verification data has been overwritten, the failed units in the data superblock are recovered using the first verification data.

2. The method according to claim 1, characterized in that, At least one of the first and second verification stripes spans multiple wafer structures, and each stripe member of the verification stripe is a multi-plane physical block located on different wafers. The first verification data or the second verification data is obtained by performing verification operations on each stripe member at the granularity of the multi-plane physical block. The first verification strip is a page-level verification strip, and the second verification strip is a physical block or multi-plane physical block-level verification strip. The strip depth of the first verification strip is greater than the strip depth of the second verification strip, such that the proportion of the first verification data relative to the user data it protects is less than the proportion of the second verification data relative to the user data it protects.

3. The method according to claim 1, characterized in that, The first check stripe and the second check stripe are based on different groups; for a data superblock whose second check data has not yet been covered, when there are two failed units in the data superblock, the first check data and the second check data are used to recover the two failed units.

4. The method according to claim 1, characterized in that, For a data superblock whose second verification data has not yet been overwritten, when the physical block containing the first verification data experiences a programming failure, the second verification data is used to recover the failed unit in the data superblock.

5. The method according to claim 1, characterized in that, The verification storage space is composed of several single-layer cell flash memory blocks, and the several single-layer cell flash memory blocks constituting the verification storage space are not organized into a super block.

6. The method according to claim 1, characterized in that, It also includes maintaining a programming persistence acknowledgment table, which records the programming status of data superblocks, physical blocks, and pages in transit; Before overwriting the second verification data in the verification storage space, a judgment is made according to the programming persistence confirmation table. The second verification data is overwritten only if it is possible to destroy all subsequent programming stages of any data unit in the second verification stripe corresponding to the second verification data, and if the paired page on the same word line as the data unit has been successfully programmed. The predetermined quantity is determined based on the interleaving depth of the multi-stage programming of the non-volatile flash memory.

7. The method according to claim 1, characterized in that, It also includes establishing and maintaining a mapping relationship, which records the correspondence between the storage address of the second check data in the check storage space and the location information of the second check stripe, wherein the location information includes a superblock identifier and a page number; the mapping relationship includes one or more mapping nodes, each mapping node recording the storage status of the second check data corresponding to a continuous second check stripe; In the same programming operation that writes the second verification data into the verification storage space, the location information corresponding to the second verification data is written into the spare area of ​​the non-volatile flash memory page where the second verification data is located. The location information includes superblock identifier, starting page number, number, stripe width, cycle generation of the verification storage space, stripe member valid bitmap, and verification value. After the second verification data and its location information are written and successfully programmed, the mapping node in the mapping relationship corresponding to the second verification data is marked as valid; After an abnormal power outage, the mapping relationship is reconstructed based on the read location information by scanning the spare areas of each non-volatile flash memory page in the verification storage space. When loading the second verification data, the query results of the mapping relationship and the location information in the spare area will be checked for consistency. The consistency check includes the comparison of the loop generation. If they are inconsistent, it is determined that the second verification data loading has failed.

8. The method according to claim 1, characterized in that, During the writing process to the data superblock, the programming status is monitored. When the first programming failure is detected in the data superblock or the programming failure warning condition is met, the remaining writes to the data superblock are performed with redundancy upgrade. The redundancy upgrade includes at least one of the following: increasing the number of copies of the second check data for the remaining writes of the data superblock; switching the remaining writes of the data superblock to single-level cell programming mode; stopping further writes to the data superblock and transferring to a new data superblock.

9. The method according to claim 1, characterized in that, When a physical block in a data superblock experiences a programming failure, and after the failed unit in the data superblock has been recovered, the physical block that experienced the programming failure is decommissioned from the data superblock. The remaining physical blocks in the data superblock then form a first check stripe for subsequent writing to the data superblock. The width of the first check stripe is smaller than the width of the first check stripe of the data superblock before decommissioning, which increases the proportion of the first check data in the first check stripe relative to the user data it protects, thereby enhancing the protection against programming failures for subsequent writing to the data superblock.

10. A programming failure data protection system, characterized in that, include: Memory is used to store executable instructions for a computer; as well as, A processor, coupled to the memory, is configured to implement the steps of the method according to any one of claims 1 to 9 when executing the computer-executable instructions.

Images