METHOD FOR OPERATING STORAGE DEVICE AND SYSTEM INCLUDING STORAGE DEVICE

Abstract

To provide a method for operating a storage device and a system including the storage device, which can operate in a variety of recovery (restoration) modes and have a fault-recoverable read-only mode that can retain partial functionality or return to all functionality despite internal failures.SOLUTION: A method for operating a storage device including a storage medium according to the present invention includes a step of causing the storage device to determine that it is in a partially recoverable failure state by causing the storage device to operate the storage device in a first read-only mode, and a step of causing the storage device to operate in the first read-only mode. The step of causing the storage device to operate in the first read-only mode includes a step of determining that the elapsed time (age) of a first data item stored on a page of the storage device has exceeded a threshold elapsed time, and a step of copying the first data item into a rescue space of the storage device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to data storage systems, and more particularly to methods of operating storage devices and systems including storage devices configured to exhibit resilience in the presence of internal failure conditions. [Background technology]

[0002] Storage devices and systems have wide applicability within a variety of data processing systems. Storage devices are complex enough that they face a significant range of internal failure conditions, including temperature sensor failure or radiation-induced bit flips. If these failure conditions are not taken into account when designing a storage device, or a system using such a storage device (e.g., a Redundant Array of Independent Disks (RAID)), a single failure in a storage device could cause the entire storage device, or a larger system that includes the storage device (such as a RAID), to become inoperable.

[0003] Therefore, there exists a need to develop systems and methods for recovery (restoration) operations of storage devices and systems that include storage devices. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] U.S. Patent No. 7,451,346 [Patent Document 2] U.S. Patent No. 8,589,723 [Patent Document 3] U.S. Patent No. 8,769,535 [Patent Document 4] U.S. Pat. No. 9,710,317 [Patent Document 5] U.S. Patent No. 9,728,277 [Patent Document 6] U.S. Patent No. 9,830,236 [Patent Document 7] U.S. Patent No. 10,095,506 [Patent Document 8] U.S. Patent No. 10102082 [Patent Document 9] U.S. Pat. No. 10,263,842 [Patent Document 10] U.S. Patent No. 10445200 [Patent Document 11] U.S. Pat. No. 10,572,161 [Patent Document 12] US Patent Publication No. 20050120267 [Patent Document 13] US Patent Publication No. 20060143507 [Patent Document 14] US Patent Publication No. 20070101188 [Patent Document 15] US Patent Publication No. 20130047028 [Patent Document 16] US Patent Publication No. 20140195847 [Patent Document 17] US Patent Publication No. 20150100720 [Patent Document 18] US Patent Publication No. 20180011649 [Patent Document 19] US Patent Publication No. 20190377637 [Patent Document 20] US Patent Publication No. 20190384670 [Patent Document 21] US Patent Publication No. 20200135280 Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention has been made in consideration of the problems with the above-mentioned conventional storage devices and systems including storage devices, and an object of the present invention is to provide a method for operating a storage device that can operate in various recovery (restoration) modes and has a fault-resilient read-only mode that can maintain partial functionality or return to full functionality despite an internal failure, and a system including a storage device. [Means for solving the problem]

[0006] In order to achieve the above object, a method for operating a storage device according to the present invention is a method for operating a storage device including a storage medium, the method comprising the steps of: determining, by the storage device, that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode; and operating the storage device in the first read-only mode, The storage device The operating step includes identifying first data and second data in a region of the storage device associated with the failure condition; First Data determining that an age of the first data exceeds a threshold age and that a size of a rescue space in the storage device is smaller than a size of an area of ​​the storage device associated with the failure state; and copying the first data into the rescue space in the storage device and retaining the second data in the area of ​​the storage device based on the determination.

[0007] The threshold age is preferably based on a retention period of the page in the storage device. The step of operating the storage device in the first read-only mode includes:It is preferable that the method further comprises the steps of receiving a read command for a third item of data from a host connected to the storage device, decoding the third item of data, returning an indication based on the decoding, and determining that the size of the area of ​​the storage device is less than a threshold size. The step of operating the storage device in the first read-only mode includes: determining that a size of the available rescue space is less than a threshold size; Switching the operation of the storage device from the first read-only mode to a second read-only mode and sending a notification to a host connected to the storage device, the notification preferably informing a host that the storage device is operating in the second read-only mode and allowing items of data stored on the storage device to expire. It is preferable that the method further comprises the steps of receiving the notification by the host, reading the third data item from the storage device by the host, and writing the third data item to another storage device by the host. It is preferable that the method further comprises a step of determining, by the host, a data rate based on the amount of data stored in the storage device and the time remaining until the data expires.

[0008] The step of operating the storage device in the first read-only mode includes: It is preferable that the method further includes the steps of receiving a read command for a third data item from a host connected to the storage device, determining that the elapsed time of the third data item is greater than a second threshold elapsed time, and returning an indication to the host based on the elapsed time of the third data item being greater than the second threshold elapsed time. The step of operating the storage device in the first read-only mode includes: It is preferable that the method further includes the steps of receiving a read command for a third data item from a host connected to the storage device, decoding the third data item, and returning an indication based on the decoding. Preferably, operating in the first read-only mode includes determining that the age of an item of third data stored in a page of the storage device has exceeded a threshold age by an amount less than the age of the item of first data, and copying the item of third data to a rescue space of the storage device. The step of operating the storage device in the first read-only mode includes: Preferably, the method further comprises the step of compressing said first data item.

[0009] The step of operating the storage device in the first read-only mode includes: Preferably, the method further comprises the steps of creating a namespace for the rescue space and increasing the size of the namespace. Preferably, the method further comprises the step of tagging, by a host connected to the storage device, the first item of data with an indicator of a first importance. The method preferably further comprises tagging, by a host connected to the storage device, the first item of data as being part of a first file, the first file being a file of a first file type. It is preferable that the method further comprises the steps of tagging, by a host connected to the storage device, the first data as being part of a first file, and tagging, by a host connected to the storage device, the third data as being part of the first file.

[0010] In order to achieve the above object, a system including a storage device according to the present invention is a system including a storage device, the storage device having a processing circuit, the processing circuit being configured to determine, by the storage device, that a partially restorable failure state is in a state by operating the storage device in a first read-only mode, and to operate the storage device in the first read-only mode, the operation in the first read-only mode identifying first data and second data in an area of ​​the storage device associated with the state of the failure, Elapsed time of the first datathe size of a rescue space in the storage device is smaller than the size of an area of ​​the storage device associated with the failure state; and based on the determination, copying the first data into the rescue space in the storage device and retaining the second data in the area of ​​the storage device.

[0011] The threshold elapsed time is of said region Preferably based on shelf life. The processing circuitry determines that a size of the available rescue space is less than a threshold size, operates the storage device in a second read-only mode, and connects to the storage device. was done Send a notification to the host moreover The notification is configured to notify the user that the storage device is operating in the second read-only mode and that data stored in the storage device is in the second read-only mode. of It is preferable to notify that the item is allowed to expire.

[0012] In order to achieve the above object, a system including a storage device according to the present invention is a system including a storage device, the storage device having a processing means, the processing means being configured to determine that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode, and to operate the storage device in the first read-only mode, the operation in the first read-only mode identifying first data and second data in an area of ​​the storage device associated with the failure state, Elapsed time of the first data the size of a rescue space in the storage device is smaller than the size of an area of ​​the storage device associated with the failure state; and based on the determination, copying the first data into the rescue space in the storage device and retaining the second data in the area of ​​the storage device.

[0013] The threshold elapsed time is of said region Preferably based on shelf life. The processing means determines that the size of the available rescue space is less than a threshold size, operates the storage device in a second read-only mode, and connects to the storage device. was done and sending a notification to a host, the notification indicating that the storage device is operating in the second read-only mode and that data stored on the storage device is in the read-only mode. of It is preferable to notify that the item is allowed to expire. Effect of the Invention

[0014] According to the method of operating a storage device and a system including a storage device of the present invention, it is possible to provide a method of operating a storage device and a system including a storage device that can operate in various recovery (restoration) modes and has a fault-resilient read-only mode that can maintain partial functionality or return to full functionality despite an internal failure. [Brief description of the drawings]

[0015] [Figure 1] 1 is a block diagram showing a schematic configuration of a data storage system according to an embodiment of the present invention. [Figure 2A] 4 is a table for explaining a failure state of a storage device according to an embodiment of the present invention. [Figure 2B] 4 is a table for explaining operation modes of a storage device according to an embodiment of the present invention. [Figure 2C] 4 is a table illustrating commands to be sent by a host to a storage device according to one embodiment of the present invention. [Figure 2D]4 is a table illustrating a hierarchical structure of recovery (restoration) modes according to an embodiment of the present invention. [Figure 3A] 4 is a flow chart illustrating a first method of operation of a fault-resilient storage device in accordance with an embodiment of the present invention. [Figure 3B] 4 is a flow chart illustrating a second method of operation of a disaster resilient storage device according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram for explaining a schematic data layout of a storage device according to an embodiment of the present invention. [Figure 5A] 4 is a flow chart illustrating a first method of operating a storage device in a read-only mode for disaster recovery according to an embodiment of the present invention. [Figure 5B] 11 is a flow chart illustrating a second method of operating a storage device in a read-only mode for disaster recovery according to an embodiment of the present invention. [Figure 6A] FIG. 2 is a schematic data layout diagram of a RAID-0 system performing write operations according to an embodiment of the present invention. [Figure 6B] FIG. 2 is a schematic data layout diagram of a RAID-0 system performing a read operation according to an embodiment of the present invention. [Figure 6C] FIG. 2 is a schematic data layout diagram of a "RAID-0" system performing remapping and write operations according to an embodiment of the present invention. [Figure 7A] 4 is a flow chart illustrating a first method of operation of a "RAID-0" storage system in accordance with an embodiment of the present invention. [Figure 7B] 4 is a flow chart illustrating a second method of operation of a "RAID-0" storage system in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Next, a specific example of an embodiment for implementing a method for operating a storage device and a system including a storage device according to the present invention will be described with reference to the drawings.

[0017] The detailed description set forth below in conjunction with the accompanying drawings is intended to describe example embodiments of memory resource management systems and methods provided in accordance with the present disclosure and is not intended to represent the only manner in which the present disclosure may be constructed or utilized. The following description presents features of the invention in conjunction with the embodiments illustrated in the drawings. It is to be understood, however, that the same or equivalent functions and structures may be accomplished by other embodiments that are also intended to be within the scope of the invention. In this specification, like reference numbers indicate like components or features.

[0018] As used herein, "a portion of" means "at least a portion" of an object, and can therefore mean all or less than all of an object. Thus, a "part" of an object includes the whole object as a special case; i.e., the whole object is an example of a part of an object. As used herein, the term "or" should be interpreted as "and / or", e.g., "A or B" means either one of "A", "B", or "A and B".

[0019] The background provided in the Background section of this specification is included only to set context, and the content of this section is not admitted to be prior art. Any component or combination of components illustrated (e.g., in any system diagram contained herein) may be used to perform any one of the operations of any flowchart contained herein. It should be noted that (i) the operations are by way of example and may include various additional steps not explicitly covered, and (ii) the temporal order of the operations may be altered.

[0020] As used herein, when a method (e.g., an adjustment) or a first quantity (e.g., a first variable) is referred to as being "based on" a second quantity (e.g., a second variable), this means that the second quantity influences an input to the method or the first quantity, but for example, the second quantity is an input (e.g., the only input or one of one or more inputs) to a function that calculates the first quantity, or the first quantity has the same value as the second quantity or can be the same as the second quantity (e.g., stored in the same location or position in memory).

[0021] However, it will be understood that the terms "first," "second," "third," etc. are used herein to describe various elements, components, regions, layers and / or sections, and that these elements, components, regions, layers and / or sections are not limited by these terms. These terms are used only to distinguish one element, component, region, layer or section from another element, component, region, layer or section, and thus a first element, component, region, layer or section described herein could be termed a second element, component, region, layer or section without departing from the spirit and scope of the inventive concept.

[0022] Spatially relative terms such as "beneath," "below," "lower," "under," "above," "upper," and the like, are used for ease of description to describe the relationship that exists of an element or feature to another element or feature as illustrated in the drawings. It should be understood that such spatially relative terms are intended to include other orientations of the device during use or operation in addition to the orientation depicted in the figures. For example, if the device in the figures were turned over, elements described as "below," "under" or "directly below" another element or feature would now be oriented "on top" of that other device or feature. Thus, the example terms "lower" and "bottom" can encompass both an orientation of upper and lower. The device may be otherwise oriented (e.g., rotated 90 degrees or at other orientation) and the spatially relative descriptors used herein should be interpreted accordingly. Additionally, when a layer is described as being between two layers, it will be understood that this may be the only layer between the two layers or that there may be one or more intervening layers.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the terms "substantially," "about," and similar terms are used as terms of approximations rather than terms of degree and are intended to take into account inherent deviations in measured or calculated values ​​that can be appreciated by one of ordinary skill in the art.

[0024] As used herein, the singular forms "a" and "an" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will also be understood that as used herein, the terms "comprises" and / or "comprising" specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. Phrases such as "at least one of," when preceding a list of elements, modify the entire list of elements, but do not modify the individual elements of the list. It is noted that, when describing embodiments of the present invention, the term "may" refers to "one or more embodiments of the present invention." Also, the word "exemplary" is intended to serve as an example or illustration. As used herein, the terms "use," "using," and "used" are considered synonymous with the terms "utilize," "utilizing," and "utilized," respectively.

[0025] When a component or layer is described as being "located on," "connected to," "coupled to," or "adjacent to" another component or layer, the component or layer is directly located, connected, coupled, or adjacent to the other component or layer, and one or more intervening components or layers may be present. In contrast, when a component or layer is described as being "directly on," "directly connected to," "directly coupled to," or "adjacent to" another component or layer, there are no intervening components or layers present.

[0026] Any numerical range recited herein is intended to include all sub-ranges of the same numerical precision contained within the recited range. For example, a range "1.0 to 10.0" or a range "between 1.0 and 10.0" includes all subranges between (and including) the stated minimum value of 1.0 and the stated maximum value of 10.0, i.e., having minimum values ​​greater than or equal to 1.0 and maximum values ​​less than or equal to 10.0, for example, the range 2.4 to 7.6. Any maximum numerical limitation set forth herein is intended to include every lower numerical limitation subsumed therein, and any minimum numerical limitation set forth herein is intended to include every higher numerical limitation subsumed therein.

[0027] Fault-resilient storage devices according to embodiments of the present invention can operate in a variety of recovery modes and can maintain partial functionality or return to full functionality despite internal failures. For example, in response to a failure of a temperature sensor, a storage device may operate at a reduced speed, operate at a reduced speed for write operations, or perform very few write operations. In response to a temporary fault that may cause errors in the storage medium, the storage device may reformat the storage medium. In response to a temporary fault that does not cause an error to occur, the storage device may power cycle the power supply.

[0028] One way a storage device can maintain partial functionality is, in some circumstances, to operate in a read-only mode, in which the storage device can respond to read requests from the host, but can return an error message if it receives a write request from the host. In addition, data that is scheduled to expire can be moved to the rescue space, so data will not be lost due to expiration. In a "RAID-0" storage system, the ability for a storage device to be switched to operate in a read-only mode is achieved by redistributing the stripes that make up the stripe for any write operations that are performed after the storage device has been switched to operate in a read-only mode.

[0029] FIG. 1 is a block diagram illustrating a simplified configuration of a computing system including a host 105 connected to one or more storage devices 110 (or "drives") in accordance with an embodiment of the present invention. Storage device 110 is connected to host 105 either via a volume manager 115 (described in more detail below) as shown, or directly to host 105 .

[0030] In one embodiment, storage device 110 may experience an internal failure condition, and the storage device may exhibit various recovery actions (operations), as described in more detail below, to mitigate the system-level impact of the failure condition. Each storage device 110 may be a solid-state drive (SSD) and may include a controller 120 (or "control circuitry") and a storage medium 125 (eg, a NAND flash memory). The smallest unit that can be erased in the storage device 110 is called a "block," and the smallest unit that can be written in the storage device 110 is called a "page."

[0031] Each storage device 110 may have any one of a number of form factors suitable for persistent storage devices, including, but not limited to, 2.5 inch, 1.8 inch, MO-297, MO-300, M.2, and EDSFF (Enterprise and Data Center SSD Form Factor), and may have an electrical interface that is any one of a number of interfaces suitable for persistent storage devices, including PCI (Peripheral Component Interconnect), PCIe (PCI express), SCSI (Ethernet, Small Computer System Interface), SATA (Serial AT Attachment), and SAS (Serial Attached SCSI), and is connected to host 105 via the interface.

[0032] Storage medium 125 has a retention period (which may depend on the usage history of storage medium 125 and may vary within storage medium 125 accordingly), and data that has been stored for longer than the retention period (i.e., data that has an elapsed time that exceeds the retention period) can be said to be unreliable and expired. Data is stored in the storage medium 125 using an error correcting code, possibly a block code. When reading data from storage medium 125, a large amount of raw data, called a code block, is read from storage medium 125 and then decoded. If the attempt fails, an additional attempt (a read retry) is made.

[0033] With use, a portion of storage medium 125, for example a block, may degrade to the point where its retention period becomes unacceptably short, and the block may be classified as a "bad block." To prevent such a situation from rendering the entire storage medium 125 unusable, a spare space called "bad block management spare space" exists (e.g., contained in each flash memory die or each flash memory plane), and the controller 120 or other controller within the flash memory die or plane can begin using the spare blocks and stop using the bad blocks.

[0034] FIG. 2A is a table illustrating fault conditions (or "fault conditions") labeled with their respective case identifiers ("case IDs"). Case 1 is any fault condition in which storage device 110 is no longer able to perform read or write operations and cannot be resolved by power cycling the power or reformatting the storage media. The state in which the storage device 110 operates in this manner may have various sub-states, each corresponding to a different failure mechanism, for example. Such a condition or failure state (storage device 110 can no longer perform read or write operations and cannot be resolved by power cycling the power source or reformatting the storage medium) may be caused, for example, by a portion of the controller's firmware being damaged (in which case the controller may be rebooted in a safe mode in which the damaged commands are not executed) or by a failure of processing circuitry in storage device 110 (e.g., a failure of processing circuitry that manages interaction with the storage medium but is not responsible for communication with host 105). If this type of failure condition occurs, storage device 110 may respond to any read or write commands from host 105 with an error message.

[0035] Case 2 is (i) storage device 110 is no longer able to perform read or write operations; (ii) Any fault condition that can be recovered from by power cycling the power supply of storage device 110 or reformatting the storage medium. Such a fault condition may occur, for example, due to a program execution error in controller 120 of storage device 110 (e.g., an out-of-range pointer resulting from a bit flip in controller 120 random access memory (RAM), or an incorrect command resulting from a bit flip). If a program execution error has not caused the controller 120 to write incorrect data to the storage medium 125 (e.g., a program execution error occurred after the most recent write by the controller to the storage medium), power cycling the storage device's power supply may be sufficient to restore the storage device 110 to normal operation, and if a program execution error has caused the controller 120 to write erroneous data to the storage medium 125, reformatting the storage medium 125 may be sufficient to restore the storage device 110 to normal operation.

[0036] Case 3 may be mitigated by operating storage device 110 in a read-only mode, reformatting storage medium 125 is any failure condition that does not restore full functionality. Examples of such disorders are: (i) Temperature sensor failure, (ii) includes a portion of storage medium 125 that has been converted to a read-only mode. In the event of a temperature sensor failure, the failure can be detected by determining that the temperature sensor's measurement is out of range (e.g., exceeds a critical temperature), in which case the risk of overheating of the storage device 110 can be reduced by avoiding write operations, which may consume more power than read operations. A transition of a portion of storage medium 125 to a read-only mode may occur for a flash memory storage medium 125, for example, if a flash memory plane or die runs out of bad block management spare space that is used for runtime bad block management.

[0037] For example, while attempting to perform a read operation, storage device 110 may fail an attempt to decode a data item, determine that the block storing the data is a bad block, and when moving the data from the bad block to the bad block management spare space, determine and determine that the remaining bad block management spare space is less than a threshold size and accordingly insufficient to ensure the reliability of the plane or die. Storage device 110 may then determine that bad block management is no longer being performed and may be switched to a read-only mode. The operation of the read-only mode is described in detail below. As used herein, a "data item" is any quantity of data that is processed in a single operation; for example, the data resulting from decoding a code block may be a data item. As used herein, "decoding a data item and returning an indication based on the decoding" means that an attempt to decode the data item fails and returning an indication that the decoding attempt failed.

[0038] Case 4 is any failure condition that is mitigated by operating storage device 110 in a write-through mode. For example, if a power supply backup capacitor in storage device 110 fails, the device may complete a write to storage medium 125 before sending a command completion to host 105 in response to any write command received from the host, so that if power fails before a write to storage medium 125 is completed, the host is not incorrectly notified that the recording was successfully completed. Operating in write-through mode may result in reduced performance (both in terms of throughput and latency).

[0039] Case 5 is any fault condition that is mitigated by operating storage device 110 in a manner that reduces power dissipation. For example, in the event of a temperature sensor failure, storage device 110 may operate in a read-only mode or reduce the rate at which operations (e.g., write operations, which may consume more power than read operations) are performed, as previously described, to reduce power dissipation in storage device 110. For example, the storage device 110 may perform a first write to the storage medium, wait for an interval corresponding to reduced performance (the rate at which the write operation is performed is reduced due to the wait), and then perform another write to the storage medium (e.g., 1 second).

[0040] Case 6 is any failure condition that is mitigated by operating storage device 110 in a read-only mode, and where reformatting storage medium 125 restores full functionality. The third column of the table in FIG. 2A indicates for each case whether valid user data is available and whether storage device 110 can be returned to full functionality, for example, by reformatting storage medium 125.

[0041] As illustrated by the cases listed in FIG. 2A, in an embodiment of the present invention, three levels of disaster resilience are achieved by storage device 110: full recovery mode, partial recovery mode, and vulnerable mode. In full recovery mode, storage device 110 can operate in a “self-healing” manner, whereby storage device 110 restores full functionality (although user data may be lost from the device) by reconfiguring operations such as power cycling or formatting storage medium 125.

[0042] In partial recovery (restore) mode, the storage device 110 operates with lower performance, smaller capacity, or reduced functionality when a failure condition exists. For example, as previously discussed, if the power backup capacitor fails, all writes may be completed (i.e., command completion may be sent to host 105) only after the data has been recorded to storage medium 125 (i.e., synchronous writes may occur), thereby slowing operation of storage device 110 and reducing its performance. In these circumstances, user data will be preserved. The storage device 110 operates at a smaller capacity when the spare space for bad block management run time bad blocks (RTBB) is exhausted. In such a situation, the affected die of storage device 110 may be removed from disk space, reducing overall disk capacity. User data from the lost space may be lost. For example, if an IO determinism set or a zone of a zoned namespace can no longer allow new data to be written, the set or zone can be removed from the disk space, while leaving the remaining disk space available for read and write operations. User data for a zone or set may be lost.

[0043] When storage device 110 does not allow write operations and switches to a read-only mode, storage device 110 operates with reduced capabilities. Storage device 110 operates in two types of read-only modes: a sustainable read-only mode (sometimes referred to as the “first read-only mode”) and a non-sustainable read-only mode (sometimes referred to as the “second read-only mode”). In a sustainable read-only mode, the storage device 110 continues to service read requests beyond the retention period of the storage medium 125 . When it is not feasible to operate in a sustainable read-only mode, for example when there is not enough unused storage space to set up a rescue space, a non-sustainable read-only mode is used (described in more detail below).

[0044] When switching to the non-persistent read-only mode, storage device 110 sends notification to host 105 that storage device 110 is operating in a second (non-persistent) read-only mode and that data items stored on storage device 110 are allowed to expire (e.g., when their respective retention periods expire). In a non-sustainable read-only mode, storage device 110 can continue to service read requests throughout the retention period of storage medium 125, and if storage device 110 encounters a data integrity problem (e.g., as detected by one or more failed attempts to decode data during a read operation), storage device 110 reports the data area as not valid. As previously described, a storage device 110 operating in vulnerable mode is unable to perform read or write operations, performs a graceful exit, and returns an error while continuing to receive commands from the host.

[0045] In some embodiments, (i) Execution space (P), (ii) performance degradation space (UP); (iii) Read-only space (RO), (iv) a volatile read-only space (VRO); (v) Inaccessible Space (IA) Five Logical Block Address (LBA) space types are defined, called Execution (P) space is the LBA space that contains valid data that can be read and written in the normal way without performance penalty. Reduced performance (UP) space is LBA space that contains valid data that can be read and written in the normal manner, but with reduced performance (eg, reduced write performance). Read-only (RO) space is an LBA space that contains valid data that is read-only. The storage apparatus 110 responds with an error message to a write command from the host directed to this type of LBA space. Data in the read-only space is valid for a period that exceeds the retention period. Volatile read-only (VRO) spaces are read-only, and the storage device 110 responds with an error message to any write commands from the host directed to such type of LBA space. Data on such a type of LBA space is temporarily valid and becomes invalid when it expires, that is, when the age of the data in the storage medium 125 reaches the retention period of the storage medium 125 . Inaccessible (IA) space is LBA space that is not accessible to the host and contains data that is not valid.

[0046] The table of FIG. 2B shows the combinations of types of LBA space that may be present on storage device 110 in each of the failure conditions identified in the first column of the table of FIG. 2A. Modes identified with an asterisk (*) support the host's use of the get feature command to retrieve detailed information for the LBA space. FIG. 2C shows arguments for a “get features” command communicated to storage device 110 to query storage device 110 about its status and associated parameter values ​​(“IOPS” means input and output operations per second).

[0047] The table in FIG. 2D shows nonvolatile memory express (NVMe) commands that the host 105 can use to query the storage device 110 about its status, and a hierarchy of enumerated constants that the storage device 110 can use to respond within categories of disaster recovery features.

[0048] FIG. 3A is a flow chart illustrating a first method of operation of a disaster resilient storage device according to one embodiment of the present invention. In step S305, the host 105 sends or receives data from the storage device; in step S310, the host 105 determines whether an error has occurred in the storage device; in step S315, the storage device 110 performs internal diagnostics to determine its failure recovery state (e.g., full recovery, partial recovery, or vulnerable mode); in step S320, the storage device 110 modifies its performance, capacity, or capability (e.g., transitions to read-only mode) based on the diagnostics; in step S325, the storage device 110 posts the status in response to a request from the host 105 based on an application programming interface (API); and in step S330, the host 105 routes data of a certain type to the storage device 110 or another storage device 110 at a given bandwidth based on the above status.

[0049] FIG. 3B is a flow chart illustrating a second method of operation of a disaster resilient storage device according to one embodiment of the present invention. The method includes, in step S335, determining by the storage device that the storage device is in a first failure state that can be recovered from by power cycling or formatting the storage medium; in step S340, determining by the storage device that the storage device is in a second failure state that can be partially restored by operating the storage device with reduced performance, reduced capacity, or in a read-only mode; and in step S345, operating the storage device with reduced performance, reduced capacity, or in a read-only mode.

[0050] Numerous embodiments and variations on the embodiments disclosed herein may also be constructed. A Field Programmable Gate Array (FPGA) or embedded processor can perform internal block checks and send asynchronous updates to the host 105 on the state of the storage device 110 . An event may occur and be transmitted to the host 105 (eg, temperature or other parameter within the device). The host 105 may poll the storage device 110 based on a predefined schedule if no device driver features exist to provide notification. The FPGA or embedded processor can monitor the historical performance of the storage device 110 and use machine learning to provide predictive analysis (eg, the likelihood of being in a given disaster recovery state). Commands may be introduced in the NVMe specification, but for example, the telemetry information of the NVMe specification may be extended (to report the status of the storage device 110). Some embodiments may be implemented with, for example, an Ethernet storage device or a key-value (KV) storage device.

[0051] In some embodiments, the host comprises: (i) sending different data types based on the state of the storage device 110 (e.g., file types such as images, videos, text, or high or low priority data) (e.g., a device considered in a partially vulnerable mode may not have high priority or real-time data recorded); (ii) reducing the transmission rate when the storage device 110 is in a partially vulnerable, lower performance state; (iii) sending a reduced amount of data when storage device 110 is in a partially vulnerable, low capacity state; (iv) if storage device 110 is in a partially vulnerable and unsustainable read-only mode, read data at maximum speed and store the data elsewhere to ensure the retention period is not exceeded (in such a situation, the host can calculate the required data rate based on the amount of data to be copied and the retention period); (v) ignoring the “read” of data from the vulnerable storage device 110 and simply deleting the data received by the host 105 because the data may have errors; (vi) Temporarily re-routing read / write inputs and outputs to the cache of a power-cycled or formatted fully restored storage device 110 based on messages that control the timing of such events between the host and storage device 110.

[0052] The FPGA on the partially vulnerable SSD with reduced capacity filters the incoming data writes and writes only a portion of the data to the storage device 110. In some cases, the filtering may include compression. Such an FPGA may receive various types of data (eg, file types such as image, video, text, or high or low priority data) from the host 105 and filter them according to the state of the storage device 110 . For example, the FPGA determines that high priority data should not be recorded to the storage device 110 in the partially vulnerable mode. The FPGA sends a rejection message to the host 105, providing the reason for the rejection. Alternatively, the FPGA filters certain types of data (eg, image data) for recording to the partial restoration low capacity state storage device 110 . For example, if storage device 110 loses performance (eg, operates at a reduced write speed), latency-sensitive reads and writes may be rejected.

[0053] In some embodiments, as previously described, storage device 110 operates in one of two read-only modes, referred to as the “sustainable” (or “first”) read-only mode and the “non-sustainable” (or “second”) read-only mode. In the non-sustainable read-only mode, the storage device 110 simply rejects any write commands that it may receive from the host 105, (i) performing a read command on unexpired data; (ii) Attempt to execute all read commands and, in response, if decoding is not successful, return the data generated by the successful decoding attempt and an error code (an indication that the data item cannot be read, e.g., "0")

[0054] In a sustainable read-only mode, the storage device 110 services external read requests beyond the retention period of the storage medium 125 . Storage device 110 does not take any action in response to any write commands from host 105, other than returning an error message, but does write to storage medium 125 for internal purposes, as described below. To enable data storage after the retention period, the storage device 110 allocates a space called a "rescue space" to which data that is about to expire (e.g., data having an age that exceeds a threshold age based on the retention period of the storage medium 125 (e.g., 80% of the retention period of the storage medium 125)) is moved, and the expiration of the data is accordingly postponed by the retention period of the rescue space. When data in the rescue space is due to expire, it is frequently moved again within the rescue space as necessary to prevent data loss. In some embodiments, the storage device 110 may move data well before it expires, for example, by utilizing low load periods to perform such movements. As mentioned above, the transition to sustainable read-only mode may be triggered by the exhaustion of spare space for bad block management. In such a situation, the affected plane or die may be made read-only and removed from the physical address space of storage device 110 as all data stored therein is relocated to rescue space.

[0055] The storage device 110 responds to read commands from the host 105 across the entire LBA space. Although the physical space of storage device 110 may decrease (e.g., because a portion of storage medium 125 becomes read-only and that data is moved (or has been moved) to a rescue space), the logical space of the device does not change, so when host 105 sends a read command in LBA space that cannot be mapped to PBA (Physical Block Address) space, storage device 110 returns 0 (zero).

[0056] The rescue space is allocated from the over-provisioned space or from unused space of the storage device 110 . If an IO deterministic set or zone of a zoned namespace is not writable, then once all data has been relocated, the set or zone may be made read-only and removed from the physical address space. A rescue space can be dynamically created using a namespace. One or more namespaces may be used for user data, and an additional namespace may be created for the rescue space. When the storage device 110 switches to a sustainable read-only mode, one or more namespaces for user data are decreased in size and the size of the namespace for rescue space is increased.

[0057] When the size of an area of ​​storage medium 125 affected by a failure (e.g., an area where the bad block management spare space has been exhausted) exceeds the size of the available rescue space, storage device 110 may move only the data that will expire soonest (e.g., the oldest data), or only data tagged as important or associated with a certain file type (e.g., image, video, document), or move data of a contiguous type (e.g., all data associated with a file) and leave other data intact. The set of file types that are considered important is user configurable. In some embodiments using KV storage device 110, the importance of the data is compressed or encoded into key value pairs.

[0058] In some embodiments, when storage device 110 determines that the amount of available rescue space is less than a threshold size and therefore insufficient to support operation in a sustainable read-only mode, storage device 110 switches to a non-sustainable read-only mode. Such a determination may be made when a failure is first detected, or when a failure is first detected, storage device 110 initially switches to a sustainable read-only mode and after a period of time the rescue space is consumed to the extent that it is reduced below a threshold size of available rescue space (e.g., due to continued expiration of data in the failed portion of storage medium 125), storage device 110 switches from the sustainable read-only mode to the unsustainable read-only mode. When switching from a sustainable read-only mode to a non-sustainable read-only mode, storage device 110 notifies host 105 of such transition, and host 105 attempts to copy as much data as possible from the storage device to another storage device before the data expires.

[0059] In some cases, data may be lost for periods of a day or even an hour. Thus, the FPGA of storage device 110 monitors the attributes of the data on the drive (e.g., stale, tagged, sequential, or file type) to facilitate the transfer when storage device 110 switches to a sustainable read-only mode. The FPGA can queue or order data to be transferred to the rescue space based on priority and can compress the data as it moves to the rescue space. Some embodiments are implemented with, for example, an Ethernet storage device or a key-value (KV) storage device.

[0060] FIG. 4 is a diagram illustrating a schematic data layout of the storage device 110 according to an embodiment of the present invention. The block lifespan table 405 lists the retention period for each block in the storage device 110, and the mapping table 410 lists the mapping from logical block addresses to physical block addresses. When the storage device 110 switches to the sustainable read-only mode, the storage device 110 copies data from the failed used space 415 (the physical space affected by the failure condition) to the rescue space 420 . Data in normal usage space 425 is treated as if storage device 110 was in normal operating mode (instead of in sustained read-only mode). Because the failure condition results in a loss of physical space, there is a corresponding reduction in the size of used LBA space 430 and some of the previously available LBA space becomes unused LBA space 435. Firmware 440 executed by controller 120 moves the data and updates the tables as previously described.

[0061] FIG. 5A is a flow chart illustrating a first method of operating a storage device in a sustainable disaster recovery read-only mode in one embodiment of the present invention. In step S505, the host 105 sends and receives data from the storage device, in step S510, the host 105 determines whether an error has occurred in the storage device, in step S515, the storage device 110 performs internal diagnostics and switches to a sustainable read-only mode, in step S520, the FPGA selectively monitors the nature of valid data on the storage device 110 (e.g., based on data type or age), in step S525, the storage device 110 relocates valid data to the rescue space as the age of the data approaches the retention period, and in step S530, the storage device 110 selectively sends information regarding the status and contents of the rescue space to the host 105 which flushes the data.

[0062] FIG. 5B is a flow chart illustrating a second method of operating a storage device in a read-only mode of sustainable disaster recovery according to one embodiment of the present invention. The method includes, in step S535, determining that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode, and in step S540, determining that the age of a first data item stored in a page of the storage device has exceeded a threshold age, and operating the storage device in the first read-only mode by copying the first data item to a rescue space of the storage device.

[0063] In some embodiments, as described above, a "RAID-0" system, including an array of storage devices 110 and a volume manager 115, is configured to support transitioning any one of the storage devices 110 in the "RAID-0" system to a read-only mode (e.g., a sustainable read-only mode). In normal operation, the volume manager 115 is responsible for striping data across the array of storage devices 110, e.g., writing any one of each stripe (each stripe being composed of such strips) to each storage device 110 in the array of storage devices 110.

[0064] In such a system, when any storage device in the array of storage devices 110 goes into read-only mode (or a "read-only state"), the "RAID-0" system transitions to an operational mode (sometimes called an "emergency mode") and the volume manager 115 for the array of storage devices 110: (i) allocating rescue space on each of the remaining unaffected storage devices 110 (in a read / write state) for the metadata and user data recovered from the failed storage device 110; (ii) Maintain a mapping table (sometimes called the “emergency mapping table”). The rescue space on each storage device 110 can store n strips, where: n=R / (strip size), R=C / M, C is the capacity of each of the storage devices in the array of storage devices 110, and M is the number of storage devices in the array of storage devices.

[0065] Volume manager 115 may be implemented in a host (e.g., in hardware, software, firmware, or a combination of hardware, software, and firmware) or in a raid controller in a "RAID-0" system (e.g., which may be housed in an enclosure separate from the host). In one embodiment, the volume manager 115 is implemented in an FPGA. A RAID-0 system may be self-contained, virtualizing an array of storage devices 110 such that from the host's perspective, the RAID-0 system behaves as if it were a single storage device 110 . In general, a volume manager may be a processing circuit (described in more detail below) that is configured (e.g., by suitable software or firmware) to perform the operations described herein as being performed by the volume manager.

[0066] When the "RAID-0" system is operating in emergency mode and receives a write command from host 105 requesting that a stripe be written to the array of storage device 110, volume manager 115 checks the emergency mapping table to determine if the stripe is "registered", i.e., whether an entry has already been created for the stripe. If an entry has not already been created (i.e., the stripe is "open mapped" or unregistered), the volume manager 115 creates an entry in the emergency mapping table to indicate the location where stripes that were typically written to the failed storage device 110 (a storage device 110 that has been converted to read-only mode) were written. If the emergency mapping table already contains an entry for the stripe, the entry is typically used to determine where the stripe written to the failed storage device 110 should be written. In any case, the volume manager 115 records strips 605, typically written to the failed storage device 110, in the rescue space of another storage device 110 by recording each strip in the array of storage devices 110, as shown in FIG. 6A.

[0067] When a read command is received requesting to read a stripe from the array of storage device 110, volume manager 115 checks the emergency mapping table to determine whether an entry has been created for the stripe. If no entries have been created, then the volume manager 115 reads the stripe as shown in FIG. 6B, such that the strip is read from each storage device 110, including the failed storage device 110, in normal operation. If the emergency mapping table contains an entry for a stripe, the entry is typically used to determine the location from which the strip is read from the failed storage device 110 .

[0068] In general, remapping of strips written to a failed storage device 110 is accomplished, for example, as follows. Each storage device 110 in the array of storage devices 110 has a drive identification number (or “drive ID”) that can be a number between “0” and “M−1”, where M is the number of storage devices 110 in the array of storage devices 110. Volume manager 115 reassigns drive identification numbers, for example, to each storage device 110 in the array of storage devices 110 for use in performing read or write operations to registered stripes (read operations to unregistered stripes continue to use the original drive identification number).

[0069] The following formula can be used to generate an alternate drive identification number: If (Drive ID)<(Faulty Drive ID) new drive id = drive id Otherwise, New Drive ID = ((Drive ID-1)+(M-1))mod(M-1)

[0070] Depending on the effect of this formula, (i) assigning a respective original drive identification number to each storage device having an identification number that is lower than the original drive identification number of the failed storage device; (ii) assigning each storage device having an original drive identification number greater than the first storage device's original drive identification number a respective original drive identification number less than "1."

[0071] Using the alternate drive number, typically the target drive to which strips written to the failed storage device 110 can be written is Formula “Target drive ID=sid%(M-1)” where target drive ID is the identification number of the replacement drive for the target drive, "sid" is the strip identifier of the strip written to the typically failed storage device 110, and "%" is the modulo operator.

[0072] FIG. 6C is a schematic data layout diagram of a RAID-0 system performing remapping and write operations according to one embodiment of the present invention, which is a schematic diagram of a RAID-0 system having four storage devices 110 (i.e., M=4) with drive 1 converted to read-only mode. The target drive ID to which stripe 1 is written is implicitly determined by the following formula: Target Drive ID = Strip ID%(M-1) = 1

[0073] That is, the target drive is the storage device 110 having the replacement drive identification number 1 (ie, drive 2). Within the drive, the rescue space is divided into strips (called "rescue strips" or "R-strips") of the same size as the strip size. The emergency mapping table contains the entry (1,0) where the first element is the stripe ID (stripe 1) and the second element is the R-strip ID of the target drive. Thus, entry (1,0) in the emergency mapping table means that strip (1,1) is mapped to R-strip (1,0).

[0074] A "RAID-0" system is configured to support transitions to a sustainable or unsustainable read-only mode by one or more of the arrays of storage devices 110. When switching to a non-persistent read-only mode, the registered strips of the failed storage device 110 are durably written to the rescue space of another device. When switching to a non-sustainable read-only mode, for example, the volume manager 115 migrates data from the failed storage device 110 to an unaffected storage device 110 fast enough to move all data off the failed storage device before the data expires. The server calculates the speed based on the amount of data and the time remaining before the data expires.

[0075] FIG. 7A is a flow chart illustrating a first method of operation of a "RAID-0" storage system in accordance with one embodiment of the present invention. In step S705, a storage device 110 in the “RAID-0” system has failed and switches to read-only mode; in step S710, the affected storage device 110 performs internal diagnostics and determines that its failure recovery state is partially restored and read-only; in step S715, the volume manager 115 determines that the affected storage device 110 is in read-only mode (“functioning normally”) and reassigns the ID of the unaffected storage device; in step S720, the volume manager 115 receives the write operation and adds an entry to the temporary mapping table to indicate that the strip of the affected device has been redirected to the target (unaffected) storage device 110 and the entire strip has been written to the rescue space of the target (unaffected) storage device based on the new drive ID of the unaffected storage device; in step S725, the volume manager 115 receives a read command from the host 105 and reads all strips of the stripe from the functioning, unaffected storage device 110 of the RAID system while reading the strip of the affected storage device from the rescue space of the target (unaffected) storage device.

[0076] FIG. 7B is a flow chart illustrating a second method of operation of a "RAID-0" storage system in accordance with one embodiment of the present invention. The method includes, in step S730, determining that the first storage device is in a read-only state and the second storage device is in a read / write state; in step S735, performing a write operation of the first stripe to the storage system by writing a portion of the first stripe to the second storage device and creating an entry in a mapping table for the first stripe; in step S740, performing a first read operation of the second stripe from the storage system by reading portions of the second stripe from the first storage device and the second storage device; and in step S745, determining that the mapping table includes an entry for the first stripe and performing a second read operation of the first stripe from the storage system by reading the portion of the first stripe from the second storage device.

[0077] Various devices described herein, such as the host 105 or the controller 120, may be or include processing circuitry. As used herein, the terms "processing circuitry" or "controller means" are used to mean any combination of hardware, firmware, and software employed to process data or digital signals. The processing circuitry hardware may include, for example, application specific integrated circuits (ASICs), general purpose or special purpose central processing units (CPUs), digital signal processors (DSPs), graphics processing units (GPUs), and programmable logic devices such as field programmable gate arrays (FPGAs). In a processing circuit, as used herein, each function is performed by hard-wired hardware configured to perform that function, or by more general-purpose hardware, such as a CPU configured to execute commands stored on a non-transitory storage medium. The processing circuitry may be fabricated on a single printed circuit board (PCB) or may be distributed over one or more interconnected PCBs. The processing circuitry includes other processing circuits, for example, the processing circuitry may include two processing circuits, i.e., an FPGA and a CPU, interconnected on a PCB.

[0078] Exemplary embodiments of systems and methods for restore operations of a storage device are specifically described and illustrated herein. However, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the technical scope of the present invention. [Explanation of symbols]

[0079] 105 Host 110 Storage device 115 Volume Manager 120 Controller 125 Storage Media 405 Block Lifetime Table 410 Mapping Table 415 Disabled Use Space 420 Rescue Space 425 Normal Use Space 430 Used LBA Space 435 unused LBA space 440 Firmware

Claims

1. 1. A method of operating a storage device including a storage medium, comprising: determining, by the storage device, that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode; and operating the storage device in the first read-only mode; The step of operating the storage device in the first read-only mode includes: identifying first data and second data in a region of the storage device associated with the failure condition; determining that an age of the first data exceeds a threshold age and that a size of a rescue space in the storage device is smaller than a size of an area of ​​the storage device associated with the failure condition; and based on the determination, copying the first data into the rescue space in the storage device and retaining the second data in the area of ​​the storage device.

2. 2. The method of claim 1, wherein the threshold age is based on a retention period of the area of ​​the storage device.

3. The step of operating the storage device in the first read-only mode comprises: receiving a read command for a third item of data from a host connected to the storage device; decoding the third item of data; returning an indication based on the decoding; 2. The method of claim 1, further comprising: determining whether a size of the region of the storage device is less than a threshold size.

4. The step of operating the storage device in the first read-only mode comprises: determining that a size of the available rescue space is less than a threshold size; switching operation of the storage device from the first read-only mode to a second read-only mode; sending a notification to a host connected to the storage device; 4. The method of claim 3, wherein the notification notifies the storage device that it is operating in the second read-only mode and allows items of data stored on the storage device to expire.

5. receiving, by the host, the notification; reading, by the host, the third item of data from the storage device; 5. The method of claim 4, further comprising the step of: writing, by the host, the third item of data to another storage device.

6. 6. The method of claim 5, further comprising determining, by the host, a data rate based on an amount of data stored in the storage device and a time until the data expires.

7. The step of operating the storage device in the first read-only mode comprises: receiving a read command for a third item of data from a host connected to the storage device; determining that the age of the third item of data is greater than a second threshold age; 5. The method of claim 4, further comprising the step of: returning an indication to the host based on the age of the third data item being greater than the second threshold age.

8. The step of operating the storage device in the first read-only mode comprises: receiving a read command for a third item of data from a host connected to the storage device; decoding the third item of data; 5. The method of claim 4, further comprising: returning an indication based on the decoding.

9. The operation in the first read-only mode includes: determining when an age of a third item of data stored in a page of the storage device exceeds a threshold age by an amount less than the age of the first item of data; 2. The method of claim 1, further comprising the step of: copying the third item of data to a rescue space of the storage device.

10. The step of operating the storage device in the first read-only mode, 2. The method of claim 1, further comprising compressing the first data item.

11. The step of operating the storage device in the first read-only mode, creating a namespace for the rescue space; 2. The method of claim 1, further comprising: increasing a size of the namespace.

12. 2. The method of claim 1, further comprising tagging, by a host connected to the storage device, the first item of data with an indicator of a first importance.

13. tagging, by a host connected to the storage device, the first item of data as being part of a first file; 2. The method of claim 1, wherein the first file is a file of a first file type.

14. tagging, by a host connected to the storage device, the first data as being part of a first file; 2. The method of claim 1, further comprising: tagging, by a host connected to the storage device, the third data as being part of the first file.

15. A system including a storage device, the storage device includes a processing circuit; The processing circuitry includes: determining, by the storage device, that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode; configured to operate the storage device in the first read-only mode; The operation in the first read-only mode includes: identifying first data and second data in a region of the storage device associated with the failure condition; determining that an age of the first data exceeds a threshold age; and determining that a size of a rescue space in the storage device is less than a size of a region of the storage device associated with the failure condition; A system including a storage device, characterized in that, based on the determination, the first data is copied into the rescue space in the storage device and the second data is retained in the area of ​​the storage device.

16. 16. The system including a storage device according to claim 15, wherein the threshold age is based on a retention period of the area of ​​the storage device.

17. The processing circuitry includes: Determines that the size of the available rescue space is less than a threshold size, operating the storage device in a second read-only mode; further configured to send a notification to a host connected to the storage device; 16. The system including a storage device of claim 15, wherein the notification notifies that the storage device is operating in the second read-only mode and allows items of data stored on the storage device to expire.

18. A system including a storage device, The storage device includes a processing unit, The processing means includes: determining, by the storage device, that the storage device is in a partially restorable failure state by operating the storage device in a first read-only mode; configured to operate the storage device in the first read-only mode; The operation in the first read-only mode includes: identifying first data and second data in a region of the storage device associated with the failure condition; determining that an age of the first data exceeds a threshold age; and determining that a size of a rescue space in the storage device is less than a size of a region of the storage device associated with the failure condition; A system including a storage device, characterized in that, based on the determination, the first data is copied into the rescue space in the storage device and the second data is retained in the area of ​​the storage device.

19. 20. The system including the storage device of claim 18, wherein the threshold age is based on a retention period of the area of ​​the storage device.

20. The processing means includes: Determines that the size of the available rescue space is less than a threshold size, operating the storage device in a second read-only mode; configured to send a notification to a host connected to the storage device; 20. The system including a storage device of claim 18, wherein the notification notifies that the storage device is operating in the second read-only mode and allows items of data stored on the storage device to expire.

Images