Filesystem, program therefor, and information processing system

The present invention relates to an information processing system, and more particularly to a file system that prevents data destruction or inconsistency in secondary storage such as a hard disk.

In recent years, hard disk devices have become smaller and cheaper, and are widely applied to information control devices and devices. In addition, flash memory devices are becoming more integrated and less expensive, and are being used as a substitute for conventional hard disks by taking advantage of their features such as small size, light weight, and low power consumption. On the other hand, the penetration of these secondary storage devices has a problem of usage conditions that was not expected in the past.

A hard disk is standard equipment on a personal computer, but the contents of the recorded data are operated in a format called a file. The main body of data is divided into blocks of a certain capacity called clusters and sectors for recording, and these are bundled together. A file system is constructed by adding table information that manages the arrangement and order of a plurality of clusters and information that associates file names. File systems are also used in many information control devices to improve their convenience by maintaining their compatibility.

However, if the power is cut off during file operations such as data rewriting, the data may be destroyed or the information in the table may become inconsistent, and subsequent device operations may not be performed correctly. Sudden power interruptions are often caused by multiple external factors, such as lightning strikes, insufficient power capacity, or disconnection of the power cord.

In response to such an unexpected power failure, a method is known in which an uninterruptible power supply (UPS) is provided and power is supplied until the system is not adversely affected. However, since the uninterruptible power supply uses a battery as a standby power supply, it is not easy to reduce the size and price. There are also problems with environmental resistance, life, and maintenance.

As another solution, a method is known in which a personal computer performs a comprehensive inspection and repair of file system information called Scandisk as a recovery measure. The scandisk method has a problem that the total inspection time becomes long. In addition, the range of repairable damage is limited, as the content of the data cannot always be guaranteed.

In recent years, a journaling file system has been introduced as a solution to these problems. This is a method that keeps a separate log of the change work to a file, and when the power is cut off, it can be inspected and repaired in a short time at the time of recovery. Patent Document 1 discloses an improvement method for improving performance and reducing the number of writings by writing a plurality of journal data together on a storage medium (flash ATA card). Patent Document 2 describes a method of recording "situation data" corresponding to journal recording in a non-volatile memory.

Further, as another solution, Patent Document 3 discloses a method of providing a second storage medium exclusively for update so that the initial file is not lost. Further, as another solution, Patent Document 4 discloses a method of temporarily creating a redundant file index and simplifying the recovery process by strictly performing the update procedure.

<patcit num="1"><text>JP 2001-209567</text></patcit>

<patcit num="2"><text>JP-A-2002-358248</text></patcit><patcit num="3"><text>JP-A-2002-36449</text></patcit><patcit num="4"><text>JP-A-2002-63057</text></patcit>

<p> The above journaling file system has a short recovery procedure inspection time, but the processing performance deteriorates due to the increase in the number of procedures in normal operation. Therefore, it often does not record enough to completely guarantee the file system. Also, it is difficult to solve the problem while maintaining compatibility with standard file systems.</p><p> In the method described in Patent Document 1, since a plurality of journal data are collected in RAM and then written in a storage medium, a plurality of records may be lost. With the method described in Patent Document 2, there are too many procedures for writing status data, and the performance deteriorates. In addition, the cost increases because the non-volatile memory is used separately.</p><p> The method described in Patent Document 3 uses two storage media, which increases the cost. Also, when the file system of a read-only medium fails, a lot of new information is lost.</p><p> In the method described in Patent Document 4, the procedure of creating and deleting a temporary file index is added to the normal operation, and the performance is deteriorated. Further, although it is said that writing within one sector is performed instantaneously and there is no possibility of write failure, write failure can occur with a general storage medium. This is especially a problem with flash media, which takes a long time to write.</p><p> The problem to be solved by the present invention is to secure correct data and management information even if the update process is interrupted due to an unexpected power cutoff or a write failure occurs in view of the above-mentioned problems of the prior art. However, the purpose is to provide a file system that does not lose the integrity of information. It also aims to provide a program for that purpose.</p>

<p> The present invention for solving the above problems is in a file system having a data area and a management area for managing the arrangement of data separately, the information of the data body is read, merged with new data, and the merged data is used as a data area. Write to the unused area of, then update the first management area (table T1), and then update the information in the second management area (table T2). Furthermore, the presence or absence of an abnormality is determined by comparing the information in the first management area with the information in the second management area.</p><p> This makes it possible to always secure the data and table information in the correct state. In addition, even if an unexpected power cutoff occurs, the error check and content comparison of tables T1 and T2 are performed at the time of recovery, so that an abnormality in the file system can be easily determined.</p>

<p> According to the present invention, in the file system on the secondary storage device, error checking and content comparison of tables T1 and T2 are performed, an abnormality of the file system is determined based on the comparison result, and the file system is repaired so that correct data can be referred to. Can be done. That is, according to the present invention, there is an effect that correct data can be secured even if an unexpected power cutoff occurs, and a file system that maintains the consistency of file system information can be constructed at low cost without significantly impairing the performance.</p>

Hereinafter, embodiments of the present invention will be described. Figure 1 shows a schematic configuration diagram of the device to which the file system is applied. This device consists of CPU101, ROM102, RAM103, I / O105, I / F106, and secondary storage device 107.

The CPU 101 is a typical semiconductor device because it controls the entire device by inputting / outputting information to / from other components by connecting the bus 104 and performing numerical operations and logical operations based on a program.

ROM 102 is a semiconductor memory device that stores programs. It is read-only and does not lose its contents even if the power is cut off, and mainly stores the programs required for the startup operation of the device. RAM103 is a semiconductor memory device that can be read and written freely. The program of the secondary storage device 107 is copied and used during the operation of the device, or data is temporarily stored.

The I / O 105 is various inputs and outputs other than the secondary storage device 107. Connect communication devices, sensors, and actuators. Since it is not particularly relevant in the present invention, detailed description thereof will be omitted. The I / F (Interface) 106 performs protocol conversion for connecting the secondary storage device 107 and the bus 104.

The secondary storage device 107 is a compact flash (registered trademark), a removable media such as a flash memory card, a hard disk, a flexible disk, or the like. It may also be a flash disk that has appeared on the market in recent years. A flash disk is not a magnetic disk, but a built-in flash memory device that constitutes a storage device and can be connected using the same protocol as a hard disk.

Figure 2 shows a schematic configuration diagram of the software of the application device of the file system. The software of this device is a group of programs used by CPU 101 and is stored in ROM 102. Consists of application 201, operating system 202, or I / O library 203. It also includes a recovery processing program 206. The operating system 202 and the I / O library 203 need only have one of them, and the present invention can be applied to any form. The minimum number of programs required at startup may be stored in the ROM 102, and the rest may be separately stored in the storage medium 107.

The operating system (OS) 202 is a versatile basic software that mainly manages various input / output devices and facilitates device reference from applications. The file system 204 is a component for handling the data in the secondary storage as a file. The device driver 205 at the bottom layer directly performs device input / output operations, absorbs protocols and parameters specific to each device, and hides the upper file system 204 so that it is not individual for each device.

The I / O library 203 is a means for referencing the secondary storage 107 without using the operating system 202. It is a software interface for file system management and device input / output operations, similar to the operating system. More optimization (faster, more compact) than using the operating system 202 can be expected. On the other hand, optimization may make the I / O library less versatile.

Figure 8 shows an explanatory diagram of the recorded information required for the file system. In the storage area 801 of the secondary storage device 107 such as a hard disk, the file system information is arranged in three areas. The three areas are the table areas 802 (T1) and 803 (T2), the directory area 804, and the data area 805. Each is located in a fixed position on the storage area.

The tablespace contains information on which cluster the recorded data bodies are arranged in what order. T2 (803) has the same contents (copy) as T1 (802), and even if one of the tables is damaged, the main body layout information can be secured.

In the example of the figure, the numerical value of "21" is written in the table No. 20. This indicates that valid data exists in cluster 20 and subsequent data exists in cluster 21. Then, the numerical value of "22" is written in the table No. 21, which indicates that the valid data exists in the cluster No. 21 and the following data exists in the cluster No. 22. The code of "E" (meaning END) is written in table 22, which indicates that valid data exists in cluster 22, there is no data to follow, and the last data is stored. .. In addition, the code indicating that there is no valid data is written in "-" in the figure.

The directory area 804 stores information such as the file name, modification date and time, file size (size), and the first cluster number for each file. The first cluster number indicates which cluster the head of the data body exists in. The example in the figure shows that a file contains the first data in cluster 20. For example, when referring to the data in this file as the actual usage, the directory area is searched by the file name, and since the first cluster number is 20, the data body layout information is stored in the T1 (802) table. You can follow from number 20 in order.

The data area 805 stores the file data body. As described above, the data is divided into clusters and recorded. The example in the figure shows that the data is stored in the "A", "B", and "C" parts from clusters 20 to 22. The size of the cluster is generally 512 bytes to 64 Kbytes, and if the data file is smaller than this, only one cluster will be occupied.

The order of writing is not specified, and the table is often updated prior to writing to the data area.

The problem occurs when the power is cut off during a series of file system information update processes. Not only when the writing is not completed normally and the contents are destroyed, but also when the data is partially rewritten or the processing is interrupted at the stage where only the table is updated, it is generally referred to as a file. The content of the data is no longer guaranteed. Moreover, it is not easy to identify the location where the abnormality has occurred.

FIG. 3 is a flowchart showing a control procedure when updating a part of a file according to an embodiment of the present invention. In response to a write request from a higher-level application to a file, a series of operations are performed on the file system information described in FIG.

First, the unused clusters for the write data size are searched (step S01). In the present invention, the data before writing is not overwritten, and new data is always written to the unused cluster. Therefore, the information in the table may be searched. After that, the write operation is performed for each cluster for the cluster of the data area 805 that is determined to be written based on the search result.

Next, it is determined whether or not it is a partial rewrite (step S02). Partial rewriting here is a case where the new data to be written is smaller than the cluster size, and part of the data is lost unless it is merged with the data before writing. If it is not a partial rewrite, the process proceeds to step S05.

If it is a partial rewrite, the data for one cluster is read (step S03). The data to be read is valid data before writing. The write data is merged with the data read in step S03 (step S04).

Next, in step S05, new data for one cluster is written to the unused cluster searched in step S01. Then, it is determined whether there is any unwritten data (step S06). In other words, has the write to all the clusters to be written completed? If there is any leftover, the process proceeds to step S02 in order to write to the next unused cluster.

If there are no leftovers, update table T1 (802) (step S07) to match the correspondence with the cluster that wrote the new data. In this embodiment, this step is performed after writing to the data area is completed. Further, the table T2 (803) is updated (step S08), and the same information as that of T1 (802) is written.

As described above, all new data is written to the unused cluster, and then table T1 is updated, and then table T2 is updated.

Next, an example of information manipulation of the file system by the control procedure of this embodiment will be specifically described. FIG. 4 is an explanatory diagram showing a series of state changes when a part of the data in the file is updated.

(1) is the state before the update. The files are recorded in order in clusters 20, 21, and 22 of data area 805. The data is divided and managed in three parts, "A", "B", and "C". The contents of tables T1 (802) and T2 (803) and directory 804 are also supported.

(2) is an update operation example, and the data corresponding to a part of the "B" part is rewritten. It is shown that the cluster determined by the unused cluster search was No. 23 (step S01 in Fig. 3). Since it is a partial rewrite, the old data and new data of cluster 21 are merged and written to cluster 23 (steps S02, S03, S04, S05 in Fig. 3). The new data is "B'". In this example, writing of the data area is completed by writing only one cluster (step S06 in Fig. 3).

(3) is an update of table T1 (802). The data concatenation order is "A", "B'", and "C", which is different from the cluster arrangement in this example. Disable the old data in cluster 21 and enable the data in cluster 23 (step S07 in Figure 3).

(4) is the update of table T2 (803) (step S08 in FIG. 3). Update the data and table as described above.

Next, a method of dealing with a power cutoff during operation according to the control procedure of this embodiment will be described. FIG. 5 shows a state in which a power-fail occurs during each of the three write operations in the operation example in FIG.

(a) is a case where the power is cut off while writing to the data area (805). The contents of the new data cluster "B'" have been destroyed. In this case, after restarting, the correspondence between the table information and the data matches that immediately before the data update. And the data can be referred to as undamaged. The same applies when the power is cut off when only the data rewriting is completed and the table is not updated at all.

(b) is a case where the power is cut off while writing to the table T1 (802). The contents of table T1 have been destroyed. In this case, after restarting, the correspondence between the information in table T2 (803) and the data matches that immediately before the data update. And the data can be referred to as undamaged. Normally, T1 is used to refer to the data, so the contents of T1 and T2 should be inspected at restart, and in this case, the contents of T2 should be copied to T1 and used. The inspection method will be described later.

(c) is a case where the power is cut off while writing to the table T2 (803). The contents of table T2 have been destroyed. In this case, the correspondence between the information in table T1 (802) and the data after the restart matches that after the data update. And the data can be referred to as undamaged. Normally, T1 is used to refer to the data, but when restarting, the contents of T1 and T2 are inspected, and in this case, the contents of T1 are copied to T2. The inspection method will be described later.

As described above, according to the control procedure of this embodiment, the data and the table information are protected even if the power supply is cut off during the operation.

Next, an example of a table inspection method after restarting (at the time of recovery) will be described. FIG. 6 is an explanatory diagram showing the inspection results and judgments of the table. The main inspection items are "error check" and "content comparison".

"Error checking" indicates reading tables T1 (802) and T2 (803) to see if a device-specific error (due to a redundant check code such as a thumb check or CRC) has occurred. When writing to the device is unsuccessful, most are detected by this check.

"Content comparison" compares the contents of tables T1 (802) and T2 (803) in bit units. According to the above control procedure, when the contents of T1 and T2 are exactly the same, the correspondence between the table information and the data is matched, and the data can be referred to as undamaged. Hereinafter, how the judgment can be made based on the inspection result will be described in detail.

Result 1 (601) is T1 = T2 (exact match) with no errors in T1 and T2. The judgment is that the two tables are normal and the table information and data are in the correct state.

Result 2 (602) shows that T1 and T2 have no error and T1 T2 (mismatch). The determination ends during table update, and at least one table is normal. In this case, a normal table can be selected by further checking the consistency of the table.

For example, single chain verification. Since cluster concatenation does not branch, you should only concatenate to one cluster from one (or zero) cluster. However, in the middle of updating the table information, a connection state from two may temporarily occur. In addition, the table information of the concatenation destination cannot be "-" (data is invalid), but the table information of the concatenation destination can be temporarily "-". Single-chain verification detects such an abnormal state. It should be noted that the abnormality can be determined in a short time by inspecting only the parts that do not match in the content comparison.

Result 3 (603) shows T1 T2 with no error detected in T1 and no error in T2. The judgment ends during the update of the T1 table, and the T2 table is normal.

Result 4 (604) shows no error in T1 and error detection in T2, and T1 T2. The judgment is normal for the T1 table and ends during the update of the T2 table.

Result 5 (605) is error detection in T1 and T2. The judgment is an abnormality of the medium.

Judging from the inspection results as described above, the data can be referred to correctly if it is based on a normal table. Next, the procedure for realizing this inspection and performing the recovery process will be described.

FIG. 7 is a flowchart showing the recovery processing procedure (recovery processing program). First, the error check of T1 is performed (step S001). If an error is detected, the process proceeds to step S004, and if not detected, the process proceeds to step S002.

Next, the error check of T2 is performed (step S002). If an error is detected, the process proceeds to step S006, and if not detected, the process proceeds to step S003.

Compare the contents of T1 and T2 (step S003). If they match, the process ends, and if they do not match, the process proceeds to step S005.

In step S004, the error check of T2 is performed. If an error is detected, the process proceeds to step S008, and if no error is detected, the process proceeds to step S007.

In step S005, the consistency of T1 is checked for the information of the inconsistent part. If it is normal, the process proceeds to step S006, and if an abnormality is detected, the process proceeds to step S007.

In step S006, the contents of T1 are overwritten and copied to T2, and then the process ends. In step S007, the contents of T2 are overwritten and copied to T1, and then the process ends. In step S008, after reporting the medium abnormality, the process ends.

The recovery process may be performed at the time of starting the device, or may be provided with a detection means and executed only when it is detected that an unexpected power failure has occurred. In addition, it is desirable that the recovery processing program itself is stored in a device (or partition) that is not normally rewritten.

Next, another embodiment of the present invention will be described. FIG. 9 is an explanatory diagram showing an example of file system information manipulation different from that of FIG. Shows a series of state changes when increasing the number of clusters to add data to a file.

(1) is the state before the update. The files are recorded in order in clusters 20 and 21 of data area 805. The data is divided and managed in two parts, "a" and "b". The contents of tables T1 (802) and T2 (803) and directory 804 are also supported.

(2) adds to the end of the data in the file. Therefore, rewrite a part of the end of the part of "b", add the cluster to be used, and add the data to the beginning. In this case, it is shown that the clusters determined by the unused cluster search were 22nd and 23rd (step S01 in FIG. 3). Since cluster 22 is a partial rewrite, write the data that merged a part of the old data and new data of cluster 21 (steps S02, S03, S04, S05 in Fig. 3), and the new data is "b'. ".

In this example, it is necessary to write the unwritten data to yet another cluster (step S06 in Fig. 3). Write to cluster 23 as new without merging with old data (steps S02 and S05 in Figure 3). In this way, the rewriting of the data area is completed (step S06 in FIG. 3).

(3) updates table T1 (802). The data concatenation order is "a", "b'", and "c". The old data of cluster 21 is invalidated, and it is enabled by concatenating to the data of clusters 22 and 23 (step S07 in Fig. 3).

(4) updates table T2 (803) (step S08 in FIG. 3). Update the data and table as described above.

As described above, according to the present embodiment, in the standard file system on the secondary storage device, the information of the data body is read, merged with new data, and the merged data is transferred to the unused area of the data area. Write. After that, by updating the information in tables T1 and T2, the data and table information in the correct state can always be secured. Even if an unexpected power failure occurs, if the error check and content comparison check of tables T1 and T2 are performed at the time of recovery, the file system abnormality can be easily determined from the check result and the correct data can be referred to. Can be repaired like this.

That is, according to the present invention, it is possible to construct a file system that secures correct data even if an unexpected power cutoff occurs and maintains the integrity of the file system information at low cost without significantly impairing the performance.

According to the present invention, there are the following improvements as a countermeasure when the information in the directory area is damaged. There are two known methods for arranging directory information in a standard file system. One is a method of arranging in a fixed area as described above, and the other is a method of freely arranging in a data area like the data body of a file.

When arranging the directory information in a fixed area, two directory areas may be provided in the same manner as the table information. As with the table information, error checking and content comparison can be performed with the recovery processing program. The method described in Patent Document 4 requires a procedure of not only writing a redundant file index but also deleting it, but in the present invention, only writing is required. Furthermore, the processing overhead is reduced by saving only when the file name is updated or the first cluster number is updated. There is also a method such as providing file size information only for non-text files without EOF. Unlike other general files, directory information should be set to a specific cluster so that problems with its own references are unlikely to occur. In addition, there are many existing technologies for consistency inspection.

When the directory information is freely arranged in the data area, the update information should be written to the unused cluster area by the same procedure as the data body.

As the second improvement of the present invention, speeding up of processing will be described. A cache method is known in which file data and table information are reserved in memory so that the same data can be referred to in a short time without being read from the secondary storage many times. In that case, there are cases where the old data can be secured not from the secondary storage but from the high-speed memory even in partial writing. Further, when the content is changed and needs to be reflected in the secondary storage device, the write control order to the data area, the table T1 and the table T2 may be observed.

<figref num="1">The schematic block diagram of the information control apparatus to which the file system of this invention is applied.</figref><figref num="2">The schematic block diagram of the software which shows the application embodiment example of this invention.</figref><figref num="3">The flowchart which shows an example of the write control procedure of the file system by this invention.</figref><figref num="4">Explanatory drawing which shows how to rewrite a part of a file in order.</figref><figref num="5">Explanatory drawing which shows the state that the power-off occurred during writing.</figref><figref num="6">Explanatory drawing which shows inspection result and judgment of a table.</figref><figref num="7">The flowchart which shows an example of the recovery processing procedure (recovery processing program) by this invention.</figref><figref num="8">Explanatory diagram showing the arrangement of standard file system information.</figref><figref num="9">Explanatory drawing which shows in order how data is added to a file in another Example of this invention.</figref>

Code description

101 ... CPU, 102 ... ROM, 103 ... RAM, 104 ... Bus, 105 ... I / O, 106 ... I / F, 107 ... Secondary storage, 201 ... Applications, 202 ... Operating System (OS), 203 ... I / O Libraries, 204 ... File Systems, 205 ... Device Drivers.