STM32F030C8 HardFault with 1 bit flipped address access

Hello Everyone,

During the operation of my program, there will be an issue of address inversion on stm32f030c8.

It occurs approximately every 4 hours, and then it transitions to a "hard fault".

For example, I was trying to read from address 0x20000940, the register R0 returns 0x20400940, 1 bit was flipped, and it is out of the range of ram address(0x20000000-0x20002000), runs into hardfault in the end.

I measured the surface temperature of the chip, and when the problem occurred, the surface temperature of the chip was 65 degrees.

I suspect it's a problem caused by excessive temperature, so I used a fan to blow on it. It has been running for a whole day and is still functioning normally.

The vcc of the MCU is 3.3V. I used external crystal oscillator 8M, the PLL  Clock is 48MHZ, configuration like follow:

    RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSE;/** 使用外部晶振（8mhz） */
    RCC_OscInitStruct.HSEState= RCC_HSE_ON;/** 打开高速外部时钟 */
    RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;/** 锁相环打开 */
    RCC_OscInitStruct.PLL.PLLSource = RCC_PLLSOURCE_HSE;/** 锁相环源为外部时钟（8mhz） */
    RCC_OscInitStruct.PLL.PREDIV = RCC_PREDIV_DIV1;/** 1分频（不分频） */
    RCC_OscInitStruct.PLL.PLLMUL = RCC_PLL_MUL6;/** 6倍频 */
    if (HAL_RCC_OscConfig(&RCC_OscInitStruct)== HAL_OK)
   {
        RCC_ClkInitStruct.ClockType = (RCC_CLOCKTYPE_SYSCLK | RCC_CLOCKTYPE_HCLK | RCC_CLOCKTYPE_PCLK1);
        RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK;
        RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1;
        RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV1;
        if (HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_1)!= HAL_OK)
        {
            Error_Handler();
        }
   }

The code that triggers a hard fault is as follows:
0x08006CF4 F002FBEC BL.W 0x080094D0 MCInfusionSettingParam
0x080094D0 4800 LDR r0,[pc,#0] ; @0x080094D4
0x080094D2 4770 BX lr
0x080094D4 0900 DCW 0x0900
0x080094D6 2000 DCW 0x2000
0x08006CF8 3040 ADDS r0,r0,#0x40
0x08006CFA 7A81 LDRB r1,[r0,#0x0A]