Flash Foundations companion · Simulator

Power Loss Lab

An SSD tells the host a write is done long before the data is safe on NAND. Cut the power mid-write and see which writes come back, with and without power loss protection (PLP): a bank of capacitors plus the firmware that uses it, which keeps the drive alive for about 10 to 25 milliseconds after the cut.

Start the walkthrough Skip to the sandbox How it works

Bank voltage30V at the top

0msTime after the cut40ms

Bank voltage
Cutoff, 6V
Worst-case flush, 3.3ms

A 750µF bank charged to 28V holds the drive up for 31.6ms until it falls to the cutoff. Flushing a full 4MiB buffer takes at most 3.3ms. These are the lab's default settings.

The walkthrough

Five cuts, five ideas

Every section shows the same picture on a different drive: the 512 cells the host wrote, and what each one reads back after the cut. Terms are defined under How it works.

Done isn't saved

The host sends a write, and the drive answers "done" as soon as the data reaches its DRAM buffer, long before it is written to NAND flash. This drive has no protection, and the plug is pulled mid-write.

209 of 512 cells came back with older data, and the drive reported no error. 4MiB of writes was still in DRAM when the power went.

Capacitors buy time

Same cut, now with power loss protection: a bank of capacitors that keeps the drive running for a few milliseconds after the power goes. That is meant to be long enough to write the buffer to NAND and commit the journal (the drive's log of map updates).

The capacitors held the drive up for 31.6ms. Saving the buffer and the journal took 2.7ms, so every cell the host wrote came back.

Ask for a promise

Back to the drive with no capacitors. With fsync, the OS sends a Flush after every transaction, and the drive answers only once the data is on NAND, which is a promise that it is safe.

With fsync, no cell rolled back and no promise was broken. The price is speed: 1.1GB/s without fsync, 199MB/s with it.

Capacitors wear out

Capacitors lose capacity with age, and faster when they run hot. This is a tight 12V design that covers the worst-case flush of a full 8MiB buffer with 5% to spare when new, and it runs at 80°C.

At 8 years the bank holds up for 0.6ms but the flush needs 3ms, so 283 cells were lost. In this model cells start to go at 7 years.

A drive that lies

Some drives answer Flush at once, before the data reaches NAND, so their write speed looks great. A 2013 study of 15 commodity SSDs found 13 that lost or corrupted data under power cuts.

The drive answered every fsync at once, so the host saw 1.1GB/s instead of 199MB/s. Then the cut took 209 cells the drive had promised were safe.

The sandbox

Cut the power mid-write

Illustrative model, not vendor data. Trends are real, numbers are not.

01 Drive

Power loss protection

On: capacitors keep the drive running after the cut so it can flush. Off: the drive has no reserve.

Capacitance

Rated size of the bank when new. Published designs quote about 10 to 25 milliseconds of hold-up.

Electrical details

Charge voltage

Voltage the bank sits at while the host supplies power.

Cutoff voltage

Below this the voltage converter drops out. It stays at least 1V under the charge voltage.

Flush power

Power the whole drive draws while it flushes. More drains the bank sooner.

DRAM write buffer

Data waiting here is lost at the cut unless the capacitors save it.

Drive honors Flush and FUA

Flush is the command that makes every completed write durable. Off: Flush and FUA return at once, before the data reaches NAND. This is what a drive that ignores Flush looks like.

02 Capacitor age

Age

Years in service.

Temperature

Average temperature the bank has run at. Heat ages capacitors faster.

03 Host

Drive write cache on

On: a write completes once it is in DRAM. Off: it completes after it reaches NAND, which is slower.

How the application asks for durability

NonefsyncFUA

None: it never asks. fsync: the OS sends a Flush after every transaction (a group of writes the application wants saved together). FUA (Force Unit Access): every write must reach NAND before it completes.

Writes per fsync

Writes in one transaction. Used with fsync only.

04 Workload

Write rate

How fast the host sends data.

Access pattern

RandomSequential

Random writes land anywhere in the region. Sequential writes walk through it in order.

Seed

The same seed and settings always give the same result.

05 The cut

Cut time

When the plug is pulled, counted from the start of the run.

Before the cut

Hold-up
Worst-case flush
Margin
Capacitance fade

Tight means under 1.5x in this lab. It is not an industry threshold.

What every cell reads back after the cut

Each square is one 16KiB cell of an 8MiB region the host writes to.

Capacitor voltage after the cut

The bank runs the flush until its voltage falls to the cutoff. The axes stay fixed, so a change in hold-up moves the curve.

Bank voltage
Flush done, or energy ran out
Time the flush needs

How it works

The host writes 16KiB cells into a small region. The drive holds each write in a DRAM buffer and programs it to NAND in 64KiB units across 16 dies.

A promise is anything the drive told the host was safe: a Flush that returned, a FUA write that completed, or any completed write on a PLP drive. Losing a write you were never told was safe is a rollback. Losing one you were told was safe is a defect.

The Flash Myths page A Power Cut Does Not Wipe Your SSD sets this lab's hold-up and flush numbers beside published ones.

At the cut, a drive with capacitors stops taking commands, finishes the programs in flight, flushes the buffer oldest first and commits its journal. It keeps going until the capacitor energy runs out. A drive without them loses everything still in DRAM, and any program in flight is lost with it.

Flush and FUA are how the host asks for durability. A Flush makes every write that has already completed durable. A FUA write completes only once it is on NAND. An fsync sends a Flush. Many drives with capacitor-backed PLP report no volatile write cache, so Flush returns at once. The lab's PLP drive does the same.

Host: The host is the computer the drive is plugged into. It sends the writes and waits for the drive to answer.
DRAM: DRAM is fast memory on the drive that holds writes on their way to flash. It forgets everything the moment it loses power.
NAND: NAND is the flash memory that keeps your data with the power off. Writing to it is much slower than writing to DRAM.
Capacitor: A capacitor stores a small amount of electrical energy and gives it back when the supply drops. A bank of them can run a drive for a few milliseconds.
fsync: fsync is the call an application makes to ask the operating system to put its writes somewhere safe. The OS passes the request to the drive as a Flush.
Flush: Flush is the command that makes every completed write durable. The drive should answer only once that data is on NAND.

Show the numbers

Usable energy: E = ½ C (V0² − Vcut²)The bank gives up the energy between its charge voltage V0 and the cutoff Vcut.
Hold-up: t = η E / Pη is 0.9, for converter losses. P is the power the drive draws while it flushes.
Voltage after the cut: V(t) = √(V0² − 2 P t / (η C))It falls until it reaches Vcut. Then the converter drops out.
Capacitance fade: fade = k × years × 2^((T − 25) / 10)Twice as fast for every 10°C is the rule for liquid aluminum electrolytic capacitors. The linear shape and its use for PLP banks are illustrative, since other capacitor types age differently. Calibrated so 5 years at 70°C loses about 27%, and capped at 90%.
Worst-case flush: t = max(detect, program) + buffer / flush speed + journalFor the default 4MiB buffer: 1ms for the last program in flight, 0.3ms to write 4MiB at 14GB/s, 2ms for the journal. The journal takes longest.
Flush speed: speed = 16 dies × 16 planes × 4kB / 75µs ≈ 14GB/sEvery die flushes at once in SLC mode, at the speed of a published SLC die: a 4kB page on each of 16 planes in 75µs. A die programming draws about 31mA, so a real controller's current budget caps how many dies program at once. The lab does not model that limit: all 16 dies run, and the flush power only sets how long the bank lasts.
Effective write speed: speed = completed writes × 16KiB / run timeWhat the host saw. Every fsync waits for NAND, so it costs speed.

What it leaves out

No paired-page or data-at-rest corruption. Older 2D MLC could damage data it had already written when power failed mid-program.
No atomic write sizes (AWUPF, the NVMe atomic write unit for power failure). Every 16KiB cell is written whole or not at all. That is a stronger guarantee than many drives make.
No file system journal. The lab shows what the drive keeps, not what a file system would rebuild on top of it.
No capacitor ESR (equivalent series resistance). Real banks lose some usable voltage under load, so real hold-up is shorter than the formula says.
One flush order. The drive flushes oldest first. Real controllers order their flushes in their own ways.
One namespace and one region of 512 cells.
Many PLP drives test the bank and can set Critical Warning bit 4 (volatile memory backup failed). The lab has no self-test.
The aging curve is illustrative. Its shape is a guess, calibrated to one published point: Lexar says a bank sized for 15ms may deliver 11ms after 5 years at 70°C.
Partial PLP. Some client drives protect only the map entries still in flight, not the whole write buffer. The lab's drive is protected fully or not at all.
The write buffer is DRAM here. Some designs use SRAM for it.
One recovery method. Without a journal, the lab's drive scans NAND from the last checkpoint and reads the out-of-band data (the spare bytes stored beside each page). Real drives use several methods.
Every timing is a teaching value. The sources and method say where each one comes from.

Search Eyes on Flash