Sources

The Power Loss Lab is an illustrative model, not vendor data. The trends are real. The exact numbers belong to no real drive. This file lists every rule and every default the lab uses, says where each one comes from, and marks the ones that are assumptions.

Checked on 2026-09-29.

Rules the model follows

Rule in the model	Source
Hold-up time is C (V0² − Vcut²) / 2P. The model multiplies it by a converter efficiency (below).	Lexar Enterprise, Power-Loss Protection in Industrial SSDs: Architecture & Validation
On power loss the drive stops taking commands, finishes or resolves programs in flight, flushes acknowledged writes, then commits its write-ahead log.	Lexar Enterprise, same article
Programs in flight at the cut finish if the energy lasts. Any that would not finish in time are torn.	Assumption, following the “finish or resolve” step in the Lexar article
The buffer is flushed oldest first.	Assumption. Real controllers order their flushes in their own ways.
After a cut, the two acceptable states are a full commit or a clean rollback (a write that was never promised is absent, earlier data intact). Anything else is a defect. The lab’s “rolled back” and “broke a promise” outcomes follow this line.	Lexar Enterprise, same article
A Flush makes every write that had already completed durable. A FUA write completes only once it is on non-volatile media.	Linux kernel docs, Explicit volatile write back cache control
A FUA write completes only after the data is committed to non-volatile storage. The lab models a drive with its write cache off the same way: a write completes only after it reaches NAND. That mapping is the lab’s model.	Linux kernel docs, same page
Many drives with capacitor-backed PLP report no volatile write cache, so Flush returns at once. The lab’s PLP drive does the same, which is why worn capacitors break promises instead of slowing Flush down.	Netdata, NVMe power-loss protection: knowing whether your drive has PLP at all; Linux kernel docs above
Critical Warning bit 4 (volatile memory backup failed) is about the backup of volatile memory, so a drive without PLP has nothing to report there. Many PLP drives test the bank and can set the bit. The lab has no self-test and does not model the bit.	Netdata, same guide; NVMe Base Specification, SMART / Health Information log
Without a committed journal, the drive rebuilds its map at the next boot by scanning flash metadata. The lab models this as a scan from the last checkpoint that discards pages that were mid-program.	Zhou et al., FAST 2021, sections 2 and 4 (rebuild the logical-to-physical map from out-of-band or superblock metadata). The checkpoint start and the mid-program discard are the lab’s modelling choices and Flash Foundations Part 6’s description, which is unsourced there. Unflushed writes are lost: Linux kernel write-back-cache documentation.
A 2013 study of 15 commodity SSDs found data loss and corruption under power faults in 13 of them. The paper does not name ignored Flush as the cause. The lab’s “drive that ignores Flush” is one illustrative way to break promises, not a finding of the paper.	Zheng, Tucek, Qin and Lillibridge, Understanding the Robustness of SSDs under Power Fault, FAST ’13
The worst-case flush is t = max(detect, program) + buffer / flush speed + journal. For the default 4MiB buffer that is 1ms for the last program in flight (it is longer than the 0.1ms detection), 0.3ms to write 4MiB at 14GB/s, and 2ms for the journal, 3.3ms in all.	The lab’s own budget, built from the flush speed, program time and journal time below
Every die flushes at once in SLC mode: 16 dies x 16 planes x 4kB / 75µs, about 14GB/s. The flush power only sets the hold-up.	Kouchi et al., “A 128Gb 1b/Cell 96-Word-Line-Layer 3D Flash Memory to Improve Random Read Latency with tPROG=75µs and tR=4µs,” ISSCC 2020, doi:10.1109/ISSCC19947.2020.9063154: 16 planes, 75µs program. A die programming draws about 31mA, and about 2A for 64 chips at once (Takeuchi, “Novel Co-Design of NAND Flash Memory and NAND Flash Controller Circuits for Sub-30 nm Low-Power High-Speed Solid-State Drives,” IEEE JSSC 44(4), 2009, doi:10.1109/JSSC.2009.2014027), so the controller’s current budget (250mA in the cited design) caps how many dies program at once. The lab does not model that limit: it lets all 16 dies flush at once. A real drive flushing in pseudo-SLC mode on TLC or QLC dies is slower than this low-latency SLC die.

Numbers

Constant	Value	Where it comes from
Default bank	750µF, charged to 28V, 6V cutoff, 8W flush power	Assumption, sized to give about 32ms of hold-up. That is above both published figures, Lexar’s 10 to 25ms industrial target and the 25ms maximum Phison quotes (cited in Flash Foundations Part 6), so the default is a deliberately generous teaching value.
Converter efficiency	0.9	Assumption. The published formula assumes a lossless converter.
Aging calibration	Lexar says a bank sized for 15ms “may deliver 11ms” after 5 years at 70°C	Lexar Enterprise, same article. This is the one published point the aging curve passes through.
Aging shape	Linear in years, twice as fast for every 10°C	The Arrhenius “10 degree rule” for capacitor life, as described for aluminum electrolytic capacitors in Würth Elektronik SN008. PLP banks usually use tantalum-polymer parts, which age differently, so the linear shape and its use for PLP banks are illustrative. Only the calibration point above is published data.
Maximum fade	90%	Assumption. Past this point a real bank would have failed its self-test long before, so the model stops there.
Power-fail detection	100µs	The lab’s own assumption (illustrative), not a Lexar figure. Lexar says well-designed drives detect a power loss in under a millisecond, and poor ones take 2 to 3ms.
SLC program on capacitor power	75µs per 4kB page, 16 planes per die, all 16 dies at once	Kouchi et al., ISSCC 2020 (above).
Journal commit on capacitor power	2ms	Assumption.
Journal commit in a normal Flush	200µs	Assumption.
NAND program	64KiB per unit, 1ms, 16 units in flight (about 1GB/s)	Assumption, in the range of TLC program times and die counts on current drives.
Partial program unit wait	1ms	Assumption. A partly filled unit waits this long for more data, then is programmed anyway.
Mapping checkpoint interval	64MiB of host data	Assumption. It caps how much NAND the recovery scan reads when the journal was not committed.
Host write size	16KiB	Assumption: a common database page size.
Region and region size	8MiB, 512 cells of 16KiB	Assumption. Small enough to draw every cell on the page.
Default write rate	2000MB/s	Assumption. It is faster than the model’s 1GB/s NAND, so the buffer fills before the cut.
Default DRAM write buffer	4MiB	Assumption. It is small enough that the default bank flushes it with room to spare.
Default cut time	50ms	Assumption. Long enough for the buffer to fill and the workload to settle.
Default writes per fsync	16	Assumption.
Default seed	1	Any whole number from 0 to 4294967295 works. The same seed and settings always give the same run.
Margin labels	Tight under 1.5x, Short under 1x	Assumption. The 1.5x line is the lab’s own and is not an industry threshold. Below 1x the worst-case flush does not fit.
Simulation tick and chart sample	10µs and 250µs	Modeling choices. Time moves in whole ticks.

Slider ranges

Every range is an assumption. Each one is chosen to cover a realistic design and a clearly broken one.

Control	Range
Capacitance	100 to 5000µF
Charge voltage	5 to 35V
Cutoff voltage	3 to 12V, and at least 1V below the charge voltage
Flush power	2 to 20W
DRAM write buffer	1 to 8MiB
Capacitor age	0 to 10 years
Capacitor temperature	25 to 85°C
Writes per fsync	1 to 256
Write rate	100 to 3000MB/s
Cut time	5 to 200ms

Fixtures

The lab has no third-party data files. The MIT license covers the code.