Eyes on Flash/ Driven by Insight
Contact

Search Eyes on Flash

Tip: press / or Ctrl+K on any page to open search.

Type to search.

    Flash Myths, Tested

    An Unplugged SSD Loses Its Data in Weeks

    SSD retention is rated on a drive that has used up its writes, so the weeks-unplugged fear describes a worn, hot, powered-off worst case and not a normal drive.

    By
    On this page 8 sections

    No. An unplugged SSD does not lose its data in weeks, and that is the verdict on this entry in Flash Myths, Tested. The standard that rates an SSD’s data retention asks a client drive to hold its data for 1 year at 30°C with the power off, and it asks that after the drive has already been written to its full rating. A drive that has not used up its writes has more margin than that.

    An unplugged SSD and its data: what the standard asks, what heat does, what power changesA three-panel schematic. Left: the client drive standard asks for 1 year of unpowered retention at 30 degrees Celsius after the drive has used its rated writes. Center: scaled with the same model, that year shrinks to about 15 days at 55 degrees. Right: while a drive has power, its firmware can refresh aging data, which resets the clock that a powered-off drive cannot reset.FLASH MYTHS, TESTED / RETENTIONThe year is for a worn driveSTANDARD · HEAT · POWER01 STANDARDRATED WRITES USEDPOWER OFF, THEN READ1 yearat 30°C,client classBars are schematic02 STORED HOT30°C55°C15 daysthe year scaledto 55°CModel, bars areschematic03 POWERREFRESH RESETSTHE CLOCKOn vs offthe standard coverspower offCurve is schematic

    That fear is not made up. Charge does leak from flash cells, and a worn drive stored hot has a requirement that shrinks to weeks. Both the wear and the heat go missing from the myth, and together they describe a worst case and not a normal drive on a shelf.

    Where the myth comes from

    Flash stores data as charge in a cell, and charge leaks. Flash Foundations Part 2 covers how the leak works and how heat speeds it up, and a drive with no power cannot do anything about the leak, which is why an unplugged SSD sounds like it must forget.

    Where the myth comes from

    Charge leaks over time, and an unplugged drive cannot refresh it

    One flash cell from the write to a read long afterward

    Three panels of one flash cell, from a write to a read long afterward. Write: the storage layer between two insulating layers holds a full set of charge. Time passes: some charge has leaked out through the insulator, shown as empty dashed slots, and with the power off nothing can refresh it. Read later: little charge is left and the read finds a data error, which JEDEC defines as a retention failure. The dots are schematic and carry no values.01 WRITEControl gateCharge storageChannelThe cell holds thedata as storedcharge02 TIME PASSESControl gateCharge storageChannelCharge leaks out,and with no powernothing can act onit03 READ LATERControl gateCharge storageChannelAn error found longafter the write isa retention failureStored chargeCharge that leftLeak path
    A schematic of the mechanism; the dots show stored charge and are not counts. Source: JEDEC retention-failure definition (A. Cox, Seagate); schematic.

    The worry is right in kind, since JEDEC’s own definition of a retention failure is a data error found when the drive is read a long time after the data was written, and only the time scale in the myth is off.

    What the standard asks

    JEDEC’s JESD218 makes retention part of the endurance rating. As Alvin Cox’s JEDEC presentation on JESD218 lays out, a drive is first stressed to its rated terabytes written, at both high and low temperatures, and only then is its retention checked. Because the required times are long, the standard allows extrapolation or acceleration to show that a drive meets them.

    What the standard asks

    The retention test starts after the drive has used up its writes

    The order of the JESD218 endurance and retention verification

    A three-step flow. Step 1: write the drive to its rated terabytes written, at high and low temperatures, so the drive is worn out. Step 2: power the drive off and hold it, at 30 degrees Celsius for the client class or 40 for the enterprise class. Step 3: read it back after 1 year for the client class or 3 months for the enterprise class, and the data must still read back.01 WRITEDrive worn outStress the drive toits rated terabyteswritten, at bothhigh and lowtemperatures02 POWER OFFNo powerClient class: 30°C.Enterprise class:40°C. The drive isunplugged03 READ BACKData reads backClient class: after1 year. Enterpriseclass: after 3months. The datamust still readbackWorn to the ratingPowered offRead back
    Figure 1 · The retention requirement is checked on a drive that has already been written to its rating, so it describes the worn end of the drive's life. Source: JEDEC JESD218 summary (A. Cox, Seagate).

    Figure 1 shows the order. Client drives are asked for 1 year at 30°C with the power off, and enterprise drives for 3 months at 40°C. Enterprise gets the shorter time on purpose, and Western Digital’s white paper on SSD endurance explains why, since enterprise drives are expected to run around the clock with few power interruptions, while client drives can sit unused for long stretches, so the client class gets the longer power-off time.

    That same table also lists the temperatures the drives are used at while powered, and the hot NAND page walks through what those mean, so this page stays on the unpowered side.

    Why wear is the other half

    Wear matters because the year is checked at the end of the drive’s rated life. Retention gets shorter as program and erase cycles go up, and Western Digital describes an inverse relationship between the two, and the survey by Cai and colleagues says the number of retention errors for data of a given age grows as the cycle count increases. My reading of those two sources is that a new or lightly used drive faces the same leak with fewer errors on top, so it sits further inside what error correction can fix. Neither source gives a number for that margin.

    Why wear is the other half

    More wear leaves less margin before errors outgrow correction

    Raw errors for data of the same age, by how worn the drive is

    Three panels of raw errors for data of the same age, each against a dashed line for the most errors error correction can fix. A lightly used drive has a short bar, well under the line. A drive at its rated wear has a tall bar close to the line, which is where the standard checks its year of retention. A drive past its rating has a dashed outline that runs above the line, because there is no specification for how quickly retention falls off. The heights are schematic and carry no values.01 LIGHTLY USEDThe same leak addsfewer errors, sothere is moremargin02 AT THE RATINGThe standard checksthe year here, withthe least margin03 PAST THE RATINGNo specificationfor how fastretention falls offRaw errorsMost errors ECC can fixNot specified
    A schematic of the page's reading of two sources; the bar heights carry no values, and neither source gives a number for the margin. Source: Western Digital white paper; Cai et al., Proc. IEEE 2017; schematic.

    Past the rating is the part of the myth that holds. Western Digital’s paper also says there is no specification for how quickly retention falls off once a drive has reached its endurance rating, and it advises replacing such a drive if the data matters, which leaves a drive worn past its rating and left unplugged with no retention promise at all.

    Why heat is what can turn a year into weeks

    JEDEC’s test speeds up charge loss with the Arrhenius model, using an activation energy of 1.1eV. Run the other way, the same model shortens a requirement when the drive is stored warmer. Applied to the client requirement, the year becomes about 95 days at 40°C, about 15 days at 55°C and about 3 days at 70°C. At 40°C, 95 days is close to the enterprise class’s 3 months.

    Why heat is what can turn a year into weeks

    A worn drive's year at 30°C scales to about 15 days at 55°C

    The client requirement scaled with an Arrhenius model at 1.1eV

    A horizontal bar chart on a logarithmic scale from 1 to 1,000 days. The bars show how long the client retention requirement of 1 year at 30 degrees Celsius becomes when the same acceleration model is applied at higher storage temperatures. 30°C: 365 days. 40°C: 95 days. 55°C: 15 days. 70°C: 3 days.Storage temperature1101001,000Scaled retention time, days (log scale)30°C365 days40°C95 days55°C15 days70°C3 daysThe standard, client classScaled by the model
    Figure 2 · Held warm, the same retention requirement shrinks fast; this is arithmetic on the standard's number, not a measurement of any drive. Source: Computed from the JEDEC client requirement and activation energy; a model of one mechanism.

    Read Figure 2 with care. This is my arithmetic on the standard’s number, and no drive was measured. It models one mechanism, and the standard also checks a second one that heat does not speed up. A worn drive must meet that requirement, so a drive that still has writes left, or one kept near 30°C, has more time than the bars show. Weeks only shows up for a worn drive stored near 55°C, which is far above the 30°C the requirement is set at. I don’t have a saved source that measures how much longer than the requirement typical drives actually hold their data, so this page doesn’t put a number on it. The hot NAND page covers the model itself and the measured activation energy for 3D flash.

    How the loss unfolds

    The loss is not a steady slide. Measurements on 3D charge-trap chips with 30 to 40 layers found the best read voltage for the upper cell states moving with the logarithm of time after programming, and the retention error rate rose by an order of magnitude in about 3 hours and by another order in about 11 days, so the loss is steep early and then slows.

    How the loss unfolds

    Retention errors rise steeply at first, then more slowly

    And an error rate is not lost data until it passes what correction can fix

    Two panels. Left: a log-log sketch of the retention error rate against time since programming. On 30 to 40 layer 3D charge-trap chips the error rate rose by an order of magnitude in about 3 hours and by another order in about 11 days. Right: two bars against a dashed line for the most errors error correction can fix. Errors within the limit are corrected and the data stays intact; errors past the limit mean the page loses data. Marker and bar positions are schematic.01 STEEP EARLYRetention error rate, log scalestartabout3 hoursabout11 daysone decadeupanotherdecade upTime since programming, log scaleSteep early, then slower02 NOT YET LOST DATAErrors in one pageMost errors ECC can fixWithin thelimitCorrected,data intactPast thelimitThe pageloses dataAn error rate is not lost dataError rateWithin the limitPast the limit
    On 30 to 40 layer 3D charge-trap chips the error rate rose by a decade in about 3 hours and by another in about 11 days; marker positions are schematic. Source: Luo et al., SIGMETRICS 2018; Cai et al., Proc. IEEE 2017; schematic.

    An error rate is also not lost data, since a page loses data when its errors exceed what error correction can fix, and the Cai survey notes that the correction capability is limited. That is why the standard cares about the worn end of life, where the starting error count is highest.

    Powered on is a different case

    Retention numbers are for power off. Western Digital’s paper says retention is specified only for the powered-off case, and that most modern SSDs run background tasks while powered. Those tasks track how long it has been since a block was written and rewrite blocks that show higher error rates or are near the end of their designed retention period.

    Powered on is a different case

    Power lets a drive reset the clock; without it, the clock runs

    Schematic of retention errors against the age of the data

    A schematic with two lanes of retention errors against time since the data was written, with a dashed line for the most errors error correction can fix. Powered on: errors climb, then fall back to a low value at each of three refreshes, and never reach the limit. Powered off: errors climb without a reset, stay under the limit until the end of the retention requirement, and cross the limit afterwards, where the standard makes no promise. No values are measured.Powered onrefresh rewrites aging dataRaw errorsPowered offnothing resets the ageRaw errorsrefreshrefreshrefreshRequirement endsNo promiseTime since the data was written (not to scale)Powered onPowered offMost errors ECC can fix
    Figure 3 · A powered drive can read, correct and rewrite aging data; an unplugged one cannot, so the standard's retention requirement covers the unpowered case. Source: Cai et al., Proc. IEEE 2017; Western Digital white paper; shapes only.

    Figure 3 sketches the difference. The Cai survey describes the mechanism as refresh, where the data is periodically read, corrected and reprogrammed, which removes the errors that built up. It gives refreshing about once a year at a low cycle count and about once a week at a high one as examples of how a controller can adapt. I can’t tell you how long a given consumer drive has to stay powered for this to happen. I don’t have a saved source for that, and the vendor statement says most modern drives and stops short of all of them. So plugging a drive in is plausible help, but this page can’t promise it or time it.

    What the NAND Cell Lab shows

    The NAND Cell Lab puts wear, retention time and temperature on sliders and runs the result through an error-correction ladder: hard-decision decode, read-retry, soft-decision LDPC, then uncorrectable. It is a teaching model with teaching values for its constants, which makes the order of the effects the thing to read and the digits beside the point. With TLC cells, reads set to zero and 1 year of retention, the lab gives three results.

    • At 0 cycles and 30°C, the first step reads the data: hard-decision decode.
    • At 1,000 cycles, the lab’s rated value for TLC, and 30°C, the data needs the last step before failure: soft-decision LDPC.
    • At 1,000 cycles and 55°C, the data is uncorrectable.

    What the NAND Cell Lab shows

    Wear takes the lab's decoding to its last step; heat then fails it

    TLC cells, reads set to zero, 1 year of retention

    A ladder of four error-correction steps: hard-decision decode, read-retry, soft-decision LDPC, then uncorrectable. Three cases for TLC cells with reads set to zero and 1 year of retention. 0 cycles, 30°C: the data ends at hard-decision decode. 1,000 cycles, 30°C: the data ends at soft-decision ldpc. 1,000 cycles, 55°C: the data ends at uncorrectable. The lab's constants are teaching values.CASE01Hard-decisiondecode02Read-retry03Soft-decisionLDPC04Uncorrectable0 cycles, 30°CResult: Hard-decision decode1,000 cycles, 30°CResult: Soft-decision LDPC1,000 cycles, 55°CResult: UncorrectableStep triedStep that reads the dataUncorrectable
    The lab runs each case through its error-correction ladder with teaching values; read the order of the results, not the digits. Source: NAND Cell Lab, teaching values.

    That is the same order the standard implies. A fresh drive has room to spare, a worn drive after a year at the standard’s temperature is near the edge of what error correction can do, and heat on top of wear tips it over.

    What to do with this

    For a drive with life left that sits at room temperature, the standard’s year is the requirement for a worse case than yours, so weeks is not what the standard implies. For a drive you are putting on a shelf, four things matter.

    What to do with this

    Each thing that shrinks the margin has a step that answers it

    What shortens an unplugged drive’s retention, and what to do about it

    A labeled diagram with no values. Four rows, each an arrow from something that shrinks retention to the step that answers it. Wear, more cycles used leads to Check how worn it is first. Heat, warmer storage leads to Keep it cool not somewhere hot. Time powered off, the data grows older leads to Power up, read, copy to a fresh drive. Any drive, whatever its margin leads to Keep a second copy of what you cannot replace.WHAT SHRINKS THE MARGINWHAT YOU DOWearmore cycles usedCheck how worn it isfirstHeatwarmer storageKeep it coolnot somewhere hotTime powered offthe data grows olderPower up, read, copyto a fresh driveAny drivewhatever its marginKeep a second copyof what you cannot replaceWhat shrinks the marginStep that answers it
    Wear, heat and time powered off all work against stored data, and each one has a step on this page that answers it. Source: JEDEC JESD218; Western Digital white paper; Cai et al., Proc. IEEE 2017.

    Each row pairs what shrinks a drive’s margin with the step in the list below that answers it.

    • Check how worn it is first. A drive near its rating has the least retention margin, and past it there is no promise.
    • Keep it cool, and not somewhere that gets hot. Heat is the one factor that can shrink the time by a large multiple.
    • Do not rely on the shelf for longer than the standard goes. That year is for a worn client drive. For longer, power the drive up, read the data and copy it to a fresh drive, which restarts the age of the data.
    • Keep a second copy of anything you cannot replace. That advice does not depend on any retention number.

    Sources

    Primary is the original paper, standard or datasheet. Secondary is a review, a vendor summary or a news report. Measured is my own test data.

    Show all 5 sources, 4 primary

    Continue reading

    Read next

    Power Loss Lab first screen: the title and introduction beside a chart of capacitor bank voltage falling after the cut, with the cutoff and the worst-case flush time marked.
    Software

    Power Loss Lab

    Cut power to a simulated SSD mid-write and see which writes come back, with and without capacitor-backed power loss protection, old capacitors and flushes.

    Explore tool