I wish reviews started taking reliability into account. The only report on power loss effects on actual hardware I could find is from 2014 [0].

http://lkcl.net/reports/ssd_analysis.html

That article said back in the day

> Right now, there is only one reliable SSD manufacturer: Intel.

Indeed I find it very hard to figure out for other vendors whether they have power loss protection or not.

Intel makes this easy to check: Each drive has a YES/NO for "Enhanced Power Loss Data Protection" which is described as

> ... prepares the SSD for unexpected system power loss by minimizing data in transition in temporary buffers, and uses on-board power-loss protection capacitance to provide enough energy for the SSD firmware to move data from the transfer buffer and other temporary buffers to the NAND, thus protecting system and user data.

They also have a list showing all Intel SSDs that have this feature:

https://ark.intel.com/Search/FeatureFilter?productType=solid...

Would be nice if other vendors had that too.

What are you wondering about? They can squeeze more money out of businesses because it is sold as enterprise feature.

No, and for numerous reasons. Capacitors are relatively large and bulky. The specifications for SSD size doesn't leave a lot of room, and the type of surface mount electrostatic capacitors which would be needed are both expensive and take up a lot of space.

Even in the enterprise market, M2 form factor SSDs rarely have these capacitors, because they don't really help. They are more common on PCIE-card devices.

The on-disk/flash format that these drives use has a journaling system much like modern filesystems do, so they know if blocks were not fully written. This feature alone almost completely negates any need for

I have committed patches and code to UBIFS and I am very familiar with how modern flash filesystems work at the hardware level. Backup caps are just not really needed.

PS: The double exclamation point and whiney-blamey statement really added to your immature hyperbolicity.

I've worked on PLP implementations in the past. Mostly it was the added cost of capacitors. Also things like laptops don't really need them since they have batteries and will shut down gracefully when battery is running low.

The capacitors needs to be reliable, small form factor and hold enough charge to keep the controller, DRAM and NAND powered for a minimum of 15-30ms. 10 years ago what was available was not so great but now the options are much better.

Given your work with PLP, which family of SSDs would you recommend most?

I personally use the Samsung PRO SSDs myself these days. I don't go with the latest models because the older NAND technology tends to be more reliable. Also you want a company with many product cycles so that the firmware has time to mature. Just too many edge cases in SSD firmware to catch them in one go.

Well, speaking of firmware, the current state of Samsung's SSD firmware is incredibly poor.

I jumped ship from SATAs to M.2 a month ago with a new computer and to quickly sum up the situation with Samsung 960 Pro from own experience and hundred page long threads on official product forum:

- last published firmware on website is 2 (don't know the long number now, writing from phone)

- a version 3 was released, system freezing started occurring in some cases and some people even ended up with bricked drives (in relation to eDrive IIRC)

- bricked drives could be reportedly used again after PSID revert, but Samsung consistently refuses to release the tool (other manufacturers do and the tool is also useful for recovering drive with lost OPAL password)

- firmware 4 reportedly exists, which can be obtained through Magician (Samsung's tool for SSD) and should solve problems from version 3. Conflicting reports on performance.

The craziest stuff is that:

- Magician will now tell you there is a new firmware for your drive, but it won't tell you with which version is it going to "enrich" your shiny new drive. Will I get 3? Or 4? Especially when only 2 is posted on the Samsung's page!

- firmware changelogs are kept secred, just install this for no reason

- no downgrades are possible

Worse than X25-M password bug. You have to be scavenging official forums for information that should be posted with the firmware and be cursing at/begging moderators to reveal some more. Ah and reportedly there is some mysterious incompatibility with major BIOS vendors in regard to eDrive. No, they won't tell what the bug is, nor on what boards.

Also, custom OPAL PBAs (image flashed to special unlocked area on disk for booting with disk locked down) don't boot in current desktop boards. Might be non-Samsung issue, maybe the one mentioned above.

How does this stuff work together at all?

I guess Samsung is just not at their top of their game in terms of pushing differentiated product lines for their M.2 SSDs. Perhaps (or perhaps not) they should learn from Taiwanese companies. They would jump on this opportunity to sell a premium edition for lots of extra margin profit.

Have a look at this wonderful marketing page for a Gigabyte Z370 motherboard:

https://www.gigabyte.com/us/Motherboard/Z370-AORUS-Gaming-7-...

It's the most over-the-top glorious thing I've ever seen. Make sure you expand a couple of the sections.

I really wonder why a $10 capacitor add-on (a capacitor, a diode, two connectors) plugged in between main board power supply and a disk power receptacle is not a common item.

Or maybe it is, but I have no idea?

A common minimum voltage requirement for the nominal +5V supply is 4.5 V. Let's assume a voltage below that won't damage the drive, but it won't operate.

The diode is going to drop 0.6V, leaving you with only 4.4 V max for the drive. Then the capacitor is going to immediately start dropping in voltage as soon as you start pulling the stored energy out of it.

So, in practice, to do a quality job of this it will probably need a DC-DC converter. These aren't necessarily expensive, but definitely more complicated than the old diode trick.

This makes sense! OTOH low-drop diodes do exist [1], and the drive likely needs just a (small) fraction of a second to flush the caches; it's SSD, not need to wait for the disk to rotate to the right position or move heads. I suppose the power loss signal from the controller still propagates, even if the computer's PSU plug is just yanked out of socket.

[1]: https://electronics.stackexchange.com/a/282471/9909

The caches on some SSD's can be multiple gigabytes.

They also frequently cache data which can be difficult (slow) to write, for example a single modified 4kb page which is part of a large unmodified area. Completing that write would involve reading the original data, erasing the entire erase-block, and rewriting the new data.

SSD's with built in power loss prevention typically reserve an area on the SSD which is pre-erased ready to dump the contents of the cache into. Then on powerup, they reload the cache and properly flush the data to the actual place it's supposed to be.

I implemented a power-loss circuit on a custom USB memory device (battery-backed LPDDR disks) and used something similar: the MAX40200[1].

[1]https://www.maximintegrated.com/en/products/analog/amplifier...

You also need to limit in-rush current without dropping that voltage and account for capacitor degradation over the life of the device.

I worked on SSD power loss implementation in the past. You also need a signal into the controller indicating power failed. At this point the controller will minimally stop all less critical tasks, prioritize the buffered user data to be written and make sure the FFS is in consistent state for recovery.

Desktop power supplies already have that, they can keep the power on for 50-100 ms or so, and they do notify the OS about the imminent power loss. I'm not sure what OSes do with that.

How do they notify?

ATX power supplies have a PWR_OK pin, which goes low when power is lost.

Most motherboards don't report that to the OS though, instead they simply reset all the hardware.

To be fair, it's probably preferable to reset stuff than to operate when the power supply isn't healthy, since that will lead to a lot of weird undefined behaviour.

So what happens when you have "power-loss capacitors"? Since these things are limited the drive races to empty its buffers onto the SSD and then shuts down. It does not ask the host "are you done writing", so now instead you lose whatever the host had in its buffers. The host is gone anyway when the drive loses power.

No. Data loss protection needs to be built into the software itself, fixing that on the SSD level doesn't make a lot of sense. If anything, you install a UPS, and then of course you don't need to pay extra for SSD capacitors because the whole system keeps running through power loss and shuts down gracefully.

The buffers maintained by the OS and drive are totally different, the entire point of having huge buffers in the device is so that it can agglomerate and reorder otherwise totally unrelated writes into flash banks it is presently convenient to write to.

When the OS flushes stuff to the device, it is done such that metadata writes reach the disk in an order that ensures a recoverable filesystem image on power failure. If the device does not preserve that ordering all bets are off. The mapping that goes on inside a SSD is of sufficient complexity that it's much easier to simply guarantee the device has enough independent power to ensure all acknowledged writes are persisted after acknowledgement, and that means capacitors, or best case, data (e.g. committed, acked DB transactions) that magically disappear during a power loss event.

You cannot have a device that temporarily writes to RAM and tells the host computer "OK that's on disk now" (i.e. every SSD in existence with a throughput exceeding a few MB/sec) be reliable without an independent source of power to ensure that RAM reaches flash in every situation

SD cards are the same. Many cards you can unplug from the host, only to find something that successfully fsync()'ed actually wasn't persisted to the underlying storage.

Power-loss capacitors are needed because without them, flush commands issued by the OS return bogus values. Write confirmations are meaningless if the data isn't actually written to disk.

It's actually even worse than this, in that long-ago written data could be in the process of being refreshed/remapped when power is lost. The drive's software should be designed to work atomically to prevent this, but that's a whole lot of edge testing we're hoping a company will do on its closed software.

Which is why things like cheap SD cards are notoriously unreliable, whereas Samsung SSDs are seen as decently reliable. What we really want is to get rid of these controller layers and let the OS directly manage the flash. But top of the line manufacturers are incentivized to decommodify their products to increase margins, and price-competitive manufacturers are inclined to stick to the same interface.

Doesn't software like databases that care about this already assume the OS flush return values are bogus?

And it still doesn't solve the problem of the host buffers disappearing. What's the scenario, the host experiences a power-loss, but was somehow anticipating it and managed to stop writing to the SSD?

>Doesn't software like databases that care about this already assume the OS flush return values are bogus?

The best a database can do is prevent corruption. It cannot magically prevent data loss of writes that have never reached the platter or NAND.

>And it still doesn't solve the problem of the host buffers disappearing. What's the scenario, the host experiences a power-loss, but was somehow anticipating it and managed to stop writing to the SSD?

You solve the problem of host buffers disappearing by using fsync. The scenario is that fsync works correctly on powerloss.

Imagine you build an app consisting of 3 microservices. They are called Human, CPU and Disk.

The human sends a request via a website to the CPU. The CPU wants to save the host buffer in a database and sends a fsync request to the Disk. The Disk sends an "OK" response immediately but actually saves the data in the background. The CPU sends an "OK" response to the human. Everything is fine. Suddenly powerloss happens and the disk cannot save the data in time. The database is smart, it knows how to reconstruct some of the data until the point where the transaction log has been cut off. Beyond that though the data is gone and the "OK" sent to the Human is no longer valid.

Now imagine the same scenario with correct fsync. The CPU waits for the Disk and during a powerloss not only is the disk dead but the CPU is dead too and it therefore cannot send an "OK" response to the Human.

What if you don't use fsync? What if you pipe your data to /dev/null? Well, here is the tough news: Nobody can help you. If you don't write data to disk then it's gone.

> Doesn't software like databases that care about this already assume the OS flush return values are bogus?

Unsure of this (I would assume "it depends" and "probably not" because how else could it possibly know that anything is written to durable storage ever ever) but the idea is that if it didn't have to assume that life would be a lot easier.

> What's the scenario, the host experiences a power-loss, but was somehow anticipating it and managed to stop writing to the SSD?

If I understood your question correctly, databases and similar stuff write data in a way to try to solve exactly this problem, with write-ahead logs and such where you first write quickly and inexpensively to the log and then write to the database.