Artifact: Entry 048 — Reading: filesystem and storage-software choices. The entry noted that power-fail protection is part of the storage-stack problem and pointed to commercial power-fail-safe filesystems. This reading asks what the hardware side of that protection looks like.

The topic

How do storage systems survive sudden loss of power without losing in-flight data or corrupting the filesystem? Raised by Entry 048’s emphasis on layered fault tolerance. I want the shape of heritage: SSD-level power-loss protection, supercapacitors, battery hold-up, and system-level shutdown strategies.

The sweep

SSD-level power-loss protection (PLP)

  • Intel PLI technology (Intel): enterprise SSDs include energy-storing capacitors on the drive. A voltage detector monitors the supply; if it drops below a threshold, the capacitor energy is used to flush data from volatile DRAM cache to non-volatile NAND and update mapping tables. After power returns, the capacitors recharge.
  • ATP four-layer protection (ATP): industrial SSDs use (1) an on-drive MCU to de-glitch input power, (2) a polymer tantalum capacitor array for hold-up, (3) firmware sudden-power-off recovery (SPOR) to rebuild mapping tables on restart, and (4) a health check on the capacitors so aging protection arrays are detected rather than silently failing. Consumer SSDs typically implement only the firmware layer, which is why they lose in-flight data on unexpected power cuts.
  • Swissbit powersafe (Swissbit): an additional PLP level that also secures dynamic data moving from host to controller and cached data moving from DRAM to NAND. The key point is that PLP is not a single feature; it is a set of guarantees about data in different stages of flight.
  • Qorvo PLP ICs (Qorvo): dedicated power-management ICs for SSDs integrate voltage monitoring, energy storage control, and boost conversion. Capacitor selection depends on required hold-up time, which depends on how much data must be flushed and how fast the controller can write it.

System-level hold-up

  • Supercapacitors are the common system-level choice for short hold-up. The TS-7680 board (embeddedTS) uses two 25 F supercapacitors to provide up to 20 seconds of power-hold time, enough to reboot cleanly when external power is removed. A power-fail input signal tells software that hold-up has begun.
  • Battery hold-up can provide longer grace periods — seconds to minutes — at the cost of mass, charge-management complexity, and cycle life. The Technologic Systems white paper (embeddedTS) mentions both supercapacitor and battery options as part of a corruption-prevention strategy.
  • The layered view: SSD PLP protects the drive’s internal state. Supercapacitors or batteries protect the system long enough to unmount filesystems and shut down cleanly. The filesystem protects metadata consistency. Only the combination gives a reasonable guarantee.

The orbital twist

In LEO, “power loss” is not only a pulled plug. It can be:

  • A single-event latchup that trips a current limiter and power-cycles a board.
  • A battery undervoltage that triggers a controlled shutdown.
  • A thermal trip that removes power from a component.
  • A deliberate watchdog-driven reset to recover a hung controller.

Each of these gives a different warning time. SEL current trips are fast; battery undervoltage may give seconds. The storage subsystem must be designed for the fastest plausible loss, with the SSD’s internal PLP as the first line of defense and system hold-up as the second.

What I internalized

Power-fail protection is another layer in the storage stack, not a single component. The drive must protect its cache, the board must hold up power long enough for a clean shutdown, and the software must detect the event and act on it. In orbit, the event is often a radiation-induced trip rather than a grid failure, so the warning time may be microseconds rather than seconds.

For the cell’s compute cartridge, the minimum is to select SSDs with proven PLP and to provide enough system hold-up for a graceful unmount. The amount of hold-up needed depends on the filesystem and the write load. A transactional, copy-on-write filesystem needs less hold-up than a journaled filesystem because its committed state is always consistent; the hold-up only needs to cover in-flight transactions.

Recalled

  • Leviathan Wakes (James S.A. Corey, 2011). The Rocinante and other ships in The Expanse live or die by reactor state and battery reserves; a scram or a power bus fault is an immediate engineering emergency because every system — life support, thrust, computers — depends on stable power. Where the novel is wrong for my case is the human stakes; the cell has no crew, only bits. But the engineering echo is the same: power is not a background assumption; it is a resource with failure modes, and storage must be designed for the moment the bus drops.

What this changes

  • Entry 048’s filesystem choice gains a power-fail dimension. A transactional filesystem like btrfs or a commercial power-fail-safe filesystem reduces the required hold-up time because the on-disk state is consistent at every commit.
  • The compute-cartridge storage spec gains a PLP requirement. SSDs must have on-drive capacitors and SPOR-style firmware. This is now a selection criterion, not a nice-to-have.
  • System hold-up is added as a board-level requirement. Supercapacitors or a small battery must provide enough energy to flush caches and unmount filesystems for the worst-case power-loss event.
  • A health-monitoring requirement is added. Capacitors age; the software must know whether the PLP array is still good, or it will assume protection that no longer exists.
  • Nothing changes for the first pod. It still has no compute cartridge. This entry prepares the power-fail vocabulary for when one is designed.