Ensuring Data Survival on Solid-State Storage Devices - CiteSeerX

with initial conditionsp2(0)= 1p1(0)= 0whose solution is−2λtp2( t)= e ,−2λtλtp1= 2e( e −1).The data survival probability for our mirrored deviceisS t)= p ( t)+ p ( ) .2(2 1tTable 2. Economic life span for a single device and amirrored device.Number of 9s Single Mirrored1 (90%) 0.10536 0.380132 (99%) 0.01005 0.105363 (99.9%) 0.00100 0.032134 (99.99%) 1.00E-04 0.010055 (99.999%) 1.00E-05 0.00317To obtain the economic life span L(r) of eachorganization, we solve observe that L=(r) is thesolution of the equation S n (t) = r. After setting λ = 1,the economic life span is expressed in multiples of thedevice MTTF.These results are summarized in Table 1 forreliability level r equal to 0.9, 0.99, 0.999, 0.9999, and0.99999, that is, 1, 2, 3, 4, and 5 nines. As we can see,a single device achieves a life span of 1% of its MTTFwith probability 99%. An SCM module with an MTTFof ten million hours would thus have an economic lifespan of one hundred thousand hours or slightly morethan eleven years. More demanding applications coulduse a mirrored organization to achieve the sameeconomic life span with a reliability level of 99.99%.This is an excellent result as we considered that thedevices could not be repaired during their useful life.SCMs thus appear to become the technology of choiceto store a few gigabytes of data at locations makingrepairs impossible (satellites) or uneconomical (remotelocations).3.2 Storage capacitiesThe relatively low storage capacity of SCMs preventsus from extending these conclusions to larger storagesystems. Consider for instance a storage system with acapacity of fifty terabytes. By the expected arrival timeof the first generation of SCMs in 2012, we are verylikely to have magnetic disks with capacities wellexceeding two terabytes. We would thus use at mostfifty of them. To achieve the same total capacity, wewould need 6,250 SCM modules. In other words, eachmagnetic disk would be replaced by 125 SCM modules.Let λ m and λ s respectively denote the failure rates ofmagnetic disks and SCM. To achieve comparabledevice failure rates in our hypothetical storage systems,we would need to have λ s < λ m /125, which is not likelyto be the case.Our second conclusion is that storage systems builtusing first-generation SCMs will be inherently lessreliable than comparable storage systems usingmagnetic disks. This situation will remain true as longas the capacity of a SCM module remains less thanλ s /λ m times that of a magnetic disk.D 11 D 12D 13 D 14 P 1D 21 D 22D 23 D 24P 2Fig. 3. A storage system consisting of two RAIDarrays. (In reality, the functions of the two paritydisks will be distributed among the five disks of eacharray.)D 11 D 21 D 12 D 22D 13 D 23 P QD 14D 24Fig. 4. The same storage system organized as asingle 8-out-of-10 array. (In reality, the functions ofthe two check disks will be distributed among the allten disks).D 11 D 12D 13 D 14 P 1D 21 D 23 D DX2422Fig. 5. How the original pair of RAID arrays couldbe reorganized after the failure of data disk D 22 .3.3 Bandwidth considerationsM-out-of-n codes are widely used to increase thereliability of storage systems because they have a muchlower space overhead than mirroring. The mostpopular of these codes are n–1-out-of-n codes, orRAIDs, which protect a disk array with n disks againstany single disk failure [CL+94, PG+88, SG+99].Despite their higher reliability, n–2-out-of-n codes[BM93, SB92] are much less widely used due to theirhigher update overhead.Consider for instance a small storage systemconsisting of ten disk drives and assume that we arewilling to accept a 20% space overhead. Figure 3shows the most likely organization for our array: the tendisks are grouped into two RAID level 5 arrays, eachhaving five disks. This organization will protect thedata against any single disk failure and thesimultaneous failures of one disk in each array.Grouping the 10 disks into a single 8-out-of-10 arraywould protect the data against any simultaneous failure3