Onboard memory: SSD, cartridges and erasing for real

What a recorder asks of a memory

A flight-test recorder is an unusual storage client. It writes almost exclusively, sequentially, at a rate it declared in advance, and it is not allowed to be late. There is no retry: a sample that cannot be written when it arrives is a sample that never existed, and no amount of throughput afterwards brings it back.

That is a completely different requirement from the one consumer and even server storage is optimised for. A drive that averages 500 MB/s but occasionally pauses for eighty milliseconds is excellent in a laptop and unusable in a recorder. The specification you care about is the worst millisecond, not the average second.

Sustained is not peak

It helps to write the budget down. A moderately instrumented sortie looks something like this.

Fifteen megabytes per second is nothing for a modern SSD, and that is exactly the point: onboard recording is rarely a bandwidth problem. It is a determinism problem, and the answer is a chain of unglamorous choices — deep buffering in RAM ahead of the drive, large aligned sequential writes, generous over-provisioning so the controller is never cornered, and a drive selected because its latency is consistent rather than because its peak is impressive.

Note also what dominates the table. One intra-only event camera outweighs every bus and every analog channel on the aircraft. Storage budgets are decided by video, and everything else is rounding.

Removable cartridge or fixed drive

A removable cartridge turns the download into a physical operation: the aircraft is released in the time it takes to swap a module, and the data walks to the analysis room. It also makes capacity a consumable — you buy more cartridges rather than a bigger recorder — and it makes handling the medium a documented procedure, with all the custody and classification questions that implies.

A fixed drive downloaded over Ethernet has the opposite profile. Nothing to lose, nothing to mishandle, no connector cycling on the flight line; but the aircraft stays occupied for the duration of the transfer, and a gigabit link moving 160 GB is a good twenty minutes at best.

The practical rule is turnaround time. If the aircraft flies twice a day, the cartridge wins outright. If it flies weekly and the recorder is buried behind a panel, Ethernet is simpler. Many installations end up with both: a cartridge for the campaign data, and a network path for a quick look at the last sortie without opening anything.

Flash reality: wear, amplification and pauses

Flash cells tolerate a finite number of erase cycles — of the order of a thousand for the dense consumer-grade parts, a few thousand for MLC, tens of thousands for the single-level cells used where endurance matters more than capacity. That number is not a warranty clause, it is the service life of your recorder medium.

The arithmetic is straightforward and worth doing once. Fill a drive completely every working day, on a part rated for a thousand cycles, and you have about a thousand working days — three years or so. Fill a tenth of it per day and the medium outlives the programme. What ruins the estimate is not the flight data but the habit of formatting, re-copying and re-testing on the same cartridge.

Write amplification is the other half. A controller that has to move existing data to free a block writes more than you asked it to, and the amplification factor climbs as the drive fills and as writes become random. A recorder writing large sequential blocks to a drive with spare capacity is the friendliest case flash ever sees — which is why a recorder that is kept 90 % full behaves noticeably worse than the same recorder kept half empty.

What an aircraft does to a memory

• Temperature. Industrial-grade parts are specified from −40 to +85 °C, and it is not a marketing distinction: writing hot accelerates wear, and an unpowered drive left in a hot aircraft loses retention faster than the same drive in an office.
• Altitude. A rotating drive relies on an air bearing and simply cannot be used. Solid state has no such objection, which settled this argument two decades ago.
• Vibration. The flash does not care. The connector, the retention mechanism and the solder joints do, and that is where a removable cartridge earns or loses its reputation.
• Contamination and humidity. A cartridge handled on a flight line collects everything a flight line has; a sealed housing and a decent connector are not luxuries.
• Qualification. The medium is part of the equipment. It travels through the same DO-160 and MIL-STD-810 campaign as the recorder around it, in the configuration it will actually fly in.

Power loss, and the file that was never closed

A recorder loses power without warning, and it does so precisely at the moments you most wanted the data. Two things protect the recording. The drive must not corrupt a block it was mid-way through writing — which is what the power-loss protection capacitors in an industrial SSD are for. And the file structure must remain readable when it was never closed.

That second requirement is a format decision, not a storage one. A container whose index lives at the end of the file, or which only becomes valid on a clean close, converts a power interruption into a total loss. A container built from self-contained, self-dating blocks degrades to exactly what was written, and not one block less.

There is a related choice about file systems. A standard one — exFAT, NTFS — means anyone can plug the medium into a PC and see files, which is worth a great deal operationally. A recorder-native layout is more robust to a hard cut and faster to write, at the price of needing a tool to read it. Both are defensible; what is not defensible is choosing the convenient one and then discovering its behaviour after a power cut for the first time on a real campaign.

Erasing for real

Deleting a file removes a directory entry. Quick-formatting rewrites a few structures. Neither touches your data, and on flash the situation is worse than on a disk: wear levelling means the controller has been quietly making copies in blocks it no longer maps, so even overwriting a file end to end leaves earlier versions of it on the dies. Whatever the operating system tells you, the recording is still there.

The genuine mechanisms are a block erase of every cell in the device, a cryptographic erase that destroys the key the data was encrypted with, or physical destruction of the dies. The second is the interesting one: if the recorder encrypted on write, then sanitising the medium means destroying a key, which takes seconds and leaves nothing readable behind — no scanning of two terabytes, no doubt about spare blocks.

This is not a paranoia feature, it is an operational one. The same aircraft, the same recorder and sometimes the same cartridge serve different customers in the same week, and those customers are frequently competitors. A quick erase that is provably a purge is what makes back-to-back campaigns possible without buying a cartridge per customer. Physical destruction, in turn, is what covers the case where no evidence of erasure is acceptable at all.

Whichever path you use, write it into the campaign procedure rather than leaving it to the last person holding the cartridge — with the level, who performs it, and what record is kept.

Choosing capacity

Sortie duration multiplied by the sustained rate, plus margin for the sortie that runs long and the one you have to repeat, plus room to keep the drive comfortably below full for the sake of the controller. That is the whole calculation, and it usually lands on a capacity one step above the honest estimate.

The one place where more capacity is not simply better is inside a crash-protected module: more gigabytes means more dies, more volume to protect and more surface to insulate. Everywhere else, the extra capacity costs money and buys margin, which on a campaign that flies once is the better end of the trade.