Fault tolerant flash use

The whole topic is rather complicated. Even if using TFAT, there is a small risk of getting an inconsistent file system. Most of the "secure" file systems silently assume that writing a page or block is atomic, i.e. always succeeds in whole or fails in whole. But if the power is switched off exactly while writing is active, the result is indetermined. The only thing a more secure file system can do is reduce the time while the disk is inconsistent. But you can almost never bring this time to zero.

Moreover all these file systems only provide a consistent file system at the next start. This is usually done by using a journal that can reconstruct the file system in an instant, or by issuing a file system check at startup. However this does not mean that you don't loose data that was still in the memory buffer when the power failed.

In fact I don't know of any really transaction-save, lossless file system. Therefore the idea must be to reduce the risk of loosing data by other techniques.

1. By using different partitions for read-only data like program executables and for the changeable data. Then the important read-only data is never in danger.

2. By avoiding times when data is only held in volatile memory before actually been written to the non-volatile media. For example use fflush() in your software or close the files as soon as possible. Or use FILE_FLAG_WRITE_THROUGH in CreateFile(). Or use _flushall() to sync all the files.

Quote from "Behrenbeck"

a) is a partition really (!) safe as long as there is no write command issued to it ?

I would assume yes. The system does not create any temporary files under FFSDISK and it opens executables in read-only mode.

Quote

I did not find a mount read only flag like linux has

However there is. You can set PARTITION_ATTRIBUTE_READONLY with SetPartitionAttributes() before mounting the partition.

Quote

b) how can I make a partition unusable to create test cases ?

Just do all the things that usually bring the trouble: heavily write on the partition and then switch off the power. Either after some iterations, the file system is actually damaged, or it proves that it is more stable than assumed.

Quote

How does CE react if there is a bad partition? does it continue quickly with booting ?

Usually yes. At least as long the files required during the boot process are not damaged. However it is rather dangerous to write to an inconsistent file system as this may corrupt further data.

Regards,

H. Keller

You can do both: use TFAT to reduce failure of the file system in general. (This alone will *not* avoid data loss of non-yet written files.) If you add the "three partition" solution then you avoid loosing data at all. And it is easier to recover from the rare cases when even TFAT fails.

TFAT *is* rather secure as it uses the two FATs as a kind of simple journal. But while doing this, it often has to write to the boot sector, especially the "File System Valid" flag to mark if the file system is consistent (transaction complete) or if it is currently changing the content (transaction in progress). This procedure may fail in those cases when the writing of the boot sector is unexpectedly interrupted.

Quote

but I would have expected that a dedicated flash file system could withstand power loss during write ...

That was my first thought a few years ago, too. However if you dive a little deeper into the file systems, you will see getting a really failsafe file system is not easy at all. If you look at jffs2, yaffs or whatever "failsafe" flash file systems there may be, even in the linux world, they all can (and will) fail in certain circumstances. It is always a compromise between memory requirements, efficency and average failure probabilities. So nothing different with NetDCU and FAT/TFAT there...

BTW we *are* currently developing a new file system offering more security. But this is still work in progress.

Regards,

H. Keller