Single-sourcing a controller: the trade you are making

A controller is the only part of a flash product you cannot swap after the enclosure is cut. The NAND, the package, the PCB — those can be re-bought without touching your product. The controller carries the firmware, the bad-block map and the arbitration between your writes and the die. It is the component whose replacement changes what the product does, and not what anyone predicted when it was specified.

That asymmetry is the whole argument. Pick one controller and the rest of the supply question gets easier to answer. Pick two and you keep a way out when one path closes. Both statements are true at the same time, and which one matters depends on where you sit in the part’s life cycle.

Our product documentation lists four controller solutions we work with — Alcor, ITE, Xinbang and Micov — in controller packages running QFN, 24-pin, 48-pin and COB. Memory sources on the same list include SanDisk, Toshiba, Micron, SK Hynix, Intel and Samsung. Four available solutions is not four interchangeable ones.

What a second source actually means here

For a resistor or a connector, a second source means the same package, the same pinout and a second vendor who can ship it next week. Flash does not behave that way. A controller is designed against a particular NAND geometry: the die it expects to talk to, the page and block size it handles, the spare area it reserves, the error-correction strength it can afford. The firmware sitting on top of that pairing is not portable code. It was written for that combination, and it is what makes the endurance management and the wear levelling behave.

Put a different controller on the same board and you are not substituting a component. You are introducing a different product with its own bring-up sequence, its own power-on behaviour, its own regression results, and its own documentation if anything you ship declares the silicon inside.

The cost lands in qualification, not on the purchase order. The silicon may cost the same. Everything around it does not.

The calendar the trade is measured against

Any honest conversation about controller availability has to start from the semiconductor cycle. Those durations are published industry figures, not measurements taken on our own floor: wafer fabrication runs up to 12 weeks, assembly and test add a further 4 to 8 weeks, and the full path from fab through test and assembly lands at roughly 26 weeks. Channel benchmarks cited in the same sources describe about 180 days of unpackaged die banked upstream and about 65 days held at distributor level.

A buyer reading only the distributor’s stock column therefore sees 65 days of visibility into a pipeline that was roughly 26 weeks long when the material entered it. The gap between those two numbers is where the second-sourcing argument lives.

Two consequences follow, and neither of them is a promise from us. First, a controller that is running short is already short several months before it appears short, because the die inside it spent that long in fab and assembly. Second, when a controller exit notices the market, the replacement part is rarely the same generation: it is usually a newer part with different firmware, which brings the qualification cost back into the picture.

Reel size sets the smallest honest order

Controllers and memory arrive on carrier tape reels, and reel quantity follows package size and tape pitch rather than commercial policy — that is what EIA-481 and IEC 60286-3 fix. Published reel counts in that family of standards include 10,000 pieces on a 7-inch reel and 50,000 on a 13-inch for a 0402 part, around 2,500 for a narrow SOIC-8, and 1,000 or 3,000 for a 3-lead SOT-23.

For a buyer placing a few hundred units a year, that number is the practical floor. You either buy a partial reel at a worse landed price, or you accept a tape-and-reel quantity far above your annual need and pay to hold it. Small orders in this category are rarely expensive because of the part. They are expensive because of the quantities the packaging standards impose on everyone.

What qualifying one controller buys you

A single, older, high-volume controller tends to be the best-documented part you can put in a product. Its firmware bugs have been found by other people’s customers. Its failure modes are known enough that your support team can describe them. Your test program, your burn-in settings and your field update procedure were all written against it, and none of them need maintaining a second time.

That is the real dividend of single-sourcing. Not a lower unit price — often a slightly higher one — but one behaviour your entire organization has learned.

The dimension that quietly closes the door

Physical size is where the theoretical second source usually dies. Our own specification cards record a TF card at 15 × 11 × 1 mm and 0.25 g, a UDP (USB Disk in Package) module at 11.3 × 24.8 × 1.45 mm and 0.819 g, and a semi-finished board at 12 × 44 × 4.5 mm and 3.2 g. Those are the parts that have to fit enclosures your tooling already produced.

A UDP module 1.45 mm deep, weighing 0.819 g, sitting inside a housing cut for it, is not a free place to change components. If the alternate controller comes in a taller package, or needs a different land pattern, or wants a decoupling layout the current board does not have, the swap stops being a supply decision and becomes a product change notice with its own tooling implications.

Ask for the alternate in the same package and the same footprint before you count it as a second source. If it does not exist in that form, the second source is theoretical.

How to write the order so both doors stay open

Three clauses do most of the work.

Name the primary controller in the order, and name the approved alternates beside it with the conditions they must meet: same package, same pin count, same footprint, comparable sustained throughput and endurance behaviour, and written notice before any change ships. A clause permitting substitution without notice simply moves the risk from your supply chain into your incoming inspection.

Freeze the enclosure and the footprint for the life of the programme. If the board outline and the housing are locked, the supplier cannot quietly optimise the BOM, and neither can you.

Split the release instead of betting the year on one part: first quantity against the primary, second release held against whichever controller is healthier at that time. This is the only arrangement where the trade stays available to both sides.

When single-sourcing is the wrong call

Skip the single-source strategy when your product has a long field life and the controller is in the back half of its own. A device that will still be shipped, repaired and supported five years from now needs a spare-part path, and the only thing that guarantees one is a second qualified part — not a promise.

Do not single-source when an approved substitution would invalidate a declaration your product carries, or when your firmware update path is closed and cannot push a fix to a different controller’s behaviour.

And if your annual volume is small, buying the second qualification is usually the wrong trade. Two controllers mean two firmware lines, two test programs and two sets of documentation for a volume that would not notice a short outage. Dual-sourcing pays for itself on long programmes and high volumes. On a short one, the premium you pay for optionality exceeds the disruption you are insuring against.

The question to put to any supplier is not whether they have alternatives. It is whether the alternative qualifies as the same part on paper — same package, same footprint, same firmware behaviour — and whether they will say so in writing before you pay for tooling.