The drive gives you about four nines in the field. The reliability that archives and AI data demand is built above the drive, with verification, copies, and erasure coding.
In an earlier article in this series we looked at an uncomfortable number. The reliability printed on an LTO cartridge, better than one uncorrectable error in 10^20 bits, works out to seventeen nines of durability, but real production tape, measured in the field, settles closer to four. That figure comes from Quantum’s Turguy Goker, who chairs the INSIC tape-technology roadmap and put real fleet data on the record in a public IEEE talk. [1] The difference is that the spec assumes errors are random, and real-world tape errors are not. They cluster, they correlate, and they defeat the assumption the drive’s own error correction is built on.
Four nines is good. For a great deal of data it is plenty. But the data now driving archive growth, irreplaceable scientific datasets, AI training corpora, legal and compliance records, often needs far more, on the order of eleven nines or better. The drive cannot get you there on its own, and no amount of faith in the spec sheet changes that. The reliability those workloads require is not a property of the drive. It is something you build above it.
First, actually verify
Before any protection scheme, there is a discipline most tape operations underinvest in: confirming that what you wrote is really readable.
It is tempting to assume the drive already does this, because LTO drives perform read-while-write. A read element just behind the write head reads each dataset back the instant it is written, and if it does not check out, the drive rewrites it. That is a real safeguard, but it is not verification in the sense that matters. Read-while-write checks the data with the same head, on the same drive, microseconds after writing, under the exact conditions of the write. [1] It tells you the bits landed. It does not tell you that the cartridge, pulled off a shelf eighteen months later and loaded into a different drive, will give those bits back.
True verification means reading the tape later, ideally on a different drive, and confirming both that the data is recoverable and that its fixity, a check that the bytes are exactly what they should be, still holds. Only a separate read can do that. The trap, as engineers at large archives have pointed out, is that most systems measure bytes moved rather than bytes verified. A backup that completed is not the same as a backup that was proven readable, and the difference only surfaces at the worst possible moment, during a restore.
There is a subtler reason a separate read matters. When a drive writes a dataset, it may make several back-and-forth passes, back-hitches, to land that data correctly within a fixed length of tape. A region that took an unusual number of back-hitches is a region that fought the drive, and a likely place for trouble later. [1] None of that is visible from the write side. Only a separate read pass finds it.
The old answer: copies
For decades the standard response to tape’s reliability ceiling was simple and effective: keep more than one copy. It remains the sensible baseline, and for many organizations two copies on tape is an entirely adequate data-protection strategy.
But copies are a blunt instrument. Each copy is itself only about four nines, so two copies improve your odds without reaching the durability the most demanding data needs. They are also expensive in every dimension that matters at scale: twice the cartridges, twice the library slots, twice the handling, twice the power and floor space and carbon. And a two-copy scheme has a quiet weakness. After a disaster that takes one copy, your protection is back to a single tape, with all of a single tape’s four-nines exposure, exactly when you can least afford it.
RAIT, and the long tail
A more sophisticated answer borrowed an idea from disk: RAID on tape, usually called RAIT. Stripe data across several drives and cartridges with parity, and you can rebuild from a failed drive or a failed cartridge. Some organizations built RAIT systems with seven or nine drives specifically to chase higher reliability.
RAIT works, but it carries real costs. It is complex to manage and needs multiple drives kept in step. Its performance is bounded by the slowest drive in the stripe, and to read even a single small file you have to load and spin up every tape in the set. That last point is the killer in practice. The industry’s own research describes it as a long-tail-latency problem: a read does not finish until the slowest, last cartridge in the group is mounted and positioned, so the occasional very slow retrieval drags down the whole system. [2] And like simple copies, RAIT does nothing special about the correlated, positional error modes that pull real-world reliability down in the first place.
The modern answer: erasure coding in two dimensions
The technique that addresses both the durability gap and the latency problem at once is erasure coding, and the version built for tape works in two dimensions: a local code within each cartridge, and a global code across a group of them. [3] Each dimension solves a different half of the problem, and it is the combination that makes the approach work where copies and RAIT fall short.
The local layer: repairing a tape from itself
The dimension that sets this apart from RAIT is the per-tape code, a locally repairable code written along each individual cartridge. Its job is to handle the errors tape actually produces. As established earlier, the overwhelming majority of real-world tape errors, by some measures well over 99.9 percent, are small and localized: the beginning-of-tape and end-of-tape clusters, worn wraps, and the other positionally correlated failures that defeat the drive’s random-error model. The per-tape code recovers essentially all of them from the affected cartridge alone, without touching another tape. [1]
That single property fixes the long-tail-latency problem that sinks RAIT. In a striped RAIT set, recovering anything means mounting and positioning every tape in the group, so the slowest cartridge sets the pace for every read. With a per-tape code, the common case, a localized error on one cartridge, is repaired from that cartridge while it streams, with no extra mounts and at close to full transfer rate. You only ever load the whole group in the rare event of an entirely lost or destroyed tape. [1]
The per-tape code is also deliberately laid out to beat correlated damage. Rather than writing each codeword to one contiguous stretch of tape, the scheme scatters its chunks across the cartridge, so that a burst of errors concentrated in one physical region, precisely the beginning-of-tape and end-of-tape pattern, cannot take out an entire codeword at once. It is engineered around the exact fact the drive’s correction has to assume away, that real errors cluster.
How far this goes is best shown by a physical demonstration Quantum has published. Two cartridges protected only by the per-tape code were deliberately destroyed: on one, a section of the magnetic surface, including the servo information, was entirely removed; on the other, a full meter of tape was cut out and spliced back together. In both cases the data was recovered at near-maximum performance, using a per-tape overhead on the order of ten percent. [1] That is damage that would leave a conventionally written tape unreadable in the affected region.
The global layer: surviving a lost tape
The second dimension is the across-tape code, and it does the job RAIT was reaching for. Data and parity are spread over a group of cartridges so the group survives the complete loss or destruction of one or more whole tapes, not just localized errors but a cartridge that is crushed, misplaced, or gone. This is the fallback for the rare case the local code cannot handle, and because the local code handles nearly everything, the group is seldom mounted at all.
Put the two together and you have a system that repairs the common errors instantly from a single tape and still survives the catastrophic loss of whole cartridges, without imposing the all-tapes-at-once penalty on every read.
The economics: replicated-copy protection at a fraction of the cost
The reason this matters commercially is overhead. The old way to reach very high durability was to keep multiple full copies. The protection equivalent to several replicated copies, by Quantum’s accounting, can be reached with two-dimensional erasure coding at a total overhead in the mid-forties of a percent, against roughly three hundred percent for four full copies. [1] The split is lopsided by design: the across-tape code carries most of it, around forty percent, while the per-tape code that does the day-to-day work adds only a few percent. And it holds that while keeping more than ninety percent tape-motion efficiency and better than ninety-five percent of full speed, because it is not constantly shuttling whole groups of tapes to service reads. [1]
The durability claimed for the result is better than eleven nines, the same tier as premium cloud object storage, reached on tape at a fraction of the media, power, and footprint replication would demand. In one published run, a petabyte was written and read back over five days across five libraries and fifteen drives, at roughly 4.8 gigabytes per second aggregate, with a full fixity check and zero errors. [1]
What it looks like as a product
In its most developed form, sold by Quantum as ActiveScale Cold Storage, the two-dimensional code is wrapped in something most tape systems are not: a cloud-style object-storage front end. Applications talk to it through the same S3 interface they would use for cloud storage, with standard and cold, Glacier-style storage classes, while underneath, the data lands on tape protected by the per-tape and across-tape codes. [1] The design puts object-storage and tape expertise in one system and one management view, rather than bolting a tape archive onto a separate gateway.
Several choices in that design show what the approach is optimized for. Writes are gathered into terabyte-sized objects rather than dribbled out as small files, restores are queued and serviced in an orderly way, and the system deliberately avoids the striping and parallel-drive speed-matching that hampers RAIT. [1] It also checks itself over time, scrubbing tapes periodically and verifying end to end with checksums, which builds the verification discipline from the start of this article in as a standing process rather than leaving it to the operator. The intended result is what the industry has begun calling an active cold tier: storage cheap and dense enough to be tape, yet durable and accessible enough to be treated like an object store, and aimed squarely at the cold AI training data now accumulating faster than there is anywhere to put it. [1]
A fair word on the source
All of this comes with a caveat worth stating plainly. The system just described is Quantum’s, covered by patents that name Turguy Goker, the same engineer and INSIC roadmap chair whose field data opened this article, among the inventors [3]. It deserves clear eyes for the same reason the four-nines figure did in the first place. The company most loudly documenting tape’s operational reliability gap is also the company selling the most complete fix for it. That does not make the gap less real or the fix less effective. The underlying principle, that erasure coding beats replication when errors are correlated, is sound, general, and proprietary to no one. But the specific eleven-plus-nines number is a vendor figure, and it deserves the same scrutiny we gave the seventeen-nines figure on the side of the box. Ask how it was measured, on what data, and under what assumptions before treating it as a guarantee.
What this means for you
The practical takeaway is the one that runs through this whole series. The reliability of tape is not a single number stamped on a drive. It is a system you assemble, and you choose how much of it you need.
For routine data, the drive’s own four-nines operational reliability, plus the basic discipline of verifying your writes, may be enough. For important data, a second copy has been the proven answer for decades. For the irreplaceable and the regulated, where eleven nines is the bar, erasure coding across and within tapes is the current state of the art, and it reaches that bar at a cost and power profile copies cannot match.
One thing is not optional at any tier: verification. Whatever protection you layer on, it is only as trustworthy as your confidence that the data is actually readable, and that confidence comes from separate reads and fixity checks, not from a write that merely completed.
Done that way, tape’s reliability stops being the liability the spec-versus-field gap might suggest and becomes a genuine strength. With verification and modern erasure coding, tape reaches the same eleven-nines durability that defines premium cloud object storage, on a medium that costs a fraction as much to buy, draws no power at rest, and will still be readable decades from now. The drive gives you four nines. What you build around it gives you the rest.
Sources
- Turguy Goker (Quantum; chair, INSIC tape-technology roadmap), Tape Roadmap and Challenges with using new High Areal Density Tapes, IEEE technical presentation, September 12, 2025. https://events.vtools.ieee.org/m/491103
- INSIC, Global Trends, Applications and Use Cases for Tape Adoption (2024 Tape Technology Roadmap). https://insic.org/roadmap/
- Quantum Corp. (inventors incl. T. Goker), U.S. Patent 11,216,196 B2, Erasure coding magnetic tapes for minimum latency and adaptive parity protection feedback. https://patents.google.com/patent/US11216196B2/en
Pete Paisley is the host of the LTO Show, the premier podcast for leaders in the LTO tape storage hardware community. Reach out with story ideas or comments at pete@ltoshow.com. Copyright 2026 The LTO Show and Pete Paisley. Linear Tape-Open, LTO, the LTO logo, Ultrium and the Ultrium logo are registered trademarks of Hewlett Packard Enterprise, IBM and Quantum. All product and company names are trademarks of their respective holders.