What does fixed BOM mean for an SSD, SD card or eMMC?

It means the supplier controls the important configuration — normally NAND flash, controller and firmware, and sometimes the PCB and other components — so it is not substituted silently. If a controlled item must change, the supplier follows a product-change process and identifies the new configuration.

Is a fixed BOM the same as guaranteed lifetime supply?

No. BOM control governs configuration changes; longevity governs how long a product remains orderable. A good industrial program addresses both, but NAND and controllers still reach end of life. Ask separately for the supply horizon, PCN notice, last-time-buy process and replacement roadmap.

Do all industrial storage products have a fixed BOM?

Do not assume so from the word “industrial.” Policies vary by supplier and product family. Require the controlled components, revision rules and notification process in writing, then match the received lot to the approved sample.

Fixed BOM in industrial flash: the spec that keeps qualified products qualified

An OEM can qualify a storage device, approve the sample, place a repeat order six months later — and receive something materially different under the same retail-looking name. The label may still say 128 GB. The interface may still be SATA, SD or eMMC. But the NAND, controller or firmware can have changed.

That is why industrial buyers ask for a fixed BOM, also called a locked or controlled bill of materials. It is not paperwork for its own sake. It is the mechanism that keeps a qualified storage configuration from changing silently between batches.

What is actually fixed?

For flash storage, the critical BOM normally includes:

the NAND manufacturer, family and generation;
the controller;
the controller firmware and its revision;
the PCB and important supporting components, where applicable;
the product identifier or revision that ties the physical device to that configuration.

Cactus Technologies describes a stable industrial BOM as holding the controller, flash IC and low-level firmware constant. It also calls out logical geometry, capacity and device-identification data because the host can depend on those details [1]. Delkin's controlled-BOM definition similarly covers the flash, controller, firmware, PCB and other physical parts [2].

“Fixed” does not mean nothing can ever change. Components reach end of life, bugs get corrected and fabrication processes move on. It means a controlled item does not change invisibly. The buyer receives a product change notification (PCN), the new configuration is distinguishable, and there is time to test it before it reaches production.

Why the same capacity is not the same device

A flash device is a small storage system, not a passive bucket of bits. Its controller and firmware decide how data is mapped, cached, corrected and recovered. Change one part of that system and behavior can change even when the headline specifications do not.

The differences may appear in:

boot or enumeration compatibility;
sustained-write speed and worst-case latency;
power consumption and startup current;
behavior during an unexpected power cut;
error recovery, bad-block handling and wear levelling;
endurance and data retention;
device identifiers or timing that host software expects.

This is not a theoretical edge case. Delkin documents an OEM whose newer card configuration became incompatible with its application although earlier changes had not caused a problem [3]. The lesson is not that every component change fails. It is that you cannot know whether it matters without testing the changed configuration.

The cost is requalification, not the card

In a camera, gateway, medical instrument or industrial controller, storage may be a small line item. Requalifying it is not. A change can trigger regression tests, thermal and power-cycle testing, image validation, updated compliance records, engineering time and a production hold.

That makes the cheapest interchangeable card expensive when its internal configuration changes without warning. Fixed BOM shifts the decision from reactive firefighting to a planned lifecycle:

The supplier issues a PCN before the change.
The new BOM receives a new revision or part number.
The OEM obtains samples and reruns the required tests.
The buyer places a last-time order if transition stock is needed.
Production moves only after the replacement is approved.

Long-term availability is related but separate. Micron, for example, describes longevity programs in terms of form-fit-function continuity, roadmap visibility and extended conversion timelines [4]. A supplier can control its BOM yet offer a short product life, or offer a long roadmap with defined revisions. An OEM should ask for both.

Put these questions in the RFQ

“Industrial grade” on a datasheet is not enough. Ask the supplier to answer these in writing:

RFQ question	What a useful answer looks like
Which items are BOM-controlled?	NAND, controller and firmware named explicitly; PCB/components added where relevant
Can any of them change under the same part number?	A clear revision or part-number rule, not “equivalent parts may be used”
How are changes communicated?	Formal PCN sent to named contacts or through a customer portal
What is the advance-notice period?	A stated period that leaves time for samples and requalification
Is there a last-time-buy process?	Order deadline, delivery window and transition support
How do I identify the received revision?	Label, lot code, firmware ID or traceability report
Will production match the approved sample?	Written sample-to-mass-production configuration control
What is the supply horizon?	A product-family roadmap, not a vague “long life” claim

Also keep the approved sample, its firmware identification, the specification revision and the supplier's written answers together. Incoming inspection should verify the part number and revision before a new lot is released to production.

When fixed BOM is worth paying for

You probably need it when a storage change could force software changes, repeat certification, field service or downtime. Common cases include embedded Linux boot media, kiosks, surveillance recorders, medical devices, industrial automation, networking equipment and any product expected to ship unchanged for several years.

For a disposable consumer accessory, configuration control may add cost without adding much value. But for an OEM, the right comparison is not card price versus card price. It is controlled storage cost versus the cost of one surprise requalification or field failure.

Bottom line

A fixed BOM is a promise about change control: no silent substitution of the NAND, controller or firmware that your team qualified. The useful version of that promise includes a formal PCN, an identifiable new revision, requalification time and a last-time-buy path. Ask for those details before approving the sample — because once the product is in the field, “same capacity, same label” is not enough.