Adding to this: undo is also written to the redolog, so undo is
protected by redo log.
Apart from a lost redo log, one can always rollback and roll forward.

--
Sybrand Bakker
Senior Oracle DBA