-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathindex.html
2634 lines (2489 loc) · 125 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!--
this is the head file that contains the headers section
.. upto the start tag of the body section
please make sure that this file contains other contents before the first file starts
-->
<!DOCTYPE html>
<html>
<head>
<title>Flash Memory Research: Comprehensive Guide</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
.collapsible {
background-color: #777;
color: white;
cursor: pointer;
padding: 2px;
width: 100%;
border: none;
text-align: left;
outline: none;
font-size: 15px;
}
.active, .collapsible:hover {
background-color: #555;
}
.content {
padding: 0 18px;
display: none;
overflow: hidden;
background-color: #f1f1f1;
}
</style>
</head>
<body>
<h1 align="center">Flash Research Comprehensive</h1>
<hr>
<p align="center">Prawar Poudel</p>
<p align="center">prawar(dot)poudel(at)hotmail(dot)com</p>
<hr>
<hr>
<button type="button" class="collapsible"> About this document</button>
<p>This document contains short description about all the research items read by Prawar Poudelduring his/her course of research. The items studied can be categorized into following classes.</p>
<p>Please follow the link below to jump to respective section:</p>
<p>
<ul><li><a href="#nvm_introduction">NVM Introduction</a></li><li><a href="#flash">Flash Memory</a></li><li><a href="#flash_security">Security Primitives in Flash Memory</a></li><li><a href="#flash_puf">Flash PUFs</a></li><li><a href="#flash_sanitization_paper">Sanitization of Flash Memory</a></li><li><a href="#ssd_papers_study">SSD papers</a></li><li><a href="#sram">SRAM</a></li><li><a href="#dram">DRAM</a></li><li><a href="#sram_dram_security">Security Primitives in SRAM and DRAM</a></li><li><a href="#fram">FRAM</a></li><li><a href="#rram">RRAM</a></li><li><a href="#mram">MRAM</a></li><li><a href="#pcm">PCM</a></li><li><a href="#optane">Optane</a></li><li><a href="#file_system_study">Study of File Systems</a></li><li><a href="#magnetic_disk">Magnetic Disks</a></li><li><a href="#other_study">Others</a></li>
</ul>
</p>
<hr>
<hr>
<h2 align="center"><a name="nvm_introduction">NVM Introduction</a></h2>
<button type="button" class="collapsible"> <i>Please Click Here to Expand: NVM Introduction</i></button>
<div>
<p>
Memory forms an integral component of every computing systems. These are the parts of the computer that are used for storage and retrival of code and data that are essential for operation of computers. It is these retrival of code and data the makes these computers or computing systems perform all the tasks that we, the user, instruct them to do.
</p>
<p>
When the term "memory" is used, it generally means the Random Access Memory (RAM) or the memory where the instructions for current (and maybe more) operations are stored. But, this is just a small part of memory system in a computer system. Now a reader might be wondering where the bulk files, multimedia, etc are stored. There is another memory, which is more generally called "storage". It is in this storage system that all bulk files are stored. In the conventional workstation computer settings, Magnetic Disks form the storage system. Nowadays, Solid State Drives (SSDs) are getting traction as well for storage purposes.
</p>
<p>
In the conventional computer settings, memory or RAM is composed of Dynamic Random Access Memory (DRAM). These memory loose their content when the power is removed, thus they form "Volatile Memory". Another example of volatile memory is SRAM, which is extensively used in caches in conventional PC settings while in embedded systems SRAM is used to serve as RAM.
</p>
<p>
Magnetic Disks and Optical Disks are some of the non-volatile memory as they do not remove their content when the power is turned off. These devices store the content as physical change in them, and this physical change do not depend on the power being supplied. However for SRAM and DRAM, they need to be supplied with power in order for them to function or retain their content.
</p>
<p>
Both the kinds of non-volatile memory (NVM) presented above, namely, Magnetic and Optical Disks are not semiconductor based. Thus, when people talk about NVM, these two are kind of left out. We will present a short description of these in the below section, however, they will not be major focus.
</p>
<p>
Semiconductor NVMs are based on the similar principle as Magnetic and Optical Disks in the sense that the content or the data to be stored in them are etched as a change in their physical property and they do not need a constant supply of power to hold the power. Flash Memory are currently the major semiconductor right now, and it has still not realized its full market potential. As metioned above, flash memories are used for storage purpose in newer computing systems as SSD drives while they have found their majoirty usage in portable storage media. In low-end computing systems, a special kind flash memory is even used for RAM memories. We will see about different kinds of flash memories in later sections.
</p>
<p>
Other semiconductor NVMs are listed below:
<ul>
<li>
Resistive Random Access Memory (RRAM)
</li>
<li>
Ferroelectric Random Access Memory (FRAM)
</li>
<li>
Magnetic Random Access Memory (MRAM)
</li>
<li>
Phase Change Memory (PCM)
</li>
<li>
3D Cross Point (Optane)
</li>
</ul>
</p>
<p>
Each of these have their separate sections below. Please find the approprite section and study the further descriptions presented. On each of the topics, will present a brief introduction and some relevant papers and their discussion.
</p>
</div>
<hr>
<hr>
<h2 align="center"><a name="flash">Flash Memory</a></h2>
<button type="button" class="collapsible"> <i>Please Click Here to Expand: Flash Memory</i></button>
<div>
<p>
<button type="button" class="collapsible"><i>List of Papers Studied </i></button>
<div>
<p>
Following are the papers studied:
<ul>
<li>
<a href="#flashbasics">Basics of Flash Memory</a>
</li>
<li>
<a href="#flashtypes">Types of Flash Memory</a>
</li>
<li>
<a href="#3dflash">Architectural and Integration Options for 3D NAND Flash Memories</a>
</li>
<li>
<a href="#heatwatch3dnand">HeatWatch: Improving 3D NAND Flash Memory Device Reliability by Exploiting Self-Recovery and Temperature Awareness</a>
</li>
<li>
<a href="#improving3D">Improving 3D NAND Flash Memory Lifetime by Tolerating Early Retention Loss and Process Variation</a>
</li>
<li>
<a href="#mlcnandthresholdvoltage">Threshold Voltage Distribution in MLC NAND Flash Memory: Characterization, Analysis, and Modeling</a>
</li>
</ul>
</p>
</div>
<hr>
<button type="button" class="collapsible"> <a name="3dflash">Architectural and Integration Options for 3D NAND Flash Memories</a></button>
<div class="content">
<p>
<ul>
<li>
The file can be found at <a href="https://www.mdpi.com/2073-431X/6/3/27">this link</a>
</li>
<li>
Different issues are faced upon by the feature size shrinking of flash memory.
</li>
<li>
Intrinsic phenomena like random doping fluctuations, random telegraphic noise and the electron injection statistics significantly reduce the margin between the threshold voltage distributions.
</li>
<li>
Multi bits per cell has made things worse reducing reliability and lifetime.
</li>
<li>
3D NAND flash has provided with a way to overcome all the limitations of planar flash memory.
</li>
<li>
Most of the 3D NAND rely on charge trap flash architecture while some rely on FG architecture.
</li>
<li>
In this paper, they discuss about the charge trap flash memory and 3D NAND architectures based on the CT process.
</li>
<li>
Following are two of the topological classification of different integration solutions:
<ul>
<li>
<b>Control Gate and Channel along the horizontal direction</b>: This includes 3D Stacked option which is the preliminary attempt to achieve 3D integration starting from planar technology.
</li>
<li>
<b>Control Gate along the horizontal direction and channel along the vertical direction</b>: This includes the architectures like BiCS, P-BiCS, and the V-NAND architecture from Samsung including VRAT, VSAT and TCAT.
</li>
</ul>
</li>
</ul>
<ol>
<li>
3D Stacked Architecture:
<ul>
<li>
first idea and straightforward idea that stacking multiple planar layers of memory arrays would yield 3D layer.
</li>
<img src="images/flash_1.PNG" align="center">
<li>
As shown in image above.
</li>
<li>
Here, drain and bitline contacts are shared between NAND strings belonging to different layers, while source/wordlines contacts and source/drain selectors are associated to separate layers.
</li>
<li>
Cost and process technologies considerations of this architecture can be derived from those of the planar products
</li>
<li>
the major hurdle is represented by the thermal budget of the manufacturing process to grow and populate additional layers
</li>
<li>
here each layer is manufactured separately and this the architecture is flexible.
</li>
<li>
Since the layers are fabricated independently, there is a significant difference in the threshold voltage distribution with ISPP programming.
</li>
</ul>
</li>
<hr>
<li>
BiCS Architecture:
<ul>
<li>
Control Gates are the different rectangles stacked on top of each other.
</li>
<img src="images/flash_2.PNG" align="center">
<li>
The bottom rectangle plate is the ensemble of Source Line Selectors terminating flash string.
</li>
<li>
Multiple holes are drilled through the stacks and filled with poly-silicon in order to form a series of vertically arranged NAND flash memory cells.
</li>
<li>
Bitline Selectors (BLS) and Bitlines (BL) contacts are on top of the structure
</li>
<li>
Each cell in the BiCS architecture works in depletion-mode since the poly-silicon constituting the body of the transistor is lightly n-doped with a uniform profile or even left un-doped. This reduces the manufacturing complexity of the p-n junction along the vertical direction of the plugs (also called pillars)
</li>
<li>
The CG plate intersection with a pillar maps a single memory cell. Each NAND Flash string of cells is connected to a BL contact via BLS, whereas the bottom of the string is connected to a common source diffusion formed directly on the process substrate made of silicon.
</li>
<img src="images/flash_3.PNG">
<li>
</li>
</ul>
</li>
<li>
P-BiCS
<ul>
<li>
BiCS evidenced some critical issues such as poor reliability characteristics of the memory cells interms of endurance and data retention, poor SLS performances (i.e., cut-off) and a high resistance of the SL, which limits the sensing performance
</li>
<li>
To solve these issues, a pipe-shaped BiCS architecture has been developed, namely the P-BiCS. This integration approach adopts a U-shaped vertical AND string
</li>
<li>
<img src="images/flash_5.PNG" align="center">
</li>
<li>
</li>
</ul>
</li>
<li>
VRAT Architecture
<ul>
<li>
Vertical Recess Array Transistor by Samsung
</li>
<li>
Still a charge trap layer is used
</li>
<li>
no staircase structure
</li>
<li>
<img src="images/flash_6.PNG" align="center">
</li>
<li>
</li>
</ul>
</li>
<li>
VSAT Architecture
<ul>
<li>
Vertical Stacked Array Transistor
</li>
<li>
<img src="images/flash_7.PNG" align="center">
</li>
</ul>
</li>
</ol>
</p>
</div>
<hr>
<button type="button" class="collapsible"> <a name="heatwatch3dnand">HeatWatch: Improving 3D NAND Flash Memory Device Reliability by Exploiting Self-Recovery and Temperature Awareness</a></button>
<div class="content">
<p>
<ul>
<li>
The original paper can be found at <a href="https://www.cs.cmu.edu/~yixinluo/index_files/heatwatch_hpca18.pdf">this link</a>
</li>
<li>
Damages in 3D NAND can be partially recovered by a process called "self-recovery"
</li>
<li>
Self recovery has been studied for 2D NAND before to improve lifetime. Proposal also included to increase temperature to accelerate self recovery
</li>
<li>
Heatwatch proposed to improve 3D NAND relability. Key idea is to optimize the read reference voltage (adapting it to the dwell time of workload and the current operating temperature).
</li>
<li>
Heatwatch:
<ul>
<li>
efficiently tracks flash memory temperature and dwell time online
</li>
<li>
sends this information to our reliability model to predict the current voltages of flash cells
</li>
<li>
predict the current voltages based on the current cell voltages
</li>
</ul>
</li>
<li>
Improves lifetime by 3.85X over the baseline that uses fixed reference voltage
</li>
<li>
Limited lifetime of NAND is because of wearout in flash cells by repeated programming and erase operations. After each PE cycle, the threshold voltage is affected because of the inadvertant trap of electrons in flash cell.
</li>
<li>
Some of these trapped electrons gradually escape during the idle time between the consecutive PE cycle. This time is called "dwell time"
</li>
<li>
This escape or detrapping is called self-recovery.
</li>
<li>
This can be accelerated by high temperature to the flash cell during the dwell time in 2D FG transistors.
</li>
<li>
But 3D NAND uses CT flash
</li>
<li>
Two effects shown in flash memory is studied in this paper:
<ul>
<li>
Retention Loss: Leakage of charge carriers from the flash cell that contains valid data, that can induce errors
</li>
<li>
Program Variation: Random variation that can cause cell to be set to an incorrect voltage while programming
</li>
</ul>
</li>
<li>
Some of the findings made are as follows:
<ul>
<li>
increase in dwell time from 1 to 137 min slows retention loss by 40%
</li>
<li>
lowering temp from 70 to 0 C slows retention loss by 58%
</li>
<li>
increasing temperature from 0 to 70 C during programming increases program variation by 21%
</li>
<li>
effectiveness of self-recovery is correlated with dwell time experienced during the most recent 20 PE cycles
</li>
</ul>
</li>
<li>
<img src="images/flash_4.PNG" align="center">
</li>
<li>
Errors in 3D NAND is dominated by retention errors. Thus, reducing retention errors by performing recovery cycles can increase lifetime. Recovery cycle means PE operation where program operatin is followed by an extended dwell time.
</li>
<li>
High temp increases electrom mobility. Thus short retention time in high temperature has same retention loss as long retention time at room temp.
</li>
<li>
And short dwell time at high temp as same self recovery effect as long dwell time at room temp.
</li>
<li>
<b>They refer to other papers [8,12,24] for technique to find the threshld voltage values. </b>
</li>
<li>
Read retry and the above technique is used to detect threshold voltage and fine tune it.
</li>
</ul>
</p>
</div>
<hr>
<button type="button" class="collapsible"> <a name="improving3D">Improving 3D NAND Flash Memory Lifetime by Tolerating Early Retention Loss and Process Variation</a></button>
<div class="content">
<p>
<ul>
<li>
Following is derived from the paper at <a href="https://arxiv.org/pdf/1807.05140.pdf">this link.</a>
</li>
<li>
3D NAND uses new flash cell design that vertically stacks dozens of silicon layers in a single chip.
</li>
<li>
Due to the difference in the physical orfanization at circuit level and structural level, there are three new error sources:
<ul>
<li>
Layer to layer process variation: Average error rate of each 3D stacked layer is significantly different. Raw bit error rate at the middle can be 6x that of top layer.
</li>
<li>
Early Retention Loss: A new phenomenon where the number of error due to charge leakage increases quickly within several hours (~3 hours) after programming, and then increases at a much lower rate.
</li>
<li>
Retention Interference: Rate at which charge leaks from a flash cell depends on the data value stored in the neighbouring cell. Charge leaks at a lower rate when the vertically adjacent cell is in a state that holds more charge.
</li>
</ul>
</li>
<li>
Different techniques are proposed for mitigation of various process variation and early retention loss.
<ul>
<li>
LaVAR or Layer Variation Aware Reading: Reduces the effect of layer to layer process variation by fine-tuning the read reference voltage separately for each layer.
</li>
<li>
LI-RAID or Layer Interleaved Redundant Array of Independent Disks: Intelligently groups pages under the RAID error recovery technique using the info about layer to layer process variation
</li>
<li>
ReMAR or Retention Model Aware Reading: Reduces the retention errors by tracking the retention time of data using the retention model (new model they propose) and adapts read reference voltage to data age
</li>
<li>
ReNAC or Retention Interference Aware Neighbour Cell Assisted Correction: Adapts the read reference voltage to the amount of retention interference a page has experienced in order to re-read the data after a read operation fails.
</li>
</ul>
</li>
<li>
These four techniques can be combined together to improve the flash reliability.
</li>
<li>
Most of the studies that have been done are based on planar NAND flash memory that are based on floating gate transistor. 3D NAND are however based on charge trap transistor where the charge is stored within an insulator. Here multiple layers of silicon are stacked together (typically 24 to 96 layers).Thus 3D NAND flash can be manufactured at higher technology node as 30-50 nm as compared to highly compact 10-15 nm for planar NAND.
</li>
<li>
Following are the errors that has been widely documented in planar NAND flash memory:
<ul>
<li>
Process Variation Error: Error due to fabrication process and lithography limitiations.
</li>
<li>
Retention Error: With time, charge leaks off the flash cell after being programmed. Refresh technique is required.
</li>
<li>
Write-Induced Error: Warout error.
</li>
<li>
Cell-to-Cell Interference Error: Increase in threshold voltage of a cell (and eventually RBER) when adjacent flash cell is programmed.
</li>
<li>
Read Induced Error: Application of pass through voltage during read operation causes weak programming effect. The values of flash cell may change in multiple read operations.
</li>
</ul>
</li>
<li>
However 3D NAND differs from planar NAND in many ways as following:
<ul>
<li>
Flash Cell Design:
<ul>
<li>
Planar memory uses storage of charge in FG, but 3D uses Charge Trap transistors.
</li>
<li>
In CT flash, a cylindrical substrate is between charge trap insulator layer that is radially wrapped inside control gate.
</li>
<li>
Charge Trap layer stores the charge, but is insulator (as oppposed to FG).
</li>
</ul>
</li>
<li>
Chip Organization:
<ul>
<li>
BL in planar NAND connects (source and drain of) the flash cells from different pages in a block.
</li>
<li>
BL in 3D NAND, which is CT, connects one charge trap cell from each layer of the chip as cells are stacked on top of each other. All the cells in a single stack (z-axis) share the same charge trap insulator.
</li>
<li>
CG in the same layer are connected through a Word Line in Y-axis. The number of WLs in a block is proportional to the length (height) of BL.
</li>
<li>
Multiple blocks are aligned in X-axis to form a flash chip.
</li>
</ul>
</li>
<li>
Manufacturing Process Technnology:
<ul>
<li>
3D NAND uses much larger mnufacturing technology (30-50 nm) as compared to planar 3D NAND flash memory (10-15 nm).
</li>
</ul>
</li>
</ul>
</li>
<li>
They use read-retry command to fine-tune the reference voltage for each read operation. (refs 9 and 14). This changes the read reference voltage by a small step called <i>voltage step</i>.
</li>
<li>
Metrics are
<ul>
<li>
RBER: is the rate at which errors in the data before error correction.
</li>
<li>
Change in Threshold Voltage Distribution: How it changes with different sources of errors. They use read retry method to sweep over all the reference voltages to identify the threshold voltage (using techniques as in refs 14, 64 and 81).
</li>
</ul>
</li>
<li>
Layer to Layer Process Variation:
<ul>
<li>
The chips used have 30-40 layers and the observations are normalized to 100 layers for anonymity of the manufacturer. It is also not known from paper how they distinguish between flash cells in differet layers.
</li>
<li>
Variation exists in all three axis. However, most prominent is in the z-axis because of difficulty in stacking multiple layers in top of each other.
</li>
<li>
Prior work has shown that no etching tech can are able to produce identical 3D NAND cells while punching through multiple stacked layers
</li>
<li>
For characterization, each pages in the blocks are programmed with some random data such that each page has faced 10K PE cycles. Then comparison of collective characteristics of flash cells in a layer is made with another layer. (Repeated in multiple chips)
</li>
<li>
The plot for number of errors in each layer of a 3D NAND flash cell (for MLC) while transitioning from ER<->P1, P1<->P2 and P2<->P3 is plotted while another plot showing error with in MSB and LSB pages are plotted.
</li>
<li>
Error for ER<->P1 is significantly large while the error for P1<->P2 is also large across layers. However error for P2<->P3 remain similar across layers. (This shows that ER threshold voltage varies significantly across layers)
</li>
<li>
MSP and LSB errors vary significantly across layers. <i>This is termed as layer-to-layer process variation.</i>
</li>
<li>
MSB errors are higher than LSB errors in most of the layers. This is because reading MSB requires two reference voltages while reding LSB requires single reference voltages.
</li>
<li>
The top half of the layers have low error rates than bottom half because of flash cell size varies across layers.
</li>
<li>
The observed pattern of error is consistent in another different chip as well.
</li>
<li>
Optimal Read Reference voltage vary across layers as well. The optimal reference voltages (Va and Vb) vary significanlty across layers but Vc does not change much. This is because process variation affects ER and P1 state while threshold voltage distribution of P2 and P3 states are controlled by ISPP that is similar across multiple layers.
</li>
<li>
Va and Vb are low for top half of layers than for bottom half.
</li>
</ul>
</li>
<li>
Early Retention Loss:
<ul>
<li>
For a larger retention analysis, they program 11 flash blocks in a chip and write a pseudo random data to each page of the block. The memory is worn out where each block is exposed to different PE cycles (each blocks from 0K to 10K, thus 11 blocks). It is left for 24 days at room temperature.
</li>
<li>
For measuring retention loss, RBER and the threshold voltage distribution is measured at 9 retention times from 7 minutes to 24 days. Only frst 72 flash pages in each bolcks are used in measurement so that other errors would not affect observation.
</li>
<li>
Observation is that retention rate changes very slowly for planar NAND than 3D NAND. ALthough 3D has very less RBER initially, after 2 hours of retention time, it quickly outgrows planar RBER. RBER increases by the order of 10^4 in 3 hours and 10^6 in 11 days.
</li>
<li>
Retention Error flattens out after time in order of 10^7 seconds.
</li>
<li>
Early retention loss is caused by two possible reasons:
<ul>
<li>
Tunnel Oxide is thinner in 3D NAND for faster programming.(since it should act as insulator but since being thinner is susceptible to leakage).
</li>
<li>
Cells in the same bit line share the same charge trap layer. This causes the charge in one cell to quickly leak to another cell in the same bit line due to <i>Electron Diffusion</i>.
</li>
</ul>
</li>
<li>
Optimal Read reference voltage also changes with retention time.
<ul>
<li>
Va remains fairly constant while Vb and Vc decreases with increase in retention times.
</li>
</ul>
</li>
</ul>
</li>
<li>
Retention Interference
<ul>
<li>
This means that the speed of retention loss of a cell depends on the threshold voltage of a vertically adjacent neighbour cell (shared charge trap layer).
</li>
<li>
If two cells have different threshold voltages, charge can leak from cell with higher threshold voltage to the cell with a lower threshold voltage.
</li>
<li>
Same observation from retention loss is used to observe retention interference.
</li>
<li>
However, only the neighbouring cells that are programmed before victim cells are used for interference correlation computation. Victim cells in ER state are also ignored because they are significantly affected by program interference even though they are programmed after neighbour cell. (These are done to remove noise due to program interference.)
</li>
<li>
For retention interference, all victim cells are grouped together based on their threshold voltage states and the states of neighboring cells. Then the shift in threshold voltage after 24-day retention time was compared.
</li>
<li>
The observation was that the change in reference voltage in terms of voltage steps shows correlation with the neighboring cell voltage.
</li>
</ul>
</li>
<li>
No evidence of program error was found in 3D NAND
</li>
<li>
PE cycling error is present in 3D NAND similar to planar NAND
</li>
<li>
3D NAND face less program interference than planar NAND.
</li>
<li>
Read disturb error is very weak so much so that it does not require any error mitigation.
</li>
<li>
LaVAR: Layer Variation Aware Reading
<ul>
<li>
to account for layer to layer process variation, how much should the reference voltage be offset? (instead of using a single reference voltage for entire block)
</li>
<li>
LaVAR learns the offset for each layer and records them in per chip table in SSD controller
</li>
<li>
uses this variation aware Vopt during read operation by reading appropriate voltage offset for the request from the per chip table that corrsponds to the layer of request.
</li>
<li>
since there are limited number of layers, this can be represented as a table between thet variation agnostic voltage and the optimal voltage for each layer
</li>
<li>
since the change in reference voltage follows similar pattern with PE cycles across different blocks, rigorous analysis of a single block should provide model for all blocks.
</li>
<li>
LaVAR uses read retry functionality in modern NAND flash chips to find variation aware Vopt (optimal read referece voltage).
</li>
<li>
Vc does not need to be changed while Va and Vb needs to be changed and the overhead is 2N bytes for N layers.
</li>
</ul>
</li>
<li>
LiRAID: Layer Interleaved RAID
<ul>
<li>
To tolerate chip to chip variation, RAID technique is used in modern SSDs. RAID in SSDs combine pages from multiple chips into a logical unit called a super group and uses one of the pages to store parity information. But they do not consider layer to layer variation
</li>
<li>
Instead of grouping pages in the same layer together in the same group, pages from different chips and different layers are grouped together so that new group has evenly distributed RBERs in LiRAID.
</li>
<li>
In a case with m chips in an SSD, each RAID group contains m pages one from each chip.
</li>
<li>
If there are n wordlines, then LiRAID groups MSB page of wordline 0 with LSB page of word line n/m, MSB page of 2*n/m and so on, MSB page of wordline (m-2)*n/m, LSB page of (m-1)*n/m. Thus combines LSB and MSB pages and combines different layers in a group.
</li>
</ul>
</li>
<li>
ReMARL Retention Model Aware Reading:
<ul>
<li>
Retention loss occurs after programming a page. RBER of early loss is logarithm of the retention time which means majority of threshold voltage shifts occurs shortly after the programming operation.
</li>
<li>
Idea here is to track the retention time and apply appropriate optimal read reference voltage.
</li>
<li>
Prediction of optimal Va, Vb and Vc are done. Va is not affected by retention time while Vb and Vc are modeled with retention time dependency (result obtained from above).
</li>
<li>
A sweeping read reference voltage learning is performed on one of the block to learn the optimal read reference voltage to construct the model <i>online</i>
</li>
<li>
SSD controller must store the PE cycle count and the program time of each block.
</li>
</ul>
</li>
<li>
ReNAC: Retention Interference Aware Neighbour Cell Assisted Correction
<ul>
<li>
Data stored in vertically adjacent cell to predict the amount of retention interference on a victim cell.
</li>
<li>
A model is generated online for retention interference as a function of retention time and neighbour cells state.
</li>
<li>
A read offset is computed for each block and is applied to the read threshold voltage.
</li>
<li>
(This method did not yield significant improvement)
</li>
</ul>
</li>
</ul>
</p>
</div>
<hr>
<button type="button" class="collapsible"> <a name="mlcnandthresholdvoltage">Threshold Voltage Distribution in MLC NAND Flash Memory: Characterization, Analysis, and Modeling</a></button>
<div class="content">
<p>
<ul>
<li>
This paper uses <i>read retry</i> command in MLCs of 2Y nm technology for threshold voltage modeling
</li>
<li>
Experimental measurement based characterization of threshold voltage distribution present in some 2Y flash memory
</li>
<li>
For a flash cell with 2-bits, there are 2^2 or 4 states. This needs 2^2-1 or 3 read reference voltages, thus creating 4 regions of threshold voltage distribution.
</li>
<li>
During a read operation, the threshold voltage is a cells is iteratively compared to predefined read reference voltages until the upper and lower bound are identified to determine the n-bit stored value
</li>
<li>
In earlier flash design, read reference voltages are fixed in design time. But newer flash memories below 30 nm have a technique to address the distorted threshold voltage distribution. (Due to different reasons like PE cycling, retention loss, program disturb etc, the otherwise non-overlapping regions of voltage distributions might overlap or corss the fixed boundary. This may lead to value being misread).
</li>
<li>
Read retry allows the voltage to be dynamically adjusted to track changes in distributions.
</li>
<li>
Two new commands are required on the controller side:
<ul>
<li>
Set REF: sets the reference voltaage to a new value
</li>
<li>
Get REF: checks the set value of the read reference voltage
</li>
</ul>
</li>
<li>
As the reference voltage can be finely tuned, we can divide the threshold voltage to multiple bins, and the values read can be changed.
</li>
<li>
Change in the threshold voltage due to PE cycling can also be done using the same technique.
</li>
<li>
For the 3D NAND chip at our disposal, the host controller issues the SET FEATURES (EFh) or SET FEATURES by LUN (D5h) command to feature address 89h with P1 subfeature set to a read retry option, as defined in that feature address. A new NAND array READ operation can now be performed.
</li>
</ul>
</p>
</div>
</p>
</div>
<hr>
<hr>
<h2 align="center"><a name="flash_security">Security Primitives in Flash Memory</a></h2>
<button type="button" class="collapsible"> <i>Please Click Here to Expand: Security Primitives in Flash Memory</i></button>
<div>
<p>
</p>
</div>
<hr>
<hr>
<h2 align="center"><a name="flash_puf">Flash PUFs</a></h2>
<button type="button" class="collapsible"> <i>Please Click Here to Expand: Flash PUFs</i></button>
<div>
<p>
<p>
The concept presented here in bullets are presented from the paper <a href="https://spqrlab1.github.io/papers/holcomb_PUFs_date14.pdf">PUFs at a Glance</a>
<ul>
<li>
It is difficult to hold the secret key a secret in practice and have it permanently store as a secret. Some systems may not even have NVMs.
</li>
<li>
Thus derive keys using random physical disorder or manufacturing variations in the devices such that even the manufacturers cannot recreate them.
</li>
<li>
A PUF is deliberately designed making use of such variation that is an disordered physical system. It responds by providing a response to an external stimuli or challenge.
</li>
<li>
PUFs differ from the normal digital circuits or systems in the sense that they work at the stability limits ie they are prone to errors. For the correction of such errors to produce stable output, two approaches are used:
<ul>
<li>
First: Use of helper data. Helper data is derived in earlier generation of response and are stored somewhere in NVM. They can be constructed such that it can be known to the adversary without compromising the secrecy of PUF, ie it need not be secret.
</li>
<li>
Second: Technique is to design the PUF system or protocol with inbuilt error tolerances.
</li>
</ul>
</li>
<li>
Weak PUFs:
<ul>
<li>
Characterized by a few challenges, commonly one challenge per instance of PUF
</li>
<li>
The challenge-response mechanism of the PUF should be access restricted.
</li>
<li>
The response of the limited challenges is known to manufacturer and other limited number of parties outside the hardware.
</li>
</ul>
</li>
<li>
Strong PUFs:
<ul>
<li>
More complex challenge response behavior. Large number of possible challenges can be applied. And even if the adversary knows a subset of CR pairs, s.he cannot extrapolate the behavior.
</li>
<li>
they can remain unprotected because of availablity of large number of CR pairs.
</li>
</ul>
</li>
</ul>
</p>
<button type="button" class="collapsible"> <i>List of Papers Studied</i></button>
<p>
Following is the list of papers studied while creating this document. The description of each papers are maintained and linked here so it would be easy for anyone doing a survey to fetch the appropriate description in timely fashion.
<ul>
<li>
<a href="#prabhu1">Paper: <i>Extracting Device Fingerprints from Flash Memory by Exploiting Physical Variations</i></a>
</li>
<li>
<a href="#wang1">Paper: <i>Flash Memory for Ubiquitous Hardware Security Functions: True Random Number Generation and Device Fingerprints</i></a>
</li>
<li>
<a href="#xu1">Paper: <i>Understanding sources of variations in flash memory for physical unclonable functions</i></a>
</li>
<li>
<a href="#jia1">Paper: <i>Extracting Robust Keys from NAND Flash Physical Unclonable Functions</i></a>
</li>
<li>
<a href="#sanu1">Presentation: <i>Energy Efficient Circuits for Entropy Generation and Secure Encryption</i></a>
</li>
<li>
<a href="#mandadi1">Thesis: <i>Remote Integrity Checking using Multiple PUF based Component Identifiers</i></a>
</li>
<li>
<a href="#clark1">Paper: <i>Reliable techniques for integrated circuit identification and true random number generation using 1.5-transistor flash memory</i></a>
</li>
<li>
<a href="#sakib1">Paper: <i>An Aging-Resistant NAND Flash Memory Physical Unclonable Function</i></a>
</li>
<li>
<a href="#erasesuspend1">Paper: <i>Extraction of Device Fingerprints using Built-In Erase-Suspend Operation of Flash Memory Devices</i></a>
</li>
<li>
<a href="#eFlash">Paper: <i>Lightweight Integrated Design of PUF andTRNG Security Primitives Based on eFlashMemory in 55-nm CMOS</i></a>
</li>
</ul>
</p>
<hr>
<button type="button" class="collapsible"> <a name="prabhu1">Paper: <i>Extracting Device fingerprints from Flash Memory by Exploiting Physical Variations</i></a></button>
<div class="content">
<p>
This paper discusses seven techniques for generating fingerprints from flash memory. Published in 2011, the author P Prabhu was affiliated with UCSD while collaborators are from Cornell University. The original paper can be found at <a href="https://dl.acm.org/doi/10.5555/2022245.2022264">this link</a>. Their conclusion is the four of the seven techniques provide usable signatures.
</p>
<p>
The set up consists of Xilinx FPGA connected to the flash chip through a custom built flash controller. The measurements can be made with a resolution of 10ns.
</p>
<p>
<ul>
<li>
<p>
<b>Program Disturb</b>: It is possible for two bits in separate pages to electrically influence each other. Program operation in a page might induce an mild programming force in an unselected word line. For generation of signature, repeated program operation is performed in a page. After each program operation, the state of adjacent page is read out to record the number of program operations required to cause the flip in each bit of adjacent page. This operation is performed for all the bits in the adjacent page. The number of program operations performed is limited to 10000. For the bits that are not affected, the value of 0 is recorded.
</p>
<p>
The signature is page based and thus thousands of signatures can be extracted from a single flash memory. The time it takes is between 1-5 minutes.
</p>
</li>
<li>
<p>
<b>Read Disturb</b>: The idea behind read disturb is similar to Program Disturb. Since for read operation, a small current has to be suppled as read current, this current might influence adjacent flash page over a number of times.
</p>
<p>
The number of read operations in a flash page to influence adjacent flash page is limited to 10 million times while the state of adjacent flash page is read after every 1000 read iterations. Despite having good metrics for correlation (high for signature generated from a single page while almost 0 for those from different pages), it is too slow process. It almost took 6 hours to have useful signature for MLC chips.
</p>
</li>
<li>
<p>
<b>Program Operation Latency</b>: This technique is based on per-bit variation in program latency.Program operation is performed one bit at a time and the latency is recorded such that a single bit contributes a single value to the fingerprint. There are two following variations of the technique as discussed below:
</p>
<p>
<ul>
<li>
<p>
<i>Single Page</i>: Following steps are followed for fingerprint generation:
<ul>
<li>Erase the block.</li>
<li>Program each bit in a page within a block as follows:</li>
<ul>
<li>First program operation programs a single '0' followed by ones.</li>
<li>Second program operation programs two '0's followed by ones.</li>
<li>.. and so on.</li>
</ul>
</ul>
</p>
</li>
<li>
<p>
<i>Multi Page:</i>Following steps are followed for fingerprint generation:
<ul>
<li>Erase the block</li>
<li>Program just the nth bit in page n.</li>
<li>.. and so on.</li>
</ul>
</p>
</li>
</ul>
</p>
</li>
<li>
Other proposals that were deemed unuseful are as follows:
<ul>
<li>
<b>Erase Lantency</b>:
<p>
Measure the erase latency for each block in a device and use the resulting sequence of values to form a signature. Offered very little variation, and were inconsistent for individual blocks.
</p>
</li>
<li>
<b>Read Lantency</b>:
<p>
Per-page read latency varied very little. In SLC, read latency was constant over entire device.
</p>
</li>
<li>
<b>Whole Page program Latency</b>:
<p>
Whole page program latency offered very little vairation to offer good signature.
</p>
</li>
<li>
<b>Program/Erase Wear</b>:
<p>
Measuring each bits susceptibility to error because of program/erase induced wear took several hours to extract signature thus making this method ineffective.
</p>
</li>
</ul>
</li>
</ul>
</p>
</div>
<hr>
<button type="button" class="collapsible"> <a name="wang1">Paper: <i>Flash Memory for Ubiquitous Hardware Security Functions: True Random Number Generation and Device Fingerprints</i></a></button>
<div class="content">
<p>
This paper demonstrates NAND flash memrory as a source of entropy for TRNG and PUF generation, and is work done by Wang et al at Cornell University. The idea is based on repeated partial program operation on the flash memory. The original paper can be found at <a href="https://ieeexplore.ieee.org/document/6234403">this link</a>.
</p>
<p>
For RNG, they make use of the Random Telegraphic Noise (RTN) as the source of randomness. RTN is the alternating capturing and emission of carriers at a defect site in a very small electronic device. This capturing and emission, that is random and exponentially distributed, generates discrete variation in the channel current.
</p>
<p>
To observe this noise, the flash memory needs to be in unreliable state so that noise effects the outputs. Thus partial program operation is used to achieve this state that is in-between erased and programmed state. The initial algorithm is described as follows:
<ol>
<li>The flash memory block is partially programmed. The duration of partial program applied is T (unspecified)</li>
<li>
The flash memory block is read N times.
</li>
<li>
Then, for each of the bits, it is checked if there exists RTN.
</li>
<li>
If it does, the number of partial program operation it took is noted, and the bit position is marked as selected.
</li>
<li>
This partial program operation is repeated until all the bits are marked selected. Go to step 1.
</li>
</ol>
The second part of the algorithm, then can be used to generate RNG.
<ol>
<li>Partial program the flash cell to appropriate levels (as dictated by the number of partial program operations from above) </li>
<li>Read each bit M times</li>
<li>Record the sequence of up-times and down-times. Since it is RTN, the duration of being up-times and down-times are randomly distibuted.</li>