LUNAROPS · OPERATIONAL UPLINK 100% UPTIME 1,247d POSTS 893 JEFF.MOON@LUNAROPS.DEV UTC --:--:--

NAND Reliability Physics and Qual

19 min read The Physics of Computing
nandreliabilityjedecqualificationretentionendurance
Contents

There is exactly one physical fact you need to internalize before any NAND datasheet number makes sense: the same oxide layer you must violently push electrons through to write a cell is the oxide that has to quietly hold those electrons for years afterward. Programming and erasing damage the very barrier that retention depends on, so endurance and retention are not two independent specs — they are opposite ends of one budget, and every qualification standard in this space exists to pin down where on that budget a part is allowed to live. A drive rated for “600 TBW with one-year retention at 30C” is making a joint claim, and the only way to read it honestly is to understand the wear mechanism underneath. This post starts at the tunnel oxide, walks up through trap generation, stress-induced leakage current, detrapping, and the disturb taxonomy, and then turns to what JESD218 and JESD219 actually require, what they prove, what they conspicuously do not prove, and how the automotive AEC-Q100 grades change the math. By the end you should be able to look at a spec line and reconstruct the physics it is hiding.

The Tunnel Oxide Is the Whole Story

A NAND cell stores data as charge on a floating gate or in a charge-trap layer, and the amount of charge sets the cell’s threshold voltage (Vt). Reading is a comparison of Vt against reference levels; everything reliability-related is about whether those Vt distributions stay where you put them. (The cell physics is covered in how data lives on platters and flash, and the device underneath in how a transistor actually works.)

To program, the controller forces electrons across the tunnel oxide — a barrier on the order of single-digit nanometers — using Fowler-Nordheim tunneling under a field that exceeds 5 MV/cm. To erase, it reverses the field and pulls them back out. Each pass is a small act of violence against the oxide lattice. The field is enormous, the electrons are energetic, and a fraction of every program/erase (P/E) cycle goes not into moving charge but into breaking Si-O bonds and creating defects.

These defects are traps: localized electronic states sitting inside the oxide bandgap where, ideally, no states should exist. A fresh tunnel oxide is close to defect-free and behaves like a clean insulator. A cycled oxide is peppered with traps, and traps are the mechanism by which the rest of this story unfolds. The central, non-negotiable fact:

trap density in tunnel oxide  is monotonic in  cumulative P/E cycles

You cannot un-cycle a die. Trap generation is cumulative and essentially permanent over a part’s life. This is why endurance is finite and why a drive’s character genuinely changes as it ages — not metaphorically, but in measurable oxide chemistry.

SILC: How Traps Become Leakage

A single trap is an empty parking space inside the oxide. By itself it does little. The problem is trap-assisted tunneling: an electron that could never tunnel directly through a 7 nm oxide at low field can hop trap-to-trap, using the defects as stepping stones across the barrier. Add enough traps and a percolation path opens up where the oxide leaks charge at fields far below what an undamaged oxide would ever conduct at.

That leakage current is Stress-Induced Leakage Current (SILC), and it is the dominant retention killer in scaled NAND. The literature is precise about the mechanism: P/E cycling generates oxide traps, traps enable low-field conduction, and a programmed floating gate slowly bleeds charge through these paths even with no applied stress. The classic refinement is the two-trap (and trapped-hole-enhanced) model — a path requiring two appropriately aligned traps explains the anomalous, tail-heavy charge loss seen in cycled cells, where a small population of cells leaks far faster than the median.

Three consequences fall straight out of this:

  • SILC scales catastrophically with thinning. Below roughly 10 nm of tunnel oxide, SILC climbs steeply, because fewer traps are needed to bridge a thinner barrier. This is precisely why planar NAND hit a scaling wall and why 3D NAND architecture went vertical instead of shrinking the oxide further — keeping a thicker, more robust tunnel dielectric while gaining density through stacking.
  • SILC is a per-cell tail, not a uniform shift. Most cells are fine; a few leak hard. Reliability is a statistics-of-the-worst-cell problem, which is why ECC strength is dimensioned against distribution tails, not means.
  • SILC couples endurance and retention directly. More cycling means more traps means worse leakage means shorter retention. The endurance-retention trade is this physical chain, not an arbitrary marketing partition.

Detrapping and the Two Clocks of Retention Loss

Retention loss has two distinct components on two different clocks, and conflating them produces wrong intuitions.

The first is charge loss through SILC paths — electrons escaping the floating gate via trap-assisted conduction, described above. This degrades the high-Vt (heavily programmed) states most, because they have the most stored charge and the steepest field driving leakage. It is a slow, field-driven drain.

The second is charge detrapping. During programming, some electrons do not make it cleanly onto the floating gate; they get stuck in oxide traps near the storage node. These trapped charges contribute to the cell’s apparent Vt right after programming, then thermally emit out over time. As they leave, the cell’s measured Vt relaxes downward. This is a fast initial transient — much of it happens in the first hours to days after a write — and it follows Arrhenius kinetics with an activation energy measured at roughly 1.0 to 1.1 eV across generations and across 3D NAND (one widely cited 3D measurement lands at 1.04 eV).

   Vt (programmed state)
    ^
    |  *
    |   \           detrapping: fast transient, Arrhenius ~1.1 eV
    |    \____
    |         \________
    |                  \_____________  SILC charge loss: slow drain
    |                                \________________
    +---------------------------------------------------------> time
       hours      days        months              years

Why this matters for qual: because detrapping has a clean, repeatable activation energy, retention can be accelerated by temperature. Heat the part and the detrapping (and leakage) clocks run faster in a calculable way. That single fact is what makes a one-year retention claim testable in days, and it is the engine behind every retention spec you will ever read. The activation energy is the knob — and it is also the place where vendors can quietly cheat, which we will return to.

The Disturb Taxonomy

Wear and leakage move Vt over time. Disturbs move Vt as a side effect of normal array operation — accessing one cell perturbs its neighbors because NAND shares wordlines and bitlines down long strings. Three named mechanisms, all the same root cause (an unintended field on a cell you didn’t mean to touch), distinguished by when they happen.

Disturb type When it happens Voltage applied Effect on victim Vt Primary mitigation
Read disturb During reads of other cells on the string Vpass (~6 V) on unselected wordlines Slow upward shift (weak programming) Read counters, Vpass tuning, scrub/refresh
Program disturb During programming of other cells in the block Vpgm coupling + Vpass Upward shift on inhibited cells Self-boosting, program order, ECC
Pass disturb Accumulated Vpass exposure during programming Vpass on cells sharing the string Gradual upward shift Vpass optimization, block-level wear

Read disturb is the famous one. To read one cell, the array drives a pass-through voltage (Vpass, around 6 V) onto every other wordline on the string so those cells conduct regardless of their stored value. Vpass is well below the program voltage Vpgm, but it is not zero, and it produces a weak programming effect — electrons slowly creep onto unread cells, nudging their Vt upward. Read a hot block a few hundred thousand times and the accumulated nudges become bit errors. The mitigation is conceptually simple: shrink (Vpass − Vt) as much as the read margin allows, count reads, and refresh blocks that get hammered. This interacts directly with the margin accounting in the read window budget.

Program disturb and pass disturb are the program-time analogues: cells you are inhibiting (not meant to program) and cells merely sharing the string still see coupling and Vpass fields, and accumulate small upward shifts. Self-boosting schemes raise the channel potential of inhibited cells to suppress the field, but suppression is never perfect.

The crucial qual insight: disturbs are workload-dependent in a way that pure wear is not. Cycling count is roughly proportional to bytes written. Read disturb depends on the read/write ratio and on access locality — a read-mostly workload hammering a few blocks stresses disturb far harder than a benchmark that writes uniformly. This is the seam where a standardized synthetic test can pass while a real workload fails, and it is exactly why JESD219 exists.

JESD218: What “Endurance Rating” Actually Means

JESD218 (Solid-State Drive Requirements and Endurance Test Method) defines what it means for a drive to claim an endurance rating. The rating is TBW — terabytes written by the host — and the standard’s real contribution is to attach conditions to that number so two drives can be compared honestly. (The component-level testing that feeds this is the subject of how semiconductors are tested.)

JESD218 splits the world into two application classes, and the class is the entire ballgame:

Requirement Client class Enterprise class
Active-use temperature (power on) 40C, 8 hr/day 55C, 24 hr/day
Retention requirement (power off) 1 year at 30C 3 months at 40C
Functional Failure Requirement (FFR) ≤ 3% ≤ 3%
UBER target ≤ 1e-15 ≤ 1e-16

Read that table as a sentence. A drive earns its TBW rating only if, after being cycled to that TBW, it still meets its retention requirement, still meets its uncorrectable-bit-error-rate (UBER) target, and still keeps functional failures under the FFR cap. The endurance number is meaningless without all three riders. And note the deliberate asymmetry: enterprise drives get a shorter retention requirement (3 months vs 1 year) and a higher active temperature. That is not a downgrade — it reflects reality. Enterprise drives are rarely powered off, so they trade retention for endurance, exactly as the oxide physics permits.

The endurance rating is verified at the end of life: cycle the drive to its rated TBW (worst-case wear, maximum trap density), then prove retention from that exhausted state. This is the single most important thing to understand about the spec. “One year at 30C” does not mean a fresh drive holds data a year. It means a fully worn drive — one that has consumed its entire rated endurance — must still hold data for a year at 30C. The retention clock starts from the most damaged the part is ever allowed to be.

JESD218 permits two verification routes: direct (cycle, bake, read back, count errors) and extrapolation (measure error rates at several stress points and project to the requirement). Extrapolation is faster and standard, but it is only as honest as its model.

The Arrhenius Engine, and Where It Bends

Retention is accelerated by temperature via the Arrhenius relation. The acceleration factor between a stress (bake) temperature and a use temperature is:

AF = exp[ (Ea / k) * (1/T_use - 1/T_stress) ]

  Ea   = activation energy of the dominant mechanism (eV)
  k    = Boltzmann constant = 8.617e-5 eV/K
  T    = absolute temperature in KELVIN (not Celsius!)

Worked example — emulate 1 year at 30C with an 85C bake, using Ea = 1.1 eV:

  T_use   = 30C = 303.15 K
  T_stress= 85C = 358.15 K

  1/T_use   = 0.0032987 /K
  1/T_stress= 0.0027922 /K
  delta     = 0.0005065 /K

  Ea/k = 1.1 / 8.617e-5 = 12766 K

  AF = exp(12766 * 0.0005065) = exp(6.466) ~ 642x

  required bake time = (1 year) / 642 ~ 13.6 hours

So a roughly 13-hour bake at 85C stands in for a year at 30C — which matches the published JEDEC-style accelerated retention recipe almost exactly. This is genuinely powerful: an entire year of field retention validated in half a day.

Now the catch, and it is the most important sentence in this post for a qual engineer: the acceleration factor depends exponentially on Ea, and Ea is an assumption. Watch what happens if the true dominant mechanism has Ea = 0.8 eV instead of 1.1 eV but you plan your bake assuming 1.1 eV:

  At Ea = 0.8 eV:  AF = exp((0.8/8.617e-5)*0.0005065) = exp(4.703) ~ 110x

  Your 13.6-hour bake, which you BELIEVE buys 642x = ~1 year,
  actually buys only 110x = ~62 days of real 30C retention.

You would ship a part you thought you qualified for a year that in truth holds data for two months. Different mechanisms (detrapping vs SILC vs interface-state effects) have different activation energies, and the dominant one can shift with cycling and with technology node. A conservative qual uses a low Ea estimate (which demands a longer bake) and validates Ea independently rather than assuming the convenient number. This is the difference between a spec that means something and a spec that is exp() of wishful thinking.

JESD219: The Workload That Makes Endurance Honest

JESD218 tells you how much to cycle a drive and what to prove afterward. But “write 600 TB” is underspecified — how you write it changes the wear. A drive’s controller does wear leveling, garbage collection, and write amplification, and all three respond to the pattern of writes. Sequential, large-block writes barely amplify; small, random, hot-cold-mixed writes amplify badly, triggering more internal program/erase per host byte than the host ever asked for.

JESD219 (Solid-State Drive Endurance Workloads) is the companion standard that fixes this by defining the actual I/O traces used to wear the drive. It specifies separate client and enterprise workloads, with the client trace derived from real recorded I/O on a user PC and the enterprise workload reflecting server-like access. The workload pins down transfer-size distributions, the random/sequential mix, and the addressing pattern, so that “TBW under JESD219 client” is a reproducible, comparable quantity rather than each vendor’s favorite benchmark.

What JESD219 does well: it forces write amplification and wear-leveling behavior into the open, and it makes cross-vendor TBW numbers mean roughly the same thing. What it does not do — and this is the limitation to keep in front of you:

  • It is a fixed synthetic proxy, not your workload. If your production access pattern stresses read disturb (read-heavy, high locality) or has a hot-cold ratio the standard trace doesn’t capture, JESD219 can pass while your fleet sees errors the qual never exercised.
  • It standardizes the write pattern; disturb stress lives partly in the read pattern. A drive qualified to TBW under JESD219 has been proven against that trace’s read behavior, not against an arbitrary read-mostly workload.
  • Passing is necessary, not sufficient. It proves the part meets a defined bar. It does not prove the part survives your corner of the workload space.

This is the honest boundary of the whole standardized-qual enterprise: it makes a defined claim rigorously, and the defined claim is not a universal guarantee. The most expensive field failures live in the gap between the qual workload and the deployed one.

The AEC-Q100 Delta: Automotive Changes the Corners

Consumer JEDEC qual assumes a benign-ish thermal and lifetime envelope. Automotive throws that out. AEC-Q100 is the Automotive Electronics Council’s stress-test qualification for ICs, and it differs from consumer qual along several axes at once: tighter defect rates (PPM/PPB targets), longer mission profiles (10-15 year service life), zero-defect mindset, and — most visibly — temperature grades that redefine what “rated” means.

AEC-Q100 grade Ambient/Tj range Typical NAND placement
Grade 0 -40C to +150C Near engine / powertrain extremes
Grade 1 -40C to +125C Under-hood, body control, most automotive NAND
Grade 2 -40C to +105C Passenger-cabin, infotainment storage
Grade 3 -40C to +85C Benign automotive zones (close to consumer)

The temperature grade is not a cosmetic label — it propagates straight into the Arrhenius math above. A Grade 1 part rated for retention “after rated cycles” must hold data at a higher use temperature than a client SSD’s 30C, and from the equation, a higher T_use means a much larger required acceleration factor to reach the same field-life target, which means tighter retention margin from the same oxide. Heat is the enemy of retention twice over: it accelerates detrapping and leakage during use and it widens the gap between the cold corner (-40C, where Vt shifts the other way and read references drift) and the hot corner. Automotive parts must hold the read window across that entire -40C-to-+125C swing simultaneously, not at one comfortable temperature.

The other AEC-Q100 deltas that bite NAND specifically:

  • Mission-profile retention. Automotive retention is stated against a temperature mission profile — a weighted histogram of time spent at each temperature over service life — not a single number. You integrate Arrhenius-accelerated leakage over the profile.
  • Cross-temperature reads. Programming at one temperature and reading at another shifts apparent Vt, because cell and read references move with temperature but not identically. Automotive qual exercises program-hot/read-cold and the reverse; consumer qual often does not.
  • Lower endurance for higher retention. To meet automotive retention at automotive temperatures, parts are de-rated in cycling — the trade pushed deliberately toward retention. An automotive NAND part on the same die as a consumer one carries a lower TBW and a tighter retention guarantee. Same physics, different point on the budget.

This is also where the geopolitics of who can even buy advanced storage intersects engineering reality; see chip export controls for the supply-side picture. And as density climbs — QLC, PLC, the density endgame — the read window shrinks, the budget tightens, and automotive grades get harder to hit at all, which is why high-density NAND is slow to reach Grade 0/1.

Reading a Spec Like a Qual Engineer

Put it all together and parse a real-shaped spec line:

“600 TBW (JESD219 client), 1-year data retention at 30C after rated P/E cycles, UBER ≤ 1e-15.”

Here is the full decode:

  1. 600 TBW under JESD219 client — proven against the standard client write trace, including its write amplification. Your random-heavy or read-heavy workload is not this trace. Treat 600 TBW as a ceiling under defined conditions, not a promise under yours.
  2. “after rated P/E cycles” — the retention clock starts from maximum wear, i.e. maximum trap density and worst SILC. This is the worst, not the best, case. A fresh drive does far better; that is not what was promised.
  3. “1 year at 30C” — validated by an accelerated bake (roughly 13 hr at 85C if Ea = 1.1 eV). The honesty of the claim is entirely contained in the Ea assumption behind that bake. Ask what Ea was used and whether it was measured or assumed.
  4. “UBER ≤ 1e-15” — this is the output of the read window surviving all of the above with ECC applied. It is the rider that makes the other numbers real, and it depends on the ECC scheme (ECC for flash, Hamming to LDPC) being strong enough to swallow the worst-cell SILC tail at end of life.

The trade-off, stated as the engineer’s mental model:

              HIGH ENDURANCE  <----------------->  LONG RETENTION
   (many P/E cycles allowed)                    (data held for years)

  more cycling                                    less cycling
  more oxide traps                                fewer oxide traps
  worse SILC / leakage                            cleaner oxide
  SHORTER retention per write       <--- one knob, one die --->   LONGER retention

  Relaxing retention from ~3 years to ~3 days can raise usable
  endurance by up to ~50x on the SAME silicon. The die didn't change.
  The point chosen on this axis did.

That last figure is the punchline: published work shows that relaxing the internal retention target from years to days can lift endurance by roughly 50x on identical silicon. Endurance and retention are not two properties of a chip. They are one knob, and the spec is a vendor’s chosen setting of that knob — informed by class (JESD218), exercised by workload (JESD219), and tightened by environment (AEC-Q100). Reading the spec means reverse-engineering where they set the knob and asking whether that setting survives your corner of the workload-temperature space. The factory-side of choosing that setting per-die is covered in NAND trim.

Verdict

NAND reliability is not a list of independent failure modes; it is one physical trade — oxide damage from writing versus oxide integrity for holding — wearing many costumes. Tunnel-oxide trap generation is the root cause; SILC is how traps become leakage; detrapping is the fast retention transient; disturbs are the workload-sensitive perturbation that pure cycling tests miss. The standards are genuinely useful and genuinely bounded. JESD218 makes “endurance rating” a real, comparable claim by binding TBW to retention, UBER, and FFR riders at end of life, and it is right to give enterprise drives shorter retention for more endurance — that is the physics, not a cheat. JESD219 makes the wear pattern reproducible, but it is a fixed synthetic proxy, and the gap between its trace and your workload (especially read-disturb stress) is where field failures hide. AEC-Q100 doesn’t invent new physics; it moves every corner outward — higher use temperature, wider cross-temperature swing, longer mission profile, tighter defect rate — and the Arrhenius equation translates each of those into less retention margin from the same oxide, forcing automotive parts down the endurance-retention curve toward retention.

The single most actionable skill here is to never read an endurance number alone. “X TBW” without its retention temperature, retention duration, post-cycling condition, UBER target, and the workload it was measured under is not a spec; it is a marketing fragment. And the one number to interrogate hardest is the activation energy behind any accelerated retention claim, because that exponent is where an honest qual and a wishful one diverge by months of real field life. Know the physics, and the datasheet stops being a list of numbers and becomes a readout of exactly where a vendor decided to spend a fixed oxide budget.

Sources

Comments