NOR Flash weak cell recovery - Page 1
Forum section: electronics / projects

author: Manul
author_rank: Super Contributor
timestamp: February 08, 2021, 05:32:39 pm
content: Hello,Question for flash experts. Suppose a leaky NOR flash cell became marginal and the read result random. After some more time, it became a stable 1. The memory is 10 years old and the degradation happened in the last few months.Are there any methods to get it back temporarily? I mean things low temperature, high temperature, overvolting, undervolting? Is it possible that something could make a cell more "sensitive" and correctly read the small remaining charge?

author: amyk
author_rank: Super Contributor
timestamp: February 09, 2021, 12:53:33 am
content: You can try adjusting the supply voltage slightly to change the read thresholds, but chances are those are internally stabilised and if the charge has leaked out then it's leaked out and gone forever.

author: Gyro
author_rank: Super Contributor
timestamp: February 09, 2021, 09:55:57 am
content: Production programmers (as opposed to development programmers) specifically verify device contents at minimum and maximum specified supply voltages. That gives some hope that youmightsee a difference in read threshold across supply range (otherwise they wouldn't take the extra effort to do it). It's probably a question of exactly how close to the threshold the remaining charge actually is. I've no idea whether temperature might be a factor though.One technique I remember from UVEPROM days was to do avery lightprogram cycle with all zeros. This could restore a bit of charge to the logic zeros without flipping the logic 1s. I'm sure Flash parts don't have anywhere near the same level of programming algorithm flexibility though. Programming algorithms don't appear in app notes any more, as far as i know.I would maybe try reading the device several times from a cold start at just below minimum supply spec. Do the same at just over maximum spec. and binary compare all of the files. Any bits that jitter between 0 and 1 are 0s. It's a long shot though.

author: Manul
author_rank: Super Contributor
timestamp: February 09, 2021, 05:30:11 pm
content: Quote from: Gyro on February 09, 2021, 09:55:57 amI remember reading about this somewhere. That is really cool trick. Sadly, modern ICs have that internal programming voltage regulator rubish. No joy. Almost nothing to play with.Quote from: Gyro on February 09, 2021, 09:55:57 amI tried minimum - maximum supply voltage. No result. I did not go beyond limits though. I'm afraid to cause latch-up and more cell degradation. Tried light freezing and very light heating. Still trying to be careful to not destroy my chances if some better idea comes to mind.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: February 09, 2021, 05:54:47 pm
content: Probably worth trying below minimum voltage spec - unlikely to make anything worse.

author: Manul
author_rank: Super Contributor
timestamp: February 11, 2021, 09:56:32 pm
content: Well, managed to read it. As suspected it was 1 bit error.Correct reading happened with supply >3.55V (3.3V part) and temperature >60 deg C (together).Also tried to couple some RF noise to the die, but that was unsuccessful idea.I was very surprised, because the correct bit was "1" which somehow degraded to "0". That is opposite from what would be expected. I'm quite sure there is no logic inversion on a chip, errased state is "1".Thats a "Superflash" memory from Microchip:https://www.microchip.com/en-us/products/memory/serial-and-parallel-flash/what-is-superflash-technologyI expect write cycles to be just a few and read cycles <100, so almost no wear. How could a floating gate slowly charge by mistake? Manufacturing defect or single-event upset (SEU)? SEU seems unlikely because the IC exhibited slow degrading behaviour, which got worse with time.After flashing back the correct data dump, it now reads stable in all conditions.

author: Gyro
author_rank: Super Contributor
timestamp: February 12, 2021, 10:41:59 am
content: That's a good result!It sounds as if you had to give it the 3rd degree to get it to confess too!That's an odd one, yes I don't think there's an inversion, so it implies that some sort of glitch might have occurred, resulting in a partial cell write. Either that or a manufacturing defect.The only SEU I can think of is something like a power glitch in the middle of a write, where the address got corrupted but that seems unlikely. I agree that it does sound more like degraded device. Maybe "Split Gate Technology" has some oddities compared to traditional flash.It's certainly an odd one (the degraded state). I assume you will be archiving the dump file!

author: Manul
author_rank: Super Contributor
timestamp: February 12, 2021, 02:24:16 pm
content: As I was told, the device once indicated a corrupted image, but was ok after reboot. After that it started to fail more often, until it was failing all the time. That device was not used a lot and most of the time it was powered down. 11 years old. Microchip is declaring 100 years of data retention.I will be replacing the IC with a new one and also giving dump to the customer. That's a MIL device, image has some sort of signing / crypto, so I'm quite sure the one I dumped is correct, it loads without error.It might be very difficult to find the lost bit computationaly, so I'm happy, that physical recovery worked.

author: Manul
author_rank: Super Contributor
timestamp: February 12, 2021, 03:16:48 pm
content: So as a scientific question, if high supply voltage + high temperature pushed the thresholds to the "1" side, how about weak "0" (the typical retention failure)? Low supply and low temperature? Of course, that was just one case with an unknown failure mechanism, so hard to say if there is a true relation. Somehow I got interested to try, but do not have a candidate.