Threshold-voltage simulator
NAND Cell Lab
A NAND cell stores bits as charge and reads them back as a voltage. Wear it, bake it and disturb it, then watch neighboring states overlap until error correction runs out of steps.
Try this: Choose Wear in the walkthrough, then drag a read reference on the bench chart and watch the error-correction ladder change.
The walkthrough
One cell, six pushes
Choose a section and the same cell shows it. The bench below shares this cell, so its sliders change it too.
1. Charge sets the voltage
Electrons held in the cell raise its threshold voltage. A read finds which of eight voltage ranges the cell sits in, and each range is three bits.
2. Programming is a staircase
A single big pulse would overshoot, and charge cannot be taken back. So the chip sends slightly taller pulses and checks after each one, and Program counts them.
3. Wear leaves traps
Every program and erase cycle can damage the tunnel oxide. The crosses are traps, and wear also widens every voltage state on the chart.
4. Time and heat let charge leak
Stored charge leaks out over time, and heat speeds it up. Press Bake 1 year to watch the dots drain and the voltage fall.
5. Reads disturb the erased state
Reading other pages in the block stresses this cell without ever selecting it. Stray electrons creep into an erased cell and lift its voltage.
6. Overlap means wrong bits
Where neighboring states overlap, a read returns the wrong level. The controller climbs a ladder of fixes, and past the last one the page needs a RAID rebuild.
- Level
- -
- Voltage
- -
- Dots
- -
- Traps
- -
- Reads as
- -
- Pulses to program
- -
- Raw bit error rate
- -
- Recovery
- -
More cell settings
- Pulse step
- -
- Trap flips
- -
- Wrong reads
- -
- Nearest reference
- -
The bench
Push a cell until it fails
Illustrative model, not vendor data. Trends are real, numbers are not.
Each hump is one value the cell can store. Wear, time and heat widen and shift the humps until they overlap, and where they overlap a read returns the wrong bits.
Log scale, 0 to 1,000,000 reads.
More settings
Adds a two-level jump to a wear-scaled share of cells. The noise buttons are under More cell settings.
Retention loss is steeper, the erased state rises with age, and the activation energy is 1.04 eV.
Gives every programmed state a long tail, longer as the cell wears.
Programmed states lose charge in proportion to their level.
- State distributions, erased to highest
- Overlap that reads wrong
- Read reference (drag, or arrow keys, Shift for larger steps)
- Valley the read-retry search would pick
- Your cell, from the walkthrough
Raw bit error rate
0
Error rate by page
- ---
- ---
- ---
- ---
Error-correction ladder
- Hard-decision decodeCurrent references, hard-decision ECC (a strong code, not a 40-bit BCH), limit 5 × 10⁻³
- Read-retryReferences move to the valleys, same 5 × 10⁻³ limit
- Soft-decision LDPCValley references plus soft reads, limit 2 × 10⁻²
- UncorrectableRAID or parity rebuild, otherwise data loss
The same walkthrough as text
All six sections
Charge sets the voltage
Electrons held in the cell raise its threshold voltage. A read finds which of eight voltage ranges the cell sits in, and each range is three bits.
TLC cell at level 4: 500 of 1,000 cycles, 1 year at 40 °C, 20,000 reads.
Programming is a staircase
A single big pulse would overshoot, and charge cannot be taken back. So the chip sends slightly taller pulses and checks after each one, and Program counts them.
TLC cell at level 4: 500 of 1,000 cycles, 1 year at 40 °C, 20,000 reads.
Wear leaves traps
Every program and erase cycle can damage the tunnel oxide. The crosses are traps, and wear also widens every voltage state on the chart.
TLC cell at level 4: 1,000 of 1,000 cycles, 0 years at 40 °C, 0 reads.
Time and heat let charge leak
Stored charge leaks out over time, and heat speeds it up. Press Bake 1 year to watch the dots drain and the voltage fall.
TLC cell at level 4: 300 of 1,000 cycles, 2 years at 70 °C, 0 reads.
Reads disturb the erased state
Reading other pages in the block stresses this cell without ever selecting it. Stray electrons creep into an erased cell and lift its voltage.
TLC cell at level 0: 300 of 1,000 cycles, 0 years at 40 °C, 300,000 reads.
Overlap means wrong bits
Where neighboring states overlap, a read returns the wrong level. The controller climbs a ladder of fixes, and past the last one the page needs a RAID rebuild.
TLC cell at level 4: 1,200 of 1,000 cycles, 1 year at 55 °C, 100,000 reads.
How the model works
Each state is a Gaussian in threshold voltage. Wear widens it, retention pulls the high states down, and read disturb pushes the erased state up. Where two neighbors overlap across a read reference, cells are misread, and Gray coding makes each misread cost exactly one bit. Every constant is a teaching value chosen to show the shape of the physics, so read the trends, not the digits.
The cell in the walkthrough is one cell from that population. Its voltage is its state's average, nudged by that cell's own fixed offset, scaled by how wide the state is. The sliders age the whole population, so they move this cell too.
Programming or erasing the cell is a fresh write, so it restarts the retention time and read count at zero. Read disturb comes from reads of other pages in the block, not from reading this cell.
The equations
- Gray coding
g(k) = k XOR (k >> 1)Adjacent states differ by one bit, so one misread flips one bit.- States
Vt(k) ~ Normal(mu_k, sigma_k)Erased state near -1 V and wide; programmed states from 1 to 5 V and tight.- Wear
sigma = sigma0 * (1 + a * (cycles / rated)^0.8)Monotone power law; the erased mean also creeps up.- Arrhenius
AF = exp[(Ea / kB) * (1 / 313.15 - 1 / T)], Ea = 1.1 eVReal hours become hours at 40 C, and worn cells lose charge faster. The activation energy is 1.1 eV (assumed for planar, from the JEDEC convention) or 1.04 eV (measured on 3D charge-trap parts).- Retention
shift_k = -0.04 V * log10(1 + AF * hours) * (1 + 1.5 * (cycles / rated)^0.8) * level_k + 0.05 V * log10(1 + AF * hours) * (1 - level_k)^2Higher states lose charge, the erased and low states rise as their holes leak away, and every programmed state widens, as Cai et al. measured on TLC (Proc. IEEE 2017, Table 5).- Read disturb
shift_k = 0.67 V * (reads / 100000)^0.45 * [(1 - level_k)^6 - 0.08 * level_k^6]Pass-voltage stress lifts the erased state most, about one state gap after 100,000 reads, and the top state dips slightly. The power law is fitted to Cai et al. (Table 6) and extrapolated past 100,000 reads.- RTN (optional)
p(Vt) = (1 - f) N(mu, s) + f/2 N(mu - h, s) + f/2 N(mu + h, s); f = 0.02 + 0.28 * (cycles / rated)^0.8, at most 0.5; h = 0.15 VA share f of cells has an active trap and sits h above or below its resting voltage. Denser cells have less room for it.- Heavy tails (optional)
V = G - E, G ~ Normal(mu + 1/lambda, s), E ~ Exponential(lambda); lambda = 50 / (1 + 4 * (cycles / rated)^0.8) per voltAn exponentially modified Gaussian mirrored to the low side of each programmed state, with the mean kept. The tail lengthens with wear; its length is a teaching value, and its one-sided shape is the lab's modeling choice.- Student's t tails (optional)
f(x) = t_nu((x - mu) / c) / c, c = sigma * sqrt((nu - 2) / nu); nu = 3 + 9 / (1 + 2 * (cycles / rated)^0.8)A symmetric Student's t with the state's mean and standard deviation. Fewer degrees of freedom, nu, give fatter tails on both sides. The degrees of freedom are teaching values.- Neutron irradiation (optional, planar)
mu_k = mu_k - 0.1 V * (level of state k)Programmed states lose charge in proportion to their level and the erased state does not move. The 100 mV top-state shift is a teaching value scaled from one measurement.- 3D charge-trap mode (optional)
shift_k = -0.06 V * log10(1 + AF3 * hours) * rate * level_k; erased: +0.04 V * log10(1 + AF3 * hours); disturb: +0.4 V * (reads / 1e6) * (1 - level_k)^4; wear = cycles / rated; Ea = 1.04 eVTeaching values shaped by published 3D measurements: early retention loss is steep, the shift grows with the log of time, the states move without widening, and the erased state rises.- ISPP
pulses = ceil((Vt_target - Vt_erased) / step); verify = Vt_target - u * stepEach pulse lifts the cell by one step and verify stops the staircase, so a cell lands within one step above its verify level. Steps of 0.10, 0.25 and 0.50 V are teaching values.- Boundary error
m_k = Q((r_k - mu_k) / sigma_k) + Q((mu_k+1 - r_k) / sigma_k+1)The shaded overlap in the chart. Q is the Gaussian tail.- RBER
page = (1/n) * sum(m_k for refs on that page); total = mean(pages)Read-retry moves each r_k to the minimum of m_k.
The retention and read-disturb fits come from Cai, Ghose, Haratsch, Luo and Mutlu, “Error Characterization, Mitigation, and Recovery in Flash-Memory-Based Solid-State Drives” (Proc. IEEE 105(9), 2017, Tables 5 and 6). The 3D charge-trap activation energy comes from Luo et al., HeatWatch (HPCA 2018).
What it leaves out
- The voltage chart has no cell-to-cell interference, and temperature acts on retention through Arrhenius but not on the read itself.
- Random telegraph noise is optional and simple: a wear-scaled share of cells jumps between two voltages a fixed swing apart, at one switching rate. Real traps have many amplitudes and time constants.
- Programming is a pulse count for one level at a time, with one verify after each pulse and one fixed step. Real parts use several verify levels, multi-pass schemes and their own step sizes.
- Gaussian tails by default, apart from the symmetric shoulders of the optional RTN mode. The heavy-tails switch adds a one-sided exponential tail with teaching-value lengths. Real planar two-step parts show heavier, asymmetric tails.
- Two cell types are modelled: the planar floating gate and the 3D charge trap. 3D floating-gate cells are not modelled.
- Wear, retention and disturb combine with simple rules and no cross-terms beyond a wear-scaled charge loss and a wear-scaled disturb widening.
- Equal state probabilities, one codeword per page, and fixed illustrative ECC limits.
- Plain reflected Gray code, so pages carry 1, 2 and 4 read references (QLC 1, 2, 4, 8). Real TLC usually balances them 2-3-2.
- The rated cycle counts are a scale for this lab, not a JEDEC endurance rating.
- The cell picture is a cartoon. One dot stands for 0.1 V of threshold voltage, counted from an arbitrary zero, so the counts are illustrative, not electrons you could measure. The traps follow the cycle count and change only the picture and the speed of the leak animation.
- This lab leaves out neighbor coupling, program inhibit, sensing, source-line bounce, cross-temperature reads, valley search, ECC strength, prone cells, hole taper, 3D density and 1/f noise. The sources page still lists the papers behind those models.
Keep going
- Flash Foundations, Part 2How a cell stores bits as charge, and why the voltage levels spread.
- Flash Foundations, Part 8How error correction rescues the bits that get misread.
- Flash Foundations, Part 9Why squeezing in more bits per cell costs speed and endurance.
- Bit Drift TracerMeasure this kind of aging on a real drive.