Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value expand and potentially overlap over time as shown in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Schaub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm node, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value expand over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Schaub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm node, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

You are correct.

It seems that this washable Logitech keyboard I'm using in my work-at-home setup, with it's crummy chiclet style keys, maybe the source of my rather frequent omission of words from my posts. Natch, I edited that last reply like 6 times after having posted it as I found mistakes in it on a re-read...

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value narrow over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Schaub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm node, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value narrow over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Staub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm node, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value narrow over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Staub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value narrow over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

P.S. Credit where it's due: This image was lifted from Eliza Staub's excellent paper SLC NAND: Secrets Exposed. That she discusses NAND flash vs. my discussion of NOR flash here is irrelevant. The concept of SLC and MLC bit cells is universal regardless of whether the underlying flash technology. As I mentioned, standalone NOR flash devices started using ECC around the 65 nm, IIRC, and I can only assume this was the case because of a switch to MLC in order to reduce die size relative to device density for the same size array implemented with SLC bit cells.

Hi b49,

...that it is okay to reprogram a flash bit to zero without first erasing it back to one.

Whoa... This is the one thing you don't want to do as this IS actually a means for over-stressing a bit cell and damaging it. The idea of erasing bits and then rewriting them makes sense from the perspective of trying to push charge back into the bit cell that may have migrated out over time.

Also, I wouldn't really lean to heavily on refreshing the areas of flash you can control without doing some further research to see if this is really useful. As a case in point, I recently answered a customer question about whether or not we use MLC flash, as this customer had experienced flash corruption problems on previous devices they'd used which had MLC flash.

For starters, as I mentioned above, the flash we use on all our devices is SLC, and I don't think anyone else in the industry building a true single-chip MCU — as opposed to the wannabes who stuff a flash die into a package with a MCU built in a process that does not have NVM — uses MLC flash either for the exact same reasons of reliability that concerned this particular customer. The reason we avoid MLC (which didn't really become an option for standalone flash memories until maybe the 65 nm node) is because the envelopes that determine whether a bit cell holds a given value narrow over time as shows in this diagram:

As you can see, even a SLC bit cell subject to wear (programming and erasure) is unlikely to reach a state where the read sense amplifier is unable to distinguish between the cell holding a 0 or a 1. This is why I'm not certain periodic refresh of the flash gets you anything. It's based on the premise that enough charge migrates out of the cell over time that the bit effectively flips from 0 to 1, but as the diagram shows, you need a lot of charge to disappear for that to happen.

One thing you could do is store your back-up image with ECC such that it could be used to restore a page that appears to have failed in your main image. The ECC syndromes would be on a per page basis and would act as a kind of localized checksum on each page to validate its integrity. You could use checksums to do the same, but I believe ECC (in my limited use of it on NAND flash in my previous job at another chip vendor) has the benefit of letting you recover some damage in your back-up image depending on the type of ECC you implement. Alas, we don't have any dedicated HW on EFM32 devices to do this for you. You'd have to implement it completely in SW, which can be rather slow.

Regards,

John

Hi b49,

You're throwing out a lot of conjecture about what we do or don't do on the device that isn't really relevant. The mechanisms we use are quite simple and may, sadly, underwhelm you.

There is no kind of self-refresh or anything fancy to retain the protected regions of flash. They are programmed and locked, and that is it.  Nothing more.  Our projections on data retention are simply based on RMAs we have received where the failure has been determined to be a flash memory problem. If we actually get back a device that fails because of the flash memory, it impacts the projected data retention for all devices in that technology.

The embedded flash we use is single-level bit cell NOR flash (as is the embedded flash on probably every single MCU in existence that is not actually a multi-chip module with distinct MCU and flash dies in the same package), and, as such, it is largely immune to something like read disturb failures.  About the first thing you can do to this kind of flash is repeatedly program the same word in flash, especially without erasing between programming cycles.

As for the lock bits page, it is managed by hardware. When you boot the chip, the contents of the lock bits page control hardware signals that do things like disable the bootloader, etc. No SW is involved.

You've also figured out that you can't do anything about some regions of flash. The lock bits page, for example, cannot be erased without having an active debug session. Similarly, the DI page, which holds calibration values for the chip's analog functionality, among other things, is locked and can never be erased or written. The main flash, bootloader region, and user data page are otherwise unprotected (short of you locking those that can be locked via corresponding lock bits) and can be erased and rewritten at will.

Finally, the mechanism for booting the device is hardwired into the corresponding bootloader disable lock bit (CLW0 bit 1). When the bootloader is enabled, there is no messing with vectors, etc. The core simply starts executing at 0x0FE10000. In fact, if I were to check, I'd suspect that the SP = 0x0 when the first instruction of the bootloader executes because the very first thing the bootloader actually does is manually load the SP.

Honestly, you're use case is a bit extreme, and I can't really say if the measures you're proposing will help extend the possible life cycle to 30 years or not. I would say that I've dealt with a few customers who are looking for around 20 years of life expectancy, and they generally look at the data we publish in the quarterly quality report and go from there. I've not otherwise had discussions about extending the usable life cycle of the device other then the occasional reminder about wear-leveling if the customer intends to write data to the flash during operation.

Regards,

John