How a NAND Cell Stores a Bit: Threshold Voltage and Read Levels

A NAND flash cell stores a value by trapping electrons on a conductor that has no connection to anything. Because the charge cannot leave, it holds the state indefinitely; because the charge shifts the voltage at which the transistor turns on, the state can be read without disturbing it. Everything else about flash — the block erase, the page program, the error correction, the endurance limit — follows from the difficulty of moving charge on and off that isolated conductor, and from the narrowness of the window in which the presence or absence of charge can be distinguished.

The cell is a transistor with a buried gate

The device is a field-effect transistor with two gates above the channel. The lower one, the floating gate, is surrounded by oxide on all sides, with a thin tunnel oxide between it and the channel. The upper one, the control gate, sits above the floating gate and is the terminal the wordline drives. In a charge-trap cell, the structure used in three-dimensional NAND, the storage layer is a nitride film that holds electrons in discrete traps rather than a single conductor. The electrical consequence is similar: negative charge stored between channel and control gate must be overcome before the channel inverts and conducts.

A cell with no stored charge conducts when the control gate rises past its intrinsic threshold. A cell holding electrons needs a higher control-gate voltage to reach the same channel condition, because the trapped negative charge repels the electrons the gate is trying to attract. The threshold voltage therefore moves upward in proportion to the stored charge. Erasing drives charge out and pushes the threshold down, often below zero volts, so an erased cell conducts even with the control gate grounded. Programming injects charge and pushes the threshold up.

There is no way to inject a precise quantity of charge in one shot. Hot-electron injection or Fowler-Nordheim tunnelling is a stochastic process: the number of electrons that cross the oxide in a fixed pulse varies cell to cell and pulse to pulse. The cell is therefore programmed to a state defined by a voltage window, not to a voltage. That window is the margin, and the entire architecture of a flash chip is an exercise in protecting it.

Reading is a single comparison

A read applies a reference voltage to the wordline and asks whether the cell conducts. The sense amplifier compares the cell’s current against a reference current; a cell whose threshold is below the applied voltage sinks more current than the reference, and the comparison resolves to one. One comparison against one reference voltage splits the threshold distribution into two halves, which is exactly enough to recover one bit: state A below the reference, state B above it.

More bits per cell do not require a different physics, only more comparisons. A cell with four states needs three reference voltages and two comparisons, which can be done by applying the references in sequence or by latching the results of parallel comparisons in the sense amplifiers. Eight states need seven references, sixteen need fifteen. The read operation on the die is a binary search over the threshold axis, and the number of decisions is the base-2 logarithm of the state count. All of it happens inside one array access; the host never sees the individual comparisons, only the page of decoded bits that comes out.

The mapping from state to bits is not simply the state index in binary. Vendors choose a Gray-like assignment so that adjacent threshold states differ in exactly one bit of the page, because the dominant read error is a cell whose threshold drifts across a single boundary. With a Gray assignment, such an error corrupts one bit, which the error-correcting code handles; a naive binary assignment would corrupt several bits at once in the same codeword.

Every added level halves the margin

The threshold window of a cell is set by the oxide thickness, the coupling ratio between control and floating gate, and the voltages the peripheral circuits can generate. Call it a few volts. Divide that window into two states and each state gets half of it, minus the guard band reserved for the reference voltage and for drift. Divide it into sixteen and each state gets roughly a sixteenth.

The arithmetic is unforgiving. A cell whose programmed threshold sits in the middle of its window, with a spread of a few hundred millivolts from programming noise, plus a drift of a comparable amount over retention, plus a shift from having its neighbours programmed after it, leaves a gap between adjacent distributions that is small compared to the width of either. When two distributions overlap, the reference voltage between them misclassifies cells on both sides, and the raw bit error rate of the page rises. The distributions are not allowed to overlap in a healthy device; the design goal is that they touch at most in the tails, and the error-correcting code absorbs what the tails produce.

This is the single fact that governs the cost of denser cells. Quad-level cells store four bits in the same area as one, at roughly a sixteenth of the margin per state. The endurance rating falls accordingly: a cell asked to hold sixteen distinguishable levels tolerates far fewer program-and-erase cycles than one holding two, because each cycle traps charge in the oxide and shifts the threshold a little. Published endurance figures for planar and early three-dimensional parts run from the order of a hundred thousand cycles for single-level cells down to the low thousands for triple-level and around a thousand for quad-level, and the figures are quoted as orders of magnitude rather than as guarantees.

Programming by stepped pulses, and the damage it does

A program operation does not apply one voltage and stop. It applies a pulse, checks the cell’s threshold with a verify read, and if the cell has not reached the target window, applies a slightly higher pulse and checks again. The increment is a few hundred millivolts, small enough that the final threshold lands within the window rather than overshooting past it. Cells that reach the target early are inhibited on subsequent pulses by raising the voltage on their bitline, so the loop can continue for the slow cells without disturbing the fast ones.

The loop terminates when every cell on the wordline has verified. That is why a program operation takes a variable, data-dependent time, and why a page full of cells that program slowly costs more than a page of average cells. It is also why the programming order across a block matters. The high voltage on a selected wordline couples into the floating gates of cells on neighbouring wordlines through parasitic capacitance, shifting their apparent threshold. If a cell is programmed before its neighbour, the neighbour’s later programming shifts it; if the neighbour is programmed first, the coupling is partly compensated when the cell is verified. Flash therefore programs wordlines in a fixed sequence from one end of the block toward the other, and within a wordline the multiple pages sharing it are programmed in a specific order, with the lower pages written first and refined by the upper pages.

Read disturb is the same mechanism in reverse. A read applies a pass voltage to the wordlines of unselected cells so that they conduct regardless of their state. That pass voltage is below the program voltage but not zero, and over many reads it can nudge charge onto the floating gates of the cells sharing the string. A block that is read millions of times without being erased accumulates enough shift to fail. Controllers respond by tracking read counts per block and relocating data before the count reaches a threshold the vendor specifies.

Where the margins go wrong

Three effects erode the window during a part’s life, and each moves the threshold in a different direction. Retention loss moves programmed thresholds down as trapped charge escapes through the oxide; it accelerates with temperature, which is why a drive stored warm loses data faster than one stored cold. Program-and-erase cycling damages the oxide and widens both the erased and the programmed distributions, so a worn block has fuzzier states at the same nominal level. Cell-to-cell interference from neighbours moves thresholds in whichever direction the coupling dictates.

A read decision made with the factory reference voltage is therefore correct only for a fresh, cool, freshly programmed block. The reference voltages a controller actually uses are adjusted per block, per wear level, and sometimes per read attempt, which is the subject of NAND error correction and read retry. Before that machinery can be understood, though, the erase side has to be understood: the reason a block, not a page, is the unit of removal, and the reason a write to an already-written page is impossible — the asymmetry described in page program and block erase.

# Threshold margin budget for a cell with n levels, in millivolts.
window = 4000.0          # usable threshold window, approximate
for name, levels in (("SLC", 2), ("MLC", 4), ("TLC", 8), ("QLC", 16)):
    slot = window / levels
    # reserve a guard band around each reference voltage
    guard = 0.25 * slot
    usable = slot - guard
    print(f"{name}: {levels:2d} states, {slot:6.0f} mV owned per state, "
          f"{usable:6.0f} mV of drift tolerated per state")

The output makes the trade visible: doubling the levels halves the window each state owns and roughly halves the drift it can absorb before a read decision becomes ambiguous. Nothing about the cell changed between the rows, only how finely the same window was subdivided, and that subdivision is what a denser process buys and what its endurance pays for.