How NAND Flash Cells Store Data

NAND flash memory stores data by trapping electrons in an insulated layer within each memory cell. Each cell is a field-effect transistor with an additional floating gate (or charge trap layer) that holds electrons even when power is removed. The number of electrons stored determines the cell's threshold voltage, which the controller reads to determine the stored bit value. A single NAND chip contains billions of these cells organized into pages and blocks.

Floating Gate and Charge Trap Architectures

Early NAND flash used floating gate cells: a conductive polysilicon layer electrically isolated by thin oxide layers above and below. Electrons tunnel through the oxide onto the floating gate during a program operation (applying a high voltage to the control gate). During an erase operation, a reverse voltage pulls electrons off the floating gate through the tunnel oxide.

Modern 3D NAND (V-NAND) uses charge trap flash (CTF) cells. Instead of a conductive floating gate, CTF cells use a silicon nitride insulating layer to trap electrons at discrete locations. The advantage is that a leak in the tunnel oxide does not drain the entire floating gate; trapped charges at individual sites are isolated from each other. This improves data retention in high-layer 3D stacks where the tunnel oxide is under more mechanical stress.

Both architectures store data the same way: the number of trapped electrons sets the cell's threshold voltage. The controller applies a reference voltage and checks whether current flows through the cell. If the threshold voltage is above the reference, the cell is in one state; if below, it is in another. Multiple bits per cell require multiple reference voltages to distinguish more states.

SLC, MLC, TLC, and QLC: Bits per Cell

SLC (Single-Level Cell)

1 bit per cell, 2 voltage states. The controller only needs to distinguish "charged" from "not charged." Wide voltage margins make reads fast and reliable. Highest endurance but lowest density and highest cost per gigabyte.

MLC (Multi-Level Cell)

2 bits per cell, 4 voltage states. The voltage window is divided into four bands. Tighter margins than SLC mean slower reads and more susceptibility to voltage drift from cell aging.

TLC (Triple-Level Cell)

3 bits per cell, 8 voltage states. The dominant technology in consumer SSDs. The narrow voltage bands between states make TLC more sensitive to read disturb, charge leakage, and temperature fluctuations.

QLC (Quad-Level Cell)

4 bits per cell, 16 voltage states. Maximum density, lowest cost. The voltage margins are so narrow that QLC cells require more aggressive ECC and have the lowest endurance ratings. Used in read-heavy or archival workloads.

Program/Erase Cycles and Endurance Limits

Every program/erase (P/E) cycle damages the tunnel oxide slightly. Electrons tunneling through the oxide layer leave behind trapped charges (oxide traps) that gradually change the cell's electrical characteristics. After enough cycles, the oxide becomes leaky enough that the cell can no longer reliably hold its programmed charge for the required data retention period.

The controller tracks the P/E cycle count per block and uses wear leveling to distribute writes evenly across all blocks. When a block's cycle count approaches the rated endurance, the controller may retire it from the active pool and allocate a spare block. SMART attribute 177 (Wear Leveling Count) on many SSDs reports the remaining endurance as a percentage.

Read Disturb and Data Retention

Reading a NAND cell requires applying a voltage to the wordline (control gate). This read voltage, while lower than a program voltage, can still cause a small amount of electron tunneling into neighboring cells on the same page or block. After many read operations on the same block, the accumulated charge shift can flip bit values in cells that were not being read. This is called read disturb.

The controller mitigates read disturb by tracking read counts per block and performing background refresh operations: reading the block's data, erasing the block, and reprogramming the data. If the controller fails (power loss, firmware crash), read disturb errors accumulate unchecked.

Data retention refers to how long a programmed cell can hold its charge without power. At room temperature, a new TLC cell retains data for years. A worn TLC cell near its endurance limit may retain data for only weeks or months. High temperatures accelerate charge leakage. This is why SSDs left unpowered for extended periods, particularly worn SSDs, may develop uncorrectable errors when powered back on.

What Is Program Disturb?

Program disturb is an unintended voltage shift in NAND cells that weren't targeted during a write operation. When the controller programs a specific page, it applies a high voltage (typically 15-20V) to the target cell's wordline. Adjacent cells on the same wordline receive a fraction of that voltage through parasitic capacitive coupling, causing a small electron injection into their charge storage layer.

The effect is cumulative. Each program operation on a block adds a tiny upward shift to the threshold voltage of neighboring cells. After thousands of partial-page writes, the accumulated shift can push a cell across a voltage state boundary, flipping its stored bit value. TLC & QLC cells are more vulnerable because their voltage margins between states are narrower; the same amount of parasitic charge injection that a SLC cell tolerates can corrupt a QLC cell.

Program disturb differs from read disturb in timing & magnitude. Read disturb happens at read time with lower voltages (~5-7V) & requires hundreds of thousands of reads to cause errors. Program disturb happens at write time with higher voltages & can cause errors after fewer operations. Controllers mitigate program disturb by enforcing sequential page programming within each block, writing pages in order from the lowest physical address to the highest, so each page is only exposed to program voltages from subsequent pages, not from random writes.

How Does 3D NAND Layer Stacking Affect Reliability?

3D NAND stacks memory cells vertically instead of shrinking them horizontally. A 96-layer (96L) die has 96 wordline tiers etched into a single silicon column. Moving from 96L to 128L, 176L, & 232L increases density per die without shrinking individual cell dimensions, which is why 3D NAND reversed the endurance decline that plagued late-era 2D planar NAND.

The engineering challenge is vertical process uniformity. Etching a channel hole through 128 or 176 layers of alternating oxide & nitride produces slight diameter variation from top to bottom. Cells near the top of the stack may have thinner tunnel oxide than cells at the bottom. This layer-to-layer variation means error rates aren't uniform across the die; some wordline tiers accumulate bit errors faster than others under identical P/E cycle counts.

String Stacking & Layer Scaling

Beyond approximately 96 layers, manufacturers use string stacking: building two separate NAND arrays (for example, two 64-layer tiers) & bonding them together to create a 128-layer die. SK hynix used this approach for their 128L 4D NAND. Samsung used a single-pass etch through their 128L (V6) generation but moved to a two-deck string-stacked process at 176L (V7), with Cell-on-Periphery (COP) architecture moving peripheral logic underneath the cell array to reclaim die area. Micron's 232L NAND achieves 14.6 Gb/mm² density with 6-plane operation, up from the traditional 2 or 4 planes.

String-stacked dies have an interface boundary between the two tiers where error behavior can differ from the rest of the stack. Single-pass high-layer dies avoid the bonding interface but push the limits of deep channel etch uniformity.

Early Retention Loss in High-Layer 3D NAND

Charge trap cells in high-layer stacks exhibit early retention loss: a rapid charge leakage phase within the first hours after programming, followed by a slower steady-state decay. The initial fast leakage comes from shallow trap states in the silicon nitride that release electrons more easily than deep traps. In a 232-layer stack, cells near the bottom of the channel hole (where oxide thickness variation is greatest) show higher early retention loss rates than cells near the top.

For data recovery, early retention loss matters when an SSD loses power shortly after a large write operation. The controller's internal ECC may not have enough margin to correct the combined effect of early retention loss & existing cell wear. PC-3000 SSD addresses this through dynamic Read Retry, adjusting reference voltages on a per-wordline basis to compensate for the charge drift that occurred while the drive was unpowered.

How Does Cell Type Affect Data Recovery Difficulty?

The number of voltage states per cell directly determines how difficult NAND-level recovery is. SLC cells store only 2 states with a voltage gap of several hundred millivolts between them. QLC cells pack 16 states into the same voltage range, leaving gaps as small as 100-200mV. The narrower the gap, the less charge drift a cell can tolerate before the controller (or a recovery tool) misreads its state.

SLC & MLC Recovery

Wide voltage margins mean PC-3000 SSD Read Retry resolves most bit errors with minimal parameter adjustments. Even heavily worn MLC cells (approaching 10,000 P/E cycles) retain enough voltage separation for reliable reads. Enterprise SSDs using SLC or eMLC NAND are the easiest to recover at the cell level.

TLC Recovery

Eight voltage states per cell means the Read Retry algorithm must test more reference voltage permutations to find the optimal read point. Temperature shifts between when data was written & when recovery is attempted change the voltage distribution, adding another variable. TLC dominates consumer SSDs from Samsung (860 EVO, 870 EVO), Crucial (MX500), & WD (Blue 3D NAND).

QLC Recovery

Sixteen voltage states with margins under 200mV make QLC the hardest NAND type to recover. Even 5-10°C temperature variation between write time & read time can shift voltage distributions enough to cause uncorrectable errors. PC-3000 SSD's Read Retry for supported QLC drives (Crucial P3, Samsung 870 QVO) involves iterating through dozens of voltage offset combinations per wordline group.

When the controller itself is dead, cell-level difficulty becomes secondary to the encryption barrier. Most modern SSDs bind an AES-256 encryption key to the controller silicon. If the controller won't power on, chip-off (desoldering the NAND packages) yields only ciphertext. The recovery path is board-level repair: replacing the failed PMIC or voltage regulator using a Hakko FM-2032, locating the fault with FLIR thermal imaging, & reviving the original controller so its encryption key is preserved. For SSDs with dead controllers, professional SSD data recovery is a board repair job, not a NAND-reading job.

Frequently Asked Questions