Oxide charge measurements in EEPROM devices

Direct charge measurements to read back stored data in nonvolatile memory devices using scanning capacitance microscopy

“…SCM scanning (reading) of sample surfaces was performed for $4 h continuously in the same area, and no noticeable reduction of charge level was detected. 1 The device was kept in a dark box after the sample preparation as suggested by Nardi et al, 2,5 so that programmed charges were retained and loss due to light did not occur. After employing these issues related to the storage conditions, the device was read by SCM from the backside, even 2-3 months after sample preparation, and the charges did not seem to reduce or change, presenting the same data as was programmed.…”

“…1 In the FGT channel, the electron density stored in its FG by capacitance coupling through the gate oxide is the coupled image of the hole density. 2,5 The SCM approach was used to directly probe the carrier density located on FGT channels. For piloting such SCM measurements, so that the AFM tip is able to scan close enough (<300 nm) to the transistor channels without discharging the FGs, the samples need to be deprocessed in a very careful way.…”

“…The floating gate potentials can then be measured through this tunnel oxide. 2 contact mode based SCM operation that uses a diamondcoated metal tip. 2,5,7,8,11 Practically achieving a 30-200 nm thin silicon layer all over the memory device is not feasible, so a bevel configuration with a small slope ($0.15%) is obtained, where a small area (%80 lm 2 large) is usable, as marked by a white box shown in Fig.…”

“…It would be preferable to measure the programmed charges on-site that will directly reveal the stored data. 2,3 Nardi et al 2 considered accuracy between 10 3 and 10 5 electrons for standard 5 V electrically erasable programmable read-only memory cells, on the basis of work done by Skorobogatov et al, 4 resulting in a 3.5 V shift in the threshold voltage. Measuring charge density involves directly probing the device on-site using physical measurement techniques and avoiding software protection against unwanted access.…”

Retention of data in heat-damaged SIM cards and potential recovery methods

“…Most of these techniques require the removal of passivation, metallisation, and control gate from the EEPROM. Well-established methods exist to achieve this; however, removal of the upper layers can cause degradation of the charge retention characteristics of the target chip before enough material has been removed to allow probing methods access to read any charge on the floating gate [23]. In addition, and potentially more seriously, in-built chip security measures may detect such an attack; for example, optical sensors and capacitive sensors to detect the passivation layer are sometimes built into systems to prevent successful reverse engineering [17,24].…”