IEEE ELECTRON DEVICE LETTERS, VOL. 40, NO.

3, MARCH 2019 391

Trap-Assisted DRAM Row Hammer Effect

Thomas Yang and Xi-Wei Lin

Abstract — Through 3D TCAD simulations with single

charge traps, we discovered a direct evidence to the mecha-
nism of DRAM row hammer effect. It is governed by a charge
pumping process, consisting of charge capture and emis-
sion under or around an aggressor wordline and subsequent
carrier migration to a victim storage node. The process is
highly sensitive to the location and energy level of acceptor-
type traps; a single trap may enhance the row hammer effect
by a factor of 60 in a 2y-nm node. Dependencies on bitline
junction depth, temperature, and hammering waveform are
analyzed, and the results are in good agreement with pre-
viously reported experiments. Feature size scaling is found
to aggravate the row hammer effect.
Index Terms — Aggressor row, bit fault, charge traps, Fig. 1. 3D DRAM structure and contacts (pink contours) assignments.
DRAM, feature size scaling, junction depth, row hammer
effect, TCAD simulations, victim row, temperature effect. TABLE I
N OMINAL PARAMETERS FOR D EVICE S IMULATIONS
I. I NTRODUCTION

R OW hammer effect in DRAM devices refers to dis-

turbance to adjacent cells by repeated activation of an
aggressor row, leading to bit faults within a refresh cycle [1].
This disturbance may be exploited to mount a system attack,
causing security concerns [1], [2]. The effect becomes worse as
the feature size scales downward. Extensive studies [3] have
been performed to analyze row hammer behaviors, such as
dependencies on time tRAS from an active command (ACT)
to precharge command (PRE) and time tRP from PRE to
subsequent ACT, as well as temperature and data pattern. The
proposed mechanism involves carrier migration and discharge
at adjacent storage nodes on a victim row, but the exact
dynamics of carrier transport is unclear and certain observa-
tions unexplained. Recent experiments in [4] show hydrogen
annealing of silicon surface significantly reduces row hammer In our simulations, a single trap is placed at various loca-
effect and indicate trap density reduction is responsible for tions in a DRAM structure, and energy level is varied. Effects
row hammer improvements. of temperature, bitline (BL) junction depth, and WL waveform
In this work, we’ve conducted a comprehensive Technology change are studied. Impacts of feature size scaling to row
CAD (TCAD) study on trap-assisted row hammer effect in hammer effect are analyzed.
a 2y nm DRAM device and observed a dynamic trans-
port process, consisting of a) charge capture and emission, II. S IMULATION M ETHODOLOGY
b) carrier migration, and c) subsequent discharge at a victim Sentaurus TCAD [5] is used for trap-assisted row hammer
storage node, throughout switching cycle of an aggressor effect simulations. A 3D DRAM structure is constructed
wordline (WL). It provides, for the first time, a direct evidence (Fig. 1), consisting of two cells with saddle-fin, buried metal
to the fundamental mechanism of row hammer effect and WL, sharing the same active area and a common BL, with
offers coherent explanations to many previous experiments. dimensions (Table I) close to a typical 2y nm node. The
substrate and source/drain are doped to achieve typical DRAM
Manuscript received December 3, 2018; revised December 26, 2018; access device I-V characteristics. Parallel capacitors are placed
accepted January 3, 2019. Date of publication January 7, 2019; date of on storage nodes (SNs) to mimic SN capacitors with the
current version March 6, 2019. The review of this letter was arranged by
Editor B. Govoreanu. (Corresponding author: Xi-Wei Lin.) dielectric permittivity set to yield a 10fF capacitance.
T. Yang is with Synopsys Taiwan Co., Ltd., Chupei 302, Taiwan. Table I shows bias conditions for row hammer simulations,
X.-W. Lin is with Synopsys, Inc., Mountain View, CA 94043 USA where the aggressor WL2 voltage is toggled on and off with
(e-mail: [email protected]).
Color versions of one or more of the figures in this letter are available duration corresponding to tRAS and tRP , respectively, while the
online at http://ieeexplore.ieee.org. victim row WL1 is held low at Vbbw = −0.2V. The victim
Digital Object Identifier 10.1109/LED.2019.2891260 SN1 potential is initially set high at Vcore = 1.2V, while
0741-3106 © 2019 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Authorized licensed use limited to: University of Electronic Science and Tech of China. Downloaded on June 22,2025 at 10:03:41 UTC from IEEE Xplore. Restrictions apply.
 392 IEEE ELECTRON DEVICE LETTERS, VOL. 40, NO. 3, MARCH 2019

Fig. 3. (a) Trapped electron charge evolution at fin top Si/SiO2

interface; lower quantities are charge in electron charge unit. (b) Aggres-
sor WL2 waveform with marked time points. (c) Victim SN1 potential
waveform, showing decay during low WL2 from tp230 to tp300.
Fig. 2. (a) Electrical potential waveform of SN1 capacitor, induced by
a switching aggressor WL2 in (b). (b) Cross-section of active area. Red
rectangles mark WL1 and WL2 gates wrapping around saddle-fins. Band
bending is stronger under the gates than outside. Triangles indicate
IV. M ECHANISM
single trap locations used in this study. Red color indicates locations The mechanism of trap-assisted row hammer effect consists
with strong row hammer effect, due to trap-assisted charge pumping of two processes: a) trap charge capture and emission and
process. (c) The corresponding matrix for row hammering threshold
number NRH . Highlighted in red are NRH smaller than safe hammering b) subsequent carrier migration towards SN to discharge its
number NS = 1,333k. Energy level of all traps is 0.45eV. capacitance.

A. Trap Charge Capture and Emission

SN2 at 0V. For simplicity, BL potential is held constant at To visualize the capture and emission process, a single
1/2 Vcore , which differs from actual DRAM operations [6], trap is placed under WL2 and the trapped charge is recorded
but is close to the precharge condition during tRP . at selected time points within a switching period. A charge
pumping process is evident from Fig. 3: A trap (Fig. 3a),
located at saddle-fin top (point at row 1 and column 4 in
III. T RAP -A SSISTED R OW H AMMER E FFECT
Fig. 2b), captures a charge as WL2 rises from time point
Fig. 2a shows victim SN1 waveform induced by aggressor tp200 to tp210 (Fig. 3b), accumulates charge to 0.664 electron
WL2 switching (Fig. 2b). In each cycle, SN1 potential (VSN ) while WL2 is high from tp210 to tp220, then begins to
is flat during high WL2, but decays by a small, yet definite, discharge partially as WL2 falls from tp220 to tp230, and
amount (VSN ) during low WL2. As the cycle repeats, VSN finally emits the remaining charge (0.414 electron) during low
keeps dropping from its initial value (VSN0 ), until it reaches WL2 from tp230 to tp300. The emitted charge eventually
a threshold (VSN−TH ), below which data failure eventually migrates to SN1 and cause potential drop (Fig. 3c). The
occurs. The corresponding number of WL2 cycles is referred process repeats as WL2 keeps toggling.
to as row hammering threshold (NRH ). It is calculated as To capture significant charge, a trap must be located in a
NRH = (VSN0 − VSN−TH )/VSN , where VSN − VSN−TH is region with strong band bending, which is under or close
set to 0.27V in this study, considering sensing margin, and to WL2 gate. This explains the strong NRH dependency on
VSN is typically a few μV. The higher the NRH , the weaker trap location (Fig. 2b and 2c). Since the band bending along
the row hammer effect. The NRH value can be so high that no gate center (column 4) is different from gate edges (column
row hammer failure occurs within a refresh cycle of 64ms. The 3 and 5), the trap occupancy dynamics is different, contributing
corresponding NRH value is referred to as safe row hammer to strong difference in NRH from one site to another.
number (NS ) and equal to 1,333k for minimum tRAS + tRP . For the charge pumping process to work efficiently, i.e.,
The presence of traps is critical to row hammer effect. capture and hold charge from WL2 rise through fall transitions,
Donor-like traps, which hold positive charge when occupied, and then emit most of it during off-state, the trap capture and
are found to have little effect, so the rest of the letter is emission processes must keep a delicate balance. A deep level
focused on acceptor-like traps, which hold negative charge trap captures more charge during on-state, but may fail to fully
when occupied. Capture and emission cross-section is set to emit it during off-state. On the other hand, a shallow level trap
1e-13 cm2 , according to [5], [7]. Traps located at both Si/SiO2 captures less charge, so little is released during off-state.
interface and in Si bulk are studied and similar results are Fig. 4 shows strong sensitivity of NRH and trapped charge
observed. The data shown below are based on interface traps. evolution to trap energy level (Et ), ranging from 0.35 to
Fig. 2c shows a NRH matrix, corresponding to the location 0.55eV above the mid-bandgap, which is typical of major
matrix in Fig. 2b. The points under or close to aggressor energy level distribution for Si/SiO2 interface traps [8], [9].
WL2 exhibit severe row hammer effect, i.e., NRH (red color) is Et = 0.50eV yields the most efficient charge pumping
far less than NS = 1, 333k, safe number for DRAM operations. process, thus strongest row hammer effect. Note that it is
The worst case NRH is 22k, a factor of 60 smaller than NS . The the charge emitted during low WL2, from tp230 to tp300
observed sensitivity to traps agrees well with hydrogen anneal- (shaded in Fig. 4b), that eventually migrates to victim SN1 and
ing experiments [4], showing a strong correlation between causes capacitor discharge and row hammer effect. The charge
row hammer effect and charge pumping current, thereby traps, emitted during WL2 fall transition, from tp220 to tp230,
in DRAM cells. contributes little to carrier migration to SN1, because the

Authorized licensed use limited to: University of Electronic Science and Tech of China. Downloaded on June 22,2025 at 10:03:41 UTC from IEEE Xplore. Restrictions apply.
 YANG AND LIN: TRAP-ASSISTED DRAM ROW HAMMER EFFECT 393

Fig. 4. (a) NRH vs. trap energy level. (b) Trap charge pumping cycle
for each trap energy level (refer to Fig. 3b for time points). Et = 0.5eV Fig. 6. Hammering threshold NRH vs. temperature from 250 to 350°K
yields the best capture and emission balance and strongest row hammer for different traps. Location in row and column refers to matrix in Fig. 2b.
effect. Charge emitted during tp230 to tp300 (shaded) migrates to SN.

171k to 31k for a change in fin width from 5nm to -2nm,

while trapped charge sequence remains basically the same.
Therefore, changes in carrier migration must be responsible
for variation in NRH .
Table II also shows NRH becomes smaller, as fin width or
WL1-WL2 spacing decreases. It implies row hammer effect
becomes worse with feature size scaling. This result also
explains the asymmetry of row hammer effect in location
Fig. 5. SN1 potential drop vs. time at low WL2 for (a) tRP = 10ns and
(b) tRP = 50ns, with three trap energy levels above mid-bandgap. A trap matrix in Fig. 2. The left two points to aggressor WL2 (column
at 0.45eV is deeper than 0.50eV relative to conduction band, so has a 2 rows 1-2 in Fig. 2) is closer to SN1, thus having a shorter
smaller emission rate and needs longer time to fully emit the charge. migration path, so NRH is relatively small (135k and 193k).
Besides geometry, BL junction depth is increased by 7nm
TABLE II to alter the carrier migration without affecting trapped charge
H AMMERING THRESHOLD N RH AND T RAPPED C HARGE ( IN U NIT
timing profile. A deeper BL junction mitigates row hammer
OF E LECTRON C HARGE ) AT T IME P OINTS TP 200-300
(D EFINED IN F IG . 3 B ) IN A S WITCHING C YCLE FOR
effect (NRH increases from 55k to 161k), because it intercepts
DRAM C ELL G EOMETRY VARIATIONS more electron carriers during migration. This finding is con-
sistent with previous experimental results in [10].

V. T EMPERATURE E FFECT
Fig. 6 shows NRH vs. temperature ranging from 250 to
350°K. A non-monotonic behavior is observed, with NRH
reaching minimum around room temperature and increasing
at either lower or elevated temperature. The magnitude of
NRH variation depends on trap locations. This temperature
channel remains open for WL2 voltage above threshold Vth =
dependency is consistent with previous measurements with
0.87V or leaky before WL2 drops below ∼0.2V, so electron
commercial DDR3 discrete components from major memory
carrier emitted during most of this time interval is swept to
manufacturers [3].
drain BL, instead of migrating to SN1.
The temperature effect can be understood based on temper-
Since trap charge capture and emission take time, row
ature dependent trap emission rate and carrier recombination
hammer effect depends on the on or off duration of aggressor.
rate. At elevated temperature, a higher emission rate means
As shown in Fig. 5, SN1 potential decays continuously for
faster loss in trapped charge and less carrier for migration,
deeper traps with increasing off-state duration (tRP ) from 10 to
thus less row hammer effect, i.e., higher NRH . At lower
50ns. For example, Et = 0.45eV is deeper relative to conduc-
temperature, a lower emission rate means less loss in trapped
tion band than 0.50eV, so it takes more time to emit all charge,
charge and more carrier for migration, but the recombination
resulting in a longer decay tail in SN1 potential (Fig. 5b).
rate is higher, causing less electrons to migrate to victim SN1,
As for the on-state duration (tRAS ), little difference is found
thus higher NRH than that at 300°K.
between 10 and 50ns, because the captured charge saturates
quickly due to strong band bending. These results agree well
with the tRAS and tRP dependency reported previously [1], [3]. VI. C ONCLUSION
This study lends a direct evidence to the mechanism of
DRAM row hammer effect. The underlying process consists
B. Carrier Migration of trap charge capture and emission and carrier migration,
The role of carrier migration in row hammer effect can as shown by time evolution of trapped charge at a single
be deduced by varying either the bulk volume or distance trap and influence of migration path during aggressor row
between aggressor and victim, without disturbing the trap switching. Impacts of factors, such as trap location and energy
capture and emission process. Table II shows NRH is sensitive level, BL junction depth, temperature, and WL waveform, are
to saddle-fin width (bulk volume) and WL1-WL2 spacing analyzed and the results agree well with previously reported
(migration distance), while the trapped charge changes little experiments. Feature size scaling is found to enhance row
at each time point in the cycle. For example, NRH varies from hammer effect.

Authorized licensed use limited to: University of Electronic Science and Tech of China. Downloaded on June 22,2025 at 10:03:41 UTC from IEEE Xplore. Restrictions apply.
 394 IEEE ELECTRON DEVICE LETTERS, VOL. 40, NO. 3, MARCH 2019

R EFERENCES [5] Sentaurus Sdevice User’s Manual, Synopsys, Mountain View, CA, USA,
2018.
[1] Y. Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, [6] C. Lee, “Memory technology for future systems,” in IEDM Short
K. Lai, and O. Mutlu, “Flipping bits in memory without accessing Course 2, Dec. 2015, pp. 1–8.
them: An experimental study of DRAM disturbance errors,” in Proc. [7] N. S. Saks and M. G. Ancona, “Determination of interface trap capture
ACM/IEEE 41st Int. Symp. Comput. Archit., Jun. 2014, pp. 361–372, cross sections using three-level charge pumping,” IEEE Electron Device
doi: 10.1109/ISCA.2014.6853210. Lett., vol. 11, no. 8, pp. 339–341, Aug. 1990, doi: 10.1109/55.57927.
[2] V. van der Veen, Y. Fratantonio, M. Lindorfer, D. Gruss, C. Maurice, [8] C.-T. Sah, B. B. Jie, and Z. Chen, “A history of electronic traps on
G. Vigna, H. Bos, K. Razavi, and C. Giuffrida, “Drammer: Deter- silicon surfaces and interfaces,” in Proc. Tech. NSTI Nanotechnol. Conf.
ministic rowhammer attacks on mobile platforms,” in Proc. ACM Trade Show, vol. 3, May 2007, pp. 485–492.
SIGSAC Conf. Comput. Commun. Secur., Oct. 2016, pp. 1675–1689, [9] P. M. Lenahan, T. D. Mishima, J. Jumper, T. N. Fogarty, and
doi: 10.1145/2976749.2978406. R. T. Wilkins, “Direct experimental evidence for atomic scale structural
[3] K. Park, C. Lim, D. Yun, and S. Baeg, “Experiments and root cause changes involved in the interface-trap transformation process,” IEEE
analysis for active-precharge hammering fault in DDR3 SDRAM under Trans. Nucl. Sci., vol. 48, no. 6, pp. 2131–2135, Dec. 2001, doi: 10.1109/
3 × nm technology,” Microelectron. Rel., vol. 57, no. 2, pp. 39–46, 23.983184.
Feb. 2016, doi: 10.1016/j.microrel.2015.12.027. [10] C.-M. Yang, C.-K. Wei, Y. J. Chang, T.-C. Wu, H.-P. Chen, and
[4] S.-W. Ryu, K. Min, J. Shin, H. Kwon, D. Nam, T. Oh, T.-S. Jang, C.-S. Lai, “Suppression of row hammer effect by doping profile modi-
M. Yoo, Y. Kim, and S. Hong, “Overcoming the reliability limitation fication in saddle-fin array devices for sub-30-nm DRAM technology,”
in the ultimately scaled DRAM using silicon migration technique by IEEE Trans. Device Mater. Rel., vol. 16, no. 4, pp. 685–687, Dec. 2016,
hydrogen annealing,” in IEDM Tech. Dig., Dec. 2017, pp. 21.6.1–21.6.4., doi: 10.1109/TDMR.2016.2607174.
doi: 10.1109/IEDM.2017.8268437.

Authorized licensed use limited to: University of Electronic Science and Tech of China. Downloaded on June 22,2025 at 10:03:41 UTC from IEEE Xplore. Restrictions apply.