Update: Flash_Destroyer Final Destroys EEPROM

The Flash_Destroyer finally succeeded in rewriting that EEPROM until its demise. When we originally looked at the device it had already recorded 2.5 million successful rewrites. The first appearance of corrupt data occurred at 11,494,069 but that doesn’t tell the whole story. The chip kept working for another 200,000 rewrites before finally showing repeated data corruption.

We do find the writeup pretty interesting. There’s one thing that we can’t stop coming back to though. In the discussion of our original article [Tiago] pointed out that long-term data retention isn’t being tested here. If the abuse of that EEPROM had ended after say five million rewrites, would it have been able to hold the data long-term without corruption? Let us know what you think in the comments.

[Thanks Drone377]

17 thoughts on “Update: Flash_Destroyer Final Destroys EEPROM

  1. As a semi-layman, I think it would have retained without much additional corruption. Once power is removed from the chip, only entropy would play a part, which wouldn’t put undue stress on the cells, unless it was placed in hostile environment (high temperature, radiation etc).

  2. Read/Writes damage the gates and the charge storing the data can leak more easily as this wears out.

    Hard to test this other than giving it time, but you could try varying temperature between read/write cycles to try to artificially cause gate leakage.

  3. It’s not clear if the suggestion is that EEPROMs might lose data that had initially been written and read back successfully but then read back unsuccessfully when tested again after some time OR, if actually writing to EEPROMs becomes more difficult over time. To test the former, take 10 or so new EEPROM chips, choose a different number of writes to each chip, make the writes, wait a month, then measure the % of bits from each chip that differ from what was written. It might make a cool graph and might differ from vendor to vendor. I bet it’s a decreasing, negatively-accelerated hyperbolic or exponential function.

  4. It would be interesting to see what the endurance of the PIC 18F45K20 family actually has – the microchip datasheet states something like 100,000 write-erase for the flash, if I remember correctly. BUT if you then look at the errata, they’ve reduced the cycles by a factor of 10 to 10,000!! Same factor of 10 less for the EEPROM! Microchip are good at crazy stuff like that.
    Anyone else notice how they make lots of different silicon revisions but don’t actually fix any bugs listed in the erratas?! I guess all they are doing is shrinking the die each time to save themselves more money.

  5. If someone is interested, i did some tests on AVR internal eeprom endurance, 4 months ago.

    Atmel guarantee 100,000 rewrite cycles of eeporm

    I have tested only 15 cells of eeprom, and results are:
    6,699,687
    6,139,211
    10,018,912
    7,856,714
    4,771,325
    6,241,237
    6,384,940
    7,718,299
    8,963,816
    6,665,912
    7,006,497
    7,347,356
    7,987,588
    7,868,301
    6,350,857

    AVERAGE – 7,201,376, that is over 7 millions of rewrite cycles! Test take one week.

    I did next test on those 15 dead cells, to check if they can be used again, the results are:
    31,213
    3,202
    261,906
    191
    357
    94,567
    5,561
    3,914
    268,649
    44,019
    529,265
    308
    12
    404,232
    231

    So they are really dead, and its not worth it to use them anymore.

    Tests in 22*C temperature, program write pseudo-random values and check after each write.

    And now ineresting detail:
    If you write over and over the “FF” value into the cells, they last much longer instead writing “00” or other value. Cells with “00” damaged after 30mln of rewrite cycles, and the “FF” – i don’t know – they worked 3 times longer and suddenly my results were lost :(

    Here you can find more http://www.elektroda.pl/rtvforum/viewtopic.php?t=1568124 i attached codes for testing and exampla image – use translator :)

    Regards.

  6. these results make sense, if the unwritten value is FF then this represents the lowest energy state.

    depending on the chip the lowest energy state is the state where the electrical stress is at a minimum, so alternating between states would wear the chip out faster…

    interestingly cooling the chips down might extend their life, as it would reduce the thermal stress on the cells and slow down the “knocking out” of electrons which normally lead to gate leakage.

  7. Hey, that was actually my first real internship in college. I spent a summer in one of Motorola’s R&D labs building a board pretty similar to this to test the cycle capacity of their new EEPROM prototypes. Not exciting in the grand scheme of things, but pretty good for 1

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.