I. INTRODUCTION

Dynamic Random Access Memory (DRAM) is used as the main memory in computing systems due to its fast access speed and cost-effectiveness in terms of capacity. The growth of large-scale data processing, such as cloud computing and big data, has led to an increasing demand for high-capacity memory. Consequently, DRAM is striving to scale down in order to achieve higher capacities. However, during this process, DRAM faces critical issues. As it scales down, the distance among cells narrows, and this reduced distance leads to electrical disturbance phenomena among adjacent cells. For example, the Pass Gate Effect (PGE) is a disturbance phenomenon similar to threshold voltage roll-off. When the gate is turned on, the energy barrier becomes lower in adjacent cells. And rapid switching of a certain word-line on and off can cause bit-flips in the data stored in adjacent cells, which is called 1-row hammer (1-RH) ^[1-4]. These disturbance phenomena can lead to abnormal operation and security vulnerabilities in DRAM. Therefore, the most significant issue in current DRAM technology is 1-RH ^[5-7].

1-RH is a problem that must be addressed because, unlike conventional software security vulnerabilities, it is a method of exploiting hardware design defects, causing critical problems for the security of any computer system, regardless of operating system (OS). This makes 1-RH a critical security vulnerability not only for PCs, but for a wide range of applications that use DRAM, including autonomous driving, data centers, AI, etc.

1-RH is a phenomenon in which data stored in neighboring cells is bit-flipped to 0${\rightarrow}$1 or 1${\rightarrow}$0 when a specific word line is quickly turned on/off in a short time, and the word line being turned on/off is called the aggressor, and the neighboring cells being attacked are called victim cells. 1-RH has two types of failures: D0 failure, where data changes from 0 to 1, and D1 failure, where data changes from 1 to 0. The type of 1-RH is determined by the location of the aggressor and victim cells. Fig. 1 shows DRAM cell array and where D0 and D1 occur. In DRAM, to achieve high density, two transistors share a single bit-line contact (BLC), resulting in each cell having two positional relationships with adjacent cells. Fig. 2 shows cross-section views of A and B. In Fig. 2, where D0 failure occurred, the aggressor is the field passing gate (FPG) through the gate next to the victim cell. where D1 failure occurred, the aggressor is the gate of another transistor which share BLC.

In this study, to find a fundamental solution to mitigate D0 failure, we initially analyzed the process of D0 failure and subsequently conducted a simulation based on interfacial traps and device structure. We implemented the BCAT structure device using TCAD 2D simulations and reproduced the 1-RH attack using mixed mode.

Fig. 1. DRAM cell array and location and type of victim cell according to aggressor.

Fig. 2. 2D cross-sectional view of DRAM cell and energy band diagram of cut line.

II. D0 FAILURE

D0 failure is a type of 1-RH, as the stored data changes from 0 to 1 through repeated toggling of the aggressor. In other words, it signifies the phenomenon as electrons stored in the capacitor are lost due to unintended electrical interactions with the aggressor. D0 failure can be categorized into two primary steps: capture and diffusion

1. Electron Capture Process

D0 failure occurs when the aggressor is an FPG, as illustrated in Fig. 3, enabling direct electrical influence on the victim cell. Initially, when the aggressor is activated, electrons stored in the victim cell's capacitor move towards the nearby FPG oxide layer, with some electrons being captured within the interfacial traps. Subsequently, when the aggressor is deactivated, most of the electrons drawn near the FPG return to the victim cell's capacitor. However, the electrons captured by the interfacial traps remain trapped and do not return to the victim cell's capacitor. In other words, it is a capture process in which electrons cannot return to the capacitor.

Fig. 3. The two-step process of a D0 failure.

III. RELATED RESEARCH

3. Probabilistic Adjacent Row Activation (PARA)

PARA, an alternative to 1-RH, involves accessing one or more adjacent rows with a low probability whenever a particular row is accessed (i.e., refreshed). PARA offers the advantage of being cost-effective as it doesn't require expensive hardware data structures, and it activates adjacent rows infrequently, resulting in minimal performance degradation and power consumption ^[9,11,12]. However, due to its probabilistic approach, PARA cannot entirely prevent 1-RH attacks, and the need to access adjacent rows additionally can lead to performance overhead.

The current approaches are not fundamental solutions to directly mitigate 1-RH, but rather a way to react to the problem when it occurs, and even then they are not well suited to 1-RH, which attacks on a row-by-row basis rather than a single bit. They also requires additional calculations or components that have the potential to degrade system performance and increase power consumption ^[13]. Therefore, research on semiconductor properties and device physics is needed to find a fundamental solution to 1-RH.

Fig. 4. 2-D view of BCAT structure.

IV. SIMULATION CONDITION

We conducted the study in 2D simulation and used SILVACO TCAD simulation. The device used in the simulation has a BCAT structure similar to the 2Y technology node. depth of victim cell word-line (WL$_{\mathrm{v}}$) is 150~nm and Depth of aggressor word-line (WL$_{\mathrm{a}}$) is 165~nm. The gate oxide thickness is 8 nm on the sides and 5 nm on the bottom. Active width (W$_{\mathrm{active}}$) is 24 nm, storage node (SN) capacitor is 10 fF and SN voltage is initially set 0V. In simulation, we have incorporated the following models: 1) doping dependent Shockley-Read-Hall recombination (SRH); 2) band-to-band tunneling (BTBT); 3) and continuously variable transmission (CVT); 4) Fowler-Nordheim tunneling and direct tunneling (FNORD); 5) Hot Electron Injection (HEI)

To implement the 1-RH in the simulation, we used a pulse of 100 ns on/off time and 10 ns rise/fall time in MixedMode. During the 1-RH, 0.5 V was applied to the drain, -0.3 V to the WL$_{\mathrm{v}}$, and 0 V to the substrate. To check the effect of the 1-RH on the properties of the trap and the structural changes of the device, we measured the average voltage change of the capacitor per pulse.

V. SIMULATION RESULTS

Simulations were used to examine the effects of the traps by varying the density, temperature, location, capture cross section, and energy level of the traps, and the effects of the device structure by varying the active width and fin depth.

First, the simulation results for the trap characteristics are shown in Fig. 5-7. The simulation results show that the higher the density of the trap, the higher the temperature, and the higher the energy level (i.e., the deeper the trap), the greater the average ${\Delta}$V/pulse, as shown in Fig. 5 and 6. The capture cross section shown in Fig. 6(b), which represents the capture probability of the trap also showed a trend of increasing ${\Delta}$V/pulse with increasing values. When we compared the amount of change in the resulting values, we found that they were significantly affected by density and temperature. These results confirmed that the trap is the main factor affecting the first stage of the 1-RH, the capture process.

Next, we investigated the effect of the trap location, as shown in Fig. 7. By dividing the trap area into different sections, we found that the ${\Delta}$V/pulse continues to increase as the trap gets deeper and then decreases as it leaves the gate region. From these results, we could infer that the closer the trap is to the bottom of the gate, the more effectively it moves the captured electrons out of the capacitor, reducing the probability of the electrons returning to the capacitor during the diffusion process.

Finally, we analyzed at the simulation results of the device structure. In Fig. 8(a), we can see that the larger the fin depth, the greater the effect, and in Fig. 8(b), we can see that the smaller the active width, the greater the effect. For the pin depth, similar to the trap region, a larger depth tends to decrease the probability of electrons returning to the capacitor in the diffusion process, while a larger active width increases the SN node area, which increases the probability of electrons returning to the capacitor.

The simulations show the effects of device structure and traps on the capture and diffusion processes of D0 failure. In summary, traps affect the trapping process and device structure affects the diffusion process. This suggests that there are three ways to reduce the D0 failure: first, to reduce the number of trapped electrons by improving the oxide film; second, to increase the probability of electrons returning to the capacitor by changing the structure of the device; and finally, to prevent the movement of electrons by WLa.

Fig. 5. The simulation result of D0 failure according to trap parameter: (a) result of trap density; (b) result of temperature.

Fig. 6. The simulation result of D0 failure according to trap parameter: (a) result of trap energy band; (b) result of capture cross section.

Fig. 7. The simulation result of D0 failure. According to interfacial trap region.

Fig. 8. The simulation result of D0 failure according to device structure: (a) results of fin depth; (b) results of active width.

VI. NITRIDE LAYER STRUCTURE

We propose a structure with a nitride layer added to the FPG oxide film, which does not affect the cell size, as a way to mitigate D0 failure, as shown in Fig. 9(a). Silicon nitride has enough traps in the material that it is being used as a charge trap layer to store electrons in flash memory ^[14]. If enough electrons are stored in the nitride layer by applying a programming voltage to the proposed structure, the negative charge of the electrons stored in the nitride layer prevents the movement of the electrons stored in the capacitor due to WL$_{\mathrm{a}}$ when the capacitor is switched on. In other words, reducing the electrical interference caused by the WL$_{\mathrm{a}}$. Nitride layer raises the energy band near the WL$_{\mathrm{a}}$, preventing the WL$_{\mathrm{a}}$ from attracting electrons stored in the victim cell. The effect of the nitride layer depends on the programming voltage and depth. As the depth of the nitride layer becomes shallower and closer to the SN doping region, or as the programming voltage is increased, gate induced drain leakage (GIDL) occurs in the victim cell. Therefore, a sufficient gap is required between the drain region and the nitride layer, and an optimization process for the programming voltage is required. Fig. 9(b) shows the effect of the programming voltage. We have experimented the ${\Delta}$V/pulse as the programming voltage with a programming time of 100 ns. Up to the programming voltage of 14V, the ${\Delta}$V/pulse decreased, but at the voltage after 14V, the ${\Delta}$V/pulse becomes negative because the nitride layer generates GIDL, which supplies electrons to the capacitor. The proposed structure programmed at 14 V showed about 70% improvement over the ordinary structure, as shown in Fig. 11.

Fig. 9. Structure of proposed nitride layer BCAT and ∆V according to programming voltage.

VII. CONCLUSION

In this paper, we investigate how 1-RH occurs and how it is affected by the structure of the trap and device. 1-RH occurs by a two-step process consisting of electron capture and diffusion. The capture step determines the number of electrons lost in the D0 failure phenomenon and is directly affected by the trap that captures the electrons. The diffusion phase, in which the captured electrons are lost without returning to the capacitor, is affected by the structure of the device, which determines the distance between the captured electrons and the capacitor. In the proposed structure, a nitride layer is added to mitigate 1-RH. The nitride layer prevents electrons from being trapped, mitigating electrical interference when the WL$_{\mathrm{a}}$ is turned on. However, depending on the length and position of the nitride layer and the programming voltage, it can cause GIDL and supply electrons to the capacitor, causing additional power consumption and data corruption, so an optimization process is required. The nitride layer structure programmed with the optimized voltage showed an improvement of 70% compared to the existing ordinary structure. Further oxide layer improvement studies and the introduction of spherical oxide structures will improve the 1-RH even more effectively.