Differing bits after each step
Ciphertext Hamming distance, 2000 random single-bit flips
The cipher. Each round XORs a 16-bit round key into the state, pushes each nibble through the S-box, then transposes the 4×4 bit grid (bit at row i, column j moves to row j, column i). The last round skips the transposition and a final key is XORed in. Round key r is the 16-bit window of the 32-bit key starting at bit 4(r−1), wrapping around. This is the toy SPN from Stinson's Cryptography: Theory and Practice.
Designing the box. Avalanche is the mean number of output bits that flip when one input bit flips (2 of 4 is ideal). Differential uniformity is the largest count in the difference distribution table: for input difference a and output difference b, how many x satisfy S(x) ⊕ S(x ⊕ a) = b. Nonlinearity is the Hamming distance from the nearest affine function over all output masks. The textbook box scores 2.44 / 8 / 2, decent but not optimal; the PRESENT box reaches the 4-bit optimum of 4 / 4. Identity and linear boxes score 0 nonlinearity and 16 uniformity, and the cipher never avalanches no matter how many rounds you add.
Why it avalanches. A one-bit input difference changes one S-box input, and a good S-box turns that into two or three output differences. The permutation scatters those into different nibbles, so the next round has several active S-boxes. Within about four rounds every output bit depends on every input bit and every key bit, and each flips with probability near ½.