JP2002251888A - Non-volatile semiconductor, memory - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security circuit of a non-volatile memory in which alternation of security data by a third person is prevented and testability is considered. SOLUTION: Erasure is performed simultaneously by sharing a memory cell array 4 for protecting data and a reference cell for read-verify. When data of the reference cell 3 for read-verify is erased, as the non-volatile memory cannot accomplisch its role, consequently, alternation of data can be prevented.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a nonvolatile semiconductor memory device such as a flash memory or an EEPROM having a security circuit capable of protecting data such as data tampering by a third party.

[0002]

2. Description of the Related Art In recent years, a non-volatile semiconductor memory device has been required to have a data protection function, and an OTP (One Time Program) in which data can be written only once.
m) A memory cell array for data protection, such as a permanent lock bit for writing data at the time of product shipment from a manufacturing factory and then preventing erasure, etc., from being erasable by a third party is mounted. .

In this memory cell array for data protection, a data area for data protection is set separately from a normal data area, and data is written to the set data area by a specific method. Data protection is performed on a data area corresponding to the predetermined address information.

When writing / erasing data to / from the data area for data protection, Japanese Patent Application Laid-Open No. 62-23 / 1987
As disclosed in Japanese Patent Application No. 6053, by referring to the data protection information (set address and the like) written in these data protection memory cell arrays, it is determined whether or not the designated data area can be rewritten / erased. It is determined whether or not the data area is a data area, and if the designated area cannot be rewritten / erased, that is, if the designated area is a data area for data protection, a circuit configuration that does not allow the user to write / erase is adopted. ing.

As described above, the circuit configuration is such that once a user writes an address in the data protection memory cell array, it cannot be rewritten. For this reason, the data written in these data protection memory cell arrays has a circuit configuration that cannot be erased again.
This is because if the data protection information stored in the data protection memory cell array is erased, the data to be protected stored in the data area is not protected.

However, considering testability, it is necessary to incorporate a circuit for erasing the data protection memory cell array during a test. Conventionally, as this erasing circuit, an erasing voltage applying circuit is connected to the source and the word line of the data protection memory cell array, and the data protection information is cleared by performing a specific operation.

However, when an erasing circuit for the data protection memory cell array is built in, the protection data in the data protection memory cell array may be rewritten by a third party. If the data in the data protection memory cell array is rewritten, data protection information for OTP or the like becomes invalid. For this reason, falsification of data by a third party is permitted.

On the premise of the above, a schematic cross-sectional view of a memory cell of an ETOX (registered trademark of Intel Corporation) type flash memory as the most commonly used flash memory is shown in FIG. This will be described specifically.

As shown in FIG. 9, a memory cell 100 has a floating gate structure, a source S and a drain D are provided in a P-type semiconductor substrate 101, and the source S
A floating gate F on a P-type semiconductor substrate (P well) 101 between the gate and the drain D via a tunnel oxide film R1.
G is provided, and a control gate CG is provided on the floating gate FG via an interlayer insulating film R2.

At the time of writing (programming) to the memory cell 100, as shown in Table 1, a positive high voltage (for example, DC 10 V) is applied to the control gate CG, and a positive voltage (for example, DC 6 V) is applied to the drain D. A reference voltage (for example, 0 V) is applied to the source S and the P-type semiconductor substrate (well) 101.

[0011]

[Table 1]

As a result, in the channel layer between the drain D and the source S, a large amount of current flows from the drain D to the source S, and channel hot electrons are generated in a high electric field near the drain D region, so that the floating gate FG The threshold voltage of the memory cell is raised by injecting electrons into the memory cell, and the memory cell is brought into a write state.

On the other hand, when data is erased (erased) from the memory cell 100, as shown in Table 1, a negative voltage (for example, DC-9V) is applied to the control gate CG, and a positive voltage (for example, DC5V) is applied to the source S. ) Is applied, a reference voltage (for example, 0 V) is applied to the P-type semiconductor substrate (well) 101, and the drain D is opened.

Thus, electrons are extracted from the floating gate FG to the source S region, and the memory cell 100
Lowers the threshold voltage of the memory cell to bring it into an erase state.

When data is read from the memory cell 100, as shown in Table 1, the memory cell 1 to be read is read.
00 control gate CG (eg, DC5
V), and the drain D of the memory cell 100 and
For example, DC1V is applied to the drain D of a separately-installed read reference cell (having a threshold voltage of a memory cell in a predetermined erased state in advance), and a current value flowing through both cells is sensed by a sense amplifier S. The stored data is detected by comparing with / A and converting to a voltage value.

The threshold voltage Vth of the memory cell 100 in the write (program) state is different from the threshold voltage Vth of the memory cell 100 in the erase (erase) state, and the distribution state is shown in FIG. I have.

In FIG. 10, the horizontal axis shows the threshold voltage Vth of the memory cell, and the vertical axis shows the number of memory cells. The threshold voltage Vth of the memory cell in the erased state is DC.
The write and erase conditions are controlled so that the threshold voltage Vth of the memory cell in the written state falls within 1.5 V to 3.0 V and falls within 4.5 V or more.

In this control, a write pulse is applied in a write operation, and a comparison (write verify) with a threshold voltage Vth of a write reference cell, which will be described later, is performed. ,
While comparing (erasing verify) with a threshold voltage Vth of an erasing reference cell described later, a writing or erasing pulse is further applied to control the voltage to fall within a predetermined threshold voltage Vth. .

FIG. 11 shows an example of a memory cell array for one block of the data area memory cell array. In general, a plurality of blocks form a data area memory cell array, and a data area memory cell array for one block includes a plurality of memory cells 100 arranged in a matrix (vertical and horizontal) direction as shown in FIG. Are located. The control gate CG of the m memory cells 100 is connected to the word line WL0.
The same applies to n-1. The drain D of the n memory cells 100 is connected to the bit line BL0, and the same applies to the bit lines BL1 to BLm-1. The source S of the memory cells in the same block is a common source line S
L.

FIG. 12 is a block diagram showing a main configuration of a conventional flash memory having a data protection memory cell array. In FIG. 12, the flash memory 110
Are a data area memory cell array 111, a reference cell array 112, a data protection memory cell array 113, a word line voltage supply circuit 114, a common source line voltage supply circuit 115, a bit line voltage supply circuit /
It has a sense amplifier circuit section 116 and a control circuit section 117 for controlling each section.

The data area memory cell array 111 stores original data.

The reference cell array 112 includes reference memory cells such as a write verification reference cell, an erase verification reference cell, and a read reference cell.

The memory cell array 113 for data protection includes:
This area specifies a predetermined area of the data area memory cell array 111 and stores an address or the like for performing data protection on the area. The reference cell array 112 and the data protection memory cell array 1
13 is also basically a data area memory cell array 111
And the same memory cell.

The word line voltage supply circuit 114 includes a data area memory cell array word line voltage supply circuit 114A.
And reference cell array word line voltage supply circuit 11
4B and a data protection memory cell array word line voltage supply circuit 114C. Based on a control signal and an address signal from the control circuit unit 117, the voltage is increased to various voltages as shown in Table 1 above. Word lines WL0-W
Ln-1 is selectively driven.

The common source line voltage supply circuit 115 is connected to the data area memory cell array common source line voltage supply circuit 11.
5A, a reference cell array common source line voltage supply circuit 115B, and a data protection memory cell array common source line voltage supply circuit 115C, and the same block based on a control signal and an address signal from the control circuit unit 117. The common source line SL in which the common source S is shared is selected and boosted to a voltage as shown in Table 1 (or Table 2 described later) to drive the common source line SL.

The bit line voltage supply circuit / sense amplifier circuit section 116 controls the data area memory cell array 111 based on a control signal and an address signal from the control circuit section 117.
In addition, the bit lines BL0 to BLm-1 of the data protection memory cell array 113 are selectively driven by raising the voltage to a voltage as shown in Table 1 (or Table 2 described later), and at the time of writing, erasing, At the time of reading, the current flowing through the selected bit line is compared with the current flowing through each of the reference cells for writing verification, erasing verification, and reading in the separately provided reference cell array 112, and is determined by the sense amplifier circuit. Or data is being read.

Here, the data protection memory cell array 1
FIG. 13 shows an example of a circuit 13 and related circuits.

In FIG. 13, a data protection memory cell array 113 has a plurality of memory cells connected to a data protection memory cell array word line voltage supply circuit 114C with one word line having a common control gate CG. Each source is shared and connected to a data protection memory cell array source line voltage supply circuit 115C. The data protection memory cell array 11
The drain D of the memory cell No. 3 is connected to the bit line voltage supply circuit / sense amplifier circuit section 116 via each bit line.
It is connected to the.

In accordance with the address data stored in the data protection memory cell array 113, security is applied to a corresponding area of the data area memory cell array 111, and conversely, security is not applied to areas other than the corresponding area. The control circuit unit 117 controls. That is, according to the security information (address) stored in the memory cell in the data protection memory cell array 113,
The presence or absence of data protection for the corresponding area in the data area memory cell array 111 is determined.

A data protection memory cell array 113
If one of the memory cells is in a write state (threshold voltage is 4.5 V or more), the bit line voltage supply circuit /
The data is read out by the sense amplifier circuit section 116, the memory cell is determined to be in the written state, and the information is output to the control circuit section 117.

Thereafter, the control circuit section 117 protects data by prohibiting erasing and writing (data falsification) of the corresponding area in the data area memory cell array 111.

Conversely, if one memory cell in a certain data protection memory cell array 113 is in an erased state (threshold voltage is 1.5 V to 3.0 V), a bit line voltage supply circuit / sense amplifier circuit The data is read out by the unit 116, the memory cell is determined to be in the erased state, and the information is output to the control circuit unit 117.

The control circuit 117 does not inhibit erasing and writing of the corresponding area in the data area memory cell array 111, and the user can freely rewrite data.

As described above, by erasing the memory cells of the data protection memory cell array 113, the data area memory cell array 11 which has been secured until now is erased.
The data protection of the corresponding area in 1 can be released. Note that the above writing, erasing, and reading are
As described above, this is realized by applying the various voltages shown in Table 1 to each part of the memory cell.

[0035]

However, in the above-mentioned conventional manufacturing process, the threshold voltage of the data protection memory cell array 113 increases due to some reason in the manufacturing process, and the memory cells of the data protection memory cell array 113 become less active. If the setting is performed, the data in the corresponding area of the data protection memory cell array 113 is protected, and if the above-described erasing circuit is not provided, the test cannot be performed. It is necessary to erase data from the data protection memory cell array 113 at the initial stage of device test.

However, in the case where the above-described erasing circuit is provided, if the data protection memory cell array is erased by a third party after the product is shipped, falsification of the protected data is permitted. Therefore, it is necessary to add some security circuit for preventing erasure before the product is shipped from the manufacturing factory.

This is because, as described above, if the threshold voltage changes to a high value in the manufacturing process, security is activated in the writing state, and the test cannot be performed. There is a laser trim method in which security information is written by cutting wiring and the like as in a fuse-type mask ROM. However, the cost is increased due to the additional step, and this method is not a very good method.

The present invention has been made in view of the above-mentioned conventional circumstances, and provides a nonvolatile semiconductor memory device capable of preventing data tampering due to a change in security information by a third party and improving testability. The purpose is to do.

[0039]

A non-volatile semiconductor memory device according to the present invention protects data stored in a corresponding area of a data area memory cell array based on data stored in the data protection memory cell array, and protects data stored in the data area memory cell array. In a nonvolatile semiconductor memory device in which information of a memory cell of a memory cell array and a data area memory cell array can be read using a reference cell, when erasing data of a memory cell for data protection, data of the reference cell is also erased at the same time. A security circuit is provided, whereby the above object is achieved.

Preferably, a memory cell in the nonvolatile semiconductor memory device of the present invention has at least a gate,
The memory cell array for data protection includes a drain and a source, and is constituted by a floating gate field-effect transistor capable of electrically writing and erasing information, and the data protection memory cell array stores data stored in a memory cell in a corresponding area of the data area memory cell array. And data protection information for making it impossible to rewrite and erase.

Still preferably, in a security circuit in the nonvolatile semiconductor memory device according to the present invention, a gate of a data protection memory cell and a gate of a reference cell are commonly connected, and an erase voltage is applied to each gate simultaneously. There is provided a gate voltage supply unit that enables the source, a source of the memory cell for data protection and a source of the reference cell, which are commonly connected, and a source voltage supply unit that can simultaneously apply an erase voltage to each source.

Still preferably, in a nonvolatile semiconductor memory device according to the present invention, the source voltage supply means applies a high voltage to each source of the memory cells and the reference cells of the data protection memory cell array at the same time, and the gate voltage supply means. However, by applying a negative voltage to the gates of both cells at the same time, when lowering the threshold voltage of one of the two cells, the threshold voltages of both cells are simultaneously reduced.

Still preferably, in a nonvolatile semiconductor memory device according to the present invention, the reference cell includes a threshold voltage of the memory cell at the time of writing / erasing to / from a memory cell in the data area memory cell array and the data protection memory cell array. A reference cell for verifying a voltage and a reference cell for comparing a threshold voltage at the time of reading are provided.

Further, preferably, in the nonvolatile semiconductor memory device of the present invention, the reference cell to be erased is
This is only the reference cell for threshold voltage comparison at the time of reading.

Further, preferably, the reference cells in the nonvolatile semiconductor memory device of the present invention are only reference cells for threshold voltage comparison at the time of reading.

Further, preferably, in the nonvolatile semiconductor memory device of the present invention, the data area memory cell array is erased in units of blocks, and a corresponding area for data protection is also set in units of blocks.

Further, preferably, in the nonvolatile semiconductor memory device of the present invention, the data protection information stored in the data protection memory cell is information corresponding to a block of the data area memory cell array.

More preferably, in the security circuit in the nonvolatile semiconductor memory device of the present invention, a high voltage is applied to the source in the circuit configuration of the fourth aspect. Well)
To lower the threshold voltages of the memory cells in both memory cell arrays.

Further, preferably, the security circuit in the nonvolatile semiconductor memory device of the present invention applies a voltage higher than that of claim 4 to both sources at the same time, thereby increasing the threshold voltage of the memory cells in both memory cell arrays. Lower.

More preferably, the security circuit in the nonvolatile semiconductor memory device of the present invention applies a voltage higher than the voltage applied to both sources simultaneously to both channels to the channel so that the voltage is applied to the channels. Lower the threshold voltage of the memory cell.

Further, preferably, the security circuit in the nonvolatile semiconductor memory device of the present invention applies a negative voltage to both sources and applies a high voltage to the word line, so that the memory cells in both memory cell arrays are connected to each other. Increase the threshold voltage.

More preferably, the security circuit in the nonvolatile semiconductor memory device of the present invention applies a negative voltage to both sources to a channel so that the negative voltage is applied to the channels so that the memory cells in the two memory cell arrays are connected to each other. Increase the threshold voltage.

Further, preferably, the security circuit in the nonvolatile semiconductor memory device of the present invention applies a voltage higher than the above-mentioned high voltage applied to the word line, so that the threshold of the memory cells in both memory cell arrays is increased. Increase the value voltage.

According to the above configuration, when erasing the memory cell array for data protection, the information of the reference cell connected to the reference bit used at the time of read / program verify and erase verify is also erased at the same time. When the data is erased, the device cannot perform operations such as reading, writing, and erasing, so that data tampering by a third party can be prevented. Further, at the same time as erasing the data protection memory cell array, the information of the reference cell is also erased, so that testability can be improved.

[0055]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A nonvolatile semiconductor memory device according to an embodiment of the present invention applied to a flash memory will be described below with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of a flash memory according to the present invention having a memory cell array for data protection.

In FIG. 1, the flash memory 1 includes a data area memory cell array 2, a reference cell array 3, a data protection memory cell array 4, a word line voltage supply circuit section 5 as word voltage supply means, and a source voltage supply circuit. Common source line voltage supply circuit section 6 as means
And a bit line voltage supply circuit / sense amplifier circuit section 7,
And a control circuit section 8 for controlling each section.

The data area memory cell array 2 is composed of a plurality of blocks Bi (i = 0 to 3; B0 to B3), and stores original data.

The reference cell array 3 includes a write verification reference cell, an erase verification reference cell, and a read reference cell.

The data protection memory cell array 4 specifies a predetermined area of the data area memory cell array 2 and stores an address (data protection information) for performing data protection on the area.

The word line voltage supply circuit section 5 has a data area memory cell array word line voltage supply circuit 5A and a reference cell array / data protection memory cell array word line voltage supply circuit 5B. The word lines WL0 to WLn are boosted to various voltages as shown in Table 1 based on the signals and the address signals.
-1 is selectively driven.

The common source line voltage supply circuit section 6 includes a data area memory cell array common source line voltage supply circuit 6A.
And a reference cell array / memory cell array common source line voltage supply circuit 6B for data protection. Based on a control signal and an address signal from the control circuit unit 8,
A common source line S in which the sources S in the same block are shared
L is selectively driven by boosting L to various voltages as shown in Table 1 (or Table 2 described later).

The bit line voltage supply circuit / sense amplifier circuit unit 7 controls the bit lines BL0 to BL of the data area memory cell array 2 and the data protection memory cell array 4 based on the control signal and the address signal from the control circuit unit 8.
Lm-1 is selectively driven by raising it to various voltages as shown in Table 1 (or Table 2 described later), and
At the time of writing, erasing, and reading, the current flowing through the selected bit line is transferred to the reference cell array 3 provided separately.
Of the reference cells for writing verification, erasing verification, and reading are compared with each other to make a determination by the sense amplifier circuit to perform verification or data reading.

A feature of the present invention is that the word line voltage supply circuit 5 and the source line voltage supply circuit 6 are shared by the reference cell array 3 and the data protection memory cell array 4 so that the same word line drive voltage and the same source The point is that the line drive voltage is applied. These circuits include a control circuit unit 8
Based on the control signal from the controller, the respective word lines and bit lines are driven by boosting to various voltages as shown in Table 1 above.

Here, circuits related to the features of the present invention, that is, reference cell array 3, data protection memory cell array 4, reference cell array / data protection memory cell array, word line voltage supply circuit 5B, reference cell array / data protection memory The security circuit including the cell array common source line voltage supply circuit 6B, the bit line voltage supply circuit / sense amplifier circuit section 7, and the control circuit section 8 will be described in more detail with reference to FIGS.

In FIG. 2 and FIG. 3, the read / judgment circuit 10 for the data protection memory cell array 4 in the flash memory 1
And a reference cell array / data protection memory cell array word line voltage supply circuit 5B, a reference cell array / data protection memory cell array common source line voltage supply circuit 6B, a bit line voltage supply circuit 7A, and a sense amplifier circuit 7B. It has a voltage supply circuit / sense amplifier circuit section 7 and a control circuit section 8. Here, the control circuit unit 8 receives the output of the sense amplifier S / A of the sense amplifier circuit 7B, as well as the bit line selection signals CSEL0 to CSEL3 and the control signal RSEL. P
V, RSEL EV, RSEL It outputs RE.

The data protection memory cell array 4 includes a plurality of data protection memory cells BSi (i = 0 to 3; BS0
ＢＳBS3), for example, if the data protection memory cell BSi is in the written state, security is applied to the block (or the corresponding area) of the data area memory cell array 2 corresponding to the written address, and that block ( Or data in the corresponding area) cannot be erased or rewritten.

On the other hand, the data protection memory cell BSi (i
= 0 to 3) in the erased state, the security of the block (or the corresponding area) of the memory cell area (data area) of the corresponding data area memory cell array 2 does not work, and Data can be erased and rewritten freely.

In the memory cell array 4 for data protection, here, the four memory cells BSi for data protection share one control gate CG as one word line WLS, and the word line voltage supply circuit 5B for the memory cell BSi for data protection. And is connected to the source line voltage supply circuit 6B of the data protection memory cell BSi by using the respective sources in common.

Further, the read reference cell Cell of the reference cell array 3 is read. RE, reference cell for write verification Cell PV, reference cell for erasure verification Cell The control gates CG of the EVs are shared, and the word lines WLref from the data protection memory cell array 4 are connected as one word line WLref. Each of the source lines SL is also shared. Are connected to the source lines from the data protection memory cell array 4.

First, the operation of the data protection memory cell array 4 and its related circuits will be described.

The data area memory cell array 2 is composed of four blocks B0 to B3. For example, information as to whether or not to secure data stored in one block is stored in one of the data protection memory cell arrays 4. The memory cell is responsible.

That is, the data protection memory cell array 4
According to the security information of one of the memory cells, the necessity of data protection of a predetermined block in the data area memory cell array 2 is determined.

One memory cell in a certain data protection memory cell array 4 is written to (a threshold voltage of 4.
If the voltage is set to 5 V or more, the bit line voltage supply circuit / sense amplifier circuit unit 7 reads the data, determines that the memory cell is in the written state, and sends the determination information of the memory cell from the sense amplifier S / A to the control circuit unit. 8 is output.

Thereafter, the control circuit unit 8 prohibits erasing and writing of the corresponding block in the data area memory cell array 2, thereby preventing data tampering by a third party, that is, data protection.

Conversely, if one memory cell in a certain data protection memory cell array 4 is in an erased state (threshold voltage is 1.5 V to 3.0 V), a bit line voltage supply circuit / sense amplifier circuit 7, the memory cell is determined to be in the erased state, and the determination information of the memory cell is output from the sense amplifier S / A to the control circuit unit 8.

The control circuit section 8 can freely rewrite data without prohibiting writing and erasing of a corresponding block in the data area memory cell array 2.

Further, by erasing the memory cells of the data protection memory cell array 4, the operation is performed so that the data protection of the corresponding block in the data area memory cell array 2 which has been secured can be released. .

The above-described writing, erasing, and reading are as described above, and are realized by applying the various voltages shown in Table 1 to the memory cells.

First, when writing to the data protection memory cell BSi, a positive high voltage (eg, DC) is applied to the word line WLS.
10 V), a positive voltage (for example, 6 V DC) is applied to the bit line of the memory cell to which writing is performed, and a reference voltage (for example, 0 V) is applied to the bit line of the memory cell where writing is not performed. A reference voltage (for example, 0 V) is applied to (channel; P well) (see Table 1).

As a result, in the channel layer between the source S and the drain D, a large amount of current flows from the drain D to the source S, and channel hot electrons are generated in a high electric field near the drain D region, and the floating gate F
When electrons are injected into G, the threshold voltage of the memory cell is raised, and the memory cell is brought into a write state.

On the other hand, erasing is performed on the word line WL.
A negative voltage (for example, DC-9 V) is applied to S, a positive voltage (for example, 5 V) is applied to the source S, and a P-type semiconductor substrate (P well)
, A reference voltage (for example, 0 V) is applied, and the drain D is opened.

As a result, electrons are extracted from the floating gate FG to the source S region, the threshold voltage of the memory cell is reduced, and the memory cell is brought into the erased state. This erasure
The data protection memory cell array 4 and the reference cell array 3 (for reading, writing verification, and erasing verification) are simultaneously performed.

Next, the operation of reading the data protection memory cell array 4 with respect to the reference cell array 3 and its related circuits will be described.

A positive voltage (for example, DC 5.0) is applied to the word line WLS input to the control gate CG of the data protection memory cell BSi of the data protection memory cell array 4.
V). The common source line SL connected to the source S of each memory cell and the P-type semiconductor substrate (channel; P well) are set to the reference voltage 0V.

In order to select a bit line (for example, BL0) connected to the memory cell to be read from the bit lines BL0 to BL3 connected to the drain D of the memory cell, a bit line selection signal CSEL0 from the control circuit unit 8 is selected. To a high level to turn on the MOS transistor T00. The other bit line selection transistors T01 to T03 are turned off.

The verification of the threshold voltage of the memory cell is compared with the threshold voltage (for example, 3.8 V) of the read reference memory cell Cell_RE which has been written and has a predetermined threshold voltage. Do it. Note that a write verification reference memory cell Cell_PV (threshold voltage: 4.5 V) and an erase verification reference memory cell Cell_EV (threshold voltage: 3.0 V) are also provided. Description is omitted.

Read Reference Cell Cell_RE
In order to turn on the MOS transistor T _{rR E} leading to, and the selection signal RSEL_RE from the control circuit unit 8 to the high level, the reference memory cell Cel for reading
Select l_RE.

Reference cell word line Wlref line (word line WL of the data protection memory cell array described above)
S (connected to S), the same positive voltage (for example, DC 5 V) as that of the word line WLS is applied.

At the time of reading, the drain D of the memory cell
In consideration of the disturbance to the memory cell, the drain BL (Drain_bias) circuit 71 and the reference drain bias (Drain # bias_Ref) circuit 72 provide the nodes BL_MEM and BL connected to the memory cell.
_Ref is limited to 1 V or less.

The power supply V via the load circuit (LOAD) 73
A current is supplied from cc to the selected data protection memory cell, and a current is supplied from the power supply Vcc to the selected read reference cell Cell_RE via the load circuit (LOAD) 74.

In the selected memory cell in the data protection memory cell array 4, a current flows according to a write or erase state. Here, when the threshold voltage of the selected memory cell is in the written state (the threshold voltage is 4.5 V or higher), the current flowing through the node BL_MEM is smaller than the current flowing through the node BL_Ref on the reference cell side. Become. This difference in the current value is due to the sense amplifier S /
Node SAIN and node SAIN_R at the input stage of A
ef is converted into a difference in voltage value, and is converted into a sense amplifier S / A.
Input stage.

In this case, the voltage V input to the sense amplifier S / A is reduced due to the voltage drop by the load circuits 73 and 74.
SAIN becomes a voltage higher than the voltage VSAIN_Ref. As a result, the sense amplifier S / A outputs a high level “1” to the control circuit unit 8.

Conversely, if the selected memory cell in the data protection memory cell array 4 is in the erased state (threshold voltage is 1.5 V to 3.0 V), the voltage drop by the load circuits 73 and 74 causes The voltage VSAIN input to the sense amplifier S / A becomes lower than the voltage VSAIN_Ref. As a result, the sense amplifier S / A outputs a low level “0” to the control circuit unit 8.

Thus, the read reference cell C
Memory cell BSi for data protection using cell_RE
Can be read.

The read result is output to the control circuit unit 8. In the control circuit unit 8, it is determined according to the read result "1" or "0" whether or not the security of the corresponding block of the data area memory cell array 2 is necessary. If security is required (the corresponding data protection memory cell is in a written state), erasing and writing to the corresponding block are prohibited.

On the other hand, if security is not available (the corresponding data protection memory cell is in the erased state), erasing and writing to the corresponding block can be performed freely.

The data reading from the data area memory cell array 2 is performed by reading the read reference cell Cell_RE.
Is performed in the same manner as the method of reading the data protection memory cell. In this case, the data protection memory cell array 4 in FIG. 3 is replaced with the data area memory cell array 2.

However, in order for a third party to falsify (rewrite) data in a block of the data area memory cell array 2 which is secured, first, the data protection memory cell BSi must be erased. In this case, the reference cell array (the read, write verify, and erase verify reference cells) is also erased at the same time to be in the erased state.

Thus, data protection memory cell BS
In comparison with i, in the nonvolatile semiconductor semiconductor device that has once performed the erasing operation for releasing the security, the threshold voltage of the read reference cell is low as the threshold voltage (1.5 V to 3.0 V) in the erased state. Therefore, when the data in the data area memory cell is read out thereafter,
In the memory cell in which the data whose output of the sense amplifier S / A should surely become “0” in the erased state is stored,
An output of "1" is also output, so that correct data cannot be read.

Further, the reference cell for writing verification and the reference cell for erasing verification are similarly in the erased state, and have a preset threshold voltage (4.5 V,
3.0 V) is changed, so that it becomes impossible to verify (verify) whether or not a predetermined value has been reached at the time of writing and erasing, so that the nonvolatile semiconductor memory device can perform its original function. And it cannot be used as a device.

[0102] To reiterate, the data protection memory cell array 4 for recording data protection information is described.
In addition, the circuit for erasing the read / verify reference cell 3 is made common, and erasing is performed at the same time. When the read / verify reference cell 3 is erased, the non-volatile memory can no longer function as a memory, so that data tampering is prevented as a result.

Thus, a non-volatile semiconductor memory device whose data has been rewritten by a third party can be identified and removed from the market.

In a test step before shipment of a product from the factory, after the nonvolatile semiconductor memory device is erased at a time (the memory cells for data protection are also erased), a test of writing, reading and erasing of all the memory cells is performed. Since no special circuit is required to prevent the falsification of protected data after product shipment, there is no increase in circuit scale.

Further, the memory cell array 4 for data protection and the reference cell array 3 share the word line WL and the source line SL and can be simultaneously erased and tested at the same time. The test time before shipment can be shortened.

In this embodiment, the point is that the data protection memory cell array 4 and the reference cell array 3 (for write verification, erasure verification, and read) are erased simultaneously. Although not particularly described, the present invention is applicable as long as the two memory cell arrays 3 and 4 are constituted by nonvolatile semiconductor memory devices. Therefore, for example, the NAND type, the AND type, the NOR type, and the ACT in which the configurations of the memory cell arrays 3 and 4 are different.
(Asymmetrical Contactless Transistor) type memory cell array configuration, etc.

In the ACT type memory cell array configuration, the threshold voltage values in the written state and the erased state are reversed, and the threshold voltage is 3.0 V or less in the written state and 4.5 V or more in the erased state. Even in this case, security can be applied by putting the data protection memory cell which is in charge of the security block into the write state after the erase state has been collectively performed, as in the case of the above-described embodiment. is there.

Further, the above-mentioned applied voltage for writing, applied voltage for erasing, and applied voltage for reading are only examples. For example, while an example is described in which a negative voltage is applied to the word line WL during erasing, a method of applying a reference voltage of 0 V may of course be used.

The description so far is based on the value of “1”,
Although the description has been given of a binary nonvolatile semiconductor memory device having a value of “0”, it is needless to say that the present invention can be applied to a multivalued nonvolatile semiconductor memory device such as a quaternary or octal value. That is.

Further, in the present embodiment, the description has been given of the example of writing and erasing using hot electrons. However, a triple well structure (FIG. 1) is used as a memory cell configuration.
4, a predetermined voltage is applied to the P-well to electrically separate the P-type semiconductor substrate and the P-well having the channel layer from the P-type semiconductor substrate. The same potential is applied to the channel layer of the memory cell, and electrons are injected or extracted by a Fowler-Nordheim (FN) tunnel phenomenon between the channel layer between the source S and the drain D and the floating gate FG. The present invention can also be easily applied to a method for reducing the value. Table 2 shows an example of voltage application in this case.

[0111]

[Table 2]

Table 2 shows an example of channel erasing in which hot electrons are used for writing and electrons are drawn out of the floating gate FG to the channel layer by the FN tunnel phenomenon. Note that the description of the drain applied voltage at the time of writing in Tables 1 and 2 above means that 6 V is applied to the drain D of the memory cell to be written, and 0 V is applied to the drain D of the memory cell to which writing is not performed. is there.

Further, in the present embodiment, the data protection memory cell array 4 is an example provided corresponding to a predetermined block of the data area memory cell array 2, but the predetermined block is divided into several blocks. Alternatively, it may correspond to a predetermined area within a predetermined block or straddling between predetermined blocks, or another method may be used. For example,
A method of storing the address of the memory cell in bit units (first address, last address) may be used.

However, if the address (protection data) stored in the data protection memory cell BSi uses a block number in block units, the number of data protection memory cells BSi can be reduced, and the nonvolatile semiconductor memory can be used. In the case of the device, erasing is performed in block units or all blocks at once, so that consistency is good.

Further, in the present embodiment, an example has been described in which the data protection memory cell is erased in a state where all the reference cells are erased. However, for example, even when only the read reference cell is erased, the data cannot be read out. Such security can be realized, but this can be easily realized by sharing only the word line WL connected to the control gate CG of the read reference cell with the data protection memory cell array.

In the present invention, the data protection memory cell array 4 that has been erased due to data falsification cannot operate normally as a nonvolatile semiconductor memory device. When it is desired to add a block to which security is to be applied to another block later, it can be easily realized because only the corresponding data protection memory cell is set to the write state.

Although not particularly described in the present embodiment, the word line voltage supply circuit 5 (gate voltage supply means)
A specific example will be described in more detail.

The word line voltage supply circuit 5 of FIG. 4 comprises a word line output section, a voltage switching section (switching between Vcc level and hnvneg level), a positive high voltage level shifter circuit HV and a negative high voltage level shifter circuit NV. I have.

FIG. 5 shows a specific example of the circuit of the positive high voltage level shifter circuit HV.
FIG. 6 shows a specific example of the circuit shown in FIG.

In FIG. 5, the positive high-voltage level shifter circuit HV is configured such that the input signal in is at a high level (power supply voltage Vc).
When the input signal in is at a low level (reference voltage 0 V level), the level is converted to a low level (reference voltage 0 V level) when the input signal in is at a low level (reference voltage 0 V level) and output from the output hhout. Circuit. Note that hhoutb is an inverted output terminal of hhout.

In FIG. 6, the negative high-voltage level shifter circuit NV has an input signal in whose input signal in is at a high level (power supply voltage Vc).
c level), high level (power supply voltage Vcc level)
On the other hand, when the input signal in is at the low level (reference voltage 0 V level), the low level (negative high voltage hn)
(in-level) and output from the output hnout. Hnoutb is an inverted output terminal of hnout.

First, writing to the memory cell for data protection is performed, for example, on the signal lines hhwlmx and hhin, for example.
10V is output, and the control signal mwlon is set to the high level.

As a result, the output terminal hhoutb of the positive high voltage level shifter circuit HV becomes low level,
When the MOS transistor P1 of the word line output section turns on,
Since the MOS transistor N1 is off, 10 V is output to the word line.

Although not particularly described in the present embodiment, the source line voltage supply circuit 6 (source voltage supply means)
A specific example will be described in more detail.

In FIG. 7, source line voltage supply circuit 6
Consists of an output part to the source line SL and a positive high voltage level shifter circuit HV. By setting the control signal erswel to a low level (reference voltage level), the output of the positive high voltage level shifter circuit HV becomes high level (hvs voltage level) of hhoutb.
Since the OS transistor P1 is turned off and the MOS transistor N1 is turned on, the reference voltage 0V is output to the source line SL.

Subsequently, only the bit line voltage supply circuit 7A of the bit line voltage supply circuit / sense amplifier circuit 7 is shown in FIG.
Is shown in

In FIG. 8, bit line voltage supply circuit 7A
Are output parts to bit lines (MOS transistors N0 to N
3) and a positive high voltage level shifter HV connected to each output unit.

The outputs of the bit line voltage supply circuit 7A are supplied via MOS transistors (the transistors Tr10 to Tr13 are turned on when writing, and otherwise turned off).
The output terminals (mbl0 to mbl3) are connected to the respective drains D of the data protection memory cell array.

When the control signal oni (i = 0 to 3) is at a high level (power supply voltage Vcc level), the output terminal hhout of the positive high voltage level shifter HV is at a high level, so that the MOS transistor Ni ( i = 0-3)
Is turned on, the MOS transistor Tri (i = 0 to 0)
3) through the output terminal mbli (i = 0-3)
, For example, 6V is output.

If the memory cell to be written in the data protection memory cell is, for example, BS0, the control signal on
0 is input at a high level, and for example, 6 V is applied to the output terminal mbl0 connected to the drain of the memory cell BS0.

On the other hand, the control signals on1 to on3 are set to low level (reference voltage 0 V level) in order to apply the reference voltage 0 V to the drains of the data protection memory cells BS1 to BS3 where writing is not performed.

Although not shown in FIG. 2, a similar bit line voltage supply circuit is provided for the drain D on the reference cell side, and each drain D is applied to the reference voltage 0V.

Thus, electrons are injected into floating gate FG of memory cell BS0, and its threshold voltage V
By setting th to the write state (4.5 V or higher), the data protection function of the corresponding block B0 in the data area becomes effective.

Next, in the erasure of the data protection memory cell array 4, at this time, the data protection memory cell and all the reference cells are erased collectively.

In the word line voltage supply circuit section 5 shown in FIG.
For example, −9 V is output to nvneg, and the control signal e
rson rises to a high level (power supply voltage Vcc level), and the control signal mwlon changes to a low level (reference voltage 0).
V level).

Thus, the positive high voltage level shifter HV
Output terminal hhoutb is at a high level (hhwlmx
Level), the MOS transistor P1 in the output section is turned off, while the MOS transistor N1 is turned on.

Since the output terminal hnout of the negative high voltage level shifter NV goes high, the MOS transistor P2 of the voltage switching section is in the OFF state, and N2 is ON.
State.

Therefore, the hnvneg level (for example, -9 V) is output to the word line.

In the source line voltage supply circuit 6, the control signal erswell rises to a high level (power supply voltage Vcc level). Thereby, the positive high voltage level shifter HV
Output terminal hhoutb outputs a low level (reference voltage), and the MOS transistor P1 in the output section is turned on , while the MOS transistor N1 is turned off.
If vs is 5V, 5V is output to the source line.

Further, the bit line voltage supply circuit / sense amplifier circuit section 7 includes MOS transistors Tr10 to Tr1.
3 (see FIG. 8), MOS transistors Tr00-Tr
03 (see FIG. 2), MOS transistors Trpv, Tr
To control ev and Trre (see FIG. 2) to the OFF state, each drain is in the open state.

As described above, Table 1 shows the applied voltage at the time of erasing the memory cell. When disabling the data protection function, the word line voltage supply shown in FIG. In the circuit section 5, the erson signal becomes high level, and the hnvneg voltage (for example, DC-9V) is output to the gate. As described above, a negative voltage is applied to the gate from the word line voltage supply circuit unit 5 and a high voltage is applied from the source line voltage supply circuit unit 6 to generate a high electric field between the source S and the control gate CG, By extracting the injected potential using the tunnel current, the security information written in the data protection memory cell array 4 and the reference information written in the read / verify reference cell array 3 are erased.

Finally, for reading, first, in the word line voltage supply circuit 5, the control signal mwlon is set to the low level (reference voltage level), while the control signal erson is
To a low level (reference voltage level).

As a result, the output terminal hnout of the negative high voltage level shifter circuit NV goes low (hnvneg).
Level), the MOS transistor P2 of the voltage switching unit is in the ON state, and the MOS transistor N2 is OFF.
State, and the Vcc level is output from the voltage switching unit.

The positive high voltage level shifter circuit HV
From the output terminal hhoutb of the high level (hhwlmx
Voltage level) is output, the MOS transistor P1 in the output section is in the off state, while the MOS transistor N1
Is turned on, and as a result, 5 V is output to the word line.

The source line voltage supply circuit section 6 performs the same control as at the time of writing, that is, by setting the control signal erswel to a low level (reference voltage level), the output of the positive high voltage level shifter circuit HV is houtb. Since it is at a high level (hvs voltage level), the output MO
Since the S transistor P1 is turned off and the MOS transistor N1 is turned on, a reference voltage of 0 V is output to the source line.

On the other hand, as described above, the bit line voltage supply circuit / sense amplifier circuit section 7 performs reading by comparing with a reference cell for reading.

[0147]

As described above, according to the present invention, when erasing the security information recorded in the data protection memory cell array, the corresponding read / verify reference cell is also erased at the same time. It is possible to obtain a security circuit for a non-volatile semiconductor memory device that keeps security and reduces test time in order to disable basic functions such as reading, writing, and erasing of the device itself. is there.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of a flash memory of the present invention having a memory cell array for data protection.

FIG. 2 is a circuit diagram showing a configuration example of a read / determination circuit in the flash memory of the present invention.

FIG. 3 is a block diagram illustrating a configuration example of a security circuit in the nonvolatile semiconductor memory device according to the embodiment of the present invention.

FIG. 4 is a circuit diagram showing a configuration example of a word line voltage supply circuit of FIG. 1;

FIG. 5 is a circuit diagram illustrating a configuration example of a high voltage level shifter circuit.

FIG. 6 is a circuit diagram illustrating a configuration example of a negative voltage level shifter circuit.

FIG. 7 is a circuit diagram showing a configuration example of a source voltage supply circuit of FIG. 1;

FIG. 8 is a circuit diagram showing a configuration example of a bit line voltage supply circuit of FIG. 1;

FIG. 9 is a cross-sectional view showing a basic structure of a memory cell in a conventional flash memory.

FIG. 10 is a threshold voltage distribution diagram of a memory cell in a conventional flash memory.

FIG. 11 is a circuit diagram of one block of a memory cell array.

FIG. 12 is a block diagram of a conventional flash memory having a data protection memory cell array.

FIG. 13 is a circuit diagram showing a configuration example of a conventional security circuit.

FIG. 14 is a cross-sectional view of a memory cell having a triple cell structure in a conventional flash memory.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 flash memory 2 data area memory cell array 3 reference cell array 4 data protection memory cell array 5 word line voltage supply circuit 6 common source line voltage supply circuit 7 bit line voltage supply circuit / sense amplifier circuit 8 control circuit

Claims (9)

[Claims] The present invention protects data stored in a corresponding area of a data area memory cell array based on data stored in the data protection memory cell array, and stores information of the data protection memory cell array and the memory cells of the data area memory cell array. What is claimed is: 1. A non-volatile semiconductor memory device readable by using a reference cell, comprising a security circuit for simultaneously erasing data of the reference cell when erasing data of the data protection memory cell. 2. The method according to claim 2, wherein the memory cell has at least a gate,
A floating gate field effect transistor having a drain and a source and capable of electrically writing and erasing information, wherein the data protection memory cell array is stored in a memory cell in a corresponding area of the data area memory cell array; 2. The nonvolatile semiconductor memory device according to claim 1, wherein data protection information for making said data unrewritable and erasable is stored. 3. The security circuit according to claim 1, wherein a gate of the memory cell for data protection and a gate of the reference cell are connected in common, and a gate voltage supply means for applying an erase voltage to each of the gates simultaneously. 3. The non-volatile memory according to claim 2, further comprising a source voltage supply means for commonly connecting a source of said data protection memory cell and a source of said reference cell, and capable of simultaneously applying an erase voltage to each of said sources. Semiconductor storage device. 4. The source voltage supply means applies a high voltage to each source of a memory cell and a reference cell of the data protection memory cell array at the same time, and the gate voltage supply means simultaneously applies a gate to both cells. 4. The nonvolatile semiconductor memory according to claim 3, wherein the threshold voltage of one of the two cells is simultaneously lowered when the threshold voltage of one of the two cells is lowered by applying a negative voltage. apparatus. 5. The verifying reference cell for verifying a threshold voltage of the memory cell at the time of writing and erasing the memory cell in the data area memory cell array and the memory cell array for data protection. 5. The nonvolatile semiconductor memory device according to claim 1, further comprising a reference cell for comparing a threshold voltage at the time of reading. 6. The nonvolatile semiconductor memory device according to claim 2, wherein the reference cells to be erased are only reference cells for threshold voltage comparison at the time of reading. 7. The non-volatile semiconductor memory device according to claim 6, wherein said reference cells are only reference cells for comparing threshold voltages at the time of reading. 8. The nonvolatile semiconductor memory device according to claim 1, wherein the data area memory cell array is erased in block units, and the data protection area is set in block units. . 9. The nonvolatile semiconductor memory device according to claim 8, wherein the data protection information stored in the data protection memory cell is information corresponding to a block of the data area memory cell array.