KR20240014439A - A semiconductor memory device and a memory system - Google Patents

Abstract

The semiconductor memory device includes a memory cell array, a row hammer management circuit, and a control logic circuit. The memory cell array includes a plurality of memory cell rows, each having a plurality of memory cells. The row hammer management circuit counts the number of activations of each of the plurality of memory cell rows based on an active command from an external memory controller and stores the counting values as count data in count cells of each of the plurality of memory cell rows. and the plurality of memory cell rows based on a precharge command applied after the active command received at a first time and applied at a second time after the first command instructing a memory operation for the target memory cell row. Among them, internal read - reading the count data stored in the count cells of a target memory cell row, updating the read count data, and rewriting the updated count data to the count cells of the target memory cell row - Perform a edit-write operation. The control logic circuit performs the memory operation on the target memory cell row based on a first command and controls the row hammer management circuit.

Description

A semiconductor memory device and a memory system including the same {A semiconductor memory device and a memory system}

The present invention relates to the field of memory, and more specifically, to a semiconductor memory device that protects against low hammer attacks and a memory system including the same.

Semiconductor memory devices can be largely divided into volatile memory devices and nonvolatile memory devices. A volatile memory device is a memory device in which the stored data is lost when the power supply is cut off. Among volatile memory devices, dynamic random access memory (DRAM) is used in various fields such as mobile systems, servers, and graphics devices.

In volatile memory devices such as DRAM, cell charges stored in memory cells may be lost due to leakage current. Additionally, when a word line frequently transitions between an active state and a precharge state, that is, when a word line or row is accessed intensively, memory cells connected to adjacent word lines may be affected, causing cell charge to be lost. Before the cell charge is lost and the data is completely damaged, the charge of the memory cell must be recharged again, and this recharging of the cell charge is called a refresh operation. This refresh operation must be performed repeatedly before the cell charge is lost.

One object of the present invention is to provide a semiconductor memory device that can defend against a row hammer attack by updating count data based on a precharge command without a dedicated command.

One object of the present invention is to provide a memory system including a semiconductor memory device capable of preventing a row hammer attack by updating count data based on a precharge command without a dedicated command.

A semiconductor memory device according to embodiments of the present invention for achieving the above object includes a memory cell array, a row hammer management circuit, and a control logic circuit. The memory cell array includes a plurality of memory cell rows, each having a plurality of memory cells. The row hammer management circuit counts the number of activations of each of the plurality of memory cell rows based on an active command from an external memory controller and stores the counting values as count data in count cells of each of the plurality of memory cell rows. and the plurality of memory cells based on a precharge command applied at a second time after the first command that is applied after the active command received at a first time and instructing a memory operation for the target memory cell row. Internal read for reading the count data stored in the count cells of a target memory cell row among rows, updating the read count data, and rewriting the updated count data to the count cells of the target memory cell row. -Perform the edit-write operation. The control logic circuit performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit.

A semiconductor memory device according to embodiments of the present invention for achieving the above object includes a memory cell array, a row hammer management circuit, and a control logic circuit. The memory cell array includes a plurality of memory cell rows, each having a plurality of memory cells. The row hammer management circuit counts the number of activations of each of the plurality of memory cell rows based on the first active command and the second active command continuously received from an external memory controller and stores the counting values as count data. Stored in each count cell of memory cell rows, applied after the first active command and the second active command received at a first time, and after a first command instructing a memory operation for the target memory cell row In, based on a precharge command applied at a second time, the count data stored in the count cells of a target memory cell row among the plurality of memory cell rows is read, the read count data is updated, and the update is performed. An internal read-modify-write operation is performed to rewrite the stored count data into the count cells of the target memory cell row. The control logic circuit performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit.

A memory system according to embodiments of the present invention for achieving the above object includes a semiconductor memory device and a memory controller that controls the semiconductor memory device. The semiconductor memory device includes a memory cell array, a row hammer management circuit, and a control logic circuit. The memory cell array includes a plurality of memory cell rows, each having a plurality of memory cells. The row hammer management circuit counts the number of activations of each of the plurality of memory cell rows based on an active command from the memory controller and stores the counting values as count data in count cells of each of the plurality of memory cell rows. , the plurality of memory cell rows based on a precharge command applied after the active command received at a first time and applied at a second time after the first command instructing a memory operation for the target memory cell row. Internal read-modification for reading the count data stored in the count cells of a target memory cell row, updating the read count data, and rewriting the updated count data to the count cells of the target memory cell row. -Perform writing operation. The control logic circuit performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit.

A semiconductor memory device according to embodiments of the present invention stores the number of accesses to each memory cell row as count data in each count cell, and performs internal read-out of the count data based on a precharge command without a separate command. By automatically performing edit-write operations, command issuance can be reduced while protecting against low hammer, thereby improving performance.

1 is a block diagram showing a memory system according to embodiments of the present invention.
FIG. 2 is a block diagram showing the configuration of a memory controller in the memory system of FIG. 1 according to embodiments of the present invention.
FIG. 3 is a block diagram showing the configuration of a semiconductor memory device in the memory system of FIG. 1 according to embodiments of the present invention.
FIG. 4 shows a first bank array in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.
FIG. 5 is a block diagram showing the configuration of a refresh control circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.
FIG. 6 shows an example of a refresh clock generator in the refresh control circuit of FIG. 6 according to embodiments of the present invention.
FIG. 7 shows an example of a refresh clock generator in the refresh control circuit of FIG. 6 according to embodiments of the present invention.
FIG. 8 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.
FIG. 9 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.
FIG. 10 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.
FIG. 11 is a block diagram illustrating an example of a random seed generator in the row hammer management circuit of FIG. 10 according to embodiments of the present invention.
FIG. 12 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.
FIG. 13 is a timing diagram showing the operation of the hammer address queue of FIG. 12.
FIG. 14 is a timing diagram showing the operation of the hammer address queue of FIG. 12.
FIG. 15 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.
Figure 16 shows a portion of the semiconductor memory device of Figure 3 in a write operation.
FIG. 17 shows a portion of the semiconductor memory device of FIG. 3 in a read operation.
FIG. 18 is a block diagram showing the configuration of an ECC engine in the semiconductor memory device of FIGS. 16 and 17 according to embodiments of the present invention.
FIG. 19 is a block diagram illustrating an example of the first bank array of FIG. 3 according to embodiments of the present invention.
20 to 22 show commands of the memory system of FIG. 1 according to embodiments of the present invention.
Figures 23 and 24 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.
Figure 25 shows a command protocol of a memory system when the memory system updates count data using a precharge command according to embodiments of the present invention.
Figure 26 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.
FIG. 27 is a flowchart showing the operation of the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.
FIG. 28 is a flowchart showing the operation of the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.
Figure 29 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.
Figure 30 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.
Figure 31 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.
Figure 32 shows a portion of a memory cell array to illustrate generating a hammer refresh address for a hammer address.
FIG. 33 shows a portion of a memory cell array to illustrate generating a hammer refresh address for a hammer address.
FIGS. 34A, 34B, and 35 are timing diagrams showing examples of operation of the refresh control circuit of FIG. 6 according to embodiments of the present invention.
Figure 36 is an example block diagram showing a semiconductor memory device according to embodiments of the present invention.
Figure 37 is a structural diagram showing an example of a semiconductor package including a stacked memory device according to embodiments of the present invention.
Figure 38 is a block diagram showing a memory system having a quad-rank memory module according to embodiments of the present invention.
Figure 39 is a block diagram showing a memory system according to embodiments of the present invention.
FIG. 40 is a block diagram showing the configuration of a semiconductor memory device in the memory system of FIG. 39 according to embodiments of the present invention.
FIG. 41 shows memory cells included in the memory cell array of FIG. 40 according to embodiments of the present invention.
FIG. 42A is a block diagram showing the configuration of a timing control circuit in the semiconductor memory device of FIG. 40 according to embodiments of the present invention.
FIG. 42B is a block diagram showing the configuration of a latency controller in the timing control circuit of FIG. 42A according to embodiments of the present invention.
FIG. 43 is a block diagram showing the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 40 according to embodiments of the present invention.
FIG. 44 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIG. 43 according to embodiments of the present invention.
Figures 45 and 46 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.
Figures 47 and 48 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.
Figure 49 shows that the row hammer management circuit according to embodiments of the present invention secures an active count update period based on the frequency of the clock signal.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings. The same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

1 is a block diagram showing a memory system according to embodiments of the present invention.

Referring to FIG. 1 , the memory system 20 may include a memory controller 30 and a semiconductor memory device 200.

The memory controller (Memory Controller) 30 generally controls the operation of the memory system (Memory System) 20 and overall data exchange between the external host and the semiconductor memory device 200. For example, the memory controller 100 controls the semiconductor memory device 200 to write data or read data according to a host's request.

Additionally, the memory controller 30 controls the operation of the semiconductor memory device 200 by applying operation commands to control the semiconductor memory device 200. Depending on the embodiment, the semiconductor memory device 200 may be dynamic random access (DRAM), double data rate 5 (DDR5) synchronous DRAM (SDRAM), or DDR6 SDRAM having volatile memory cells.

The memory controller 30 may transmit a clock signal (CK, or command clock signal), a command (CMD), and an address (ADDR) to the semiconductor memory device 200. When writing a data signal (DQ) to the semiconductor memory device 200 or reading a data signal (DQ) from the semiconductor memory device 200, the memory controller 30 sends a data strobe signal (DQS) to the semiconductor memory device 200. It can be exchanged with (200). The address (ADDR) may be accompanied by the command (CMD), and in this specification, the address (ADDR) may be called an access address.

The memory controller 30 includes a central processing unit (CPU) 35 that controls the overall operation of the memory controller 30 and a refresh function related to a row hammer among the memory cell rows of the semiconductor memory device 200. It may include RFM control logic 100 that generates a refresh management (RFM) command.

The semiconductor memory device 200 may include a memory cell array 310 in which the data signal DQ is stored, a control logic circuit 210, and a row hammer management circuit (RH management circuit 500).

The control logic circuit 210 may control the operation of the semiconductor memory device 200. The memory cell array 310 may include a plurality of memory cell rows each having a plurality of volatile memory cells (MC) connected to a word line (WL) and a bit line (BL).

The row hammer management circuit 500 counts the number of activations of each of the plurality of memory cell rows based on an active command from the memory controller 30 and uses the count values as count data for each of the plurality of memory cell rows. It can be stored in cells. The row hammer management circuit 500 first-in-first-out (first-in-first-out) one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows based on a comparison of the counting values and a first reference number. A first number is stored in a FIFO) manner, and when the number of stored candidate hammer addresses reaches the first number, the logic level of the alert signal (ALRT) provided to the memory controller 30 is changed, and the stored It may include a hammer address queue 600 that outputs one of the candidate hammer addresses as a hammer address.

The row hammer management circuit 500 also reads the count data stored in count cells of a target memory cell row among memory cell rows in response to a first command such as a precharge command applied after the active command, and reads the read count data. An internal read-modify-write operation may be performed to update count data and write the updated count data to the count cells of the target memory cell row.

In an embodiment, the row hammer management circuit 500 may perform the internal read-write-modify operation based on a flag of a precharge command applied after an active command and precharge the target memory cell row.

The row hammer management circuit 500 generates randomized count data by randomly changing updated count data based on an event signal indicating a change in the state of the hammer address queue 600, and stores the randomized count data in count cells. It can be saved in .

The control logic circuit 210 may control access to the memory cell array 310 and the row hammer management circuit 500.

The semiconductor memory device 200 must be periodically refreshed due to charge leakage of memory cells that store data. As DRAM processes become more refined, the storage capacitance of memory cells is becoming smaller and the refresh cycle is becoming shorter. Additionally, as the total memory capacity of the semiconductor memory device 200 increases, the time required to refresh the entire semiconductor memory device 200 increases, and thus the refresh cycle becomes shorter.

Conventionally, the TRR (Target Row Refresh) method was adopted to compensate for the degradation of adjacent cells due to intensive access to a specific memory cell row, and then in-memory refresh was used to reduce the system burden. (In-memory refresh) method has been developed and is being used. In the TRR method, the memory controller is entirely responsible for the hammer refresh operation for the hammer address that is accessed intensively, and in the in-memory refresh method, the semiconductor memory device is entirely responsible for the burden.

In the future, as semiconductor memory devices become more high-capacity and low-power, there will be problems of chip size overhead for in-memory refresh and increased power consumption to take care of specific memory cell rows even when they are not concentrated. may occur. Additionally, row hammer was managed for some memory cell rows selected from the memory cell rows.

In the memory system 20 according to embodiments of the present invention, the hammer address queue 600 of the row hammer management circuit 500 becomes full due to repeated access to memory cell rows intentionally by a hacker, and the memory system ( 20) In order to prevent this performance from being degraded, an event in the hammer address queue 600 occurs or unspecified count data stored in the count cells is randomized and stored in the count cells, thereby overloading the hammer address queue 600. To prevent flow, the number of activations of each of the plurality of memory cell rows is counted, the count values are stored as count data in each count cell of the plurality of memory cell rows, and all memory cell rows are stored based on the counting values. You can manage a low hammer for everyone.

FIG. 2 is a block diagram showing the configuration of a memory controller in the memory system of FIG. 1 according to embodiments of the present invention.

Referring to FIG. 2, the memory controller 30 includes a CPU 35, RFM control logic 100, refresh logic 40, host interface 50, scheduler 55, and It may include a memory interface 60.

The CPU 35 controls overall operations of the memory controller 30. The CPU 35 can control the RFM control logic 100, refresh logic 40, host interface 50, scheduler 55, and memory interface 60.

The refresh logic 40 may generate an auto refresh command to sequentially refresh a plurality of memory cell rows according to the refresh cycle.

The host interface 50 may perform interfacing with a host. The memory interface 60 may perform interfacing with the semiconductor memory device 200.

The scheduler 55 may manage scheduling and transmission of sequences of commands generated within the memory controller 30. In particular, the scheduler 55 provides an active command and a precharge command to the semiconductor memory device 200 through the memory interface 60, and the semiconductor memory device 200 responds to the precharge command to activate the active command of each memory cell row. By updating the count, row hammers can be managed for all memory cell rows.

The RFM control logic 100 sends a refresh management command to the semiconductor memory device 200 through the memory interface 60 in response to the transition of the alert signal (ALRT) received from the semiconductor memory device 200 through the memory interface 60. ) can be applied to cause the semiconductor memory device 200 to perform a hammer refresh operation on big memory cell rows adjacent to the hammer address.

FIG. 3 is a block diagram showing the configuration of a semiconductor memory device in the memory system of FIG. 1 according to embodiments of the present invention.

Referring to FIG. 3, the semiconductor memory device 200 includes a control logic circuit 210, an address register 220, a bank control logic 230, a refresh control circuit 400, a row address multiplexer 240, and a column address latch. (250), row decoder 260, column decoder 270, memory cell array 310, sense amplifier 285, input/output gating circuit 290, ECC engine 350, clock buffer 225, strobe. It may include a signal generator 235, a voltage generator 385, a row hammer management circuit 500, and a data input/output buffer 320.

The memory cell array 310 may include first to sixteenth bank arrays 310a to 310s. In addition, the row decoder 260 includes first to sixteenth row decoders (260a to 260s) respectively connected to first to sixteenth bank arrays (310a to 310s), and the column decoder 270 is It includes first to sixteenth column decoders (270a to 270s) respectively connected to the first to sixteenth bank arrays (310a to 310s), and the sense amplifier 285 is connected to the first to sixteenth bank arrays (310a to 310a). ~310s) may include first to sixteenth sense amplifiers (285a to 285s) respectively connected to each other.

First to sixteenth bank arrays (310a to 310s), first to sixteenth sense amplifiers (285a to 285s), first to sixteenth column decoders (270a to 270s), and first to sixteenth row decoders (260a to 260s) may respectively constitute the first to sixteenth banks. Each of the first to sixteenth bank arrays 310a to 310s is located at a plurality of word lines (WL) and a plurality of bit lines (BL) and at intersections of the word lines (WL) and the bit lines (BL). It may include a plurality of memory cells (MC) being formed.

The address register 220 may receive an address (ADDR) including a bank address (BANK_ADDR), a row address (ROW_ADDR), and a column address (COL_ADDR) from the memory controller 30. The address register 220 provides the received bank address (BANK_ADDR) to the bank control logic 230, the received row address (ROW_ADDR) to the row address multiplexer 240, and the received column address (COL_ADDR). It can be provided to the column address latch 250. Additionally, the address register 220 may provide a bank address (BANK_ADDR) and a row address (ROW_ADDR) to the row hammer management circuit 500.

The bank control logic 230 may generate bank control signals in response to the bank address (BANK_ADDR). In response to the bank control signals, the row decoder corresponding to the bank address (BANK_ADDR) among the first to sixteenth row decoders (260a to 260s) is activated, and the first to sixteenth column decoders (270a to 270s) The column decoder corresponding to the middle bank address (BANK_ADDR) may be activated.

The row address multiplexer 240 may receive a row address (ROW_ADDR) from the address register 220 and a refresh row address (REF_ADDR) from the refresh counter 245. The row address multiplexer 240 can selectively output a row address (ROW_ADDR) or a refresh row address (REF_ADDR) as a row address (SRA). The row address (SRA) output from the row address multiplexer 240 may be applied to the first to sixteenth row decoders 260a to 260s, respectively.

The refresh control circuit 400 may sequentially increase or decrease the refresh row address REF_ADDR in normal refresh mode in response to the refresh signals IREF1 and IREF2 from the control logic circuit 210. In the hammer refresh mode, the refresh control circuit 400 receives a hammer address (HADDR) and converts the hammer refresh address, which is the addresses of memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR), into a refresh row address ( REF_ADDR).

Among the first to sixteenth row decoders 260a to 260s, the row decoder activated by the bank control logic 230 decodes the row address (SRA) output from the row address multiplexer 240 to You can activate the corresponding word line. For example, the activated row decoder may apply a word line driving voltage to the word line corresponding to the row address (SRA).

The column address latch 250 may receive the column address (COL_ADDR) from the address register 220 and temporarily store the received column address (COL_ADDR). Additionally, the column address latch 250 may gradually increase the received column address (COL_ADDR) in burst mode. The column address latch 250 may apply the temporarily stored or gradually increased column address COL_ADDR' to the first to sixteenth column decoders 270a to 270s, respectively.

Among the first to sixteenth column decoders 270a to 270s, the column decoder activated by the bank control logic 230 corresponds to the bank address (BANK_ADDR) and the column address (COL_ADDR) through the corresponding input/output gating circuit 290. This can activate the sense amplifier.

The input/output gating circuit 290 includes circuits for gating input/output data, input data mask logic, read data latches for storing codewords output from the first to sixteenth bank arrays 310a to 310s, and It may include write drivers for writing data to the first to sixteenth bank arrays 310a to 310s.

A codeword (CW) read from one of the first to sixteenth bank arrays 310a to 310s is sensed by a sense amplifier corresponding to the one bank array and stored in the read data latches. You can. The codeword (CW) stored in the read data latches is ECC decoded by the ECC engine 350 and provided as data (DTA) to the data input/output buffer 320, and the data input/output buffer 320 is converted to data (DTA). ) can be converted into a data signal (DQ) and provided to the memory controller 30 together with a strobe signal (DQS).

The data signal DQ to be written in one of the first to sixteenth bank arrays 310a to 310s is received by the data input/output buffer 320 together with the strobe signal DQS. The data input/output buffer 320 converts the data signal (DQ) into data (DTA) and provides it to the ECC engine 350, and the ECC engine 350 generates parity bits (or parity data) based on the data (DTA). may be generated, and a codeword (CW) including the data (DTA) and the parity bits may be provided to the input/output gating circuit 290. The input/output gating circuit 290 may write the codeword (CW) to the target page of the one bank array through the write drivers.

In a write operation, the data input/output buffer 320 converts the data signal (DQ) into data (DTA) and provides it to the ECC engine 350, and in a read operation, the data (DTA) provided from the ECC engine 350 is converted into a data signal. (DQ), and the data signal (DQ) and strobe signal (DQS) can be provided to the memory controller 30.

The ECC engine 350 may perform ECC encoding for the data (DTA) and ECC decoding for the codeword (CW) based on the second control signal (CTL2) from the control logic circuit 210. Additionally, the ECC engine 350 performs ECC encoding and ECC decoding on the random count data (RCNTD) and/or count data (CNTD) provided from the row hammer management circuit 500 based on the second control signal (CTL2). can do.

The clock buffer 225 receives the clock signal (CK), buffers the clock signal (CK) to generate an internal clock signal (ICK), and the internal clock signal (ICK) generates a command (CMD) and an address (ADDR). It can be provided to processing components.

The strobe signal generator 235 may receive the clock signal CK, generate a strobe signal DQS based on the clock signal CK, and provide the strobe signal DQS to the data input/output buffer 320. .

The voltage generator 385 generates an operating voltage (VDD1) based on the power supply voltage (VDD) input from the outside, and generates a power stabilization signal (PVCCH) indicating that the level of the power supply voltage (VDD) has reached the reference voltage level. A power stabilization signal (PVCCH) may be generated and provided to the row hammer management circuit 500, and an operating voltage (VDD1) may be provided to the memory cell array 310.

The row hammer management circuit 500 manages a plurality of memory cell arrays 310 based on an access address (ADDR) including a row address (ROW_ADDR) and a bank address (BANK_ADDR) accompanying an active command from the memory controller 30. The number of activations of each of the memory cell rows may be counted and the count values may be stored as count data (CNTD) in the count cells of each of the plurality of memory cell rows. The row hammer management circuit 500 first-in-first-out (first-in-first-out) one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows based on a comparison of the counting values and a first reference number. A first number is stored in a FIFO) manner, and when the number of stored candidate hammer addresses reaches the first number, the alert signal (ALRT) provided to the memory controller 30 through the alert pin 201 is The logic level may be changed, and one of the stored candidate hammer addresses may be provided to the refresh control circuit 400 as a hammer address (HADDR).

The row hammer management circuit 500 may also randomly change updated count data based on an event signal related to a change in the state of the hammer address queue 600 and store the random count data in count cells.

The control logic circuit 210 may control the operation of the semiconductor memory device 200. For example, the control logic circuit 210 may generate control signals so that the semiconductor memory device 200 performs a write operation, a read operation, a normal refresh operation, and a hammer refresh operation. The control logic circuit 210 may include a command decoder 211 for decoding the command (CMD) received from the memory controller 30 and a mode register 212 for setting the operation mode of the semiconductor memory device 200. You can.

For example, the command decoder 211 may decode a chip select signal and a command/address signal to generate the control signals corresponding to a command (CMD). In particular, the control logic circuit 210 decodes the command (CMD) and decodes the first control signal (CTL1) to control the input/output gating circuit 290, the second control signal (CTL2) to control the ECC engine 350, and the row hammer A third control signal CTL3 that controls the management circuit 500 may be generated. In addition, the command decoder 211 decodes the command (CMD) to generate a first refresh signal (IREF1), a second refresh signal (IREF2), an active signal (IACT1), a precharge signal (IPRE), a read signal (IRD), and a write signal (IREF1). Internal command signals such as signal (IWR) can be generated.

FIG. 4 shows a first bank array in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 4, the first bank array 310a, referring to FIG. 3, has a plurality of word lines (WL0 to WLm-1, m is an even integer of 2 or more), a plurality of word lines (WL0 to WLm-1, m is an even integer of 2 or more), bit lines (BL0 to BLn-1, n is an even integer of 2 or more), and a plurality of bit lines (WL0 to WLm-1) and a plurality of bit lines (BL0 to BLn-1) Contains memory cells (MCs). Each memory cell (MC) has a DRAM cell structure. In addition, it can be seen that the arrangement of the memory cells (MCs) connected to each of the even word lines (WL0) and the odd word lines (WL1) are different. Each of the memory cells (MCs) may include a cell transistor connected to each of the word lines (WL0 to WLm-1) and each of the bit lines (BL0 to BLn-1) and a cell capacitor connected to the cell transistor. You can.

The word lines (WL0 to WLm-1) extending in the first direction (D1) where the memory cells (MCs) are connected are defined as rows of the first bank array (310a), and the memory cells (MCs) The connected bit lines BL0 to BLn-1 extending in the second direction D2 may be referred to as columns of the first bank array 310a.

FIG. 5 is a block diagram showing the configuration of a refresh control circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 5 , the refresh control circuit 400 may include a refresh control logic 410, a refresh clock generator 420, a refresh counter 430, and a hammer refresh address generator 440.

The refresh control logic 410 may provide the mode signal MS to the refresh clock generator 420 in response to the refresh management signal RFMS. The refresh control logic 410 sends a hammer refresh signal (HREF), which controls the output timing of the hammer address, to the hammer refresh address generator 440 based on one of the first refresh signal (IREF1) and the second refresh signal (IREF). can be provided.

The refresh management signal RFMS may be provided by the control logic circuit 210 of FIG. 3 to the refresh control circuit 400 in response to a refresh management command provided from the memory controller 30.

The refresh clock generator 420 may generate a refresh clock signal (RCK) indicating the timing of the normal refresh operation based on the first refresh control signal (IREF1), the second refresh control signal (IREF2), and the mode signal (MS). there is. The refresh clock generator 420 may generate the refresh clock signal RCK whenever the first refresh control signal IREF1 is applied or while the second refresh control signal IREF2 is activated.

When the command (CMD) from the memory controller 30 is an auto refresh command, the control logic circuit 210 of FIG. 3 generates the first refresh control signal (IREF1) whenever the auto refresh command is applied to the refresh control circuit ( 400). When the command (CMD) from the memory controller 30 is a self-refresh entry command, the control logic circuit 210 generates a second refresh control signal that is activated after receiving the self-refresh entry command until a self-refresh exit command is applied. (IREF2) can be applied to the refresh control circuit 400.

The refresh counter 420 performs a counting operation for each cycle of the refresh clock signal (RCK) to generate a counter refresh address (CREF_ADDR) designating each memory cell row, and sets the counter refresh address (CREF_ADDR) to a refresh row address (REF_ADDR). ) can be provided to the row address multiplexer 240 of FIG. 3.

The hammer refresh address generator 440 may include a hammer address storage 445 and a mapper 450.

The hammer address storage 445 may store the hammer address (HADDR) and output the stored hammer address (HADDR) to the mapper 450 based on the hammer refresh signal (HREF). The mapper 450 may generate hammer refresh addresses (HREF_ADDR) that represent addresses of big memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR).

For example, the mapper 450 may generate hammer refresh addresses (HREF_ADDR) that represent addresses of one or more victim memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR).

The hammer refresh address generator 440 may provide the hammer refresh addresses (HREF_ADDR) as refresh row addresses (REF_ADDR) to the row address multiplexer 240 of FIG. 3.

FIG. 6 shows an example of a refresh clock generator in the refresh control circuit of FIG. 5 according to embodiments of the present invention.

Referring to FIG. 6, the refresh clock generator 420a may include a plurality of oscillators 421, 422, and 423, a multiplexer 424, and a decoder 425a.

The decoder 425a may output a clock control signal RCS1 by decoding the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS. A plurality of oscillators (421, 422, and 423) generate refresh clock signals (RCK1, RCK2, and RCK3) having different periods. The multiplexer 424 selects one of the plurality of refresh clock signals RCK1, RCK2, and RCK3 in response to the clock control signal RCS1 and outputs it as the refresh clock signal RCK.

Since the mode signal MS may indicate that the refresh management signal RFMS has been received (i.e., a row hammer event has occurred), the refresh clock generator 420a generates a plurality of refresh clocks in response to the clock control signal RCS1. The refresh cycle can be adjusted by selecting one of the signals (RCK1, RCK2, and RCK3).

FIG. 7 shows an example of a refresh clock generator in the refresh control circuit of FIG. 5 according to embodiments of the present invention.

Referring to FIG. 7, the refresh clock generator 420b may include a decoder 425b, a bias unit 426, and an oscillator 427.

The decoder 425b may output a clock control signal RCS2 by decoding the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS. The bias unit 426 may generate a control voltage (VCON) in response to the clock control signal (RCS2). The oscillator 427 may generate a refresh clock signal (RCK) whose period varies depending on the control voltage (VCON).

Since the mode signal (MS) may indicate that the refresh management signal (RFMS) has been received (i.e., that a row hammer event has occurred), the refresh clock generator 420b generates a refresh clock signal (i.e., a low hammer event) in response to the clock control signal (RCS1). The refresh cycle can be adjusted by varying the cycle of RCK).

FIG. 8 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 8, the row hammer management circuit 500a includes an adder 510, a comparator 520, a register 530, a random value generator 540a, a complement generator 550, a multiplexer 560, and a hammer address queue. It may include (600).

The adder 510 may increase the count data (CNTD), which is read from the target memory cell row and ECC decoded by the ECC engine 350, by 1 to provide updated count data (UCNTD). That is, the adder 510 can update the count data (CNTD). The adder 510 may be implemented as an up-counter.

The updated count data (UCNTD) is provided to the ECC engine 350, and the ECC engine 350 may perform ECC encoding on the count data (UCNTD).

The register 530 may store the first reference number (NTH1). The comparator 520 may compare the read count data CNTD with the first reference number NTH1 and output a store signal STR indicating the result of the comparison. That is, when the read count data CNTD is greater than or equal to the first reference number NTH1, the comparator 520 may activate the store signal STR.

The first reference number NTH1 may include multiples of the default reference number and the default key number, and therefore, the store signal STR may include a plurality of bits.

The hammer address queue 600 is a target designating a target memory cell row in response to the store signal (STR) indicating that the read count data (CNTD) or the updated count data (UCNTD) is greater than or equal to the first reference number (NTH). The row address (T_ROW_ADDR) may be stored as a candidate hammer address, and one of the stored candidate hammer addresses may be provided as a hammer address (HADDR) to the refresh control circuit 400 of FIG. 3. The hammer address queue 600 stores target row addresses (T_ROW_ADDR) that are accessed more than the first reference number of times (NTH1) as candidate hammer addresses, and adjusts the state of the hammer address queue 600 according to the number of stored candidate hammer addresses. It can be expressed as the logic level of the alert signal (ALRT).

The random value generator 540a may generate a random value RV in response to activation of the alert signal ALRT. The complement generator 550 may generate a random complement (CRV) corresponding to the complement of the random value (RV). The multiplexer 560 may provide one of a random value (RV) and a random complement (CRV) to the adder 510 in response to the selection signal (SS1).

Therefore, while the alert signal (ALRT) is activated, the adder 510 increases the count data (CNTD) by 1 and adds one of the random value (RV) and the random complement (CRV) to an updated count value. (UCNTD) can be changed randomly. That is, while the alert signal (ALRT) is activated, the adder 510 subtracts or subtracts the random value (RV) from the value that increases the count data (CNTD) by 1 to randomly generate the updated count value (UCNTD). It can change.

The random value generator 540a may include a timer 555, and the timer 555 may be activated during a first period after the alert signal ALRT is activated. In this case, the random value generator 540a may generate a random value (RV) during the first period after the alert signal (ALRT) is activated, and the adder 510 may generate the random value (RV) during the first period after the alert signal (ALRT) is activated. Afterwards, the updated count value (UCNTD) may be randomly changed by subtracting or subtracting the random value (RV) from the value obtained by increasing the count data (CNTD) by 1 during the first section.

FIG. 9 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 9, the row hammer management circuit 500b includes an adder 510, a comparator 520, a register 530, a random value generator 540b, a complement generator 550, a multiplexer 560, and a hammer address queue. It may include (600).

Descriptions of FIG. 9 that overlap with those of FIG. 8 are omitted.

The random value generator 540b may generate a random value RV in response to activation of the store signal ALRT. The complement generator 550 may generate a random complement (CRV) corresponding to the complement of the random value (RV). The multiplexer 560 may provide one of a random value (RV) and a random complement (CRV) to the adder 510 in response to the selection signal (SS1).

Therefore, in response to activation of the store signal (STR), the adder 510 increases the count data (CNTD) by 1 and adds one of the random value (RV) and the random complement (CRV) to an updated count value. (UCNTD) can be changed randomly. That is, in response to activation of the store signal (STR), the adder 510 subtracts or subtracts the random value (RV) from the value that increases the count data (CNTD) by 1 to randomly generate the updated count value (UCNTD). It can change.

The random value generator 540b may include a timer 555, and the timer 555 may be activated during a first period after the store signal STR is activated. In this case, the random value generator 540b may generate a random value (RV) during the first section after the store signal (STR) is activated, and the adder 510 may generate the random value (RV) during the first section after the store signal (STR) is activated. The updated count value (UCNTD) can be randomly changed by subtracting or subtracting a random value (RV) from the value that increases the count data (CNTD) by 1 during one section.

FIG. 10 is a block diagram illustrating an example of the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 10, the row hammer management circuit 500c includes an adder 510, a comparator 520, a register 530, a random value generator 540c, a complement generator 550, a multiplexer 560, and a random seed generator. It may include 570 and hammer address queue 600.

Descriptions of FIG. 10 that overlap with those of FIG. 8 are omitted.

The random seed generator 570 may provide a random enable signal (REN) to the random value generator 540c in response to the power stabilization signal (PVCCH).

The random value generator 540c may generate a random value (RV) in response to activation of the random enable signal (REN). The complement generator 550 may generate a random complement (CRV) corresponding to the complement of the random value (RV). The multiplexer 560 may provide one of a random value (RV) and a random complement (CRV) to the adder 510 in response to the selection signal (SS1).

Therefore, in response to activation of the random enable signal (REN), the adder 510 increases the count data (CNTD) by 1 and adds one of the random value (RV) and the random complement (CRV) to the updated The count value (UCNTD) can be changed randomly. That is, in response to activation of the random enable signal (REN), the adder 510 subtracts or subtracts the random value (RV) from the value that increases the count data (CNTD) by 1 to provide an updated count value (UCNTD). It can be changed randomly.

The random value generator 540c may include a timer 555, and the timer 555 may be activated during a first period after the random enable signal REN is activated. In this case, the random value generator 540c may generate a random value (RV) during the first period after the random enable signal (REN) is activated, and the adder 510 may generate the random value (RV) during the first period after the random enable signal (REN) is activated. After activation, the updated count value (UCNTD) may be randomly changed by subtracting or subtracting the random value (RV) from the value obtained by increasing the count data (CNTD) by 1 during the first section.

In an embodiment, the random seed generator 570 may provide a reset signal (RST) to the random value generator 540c to reset the random value generator 540c.

In an embodiment, the random seed generator 570 may be implemented using a pseudo random binary sequence (PRBS) or a linear feedback shift register (LFSR).

FIG. 11 is a block diagram illustrating an example of a random seed generator in the row hammer management circuit of FIG. 10 according to embodiments of the present invention.

Referring to FIG. 11, the random seed generator 570 may include an oscillator 575 and a counter 580.

The oscillator 575 may operate in the power-up sequence in response to a transition of the power stabilization signal (PVCCH) to generate a clock signal (CLK) that toggles to a first frequency. The counter 580 counts the clock signal CLK, activates the random enable signal REN when the clock signal CLK is counted a certain number of times, and after the random enable signal REN is activated, the second After the interval, the reset signal (RST) can be activated.

FIG. 12 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.

Referring to FIG. 12, the hammer address queue 600a may include a first number of first-in first-out (FIFO) registers 610a, 610b, ..., 610h and a monitor logic 650a. You can.

The first number of FIFO registers (610a, 610b, ..., 610h) stores the first number of candidate hammer addresses (CHADDRa, CHADDRb, ..., CHADDRh) accessed more than a first reference number (NTH1) in a first-in-first-out manner. You can save it.

The monitor logic 650a is connected to the first number of FIFO registers 610a, 610b, ..., 610h, manages the first number of FIFO registers 610a, 610b, ..., 610h, and manages the first number of FIFO registers 610a, 610b, ..., 610h. It is possible to monitor whether the candidate hammer address is stored in each of the registers 610a, 610b, ..., 610h. The monitor logic 650a detects when the number of candidate hammer addresses stored in the first number of FIFO registers 610a, 610b, ..., 610h reaches the first number (i.e., the first number of FIFO registers 610a, 610b , …, 610h) is full), the candidate hammer address input first among the candidate hammer addresses is output as the hammer address (HADDR), and the level of the alert signal (ALRT) is changed from the first logic level to the first The state of the hammer address queue 600 can be notified to the memory controller 30 by activating it at a second logic level different from the logic level.

The memory controller 30 of FIG. 2 applies a refresh management command to the semiconductor memory device 200 in response to activation of the alert signal ALRT, and the monitor logic 650a operates the FIFO registers 610a, 610b, ..., 610h), the alert signal ALRT may be transitioned (deactivated) to the first logic level in response to the hammer address HADDR being output.

FIG. 13 is a timing diagram showing the operation of the hammer address queue of FIG. 12.

In FIG. 13, the FIFO registers 610a, 610b, ..., 610h of FIG. 12 include three FIFO registers 610a, 610b, 610c, and a row address (RA=j) and a row address (RA=k). It is assumed that access continues to memory cell rows with row addresses (Ra=l). Also, assume that the reference number (NTH1) is 1024.

In Figure 13, ACT-j represents an active command accompanying a row address (RA=j), PRE-j represents a precharge command for the memory cell row specified by the row address (RA=j), and ACT-k represents an active command accompanying a row address (RA=k), PRE-k represents a precharge command for the memory cell row specified by the row address (RA=k), and ACT-l represents a row address (RA=k). indicates an active command accompanying l), and PRE-l indicates a precharge command for the memory cell row specified by the row address (RA=l).

Referring to FIGS. 12 and 13, when the number of accesses (i.e., count data (CNTD)) to the memory cell row specified by the row address (RA=j) reaches 1024, the row address is entered in the FIFO register 610a. (RA=j) is stored as a candidate hammer address, and when the number of accesses (i.e., count data (CNTD)) to the memory cell row specified by the row address (RA=k) becomes 1024, the FIFO register 610b ), the row address (RA=k) is stored as a candidate hammer address, and the number of accesses (i.e., count data (CNTD)) to the memory cell row specified by the row address (RA=l) becomes 1024, The row address (RA=l) is stored as a candidate hammer address in the FIFO register 610c.

Since the FIFO registers 610a, 610b, and 610c all store candidate hammer addresses, the monitor logic 650a transitions the alert signal ALRT to the second logic level to inform the memory controller 30 that there is no available space. Upon notification, the memory controller 30 may stop applying the active command and apply the refresh management command (RFM) to the semiconductor memory device 200 in response to the transition of the alert signal (ALRT). The monitor logic 650a changes the alert signal ALRT from the first logic level (logic high level) to the second logic level in response to the row address (RA=j) stored in the FIFO register 610a being output as a hammer address. It can be transitioned to (logic low level).

The refresh control circuit 400 performs a hammer refresh operation on big memory cell rows adjacent to the hammer address in response to a refresh management signal (RFMS) based on the refresh management command (RFM), and the monitor logic 650a performs the hammer refresh operation. After this is performed, the alert signal (ALRT) can be transitioned to the first logic level.

When access to the row addresses (RA=j, RA=k, RA=l) is caused by a malicious hacker, an overflow occurs in the hammer address queue 600a, deteriorating the performance of the semiconductor memory device 200. may deteriorate.

FIG. 14 is a timing diagram showing the operation of the hammer address queue of FIG. 12.

In Figure 14, the FIFO registers (610a, 610b, ..., 610h) of Figure 12 include three FIFO registers (610a, 610b, 610c), row address (RA = j), row address (RA = k) It is assumed that access continues to memory cell rows with row addresses (Ra=l). Also, assume that the reference number (NTH1) is 1024.

12 and 14, after activation of the alert signal ALRT, the number of accesses to the memory cell rows stored by the row addresses (RA=j, RA=k, Ra=l) (i.e. If the number of accesses is randomly changed by adding a random value (RV) to the count data (CNTD), the number of accesses (i.e., count data (CNTD)) to the memory cell row specified by the row address (RA = j) is 958. , the number of accesses to the memory cell row specified by the row address (RA=k) (i.e., count data (CNTD)) is 876, and the number of accesses to the memory cell row specified by the row address (RA=l) is 876 ( That is, since the count data (CNTD) is 537, no overflow occurs in the hammer address queue 600a, and the alert signal ALRT can be maintained at the first logic level.

FIG. 15 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.

Referring to FIG. 15, the hammer address queue 600b includes a first number of FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, 610h, a monitor logic 650b, a multiplexer 660b, and a comparator. It may include 675 and register 680.

The first number of FIFO registers (610a, 610b, 610c, 610d, 610e, 610f, 610g, 610h) is a first number of candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, Each counting value of CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh) and the first number of candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh) is converted into count data (CNTDa, CNTDb, CNTDc). , CNTDd, CNTDe, CNTDf, CNTDg, CNTDh) can each be stored in a first-in-first-out manner.

The monitor logic 650b is connected to a first number of FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, and 610h to form a first number of FIFO registers 610a, 610b, 610c, 610d, 610e. , 610f, 610g, 610h), and monitor whether the candidate hammer address of each of the first number of FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, 610h is stored.

The register 680 stores a second reference number (NTH2) greater than the first reference number (NTH1) and a third reference number (NTH3) greater than the second reference number (NTH2), and the second reference number (NTH2) and A third reference number (NTH3) may be provided to the comparator 675.

The comparator 675 counts each of the count data (CNTDa, CNTDb, CNTDc, CNTDd, CNTDe, CNTDf, CNTDg, CNTDh) stored in each of the FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, and 610h. The data CNTD may be compared with the second reference number NTH2 and the third reference number NTH3, and a comparison signal CS2 indicating the result of the comparison may be provided to the monitor logic 650b. The comparison signal CS2 may include a plurality of bits and indicate a magnitude relationship between the count data CNTD and the second reference number NTH2 and the third reference number NTH3.

The monitor logic 650b corresponds to count data exceeding the second reference number (NTH2) among the candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh) based on the comparison signal (CS2). A selection signal SS2 that selects the first candidate hammer address may be generated, and the selection signal SS2 may be provided to the multiplexer 660b. The monitor logic 650b corresponds to count data exceeding the third reference number (NTH3) among the candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh) based on the comparison signal (CS). Generate a selection signal (SS2) for selecting a second candidate hammer address, provide the selection signal (SS2) to the multiplexer (660b), and change the level of the alert signal (ALRT) from the first logic level to the second logic level. It can be transitioned to .

The multiplexer 660b receives candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh) and selects candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc, CHADDRd) based on the selection signal (SS2). , CHADDRe, CHADDRf, CHADDRg, CHADDRh), output the first candidate hammer address corresponding to the count data exceeding the second reference number (NTH2) as a hammer address (HADDR), or output the candidate hammer addresses (CHADDRa, CHADDRb, CHADDRc) , CHADDRd, CHADDRe, CHADDRf, CHADDRg, CHADDRh), the first candidate hammer address corresponding to the count data exceeding the second reference number (NTH2) may be output as the hammer address (HADDR).

When the first candidate hammer address is output as a hammer address (HADDR), the refresh control circuit 400 of FIG. 3 connects two memory cell rows adjacent to the first candidate hammer address at the normal refresh timing for the memory cell rows. A hammer refresh operation can be performed on the Big Team memory cell rows.

When the second candidate hammer address is output as the hammer address (HADDR), the memory controller 30 in FIG. 2 stops applying the active command in response to the transition of the alert signal (ALRT) and sends a refresh management command to the semiconductor memory. Applied to the device 200, the refresh control circuit 400 of FIG. 5 performs a hammer operation on four victim memory cell rows adjacent to the memory cell row corresponding to the second candidate hammer address in response to the refresh management signal (RFMS). A refresh operation can be performed.

The monitor logic 650b sends an alert signal ALRT to the first logic in response to the hammer address HADDR being output from one of the FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, and 610h. It can be transitioned to a level.

Each of the FIFO registers 610a, 610b, 610c, 610d, 610e, 610f, 610g, and 610h may include a first area 612 for storing a candidate hammer address and a second area 614 for storing count data. there is.

In the description referring to FIGS. 8 to 10, 12, and 15, it has been described that one hammer address queue 600 is included. However, in embodiments, the hammer address queue 600 may be arranged as many as the bank arrays 310a to 310s in FIG. 3, and one hammer address queue may be in charge of one bank array. Therefore, when a full situation occurs in one of the hammer address queues in which candidate hammer addresses are stored in FIFO registers, the one hammer address queue sends the corresponding alert signal to the second logic level. After transition, the memory controller 30 may apply a refresh management command to the bank array corresponding to the one hammer address queue and perform a normal operation on other bank arrays.

Figure 16 shows a portion of the semiconductor memory device of Figure 3 in a write operation.

FIG. 16 shows the control logic circuit 210, the first bank array 310a, the input/output gating circuit 290, the ECC engine 350, and the row hammer management circuit 500.

Referring to FIG. 19, the first bank array 310a may include a normal cell area (NCA) and a redundancy cell area (RCA). The normal cell area (NCA) may include a plurality of first memory blocks (MB0 to MB15, 311, 312, and 313), and the redundancy cell area (RCA) may include at least one second memory block 314. can do. Each of the first memory blocks 311, 312, and 313 may include memory cells to which a word line (WL) and a bit line (BL) are connected. At least one second memory block 314 may include redundancy memory cells connected to the word line (WL) and the redundancy bit line (BL). The second memory block 314 is used for ECC, data line repair, and block repair to rescue defective cells occurring in the first memory blocks 311, 312, and 313. It can also be called an EDB block. The redundancy cell area (RCA) may also be referred to as a parity cell area. Each of the first memory blocks 311, 312, and 313 and the second memory block 314 may correspond to the sub-array block (SCB) of FIG. 12.

The input/output gating circuit 290 may include a plurality of switching circuits 291a to 291d respectively connected to the first memory blocks 311, 312, and 313 and the second memory block 294.

The ECC engine 350 may be connected to the switching circuits 291a to 291d through each of the corresponding first data lines (GIO) and second data lines (EDBIO). The control logic circuit 210 decodes the address (ADDR) and command (CMD) to provide a first control signal (CTL1) for controlling the switching circuits (291a to 291d) to the input/output gating circuit 290, and a second A control signal (CTL2) may be provided to the ECC engine 350 and a third control signal (CTL3) may be provided to the row hammer management circuit 500.

When the command (CMD) is a write command, the control logic circuit 210 applies the second control signal (CTL2) to the ECC engine 350, and the ECC engine 350 responds to the second control signal (CTL2) ECC encoding may be performed on the data (DTA) to generate parity data, and a codeword (CW) including the data (DTA) and the parity data may be provided to the input/output gating circuit 290. The control logic circuit 210 may apply the first control signal (CTL1) to the input/output gating circuit 290 to store the codeword (CW) in one sub-page of the target page of the first bank array 310. there is.

When the command (CMD) input after the write command is a precharge command, the control logic circuit 210 applies the first control signal (CTL1) to the input/output gating circuit 290 to charge the first bank array 310. Count data (CNTD) stored in the counter cells of the target page and count parity data related to the count data (CNTD) are read and provided to the ECC engine 350, based on the second control signal (CTL2) of the ECC engine 350. ECC decoding may be performed on the count data (CNTD) and the count parity data to correct error bits of the count data (CNTD), and the count data (CNTD) may be provided to the row hammer management circuit 500.

The row hammer management circuit 500 updates the count data (CNTD) and provides the updated count data (UCNTD) to the ECC engine 350, and the ECC engine 350 performs ECC encoding on the updated count data (UCNTD). By performing, updated count parity data can be generated, and the updated count data (UCNTD) and updated count parity data can be stored in the target page. In an embodiment, when updating the count data (CNTD), the row hammer management circuit 500 randomly changes the count data (CNTD) by adding or subtracting a random value from the count data (CNTD), and adds or subtracts a random value from the count data (CNTD). Data (UCNTD) may be provided to the ECC engine 350.

That is, the ECC engine 350 and the row hammer management circuit 500 read count data (CNTD) in response to the precharge command, modify the read data, and rewrite the modified data. A write operation can be performed. Additionally, when candidate hammer addresses exceeding the first reference number (NTH1) are stored in all of the FIFO registers, the row hammer management circuit 500 transitions the alert signal (ALRT) from the first logic level to the second logic level. The status of the FIFO registers can be notified to the memory controller 30.

FIG. 17 shows a portion of the semiconductor memory device of FIG. 3 in a read operation.

Referring to FIG. 17, when the command CMD is a read command that instructs a read operation, the control logic circuit 210 applies the first control signal CTL1 to the input/output gating circuit 290 to generate the first bank array ( The codeword (RCW) stored in the subpage of the target page of 310) may be provided to the ECC engine 350.

When the command (CMD) input after the read command is a precharge command, the control logic circuit 210 applies the first control signal (CTL1) to the input/output gating circuit 290 to load the first bank array 310. The count data (CNTD) stored in the target page and the count parity data related to the count data (CNTD) are read and provided to the ECC engine 350, and the count data ( ECC decoding may be performed on the CNTD) and count parity data to correct error bits of the count data (CNTD), and the count data (CNTD) may be provided to the row hammer management circuit 500.

The row hammer management circuit 500 updates the count data (CNTD) and provides the updated count data (UCNTD) to the ECC engine 350, and the ECC engine 350 performs ECC encoding on the updated count data (UCNTD). By performing, updated count parity data can be generated, and the updated count data (UCNTD) and the updated count parity data can be stored in the counter cells of the target page. In an embodiment, when updating the count data (CNTD), the row hammer management circuit 500 randomly changes the count data (CNTD) by adding or subtracting a random value from the count data (CNTD), and adds or subtracts a random value from the count data (CNTD). Data (UCNTD) may be provided to the ECC engine 350.

That is, the ECC engine 350 and the row hammer management circuit 500 read count data (CNTD) in response to the precharge command, modify the read data, and write the modified data through an internal read-modify-write operation. The action can be performed. In addition, when candidate hammer addresses whose access number exceeds the first reference number (NTH1) are stored in all of the FIFO registers, the row hammer management circuit 500 sends an alert signal (ALRT) from the first logic level to the second logic level. By transitioning to the level, the status of the FIFO registers can be notified to the memory controller 30.

FIG. 18 is a block diagram showing the configuration of an ECC engine in the semiconductor memory device of FIGS. 16 and 17 according to embodiments of the present invention.

Referring to FIG. 18, the ECC engine 350 may include an ECC encoder 360, an ECC decoder 380, and a memory 365. Memory 365 may store ECC 370. The ECC 370 may be a single error correction (SEC) code or a single error correction and double error detection (SECDED) code, but is not limited thereto.

The ECC encoder 360 may use the ECC 370 to generate parity data (PRT) related to data (DTA) to be stored in the normal cell area (NCA) of the first bank array 310. Parity data (PRT) may be stored in the redundancy cell area (RCA) of the first bank array 310. The ECC encoder 360 may also use the ECC 370 to generate count parity data (CPRT) related to the count data (CNTD) to be stored in the normal cell area (NCA) of the first bank array 310. Count parity data (CPRT) may also be stored in the redundancy cell area (RCA) of the first bank array 310.

The ECC decoder 380 performs ECC decoding on the data (DTA) read from the first bank array 310 based on the parity data (PRT) read from the first bank array 310 using the ECC 370. It can be done. As a result of performing ECC decoding, when the read data (DTA) includes one error bit, the ECC decoder 430 corrects one error bit and sends the corrected data (C_DTA) to the data input/output buffer 320. can be provided.

The ECC decoder 380 also uses the ECC 370 to calculate the count data (CNTD) read from the first bank array 310 based on the count parity data (CPRT) read from the first bank array 310. ECC decoding can be performed. As a result of performing ECC decoding, when the read count data (CNTD) includes at least one error bit, the ECC decoder 430 corrects the at least one error bit and performs row hammer management on the corrected count data (C_CNTD). It can be provided to the circuit 500.

FIG. 19 is a block diagram illustrating an example of the first bank array of FIG. 3 according to embodiments of the present invention.

Referring to FIG. 19, the first bank array 310aa includes first sub-array blocks (SCA11, 311a, 312a), second sub-array blocks (SCA12, 313a, 314a), and a third sub-array block 315a. , may include input/output winding amplifiers (331, 332, 333, 334, 335) and drivers (341, 342, 343, 344, 346).

Data input/output for each of the first sub-array blocks 311a, 312a and the second sub-array blocks 313a, 314a is performed through first global input/output lines (GIO1<1:a>, where a is a natural number of 8 or more) and It can be performed through the first local input/output lines (LIO1<1:a>). According to a read command or a write command, a number of bit lines in each of the first sub-array blocks 311a and 312a and the second sub-array blocks 313a and 314a arranged in the first direction D1 are column selection lines. It can be selected by a column selection signal transmitted through one of the CSLs.

The number of first sub-array blocks 311a, 312a and second sub-array blocks 313a, 314a arranged in the first direction D1 is not limited to that shown and is the number processed by the semiconductor memory device 200. It can be determined according to the size of the bits of data.

Data input/output to the third sub-array block (SCA2, 315a) is performed through second global input/output lines (GIO2<1:b>, where b is a natural number smaller than a) and second local input/output lines (LIO2<1:b>). ) can be performed through. According to a read command or a write command, b bit lines in the third sub-array block 315a may be selected by a column select signal transmitted through one of the column select lines (CSLs). The number of third sub-array blocks 315a is not limited to what is shown.

In an embodiment, the first bank array 310aa may further include first sub-array blocks, second sub-array blocks, and third sub-array blocks arranged in the second direction D2.

In an embodiment, the first sub-array blocks 311a and 312a may store data and count data, the second sub-array blocks 313a and 314a may store data, and the third sub-array block may store data. Parity data and count parity data can be provided. Here, the data may represent data provided by the semiconductor memory device 200 from an external device or data that the semiconductor memory device 200 must provide to an external device.

The input/output detection amplifier 331 detects and amplifies the voltages of the first global input/output lines (GIO1<1:a>) according to the bits output through the first global input/output lines (GIO1<1:a>). You can. Each of the input/output sense amplifiers 332, 333, 334, and 336 may operate substantially the same as the input/output sense amplifier 331. However, the input/output detection amplifier 336 detects and amplifies the voltages of the first global input/output lines (GIO1<1:b>) according to the bits output through the second global input/output lines (GIO1<1:b>). can do.

Driver 341 operates one of the first global input/output lines (GIO1<1:a>), first local input/output lines (LIO1<1:a>), and column select lines (CSLs) in response to the write signal. Data can be transmitted to memory cells of the first sub-array block 313a through a bit lines selected by a column selection signal transmitted through . Here, the data may include bits received through one data input/output pin or bits received through a plurality of data input/output pins including a data input/output pin and aligned with the rising edge or falling edge of the data strobe signal.

Each of the other drivers 342, 343, 344, and 346 and drivers 332 to 334 may operate substantially the same as the driver 341. However, the driver 346 transmits information through one of the second global input/output lines (GIO1<1:b>), the first local input/output lines (LIO1<1:b>), and the column select lines (CSLs). Data can be transmitted to memory cells of the third sub-array block 315a through b bit lines selected by the column selection signal.

20 to 22 show commands of the memory system of FIG. 1 according to embodiments of the present invention.

20 shows a combination of a chip select signal (CS_n) representing an active command (ACT), a write command (WR), and a read command (RD) and the first to fourteenth command/address signals (CA0 to CA13). 21 shows a chip select signal (CS_n) and first to fourteenth command/address signals (CA0 to CA0) indicating a write command (WRA) including off precharge and a read command (RDA) including auto precharge. The combination of CA13) is shown, and in FIG. 22, the combination of the chip select signal CS_n representing the precharge commands (PREab, PREsb, PPREpb) and the first to fourteenth command/address signals (CA0 to CA13) is shown. It is shown.

20 to 22, H represents a logic high level, L represents a logic low level, V represents a valid logic level that is either a logic high level or a logic low level, and R0 to R17 represent bits of the row address. BA0 and BA1 represent bits of the bank address, BG0 to BA2 represent bits of the bank group address, and CID0 to CID3 represent the memory die when the semiconductor memory device 200 of FIG. 1 is configured as a stacked memory device. Indicates the chip identifier. Additionally, in FIGS. 20 and 21, C2 to C10 represent bits of a column address, in FIGS. 20 and 21, BLT represents a burst length flag, and in FIG. 21, AP represents an auto precharge flag.

Referring to FIG. 20, the active command (ACT), write command (WR), and read command (RD) are two cycle commands transmitted at the high level and low level of the chip select signal (CS_n), and the active command (ACT) may include bank addresses (BA0, BA1) and row addresses (R0 to R17).

Referring to FIG. 21, the write command (WRA) including off precharge and the read command (RDA) including auto precharge are also two cycle commands transmitted at the high level and low level of the chip select signal (CS_n). , may include bank addresses (BA0, BA1) and column addresses (C3 to C10 or C2 to C10). Continuing to refer to FIG. 21, the tenth command/address signal (CA9) or the eleventh command/address signal (CA10) of the write command (WRA) including off precharge and the read command (RDA) including auto precharge. Can be used as a flag to indicate an internal read-modify-write operation.

In Figure 22, PREpb is a precharge command to precharge a specific bank in a specific bank group, PREab is an all bank precharge command to precharge all banks in all bank groups, and PREsb is an all bnak precharge command in all bank groups. This is the same bank precharge command to precharge the same bank.

Referring to FIG. 22, the ninth command/address signal CA8 or the tenth command/address signal CA9 of PREab and PREsb can be used as a flag indicating an internal read-modify-write operation.

Figures 23 and 24 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.

23 and 24 show differential clock signal pairs (CK_t, CK_c).

1, 2, 3, and 23, the scheduler 55 of the memory controller 30 carries out the first target row address of the first target memory cell row in synchronization with the edge of the clock signal CK_t. The first active command ACT1 is applied to the semiconductor memory device 200.

In response to the first active command ACT1, the control logic circuit 210 activates the first active signal IACT1 to activate the first target word line connected to the first target memory cell row.

After applying the first active command (ACT1), the scheduler 55 sends a read command (RD) that instructs a read operation for the first target memory cell row in synchronization with the edge of the clock signal (CK_t) to the semiconductor memory device ( 200). In response to the read command RD, the control logic circuit 210 activates the first read signal IRD1 to perform a read operation on data stored in the first target memory cell row.

After applying the read command (RD) and tCCD_L corresponding to the delay time when applying consecutive read commands corresponding to the same bank group, the scheduler 55 applies a precharge command (PRE) to the semiconductor memory device 200. And, the control logic circuit 210 sequentially activates the second read signal (IRD2) and the write signal (IWR) in response to the precharge command (PRE), and counts data (CNTD) stored in the first target memory cell row. is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is written in the first target memory cell row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row access address (RA=u) increases from w to w+1.

After activating the second read signal (IRD2) and after the time (tACU) required for the internal read-modify-write operation, the control logic circuit 210 activates the precharge signal (IPRE) to free the first target word line. Occupy

After the time (tRP) required for the precharge operation, the scheduler 55 applies the second active command (ACT2) for the second target memory cell row to the semiconductor memory device 200, and the control logic circuit 210 activates the second active signal (IACT2) in response to the second active command (ACT2) to activate the second target word line connected to the second target memory cell row.

In Figure 23, tRAS may correspond to the active to precharge time.

1, 2, 3, and 24, the scheduler 55 of the memory controller 30 selects the first target row address of the first target memory cell row in synchronization with the edge of the clock signal CK_t. The first active command ACT1 is applied to the semiconductor memory device 200.

In response to the first active command ACT1, the control logic circuit 210 activates the first active signal IACT1 to activate the first target word line connected to the first target memory cell row.

After applying the first active command (ACT1), the scheduler 55 sends a write command (WR) that instructs a write operation to the first target memory cell row in synchronization with the edge of the clock signal (CK_t) to the semiconductor memory device ( 200). In response to the write command WR, the control logic circuit 210 activates the first write signal IWR1 to perform a write operation to store data in the first target memory cell row.

After applying the write command (WR) and tCCD_L_WR corresponding to the delay time when consecutive write commands corresponding to the same bank group are applied, the scheduler 55 applies the precharge command (PRE) to the semiconductor memory device 200. And, the control logic circuit 210 sequentially activates the read signal (IRD) and the second write signal (IWR2) in response to the precharge command (PRE), and counts data (CNTD) stored in the first target memory cell row. is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is written in the first target memory cell row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row access address (RA=u) increases from w to w+1.

After activating the read signal (IRD) and after the time (tACU) required for the internal read-modify-write operation, the control logic circuit 210 activates the precharge signal (IPRE) to precharge the first target word line. .

After the time (tRP) required for the precharge operation, the scheduler 55 applies the second active command (ACT2) for the second target memory cell row to the semiconductor memory device 200, and the control logic circuit 210 activates the second active signal (IACT2) in response to the second active command (ACT2) to activate the second target word line connected to the second target memory cell row.

Figure 25 shows a command protocol of a memory system when the memory system updates count data using a precharge command according to embodiments of the present invention.

Referring to FIGS. 1, 2, 22, and 28, the scheduler 55 applies the first active command ACT1 to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and activates the active to After tRAS corresponding to the precharge time, a precharge command (PRE) that instructs an internal read-modify-write operation for the count data stored in the target memory cell row specified by the target row address accompanying the first active command (ACT1). ) is applied to the semiconductor memory device 200. In this case, the scheduler 55 may set the tenth command/address signal CA5 of the precharge command PRE to a low level.

After the time (tRP) required for the precharge operation, the scheduler 55 applies the second active command (ACT2) to the semiconductor memory device 200 in synchronization with the edge of the clock signal (CK_t). After that, the scheduler 55 applies a refresh management command (RFM) to the semiconductor memory device 200. In response to the refresh management command (RFM), the semiconductor memory device 200 generates a memory cell row corresponding to the hammer address. A hammer refresh operation is performed on the two adjacent Big Team memory cell rows.

Figure 26 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.

1 to 10 and 26, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 600 determines whether the count number of memory cell rows related to the precharge command has reached the threshold (the first reference number (NTH1)) (S120).

If the count number reaches the threshold (YES in S120), the address of the memory cell row related to the precharge command is stored in the hammer address queue 600 (S130).

When the count number does not reach the threshold (NO in S120) or the address of the memory cell row related to the precharge command is stored in the hammer address queue 600, the row hammer management circuit 600 generates an alert signal (ALRT). Determine whether to activate (S140).

If the alert signal (ALRT) is not activated (NO in S140), the count data (CNTD) is increased by 1 (S170). If the alert signal (ALRT) is activated (YES in S140), the count data (CNTD) is increased by 1. ) is increased by 1 and the random value (RV) is added to randomly change the count data (CNTD) (S180).

FIG. 27 is a flowchart showing the operation of the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.

1 to 10 and 27, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 600 determines whether the count number of memory cell rows related to the precharge command has reached the threshold (the first reference number (NTH1)) (S120).

If the count number reaches the threshold (YES in S120), the address of the memory cell row related to the precharge command is stored in the hammer address queue 600 (S130).

When the count number does not reach the threshold (NO in S120) or the address of the memory cell row related to the precharge command is stored in the hammer address queue 600, the row hammer management circuit 600 generates an alert signal (ALRT). Determine whether to activate (S140).

If the alert signal (ALRT) is not activated (NO in S140), count data (CNTD) is increased by 1 (S170), and if the alert signal (ALRT) is activated (YES in S140), randomization deactivation conditions Determine whether this has been met (S150).

Randomization deactivation conditions may include deactivation of the timer 545, activation of the reset signal (RST), and deactivation of the alert signal (ALRT), and deactivation of the timer 545, activation of the reset signal (RST), and deactivation of the alert signal (ALRT). If at least one of the deactivations of the RT signal (ALRT) is satisfied, it may be determined that the randomization deactivation condition is satisfied.

If the randomization deactivation condition is not met (NO in S150), count data (CNTD) is increased by 1 (S170). If the randomization deactivation condition is met (YES in S150), the count data (CNTD) is increased by 1. The count data (CNTD) is randomly changed by adding the random value (RV) to the specified value (S180).

FIG. 28 is a flowchart showing the operation of the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.

1 to 10 and 28, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 500 determines whether the count number of memory cell rows related to the precharge command has reached the threshold (the first reference number (NTH1)) (S120).

If the count number reaches the threshold (YES in S120), the address of the memory cell row related to the precharge command is stored in the hammer address queue 600 (S130).

When the count number does not reach the threshold (NO in S120) or the address of the memory cell row related to the precharge command is stored in the hammer address queue 600, the row hammer management circuit 600 generates an alert signal (ALRT). Determine whether to activate (S140).

If the alert signal (ALRT) is not activated (NO in S140), count data (CNTD) is increased by 1 (S170), and if the alert signal (ALRT) is activated (YES in S140), randomization deactivation conditions Determine whether this has been met (S150).

Randomization deactivation conditions may include deactivation of the timer 545, activation of the reset signal (RST), and deactivation of the alert signal (ALRT), and deactivation of the timer 545, activation of the reset signal (RST), and deactivation of the alert signal (ALRT). If at least one of the deactivations of the RT signal (ALRT) is satisfied, it may be determined that the randomization deactivation condition is satisfied.

If the randomization deactivation condition is not met (NO in S150), the count data (CNTD) is increased by 1 (S170), and if the randomization deactivation condition is met (YES in S150), the random enable signal (REN) is activated. Determine whether or not (S160).

If the random enable signal (REN) is not activated (NO in S160), the count data (CNTD) is increased by 1 (S170), and if the random enable signal (REN) is activated (YES in S160), the count data (CNTD) is increased by 1 (S170). The count data (CNTD) is randomly changed by adding the random value (RV) to the value obtained by increasing CNTD by 1 (S180).

Figure 29 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.

1 to 10 and 29, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 600 determines whether the random enable signal REN is activated (S220).

If the random enable signal (REN) is not activated (NO in S220), count data (CNTD) is increased by 1 (S270), and if the random enable signal (REN) is activated (YES in S220), the count data is increased by 1. The count data (CNTD) is randomly changed by adding the random value (RV) to the value of (CNTD) increased by 1 (S280).

FIG. 30 is a flowchart showing the operation of the row hammer management circuit of FIGS. 8 to 10 according to embodiments of the present invention.

1 to 10 and 30, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 500 determines whether the count number of memory cell rows related to the precharge command has reached the threshold (the first reference number (NTH1)) (S225).

If the count number reaches the threshold (YES in S225), the address of the memory cell row related to the precharge command is stored in the hammer address queue 600 (S235).

When the count number does not reach the threshold (NO in S225) or after the address of the memory cell row related to the precharge command is stored in the hammer address queue 600, the row hammer management circuit 600 generates a random enable signal (REN). ) is activated (S245).

If the random enable signal (REN) is not activated (NO in S245), count data (CNTD) is increased by 1 (S270), and if the random enable signal (REN) is activated (YES in S245), the count data is increased by 1. The count data (CNTD) is randomly changed by adding the random value (RV) to the value of (CNTD) increased by 1 (S280).

Figure 31 is a flowchart showing the operation of the row hammer management circuit of Figures 8 to 10 according to embodiments of the present invention.

1 to 10 and 31, the semiconductor memory device 200 receives a row operation command from the memory controller 30 (S110). The row operation command is a precharge command and may be applied after the active command.

The row hammer management circuit 500 increases the count data (CNTD) by 1 (S215).

The row hammer management circuit 500 determines whether the count number of memory cell rows related to the precharge command has reached the threshold (the first reference number (NTH1)) (S225).

If the count number reaches the threshold (YES in S225), the address of the memory cell row related to the precharge command is stored in the hammer address queue 600 (S235).

When the count number does not reach the threshold (NO in S225) or after the address of the memory cell row related to the precharge command is stored in the hammer address queue 600, the row hammer management circuit 600 generates a random enable signal (REN). ) is activated (S245).

If the random enable signal (REN) is not activated (NO in S245), the process is terminated. If the random enable signal (REN) is activated (YES in S245), the count data (CNTD) is increased by 1. The random value (RV) is added to randomly change the count data (CNTD) (S255).

Therefore, the semiconductor memory device 200, which stores the access number of each memory cell row in each count cell according to embodiments of the present invention, responds to an event signal indicating a change in the state of the hammer address queue 600 or periodically By randomly changing the count data corresponding to the number of accesses, overflow of the hammer address queue 600 due to a hacker's attack can be prevented, thereby preventing performance degradation.

Figure 32 shows a portion of a memory cell array to illustrate generating a hammer refresh address for a hammer address.

32 shows three word lines (WLt-1, WLt, WLt+) extended in the first direction D1 and sequentially arranged adjacent to each other in the second direction D2 within the memory cell array. 1), three bit lines (BLg-1, BLg, BLg+1) extended in the column direction (D2) and sequentially arranged adjacent to each other in the first direction (D1), and memory cells (MC) each coupled thereto ) is shown.

For example, the middle word line (WLt) may correspond to an intensively accessed hammer address (HADDR). Here, being accessed intensively means that the number of word lines is active is high or the frequency of activation is high. When the hammer word line (WLt) is accessed and active and precharged, that is, when the voltage of the hammer word line (WLt) rises and falls, a coupling phenomenon that occurs between adjacent word lines (WLt-1, WLt+1) As a result, the voltages of the adjacent word lines (WLt-1, WLt+1) rise and fall together, affecting the cell charges charged in the memory cells (MC) connected to the adjacent word lines (WLt-1, WLt+1). It's crazy. The more frequently the hammer word lines (WLs) are accessed, the more likely it is that the cell charges of the memory cells (MC) connected to the big word lines (WLt-1, WLt+1) will be lost and the stored data will be damaged.

The hammer refresh address generator 440 of FIG. 5 represents the addresses (HREF_ADDRa, HREF_ADDRb) of the word lines (WLt-1, WLt+1) physically adjacent to the word line (WLt) corresponding to the hammer address (HADDR). By providing a hammer refresh address (HREF_ADDR) and additionally performing a hammer refresh operation on adjacent word lines (WLt-1, WLt+1) based on the hammer refresh address (HREF_ADDR), memory cells are refreshed through intensive access. Data damage can be prevented.

FIG. 33 shows a portion of a memory cell array to illustrate generating a hammer refresh address for a hammer address.

33 shows five word lines (WLt-2, WLt-1, WLt, WLt+1, WLt) extending in the first direction (D1) and sequentially arranged adjacent to each other in the column direction (D2) within the memory cell array. +2), three bit lines (BLg-1, BLg, BLg+1) extending in the second direction (D2) and sequentially arranged adjacent to each other in the first direction (D1) and memory cells respectively coupled thereto (MC) is shown.

The hammer refresh address generator 440 of FIG. 5 generates the word line (WLt) corresponding to the hammer address (HADDR) and the physically adjacent word lines (WLt-1, WLt+1, WLt-2, WLt+2). Provides a hammer refresh address (HREF_ADDR) representing the addresses (HREF_ADDRa, HREF_ADDRb, REF_ADDRc, HREF_ADDRd), and based on this hammer refresh address (HREF_ADDR), adjacent word lines (WLt-1, WLt+1, WLt-2, WLt) By additionally performing the hammer refresh operation for +2), data damage to memory cells due to intensive access can be prevented.

FIGS. 34A, 34B, and 35 are timing diagrams showing examples of operation of the refresh control circuit of FIG. 6 according to embodiments of the present invention.

34A and 34B, the refresh clock signal (RCK), hammer refresh signal (HREF), counter refresh address (CREF_ADDR), and hammer refresh for the refresh control signal (IREF) activated in pulse form from t1 to t15 or t1 to t10. Embodiments related to the generation of the address (HREF_ADDR) are shown. The interval between activation times (t1 to t15) of the refresh control signal (IREF) may be regular or irregular.

Referring to FIGS. 5 and 34A, the refresh control logic 410 refreshes in synchronization with some (t1 to t4, t6 to t10, and t12 to t15) of the activation points (t1 to t15) of the refresh control signal (IREF). The clock signal (RCK) may be activated and the hammer refresh address (HERF_ADDR) may be activated in synchronization with the remaining portions (t5, t11) of the activation points (t1 to t15) of the refresh control signal (IREF).

The refresh counter 430 is a counter refresh counter indicating addresses (X+1 to Generates an address (CREF_ADDR). The hammer refresh address generator 440 synchronizes with the activation times (t5, t11) of the hammer refresh signal (HREF) and generates the addresses of the memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR) described above. A hammer refresh address (HREF_ADDR) indicating (Ha1, Ha2) is generated.

Referring to FIGS. 5 and 34B, the refresh control logic 410 generates a refresh clock signal (RCK) in synchronization with some (t1 to t4, t7 to t10) of the activation points (t1 to t10) of the refresh control signal (IREF). ) can be activated and the hammer refresh address (HERF_ADDR) can be activated in synchronization with the remaining portions (t5, t6) of the activation points (t1 to t10) of the refresh control signal (IREF).

The refresh counter 430 has a counter refresh address (CREF_ADDR) indicating addresses (X+1 to occurs. The hammer refresh address generator 440 synchronizes with the activation times (t5, t6) of the hammer refresh signal (HREF) and generates the addresses of the memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR) described above. A hammer refresh address (HREF_ADDR) indicating (Ha1, Ha2) is generated.

5 and 35, the hammer refresh address generator 440 generates a memory corresponding to the hammer address (HADDR) in synchronization with the activation points (t5, t6, t7, and t8) of the hammer refresh signal (HREF). A hammer refresh address (HREF_ADDR) indicating the addresses (Ha1, Ha2, Ha3, Ha4) of big memory cell rows physically adjacent to the cell row is generated.

Figure 36 is an example block diagram showing a semiconductor memory device according to embodiments of the present invention.

Referring to FIG. 36, the semiconductor memory device 900 includes at least one buffer die 910 and a plurality of memory dies 920-1,920- to provide analysis and relief functions for soft data failure in a stacked chip structure. 2,...,920-p, p is a natural number of 3 or more).

A plurality of memory dies (920-1, 920-2,..., 920-p) are sequentially stacked on the buffer die 910 and can communicate data through a plurality of through silicon via (hereinafter, TSV) lines. there is.

Each of the plurality of memory dies 920-1, 920-2,..., 920-p generates transmission parity bits using transmission data transmitted to the cell core 921 and buffer die 910 for storing data. It may include a generating cell core ECC engine (923), a refresh control circuit (RCC, 925), and a row hammer management circuit (RHMC, 927). The cell core 921 may include a plurality of memory cells having a DRAM cell structure.

The refresh control circuit 925 may employ the refresh control circuit 400 of FIG. 5, and the row hammer management circuit 927 may employ the row hammer management circuits 500a, 500b, and 500c of FIGS. 8 to 10. can do. Accordingly, the row hammer management circuit 927 stores the number of activations of each memory cell row as count data in the count cells of each memory cell row in a normal operation, and updates the count data in response to a precharge command. , Count data is randomly changed based on changes in the state of the hammer address queue, and when candidate hammer addresses are stored in all of the FIFO registers, the hammer address queue sends an alert signal provided to the memory controller at the first logic level. 2 logic level, and one of the candidate hammer addresses can be output as the hammer address. The refresh control circuit 925 may receive a hammer address from the row hammer management circuit 927 and perform a hammer refresh operation on one or more big memory cell rows based on the hammer address.

The buffer die 910 is a via ECC engine 912 that generates error-corrected data by correcting the transmission error using transmission parity bits when a transmission error occurs in transmission data received through the plurality of TSV lines. may include.

The buffer die 910 may include a data input/output buffer 916. The data input/output buffer 916 may sample data DTA provided from the via ECC engine 912 to generate a data signal DQ and output the data signal DQ to the outside.

The semiconductor memory device 900 may be a stack chip type memory device or a stacked memory device that communicates the data and control signals through the TSV lines. The TSV lines may also be referred to as through-silicon electrodes.

The cell core ECC engine 922 may also perform error correction on data output from the memory die 920-p before the transmission data is transmitted.

The data TSV line group 932 formed on one memory die 920-p may be composed of TSV lines (L1 to Lp), and the parity TSV line group 934 may be composed of TSV lines (L10 to Lq). It can be composed of: The TSV lines (L1 to Lp) of the data TSV line group 932 and the TSV lines (L10 to Lq) of the parity TSV line group 934 are connected to a plurality of memory dies (920-1 to 920-p). It can be connected to micro bumps (MCBs) formed correspondingly between.

The semiconductor memory device 900 may have a 3D chip structure or a 2.5D chip structure to communicate with an external memory controller through the data bus B10. The buffer die 910 may be connected to an external memory controller through the data bus B10.

In embodiments of the present invention, detection and correction of soft data failure can be verified by installing a cell core ECC engine in the memory die and a via ECC engine in the buffer die, as shown in FIG. 36. Soft data fail may include transmission errors caused by noise when data is transmitted through through silicon via lines.

Figure 37 is a structural diagram showing an example of a semiconductor package including a stacked memory device according to embodiments of the present invention.

Referring to FIG. 37 , the semiconductor package 1000 may include one or more stacked memory devices 1010 and a graphic processing unit (GPU) 1020. The stacked memory device 1010 and GPU 1020 are mounted on an interposer 1030, and the interposer 1030 on which the stacked memory device 1010 and GPU 1020 are mounted is mounted on a package substrate ( 1040). The package substrate 1040 may be mounted on the solder ball 1050. The GPU 1020 may correspond to a semiconductor device capable of performing a memory controller function, and as an example, the GPU 1020 may be implemented as an application processor. GPU 1020 may also include a memory controller having the scheduler described above.

The stacked memory device 1010 can be implemented in various forms, and according to one embodiment, the stacked memory device 1010 may be a high bandwidth memory (HBM) type memory device in which multiple layers are stacked. Accordingly, the stacked memory device 1010 includes a buffer die and a plurality of memory dies, and each of the plurality of memory dies may include the refresh control circuit and the row hammer management circuit described above.

A plurality of stacked memory devices 1010 may be mounted on the interposer 1030, and the GPU 1020 may communicate with the multiple stacked memory devices 1010. As an example, each of the stacked memory devices 1010 and the GPU 1020 may include a physical (PHY) area, and the stacked memory devices 1010 and the GPU 1020 may include a physical (PHY) area. Communication can be performed between them. Meanwhile, when the stacked memory device 1010 includes a direct access area, a test signal is transmitted through the direct access area and a conductive means (e.g., solder ball 1050) mounted on the lower part of the package substrate 1040 to the stacked memory device 1010. It may be provided inside the device 1010.

Figure 38 is a block diagram showing a memory system having a quad-rank memory module according to embodiments of the present invention.

Referring to FIG. 38 , the memory system 1100 may include a memory controller 1110 and at least one memory module 1120 or 1130.

The memory controller 1110 may control memory modules to execute commands applied from a processor or host. The memory controller 1110 may be implemented inside a processor or host, or may be implemented as an application processor or SoC. Source termination is implemented on the bus 1140 of the memory controller 1110 through a resistor (RTT) for signal integrity. The memory controller 1010 may include a CPU 1115.

The first memory module 1120 and the second memory module 1130 are connected to the memory controller 1110 through the bus 1140. Each of the first memory module 1120 and the second memory module 1130 may include a plurality of semiconductor memory devices and a register clock driver. The first memory module 1120 may include at least one memory rank RK1 and RK2, and the second memory module 1130 may include at least one memory rank RK3 and RK4.

The memory rank RK1 may include semiconductor memory devices 1121 and 1122, and the memory rank RK2 may include semiconductor memory devices 1123 and 1124. Although not shown, at least one memory rank RK3 and RK4 may also include semiconductor memory devices. Each of the semiconductor memory devices 1121, 1122, 1123, and 1124 may be implemented as the semiconductor memory device 200 of FIG. 3.

Each of the semiconductor memory devices 1121, 1122, 1123, and 1124 may be connected to the memory controller 1110 through an alert pin 1025 and a bus 1040. Each of the semiconductor memory devices 1121, 1122, 1123, and 1124 changes the logic level of the alert signal through the alert pin 1125, thereby changing the hammer address of each of the semiconductor memory devices 1121, 1122, 1123, and 1124. The status of the queue may be notified to the memory controller 1110.

Alert pins 1125 of each of the semiconductor memory devices 1121, 1122, 1123, and 1124 may be commonly connected to the bus 1140. When the logic level of the alert signal is changed in at least one of the semiconductor memory devices 1121, 1122, 1123, and 1124, the voltage of the source termination resistor (RTT) changes, so the CPU 1115 operates the semiconductor memory devices ( It can be seen that a full situation has occurred in the hammer address queue in at least one of 1121, 1122, 1123, and 1124).

Accordingly, the semiconductor memory device according to embodiments of the present invention stores the number of accesses of each memory cell row in each count cell, and responds to an event signal indicating a change in the state of the hammer address queue or at an unspecified time. By randomly changing the count data corresponding to the number of accesses, performance degradation can be prevented by preventing overflow of the hammer address queue due to hacker attacks.

Figure 39 is a block diagram showing a memory system according to embodiments of the present invention.

Referring to FIG. 39, the memory system 20a may include a memory controller 30a and a semiconductor memory device 200a.

The memory system 20a may be similar or identical to the memory system 20 of FIG. 1 .

The memory controller 30a controls the operation of the semiconductor memory device 200a by applying operation commands to control the semiconductor memory device 200a. Depending on the embodiment, the semiconductor memory device 200a may be dynamic random access (DRAM), double data rate 5 (DDR5) synchronous DRAM (SDRAM), DDR6 SDRAM, or lower power (LP) DDR DRAM having volatile memory cells. You can.

The memory controller 30a may transmit a clock signal (CK, or command clock signal), a command (CMD), and an address (ADDR) to the semiconductor memory device 200a. When writing the data signal DQ to the semiconductor memory device 200a or reading the data signal DQ from the semiconductor memory device 200a, the memory controller 30a sends the data strobe signal DQS to the semiconductor memory device 200a. It can be exchanged with (200a). The address (ADDR) may be accompanied by the command (CMD), and in this specification, the address (ADDR) may be called an access address.

The memory controller 30a includes a central processing unit (CPU) 35 that controls the overall operation of the memory controller 30a and a scheduler 55 that schedules commands applied to the semiconductor memory device 200a. may include.

The semiconductor memory device 200a may include a memory cell array 310 in which the data signal DQ is stored, a control logic circuit 210a, a row hammer management circuit 500a, and a timing control circuit 700.

The control logic circuit 210a may control the operation of the semiconductor memory device 200a. The memory cell array 310 may include a plurality of memory cell rows each having a plurality of volatile memory cells (MC) connected to a word line (WL) and a bit line (BL).

The row hammer management circuit 500a counts the number of activations of each of the plurality of memory cell rows based on an active command from the memory controller 31 and uses the count values as count data for each of the plurality of memory cell rows. It can be stored in cells. The row hammer management circuit 500a performs first-in first-out (FIFO) one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows based on a comparison of the counting values and a reference number. A first number is stored in this way, and when the number of stored candidate hammer addresses reaches the first number, the logic level of the alert signal (ALRT) provided to the memory controller 30 is changed, and the stored candidate hammer addresses are It may include a hammer address queue 600c that outputs one of the addresses as a hammer address.

The row hammer management circuit 500a also receives an active command at a first time, receives a first command after the active command, and stores the memory based on a precharge command applied at a second time after the first command. Internal read for reading the count data stored in count cells of a target memory cell row among cell rows, updating the read count data, and writing the updated count data to the count cells of the target memory cell row - Edit-write operations can be performed.

The timing control circuit 700 may provide an active count update activation signal (ACU_EN) signal to the row hammer management circuit 500a to activate the row hammer management circuit 500a from a second time point to a third time point. The row hammer management circuit 500a may perform an internal read-modify-write operation in response to activation of the active count update activation signal (ACU_EN).

Since the configuration of the memory controller 30a is substantially the same as that of the memory controller 30 of FIG. 2, detailed description will be omitted. That is, the memory controller 30a may include a CPU 35, RFM control logic, refresh logic, host interface, scheduler 55, and memory interface that are connected to each other through a bus.

FIG. 40 is a block diagram showing the configuration of a semiconductor memory device in the memory system of FIG. 39 according to embodiments of the present invention.

Referring to FIG. 40, the semiconductor memory device 200a includes a control logic circuit 210a, an address register 220, a bank control logic 230, a refresh control circuit 400, a row address multiplexer 240, and a column address latch. (250), row decoder 260, column decoder 270, memory cell array 310, sense amplifier 285, input/output gating circuit 290, ECC engine 350, clock buffer 225, strobe. It may include a signal generator 235, a timing control circuit 700, a row hammer management circuit 500a, and a data input/output buffer 320.

The memory cell array 310 may include first to sixteenth bank arrays 310a to 310s. In addition, the row decoder 260 includes first to sixteenth row decoders (260a to 260s) respectively connected to first to sixteenth bank arrays (310a to 310s), and the column decoder 270 is It includes first to sixteenth column decoders (270a to 270s) respectively connected to the first to sixteenth bank arrays (310a to 310s), and the sense amplifier 285 is connected to the first to sixteenth bank arrays (310a to 310a). ~310s) may include first to sixteenth sense amplifiers (285a to 285s) respectively connected to each other.

First to sixteenth bank arrays (310a to 310s), first to sixteenth sense amplifiers (285a to 285s), first to sixteenth column decoders (270a to 270s), and first to sixteenth row decoders (260a to 260s) may respectively constitute the first to sixteenth banks. Each of the first to sixteenth bank arrays 310a to 310s is located at a plurality of word lines (WL) and a plurality of bit lines (BL) and at intersections of the word lines (WL) and the bit lines (BL). It may include a plurality of memory cells (MC) being formed.

The address register 220 may receive an address (ADDR) including a bank address (BANK_ADDR), a row address (ROW_ADDR), and a column address (COL_ADDR) from the memory controller 30. The address register 220 provides the received bank address (BANK_ADDR) to the bank control logic 230, the received row address (ROW_ADDR) to the row address multiplexer 240, and the received column address (COL_ADDR). It can be provided to the column address latch 250. Additionally, the address register 220 may provide a bank address (BANK_ADDR) and a row address (ROW_ADDR) to the row hammer management circuit 500a.

The bank control logic 230 may generate bank control signals in response to the bank address (BANK_ADDR). In response to the bank control signals, the row decoder corresponding to the bank address (BANK_ADDR) among the first to sixteenth row decoders (260a to 260s) is activated, and the first to sixteenth column decoders (270a to 270s) The column decoder corresponding to the middle bank address (BANK_ADDR) may be activated.

The row address multiplexer 240 may receive a row address (ROW_ADDR) from the address register 220 and a refresh row address (REF_ADDR) from the refresh counter 245. The row address multiplexer 240 can selectively output a row address (ROW_ADDR) or a refresh row address (REF_ADDR) as a row address (SRA). The row address (SRA) output from the row address multiplexer 240 may be applied to the first to sixteenth row decoders 260a to 260s, respectively.

The refresh control circuit 400 may sequentially increase or decrease the refresh row address REF_ADDR in normal refresh mode in response to the refresh control signals IREF1 and IREF2 from the control logic circuit 210a. In the hammer refresh mode, the refresh control circuit 400 receives a hammer address (HADDR) and converts the hammer refresh address, which is the addresses of memory cell rows physically adjacent to the memory cell row corresponding to the hammer address (HADDR), into a refresh row address ( REF_ADDR).

Among the first to sixteenth row decoders 260a to 260s, the row decoder activated by the bank control logic 230 decodes the row address (SRA) output from the row address multiplexer 240 to You can activate the corresponding word line. For example, the activated row decoder may apply a word line driving voltage to the word line corresponding to the row address (SRA).

The column address latch 250 may receive the column address (COL_ADDR) from the address register 220 and temporarily store the received column address (COL_ADDR). Additionally, the column address latch 250 may gradually increase the received column address (COL_ADDR) in burst mode. The column address latch 250 may apply the temporarily stored or gradually increased column address COL_ADDR' to the first to sixteenth column decoders 270a to 270s, respectively.

Among the first to sixteenth column decoders 270a to 270s, the column decoder activated by the bank control logic 230 corresponds to the bank address (BANK_ADDR) and the column address (COL_ADDR) through the corresponding input/output gating circuit 290. This can activate the sense amplifier.

The input/output gating circuit 290 includes circuits for gating input/output data, input data mask logic, read data latches for storing codewords output from the first to sixteenth bank arrays 310a to 310s, and It may include write drivers for writing data to the first to sixteenth bank arrays 310a to 310s.

A codeword (CW) read from one of the first to sixteenth bank arrays 310a to 310s is sensed by a sense amplifier corresponding to the one bank array and stored in the read data latches. You can. The codeword (CW) stored in the read data latches is ECC decoded by the ECC engine 350 and provided as data (DTA) to the data input/output buffer 320, and the data input/output buffer 320 is converted to data (DTA). ) can be converted into a data signal (DQ) and provided to the memory controller 30a along with the data signal (DQ) and the strobe signal (DQS).

The data signal DQ to be written in one of the first to sixteenth bank arrays 310a to 310s is received by the data input/output buffer 320 together with the strobe signal DQS. The data input/output buffer 320 converts the data signal (DQ) into data (DTA) and provides it to the ECC engine 350, and the ECC engine 350 generates parity bits (or parity data) based on the data (DTA). may be generated, and a codeword (CW) including the data (DTA) and the parity bits may be provided to the input/output gating circuit 290. The input/output gating circuit 290 may write the codeword (CW) to the target page of the one bank array through the write drivers.

In a write operation, the data input/output buffer 320 converts the data signal (DQ) into data (DTA) and provides it to the ECC engine 350, and in a read operation, the data (DTA) provided from the ECC engine 350 is converted into a data signal. (DQ), and the data signal (DQ) and strobe signal (DQS) can be provided to the memory controller 30.

The ECC engine 350 may perform ECC encoding for the data (DTA) and ECC decoding for the codeword (CW) based on the second control signal (CTL2) from the control logic circuit 210a. Additionally, the ECC engine 350 performs ECC encoding and ECC decoding on the random count data (RCNTD) and/or count data (CNTD) provided from the row hammer management circuit 500a based on the second control signal (CTL2). can do.

The clock buffer 225 receives the clock signal (CK), buffers the clock signal (CK) to generate an internal clock signal (ICK), and the internal clock signal (ICK) generates a command (CMD) and an address (ADDR). It can be provided to processing components.

The strobe signal generator 235 may receive the clock signal CK, generate a strobe signal DQS based on the clock signal CK, and provide the strobe signal DQS to the data input/output buffer 320. .

The timing control circuit 700 is configured to receive a fourth control signal (CTL4) representing a command received from the control logic circuit (210a) and control the row hammer management circuit (500a) based on the fourth control signal (CTL4). Generate second internal command signals (IWR2, IRD2, IPRE) and an active count update activation signal (ACU_EN), and turn the second internal command signals (IWR2, IRD2, IPRE) and an active count update activation signal (ACU_EN) low. It can be provided to the hammer management circuit 500a. The second internal command signals (IWR, IRD, IPRE) may include a write signal (IWR2), a read signal (IRD2), and a precharge signal (IPRE).

The timing control circuit 700 receives the clock signal CK and generates the clock signal CK corresponding to the activation period of the active count update activation signal ACU_EN based on the frequency information FRI of the clock signal CK. The number can be adjusted adaptively.

The row hammer management circuit 500a manages a plurality of memory cell arrays 310 based on an access address (ADDR) including a row address (ROW_ADDR) and a bank address (BANK_ADDR) accompanying an active command from the memory controller 30a. The number of activations of each of the memory cell rows may be counted and the count values may be stored as count data (CNTD) in the count cells of each of the plurality of memory cell rows. The row hammer management circuit 500a performs first-in first-out (FIFO) one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows based on a comparison of the counting values and a reference number. When the number of candidate hammer addresses stored reaches the first number, the logic level of the alert signal (ALRT) is provided to the memory controller 30 through the alert pin 201. may be changed, and one of the stored candidate hammer addresses may be provided to the refresh control circuit 400 as a hammer address (HADDR).

The control logic circuit 210a may control the operation of the semiconductor memory device 200a. For example, the control logic circuit 210a may generate control signals so that the semiconductor memory device 200 performs a write operation, a read operation, a normal refresh operation, and a hammer refresh operation. The control logic circuit 210a may include a command decoder 211 for decoding the command (CMD) received from the memory controller 30a and a mode register 212 for setting the operation mode of the semiconductor memory device 200a. You can.

For example, the command decoder 211 may decode a chip select signal and a command/address signal to generate the control signals corresponding to a command (CMD). In particular, the control logic circuit 210a decodes the command (CMD) to control the input/output gating circuit 290, a first control signal (CTL1), a second control signal (CTL2) that controls the ECC engine 350, and a low hammer signal. A third control signal (CTL3) controlling the management circuit 500a and a fourth control signal (CTL4) controlling the timing control circuit 700 may be generated. In addition, the command decoder 211 decodes the command (CMD) and outputs the first refresh control signal (IREF1), the second refresh control signal (IREF2), the active signal (IACT), the write signal (IWR1), and the read signal (IRD1). The same first internal command signals may be generated, and an active period signal (PRD) indicating the activation period of the target word line may be generated.

FIG. 41 shows memory cells included in the memory cell array of FIG. 40 according to embodiments of the present invention.

FIG. 41 shows memory cells connected to the word line WLa as an example.

Referring to FIG. 41, normal cells (NCS) and count cells (CCS) may be connected to the word line (WLa), and normal data (DTA) may be stored in the normal cells (NCS) or read from the normal cells (NCS). The count data (CNTD) may be stored in or read from the count cells (CCS).

FIG. 42A is a block diagram showing the configuration of a timing control circuit in the semiconductor memory device of FIG. 40 according to embodiments of the present invention.

Referring to FIG. 42A , the timing control circuit 700 may include an internal command signal generator 710, a latency controller 730, and an active count update (ACU) activation signal generator 750.

The latency controller 730 may receive the clock signal CK and generate a delay control signal DCS based on the frequency information FRI of the clock signal CK.

The internal command signal generator 710 generates an internal write signal (IWR) and an internal read signal that control the operation of the row hammer management circuit 500a based on a command (CMD) including a continuously applied first command and a precharge command. A signal (IRD) and an internal precharge signal (IPRE) can be generated, and the activation timing of the internal precharge signal (IPRE) can be adjusted based on the delay control signal (DCS).

The active count update activation signal generator 750 generates an active count update activation signal (ACU_EN) that activates the low hammer management circuit 500a based on the internal read signal (IRD) and the internal precharge signal (IPRE). The active count update activation signal (ACU_EN) may be activated based on the activation (IRD) of the read signal, and the deactivation point of the active count update activation signal (ACU_EN) may be adjusted based on the activation of the internal precharge signal (IPRE).

FIG. 42B is a block diagram showing the configuration of a latency controller in the timing control circuit of FIG. 42A according to embodiments of the present invention.

Referring to FIG. 42B, the latency controller 730 may include a clock counter 740 and a signal generator 745.

The clock counter 740 receives the clock signal CK and the internal read signal IRD, counts the clock signal CK in response to activation of the internal read signal IRD, and outputs a counting value CV.

The signal generator 745 activates the delay control signal (DCS) when the counting value (CV) reaches the target value based on the frequency information (FRI) and sends the activated delay control signal (DCS) to the internal command signal generator 710. can be provided to. The signal generator 745 can adaptively adjust the target value of the frequency information (FRI). That is, when the frequency information (FRI) indicates that the frequency of the clock signal (CK) increases, the signal generator 745 increases the target value of the counting value (CV), thereby increasing the activation period of the active count update activation signal (ACU_EN). The number of clock signals (CK) corresponding to can be increased.

FIG. 43 is a block diagram showing the configuration of a row hammer management circuit in the semiconductor memory device of FIG. 40 according to embodiments of the present invention.

Referring to FIG. 43, the row hammer management circuit 500a may include an adder 510, a comparator 520, a register 530, and a hammer address queue 600c.

The adder 510 may increase the count data (CNTD), which is read from the target memory cell row and ECC decoded by the ECC engine 350, by 1 to provide updated count data (UCNTD). That is, the adder 510 can update the count data (CNTD). The adder 510 may be implemented as an up-counter.

The updated count data (UCNTD) is provided to the ECC engine 350, and the ECC engine 350 may perform ECC encoding on the count data (UCNTD).

The register 530 may store a reference number (NTH1). The comparator 520 may compare the read count data (CNTD) with the reference number (NTH1) and output a comparison signal (CS) indicating the result of the comparison.

In an embodiment, the comparator 520 may compare the updated count data (UCNTD) with the reference count (NTH1).

The reference number NTH1 may include a default reference number and multiples of the default reference number, and therefore, the comparison signal CS may include a plurality of bits.

In response to the comparison signal CS indicating that the read count data CNTD is greater than the reference number NTH1, the hammer address queue 600c uses the target row address T_ROW_ADDR, which specifies the target memory cell row, as a candidate hammer address. It may be stored, and at least one of the stored candidate hammer addresses may be provided to the refresh control circuit 400 of FIG. 40 as a hammer address (HADDR). The hammer address queue 600 stores target row addresses (T_ROW_ADDR) that are accessed more than the reference number of times (NTH1) as candidate hammer addresses, and alerts the state of the hammer address queue 600c according to the number of stored candidate hammer addresses. It can be expressed as the logic level of the signal (ALRT).

FIG. 44 is a block diagram illustrating an example of a hammer address queue in the row hammer management circuit of FIG. 43 according to embodiments of the present invention.

Referring to FIG. 44, the hammer address queue 600c will include a first number of first-in first-out (FIFO) registers 610a, 610b, ..., 610h and monitor logic 650c. You can.

The first number of FIFO registers (610a, 610b, ..., 610h) can store the first number of candidate hammer addresses (CHADDRa, CHADDRb, ..., CHADDRh) accessed more than a reference number (NTH1) in a first-in-first-out manner. there is.

The monitor logic 650c is connected to the first number of FIFO registers 610a, 610b, ..., 610h, manages the first number of FIFO registers 610a, 610b, ..., 610h, and provides a comparison signal (CS). Based on , it is possible to monitor whether the candidate hammer address is stored in each of the first number of FIFO registers 610a, 610b, ..., 610h. The monitor logic 650c detects when the number of candidate hammer addresses stored in the first number of FIFO registers 610a, 610b, ..., 610h reaches the first number (i.e., the first number of FIFO registers 610a, 610b). , …, 610h) is full), the candidate hammer address input first among the candidate hammer addresses is output as the hammer address (HADDR), and the logic level of the alert signal (ALRT) is transitioned to generate the hammer address queue (600c). ) can be notified to the memory controller 30a.

Figures 45 and 46 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.

45 and 46, assuming that the semiconductor memory device 200a is DDR5 SDRAM or DDR6 SDRAM, a clock signal CK_t and a chip select signal CS_n are shown. Additionally, FIGS. 45 and 46 may correspond to the embodiments of FIGS. 24 and 23, respectively.

Referring to FIGS. 39, 40, and 45, the scheduler 55 of the memory controller 30a synchronizes with the edge of the clock signal CK_t at time t11 to determine the first target row address of the first target memory cell row. The first active command ACT1 accompanied by is applied to the semiconductor memory device 200a.

In response to the first active command ACT1, the control logic circuit 210a activates the first active signal IACT1 to activate the first target word line connected to the first target memory cell row.

After applying the first active command (ACT1), at time t12, the scheduler 55 issues a write command (WR) that instructs a write operation on the first target memory cell row in synchronization with the edge of the clock signal (CK_t). is applied to the semiconductor memory device 200a, and the control logic circuit 210a activates the first write signal IWR1 in response to the write command WR. After applying the write command WR, the memory controller 30a applies data DTA accompanying the write command WR to the semiconductor memory device 200a at time t13. Data (DTA) may include a plurality of bits (0, 1, s-1).

The control logic circuit 201 activates the second write signal IWR21 at time t14 to perform a write operation to store data DTA in the first target memory cell row.

A write command (WR) is applied, and the scheduler 55 applies a precharge command (PRE) to the semiconductor memory device 200a at time t15.

When the precharge command (PRE) is applied at time t15, the row hammer management circuit 500a generates the read signal IRD and the third write signal at times t15 and t16 based on the precharge command (PRE). By sequentially activating (IWR2), count data (CNTD) stored in the first target memory cell row is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is stored in the first target memory cell. Write in row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row address (RA=u) increases from w to w+1. That is, the row hammer management circuit 500a reads the count data (CNTD) stored in the first target memory cell row based on the received precharge command (PRE), not based on a separate command, and updates the read data. And, the updated count data is rewritten in the first target memory cell row.

After activating the read signal (IRD), and after the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal (IPRE) at time t17 and the control logic circuit 210a precharges the first target word line in response to activation of the precharge signal IPRE.

After the delay time (tRP) has elapsed from the time t15 of receiving the precharge command (PRE), the scheduler 55 sends a second active command (ACT2) for the second target memory cell row at time t18. It is applied to the semiconductor memory device 200a, and the control logic circuit 210a activates the second active signal (IACT2) in response to the second active command (ACT2) to connect the second target word line to the second target memory cell row. Activate .

In Figure 45, tRAS may correspond to the active to precharge time, tRCD may correspond to the active to write time, WLT may correspond to the write latency, WBL may correspond to the write burst length, and tWTR_L may correspond to the minimum write to read, tWTR_PRHT may correspond to the interval of the internal write operation, tWR may correspond to the write recovery time, and tRP may correspond to the interval between the precharge command and the next active command. You can.

In Figure 45, tWR may correspond to 30ns and tACU may correspond to 20ns.

The row hammer management circuit 500a performs an internal write-modify-read operation for count data in response to an active count update activation signal (ACU_EN) that is activated during the time interval (tACU) from time t15 to t17. It can be done. The timing control circuit 700 activates the set signal (SET) at time t15 and the reset signal (RST) at time t17 to set the time interval (tACU) from time t15 to t17. During this period, the active count update activation signal (ACU_EN) can be activated.

That is, after the control logic circuit 210a receives the first active command ACT1 at a time t11 (the first time point), the row hammer management circuit 500a operates the free command received at a time point t15 (the second time point). The internal read-modify-write operation may be performed based on a charge command (PRE). That is, the semiconductor memory device 200a reads the count data (CNTD) stored in the first target memory cell row based on the precharge (PRE) received from the memory controller 30a, updates the read data, and updates the updated Count data may be rewritten in the first target memory cell row. In an embodiment, the time interval between the time t11 and the time t15 may be determined in advance between the memory controller 30a and the semiconductor memory device 200a.

After the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal (IPRE) and the control logic circuit 210a responds to the activation of the precharge signal (IPRE). Thus, the first target memory cell row can be precharged. That is, the row hammer management circuit 500a transmits the precharge signal (IPRE) at a time interval (tACU) after the precharge command (PRE) is received (t15, second time) (t17, third time). can be activated. The control logic circuit 210a may precharge the first target memory cell row in response to the precharge signal IPRE activated by the row hammer management circuit 500a at the third time point t17.

39, 40, and 46, the scheduler 55 of the memory controller 30a selects the first target row address of the first target memory cell row in synchronization with the edge of the clock signal CK_t at time t21. The first active command ACT1 accompanied by is applied to the semiconductor memory device 200a.

In response to the first active command ACT1, the control logic circuit 210a activates the first active signal IACT1 to activate the first target word line connected to the first target memory cell row.

After applying the first active command ACT1, at time t22, the scheduler 55 issues a read command RD that instructs a read operation for the first target memory cell row in synchronization with the edge of the clock signal CK_t. is applied to the semiconductor memory device 200a, and the control logic circuit 210a activates the first read signal IRD1 in response to the read command RD.

A read command (RD) is applied, and the scheduler 55 applies a precharge command (PRE) to the semiconductor memory device 201 at time t23.

When the precharge command (PRE) is applied at time t23, the row hammer management circuit 500a generates a second read signal IRD2 and a write signal at times t23 and t24 based on the precharge command PRE. By sequentially activating (IWR2), count data (CNTD) stored in the first target memory cell row is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is stored in the first target memory cell. Write in row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row address (RA=u) increases from w to w+1. That is, the row hammer management circuit 500a reads the count data (CNTD) stored in the first target memory cell row based on the received precharge command (PRE), not based on a separate command, and updates the read data. And, the updated count data is rewritten in the first target memory cell row.

After activating the second read signal (IRD2), after the time (tACU) required for the internal read-modify-write operation, the low hammer management circuit 500a activates and controls the precharge signal (IPRE) at time t25. The logic circuit 210a precharges the first target word line in response to activation of the precharge signal IPRE.

At a time point (t26) when the delay time (tRP) has elapsed from the time point (t23), the scheduler 55 applies the second active command (ACT2) for the second target memory cell row to the semiconductor memory device 200a and controls The logic circuit 210a activates the second active signal IACT2 in response to the second active command ACT2 to activate the second target word line connected to the second target memory cell row.

At time t27, data DTA in response to the read command RD may be output to the outside of the semiconductor memory device 200a.

In Figure 46, tRAS may correspond to the active to precharge delay, tRCD may correspond to the active to read delay, CL may correspond to the read latency, tCCD_L applies the read command (RD), and the same It may correspond to a delay time when applying a continuous read command corresponding to a bank group, and tRTP may correspond to a read to precharge delay.

In Figure 46, tACU may correspond to 20ns.

The row hammer management circuit 500a performs an internal write-modify-read operation for count data in response to the active count update activation signal (ACU_EN) activated during the time interval (tACU) from time t23 to t25. It can be done. The timing control circuit 700 activates the set signal (SET) at time t23 and the reset signal (RST) at time t25 to set the time interval (tACU) from time t23 to t25. During this period, the active count update activation signal (ACU_EN) can be activated.

That is, the row hammer management circuit 500a receives the first active command ACT1 at the time t21 (first time point) of the control logic circuit 210a, and sends the read command RD after the first active command ACT1. ), the internal read-modify-write operation may be performed based on the precharge command (PRE) received at time t23 (second time point). That is, the semiconductor memory device 200a reads the count data (CNTD) stored in the first target memory cell row based on the precharge (PRE) received from the memory controller 30a, updates the read data, and updates The stored count data can be rewritten in the first target memory cell row. The time interval between the time t21 and the time t23 may be determined in advance between the memory controller 30a and the semiconductor memory device 200a.

After the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal (IPRE) and the control logic circuit 210a responds to the activation of the precharge signal (IPRE). Thus, the first target memory cell row can be precharged. That is, the low hammer management circuit 500a transmits the precharge signal (IPRE) at a time interval (tACU) after the precharge command (PRE) is received (t23, second time) (t25, third time). can be activated. The control logic circuit 210a may precharge the first target memory cell row in response to the precharge signal IPRE activated by the row hammer management circuit 500a at the third time point t25.

Figures 47 and 48 respectively show command protocols of a memory system when the memory system according to embodiments of the present invention performs an internal read-modify-write operation using a precharge command.

47 and 48, assuming that the semiconductor memory device 200a is an LPDDR SDRAM, a clock signal CK_t and a chip select signal CS_n are shown. Additionally, FIGS. 47 and 48 may correspond to the embodiments of FIGS. 24 and 23, respectively.

39, 40, and 47, the scheduler 55 of the memory controller 30a selects the first target row address of the first target memory cell row in synchronization with the edge of the clock signal CK_t at time t31. The first active command (ACT11) and the second active command (ACT12) accompanying are successively applied to the semiconductor memory device 200a.

In response to the first active command (ACT11) and the second active command (ACT12), the control logic circuit 210a activates the first active signal (IACT1) to activate the first target word line connected to the first target memory cell row. I order it.

After applying the first active command (ACT11) and the second active command (ACT12), at time t32, the scheduler 55 performs a write operation on the first target memory cell row in synchronization with the edge of the clock signal (CK_t) A write command WR indicating is applied to the semiconductor memory device 200a, and the control logic circuit 210a activates the first write signal IWR1 in response to the write command WR. The write command WR is applied, and the memory controller 30a applies the data DTA accompanying the write command WR to the semiconductor memory device 200a at time t33. Data (DTA) may include a plurality of bits (0, 1, s-1).

The control logic circuit 210a activates the second write signal IWR21 at time t34 to perform a write operation to store data DTA in the first target memory cell row.

A write command (WR) is applied, and the scheduler 55 applies a precharge command (PRE) to the semiconductor memory device 200a at time t35.

When the precharge command (PRE) is applied at time t35, the row hammer management circuit 500a generates the read signal IRD and the third write signal at times t35 and t36 based on the precharge command (PRE). By sequentially activating (IWR2), count data (CNTD) stored in the first target memory cell row is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is stored in the first target memory cell. Write in row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row address (RA=u) increases from w to w+1. That is, the row hammer management circuit 500a reads the count data (CNTD) stored in the first target memory cell row based on the received precharge command (PRE), not based on a separate command, and stores the read data. Update and rewrite the updated count data into the first target memory cell row.

After activation of the read signal (IRD) and the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal IPRE and the control logic circuit 210a activates the precharge signal (IPRE). The first target word line is precharged in response to activation of the charge signal (IPRE).

After the delay time (tRP) has elapsed from the time point (t35) of receiving the precharge command (PRE), the scheduler 55 sends a third active command (ACT21) for the second target memory cell row at time point (t38) and The fourth active command ACT22 is continuously applied to the semiconductor memory device 200a, and the control logic circuit 210a generates a second active signal in response to the third active command ACT21 and the fourth active command ACT22. IACT2) is activated to activate the second target word line connected to the second target memory cell row.

In Figure 47, tRAS may correspond to the active to precharge time, tRCD may correspond to the active to write time, WLT may correspond to the write latency, WBL may correspond to the write burst length, and tWTR_L may correspond to the minimum write to read, tWTR_PRHT may correspond to the interval of the internal write operation, tWR may correspond to the write recovery time, and tRP may correspond to the interval between the precharge command and the next active command. You can.

In Figure 47, tWR may correspond to 34ns and tACU may correspond to 22ns.

The row hammer management circuit 500a performs an internal write-modify-read operation for count data in response to an active count update activation signal (ACU_EN) that is activated during the time interval (tACU) from time t35 to t37. It can be done. The timing control circuit 700 activates the set signal (SET) at time t35 and the reset signal (RST) at time t37 to set the time interval (tACU) from time t15 to t17. During this period, the active count update activation signal (ACU_EN) can be activated.

That is, the row hammer management circuit 500a receives the first active command (ACT11) and the second active command (ACT12) at the time t31 (first time point) of the control logic circuit 210a, and then sends the write command ( After receiving WR), the internal read-modify-write operation may be performed based on the precharge command (PRE) received at time t35 (second time point). That is, the semiconductor memory device 200a reads the count data (CNTD) stored in the first target memory cell row based on the precharge (PRE) received from the memory controller 30a, updates the read data, and updates the updated Count data may be rewritten in the first target memory cell row. In an embodiment, the time interval between the time t31 and the time t35 may be determined in advance between the memory controller 30a and the semiconductor memory device 200a.

After the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal (IPRE) and the control logic circuit 210a responds to the activation of the precharge signal (IPRE). Thus, the first target memory cell row can be precharged. That is, the low hammer management circuit 500a transmits the precharge signal (IPRE) at a time interval (tACU) after the precharge command (PRE) is received (t35, second time) (t37, third time). can be activated. The control logic circuit 210a may precharge the first target memory cell row in response to the precharge signal IPRE activated by the row hammer management circuit 500a at the third time point t37.

Referring to FIGS. 39, 40, and 48, the scheduler 55 of the memory controller 30a synchronizes with the edge of the clock signal CK_t at time t41 to determine the first target row address of the first target memory cell row. The first active command (ACT11) and the second active command (ACT12) accompanying are successively applied to the semiconductor memory device 200a.

In response to the first active command (ACT11) and the second active command (ACT12), the control logic circuit 210a activates the first active signal (IACT1) to activate the first target word line connected to the first target memory cell row. I order it.

After applying the first active command (ACT11) and the second active command (ACT12), at time t42, the scheduler 55 performs a read operation for the first target memory cell row in synchronization with the edge of the clock signal (CK_t) A read command RD indicating is applied to the semiconductor memory device 200a, and the control logic circuit 210a activates the first read signal IRD1 in response to the read command RD.

A read command (RD) is applied, and the scheduler 55 applies a precharge command (PRE) to the semiconductor memory device 200a at time t43.

When the precharge command (PRE) is applied at the time point (t43), the row hammer management circuit 500a generates the second read signal (IRD2) and the write signal at the times (t43 and t44) based on the precharge command (PRE). By sequentially activating (IWR2), count data (CNTD) stored in the first target memory cell row is read, the read count data (CNTD) is updated, and the updated count data (CNTD) is stored in the first target memory cell. Write in row. Accordingly, the bit value of the count data (CNTD) stored in the first target memory cell row designated by the first target row address (RA=u) increases from w to w+1. That is, the row hammer management circuit 500a reads the count data (CNTD) stored in the first target memory cell row based on the received precharge command (PRE), not based on a separate command, and stores the read data. Update and rewrite the updated count data into the first target memory cell row.

After activating the second read signal (IRD2), after the time (tACU) required for the internal read-modify-write operation, at time t45, the low hammer management circuit 510a activates and controls the precharge signal (IPRE). The logic circuit 210a precharges the first target word line in response to activation of the precharge signal IPRE.

At a time point (t46) when the delay time (tRP) has elapsed from the time point (t43), the scheduler 55 applies the second active command (ACT2) for the second target memory cell row to the semiconductor memory device 200a and controls The logic circuit 210a activates the second active signal IACT2 in response to the second active command ACT2 to activate the second target word line connected to the second target memory cell row.

After the time point t46, the data DTA in response to the read command RD may be output to the outside of the semiconductor memory device 200a.

In Figure 48, tRAS may correspond to the active to precharge delay, tRCD may correspond to the active to read delay, CL may correspond to the read latency, tCCD_L applies the read command (RD), It may correspond to the delay time when applying successive read commands corresponding to the same bank group, and tRTP may correspond to the read to precharge delay.

In Figure 48, tACU may correspond to 22ns.

The row hammer management circuit 500a performs an internal write-modify-read operation for count data in response to the active count update activation signal (ACU_EN) that is activated during the time interval (tACU) from time point (t43) to time point (t45). It can be done. The timing control circuit 700 activates the set signal (SET) at time t43 and the reset signal (RST) at time t45 to set the time interval (tACU) from time t43 to t45. During this period, the active count update activation signal (ACU_EN) can be activated.

That is, the row hammer management circuit 500a is configured such that the control logic circuit 210a executes the first active command ACT11 and the first active command ACT11 at a time t41 (the first time point). 2 After receiving the active command (ACT12) and subsequently receiving the read command (RD), the internal read-modify-write operation based on the precharge command (PRE) received at time t43 (second time point) can be performed. That is, the semiconductor memory device 200a reads the count data (CNTD) stored in the first target memory cell row based on the precharge (PRE) received from the memory controller 30a, updates the read data, and updates The stored count data can be rewritten in the first target memory cell row. In an embodiment, the time interval between the time t41 and the time t43 may be predetermined between the memory controller 30a and the semiconductor memory device 200a.

After the time (tACU) required for the internal read-modify-write operation, the row hammer management circuit 500a activates the precharge signal (IPRE) and the control logic circuit 210a responds to the activation of the precharge signal (IPRE). Thus, the first target memory cell row can be precharged. That is, the low hammer management circuit 500a transmits the precharge signal (IPRE) at a time interval (tACU) after the precharge command (PRE) is received (t43, second time) (t45, third time). can be activated. The control logic circuit 210a may precharge the first target memory cell row in response to the precharge signal IPRE activated by the row hammer management circuit 500a at the third time point t45.

Figure 49 shows that the row hammer management circuit according to embodiments of the present invention secures an active count update period based on the frequency of the clock signal.

Figure 49 shows the data transmission frequency, clock signal frequency, period of one clock signal (tCK), write recovery time (tWR), and active count update period (tACU) according to the clock signal frequency.

In Figure 49, it is assumed that the write recovery time (tWR) is 30ns and the active count update period (tACU) is 20ns.

Referring to Figure 49, as the data transmission frequency increases to 3200Mbps, 3600Mbps, 4000Mpbs, 4400Mbps, 4800Mbps, 5200Mbps, 5600Mbps, 6000Mbps, 6400Mbps, the frequency of the clock signal (CK) increases to 1600MHz, 1800MHz, and 200Mbps. 0MHz, 2200MHz, 2400MHz, 2600MHz , increases to 2800MHz, 3000MHz, and 3200MHz, and accordingly, the period (tCK) of one clock signal is 0.625ns, 0.556ns, 0.500ns, 0.455ns, 0.417ns, 0.385ns, 0.357ns, 0.357ns, 0.333ns, It decreases to 0.333ns and 0.3125ns.

As the period (tCK) of one clock signal decreases with an increase in the frequency of the clock signal (CK), the number of clock signals (tCK) corresponding to the write recovery time (tWR) is 48, 54, 60, 66, It increases to 72, 78, 84, 90, and 96, and the number of clock signals (tCK) corresponding to the active count update period (tACU) increases to 32, 36, 40, 44, 48, 56, 60, and 64.

The latency controller 730 in FIG. 42b adaptively adjusts the counting value (CV) of the clock signal (CK) reaching the target counting value according to the frequency information (FRI) of the clock signal (CK) to control the delay control signal (DCS). ) can be activated.

Therefore, the semiconductor memory device according to embodiments of the present invention stores the number of accesses of each memory cell row as count data in each count cell, and in response to receiving a precharge command, adds the count data to the count data without a separate command. Performance can be improved by automatically performing internal read-modify-write operations to prevent low hammer while reducing command issuance.

The present invention can be applied to various systems using a semiconductor memory device including a plurality of volatile memory cells. That is, the present invention can be applied to various systems that use semiconductor memory devices as operating memory, such as smart phones, navigation systems, laptop computers, desktop computers, game consoles, etc.

As described above, the present invention has been described with reference to embodiments, but those skilled in the art may vary the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. You will understand that modifications and changes may be made.

Claims (20)

A memory cell array comprising a plurality of memory cell rows each having a plurality of memory cells;
Counting the number of activations of each of the plurality of memory cell rows based on an active command from an external memory controller and storing the counting values as count data in count cells of each of the plurality of memory cell rows,
The plurality of memory cell rows based on a precharge command applied at a second time after the first command that is applied after the active command received at a first time and instructing a memory operation for the target memory cell row. Internal read-modification for reading the count data stored in the count cells of a target memory cell row, updating the read count data, and rewriting the updated count data to the count cells of the target memory cell row. -low hammer management circuit that performs the writing operation; and
A semiconductor memory device comprising a control logic circuit that performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit. According to paragraph 1,
The row hammer management circuit activates the precharge signal at a third time after the second time,
The control logic circuit precharges the target memory cell row in response to the precharge signal. According to paragraph 2,
The time interval between the second time point and the third time point corresponds to a section in which the row hammer management circuit performs the internal read-modify-write operation. According to paragraph 2,
An active count update activation signal that generates internal command signals that control the operation of the row hammer management circuit based on the precharge command and activates the row hammer management circuit based on the frequency of the clock signal received from the memory controller. A semiconductor memory device further comprising a timing control circuit that adaptively adjusts the number of clock signals corresponding to the activation period of . According to paragraph 4,
The first command is a write command that instructs a write operation for the target memory cell row,
The control logic circuit is
activating a first write signal based on receipt of the write command;
activating a second write signal based on receipt of write data accompanying the write command;
The timing control circuit is
Activating a read signal, a third write signal, and the precharge signal sequentially based on reception of the precharge command,
Characterized by activating the active count update signal during the time interval from the second time to the third time based on the read signal activated at the second time and the precharge signal activated at the third time. semiconductor memory device. According to clause 5,
The semiconductor memory device wherein the row hammer management circuit performs the internal read-modify-write operation in response to activation of the active count update signal. According to clause 5,
The timing control circuit is a semiconductor memory device characterized in that adaptively adjusts the number of clock signals corresponding to the time interval based on the frequency of the clock signal. According to paragraph 4,
The first command is a read command that instructs a read operation for the target memory cell row,
The control logic circuit is
Activating a first read signal based on reception of the read command,
The timing control circuit is
Based on reception of the precharge command, sequentially activating a second read signal, a write signal, and the precharge signal,
Activating the active count update activation signal during the time interval from the second time to the third time based on the second read signal activated at the second time and the precharge signal activated at the third time. A semiconductor memory device characterized in that. According to clause 8,
The timing control circuit is a semiconductor memory device characterized in that adaptively adjusts the number of clock signals corresponding to the time interval based on the frequency of the clock signal. The method of claim 4, wherein the timing control circuit is
a latency controller that generates a delay control signal based on frequency information of the clock signal;
An internal command signal that generates a write signal, a read signal, and a precharge signal that control the operation of the row hammer management circuit based on the precharge command, and controls the activation point of the precharge signal based on the delay control signal. generator; and
Generating an active count update activation signal that activates the row hammer management circuit based on the read signal and the precharge signal, activating the active count update activation signal based on activation of the read signal, and generating the precharge signal A semiconductor memory device comprising an active count update activation signal generator that adjusts a deactivation point of the active count update activation signal based on activation of . The method of claim 1, wherein the row hammer management circuit
Based on the comparison of the counting values and the reference number, a first number of one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows may be stored, and one of the stored candidate hammer addresses may be output as a hammer address. Contains a hammer address cue that does,
The semiconductor memory device is
The semiconductor further comprising a refresh control circuit that receives the hammer address and performs a hammer refresh operation on one or more victim memory cell rows physically adjacent to the memory cell row corresponding to the hammer address. memory device. The method of claim 11, wherein the row hammer management circuit
an adder that updates count data read from the target memory cell row and outputs the updated count data; and
Further comprising a comparator that compares the read count data with the reference number and outputs a comparison signal,
The hammer address queue is
A semiconductor memory device, wherein in response to the comparison signal indicating that the read count data is greater than or equal to the reference number, a target access address designating the target memory cell row is stored as the candidate hammer address. The method of claim 12, wherein the hammer address queue is
the first number of first in-first out (FIFO) registers storing the candidate hammer addresses; and
It is connected to the first number of FIFO registers to manage the first number of FIFO registers, monitors whether the candidate hammer address is stored in each of the first number of FIFO registers, and stores the candidate hammer address in each of the first number of FIFO registers. A semiconductor memory device comprising monitor logic that outputs the candidate hammer address input first among the candidate hammer addresses as the hammer address when the number of the candidate hammer addresses stored in the field reaches the first number. . According to clause 11,
The refresh control circuit is
refresh control logic for generating a hammer refresh signal in response to a refresh management signal based on a refresh management command provided from the memory controller in response to a transition of an alert signal indicating that the number of stored candidate hammer addresses has reached the first number;
a refresh clock generator that generates a refresh clock signal in response to the refresh signal;
a refresh counter that generates a counter refresh address related to a normal refresh operation of the plurality of memory cell rows based on the refresh clock signal;
a hammer address storage that stores the hammer address and outputs the hammer refresh signal; and
A semiconductor memory device comprising a mapper that generates hammer refresh addresses indicating addresses of the victim memory cell rows based on the hammer address output from the hammer address storage. A memory cell array comprising a plurality of memory cell rows each having a plurality of memory cells;
Counting the number of activations of each of the plurality of memory cell rows based on a first active command and a second active command continuously received from an external memory controller, and using the counting values as count data for each of the plurality of memory cell rows Store in count cells of,
Based on a precharge command applied after the first active command and the second active command received at a first time and applied at a second time after the first command instructing a memory operation for the target memory cell row The count data stored in the count cells of a target memory cell row among the plurality of memory cell rows is read, the read count data is updated, and the updated count data is stored in the count cells of the target memory cell row. a row hammer management circuit that performs an internal read-modify-write operation to rewrite to; and
A semiconductor memory device comprising a control logic circuit that performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit. According to clause 15,
The row hammer management circuit activates the precharge signal at a third time after the second time,
The control logic circuit precharges the target memory cell row in response to the precharge signal. According to clause 16,
The time interval between the third time point and the second time point corresponds to a section in which the row hammer management circuit performs the internal read-modify-write operation. According to clause 16,
An active count update activation signal that generates internal command signals that control the operation of the row hammer management circuit based on the precharge command and activates the row hammer management circuit based on the frequency of the clock signal received from the memory controller. It further includes a timing control circuit that adaptively adjusts the number of the clock signals corresponding to the activation period of,
The semiconductor memory device, wherein the first command is a write command instructing a write operation on the target memory cell row or a read command instructing a read operation on the target memory cell row. According to clause 18,
The timing control circuit is
a latency controller that generates a delay control signal based on frequency information of the clock signal received from the memory controller;
An internal command signal that generates a write signal, a read signal, and a precharge signal that control the operation of the row hammer management circuit based on the precharge command, and controls the activation point of the precharge signal based on the delay control signal. generator; and
An active count that generates an active count update signal that activates the row hammer management circuit based on the read signal and the precharge signal, and controls a deactivation point of the active count update activation signal based on activation of the precharge signal. A semiconductor memory device comprising an update activation signal generator. semiconductor memory devices; and
Including a memory controller that controls the semiconductor memory device,
The semiconductor memory device is
A memory cell array comprising a plurality of memory cell rows each having a plurality of memory cells;
Counting the number of activations of each of the plurality of memory cell rows based on an active command from the memory controller and storing the counting values as count data in count cells of each of the plurality of memory cell rows,
The plurality of memory cell rows based on a precharge command applied at a second time after the first command that is applied after the active command received at a first time and instructing a memory operation for the target memory cell row. Internal read-modification for reading the count data stored in the count cells of a target memory cell row, updating the read count data, and rewriting the updated count data to the count cells of the target memory cell row. -low hammer management circuit that performs the writing operation; and
A memory system comprising a control logic circuit that performs the memory operation on the target memory cell row based on the first command and controls the row hammer management circuit.