Memory devices and methods for controlling row hammer

Memory devices and methods for controlling a row hammer are provided. The memory device includes a memory cell array including a word line and a plurality of counter memory cells storing an access count value of the word line, and a control logic circuit configured to monitor a row address accessing the word line during a row hammer monitoring time frame and to determine the row address to be a row hammer address when the number of times the word line is accessed is greater than or equal to a threshold value, wherein the row hammer address is to be stored in an address storage. The control logic circuit is further configured to hold up a determination operation for a next row hammer address, based on activation of a latch full signal indicating that there is no free space to store the row hammer address in the address storage.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based on and claims priority under 35 U.S.C. § 119 to Korean Patent Application No. 10-2021-0175213, filed on Dec. 8, 2021, and Korean Patent Application No. 10-2022-0016430, filed on Feb. 8, 2022, in the Korean Intellectual Property Office, the disclosures of which are incorporated by reference herein in their entireties.

BACKGROUND

The present disclosure relates to semiconductor memory devices, and more particularly, to a memory device that is configured to control a row hammer such that row hammer address information is not evicted, or deleted, by holding up a next row hammer address determining operation until a row hammer address is target-refreshed, and a method of operating the memory device.

A system including semiconductor chips widely uses dynamic random access memory (DRAM) as main memory or working memory of the system to store data or instructions used by a host of the system and/or to perform a computational operation. In general, DRAM writes data or reads written data under control by a host. When a computational operation is performed, a host retrieves instructions and/or data from DRAM, executes the instructions, and/or uses the data to perform the computational operation. When there is a result of the computational operation, the host writes back the result of the computational operation to the DRAM. Accordingly, a host may request reliability, availability, and serviceability (RAS) functions of DRAM chips.

DRAM cell sizes are sometimes reduced to increase DRAM capacity and density. Some DRAM-based system sometimes experience an intermittent failure due to a heavy workload. The failure is traced by repeated accesses to a single memory row, that is, a row hammer. The repetitive accesses to a certain row may cause an increased rate of decay of adjacent rows (for example, victim rows) due to electromagnetic coupling between rows. Also, memory cells connected to the victim rows may be disturbed, and thus, data corruption, such as flip of memory cell data, may occur.

In order to control a row hammer, DRAM may monitor an intensively accessed row hammer address for a preset time. DRAM may store row hammer addresses in a register of an address storage, generate hammer refresh addresses indicating addresses of memory cell rows physically adjacent to memory cell rows corresponding to row hammer addresses, and target-refresh memory cells connected to the victim memory cell row corresponding to the hammer refresh address.

However, in general, DRAM may use limited registers (or latches) to control row hammers, and the number of row hammer addresses may be determined by the number of times of performing historical access for a certain time and furthermore may be determined by the number of registers storing the number of access times. As row hammer addresses are newly stored in registers, the row hammer addresses previously stored in the registers may be evicted or deleted, and thus, the monitored row hammer address may be missed. Victim rows adjacent to the missed row hammer address may be attenuated faster than the timing of an auto-refresh operation, thereby being vulnerable to row hammer.

Accordingly, in order to satisfy RAS expectation, there is a need for a memory device and an operating method thereof to control row hammer information not to be evicted or deleted until a memory cell row related to the row hammer information is target-refreshed.

SUMMARY

The present disclosure provides a memory device for controlling row hammer such that row hammer address information is not evicted or deleted by holding up a next row hammer address determination operation until a row hammer address is target-refreshed, and a method of operating the memory device.

According to an embodiment, a memory device comprises a memory cell array comprising a word line and a plurality of counter memory cells configured to store an access count value of the word line, and a control logic circuit configured to: monitor a row address accessing the word line during a row hammer monitoring time frame; determine the row address to be a row hammer address when the number of times the word line is accessed is greater than or equal to a threshold value, wherein the row hammer address is to be stored in an address storage. The control logic circuit is configured to hold up a determination operation for a next row hammer address, based on activation of a latch full signal indicating that there is no free space to store the row hammer address in the address storage.

According to another embodiment, a control logic circuit comprises a counter configured to: count a number of times a word line is accessed by a row address during a row hammer monitoring time frame; read an access count value of the word line from a plurality of counter memory cells connected to the word line accessed by the row address; increment the read access count value; and output an output value of the counter as the number of times the word line is accessed by the row address; a comparator configured to compare an output value of the counter with a threshold value to determine whether the row address is a row hammer address; and a latch circuit configured to store the row hammer address in an address storage based on a determination of the comparator, and configured to activate a latch full signal indicating that there is no free space to store the row hammer address in the address storage, wherein the output value of the counter related to a number of times accessing by a next row address is not provided to the comparator, in response to the activated latch full signal.

According to another embodiment, a method of operating a memory device comprising a plurality of memory cell rows comprises: monitoring a row address for accessing a word line during a row hammer monitoring time frame; determining the row address to be a row hammer address when the number of times accessing the word line is greater than or equal to a threshold value; storing the row hammer address in an address storage; activating a latch full signal indicating that there is no free space to store the row hammer address in the address storage; and holding up a determination operation for a next row hammer address based on the activating of the latch full signal.

DETAILED DESCRIPTION OF THE EMBODIMENTS

FIG.1is a block diagram illustrating a system including a memory device for controlling a row hammer, according to an example embodiment of the present disclosure.

Referring toFIG.1, a system100may include a host device110and a memory device120. The host device110may be communicatively connected to the memory device120through a memory bus130.

The host device110may include, for example, a computing system, such as a computer, a notebook computer, a server, a workstation, a portable communication terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a smartphone, and/or a wearable device. Alternatively, the host device110may include some of components included in a computing system, such as a graphics card.

The host device110may serve as a functional block that performs a general computer operation of the system100and may include a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), and/or an application processor (AP). The host device110may include a memory controller112that controls data transmission and data reception to and from the memory device120.

The memory controller112may access the memory device120according to a memory request from the host device110. The memory controller112may include a memory physical layer interface (PHY) for interfacing with the memory device120, such as selecting a row and a column corresponding to a memory location, writing data to a memory location, or reading written data. The memory PHY may include a physical or electrical layer and a logical layer provided for signals, frequency, timing, driving, detailed operating parameters, and functionality required for efficient communication between the memory controller112and the memory device120. The memory PHY may support features of a double data rate (DDR) protocol and/or a low-power double data rate (LPDDR) protocol of the joint electron device engineering council (JEDEC) standard.

The memory controller112may be connected to the memory device120through the memory bus130. For the sake of brief drawing, each of a clock signal CK, a command/address CA, a chip select signal CS, and data DQ is illustrated to be transmitted through one signal line of the memory bus130between the memory controller112and the memory device120but may be transmitted through a plurality of signal lines or buses. Signal lines between the memory controller112and the memory device120may be connected through connectors. The connectors may be implemented by pins, balls, signal lines, and/or other hardware components.

The clock signal CK may be transmitted from the memory controller112to the memory device120through a clock signal line of the memory bus130. The command/address CA may be transmitted from the memory controller112to the memory device120through a command/address bus of the memory bus130. A chip select signal CS may be transmitted from the memory controller112to the memory device120through a chip select line of the memory bus130. For example, when the chip select signal CS is activated to a logic high level, a signal transmitted through the command/address bus may indicate a command. The data DQ may be transmitted from the memory controller112to the memory device120or from the memory device120to the memory controller112through a data bus, which may be composed of bidirectional signal lines, of the memory bus130.

The memory device120may write the data DQ or read the data DQ and perform a refresh operation under control by the memory controller112. For example, the memory device120may include a DDR synchronous dynamic random access memory (SDRAM) device. However, the scope of the present disclosure is not limited thereto, and the memory device120may include any one of volatile memory devices, such as an LPDDR SDRAM, a wide input/output (I/O) DRAM, a high bandwidth memory (HBM), and a hybrid memory cube (HMC). The memory device120may include a memory cell array200and a row hammer control circuit210.

The memory cell array200may include a plurality of word lines, a plurality of bit lines, and a plurality of memory cells formed at intersections of the plurality of word lines and the plurality of bit lines. The plurality of memory cells in the memory cell array200may include volatile memory cells, for example, DRAM cells.

The memory cell array200may include counter memory cells202connected to the plurality of word lines. The counter memory cells202may store the number of times the corresponding word line is accessed. The row hammer control circuit210may monitor a row address that accesses a word line during a row hammer monitoring time frame and may determine the row address to be a row hammer address and store the row address in an address storage when the number of times the word line is accessed is greater than or equal to a threshold value. The row hammer control circuit210may hold up a determination operation for the next row hammer address based on activation of a latch full signal indicating that there is no free space to store the row hammer address in the address storage. As used herein, the term “hold” or “hold up” may mean, without limitation, to “block at least temporarily” or “pause at least temporarily” the determination operation for the next row hammer address based on the activation of the latch full signal. Accordingly, the memory device120may provide an increased RAS function by preventing the row hammer address stored in the address storage from being evicted or deleted until normally refreshed and/or target-refreshed, and preventing a row hammer attack from being easily performed.

FIGS.2and3are block diagrams illustrating a memory devices according to an embodiment of the present disclosure.FIG.2illustrates the memory device120ofFIG.1implemented as DRAM, andFIG.3illustrates a portion of the memory cell array200ofFIG.2.FIG.4is a diagram illustrating a refresh operation of the memory device ofFIG.2. It may be noted that a configuration of the DRAM illustrated inFIG.2is an example and is not a configuration of actual DRAM. In addition, the present disclosure is not limited by the example of the configuration of the DRAM illustrated inFIG.2.

Referring toFIGS.1and2, the memory device120may include a memory cell array200, a row decoder204, a column decoder206, an input/output gating circuit208, a control logic circuit220, an address buffer230, a refresh control circuit240, and an input/output (I/O) circuit250. Although not illustrated inFIG.2, the memory device120may further include a clock buffer, a mode register set (MRS), a bank control logic, a voltage generation circuit, and so on.

The address buffer230may receive an address ADDR including a bank address, a row address ROW_ADDR, and a column address COL_ADDR from the memory controller112. The address buffer230may provide the received bank address to the bank control logic, the received row address ROW_ADDR to the row decoder204, and the received column address COL_ADDR to the column decoder206.

The memory cell array200may include a plurality of memory cells arranged in rows and columns in a matrix. The memory cell array200may include a plurality of word lines WL and a plurality of bit lines BL connected to the plurality of memory cells. The plurality of word lines WL may be connected to rows of the plurality of memory cells, and the plurality of bit lines BL may be connected to columns of the plurality of memory cells. Data of memory cells connected to an activated word line WL may be sensed and amplified by sense amplifiers connected to the plurality of bit lines BL.

The memory cell array200may include first to fourth banks BANK1to BANK4. The bank control logic may generate bank control signals in response to a bank address, and in response to the bank control signals, the row decoder204and the column decoder206of a bank corresponding to the bank address among the first to fourth banks BANK1to BANK4may be activated. Although the present embodiment illustrates an example of the memory device120including four banks, the memory device120may include any number of banks depending on embodiments.

The row decoder204and the column decoder206may be arranged to correspond to each of the first to fourth banks BANK1to BANK4, and the row decoder204and the column decoder206connected to the bank corresponding to the bank address may be activated. The row decoder204may decode the row address ROW_ADDR received from the address buffer230to select a word line WL corresponding to the row address ROW_ADDR from among the plurality of word lines WL and may connect the selected word line WL to a word line driver that activates the plurality of word lines WL.

The column decoder206may select certain bit lines BL from among the plurality of bit lines BL of the memory cell array200. The column decoder206may decode a burst address gradually incremented by +1 based on the column address COL_ADDR in a burst mode to generate a column select signal and may connect the bit lines BL selected by the column select signal to the input/output gating circuit208. Burst addresses refer to addresses of column locations that may be accessed in terms of a burst length BL for a read and/or write command.

The input/output gating circuit208may include read data latches for storing read data of the bit lines BL selected by the column select signal, and a write driver for writing write data into the memory cell array200. The input/output circuit250may include a data input buffer260and a data output buffer270. Read data stored in the read data latches of the input/output gating circuit208may be provided to a data bus through the data output buffer270. Write data may be written to the memory cell array200through the data input buffer260connected to the data bus and through the write driver of the input/output gating circuit208.

The control logic circuit220may receive the clock signal CK and the command CMD and generate control signals for controlling an operation timing and/or a memory operation of the memory device120. The control logic circuit220may provide control signals to circuits of the memory device120to operate as set in operations and control parameters stored by the MRS. The control logic circuit220may read data from and write data to the memory cell array200by using the control signals. Although the control logic circuit220and the address buffer230are illustrated as separate components inFIG.2, the control logic circuit220and the address buffer230may be implemented as one inseparable component. In addition, although the command CMD and the address ADDR are illustrated as separate signals inFIG.2, the address may be regarded as included in the command according to the LPDDR standard or so on.

The first bank BANK1of the first to fourth banks BANK1to BANK4in the memory cell array200is representatively illustrated inFIG.3. Referring toFIG.3, the first bank BANK1may include a plurality of word lines WL1to WLm and a plurality of bit lines BL1to BLn and BLx to BLz. In the first bank BANK1, a plurality of memory cells may be at intersections of the plurality of word lines WL1to WLm and the plurality of bit lines BL1to BLn and BLx to BLz. The plurality of memory cells respectively connected to the plurality of word lines WL1to WLm in the first bank BANK1may be divided into first memory cells201and second memory cells202.

The first memory cells201connected to the plurality of word lines WL1to WLm and the plurality of bit lines BL1to BLn may store data and may be referred to as data cells. The second memory cells202connected to the plurality of word lines WL1to WLm and the plurality of bit lines BLx to BLz may store the number of times corresponding word lines WL1to WLm are accessed and may include first to m-th counter memory cells C31, C32, C33, and C3m. For the sake of convenient description, the first memory cells201may be referred to as data cells, and the second memory cells202may be referred to as counter memory cells.

For example, the first counter memory cells C31connected to the first word line WL1may store the number of access times for activating a memory cell row of the first word line WL1. The second counter memory cells C32connected to the second word line WL2may store the number of access times for activating a memory cell row of the second word line WL2, and the third counter memory cells C33connected to the third word line WL3may store the number of access times for activating a memory cell row of the third word line WL3. Similarly, the m-th counter memory cells C3mmay store the number of access times for activating a memory cell row of the m-th word line WLm.

The first to m-th counter memory cells C31, C32, C33, and C3mmay also be repeated in each of the second to fourth banks BANK2to BANK4of the memory cell array200. The number and positions of the first to m-th counter memory cells C31, C32, C33, and C3mmay be reconfigured according to the greatest number of access times expected by the memory controller112. In some embodiments, 8 to 24 counter memory cells may be provided in each word line. For example, 8, 12, 16, or 24 counter memory cells may be provided in each word line. In another example, more or fewer counter memory cells may be provided therein.

InFIG.2, the control logic circuit220may count the number of times each of the memory cell rows in the memory cell array200is accessed and store the counted number of access times in the counter memory cells202connected to the plurality of word lines. The control logic circuit220may include a row hammer control circuit210that determines when the number of access times is greater than or equal to a threshold value and identifies a memory cell row having the number of access times that is greater than or equal to the threshold value as a row hammer dangerous row.

The row hammer control circuit210may be configured to monitor a row hammer for a memory cell row having the number of access times that are greater than or equal to a threshold value in the memory cell array200and to detect a row hammer of a preset memory cell row. The preset memory cell row refers to a memory cell row having the number of access times that are greater than or equal to a threshold value during a preset time period. As illustrated inFIG.4, the preset time period may be set as a refresh window time tREFw of 32 milliseconds (ms) or 64 ms defined in the JEDEC standard. According to an embodiment, the preset time period may be set as a basic refresh rate time tREFi ofFIG.4. A basic refresh rate may be defined by, for example, the number of refresh commands REFRESH of about 8K within the refresh window of 32 ms. The preset time period may be referred to as a row hammer monitor time frame or a time window set by the memory controller112.

According to an embodiment, the row hammer control circuit210may transmit information on a detected row hammer dangerous row to the memory controller112. The memory controller112may issue a normal refresh command based on the row hammer dangerous row information. The memory controller112may transmit an address of a memory cell row physically adjacent to a row hammer dangerous row to the memory device120together with a refresh command. The memory device120may refresh a memory cell row physically adjacent to a row hammer dangerous row, according to a normal refresh command.

According to an embodiment, the row hammer control circuit210may be configured to target-refresh a memory cell row physically adjacent to a row hammer dangerous row. The row hammer control circuit210may include hardware, firmware, software, and/or a combination thereof for controlling or managing a row hammer. In the following embodiment, the row hammer control circuit210is described to control a row hammer accessed with a threshold value or more during a row hammer monitoring time frame, but embodiments of the present disclosure are not limited thereto. For example, it may be described that the row hammer control circuit210corresponds to a configuration provided in the control logic circuit220, and the control logic circuit220controls a row hammer.

The control logic circuit220may control the refresh control circuit240to perform a normal refresh operation by incrementing a refresh counter value by +1 in response to a refresh command. Also, the control logic circuit220may control the refresh control circuit240to perform a target row refresh operation based on a row hammer address RH_ADDR. The refresh control circuit240may generate a refresh address REF_ADDR corresponding to a memory cell row on which a normal refresh operation and/or a target row refresh operation is to be performed.

FIG.5is a block diagram illustrating a row hammer control circuit according to an embodiment of the present disclosure.

Referring toFIG.5, the row hammer control circuit210may include a counter510, a logic circuit520, a comparator530, a pulse generator540, a latch circuit550, and a row hammer address generator560.

The counter510, the logic circuit520, and the comparator530may operate together to determine whether the number of times accessing a memory cell row associated with the row address ROW_ADDR applied together with an active command ACT is greater than or equal to the threshold value THRESHOLD. When the word line WL corresponding to the row address ROW_ADDR is accessed, an access count value CNT stored in the counter memory cells202connected to the word line WL may be read into the counter510. The access count value CNT stored in the counter memory cells202may be understood as the number of times accessing the word line WL corresponding to the row address ROW_ADDR. The counter510may increment, by +1, the access count value CNT read by considering the currently applied active command ACT. An incremented access count value CNT+1 may be stored in the counter memory cells202connected to the word line WL. Also, the counter510may output the incremented access count value CNT+1 as an output signal XOUT of the counter510.

In addition, the counter510may reset the output signal XOUT of the counter510to zero, in response to a reset RST signal. A reset RST signal line of the counter510may be connected to an output CO signal line of the comparator530. The comparator530may output an output signal of a logic high level when the incremented access count value CNT+1 that is output from the counter510and transmitted through the logic circuit520is greater than or equal to the threshold value THRESHOLD. As an output CO signal of a logic high level of the comparator530is provided as a reset RST signal of the counter510, the output signal XOUT of the counter510may be reset to a zero value.

The logic circuit520may include a first input L1to which the output signal XOUT of the counter510is input, a second input L2to which a latch full signal LFULL of the latch circuit550is input, and an output LO. The logic circuit520may include an AND gate. The logic circuit520may output the output signal XOUT of the counter510input to the first input L1as an output signal thereof when the latch full signal LFULL input to the second input L2is at a logic low level. The logic circuit520may output an output LO signal of a logic low level when the latch full signal LFULL input to the second input L2is at a logic high level. The latch full signal LFULL may be provided by the latch circuit550, and as the row hammer address is stored in an address storage included in the latch circuit550resulting in no free space in the address storage, the latch full signal LFULL may be provided at a logic high level. The logic circuit520may block the output signal XOUT of the counter510from being provided to the comparator530in response to the latch full signal LFULL of a logic high level.

The comparator530may include a first input C1to which the threshold value THRESHOLD is input, a second input C2to which an output LO of the logic circuit520is input, and an output CO. The threshold value THRESHOLD may be set by the memory controller112as a row hammer determination reference and provided by the MRS. The comparator530may compare an output LO signal of the logic circuit520input to the second input C2with the threshold value THRESHOLD input to the first input C1. When the output signal XOUT with the incremented access count value CNT+1 output from the counter510is input to the second input C2, the comparator530may compare the incremented access count value CNT+1 with the threshold value THRESHOLD.

The pulse generator540may include an input PIN to which the output signal of the comparator530is input, and an output POUT. The pulse generator540may selectively output an output signal with a pulse shape according to a logic level of the output signal of the comparator530. For example, the pulse generator540may output the output signal with a pulse shape when the output signal of the comparator530is at a logic high level. When the output signal of the comparator530is at a logic low level, the output signal of the pulse generator540may be output at a logic low level.

For example, when the incremented access count value CNT+1 is less than the threshold value THRESHOLD as a result of comparing the threshold value THRESHOLD input to the first input C1with the incremented access count value CNT+1 input to the second input C2, the comparator530may output an output signal of a logic low level. The output signal of a logic low level of the comparator530may be provided to the pulse generator540and the counter510. The pulse generator540may output an output POUT signal of a logic low level in response to the output signal of a logic low level of the comparator530. In addition, the output CO signal of a logic low level of the comparator530may be provided as the reset RST signal of the counter510and act as an inactive signal for a reset operation of the counter510. Accordingly, the counter510may continuously perform a count operation without being reset by the reset RST signal of a logic low level. The counter510may read the access counter value CNT associated with the next active command ACT and the next row address ROW_ADDR from the counter memory cells202, increment the read access count value CNT by +1, store the incremented access count value CNT+1 in the counter memory cells202connected to the word line WL corresponding to the next row address ROW_ADDR, and provide the incremented access count value CNT+1 to the logic circuit520as the output signal XOUT.

For example, when the incremented access count value CNT+1 is greater than or equal to the threshold value THRESHOLD as a result of comparing the threshold value THRESHOLD input to the first input C1with the incremented access count value CNT+1 input to the second input C2by using the comparator530, the comparator530may output the output CO signal of a logic high level. The output CO signal may be provided to the pulse generator540and the counter510. The pulse generator540may output an output POUT signal having a pulse shape, in response to the output CO signal of a logic high level of the comparator530. In addition, the output CO signal of a logic high level of the comparator530may be provided as the reset RST signal of the counter510and act as an activation signal for a reset operation of the counter510to reset the output signal XOUT of the counter510to a zero value.

The latch circuit550and the row hammer address generator560store the row address ROW_ADDR with the number of access times that are greater than or equal to the threshold value THRESHOLD and may operate together to perform a normal refresh operation and/or a target row refresh operation of the stored row address ROW_ADDR as the row hammer address RH_ADDR. The latch circuit550may store the row address ROW_ADDR in an address storage and activate the latch full signal LFULL to a logic high level when there is no free space in the address storage. The latch full signal LFULL may be deactivated to a logic low level when the row address ROW_ADDR stored in the address storage is transmitted to the row hammer address generator560in response to the refresh signal REFRESH. The row hammer address generator560may provide the received row address ROW_ADDR to the refresh control circuit240(FIG.2) as the row hammer address RH_ADDR to perform a normal refresh operation and/or a target row refresh operation.

The latch circuit550may include a first input EN to which the output POUT signal of the pulse generator540is input, a second input LIN to which the row address ROW_ADDR is input, and an output LOUT, and may output the latch full signal LFULL indicating that an address storage in the latch circuit550is full. The latch circuit550may be enabled when the output POUT signal of the pulse generator540applied to the first input EN has a pulse shape. When the output POUT signal of the pulse generator540is applied at a logic low level, the latch circuit550is disabled.

When the output POUT signal of the pulse generator540is applied to the first input EN, the latch circuit550stores the row address ROW_ADDR input to the second input LIN in an address storage. The output POUT signal having a pulse shape output from the pulse generator540indicates that the number of times accessing by the row address ROW_ADDR corresponding to the active command ACT is greater than or equal to the threshold value THRESHOLD, which means that the row address ROW_ADDR corresponds to a row hammer address.

The latch circuit550may store the row address ROW_ADDR in a latch of an address storage, in response to the output POUT signal having a pulse shape output from the pulse generator540, and output, at a logic high level, the latch full signal LFULL indicating that the address storage is full. The latch full signal LFULL of a logic high level may be provided to the logic circuit520to block the output signal XOUT of the counter510from being provided to the comparator530. In the present embodiment, the address storage of the latch circuit550is described as including one latch. In some embodiments, the address storage of the latch circuit550may be configured to include two or more latches.

The latch circuit550may output the row address ROW_ADDR stored in the address storage as an output LOUT signal. The output LOUT signal of the latch circuit550may be provided to the row hammer address generator560. The row hammer address generator560may include a first input EN to which the refresh signal REFRESH is input, a second input D to which the output LOUT signal of the latch circuit550is input, and an output O. The row hammer address generator560is enabled when the refresh signal REFRESH is applied to the first input EN and may output, as an output O signal, the row address ROW_ADDR which corresponds to the output LOUT signal of the latch circuit550and is stored in the address storage. The row hammer address generator560may output the row address ROW_ADDR stored in the address storage as a row hammer address RH_ADDR in response to the refresh signal REFRESH.

The row hammer address RH_ADDR may be provided to the refresh control circuit240, and the refresh control circuit240may generate the refresh address REF_ADDR based on the row hammer address RH_ADDR. The refresh address REF_ADDR may refer to a memory cell row for performing a normal refresh operation and/or a target row refresh operation.

FIG.6is a diagram illustrating a row hammer control operation according to an embodiment of the present disclosure.

Referring toFIGS.2,5, and6, the row address ROW_ADDR may be applied to the memory device120together with the active command ACT at time T1. For the sake of convenience of description, the active command ACT applied together with the row address ROW_ADDR of 300 h at the time T1is referred to as a first active command ACT1, the active command ACT applied together with the row address ROW_ADDR of 300 h at time T3is referred to as a second active command ACT2, and the active command ACT applied together with the row address ROW_ADDR of 200 h at time T6is referred to as a third active command ACT3. In addition, it is assumed that the threshold value THRESHOLD applied to the first input C1of the comparator530is set to 200 h, that is,512.

From the time T1to time T2, the row address ROW_ADDR of 300 h may be applied together with the first active command ACT1. The counter510may read the access count value CNT stored in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 300 h of the memory cell array200and may provide a value, for example, 1FFh, which is an output value XOUT of the counter510obtained by incrementing the read access count value CNT by +1, that is,511to the second input C2of the comparator530. In addition, the counter510may store 1FFh, which is the output value XOUT of the counter510, that is,511in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 300 h. The comparator530may compare the threshold value THRESHOLD of 200 h input to the first input C1, that is,512with 1FFh, which is the output value XOUT of the counter510input to the second input C2, that is511, and may output the output CO signal of a logic low level. Accordingly, the pulse generator540may output the output POUT signal of a logic low level, and the latch circuit550may output the latch full signal LFULL of a logic low level.

From the time T3to time T5, the row address ROW_ADDR of 300 h may be applied together with the second active command ACT2. At the time T3, the counter510may read the access count value CNT, which is stored in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 300 h of the memory cell array200, for example, 1FFh, that is511and may provide the second input C2of the comparator530with 200 h, which is the output value XOUT of the counter510, obtained by incrementing the read access count value CNT by +1, that is,512. In addition, the counter510may store 200 h, which is the output value XOUT of the counter510, that is512, in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 300 h. The comparator530may compare the threshold value THRESHOLD of 200 h input to the first input C1, that is,512with 200 h, which is the output value XOUT of the counter510input to the second input C2, that is512, and may output the output CO signal of a logic high level.

At time T4, the output value XOUT of the counter510may be reset to 0 h in response to the output CO signal of a logic high level of the comparator530. The counter510may store 0 h which is the output value XOUT of the counter510, that is zero, in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 300 h. Accordingly, the second input C2of the comparator530may be output as 0 h, which is the output value XOUT of the counter510, that is zero. The comparator530may compare the threshold value THRESHOLD of 200 h input to the first input C1, that is,512with 0 h, which is the output value XOUT of the counter510input to the second input C2, that is zero, and may output the output CO signal of a logic low level.

Between the time T3and the time T4, the output CO signal of the comparator530may be output at a logic high level. The pulse generator540may output the output POUT signal having a pulse shape, in response to an output CO signal of a logic high level output from of the comparator530.

At the time T4, the latch circuit550may store the row address ROW_ADDR corresponding to the second active command ACT2in an address storage in response to the output POUT signal having a pulse shape output from the pulse generator540. The latch circuit550may store the row address ROW_ADDR of 300 h in a latch of an address storage and output, at a logic high level, the latch full signal LFULL indicating that the address storage is full. The latch full signal LFULL of a logic high level may be provided to the logic circuit520to block the output value XOUT of the counter510from being provided to the comparator530. Also, the latch circuit550may output, as the output LOUT signal, the row address ROW_ADDR of 300 h stored in the address storage. An output LOUT signal 300 h of the latch circuit550may be provided to the row hammer address generator560. The row hammer address generator560may output the output LOUT signal 300 h of the latch circuit550as the row hammer address RH ADDR, in response to the refresh signal REFRESH. The row hammer address RH_ADDR of 300 h may be provided to the refresh control circuit240(seeFIG.2), and the refresh address REF_ADDR may be generated based on the row hammer address RH_ADDR of 300 h.

At the time T6, the row address ROW_ADDR of 200 h may be applied together with the third active command ACT3. The counter510may read the access count value CNT stored in the counter memory cells202connected to the word line WL corresponding to the row address ROW_ADDR of 200 h of the memory cell array200and may output a value, for example 200h, which is the output value XOUT of the counter510, obtained by incrementing the read access count value CNT by +1, that is512. 200 h, which is the output value XOUT of the counter510with respect to the row address ROW_ADDR of 200 h, that is512, is greater than or equal to the threshold value THRESHOLD of 200 h, that is512, and thus, the row address ROW_ADDR may correspond to a row hammer address.

However, 200 h, which is the output value XOUT of the counter510, that is,512, is not provided to the comparator530by the latch full signal LFULL of a logic high level provided to the logic circuit520. This means that the next row hammer determination operation is held until the row hammer address RH_ADDR of 300 h is normally refreshed and/or target-row-refreshed by the refresh control circuit240. Accordingly, the row hammer address RH_ADDR of 300 h is not evicted or deleted by the row address ROW_ADDR of 200 h to be determined as the next row hammer address. The row address ROW_ADDR of 200 h may be determined as the row hammer address RH_ADDR after a normal refresh operation and/or a target row refresh operation for the row hammer address RH_ADDR of 300 h.

FIG.7is a flowchart illustrating an operation of a control logic circuit, according to an embodiment of the present disclosure.

Referring toFIG.7in conjunction withFIGS.1to6, the system100may perform initialization in operation S710. When the system100is powered up, the memory controller112and the memory device120may perform an initial setting operation according to a preset method. Default operation parameters may be set in initialization of the memory device120. For example, the threshold value THRESHOLD, which is a row hammer determination reference, may be set, and a row hammer monitor time frame tREFi may be set. Also, an address storage in the latch circuit550of the row hammer control circuit210may be reset to an empty latch state.

In operation S720, the control logic circuit220may perform an operation of monitoring a row hammer. The control logic circuit220may monitor a row address that accesses a word line.

In operation S730, the control logic circuit220may perform a counter-based latch hold operation on the row hammer monitored in operation S720. In operation S730, when the number of times accessing the word line is greater than or equal to a threshold value, the control logic circuit220may determine the row address to be a row hammer address and store the row address in the address storage. The control logic circuit220may hold up a determination operation for the next row hammer address, based on activation of the latch full signal LFULL indicating that there is no free space to store the row hammer address in the address storage. Operation S730will be described in detail with reference toFIG.8.

In operation S740, the control logic circuit220may determine whether the row hammer monitoring time frame tREFi elapses. When the row hammer monitoring time frame tREFi has not elapsed (NO), the processing may proceed back to operation S720. The control logic circuit220may perform a counter-based latch hold operation for the row hammer address RH_ADDR to be obtained in operation S730. Otherwise, when the row hammer monitor time frame tREFi has elapsed (YES), the processing may proceed to operation S750.

In operation S750, the control logic circuit220may perform a normal refresh and/or a target row refresh operation for the row hammer address RH_ADDR obtained in operation S730. After the control logic circuit220performs a normal refresh and/or a target row refresh operation for the row hammer address RH_ADDR, the processing may proceed back to operation S710. In operation S710, the control logic circuit220may reset, to an empty latch state, the address storage of the latch circuit550storing the row address ROW_ADDR corresponding to the row hammer address RH_ADDR by which the normal refresh operation and/or the target row refresh operation has been performed. Accordingly, the control logic circuit220may monitor the next row hammer address RH_ADDR and store the monitored row hammer address RH_ADDR in an empty latch of the address storage.

FIG.8is a flowchart illustrating an operation of a control logic circuit, according to an embodiment of the present disclosure.FIG.8is a flowchart specifically illustrating a counter-based latch hold operation (operation S730) for the monitored row hammer described with reference toFIG.7.

Referring toFIG.8in conjunction withFIGS.1to7, in operation S810, the control logic circuit220may receive the row address ROW_ADDR together with the active command ACT. The row address ROW_ADDR is configured to access the word line WL corresponding to the row address ROW_ADDR, and thus, the row address ROW_ADDR may be referred to as a word line WL address for the sake of convenience of description.

In operation S820, the control logic circuit220may read the access count value CNT stored in the counter memory cells202connected to the word line WL into the counter510.

In operation S830, the control logic circuit220may increment the access count value CNT read in operation S820by +1 and output the incremented access count value CNT as the access count value of the word line WL, that is, the output value XOUT of the counter510.

In operation S840, the control logic circuit220may determine whether the output value XOUT of the counter510, obtained in operation S830, is greater than or equal to the threshold value THRESHOLD. As a result of the determination, when the output value XOUT of the counter510is greater than or equal to the threshold value THRESHOLD (YES), the control logic circuit220may proceed to operation S850, and when the output value XOUT of the counter510is less than the threshold value THRESHOLD (NO), the control logic circuit220may proceed to operation S880. In operation S880, the control logic circuit220may store the output value XOUT of the counter510obtained in operation S830in the counter memory cells202connected to the word line WL as the access count value of the word line WL.

In operation S850, the control logic circuit220may determine whether there is an empty latch in an address storage in the latch circuit550of the row hammer control circuit210. As a result of the determination, when there is an empty latch in the address storage, the control logic circuit220may proceed to operation S860, and when there is no empty latch in the address storage, the control logic circuit220may proceed to operation S880. In operation S880, the control logic circuit220may store the output value XOUT of the counter510obtained in operation S830in the counter memory cells202connected to the word line WL as the access count value of the word line WL.

In operation S860, the control logic circuit220may store the word line WL address having an access count value greater than or equal to the threshold value THRESHOLD in a latch of the address storage of the latch circuit550. The latch circuit550may store the word line WL address in the latch of the address storage and activate the latch full signal LFULL indicating that the address storage is full to a logic high level.

In operation S870, the control logic circuit220may reset the output value XOUT of the counter510to zero, based on the latch full signal LFULL of a logic high level. In operation S880, the control logic circuit220may store the output value XOUT of zero of the counter510, obtained in operation S870, in the counter memory cells202connected to the word line WL as the access count value CNT of the word line WL.

After operation S880is performed, the control logic circuit220may proceed to operation S740ofFIG.7to determine whether the row hammer monitor time frame tREFi has elapsed and perform a normal refresh operation and/or a target row refresh operation for the row hammer address RH_ADDR in operation S750.

FIG.9is a view illustrating a memory device for controlling a row hammer according to an example embodiment of the present disclosure.FIG.9illustrates the memory device120ofFIG.1implemented in HBM. It may be noted that an HBM configuration illustrated inFIG.9is provided as an example and is not an actual HBM configuration. In addition, the present disclosure is not limited by an example of the HBM configuration illustrated inFIG.9. Hereinafter, subscripts (for example, a of120a) attached to the same reference numerals in different drawings are used to distinguish a plurality of circuits having similar or identical functions. For the sake of convenient description, a memory device120amay hereinafter referred to as an HBM.

Referring toFIGS.1and9, the HBM120amay be connected to the host device110through an HBM protocol of the JEDEC standard. The HBM protocol is a high-performance random access memory (RAM) interface for three-dimensional stacked memories (for example, DRAM). The HBM120agenerally achieves a wider bandwidth while consuming less power in a substantially smaller form factor than other DRAM technologies (for example, DDR4, graphics DDR5 (GDDR5), and so on).

The HBM120amay have a high bandwidth by including multiple channels CH1to CH8having interfaces independent of each other. The HBM120amay include a plurality of dies, for example, a logic die910(or a buffer die) and one or more core dies920stacked on the logic die910.FIG.9illustrates an example in which first to fourth core dies921to924are provided in the HBM120a, but the number of core dies920may be variously changed. The core dies920may be referred to as memory dies.

Each of the first to fourth core dies921to924may include one or more channels.FIG.9illustrates an example in which each of the first to fourth core dies921to924includes two channels and the HBM120aincludes eight channels CH1to CH8. For example, the first core die921may include a first channel CH1and a third channel CH3, the second core die922may include a second channel CH2and a fourth channel CH4, the third core die923may include a fifth channel CH5and a seventh channel CH7, and the fourth core die924may include a sixth channel CH6and an eighth channel CH8.

The logic die910may include an interface circuit911configured to communicate with the host device110and may receive command/address and data from the host device110through the interface circuit911. The host device110may transmit the command/address and the data through the memory buses130corresponding to the first channel CH1to the eighth channel CH8, and the memory buses130may be formed to be divided for each channel, or some of the memory buses130may be shared by at least two channels. The interface circuit911may transmit the command/address and the data to channels through which the host device110requests a memory operation or arithmetic processing. In addition, according to an example embodiment of the present disclosure, each of the core dies920or each of the channels may include a processor-in-memory (PIM) circuit.

The host device110may provide the command/address and the data such that at least some of a plurality of arithmetic operations or kernels may be performed by the HBM120a, and a PIM circuit of a channel designated by the host device110may perform arithmetic processing. For example, when the received command and address indicate arithmetic processing, the PIM circuit of a corresponding channel may perform the arithmetic processing by using write data provided from the host device110and/or data read from the corresponding channel. In another example, when the command and address received through a corresponding channel of the HBM120aindicate a memory operation, an access operation on data may be performed.

According to an embodiment, each of the first to eighth channels CH1to CH8may include a plurality of banks, and one or more processing elements may be provided in a PIM circuit in each of the first to eighth channels CH1to CH8. For example, the number of processing elements in each channel may be equal to the number of banks, or one processing element may be shared among at least two banks when the number of processing elements is less than the number of banks. The PIM circuit in each of the first to eighth channels CH1to CH8may perform a kernel offloaded by the host device110.

According to an embodiment, each of the first to eighth channels CH1to CH8may include a row hammer control circuit RHC described with reference toFIGS.1to8(row hammer control circuit210). Each of the first to eighth channels CH1to CH8may include a memory cell array including a word line and a plurality of counter memory cells and a control logic circuit, and the plurality of counter memory cells may store an access count value of the word line. The row hammer control circuit RHC may monitor a row address that accesses a word line during a row hammer monitoring time frame, and when the number of times the word line is accessed is greater than or equal to a threshold value, the row hammer control circuit (RHC) may determine the row address to be a row hammer address and store the row address in an address storage. The row hammer control circuit RHC may hold up a determination operation for the next row hammer address, based on activation of a latch full signal indicating that there is no free space to store the row hammer address in the address storage. Accordingly, each of the first to eighth channels CH1to CH8may prevent the row hammer address stored in the address storage from being evicted or deleted until normally refreshed and/or target-refreshed, and thus, a RAS function may be increased.

In addition, the logic die910may further include a through silicon via (TSV) region912, an HBM physical layer interface (HBM PHY) region913, and a serializer/deserializer (SERDES) region914. The TSV region912is a region in which a TSV for communication with the core dies920is formed and is a region in which the memory buses130corresponding to the first to eighth channels CH1to CH8are formed. When each of the first to eighth channels CH1to CH8has a bandwidth of 128 bits, the TSVs may include configurations for data input/output of 1024 bits.

The HBM PHY region913may include a plurality of input/output circuits for communication with the memory controller112and the first to eighth channels CH1to CH8, and for example, the HBM PHY region913may include one or more interconnect circuits for connecting the first to eighth channels CH1to CH8to the memory controller112. The HBM PHY region913may include a physical or electrical layer and a logical layer provided for signals, frequencies, timing, driving, detailed operating parameters, and functionality required for efficient communication between the memory controller112and the first to eighth channels CH1to CH8. The HBM PHY region913may perform memory interfacing such as selecting a row and a column corresponding to a memory cell for a corresponding channel, writing data into the memory cell, or reading the written data from the memory cell. The HBM PHY region913may support features of an HBM protocol of a JEDEC standard.

The SERDES region914is a region for providing a SERDES interface of the JEDEC standard as processing throughput of a processor of the host device110increases and as requirements for a memory bandwidth increase. The SERDES region914may include a SERDES transmitter, a SERDES receiver, and a controller. The SERDES transmitter may include a parallel-to-serial circuit and a transmitter. The SERDES transmitter may receive a parallel data stream and serialize the received parallel data stream. The SERDES receiver may include a reception amplifier, an equalizer, a clock and data recovery circuit, and a serial-to-parallel circuit. The SERDES receiver may receive a serial data stream and parallelize the received serial data stream. The controller may include an error detection circuit, an error correction circuit, and registers such as first in first out (FIFO).

FIG.10is a block diagram illustrating a system including a memory device for controlling a row hammer, according to embodiments of the present disclosure.

Referring toFIG.10, a system1000may include a camera1100, a display1200, an audio processor1300, a modem1400, DRAMs1500aand1500b, flash memory devices1600aand1600b, I/O devices1700aand1700b, and an Application Processor (AP)1800. The system1000may be implemented as a laptop computer, a mobile phone, a smartphone, a tablet personal computer (PC), a wearable device, a healthcare device, and/or an internet of things (IOT) device. In addition, the system1000may be implemented as a server or a PC.

The camera1100may capture a still image or a moving image according to a user's control and may store the captured images or image data therein or transmit the captured images or image data to the display1200. The audio processor1300may process audio data included in content of flash memory1620of the flash memory devices1600aand1600bor a network. The modem1400may modulate a signal and transmit the modulated signal through wired/wireless communication, and a receiver may receive and demodulate the modulated signal to obtain an original signal. The I/O devices1700aand1700bmay include devices having a digital input function and/or a digital output function, such as a Universal Serial Bus (USB) or storage, a digital camera, a secure digital (SD) card, a digital versatile disc (DVD), a network adapter, and/or a touch screen.

The AP1800may entirely control an operation of the system1000, such as through a controller1810. The AP1800may control the display1200such that some of content stored in the flash memory1620of the flash memory devices1600aand1600bis displayed on the display1200. When a user input is received through the I/O devices1700aand1700b, the AP1800may perform a control operation corresponding to the user input. The AP1800may include an accelerator block, which is a dedicated circuit for artificial intelligence (AI) data arithmetic, or may include an accelerator1820separate from the AP1800. The DRAM1500bmay be additionally mounted in the accelerator block or the accelerator1820. The accelerator1820may include a function block that professionally performs a certain function of the AP1800, and the accelerator1820may include a GPU that is a function block for professionally processing graphics data, a neural processing unit (NPU) that is a block for professionally performing AI calculation and inference, and a data processing unit (DPU) that is a block for professionally transmitting data.

The system1000may include the plurality of DRAMs1500aand1500b. The AP1800may include an interface1830and may control the DRAMs1500aand1500bthrough command and mode register (MRS) settings conforming to the JEDEC standard or may set a DRAM interface protocol for communication in order to use company-specific functions such as a low voltage, a high speed, reliability, and a cyclic redundancy Check (CRC)/error correction code (ECC) function. For example, the AP1800may communicate with the DRAM1500athrough the interface1830, which conforms to the JEDEC standard, such as, LPDDR4 or LPDDR5, and the accelerator block or the accelerator1820may set a new DRAM interface protocol for communication in order to control the DRAM1500bfor the accelerator1820having a higher bandwidth than the DRAM1500a.

Only the DRAMs1500aand1500bare illustrated inFIG.10but are not limited thereto, and any type of memory, such as phase-change random access memory (PRAM), static random access memory (SRAM), magnetic random access memory (MRAM), resistive random access memory (RRAM), ferroelectrics random access memory (FRAM), or Hybrid random access memory may be used when satisfying a bandwidth, a response speed, and a voltage condition of the AP1800or the accelerator1820. The DRAMs1500aand1500bhave relatively less latency and a relatively smaller bandwidth than the I/O devices1700aand1700bor the flash memories1620of the flash memory devices1600aand1600b. The DRAMs1500aand1500bmay be initialized when the system1000is powered on, used as temporary storages for an operating system and application data when the operating system and the application data are loaded, or used as execution spaces for various software code.

The DRAMs1500aand1500bmay perform addition/subtraction/multiplication/division operations, a vector operation, address arithmetic, and/or fast Fourier transform (FFT) arithmetic. In addition, the DRAMs1500aand1500bmay perform a function used for inference. Here, the inference may be performed by a deep learning algorithm using an artificial neural network. The deep learning algorithm may include a training operation of learning a model through various data and an inference operation of recognizing data by using the learned model. In an embodiment, an image captured by a user through the camera1100is signal-processed and stored in the DRAM1500b, and the accelerator block or the accelerator1820may perform AI data arithmetic that recognizes data by using a function used for the data stored in the DRAM1500band the inference.

The system1000may include a plurality of storages or a plurality of flash memories1620in flash memory devices1600aand1600bhaving greater capacity than the capacity of the DRAMs1500aand1500b. The accelerator block or the accelerator1820may perform the training operation and the AI data arithmetic by using the flash memory devices1600aand1600b. In an embodiment, the flash memory devices1600aand1600bmay perform more efficiently the training operation and the inference AI data arithmetic performed by the AP1800and/or the accelerator1820by using a computing device included in a memory controller1610in the flash memory devices1600aand1600b. The flash memory devices1600aand1600bmay store pictures taken by the camera1100or data transmitted through a data network. For example, the flash memory devices1600aand1600bmay store augmented reality/virtual reality, and high definition (HD) or ultrahigh definition (UHD) content.

The DRAMs1500aand1500bin the system1000may include the row hammer control circuit described with reference toFIGS.1to8. The DRAMs1500aand1500bmay each include a memory cell array including a word line and a plurality of counter memory cells and a control logic circuit, and the plurality of counter memory cells may store an access count value of the word line. The DRAMs1500aand1500bmay monitor a row address that accesses a word line during a row hammer monitoring time frame, and when the number of times the word line is accessed is greater than or equal to a threshold value, the row hammer control circuit (RHC) may determine the row address to be a row hammer address and store the row address in an address storage. The DRAMs1500aand1500bmay hold up a determination operation for the next row hammer address, based on activation of a latch full signal indicating that there is no free space to store the row hammer address in the address storage. Accordingly, the DRAMs1500aand1500bmay prevent the row hammer address stored in the address storage from being evicted or deleted until normally refreshed and/or target-refreshed, and thus, a RAS function may be increased.