Patent Description:
A semiconductor memory device may be classified as a volatile memory device or a nonvolatile memory device. A volatile memory device refers to a memory device that loses data stored therein at power-off. As an example of a volatile memory device, a dynamic random access memory (DRAM) may be used in various devices such as a mobile system, a server, or a graphic device.

From <CIT> a semiconductor memory device and a memory system having the same are known. The semiconductor memory device includes a memory cell array including plural memory cell array blocks, and a refresh controller configured to control the memory cell array blocks to perform a normal refresh operation and a hammer refresh operation. The refresh controller controls one or more third memory cell array blocks excluding a first memory cell array block and one or more second memory cell array blocks adjacent to the first memory cell array block to perform the hammer refresh operation while the normal refresh operation is performed on the first memory cell array block among the memory cell array blocks.

In volatile memory devices such as dynamic random access memory (DRAM) devices, cell charges stored in a memory cell may be lost by a leakage current. In addition, when a word-line is transitioned frequently between an active state and a precharged state (i.e., when the word-line has been accessed intensively or frequently), an affected memory cell connected to a word-line that is adjacent to the frequently accessed word-line may lose stored charges. Charges stored in a memory cell may be maintained by recharging before data is lost by leakage of cell charges. Such recharge of cell charges is referred to as a refresh operation, and a refresh operation may be performed repeatedly before cell charges are significantly lost.

According to an embodiment, a semiconductor memory device comprises: a memory cell array including a plurality of memory cell rows, each including a plurality of volatile memory cells, the volatile memory cells being DRAM cells; a row hammer management circuit configured to: capture row addresses accompanied by first active commands randomly selected from active commands, each having a first selection probability that is uniform, from an external memory controller during a reference time interval; and select at least one row address from among the captured row addresses as a hammer address a number of times proportional to access counts of an active command corresponding to the at least one row address during the reference time interval; and a refresh control circuit configured to receive the hammer address, and to perform a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address.

According to an embodiment, there is provided a method of operating a semiconductor memory device including a memory cell array that includes a plurality of memory cell rows, each of which includes a plurality of volatile memory cells, the volatile memory cells being DRAM cells. According to the method, row addresses are captured and the row addresses are accompanied by first active commands randomly selected from active commands, each of which has a first selection probability that is uniform, from an external memory controller during a reference time interval, at least one row address is selected from among the captured row addresses as a hammer address a number of times proportional to access counts of an active command corresponding to the at least one row address during the reference time interval, and a hammer refresh operation is performed on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address. The reference time interval corresponds to a refresh interval of the semiconductor memory device, and the first selection probability corresponds to a ratio of a number of the hammer refresh operation to be performed on the plurality of memory cell rows during a refresh period of the semiconductor memory device to an average access count of the plurality of memory cell rows during the reference time interval.

Features will become apparent to those of skill in the art by describing in detail example embodiments with reference to the attached drawings in which:.

<FIG> is a block diagram illustrating a memory system according to an example embodiment.

Referring to <FIG>, a memory system <NUM> may include a memory controller <NUM> and a semiconductor memory device <NUM>.

The memory controller <NUM> may control overall operation of the memory system <NUM>. The memory controller <NUM> may control overall data exchange between an external host and the semiconductor memory device <NUM>. For example, the memory controller <NUM> may write data in the semiconductor memory device <NUM>, or read data from the semiconductor memory device <NUM> in response to a request from the host.

The memory controller <NUM> may issue operation commands to the semiconductor memory device <NUM> for controlling the semiconductor memory device <NUM>. The semiconductor memory device <NUM> may be a memory device including dynamic memory cells such as a dynamic random access memory (DRAM), double data rate <NUM> (DDR5) synchronous DRAM (SDRAM), or a DDR6 SDRAM.

The memory controller <NUM> may transmit a clock signal CK (the clock signal CK may be referred to a command clock signal), a command CMD, and an address (signal) ADDR to the semiconductor memory device <NUM>. The memory controller <NUM> may exchange a (data) strobe signal DQS with the semiconductor memory device <NUM> when the memory controller <NUM> writes data signal DQ in the semiconductor memory device <NUM> or reads data signal DQ from the semiconductor memory device <NUM>. The address ADDR may be accompanied by the command CMD, and the address ADDR may be referred to as an access address.

The memory controller <NUM> may include a refresh management (RFM) control logic <NUM> that generates an RFM command associated with a row hammer of the plurality of memory cell rows.

The semiconductor memory device <NUM> may include a memory cell array <NUM>, which stores data corresponding to the data signal DQ, a control logic circuit <NUM>, and a row hammer (RH) management circuit <NUM>.

The control logic circuit <NUM> may control operations of the semiconductor memory device <NUM>. The memory cell array <NUM> may include a plurality of memory cell rows, and each of the memory cell rows may include a plurality of volatile memory cells.

The row hammer management circuit <NUM> may capture row addresses accompanied by first active commands randomly selected from active commands, each having a first selection probability that is uniform, from the memory controller <NUM> during a reference time interval, and may select at least one row address from among the captured row addresses as a hammer address a number of times that is proportional to access counts of an active command corresponding to the at least one row address during the reference time interval.

The reference time interval may correspond to a refresh interval between refresh cycles during which the plurality of memory cell rows are refreshed, of the semiconductor memory device <NUM>. The first selection probability may correspond to a ratio of a number of the hammer refresh operation to be performed on the plurality of memory cell rows during a refresh period of the semiconductor memory device <NUM> to an average access count of the plurality of memory cell rows during the reference time interval.

For example, when the average access count of the plurality of memory cell rows during the reference time interval corresponds to K (K is a natural number equal to or greater than three) and the number of the hammer refresh operation to be performed on the plurality of memory cell rows during the refresh period corresponds to L (L is a natural number equal to or greater than two and smaller than L), the first selection probability corresponds to L/K.

The semiconductor memory device <NUM> may perform a refresh operation periodically due to charge leakage of memory cells storing data. Due to scale down of the manufacturing process of the semiconductor memory device <NUM>, a storage capacitance of the memory cell may be decreased, and a refresh period may be shortened. The refresh period may be further shortened because the entire refresh time may be increased as the memory capacity of the semiconductor memory device <NUM> is increased.

To compensate for degradation of adjacent memory cells due to the intensive access to a particular row or a hammer address, a target row refresh (TRR) scheme may be adopted and an in-memory refresh scheme may be adopted to reduce the burden of the memory controller. In an implementation, the memory controller is totally responsible for the hammer refresh operation in the TRR scheme, and the semiconductor memory device is totally responsible for the hammer refresh operation in the in-memory refresh scheme.

The chip size overhead for the in-memory refresh may become serious as the memory capacity is increased and demands on low power consumption of the semiconductor memory device are increased. In addition, the power consumption may be increased when the semiconductor memory device has to take care of the hammer refresh operation, even when there is no intensive access. In addition, a row hammer of some of memory cell row selected from the plurality of the memory cell rows may be managed.

In the semiconductor memory device <NUM> according to the present example embodiment, the row hammer management circuit <NUM> may generate the hammer address in proportion to an access number (counts) of each of the memory cell rows, and a refresh control circuit (<NUM> in <FIG>) may perform a hammer refresh operation on victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address in proportion to the access number (counts) of each of the memory cell rows. Therefore, row hammer due to non-uniform access patterns may be prevented.

<FIG> is a block diagram illustrating the memory controller in <FIG> according to an example embodiment.

Referring to <FIG>, the memory controller <NUM> may include a central processing unit (CPU) <NUM>, the RFM control logic <NUM>, a refresh logic <NUM>, a host interface <NUM>, a scheduler <NUM>, and a memory interface <NUM>, which are connected to each other through a bus <NUM>.

The CPU <NUM> may control overall operation of the memory controller <NUM>. The CPU <NUM> may control the RFM control logic <NUM>, the refresh logic <NUM>, the host interface <NUM>, the scheduler <NUM>, and the memory interface <NUM>, through the bus <NUM>.

The refresh logic <NUM> may generate an auto refresh command for refreshing memory cells of the plurality of memory cell rows based on a refresh period of the semiconductor memory device <NUM>.

The host interface <NUM> may perform interfacing with a host.

The memory interface <NUM> may perform interfacing with the semiconductor memory device <NUM>.

The scheduler <NUM> may manage scheduling and transmission of sequences of commands generated in the memory controller <NUM>. The scheduler <NUM> may transmit the active command and subsequent commands to the semiconductor memory device <NUM>, via the memory interface <NUM>.

<FIG> is a block diagram illustrating an example of the semiconductor memory device in <FIG> according to an example embodiment.

Referring to <FIG>, the semiconductor memory device <NUM> may include the control logic circuit <NUM>, an address register <NUM>, a bank control logic <NUM>, a refresh control circuit <NUM>, a row address multiplexer <NUM>, a column address latch <NUM>, a row decoder <NUM>, a column decoder <NUM>, the memory cell array <NUM>, a sense amplifier unit <NUM>, an input/output (I/O) gating circuit <NUM>, an error correction code (ECC) engine <NUM>, a clock buffer <NUM>, a strobe signal generator <NUM>, the row hammer management circuit <NUM>, and a data I/O buffer <NUM>.

The memory cell array <NUM> may include first through sixteenth bank arrays 310a~<NUM>. The row decoder <NUM> may include first through sixteenth row decoders 260a~<NUM> respectively coupled to the first through sixteenth bank arrays 310a~<NUM>. The column decoder <NUM> may include first through sixteenth column decoders 270a~<NUM> respectively coupled to the first through sixteenth bank arrays 310a~<NUM>. The sense amplifier unit <NUM> may include first through sixteenth sense amplifiers 285a~<NUM> respectively coupled to the first through sixteenth bank arrays 310a~<NUM>.

The first through sixteenth bank arrays 310a~<NUM>, the first through sixteenth row decoders 260a~<NUM>, the first through sixteenth column decoders 270a~<NUM>, and first through sixteenth sense amplifiers 285a~<NUM> may form first through sixteenth banks. Each of the first through sixteenth bank arrays 310a~<NUM> may include a plurality of memory cells MC at intersections of a plurality of word-lines WL and a plurality of bit-line BTL.

The address register <NUM> may receive the address ADDR including a bank address BANK_ADDR, a row address ROW_ADDR, and a column address COL_ADDR from the memory controller <NUM>. The address register <NUM> may provide the received bank address BANK_ADDR to the bank control logic <NUM>, may provide the received row address ROW_ADDR to the row address multiplexer <NUM>, and may provide the received column address COL_ADDR to the column address latch <NUM>.

The bank control logic <NUM> may generate bank control signals in response to the bank address BANK_ADDR. One of the first through sixteenth row decoders 260a~<NUM> corresponding to the bank address BANK_ADDR may be activated in response to the bank control signals. One of the first through sixteenth column decoders 270a~<NUM> corresponding to the bank address BANK_ADDR may be activated in response to the bank control signals.

The row address multiplexer <NUM> may receive the row address ROW_ADDR from the address register <NUM>, and may receive a refresh row address REF_ADDR from the refresh control circuit <NUM>. The row address multiplexer <NUM> may selectively output the row address ROW_ADDR or the refresh row address REF_ADDR as a row address SRA. The row address SRA that is output from the row address multiplexer <NUM> may be applied to the first through sixteenth row decoders 260a~<NUM>.

The refresh control circuit <NUM> may sequentially increase or decrease the refresh row address REF_ADDR in a normal refresh mode, in response to a third control signal CTL3 from the control logic circuit <NUM>. The refresh control circuit <NUM> may receive a hammer address HADDR in a hammer refresh mode, and may output hammer refresh row addresses designating one or more victim memory cell rows physically adjacent to a memory cell row corresponding to the hammer address as the refresh row address REF_ADDR.

The activated one of the first through sixteenth row decoders 260a~<NUM>, by the bank control logic <NUM>, may decode the row address SRA that is output from the row address multiplexer <NUM>, and may activate a word-line corresponding to the row address SRA. For example, the activated bank row decoder may apply a word-line driving voltage to the word-line corresponding to the row address.

The column address latch <NUM> may receive the column address COL_ADDR from the address register <NUM>, and may temporarily store the received column address COL _ADDR. In a burst mode, the column address latch <NUM> may generate column address COL_ADDR' that increments from the received column address COL _ADDR. The column address latch <NUM> may apply the temporarily stored or generated column address COL_ADDR' to the first through sixteenth column decoders 270a~<NUM>.

The activated one of the first through sixteenth column decoders 270a~<NUM> may activate a sense amplifier corresponding to the bank address BANK_ADDR and the column address COL_ADDR through the I/O gating circuit <NUM>.

The I/O gating circuit <NUM> may include a circuitry for gating input/output data, input data mask logic, read data latches for storing data that is output from the first through sixteenth bank arrays 310a~<NUM>, and write drivers for writing data to the first through sixteenth bank arrays 310a~<NUM>.

A codeword CW read from a selected bank array of the first through sixteenth bank arrays 310a~<NUM> may be sensed by a sense amplifier coupled to the selected bank array from which the data is to be read, and may be stored in the read data latches. The codeword CW stored in the read data latches may be provided to the data I/O buffer <NUM> as data DTA after ECC decoding is performed on the codeword CW by the ECC engine <NUM>. The data I/O buffer <NUM> may convert the data DTA into the data signal DQ, and may transmit the data signal DQ along with the data strobe signal DQS to the memory controller <NUM>.

The data signal DQ to be written in a selected bank array of the first through sixteenth bank arrays 310a~<NUM> may be provided to the data I/O buffer <NUM> from the memory controller <NUM>. The data I/O buffer <NUM> may convert the data signal DQ to the data DTA, and may provide the data DTA to the ECC engine <NUM>. The ECC engine <NUM> may perform an ECC encoding on the data DTA to generate parity bits. The ECC engine <NUM> may provide the codeword CW including data DTA and the parity bits to the I/O gating circuit <NUM>. The I/O gating circuit <NUM> may write the codeword CW in a sub-page in the selected bank array through the write drivers.

The data I/O buffer <NUM> may provide the data signal DQ from the memory controller <NUM> to the ECC engine <NUM> by converting the data signal DQ to the data DTA in a write operation of the semiconductor memory device <NUM>, may convert the data DTA to the data signal DQ from the ECC engine <NUM>, and may transmit the data signal DQ and the data strobe signal DQS to the memory controller <NUM> in a read operation of the semiconductor memory device <NUM>.

The ECC engine <NUM> may perform an ECC encoding on the data DTA, and may perform an ECC decoding on the codeword CW based on a second control signal CTL2 from the control logic circuit <NUM>.

The clock buffer <NUM> may receive the clock signal CK, may generate an internal clock signal ICK by buffering the clock signal CK, and may provide the internal clock signal ICK to circuit components processing the command CMD and the address ADDR.

The strobe signal generator <NUM> may receive the clock signal CK, may generate the data strobe signal DQS based on the clock signal CK, and may provide the data strobe signal DQS to the memory controller <NUM>.

The control logic circuit <NUM> may control operations of the semiconductor memory device <NUM>. For example, the control logic circuit <NUM> may generate control signals for the semiconductor memory device <NUM> in order to perform a write operation, a read operation, a normal refresh operation, and a hammer refresh operation. The control logic circuit <NUM> may include a command decoder <NUM>, which decodes the command CMD received from the memory controller <NUM>, and a mode register set (MRS) <NUM>, which sets an operation mode of the semiconductor memory device <NUM>.

The command decoder <NUM> may generate the control signals corresponding to the command CMD by decoding a write enable signal, a row address strobe signal, a column address strobe signal, a chip select signal, etc. The control logic circuit <NUM> may provide a first control signal CTL1 to the I/O gating circuit, the second control signal CTL2 to control the ECC engine <NUM>, the third control signal CTL3 to control the refresh control circuit <NUM>, and a fourth control signal CTL4 to control the row hammer management circuit <NUM>.

The row hammer management circuit <NUM> may receive the address ADDR (including the bank address BANK_ADDR and the row address ROW_ADDR), may capture row addresses accompanied by first active commands randomly selected from active commands during a reference time interval in response to the command CMD corresponding to the active command, and may output at least one row address from among the captured row addresses as the hammer address HADDR a number of times that is proportional to access counts of an active command corresponding to the at least one row address during the reference time interval.

<FIG> illustrates an example of the first bank array in the semiconductor memory device of <FIG>.

Referring to <FIG>, the first bank array 310a may include a plurality of word-lines WL0~WLm-<NUM> (m is a natural number greater than two), a plurality of bit-lines BTL0~BTLn-<NUM> (n is a natural number greater than two), and a plurality of volatile memory cells MCs disposed at intersections between the word-lines WL0~WLm-<NUM> and the bit-lines BTL0~BTLn-<NUM>. Each of the memory cells MCs may include a cell transistor coupled to each of the word-lines WL0~WLm-<NUM> and each of the bit-lines BTL0~BTLn-<NUM>, and a cell capacitor coupled to the cell transistor. Each of the memory cells MCs may have a DRAM cell structure. The word-lines WL0~WLm-<NUM> bit-lines BTL0~BTLn-<NUM> may extend in a first direction D1, and the bit-lines BTL1~BTLn may extend in a second direction D2 crossing the first direction D1.

The word-lines WL0~WLm-<NUM> coupled to a plurality of memory cells MCs may be referred to as rows of the first bank array 310a. The bit-lines BTL0~BTLn-<NUM> coupled to a plurality of memory cells MCs may be referred to as columns of the first bank array 310a.

<FIG> is a block diagram illustrating an example of the row hammer management circuit in <FIG> according to an example embodiment.

Referring to <FIG>, a row hammer management circuit 500a may include an address capturer 510a, an address storage <NUM>, a hammer address (HADDR) selector <NUM>, a comparator <NUM>, a random bit generator <NUM>, and a control logic 590a. Each element included in the row hammer management circuit 500a may be a logic circuit capable of performing respective functions.

The random bit generator <NUM> may generate a random binary code RBC, which varies randomly, in response to active commands ACT. The random binary code RBC may include a plurality of bits. The random bit generator <NUM> may output the random binary code RBC based on the random bit generator <NUM> receiving each of the active commands ACT. The random binary code RBC may be a pseudo random sequence, e.g., the random bit generator <NUM> may generate the random binary code RBC, periodically repeated in response to the active commands ACT, when the random binary code RBC corresponds to a pseudo random sequence.

The comparator <NUM> may compare the random binary code RBC and a reference binary code PBC, to output a matching signal MTC1 based on a result of the comparison. The reference binary code PBC may be the same as at least one of the values of the random binary code RBC output from the random bit generator <NUM>.

The reference binary code PBC may be provided from an external register or may be stored in a register in the comparator <NUM>. When bits of the random binary code RBC are the same as bits of the reference binary code PBC (i.e., when the random binary code RBC matches the reference binary code PBC), the comparator <NUM> may output the matching signal MTC1 to the address capturer 510a. For example, when the random binary code RBC is periodically repeated, the comparator <NUM> may output the matching signal MTC1 which is periodically repeated based on the random binary code RBC.

The comparator <NUM> may compare the random binary code RBC with a plurality of reference binary codes PBC. In this case, a frequency of generating the matching signal MTC1 may vary according to a number of the reference binary codes PBC. For example, a frequency of generating the matching signal MTC1 may increase as the number of the reference binary codes PBC increases.

The address capturer 510a may receive the row address ROW_ADDR accompanied by the active commands ACT, and may output row addresses accompanied by first active commands randomly selected from the active commands ACT in response to the matching signal MTC1 as captured row addresses CRA. Each of the active commands ACT may have a first selection probability that is uniform based on probability information PBI. Thus, the address capturer 510a may select at least a portion of the active commands ACT with the first selection probability that is uniform based on probability information PBI as the captured row addresses CRA.

The address storage <NUM> may store the captured row addresses CRA sequentially.

The hammer address selector <NUM> may select at least one of the captured row addresses CRA stored in the address storage <NUM>, to output the selected one as the hammer address HADDR.

The control logic 590a may control the address storage <NUM> and the hammer address selector <NUM>. The control logic 590a may control storing the captured row addresses CRA in the address storage <NUM>, and may manage the address storage <NUM>.

The control logic 590a may control a selection mode of the hammer address selector <NUM>, associated with selecting the hammer address HADDR, by applying a selection mode signal SMS1 to the hammer address selector <NUM>. The control logic 590a may provide the refresh control circuit <NUM> in <FIG> with a hammer address generation signal HAG indicating that the hammer address selector <NUM> outputs the hammer address HADDR.

In response to the selection mode signal SMS1 having a first logic level, the hammer address selector <NUM> may output the captured row addresses CRA as the hammer address HADDR according to an order of being stored in the address storage <NUM>. In response to the selection mode signal SMS1 having a second logic level, the hammer address selector <NUM> may output the captured row addresses CRA as the hammer address HADDR randomly with a second selection probability that is uniform.

The hammer address selector <NUM> may include a random bit generator (RBG) <NUM> therein. The random bit generator <NUM> may provide the address storage <NUM> with a random binary code RBC1 in response to the selection mode signal SMS1 having a second logic level. The address storage <NUM> may provide the hammer address selector <NUM> with one of the captured row addresses CRA in response to the random binary code RBC1.

Thus, the row hammer management circuit 500a may select a portion of the row addresses ROW_ADDR accompanied by the first active commands ACT which are randomly selected based on the random binary code RBC that varies randomly in response to the active commands ACT matching the reference binary code PBC.

<FIG> is a block diagram illustrating an example of the address storage included in the row hammer management circuit of <FIG> according to an example embodiment.

Referring to <FIG>, the address storage <NUM> may include a plurality of storage blocks SBK_A~SBK_S 520a~<NUM>, where s may be an integer greater than two, and each of the storage blocks 520a~<NUM> may include a plurality of storage units SU1~SUH, where H may be an integer greater than three. The storage blocks 520a~<NUM> may have the same configuration, and thus the one storage block 520a is described.

The storage units SU1~SUH may include address registers AREG1~AREGH storing the row addresses that are accessed.

<FIG> is a diagram for explaining a hammer refresh operation performed in proportion to access ratio.

The example in <FIG> shows that, when a number of access count associated with a row address R0 corresponds to <NUM>, a number of access count associated with a row address R1 corresponds to <NUM>, and a number of access count associated with a row address R2 corresponds to <NUM> during the reference time interval, a hammer refresh operation HREF is performed <NUM> times on one or more victim memory cell rows physically adjacent to a memory cell row designated by the row address R0, a hammer refresh operation HREF is performed <NUM> times on one or more victim memory cell rows physically adjacent to a memory cell row designated by the row address R1, and a hammer refresh operation HREF is performed <NUM> times on one or more victim memory cell rows physically adjacent to a memory cell row designated by the row address R2. Thus, the hammer refresh operation HREF is performed on victim memory cell row in proportion to the number of access count of the row addresses R0, R1, and R2.

<FIG> is a circuit diagram illustrating an example of the random bit generator in <FIG> according to an example embodiment.

Referring to <FIG>, the random bit generator <NUM> may include a register circuit <NUM> and a logical operation circuit <NUM>. The random bit generator <NUM> may be implemented with a linear feedback shift register. Thus, the register circuit <NUM> and the logical operation circuit <NUM> may constitute a linear feedback shift register.

The linear feedback shift register may determine feedback bits based on a characteristic polynomial having a coefficient '<NUM>' or '<NUM>'. The feedback bits may be output through a feedback path of the linear feedback shift register, and bits, generated by logical operation based on the feedback bits, may be input to input terminals of the linear feedback shift register. The linear feedback shift register may generate a pseudo random sequence based on the bits input to the input terminals.

For example, when the random bit generator <NUM> is implemented based on a characteristic polynomial of x<NUM>+x<NUM>+x<NUM>+x<NUM>+<NUM> as illustrated in <FIG>, the register circuit <NUM> may include first through eleventh registers REG1~REG11 and the logical operation circuit <NUM> may include first through third logic circuits XOR1~XOR3.

Each of the first through eleventh registers REG1~REG11 may store respective one of first through eleventh bits b1~b11. Values of the first through eleventh bits b1~b11 may vary according to shift operation. Each of the first through third logic circuits XOR1~XOR3 may perform exclusive OR operation.

The random bit generator <NUM> may output the random binary code RBC through the register circuit <NUM>. The random bit generator <NUM> may output the random binary code RBC having a predetermined number of bits. For example, the random bit generator <NUM> may output the random binary code RBC having five bits based on the first through fifth bits b1~b5 stored in the first through fifth registers REG1~REG5.

The logical operation circuit <NUM> may be positioned in a feedback path of the random bit generator <NUM>. The first logical circuit XOR1 may be positioned in an output path of the second register REG2, the second logical circuit XOR2 may be positioned in an output path of the seventh register REG7, and the third logical circuit XOR3 may be positioned in output paths of the ninth register REG9 and the eleventh register REG11.

The example in <FIG> shows that the third logical circuit XOR3 performs a logical operation based on the ninth bit b9 in the ninth register REG9 and the eleventh bit b11 in the eleventh register REG11. The second logical circuit XOR2 performs a logical operation based on the seventh bit b7 in the seventh register REG7 and an output of the third logical circuit XOR3. The first logical circuit XOR1 performs a logical operation based on the second bit b2 in the second register REG1 and an output of the second logical circuit XOR2.

The output of the first logical circuit XOR1 may vary based on the second bit b2, the seventh bit b7, the ninth bit b9, and the eleventh bit b11. Thus, each of the second bit b2, the seventh bit b7, the ninth bit b9, and the eleventh bit b11 may be a feedback bit. The output of the first logical circuit XOR1 may be provided to the first register REG1 as an input.

The first register REG1 may store the output of the first logical circuit XOR1 as the first bit b1. The bit input through a feedback path may be shifted through the first through eleventh registers REG1~REGT11 based on a control signal.

<FIG> illustrates an example operation of the row hammer management circuit of <FIG> according to an example embodiment.

In <FIG>, it is assumed that row addresses R0, R1, R3, R1, R0, and R2 are accessed during a reference time interval RINT between normal refresh operations NREF, and the reference binary code PBC may also be output or accessed during the reference time interval RINT between normal refresh operations NREF. Thus, the reference time interval RINT may correspond to a refresh interval between refresh cycles of the semiconductor memory device <NUM>.

Referring to <FIG> and <FIG>, the random bit generator <NUM> may generate the random binary code RBC including five bits, and the address capturer 510a may capture the row address R3 accompanied by the active command, in response to the matching signal MTC1 that is activated based on the random binary code RBC having '<NUM>' matching the reference binary code PBC, and store the captured row address R3 in the address storage <NUM>. A hammer refresh operation FREF may be performed on one or more victim memory cell rows physically adjacent to the captured row address R3 stored in the address storage <NUM> at a refresh timing after row addresses R7, R5, R1, and R2 are accessed after a normal refresh operation NREF is performed.

Referring to <FIG>, a row hammer management circuit 500b may include an address capturer 510b, an address storage <NUM>, a hammer address (HADDR) selector <NUM>, a comparator 540a, an active counter <NUM>, a random number generator (RNG) 550a, and a control logic 590a.

Operations of the address storage <NUM>, the hammer address, and the control logic 590a are the same as the operations of corresponding components in <FIG>, and thus descriptions repeated with <FIG> will be omitted.

The random number generator 550a may generate a random number RN, which varies randomly, in response to active commands ACT. The random number generator 550a may output the number RN whenever the random number generator 550a receives each of the active commands ACT.

The active counter <NUM> may count the active commands ACT to output a corresponding counted value CV.

The comparator 540a may compare the random number RN from the random number generator 550a and the counted value CV from the active counter <NUM>, and may output a matching signal MTC2 based on a result of the comparison. The comparator 540a may output the matching signal MTC that is activated in response to the random number RN matching the counted value CV.

The address capturer 510b may receive the row address ROW_ADDR accompanied by the active commands ACT, and may output row addresses accompanied by first active commands randomly selected from the active commands ACT in response to the matching signal MTC2 as captured row addresses CRA. Each of the active commands ACT may have a first selection probability that is uniform based on probability information PBI. Thus, the address capturer 510b may select at least a portion of the active commands ACT with the first selection probability that is uniform based on probability information PBI as the captured row addresses CRA.

Thus, the row hammer management circuit 500b may select a portion of the row addresses ROW_ADDR accompanied by the first active commands ACT which are randomly selected based on the random number RN that varies randomly in response to the active commands ACT matching the counted value CV obtained by counting the active commands ACT as the hammer address HADDR in proportion to a number of access count of each of the first active commands as the hammer address HADDR in proportion to a number of access count of each of the first active commands.

In <FIG>, assuming that the row addresses R0, R1, R3, R1, R0, and R2 are accessed during the reference time interval RINT between normal refresh operations NREF, the counted values with respect to row addresses R0, R1, R3, R1, R0, and R2 correspond to '<NUM>', '<NUM>', '<NUM>', '<NUM>', '<NUM>', and '<NUM>', respectively, and the random number RN corresponds to '<NUM>' for convenience of explanation. In this example, the reference time interval RINT corresponds to a refresh interval between refresh cycles of the semiconductor memory device <NUM>.

Referring to <FIG> and <FIG>, the random number generator 550a generates the random number RN corresponding to '<NUM>'. The address capturer 510a captures the row address R2 accompanied by the active command, in response to the matching signal MTC2 that is activated based on the counted value CV having '<NUM>' matching the random number RN, and stores the captured row address R2 in the address storage <NUM>. A hammer refresh operation FREF may be performed on one or more victim memory cell rows physically adjacent to the captured row address R2 stored in the address storage <NUM> at a refresh timing after row addresses R7, R5, R1, and R2 are accessed after a normal refresh operation NREF is performed. The counted values CV of the active command with respect to row addresses R7 and R5 may correspond to '<NUM>' and '<NUM>', respectively.

Referring to <FIG>, a row hammer management circuit 500c may include an address capturer 510a, a candidate address register <NUM>, an address selector <NUM>, an address storage <NUM>, a hammer address (HADDR) selector 530a, a comparator <NUM>, a random bit generator <NUM>, and a control logic 590b.

The random bit generator <NUM> may generate a random binary code RBC, which varies randomly, in response to active commands ACT. The random binary code RBC may include a plurality of bits. The random bit generator <NUM> may output the random binary code RBC whenever the random bit generator <NUM> receives each of the active commands ACT. The random binary code RBC may be a pseudo random sequence. Thus, the random bit generator <NUM> may generate the random binary code RBC that is periodically repeated in response to the active commands ACT when the random binary code RBC corresponds to a pseudo random sequence.

The comparator <NUM> may compare the random binary code RBC and the reference binary code PBC, to output a matching signal MTC1 based on a result of the comparison. The reference binary code PBC may be the same as at least one of values of the random binary code RBC that the random bit generator <NUM> is capable of outputting.

The address capturer 510a may receive the row address ROW_ADDR accompanied by the active commands ACT, and may output N row addresses accompanied by N first active commands randomly selected from the active commands ACT in response to the matching signal MTC1 as captured row addresses CRA. Here, N is an integer equal to or greater than two. Each of the active commands ACT may have a first selection probability that is uniform based on probability information PBI. Thus, the address capturer 510a may select at least a portion of the active commands ACT with the first selection probability that is uniform based on probability information PBI as the captured row addresses CRA.

The candidate address register <NUM> may store the captured row addresses CRA as first candidate row addresses CDRA1 sequentially.

The address selector <NUM> may select a portion of the first candidate row addresses CDRA1 with a uniform probability to output second candidate row addresses CDRA2, in response to the candidate address register <NUM> being full.

The address storage <NUM> may store the second candidate row addresses CDRA2 sequentially.

The hammer address selector 530a may select at least one of the second candidate row addresses CDRA2, to output the selected one as the hammer address HADDR. The hammer address selector 530a may be connected to the candidate address register <NUM> and the address storage <NUM>.

The control logic 590b may control the candidate address register <NUM>, the address storage <NUM>, and the hammer address selector 530a.

The control logic 590b may determine whether each of the candidate address register <NUM> and the address storage <NUM> is empty or full, and may control storing operating of the candidate address register <NUM> and the address storage <NUM>.

The control logic 590b may control a selection mode of the hammer address selector 530a, associated with selecting the hammer address HADDR, by applying a selection mode signal SMS2 to the hammer address selector 530a. The control logic 590b may provide the refresh control circuit <NUM> in <FIG> with a hammer address generation signal HAG indicating that the hammer address selector 530a outputs the hammer address HADDR.

In response to the selection mode signal SMS2 having a first logic level, the hammer address selector 530a may output the second candidate row addresses CDRA2 stored in the address storage <NUM> as the hammer address HADDR according to an order of being stored in the address storage <NUM>. In response to the selection mode signal SMS1 having a second logic level, the hammer address selector 530a may output the second candidate row addresses CDRA2 stored in the address storage <NUM> as the hammer address HADDR randomly with a second selection probability that is uniform.

The hammer address selector 530a may include a random bit generator (RBG) 535b therein. The random bit generator 535b may provide the address storage <NUM> with a random binary code RBC2 in response to the selection mode signal SMS2 having a second logic level. The address storage <NUM> may provide the hammer address selector 530a with one of the second candidate row addresses CDRA2 in response to the random binary code RBC2.

Thus, hammer address selector 530a may select at least one of the first candidate row addresses CDRA1 stored in the candidate address register <NUM> to output the selected one as the hammer address HADDR, in response to a refresh management command from the memory controller <NUM> and in response to the address storage <NUM> being empty at a timing for performing the hammer refresh operation.

The row hammer management circuit 500c may select the N first active commands from among the active command based on the random binary code RBC that varies randomly in response to the active commands ACT matching the reference binary code PBC, may store the N row addresses accompanied by the N first active commands as first candidate row addresses CDRA1, and may select at least a portion of the first candidate row addresses CDRA1 as the hammer address HADDR.

<FIG> is a block diagram illustrating an example of the refresh control circuit in <FIG> according to an example embodiment.

Referring to <FIG>, the refresh control circuit <NUM> may include a refresh control logic <NUM>, a refresh clock generator <NUM>, a refresh counter <NUM>, and a hammer refresh address generator <NUM>.

The refresh control logic <NUM> may provide a mode signal MS in response to the hammer address generation signal HAG. The refresh control logic <NUM> may provide the hammer refresh address generator <NUM> with a hammer refresh signal HREF to control output timing of the hammer address, in response to one of a first refresh control signal IREF1 and a second refresh control signal IREF2.

The refresh clock generator <NUM> may generate a refresh clock signal RCK indicating a timing of a normal refresh operation based on the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS. The refresh clock generator <NUM> may generate the refresh clock signal RCK in response to the receiving of the first refresh control signal IREF1 or while the second refresh control signal IREF2 is activated.

When the command CMD from the memory controller <NUM> corresponds to an auto refresh command, the control logic circuit <NUM> in <FIG> may apply the first refresh control signal IREF1 to the refresh control circuit <NUM> whenever the control logic circuit <NUM> receives the auto refresh command. When the command CMD from the memory controller <NUM> corresponds to a self-refresh entry command, the control logic circuit <NUM> may apply the second refresh control signal IREF2 to the refresh control circuit <NUM>, and the second refresh control signal IREF2 is activated from a time point when the control logic circuit <NUM> receives the self-refresh entry command to a time point when control logic circuit <NUM> receives a self-refresh exit command.

The refresh counter <NUM> may generate a counter refresh address CREF_ADDR designating sequentially the memory cell rows by performing counting operation at the period of the refresh clock signal RCK, and may provide the counter refresh address CREF_ADDR as the refresh row address REF_ADDR to the row address multiplexer <NUM> in <FIG>.

The hammer refresh address generator <NUM> may include a hammer address storage <NUM> and a mapper <NUM>.

The hammer address storage <NUM> may store the hammer address HADDR, and may output the hammer address HADDR to the mapper <NUM> in response to the hammer refresh signal HREF. The mapper <NUM> may generate hammer refresh addresses HREF_ADDR designating one or more victim memory cell rows physically adjacent to a memory cell row corresponding to the hammer address HADDR.

The hammer refresh address generator <NUM> may provide the hammer refresh address HREF_ADDR as the refresh row address REF_ADDR to the row address multiplexer <NUM> in <FIG>.

<FIG> is a circuit diagram illustrating an example of the refresh clock generator in <FIG> according to an example embodiment.

Referring to <FIG>, a refresh clock generator 420a may include a plurality of oscillators <NUM>, <NUM>, and <NUM>, a multiplexer <NUM>, and a decoder 425a.

The decoder 425a may decode the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS, to output a clock control signal RCS1.

The oscillators <NUM>, <NUM>, and <NUM> may generate refresh clock signals RCK1, RCK2, and RCK3 having different periods.

The multiplexer <NUM> may select one of the refresh clock signals RCK1, RCK2, and RCK3, to provide the refresh clock signal RCK in response to the clock control signal RCS1.

Because the mode signal MS indicates that the hammer address is generated, the refresh clock generator 420a may adjust a refresh cycle by selecting one of the refresh clock signals RCK1, RCK2, and RCK3.

<FIG> is a circuit diagram illustrating another example of the refresh clock generator in <FIG> according to an example embodiment.

Referring to <FIG>, a refresh clock generator 420b may include a decoder 425b, a bias unit <NUM>, and an oscillator <NUM>.

The decoder 425b may decode the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS, to output a clock control signal RCS2.

The bias unit <NUM> may generate a control voltage VCON in response to the clock control signal RCS2.

The oscillator <NUM> may generate the refresh clock signal RCK having a variable period, according to the control voltage VCON.

Because the mode signal MS indicates that the hammer address is generated, the refresh clock generator 420b may adjust a refresh cycle by varying a period of the refresh clock signal RCK based on the clock control signal RCS2.

<FIG> illustrates an example of the first bank array in the semiconductor memory device of <FIG> according to an example embodiment.

Referring to <FIG>, in the first bank array 310a, I sub-array blocks SCB may be disposed in the first direction D1, and J sub-array blocks SCB may be disposed in the second direction D2 substantially perpendicular to the first direction D1. I and J represent a number of the sub-array blocks SCB in the first direction D1 and the second direction D2, respectively, and may be natural numbers greater than two.

The I sub-array blocks SCB disposed in the first direction D1 in one row may be referred to as a row block. A plurality of bit-lines, a plurality of word-lines, and a plurality of memory cells connected to the bit-lines and the word-lines may be disposed in each of the sub-array blocks SCB.

I+<NUM> sub word-line driver regions SWB may be disposed in the first direction D1, e.g., between the sub-array blocks SCB in the first direction D1 as well on each side of each of the sub-array blocks SCB. Sub word-line drivers may be disposed in the sub word-line driver regions SWB.

J+<NUM> bit-line sense amplifier regions BLSAB may be disposed in the second direction D2, e.g., between the sub-array blocks SCB in the second direction D2 and above and below each of the sub-array blocks SCB. Bit-line sense amplifiers to sense data stored in the memory cells may be disposed in the bit-line sense amplifier regions BLSAB.

A plurality of sub word-line drivers may be provided in each of the sub word-line driver regions SWB. One sub word-line driver region SWB may be associated with two sub-array blocks SCB adjacent to the sub word-line driver region SWB in the first direction D1.

A plurality of conjunction regions CONJ may be disposed adjacent the sub word-line driver regions SWB and the bit-line sense amplifier regions BLSAB. A voltage generator may be disposed in each of the conjunction regions CONJ.

An example of a portion <NUM> in the first bank array 310a will now be described with reference to <FIG> below.

<FIG> illustrates the portion <NUM> of the first bank array 310a in <FIG> according to an example embodiment.

Referring to <FIG> and <FIG>, in the portion <NUM> of the first bank array 310a, the sub-array block SCB, two of the bit-line sense amplifier regions BLSAB, two of the sub word-line driver regions SWB, and four of the conjunction regions CONJ are disposed.

The sub-array block SCB includes a plurality of word-lines WL1~WL4 extending in a row direction (the first direction D1), and a plurality of bit-line pairs BTL1~BTLB1 and BTL2~BTLB2 extending in a column direction (the second direction D2). The sub-array block SCB includes a plurality of memory cells MCs disposed at intersections of the word-lines WL1~WL4 and the bit-line pairs BTL1~BTLB1 and BTL2~BTLB2.

With reference to <FIG>, the sub word-line driver regions SWB include a plurality of sub word-line drivers SWDs <NUM>, <NUM>, <NUM>, and <NUM> that respectively drive the word-lines WL1~WL4. The sub word-line drivers <NUM> and <NUM> may be disposed in the sub word-line driver region SWB, which is leftward (in this example), with respect to the sub-array block SCB. The sub word-line drivers <NUM> and <NUM> may be disposed in the sub word-line driver region SWB, which is rightward (in this example), with respect to the sub-array block SCB.

The bit-line sense amplifier regions BLSAB may include bit-line sense amplifiers <NUM> (BLSA) and bit-line sense amplifier <NUM> coupled to the bit-line pairs BTL1~BTLB1 and BTL2~BTLB2, and local sense amplifier circuit <NUM> and local sense amplifier circuit <NUM>. The bit-line sense amplifier <NUM> may sense and amplify a voltage difference between the bit-line pair BTL1 and BTLB1, to provide the amplified voltage difference to a local I/O line pair LIO1 and LIOB1.

The local sense amplifier circuit <NUM> may control connection between the local I/O line pair LIO1 and LIOB1 and a global I/O line pair GIO1 and GIOB1. The local sense amplifier circuit <NUM> may control connection between the local I/O line pair LIO2 and LIOB2 and a global I/O line pair GIO2 and GIOB2.

Referring to <FIG>, the bit-line sense amplifier <NUM> and the bit-line sense amplifier <NUM> may be alternately disposed at an upper portion and a lower portion of the sub-array block SCB. The conjunction regions CONJ may be disposed adjacent to the bit-line sense amplifier regions BLSAB and the sub word-line driver regions SWB. The conjunction regions CONJ may be disposed at each corner of the sub-array block SCB in <FIG>. A plurality of voltage generators <NUM>, <NUM>, <NUM>, and <NUM> may be disposed in the conjunction regions CONJ.

<FIG> and <FIG> illustrate example commands which may be used in the memory system of <FIG>.

<FIG> illustrates combinations of a chip selection signal CS_n and first through fourteenth command-address signals CA0~CA13 representing an active command ACT, a write command WR, and a read command RD. <FIG> illustrates combinations of the chip selection signal CS_n and the first through fourteenth command-address signals CA0~CA13 representing precharge commands PREab, PREsb, and PREpb.

In <FIG> and <FIG>, H indicates the logic high level, L indicates the logic low level, V indicates a valid logic level corresponding to one of the logic high level and the logic low level, R0~R17 indicate bits of a row address, BA0 through BA2 indicate bits of a bank address, and CID0 through CID3 indicate die identifiers of a memory die when the semiconductor memory device <NUM> is implemented with a stacked memory device including a plurality of memory dies. In <FIG>, C2~C10 indicate bits of a column address. In <FIG>, BL indicates burst length flag.

Referring to <FIG>, the active command ACT, the write command WR, and the read command RD may be transferred during two cycles, e.g., during a high level and a low level of the chip selection signal CS_n. The active command ACT a may include the bank address bits BA0 and BA1 and the row address bits R0~R17.

In <FIG>, PREpb is a precharge command to precharge a particular bank in a particular bank group, PREab is all bank precharge command to precharge all banks in all bank groups, and PREsb is same bank precharge command to precharge a same bank in all bank groups.

Referring to <FIG>, the ninth command-address signal CA8 or the tenth command-address signal CA9 of each of the precharge commands PREab and PREsb may be used as a flag to determine the hammer address.

<FIG> illustrates an example of the command protocol of the memory system when the memory system determines a hammer address based on the precharge command.

Referring to <FIG>, <FIG>, <FIG>, and <FIG>, the scheduler <NUM> may apply the first active command ACT1 to the semiconductor memory device <NUM> in synchronization with an edge of the clock signal CK_t, and apply the precharge command PRE designating whether a target memory cell row designated by a target row address corresponds to a hammer address, which is accompanied by the first active command ACT1, to the semiconductor memory device <NUM> after a tRAS corresponding to active to precharge time elapses. The scheduler <NUM> may set the tenth command-address signal CA9 of the precharge command PRE to a logic low level.

After a time interval corresponding to precharge time tRP, the scheduler <NUM> may apply a second active command ACT2 to the semiconductor memory device <NUM> in synchronization with an edge of the clock signal CK_t, and apply a direct refresh management command DRFM to the semiconductor memory device <NUM>. The semiconductor memory device <NUM> may perform a hammer refresh operation on one or more victim memory cell rows physically adjacent to a memory cell row corresponding to the hammer address HADDR during a refresh cycle tRFC, in response to the direct refresh management command DRFM. During the refresh cycle interval tRFC, generating other commands may be inhibited from a time point at the semiconductor memory device <NUM> receiving the direct refresh management command DRFM.

<FIG> is a diagram illustrating a portion of a memory cell array for describing generation of hammer refresh addresses.

<FIG> illustrates three word-lines WLt-<NUM>, WLt, and WLt+<NUM>, three bit-lines BTLg-<NUM>, BTLg, and BTLg+<NUM>, and memory cells MC coupled to the word-lines WLt-<NUM>, WLt, and WLt+<NUM> and the bit-lines BTLg-<NUM>, BTLg, and BTLg+<NUM> in the memory cell array. The three word-lines WLt-<NUM>, WLt, and WLt+<NUM> are extended in a row direction (e.g., the first direction D1) and arranged sequentially along a column direction (e.g., the second direction D2). The three bit-lines BTLg-<NUM>, BTLg, and BTLg+<NUM> are extended in the column direction and arranged sequentially along the row direction. It will be understood that the word-lines WLt-<NUM> and WLt are physically directly adjacent to each other since there are no intervening word-lines between the word-lines WLt-<NUM> and WLt.

By way of example, it may be assumed that the middle word-line WLt may correspond to the hammer address HADDR that has been intensively accessed. It will be understood that "an intensively-accessed word-line" refers to a word-line that has a relatively higher activation number and/or has a relatively higher activation frequency. Whenever the hammer word-line (e.g., the middle word-line WLt) is accessed, the hammer word-line WLt is enabled and precharged, and the voltage level of the hammer word-line WLt is increased and decreased. Word-line coupling may cause the voltage levels of the adjacent word-lines WLt-<NUM> and WLt+<NUM> to fluctuate as the voltage level of the hammer word-line WLt varies, and thus the cell charges of the memory cells MC coupled to the adjacent word-lines WLt-<NUM> and WLt+<NUM> may be affected. As the hammer word-line WLt is accessed more frequently, the cell charges of the memory cells MC coupled to the adjacent word-lines WLt-<NUM> and WLt+<NUM> may be lost more rapidly.

The hammer refresh address generator <NUM> in <FIG> may provide the hammer refresh address HREF_ADDR representing the addresses HREF_ADDRa and HREF_ADDRb of the rows (e.g., the word-lines WLt-<NUM> and WLt+<NUM>) that are physically adjacent to the row of the hammer address HADDR (e.g., the middle word-line WLt). A refresh operation for the adjacent word-lines WLt-<NUM> and WLt+<NUM> may be performed additionally based on (e.g., in response to) the hammer refresh address HREF_ADDR to reduce or prevent the loss of data stored in the memory cells MC.

<FIG> and <FIG> are timing diagrams illustrating example operations of a refresh control circuit of <FIG> according to an example embodiment.

<FIG> and <FIG> illustrate generations of a refresh clock signal RCK, a hammer refresh signal HREF, a counter refresh address CREF_ADDR, and a hammer refresh address HREF _ADDR, with respect to a refresh control signal IREF that is activated in a pulse shape. The intervals between the activation time points t1~t15 of the refresh control signal IREF may be regular or irregular.

Referring to <FIG> and <FIG>, the refresh control logic <NUM> may activate the refresh clock signal RCK in synchronization with some time points t1~t4, t6~t10, and t12~t15 among the activation time points t1~t15 of the refresh control signal IREF, and may activate the hammer refresh signal HREF with the other time points t5 and t11.

The refresh counter <NUM> may generate the counter refresh address CREF_ADDR representing the sequentially changing addresses X+<NUM>~X+<NUM> in synchronization with the activation time points t1~t4, t6~t10, and t12~t15 of the refresh clock signal RCK. The hammer refresh address generator <NUM> may generate the hammer refresh address HREF_ADDR representing the address Ha1 and Ha2 of the rows that are physically adjacent to the row of the hammer address in synchronization with the activation time points t5 and t11 of the hammer refresh signal HREF.

Referring to <FIG> and <FIG>, the refresh control logic <NUM> may activate the refresh clock signal RCK in synchronization with some time points t1~t4 and t7~t10 among the activation time points t1~t10 of the refresh control signal IREF, and may activate the hammer refresh signal HREF with the other time points t5 and t6.

The refresh counter <NUM> may generate the counter refresh address CREF_ADDR representing the sequentially changing addresses X+<NUM>~X+<NUM> in synchronization with the activation time points t1~t4 and t7~t10 of the refresh clock signal RCK. The hammer refresh address generator <NUM> may generate the hammer refresh address HREF_ADDR representing the address Ha1 and Ha2 of the rows that are physically adjacent to the row of the hammer address in synchronization with the activation time points t5 and t6 of the hammer refresh signal HREF.

<FIG> illustrates five word-lines WLt-<NUM>, WLt-<NUM>, WLt, WLt+<NUM>, and WLt+<NUM>, three bit-lines BTLg-<NUM>, BTLg, and BTLg+<NUM>, and memory cells MC coupled to the word-lines WLt-<NUM>, WLt-<NUM>, WLt, WLt+<NUM>, and WLt+<NUM> and the bit-lines BTLg-<NUM>, BTLg, and BTLg+<NUM> in the memory cell array. The five word-lines WLt-<NUM>, WLt-<NUM>, WLt, WLt+<NUM>, and WLt+<NUM> are extended in a row direction and arranged sequentially along a column direction.

The hammer refresh address generator <NUM> in <FIG> may provide the HREF_ADDR representing addresses HREF_ADDRa, HREF_ADDRb, HREF_ADDRc, and HREF_ADDRd of the rows (e.g., the word-lines WLt-<NUM>, WLt-<NUM>, WLt+<NUM>, and WLt+<NUM>) that are physically adjacent to the row of the hammer address HADDR (e.g., the middle word-line WLt). A refresh operation for the adjacent word-lines WLt-<NUM>, WLt-<NUM>, WLt+<NUM>, and WLt+<NUM> may be performed additionally based on (e.g., in response to) the hammer refresh address HREF _ADDR, to reduce or prevent the loss of data stored in the memory cells MC.

<FIG> is a flow chart illustrating a method of operating a semiconductor memory device according to an example embodiment.

Referring to <FIG>, an example embodiment may provide a method of operating a semiconductor memory device <NUM>, which include a memory cell array <NUM> that includes a plurality of memory cell rows, each of which includes a plurality of volatile memory cells, in which a row hammer management circuit <NUM> captures row addresses accompanied by first active commands randomly selected from active commands, each having a first selection probability that is uniform, from an external memory controller <NUM> during a reference time interval RINT (operation S100).

The row hammer management circuit <NUM> selects at least one row address from among the captured row addresses as a hammer address HADDR a number of times proportional to access counts of an active command corresponding to the at least one row address during the reference time interval RINT (operation S200).

A refresh control circuit <NUM> performs a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address HADDR (operation S300).

Accordingly, in the semiconductor memory device and the method of operating the semiconductor memory device, the row hammer management circuit <NUM> generates the hammer address a number of times proportional to access counts of an active command corresponding to at least one row address based on the row addresses accompanied by first active commands randomly selected from active commands having a uniform selection probability that is uniform during a reference time interval, and the refresh control circuit <NUM> performs a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address. Therefore, the semiconductor memory device may prevent a row hammer generated by non-uniform attack pattern such as Blacksmith.

<FIG> is a block diagram illustrating a semiconductor memory device according to an example embodiment.

Referring to <FIG>, a semiconductor memory device <NUM> may include at least one buffer die <NUM> and a plurality of memory dies <NUM>-<NUM> to <NUM>-p (p is a natural number equal to or greater than three) providing a soft error analyzing and correcting function in a stacked chip structure.

The plurality of memory dies <NUM>-<NUM> to <NUM>-p may be stacked on the buffer die <NUM> and may convey data through a plurality of through silicon via (TSV) lines.

Each of the plurality of memory dies <NUM>-<NUM> to <NUM>-p may include a cell core <NUM> to store data, a cell core ECC engine <NUM> which generates transmission parity bits (i.e., transmission parity data) based on transmission data to be sent to the at least one buffer die <NUM>, a refresh control circuit (RCC) <NUM>, and a row hammer management circuit (RHMC) <NUM>. The cell core <NUM> may include a plurality of memory cells having a DRAM cell structure.

The refresh control circuit <NUM> may employ the refresh control circuit <NUM> of <FIG>.

The row hammer management circuit <NUM> may employ one of the row hammer management circuit 500a of <FIG>, the row hammer management circuit 500b of <FIG>, and the row hammer management circuit 500b of <FIG>.

The row hammer management circuit <NUM> may generate the hammer address a number of times proportional to access counts of an active command corresponding to at least one row address based on the row addresses accompanied by first active commands randomly selected from active commands having a uniform selection probability that is uniform during a reference time interval, and the refresh control circuit <NUM> may perform a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address.

The buffer die <NUM> may include a via ECC engine <NUM>, which may correct a transmission error using the transmission parity bits when a transmission error is detected from the transmission data received through the TSV liens and generate error-corrected data.

The buffer die <NUM> may include a data I/O buffer <NUM>. The data I/O buffer <NUM> may generate the data signal DQ by sampling the data DTA from the via ECC engine <NUM>, and may output the data signal DQ to the outside.

The semiconductor memory device <NUM> may be a stack chip type memory device or a stacked memory device which conveys data and control signals through the TSV lines. The TSV lines may be also called through electrodes.

The cell core ECC engine <NUM> may perform error correction on data which is outputted from the memory die <NUM>-p before the transmission data is sent.

A data TSV line group <NUM> formed at one memory die <NUM>-p may include <NUM> TSV lines L1 to Lp. A parity TSV line group <NUM> may include <NUM> TSV lines L10 to Lq. The TSV lines L1 to Lp of the data TSV line group <NUM> and the parity TSV lines L10 to Lq of the parity TSV line group <NUM> may be connected to micro bumps MCB, which are correspondingly formed among the memory dies <NUM>-<NUM> to <NUM>-p.

The semiconductor memory device <NUM> may have a three-dimensional (3D) chip structure or a <NUM>. 5D chip structure to communicate with the host through a data bus B10. The buffer die <NUM> may be connected with the memory controller through the data bus B10.

According to an embodiment, referring to <FIG>, the cell core ECC engine <NUM> may be included in the memory die, and the via ECC engine <NUM> may be included in the buffer die. Accordingly, it may be possible to detect and correct soft data fail. The soft data fail may include a transmission error which is generated due to noise when data is transmitted through TSV lines.

<FIG> is a configuration diagram illustrating a semiconductor package including the stacked memory device according to an example embodiment.

Referring to <FIG>, a semiconductor package <NUM> may include one or more stacked memory devices <NUM> and a graphic processing unit (GPU) <NUM>.

The stacked memory devices <NUM> and the GPU <NUM> may be mounted on an interposer <NUM>. The interposer, on which the stacked memory device <NUM> and the GPU <NUM> are mounted, may be mounted on a package substrate <NUM> mounted on solder balls <NUM>. The GPU <NUM> may correspond to a semiconductor device which may perform a memory control function. For example, the GPU <NUM> may be implemented as an application processor (AP). The GPU <NUM> may include a memory controller having a scheduler.

The stacked memory device <NUM> may be implemented in various forms, e.g., the stacked memory device <NUM> may be a memory device in a high bandwidth memory (HBM) form in which a plurality of layers are stacked. Accordingly, the stacked memory device <NUM> may include a buffer die and a plurality of memory dies, and each of the plurality of memory dies may include a refresh control circuit and a row hammer management circuit.

The plurality of stacked memory devices <NUM> may be mounted on the interposer <NUM>. The GPU <NUM> may communicate with the plurality of stacked memory devices <NUM>. For example, each of the stacked memory devices <NUM> and the GPU <NUM> may include a physical region, and communication may be performed between the stacked memory devices <NUM> and the GPU <NUM> through the physical regions. When the stacked memory device <NUM> includes a direct access region, a test signal may be provided into the stacked memory device <NUM> through conductive means (e.g., solder balls <NUM>) mounted under package substrate <NUM> and the direct access region.

<FIG> is a block diagram illustrating an example of a mobile system according to an example embodiment.

Referring to <FIG>, a mobile system <NUM> may include a camera <NUM>, a display <NUM>, an audio processor <NUM>, an I/O device <NUM>, a memory device <NUM>, a storage device <NUM>, an antenna <NUM>, and an application processor (AP) <NUM>.

The mobile system <NUM> may be implemented with one of a laptop computer, a portable terminal, a smart phone, a tablet personal computer (PC), a wearable device, a healthcare device, and internet of things (IoT). The mobile system <NUM> may be implemented with a server or a PC.

The camera <NUM> may capture an image or a video under control of a user. The camera <NUM> may communicate with the AP <NUM> through a camera interface (I/F) <NUM>.

The display <NUM> may include, e.g., a liquid crystal display (LCD), an organic light emitting diode (OLED) display, an active matrix (AM)-OLED, or a plasma display panel (PDP). The display <NUM> may receive input signals through interactions with a user and may be used as an input device of the mobile system <NUM>. For example, the display <NUM> may be a touch screen display that can receive input signals through a touch operation by a user. The display <NUM> may communicate with the AP <NUM> through a display interface (I/F) <NUM>.

The audio processor <NUM> may process audio data in contents transferred from the memory device <NUM> or the storage device <NUM>. The audio processor <NUM> may perform encoding/decoding or noise filtering on the audio data.

The I/O device <NUM> may include various devices that provide a digital input and/or digital output, such as a device to generate signal based on input of the user, a universal serial bus (USB), a digital camera, a secure digital (SD) card, a digital versatile disc (DVD), or a network adaptor. The audio processor <NUM> and the I/O device <NUM> may communicate with the AP <NUM> through a peripheral I/F <NUM>.

The AP <NUM> may control overall operation of the mobile system <NUM> through a central processing unit (CPU) <NUM>.

The AP <NUM> may control the display <NUM> to display a portion of the contents stored in the storage device <NUM>. When a user's input is received through the I/O device <NUM>, the AP <NUM> may perform control operation corresponding to the user's input. The AP <NUM> may include a bus <NUM> through which a modem <NUM>, the CPU <NUM>, an accelerator <NUM>, a memory I/F <NUM>, a storage I/F <NUM>, the peripheral I/F <NUM>, the display I/F <NUM>, and the camera I/F are connected to each other.

The AP <NUM> may be implemented with an SoC to run an operating system (OS). The AP <NUM>, a memory device <NUM>, and the storage device <NUM> may be implemented by using packages such as package-on-package (PoP), ball grid array (BGA), chip scale package (CSP), system-in-package (SIP), multi-chip package (MCP), wafer-level fabricated package (WFP), and wafer-level processed stack package (WSP), etc..

The AP <NUM> may further include an accelerator <NUM>. The accelerator <NUM> may be a function block to perform a specified function. The accelerator <NUM> may include a graphics processing unit (GPU) to process graphics data, or a neural processing unit (NPU) to perform an artificial operation such as training and/or inference.

The AP <NUM> may include a modem <NUM>, or a modem chip may be disposed outside of the AP <NUM>. The modem <NUM> may receive and/or transmit wireless data through an antenna <NUM>, modulate signals to be transmitted to the antenna <NUM>, and/or demodulate signals received from the antenna <NUM>.

The AP <NUM> may include a memory I/F <NUM> to communicate with the memory device <NUM>. The memory I/F <NUM> may include a memory controller to control the memory device <NUM>, and the memory device <NUM> may be directly connected to the memory I/F <NUM>. The memory controller in the memory I/F <NUM> may control the memory device <NUM> by changing read/write instructions from the CPU <NUM>, the accelerator <NUM>, or the modem <NUM> to commands for controlling the memory device <NUM>.

The AP <NUM> may communicate with the memory device <NUM> through a predefined interface protocol, e.g., an interface protocol such as LPDDR4 or LPDDR5 conformed to JEDEC standards, an interface protocol such as HBM, HMC, or Wide I/O conformed to high bandwidth JEDEC standards, etc..

The memory device <NUM> may be implemented with a DRAM device, or may be implemented based on SRAM, PRAM, MRAM, FRAM, or a hybrid RAM, etc..

The memory device <NUM> may have relatively smaller latency and bandwidth than latency and bandwidth of the I/O device <NUM> and the storage device <NUM>. The memory device <NUM> may be initialized at a timing of power on of the mobile system <NUM> and an OS and application data are loaded into the memory device <NUM>. The memory device <NUM> may be used for temporarily storing the OS and application data or a space for executing software.

In an example embodiment, the memory device <NUM> may correspond to the semiconductor memory device <NUM> described with reference to <FIG>. For example, the memory device <NUM> may select a hammer address a number of times proportional to access counts during a reference time interval based on a command and an address from a memory controller, and may perform a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address.

The AP <NUM> may include a storage I/F <NUM> to communicate with the storage device <NUM> and the storage device <NUM> may be directly connected to the storage I/F <NUM>. The storage device <NUM> may be provided as a separate chip, and the AP <NUM> and the storage device <NUM> may be fabricated into one package. The storage device <NUM> may be implemented with, e.g., a NAND flash memory.

Aspects of the example embodiments may be applied to systems using semiconductor memory devices that employ volatile memory cells and data clock signals. For example, aspects of the example embodiments may be applied to systems such as a smart phone, a navigation system, a notebook computer, a desk top computer, and a game console that use a semiconductor memory device as a working memory.

As described above, example embodiments may provide a semiconductor memory device capable of managing row hammer based on access ratio of memory cell rows. Example embodiments may provide a method of operating a semiconductor memory device, capable of managing row hammer based on access ratio of memory cell rows.

In a semiconductor memory device and a method of operating the semiconductor memory device according to example embodiments, a row hammer management circuit may generate a hammer address a number of times that is proportional to access counts of an active command corresponding to at least one row address based on the row addresses accompanied by first active commands randomly selected from active commands having a uniform selection probability that is uniform during a reference time interval, and a refresh control circuit may perform a hammer refresh operation on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address. Therefore, the semiconductor memory device may prevent a row hammer generated by non-uniform attack pattern such as Blacksmith.

Claim 1:
A semiconductor memory device (<NUM>; <NUM>), comprising:
a memory cell array (<NUM>) including a plurality of memory cell rows, each including a plurality of volatile memory cells (MC, MCs), the volatile memory cells (MC, MCs) being DRAM cells;
a row hammer management circuit (<NUM>; 500a; 500b; 500c) configured to:
capture row addresses accompanied by first active commands (ACT1) randomly selected from active commands (ACT, ACT1, ACT2), each having a first selection probability that is uniform, from an external memory controller (<NUM>) during a reference time interval (RINT); and
select at least one row address from among the captured row addresses (CRA) as a hammer address (HADDR) a number of times proportional to access counts of an active command (ACT, ACT1, ACT2) corresponding to the at least one row address during the reference time interval (RINT); and
a refresh control circuit (<NUM>, <NUM>) configured to receive the hammer address (HADDR), and to perform a hammer refresh operation (HREF) on one or more victim memory cell rows which are physically adjacent to a memory cell row corresponding to the hammer address (HADDR).