Semiconductor memory device and memory system including same

Abstract

The invention discloses a semiconductor memory device and a memory system including the same. The semiconductor memory device includes a memory cell array, an error correction code (ECC) engine, an error check and wash (ECS) circuit, a row hammer management circuit, and a refresh control circuit. The ECC engine generates an error generation signal based on a result of the ECC decoding. The ECS circuit generates cleaning addresses and outputs at least one of the cleaning addresses as an error address based on the error generation signal. The row hammer management circuit stores an error flag having a first logic level in a counting unit, compares a count value with a different reference number based on the logic level of the error flag, and outputs a hammer address. The refresh control circuit receives the hammer address and performs a hammer refresh operation on one or more sacrificial memory cell rows physically adjacent to the memory cell row corresponding to the hammer address.

Description

[0001] This application claims the priority of Korean Patent Application No. 10-2023-0088262 filed on July 7, 2023 in the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0002] The present disclosure relates to a memory, and more particularly, to a semiconductor memory device for preventing row hammering and a memory system including the semiconductor memory device. Background Art

[0003] Semiconductor memory devices may be classified as volatile memory devices or nonvolatile memory devices. Volatile memory devices refer to memory devices that lose data stored therein when power is turned off. As an example of a volatile memory device, a dynamic random access memory (DRAM) may be used in various devices such as mobile systems, servers, or graphics devices.

[0004] In a volatile memory device such as a DRAM device, the cell charge stored in the memory cell may be lost due to leakage current. In addition, when the word line is frequently switched between the activated state and the precharged state (i.e., when the word line has been densely or frequently accessed), the affected memory cells connected to the word line adjacent to the frequently accessed word line may lose the stored charge. The charge stored in the memory cell can be maintained by recharging before the data is lost due to leakage of the cell charge. Such recharging of the cell charge is called a refresh operation, and the refresh operation can be repeatedly performed before the cell charge is significantly lost. Summary of the invention

[0005] Example embodiments may provide a semiconductor memory device capable of defending against a row hammering attack by storing hammering addresses at different reference times based on degradation of a memory cell.

[0006] Furthermore, example embodiments may provide a memory system including a semiconductor memory device capable of defending against a row hammering attack by storing hammering addresses at different reference times based on degradation of a memory cell.

[0007] According to an aspect of an example embodiment, a semiconductor memory device includes: a memory cell array including a plurality of memory cell rows, each of the plurality of memory cell rows including a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array, and generate an error generation signal based on the ECC decoding; an error checking and scrubbing (ECS) circuit configured to: generate a scrubbing address for performing a scrubbing operation in an ECS mode, and output at least one of the scrubbing addresses as an error address based on the error generation signal; and a row hammering management circuit configured to: store an error flag having a first logic level in each of one or more adjacent memory cell rows for storing a count in the ECS mode. In a portion of a counting unit of count data, the one or more adjacent memory cell rows are physically adjacent to a weak memory cell row corresponding to an error address among the multiple memory cell rows; and in a normal mode, a count value indicating the number of accesses associated with each of the multiple memory cell rows is compared with a different reference number of times based on an error flag to provide a comparison, and a hammer address of a first memory cell row that is densely accessed among the multiple memory cell rows is specified based on the comparison output; and a refresh control circuit is configured to: receive the hammer address, and perform a hammer refresh operation on one or more victim memory cell rows, the one or more victim memory cell rows being physically adjacent to the first memory cell row corresponding to the hammer address.

[0008] According to an aspect of an example embodiment, a memory system includes: a semiconductor memory device; and a memory controller configured to control the semiconductor memory device, wherein the semiconductor memory device includes: a memory cell array including a plurality of memory cell rows, each of the plurality of memory cell rows including a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array, and generate an error generation signal based on the ECC decoding; an error checking and scrubbing (ECS) circuit configured to: generate a scrubbing address for performing a scrubbing operation in a scrubbing mode, and output at least one of the scrubbing addresses as an error address based on the error generation signal; and a row hammering management circuit configured to: store an error flag having a first logic level in an ECS mode. a portion of a counting cell for storing counting data in each of one or more adjacent memory cell rows, the one or more adjacent memory cell rows being physically adjacent to a weak memory cell row corresponding to an error address among the multiple memory cell rows; and in a normal mode, comparing a count value indicating a number of accesses associated with each of the multiple memory cell rows with a different reference number of accesses based on a logic level of an error flag to provide a comparison, and specifying a hammer address of a first memory row that is densely accessed among the multiple memory cell rows based on the comparison output; and a refresh control circuit configured to: receive the hammer address, and perform a hammer refresh operation on one or more victim memory cell rows, the one or more victim memory cell rows being physically adjacent to a first memory cell row corresponding to the hammer address.

[0009] According to an aspect of an example embodiment, a semiconductor memory device includes: a memory cell array including a plurality of memory cell rows, each of the plurality of memory cell rows including a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array, and generate an error generation signal based on the ECC decoding; an error checking and scrubbing (ECS) circuit configured to: generate a scrubbing address for performing a scrubbing operation in a scrubbing mode, and output at least one of the scrubbing addresses as an error address based on the error generation signal; and a row hammering management circuit configured to: in an ECS mode, store an error flag having a first logic level in a portion of a counting unit for storing count data of each of one or more adjacent memory cell rows, the one or more adjacent memory cell rows being physically adjacent to a weak memory cell row corresponding to the error address among the plurality of memory cell rows, and in a normal mode, based on the error generation signal. The logic level of the error flag compares a count value indicating the number of accesses associated with each of the plurality of memory cell rows with a different reference number to provide a comparison, and specifies a hammer address of a densely accessed memory cell row among the plurality of memory cell rows based on the comparison output; and a refresh control circuit configured to: receive a hammer address, and perform a hammer refresh operation on one or more victim memory cell rows, the one or more victim memory cell rows being physically adjacent to the memory cell row corresponding to the hammer address, wherein the row hammer management circuit is further configured to: receive an error address in an ECS mode, sequentially access a first adjacent memory cell row and a second adjacent memory cell row, the first adjacent memory cell row and the second adjacent memory cell row being physically adjacent to the weak memory cell row corresponding to the error address, and store an error flag having a first logic level in a corresponding counting cell of each of the first adjacent memory cell row and the second adjacent memory cell row. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Example embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings, in which:

[0011] Figure 1 is a block diagram illustrating a memory system according to one or more example embodiments;

[0012] Figure 2 is a diagram showing a method according to one or more example embodiments Figure 1 A block diagram of a memory controller in FIG.

[0013] Figure 3 is a diagram showing a method according to one or more example embodiments Figure 1 A block diagram of an example of a semiconductor memory device in;

[0014] Figure 4 Show Figure 3 An example of a first memory bank array in a semiconductor memory device;

[0015] Figure 5 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of an ECS circuit in FIG.

[0016] Figure 6 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of a refresh control circuit in;

[0017] Figure 7 is a diagram showing a method according to one or more example embodiments Figure 6 A circuit diagram of an example of a refresh clock generator shown in FIG.

[0018] Figure 8 is a diagram showing a method according to one or more example embodiments Figure 6 A circuit diagram of another example of a refresh clock generator in;

[0019] Fig. 9 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of a row hammer management circuit in a semiconductor memory device;

[0020] Fig.10 According to one or more example embodiments, Fig. 9 An example of a hammer address queue in a row hammer management circuit of;

[0021] Fig.11A According to an example embodiment, Figure 4 memory cells in a first memory bank array;

[0022] Fig. 11B , Fig. 11C and Fig.11D illustrating a cleaning operation and a refreshing operation according to an example embodiment, respectively;

[0023] Fig.12 is a diagram showing a method according to one or more example embodiments Fig.10 A timing diagram of an example operation of a hammer address queue;

[0024] Fig.13 is a diagram showing a method according to one or more example embodiments Fig.10 A timing diagram of an example operation of a hammer address queue;

[0025] Fig.14 According to one or more example embodiments, Figure 3 a first memory bank array and a first sense amplifier in a semiconductor memory device;

[0026] Fig.15 According to one or more example embodiments, Fig.14 a portion of a first memory bank array in;

[0027] Fig.16 Shows the ECS mode Figure 3 a portion of a semiconductor memory device;

[0028] Fig.17 The following table shows the operation of writing Figure 3 A portion of a semiconductor memory device;

[0029] Fig.18 The following table shows the operation used to explain the read operation. Figure 3 A portion of a semiconductor memory device;

[0030] Fig.19 is a diagram showing a method according to one or more example embodiments Fig.16 , Fig.17 or Fig.18 A block diagram of an example of an ECC engine in a semiconductor memory device;

[0031] Fig. 20 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of a first memory bank array in;

[0032] Fig.21 and Fig. 22 Shown can be used Figure 1 Example commands in a memory system of:

[0033] Fig.23A and Fig. 23B An example of a command protocol of a memory system when the memory system uses an activation count update command is respectively shown;

[0034] Fig.24A and Fig. 24B An example of a command protocol of a memory system when a semiconductor memory device performs an activation count update operation internally is respectively shown;

[0035] Fig.25A An example of a command protocol of a memory system is shown when the memory system updates count data based on a precharge command;

[0036] Fig.25B An example of a command protocol of a memory system is shown when a semiconductor memory device updates count data within an activation time to a precharge time;

[0037] Fig.26is a diagram showing a portion of a memory cell array for describing generation of a hammer refresh address;

[0038] Fig. 27 is a diagram showing a portion of a memory cell for describing generation of a hammer refresh address in response to a second type of hammer address;

[0039] Fig.28A , Fig.28B and Fig.29 is a diagram showing a method according to one or more example embodiments Figure 6 A timing diagram of an example operation of a refresh control circuit;

[0040] Fig.30 is a block diagram illustrating a semiconductor memory device according to one or more exemplary embodiments;

[0041] Fig.31 is a configuration diagram showing a semiconductor package including a stacked memory device according to one or more exemplary embodiments; and

[0042] Fig.32 is a block diagram illustrating a memory system having four ranks of memory modules according to one or more example embodiments. DETAILED DESCRIPTION

[0043] Hereinafter, various example embodiments of the present disclosure will be described more fully with reference to the accompanying drawings, in which example embodiments are shown.

[0044] Figure 1 is a block diagram illustrating a memory system according to one or more example embodiments.

[0045] Reference Figure 1 , the memory system 20 may include a memory controller 30 and a semiconductor memory device 200 .

[0046] The memory controller 30 may control the overall operation of the memory system 20. The memory controller 30 may control the overall data exchange between the external host and the semiconductor memory device 200. For example, the memory controller 30 may write data into the semiconductor memory device 200 or read data from the semiconductor memory device 200 in response to a request from the host.

[0047] In addition, the memory controller 30 may issue an operation command to the semiconductor memory device 200 to control the semiconductor memory device 200. In an example embodiment, the semiconductor memory device 200 is a memory device including a dynamic memory cell such as a dynamic random access memory (DRAM), a double data rate 5 (DDR5) synchronous DRAM (SDRAM), a DDR6 SDRAM, etc.

[0048] The memory controller 30 may send a clock signal CK (the clock signal CK may be referred to as a command clock signal), a command CMD, and an address (signal) ADDR to the semiconductor memory device 200. Here, for ease of description, the singular terms clock signal CK, command CMD, and address ADDR and the plural terms clock signal CK, command CMD, and address ADDR may be used interchangeably. When the memory controller 30 writes the data signal DQ into the semiconductor memory device 200, the memory controller 30 may send a data strobe signal DQS to the semiconductor memory device 200. When the memory controller 30 reads the data signal DQ from the semiconductor memory device 200, the semiconductor memory device 200 may send the data strobe signal DQS to the memory controller 30. The address ADDR may be accompanied by the command CMD, and the address ADDR may be referred to as an access address.

[0049] The memory controller 30 may include a central processing unit (CPU) 35 controlling overall operations of the memory controller 30 , and refresh management (RFM) control logic 100 for refresh management commands associated with row hammering of a plurality of memory cell rows of the semiconductor memory device 200 .

[0050] The semiconductor memory device 200 may include a memory cell array 310 storing a data signal DQ, a control logic circuit 210 , an error checking and cleaning (or scrubbing) (ECS) circuit 330 , and a row hammering (RH) management circuit 500 .

[0051] The control logic circuit 210 may control the operation of the semiconductor memory device 200. The memory cell array 310 may include a plurality of memory cell rows, and each memory cell row may include a plurality of (volatile) memory cells.

[0052] In the ECS mode, the ECS circuit 330 may generate wash addresses for performing a wash operation in the wash mode, and output at least one of the wash addresses as an error address EADDR based on a result of the wash operation.

[0053] In the ECS mode, the row hammer management circuit 500 may store an error flag having a first logic level in a portion of a counting unit for storing count data of each of one or more adjacent memory cell rows, and in the normal mode, the row hammer management circuit 500 may store count data in a counting unit of each of a plurality of memory cell rows by counting the number of accesses to each of the memory cell rows based on an activation command from the memory controller 30, the one or more adjacent memory cell rows being physically adjacent to a weak memory cell row corresponding to an error address among the plurality of memory cell rows. In the normal mode, the row hammer management circuit 500 may compare a count value indicating the number of accesses associated with each of the plurality of memory cell rows with different reference numbers based on the logic level of the error flag, and output a hammer address specifying a densely accessed memory cell row among the plurality of memory cell rows based on a result of the comparison.

[0054] In response to a subsequent command applied after the activate command (such as an activate count update command or a precharge command), the row hammer management circuit 500 may perform an internal read-update-write operation to read count data from a target memory cell row among multiple memory cell rows, update the read count data, and write the updated count data to the target memory cell row.

[0055] The row hammer management circuit 500 may perform an internal read-update-write operation based on a flag of a precharge command applied after applying an activate command or when a reference time interval has passed since applying the activate command, and the control logic circuit 210 may precharge a target memory cell row.

[0056] The control logic circuit 210 may control access to the memory cell array 310 , and may control the ECS circuit 330 and the row hammer management circuit 500 .

[0057] Due to the charge leakage of the memory cell storing data, the semiconductor memory device 200 periodically performs a refresh operation. As the scale of the manufacturing process of the semiconductor memory device 200 is reduced, the storage capacitance of the memory cell is reduced and the refresh cycle is shortened. Because the entire refresh time increases as the storage capacity of the semiconductor memory device 200 increases, the refresh cycle is further shortened.

[0058] In order to compensate for the degradation of adjacent memory cells due to intensive accesses to a specific row or hammer address, a target row refresh (TRR) scheme is adopted and an in-memory refresh scheme is developed to reduce the burden on the memory controller. In the TRR scheme, the memory controller is fully responsible for the hammer refresh operation, and in the in-memory refresh scheme, the semiconductor memory device is fully responsible for the hammer refresh operation.

[0059] As memory capacity increases and demand for low power consumption of semiconductor memory devices increases, chip size overhead for in-memory refresh may be severe. In addition, because semiconductor memory devices must take care of hammer refresh operations even if there is no intensive access, power consumption may increase. In addition, row hammering of a memory cell row selected from a plurality of memory cell rows is managed.

[0060] In the memory system 20 according to one or more example embodiments, the row hammer management circuit 500 counts each of the activation numbers associated with a plurality of memory cell rows to store the count value as count data in the count unit of each of the plurality of memory cell rows and can manage the row hammer of all memory cell rows based on the count value, and at the same time, the semiconductor memory device 200 stores an error flag having a first logic level in the count unit of an adjacent memory cell row physically adjacent to a weak memory cell row corresponding to an error address obtained in a cleaning operation. When updating the count data of the adjacent memory cell row, when the error flag has the first logic level, the updated count data of the adjacent memory cell row is stored in a hammer address queue, or the address of the adjacent memory cell row is output as a hammer address by comparing the updated count data with a smaller reference number of times. Therefore, the weak memory cell row is refreshed faster than a normal memory cell row.

[0061] Figure 2 is a diagram showing a method according to one or more example embodiments Figure 1 Block diagram of the memory controller in .

[0062] Reference Figure 2 , the memory controller 30 may include a CPU 35 , an RFM control logic 100 , a refresh logic 40 , a host interface 50 , a scheduler 55 , and a memory interface 60 , which are connected to each other through a bus 31 .

[0063] The CPU 35 may control the overall operation of the memory controller 30. The CPU 35 may control the RFM control logic 100, the refresh logic 40, the host interface 50, the scheduler 55, and the memory interface 60 through the bus 31.

[0064] The refresh logic 40 may generate an auto refresh command for refreshing memory cells of a plurality of memory cell rows based on a refresh interval of the semiconductor memory device 200 .

[0065] The host interface 50 may perform an interface connection with a host. The memory interface 60 may perform an interface connection with the semiconductor memory device 200.

[0066] The scheduler 55 may manage the scheduling and sending of the sequence of commands generated in the memory controller 30. The scheduler 55 may send the activation command and subsequent commands to the semiconductor memory device 200 via the memory interface 60, and the semiconductor memory device 200 may update the activation count of each of the memory cell rows to manage the row hammering of all memory cell rows.

[0067] The RFM control logic 100 may apply a refresh management command to the semiconductor memory device 200 through the memory interface 60 in response to a conversion of the alarm signal ALRT from the semiconductor memory device 200, so that the semiconductor memory device 200 performs a row hammering refresh operation on one or more victim memory cell rows that are physically adjacent to the memory cell row corresponding to the hammering address.

[0068] Figure 3 is a diagram showing a method according to one or more example embodiments Figure 1 A block diagram of an example of a semiconductor memory device in FIG.

[0069] Reference Figure 3 , the semiconductor memory device 200 may include a control logic circuit 210, an address register 220, a memory bank control logic 230, a refresh control circuit 400, a row address multiplexer (RA MUX) 240, a column address (CA) latch 250, a row decoder 260, a column decoder 270, a memory cell array 310, a sense amplifier unit 285, an I / O gating circuit 290, an error correction code (ECC) engine 350, a clock buffer 225, a selection signal generator 235, an ECS circuit 330, a row hammer management circuit 500, and a data I / O buffer 320.

[0070] The memory cell array 310 may include first to sixteenth memory cell arrays 310a-310p. The row decoder 260 may include first to sixteenth row decoders 260a-260p coupled to the first to sixteenth memory cell arrays 310a-310p, respectively, the column decoder 270 may include first to sixteenth column decoders 270a-270p coupled to the first to sixteenth memory cell arrays 310a-310p, respectively, and the sense amplifier unit 285 may include first to sixteenth sense amplifiers 285a-285p coupled to the first to sixteenth memory cell arrays 310a-310p, respectively.

[0071] The first to sixteenth memory bank arrays 310a-310p, the first to sixteenth row decoders 260a-260p, the first to sixteenth column decoders 270a-270p, and the first to sixteenth sense amplifiers 285a-285p may form the first to sixteenth memory bank arrays 310a-310p. Each of the first to sixteenth memory bank arrays 310a-310p includes a plurality of memory cells MC formed at intersections of a plurality of word lines WL and a plurality of bit lines BTL.

[0072] The address register 220 may receive an address ADDR including a bank address BANK_ADDR, a row address ROW_ADDR, and a column address COL_ADDR from the memory controller 30. The address register 220 may provide the received bank address BANK_ADDR to the bank control logic 230, may provide the received row address ROW_ADDR to the row address multiplexer 240, and may provide the received column address COL_ADDR to the column address latch 250. In addition, the address register 220 may provide the received bank address BANK_ADDR and the received row address ROW_ADDR to the row hammering management circuit 500.

[0073] The bank control logic 230 may generate a bank control signal in response to the bank address BANK_ADDR. One of the first to sixteenth row decoders 260a-260p corresponding to the bank address BANK_ADDR is activated in response to the bank control signal, and one of the first to sixteenth column decoders 270a-270p corresponding to the bank address BANK_ADDR is activated in response to the bank control signal.

[0074] The row address multiplexer 240 may receive the row address ROW_ADDR from the address register 220, and may receive the refresh row address REF_ADDR from the refresh control circuit 400. The row address multiplexer 240 may selectively output the row address ROW_ADDR or the refresh row address REF_ADDR as the row address RA. The row address RA output from the row address multiplexer 240 is applied to the first to sixteenth row decoders 260a-260p.

[0075] The refresh control circuit 400 may sequentially increase or decrease the refresh row address REF_ADDR in the normal refresh mode in response to the first refresh control signal IREF1 and the second refresh control signal IREF2 from the control logic circuit 210. The refresh control circuit 400 may receive the hammer address HADDR in the hammer refresh mode, and may output one or more hammer refresh addresses designating one or more victim memory cell rows that are physically adjacent to the memory cell row corresponding to the hammer address as the refresh row address REF_ADDR.

[0076] One of the first to sixteenth row decoders 260a-260p activated by the bank control logic 230 may decode the row address RA output from the row address multiplexer 240 and may activate a word line corresponding to the row address RA. For example, the activated bank row decoder applies a word line driving voltage to the word line corresponding to the row address.

[0077] The column address latch 250 may receive the column address COL_ADDR from the address register 220 and may temporarily store the received column address COL_ADDR. In one or more embodiments, in the burst mode, the column address latch 250 may generate a column address COL_ADDR' incremented from the received column address COL_ADDR. The column address latch 250 may apply the temporarily stored or generated column address COL_ADDR' to the first to sixteenth column decoders 270a-270p.

[0078] An activated one of the first to sixteenth column decoders 270 a ˜ 270 p activates a sense amplifier corresponding to the bank address BANK_ADDR and the column address COL_ADDR through the I / O gating circuit 290 .

[0079] The I / O gating circuit 290 may include a circuit system for gating input / output data, and may also include input data mask logic, a read data latch for storing data output from the first memory array to the sixteenth memory array 310a~310p, and a write driver for writing data to the first memory array to the sixteenth memory array 310a~310p.

[0080] The code word CW (eg, Fig.18 The read codeword RCW in the read data latch is sensed by a sense amplifier coupled to a selected one of the memory bank arrays from which data is to be read, and is stored in the read data latch. After the ECC engine 350 performs ECC decoding on the codeword CW, the codeword CW stored in the read data latch may be used as data DTA (e.g., Fig.18 The corrected data C_DTA in the memory is provided to the data I / O buffer 320. The data I / O buffer 320 may convert the data DTA into a data signal DQ, and may transmit the data signal DQ to the memory controller 30 together with a data strobe signal DQS.

[0081] The data signal DQ to be written into a selected one of the first to sixteenth memory bank arrays 310a-310p may be provided from the memory controller 30 to the data I / O buffer 320. The data I / O buffer 320 may convert the data signal DQ into data DTA and may provide the data DTA to the ECC engine 350. The ECC engine 350 may perform ECC encoding on the data DTA to generate parity bits, and the ECC engine 350 may provide a codeword CW including the data DTA and the parity bits to the I / O gating circuit 290. The I / O gating circuit 290 may write the codeword CW into a subpage in the selected one of the memory bank arrays through a write driver.

[0082] The data I / O buffer 320 may provide the data signal DQ from the memory controller 30 to the ECC engine 350 by converting the data signal DQ to the data DTA in a write operation of the semiconductor memory device 200, and may convert the data DTA from the ECC engine 350 to the data signal DQ in a read operation of the semiconductor memory device 200 and may send the data signal DQ and a data selection signal DQS to the memory controller 30.

[0083] The ECC engine 350 may perform ECC encoding on the data DTA and may perform ECC decoding on the codeword CW based on the second control signal CTL2 from the control logic circuit 210. The ECC engine 350 may perform ECC encoding and ECC decoding on the count data CNTD provided from the row hammer management circuit 500 based on the second control signal CTL2 from the control logic circuit 210.

[0084] The clock buffer 225 may receive the clock signal CK, may generate an internal clock signal ICK by buffering the clock signal CK, and may provide the internal clock signal ICK to a circuit component processing a command CMD and an address ADDR.

[0085] The strobe signal generator 235 may receive the clock signal CK, may generate a data strobe signal DQS based on the clock signal CK, and may provide the data strobe signal DQS to the data I / O buffer 320 .

[0086] The ECS circuit 330 may generate a cleaning address ECS_ADDR for performing a cleaning operation in the ECS mode and may sequentially provide the cleaning address ECS_ADDR to the row decoder 260 and the column decoder 270. Each of the cleaning addresses ECS_ADDR may include a cleaning row address SRA and a cleaning column address SCA based on the fourth control signal CTL4 from the control logic circuit 210.

[0087] The ECC engine 350 may perform a scrubbing operation to perform ECC decoding on data read from a first memory cell row specified by one of the scrubbing addresses ECS_ADDR in units of codewords based on the scrubbing row address SRA and the scrubbing column address SCA, so as to detect an error bit in an ECS mode based on a second control signal CTL2, correct the error bit, and write the corrected codeword back to a corresponding memory location of the first memory cell row. The ECC engine 350 may generate an error generation signal EGS based on a result of the ECC decoding when an error bit is detected, and may provide the error generation signal EGS to the ECS circuit 330.

[0088] In the ECS mode, the ECS circuit 330 may provide at least one of the cleaning addresses ECS_ADDR as the error address EADDR to the row hammer management circuit 500 based on the error generation signal EGS.

[0089] When the number of error bits detected in units of codewords is equal to or greater than a first number, the ECS circuit 330 may provide the cleaning address ECS_ADDR as the error address EADDR to the row hammer management circuit 500 based on the error generation signal EGS. The first number may be a positive integer.

[0090] In the ECS mode, the row hammer management circuit 500 may store an error flag having a first logic level in a portion of a counting cell for storing counting data in each of one or more adjacent memory cell rows that are physically adjacent to a weak memory cell row corresponding to an error address among multiple memory cell rows.

[0091] The row hammer management circuit 500 may count the number of accesses associated with each of the plurality of memory cell rows based on the access address ADDR including the row address ROW_ADDR and the bank address BANK_ADDR accompanied by the activation command from the memory controller 30 to store the count value as count data CNTD in the count unit of each of the plurality of memory cell rows. In the normal mode, the row hammer management circuit 500 may compare the count value indicating the number of accesses associated with each of the plurality of memory cell rows with different reference numbers based on the logic level of the error flag, may store one or more candidate hammer addresses that are intensively accessed among the plurality of memory cell rows in a hammer address queue in the row hammer management circuit 500 based on the comparison result, and may output one of the one or more candidate hammer addresses as the hammer address HADDR to the refresh control circuit 400.

[0092] The row hammering management circuit 500 may provide the address of the intensively accessed memory cell row as a hammering address HADDR to the refresh control circuit 400 based on the result of the comparison.

[0093] When the row hammer management circuit 500 outputs the hammer address HADDR, the row hammer management circuit 500 may change the logic level of the alarm signal ALRT output to the memory controller 30 through the pad 201 .

[0094] The control logic circuit 210 may control the operation of the semiconductor memory device 200. For example, the control logic circuit 210 may generate control signals for the semiconductor memory device 200 to perform a write operation, a read operation, a normal refresh operation, and a hammer refresh operation. The control logic circuit 210 may include a command decoder 211 that decodes a command CMD received from the memory controller 30, and a mode register 212 that sets an operation mode of the semiconductor memory device 200.

[0095] For example, the command decoder 211 may generate a control signal corresponding to the command CMD by decoding a write enable signal, a row address strobe signal, a column address strobe signal, a chip select signal, etc. The control logic circuit 210 may provide a first control signal CTL1 to the I / O gating circuit, a second control signal CTL2 to the ECC engine 350, a third control signal CTL3 to the row hammering management circuit 500, and a fourth control signal CTL4 to the ECS circuit 330. In addition, the command decoder 211 may generate internal command signals by decoding the command CMD, and the internal command signals include a first refresh control signal IREF1, a second refresh control signal IREF2, an activation signal IACT1, a precharge signal IPRE, a read signal IRD, and a write signal IWR.

[0096] Figure 4 Show Figure 3 An example of a first memory bank array in a semiconductor memory device.

[0097] Reference Figure 4 , the first memory bank array 310a includes a plurality of word lines WL0~WLm-1 (m is a natural number greater than 2), a plurality of bit lines BTL0~BTLn-1 (n is a natural number greater than 2), and a plurality of memory cells MC arranged at intersections between the word lines WL0~WLm-1 and the bit lines BTL0~BTLn-1. Each of the memory cells MC includes a cell transistor coupled to one of the word lines WL0~WLm-1 and one of the bit lines BTL0~BTLn-1 and a cell capacitor coupled to the cell transistor. Each of the memory cells MC may have a DRAM cell structure. Each of the word lines WL0~WLm-1 extends in a first direction D1, and each of the bit lines BTL0~BTLn-1 extends in a second direction D2 intersecting the first direction D1.

[0098] The word lines WL0 ˜ WLm- 1 coupled to the plurality of memory cells MC may be referred to as rows of the first bank array 310 a , and the bit lines BTL0 ˜ BTLn- 1 coupled to the plurality of memory cells MC may be referred to as columns of the first bank array 310 a .

[0099] Figure 5 According to one or more example embodiments Figure 3 A block diagram of an example of an ECS circuit.

[0100] Reference Figure 5 The ECS circuit 330 may include an ECS address counter 335 , an error counter 337 , a comparator 340 , and an error address generator 345 .

[0101] The ECS address counter 335 may generate the clean addresses ECS_ADDR by sequentially increasing or decreasing the clean addresses ECS_ADDR based on the ECS mode signal included in the fourth control signal CTL4. Each of the clean addresses ECS_ADDR may include a clean row address SRA and a clean column address SCA.

[0102] In the ECS mode, the error counter 337 may generate an error count value ECV by counting the error generation signal EGS provided from the ECC engine 320. The comparator 340 may generate a comparison signal CS1 that compares the error count value ECV with the reference error number ETH1. In response to the error count value ECV being equal to or greater than the reference error number ETH1, the comparator 340 may generate the comparison signal CS1 having a first logic level (i.e., a logic high level). In response to the error count value ECV being less than the reference error number ETH1, the comparator 340 may generate the comparison signal CS1 having a second logic level (i.e., a logic low level).

[0103] The error address generator 345 may store a corresponding cleaning address in the cleaning address ECS_ADDR, and selectively output the stored cleaning address ECS_ADDR as the error address EADDR based on the comparison signal CS1. Based on the result of ECC decoding of the cleaning target memory cell row specified by the cleaning address, when the number of error bits equal to or greater than the reference error number ETH1 is detected in the codeword of the cleaning target memory cell row, the error address generator 345 may output the stored cleaning address ECS_ADDR as the error address EADDR in response to the comparison signal indicating that the error count value ECV is equal to or greater than the reference error number ETH1. The error address generator 345 may provide the error address EADDR to the Figure 3 The row hammer management circuit 500 in.

[0104] Figure 6 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of a refresh control circuit in FIG.

[0105] Reference Figure 6 , the refresh control circuit 400 may include a refresh control logic 410 , a refresh clock generator 420 , a refresh counter 430 , and a hammer refresh address generator 440 .

[0106] The refresh control logic 410 may provide the mode signal MS1 in response to the refresh management signal RFMS. In addition, the refresh control logic 410 may provide the hammer refresh signal HREF to the hammer refresh address generator 440 in response to one of the first refresh control signal IREF1 and the second refresh control signal IREF2 to control the output timing of the hammer address.

[0107] Figure 3 The control logic circuit 210 in the memory may provide a refresh management signal RFMS to the refresh control circuit 400 based on a refresh management command from the memory controller 30 .

[0108] The refresh clock generator 420 may generate a refresh clock signal RCK indicating a timing of a normal refresh operation based on the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS1. The refresh clock generator 420 may generate the refresh clock signal RCK in response to receiving the first refresh control signal IREF1 or during activation of the second refresh control signal IREF2.

[0109] When the command CMD from the memory controller 30 corresponds to an auto-refresh command, each time the control logic circuit 210 receives the auto-refresh command, Figure 3 The control logic circuit 210 in the memory controller 30 may apply the first refresh control signal IREF1 to the refresh control circuit 400. When the command CMD from the memory controller 30 corresponds to a self-refresh entry command, the control logic circuit 210 may apply the second refresh control signal IREF2 to the refresh control circuit 400, and the second refresh control signal IREF2 is activated from the time point when the control logic circuit 210 receives the self-refresh entry command to the time point when the control logic circuit 210 receives the self-refresh exit command.

[0110] The refresh counter 430 may generate a counter refresh address CREF_ADDR that sequentially specifies a memory cell row by performing a counting operation in a cycle of a refresh clock signal RCK, and may provide the counter refresh address CREF_ADDR as a refresh row address REF_ADDR to the memory cell row. Figure 3 The row address multiplexer 240 in.

[0111] The hammer refresh address generator 440 may include a hammer address storage 450 and a mapper 460 .

[0112] The hammer address storage device 450 may store the hammer address HADDR and may output the hammer address HADDR to the mapper 460 in response to the hammer refresh signal HREF. The mapper 460 may generate a hammer refresh address HREF_ADDR that specifies one or more victim memory cell rows physically adjacent to the memory cell row corresponding to the hammer address HADDR.

[0113] The hammer refresh address generator 440 may provide the hammer refresh address HREF_ADDR as the refresh row address REF_ADDR to the Figure 3 The row address multiplexer 240 in.

[0114] Figure 7 is a diagram showing a method according to one or more example embodiments Figure 6 A circuit diagram of an example of a refresh clock generator is shown in FIG.

[0115] Reference Figure 7, the refresh clock generator 420a may include a plurality of oscillators (oscillator A) 421, (oscillator B) 422, and (oscillator C) 423, a multiplexer 424, and a decoder 425a. The decoder 425a may decode the first refresh control signal IREF1, the second refresh control signal IREF2, and the mode signal MS1 to output the clock control signal RCS1. The oscillators 421, 422, and 423 generate refresh clock signals RCK1, RCK2, and RCK3 having different periods. The multiplexer 424 selects one of the refresh clock signals RCK1, RCK2, and RCK3 in response to the clock control signal RCS1 to provide the refresh clock signal RCK.

[0116] Because the mode signal MS1 indicates that a row thumping event occurs, the refresh clock generator 420a may adjust the refresh period by selecting one of the refresh clock signals RCK1, RCK2, and RCK3.

[0117] Figure 8 is a diagram showing a method according to one or more example embodiments Figure 6 A circuit diagram of another example of a refresh clock generator in FIG.

[0118] Reference Figure 8 , the refresh clock generator 420b may include a decoder 425b, a bias unit 426, and an oscillator 427. The oscillator 427 may include a plurality of delay units connected in series. Each of the plurality of delay units may be connected between a power supply voltage Vcc and a ground voltage VSS, and each of the plurality of delay units may include a p-channel metal oxide semiconductor (PMOS) transistor, a buffer, and an n-channel metal oxide semiconductor (NMOS) transistor connected in series between the power supply voltage Vcc and the ground voltage VSS.

[0119] The decoder 425b may decode the first refresh control signal IREF1, the second refresh control signal IREF2 and the mode signal MS1 to output the clock control signal RCS2. The bias unit 426 generates a control voltage VCON in response to the clock control signal RCS2. The oscillator 427 generates a refresh clock signal RCK having a variable period according to the control voltage VCON applied to the gates of the PMOS transistor and the NMOS transistor.

[0120] Because the mode signal MS1 indicates that the refresh management signal RFMS has been received (ie, a row hammering event has occurred), the refresh clock generator 420b may adjust the refresh period by changing the period of the refresh clock signal RCK based on the clock control signal RCS2.

[0121] Fig. 9 is a diagram showing a method according to one or more example embodiments Figure 3A block diagram of an example of a row hammer management circuit in a semiconductor memory device.

[0122] Reference Fig. 9 The row hammer management circuit 500 may include an adder 510 , a comparator 520 , a register 530 , a multiplexer 535 , a first demultiplexer 537 , a second demultiplexer 539 , a neighboring address generator 540 , an error flag control circuit 550 , and a hammer address queue 600 .

[0123] The neighboring address generator 540 may receive the error address EADDR in the ECS mode, may generate at least one neighboring address ADJ_ADDR based on the error address EADDR, and may provide the at least one neighboring address ADJ_ADDR to the error flag control circuit 550, the at least one neighboring address ADJ_ADDR specifying at least one neighboring memory cell row physically adjacent to the weak memory cell row corresponding to the error address EADDR. The at least one neighboring address ADJ_ADDR may include a first neighboring address ADJ_ADDR1 and a second neighboring address ADJ_ADDR2.

[0124] The error flag control circuit 550 may sequentially access a first adjacent memory cell row and a second adjacent memory cell row physically adjacent to the weak memory cell row based on the first adjacent address ADJ_ADDR1 and the second adjacent address ADJ_ADDR2, and may store an error flag EF having a first logic level ('H') in a counting unit of each of the first adjacent memory cell row and the second adjacent memory cell row.

[0125] The adder 510 can update the count data CNTD read from the count unit of the target memory cell row by increasing the count data CNTD read from the count unit of the target memory cell row and subjected to the ECC decoding operation by one to provide updated count data UCNTD. The adder 510 can update the read count data CNTD. The adder 510 can be implemented with an up-counter.

[0126] In one or more example embodiments, the adder 510 may provide the updated count data UCNTD to the comparator 520 .

[0127] The updated count data UCNTD is provided to the ECC engine 350, and the ECC engine 350 performs an ECC encoding operation on the updated count data UCNTD.

[0128] The register 530 may store a first reference number NTH1 and a second reference number NTH2 which is smaller than the first reference number NTH1.

[0129] The multiplexer 535 may provide one of the first reference number NTH1 and the second reference number NTH2 as the selected reference number SNTH to the comparator 520 based on the logic level of the error flag EF read from a portion of the counting unit of the target memory cell row. In response to the error flag EF having the second logic level, the multiplexer 535 may provide the first reference number NTH1 as the selected reference number SNTH to the comparator 520. In response to the error flag EF having the first logic level, the multiplexer 535 may provide the second reference number NTH2 as the selected reference number SNTH to the comparator 520.

[0130] The comparator 520 may compare the read count data CNTD or the updated count data UCNTD with the selected reference number SNTH to output a comparison signal CS2 indicating a result of the comparison. When the read count data CNTD is equal to or greater than the selected reference number SNTH, the comparator 520 may activate the comparison signal CS2.

[0131] The first reference number NTH1 may include a first default reference number and a multiple of the first default reference number, and the second reference number NTH2 may include a second default reference number and a multiple of the second default reference number. Therefore, the comparison signal CS2 may include a plurality of bits.

[0132] The first demultiplexer 537 may provide a target row address T_ROW_ADDR specifying a target memory cell row to the second demultiplexer 539 in response to the comparison signal CS2 indicating that the read count data CNTD or the updated count data UCNTD is equal to or greater than the selected reference number SNTH, and may bypass the target row address T_ROW_ADDR to the ground voltage VSS in response to the comparison signal CS2 indicating that the read count data CNTD or the updated count data UCNTD is less than the selected reference number SNTH.

[0133] Based on the mode signal MS2 specifying one of the non-emergency mode and the emergency mode, the second demultiplexer 539 may store the output of the first demultiplexer 537 as the candidate hammer address CHADDR in the hammer address queue 600 in the non-emergency mode, and may provide the output of the first demultiplexer 537 as the first hammer address HADDR1 to the hammer address queue 600 in the emergency mode. Figure 3 The refresh control circuit 400 in FIG.

[0134] The hammer address queue 600 can store candidate hammer addresses and can output one of the candidate hammer addresses as a second hammer address HADDR2 to the Figure 3 The refresh control circuit 400 in FIG.

[0135] The hammer address queue 600 may store the target row address T_ROW_ADDR accessed a number of times equal to or greater than the first reference number NTH1 or the second reference number NTH2 as candidate hammer addresses, and may indicate the state of the hammer address queue 600 as a logic level of the alarm signal ALRT based on the number of candidate hammer addresses stored in the hammer address queue 600.

[0136] When the error flag EF read from the counting unit of the target memory cell row has the first logic level and the target row address T_ROW_ADDR is accessed a number of times equal to or greater than the second reference number of times NTH2, the target row address T_ROW_ADDR may be output as the first hammer address HADDR1 in the emergency mode, and the target row address T_ROW_ADDR may be stored as the candidate hammer address CHADDR in the non-emergency mode in the hammer address queue 600. When the error flag EF read from the counting unit of the target memory cell row has the second logic level and the target row address T_ROW_ADDR is accessed a number of times equal to or greater than the first reference number of times NTH1, the target row address T_ROW_ADDR may be output as the first hammer address HADDR1 in the emergency mode, and the target row address T_ROW_ADDR may be stored as the candidate hammer address CHADDR in the non-emergency mode in the hammer address queue 600.

[0137] Therefore, the error flag EF associated with the adjacent memory cell row physically adjacent to the weak memory cell row in which the number of error bits detected is equal to or greater than the reference error number is stored at the first logic level in the ECS mode, and when the error flag EF has the first logic level in the normal mode, the hammer address is determined by comparing the count data CNTD of the corresponding memory cell row with the second reference number of times, and one or more victim memory cell rows physically adjacent to the memory cell row corresponding to the hammer address are refreshed. Therefore, the weak memory cell row can be refreshed faster than the normal memory cell row.

[0138] Fig.10 According to one or more example embodiments, Fig. 9 An example of a hammer address queue in the row hammer management circuit of FIG.

[0139] Reference Fig.10 , the hammer address queue 600 may include a plurality of first-in-first-out (FIFO) registers 610a, 610b, ..., 610h and a monitor logic 650. The number of the plurality of FIFO registers 610a, 610b, ..., 610h may correspond to the second number.

[0140] The plurality of FIFO registers 610a, 610b, ..., 610h may store a plurality of candidate hammer addresses CHADDRa, CHADDRb, ..., CHADDRh up to a second number from the input terminal IN to the output terminal OUT based on a FIFO scheme.

[0141] The monitor logic 650 may be connected to the plurality of FIFO registers 610a, 610b, ..., 610h, may manage the plurality of FIFO registers 610a, 610b, ..., 610h, and may monitor whether each of the plurality of FIFO registers 610a, 610b, ..., 610h stores a candidate hammer address. In response to the number of candidate hammer addresses stored in the plurality of FIFO registers 610a, 610b, ..., 610h reaching a second number (i.e., in response to the plurality of FIFO registers being full), the monitor logic 650 may output the first input candidate hammer address among all the candidate hammer addresses as the second hammer address HADDR2, and may notify the memory controller 30 of the state of the hammer address queue 600 by converting the logic level of the alarm signal ALRT from the second logic level to the first logic level different from the second logic level in response to the output of the second hammer address HADDR2.

[0142] In response to the transition of the alarm signal ALRT, Figure 2 The memory controller 30 applies the refresh management command to the semiconductor memory device 200, and the monitor logic 650 may convert the alarm signal ALRT to the second logic level in response to completion of the hammer refresh operation based on the hammer address HADDR.

[0143] In one or more example embodiments, the hammer address queue 600 may include a plurality of registers and monitor logic. The plurality of registers may store up to a second number of candidate hammer addresses based on a predetermined priority rather than a FIFO scheme.

[0144] Fig.11A According to one or more example embodiments, Figure 4 of memory cells in a first bank array.

[0145] For example, in Fig.11A , a memory cell coupled to a word line WLa is shown.

[0146] Reference Fig.11A , the normal cell NCS and the counting cell CCS may be coupled to the word line WLa, the data DTA may be stored in or read from the normal cell NCS, and the error flag EF and the counting data CNTD may be stored in or read from the counting cell CCS.

[0147] Fig. 11B, Fig. 11C and Fig.11D A cleaning operation and a refresh operation according to example embodiments are respectively illustrated.

[0148] exist Fig. 11B , Fig. 11C and Fig.11D In each of the word lines WLb, WLc, WLd, and WLe, the normal cell NCS and the counting cell CCS may be coupled to the word lines WLb, WLc, WLd, and WLe.

[0149] Reference Fig. 11B , a part of the counting unit CCS can be allocated to store the error flag EF.

[0150] exist Fig. 11B In the process, the error flag EF may be stored at a second logic level ('L') in a portion of the counting unit CCS coupled to a corresponding one of the word lines WLa, WLb, WLc, and WLd, and the ECS circuit 330 provides the address of the word line WLc as the error address EADDR to the row hammer management circuit 500 based on a result of the cleaning operation.

[0151] Reference Fig. 11C , Fig. 9 The adjacent address generator 540 in the embodiment may generate addresses of word lines WLb and WLd physically adjacent to the address WLc corresponding to the error address EADDR as adjacent addresses ADJ_ADDRa and ADJ_ADDRb, and Fig. 9 The error flag control circuit 550 in the adjacent memory cell rows sequentially accesses adjacent memory cell rows designated by the adjacent addresses ADJ_ADDRa and ADJ_ADDRb, and stores an error flag EF having a first logic level (“H”) in a counting unit of each of the adjacent memory cell rows.

[0152] Reference Fig.11D In the normal mode, when the number of accesses to the memory cell row coupled to the word line WLd becomes equal to or greater than the second reference number NTH2 and the address of the word line WLd is determined as the hammer address HADDRa, the address of the word line WLd is provided to the refresh control circuit 400 as the hammer address HADDRa, and the refresh control circuit 400 outputs the addresses of the word lines WLc and WLe physically adjacent to the word line WLd as the hammer refresh addresses HREF_ADDRa_1 and HREF_ADDRa_2. Therefore, the hammer refresh operation can be performed on the memory cell rows corresponding to the word lines WLc and WLe.

[0153] Therefore, the hammer refresh operation on the word line WLc corresponding to the error address EADDR may be performed based on a reference number less than that of the hammer refresh operation on the word lines WLb and WLd.

[0154] Fig.12 is a diagram showing a method according to one or more example embodiments Fig.10 A timing diagram of an example operation of the hammer address queue.

[0155] exist Fig.12 11 includes three FIFO registers 610a, 610b, ..., 610h, and 610c, and access to the memory cell rows specified by the row address RA=j, the row address RA=k, and the row address RA=l is repeated. In addition, it is assumed that the error flag EF of each of the memory cell rows specified by the row address RA=j, the row address RA=k, and the row address RA=l has a second logic level, and the first reference number NTH1 corresponds to 1024.

[0156] exist Fig.12 In the figure, ACT-j represents an activation command accompanying row address RA=j, PRE-j represents a precharge command for the memory cell row specified by row address RA=j, ACT-k represents an activation command accompanying row address RA=k, PRE-k represents a precharge command for the memory cell row specified by row address RA=k, ACT-l represents an activation command accompanying row address RA=l, and PRE-l represents a precharge command for the memory cell row specified by row address RA=l.

[0157] Refer to Figure 11 and Fig.12 In response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=j reaching 1024, the row address RA=j is stored as a candidate hammer address in the FIFO register 610a, in response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=k reaching 1024, the row address RA=k is stored as a candidate hammer address in the FIFO register 610b, and in response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=l reaching 1024, the row address RA=l is stored as a candidate hammer address in the FIFO register 610c.

[0158] Because all of the FIFO registers 610a, 610b, and 610c store candidate hammer addresses, the monitor logic 650 notifies the memory controller 30 that the hammer address queue 600 is full (i.e., there is no available space in the hammer address queue 600) by converting the alarm signal ALRT to the first logic level. In response to the conversion of the alarm signal ALRT, the memory controller 30 may not apply the activate command to the semiconductor memory device 200, and may apply the refresh management command RFM to the semiconductor memory device 200. The monitor logic 650 may convert the alarm signal ALRT from the first logic level to the second logic level in response to the row address RA=j stored in the FIFO register 610a being output as the hammer address.

[0159] Figure 6 The refresh control circuit 400 in the embodiment may perform a hammer refresh operation on one or more victim memory cell rows physically adjacent to the memory cell row corresponding to the hammer address. The hammer refresh operation is performed by Fig.12 Immediate RH relief is indicated.

[0160] Fig.13 is a diagram showing a method according to one or more example embodiments Fig.10 A timing diagram of an example operation of the hammer address queue.

[0161] exist Fig.13 11 includes three FIFO registers 610a, 610b, ..., 610h, and 610c, and access to the memory cell rows specified by the row address RA=j, the row address RA=k, and the row address RA=l is repeated. In addition, assuming that the error flag EF of each of the memory cell rows specified by the row address RA=j, the row address RA=k, and the row address RA=l has a second logic level, the first reference number NTH1 corresponds to 1024, and the second reference number NTH2 corresponds to 512.

[0162] exist Fig.13 In the figure, ACT-j represents an activation command accompanying row address RA=j, PRE-j represents a precharge command for the memory cell row specified by row address RA=j, ACT-k represents an activation command accompanying row address RA=k, PRE-k represents a precharge command for the memory cell row specified by row address RA=k, ACT-l represents an activation command accompanying row address RA=l, PRE-l represents a precharge command for the memory cell row specified by row address RA=1.

[0163] Reference Fig.10 and Fig.13In response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=j reaching 512, the row address RA=j is stored as a candidate hammer address in the FIFO register 610a, in response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=k reaching 1024, the row address RA=k is stored as a candidate hammer address in the FIFO register 610b, and in response to the count value (i.e., count data CNTD) associated with the memory cell row specified by the row address RA=l reaching 512, the row address RA=l is stored as a candidate hammer address in the FIFO register 610c.

[0164] Because all of the FIFO registers 610a, 610b, and 610c store candidate hammer addresses, the monitor logic 650 notifies the memory controller 30 that the hammer address queue 600 is full (i.e., there is no available space in the hammer address queue 600) by converting the alarm signal ALRT to the first logic level. In response to the conversion of the alarm signal ALRT, the memory controller 30 may not apply the activate command to the semiconductor memory device 200, and may apply the refresh management command RFM to the semiconductor memory device 200. The monitor logic 650 may convert the alarm signal ALRT from the first logic level to the second logic level in response to the row address RA=j stored in the FIFO register 610a being output as the hammer address.

[0165] Figure 6 The refresh control circuit 400 in the embodiment may perform a hammer refresh operation on one or more victim memory cell rows that are physically adjacent to the memory cell row corresponding to the hammer address. The hammer refresh operation is performed by Fig.13 Immediate RH relief is indicated.

[0166] exist Fig. 9 , Fig.10 , Fig.12 and Fig.13 , they are described as the row hammer management circuit 500 including one hammer address queue 600. However, in one or more example embodiments, a plurality of hammer address queues corresponding to the number of memory bank arrays 310a-310p may be included in the row hammer management circuit 500, and one hammer address queue may correspond to one memory bank array. When a first hammer address queue among the plurality of hammer address queues is full of candidate hammer addresses, the first hammer address queue may convert a logic level of a corresponding alarm signal to a first logic level, and the memory controller 30 may apply a refresh management command to the first hammer address queue while performing normal operations on other memory bank arrays except the first memory bank array.

[0167] Fig.14According to one or more example embodiments, Figure 3 A first memory bank array and a first sense amplifier in a semiconductor memory device.

[0168] Reference Fig.14 In the first memory bank array 310a, I sub-array blocks SCB may be arranged in a first direction D1, and J sub-array blocks SCB may be arranged in a second direction D2 perpendicular to the first direction D1. I and J represent the number of sub-array blocks SCB in the first direction D1 and the second direction D2, respectively, and are natural numbers greater than 2.

[0169] I sub-array blocks SCB arranged in a row in the first direction D1 may be referred to as a row block. A plurality of bit lines, a plurality of word lines, and a plurality of memory cells connected to the bit lines and the word lines are arranged in each sub-array block SCB.

[0170] I+1 sub-word line driver regions SWB may be disposed between sub-array blocks SCB in the first direction D1, and on each side of each sub-array block SCB in the first direction D1. The sub-word line driver may be disposed in the sub-word line driver region SWB. J+1 bit line sense amplifier regions BLSAB may be disposed, for example, between sub-array blocks SCB in the second direction D2, and above and below each sub-array block SCB in the second direction D2. A bit line sense amplifier for sensing data stored in a memory cell may be disposed in the bit line sense amplifier region BLSAB.

[0171] A plurality of sub word line drivers may be provided in each of the sub word line driver regions SWB. One sub word line driver region SWB may be associated with two sub array blocks SCB adjacent to the sub word line driver region SWB in the first direction D1.

[0172] A plurality of junction regions CONJ may be disposed adjacent to the sub word line driver region SWB and the bit line sense amplifier region BLSAB. A voltage generator may be disposed in each junction region CONJ.

[0173] The first sense amplifier 285a may be disposed in the first direction D1 with respect to the first memory bank array 310a, and the first sense amplifier 285a may include 1 I / O sense amplifier (IOSA) 286a, 286b, ..., 286i, 1 driver (DRV) 287a, 287b, ..., 287i, and a controller 289. The controller 289 may control the 1 I / O sense amplifiers 286a, 286b, ..., 286i and the 1 drivers 287a, 287b, ..., 287i by providing an enable signal IOSA_EN to the 1 I / O sense amplifiers 286a, 286b, ..., 286i in a read operation and by providing a drive signal PDT to the 1 drivers DRV 287a, 287b, ..., 287i in a write operation.

[0174] The following will refer to Fig.15 A portion 390 in the first memory bank array 310a is depicted.

[0175] Fig.15 According to one or more example embodiments, Fig.14 A portion of a first memory bank array.

[0176] Reference Fig.14 and Fig.15 , in the portion 390 of the first memory bank array 310a, sub-array blocks SCBa and SCBb, a bit line sense amplifier region BLSAB, four sub word line driver regions SWBa1, SWBa2, SWBb1, and SWBb2, and two coupling regions CONJ are provided.

[0177] The sub-array block SCBa may include a plurality of word lines WL0-WL3 extending in the second direction D2 and a plurality of bit lines BTL0-BTL3 extending in the first direction D1. The sub-array block SCBa may include a plurality of memory cells MC disposed at intersections of the word lines WL0-WL3 and the bit lines BTL0-BTL3. The sub-array block SCBb may include a plurality of word lines WL4-WL7 extending in the second direction D2 and a plurality of bit lines BTL0-BTL3 extending in the first direction D1. The sub-array block SCBb may include a plurality of memory cells MC disposed at intersections of the word lines WL4-WL7 and the bit lines BTL0-BTL3.

[0178] Reference Fig.15 , the sub-word line driver regions SWBa1 and SWBa2 may include a plurality of sub-word line drivers 731, 732, 733, and 734 for driving word lines WL0-WL3, respectively. The sub-word line driver regions SWBb1 and SWBb2 may include a plurality of sub-word line drivers 741, 742, 743, and 744 for driving word lines WL4-WL7, respectively.

[0179] The bit line sense amplifier region BLSAB may include a bit line sense amplifier BLSA 750 coupled to a bit line BTL0 in the sub-array block SCBb and a bit line BTL1 in the sub-array block SCBa, and a local sense amplifier (LSA) circuit 780. The bit line sense amplifier 750 may sense and amplify a voltage difference between the bit lines BTL0 and BTL1 to provide the amplified voltage difference to the local I / O line pair LIO1 and LIOB1.

[0180] The local sense amplifier circuit 780 may control electrical connections between the local I / O line pair LIO1 and LIOB1 and the global I / O line pair GIO1 and GIOB1.

[0181] like Fig.15 As shown in FIG. 1 , the junction region CONJ may be disposed adjacent to the bit line sense amplifier region BLSAB and the sub word line driver regions SWBa1 , SWBb1 , SWBa2 , and SWBb2 . Voltage generators (VG) 710 and 720 may be disposed in the junction region CONJ.

[0182] Fig.16 Shows the ECS mode Figure 3 A portion of a semiconductor memory device.

[0183] exist Fig.16 , the control logic circuit 210, the first memory bank array 310a, the I / O gating circuit 290, the ECS circuit 330, the ECC engine 350 and the row hammering management circuit 500 are shown.

[0184] Reference Fig.16 , the first memory bank array 310a includes a normal cell array NCA and a redundant cell array RCA.

[0185] The normal cell array NCA includes a plurality of first memory blocks MB0, MB1 to MB15 (i.e., 311, 312 to 313), and the redundant cell array RCA includes at least a second memory block 314. The first memory blocks 311, 312 to 313 are memory blocks that determine or are used to determine the storage capacity of the semiconductor memory device 200. The second memory block 314 is used for ECC and / or redundancy repair. Since the second memory block 314 for ECC and / or redundancy repair is used for ECC, data line repair, and block repair to repair the "faulty" cells generated in the first memory blocks 311, 312 to 313, the second memory block 314 is also referred to as an (ECC repair, data line repair, and block repair) EDB block. Each of the first memory blocks 311, 312 to 313 includes a memory cell coupled to a word line WL and a bit line BTL, and the second memory block 314 includes a memory cell coupled to a word line WL and a redundant bit line RBTL. The first memory blocks 311, 312-313 and the second memory block 314 may each represent Fig.14 A portion of the memory cells in the first memory blocks 311, 312 to 313 may be allocated as counting cells.

[0186] The I / O gating circuit 290 includes a plurality of switch circuits (eg, multiplexers (MUX)) 291 a ˜ 291 d connected to the first memory blocks 311 , 312 ˜ 313 and the second memory block 314 , respectively.

[0187] The ECC engine 350 may be connected to the switch circuits 291a-291d through the first data line GIO and the second data line EDBIO. The control logic circuit 210 may receive a command CMD and an address ADDR, and may decode the command CMD to generate a first control signal CTL1 for controlling the switch circuits 291a-291d, a second control signal CTL2 for controlling the ECC engine 350, a third control signal CTL3 for controlling the row hammer management circuit 500, and a fourth control signal CTL4 for controlling the ECS circuit 330.

[0188] The ECS circuit 330 may generate a cleaning address ECS_ADDR in the ECS mode, and the ECC engine 350 may perform a cleaning operation on a first memory cell row specified by the cleaning address ECS_ADDR, and the ECC engine 350 may provide an error generation signal EGS to the ECS circuit 330 whenever an error bit is detected in the first memory cell row.

[0189] When the number of error bits detected in units of codewords is equal to or greater than the reference error number, the ECS circuit 330 may provide the cleaning address ECS_ADDR as the error address EADDR to the row hammer management circuit 500 based on the error generation signal EGS.

[0190] The row hammer management circuit 500 may store an error flag EF having a first logic level in a portion of a counting cell for storing counting data in each of one or more adjacent memory cell rows in the ECS mode, wherein the one or more adjacent memory cell rows are physically adjacent to a weak memory cell row corresponding to an error address among a plurality of memory cell rows.

[0191] Fig.17 The following table shows the operation of writing Figure 3 A portion of a semiconductor memory device.

[0192] exist Fig.17 , the control logic circuit 210, the first memory bank array 310a, the I / O gating circuit 290, the ECC engine 350 and the row hammering management circuit 500 are shown.

[0193] exist Fig.17 In the Fig.16 Duplicate description.

[0194] Reference Fig.17 , when the command CMD is a write command, the control logic circuit 210 provides the second control signal CTL2 to the ECC engine 350. The ECC engine 350 performs ECC encoding on the data DTA to generate parity data associated with the data DTA, and provides a codeword CW including the data DTA and the parity data to the I / O gating circuit 290. The control logic circuit 210 provides the first control signal CTL1 to the I / O gating circuit 290, so that the codeword CW will be stored in a subpage of the target page in the first memory bank array 310a.

[0195] When the command CMD received after the write command corresponds to the activation count update command or the precharge command, the control logic circuit 210 provides the first control signal CTL1 to the I / O gating circuit 290, so that the I / O gating circuit 290 reads the count data CNTD, the error flag EF, and the count parity data associated with the count data CNTD from the target page of the first memory bank array 310a, and provides the count data CNTD, the error flag EF, and the count parity data to the ECC engine 350. The ECC engine 350 performs an ECC decoding operation on the count data CNTD and the count parity data based on the second control signal CTL2, corrects an error bit in the count data CNTD, and provides the count data CNTD as corrected count data to the row hammer management circuit 500.

[0196] The row hammer management circuit 500 updates the count data CNTD to provide the updated count data UCNTD to the ECC engine 350. The ECC engine 350 performs ECC encoding on the updated count data UCNTD to generate updated count parity data, and stores the updated count data UCNTD and the updated count parity data in the target page through the I / O gating circuit 290.

[0197] That is, the ECC engine 350 and the row hammer management circuit 500 may perform an internal read-update-write operation in response to the activation count update command to read the count data CNTD and the error flag EF, update the read count data, and write the updated count data. In addition, in response to all FIFO registers storing candidate hammer addresses (the number of accesses of each of the candidate hammer addresses is equal to or greater than the first reference number NTH1 and the second reference number NTH2 based on the error flag EF), the row hammer management circuit 500 may notify the memory controller 30 of the state of the FIFO register by converting the logic level of the alarm signal ALRT from the second logic level to the first logic level.

[0198] Fig.18 The following table shows the operation used to explain the read operation. Figure 3 A portion of a semiconductor storage device. Fig.17 Duplicate description.

[0199] Reference Fig.18 When the command CMD is a read command for specifying a read operation, the control logic circuit 210 provides the first control signal CTL1 to the I / O gating circuit 290, so that the (read) codeword RCW stored in the subpage of the target page in the first memory array 310a is provided to the ECC engine 350.

[0200] When the command CMD received after the read command corresponds to the activate count update command or the precharge command, the control logic circuit 210 provides the first control signal CTL1 to the I / O gating circuit 290, so that the I / O gating circuit 290 reads the count data CNTD, the error flag EF, and the count parity data associated with the count data CNTD from the target page of the first memory bank array 310a, and provides the count data CNTD, the error flag EF, and the count parity data to the ECC engine 350. The ECC engine 350 performs an ECC decoding operation on the count data CNTD and the count parity data based on the second control signal CTL2, corrects an error bit in the count data CNTD, and provides the count data CNTD as corrected count data to the row hammer management circuit 500.

[0201] The row hammer management circuit 500 updates the count data CNTD to provide the updated count data UCNTD to the ECC engine 350. The ECC engine 350 performs ECC encoding on the updated count data UCNTD to generate updated count parity data, and stores the updated count data UCNTD and the updated count parity data in the target page through the I / O gating circuit 290.

[0202] That is, the ECC engine 350 and the row hammer management circuit 500 may perform an internal read-update-write operation in response to the activation count update command or the precharge command to read the count data CNTD and the error flag EF, update the read count data, and write the updated count data. In addition, in response to all FIFO registers storing candidate hammer addresses (the number of accesses of each of the candidate hammer addresses is equal to or greater than the first reference number NTH1 and the second reference number NTH2 based on the error flag EF), the row hammer management circuit 500 may notify the memory controller 30 of the state of the FIFO register by converting the logic level of the alarm signal ALRT from the second logic level to the first logic level.

[0203] Fig.19 is a diagram showing a method according to one or more example embodiments Fig.16 , Fig.17 or Fig.18 A block diagram of an example of an ECC engine in a semiconductor memory device.

[0204] exist Fig.19 In the figure, for the convenience of explanation, the first memory bank array 310a is also shown.

[0205] Reference Fig.19, the ECC engine 350 may include an ECC encoder 360, an ECC decoder 380, and an (ECC) memory 365. The memory 365 may store an ECC 370. The ECC 370 may be a single error correction (SEC) code or a single error correction / double error detection (SECDED) code.

[0206] The ECC encoder 360 may receive the data DTA from the data I / O buffer 320, and generate parity data PRT associated with the data DTA to be stored in the normal cell array NCA of the first memory bank array 310a using ECC370. The parity data PRT may be stored in the redundant cell array RCA of the first memory bank array 310a. In addition, the ECC encoder 360 may receive the count data CNTD as the updated count data UCNTD from the row hammer management circuit 500, and generate count parity data CPRT associated with the count data CNTD (i.e., updated count data UCNTD) to be stored in the normal cell array NCA of the first memory bank array 310a using ECC370. The count parity data CPRT may be stored in the redundant cell array RCA of the first memory bank array 310a.

[0207] The ECC decoder 380 may perform an ECC decoding operation on the read data DTA based on the read data DTA and the parity data PRT read from the first memory bank array 310a using the ECC 370. When the read data DTA includes an error bit as a result of the ECC decoding, the ECC decoder 380 may correct the error bit in the read data DTA and may provide the corrected data C_DTA to the data I / O buffer 320.

[0208] In addition, the ECC decoder 380 may perform an ECC decoding operation on the count data CNTD based on the count data CNTD and the count parity data CPRT read from the first memory bank array 310a using the ECC 370. When the count data CNTD includes an error bit as a result of the ECC decoding, the ECC decoder 380 may correct the error bit in the count data CNTD and may provide the corrected count data C_CNTD to the row hammer management circuit 500. When the count data CNTD is read from the count unit, the error flag EF may be read from the count unit.

[0209] Fig. 20 is a diagram showing a method according to one or more example embodiments Figure 3 A block diagram of an example of a first memory bank array in FIG.

[0210] Reference Fig. 20, the first memory bank array 310aa may include first sub-array blocks SCA11 311a and 312a, second sub-array blocks SCA12 313a and 314a, third sub-array block SCA2 315a, I / O sense amplifiers 331, 332, 333, 334 and 336, and drivers 341, 342, 343, 344 and 346.

[0211] Data I / O for each of the first sub-array blocks 311a and 312a and the second sub-array blocks 313a and 314a may be performed through the first global I / O line GIO1<1:a> and the first local I / O line LIO1<1:a>. Here, a may be a natural number equal to or greater than 8. According to a read command or a write command, "a" bit lines of each of the first sub-array blocks 311a and 312a and the second sub-array blocks 313a and 314a arranged in the first direction D1 may be selected by a column selection signal transmitted through one of the column selection lines CSL. In other embodiments, the number of the first sub-array blocks 311a and 312a and the second sub-array blocks 313a and 314a may be different, and may be determined, for example, according to the number of bits of data that the semiconductor memory device 200 can process.

[0212] Data I / O for the third sub-array block 315a may be performed through the second global I / O line GIO2<1:b> and the second local I / O line LIO2<1:b>. Here, b may be a positive number less than a. According to a read command or a write command, the "b" bit lines of the third sub-array block 315a may be selected by a column select signal sent through one of the column select lines CSL. In other embodiments, the number of the third sub-array blocks 315a may be different.

[0213] In one or more example embodiments, the first memory bank array 310aa may further include a first sub-array block, a second sub-array block, and a third sub-array block arranged in the second direction D2.

[0214] In one or more example embodiments, the first sub-array blocks 311a and 312a may store normal data and count data, the second sub-array blocks 313a and 314a may store normal data, and the third sub-array block 315a may store parity data and count parity data. The normal data may be, for example, data received by the semiconductor memory device 200 from an external device or data to be provided by the semiconductor memory device 200 to an external device.

[0215] The I / O sense amplifier 331 may sense and amplify a voltage of the first global I / O line GIO1<1:a> determined according to a bit output through the first global I / O line GIO1<1:a>. Each of the I / O sense amplifiers 332, 333, 334, and 336 may operate in a manner similar to the I / O sense amplifier 331. The I / O sense amplifier 336 may sense and amplify a voltage of the second global I / O line GIO2<1:b> determined according to a bit output through the second global I / O line GIO2<1:b>.

[0216] The driver 341 may provide data to the memory cells of the second sub-array block 313a based on the write command through the first global I / O line GIO1<1:a>, the first local I / O line LIO1<1:a>, and the "a" bit line selected by the column selection signal transmitted through one of the column selection lines CSL. The data may include bits received through one data I / O pin, or may include bits received through a plurality of data I / O pins aligned at the rising edge or the falling edge of the data strobe signal.

[0217] Drivers 342, 343, 344, and 346 may operate in a manner substantially similar to driver 341. Driver 346 may transmit parity data or count parity data to memory cells of the third sub-array block 315a through the second global I / O line GIO2<1:b>, the second local I / O line LIO2<1:b>, and "b" bit lines selected by a column select signal transmitted through one of the column select lines CSL.

[0218] The first sub-array blocks 311 a and 312 a , the second sub-array blocks 313 a and 314 a , and a portion of the third sub-array block 315 a may include a counting unit for storing the count data CNTD and the error flag EF.

[0219] Fig.21 and Fig. 22 Shown can be used Figure 1 Example commands in a memory system.

[0220] Fig.21 shows a combination of a chip selection signal CS_n and first to fourteenth command address signals CA0 to CA13 indicating an active command ACT, a write command WR, and a read command RD, and Fig. 22 A combination of the chip selection signal CS_n and the first to fourteenth command address signals CA0 ˜ CA13 indicating precharge commands PREab, PREsb, and PREPb is shown.

[0221] exist Fig.21 and Fig. 22In the figure, H indicates a logic high level, L indicates a logic low level, V indicates a valid logic level corresponding to one of a logic high level H and a logic low level L, R0 to R17 indicate bits of a row address, BA0, BA1, and BA2 indicate bits of a bank address, BG0, BG1, and BG2 indicate bits of a bank group address, and CID0, CID1, CID2, and CID3 indicate bits of a bank group address. Figure 1 The semiconductor memory device 200 in FIG. 1 is implemented as a stacked memory device including a plurality of memory dies. In addition, in Fig.21 In the example, C2 to C10 indicate the column address bits, and Fig.21 In the example, B1 indicates the burst length flag.

[0222] Reference Fig.21 , the active command ACT, the write command WR, and the read command RD may be transmitted during two cycles (eg, during the logic high level H and the logic low level L of the chip selection signal CS_n). The active command ACT may include the bank address bits BA0 and BA1 and the row address bits R0 to R17.

[0223] exist Fig. 22 In the embodiment, PREpb is a precharge command for precharging a specific memory bank in a specific memory bank group, PREab is an all-memory bank precharge command for precharging all memory banks in all memory bank groups, and PREsb is a same-memory bank precharge command for precharging the same memory bank in all memory bank groups.

[0224] Reference Fig. 22 , the ninth command address signal CA8 or the tenth command address signal CA9 of each of the precharge commands PREab and PREsb may be used as an activation count update flag designating an internal read-update-write operation.

[0225] Fig.23A and Fig. 23B Examples of command protocols of a memory system when the memory system uses an activation count update command are respectively shown.

[0226] exist Fig.23A and Fig. 23B , a differential clock signal pair CK_t and CK_c is shown.

[0227] Reference Figure 1 , Figure 2 , Figure 3 and Fig.23A , the scheduler 55 applies a first active command ACT1 accompanied by a first target row address designating a first target memory cell row to the semiconductor memory device 200 in synchronization with an edge of the clock signal CK_t.

[0228] In response to the first active command ACT1 , the control logic circuit 210 enables a first target word line connected to a first target memory cell row by enabling a first active signal IACT11 .

[0229] After applying the first active command ACT1, the scheduler 55 applies a read command RD designating a read operation on the first target memory cell row to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t. In response to the read command RD, the control logic circuit 210 performs a read operation on data stored in the first target memory cell row by enabling the first read signal IRD1.

[0230] After a time interval corresponding to the delay time of the continuous read commands for the same memory bank group tCCD_L from applying the read command RD, the scheduler 55 applies the activation count update command ACU to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and in response to the activation count update command ACU, the control logic circuit 210 reads the count data CNTD from the first target memory cell row by sequentially enabling the second read signal IRD2 and the write signal IWR1, updates the read count data CNTD and stores the updated count data in the first target memory cell row. Therefore, the bit value stored in the first target memory cell row specified by the first target row address (e.g., RA=u) increases from w to w+1.

[0231] After a time interval corresponding to the time tACU when the internal read-update-write operation is performed from the application of the activation count update command ACU, the scheduler 55 applies a precharge command PRE to the semiconductor memory device 200, and the control logic circuit 210 precharges the first target word line in response to the precharge command PRE by enabling the precharge signal IPRE.

[0232] After a time interval corresponding to the precharge time tRP, the scheduler 55 applies a second activation command ACT2 associated with the second target memory cell row to the semiconductor memory device 200, and in response to the second activation command ACT2, the control logic circuit 210 enables the second target word line connected to the second target memory cell row by enabling the second activation signal IACT12.

[0233] Reference Figure 1 , Figure 2 , Figure 3 and Fig. 23B , the scheduler 55 applies a first active command ACT1 accompanied by a first target row address designating a first target memory cell row to the semiconductor memory device 200 in synchronization with an edge of the clock signal CK_t.

[0234] In response to the first active command ACT1 , the control logic circuit 210 enables a first target word line connected to a first target memory cell row by enabling a first active signal IACT11 .

[0235] After applying the first active command ACT1, the scheduler 55 applies a write command WR designating a write operation to the first target memory cell row to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t. In response to the write command WR, the control logic circuit 210 performs a write operation by enabling a first write signal IWR11 to store data in the first target memory cell row.

[0236] After a time interval corresponding to the delay time of the continuous write commands to the same memory bank group tCCD_L_WR from applying the write command WR, the scheduler 55 applies the activation count update command ACU to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and in response to the activation count update command ACU, the control logic circuit 210 reads the count data CNTD from the first target memory cell row by sequentially enabling the read signal IRD and the second write signal IWR12, updates the read count data CNTD and stores the updated count data in the first target memory cell row. Therefore, the bit value stored in the first target memory cell row specified by the first target row address (e.g., RA=u) increases from w to w+1.

[0237] After a time interval corresponding to a time tACU at which an internal read-update-write operation is performed from the application of an activation count update command ACU, the scheduler 55 applies a precharge command PRE to the semiconductor memory device 200, and in response to the precharge command PRE, the control logic circuit 210 precharges the first target word line by enabling a precharge signal IPRE.

[0238] After a time interval corresponding to the precharge time tRP, the scheduler 55 applies a second activation command ACT2 associated with the second target memory cell row to the semiconductor memory device 200, and in response to the second activation command ACT2, the control logic circuit 210 enables the second target word line connected to the second target memory cell row by enabling the second activation signal IACT12.

[0239] Fig.24A and Fig. 24B Examples of command protocols of a memory system when a semiconductor memory device performs an activation count update operation internally are respectively shown.

[0240] exist Fig.24A and Fig. 24B In the Fig.23A and Fig. 23B Duplicate description.

[0241] Reference Fig.24A , after applying the first active command ACT1, the scheduler 55 applies a read command RD designating a read operation on the first target memory cell row to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t. In response to the read command RD, the control logic circuit 210 performs a read operation on data stored in the first target memory cell row by enabling the first read signal IRD1.

[0242] In response to the time point when the first activation command is received from the semiconductor memory device 200, the reference time interval RINT1 passes, the control logic circuit 210 reads the count data CNTD from the first target memory cell row by sequentially enabling the second read signal IRD2 and the write signal IWR1, updates the read count data CNTD and stores the updated count data in the first target memory cell row. Therefore, the bit value stored in the first target memory cell row specified by the first target row address (e.g., RA=u) increases from w to w+1.

[0243] The control logic circuit 210 may determine that a reference time interval RINT1 has passed from a time point when the semiconductor memory device 200 receives the first active command by counting the clock signal CK.

[0244] The semiconductor memory device 200 may internally perform an internal read-update-write operation using tRAS corresponding to the active time to the precharge time.

[0245] Reference Fig. 24B After applying the first active command ACT1, the scheduler 55 applies a write command WR designating a write operation to the first target memory cell row to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t. In response to the write command WR, the control logic circuit 210 performs a write operation by enabling the first write signal IWR11 to store data in the first target memory cell row.

[0246] In response to the time point when the first activation command is received from the semiconductor memory device 200, the reference time interval RINT2 is passed, the control logic circuit 210 reads the count data CNTD from the first target memory cell row by sequentially enabling the second read signal IRD2 and the write signal IWR1, updates the read count data CNTD and stores the updated count data in the first target memory cell row. Therefore, the bit value stored in the first target memory cell row specified by the first target row address (e.g., RA=u) increases from w to w+1.

[0247] The control logic circuit 210 may determine that a reference time interval RINT2 has passed from a time point when the semiconductor memory device 200 receives the first active command by counting the clock signal CK.

[0248] The semiconductor memory device 200 may internally perform an internal read-update-write operation using tRAS corresponding to the active time to the precharge time.

[0249] Fig.25A An example of a command protocol of a memory system is shown when the memory system updates count data based on a precharge command.

[0250] Reference Figure 1 , Figure 2 , Fig. 22 and Fig.25A , the scheduler 55 applies the first activation command ACT1 to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and applies the precharge command PRE to the semiconductor memory device 200 after tRAS corresponding to the activation time to the precharge time has passed, the precharge command PRE specifies an internal read-update-write operation of the count data stored in the target memory cell specified by the target row address accompanied by the first activation command ACT1. In this case, the scheduler 55 may set the tenth command address signal CA9 of the precharge command PRE to a logic low level L.

[0251] After a time interval corresponding to the precharge time tRP, the scheduler 55 applies the second active command ACT2 to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and applies the refresh management command RFM to the semiconductor memory device 200. In response to the refresh management command RFM, the semiconductor memory device 200 performs a hammer refresh operation on two sacrificial memory cell rows physically adjacent to the memory cell row corresponding to the hammer address.

[0252] Fig.25B An example of a command protocol of a memory system is shown when a semiconductor memory device updates count data within an activation time to a precharge time.

[0253] Reference Figure 1 , Figure 2 , Fig. 22 and Fig.25B, the scheduler 55 applies the first activation command ACT1 to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and within the tRAS corresponding to the activation time to the precharge time, the semiconductor memory device 200 performs an internal read-update-write operation on the count data stored in the target memory cell specified by the target row address accompanied by the first activation command ACT1. In this case, the scheduler 55 may set the tenth command address signal CA9 of the precharge command PRE to a logic high level H.

[0254] After a time interval corresponding to the precharge time tRP, the scheduler 55 applies the second active command ACT2 to the semiconductor memory device 200 in synchronization with the edge of the clock signal CK_t, and applies the refresh management command RFM to the semiconductor memory device 200. In response to the refresh management command RFM, the semiconductor memory device 200 performs a hammer refresh operation on two sacrificial memory cell rows physically adjacent to the memory cell row corresponding to the hammer address.

[0255] Fig.26 is a diagram showing a portion of a memory cell array for describing generation of a hammer refresh address.

[0256] Fig.26 Three word lines WLt-1, WLt, and WLt+1, three bit lines BTLg-1, BTLg, and BTLg+1, and memory cells MC coupled to the word lines WLt-1, WLt, and WLt+1 and the bit lines BTLg-1, BTLg, and BTLg+1 in the memory cell array are shown. The three word lines WLt-1, WLt, and WLt+1 extend in a first direction D1 and are arranged sequentially along a second direction D2. The three bit lines BTLg-1, BTLg, and BTLg+1 extend in a second direction D2 and are arranged sequentially along the first direction D1. It will be understood that since there is no intervening word line between the word lines WLt-1 and WLt, the word lines WLt-1 and WLt are physically directly adjacent to each other.

[0257] For example, the middle word line WLt may correspond to a hammer address HADDR that has been intensively accessed. It will be understood that a "intensively accessed word line" refers to a word line that has a relatively high activation number and / or has a relatively high activation frequency. Whenever a hammer word line (e.g., the middle word line WLt) is accessed, the hammer word line WLt is enabled and precharged, and the voltage level of the hammer word line WLt is increased and decreased. Word line coupling may cause the voltage levels of the neighboring word lines WLt-1 and WLt+1 to fluctuate as the voltage level of the hammer word line WLt changes, and thus the cell charge of the memory cells MC coupled to the neighboring word lines WLt-1 and WLt+1 may be affected. As the hammer word line WLt is accessed more frequently, the cell charge of the memory cells MC coupled to the neighboring word lines WLt-1 and WLt+1 may be lost more quickly.

[0258] Figure 6 The hammer refresh address generator 440 in the memory may provide hammer refresh addresses HREF_ADDR representing addresses HREF_ADDRa and HREF_ADDRb of rows (e.g., word lines WLt-1 and WLt+1) that are physically adjacent to the row of the hammer address HADDR (e.g., the hammer word line WLt), and refresh operations for the adjacent word lines WLt-1 and WLt+1 may be additionally performed based on (e.g., in response to) the hammer refresh addresses HREF_ADDR to reduce or prevent as much as possible the loss of data stored in the memory cells MC.

[0259] Fig. 27 is a diagram showing a portion of a memory cell for describing generation of a hammer refresh address in response to a second type of hammer address.

[0260] Fig. 27 Five word lines WLt-2, WLt-1, WLt, WLt+1, and WLt+2, three bit lines BTLg-1, BTLg, and BTLg+1, and memory cells MC coupled to the word lines WLt-2, WLt-1, WLt, WLt+1, and WLt+2 and the bit lines BTLg-1, BTLg, and BTLg+1 in the memory cell array are shown. The five word lines WLt-2, WLt-1, WLt, WLt+1, and WLt+2 extend in the first direction D1 and are sequentially arranged along the second direction D2.

[0261] Figure 6The hammer refresh address generator 440 in may provide hammer refresh addresses HREF_ADDR representing addresses HREF_ADDRa, HREF_ADDRb, HREF_ADDRc, and HREF_ADDRd of rows (e.g., word lines WLt-1, WLt+1, WLt-2, and WLt+2) that are physically adjacent to the hammer address HADDR (e.g., the middle word line WLt), and refresh operations for adjacent word lines WLt-1, WLt+1, WLt-2, and WLt+2 may be additionally performed based on (e.g., in response to) the hammer refresh address HREF_ADDR to reduce or prevent as much as possible the loss of data stored in the memory cells MC.

[0262] Fig.28A , Fig.28B and Fig.29 is a diagram showing a method according to one or more example embodiments Figure 6 A timing diagram of an example operation of a refresh control circuit.

[0263] Fig.28A and Fig.28B 1. The refresh clock signal RCK, the hammer refresh signal HREF, the counter refresh address CREF_ADDR and the hammer refresh address HREF_ADDR are shown with respect to the generation of the refresh control signal IREF activated in a pulse shape at the activation time points t1 to t15 or at the activation time points t1 to t10. The intervals between the activation time points t1 to t15 or the activation time points t1 to t10 of the refresh control signal IREF may be regular or irregular.

[0264] Reference Figure 6 and Fig.28A , the refresh control logic 410 may activate the refresh clock signal RCK in synchronization with some time points t1-t4, t6-t10, and t12-t14 among the activation time points t1-t15 of the refresh control signal IREF, and may activate the hammer refresh signal HREF in synchronization with the other time points t5 and t11.

[0265] The refresh counter 430 may generate a counter refresh address CREF_ADDR representing sequentially changed addresses X+1 to X+12 in synchronization with activation time points t1 to t4, t6 to t10, and t12 to t14 of the refresh clock signal RCK. The hammer refresh address generator 440 may generate a hammer refresh address HREF_ADDR in synchronization with activation time points t5 and t11 of the hammer refresh signal HREF, the hammer refresh address HREF_ADDR representing addresses Ha1 and Ha2 of rows physically adjacent to the row of the hammer address.

[0266] Reference Figure 6 and Fig.28B, the refresh control logic 410 may activate the refresh clock signal RCK in synchronization with some time points t1-t4 and t7-t9 among the activation time points t1-t10 of the refresh control signal IREF, and may activate the hammer refresh signal HREF in synchronization with the other time points t5 and t6.

[0267] The refresh counter 430 may generate a counter refresh address CREF_ADDR representing sequentially changed addresses X+1~X+7 in synchronization with activation time points t1~t4 and t7~t9 of the refresh clock signal RCK. The hammer refresh address generator 440 may generate a hammer refresh address HREF_ADDR in synchronization with activation time points t5 and t6 of the hammer refresh signal HREF, the hammer refresh address HREF_ADDR representing addresses Ha1 and Ha2 of rows physically adjacent to the row of the hammer address.

[0268] Reference Figure 6 and Fig.29 The hammer refresh address generator 440 may generate a hammer refresh address HREF_ADDR in synchronization with activation time points t5, t6, t7, and t8 of the hammer refresh signal HREF, the hammer refresh address HREF_ADDR indicating addresses Ha1, Ha2, Ha3, and Ha4 of rows physically adjacent to the row of the hammer address.

[0269] Fig.30 is a block diagram illustrating a semiconductor memory device according to one or more example embodiments.

[0270] Reference Fig.30 , the semiconductor memory device 800 may include at least one buffer die 810 and a plurality of memory dies 820 - 1 to 820 - r (r is a natural number equal to or greater than 3) that provide soft error analysis and correction functions in a stacked chip structure.

[0271] A plurality of memory dies 820 - 1 to 820 - r are stacked on the buffer die 810 , and data is transmitted through a plurality of through silicon via (TSV, also called through silicon via) lines.

[0272] Each of the plurality of memory dies 820-1 to 820-r may include a cell core 821 for storing data, a cell core ECC engine 823 for generating a transmission parity bit (i.e., transmission parity data) based on transmission data to be transmitted to at least one buffer die 810, a refresh control circuit (RCC) 825, an ECS circuit (ECSC) 829, and a row hammer management circuit (RHMC) 827. The cell core 821 may include a plurality of memory cells having a DRAM cell structure.

[0273] The refresh control circuit 825 can be used Figure 6The refresh control circuit 400 and the row hammer management circuit 827 can be used Fig. 9 The hammer management circuit 500 and the ECS circuit 829 may be used Figure 5 The ECS circuit 330.

[0274] The ECS circuit 829 may provide an error address to the row hammer management circuit 827 based on the error generation signal in the ECS mode, and the row hammer management circuit 827 may store an error flag having a first logic level in a portion of a counting unit for storing count data of each of one or more adjacent memory cell rows in the ECS mode, and may determine a hammer address by comparing count data read from a counting unit of a target memory cell row with different reference times based on the logic level of the error flag in the normal mode, the one or more adjacent memory cell rows being physically adjacent to a weak memory cell row corresponding to the error address. The refresh control circuit 825 may receive the hammer address from the row hammer management circuit 827, and may perform a hammer refresh operation on one or more victim memory cell rows physically adjacent to a memory cell row corresponding to the hammer address.

[0275] The buffer die 810 may include a via ECC engine 812 that corrects the transmission error using a transmission parity bit and generates error-corrected data when a transmission error is detected from transmission data received through the TSV line.

[0276] The buffer die 810 may further include a data I / O buffer 816. The data I / O buffer 816 may generate a data signal DQ by sampling the data DTA from the via ECC engine 812, and may output the data signal DQ to the outside.

[0277] The semiconductor memory device 800 may be a stacked chip type memory device or a stacked memory device that transmits data and control signals through TSV lines. The TSV lines may also be referred to as "through electrodes."

[0278] The unit core ECC engine 823 may perform error correction on data output from the memory die 820 - r before the transmission data is sent.

[0279] The data TSV line group 832 formed at one memory die 820-r-1 may include TSV lines L1, L2, ..., Lr, and the parity TSV line group 834 may include TSV lines L10 to Ls. The TSV lines L1, L2, ..., Lr of the data TSV line group 832 and the parity TSV lines L10 to Ls of the parity TSV line group 834 may be connected to micro bumps MCBs correspondingly formed between the memory dies 820-1 to 820-r.

[0280] The semiconductor memory device 800 may have a three-dimensional (3D) chip structure or a 2.5D chip structure to communicate with a host through a data bus B10. The buffer die 810 may be connected to a memory controller through the data bus B10.

[0281] According to one or more example embodiments, Fig.30 As shown in , the cell core ECC engine 823 may be included in the memory die, and the via ECC engine 812 may be included in the buffer die. Therefore, it may be feasible to detect and correct soft data failures. Soft data failures may include transmission errors generated due to noise when data is transmitted through TSV lines.

[0282] Fig.31 is a configuration diagram illustrating a semiconductor package including a stacked memory device according to one or more example embodiments.

[0283] Reference Fig.31 , the semiconductor package 900 may include one or more stacked memory devices 910 and a graphics processing unit (GPU) 920 .

[0284] The stacked memory device 910 and the GPU 920 may be mounted on an intermediate layer 930, and the interposer on which the stacked memory device 910 and the GPU 920 are mounted may be mounted on a package substrate 940, and the package substrate 940 is mounted on a solder ball 950. The GPU 920 may correspond to a semiconductor device that can perform a memory control function, and for example, the GPU 920 may be implemented as an application processor (AP). The GPU 920 may include a memory controller CTRL 925 having a scheduler.

[0285] The stacked memory device 910 may be implemented in various forms, and the stacked memory device 910 may be a memory device in the form of a high bandwidth memory (HBM) in which a plurality of layers are stacked. Therefore, the stacked memory device 910 may include a buffer die and a plurality of memory dies, and each of the plurality of memory dies includes an ECS circuit, a refresh control circuit, and a row hammer management circuit.

[0286] A plurality of stacked memory devices 910 may be mounted on the middle layer 930, and the GPU 920 may communicate with the plurality of stacked memory devices 910. For example, each of the stacked memory device 910 and the GPU 920 may include a physical region, and communication may be performed between the stacked memory device 910 and the GPU 920 through the physical region. Meanwhile, when the stacked memory device 910 includes a direct access region, a test signal may be provided to the stacked memory device 910 through a conductive device (e.g., solder ball 950) mounted below the package substrate 940 and the direct access region.

[0287] Fig.32 is a block diagram illustrating a memory system having four ranks of memory modules according to one or more example embodiments.

[0288] Reference Fig.32 , the memory system 1000 may include a memory controller 1010 and / or memory modules 1020 and 1030. Fig.32 Two memory modules are depicted in FIG. 1 , but more or fewer memory modules may be included in the memory system 1000 according to one or more example embodiments.

[0289] The memory controller 1010 may control the memory modules 1020 and / or 1030 so as to execute commands supplied from a processor and / or a host. The memory controller 1010 may be implemented using a processing circuit system (e.g., a processor) and / or may be implemented using a host, an application processor, or a system on chip (SoC). For signal integrity, a source terminal may be implemented using a resistor RTT on a bus 1040 of the memory controller 1010. The resistor RTT may be coupled to a power supply voltage VDDQ. The memory controller 1010 may include a transmitter 1011 and a receiver 1013, the transmitter 1011 may send a signal to at least one of the memory modules 1020 and / or 1030, and the receiver 1013 may receive a signal from at least one of the memory modules 1020 and / or 1030. The memory controller 1010 may include a CPU 1015.

[0290] The memory modules 1020 and 1030 may be referred to as first memory modules 1020 and second memory modules 1030. The first memory modules 1020 and the second memory modules 1030 may be coupled to the memory controller 1010 via a bus 1040. Each of the first memory modules 1020 and the second memory modules 1030 may include a plurality of semiconductor memory devices and / or a register clock driver. The first memory module 1020 may include memory banks RK1 and RK2, and the second memory module 1030 may include memory banks RK3 and RK4.

[0291] The memory rank RK1 may include semiconductor memory devices 1021 and 1022, and the memory rank RK2 may include semiconductor memory devices 1023 and 1024. Each of the memory rank RK3 and RK4 may include a semiconductor memory device. Each of the semiconductor memory devices 1021, 1022, 1023, and 1024 may be configured as Figure 3 A semiconductor memory device 200.

[0292] Each of the semiconductor memory devices 1021, 1022, 1023, and 1024 may be connected to the memory controller 1010 through an alarm pin 1025 and a bus 1040. Each of the semiconductor memory devices 1021, 1022, 1023, and 1024 may notify the memory controller 1010 of an error state by changing a logic level of an alarm signal through the alarm pin 1025.

[0293] The alarm pin 1025 of each of the semiconductor memory devices 1021, 1022, 1023, and 1024 may be commonly connected to the bus 1040. When at least one of the semiconductor memory devices 1021, 1022, 1023, and 1024 changes the logic level of the alarm signal, the voltage across the resistor RTT is changed, and thus, the CPU 1015 may recognize that a hammering address queue full situation occurs in at least one of the semiconductor memory devices 1021, 1022, 1023, and 1024.

[0294] Aspects of the present disclosure may be applied to systems using semiconductor memory devices that employ volatile memory cells. For example, aspects may be applied to systems that use semiconductor memory devices as working memories, such as smartphones, navigation systems, notebook computers, desktop computers, and game consoles.

[0295] The foregoing is an illustration of example embodiments and should not be construed as limiting thereof. Although example embodiments have been described, those skilled in the art will readily appreciate that many modifications may be made in the example embodiments without materially departing from the novel teachings and advantages of the present disclosure. Therefore, all such modifications are intended to be included within the scope of the present disclosure as defined in the claims.

Claims

1. A semiconductor memory device, comprising: a memory cell array comprising a plurality of memory cell rows, each of the plurality of memory cell rows comprising a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array and generate an error generation signal based on the ECC decoding; an error checking and scrubbing ECS ​​circuit configured to: generate a plurality of scrubbing addresses for performing a scrubbing operation in an ECS mode, and output at least one of the plurality of scrubbing addresses as an error address based on an error generation signal; The row hammer management circuit is configured as follows: storing, in an ECS mode, an error flag having a first logic level in a portion of a counting cell for storing counting data of each of one or more adjacent memory cell rows that are physically adjacent to a weak memory cell row corresponding to an error address among the plurality of memory cell rows; and in a normal mode, comparing a count value indicating a number of accesses associated with each of the plurality of memory cell rows with a different reference number based on an error flag, and specifying a hammer address of a first memory cell row that is intensively accessed among the plurality of memory cell rows based on the comparison output; as well as A refresh control circuit is configured to receive the hammering address and perform a hammering refresh operation on one or more victim memory cell rows that are physically adjacent to a first memory cell row corresponding to the hammering address.

2. The semiconductor memory device according to claim 1, wherein The ECC engine is also configured to perform scrubbing operations in ECS mode by: detecting an error bit by performing ECC decoding on first data read from a second memory cell row designated by a first cleaning address among the plurality of cleaning addresses in units of codewords; Correcting detected error bits; and writing the corrected codeword back into the corresponding memory location of the second row of memory cells, and The ECS circuit is further configured to provide a first cleaning address as an error address to a row hammer management circuit based on the number of error bits detected in the second memory cell row in units of codewords being equal to or greater than a first number, wherein the first number is a natural number equal to or greater than one.

3. The semiconductor memory device according to claim 1, wherein: The ECS circuit includes: an ECS address counter configured to generate the plurality of wash addresses by sequentially increasing or decreasing the wash address based on an ECS mode signal; an error counter configured to generate an error count value by counting an error generation signal in an ECS mode; a comparator configured to generate a comparison signal by comparing the error count value with a reference error number; and The error address generator is configured to store a corresponding cleaning address among the plurality of cleaning addresses and selectively output a first cleaning address as an error address based on a comparison signal.

4. The semiconductor memory device according to claim 3, wherein: The error address generator is further configured to output the first cleaning address as the error address based on the comparison signal indicating that the error count value is equal to or greater than a reference error number.

5. The semiconductor memory device according to claim 1, wherein: The row hammer management circuit is also configured to: Receive wrong address in ECS mode; sequentially accessing a first adjacent memory cell row and a second adjacent memory cell row, the first adjacent memory cell row and the second adjacent memory cell row being physically adjacent to a weak memory cell row corresponding to the error address; and An error flag having a first logic level is stored in a counting cell of each of a first adjacent memory cell row and a second adjacent memory cell row.

6. The semiconductor memory device according to claim 1, wherein: The row hammer management circuit includes a hammer address queue, and The row hammer management circuit is further configured to: in normal mode, storing the count value as count data in a count unit based on an activation command from an external memory controller; performing an internal read-update-write operation based on a lapse of a reference time interval from receiving an activation command to read count data and an error flag from a count cell of a target memory cell row among the plurality of memory cell rows, update the count data, and write the updated count data into the count cell of the target memory cell row; selectively storing a target access address specifying a target memory cell row in a hammer address queue based on comparing the count data with a first reference number of times based on the error flag having a second logic level different from the first logic level; and Based on the error flag having a first logic level, the target access address is selectively stored in the hammer address queue based on comparing the count data with a second reference number, the second reference number being less than the first reference number.

7. The semiconductor memory device according to claim 6, wherein: The row hammer management circuit is further configured to store the target access address as a candidate hammer address in the hammer address queue based on the error flag having the first logic level and the count data being equal to or greater than a second reference number of times.

8. The semiconductor memory device according to claim 6, wherein: The row hammer management circuit is further configured to provide the target access address as the hammer address to the refresh control circuit based on the error flag having the first logic level and the count data being equal to or greater than a second reference number of times.

9. The semiconductor memory device according to claim 6, wherein: The row hammer management circuit also includes: an adder configured to update count data read from the count cells of the target memory cell row to output updated count data; a second comparator configured to compare the read count data or the updated count data with a selected reference number of times to output a second comparison signal; a multiplexer configured to: provide one of the first reference number and the second reference number as a selected reference number to the second comparator based on an error flag read from a counting unit of a target memory cell row; a neighboring address generator configured to: receive an error address in the ECS mode and generate a first neighboring address and a second neighboring address based on the error address; and An error flag control circuit is configured to sequentially access a first adjacent memory cell row and a second adjacent memory cell row physically adjacent to the weak memory cell row based on a first adjacent address and a second adjacent address, and store an error flag having a first logic level in a counting cell of each of the first adjacent memory cell row and the second adjacent memory cell row.

10. The semiconductor memory device according to claim 9, wherein: The multiplexer is also configured as: outputting a first reference number as a selected reference number based on the error flag having a first logic level; and Based on the error flag having a second logic level, a second reference number is output as the selected reference number.

11. The semiconductor memory device according to claim 9, wherein: The row hammer management circuit also includes: a first demultiplexer configured to: selectively output a target access address based on a second comparison signal; and The second demultiplexer is configured to store the output of the first demultiplexer as a candidate hammer address in a hammer address queue or provide the output of the first demultiplexer as a hammer address to a refresh control circuit based on a mode signal specifying one of an emergency mode and a non-emergency mode.

12. The semiconductor memory device according to claim 11, wherein The first demultiplexer is further configured to provide the target access address to the second demultiplexer based on the second comparison signal indicating that the count data is equal to or greater than the selected reference number of times.

13. The semiconductor memory device according to claim 11, wherein: The second demultiplexer is further configured to: outputting a target access address as the hammer address based on a mode signal designating an emergency mode; and Based on the mode signal designating a non-emergency mode, the target access address is stored in a hammer address queue.

14. The semiconductor memory device according to claim 6, wherein: The hammer address queue includes: a plurality of registers configured to store a plurality of candidate hammer addresses, the number of the plurality of registers corresponding to the first number; and Monitor logic, connected to the plurality of registers, and configured to: managing the plurality of registers; monitoring a number of the plurality of candidate hammer addresses stored in the plurality of registers; and Based on the number of the plurality of candidate hammer addresses stored in the plurality of registers reaching a second number, one of the plurality of candidate hammer addresses is output as the hammer address, and based on outputting the hammer address, an alarm signal provided to a memory controller is converted from a second logic level to a first logic level different from the second logic level.

15. The semiconductor memory device according to claim 1, wherein: The refresh control circuit includes: a refresh control logic configured to: generate a hammer refresh signal based on a refresh management signal based on a refresh management command provided from the memory controller in response to a transition of the alarm signal; a refresh clock generator configured to generate a refresh clock signal based on the refresh control signal; a refresh counter configured to: generate a counted refresh address associated with a normal refresh operation on the plurality of memory cell rows; a hammer address storage device configured to store the hammer address and to output the hammer address based on a hammer refresh signal; and A mapper is configured to generate a hammer refresh address specifying addresses of the one or more victim memory cell rows based on the hammer address.

16. The semiconductor memory device according to any one of claims 1 to 15, further comprising: A control logic circuit configured to control the ECS circuit, the row hammer management circuit, and the ECC engine, Among them, the ECC engine is also configured as: performing a first ECC encoding operation on data to be stored in normal cells in each of the plurality of memory cell rows to generate parity data, and performing a second ECC encoding operation on the count data to generate count parity data, Wherein, the memory cell array comprises: a normal cell region including normal cells for storing the data and counting cells for storing counting data, and Parity unit area, used to store parity data and count parity data, wherein the normal cell region includes a plurality of sub-array blocks arranged in a first direction and a second direction intersecting the first direction, each of the plurality of sub-array blocks includes a volatile memory cell, and Part of the plurality of sub-array blocks includes a counting unit.

17. A memory system comprising: Semiconductor memory devices; as well as a memory controller configured to control a semiconductor memory device, The semiconductor memory device comprises: a memory cell array comprising a plurality of memory cell rows, each of the plurality of memory cell rows comprising a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array and generate an error generation signal based on the ECC decoding; an error checking and cleaning ECS ​​circuit configured to: generate a plurality of cleaning addresses for performing a cleaning operation in a cleaning mode, and output at least one of the plurality of cleaning addresses as an error address based on an error generation signal; The row hammer management circuit is configured as follows: In the ECS mode, an error flag having a first logic level is stored in a portion of a counting cell for storing counting data of each of one or more adjacent memory cell rows that are physically adjacent to a weak memory cell row corresponding to the error address among the plurality of memory cell rows; and in a normal mode, comparing a count value indicating a number of accesses associated with each of the plurality of memory cell rows with a different reference number based on a logic level of an error flag, and specifying a hammer address of a first memory row that is intensively accessed among the plurality of memory rows based on the comparison output; and A refresh control circuit is configured to receive the hammering address and perform a hammering refresh operation on one or more victim memory cell rows that are physically adjacent to a first memory cell row corresponding to the hammering address.

18. The memory system of claim 17, wherein: The row hammer management circuit is also configured to: Receive wrong address in ECS mode; sequentially accessing a first adjacent memory cell row and a second adjacent memory cell row, the first adjacent memory cell row and the second adjacent memory cell row being physically adjacent to a weak memory cell row corresponding to the error address; and An error flag having a first logic level is stored in a counting cell of each of a first adjacent memory cell row and a second adjacent memory cell row.

19. The memory system according to any one of claims 17 to 18, wherein: The row hammer management circuit includes a hammer address queue, and The row hammer management circuit is further configured to: in normal mode, storing the count value as count data in a count unit in response to an activation command from a memory controller; performing an internal read-update-write operation to read count data and an error flag from a count cell of a target memory cell row among the plurality of memory cell rows, update the count data, and write the count data to the count cell of the target memory cell row based on a lapse of a reference time interval from receiving an activate command; selectively storing a target access address specifying a target memory cell row in a hammer address queue based on comparing the count data with a first reference number of times based on the error flag having a second logic level different from the first logic level; and Based on the error flag having a first logic level, the target access address is selectively stored in the hammer address queue based on comparing the count data with a second reference number, the first reference number being less than the second reference number.

20. A semiconductor memory device comprising: a memory cell array comprising a plurality of memory cell rows, each of the plurality of memory cell rows comprising a plurality of memory cells; an error correction code (ECC) engine configured to: perform ECC decoding on data read from the memory cell array and generate an error generation signal based on the ECC decoding; an error checking and cleaning ECS ​​circuit configured to: generate a plurality of cleaning addresses for performing a cleaning operation in a cleaning mode, and output at least one of the plurality of cleaning addresses as an error address based on an error generation signal; The row hammer management circuit is configured as follows: In the ECS mode, an error flag having a first logic level is stored in a portion of a count cell for storing count data in each of one or more adjacent memory cell rows that are physically adjacent to a weak memory cell row corresponding to an error address among the plurality of memory cell rows, and in a normal mode, comparing a count value indicating a number of accesses associated with each of the plurality of memory cell rows with a different reference number based on a logic level of an error flag, and specifying a hammer address of a densely accessed memory cell row among the plurality of memory cell rows based on the comparison output; as well as a refresh control circuit configured to receive the hammering address and perform a hammering refresh operation on one or more victim memory cell rows that are physically adjacent to a memory cell row corresponding to the hammering address, Wherein, the row hammer management circuit is further configured as: Receive wrong address in ECS mode, sequentially accessing a first adjacent memory cell row and a second adjacent memory cell row, the first adjacent memory cell row and the second adjacent memory cell row being physically adjacent to a weak memory cell row corresponding to the error address, and An error flag having a first logic level is stored in a corresponding counting cell of each of the first adjacent memory cell row and the second adjacent memory cell row.

Images