STORAGE COMPONENT FOR A SYSTEM-ON-CHIP DEVICE

Abstract

comprising a memory component (210) for a system-on-chip (SoC) structure (200): a storage array; a multitude of connection pads located on a surface of the memory component (210); a logic section for interacting with the memory array and the SoC structure (200), wherein the memory component (210) is a structurally independent semiconductor device that is coupled to and partially overlaps the SoC structure (200); and Read amplifier (SA) for reading the memory array coupled to the SoC structure (200) in a direct memory access configuration.

Description

[0001] The present invention relates to storage devices and in particular to a storage component that makes it possible to replace an embedded storage section in SoC devices. STATE OF THE ART

[0002] A system-on-a-chip, or SoC, is an integrated semiconductor circuit that integrates all the components of a computer or other electronic system. These components typically include a central processing unit (CPU), memory sections, input / output ports, and secondary storage components, all on a single semiconductor substrate.

[0003] Depending on the application, a system-on-a-chip (SoC) device can include digital, analog, mixed-signal, and often high-frequency signal processing capabilities. Because they are integrated onto a single electronic substrate, an SoC device can consume far less power and occupy significantly less space than multi-chip designs with equivalent functionality. SoC devices are now widely used in mobile computing, embedded systems, and the Internet of Things (IoT).

[0004] US 2012 / 0018885A1 describes a semiconductor device comprising a logic chip and a memory chip. The logic chip includes a memory control circuit, a first via channel, and a second via channel. The memory control circuit is located on a first surface of a substrate of the logic chip, and the memory chip is located on a second surface of the substrate of the logic chip. The first via channel electrically connects the memory control circuit and the memory chip, while the second via channel is electrically connected to the memory chip and configured to carry power to the memory chip. The second via channel is electrically isolated from the logic chip, and the first surface of the substrate of the logic chip faces the base substrate.Separating the signal transmission and power supply between the logic chip and the memory chip enables high-speed operation. Furthermore, noise and interference in the memory chip's power supply can be reduced by electrically isolating the second via channel from the logic chip.

[0005] Particularly in the automotive sector, there is an urgent need to dispose of SoC devices, including controllers, memory, and connections with numerous external sensors and actuators. Furthermore, the controllers of these SoC devices must exhibit a long lifespan and extremely high reliability, and operate with the memory components embedded in the SoC device with low initial latency and maximum possible throughput.

[0006] Non-volatile flash memory is now one of the fundamental building blocks of modern electronic systems, including SoC components for automotive applications and especially for real-time operating systems (dhRTOS). Its performance in terms of speed, power consumption, modifiability, non-volatility, and the increasing importance of system reconfigurability have driven the integration of flash memory into system-on-chip devices.

[0007] However, flash integration introduces many challenges at both the system and circuit / technology levels, necessitating careful design. From a system perspective, several aspects influence the choice of flash memory type to be integrated into the SoC device; the most important, depending on the specific applications and requirements, are yield, cost, power consumption, reliability, and performance.

[0008] Furthermore, it is difficult to manage embedded memory in SoC devices when the lithography node is below 28 nm and when the embedded macro-flash can constitute most of the SoC. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a schematic and perspective view of a state-of-the-art system-on-chip device with an embedded memory section; Fig. Figure 2 is a schematic and perspective view of a system-on-chip device according to the present disclosure and includes a memory component that replaces the embedded memory section of the prior art devices; Fig. Figure 3 is a schematic view of the storage component according to the present disclosure; Fig. Figure 4 schematically shows an architecture of a controller of the memory component according to the present disclosure; Fig. 5 is an example of an instruction that is filtered by the controller according to the present disclosure; Fig. 6A and Fig. Figure 6B schematically shows an access operation to areas of a ROM of the controller of the present disclosure; and Fig. Figure 7 schematically shows an initialization of a user area of ​​the ROM of the controller of the present disclosure; Fig. Figure 8 shows a schematic view of a section of the non-volatile memory component of Fig. 2, which contains a layout configuration according to the present disclosure; Fig. 9 is a schematic view of a single one of the in Fig. 2 shown memory section; Fig. 10A is another schematic view of a single one of the in Fig. 2 shown memory section; Fig. Figure 10B is a schematic view of the connections between a generic memory cell and a corresponding read amplifier, including the modified JTAG cell according to the present disclosure; Fig. Figure 11 is a schematic view of a memory block formed by a plurality of rows of a memory array according to an embodiment of the present disclosure; Fig. Figure 12 is a schematic view of a JTAG cell modified according to the present disclosure; Fig. Figure 13 is a schematic view of a standard structural architecture that uses a boundary-scan cell configured according to IEEE Standard No. 1149.1, but includes the modified JTAG cells of Figure 10B; Fig. Figure 14 is a diagram that schematically shows in more detail the composition of registers that are integrated into a boundary-scan architecture of the present disclosure; Fig. Figure 15 shows a diagram that reports the operations of a Finite State Machine based on the JTAG protocol; Fig. Figure 16 shows a schematic view of the contents of an output buffer for the memory block architecture of the present disclosure; Fig. 17 is a schematic view of a group of address registers for a memory page in the memory section of the present disclosure; Fig. Figure 18 is a schematic view of a relationship between address and data registers in the storage section of the present disclosure; Fig. Figure 19 shows a block diagram illustrating the manufacturing process phases of the present disclosure. DETAILED DESCRIPTION

[0009] With reference to these figures, devices and methods are disclosed herein which include a non-volatile storage device or component and a host device for such storage device.

[0010] The in Fig. 1. The host device shown according to the prior art can be a system-on-chip with an embedded memory component or a more complex electronic device containing a system coupled with a storage device, as can be seen from the description of other embodiments of the present invention and the disclosure with reference to other figures.

[0011] Alternatively, the system can be an external controller that communicates with the system-on-chip, but for the purposes of this disclosure, we will refer to the host device or the SoC as entities communicating with the memory component.

[0012] For example, the system can be one of several electronic devices that can use memory for the temporary or permanent storage of information. A host device could be, for example, a computer, a mobile phone, a tablet, or the central processing unit of an autonomous vehicle.

[0013] Embodiments of the present disclosure, as well as the various features and advantageous details thereof, are explained with reference to the non-limiting examples shown in the accompanying drawings and detailed in the following description.

[0014] Descriptions of known components and processing techniques are omitted to avoid unnecessarily obscuring the embodiments described herein. The examples used herein are intended only to facilitate an understanding of ways in which the embodiments described herein can be implemented and, furthermore, to enable the person skilled in the art to implement the embodiments described herein. Accordingly, the examples should not be interpreted as limiting the scope of the embodiments described herein.

[0015] Non-volatile memory retains its contents when the power supply is switched off, making it a good choice for storing information that needs to be retrieved after a system power cycle. However, non-volatile memory is typically slower than volatile memory and often has more complex write and erase operations.

[0016] Flash memory is a type of non-volatile memory that retains stored data thanks to the electrical current, without requiring regular updates. Flash memory can be erased in blocks rather than bytes. Each erasable memory block comprises a multitude of non-volatile memory cells arranged in a matrix of rows and columns. Each cell is connected to an access line and / or a data line. The cells are programmed and erased by manipulating the voltages on the data lines.

[0017] The technology of complex semiconductor structures known as system-on-chips currently envisages the integration of at least one embedded non-volatile memory, for example up to 128 Mbit.

[0018] Fig. Figure 1 shows an example of a known solution of a complex system-on-chip (SoC) structure 100, which includes a large circuit section occupied by a conventional embedded non-volatile memory section 110.

[0019] This embedded non-volatile memory section 110 contains an array of flash memory cells arranged in Fig. 1 is displayed as an eFlash array.

[0020] To read the memory cells of the array, a dedicated circuit section 130 is provided, which contains an optimized read finite-state machine used to ensure high read performance, such as correction and so on.

[0021] To write and erase the memory cells of the array, a special logic circuit section 140 is provided, which contains a simplified RISC controller (Reduced Instruction Set Computer) or a Modify Finite State Machine, which is the logic circuit for handling the programming and erasing algorithms.

[0022] Although advantageous in many respects, systems-on-chips (SoCs) with large memory arrays can suffer from several disadvantages. This is because the memory section is implemented using a process not specifically designed for memory, and potential defects in the memory arrays can affect the lifespan or functionality of the entire SoC structure. Furthermore, if an SoC already has a flash array as embedded memory, it would be desirable to also have extended non-volatile memory as a type of remote storage.

[0023] To improve the performance of the entire SoC structure, according to embodiments of the present disclosure, the old memory section 110 was implemented as an independent memory device using a technology specifically designed for the manufacture of flash memory devices. This new memory component is associated with and connected to the SoC structure, partially overlapping it, while the corresponding semiconductor area of ​​the SoC structure was used for other logic circuits and to support the overlapping, structurally independent memory section.

[0024] A non-volatile memory structure is revealed here, which can improve access time. In each case, the system-on-chip and the associated memory device are implemented on a separate chip, which is produced by a different lithography process.

[0025] As shown in 2, according to the present disclosure we can assume that the memory section (i.e. the old reference number 110 of 1) has been removed from the SoC structure, making it possible to use the corresponding semiconductor area for other logic circuits and to provide support for a structurally independent memory component 210 that partially overlaps an SoC structure 200.

[0026] The memory component 210 is structured as a self-contained device implemented on a single chip using a technology specifically designed for the fabrication of flash memory devices. While the memory component 210 is an independent structure, it is strictly associated with the host device or SoC structure. Specifically, the memory device 210 is connected to and interlinked with the SoC structure, partially overlapping it. The corresponding semiconductor area of ​​the SoC structure is used for other logic circuits. The partially overlapping, structurally independent memory device 210 can be connected, for example, by multiple columns 230 or other similar alternative connections, such as bumping balls or using a flip-chip-like technology.

[0027] Flip-chip technology, also known as C4 (Controlled Collapse Chip Connection), is a method for connecting semiconductor devices such as IC chips and / or microelectromechanical systems (MEMS) to external circuits via solder bumps deposited on the chip pads. These solder bumps are deposited on the chip pads on the top side of the wafer during the final wafer processing step.

[0028] The present disclosure relates to a method for manufacturing a memory component for a system-on-chip (SoC) structure comprising a plurality of interconnect pads, wherein the method includes at least the following steps: - Providing a structurally independent semiconductor memory component with a memory array having at least one logic section to interact with the memory array and the SoC structure; - Providing a large number of connection pads located on a surface of the memory component; - Assign to the surfaces of the SoC structure and the memory component, which includes the connection pads; - Coupling the memory component to the SoC structure, aligning and connecting the multiple connection pads to the corresponding multiple pads of the SoC structure.

[0029] To mount the chip to an external circuit (e.g., a printed circuit board or another chip or wafer), the chip is flipped over so that its top side is facing down, and its pads are aligned pad-to-pad so that they match the pads on the external circuit. Then, solder is melted to complete the connections.

[0030] This technology differs from wire bonding, where the chip is mounted upright and wires are used to connect the chip pads to external circuits.

[0031] The final configuration will be a direct-connected SoC / Flash array, with the read amplifiers connected to the SoC in a direct-access memory configuration.

[0032] Ultimately, the storage device is manufactured according to the user's needs within a range of values ​​that can vary depending on the available technology, for example, from a minimum of 128 Mbit to 512 Mbit or even more, without restricting the applicant's rights. More precisely, the proposed external architecture allows users to overcome the limitations of current eFlash (i.e., embedded flash technology), enabling the integration of larger storage capacities, which, depending on the storage technology and technology nodes, can reach 512 Mbit and / or 1 Gbit and / or more.

[0033] The result of this solution is the new SoC structure of 2, which is strictly connected to the new structurally independent memory component 210, which is coupled to the SoC structure 200, for example by a variety of coupling elements 230, such as columns, as well as by bumping balls, flip-chip technology, face-to-face connections (coils), and the like. In a preferred embodiment, the coupling elements are columns 230, which are arranged in the semiconductor area 220 previously designated for the embedded memory section 110 of Fig. It was dedicated to number 1.

[0034] In one embodiment of the present disclosure, the memory component 210 for the SoC structure 200 comprises at least one memory section and a logic circuit section for interacting with the memory section and with the SoC structure 200, wherein the memory component 210 is a structurally independent semiconductor device that is coupled to and partially overlaps the system-on-chip structure 210. A logic circuit 240 is integrated into the SoC structure 200 to cooperate with the logic circuit section of the memory component 210.

[0035] More generally, the memory component 210 is smaller than the larger SoC structure 200, with the term "partially overlapping" meaning that the memory component 210 only partially or not completely covers the area of ​​the SoC structure 200. However, even a larger memory component 210 can be supported by and connected to the pads of the SoC structure, maintaining the position and offset of its connection or connecting pads.

[0036] The coupling between the SoC structure 200 and the memory component 210 is achieved by connecting several respective pads or pin connections facing each other in a circuit layout that maintains the orientation of the pads even when the size of the memory component 210 is changed.

[0037] In one embodiment of the present disclosure, the pads of the memory component 210 are arranged on a surface of the memory component 210. More precisely, the pads are arranged above the array so that, when the memory component 210 is inverted, its pads face the corresponding pads of the SoC structure 200. The semiconductor area 220, which in known system-on-chip devices 100 is occupied by the embedded non-volatile memory section, is dedicated to the housing of the interconnect pads corresponding to the pads of the memory component 210.

[0038] Even a larger memory component can be supported and connected using the pads of the SoC structure 200, while maintaining the position and offset of the connection pads.

[0039] In the context of this disclosure, the top side of the SoC structure 200 is connected to the back side of the memory component 210, with the pads of the SoC structure 200 oriented towards the corresponding pads of the reversed memory component. Alternatively, the structurally independent memory component 210 can be directly coupled to the SoC structure 200. In a face-to-face coupling, a stack of memory components of the same size could be superimposed, resulting in a stacked structure in which each independent component is addressed by the logic circuitry of the SoC structure 200 via a corresponding identification address.

[0040] The semiconductor area 220 previously occupied by the embedded memory section 110 is now used to implement additional functionalities and to prepare the semiconductor device for logic-over-pads technology. The term "logic over pads" means that a logic circuit is provided that overlaps some interconnect pads located inside a first or base layer, which is represented by a complete semiconductor product, i.e., the SoC structure 200.

[0041] The memory component 210 thus represents an upper layer that is coupled to and connected with the SoC base structure 200. The memory component 210 partially overlaps the SoC structure surface, covering at least the semiconductor area 220 previously occupied by the embedded memory section 110. However, the memory component 210 has a larger capacity and can cover a larger semiconductor area than the semiconductor area 220. In this respect, the size of the overlapping memory component 210 is larger than the size of the overlapping semiconductor area 220 dedicated to the connections with such an overlapping memory component 210. In other words, the area of ​​the overlapping memory component 210 is larger than the semiconductor area 220 of the SoC structure 200 dedicated to the connection pads for the memory component 210.

[0042] Furthermore, for improved functioning of the SoC structure 200, even the logic circuit section 140 of 1 (which contains the Modify Finite State Machine or RISC in the SoC device 100 of 1) can be removed and reorganized in conjunction with the memory component 210. To support the write and erase phases that are performed on the larger memory component 210, a Modify Finite State Machine or RISC 240 has been migrated into the memory component 210.

[0043] As previously stated, the memory component 210 includes the logic circuit section for interacting with the memory section and with the SoC structure 200.

[0044] Furthermore, the separation and optimization of the logic circuit section makes it possible to improve the functionality of the entire SoC structure 200, thereby obtaining an independent semiconductor memory component 210 coupled to the SoC structure 200.

[0045] This independent semiconductor memory component 210 therefore includes at least the memory section (preferably a non-volatile memory section) and the associated modification finite-state machine 240, both of which are integrated into a semiconductor product coupled to the SoC structure 200. In this case, the logic embedded in the SoC is the read logic: retrieving the data, correcting the data, elaborating, and executing.

[0046] As will appear below in this disclosure, the memory component 210 is provided with DMA capability with an interface logic JTAG-TAP using modified JTAG cells, as well as a flexible TDI, secure access, address buffers and other features for handling communication with the SoC structure 200.

[0047] In other words, both the non-volatile memory section and the associated logic circuit section are integrated into the independent semiconductor memory component 210, which is coupled and connected to the SoC structure 200.

[0048] In the context of the present disclosure, the top side of the SoC structure 200 is connected to the reverse side of the memory component 210, with the pads of the SoC structure 200 aligned with the corresponding pads of the reverse memory component 210. Obviously, according to the assumed spatial reference, it could be the other way around.

[0049] Alternatively, the structurally independent storage component 210 can be directly coupled to the SoC structure 200.

[0050] When face-to-face coupling is used, a stack of memory components 210 of the same size could be overlapped, thereby realizing a stack structure, with each independent component being addressed by the logic circuitry of the SoC structure 200 via a corresponding identification address.

[0051] Crucial to the principle of this disclosure is the idea that the semiconductor area previously occupied by the embedded memory array 110 is now used to implement additional functionality and to prepare the semiconductor device for logic-over-pads technology. The term "logic over pads" means providing a logic circuit that overlaps some interconnect pads internally with a first or base layer represented by a complete semiconductor product, i.e., the SoC structure 200. It should be noted, however, that the SoC structure could retain an embedded flash portion realized with SoC technology but might require an extended memory portion as a kind of physically close-coupled remote storage.

[0052] The memory component 210 thus represents an upper layer that is coupled and connected to the base SoC structure 200. The memory component 210 partially overlaps the surface of the SoC structure in that it covers at least the semiconductor area previously occupied by the embedded memory array 110. However, the memory component 210 has a larger capacity and covers a larger semiconductor area than the semiconductor area 110.

[0053] In this context, it can be said that the size of the overlapping memory component 210 can be larger than the size of the overlapping semiconductor area provided for the connections with the covering memory component 210. In this respect, the area of ​​the overlapping memory component 210 is larger than the semiconductor area of ​​the SoC structure 200 provided for the connection pads for the memory component 210. However, the reverse situation can also be true.

[0054] Now, with more specific reference to the example of Fig. 3 discloses the main structure of the memory component 310 according to an embodiment of the present disclosure, wherein the reference 310 of Fig. 3 of reference 210 of Fig. 2 corresponds.

[0055] The memory component 310 includes at least: an IO circuit, a microsequencer, an array of memory cells 320, an array peripheral device, a charge pump architecture, address decoders, read amplifiers and corresponding intermediate storage, a service logic to connect all parts of the memory and a command user interface, for example a CUI block.

[0056] The array of memory cells 320 contains non-volatile flash memory cells.

[0057] In one embodiment of the present disclosure, the memory component 310 implements a direct-access memory type to replace the embedded memory array of known SoC devices.

[0058] Furthermore, the proposed idea envisages the implementation of the 310 memory component in a "Known Good Die" (KGD) form factor or bare die, which allows the read amplifier outputs, except for an intermediate storage structure in the middle, to be directly connected to a controller of the SoC structure.

[0059] Strategies for achieving the KGD form factor were based on leveraging existing infrastructure for testing and burning in conventionally packaged components. This minimizes the amount of hardware, tools, or inserts that make bare-die products more expensive.

[0060] Furthermore, a JTAG interface 350 is used for testing the memory component 310, which allows the test tool to be reused. Therefore, the memory component 310 also includes JTAG logic 350. This JTAG interface 350 will be described later with reference to Fig. 8 revealed in more detail.

[0061] More precisely, each memory array includes at least one JTAG 350 interface, which receives standard JTAG signals as inputs: TMS, TCK, TDI, as well as data from a memory page, as shown in Figure 8. According to embodiments of the present disclosure, Extended TDI is used as a flexible TDI. The flexibility is based on the fact that the number of parallel bits operating as TDI depends on the selected registers, i.e., K (four in the example) lines for the instruction register, M lines for the address register, N lines for the data register, and so on. TDI is derived from the JTAG protocol, which uses TDI as the name for the signal used to fill the registers.

[0062] This JTAG interface 350 generates data, addresses and control signals as output, which are transmitted to a memory address decoder 340 and also to the internal flash controller 300 to perform modification, testing and verification operations.

[0063] The activity of decoder 340 is enabled by charge pumps 330, which are designed to keep the voltages and timings for managing the array secret. The decoding phase drives the data lines, while the charge pumps provide the high voltage fed from the address decoder into the selected data lines.

[0064] This Decoder 340 addresses the selected memory block. The address decoder is connected to the array to select the correct data lines, i.e., row and column for each superpage. Reading, modifying, and all other operations use the address decoder to correctly address bytes in the memory array.

[0065] A memory block is connected to the read amplifiers, and the read amplifiers of the 360 ​​read interface are connected to the SoC device 200 using the modified JTAG cells. The communication channel between the flash array blocks and the SoC device 200 is represented by a control and status bus.

[0066] The output of the 360 ​​read interface is represented by an extended page containing the combined chain of data cells, address cells, and ECC cells. The write operation also drives the three components (data cells, address cells, and ECC cells) of the extended page; the ECC and address cells serve as a safety mechanism to ensure a low probability of errors.

[0067] The total number of bits would comprise N+M+R bits in the example disclosed herein, for example one hundred and sixty-eight pads per channel in the implementation disclosed herein.

[0068] The memory component 310 uses the connection pads and logic circuit section to enable connection to the SoC structure 200.

[0069] The final configuration will be a direct-connected SoC / flash array, with the read amplifiers connected to the SoC in a direct memory access configuration. The connections also include the JTAG interface and control pins for testing and other purposes.

[0070] In this way it is possible to keep the number of required connections relatively low, for example in this particular disclosure in the range of 600 to 650 pads, but a larger or smaller number could depend on the implementation.

[0071] The memory array 320 of the memory component 310 is structured as a collection of subarrays. The sampling chains can be connected to form a unique shift register in order to properly test the connections.

[0072] The advantage of this architecture is its high scalability, where increasing and / or decreasing the endpoint density is simply reflected in the mirroring of a subarray and the provisioning of the corresponding connections in a highly scalable manner. Memory can also be expanded by increasing the memory size per subarray without increasing the number of channels for the SoC.

[0073] Direct Memory Access makes it possible to reduce the final latency that the SoC may experience when reading data.

[0074] Advantageously, according to the present disclosure, the memory component 310 is equipped with a controller 300 of the flash array 320 (hereinafter referred to as the flash array controller), wherein the flash array controller 300 has an architecture that makes it possible to share some flash array resources with the SoC controller without compromising the confidentiality of certain information stored therein (e.g., algorithms, flash array voltages, currents, and more in general process information) and guarantees eventual customer returns management.

[0075] Fig. Figure 4 is a schematic view of the architecture of a controller 400 according to the present disclosure, wherein the controller 400 is derived from the controller 300. Fig. 3 corresponds.

[0076] The control unit 400 comprises a processing unit 410 and a storage unit 420, which is operationally connected to the processing unit 410.

[0077] According to one embodiment of the present disclosure, as shown in Figure 4, the memory unit 420 is a flash memory array that functions as a ROM. The advantage of this is that it can be updated as needed or during an upgrade, and such an update can be performed safely over the air. Therefore, the memory is partially addressable (readable / writable) from outside the flash array controller 400, i.e., from the SoC controller, as will be described in detail below.

[0078] In particular, the ROM-like structure comprises at least two distinct flash blocks, logically mapped as a continuous address space. In other words, the ROM is divided into a first 420' area and a second 420" area, mapped as a continuous address space, which are physically separate and can be erased independently.

[0079] As shown in Figure 4, the processing unit 410 includes a control section 430 (also called the ROM user area - RUA - watchdog) configured to allow the user selective and guided access to the areas of the ROM, as described below.

[0080] According to one embodiment of the present disclosure, the user can write and store their own firmware in the first area 420' of the ROM. Therefore, the first area 420' contains the user firmware and can be accessed by an external controller, for example, the controller of the SoC.

[0081] On the other hand, the second 420" area is configured to store the flash array controller firmware (i.e., the internal controller firmware that manages the system's operation and was written by the manufacturer), and the user cannot access it directly. Therefore, the second 420" area can only be written to by the manufacturer, and the user cannot directly access it or use and modify the firmware embedded within it.

[0082] Due to the above separation of the first and second areas, the ROM of the controller 400 of the present disclosure is thus partially addressable (readable / writable) by the SoC controller.

[0083] To correctly identify which user firmware instruction should be retrieved for execution, the controller 400 includes a register that identifies which firmware instruction should be retrieved and executed next, such a register being commonly referred to as a program counter (PC).

[0084] The control section 430 of the processing unit 410 is connected to the program counter PC via an address bus, so that it can detect the value of the program counter PC and read the memory address of the instruction to be executed, which address is referred to here as PC_Adr.

[0085] The processing unit 410, specifically the control section 430, is then configured to compare the memory address received from the program counter PC with a reference value (or threshold address, hereinafter referred to as User_ADDR_limit) previously stored in the processing unit 410. The reference value User_ADDR_limit can be set by the manufacturer as needed and / or according to circumstances.

[0086] According to one embodiment of the present disclosure, the reference value User_ADDR_limit is a ROM memory address that separates the first area 420' from the second area 420'. Preferably, the reference value User_ADDR_limit belongs to the first area 420' of the ROM and is the memory address at the boundary between the first area 420' and the second area 420" of the ROM.

[0087] In particular, if the memory address PC_addr received by the program counter PC belongs to the first area 420' of the memory unit 420 (i.e., it is assigned to the first area 420'), the processing unit 410, in particular the control section 430', generates a corresponding output signal suitable for disabling actions associated with the user firmware instruction to be executed and corresponding to the memory address PC_addr, thereby applying a restriction to the user firmware instruction.

[0088] In this way, the controller 400 can recognize that the command to be executed is not a command of the manufacturer-written controller firmware, but a command of the user firmware with a lower (or generally different) priority level and therefore with some restrictions, so that part of the manufacturer's code in the second area 420" as well as other areas are not directly accessible to the external user.

[0089] In particular, the generated output signal is adapted to trigger dedicated filter blocks of the Controller 400, the filter blocks being configured to respond to the instructions of the user firmware (e.g., the target addresses of such instructions) in order to prevent the execution of some actions associated with these instructions, thereby applying the restrictions specified above to the instructions of the user firmware.

[0090] The aforementioned output signal of the processing unit 410 will also be referred to as the RUA signal in the following.

[0091] More precisely, in one embodiment of the present disclosure, the RUA signal is generated by a state machine in the processing unit 410, and such a signal takes on different values ​​based on the above comparison of the memory address PC_addr with the reference value User_ADDR_limit. For example, the RUA signal can be high (e.g., equal to 1) if the memory address PC_addr associated with the user instruction is an address in the first area 420' of the ROM, and can be low (i.e., equal to 0) if the memory address PC_addr is an address in the second first area 420" of the ROM.

[0092] In one embodiment of the present disclosure, the processing unit 410, in particular its control section 430, is configured to generate and assert the RUA signal when the value of the program counter PC is less than or equal to the reference value User_ADDR_limit, i.e., when the program counter PC is located within the ROM area shared with the external controller (namely, within the first area 420' of the ROM). The control section 430 of the processing unit 410 is thus configured to check whether PC_addr is User_ADDR_limit.

[0093] Based on the above comparison between the captured memory address PC_addr of the program instruction and the reference value User_ADDR_limit, it is therefore possible to enable / disable actions that are associated with the program instructions of the user firmware, especially thanks to the RUA signal generated by the processing unit 410.

[0094] As will be revealed in more detail below, the actions associated with the user firmware program instructions can include, for example, accessing specific parts of the ROM, selecting specific RAM addresses, or selecting specific test registers implemented in the memory component assigned to controller 400. The filter blocks mentioned above, which are activated by the RUA signal (i.e., activated when PC_addr User_ADDR_limit is active), are therefore able to detect the respective target address of these instructions and react accordingly to prevent these actions.

[0095] Advantageously, according to a preferred embodiment of the present disclosure, the user firmware is able to use some subroutines of the controller firmware without having direct access to and knowledge of the details of such subroutines.

[0096] In order to connect, in particular, the user firmware of the first area 420' with the controller firmware of the second area 420", the second area 420" of the memory unit 420 comprises a variety of application programming interfaces (APIs). According to one embodiment of the present disclosure, it is not possible to directly call an API of the second area 420" by the user firmware, i.e., directly from the first area 420', so that some reserved information is not shared with the user. The API is called as described below.

[0097] In particular, the second area 420" of the ROM is further configured to store multiple call commands that can be invoked by the user firmware, each of these call commands being assigned a specific address within the second area 420". The call commands interrupt the program flow by transferring control to a subroutine of the controller firmware. In this way, the multitude of call commands defines a sub-area 420sub within the second area 420" of the memory unit 420, with this sub-area 420sub storing all the necessary call commands. The call commands of this sub-area 420sub are designed to invoke all the APIs contained in the second area 420" of the ROM and are therefore adapted to connect the user firmware of the first area 420' with subroutines of the controller firmware of the second area 420".

[0098] The API in the second area 420" is written by the manufacturer and cannot be directly accessed or modified by the user. This allows the user program in the first area 420' to interact with the control program in the second area 420" through the call commands of the sub-area 420sub, without requiring direct access to the latter.

[0099] The multitude of call commands in subspace 420sub of the second space 420" defines an API lookup table in the second space 420" of storage unit 420, where this API lookup table is a collection of call commands adapted to provide an interface for the external user.

[0100] The addresses of the call instructions stored in subarea 420sub of the second ROM area 420" are contained between the memory addresses of the first area 420' and the remaining addresses of the second area 420', with the subarea being directly accessible by instructions of the user firmware.

[0101] In particular, according to a preferred embodiment of the present disclosure, the subrange 420sub, which contains the call commands, is assigned above the second range 420", and the reference value User_ADDR_limit is the lowest address of the first range 420'. In other words, the subrange 420sub is the part of the second range 420" that is characterized by higher addresses, although other configurations are not excluded.

[0102] According to one embodiment of the present disclosure, the RUA signal generated by the processing unit 410 prevents the user firmware from directly calling an API instruction in the second area 420" from the first area 420'. More precisely, when an API is called directly by a user firmware instruction, the control section 430 of the processing unit 410 detects the corresponding address PC_addr of the program counter PC and determines that it belongs to the first area 420': the RUA signal is generated (e.g., the RUA signal is equal to 1), and the user is not allowed to directly call an API located in the second area 420".

[0103] In particular, according to one embodiment of the present disclosure, the processing unit 410 is configured to implement a first filter block 440 that acts on the user program instruction based on the RUA signal. When the RUA signal is generated (e.g., the RUA signal is equal to 1), the first filter block 440 is configured to mask parameters of the user firmware program instruction to prevent direct access to the second area of ​​the memory unit, as shown in Fig. Figure 5 shows where some bits are forced to 0. For example, if the RUA signal is equal to 1, the instruction is filtered so that the destination addresses of JMPs and Calls instructions are masked to prevent a direct jump to the internal controller's FLASH area, and the significant bits are set to 0. The subsequent jump / call allowed by the controller architecture therefore goes to the API look-table area, i.e., subarea 420sub.

[0104] On the other hand, if the user program command calls a call command from the API lookup table in subspace 420sub, the control section 430 recognizes that PC_addr > User_ADDR_limit and no control output signal is generated (i.e., the RUA signal is equal to 0), because the memory address in this case is an address associated with a call command in subspace 420sub, which is a valid range; in this way, the call command invoked by the user firmware can call an API of the second range 420, which is thus executed without restriction, since it is called by a command in subspace 420sub, as shown in Fig. 6A and Fig. 6B. Fig. 6A illustrates this general principle and Fig. Figure 6B illustrates an example case where the first of many APIs is called by the corresponding caller in subroutine 420sub. Therefore, when a subroutine is called by a caller corresponding to a RUA signal of 0, all actions are permitted. The call (and the corresponding return value) is thus a two-step process, and no direct call is allowed.

[0105] In this way, the user can use the call commands in sub-area 420sub to call the desired API of the second area 420" and perform the associated actions.

[0106] In summary, an API can be invoked by a command stored in subspace 420sub, i.e., within the internal controller's flash ROM area, which has memory addresses between the reference value User_Addr_limit and another limit in the second area 420, called API_ADDR_limit. Such a command is first invoked by a user firmware command, i.e., within the user's flash ROM area. This has the advantage that the user can write their own firmware in the first area and interact with the controller's internal firmware in the second area, while maintaining the confidentiality of certain information, thus providing a very versatile and reliable controller.

[0107] Referring again to paragraph 4, the controller 400 according to one embodiment of the present disclosure further comprises a random access memory (RAM) 450, which includes a first RAM area 450', which the user firmware can directly access (and is therefore directly accessible by an external controller such as the SoC controller), and a second RAM area 450" with different addresses. The first area 450' of the RAM is the stack pointer, in which data is organized in a LIFO configuration, enabling the execution of push-pop instructions as known in the prior art. Accordingly, the user may always access this area without restriction. The separator RAM address between the first RAM area 450' and the second RAM area 450" is hereby referred to as STACK_ADDR.

[0108] The second area 450" of the RAM comprises a first part 451, which the user can never access (only the manufacturer can access this first part 451), and a second part 452, which the user can access under certain circumstances.

[0109] In particular, when processing unit 410 generates the output signal (i.e., when the RUA signal is equal to 1), a dedicated second filter block 460 (hereafter referred to as R_Addr_filter) prevents the selection of all addresses in the second area 450'' of RAM, and the second part 451 of this area is also unaddressable. In this case, the user can only control the first area 450', i.e., the stack pointer area, through PUSH / POP instructions.

[0110] In other words, if the user firmware program instruction is assigned to a memory address belonging to the first area 420' of the ROM, the processing unit 410 recognizes that such an instruction does not have the necessary privileges to access section 452 of the ROM RAM, so the second filter block 460, which receives at its input the address (displayed as ram_addr) of the part of RAM that the user wants to access, masks the relevant parameters of the instruction so that such a part is not addressable.

[0111] However, if the output signal is not generated (namely, if the RUA signal is equal to 0), i.e., if an API in the second area 420" is accessed by the correct call instruction in sub-area 420sub (which in turn is called by the user program instruction in the first area 420'), all restrictions for that specific instruction are lifted, and the user can access the second area 450" of RAM, specifically the second part 452 of the second area. In other words, when RAM is addressed by an API called by its correct caller, the RAM address restrictions are removed.

[0112] Furthermore, according to one embodiment of the present disclosure, the controller includes an interface with several test registers (simply referred to as T_reg), wherein each register is assigned to a specific address (referred to as T_reg_addr) for testing the functionality of the memory component assigned to the controller 400, or more generally for connecting the memory component to a test machine and / or an external controller.

[0113] The test mode architecture of the memory chip is therefore based on these registers, which may be written to / read from the SoC controller via the JTAG interface, from the test machine via the JTAG interface, and from the Flash Array Controller 400 via internal buses.

[0114] The test registers T_reg contain the instructions (e.g. parameters such as currents / voltages) for testing the memory module.

[0115] In particular, test registers are organized into several banks, each containing N registers (N = 8, 16, etc.) and assigned to a specific address (hereafter referred to as TL_addr). Each bank can also control one or more macro functions (analog or digital). For example, bank 0 is dedicated to the Positive Read Charge Pump, and each bit of the bank corresponds to a specific function (e.g., bit 0 = enable pump, bits 5:1 = clock frequency, bits 7:6 = drive capability (max. current)), while bank 12 is dedicated to the sense amplifier.

[0116] The memory chip test is therefore managed by a protocol based on a JTAG interface, using instructions from the test registers T_reg. As mentioned earlier, the test can be controlled by the SoC controller or by an external test machine. In either case, both approaches are based on an integrated self-test (BIST) performed by the internal Flash Array Controller 400 of this disclosure. This approach also keeps the internal algorithm with sensitive technological parameters (such as timing voltages and the like) confidential.

[0117] To enable the use of some test registers and to disable access to other reserved test registers, the controller 400 according to an advantageous embodiment of the present disclosure includes a third filter block 470 (also referred to as the T_Addr filter).

[0118] In fact, the external user cannot access all test registers T_reg, and the third filter block 470 is configured to disable access to some test registers T_reg based on the RUA signal generated by the processing unit 410. In this embodiment, the third filter block 470 is configured such that when the RUA signal is generated by the processing unit 410, some reserved registers are not addressable by masking the specific address of such a register, and the output of such a third filter block 470 provides only the first allowed register T_reg.

[0119] The non-addressable test registers T_reg are written by controller 400 to a configuration register.

[0120] Once the address captured by the program counter PC is within the second subrange 420" of the ROM (i.e., when PC_addr > User_ADDR_limit), the RUA signal is zero, and all restrictions are lifted. In other words, if a test register T_reg is accessed by an API called by a proper caller in subrange 420sub, this register is not forbidden and can be used by the external user (though it cannot be directly accessed by the user firmware). In this way, the user can access some registers without being able to directly write to or erase them; that is, they have indirect access to the registers.

[0121] In one embodiment, some registers T_reg can never be accessed by the user firmware and can only be accessed by the manufacturer, who has the necessary privileges to run a specific test mode that requires the user of such a forbidden register.

[0122] According to one embodiment of the present disclosure, the processing unit 410 is also configured to receive at one of its inputs a further signal that forces the control section 430 not to generate an RUA signal (i.e., it sets RUA to 0 by default). For example, this further signal, here referred to as Force_RUA_low, is the output of one of the plurality of test registers T_reg, preferably a register that the external user cannot access (i.e., a register that can only be accessed using a high-privilege test mode, which, for example, can only be performed by the manufacturer). In this case, all restrictions are removed.

[0123] Finally, according to one embodiment of the present disclosure, the external controller (e.g., the controller of the SoC) is not able to directly program the first area 420' of the ROM. The controller can then be programmed by the user by a method that includes: writing firmware to a portion of the RAM using the JTAG protocol, in particular to the second part 452 of the second RAM area 450", as shown in Fig. Figure 7 shows the procedure. It involves calling an API stored in the second area (420") of the ROM, where the API is specifically dedicated to the user programming phase, and then moving the firmware via this API to the first area (420") of the ROM, where it is stored. The API for user flash updates then erases and programs the firmware into the flash block. This operation is possible because the two flashes are separated by a "well area".

[0124] In summary, according to the present disclosure, the controller allows the user to write their own firmware to the dedicated ROM area and shares some information to perform certain operations, while secret information remains confidential as it is executed indirectly. The API lookup table and some areas of the controller are never accessible. In particular, thanks to the RUA signal generated by the processing unit, it is possible to implement a "command filter" configured to filter some user program commands to prevent calls / jumps outside the permissible range. Therefore, during code execution from the user's FLASH ROM area (i.e., when RUA = 1), certain restrictions are applied to accessible code areas, addressable RAM addresses, and T_REG, and subsequently, usable text modes.Even if the user is allowed to use some of the controller's resources, they cannot directly access or write to forbidden areas of that controller.

[0125] This modified architecture ensures great versatility of the controller of the present disclosure and allows the user to use some functionalities without directly accessing forbidden areas.

[0126] Furthermore, the filters can be configured to apply different restrictions to different users with varying access rights (for example, different RAM areas, different T_reg restrictions, and different available APIs). Specifically, the controller's filters can receive additional input that takes into account the specific test mode being executed, with each test mode associated with a particular user and their respective privileges. This allows the controller to apply different restrictions to different users, as described above. Thus, it is possible to run different test modes with varying privileges, and access to certain areas of the controller is restricted according to these privileges.

[0127] In other words, the filter blocks can be configured differently depending on the different users, which can be detected by the controller during authentication, allowing the controller to configure the filters accordingly.

[0128] Upon closer examination of the internal structure of the memory component 210 (or 310), it should be noted that the architecture of the memory array 320 is structured as a collection of subarrays 900, as shown schematically in Figure 9, where the reference 320 of Fig. 3 of the reference 920 from Fig. 9 corresponds to.

[0129] Each subarray 900 is independently addressable within the storage device 310. Each subarray 900 contains several memory blocks 1160 (more details in Fig. 11 shown).

[0130] In this way, smaller sectors compared to known solutions significantly reduce access time and improve the overall throughput of the memory device. The reduction in initial latency occurs at the block level, as the row and column lines, the latency associated with the read path, and external communication have been optimized. Initial latency is the time required to obtain the first valid data after the address has been issued.

[0131] In the embodiments disclosed herein, the memory array 920 is structured with a number of subarrays 900 corresponding to the number of cores of the associated SoC 200 and therefore the number of corresponding communication channels. For example, at least four memory subarrays 900 are provided, one for each communication channel with a corresponding core of the SoC 200.

[0132] The host device or system-on-chip 200 typically includes more than one core, and each core is coupled to a corresponding bus or channel for receiving and transmitting data to the memory component 210 or 310. We generally refer to a number of K buses for N data bits.

[0133] Therefore, in the present implementation, each subarray 900 has access to a corresponding channel to communicate with a corresponding core of the System-on-Chip 200. The result of the memory block operations is transferred directly to the SoC without using high-performance buffers or optimizing the path.

[0134] The advantage of this architecture is that it is highly scalable, with increasing and / or decreasing the density of the end device only resulting from mirroring a subarray and creating the connection or increasing the number of blocks in each subarray, i.e., the available density per core.

[0135] In embodiments of the present disclosure, each independently addressable location of the blocks of each memory subarray 900 addresses an extended page 1150 (for more details in Fig. 11), which is also defined below as the term superpage, meaning a double extended page.

[0136] As a non-restrictive example, this extended page 1150 includes a string comprising a first group of at least N bits, for example, one hundred and twenty-eight (128) bits for I / O data exchange with the SoC device 200, plus at least a second group of M bits, for example, twenty-four (24) address bits, and a final or third group of at least R bits, for example, sixteen (16) ECC bits. The M address bits (in the example, the 24 address bits) are sufficient to address up to 2 gigabits of available memory.

[0137] According to the present disclosure, the outputs of the read amplifiers SA each prepare a doubly extended page, i.e., a super page 1150 with a number of bits given by the double combination of the above-mentioned three groups of data bits, address bits and ECC bits, corresponding to the size of the memory array.

[0138] In the specific but non-limiting example hereby disclosed, each extended page 1150 contains at least 168 bits obtained by combining the above three groups of N+M+R = 128 + 24 + 16 data, address and ECC bit, and each superpage is formed by a pair of extended pages, i.e. a group of 168 × 2 bits.

[0139] To give just one non-restrictive numerical example, each line of a memory block contains 1160 sixteen extended pages. Therefore, the resulting line contains 2688 bits, which come from the combination of sixteen independently addressable extended pages, each containing 168 bits, or, in other words, the combination of eight superpages.

[0140] In embodiments of the present disclosure, the output of a generic subarray 900 is formed by combining the following sequence: N data cells plus M address cells plus R ECC cells. In this non-restrictive example, the total number of bits would comprise 168 pads per channel, as in the example in Fig. 8 shown.

[0141] The combined string of data cells + address cells + ECC cells enables the implementation of bus security coverage according to standard requirements, since the ECC covers all bus communication (data cells + address cells), while the presence of the address cells ensures that the data comes exactly from the addressed location of the responsible party.

[0142] The read amplifiers SA of each subarray 920 are connected to a scanning chain of modified JTAG cells 950, which connect all outputs of a subarray 900 together, as shown in the Fig. 9 and Fig. 10A shown.

[0143] Figure 10A shows a schematic view of a memory section, where the architecture of the subarray 900 is structured to serve at least one channel of the SoC structure 200 to which the memory component 210 is connected.

[0144] In this Fig. Figure 10A shows an example where the modified JTAG cells 950, which are assigned to a subarray 900, can be connected together to form a unique scan chain 1000 for fast checking the integrity of the pad connections.

[0145] Thanks to the memory architecture of the present disclosure, it is possible to switch from a parallel mode for retrieving data and addresses from the memory subarrays 900 to a serial mode for checking the connections between the memory component 210 and the associated SoC device 200. Furthermore, the SoC 200 is authorized to read '1' and '0' once for testing purposes and can also analyze the memory result and read the data using the scan chain.

[0146] It should also be noted that each subarray comprises 900 address registers connected to data buffer registers, similar to an architecture used in a DRAM storage device, i.e., DDRX-type DRAMs.

[0147] In the following sections of this disclosure, it will be evident that the outputs of the SA read amplifiers per subarray 900 are buffered by an internal circuit to allow the read amplifiers to perform a further internal read operation to prepare the second half-byte, or group of 128 bits. This second half-byte is transferred to the output of the flash array 320 using an additional enable signal (i.e., an internal clock signal or an ADV signal; ADV = Address Data Valid. In our case, the signal is load_data[1:0], depending on the addressed flip-flop), which transfers the content read at the read amplifier level to the host device or SoC device 200.

[0148] In other words, the internal read amplifiers prepare two extended pages 1150, and while the first page is ready to be shifted (or ejected), an internal reading phase of the second page, which is assigned to the same address, is performed. This allows the preparation of five to eight double words (in the present example), which are typical in RTOS applications. In any case, the disclosed structure can be extended to allow multi-page reading while the already read page is being ejected.

[0149] The SA read amplifiers are directly connected to modified JTAG cells 950, which will be disclosed in more detail later, to integrate a JTAG structure and the read amplifiers into a single circuit section. This allows the delay in passing the memory array's output to the SoC to be reduced as much as possible.

[0150] To give just a numerical example based on the embodiment disclosed herein, we can note that each address in the address buffers is associated with a data buffer containing, for example, N data bits (i.e., 128 bits). However, the SoC may require up to 2*N bits (i.e., 256 bits, not including the address bits and the ECC) at any one time, so the data buffers are duplicated to allow for shifting, assuming address 0 of subarray 0 is used.

[0151] First pass of the first group of N bits: Data 0_0_H [127:0]

[0152] Second pass of the second group of N bits: data 0_0_L [127:0]

[0153] The above information refers to a standard read, which is used, for example, for security purposes and data integrity / correction.

[0154] In one embodiment, the address buffers are implemented by using modified JTAG cells 950, as we will see below.

[0155] In one embodiment of the present disclosure, each subarray 900 within the storage device 210 is independently addressable.

[0156] As in Fig. As shown in Figure 11, each block 1160 of each memory subarray 900 is structured with a row 1135 containing at least 16 double words of N bits each (i.e., 128 bits), plus the M address bits and the R ECC syndrome replacement bits per page, forming a memory page of N+M+R 168 bits. This architecture resembles a DRAM-like scheme for preparing multiple addresses simultaneously. For example, each double word containing N+M+R bits can comprise 168 bits plus 168 bits to form the previously mentioned superpage.

[0157] A person skilled in this field will recognize that a larger or smaller storage device can be structured with an increased number of storage subarrays 900, thereby increasing or decreasing the density of the final storage device 210. A larger storage device, for example, is obtained by mirroring a subarray 900 and providing the appropriate connections in a highly scalable manner.

[0158] The combined string of data cells + address cells + ECC cells enables the implementation of bus security coverage according to standard requirements, since the ECC covers all bus communication (data cells + address cells), while the presence of the address cells ensures that the data comes exactly from the addressed location of the responsible party, i.e., when ADD == ADD0.

[0159] The RECC cells enable the host controller to understand whether damage to the data and address content is occurring.

[0160] The implementation of these mechanisms ensures the optimization of the memory read process.

[0161] The JTAG cell 950 is like in Fig. 10B is shown connected as follows: PIN: Output of a reading amplifier POUT: to SoC correspondent Data I / O SIN: is the serial IN input, which is connected to the SOUT of the previous reading amplifier. SOUT: is the serial output that is connected to the SIN of the next reading amplifier.

[0162] The scan chain 1000 formed by the interconnected JTAG cells 950, using the serial inputs and outputs, has several advantages: - be able to test the successful connection between the SoC and the Direct Memory Access (DMA) memory; - be able to implement a digital test of the read amplifiers, since the cell can act as a program load to store the data within the array; - be able to function as a second level of buffers.

[0163] We shall see later in the present disclosure that when the first group of data bits is ready to be transferred to the parallel output POUT of the read amplifier, there is an internal buffer coupled to the read amplifier which triggers the read data of the subsequent section of the remaining data bits.

[0164] With further reference to the examples of Fig. 10A and Fig. 10B we can consider the connections of each JTAG cell 950: PIN is coupled to the output of a read amplifier; POUT is coupled to the corresponding data I / O of the host device 200 (i.e. the system-on-chip); SIN is the serial IN input connected to the SOUT of the previous read amplifier, while SOUT is the serial output connected to the SIN of the next read amplifier.

[0165] For example, the schematic example of Fig. 10B A schematic and generic memory cell MC, which is arranged at the interface of a series of memory cells and a column of memory cells in a matrix of cells of a generic submatrix, such that the cell can be addressed accordingly. The actual implementation may include additional circuitry from the cell to the output of the SA, but this is not shown to be irrelevant for the purposes of this disclosure.

[0166] A read amplifier SA is connected to the column of memory cells as part of the read circuitry used when reading data from the memory array. Generally speaking, a memory word containing the aforementioned superpage 1150 is read all at once, and in this example, we are referring to a memory page containing data + address + ECC bits.

[0167] As is generally known, the role of the read amplifier is to capture the low-power signals from the array. The low voltage values, representing the logic data bit (1 or 0, depending on the convention) stored in the memory cell MC, are amplified to a recognizable logic level, allowing the data to be correctly interpreted by logic circuit sections outside the memory.

[0168] In the example disclosed herein, the output of each read amplifier SA is coupled to the modified JTAG cell 950 to integrate a JTAG structure and the read amplifier.

[0169] In the non-restrictive example disclosed herein, an output amplifier OA is inserted between the read amplifier SA and the JTAG cell 950.

[0170] Thanks to the memory architecture of this disclosure, it is possible to switch from a parallel mode for retrieving data and addresses from the memory subfields 900 to a serial mode for verifying the connections between the memory component 210 and the associated host device. Furthermore, the SoC is authorized to read '1' and '0' once for testing purposes and can also analyze the memory result by reading the data using the scan chain.

[0171] The transition from parallel to serial mode is managed by the JTAG 350 interface. However, the implementation of these dual-mode operations is made possible by the special structure of a modified JTAG 950 cell, which is disclosed below.

[0172] With more precise reference to the schematic example of Fig. Figure 12 shows a JTAG cell 1200, which is modified according to the present disclosure and corresponds to the modified JTAG cell 950 previously disclosed with reference to the Fig. 9, Fig. 10A and Fig. 10B was revealed.

[0173] The JTAG Cell 1200 has a first parallel input pin and a first serial input sin, which receives corresponding pin and sin signals. In addition, the JTAG Cell 1200 has a first parallel output POUT and a first serial output SOUT. The Scan Chain 1000 enables the output of the entire 256 bits, as the first group is read directly from the output while the second group is prepared in the background.

[0174] As shown in Figure 12, the JTAG cell 1200 can be viewed as a box with two input terminals, PIN and SIN, and two output terminals, POUT and SOUT. The input terminal PIN is a parallel input, while the input terminal SIN is a serial input. Similarly, the output terminal POUT is a parallel output, while the output terminal SOUT is a serial output.

[0175] Thanks to the serial input and output, a test process can be performed to verify that there are no faulty connections between the memory component 210 and the associated system-on-chip 200. Thanks to the parallel input and output, the same JTAG cell is used as a data buffer for the completion of the read phase by the read amplifiers SA.

[0176] The JTAG cell 1200 comprises a boundary-scan base cell 1280 with a pair of intermediate storage units 1201 and 1202 and a pair of multiplexers 1251 and 1252. A first input multiplexer 1251 and a second output multiplexer 1252.

[0177] The boundary scan base cell 1280 is represented by the dashed box in Fig. 12 is displayed and is a cell with two inputs, with a serial input corresponding to SIN and a parallel input corresponding to PIN, and a cell with two outputs with a serial output corresponding to SOUT and a parallel output corresponding to POUT.

[0178] The first multiplexer 1251 receives a parallel input signal Pin from the first parallel input terminal PIN at a first input “0” and a serial input signal Sin from the first serial input terminal SIN at a second input “1”.

[0179] This first multiplexer, 1251, is driven by a control signal, ShiftIR (referred to as the instruction register signal), and has one output, MO1. Cell 1200 has two parallel outputs, MO1 and MO2. When the JTAG clock arrives, the serial output is driven from SOUT. SOUT is connected to the JTAG buffer near the multiplexer, which receives a selector signal: Mode Controller (serial / parallel). Essentially, the output of the buffer connected to input '1' of this multiplexer, MO2, is also SOUT.

[0180] The first multiplexer output MO1 is connected to a first input of the first intermediate memory 1201, which receives a clock signal ClockDR at a second input terminal.

[0181] The first intermediate storage device 1201 is connected in series with the second intermediate storage device 1202, wherein a first output of the first intermediate storage device 1201 is connected to a first input of the second intermediate storage device 1202.

[0182] It is important to note that the output of the first buffer 1201 is also the serial output SOUT of the entire JTAG cell 1200.

[0183] A second input port of the second buffer 1202 received a signal UpdateDR.

[0184] The second buffer 1202 has an output that is connected to an input of the second multiplexer 1252, in particular to its second input.

[0185] This second multiplexer 1252 is controlled by a mode control signal, which makes it possible to switch the entire JTAG cell 1200 from a serial to a parallel mode and vice versa.

[0186] In one embodiment of the present disclosure, the JTAG cell 1200 further includes an additional pair of intermediate storage locations 1221 and 1222, which are provided between the parallel input pin and the second multiplexer 1252. These additional intermediate storage locations 1221 and 1222 are for storing the direct read, i.e., the first group of data bits, and the shadow, i.e., the second group of 128 data bits (excluding the address bits and the ECC). In other words, the JTAG cell 1200 includes the boundary-scan cell 1280 and at least the additional intermediate storage locations 1221 and 1222.

[0187] We will refer to these additional intermediate storage devices as a third intermediate storage device 1221 and a fourth intermediate storage device 1222. In other embodiments, a longer chain of intermediate storage devices can be used.

[0188] In particular, the third intermediate storage 1221 and the fourth intermediate storage 1222 are connected in a small pipeline configuration, wherein the third intermediate storage 1221 receives at a first input the parallel input signal Pin from the first parallel input terminal PIN and receives at a second input a signal Data_Load' [0] corresponding to the previously mentioned AVD signal and a first data load.

[0189] The fourth intermediate storage 1222 receives at a first input the output of the third intermediate storage 1221 and receives at a second input a signal Data Load[ 1 ] (always the AVD signal) which corresponds to a subsequent data load.

[0190] The output of the fourth intermediate storage 1222 is connected to the first input “0” of the second multiplexer 1252, which generates the output signal for the parallel output POUT at its output terminal MO2.

[0191] In comparison to a conventional JTAG cell, the JTAG cell 1200 of the present disclosure can be considered a modified JTAG cell due to the presence of the two additional intermediate storage units, the third and fourth intermediate storage units 1221 and 1222, in addition to the presence of the boundary scan cell 1280'.

[0192] Now we must imagine that a JTAG cell 1200 is coupled to the output of each read amplifier SA of the memory subarray 900. As usual, the memory array provides one read amplifier for each column of memory cells, as shown in 10B.

[0193] In the embodiment of the present disclosure, all JTAG cells 1200 coupled to the read amplifiers of a memory subarray are to be regarded as a data buffer comprising a data page, including in this example at least one hundred twenty-eight (128) bits (always excluding the address bits and the ECC bits) for simultaneously reading a combined memory page from the four subarrays 900.

[0194] However, as previously reported, the communication channel between the memory component and the SoC structure can require up to 256 bits simultaneously (i.e., two combined memory pages), but in the present disclosure, another 2 × 16 plus 2 × 24 additional bits are required. The JTAG cell 1200 was modified only to duplicate the internal buffers in order to shift the first or higher portion of the 128 bits of data to be read along with the second or lower portion. Obviously, in this context, "higher" means the portion of data that is loaded first, while "lower" means the portion of data that is loaded later.

[0195] An expert will understand that the number of internal buffers of the modified JTAG cell 1200 can be increased if necessary to improve the number of bits that can be transmitted to the SoC structure via the communication channel. For example, the structure described above can be expanded according to the size of the page required by the specific implementation of the memory controller.

[0196] Just to explain how data is transferred into the data buffer, we need to imagine that when data is loaded into one of the two buffers 1221 or 1222, the other buffer is in a standby state, but ready to receive the subsequent data portion.

[0197] Therefore, the first section of 128 bits (excluding the address bits and ECC bits) is transferred to the SoC structure for initial data processing, while the read phase is not stopped, as the other part of 128 bits is prepared to be loaded into the intermediate storage at the subsequent clock signal.

[0198] In this example, each data buffer contains 128 modified JTAG cells 1200 and the common Data_Load[1:0] are signals that are generated to enable the capture of the entire 256 bits, that is: eight doubleword DWs according to the proposed implementation (four subarrays for each doubleword).

[0199] Signal generation is controlled internally when the read operation is performed in a specific data buffer, and the signals are controlled by the SoC structure to enable the execution of the read phase using 128-bit parallelism.

[0200] The main advantage of this memory architecture is that each buffer can contain the entire doubleword DWs, thus leaving the read amplifier free to read from another memory location.

[0201] The presence of the modified JTAG cell 1200 is particularly important as an output of the read amplifiers, since it enables the following: a. Using boundary scan as a method to verify the connection between the SoC 200 and the flash array component 210 or 310; b. Implement direct memory access by connecting the read amplifier directly to the controller; c. It allows the read amplifier to exit in order to prepare the second 256-bit-wide page plus the address plus the ECC and write it close to the page.

[0202] A further advantage arises from the possibility of using a boundary-scan test architecture with modified JTAG cells 1200, thus enabling a new and special boundary-scan test architecture such as the one shown in the schematic view of Fig. The output shown in Figure 13 is obtained. This is a further advantage, as only one driven output is required for this test, and this is obtained using the TCK signal and the data stored in the cells. The scan chain test requires the SoC 200 to test the scan chain output.

[0203] Boundary scan is well-known in this particular technical field and encompasses a family of test methods designed to solve many test problems: from the chip level to the system level, from logic cores to connections between cores, and from digital circuits to analog or mixed-mode circuits.

[0204] The Boundary-Scan Test Architecture 1300 provides a means for testing connections between the integrated circuits 210 and 200 on a circuit board without using physical test probes. It adds a Boundary-Scan Cell 1200 like the one in Fig. 12 shown, which includes a multiplexer and buffer and is assigned to each pin or pad on the device.

[0205] In other words, each primary input signal and each primary output signal of a complex semiconductor device such as the memory component 210 or the host component 200 is augmented by a general-purpose storage element called a boundary scan cell, forming a total serial shift register 1350 around the boundary of the device.

[0206] These boundary-scan cells were originally introduced as a means of applying tests to individual semiconductor devices. The use of boundary-scan cells to test the presence, orientation, and bonding of devices in place on a printed circuit board was the original motivation for their integration into a semiconductor device.

[0207] According to the present disclosure, the boundary scan cells 1200 are also used to test the connections between integrated circuits that work together, such as the system-on-chip 200 with the associated memory component 210, as is the case in the present disclosure.

[0208] The collection of boundary scan cells is configured in a parallel-in or parallel-out shift register, and the boundary scan path is independent of the host device's function. The necessary digital logic is contained within the boundary scan register. An external JTAG FSM interacts with the cells; that is, `shiftDR`, `shiftIR`, `UpdateDR`, etc., are controlled by the JTAG logic 350.

[0209] To summarize the operation of a boundary-scan cell very briefly, each cell is structured to acquire data at its parallel input PI; update data at its parallel output PO; and serially sample data from its serial output SO to the serial input SI of its neighbor. Furthermore, each cell behaves transparently in that PI passes through PO.

[0210] Figure 13 shows a schematic view of a standard structural architecture using boundary-scan cells configured according to IEEE Standard No. 1149.1. However, according to the present disclosure, the boundary-scan cells used in Architecture 1300 are the modified JTAG cells 1200 previously described with reference to Fig. 12 were revealed.

[0211] A JTAG interface is a special interface added to a chip. According to the present embodiments, two, four, or five pins are added, allowing the JTAG to be extended according to the needs of the implementation.

[0212] The connection pins are: TDI (Test Data In); TDO (Test Data Output); TCK (Test Clock); TMS (Test Mode Select) and an optional TRST (Test Reset).

[0213] The TRST pin is an optional active-low reset for the test logic, usually asynchronous, but sometimes synchronous depending on the chip. If the pin is unavailable, the test logic can be reset by synchronously switching to the reset state using TCK and TMS. Note that resetting the test logic does not necessarily imply resetting anything else. There are generally some processor-specific JTAG operations that can reset all or part of the chip being debugged.

[0214] Since only one data line is available, the protocol is serial. The clock input is located at the TCK pin. On each rising TCK clock edge, a data bit is transferred from the TDI to the TDO. Various instructions can be loaded. Instructions for typical ICs can read the chip ID, sample input pins, read drive output pins (or float), manipulate or bypass chip functions (forward TDI to TDO to logically shorten chains of multiple chips).

[0215] As with any clocked signal, data presented to the TDI must be valid for a specific chip-specific setup time before and for a hold time after the corresponding (here, rising) clock edge. TDO data is valid for a certain chip-specific time after the falling edge of TCK.

[0216] Fig. Figure 6 shows a set of four dedicated test pins - Test Data In (TDI), Test Mode Select (TMS), Test Clock (TCK), Test Data Out (TDO) - and an optional Test Reset (TRST) test pin.

[0217] These pins are collectively referred to as the Test Access Port (TAP). However, the 1300 architecture includes a finite state machine, called the TAP controller 1370, which receives three signals as inputs: TCK, TMS, and TRST. The TAP controller 1370 is a 16-state finite state machine (FSM) that controls each step of the operations of the 1300 boundary-scan architecture. Each instruction to be executed by the 1300 boundary-scan architecture is stored in the instruction register 1320.

[0218] Figure 13 shows a multitude of boundary-scan cells 1200 connected to the primary input and primary output pins of the device. The cells 1200 are internally connected to form a serial boundary-scan register 1350. In other words, the modified JTAG cells 1200 are used as building blocks of the boundary-scan architecture 1300.

[0219] Data can also be shifted in serial mode around the boundary-scan shift register 1350, starting at a dedicated device input pin called "Test Data In" (TDI) and ending at a dedicated device output pin called "Test Data Out" (TDO) at the output of a multiplexer 1360.

[0220] The test clock TCK is selectively sent to each register, depending on the TAP state and register selection; the TCK signal is supplied via a dedicated device input pin and the operating mode is controlled by a dedicated serial “Test Mode Select” (TMS) control signal.

[0221] The instruction register (IR) 1320 contains n bits (with n ≥ 2) and is implemented to hold each current instruction, but can be extended to handle the flexible TDI.

[0222] According to the IEEE 1149 standard, the architecture is completed by a 1-bit bypass register 1340 (Bypass); an optional 32-bit identification register 1330 (Ident) which can be loaded with a permanent device identification code.

[0223] Only one register can be connected from TDI to TDO at any given time (e.g., IR, Bypass, Boundary-Scan, Ident, or even a suitable internal register of the core logic). The selected register is identified by the decoded output of the IR. Certain instructions are mandatory, such as Extest (Boundary-Scan register selected), while others are optional, such as the Idcode instruction (Ident register selected).

[0224] A parallel loading operation is referred to as a "capture" operation, and the data is captured by the instruction in the selected register cells. Capture causes signal values ​​at device input pins to be loaded into input cells, and signal values ​​traveling from the core logic to device output pins to be loaded into output cells.

[0225] A parallel unload operation is called an "update" operation to freeze the register contents. Essentially, it temporarily stores the contents in the executable shadow register within the OS cell. This update makes the shift register available for future incoming data / instructions. Furthermore, a PAUSE instruction allows the data to be retained in the register even if it is not fully completed.

[0226] Depending on the nature of the input scan cells, signal values ​​already present in the input scan cells are passed into the core logic.

[0227] In one embodiment of the present disclosure, the boundary-scan architecture 1300 is augmented with one or more additional registers 1380, specifically provided to manage the memory component 210. This additional register 1380 is also user-definable. This extension is permitted by the IEEE 1532 standard.

[0228] Figure 14 shows in more detail the composition of the registers that are integrated into the boundary-scan architecture 1300 of the present disclosure. In this Fig. 14 is the boundary scan shift register 1450 coupled to the TDI pin in serial mode and provides an output towards the TDO output pin via the multiplexer 1460.

[0229] The test clock TCK is fed in via yet another dedicated device input pin, and the operating mode is controlled by a dedicated serial “Test Mode Select” (TMS) control signal, both of which are applied to the TAP controller 1470.

[0230] The various control signals assigned to the command are then provided by a Decoder 1490.

[0231] The 1420 instruction register (IR) contains n bits (where n ≥ 2) and is implemented to hold each current instruction. The architecture includes a 1-bit bypass register (in Fig. 14 not shown) and the identification register 1430.

[0232] The additional register 1480 is used as a shift data register to enable interaction with the host device's core during the write and / or read phases of the memory chip. This user-definable register can even be different. Depending on the instruction loaded in the IR, various registers can be combined. For example, programming the memory requires at least one data register with a size corresponding to the minimum page to be programmed in the memory array, a data address that specifies which address can be loaded, and optionally, a mask register to prevent any data from being affected.

[0233] The command user interface represented by the TAP controller 1470 or 1470 is based on IEEE1149, which implements a low-signal-count interface, i.e., TMS, TCK, TDI, TDO, TRST (optional), with the ability to modify the internal contents of the associated memory sub-array 900.

[0234] Figure 15 shows a diagram that reports the operations of a Finite State Machine based on the JTAG protocol;

[0235] As in Fig. As shown in Figure 15, the IEEE1149.1 standard is based on a TAP finite-state machine, which comprises sixteen states, two of which, i.e., shift instruction registers (ShiftIR) and shift data registers (ShiftDR), allow interaction with the system during writing and / or reading.

[0236] Fig. Figure 15 schematically shows the test access port TAP 800 as a finite state machine that performs all operations relating to testing an integrated circuit such as a storage device.

[0237] The sequence of logic signals “0” and “1” applied to the TMS pin controls the operation of the chip architecture through the boundary scan structure.

[0238] Let's begin with the reset state of the test logic, which is displayed as number 1510 when the circuit is powered on. In this specific state, all boundary-scan cells are in a so-called transparent state, with the parallel input PIN internally connected to the parallel output POUT and all input pins connected to the core of the integrated circuit.

[0239] By applying a corresponding sequence of logical values ​​"1" and "0" as a TMS signal, it is possible to configure the output multiplexer so that the TDI input is shifted as the first instruction to obtain the output TDO. The TMS signal should drive the TAP FSM into the ShiftDR or ShiftIR state to link the TDI and TDO to a register. The code "IR" defines which register is addressed when the ShiftDR state is reached.

[0240] To shift an instruction, we need to enter state ShiftIR number 1530, and to reach this state, we need to apply the following sequence: By setting 0 as TMS and driving a clock pulse to TCK, we reach the Run / Idle state 1520.

[0241] If we now select a "1" from state 1520, we proceed to a selection of a data register scan 1540 and an instruction register scan 1545. With another "0" on the TMS, we reach the capture phase of the instruction register 1550.

[0242] The capture phase allows capturing at the last two bits of instruction register 1420 in Fig. 14; as mentioned, the capture operation uses parallel input.

[0243] Another “0” leads to the Shift IR, which allows the input value TDI to be passed to the output TDO; the TDI value at the input appears after a number of clock cycles equal to the register size.

[0244] If we keep the TMS at "0", we can remain in the Shift IR state 1530, which allows the bits received at the TDI pin to be shifted to the output TDO.

[0245] It is possible to remain in this state 1530 for the entire clock cycle required to shift all input bits.

[0246] We remain in ShiftIR state 1530 for a number of clock cycles equal to the number of bits in IR 1420 minus one. At the end of the sequence, the Exit-1 IR state 1555 is reached.

[0247] From this initial state 1555, we transition to an update state 1560, which triggers a "1" TMS, and this is the moment when the new instruction becomes valid. The boundary scan cells are reset to test mode, with the input pins isolated from the core circuitry.

[0248] It is now possible to send the test vector to the core circuit by reaching the Shift-DR state 1570.

[0249] The states of the data register are similar to the states of the instruction registers.

[0250] Therefore, we can achieve ShiftDR state 1570 with the sequence 1-0-0.

[0251] During the Capture DR 1575 cycle, the first multiplexer MO1 of the boundary scan cell is connected to the parallel input PIN and all input pins of the boundary scan register have captured their input value.

[0252] Switching to the Shift DR 1570, the multiplexer changes its state and allows the serial input SIN to be captured, and the sampling path is shifted from the TDI input through the Boundary Scan Register to the output pin TDO.

[0253] The circuit remains in this state for a number of clock cycles equal to the number of boundary scan cells minus one; obviously, the boundary scan is one of the possible data registers that can be selected with a suitable instruction in the IR register.

[0254] The new test vector is output at the output pins when the Exit -1 DR 1580 state is passed and the Update DR 1585 state is reached.

[0255] The sequence is repeated from update to capture to allow a new test vector to be introduced into the circuit.

[0256] As we have seen, the TAP includes a test data input, a test data output, and a clock signal. Specifically, the shift data register ShiftDR reports a state in which the TDI is connected to a register. In this state, the register contents are transferred into and / or out of the device.

[0257] Similarly, the shift instruction register ShiftIR also reports a state in which the TDI is connected to a register. Instructions are loaded in this state.

[0258] Due to the requirement to have multiple cores within the host device 200, the internal register 1480 of the JTAG interface must be able to support up to address and data registers. Specifically, the creation of four address registers (one from each subarray 900) is planned, to be filled with a different address for each subarray 900 and to trigger four different data outputs for the read register [0:3] per subarray section. As an example, four address registers are provided for each subarray, and four data registers are also provided for each subarray. Therefore, for example, four subarrays require sixteen address registers and sixteen data registers.

[0259] Communication with the SoC is achieved by directly connecting the selected Read Register, i.e., the output called POUT [127:0] (ignoring the address bits and the ECC bits), to the input of the channel of the host device or SoC 200.

[0260] This mechanism makes it possible to preload the data for the controller, thereby reducing the latency to a very low value.

[0261] For the sake of completeness, it should be noted that the JTAG state machine can be used to reset a register, access an instruction register, or access the data selected by the instruction register.

[0262] JTAG platforms often add signals to the handful defined in the IEEE 1149.1 specification. A System Reset Signal (SRST) is widely used, allowing debuggers to reset the entire system, not just the JTAG-enabled parts. Sometimes there are event signals used to trigger activity by the host or device being monitored via JTAG; or perhaps additional control lines.

[0263] In JTAG, devices provide one or more test access ports (TAPs).

[0264] To use JTAG, a host is connected to the SoC via a direct connection to the target's JTAG signals (TMS, TCK, TDI, TDO, etc.), which may have to overcome issues such as level shifting and galvanic isolation. The adapter is connected to the host via an interface such as USB, PCI, Ethernet, etc. However, according to the present disclosure, the SoC is also capable of driving the JTAG TAP in memory without external assistance.

[0265] The host device 200 communicates with the TAPs by manipulating the TMS and TCK signals (or TRST, if present). The TDI signal is only used to load register data and then read the results via TDO (the only standard host-side input). TMS / TDI / TCK output transitions create the basic JTAG communication primitive upon which higher-layer protocols are built.

[0266] State switching: all TAPs are in the same state, and this state changes during TCK transitions. All TAP FSMs move accordingly, as the TMS is simultaneously connected to all JTAG-compatible devices if they are present on the board.

[0267] As in Fig. As shown in Figure 15, this JTAG state machine is part of the JTAG specification and comprises sixteen states. There are six "stable states" where the stability of the TMS prevents the state from changing. In all other states, TCK always changes the state. Furthermore, applying the TRST signal forces entry, which resets the entire contents of the registers to their default values. Their contents are no longer valid and should be loaded into one of these stable states (Test_Logic_Reset) somewhat faster than the alternative of keeping the TMS high and iterating through TCK five times.

[0268] Shift phase (i.e., reading the captured values ​​while new ones arrive; the TDO outputs the captured values): most parts of the JTAG state machine support two stable states used for data transfer. Each TAP has an instruction register (IR) and a data register (DR). The size of these registers varies between TAPs, and these registers are combined by the TDI and TDO to form a large shift register. (The size of the DR is a function of the value in the current IR of that TAP and possibly the value specified by a SCAN_N instruction.)

[0269] Normally, there is an optional register to define the size of the data registers. The IR is checked according to the standard, as the least significant bits are loaded with 1s and 0s. This makes it possible to count the number of JTAG devices on the network and to know the size of each TAP IR, which can vary.

[0270] Three operations are defined for this shift register: Capturing a temporary value.

[0271] The entry into the stable state Shift_IR occurs via the state Capture_IR, which loads the shift register with a partially fixed value (not the current instruction).

[0272] The entry into the stable state Shift_DR occurs via the state Capture_DR, where the value of the data register specified by the current IR of the TAP is loaded.

[0273] Bitwise shifting of this value into the stable state Shift_IR or Shift_DR; TCK transitions shift the shift register by one bit from TDI towards TDO, just like in an SPI mode 1 data transmission through a daisy chain of devices (where TMS=0 acts like the chip selection signal, TDI as MOSI, etc.).

[0274] Updating IR or DR (i.e., freezing the content moved to the selected register) from the inserted temporary value when transitioning through the Update_IR or Update_DR state. The PAUSE state is also relevant as part of the standard on each side of the Shift branch.

[0275] Note that it is not possible to read the contents of a register (i.e., store the contents of the signals connected to the register into the register cells) without writing to it (updating it), and vice versa. A common practice is to add flag bits to indicate whether the update should have side effects, or whether the hardware is willing to perform such side effects.

[0276] Running state: where a stable state is called Run_Test / Idle. The distinction is TAP-specific. Clocking TCK in the idle state has no particular side effect, but clocking in the Run_Test state can change the system state. For example, some cores support a debugging mode where TCK cycles in the Run_Test state control the instruction pipeline.

[0277] In essence, using JTAG involves reading and writing instructions and their associated data registers; and sometimes includes executing a series of test cycles. Behind these registers lies hardware that is not specified by JTAG and has its own states, which are affected by JTAG activities.

[0278] The JTAG finite state machine is triggered on the rising edge of the TCK (clock signal) and output on the falling edge. This allows the bypass register to be used without losing any clock cycles in the scan chain.

[0279] The TMS signal is checked and its value triggers the state transition.

[0280] The ShiftDR and ShiftIR states address I / O registers, and the TDI signal is used to serially insert data into the selected register.

[0281] The IR register is used to select the specific data register and / or command to use.

[0282] When the state machine is in run-test / idle mode, the IR register is checked for an instruction and executed with the data from any service registers; that is, a program instruction can decide what and where the data needs to be stored based on the data register and the address register.

[0283] JTAG boundary-scan technology provides access to many logic signals of a complex integrated circuit, including device pins. These signals are represented in the boundary-scan register (BSR), accessible via the TAP (Telecommunications Access Point). This enables both testing and controlling the signal states for testing and debugging purposes. Therefore, both software and hardware (manufacturing) errors can be located, and an operating device can be monitored.

[0284] The present disclosure achieves many advantages, which are reported below, not in order of importance. The previously disclosed solution reduces the cost of silicon for the memory component and improves the overall quality and reliability of the entire device, including the host device and the memory component.

[0285] The device of the present disclosure offers a good option for implementing Real Time Operating Systems (RTOS), especially in the automotive segment, which provides a low initial latency on the first access of the memory component.

[0286] Furthermore, the previously revealed memory architecture ensures very high quality and an error rate of less than 1 part per million.

[0287] Finally, the revealed architecture enables the use of an aggressive lithography node in the host device and the latest flash memory technology in the storage component, thereby decoupling both technologies and enabling the best integrated circuit for both devices to be realized on-site.

[0288] As previously disclosed, and to summarize the principle of the present disclosure, in some embodiments of the present disclosure, the output of a generic subarray 900 is formed by combining the following sequence: data cells plus address cells plus ECC cells. In this non-restrictive example, the total number of bits would comprise 168 pads per channel, as in the example in Fig. 16 shown.

[0289] The combined string of data cells + address cells + ECC cells enables the implementation of bus security coverage according to standard requirements, since the ECC covers all bus communication (data cells + address cells), while the presence of the address cells ensures that the data comes exactly from the addressed location of the responsible party.

[0290] The SA read amplifiers of each 900 subarray are connected to the scanning chain of the modified 1200 JTAG cells, thus connecting all outputs of a 900 subarray. Furthermore, the modified 1200 JTAG cells assigned to a 900 subarray can be interconnected to form a unique chain for quickly verifying the integrity of the pad connections.

[0291] Thanks to the memory architecture of the present disclosure, it is possible to switch from a parallel mode for retrieving data and addresses from the memory subarrays 900 to a serial mode for checking the connections between the memory component 210 and the associated SoC device 200. Furthermore, the SoC 200 is authorized to read '1' and '0' once for testing purposes and can also analyze the memory result and read the data using the scan chain.

[0292] It should also be noted that each subarray comprises 900 address registers connected to data buffer registers, similar to an architecture used in a DRAM storage device, i.e., DDRX-type DRAMs.

[0293] Error correction is handled by the SoC 200; the additional bits are provided to the controller to store any possible ECC syndrome associated with the page. The ECC cells allow the SoC controller to detect whether the data and address content is corrupted.

[0294] A special logic circuit section is provided for writing and erasing the memory cells of the array 320, which contains a simplified RISC controller (Reduced Instruction Set Computer) or a Modify Finite State Machine, i.e. the logic circuit for handling the programming and erasing algorithms.

[0295] In one embodiment of the present disclosure, the memory component 210 implements a direct-access memory type to replace the embedded memory array of known SoC devices.

[0296] Furthermore, a JTAG interface 350 is used as a regular user interface to modify the array and provide read addresses to the memory blocks. The JTAG interface 350 is also used to test the memory component 210, allowing for the reuse of the test tool. Therefore, the memory module 210 (or 310) also includes JTAG logic.

[0297] The memory component 210 uses the connection pads and logic circuit section to enable connection to the SoC structure 200.

[0298] The final configuration will be a direct-connected SoC / Flash array, with the read amplifiers connected to the SoC in a direct-access memory configuration.

[0299] Direct Memory Access enables a reduction in the final latency that the SoC may experience when reading data. Furthermore, the final latency is also reduced by the block form factor, the distribution of read amplifiers across blocks, the selection of the comparison threshold in the read amplifiers, and the optimized path.

[0300] The connections also include the JTAG interface 210 and control pins for testing and other purposes. The core of the SoC device can access the JTAG interface 210 using some internal pads 270. These pads are fast and capable of supporting the maximum frequency. More precisely, high-speed pads 250 are used in the fast read path to the SoC, while a low-speed path is dedicated to the test phase. The JTAG cells are part of the fast path, but the JTAG interface uses the slower path.

[0301] According to the present disclosure, the memory component 1 is equipped with a controller 230 of the flash array 90 (hereinafter referred to as the flash array controller). The flash array controller 230 has an architecture that allows some flash array resources to be used with the SoC controller without compromising the confidentiality of certain information stored therein (for example, algorithms, flash array voltages, currents, and other general process information), and guarantees potential customer return management. This is made possible by adopting a special structure in which the user can write their own firmware in one area and interact with the controller's internal firmware in a second area.

[0302] The memory component 210 and the host or SoC 200 were coupled via an interface using very high parallelism. This feature can also be used to improve performance, for example, for loading the instruction register and the (generic) data registers.

[0303] The need for very low initial latency and high throughput drives the creation of the following addressing scheme per subfield.

[0304] Referring to the example of Fig. 18: If the SoC 200 requires up to 256 bits simultaneously, the data buffers are duplicated to allow them to be moved, assuming that address 0 of subarray 0 is used:

[0305] First pass of the first group of bits: Data 0_0_H [127:0]

[0306] Second pass of the second group of bits: Data 0_0_L [127:0]

[0307] The address buffers are created using JTAG cells.

[0308] According to the IEEE 1149 and 1532 standards regarding JTAG, the IEEE1532 protocol is used as an extended instruction set to operate in any subarray, and the new subarray structure enables in-system programming.

[0309] The need for very low initial latency and high throughput drives the creation of the following addressing scheme per subfield. Fig. Figure 17 shows the row address buffer and the corresponding row data buffer in a structure similar to DRAM, but here we have adopted the superpage addresses and the corresponding data, i.e., 168 x 2.

[0310] The implemented instruction set for addressing the implemented memory array can be of two types or two address levels; in other words, a global instruction selects the subarray, while a local instruction selects one of the address registers (for example, one of the four) that are assigned to the selected subarray.

[0311] Loading the global address: In this case, all sub-arrays receive the address in several steps with one command, i.e., load_global_address_0, load_global_address_1, etc.

[0312] Loading the local address: In this case, only the addressed register in the selected subarray receives the new address, i.e., local_address_0_0, local_address_0_1, local_global_address_1_3, etc.

[0313] Each subarray contains a set of 4x data registers, for example, 4x (data + address + ECC register), each corresponding to an address register. 4x data registers contain a superpage, that is: data_H + data_L (after the link to the specific address has been removed).

[0314] The address registers are connected to the address decoder when the read or modify operation addresses the array. The connection is initiated by the flash controller during the modification phase, while the read finite-state machine makes the connection when the read operation is triggered. The address register is loaded using a JTAG finite-state machine. When the corresponding Load_Address instruction is detected and the Shift_DR state is in the JTAG tap, the TDI is connected to the address register.

[0315] A Global_Address_Loadx instruction simultaneously loads the nibble of eight bits into the corresponding registers:

[0316] Global_Address_Load0 in the instruction register generates the loading of addr0_0. This instruction can, for example, address subarray 0; similarly, this is done for selecting the corresponding subarray address registers addr1_0, addr2_0, and addr3_0 using three TCK cycles when the finite state machine of the JTAG interface is in the Shift_DR state.

[0317] The `Local_Address_Load0_0` instruction in the instruction register loads `addr0_0` using three TCK cycles when the finite automaton is in the `Shift_DR` state. This instruction addresses, for example, register 0 of the selected subarray. This means that when the `Shift_DR` state is reached, the TDI is connected to the input of this shift register and the TDO to its output. If the flexible TDI is used, we only need three Tck cycles to register the entire address within the selected address; otherwise, we would need 24 Tck cycles.

[0318] These instructions (Global_Address_Load0, Global_Address_Load1, Global_Address_Load2, Global_Address_Load3) enable address preloading for all channels implemented in the flash array. These four instructions are implemented to select one of the four subarrays. In a potential eight-core implementation, we would need eight instructions, one for each core, or a method to select one of the cores with a single instruction and a subarray address. Therefore, introducing the above instruction optimizes communication between the SoC structure 10 and the memory component 1, thereby improving transfer performance to the controller.

[0319] The instructions (Local_Address_Load0_0, ..., Local_Address3_3) allow the use of a single core / channel without the controller having to manage the entire set of cores when only one is operating; the cores are independent and can use their own channel if needed. These instructions are used to select one of the address registers of the selected subarray.

[0320] The implementation of this latter mechanism ensures the optimization of the memory read process.

[0321] For the sake of completeness, we will now refer to the block diagram example from Fig. 7, which reports on the manufacturing phases of a process 2000 according to the present disclosure.

[0322] Providing a structurally independent semiconductor memory component with a memory array having at least one logic section to interact with the memory array and the SoC structure;

[0323] During the manufacturing phase illustrated in step 2020, several connection pads are located on one surface of the memory component.

[0324] Then, in step 2030, the surfaces of the SoC structure and the memory component are oriented towards each other using the connection pads.

[0325] Finally, in step 2040, a coupling phase is performed in which the memory component and the SoC structure are connected, with the multiple connection pads being aligned and connected to the corresponding multiple pads of the SoC structure.

[0326] As used herein, “a number of” something can refer to one or more such things. A “multitude” of something intends two or more. As used herein, the term “coupled” can include electrically coupled, directly coupled, and / or directly connected without any intervening elements (e.g., by direct physical contact), or indirectly coupled and / or connected with intervening elements. The term coupled can further include two or more elements that work together or interact with each other (e.g., as in a cause-and-effect relationship).

Claims

[1] Having a memory component (210) for a system-on-chip (SoC) structure (200): a storage array; a multitude of connection pads located on a surface of the memory component (210); a logic section for interacting with the memory array and the SoC structure (200), wherein the memory component (210) is a structurally independent semiconductor device that is coupled to and partially overlaps the SoC structure (200); and Read amplifier (SA) for reading the memory array coupled to the SoC structure (200) in a direct memory access configuration. [2] The memory component (210) according to claim 1, wherein the SoC structure (200) and the overlapping memory component (210) are coupled by connecting columns (230) which are connected to each other according to the plurality of connecting pads located on the surface of the memory component (210). [3] The memory component (210) according to claim 1, wherein the SoC structure (200) and the overlapping memory component (210) are coupled by flip-chip technology. [4] The memory component (210) according to claim 1, wherein the SoC structure (200) and the overlapping memory component (210) are coupled face to face. [5] The memory component (210) according to claim 1, wherein an overlapping area of ​​the memory component (210) is larger than a semiconductor area (220) of the SoC structure (200) which is dedicated to connections with the memory component (210). [6] The memory component (210) according to claim 1, comprising a plurality of connection pads implemented on the surface of the memory component (210). [7] The memory component (210) according to claim 1, wherein a layout of the plurality of connection pads located on the surface of the memory component (210) corresponds to a layout of corresponding and aligned connection pads associated with the SoC structure (200). [8] The memory component (210) according to claim 1, wherein the memory array contains non-volatile memory cells or flash memory cells. [9] The memory component (210) according to claim 1, wherein the read amplifiers (SA) of the memory arrays are connected to the SoC structure (200) in the direct memory access configuration. [10] A storage device comprising: a storage array; a logic section of the memory array for interacting with a system-on-chip (SoC) structure (200); a Modify Finite State Machine or a RISC logic section (240) to handle memory interface communication with the associated SoC; a multitude of connection pads located on a surface of the storage device, and a circuit logic integrated into the storage device for communicating with the SoC structure (200) via a communication channel. [11] The storage device according to claim 10, wherein the storage device partially overlaps the SoC structure (200) in a direct connection between corresponding connection pads. [12] The storage device according to claim 10, wherein the surface of the storage device is reversed so that its top side faces downwards and is aligned pad-to-pad with corresponding matching pads of the SoC structure (200). [13] The storage device according to claim 12, wherein the connecting pads of the storage device are coupled to the corresponding matching pads of the SoC structure (200) by means of columns (230), bumping balls, in flip-chip technology or face to face. [14] The storage device according to claim 10, wherein the array is a flash array. [15] The storage device according to claim 13, wherein the coupling between the SoC structure (200) and the storage device comprises connecting the respective pads or using pin connectors, wherein the pin connectors are facing each other, in a coupled structure that maintains the orientation of the pads. [16] The storage device according to claim 10, wherein the storage device is a structurally independent upper layer supported by the SoC structure (200). [17] The storage device according to claim 10, wherein an overlapping area of ​​the storage device is larger than a semiconductor area (220) of the SoC structure (200) which is dedicated to the plurality of interconnect pads for the storage device. [18] The storage device according to claim 10, comprising read amplifiers (SA) for reading the memory array connected to the SoC structure (200) in a direct memory access configuration. [19] An integrated semiconductor device comprising: a system-on-chip (SoC) structure (200) and an overlapping memory device, both having a plurality of connection pads and connected oppositely to corresponding connection pads, the overlapping memory device having circuit logic for communicating with the SoC structure (200) via a communication channel; and an array of non-volatile memory cells of the overlapping storage device, structured in subarrays, connected to the SoC structure (200) in a direct memory access configuration, wherein the direct memory access configuration includes read amplifiers (SA) for reading the array of non-volatile memory cells. [20] The integrated semiconductor device according to claim 19, wherein the coupling between the SoC structure (200) and the overlapping memory device is achieved by connecting columns (230) that connect corresponding pads of the SoC structure (200) and the overlapping memory device. [21] The integrated semiconductor device according to claim 19, wherein the SoC structure (200) and the overlapping memory device are coupled by flip-chip technology. [22] The integrated semiconductor device according to claim 19, wherein an area of ​​the overlapping memory device that overlaps the SoC structure (200) is larger than a semiconductor area (220) of the SoC structure (200) that is dedicated to the interconnect pads for the overlapping memory device. [23] The integrated semiconductor device according to claim 19, wherein the plurality of interconnect pads are realized on a surface of the overlapping memory device. [24] The integrated semiconductor device according to claim 19, wherein the array of non-volatile memory cells includes flash memory cells. [25] A storage device comprising: a storage array; a logic section of the memory array for interaction with a system-on-chip (SoC) structure (200); a large number of connection pads located on a surface of the storage device, Read amplifiers (SA) for reading the memory array, which are connected to the SoC structure (200) in a direct memory access configuration; and a circuit logic integrated in the storage device for communicating with the SoC structure (200) via a communication channel.

Images