Exploitations of Multiple Rows Hammering and Retention Time Interactions in DRAM Using X-Ray Radiation

The methodological approach of hammering multiple rows is newly proposed to evaluate today’s SDRAMs, employed with in-DRAM mitigation circuits. The multiple rows are selected based on the one-row hammering test (single row hammering without refresh commands) and are exploited to defeat the employed mitigation algorithm. We irradiated the target sample using an X-ray to observe the reactions of the mitigation circuit when various combinations of multiple rows are hammered. The results showed a four times reduction in the number of hammering thresholds under the one-row hammering test. The same radiated sample showed no errors when one or a few rows were hammered due to the built-in mitigation circuit. However, multiple rows hammering (MRH) demonstrated its effectiveness by generating errors despite an active mitigation circuit. In this paper, we explore the X-ray damage results in the aging of the DRAM sample and induces vulnerabilities from the row hammering error perspective. Also, we use the error bits detected by MRH to investigate the coverage pitfalls of the mitigation circuit employed in the sample DRAM. Finally, we newly evaluate the remaining retention time under row hammering stress to explain the coverage loss in the mitigation strategy based solely on hammering counts.


I. INTRODUCTION
A DRAM cell needs to be refreshed at least once every 64 ms at an average operating temperature to maintain its stored value. Even though the above condition is met, errors can occur under certain corner operations, and one type is row hammer failure [1].
Today's DRAM has in-DRAM features to mitigate the stresses due to row hammering. The primary underlying mechanism of the mitigation is performing extra refreshes to the cells affected by row hammering and the regular refreshes within the 64 ms refresh interval. An example of the additional refresh can be found in the Target Row Refresh (TRR) mode provided by DRAM manufacturers [2]. When a row is heavily and repeatedly accessed for more than the maximum The associate editor coordinating the review of this manuscript and approving it for publication was Paolo Giangrande . activate count (MAC) value within the 64 ms refresh interval, the TRR mode will cause the accessed row to additionally refresh the rows physically adjacent to it, preventing the adjacent rows from being victim rows.
While the underlying concept behind the mitigation mechanism is simple, the implementation is complex as it seeks an economical solution in both the silicon area and performance penalty. Many researchers proposed various mitigation solutions. Most of the proposed solutions are still based on performing extra refresh to the rows affected by the hammered row. However, the proposed mitigation solutions are different in how they identify the victim rows, which methods can be classified as hardware countermeasures or software-based mitigations [1], [3]- [10].
As technology shrinks, the distance between bit cells in DRAMs gets smaller, which is a major reason why row hammering becomes critical [11]- [17]. The experimental results of various DRAM chips have proved this [11], [12]. The closer spaces between bit cells make the storage node vulnerable to the remnant charge in the channel area after the corresponding access transistor is turned off; the storage capacitor loses its charge through the recombination process with the remaining charge in the channel [18]. When the storage capacitance is reduced by technology shrinkage, the effect of row hammering stress becomes more evident. Also, the retention failures of the DRAM become more critical as well.
The leakage current in DRAM increases with degradations. For example, hot electrons can inject holes (i.e., Hot Carrier Injection, HCI) into the gate oxide area through impact ionizations, which will incur the threshold shift [19], [20]. For a similar reason as in technology shrinkage, row hammering can become worse with cell degradations.
The study in this work started with a curiosity about the reactions of the mitigation circuit when weakened DRAMs-which can happen in many different ways, such as technology shrinkage, normal degradation, and radiation-are row hammered. X-ray radiation damages the DRAM cells and induces the aging process, resulting in a shift in the threshold number [21]- [23]. X-ray inspections are commonly used in chip package assembly or product shipping, making the row hammering problems more serious. Thus, analyzing the vulnerabilities of the row hammering errors becomes more vital. The major interest of this work is to study when the DRAM components are damaged by exposure to radiation sources without power connected to mimic the real-life situation.
Consequently, we evaluated the X-ray damaged DRAM by analyzing various reactions of mitigation circuits to different combinations of multiple rows hammering (MRH). Recent works demonstrated the effects of multiple rows hammer to find weaknesses of built-in mitigation circuits. The number of hammering rows was limited to a few rows, and the effects of many hammering rows were not discovered [11]. The work in [12] expanded the hammering rows to many rows to find the additional weakness of the mitigation circuit.
In coping with new mitigation techniques adopted in today's DRAMs, row hammering methods should accordingly evolve from simple and repetitive hammering using one or a few rows [1], [11], [12], [24]- [26]. In this work, the number of hammering rows is extended by selecting the worst hammering rows intrinsically. As the hammering rows increase, a retention time issue is compounded with the hammering row, which is experimentally explored.
In Section II, sample preparation using X-ray radiation and the test environment is discussed. In Section III, the test results of the one-row hammer (ORH) and retention time are shared for both before and after the X-ray radiation. Sections IV and V introduce MRH, and its effects are discussed in association with the mitigation circuit. In Section VI, the potential coverage loopholes in the mitigation decision-making by hammering count are discussed with test results. Section VIII concludes this work after the temperature effect on row hammering is discussed in Section VII.

II. TEST PLATFORM AND SAMPLE PREPARATION
This section explains sample preparation using X-ray radiation and the experimental setup for row hammering.

A. MEMORY TEST PLATFORM
The memory test platform was developed in-house through collaboration with a third-party company, Cisco Systems, Inc. Fig. 1 shows the system-level view of the memory test platform, designed for both the row hammering and retention time test.
The test platform uses the Intel Field Programmable Gate Array (FPGA) to control and test DRAM samples. The design blocks can be remotely downloaded into the FPGA by the host computer using an ethernet interface. Test types and parameter selections are made through the configuration block for row hammering and retention tests.
The Built-In Self-Test (BIST) block is the major engine, and its features are programmable. The engine can be remotely configured for various memory test algorithms, which are then used to generate test patterns. The engine also compares data from the memory and reports differences when mismatches occur. The errors are stored in the FPGA buffer for speed reasons, and the buffer can be slowly accessed for data download by the host computer.
The memory controller is additionally designed to access DRAM memories with the customization capability to adjust timing parameters related to the row hammering, such as activate, precharge, or refresh commands of the target memory. The timing parameters can be configured outside datasheet boundaries to check for additional margins in sample components.

B. SAMPLE AND X-RAY RADIATION
For this work, a Micron low-power DDR3L was used as the target sample (MT41K512M8DA-093:P). The density of the sample was 4 Gb; 8 banks, 16 and 10 bits for the row and column addresses, respectively. The maximum speed of the sample was 800 MHz with a 1.5 V supply core voltage VOLUME 9, 2021 compatible mode. The sample was tested at an operating speed of 800 MHz using the memory test platform in Fig. 1. All the test results throughout this work were based on DDR3L unless specified otherwise.
The sample was tested with ORH without refreshes (intrinsic ORH) to assess the intrinsic row Hammering Threshold (HT) for the component. The test data is shown in the next section. With the intrinsic HT as base hammering, ORH with refreshes (refreshed ORH) was performed, and no errors were observed. Since the sample had a very low HT in the intrinsic ORH test, errors should have been produced even with refreshed ORH test. We judged that the lack of errors was due to the built-in mitigation circuit, which extra refreshes the cells under row hammering stress. Thus, well-controlled artificial degradation must be made to analyze the behavior of the built-in mitigation circuit in DRAMs.
The DRAM sample was irradiated using an X-ray source to prove our judgment and verify the vulnerabilities of the mitigation circuit. X-ray radiation induces a shift in the transistor's thresholds [20]- [22]. As a result, the retention time of X-rayed cells was reduced. Such changes in cell characteristics are similar to degradation effects such as HCI. The purpose of X-ray radiation in this work is to weaken the test sample. Consequently, the radiated cells could be used to assess the vulnerabilities of the mitigation circuit by multiple rows hammerings with refreshes. We have demonstrated the experimental results in Section V.
The X-ray radiation was performed at the Korea Atomic Energy Research Institute (KAERI) using a 43855F Cabinet X-ray System (Faxitron, IL, USA). The radiation source had 160 kV tube voltage and 10 mA current. The resultant energy ranged from 30 keV to 160 keV with 75 keV mean energy. The sample was irradiated for 160 min with a 0.4 kGy/h dose rate. The total dose of 1000 Gray was measured using the alanine dosimeter. The total dose was equivalent to 362 krad (Si). The irradiation was applied evenly to the entire sample.

III. RETENTION TEST AND ONE ROW HAMMERING
A retention test was conducted to see the effect of radiation effect. The retention time varied from 0 s to 40 s with 0.5 s step; Write data, wait for target retention time-without any refresh command-read the values, and check for any errors. The test was conducted at room temperature without temperature control. Fig. 2 shows the retention test results. The X-axis shows the target retention time in seconds. The Y-axis shows the percentage of flipped cells in a bank. The two plots, Pre-S1 and Post-S1, are for before and after radiation, respectively. The fluctuations at Post-S1 results are due to a longer retention time, during which ambient temperature can fluctuate quickly. A larger fluctuation was observed with a larger target retention time, which produced more bit flips. As the main purpose of the Post-S1 is to verify that the DRAM cell was affected by the X-ray irradiation, the device was tested under uncontrolled room temperature. With the controlled  temperature, the degree of fluctuations may reduce, but the trend of radiation effect will still be the same.
When a row is activated and precharged over the HT, the cells physically near the row can be flipped; The active row is called an Aggressor Row (AR), and the rows with the flipped cells are called Victim Rows (VRs).
The intrinsic ORH test was performed for the prepared sample. Fig. 3 shows the result of intrinsic ORH for the sample. Every row was hammered from 100 k to 1300 k-that is, about 64 ms at 800 MHz-with 100 k steps. The number of VRs was accumulated and is shown as Pre-S1. The test was performed with all '1's as a background pattern.
The result in Fig. 3 corresponds to the failed rows in a bank. Other banks were also tested, and they showed similar results. The X-axis shows the number of hammering, and all the failed rows are shown on the Y-axis as a percentage of the total failed rows. The same intrinsic ORH test was also performed for the radiated sample, and the result is shown as Post-S1. Please note that the X-ray radiation caused shifting the mean value from 812 k at Pre-S1 to 221 k at Post-S1.
In order to observe the effects of regular refreshes and the mitigation circuit, refreshed ORH was performed for the radiated sample. The test was exactly the same as the intrinsic ORH test except for the refresh commands issued. The refreshed ORH test did not generate any errors even for the sample exposed to radiation. This observation was consistent across all repeated tests. During refreshed ORH, a target row was consecutively hammered for 64 ms, during which the target row could be refreshed once by regular refresh. Even with one refresh, the rows with HTs less than the average 221 k HT could easily have failed. The absence of errors during the refreshed ORH test cannot be explained only by regular refresh. This gives evidence of a mitigation circuit, which provides extra refresh to the neighborhood of the hammered rows. For such reason, radiation can be used to evaluate the mitigation circuit. The evaluation technique by X-ray radiation can be applied to other technology nodes as well as other DRAM manufacturers since the exact failure mechanisms of the total ionization dose in SiO 2 are involved [18], [27], [28].

IV. MULTIPLE ROWS HAMMERING STRATEGY
The MRH strategy is newly proposed in this section. Today's DRAMs are equipped with in-DRAM features to mitigate stress due to row hammering. Such built-in features are quite effective in handling errors due to row hammering, as demonstrated in the previous section by the absence of errors during simple exercises of row hammering with refreshes.
Since the mitigation embedded in DRAM can mask out the errors, row hammering, from a failure analysis perspective, should be more intelligent in inducing appropriate stress by exploiting interactions of row hammering with mitigation algorithm, retention time, and refreshes. The MRH strategy expands the number of aggressor rows to multiple rows, which is why it is called multiple rows hammering-the objective was to evaluate the effect of row hammering up against the influence of in-DRAM mitigation features.
A major role of the mitigation circuit is typically performing an extra refresh. However, the strategies of extra refreshes are typically not disclosed and can be different over various manufacturers. The circuit can also be varied in different components from the same manufacturer as the circuit can evolve with changing technologies. Consequently, the MRH strategy should be based on trial and error to find an efficient stressing mechanism.
The MRH strategy consists of both selecting multiple rows and hammering them, which can be implemented in numerous ways. For example, row selections by the embedded circuit can be made either deterministically or statistically, which will give different silicon area costs inside a DRAM. The high-level objective of this study focuses on stressing weak cells by intelligently locating them while algorithmically confusing the decision-making by mitigation circuits as much as possible.
In order to select the weak cells, weak cell data from ORH was used in the proposed method. The number of multiple rows was approximately-to begin with-determined by dividing the maximum hammering count in a refresh interval,1300 k by average HTs that belonged to the left tail region in ORH distribution as shown in Fig. 3, which was 32 for the sample used in this study.
The 32 multiple rows were accordingly selected based on the cells in the tail region of HT distribution. The cells were chosen based on the lowest HTs, and the cells turned out to be widely distributed over the entire bank. Table 1 shows the selected cells. The rows that the cells belonged to were further filtered out not to share victim rows. Fig. 4 pictorially shows the distribution of the selected ARs over a target bank. Some of the selected row addresses were relatively close compared to the others and looked like they overlapped. When each row is hammered, errors can occur in victim rows, as shown in Fig. 4.
As previously mentioned, the hammering sequence of the selected multiple rows was performed to confuse the algorithmic decision-making of the mitigation circuit. It was achieved by hammering all rows with an equal hammering count. In summary, MRH in this study performs hammering the cells in the tail region of ORH distribution with an equal amount of hammering counts-in a round-robin manner.
Since the total rows are selected based on HT cells, the number of multiple rows should decrease in order to increase the hammering count for cells (within a 64 ms time window). As part of this process, the Multiple-row Hammering Group (MHG) was defined. MHG(n) stands for a group of n ARs hammered in a round-robin manner. Fig. 5 shows the pseudo-code and total test cycle for an MRH test. The function, TestMultipleRowsHammering executes MRH in 31 MHGs with sizes from 2 to 32. Once an MHG is selected, the memory is initialized by the function WriteAllRows(), which basically initializes the target memory with background data, which can be any pattern-generally all 0's or 1's for hammering purposes.   The ReadAllRows is to check if there are any mismatches due to hammering-induced errors.
The function ExecuteMRH(n) triggers the hammering of multiple rows in an MHG, which includes n rows (x1, x2, .., xn). The n rows are hammered by alternating active (ACT_row) and precharge (PRE_row) commands. Please note that the rows are accessed round-robin up to the hammering count (Hammer_Cnt). The Hammer_Cnt is the same for each MHG(n).
In Fig. 5, the refresh command is assumed to be issued every 7.8 us, the purpose of which was to refresh all rows at least once for every 64 ms. As a result, all cells were regularly

V. EVIDENCE OF ROW HAMMER MITIGATION AND MULTIPLE ROWS HAMMERING INDUCED ERROR
The MRH test was performed for a DDR3L DRAM sample. For the experiment, the 32 aggressor rows associated with the worst HT victim rows were selected from the tests without refreshes based on the proposed method in Section IV. There was a total of 31 MHGs, the sizes of which ranged from 2 to 32. The group members in each MHG were selected based on the worst HTs in the 32 aggressor rows. For each MHG, only one combination of MHG members was chosen and tested consistently throughout the experiments, unless specified otherwise.
Each MRH test for each MHG was repeated numerous times. Among them, 15 times of typical test results were chosen to observe the variance in errors. All tests were performed at room temperature unless specified otherwise. The test results for each MHG are shared in various formats depending on the discussion focus in this section. Fig. 6 shows a typical MRH test result; one of the MRH test results for each MHG(n) is shown from the 15 repeated MRH tests. The number of failed rows is shown in Fig. 6(a). Fig. 6(b) shows the matched failed cells for the same MHGs in Fig. 6(a). The number of hammering for each aggressor row in the MRH tests was 2600 k, which is equivalent to a 128 ms duration for each aggressor row. The time was intentionally made much larger than the one refresh interval of 64 ms to observe errors across refresh intervals.
It is important to understand how MRH-induced errors in Fig. 6 are different from intrinsic RH errors. Such understanding can be expanded to analyze the effects of built-in RH mitigation circuits. In the next three subsections, the discussion focuses on evidencing the source of errors, particularly MRH stresses, despite active mitigation circuits.

A. EXTRA REFRESH BY MITIGATION CIRCUIT
The general RH mitigation strategy that the in-DRAM mitigation circuit uses is performing extra refreshes in addition to regular refreshes. It would be interesting to find evidence from MRH experiments that the extra refreshes actually occur.
In addition to multiple member MHG, RH was performed with refreshes for a single row that failed in MRH. The hammering strategy was the same as with MRH except for the one group member in single-row hammering. There were no errors found in the refreshed single RH tests. This result was consistent throughout all repeated tests performed for all the 32 target rows.
As shown in Table 1, the average number of intrinsic HT was about 50 k, which is equivalent to about 2.4 ms because the time for one hammer is 48.75 ns based on the timing parameter used in this experiment. It is hard to imagine that the errors in the intrinsic RH test were protected only by the regular refresh during the refresh ORH test because the 32 test rows were randomly distributed over the memory bank. On the other hand, it is more reasonable to assume that there were extra refreshes by the in-DRAM RH mitigation circuit. Please note that the regular refresh sequence is solely determined internally by the memory control circuit and users are not able to know the exact rows refreshed with refresh commands. Fig. 6 is an error that started to occur from MHG(6). In both row and bit errors, no errors occurred for any MHG with up to 5 rows, in which case 5 is referred to as the maximum MHG Without Errors (MWE). All MHGs with less than the maximum size should not have any errors.

One interesting observation in
To ensure the maximum MWE was consistently observed, many different combinations of 5 rows out of the 32 worst HT rows were tried in MRH tests at room temperature. The maximum MWE of 5 consistently did not produce any errors. This observation implies that this device's in-DRAM MRH mitigation strategy is very effective and serves as a complete solution up to the maximum MHG, after which mitigation effectiveness is not guaranteed.
The mitigation circuit seems to track hammered rows to a certain number quite well and effectively mitigates RH stresses. Effective buffer size determination should consider many underlying factors such as the distribution of HTs for target memory and performance penalty due to extra refreshes for tracked rows if buffers implement such tracking.

C. ERRORS BY MULTIPLE ROWS HAMMERING STRESS
The previous two subsections demonstrated that there was a mitigation circuit working during the MRH test. How do you confirm that it was MRH stress that caused errors even with an active mitigation circuit?
Regular refreshes protect all the cells in DRAM, and the refresh interval was determined at 64 ms. As long as a refresh command is issued every 7.8 us, no cells should fail due to retention issues. For this reason, an intrinsic ORH test was performed for a 64 ms interval, and the errors were consistently repeated every 64 ms.
The error bits in Fig. 6 did not fail every 64 ms. It means the errors should not be attributed to a simple retention issue. Although refreshes were issued every 7.8 us during the test, these refreshes were not enough to retain the cells. Fig. 2 in Section III shows that no error occurred within a 1.5 second retention time for the X-ray irradiated sample. The retention test was performed at three different temperatures, 30 • C, 85 • C, and 95 • C, for all the banks and rows of the sample. No bits failed due to the retention time of 64 ms except a few bits that failed at 95 • C.
Accordingly, the cells should not fail for any of the tests in Fig. 6 for the following reasons: 1) the test was performed under room temperature like the retention test and intrinsic ORH, 2) the total test time of 128 ms was much less than the retention time, 1.5 s, measured, 3) the cells were regularly refreshed because refresh commands were issued every 7.8 us, 4) there were extra refreshes by the mitigation circuit as discussed in Subsection V.A. Despite all the protection provided for the cells, they were flipped during MRH test. It should be fair to say the errors in Fig. 6 were mainly due to MRH and not protected (due to coverage loss) by the in-DRAM mitigation circuit.

VI. IS MITIGATING BY HAMMERING COUNT ENOUGH?
As mentioned in the previous section, the MRH test for every MHG was repeated 15 times, during which failed VRs were accumulated, as shown in Fig. 7. The Y-axis in Fig. 7 shows MHG sizes from 6 to 32; sizes less than 6 are not shown because no errors were found. The X-axis shows the list of VRs in hexadecimal addresses from table 1. The dots in Fig. 7 show the accumulated failed VRs during the 15 trials of each MHG(n) test and are referred to as fail dots.
For example, if the MHG(6) (i.e., ARs from x 1 to x 6 from table 1) is hammered, any rows from 0 × 0C6B to 0 × 4CAB on the X-axis may fail. In the case of MHG(6), there was a total of 1 VR failed, 0 × 27B8.

A. COVERAGE LOSS FROM A MITIGATION ALGORITHM PERSPECTIVE
In Fig. 7, there is one fail dot in MHG (6). The fail dot could have happened at any MRH test trials. Not all test trials produced fail dots. Please note that there were MHG tests that did not have any fail dots.
It's interesting to compare the two MHG cases, MHG(5) and MHG(6), in Fig. 7. The only difference between the two groups members is an additional row, 0×4 CAB, in MHG(6). It is interesting that row 0 × 27B8, which was in both groups, failed when it was hammered in MHG(6) but did not fail when hammered in MHG (5).
The main role of mitigation logic is to do an extra refresh to prevent RH-induced bit errors. The function seamlessly worked for MHG(5) but started to show a coverage hole when a new row was added; this implicitly demonstrates that the coverage hole was due to the Decision Making Strategy (DMS) by a mitigation circuit.
The DMS produced three different cases in terms of the number of fail dots in Fig. 7. The first two cases were two extreme cases that had no fail dots in all aggressor rows. The third case presented fail dots in the subset of member rows.
For example, MHG (14) had no errors, and MHG(15) had errors that were found in all rows. Given that only one new row was added in MHG (15), the dramatically different results by DMS are not easy to explain. MHG (19), which had 4 more rows than MHG(15), did not produce any errors; this implicitly provides evidence that there was no such extreme situation that cannot be avoided simply because of the addition of one row in MHG (15).
If the DMS is assumed to have been made solely from a hammering threshold data, with optimal engineering skills and effort, the coverage variance observed in Fig. 7 can be interpreted from two angles; 1) the MRH test cases in the experiment were not considered practical and were not covered by the DMS, or 2) the deciding factors in the DMS were not sufficiently considered, intentional or unintentional. The next two subsections discuss the potential decision factors that can be used as part of the DMS for coverage enhancement.
In addition to the extreme coverage cases, the number of errors depended on MHG sizes, and the errors were spread out over the hammered rows. The rows were hammered in a round-robin manner, as described in Section IV. In practice, there are many ways of hammering other than the round-robin manner. The outcome of such random ordering of aggressor rows is even more complex to analyze, which can burden the failure analysis in the field. It is preferable to devise MRH, which has a more predictable coverage.  Fig. 6 shows that the number of failed rows increased at first as the size of MHG increased. However, the number of failed rows decreased after the number of rows in an MHG got larger than a certain size (25 in Fig. 6). In order to understand such a trend, the distribution of HT for aggressor rows was investigated.

B. DISTRIBUTION OF HAMMERING THRESHOLDS
The vertical bars in Fig. 8 show the number of HTs for the victim rows of the 32 rows selected in the MRH tests. The dotted line in the figure shows the maximum number of hammering thresholds (or counts) possible within a refresh cycle of 64 ms for various sizes of MHGs. Please note that the maximum hammering counts decrease as the MHG sizes increase. The plots are not shown for MHGs less than 13 as the values keep increasing.
For example, the maximum hammering count for MHG(30) was 43.8 k, in which case the HTs were above the maximum hammering count. Since all the rows in the MHG were accessed in a round-robin manner and all rows had equal hammering counts, it was therefore expected that fewer errors would occur with more rows in an MHG if all rows had the same number of HTs. Fig. 6 shows the number of failed cells and failed rows as MHG sizes increased. In the case of MHG(6), the maximum hammering count was 218.8 k, which was 5 times larger than MHG(30). Since the hammering thresholds for the rows in Fig. 8 are much smaller than the maximum hammering count allowed in MHG (6), it is expected that the number of error cells gets larger as MHG sizes decrease.
Obviously, the best DMS should involve deterministically tracing all hammered rows and determining all the rows that are near HTs for extra refreshes. However, such an exhaustive DMS may not be practical in terms of silicon space and the performance penalty. Alternatively, the DMS can consider the statistical distributions of both hammering counts and HTs of aggressor rows to make optimal decisions for extra refreshes.

C. COMBINED EFFECTS OF HAMMERING AND RETENTION
Every cell in a DRAM is refreshed once every 64 ms, which means the retention time of 64 ms should be guaranteed under any active or passive operating condition. HTs in row hammering is a key parameter in selecting refresh rows within 64 ms. The HT is determined based on the hammering number of AR that flips cells in associated VRs. However, this is not the only situation in which errors can occur, which means DMSs based on HT may lead to coverage holes in a real application, which is examined in Fig. 9. Fig. 9 shows the experimental result for the retention time of a cell in association with the number of hammering at room temperature. Please note that the retention time on the Y-axis is the Remaining Retention Time (RRT) after the cell is hammered up to the hammering count on the X-axis. The two plots, S1 and S2, are for a cell in different samples. Similar trends can be observed in any cell in DRAM with different slopes. The HTs of the two cells were 205 k and 66.6 k, respectively. For the data in Fig. 9, DDR4 samples were used due to the test program availability of these specific retention time measurements.
Typically, the retention time is measured by passively waiting for a bit cell to flip after writing a value. S1 had a retention time of greater than the 50 s (not shown above 45 s in Fig. 9), which is much larger than the required minimum of 64 ms. When row hammering was performed for S1, the RRT decreased. The rate that RRTs decrease over hammering counts is characteristic of cells and should have distributions depending on the type of DRAM chip.
For example, the RRT of 50 k hammered S2 cell was reduced from 44 s to 11 s. Please note that the time taken for 50 k hammering was 2.44 ms under the timing parameters selected for the DRAM device. If S2 happened to be hammered at the beginning of the 64 ms refresh interval, S2 should survive for 61.56 ms until the cell is scheduled to be refreshed by a regular refresh mechanism. In this example, 50 k hammering was much smaller than the HT of 66.6 k. However, the cell may lose its data when RRT after RH is not sufficient. At room temperature, the RRT of 11 s was still much larger than the minimum, 64 ms. However, this RRT may not be enough at high temperatures. This example demonstrates that DMS based solely on HT can be a source of a coverage hole. In other words, failure by row hammering is affected by the combined and compounding effect of row hammering and retention time.

VII. TEMPERATURE SENSITIVITY
The DRAM is very sensitive to ambient temperatures. The same tests in Fig 6 were repeated over 2 additional high temperatures, 50 • C, and 80 • C; the results are shown as a ratio to room temperature in Fig. 10, respectively.
With MHG(6), the errors occurred only one row at a time, and the failed row number was not too different from the result in room temperature, as shown in Fig. 6. The major difference in high temperature was found in the number of cell errors, which increased by about 5.3 times in the case of MHG (6). On the other hand, the ratio decreased as the number of MHG increases in both failed rows and cells. This can be similarly explained as described in Section VI.B-as the number of MHG increases, the number of total hammering decreases in a given 64 ms time window, reducing the hammering effect on any victim rows.

VIII. CONCLUSION
The ORH test uncovered the distribution of row hammering thresholds in the DDR3L target sample. The mean threshold was 812 k, which was much smaller than the minimum guaranteed HT of 1300 k. When the sample was radiated with X-ray, the mean HT was reduced to 221 k. Even with such a drastic reduction of mean HT, the radiated sample did not generate any errors as refresh commands were issued regularly during the refresh time interval of 64 ms. This proved that the mitigation circuit embedded in sample DRAM worked very well against one or a few row-based hammerings.
However, when the sample was exposed to MRH with refreshes turned on, errors started to occur. This manifested VOLUME 9, 2021 the weaknesses of the embedded mitigation circuit; this also meant that MRH was better for exercising hammering stresses. The errors due to MRH also showed weakness in the DMS by the mitigation circuit. Two types of weaknesses were pointed out. Consideration of the distribution of hammered count, as well as HT, is needed for better decision-making. Retention time after the hammering is also a very critical consideration. Decision-making based solely on hammered count can lead to coverage loss and cause intermittent errors during functional operations. Finally, an MRH test was performed under high temperatures. The results tell us that the discussions surrounding results from room temperature are equally valid under high temperatures. He is currently a Founder of Radiate, Inc., a startup company providing radiation measurement solutions. He has ten years of experience in developing equipment for various (SRAMs and DRAMs) memory component testing. His research interest includes the failure analysis at component and system levels (mainly related to memory devices).
SANGHYEON BAEG (Member, IEEE) received the B.S. degree in electronic engineering from Hanyang University, Seoul, South Korea, in 1986, and the M.S. and Ph.D. degrees in electrical and computer engineering from The University of Texas at Austin, TX, USA, in 1988 and 1991, respectively.
From 1994 to 1997, he was a Staff Researcher at Samsung Electronics Company, Kihung, South Korea. In 1995, he was dispatched to Samsung Semiconductor Inc., San Jose, CA, USA, and worked as a member of the Technical Staff. In 1997, he joined Cisco Systems, Inc., San Jose, and worked as a Hardware Engineer, the Technical Leader, and a Hardware Manager. Since 2004, he has been working as an Associate Professor at the School of Electrical Engineering and Computer Science, Hanyang University, Ansan, South Korea. His work has focused on reliable computing, low-power content-addressable memory, VLSI discrete Fourier transform implementation, and methodologies, silicon failure analysis, and yield enhancement.
SHI-JIE WEN received the Ph.D. degree in material engineering from the University of Bordeaux I, France, in 1993.
He joined Cisco Systems, Inc., San Jose, CA, USA, in 2004, where he has been engaged in IC component technology reliability assurance. He is a member of DFR and SEU core teams in Cisco. Before Cisco, he worked at Cypress Semiconductor, where he was involved in the area of product reliability qualification with technology in 0.35, 0.25, 0.18, 0.13, and 90 nm. His main research interests include silicon technology reliability, such as SEU, WLR, and complex failure analysis. VOLUME 9, 2021