High Quality Professional Instruments

2012/06

eMMC Technology Application

Preface
eMMC, short for Embedded MultiMediaCard, is the embedded memory standard specification
defined by the MMC (MultiMediaCard Association). It is mainly applied in mobile devices, such as
mobile phone, smart phone, tablet computer, notebook computer, etc., which are all characterized
by light and thin. eMMC is designed just for reducing the component size.

eMMC packages the NAND Flash chip and Control chip into one chip by the MCP technology, so
as to simplify the memory design, and further reduce the components and increase the PCB size.

eMMC Structure

eMMC consists of one embedded storage proj-

ect. In its inside MMC Interface, NAND Flash and
Control are packaged into one small chip by BGA. In
short words, the Host processor only needs to trans-
mit commands through the MMC Bus without doing
any commuting about memory management, such
as ECC, Wear-Leveling and BBM, which are done by
the Control chip that packaged with the NAND Flash.
This is a good way to save the R&D cost.

Fig.1: eMMC Structure

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 1
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Specification
For eMMC, its transmission speed can be up to 52MB/s; it supports two voltages: 1.8v and
3.3v; and it supports updating. For its specification, eMMC 4.2 defines the eMMC’s interface ca-
pacity (larger than 2GB) and speed (52MB/s); eMMC 4.3 provides new functions of Booting Func-
tion, Explicit Sleep Mode, Reliable Write, etc.; and the latest eMMC 4.4’s double data rate (DDR) is
strengthened, which increases the original 52MB/s to 100MB/s; besides, the Multiple Partitioning
is added for defining the chip by two parts: High Density and High Performance. Users can store
the codes and system data in the High Performance part, so as to use the block capacity more
flexibly. And write-protection is also added to ensure the security.

Table 1 and Fig.2 show MMC’s pins and appearance respectively.

Pin Name

1 Data3

2 Command

3 VSS

4 VDD

5 Clock

6 VSS(2)

7 Data0

8 Data1

9 Data2

10 Data4
Fig.2: MMC appearance
11 Data5

12 Data6

13 Data7

Table 1: MMC pins and their names.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 2
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC’s characters and advantages

• Has these System Voltage (VDD) Ranges :

High Voltage MultiMediaCard Dual Voltage MultiMediaCard

Communication 2.7 - 3.6 1.70 - 1.95, 2.7 - 3.6 (Note 1)
Memory Access 2.7 - 3.6 1.70 - 1.95, 2.7 - 3.6
NOTE 1 VDD range: 1.95V - 2.7V is not supported.

• Ten-wire bus (clock, 1 bit command, 8 bit data bus) and a hardware reset.
- Clock frequencies of 0-200MHz
- Three different data bus width modes: 1-bit , 4-bit, and 8-bit

• Data protection Mechanisms (Write Protection Types) :

- Password
- Permanent
- Power-On
- Temporary

• Different types of error protected read and write modes:

- Single Block
- Multiple Block

• Data Removal Commands:

- Erase
- Trim
- Sanitize

• Enhance host and device communication techniques to improve performance

- Power Off Notification
- High Priority Interrupt
- Background Operations
- Partitioning
- System data tagging

• Introduces dual data rate transfer (DDR mode)

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 3
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Operating Mode

• The Host controls all the transmission between Host and Card; its control command has
two types: Broadcast and Addressed (point-to-point transmission)

The Host transmits a command to all MMC cards, but

Broadcast commands
only some cards will respond.

The Host transmits a command to some particular

Addressed (point-to-point)
MMC card, and the card will respond to this com-
commands
mand.

• eMMC has five operating modes: Boot Mode, Card Identification Mode, Interrupt Mode,
Data Transfer Mode and Inactive Mode. See Table 2.

After power on, if the Card receives the CMD0(GO_

Idle_State) with argument(0xF0F0F0F0), then it will
Boot mode
enter into the Boot Mode if it supports, or enter into
the Identification Mode.

After power on, the Card will enter into this mode
Card identification mode directly or after the Boot Mode, waiting the Host to
transmit the CMD3(Send_Relative_Address).

The Host and Card will enter into this mode at the
same time. There is no data transfer in this mode,
Interrupt mode
which only permits the Host or the Card to transmit
the interrupt service request.

After receives the RCA transmitted by the Host, the

Data transfer mode Card will enter into the Data Transfer Mode and wait
for the read/write command.

Caused by incorrect voltage and invalid inserting,

the Card will enter into this mode; CMD15(GO_INAC-
Inactive mode
TIVE_ STATE ) also can make a marked Card enter
into the Inactive Mode.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 4
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Status (Card) Operating Mode Cable Mode

Inactive State Inactive mode
Pre-Idle State
Boot mode Open-drain
Pre-Boot State
(Output in low voltage)
Idle State
Ready State Device identification mode
Identification State
Stand-by State
Sleep State
Transfer State
Bus-Test State Push-pull
Data Transfer mode
Sending-data State (Output in high voltage)
Receive-data State
Programming State
Disconnect State
Boot State Boot mode
Wait-IRQ State Interrupt mode Open-drain

Table 2: Table of comparisons between operating mode and status.

• Current the eMMC 4.5 Specification defines 4 speed modes, see table 3.

I/O Bus Width CLK Max Data Transfer

Mode Name Data Rate
Voltage (bit) Frequency (implies x8 Bus width)

Backwards Compatibili-
Single 3/1.8/1.2V 1, 4, 8 0-26MHz 26MB/s
ty with legacy MMC card

High speed SDR Single 3/1.8/1.2V 4, 8 0-52MHz 52MB/s

High Speed
Dual 3/1.8/1.2V 4, 8 0-52MHz 104MB/s
DDR

HS200 Single 1.8/1.2V 4, 8 0-200MHz 200MB/s

Table.3: 4 speed modes.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 5
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Fig.3: State flow of eMMC card after power on (Identification Mode).

Normally, after power on, if not enter into the Boot Mode, the eMMC will enter into
the Identification Flow immediately. Then the Host (Card Reader or Processor) will transmit
the CMD1 (Command 1) to the Device (Card) immediately, requiring the working condition
of idle device. The Device will return one of two status to the Host: Busy or Ready. If the
Device returns Busy, then the Host will continuously transmit the CMD1 to the Device until
it returns Ready and responds the required data. CMD2 and CMD3 follow that. CMD2 is to
require the CID number; CMD3 is to transmit the Device RCA address for the Host. Now the
registration between the Device and Host is completed; the Device will enter into the Data
Transfer Mode and keep stand-by, waiting the Host to transmit any data transfer command
or special command.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 6
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Packet and Response

• Packet : There are five packets in the eMMC protocol : Command, Response, Block, CRC
Status and Busy. See below descriptions:

- Command : Command transmitted by the Host with parameters.

- Response : The response the Device makes to the Command;
its inside parameters indicate the Device current status.
- Block : The basic unit in the eMMC transmission protocol.
All data is packaged in the Block and then transmitted.
- CRC Status : It is always after writing the Block, used to notify the Host about
the result of writing the Block.
- Busy : It is always after writing the Block, used to notify the Host that
the Device is busy and can’t write the next Block.

• Responses : All responses are transmitted by the Device after receiving the Host com-
mand. The response type determines the response length. The basic response structure
includes: Start bit, Transmission bit, Content bits, CRC bits and End bit. In the eMMC pro-
tocol there are 5 response types: R1, R2, R3, R4 and R5. See below detailed description.

Fig.4: The basic response packet structure.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 7
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

- R1 (normal response command):

Total 48 bits. [45:40] indicate the CMD value; [39:8] indicate the current status of Device.
R1b, another format of R1, has a different structure, but owns a selectable Busy signal.

- R2 (CID, CSD register):

Total 136 bits. Used to respond the content of CID/CSD register. CID register matches
with CMD2 and CMD10; and CSD register matches with CMD9.

- R3 (OCR register):
Total 48 bits. Used to respond the content of ORC register. The format of the Device
response is R3 only when the Host transmits the CMD1.

- R4 (Fast I/O):
Total 48 bits. Used to write or read 8 bits data segment into or from some register. The
format of the Device response is R4 only when the Host transmitted the CMD39.

- R5 (Interrupt request):
Total 48 bits. It is the response format for interrupt request. When the Host transmits the
CMD40 to order some card to enter into the Interrupt Mode, and the Device receives it
and responds in R5 format, then the Card can be considered be interrupted and the RCA
is set to 0x0.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 8
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Transmission Mode

There are 5 transmission modes : 1 bit SDR ( 1 bit Bus sampling at rising edge), 4 bits SDR (4 bits
Bus sampling at rising edge), 8 bits SDR (8 bits Bus sampling at rising edge), 4 bits Bus DDR and
8 bits Bus DDR. All five modes take the Block as the unit of data transmission.
See below diagrams:

• 1 bit Bus SDR (Single Data Rate) : Sampling at rising edge.

One data pin (Data 0) is enough.

• 4 bit Bus SDR : Sampling at rising edge.

4 data pins (Data 0-Data 3) are needed.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 9
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

• 8 bit Bus SDR : Sampling at rising edge.

4 data pins (Data 0-Data 3) are needed.

• 4 bit Bus DDR (Double Data Rate) :

The Block and CRC are sampled at the rising/falling edge of CLK. But the start bit and end
bit are only sampled at the rising edge.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 10
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

See below image for the DDR sampling mode. It captures the data at the rising/falling
edge of CLK, to achieve double-data transmission. Please note that only the start bit and end bit
are captured at the rising edge, the Data and CRC are captured at the rising/falling edge.

• 8 bit Bus DDR (Double Data Rate):

8 data pins (Data 0-Data 7) are needed. It has the same transmission mode of 4 bits Bus DDR.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 11
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Practical Measurement and Signal Tracing

eMMC Protocol Analyzer module, designed by Zeroplus Logic Analyzer, can help engi-
neers measuring the eMMC signal packet. They only need to connect the test line of Logic
Analyzer with the eMMC to measure the signal; then, with the humanized software interface,
the eMMC can trace any eMMC Command, Response or Data, helping engineers to quicken the
R&D process. See Fig.5:

Fig.5: Connect the card reader and eMMC with the test line,
then start the LA to capture.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 12
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Refer the table 4 for the pins and their names, connect the lines of Command, Clock and
Data0-Data7 with A0, A1, A2, A3, A4, A5, A6, A7, B0 and B1. See Fig.6.

Pin Name

1 Data3

2 Command

3 VSS

4 VDD

5 Clock

6 VSS(2)

7 Data0

8 Data1

9 Data3

10 Data4

11 Data5

12 Data6

13 Data7

Table 4 Fig.6

Fig.7: Use Zeroplus Logic Analyzer to measure the eMMC CMD.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 13
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Fig.7: Use Zeroplus Logic Analyzer to measure the eMMC Data.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 14
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

eMMC Protocol Analyzer Module Introduction

The eMMC Protocol Analyzer module of Zeroplus Logic Analyzer can analyze the Com-
mand and Data of eMMC Bus. Users only need to do some settings in the Bus setting interface,
which has four sections: Decoding format, Pin Assignment, Decode settings, Protocol Analyzer
Color. See Fig.9.

Fig.9: eMMC Protocol Analyzer module setting window.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 15
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

• Decoding format:
Select the eMMC’s transmission mode, which determines the Logic Analyzer can decode the
data correctly or not.

• Pin Assignment:
Set the pin connection when analyzing the eMMC. Make sure the connection is correct.

• Decode settings:
Set the Bus to decode at the CMD line or Data line; if at the Data line, users must set the
Block length (2-16KBytes).

• Protocol Analyzer Color:

Self-set the color of each packet.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 16
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

If users want to analyze both the Command and the Data, they can group two Buses to
decode, one for the Command and one for the Data.

Setting Steps:
Step 1 : Click “Bus/Signal” --> “Channels Setup”.
Step 2 : In the “Channels Setup” window, select A0, A1, A2, A3, A4 and A5 for each Bus.
See Fig.8 and Fig.9.

Name the Bus directly. Click the pins directly.

Fig.10: Channels Setup

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 17
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

CMD Bus

DATA Bus

Fig.11: Analyze the Command and Data at the same time.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 18
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Practical Application: CMD Tracing and Debug Program

In some eMMC R&D project, the codes are written and compiled, and no problem is found in
its basic read/write test. But in some location the data is error in reading/writing. So is there any
better method to find the error data except using the software of Hex Editor, Ultra Edit, etc.?
Now you can use Zeroplus Logic Analyzer to trace some CMD, Address or Data, and capture
its data to find the bug. See below image, the bug is found through tracing the particular CMD.

Step 1 : Trace the CMD25(WRITE_MULTIPLE_BLOCK) and capture the written data.

Step 2 : Find the particular location Address 0x60000 to see the data
writing status behind that.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 19
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Step 3 : Use the ‘Bus Packet List’ function and set the packet be synchronous with the waveform,
then users can analyze directly why the written data is completed different in the same location.

Points of difference Compare the correct data with the incorrect.

Fig.12: Find the difference.

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 20
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362
 High Quality Professional Instruments
2012/06

Conclusion

In the past few years, the smart phone, tablet computer and notebook computer have
developed very quickly, that requires a large number of traditional multi-chip packaging
(MCP) and eMMC. The R&D team has a higher requirement about CPU performance and
memory capacity of in-built NAND Flash. Since the first iPhone’s hot sell in 2007, more and
more mobile phone manufactures began to design the smart phone with in-built memory.
The latest iPhone 4 has abandoned the traditional MCP module but adopted the eMMC. So
the eMMC is very possible to lead the future trend.

Zeroplus PC-Based Logic Analyzer has supported nearly a hundred Bus modules, its
software can auto-decode the captured signal. That helps engineers to quickly analyze and
check the signal, optimize the system, quicken the project process and make the product
come into the market earlier. They don’t need to decode by hand slowly with the oscillo-
scope. Zeroplus Logic Analyzer is the best tool for you to analyze signal.

Please login our website www.zeroplus.com.tw for more information; or you can reg-
ister on our website to be our member, we will send technical analysis report to you on
irregularly schedule.

Roger Tsai
Instrument Department/ FAE

Copyright C ZEROPLUS TECHNOLOGY CO., LTD. ALL rights reservied. Publication Release: 21
www.zeroplus.com.tw TEL:+886 2-66202225 FAX:+886 2-22234362