eMMC Protocol
An eMMC Protocol (embedded Multi Media Controller Protocol) Flash device is a non-volatile, rewritable mass storage device. Both flash memory and controller are included in single integrated circuit. An eMMC Protocol acts as dominate storage technology for mobile phones, automotive, and PDA. An eMMC memory device is used as embedded storage device choice in most of the consumer products. Flash memory controller in eMMC Protocol simplifies interfacing complexities with processors and frees the processor from low level task for flash memory management.
Current version of eMMC is 5.1. eMMC Protocol interface is evolved from 4.41, 4.51, 5.0 and 5.1.
How does eMMC Interface look like ?
System Overview of eMMC Protocol
Communication Signals of eMMC Protocol interface are as below
Clock: This signal is driven by the host controller to device. Each cycle of this signal transfers one bit command. But for data it can be one bit or two bit depending upon the configuration. Frequency may vary from zero to maximum clock frequency specification.
Data 0-7: There eight data line D0 to D7. These are bi-directional data lines. It can either driven by host or device. During the powerup or reset, only D0 line used for data transfer. A wider bus can be configured as 4 bit or 8 bit during the operation of device.
Data Strobe: This signal is generated by device. Strobe is used for Data output and CRC status, response output in HS400. Frequency of this signal follows the frequency of clock. For data output for each cycle of this signal is two bits-one bit is for positive edge and other bit is negative edge of the cycle. For CRC response status is latched only on positive edge of this signal.
CMD: This signal is bidirectional channel used for device initialization and transfer of commands. Commands are send eMMC Protocol host controller to device and response to these commands is sent by device to host in CMD line.
RST: Hardware Reset
Vcc: Supply voltage for Core
Vccq: Supply voltage for I/O
Vss, Vssq: Ground for supply voltage core and I/O
eMMC Theory of Operations : eMMC Protocol Understanding
eMMC Device set of information registers
| Name | Register Width (byte) | Description |
| CID | 16 | Device Identification Number |
| RCA | 2 | Relative Device Address, is the Device system Address, dynamically assigned by the host during initialization |
| DSR | 2 | Driver State Register (Optional) |
| CSD | 16 | Device Specific Data, information about the device operation Condition |
| OCR | 4 | Operation Conditions Register. Used by special broadcast command to identify the voltage type of the device |
| EXT_CSD | 512 | Extended Device Specific Data. Contains information about the device capabilities and selected modes. |
After power-on reset host to needs to send a special message to device to initialize the communication between eMMC Protocol host and device. This communication has three tokens command, response and data token. Command token is issued by host. Response token is issued by device. Based on the command data can be either from host or device.
Command Token: Command is transferred from host to device. It is transferred serially on command line. Command has following bit coding scheme
eMMC Protocol has 64 commands cmd0 to cmd63. Some of these commands are reserved. Each command has different function.
Response Token: This token is sent from device to host as response to previously received command. Response is serially transferred over command line. Response has five coding schemes. It could be either 48 or 136 bits. 48 bit wide responses are R1, R3, R4 and R5. R1 response has card status information. R3 has OCR register information. R4 an dR5 has relative card address. 136 bit wide response is R2. This has CID or CSD register information.
R2 bit scheme is shown in this figure.
Data Token: Data is transferred from the device to the host or vice versa. Data can be transferred in 1 line/4 line/8 lines using data lines. DAT0 is used for one line, DAT0-DAT3 is used for four line, DAT0-DAT7 is used for eight-line data transfer. For each clock cycle either one bit or two bit (Dual/DDR) transferred. One bit either is transferred at rising edge and second bit is transferred at falling edge of the clock cycle.
One line DAT0 line coding
Four line DAT0-DAT3 line coding
Eight line DAT0-DAT7 line coding
8 bit DDR mode
Bus of Speed of eMMC Protocol System: Bus speed is started with 25MHz SDR mode. Currently, eMMC Protocol bus speed is 200MHz DDR mode. It is commonly known as HS400. The below table provides details of the different speeds of the eMMC Bus.
| Mode Name | Data Rate | IO Voltage | Bus Width | Frequency | Maximum Data Rate @bus width 8 |
| Backward Compatibility with legacy MMC card | Single | 3/1.8/1.2V | 1,4,8 | 0-26MHz | 26MB/s |
| High Speed SDR | Single | 3/1.8/1.2V | 1,4,8 | 0-52MHz | 52MB/s |
| High Speed DDR | Dual | 3/1.8/1.2V | 1,4,8 | 0-52Mhz | 104MB/s |
| HS200 | Single | 1.8/1.2V | 4,8 | 0-200MHz | 200MB/s |
| HS400 | Dual | 1.8/1.2V | 4,8 | 0-200MHz | 400MB/s |
eMMC Modes of Operation for Host and Device:
All communication between host and device is controlled by Host. Host sends a command to device resulting response from device. There are five operations mode for eMMC System.
Boot Mode: The device will be in boot mode after power cycle, reception of CMD0 with argument F0F0F0F) or assertion of reset signal.
Device Identification Mode: The device will be in device identification mode after the boot mode or if host and/or device don’t support boot mode. The device will be in this mode until the host issues set RCA command CMD.
Interrupt Mode: Host and device enter interrupt mode simultaneously. In this mode there is no data transfer. The only message allowed is interrupt service request from with either device or host.
Data Transfer Mode: The device will enter the device transfer mode once RCA is assigned. The host will enter the data transfer mode once it recognizes the device in the bus.
Inactive State: The device will enter inactive mode if either the device operating voltage range or access mode is not valid. The device can also enter inactive mode with GO_INACTIVE_STATE command (CMD15). The device will reset to Pre-idle state with power cycle.
Debugging Protocol eMMC :
When working with eMMC, it is important to have right set of tools to ensure the eMMC design is implemented properly. Having a protocol analyzer and oscilloscope are always helpful to debug complex hardware timing issues.
An oscilloscope is helpful in case you want to measure the timing parameters of the eMMC Device.
eMMC protocol analyzer can be very helpful to do eMMC packet sniffing. Prodigy Technovations also offers an eMMC trigger and decode software to debug your eMMC packets using Tektronix oscilloscope.
How Prodigy Technovations Interfaces with eMMC Protocol?
Prodigy Technovations has number of different tools that interface with eMMC .The protocol analyzer is used to monitor the traffic that is happening on the bus. The eMMC protocol analyzer can capture the packets and help expedite debug. This protocol analyzer can be used as SD Protocol analyzer, SDIO protocol analyzer as well as eMMC protocol analyzer
The product features are as follows:
- Continuous monitoring of protocol data for long time to capture elusive events (more than 30GB data capture)
- Analysis of captured data per standards for protocol integrity, count of data bursts, CMD CRC errors, Response CRC errors, Data CRC errors, Timing Values and Reserved commands
- Hardware-based protocol-aware trigger capability in real time enables capturing specific Events. Triggering facility on patterns, commands or error events.
- User can identify the anomalies by decoding command and response arguments
- Analytics feature provides analysis of acquired protocol data by plotting command, response, data and frequency of operation over acquired time
- Analytics feature also provides the decoding of device registers for easy analysis
- Filters allow you to view specific packets in decoded protocol packets
- Search feature for specific events in protocol activity
- Easy-to-use user interfaces saves time on learning curve
- Handles long duration capture and displays the decoded data without demanding extensive resources in host computer
- Inserting markers [using Trigger-In] in protocol activity helps in correlating the input digital signal with Protocol Activity
- Trigger-out signal for any specific protocol event allows triggering of other instruments such as oscilloscope
- Interface to host system [running UI] using USB3.0 or Gigabit Ethernet interface
- Flexibility to upgrade the hardware firmware using GbE interface provides easy field up-gradation of firmware
- Export of Decoded data packets to txt file for further analysis
