View S75PL127J_2067963.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

advance information publication number S75PL127J_00 revision a amendment 1 issue date january 6, 2005 S75PL127J mcps stacked multi-chip product (mcp) code flash, psram and data flash 128m (8m x 16-bit cmos 3.0 volt- only, simultaneous operation, page mode code flash memory, with 64m/32m (4m/2m x 16-bit) psram and 512m/256/128m (32m/16m/8m x 16- bit) data flash memory mcp features ? power supply voltage of 2.7 to 3.1 volt ? high performance ? 65ns for pl-j, 70ns for psram, and 110ns for gl-n ? page access - 25ns ? package ? 9 x 12 mm 84 ball fbga ? operating temperature ? ?25c to +85c (wireless) ? other temperature grade options ? please contact the factor y through the local sales support team general description the 75pl series is a product line of stacked multi-chip product (mcp) packages and consists of: ? one s29pl127j based code flash device(s) ? psram ? one or more s29glxxxn ba sed data flash device(s) density 128m 256m 512m 128m S75PL127Jbd S75PL127Jbe S75PL127Jbf data flash 32m psram code flash density 128m 256m 512m 128m S75PL127Jcd S75PL127Jce S75PL127Jcf code flash 64m psram data flash data sheet
2 27631a5 september 28, 2004 advance information S75PL127J mcps .................................................1 general description ...................................................1 product selector guide ............................................ 5 mcp block diagram ................................................ 6 connection diagram ................................................ 7 pin description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 logic symbol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ordering information ............................................... 9 valid combinations .................................................10 data: s29gl128n ................................................................................................ 10 data: s29gl256n ................................................................................................ 11 data: s29gl512n ............................................................................................... 12 s29pl127j/s29pl064j/s29p l032j for mcp ..... 13 general description .................................................15 simultaneous read/write operation with zero latency .......................15 page mode features ............................................................................................15 standard flash memory features ..... ...............................................................15 pin description .........................................................17 device bus operations ............................................18 table 1. pl127j device bus operations ................................ 18 requirements for reading array data ......................................................... 18 random read (non-page read) ...... .......................................................... 18 page mode read .............................................................................................. 19 table 2. page select .......................................................... 19 simultaneous read/write operation ........................................................... 19 table 3. bank select .......................................................... 19 writing commands/command sequences ................................................ 20 accelerated program operation ..... ......................................................... 20 autoselect functions .................................................................................... 20 standby mode .......................................................................................................20 automatic sleep mode ...................................................................................... 21 reset#: hardware reset pin ........... .............................................................. 21 output disable mode ........................................................................................ 21 table 4. pl127j sector architecture ..................................... 22 table 5. secsitm sector addresses ...................................... 27 autoselect mode .................................................................................................27 table 6. autoselect codes (high voltage method) .................. 28 table 7. pl127j boot sector /sector block addresses for protection/unprotection ..................................................... 29 selecting a sector prot ection mode ............................................................. 30 table 8. sector protection schemes ..................................... 30 sector protection ................................................... 30 sector protection schemes .................................. 30 password sector protection .............. ............................................................. 30 wp# hardware protection ............................................................................ 30 selecting a sector prot ection mode ............................................................. 30 persistent sector protection ................................. 31 persistent protection bit (ppb) ........................................................................31 persistent protection bit lock (ppb lock) ..................................................31 persistent sector protec tion mode locking bit ........................................33 password protection mode ................................... 33 password and password mode lockin g bit ................................................34 64-bit password ...................................................................................................34 write protect (wp#) ........................................................................................34 persistent protection bit lock ....................................................................35 high voltage sector protection .... ..................................................................35 figure 1. in-system sector protection/sector unprotection algorithms...................................................... 36 temporary sector unprotect .........................................................................37 figure 2. temporary sector unprotect operation .................... 37 secsi? (secured silicon) sector fl ash memory region ...........................37 factory-locked area (64 words) ..............................................................37 customer-lockable area (64 words) ......................................................38 secsi sector protection bits ........................................................................38 figure 3. secsi sector protect verify..................................... 39 hardware data protection ............ ..................................................................39 low vcc write inhibit ................................................................................ 39 write pulse ?glitch? protection ............................................................... 39 logical inhibit ................................................................................................... 39 power-up write inhibit ............................................................................... 39 common flash memory interface (cfi) ............ 40 table 9. cfi query identification string ................................ 40 table 10. system interface string ........................................ 41 table 11. device geometry definition ................................... 41 table 12. primary vendor-specific extended query ................ 42 command definitions .............................................44 reading array data ............................. ..............................................................44 reset command .................................................................................................44 autoselect command sequence .......... .......................................................... 45 enter secsi? sector/exit secsi se ctor command sequence ................ 45 word program command sequence . .......................................................... 45 unlock bypass command sequence .. ...................................................... 46 figure 4. program operation ............................................... 47 chip erase command sequence ................................................................... 47 sector erase command sequence ................................................................48 figure 5. erase operation ................................................... 49 erase suspend/erase resume comma nds ..................................................49 command definitions tables .........................................................................50 table 13. memory array command definitions ...................... 50 table 14. sector protection command definitions .................. 51 write operation status ........................................ 52 dq7: data# polling ............................................................................................ 52 figure 6. data# polling algorithm ........................................ 54 ry/by#: ready/busy# ........................................................................................55 dq6: toggle bit i ............................................................................................... 55 figure 7. toggle bit algorithm ............................................. 56 dq2: toggle bit ii .............................................................................................. 56 reading toggle bits dq6/dq2 ....... .............................................................. 56 dq5: exceeded timing limits ........................................................................ 57 dq3: sector erase time r ................................................................................ 57 table 15. write operation status ......................................... 58 absolute maximum ratings ...................................59 figure 8. maximum overshoot waveforms ............................ 59 operating ranges ................................................... 60 industrial (i) devices ..........................................................................................60 wireless devices ................................................................................................60 supply voltages ...................................................................................................60 dc characteristics .................................................. 61 table 16. cmos compatible ................................................ 61 ac characteristic ....................................................62 test conditions .................................................................................................. 62 figure 9. test setups ........................................................ 62 table 17. test specifications ............................................... 62 switching waveforms ......................................................................... 63 table 18. key to switching waveforms .......................... 63 figure 10. input waveforms and measurement levels ............ 63 vcc ramprate ................................................................................................... 63 read operations .................................................................................................64 table 19. read-only operations .......................................... 64 figure 11. read operation timings ...................................... 64 figure 12. page read operation timings............................... 65 reset ....................................................................................................................... 65 table 20. hardware reset (reset#) .................................... 65 figure 13. reset timings .................................................... 66 erase/program operations .............................................................................. 67 table 21. erase and program operations .............................. 67 timing diagrams .................................................................................................68 figure 14. program operation timings ................................. 68 figure 15. accelerated program timing diagram.................... 68 figure 16. chip/sector erase operation timings .................... 69 figure 17. back-to-back read/write cycle timings................. 69 figure 18. data# polling timings (during embedded algorithms)....................................................................... 70 figure 19. toggle bit timings (during embedded algorithms)....................................................................... 70 figure 20. dq2 vs. dq6 ..................................................... 71
september 28, 2004 27631a5 3 advance information protect/unprotect .................................................. 71 table 22. temporary sector unprotect ................................. 71 figure 21. temporary sector unprotect timing diagram.......... 71 figure 22. sector/sector block protect and unprotect timing diagram ................................................................. 72 controlled erase operations ..........................................................................73 table 23. alternate ce# controlled erase and program operations ....................................................................... 73 table 24. alternate ce# controlled write (erase/program) opera- tion timings ..................................................................... 74 table 25. erase and programming performance .................... 75 bga pin capacitance ............................................ 75 s29glxxxn mirrorbit tm flash family ........... 77 general description ................................................78 product selector guide ..........................................80 block diagram ........................................................ 81 pin description ....................................................... 82 logic symbol .......................................................... 83 s29gl512n ........................................................................................................83 s29gl256n .......................................................................................................83 s29gl128n .......................................................................................................83 device bus operations ........................................... 84 table 1. device bus operations ........................................... 84 versatileio tm (v io ) control ............................................................................ 84 requirements for reading array data ........................................................ 84 page mode read ............................................................................................. 85 writing commands/command sequences ................................................ 85 write buffer .................................................................................................... 85 accelerated program operation ..... ......................................................... 85 autoselect functions .................................................................................... 86 standby mode ...................................................................................................... 86 automatic sleep mode ..................................................................................... 86 reset#: hardware reset pin ........... ............................................................. 86 output disable mode ....................................................................................... 87 table 2. sector address table?s29gl512n ........................... 87 table 3. sector address table?s29gl256n ..........................102 table 4. sector address table?s29gl128n ..........................109 autoselect mode ................................................................................................ 113 table 5. autoselect codes, (high voltage method) ...............114 sector protection ............................................................................................... 114 persistent sector protection ...................................................................... 114 password sector protection ....................................................................... 114 wp# hardware protection ............... ......................................................... 114 selecting a sector protection mode ........................................................ 114 advanced sector protec tion .......................................................................... 115 lock register ....................................................................................................... 115 table 6. lock register .......................................................116 persistent sector protection ......... ................................................................. 116 dynamic protection bit (dyb) .................................................................. 116 persistent protection bit (ppb) .... ............................................................. 117 persistent protection bit lock (ppb lock bit) ..................................... 117 table 7. sector protection schemes ....................................118 persistent protection mode lock bi t .......................................................... 118 password sector protection .............. ............................................................. 119 password and password protection mo de lock bit ............................... 119 64-bit password .................................................................................................120 persistent protection bit lock (ppb lock bit) .........................................120 secured silicon sector flash memory region ..........................................120 write protect (wp#) ...................................................................................... 122 hardware data protection ................ ............................................................ 122 low vcc write inhibit .............................................................................. 122 write pulse ?glitch? protection ...... ........................................................ 122 logical inhibit ................................................................................................. 122 power-up write inhibit .............................................................................. 122 common flash memory interface (cfi) ............ 122 table 8. cfi query identification string............................... 123 table 9. system interface string ........................................ 124 table 10. device geometry definition ................................. 125 table 11. primary vendor-specific extended query ............... 126 command definitions .......................................... 126 reading array data ............................. .............................................................127 reset command ................................................................................................127 autoselect command sequence .......... .........................................................127 enter secured silicon sect or/exit secured silicon sector command sequence ...........................................................................128 word program command sequence ..... .....................................................128 unlock bypass command sequence .. .....................................................129 write buffer programming .........................................................................129 accelerated program ...................................................................................130 figure 1. write buffer programming operation .................... 131 figure 2. program operation ............................................. 132 program suspend/program resume command sequence ................... 132 figure 3. program suspend/program resume...................... 133 chip erase command sequence ......... ......................................................... 133 sector erase command sequence ...............................................................134 figure 4. erase operation ................................................. 135 erase suspend/erase resume command s ................................................. 135 lock register command set definiti ons ...................................................136 password protection command set de finitions .....................................136 non-volatile sector protection co mmand set definitions .................138 global volatile sector protection freeze command set .....................138 volatile sector protection command set .................................................139 secured silicon sector entry command ....................................................140 secured silicon sector exit command .......................................................140 command definitions ....................................................................................... 141 table 12. s29gl512n, s29gl256n, s29gl128n command definitions, x16 ................................................ 141 write operation status ..................................................................................144 dq7: data# polling ...........................................................................................144 figure 5. data# polling algorithm ...................................... 145 ry/by#: ready/busy# ......................................................................................145 dq6: toggle bit i ..............................................................................................146 figure 6. toggle bit algorithm ........................................... 147 dq2: toggle bit ii .............................................................................................147 reading toggle bits dq6/dq2 ....... .............................................................148 dq5: exceeded timing limits .......................................................................148 dq3: sector erase time r ...............................................................................148 dq1: write-to-buffer abort ..........................................................................149 table 13. write operation status ....................................... 149 absolute maximum ratings ................................ 150 figure 7. maximum negative overshoot waveform .............. 150 figure 8. maximum positive overshoot waveform ................ 150 operating ranges ................................................. 150 dc characteristics ................................................. 151 test conditions ......................................................152 figure 9. test setup ........................................................ 152 table 14. test specifications ............................................. 152 key to switching waveforms .............................. 152 figure 10. input waveforms and measurement levels .......... 152 ac characteristics .................................................153 read-only operations?s29gl128n, s29gl256n, s29gl512n .......... 153 figure 11. read operation timings .................................... 154 figure 12. page read timings ........................................... 154 hardware reset (reset#) ............................................................................. 155 figure 13. reset timings .................................................. 155 erase and program operations?s29gl128n, s29gl256n, s29gl512n ..........................................................................................................156 figure 14. program operation timings ............................... 157 figure 15. accelerated program timing diagram.................. 157 figure 16. chip/sector erase operation timings .................. 158 figure 17. data# polling timings (during embedded algorithms)..................................................................... 159 figure 18. toggle bit timings (during embedded algorithms) 160 figure 19. dq2 vs. dq6 ................................................... 160 alternate ce# controlled erase and program operations- s29gl128n, s29gl256n, s29gl512n .........................................................161
4 27631a5 september 28, 2004 advance information figure 20. alternate ce# controlled write (erase/ program) operation timings .............................................. 162 erase and programming performance .............. 163 tsop pin and bga package capacitance ......... 163 psram type 2 ................................................164 features ................................................................ 164 product information ............................................ 164 pin description ..................................................... 164 power up sequence ............................................. 165 timing diagrams ...................................................166 power up ............................................................................................................ 166 figure 21. power up 1 (cs1# controlled) ............................ 166 figure 22. power up 2 (cs2 controlled) .............................. 166 functional description ........................................ 166 absolute maximum ratings ................................. 167 dc recommended operating conditions ......... 167 capacitance (ta = 25c, f = 1 mhz) .................... 167 dc and operating characteristics ..................... 167 common .............................................................................................................. 167 16m psram .........................................................................................................168 32m psram ........................................................................................................168 64m psram ........................................................................................................ 169 ac operating conditions ................................... 169 test conditions (test load and test input/output reference) ....... 169 figure 23. output load ..................................................... 169 acc characteristics (ta = -40c to 85c, v cc = 2.7 to 3.1 v) ........ 170 timing diagrams ....................................................171 read timings ....................................................................................................... 171 figure 24. timing waveform of read cycle(1)...................... 171 figure 25. timing waveform of read cycle(2)...................... 171 figure 26. timing waveform of read cycle(2)...................... 171 write timings .................................................................................................... 172 figure 27. write cycle #1 (we# controlled) ........................ 172 figure 28. write cycle #2 (cs1# controlled) ....................... 172 figure 29. timing waveform of write cycle(3) (cs2 controlled) ............................................................. 173 figure 30. timing waveform of write cycle(4) (ub#, lb# controlled) ..................................................................... 173 psram type 6 ................................................174 features ................................................................. 174 pin description ..................................................... 174 functional description ......................................... 175 absolute maximum ratings ................................ 175 dc recommended operating conditions (ta = -40c to 85c) ............................................. 175 dc characteristics (ta = -40c to 85c, vdd = 2.6 to 3.3 v) (see note 3 to 4) ................ 176 capacitance (ta = 25c, f = 1 mhz) .................... 176 ac characteristics and operating conditions ............................................................. 176 (ta = -40c to 85c, vdd = 2.6 to 3.3 v) (see note 5 to 11) ............176 ac test conditions .............................................. 177 timing diagrams ................................................... 178 read timings .......................................................................................................178 figure 1. read cycle ........................................................ 178 figure 2. page read cycle (8 words access) ....................... 179 write timings .................................................................................................... 180 figure 3. write cycle #1 (we# controlled) (see note 8) ...... 180 figure 4. write cycle #2 (ce# controlled) (see note 8) ....... 181 deep power-down timing ..............................................................................181 figure 5. deep power down timing.................................... 181 power-on timing ................................................................................................181 figure 6. power-on timing ................................................ 181 provisions of address skew ...........................................................................182 read ...................................................................................................................182 figure 7. read ................................................................ 182 write .................................................................................................................182 figure 8. write ................................................................ 182 revision summary .........................................183
january 6, 2005 S75PL127J_00_a1_e S75PL127J mcps 5 prelimiary product selector guide device-model# pl127j access times (ns) psram density psram access time (ns) supplier data storage density package S75PL127Jbd-ku 65 32 mb 70 type 6 128 mb (110ns) 9x12 mm 84-ball fbga S75PL127Jbd-kb type 2 S75PL127Jcd-ku 64 mb type 6 S75PL127Jcd-kb type 2 S75PL127Jbe-ku 65 32 mb 70 type 6 256 mb (110ns) 9x12 mm 84-ball fbga S75PL127Jbe-kb type 2 S75PL127Jce-ku 64 mb type 6 S75PL127Jce-kb type 2 S75PL127Jbf-ku 65 32 mb 70 type 6 512 mb (110ns) 9x12 mm 84-ball fbga S75PL127Jbf-kb type 2 S75PL127Jcf-ku 64 mb type 6 S75PL127Jcf-kb type 2
6 S75PL127J mcps S75PL127J_00_a1_e january 6, 2005 advance information mcp block diagram note: f1-ce# and f2-ce# are the chip-enable pins for the pl and gl flash devices, respectively. v cc f v cc f dq15 to dq0 dq15 to dq0 16 s29pl127j s29gl-n a max *-a22 flash-only address shared address wp#acc f1-ce# (see note) oe# we# f-rst# wp# ce# oe# we# reset# 23 rdy vss f2-cw# (see note) ry/by# v ss dq15 to dq0 16 psram v cc v cco r-v cc ce# we# oe# ub# lb# r-ce# r-ub# r-lb# (note 1) r-ce2 23 v ss v ssq amax -a24 for gl512, a23 for gl256n, a22 for gl128 and pl127j. flash-only addressess may be shared between pl and gl, but is not shared with psram. for more details, refer to the table following th e connection diagram.
january 6, 2005 S75PL127J_00_a1_e S75PL127J mcps 7 prelimiary connection diagram mcp gl-only addresses pl-gl shared addresses pl, gl, and psram shared addresses S75PL127Jbd - a22?a21 a20?a0 S75PL127Jcd - a22 a21?a0 S75PL127Jbe a23 a22?a21 a20?a0 S75PL127Jce a23 a22 a21?a0 S75PL127Jbf a24-a23 a22?a21 a20?a0 S75PL127Jcf a24-a23 a22 a21?a0 c9 f2-ce# b9 rfu c7 a8 b7 rfu c6 we# b6 f-vcc e4 a1 dnu a2 dnu dnu dnu legend: gl (data) only psram only pl (code) only pl and gl shared reserved for future use all shared c5 f1-wp/acc rfu b5 a11 c8 b8 rfu d8 a12 e8 a13 f8 a14 g8 a24 h8 dq15 dq7 j8 k8 dq14 l8 rfu e7 d7 a19 a9 f7 a10 g7 dq6 h7 dq13 j7 dq12 k7 dq5 l7 rfu e9 d9 a15 a21 f9 a22 g9 a16 h9 rfu j9 vss k9 f2-wp#/acc l9 rfu l5 f-vcc k5 dq11 j5 j 5 f-vcc h5 dq3 g5 rfu f5 rfu ry/by# e5 f-rst# d5 rfu l2 k2 rfu g2 a0 f2 a1 e2 a2 d2 a3 c2 rfu rfu b2 h2 h 2 f1-ce# h2 r-ce1# j2 l6 rfu k6 rfu h6 dq4 g6 rfu f6 a23 e6 a20 d6 r-ce2 r-vcc j6 vss l4 k4 dq2 dq10 j4 h4 dq9 g4 dq1 f4 a17 a18 r-ub# d4 rfu l3 k4 dq8 dq0 j3 h3 oe# g3 vss f3 a4 e3 a5 d3 a6 b3 vss a7 c3 b4 rfu r-lb# c4 shared (see table below) top view note: connect 2-wp#/ acc (k9) to flash vcc.
8 S75PL127J mcps S75PL127J_00_a1_e january 6, 2005 advance information pin description amax?a0 = address inputs dq15?dq0 = 16 data inputs/outputs (common) f1-ce# = chip enable for pl f2-ce = chip enable for gl = r-ce#1 = chip enable 1 (psram) r-ce#2 = chip enable 2 (psram) oe# = output enable (common) we# = write enable (common) ry/by# = ready/busy output (flash) r-ub# = upper byte control (psram) r-lb# = lower byte control (psram) f-rst# = hardware reset pin (flash) f1-wp#/acc = hardware write protect /acceleration pin (pl) hardware write protect/acceleration pin (gl) should be tied to vcc f-vcc = flash 3.0 volt-only single power supply r-vccs = psram power supply vss = device ground (common) dnu = do not use
january 6, 2005 S75PL127J_00_a1_e S75PL127J mcps 9 prelimiary ordering information s75pl 127 j c d ba w k z 0 packing type 0=tray 2 = 7? tape and reel 3 = 13? tape and reel suppplier; speed combination b = psram2, 70 ns u = psram6, 70 ns package height; data type; psram speed k = 1.4 mm, gl as data; 70 ns temperature range w = wireless (-25 c to +85 c) package type ba = very thin fine-pitch bga lead (pb)-free compliant package bf = very thin fine-pitch bga lead (pb)-free package gl data flash density d = 128 mb e = 256 mb f = 512 mb psram density b = 32 mb c = 64 mb process technology j = 110 nm, floating gate pl code flash density 127 = 128 mb product family s75pl = multi-chip product (mcp) 3.0 v simultaneous read/write page mode code flash + psram + 3.0v data flash
10 S75PL127J mcps S75PL127J_00_a1_e january 6, 2005 advance information valid combinations data: s29gl128n notes: 1. type 0 is standard. specify other options as required. 2. bga package marking omits leading s and packing type designator from ordering part number. valid combinations valid combinations list configur ations planned to be supported in volume for this device. consult your local sales office to confirm availa bility of specific valid combinations and to check on newly released combinations. data: s29gl256n notes: 1. type 0 is standard. specify other options as required. 2. bga package marking omits leading s and packing type designator from ordering part number. valid combinations valid combinations list configur ations planned to be supported in volume for this device. consult your local sales office to confirm availa bility of specific valid combinations and to check on newly released combinations. base ordering part number package & temperature package modifier/ model number packing type pl127j speed options (ns) psram supplier/ access time (ns) package marking S75PL127Jbd baw ku 0, 2, 3, ( note 1 ) 65 type 6 / 70 ( note 2 ) S75PL127Jbd kb type 2 / 70 S75PL127Jcd ku type 6/ 70 S75PL127Jcd kb type 2 / 70 S75PL127Jbd bfw ku type 6 / 70 S75PL127Jbd kb type 2 / 70 S75PL127Jcd ku type 6 / 70 S75PL127Jcd kb type 2 / 70 base ordering part number package & temperature package modifier/ model number packing type pl127j speed options (ns) psram supplier/ access time (ns) package marking S75PL127Jbe baw ku 0, 2, 3, ( note 1 ) 65 type 6 / 70 ( note 2 ) S75PL127Jbe kb type 2 / 70 S75PL127Jce ku type 6 / 70 S75PL127Jce kb type 2 / 70 S75PL127Jbe bfw ku type 6 / 70 S75PL127Jbe kb type 2 / 70 S75PL127Jce ku type 6 / 70 S75PL127Jce kb type 2 / 70
january 6, 2005 S75PL127J_00_a1_e S75PL127J mcps 11 prelimiary data: s29gl512n notes: 1. type 0 is standard. specify other options as required. 2. bga package marking omits leading s and packing type designator from ordering part number. valid combinations valid combinations list configur ations planned to be supported in volume for this device. consult your local sales office to confirm availa bility of specific valid combinations and to check on newly released combinations. base ordering part number package & temperature package modifier/ model number packing type pl127j speed options (ns) psram supplier/ access time (ns) package marking S75PL127Jbf baw ku 0, 2, 3, ( note 1 ) 65 type 6 / 70 ( note 2 ) S75PL127Jbf kb type 2 / 70 S75PL127Jcf ku type 6 / 70 S75PL127Jcf kb type 2 / 70 S75PL127Jbf bfw ku type 6 / 70 S75PL127Jbf kb type 2 / 70 S75PL127Jcf ku type 6 / 70 S75PL127Jcf kb type 2 / 70
publication number s29pl127j_064j_032j_mcp revision a amendment 3 issue date august 12, 2004 preliminary s29pl127j/s29pl064j/ s29pl032j for mcp 128/64/32 megabit (8/4/2 m x 16-bit) cmos 3.0 volt-only, si multaneous read/write flash memory with enhanced versatileio tm control distinctive characteristics architectural advantages ? 128/64/32 mbit page mode devices ? page size of 8 words: fast page read access from random locations within the page ? single power supply operation ? full voltage range: 2.7 to 3.1 volt read, erase, and program operations for battery-powered applications ? simultaneous read/write operation ? data can be continuously read from one bank while executing erase/program functions in another bank ? zero latency switching from write to read operations ? flexbank architecture (pl127j/pl064j/pl032j) ? 4 separate banks, with up to two simultaneous operations per device ?bank a: pl127j -16 mbit (4 kw x 8 and 32 kw x 31) pl064j - 8 mbit (4 kw x 8 and 32 kw x 15) pl032j - 4 mbit (4 kw x 8 and 32 kw x 7) ?bank b: pl127j - 48 mbit (32 kw x 96) pl064j - 24 mbit (32 kw x 48) pl032j - 12 mbit (32 kw x 24) ?bank c: pl127j - 48 mbit (32 kw x 96) pl064j - 24 mbit (32 kw x 48) pl032j - 12 mbit (32 kw x 24) ?bank d: pl127j -16 mbit (4 kw x 8 and 32 kw x 31) pl064j - 8 mbit (4 kw x 8 and 32 kw x 15) pl032j - 4 mbit (4 kw x 8 and 32 kw x 7) ? enhanced versatilei/o tm (v io ) control ? output voltage generated and input voltages tolerated on all control inpu ts and i/os is determined by the voltage on the v io pin ?v io options at 1.8 v and 3 v i/o for pl127j devices ?3v v io for pl064j and pl032j devices ? secsi tm (secured silicon) sector region ? up to 128 words accessible through a command sequence ? up to 64 factory-locked words ? up to 64 customer-lockable words ? both top and bottom boot blocks in one device ? manufactured on 110 nm process technology ? data retention: 20 years typical ? cycling endurance: 1 million cycles per sector typical performance characteristics ? high performance ? page access times as fast as 20 ns ? random access times as fast as 55 ns ? power consumption (typical values at 10 mhz) ? 45 ma active read current ? 17 ma program/erase current ? 0.2 a typical standby mode current software features ? software command-set compatible with jedec 42.4 standard ? backward compatible with am29f, am29lv, am29dl, and am29pdl families and mbm29qm/rm, mbm29lv, mbm29dl, mbm29pdl families ? cfi (common flash interface) compliant ? provides device-specific information to the system, allowing host software to easily reconfigure for different flash devices ? erase suspend / erase resume ? suspends an erase operation to allow read or program operations in other sectors of same bank ? unlock bypass program command ? reduces overall programming time when issuing multiple program command sequences
14 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary hardware features ? ready/busy# pin (ry/by#) ? provides a hardware method of detecting program or erase cycle completion ? hardware reset pin (reset#) ? hardware method to reset the device to reading array data ? wp#/ acc (write protect/acceleration) input ?at v il , hardware level protection for the first and last two 4k word sectors. ?at v ih , allows removal of sector protection ?at v hh , provides accelerated programming in a factory setting ? persistent sector protection ? a command sector protection method to lock combinations of individual sectors and sector groups to prevent program or erase operations within that sector ? sectors can be locked and unlocked in-system at v cc level ? password sector protection ? a sophisticated sector protection method to lock combinations of individual sectors and sector groups to prevent program or erase operations within that sector using a user-defined 64-bit password ? package options ? standard discrete pinouts 11 x 8 mm, 80-ball fine-pitch bga (pl127j) (vbg080) 8 x 6 mm, 48-ball fine pitch bga (pl064j/pl032j) (vbk048) ? mcp-compatible pinout 8 x 11.6 mm, 64-ball fine-p itch bga (pl127j) 7 x 9 mm, 56-ball fine-pitch bga (pl064j and pl032j) compatible with mcp pinout, allowing easy integration of ram into existing designs
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 15 preliminary general description the pl127j/pl064j/pl032j is a 128/128/64/32 mbit, 3.0 volt-only page mode and simultaneous read/write flash me mory device organized as 8/8/4/2 mwords. the devices are offered in the following packages: ? 11mm x 8mm, 64-ball fine-p itch bga standalone (all) ? 9mm x 8mm, 80-ball fine-pitch bga standalone (pl127j) ? 8mm x 11.6mm, 64-ball fine pitch bga multi-chip compatible (pl127j) the word-wide data (x16) appears on dq15-dq0. this device can be pro - grammed in-system or in standard eprom programmers. a 12.0 v v pp is not required for write or erase operations. the device offers fast page access time s of 20 to 30 ns, with corresponding ran - dom access times of 55 to 70 ns, respectively, allowing high speed microprocessors to operate without wait states. to eliminate bus contention the device has separate chip enable (ce#), write enable (we#) and output enable (oe#) controls. simultaneous read/write operation with zero latency the simultaneous read/write architecture provides simultaneous operation by dividing the memory space into 4 bank s, which can be considered to be four separate memory arrays as far as certain operations are concerned. the device can improve overall system performance by allowing a host system to program or erase in one bank, then immediately and simultaneously read from another bank with zero latency (with two simultaneous operations operating at any one time). this releases the system from wa iting for the completion of a program or erase operation, greatly im proving system performance. the device can be organized in both to p and bottom sector configurations. the banks are organized as follows: page mode features the page size is 8 words. after initial pa ge access is accomplished, the page mode operation provides fast read access speed of random locations within that page. standard flash memory features the device requires a single 3.0 volt power supply (2.7 v to 3.6 v) for both read and write functions. internally ge nerated and regulated voltages are pro - vided for the program and erase operations. the device is entirely command set compatible with the jedec 42.4 single- power-supply flash standard . commands are written to the command regis - ter using standard microprocessor write timi ng. register contents serve as inputs to an internal state-machin e that controls the erase and programming circuitry. bank pl127j sectors a 16 mbit (4 kw x 8 and 32 kw x 31) b 48 mbit (32 kw x 96) c 48 mbit (32 kw x 96) d 16 mbit (4 kw x 8 and 32 kw x 31)
16 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary write cycles also internally latch addresses and data needed for the programming and erase operations. reading data out of the device is similar to reading from other flash or eprom devices. device programming occurs by executing the program command sequence. the unlock bypass mode facilita tes faster programming times by requiring only two write cycles to program data instead of four. device erasure occurs by executing the erase command sequence. the host system can detect whether a prog ram or erase operation is complete by reading the dq7 (data# polling) and dq6 (toggle) status bits . after a program or erase cycle has been completed, the de vice is ready to read array data or ac - cept another command. the sector erase architecture allows me mory sectors to be erased and repro - grammed without affecting the data contents of other sectors. the device is fully erased when shipped from the factory. hardware data protection measures include a low v cc detector that automat - ically inhibits write operations during power transitions. the hardware sector protection feature disables both progra m and erase operations in any combina - tion of sectors of memory. this can be achieved in-system or via programming equipment. the erase suspend/erase resume feature enables the user to put erase on hold for any period of time to read data from, or program data to, any sector that is not selected for erasure. true background erase can thus be achieved. if a read is needed from the secsi sector area (one time program area) after an erase suspend, then the user must use the prop er command sequence to enter and exit this region. the device offers two power-saving features. when addresses have been stable for a specified amount of ti me, the device enters the automatic sleep mode . the system can also place the device in to the standby mode. power consumption is greatly reduced in both these modes. the device electrically erases all bits wi thin a sector simultaneously via fowler- nordheim tunneling. the data is prog rammed using hot electron injection.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 17 preliminary pin description amax?a0 = address bus dq15?dq0 = 16-bit data inputs/outputs/float ce# = chip enable inputs oe# = output enable input we# = write enable v ss = device ground nc = pin not connected internally ry/by# = ready/busy output and open drain. when ry/by#= v ih , the device is ready to accept read operations and commands. when ry/by#= v ol , the device is either executing an embedded algorithm or the device is executing a hardware reset operation. wp#/acc = write protect/acceleration input. when wp#/acc= v il , the highest and lowest two 4k-word sectors are write protected regardless of other sector protection configurations. when wp#/ acc= v ih , these sector are unprotected unless the dyb or ppb is programmed. when wp#/acc= 12v, program and erase operations are accelerated. v io = input/output buffer power supply (1.65 v to 1.95 v (for pl127j) or 2.7 v to 3.6 v (for all plxxxj devices) v cc =chip power supply (2.7 v to 3.6 v or 2.7 to 3.3 v) reset# = hardware reset pin ce#1 = chip enable inputs notes: 1. amax = a22 (pl127j), a21 (pl064j), a20 (pl032j)
18 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary device bus operations this section describes the requirements and use of the device bus operations, which are initiated through the internal command register. the command register itself does not occupy any addressable me mory location. the register is a latch used to store the commands, along wi th the address and data information needed to execute the command. the contents of the register serve as inputs to the internal state machine. the state mach ine outputs dictate the function of the device. ta b l e 1 lists the device bus operations, th e inputs and control levels they require, and the resulting output. the fo llowing subsections describe each of these operations in further detail. legend: l= logic low = v il , h = logic high = v ih , v id = 11.5-12.5 v, v hh = 8.5-9.5 v, x = don?t care, sa = sector address, a in = address in, d in = data in, d out = data out notes: 1. the sector protect and sector unprotect functions may also be implemented via programming equipment. see the high voltage sector protection section. 2. wp#/acc must be high when writing to upper two and lower two sectors. requirements for reading array data to read array data from the outputs, the system must drive the oe# and appro - priate ce# pins. oe# is the output cont rol and gates array data to the output pins. we# should remain at v ih . the internal state machine is set for re ading array data upon device power-up, or after a hardware reset. this ensures th at no spurious alteration of the memory content occurs during the power transiti on. no command is necessary in this mode to obtain array data. standard microprocessor re ad cycles that assert valid addresses on the device address inputs produce valid data on the device data outputs. each bank remains enabled for read access until the command register contents are altered. refer to ta b l e 1 9 for timing specifications and to figure 11 for the timing diagram. i cc1 in the dc characteristics table represen ts the active current specification for reading array data. random read (non-page read) address access time (t acc ) is equal to the delay from stable addresses to valid output data. the chip enable access time (t ce ) is the delay from the stable ad - dresses and stable ce# to valid data at the output inputs. the output enable ac - cess time is the delay from the falling edge of the oe# to valid data at the output inputs (assuming the addresses have been stable for at least t acc ?t oe time). ta b l e 1 . pl127j device bus operations operation ce# oe# we# reset# wp#/acc addresses (amax?a0) dq15? dq0 read l l h h x a in d out write l h l h x (note 2 ) a in d in standby v io 0.3 v x x v io 0.3 v x (note 2 ) x high-z output disable l h h h x x high-z reset x x x l x x high-z temporary sector unprotect (high voltage) x x x v id x a in d in
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 19 preliminary page mode read the device is capable of fast page mode read and is compatible with the page mode mask rom read operation. this mode provides faster read access speed for random locations within a page. address bits amax?a3 select an 8 word page, and address bits a2?a0 select a specific word within that page. this is an asyn - chronous operation with the microprocess or supplying the speci fic word location. the random or initial page access is t acc or t ce and subsequent page read ac - cesses (as long as the locations specified by the microprocessor falls within that page) is equivalent to t pacc . fast page mode accesses are obtained by keeping amax?a3 constant and changing a2?a0 to select the specific word within that page. simultaneous read/write operation in addition to the conventi onal features (read, program, erase-suspend read, and erase-suspend program), the device is capa ble of reading data from one bank of memory while a program or erase operation is in progress in another bank of memory (simultaneous operation). the bank can be selected by bank addresses (pl127j: a22?a20, l064j: a21?a19, pl032j: a20?a18) with zero latency. the simultaneous operation can execute multi-function mode in the same bank. ta b l e 2 . page select word a2 a1 a0 word 0 0 0 0 word 1 0 0 1 word 2 0 1 0 word 3 0 1 1 word 4 1 0 0 word 5 1 0 1 word 6 1 1 0 word 7 1 1 1 table 3. bank select bank pl127j: a22?a20 pl064j: a21?a19 pl032j: a20?a18 bank a 000 bank b 001, 010, 011 bank c 100, 101, 110 bank d 111
20 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary writing commands/command sequences to write a command or command sequence (which includes programming data to the device and erasing sectors of memory), the system must drive we# and ce# to v il , and oe# to v ih . the device features an unlock bypass mode to facilitate faster programming. once a bank enters the unlock bypass mo de, only two write cycles are required to program a word, instead of four. the ?word program command sequence? section has details on programming data to the device using both standard and unlock bypass command sequences. an erase operation can erase one sector, multiple sectors, or the entire device. ta b l e 4 indicates the set of address space th at each sector occupies. a ?bank ad - dress? is the set of address bits required to uniquely select a bank. similarly, a ?sector address? refers to the address bits required to uniquely select a sector. the ?command definitions? section has details on erasing a sector or the entire chip, or suspending/resuming the erase operation. i cc2 in the dc characteristics table represen ts the active current specification for the write mode. see the timing specification tables and timing diagrams in the reset for write operations. accelerated program operation the device offers accelerated program op erations through the acc function. this function is primarily intended to allow faster manufacturing throughput at the factory. if the system asserts v hh on this pin, the device au tomatically enters the afore - mentioned unlock bypass mode, temporarily unprotects any protected sectors, and uses the higher voltage on the pin to reduce the time required for program operations. the system would use a tw o-cycle program command sequence as required by the unlock bypass mode. removing v hh from the wp#/acc pin re - turns the device to normal operation. note that v hh must not be asserted on wp#/acc for operations other than acce lerated programming, or device damage may result. in addition, the wp#/acc pin should be raised to v cc when not in use. that is, the wp#/acc pin should not be left floating or unconnected; incon - sistent behavior of the device may result. autoselect functions if the system writes the autoselect co mmand sequence, the device enters the au - toselect mode. the system can then read autoselect codes from the internal register (which is separate from th e memory array) on dq15?dq0. standard read cycle timings apply in this mode. refer to the secsitm sector addresses and autoselect command sequence for more information. standby mode when the system is not reading or writin g to the device, it can place the device in the standby mode. in this mode, current consumption is greatly reduced, and the outputs are placed in the high im pedance state, independent of the oe# input. the device enters the cmos standby mode when the ce# and reset# pins are both held at v io 0.3 v. (note that this is a more restricted voltage range than v ih .) if ce# and reset# are held at v ih , but not within v io 0.3 v, the device will be in the standby mode, but the standby current will be greater. the device
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 21 preliminary requires standard access time (t ce ) for read access when the device is in either of these standby modes, before it is ready to read data. if the device is deselected during erasure or programming, the device draws ac - tive current until the operation is completed. i cc3 in ?dc characteristics? represents the cmos standby current specification. automatic sleep mode the automatic sleep mode minimizes flas h device energy consumption. the de - vice automatically enables this mode when addresses remain stable for t acc + 30 ns. the automatic sleep mode is indepe ndent of the ce#, we#, and oe# con - trol signals. standard address access timings provide new data when addresses are changed. while in sleep mode, output data is latched and always available to the system. note that during automa tic sleep mode, oe# must be at v ih before the device reduces current to the stated sleep mode specification. i cc5 in ?dc characteristics? represents the automatic sleep mode current specification. reset#: hardware reset pin the reset# pin provides a hardware meth od of resetting the device to reading array data. when the reset# pin is dr iven low for at least a period of t rp , the device immediately terminates any operat ion in progress, tr istates all output pins, and ignores all read/write commands for the duration of the reset# pulse. the device also resets the internal st ate machine to reading array data. the op - eration that was interrupted should be reinitiated once the device is ready to accept another command sequence , to ensure data integrity. current is reduced for the duration of th e reset# pulse. when reset# is held at v ss 0.3 v, the device draws cmos standby current ( i cc4 ). if reset# is held at v il but not within v ss 0.3 v, the standby current will be greater. the reset# pin may be tied to the system reset circuitry. a system reset would thus also reset the flash memory, enabli ng the system to read the boot-up firm - ware from the flash memory. if reset# is asserted during a program or erase operation, the ry/by# pin re - mains a ?0? (busy) until the internal reset operation is complete, which requires a time of t ready (during embedded algorithms). the system can thus monitor ry/ by# to determine whet her the reset operation is complete. if reset# is asserted when a program or erase operation is not executing (ry/by# pin is ?1?), the reset operation is completed within a time of t ready (not during embedded algorithms). the system can read data t rh after the reset# pin returns to v ih . refer to the ac characteristic tables for reset# parameters and to 13 for the timing diagram. output disable mode when the oe# input is at v ih , output from the device is disabled. the output pins (except for ry/by#) are placed in the highest impedance state
22 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary ta b l e 4 . pl127j sector architecture bank sector sector address (a22-a12) sector size (kwords) address range (x16) bank a sa0 00000000000 4 000000h?000fffh sa1 00000000001 4 001000h?001fffh sa2 00000000010 4 002000h?002fffh sa3 00000000011 4 003000h?003fffh sa4 00000000100 4 004000h?004fffh sa5 00000000101 4 005000h?005fffh sa6 00000000110 4 006000h?006fffh sa7 00000000111 4 007000h?007fffh sa8 00000001xxx 32 008000h?00ffffh sa9 00000010xxx 32 010000h?017fffh sa10 00000011xxx 32 018000h?01ffffh sa11 00000100xxx 32 020000h?027fffh sa12 00000101xxx 32 028000h?02ffffh sa13 00000110xxx 32 030000h?037fffh sa14 00000111xxx 32 038000h?03ffffh sa15 00001000xxx 32 040000h?047fffh sa16 00001001xxx 32 048000h?04ffffh sa17 00001010xxx 32 050000h?057fffh sa18 00001011xxx 32 058000h?05ffffh sa19 00001100xxx 32 060000h?067fffh sa20 00001101xxx 32 068000h?06ffffh sa21 00001110xxx 32 070000h?077fffh sa22 00001111xxx 32 078000h?07ffffh sa23 00010000xxx 32 080000h?087fffh sa24 00010001xxx 32 088000h?08ffffh sa25 00010010xxx 32 090000h?097fffh sa26 00010011xxx 32 098000h?09ffffh sa27 00010100xxx 32 0a0000h?0a7fffh sa28 00010101xxx 32 0a8000h?0affffh sa29 00010110xxx 32 0b0000h?0b7fffh sa30 00010111xxx 32 0b8000h?0bffffh sa31 00011000xxx 32 0c0000h?0c7fffh sa32 00011001xxx 32 0c8000h?0cffffh sa33 00011010xxx 32 0d0000h?0d7fffh sa34 00011011xxx 32 0d8000h?0dffffh sa35 00011100xxx 32 0e0000h?0e7fffh sa36 00011101xxx 32 0e8000h?0effffh sa37 00011110xxx 32 0f0000h?0f7fffh sa38 00011111xxx 32 0f8000h?0fffffh
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 23 preliminary bank b sa39 00100000xxx 32 100000h?107fffh sa40 00100001xxx 32 108000h?10ffffh sa41 00100010xxx 32 110000h?117fffh sa42 00100011xxx 32 118000h?11ffffh sa43 00100100xxx 32 120000h?127fffh sa44 00100101xxx 32 128000h?12ffffh sa45 00100110xxx 32 130000h?137fffh sa46 00100111xxx 32 138000h?13ffffh sa47 00101000xxx 32 140000h?147fffh sa48 00101001xxx 32 148000h?14ffffh sa49 00101010xxx 32 150000h?157fffh sa50 00101011xxx 32 158000h?15ffffh sa51 00101100xxx 32 160000h?167fffh sa52 00101101xxx 32 168000h?16ffffh sa53 00101110xxx 32 170000h?177fffh sa54 00101111xxx 32 178000h?17ffffh sa55 00110000xxx 32 180000h?187fffh sa56 00110001xxx 32 188000h?18ffffh sa57 00110010xxx 32 190000h?197fffh sa58 00110011xxx 32 198000h?19ffffh sa59 00110100xxx 32 1a0000h?1a7fffh sa60 00110101xxx 32 1a8000h?1affffh sa61 00110110xxx 32 1b0000h?1b7fffh sa62 00110111xxx 32 1b8000h?1bffffh sa63 00111000xxx 32 1c0000h?1c7fffh sa64 00111001xxx 32 1c8000h?1cffffh sa65 00111010xxx 32 1d0000h?1d7fffh sa66 00111011xxx 32 1d8000h?1dffffh sa67 00111100xxx 32 1e0000h?1e7fffh sa68 00111101xxx 32 1e8000h?1effffh sa69 00111110xxx 32 1f0000h?1f7fffh sa70 00111111xxx 32 1f8000h?1fffffh sa71 01000000xxx 32 200000h?207fffh sa72 01000001xxx 32 208000h?20ffffh sa73 01000010xxx 32 210000h?217fffh sa74 01000011xxx 32 218000h?21ffffh sa75 01000100xxx 32 220000h?227fffh sa76 01000101xxx 32 228000h?22ffffh sa77 01000110xxx 32 230000h?237fffh sa78 01000111xxx 32 238000h?23ffffh table 4. pl127j sector architecture (continued) bank sector sector address (a22-a12) sector size (kwords) address range (x16)
24 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary bank b sa79 01001000xxx 32 240000h?247fffh sa80 01001001xxx 32 248000h?24ffffh sa81 01001010xxx 32 250000h?257fffh sa82 01001011xxx 32 258000h?25ffffh sa83 01001100xxx 32 260000h?267fffh sa84 01001101xxx 32 268000h?26ffffh sa85 01001110xxx 32 270000h?277fffh sa86 01001111xxx 32 278000h?27ffffh sa87 01010000xxx 32 280000h?287fffh sa88 01010001xxx 32 288000h?28ffffh sa89 01010010xxx 32 290000h?297fffh sa90 01010011xxx 32 298000h?29ffffh sa91 01010100xxx 32 2a0000h?2a7fffh sa92 01010101xxx 32 2a8000h?2affffh sa93 01010110xxx 32 2b0000h?2b7fffh sa94 01010111xxx 32 2b8000h?2bffffh sa95 01011000xxx 32 2c0000h?2c7fffh sa96 01011001xxx 32 2c8000h?2cffffh sa97 01011010xxx 32 2d0000h?2d7fffh sa98 01011011xxx 32 2d8000h?2dffffh sa99 01011100xxx 32 2e0000h?2e7fffh sa100 01011101xxx 32 2e8000h?2effffh sa101 01011110xxx 32 2f0000h?2f7fffh sa102 01011111xxx 32 2f8000h?2fffffh sa103 01100000xxx 32 300000h?307fffh sa104 01100001xxx 32 308000h?30ffffh sa105 01100010xxx 32 310000h?317fffh sa106 01100011xxx 32 318000h?31ffffh sa107 01100100xxx 32 320000h?327fffh sa108 01100101xxx 32 328000h?32ffffh sa109 01100110xxx 32 330000h?337fffh sa110 01100111xxx 32 338000h?33ffffh sa111 01101000xxx 32 340000h?347fffh sa112 01101001xxx 32 348000h?34ffffh sa113 01101010xxx 32 350000h?357fffh sa114 01101011xxx 32 358000h?35ffffh sa115 01101100xxx 32 360000h?367fffh sa116 01101101xxx 32 368000h?36ffffh sa117 01101110xxx 32 370000h?377fffh sa118 01101111xxx 32 378000h?37ffffh table 4. pl127j sector architecture (continued) bank sector sector address (a22-a12) sector size (kwords) address range (x16)
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 25 preliminary bank b sa119 01110000xxx 32 380000h?387fffh sa120 01110001xxx 32 388000h?38ffffh sa121 01110010xxx 32 390000h?397fffh sa122 01110011xxx 32 398000h?39ffffh sa123 01110100xxx 32 3a0000h?3a7fffh sa124 01110101xxx 32 3a8000h?3affffh sa125 01110110xxx 32 3b0000h?3b7fffh sa126 01110111xxx 32 3b8000h?3bffffh sa127 01111000xxx 32 3c0000h?3c7fffh sa128 01111001xxx 32 3c8000h?3cffffh sa129 01111010xxx 32 3d0000h?3d7fffh sa130 01111011xxx 32 3d8000h?3dffffh sa131 01111100xxx 32 3e0000h?3e7fffh sa132 01111101xxx 32 3e8000h?3effffh sa133 01111110xxx 32 3f0000h?3f7fffh sa134 01111111xxx 32 3f8000h?3fffffh bank c sa135 10000000xxx 32 400000h?407fffh sa136 10000001xxx 32 408000h?40ffffh sa137 10000010xxx 32 410000h?417fffh sa138 10000011xxx 32 418000h?41ffffh sa139 10000100xxx 32 420000h?427fffh sa140 10000101xxx 32 428000h?42ffffh sa141 10000110xxx 32 430000h?437fffh sa142 10000111xxx 32 438000h?43ffffh sa143 10001000xxx 32 440000h?447fffh sa144 10001001xxx 32 448000h?44ffffh sa145 10001010xxx 32 450000h?457fffh sa146 10001011xxx 32 458000h?45ffffh sa147 10001100xxx 32 460000h?467fffh sa148 10001101xxx 32 468000h?46ffffh sa149 10001110xxx 32 470000h?477fffh sa150 10001111xxx 32 478000h?47ffffh sa151 10010000xxx 32 480000h?487fffh sa152 10010001xxx 32 488000h?48ffffh sa153 10010010xxx 32 490000h?497fffh sa154 10010011xxx 32 498000h?49ffffh sa155 10010100xxx 32 4a0000h?4a7fffh sa156 10010101xxx 32 4a8000h?4affffh sa157 10010110xxx 32 4b0000h?4b7fffh sa158 10010111xxx 32 4b8000h?4bffffh table 4. pl127j sector architecture (continued) bank sector sector address (a22-a12) sector size (kwords) address range (x16)
26 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary bank c sa159 10011000xxx 32 4c0000h?4c7fffh sa160 10011001xxx 32 4c8000h?4cffffh sa161 10011010xxx 32 4d0000h?4d7fffh sa162 10011011xxx 32 4d8000h?4dffffh sa163 10011100xxx 32 4e0000h?4e7fffh sa164 10011101xxx 32 4e8000h?4effffh sa165 10011110xxx 32 4f0000h?4f7fffh sa166 10011111xxx 32 4f8000h?4fffffh sa167 10100000xxx 32 500000h?507fffh sa168 10100001xxx 32 508000h?50ffffh sa169 10100010xxx 32 510000h?517fffh sa170 10100011xxx 32 518000h?51ffffh sa171 10100100xxx 32 520000h?527fffh sa172 10100101xxx 32 528000h?52ffffh sa173 10100110xxx 32 530000h?537fffh sa174 10100111xxx 32 538000h?53ffffh sa175 10101000xxx 32 540000h?547fffh sa176 10101001xxx 32 548000h?54ffffh sa177 10101010xxx 32 550000h?557fffh sa178 10101011xxx 32 558000h?15ffffh sa179 10101100xxx 32 560000h?567fffh sa180 10101101xxx 32 568000h?56ffffh sa181 10101110xxx 32 570000h?577fffh sa182 10101111xxx 32 578000h?57ffffh sa183 10110000xxx 32 580000h?587fffh sa184 10110001xxx 32 588000h?58ffffh sa185 10110010xxx 32 590000h?597fffh sa186 10110011xxx 32 598000h?59ffffh sa187 10110100xxx 32 5a0000h?5a7fffh sa188 10110101xxx 32 5a8000h?5affffh sa189 10110110xxx 32 5b0000h?5b7fffh sa190 10110111xxx 32 5b8000h?5bffffh sa191 10111000xxx 32 5c0000h?5c7fffh sa192 10111001xxx 32 5c8000h?5cffffh sa193 10111010xxx 32 5d0000h?5d7fffh sa194 10111011xxx 32 5d8000h?5dffffh sa195 10111100xxx 32 5e0000h?5e7fffh sa196 10111101xxx 32 5e8000h?5effffh sa197 10111110xxx 32 5f0000h?5f7fffh sa198 10111111xxx 32 5f8000h?5fffffh table 4. pl127j sector architecture (continued) bank sector sector address (a22-a12) sector size (kwords) address range (x16)
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 27 preliminary autoselect mode the autoselect mode provides manufacturer and device identification, and sector protection verification, th rough identifier codes outp ut on dq7?dq0. this mode is primarily intended for programming eq uipment to automatica lly match a device bank c sa199 11000000xxx 32 600000h?607fffh sa200 11000001xxx 32 608000h?60ffffh sa201 11000010xxx 32 610000h?617fffh sa202 11000011xxx 32 618000h?61ffffh sa203 11000100xxx 32 620000h?627fffh sa204 11000101xxx 32 628000h?62ffffh sa205 11000110xxx 32 630000h?637fffh sa206 11000111xxx 32 638000h?63ffffh sa207 11001000xxx 32 640000h?647fffh sa208 11001001xxx 32 648000h?64ffffh sa209 11001010xxx 32 650000h?657fffh sa210 11001011xxx 32 658000h?65ffffh sa211 11001100xxx 32 660000h?667fffh sa212 11001101xxx 32 668000h?66ffffh sa213 11001110xxx 32 670000h?677fffh sa214 11001111xxx 32 678000h?67ffffh sa215 11010000xxx 32 680000h?687fffh sa216 11010001xxx 32 688000h?68ffffh sa217 11010010xxx 32 690000h?697fffh sa218 11010011xxx 32 698000h?69ffffh sa219 11010100xxx 32 6a0000h?6a7fffh sa220 11010101xxx 32 6a8000h?6affffh sa221 11010110xxx 32 6b0000h?6b7fffh sa222 11010111xxx 32 6b8000h?6bffffh sa223 11011000xxx 32 6c0000h?6c7fffh sa224 11011001xxx 32 6c8000h?6cffffh sa225 11011010xxx 32 6d0000h?6d7fffh sa226 11011011xxx 32 6d8000h?6dffffh sa227 11011100xxx 32 6e0000h?6e7fffh sa228 11011101xxx 32 6e8000h?6effffh sa229 11011110xxx 32 6f0000h?6f7fffh sa230 11011111xxx 32 6f8000h?6fffffh ta b l e 5 . secsitm sector addresses sector size address range factory-locked area 64 words 000000h-00003fh customer-lockable area 64 words 000040h-00007fh table 4. pl127j sector architecture (continued) bank sector sector address (a22-a12) sector size (kwords) address range (x16)
28 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary to be programmed with its corresponding programming algorithm. however, the autoselect codes can also be accessed in-system through the command register. when using programming equipment, the autoselect mode requires v id on ad - dress pin a9. address pins must be set as shown in ta b l e 6 . in addition, when verifying sector protection, the sector address must appear on the appropriate highest order address bits (see ta b l e 3 ). ta b l e 6 shows the remaining address bits that are don?t care. when all necess ary bits have been set as required, the programming equipment may then read the corresponding identifier code on dq7?dq0. however, the autoselect co des can also be accessed in-system through the command register, for instance s when the device is erased or pro - grammed in a system without access to hi gh voltage on the a9 pin. the command sequence is illustrated in ta b l e 1 3 . note that if a bank address (ba) (on address bits pl127j: a22 ? a20, pl064j: a21 ? a19, pl032j: a20 ?a18) is asserted during the third write cycle of the autoselect command, the host system can read au - toselect data that bank and then immediately read array data from the other bank, without exiting the autoselect mode. to access the autoselect codes in-system, the host system can issue the autose - lect command via the command register, as shown in ta b l e 1 3 . this method does not require v id . refer to the autoselect command sequence for more information. legend: l = logic low = v il , h = logic high = v ih , ba = bank address, sa = sector address, x = don?t care. note: the autoselect codes may also be accessed in-system via command sequences ta b l e 6 . autoselect codes (high voltage method) description ce# oe# we# amax to a12 a1 0 a9 a8 a7 a6 a5 to a4 a3 a2 a1 a0 dq15 to dq0 manufacturer id : spansion products l l h ba x v id x l l x l l l l 0001h device id read cycle 1 l l h ba x v id x l l l l l l h 227eh read cycle 2 l h h h l 2220h (pl127j) 2202h (pl064j) 220ah (pl032j) read cycle 3 l h h h h 2200h (pl127j) 2201h (pl064j) 2201h (pl032j) sector protection verification l l h sa x v id x l l l l l h l 0001h (protected), 0000h (unprotected) secsi indicator bit (dq7, dq6) l l h ba x v id x x l x l l h h 00c4h (factory and customer locked), 0084h (factory locked), 0004h (not locked)
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 29 preliminary table 7. pl127j boot sector/sector block addr esses for protection/unprotection sector a22-a12 sector/ sector block size sector a22-a12 sector/ sector block size sa0 00000000000 4 kwords sa131-sa134 011111xxxxx 128 (4x32) kwords sa1 00000000001 4 kwords sa135-sa138 100000xxxxx 128 (4x32) kwords sa2 00000000010 4 kwords sa139-sa142 100001xxxxx 128 (4x32) kwords sa3 00000000011 4 kwords sa143-sa146 100010xxxxx 128 (4x32) kwords sa4 00000000100 4 kwords sa147-sa150 100011xxxxx 128 (4x32) kwords sa5 00000000101 4 kwords sa151-sa154 100100xxxxx 128 (4x32) kwords sa6 00000000110 4 kwords sa155-sa158 100101xxxxx 128 (4x32) kwords sa7 00000000111 4 kwords sa159-sa162 100110xxxxx 128 (4x32) kwords sa8 00000001xxx 32 kwords sa163-sa166 100111xxxxx 128 (4x32) kwords sa9 00000010xxx 32 kwords sa167-sa170 101000xxxxx 128 (4x32) kwords sa10 00000011xxx 32 kwords sa171-sa174 101001xxxxx 128 (4x32) kwords sa11-sa14 000001xxxxx 128 (4x32) kwords sa175-sa178 101010xxxxx 128 (4x32) kwords sa15-sa18 000010xxxxx 128 (4x32) kwords sa179-sa182 101011xxxxx 128 (4x32) kwords sa19-sa22 000011xxxxx 128 (4x32) kwords sa183-sa186 101100xxxxx 128 (4x32) kwords sa23-sa26 000100xxxxx 128 (4x32) kwords sa187-sa190 101101xxxxx 128 (4x32) kwords sa27-sa30 000101xxxxx 128 (4x32) kwords sa191-sa194 101110xxxxx 128 (4x32) kwords sa31-sa34 000110xxxxx 128 (4x32) kwords sa195-sa198 101111xxxxx 128 (4x32) kwords sa35-sa38 000111xxxxx 128 (4x32) kwords sa199-sa202 110000xxxxx 128 (4x32) kwords sa39-sa42 001000xxxxx 128 (4x32) kwords sa203-sa206 110001xxxxx 128 (4x32) kwords sa43-sa46 001001xxxxx 128 (4x32) kwords sa207-sa210 110010xxxxx 128 (4x32) kwords sa47-sa50 001010xxxxx 128 (4x32) kwords sa211-sa214 110011xxxxx 128 (4x32) kwords sa51-sa54 001011xxxxx 128 (4x32) kwords sa215-sa218 110100xxxxx 128 (4x32) kwords sa55-sa58 001100xxxxx 128 (4x32) kwords sa219-sa222 110101xxxxx 128 (4x32) kwords sa59-sa62 001101xxxxx 128 (4x32) kwords sa223-sa226 110110xxxxx 128 (4x32) kwords sa63-sa66 001110xxxxx 128 (4x32) kwords sa227-sa230 110111xxxxx 128 (4x32) kwords sa67-sa70 001111xxxxx 128 (4x32) kwords sa231-sa234 111000xxxxx 128 (4x32) kwords sa71-sa74 010000xxxxx 128 (4x32) kwords sa235-sa238 111001xxxxx 128 (4x32) kwords sa75-sa78 010001xxxxx 128 (4x32) kwords sa239-sa242 111010xxxxx 128 (4x32) kwords sa79-sa82 010010xxxxx 128 (4x32) kwords sa243-sa246 111011xxxxx 128 (4x32) kwords sa83-sa86 010011xxxxx 128 (4x32) kwords sa247-sa250 111100xxxxx 128 (4x32) kwords sa87-sa90 010100xxxxx 128 (4x32) kwords sa251-sa254 111101xxxxx 128 (4x32) kwords sa91-sa94 010101xxxxx 128 (4x32) kwords sa255-sa258 111110xxxxx 128 (4x32) kwords sa95-sa98 010110xxxxx 128 (4x32) kwords sa259 11111100xxx 32 kwords sa99-sa102 010111xxxxx 128 (4x32) kwords sa260 11111101xxx 32 kwords sa103-sa106 011000xxxxx 128 (4x32) kwords sa261 11111110xxx 32 kwords sa107-sa110 011001xxxxx 128 (4x32) kwords sa262 11111111000 4 kwords sa111-sa114 011010xxxxx 128 (4x32) kwords sa263 11111111001 4 kwords sa115-sa118 011011xxxxx 128 (4x32) kwords sa264 11111111010 4 kwords sa119-sa122 011100xxxxx 128 (4x32) kwords sa265 11111111011 4 kwords sa123-sa126 011101xxxxx 128 (4x32) kwords sa127-sa130 011110xxxxx 128 (4x32) kwords
30 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary selecting a sector protection mode the device is shipped with all sectors unprotected. optional spansion program - ming services enable programming and prot ecting sectors at the factory prior to shipping the device. contact your local sales office for details. it is possible to determine whether a sector is protected or unprotected. see the secsitm sector addresses for details. sector protection the pl127j, pl064j, and pl032j features several levels of sector protection, which can disable both the program and er ase operations in certain sectors or sector groups. sector protection schemes password sector protection a highly sophisticated protection meth od that requires a password before changes to certain sectors or sector groups are permitted wp# hardware protection a write protect pin that can prevent program or erase operations in sectors sa1- 133, sa1-134, sa2-0 and sa2-1. the wp# hardware protection feature is always available, independent of the software managed protection method chosen. selecting a sector protection mode all parts default to operate in the pers istent sector protec tion mode. the cus - tomer must then choose if the persistent or password protection method is most desirable. there are two one-time progra mmable non-volatile bits that define which sector protection method will be us ed. if the persistent sector protection method is desired, programming the persistent sector protection mode locking bit permanently sets the devi ce to the persistent sector protection mode. if the password sector protection method is desired, programming the password mode locking bit permanently sets the device to the password sector protection mode. it is not possible to switch between th e two protection modes once a locking bit has been set. one of the two modes must be selected when the device is first programmed. this prevents a program or virus from later setting the password ta b l e 8 . sector protection schemes dyb ppb ppb lock sector state 0 0 0 unprotected?ppb and dyb are changeable 0 0 1 unprotected?ppb not changeable, dyb is changeable 0 1 0 protected?ppb and dyb are changeable 1 0 0 1 1 0 0 1 1 protected?ppb not changeable, dyb is changeable 1 0 1 1 1 1
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 31 preliminary mode locking bit, which wo uld cause an unexpected shift from the default per - sistent sector protection mode in to the password protection mode. the device is shipped with all sectors unprotected. optional spansion program - ming services enable programming and prot ecting sectors at the factory prior to shipping the device. contact your local sales office for details. it is possible to determine whether a se ctor is protected or unprotected. see au - toselect mode for details. persistent sector protection the persistent sector protection method replaces the 12 v controlled protection method in previous flash devices. this new method provides three different sec - tor protection states: ? persistently locked?the sector is protected and cannot be changed. ? dynamically locked?the sector is protected and can be changed by a simple command. ? unlocked?the sector is unprotected and can be changed by a simple com - mand. to achieve these states, three types of ?bits? are used: ? persistent protection bit ? persistent protection bit lock ? persistent sector protec tion mode locking bit persistent protection bit (ppb) a single persistent (non-volatile) protec tion bit is assigned to a maximum four sectors (see the sector address tables for specific sector protection groupings). all 4 kword boot-block sectors have indivi dual sector persistent protection bits (ppbs) for greater flexibility. each ppb is individually modifiable through the ppb write command. the device erases all ppbs in parallel. if any ppb requires erasure, the device must be instructed to prepro gram all of the sector ppbs prior to ppb erasure. oth - erwise, a previously erased sector ppbs can potentially be over-erased. the flash device does not have a built-in means of preventing sector ppbs over-erasure. persistent protection bit lock (ppb lock) the persistent protection bit lock (ppb lock ) is a global volatile bit. when set to ?1?, the ppbs cannot be changed. when cleared (?0?), the ppbs are changeable. there is only one ppb lock bit per devi ce. the ppb lock is cleared after power- up or hardware reset. there is no co mmand sequence to unlock the ppb lock. dynamic protection bit (dyb) a volatile protection bit is assigned for each sector. after power-up or hardware reset, the contents of all dybs is ?0?. each dyb is individually modifiable through the dyb write command. when the parts are first shipped, the ppbs are cleared, the dybs are cleared, and ppb lock is defaulted to power up in the cleared state ? meaning the ppbs are changeable. when the device is first powered on the dybs power up cleared (sectors not pro - tected). the protection state for each sect or is determined by the logical or of the ppb and the dyb related to that sect or. for the sectors that have the ppbs cleared, the dybs control whether or not the sector is protected or unprotected.
32 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary by issuing the dyb write command sequence s, the dybs will be set or cleared, thus placing each sector in the protecte d or unprotected state. these are the so- called dynamic locked or unlocked stat es. they are called dynamic states be - cause it is very easy to switch ba ck and forth between the protected and unprotected conditions. this allows softwa re to easily protect sectors against in - advertent changes yet does not prevent the easy removal of protection when changes are needed. the dybs maybe set or cleared as often as needed. the ppbs allow for a more static, and difficu lt to change, level of protection. the ppbs retain their state across power cycles because they are non-volatile. indi - vidual ppbs are set with a command but must all be cleared as a group through a complex sequence of program and erasing commands. the ppbs are also lim - ited to 100 erase cycles. the ppb lock bit adds an additional level of protection. once all ppbs are pro - grammed to the desired settings, the ppb lock may be set to ?1?. setting the ppb lock disables all program and erase co mmands to the non-vo latile ppbs. in ef - fect, the ppb lock bit locks the ppbs into their current state. the only way to clear the ppb lock is to go through a power cy cle. system boot code can determine if any changes to the ppb are needed; for example, to allow new system code to be downloaded. if no changes are needed then the boot code can set the ppb lock to disable any further changes to the ppbs during system operation. the wp#/acc write protect pin adds a final level of hardware protection to sec - tors sa1-133, sa1-134, sa2-0 and sa2-1. when this pin is low it is not possible to change the contents of these sector s. these sectors generally hold system boot code. the wp#/acc pin can prevent an y changes to the boot code that could override the choices made while setting up sector protection during system initialization. for customers who are concerned about ma licious viruses there is another level of security - the persistently locked state. to persistently protect a given sector or sector group, the ppbs associated with that sector need to be set to ?1?. once all ppbs are programmed to the desired settings, the ppb lock should be set to ?1?. setting the ppb lock automatically disables all program and erase commands to the non-volatile ppbs. in effect, the ppb lock ?freezes? the ppbs into their cur - rent state. the only way to clear the pp b lock is to go through a power cycle. it is possible to have sectors that have been persistently locked, and sectors that are left in the dynamic state. the sectors in the dynamic state are all unprotected. if there is a need to protect some of them, a simple dyb write command se - quence is all that is necessary. the dy b write command for the dynamic sectors switch the dybs to signify protected and unprotected, respectively. if there is a need to change the status of the persistently locked sectors, a few more steps are required. first, the ppb lock bit must be disabled by either putting the device through a power-cycle, or hardware rese t. the ppbs can then be changed to re - flect the desired settings. setting the ppb lock bit once again will lock the ppbs, and the device operates normally again. the best protection is achieved by exec uting the ppb lock bit set command early in the boot code, and protect the bo ot code by holding wp#/acc = vil. ta b l e 8 contains all possible combinations of the dyb, ppb, and ppb lock relating to the status of the sector. in summary, if the ppb is set, and the ppb lock is set, the sector is protected and the protection can not be removed until th e next power cycle clears the ppb lock.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 33 preliminary if the ppb is cleared, the sector can be dynamically locked or unlocked. the dyb then controls whether or not the se ctor is protected or unprotected. if the user attempts to program or erase a protected sector, the device ignores the command and returns to read mode. a program command to a protected sec - tor enables status polling for approximately 1 s before the device returns to read mode without having modified the conten ts of the protected sector. an erase command to a protected sector enables st atus polling for approximately 50 s after which the device returns to read mo de without having erased the protected sector. the programming of the dyb, ppb, and ppb lock for a given sector can be verified by writing a dyb/ppb/ppb lock verify command to the device. there is an alter - native means of reading the protection st atus. take reset# to vil and hold we# at vih.(the high voltage a9 autoselect mo de also works for reading the status of the ppbs). scanning the addresses (a18?a 11) while (a6, a1, a0) = (0, 1, 0) will produce a logical ?1? code at device output dq0 for a protected sector or a ?0? for an unprotected sector. in this mode, the other addresses are don?t cares. address location with a1 = vil are reserved for autoselect manufacturer and device codes. persistent sector protection mode locking bit like the password mode locking bit, a pers istent sector protection mode locking bit exists to guarantee that the device re main in software sector protection. once set, the persistent sector protection locking bit prevents programming of the password protection mode locking bit. th is guarantees that a hacker could not place the device in password protection mode. password protection mode the password sector protection mode meth od allows an even higher level of se - curity than the persistent sector protec tion mode. there are two main differences between the persistent sector protection and the password sector protection mode: when the device is first powered on, or comes out of a reset cycle, the ppb lock bit set to the locked state, rather than cleared to the unlocked state. the only means to clear the ppb lock bit is by writing a unique 64-bit password to the device. the password sector protection method is otherwise identical to the persistent sector protection method. a 64-bit password is the only addition al tool utilized in this method. once the password mode locking bit is set, the password is permanently set with no means to read, program, or erase it. the password is used to clear the ppb lock bit. the password unlock command must be written to the flash, along with a password. the flash device internally compares the given password with the pre-programmed password. if they match, the ppb lock bit is cleared, and the ppbs can be altered. if they do not match, the flash de vice does nothing. there is a built-in 2 s delay for each ?password check.? this delay is intended to thwart any efforts to run a program that tries al l possible combinations in order to crack the password.
34 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary password and password mode locking bit in order to select the password sector pr otection scheme, the customer must first program the password. the password may be correlated to the unique electronic serial number (esn) of the particular flas h device. each esn is different for every flash device; therefore each password should be different for every flash device. while programming in the password region, the customer may perform password verify operations. once the desired password is programmed in, the customer must then set the password mode locking bit. this operation achieves two objectives: permanently sets the device to operate us ing the password protection mode. it is not possible to reverse this function. disables all further commands to the pass word region. all program, and read op - erations are ignored. both of these objectives are important, and if not carefully considered, may lead to unrecoverable errors. the user must be sure that the password protection method is desired when setting the passwor d mode locking bit. more importantly, the user must be sure that the passw ord is correct when the password mode locking bit is set. due to th e fact that read operations are disabled, there is no means to verify what the password is afte rwards. if the password is lost after set - ting the password mode locking bit, there wi ll be no way to clear the ppb lock bit. the password mode locking bit, once set, prevents reading the 64-bit password on the dq bus and further password pr ogramming. the password mode locking bit is not erasable. once password mode locking bit is programmed, the persis - tent sector protection locking bit is disabled from programming, guaranteeing that no changes to the protection scheme are allowed. 64-bit password the 64-bit password is located in its ow n memory space and is accessible through the use of the password program and verify commands (see ?password verify command?). the password function works in conjunction with the password mode locking bit, which when set, prev ents the password verify command from reading the contents of the passw ord on the pins of the device. write protect (wp#) the write protect feature provides a hard ware method of protecting the upper two and lower two sectors without using v id . this function is provided by the wp# pin and overrides the previously discussed high voltage sector protection method. if the system asserts v il on the wp#/acc pin, the device disables program and erase functions in the two outermost 4 kw ord sectors on both ends of the flash array independent of whether it was previously protected or unprotected. if the system asserts v ih on the wp#/acc pin, the de vice reverts the upper two and lower two sectors to whether they we re last set to be protected or unpro - tected. that is, sector protection or unprotection for these sectors depends on whether they were last protected or un protected using the method described in the high voltage sector protection . note that the wp#/acc pin must not be le ft floating or unconnected; inconsistent behavior of the device may result.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 35 preliminary persistent protection bit lock the persistent protection bit (ppb) lock is a volatile bit that reflects the state of the password mode locking bit after power- up reset. if the password mode lock bit is also set after a hardware reset (reset# asserted) or a power-up reset, the only means for clearing the ppb lock bit in password protection mode is to issue the password unlock command. successful execution of the password unlock command clears the ppb lock bit, allowing for sector ppbs modifications. assert - ing reset#, taking the device through a po wer-on reset, or issuing the ppb lock bit set command sets the ppb lock bit to a ?1? when the password mode lock bit is not set. if the password mode locking bit is not se t, including persistent protection mode, the ppb lock bit is cleared after power-up or hardware reset. the ppb lock bit is set by issuing the ppb lock bit set comma nd. once set the only means for clear - ing the ppb lock bit is by issuing a hard ware or power-up reset. the password unlock command is ignored in persistent protection mode. high voltage sector protection sector protection and unprotection may also be implemented using programming equipment. the procedure requires high voltage (v id ) to be placed on the re - set# pin. refer to figure 1 for details on this procedure. note that for sector unprotect, all unprotected sectors must firs t be protected prior to the first sector write cycle.
36 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary figure 1. in-system sector protection/s ector unprotection algorithms sector protect: write 60h to sector address with a7-a0 = 00000010 set up sector address wait 100 s verify sector protect: write 40h to sector address with a7-a0 = 00000010 read from sector address with a7-a0 = 00000010 start plscnt = 1 reset# = v id wait 4 s first write cycle = 60h? data = 01h? remove v id from reset# write reset command sector protect complete yes yes no plscnt = 25? yes device failed increment plscnt temporary sector unprotect mode no sector unprotect: write 60h to sector address with a7-a0 = 01000010 set up first sector address wait 1.2 ms verify sector unprotect: write 40h to sector address with a7-a0 = 00000010 read from sector address with a7-a0 = 00000010 start plscnt = 1 reset# = v id wait 4 s data = 00h? last sector verified? remove v id from reset# write reset command sector unprotect complete yes no plscnt = 1000? yes device failed increment plscnt temporary secto r unprotect mode no all sectors protected? yes protect all sectors: the indicated portion of the sector protect algorithm must be performed for all unprotected sectors prior to issuing the first sector unprotect address set up next sector address no yes no yes no no yes no sector protect algorithm sector unprotect algorithm first write cycle = 60h? protect another sector? reset plscnt = 1 remove v id from reset# write reset command sector protect complete remove v id from reset# write reset command sector unprotect complete
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 37 preliminary temporary sector unprotect this feature allows temporary unprotecti on of previously protected sectors to change data in-system. the sector unpr otect mode is activa ted by setting the reset# pin to v id . during this mode, formerly protected sectors can be pro - grammed or erased by selecting the sector addresses. once v id is removed from the reset# pin, all the previously protected sectors are protected again. 2 shows the algorithm, and 21 shows the timing diagrams, for this feature. while ppb lock is set, the device cannot enter the temporary sector unprotection mode. secsi? (secured s ilicon) sector flash memory region the secsi (secured silicon) sector feature provides a flash memory region that enables permanent part identification thro ugh an electronic se rial number (esn) the 128-word secsi sector is divided into 64 factory-lockable words that can be programmed and locked by the customer . the secsi sector is located at ad - dresses 000000h-00007fh in both persis tent protection mode and password protection mode. it uses indicator bits (d q6, dq7) to indicate the factory-locked and customer-locked status of the part. the system accesses the secsi sector through a command sequence (see the enter secsi? sector/exit secsi sector command sequence ). after the system has written the enter secsi sector comma nd sequence, it may read the secsi sector by using the addresses normally o ccupied by the boot sectors. this mode of operation continues until the system issues the exit secsi sector command se - quence, or until power is removed from the device. on power-up, or following a hardware reset, the device reverts to sending commands to the normal address space. note that the acc function and unl ock bypass modes are not available when the secsi sector is enabled. factory-locked area (64 words) the factory-locked area of the secsi sector (000000h-00003fh) is locked when the part is shipped, whether or not the area was programmed at the factory. the notes: 1. all protected sectors unp rotected (if wp#/acc = v il , upper two and lower two sectors will remain protected). 2. all previously protected sect ors are protected once again figure 2. temporary sector unprotect operation start perform erase or program operations reset# = v ih temporary sector unprotect completed (note 2) reset# = v id (note 1)
38 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary secsi sector factory-locked indicator bit (dq7) is permanently set to a ?1?. op - tional spansion programming services ca n program the factory-locked area with a random esn, a customer-defined code, or any combination of the two. because only spansion can program and protect th e factory-locked area, this method en - sures the security of the esn once the pr oduct is shipped to the field. contact your local sales office for details on us ing spansion?s programming services. note that the acc function and unlock bypass modes are not available when the secsi sector is enabled. customer-lockable area (64 words) the customer-lockable area of the secs i sector (000040h-00007fh) is shipped unprotected, which allows the customer to program and optionally lock the area as appropriate for the application. the secsi sector customer-locked indicator bit (dq6) is shipped as ?0? and can be pe rmanently locked to ?1? by issuing the secsi protection bit prog ram command. the secsi sector can be read any num - ber of times, but can be programmed and locked only once. note that the accelerated programming (acc) and unlock bypass functions are not available when programming the secsi sector. the customer-lockable secsi sector area can be protected using one of the following procedures: ? write the three-cycle enter secsi sector region command sequence, and then follow the in-system sector protect algorithm as shown in figure 1 , ex - cept that reset# may be at either v ih or v id . this allows in-system protec - tion of the secsi sector region with out raising any device pin to a high voltage. note that this method is only applicable to the secsi sector. ? to verify the protect/unprotect status of the secsi sector, follow the algo - rithm shown in figure 3 . once the secsi sector is locked and verifi ed, the system must write the exit secsi sector region command sequence to retu rn to reading and writing the remainder of the array. the secsi sector lock must be used with caution since, once locked, there is no procedure available for unlocking the secsi sector area and none of the bits in the secsi sector memory space can be modified in any way. secsi sector protection bits the secsi sector protection bits prevent programming of the secsi sector mem - ory area. once set, the secsi sector me mory area contents are non-modifiable.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 39 preliminary hardware data protection the command sequence requirement of unlock cycles for programming or erasing provides data protection against inadve rtent writes. in addition, the following hardware data protection measures prev ent accidental eras ure or programming, which might otherwise be caused by spurious system level signals during v cc power-up and power-down transi tions, or from system noise. low v cc write inhibit when v cc is less than v lko , the device does not accept any write cycles. this pro - tects data during v cc power-up and power-down. th e command register and all internal program/erase circuits are disabled, and the device resets to the read mode. subsequent writes are ignored until v cc is greater than v lko . the system must provide the proper signals to the cont rol pins to prevent unintentional writes when v cc is greater than v lko . write pulse ?glitch? protection noise pulses of less than 3 ns (typical) on oe#, ce#, or we# do not initiate a write cycle. logical inhibit write cycles are inhibited by holding any one of oe# = v il , ce# = v ih or we# = v ih . to initiate a write cycle, ce# and we# must be a logical zero while oe# is a logical one. power-up write inhibit if we# = ce# = v il and oe# = v ih during power up, the device does not accept commands on the rising edge of we#. the internal state machine is automatically reset to the read mode on power-up. figure 3. secsi sector protect verify write 60h to any address write 40h to secsi sector address with a6 = 0, a1 = 1, a0 = 0 start reset# = v ih or v id wait 1 s read from secsi sector address with a6 = 0, a1 = 1, a0 = 0 if data = 00h, secsi sector is unprotected. if data = 01h, secsi sector is protected. remove v ih or v id from reset# write reset command secsi sector protect verify complete
40 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary common flash memory interface (cfi) the common flash interface (cfi) specific ation outlines device and host system software interrogation hand shake, which allows specific vendor-specified soft - ware algorithms to be used for entire fa milies of devices. software support can then be device-independent, jedec id -independent, and forward- and back - ward-compatible for the specified flash device families. flash vendors can standardize their existing interfac es for long-term compatibility. this device enters the cfi query mode when the system writes the cfi query command, 98h, to address 55h, any time th e device is ready to read array data. the system can read cfi information at the addresses given in tables 9 ? 12 . to terminate reading cfi data, the system must write the reset command. the cfi query mode is not accessible when the device is executing an embedded program or embedded erase algorithm. the system can also write the cfi query command when the device is in the au - toselect mode. the device enters the cf i query mode, and the system can read cfi data at the addresses given in tables 9 ? 12 . the system must write the reset command to return the device to reading array data. for further information, please refer to the cfi specification and cfi publication 100. contact your local sales office for copies of these documents. table 9. cfi query identification string addresses data description 10h 11h 12h 0051h 0052h 0059h query unique ascii string ?qry? 13h 14h 0002h 0000h primary oem command set 15h 16h 0040h 0000h address for primary extended table 17h 18h 0000h 0000h alternate oem command set (00h = none exists) 19h 1ah 0000h 0000h address for alternate oem extended table (00h = none exists)
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 41 preliminary table 10. system interface string addresses data description 1bh 0027h v cc min. (write/erase) d7?d4: volt, d3?d0: 100 millivolt 1ch 0036h v cc max. (write/erase) d7?d4: volt, d3?d0: 100 millivolt 1dh 0000h v pp min. voltage (00h = no v pp pin present) 1eh 0000h v pp max. voltage (00h = no v pp pin present) 1fh 0003h typical timeout per single byte/word write 2 n s 20h 0000h typical timeout for min. size buffer write 2 n s (00h = not supported) 21h 0009h typical timeout per individual block erase 2 n ms 22h 0000h typical timeout for full chip erase 2 n ms (00h = not supported) 23h 0004h max. timeout for byte/word write 2 n times typical 24h 0000h max. timeout for buffer write 2 n times typical 25h 0004h max. timeout per individual block erase 2 n times typical 26h 0000h max. timeout for full chip erase 2 n times typical (00h = not supported) table 11. device geometry definition addresses data description 27h 0018h (pl127j) 0017h (pl064j) 0016h (pl032j) device size = 2 n byte 28h 29h 0001h 0000h flash device interface description (refer to cfi publication 100) 2ah 2bh 0000h 0000h max. number of byte in multi-byte write = 2 n (00h = not supported) 2ch 0003h number of erase block regions within device 2dh 2eh 2fh 30h 0007h 0000h 0020h 0000h erase block region 1 information (refer to the cfi specifica tion or cfi publication 100) 31h 00fdh (pl127j) 007dh (pl064j) 003dh (pl032j) erase block region 2 information (refer to the cfi specifica tion or cfi publication 100) 32h 33h 34h 0000h 0000h 0001h 35h 36h 37h 38h 0007h 0000h 0020h 0000h erase block region 3 information (refer to the cfi specifica tion or cfi publication 100) 39h 3ah 3bh 3ch 0000h 0000h 0000h 0000h erase block region 4 information (refer to the cfi specifica tion or cfi publication 100)
42 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary table 12. primary vendor-specific extended query addresses data description 40h 41h 42h 0050h 0052h 0049h query-unique ascii string ?pri? 43h 0031h major version number, ascii (refle cts modifications to the silicon) 44h 0033h minor version number, ascii (reflects modifications to the cfi table) 45h tbd address sensitive unlock (bits 1-0) 0 = required, 1 = not required silicon revision number (bits 7-2) 46h 0002h erase suspend 0 = not supported, 1 = to read only, 2 = to read & write 47h 0001h sector protect 0 = not supported, x = number of sectors in per group 48h 0001h sector temporary unprotect 00 = not supported, 01 = supported 49h 0007h (plxxxj) sector protect/unprotect scheme 07 = advanced sector protection 4ah 00e7h (pl127j) 0077h (pl064j) 003fh (pl032j) simultaneous operation 00 = not supported, x = number of sectors excluding bank 1 4bh 0000h burst mode type 00 = not supported, 01 = supported 4ch 0002h (plxxxj) page mode type 00 = not supported, 01 = 4 word page, 02 = 8 word page 4dh 0085h acc (acceleration) supply minimum 00h = not supported, d7-d4: volt, d3-d0: 100 mv 4eh 0095h acc (acceleration) supply maximum 00h = not supported, d7-d4: volt, d3-d0: 100 mv 4fh 0001h top/bottom boot sector flag 00h = uniform device, 01h = both top and bottom boot with write protect, 02h = bottom boot device, 03h = top boot device, 04h = both top and bottom 50h 0001h program suspend 0 = not supported, 1 = supported 57h 0004h bank organization 00 = data at 4ah is zero, x = number of banks 58h 0027h (pl127j) 0017h (pl064j) 000fh (pl032j) bank 1 region information x = number of sectors in bank 1 59h 0060h (pl127j) 0030h (pl064j) 0018h (pl032j) bank 2 region information x = number of sectors in bank 2 5ah 0060h (pl127j) 0030h (pl064j) 0018h (pl032j) bank 3 region information x = number of sectors in bank 3
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 43 preliminary 5bh 0027h (pl127j) 0017h (pl064j) 000fh (pl032j) bank 4 region information x = number of sectors in bank 4 table 12. primary vendo r-specific extended query (continued) addresses data description
44 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary command definitions writing specific address and data comma nds or sequences into the command register initiates device operations. ta b l e 1 3 defines the valid register command sequences. writing incorrect address and data values or writing them in the improper sequence may place the device in an unknown state. a reset com - mand is then required to return the device to reading array data. all addresses are latched on the falling edge of we# or ce#, whichever happens later. all data is latched on the rising edge of we# or ce#, whichever happens first. refer to the ac characteristic section for timing diagrams. reading array data the device is automatically set to readin g array data after device power-up. no commands are required to retrieve data. ea ch bank is ready to read array data after completing an embedded program or embedded erase algorithm. after the device accepts an erase suspe nd command, the corresponding bank enters the erase-suspend-read mode, after which the system can read data from any non-erase-suspended sector within the same bank. the system can read array data using the standard read timing, except that if it reads at an address within erase-suspended sectors, the device outputs status data . after completing a programming operation in the erase suspend mode, the system may once again read array data with the same exception. see the erase suspend/erase re - sume commands section for more information. the system must issue the reset command to return a bank to the read (or erase- suspend-read) mode if dq5 goes high during an active program or erase opera - tion, or if the bank is in the auto select mode. see the next section, reset command , for more information. see also requirements for reading array data in the device bus operations sec - tion for more information. the ac characteristic table provides the read parameters, and figure 12 shows the timing diagram. reset command writing the reset command resets the bank s to the read or erase-suspend-read mode. address bits are don?t cares for this command. the reset command may be written between the sequence cycles in an erase command sequence before erasing begins. this resets the bank to which the sys - tem was writing to the read mode. once erasure begins, however, the device ignores reset commands until the operation is complete. the reset command may be written between the sequence cycles in a program command sequence before programming be gins. this resets the bank to which the system was writing to the read mode . if the program command sequence is written to a bank that is in the eras e suspend mode, writing the reset command returns that bank to the erase-suspen d-read mode. once programming begins, however, the device ignores reset commands until the operation is complete. the reset command may be written between the sequence cycles in an autoselect command sequence. once in the autosele ct mode, the reset command must be written to return to the read mode. if a bank entered the autoselect mode while in the erase suspend mode, writing the re set command returns that bank to the erase-suspend-read mode.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 45 preliminary if dq5 goes high during a program or erase operation, writing the reset command returns the banks to the re ad mode (or erase-suspend-read mode if that bank was in erase suspend). autoselect command sequence the autoselect command sequence allows the host system to access the manu - facturer and device codes, and determine whether or not a sector is protected. the autoselect command sequence may be written to an address within a bank that is either in the read or erase-su spend-read mode. the autoselect command may not be written while the device is actively programming or erasing in the other bank. the autoselect command sequence is initia ted by first writing two unlock cycles. this is followed by a third write cycle that contains the bank address and the au - toselect command. the bank then enters the autoselect mode. the system may read any number of autoselect codes with out reinitiating the command sequence. ta b l e 1 3 shows the address and data requir ements. to determine sector protec - tion information, the system must write to the appropri ate bank address (ba) and sector address (sa). ta b l e 3 shows the address range and bank number associ - ated with each sector. the system must write the reset command to return to the read mode (or erase- suspend-read mode if the bank wa s previously in erase suspend). enter secsi? sector/exit se csi sector command sequence the secsi sector region provides a secured data area containing a random, eight word electronic serial number (esn). the system can access the secsi sector re - gion by issuing the three-cycle ente r secsi sector command sequence. the device continues to access the secsi sect or region until the system issues the four-cycle exit secsi sector command se quence. the exit secsi sector command sequence returns the device to normal op eration. the secsi sector is not acces - sible when the device is executing an embedded program or embedded erase algorithm. ta b l e 1 3 shows the address and data re quirements for both command sequences. see also ?secsi? (secured silicon) sector flash memory region? for further information. note that the acc function and unlock bypass modes are not available when the secsi sector is enabled. word program command sequence programming is a four-bus-cycle operat ion. the program command sequence is initiated by writing two unlock write cycles, followed by the program set-up com - mand. the program address and data are wr itten next, which in turn initiate the embedded program algorithm. the system is not required to provide further con - trols or timings. the device automatically provides in ternally generated program pulses and verifies the programmed cell margin. ta b l e 1 3 shows the address and data requirements for the program command sequence. note that the secsi sec - tor, autoselect, and cfi functions ar e unavailable when a [program/erase] operation is in progress. when the embedded program algorithm is complete, that bank then returns to the read mode and addresses are no long er latched. the system can determine the status of the program operation by using dq7, dq6, or ry/by#. refer to the write operation status section for information on these status bits. any commands written to the device du ring the embedded program algorithm are ignored. note that a hardware reset immediately terminates the program
46 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary operation. the program command sequence should be reinitiated once that bank has returned to the read mode, to ensure data integrity. note that the secsi sec - tor, autoselect and cfi functions are unavailable when the secsi sector is enabled. programming is allowed in any sequ ence and across sector boundaries. a bit cannot be programmed from ?0? back to a ?1.? attempting to do so may cause that bank to set dq5 = 1, or cause the dq7 and dq6 status bits to indicate the operation was successful. however, a succeeding read will show that the data is still ?0.? only erase operations can convert a ?0? to a ?1.? unlock bypass command sequence the unlock bypass feature allows the syst em to program data to a bank faster than using the standard program command sequence. the unlock bypass com - mand sequence is initiated by first writin g two unlock cycles. this is followed by a third write cycle containing the unlock bypass command, 20h. that bank then enters the unlock bypass mode. a two- cycle unlock bypass program command sequence is all that is required to progra m in this mode. the first cycle in this se - quence contains the unlock bypass program command, a0h; the second cycle contains the program address and data. a dditional data is programmed in the same manner. this mode dispenses with th e initial two unlock cycles required in the standard program command sequence, resulting in faster total programming time. ta b l e 1 3 shows the requirements for the command sequence. during the unlock bypass mode, only the unlock bypass program and unlock by - pass reset commands are valid. to exit the unlock bypass mode, the system must issue the two-cycle unlock bypass reset command sequence. (see table 14 ) the device offers accelerated program operations through the wp#/acc pin. when the system asserts v hh on the wp#/acc pin, th e device automatically en - ters the unlock bypass mode. the system may then write the two-cycle unlock bypass program command sequence. the devi ce uses the higher voltage on the wp#/acc pin to accelerate the operation. note that the wp#/acc pin must not be at v hh any operation other than accelerated programming, or device damage may result. in addition, the wp#/acc pi n must not be left floating or uncon - nected; inconsistent behavior of the device may result. 4 illustrates the algorithm for the program operation. refer to the erase/program operations table in the ac characterist ics section for parameters, and figure 14 for timing diagrams.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 47 preliminary chip erase command sequence chip erase is a six bus cycle operation. the chip erase command sequence is ini - tiated by writing two unlock cycles, followed by a set-up command. two additional unlock write cycles are then followed by the chip erase command, which in turn invokes the embedded erase algorithm. the device does not require the system to preprogram prior to er ase. the embedded erase algorithm auto - matically preprograms and verifies the enti re memory for an all zero data pattern prior to electrical erase. the system is no t required to provide any controls or tim - ings during these operations. ta b l e 1 3 shows the address and data requirements for the chip erase command sequence. when the embedded erase algorithm is comp lete, that bank returns to the read mode and addresses are no longer latche d. the system can determine the status of the erase operation by using dq7, dq6, dq2, or ry/by#. refer to the write operation status section for information on these status bits. any commands written during the chip erase operation are ignored. note that secsi sector, autoselect, and cfi functi ons are unavailable when a [program/ erase] operation is in progress. however, note that a hardware reset immedi - ately terminates the erase operation. if that occurs, the chip erase command sequence should be reinitiated once that bank has returned to reading array data, to ensure data integrity. note: see table 13 for program command sequence. figure 4. program operation start write program command sequence data poll from system verify data? no yes last address? no yes programming completed increment address embedded program algorithm in progress
48 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary 5 illustrates the algorithm for th e erase operation. refer to the erase/program operations tables in the ac characteristics section for parameters, and figure 16 section for timing diagrams. sector erase command sequence sector erase is a six bus cycle operation. the sector erase command sequence is initiated by writing two unlock cycles, followed by a set-up command. two addi - tional unlock cycles are written, and ar e then followed by the address of the sector to be erased, and the sector erase command. ta b l e 1 3 shows the address and data requirements for the sector erase command sequence. the device does not require the system to preprogram prior to erase. the em - bedded erase algorithm automatically prog rams and verifies the entire memory for an all zero data pattern prior to electrical erase. the system is not required to provide any controls or timi ngs during these operations. after the command sequence is written, a sector erase time-out of 50 s occurs. during the time-out period , additional sector addresses and sector erase com - mands may be written. loading the sector erase buffer may be done in any sequence, and the number of sectors may be from one sector to all sectors. the time between these additional cycles must be less than 50 s, otherwise erasure may begin. any sector erase address an d command following the exceeded time- out may or may not be accepted. it is recommended that processor interrupts be disabled during this time to ensure all commands are accepted. the interrupts can be re-enabled after the last sector erase command is written. any com - mand other than sector erase or erase suspend during the time-out period resets that bank to the read mode. the system must rewrite the com - mand sequence and any additi onal addresses and commands. note that secsi sector, autoselect, and cfi functions are unavailable when a [program/erase] operation is in progress. the system can monitor dq3 to determine if the sector erase timer has timed out (see the section on dq3: sector erase ti mer). the time-out begins from the ris - ing edge of the final we# pulse in the command sequence. when the embedded erase algorithm is co mplete, the bank returns to reading array data and addresses are no longer latched. note that while the embedded erase operation is in progress, the syst em can read data from the non-erasing bank. the system can determine the stat us of the erase operation by reading dq7, dq6, dq2, or ry/by# in the erasing bank. refer to the write operation sta - tus section for information on these status bits. once the sector erase operation has begu n, only the erase suspend command is valid. all other commands are ignored. however, note that a hardware reset im - mediately terminates the erase operation. if that occurs, the sector erase command sequence should be reinitiated on ce that bank has returned to reading array data, to ensure data integrity. 5 illustrates the algorithm for th e erase operation. refer to the erase/program operations tables in the ac characteristics section for parameters, and figure 16 section for timing diagrams.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 49 preliminary erase suspend/erase resume commands the erase suspend command, b0h, allows the system to interrupt a sector erase operation and then read data from, or pr ogram data to, any sector not selected for erasure. the bank address is required when writing this command. this com - mand is valid only during the sector erase operation, including the 80 s time-out period during the sector erase command sequence. the erase suspend command is ignored if written during the chip erase operation or embedded program algorithm. when the erase suspend command is written during the sector erase operation, the device requires a maximum of 35 s to suspend the erase operation. how - ever, when the erase suspend command is written during the sector erase time-out, the device immedi ately terminates the time-out period and suspends the erase operation. addresses are ?don?t-cares? when writing the erase suspend command. after the erase operation has been suspe nded, the bank enters the erase-sus - pend-read mode. the system can read data from or program data to any sector not selected for erasure. (the device ?erase suspends? all sectors selected for erasure.) reading at any address within erase-suspended sectors produces sta - tus information on dq7?d q0. the system can use dq7, or dq6 and dq2 together, to determine if a sector is actively erasing or is erase-suspended. refer to the write operation status section for information on these status bits. after an erase-suspended program operatio n is complete, the bank returns to the erase-suspend-read mode. the system can determine the status of the program notes: 1. see table 13 for erase command sequence. 2. see the section on dq3 for information on the sector erase timer. figure 5. erase operation start write erase command sequence (notes 1, 2) data poll to erasing bank from system data = ffh? no yes erasure completed embedded erase algorithm in progress
50 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary operation using the dq7 or dq6 status bits, just as in the standard word program operation. refer to the write operation status section for more information. in the erase-suspend-read mode, the syst em can also issue the autoselect com - mand sequence. the device allows readin g autoselect codes even at addresses within erasing sectors, since the codes ar e not stored in the memory array. when the device exits the autoselect mode, th e device reverts to the erase suspend mode, and is ready for another valid operation. refer to the secsitm sector ad - dresses and the autoselect command sequence sections for details. to resume the sector erase operation, the system must write the erase resume command (address bits are don?t care). the bank address of the erase-sus - pended bank is required when writin g this command. further writes of the resume command are ignored. another erase suspend command can be written after the chip has resumed erasing. if the persistent sector protection mode locking bit is verified as programmed without margin, the persiste nt sector protection mode locking bit program com - mand should be reissued to improve program margin. if the secsi sector protection bit is verified as programme d without margin, the secsi sector pro - tection bit program command should be reissued to improve program margin. ? after programming a ppb, two addition al cycles are needed to determine whether the ppb has been programmed wi th margin. if the ppb has been pro - grammed without margin, the program comm and should be reissued to improve the program margin. also note that the total number of ppb program/erase cycles is limited to 100 cycles. cycling the ppbs beyond 100 cycles is not guaranteed. after erasing the ppbs, two additional cycles are needed to determine whether the ppb has been erased with margin. if the ppbs has been erased without mar - gin, the erase command should be reissued to improve the program margin. the programming of either the ppb or dyb for a given sector or sector group can be verified by writing a sector protec tion status command to the device. note that there is no single command to independently verify the programming of a dyb for a given sector group. command definitions tables ta b l e 1 3 . memory array command definitions command (notes) cycles bus cycles (notes 1 ? 4 ) addr data addr data addr data addr data addr data addr data read (note 5) 1 ra rd reset (note 6) 1 xxx f0 autoselect (note 7) manufacturer id 4 555 aa 2aa 55 (ba) 555 90 (ba) x00 01 device id (note 10) 6 555 aa 2aa 55 (ba) 555 90 (ba) x01 227e (ba) x0e (note 10) (ba) x0f (note 10) secsi sector factory protect (note 8) 4 555 aa 2aa 55 (ba) 555 90 x03 (note 8) sector group protect verify (note 9) 4 555 aaa 2aa 55 (ba) 555 90 (sa) x02 xx00/ xx01 program 4 555 aa 2aa 55 555 a0 pa pd chip erase 6 555 aa 2aa 55 555 80 555 aa 2aa 55 555 10 sector erase 6 555 aa 2aa 55 555 80 555 aa 2aa 55 sa 30 program/erase suspend (note 11) 1 ba b0 program/erase resume (note 12) 1 ba 30
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 51 preliminary cfi query (note 13) 1 55 98 accelerated program (note 15) 2 xx a0 pa pd unlock bypass entry (note 15) 3 555 aa 2aa 55 555 20 unlock bypass program (note 15) 2 xx a0 pa pd unlock bypass erase (note 15) 2 xx 80 xx 10 unlock bypass cfi (notes 13 , 15 ) 1 xx 98 unlock bypass reset (note 15) 2 xxx 90 xxx 00 ta b l e 1 4 . sector protection command definitions command (notes) cycles bus cycles (notes 1 - 4 ) addr data addr data addr data addr data addr data addr data addr data reset 1 xxx f0 secsi sector entry 3 555 aa 2aa 55 555 88 secsi sector exit 4 555 aa 2aa 55 555 90 xx 00 secsi protection bit program (notes 5 , 6 ) 6 555 aa 2aa 55 555 60 ow 68 ow 48 ow rd(0) secsi protection bit status 5 555 aa 2aa 55 555 60 ow 48 ow rd(0) password program (notes 5 , 7 , 8 ) 4 555 aa 2aa 55 555 38 xx[0-3] pd[0-3] password verify (notes 6 , 8 , 9 ) 4 555 aa 2aa 55 555 c8 pwa[0-3] pwd[0-3] password unlock (notes 7 , 10 , 11 ) 7 555 aa 2aa 55 555 28 pwa[0] pwd[0] pwa[1] pwd[1] pwa[2] pwd[2] pwa[3] pwd[3] ppb program (notes 5 , 6 , 12 ) 6 555 aa 2aa 55 555 60 (sa)wp 68 (sa)wp 48 (sa)wp rd(0) table 13. memory array command definitions command (notes) cycles bus cycles (notes 1 ? 4 ) addr data addr data addr data addr data addr data addr data legend: ba = address of bank switching to autoselect mode, bypass mode, or erase operation. dete rmined by pl127j: amax:a20, pl064j: amax:a19, pl032j: amax:a18. pa = program address (amax:a0). addresses latch on falling edge of we# or ce# pulse, whichever happens later. pd = program data (dq15:dq0) written to location pa. data latches on rising edge of we# or ce# pulse, whichever happens first. ra = read addr ess (amax:a0). rd = read data (dq15:dq 0) from location ra. sa = sector address (amax:a12) for verifying (in autoselect mode) or erasing. wd = write data. see ?configuration register? definition for specific write data. data latched on rising edge of we#. x = don?t care notes: 1. see table 1 for description of bus operations. 2. all values are in hexadecimal. 3. shaded cells in table denote re ad cycles. all other cycles are write operations. 4. during unlock and command cycles, when lower address bits are 555 or 2aah as shown in ta ble, address bits higher than a11 (except where ba is required ) and data bits higher than dq7 are don?t cares. 5. no unlock or command cycles re quired when bank is reading array data. 6. the reset command is required to return to reading array (or to erase-suspend-read mo de if previously in erase suspend) when bank is in auto select mode, or if dq5 goes high (while bank is providing status information). 7. fourth cycle of autoselect command sequence is a read cycle. system must provid e bank address to obtain manufacturer id or device id information. see autoselect command sequence section for more information. 8. the data is c4h for factory and customer locked, 84h for factory locked and 04h for not locked. 9. the data is 00h for an unprotected sector group and 01h fo r a protected sector group. 10. device id must be read across cycles 4, 5, and 6. pl127j (x0eh = 2220h, x0fh = 2200h),pl064j (x0eh = 2202h, x0fh = 2201h), pl032j (x0eh = 220ah, x0fh = 2201h). 11. system may read and program in non-erasing sectors, or enter autoselect mode, when in program/erase suspend mode. program/erase suspend command is valid only during a sector erase operatio n, and requires bank address. 12. program/erase resume command is valid only during erase suspend mode, and requires bank address. 13. command is valid when device is ready to read array data o r when device is in autoselect mode. 14. wp#/acc must be at v id during the entire operation of command. 15. unlock bypass entry command is required prior to any unlock bypass operation. unlo ck bypass reset command is required to return to the reading array.
52 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary write operation status the device provides several bits to determine the status of a program or erase opera - tion: dq2, dq3, dq5, dq6, and dq7. ta b l e 1 5 and the following subsections describe the function of these bits. dq7 and dq6 ea ch offer a method for determining whether a program or erase operation is complete or in progress. the device also provides a hardware-based output signal, ry/by#, to determine whether an embedded program or erase operation is in prog ress or has been completed. dq7: data# polling the data# polling bit, dq7, indicates to the host system whether an embedded pro - gram or erase algorithm is in progress or completed, or whether a bank is in erase suspend. data# polling is vali d after the rising edge of th e final we# pulse in the com - mand sequence. ppb status 4 555 aa 2aa 55 555 90 (sa)wp rd(0) all ppb erase (notes 5 , 6 , 13 , 14 ) 6 555 aa 2aa 55 555 60 wp 60 (sa) 40 (sa)wp rd(0) ppb lock bit set 3 555 aa 2aa 55 555 78 ppb lock bit status (note 15) 4 555 aa 2aa 55 555 58 sa rd(1) dyb write (note 7) 4 555 aa 2aa 55 555 48 sa x1 dyb erase (note 7) 4 555 aa 2aa 55 555 48 sa x0 dyb status (note 6) 4 555 aa 2aa 55 555 58 sa rd(0) ppmlb program (notes 5 , 6 , 12 ) 6 555 aa 2aa 55 555 60 pl 68 pl 48 pl rd(0) ppmlb status (note 5) 5 555 aa 2aa 55 555 60 pl 48 pl rd(0) spmlb program (notes 5 , 6 , 12 ) 6 555 aa 2aa 55 555 60 sl 68 sl 48 sl rd(0) spmlb status (note 5) 5 555 aa 2aa 55 555 60 sl 48 sl rd(0) table 14. sector protecti on command definitions l egend: d yb = dynamic protection bit o w = address (a7:a0) is (00011010) p d[3:0] = password data (1 of 4 portions) p pb = persistent protection bit p wa = password address. a1:a0 selects portion of password. p wd = password data being verified. p l = password protection mode lock address (a7:a0) is (00001010) rd(0) = read data dq0 for protection indicator bit. rd(1) = read data dq1 for ppb lock status. sa = sector address where security command applies. address bits amax:a12 uniquely select any sector. sl = persistent protection mode lock address (a7:a0) is (00010010) wp = ppb address (a7:a0) is (00000010) x = don?t care ppmlb = password protection mode locking bit spmlb = persistent protec tion mode locking bit n otes: 1. see table 1 for description of bus operations. 2 . all values are in hexadecimal. 3 . shaded cells in table denote read cycles. all other cycles are write operations. 4 . during unlock and command cycles, when lower address bits are 555 or 2aah as shown in table, address bits higher than a11 (except where ba is required ) and data bits higher than dq7 are don?t cares. 5 . the reset command returns device to reading array. 6 . cycle 4 programs the addressed locking bit. cycles 5 and 6 validate bit has been fully programmed when dq0 = 1. if dq0 = 0 in cycle 6, program command must be issued and verified again. 7. data is latched on the rising edge of we#. 8 . entire command sequence must be entered for each portion of password. 9. command sequence returns ffh if ppmlb is set. 10. the password is written over four consecutive cycles, at addresses 0-3. 11. a 2 s timeout is required between any two portions of password. 12. a 100 s timeout is required between cycles 4 and 5. 13. a 1.2 ms timeout is required between cycles 4 and 5. 14. cycle 4 erases all ppbs. cycles 5 and 6 validate bits have been fully erased when dq0 = 0. if dq0 = 1 in cycle 6, erase command must be issued and verified again. before issuing erase command, all ppbs should be programmed to prevent ppb overerasure. 15. dq1 = 1 if ppb locked, 0 if unlocked.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 53 preliminary during the embedded program algorithm, the device outputs on dq7 the complement of the datum programmed to dq7. this dq7 st atus also applies to programming during erase suspend. when the embedded program algorithm is complete, the device out - puts the datum programmed to dq7. the system must provide the program address to read valid status information on dq7. if a program address falls within a protected sector, data# polling on dq7 is active for approximately 1 s, then that bank returns to the read mode. during the embedded erase algorithm, data# polling produces a ?0? on dq7. when the embedded erase algorithm is comp lete, or if the bank enters the erase suspend mode, data# polling produces a ?1? on dq7. the system must provide an address within any of the sectors selected for erasure to read valid status in - formation on dq7. after an erase command sequence is written, if all sectors selected for erasing are protected, data# polling on dq7 is ac tive for approximately 400 s, then the bank returns to the read mode. if not al l selected sectors are protected, the em - bedded erase algorithm erases the unprotected sectors, and ignores the selected sectors that are protected. however, if th e system reads dq7 at an address within a protected sector, the status may not be valid. when the system detects dq7 has change d from the complement to true data, it can read valid data at dq15?dq0 on the following read cycles. just prior to the completion of an embedded program or erase operation, dq7 may change asyn - chronously with dq15?dq0 while output enable (oe#) is asserted low. that is, the device may change from providing stat us information to valid data on dq7. depending on when the system samples th e dq7 output, it may read the status or valid data. even if the device has completed the program or erase operation and dq7 has valid data, the data outputs on dq15?dq0 may be still invalid. valid data on dq15?dq0 will appear on successive read cycles. ta b l e 1 5 shows the outputs for data# polling on dq7. 6 shows the data# polling algorithm. 18 in the ac characteristic section shows the data# polling timing diagram.
54 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary notes: 1. va = valid address for programming. during a sector erase operation, a valid address is any sector address within the sector being er ased. during chip eras e, a valid address is any non-protected sector address. 2. dq7 should be rechecked even if dq5 = ?1? because dq7 may change simultaneously with dq5. figure 6. data# polling algorithm dq7 = data? yes no no dq5 = 1? no yes yes fail pass read dq7?dq0 addr = va read dq7?dq0 addr = va dq7 = data? start
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 55 preliminary ry/by#: ready/busy# the ry/by# is a dedicated, open-drain output pin which indicates whether an embedded algorithm is in progress or complete. the ry/by# status is valid after the rising edge of the final we# pulse in the command sequence. since ry/by# is an open-drain output, several ry/by# pins can be tied together in parallel with a pull-up resistor to v cc . if the output is low (busy), the device is actively erasing or programming. (this includes programming in the erase suspend mode.) if the output is high (ready), the device is in the read mode, the stan dby mode, or one of the banks is in the erase-suspend-read mode. ta b l e 1 5 shows the outputs for ry/by#. dq6: toggle bit i toggle bit i on dq6 indicates whether an embedded program or erase algorithm is in progress or complete, or whether the device has entered the erase suspend mode. toggle bit i may be read at any address, and is valid after the rising edge of the final we# pulse in the command sequence (prior to the program or erase operation), and during the sector erase time-out. during an embedded program or erase algorithm operation, successive read cy - cles to any address cause dq6 to toggle. the system may use either oe# or ce# to control the read cycles. when the op eration is complete, dq6 stops toggling. after an erase command sequence is written, if all sectors selected for erasing are protected, dq6 toggles for approximately 400 s, then returns to reading array data. if not all selected sectors are protected, the embedded erase algo - rithm erases the unprotected sectors, an d ignores the selected sectors that are protected. the system can use dq6 and dq2 together to determine whether a sector is ac - tively erasing or is erase-suspended. when the device is actively erasing (that is, the embedded erase algorithm is in prog ress), dq6 toggles. when the device en - ters the erase suspend mode, dq6 stops toggling. however, the system must also use dq2 to determine which sectors are erasing or erase-suspended. alter - natively, the system can use dq7 (see the dq7: data# polling ). if a program address falls within a protected sector, dq6 toggles for approxi - mately 1 s after the program command se quence is written, then returns to reading array data. dq6 also toggles during the erase-su spend-program mode, and stops toggling once the embedded program algorithm is complete. ta b l e 1 5 shows the outputs for toggle bit i on dq6. figure 7 shows the toggle bit algorithm. figure 19 in ?read operation timings? shows the toggle bit timing di - agrams. figure 20 shows the differences between dq2 and dq6 in graphical form. see also the dq2: toggle bit ii .
56 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary dq2: toggle bit ii the ?toggle bit ii? on dq2, when used wi th dq6, indicates whether a particular sector is actively erasing (that is, the embedded erase algorithm is in progress), or whether that sector is erase-suspended. toggle bit ii is valid after the rising edge of the final we# pulse in the command sequence. dq2 toggles when the system reads at a ddresses within those sectors that have been selected for erasure. (the system may use either oe# or ce# to control the read cycles.) but dq2 cannot distinguish whether the sector is actively erasing or is erase-suspended. dq6, by comparison, indicates whether the device is actively erasing, or is in erase suspend, but cannot distinguish which sectors are selected for erasure. thus, both status bits are re quired for sector an d mode information. refer to ta b l e 1 5 to compare outputs for dq2 and dq6. figure 7 shows the toggle bit algorith m in flowchart form, and the dq2: toggle bit ii explains the algorithm. see also the dq6: toggle bit i . figure 19 shows the toggle bit timing diagram. figure 20 shows the differences between dq2 and dq6 in graphical form. reading toggle bits dq6/dq2 refer to figure 7 for the following discussion. wh enever the system initially be - gins reading toggle bit status, it must read dq7?dq0 at least twice in a row to determine whether a toggle bit is toggling . typically, the system would note and note: the system should recheck the toggle bi t even if dq5 = ?1? because the toggle bit may stop toggling as dq 5 changes to ?1.? see the dq6: toggle bit i and dq2: toggle bit ii for more information. figure 7. to g g l e b i t a l g o r i t h m start no yes yes dq5 = 1? no yes toggle bit = toggle? no program/erase operation not complete, write reset command program/erase operation complet e toggle bit = toggle? read byte twice (dq7?dq0) address = va read byte (dq7?dq0) address =va read byte (dq7?dq0) address =va
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 57 preliminary store the value of the toggle bit after th e first read. after the second read, the system would compare the new value of the toggle bit with the fi rst. if the toggle bit is not toggling, the device has completed the program or erase operation. the system can read array data on dq7?dq0 on the following read cycle. however, if after the initial two read cycl es, the system determines that the toggle bit is still toggling, the system also shou ld note whether the value of dq5 is high (see the section on dq5). if it is, the system should then determine again whether the toggle bit is toggling, sinc e the toggle bit may have stopped toggling just as dq5 went high. if the toggle bit is no longer toggling , the device has suc - cessfully completed the program or erase operation. if it is still toggling, the device did not completed the operation successfully, and the system must write the reset command to return to reading array data. the remaining scenario is that the system initially determines that the toggle bit is toggling and dq5 has not gone high. the system may continue to monitor the toggle bit and dq5 through successive read cycles, determining the status as de - scribed in the previous paragraph. altern atively, it may choose to perform other system tasks. in this case, the system must start at the beginning of the algo - rithm when it returns to determine th e status of the operation (top of figure 7 ). dq5: exceeded timing limits dq5 indicates whether the program or erase time has exceeded a specified inter - nal pulse count limit. under these conditions dq5 produces a ?1,? indicating that the program or erase cycle was not successfully completed. the device may output a ?1? on dq5 if the system tries to program a ?1? to a location that was previously programmed to ?0.? only an erase operation can change a ?0? back to a ?1.? under this condition, the device halts the opera - tion, and when the timing limit has been exceeded, dq5 produces a ?1.? under both these conditions, the system must write the reset command to return to the read mode (or to the erase-suspen d-read mode if a bank was previously in the erase-suspend-program mode). dq3: sector erase timer after writing a sector erase command se quence, the system may read dq3 to de - termine whether or not erasure has begu n. (the sector erase timer does not apply to the chip erase comm and.) if additional sectors are selected for erasure, the entire time-out also applies after each additional sector erase command. when the time-out period is complete, dq3 switches from a ?0? to a ?1.? see also the sector erase command sequence . after the sector erase command is written, the system should read the status of dq7 (data# polling) or dq6 (toggle bit i) to ensure that the device has accepted the command sequence, and then read dq3. if dq3 is ?1,? the embedded erase algorithm has begun; all further comma nds (except erase suspend) are ignored until the erase operation is complete. if dq3 is ?0,? the device will accept addi - tional sector erase commands. to ensure the command has been accepted, the system software should check the status of dq3 prior to and following each sub - sequent sector erase command. if dq3 is high on the second status check, the last command might not have been accepted. ta b l e 1 5 shows the status of dq3 relative to the other status bits.
58 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary notes: 1. dq5 switches to ?1? when an embedded program or em bedded erase operation has ex ceeded the maximum timing limits. refer to th e section on dq5 for more information. 2. dq7 and dq2 require a valid address wh en reading status information. refe r to the appropriate subsection for further details. 3. when reading write operation status bits, the system must always provide the bank address where the embedded algorithm is in progress. the device outputs arra y data if the system addresses a non-busy bank. ta b l e 1 5 . write operation status status dq7 (note 2) dq6 dq5 (note 1) dq3 dq2 (note 2) ry / b y # standard mode embedded program algorithm dq7# toggle 0 n/a no toggle 0 embedded erase algorithm 0 toggle 0 1 to g g l e 0 erase suspend mode erase-suspend- read erase suspended sector 1 no toggle 0 n/a to g g l e 1 non-erase suspended sector data data data data data 1 erase-suspend-program dq7# toggle 0 n/a n/a 0
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 59 preliminary absolute maximum ratings storage temperature plastic packages . . . . . . . . . . . . . . . . .?65c to +150c ambient temperature with power applied. . . . . . . . . . . . . . .?65c to +125c voltage with respect to ground v cc (note 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to +4.0 v reset# (note 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to +13.0 v wp#/acc (note 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to +10.5 v all other pins (note 1) . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to v cc +0.5 v output short circuit current (note 3) . . . . . . . . . . . . . . . . . . . . . . . 200 ma notes: 1. minimum dc voltage on input or i/o pins is ?0.5 v. during voltage transitions, input or i/o pins may overshoot v ss to ?2.0 v for periods of up to 20 ns. maximum dc voltage on input or i/o pins is v cc +0.5 v. during voltag e transitions, input or i/o pins may overshoot to v cc +2.0 v for periods up to 20 ns. see figure 8 . 2. minimum dc input voltage on pins a9 , oe#, reset#, and wp#/acc is ?0.5 v. during voltage transitions, a9, oe#, wp#/acc, and reset# may overshoot v ss to ?2.0 v for periods of up to 20 ns. see figure 8 . maximum dc input voltage on pin a9, oe#, and reset# is +12.5 v whic h may overshoot to +14.0 v for periods up to 20 ns. maximum dc input voltage on wp#/acc is +9.5 v which may overshoot to +12.0 v for periods up to 20 ns. 3. no more than one output may be shorte d to ground at a time. duration of the short circuit should not be greater than one second. 4. stresses above those listed under ?abs olute maximum ratings? may cause perma- nent damage to the device. this is a stre ss rating only; function al operation of the device at these or any other conditions above those indicated in the operational sections of this data sheet is not implied. exposure of the device to absolute max- imum rating conditions fo r extended periods may affect device reliability. figure 8. maximum overshoot waveforms 20 ns 20 ns +0.8 v ?0.5 v 20 ns ?2.0 v 20 ns 20 ns v cc +2.0 v v cc +0.5 v 20 ns 2.0 v maximum negative overshoot waveform maximum positive overshoot waveform
60 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary operating ranges operating ranges define those limits be tween which the functionality of the de - vice is guaranteed. industrial (i) devices ambient temperature (t a ) . . . . . . . . . . . . . . . . . . . . . . . . . ?40c to +85c wireless devices ambient temperature (t a ) . . . . . . . . . . . . . . . . . . . . . . . . . ?25c to +85c supply voltages v cc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.7?3.1 v v io (see note) . . 1.65?1.95 v (for pl127j) or 2.7?3.1 v (for all plxxxj devices) notes: for all ac and dc specifications, v io = v cc ; contact your local sales office for other v io options.
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 61 preliminary dc characteristics notes: 1. the i cc current listed is typically less than 5 ma/mhz, with oe# at v ih . 2. maximum i cc specifications are tested with v cc = v ccmax . 3. i cc active while embedded erase or embedded program is in progress. 4. automatic sleep mode enables the low power mode when addresses remain stable for t acc + 30 ns. typical sleep mode current is 1 m a. 5. not 100% tested. 6. valid ce1#/ce2# conditions: (ce1# = v il, ce2# = v ih, ) or (ce1# = v ih, ce2# = v il ) or (ce1# = v ih, ce2# = v ih ) ta b l e 1 6 . cmos compatible parameter symbol parameter description test conditions min typ max unit i li input load current v in = v ss to v cc , v cc = v cc max 1.0 a i lit a9, oe#, reset# input load current v cc = v cc max ; v id = 12.5 v 35 a i lr reset leakage current v cc = v cc max ; v id = 12.5 v 35 a i lo output leakage current v out = v ss to v cc , oe# = v ih v cc = v cc max 1.0 a i cc1 v cc active read current (notes 1 , 2 ) oe# = v ih , v cc = v cc max (note 1) 5 mhz 15 25 ma 10 mhz 45 55 i cc2 v cc active write current (notes 2 , 3 ) oe# = v ih , we# = v il 15 25 ma i cc3 v cc standby current (note 2) ce#, reset#, wp#/acc = v io 0.3 v 0.2 5 a i cc4 v cc reset current (note 2) reset# = v ss 0.3 v 0.2 5 a i cc5 automatic sleep mode (notes 2 , 4 ) v ih = v io 0.3 v; v il = v ss 0.3 v 0.2 5 a i cc6 v cc active read-while-program current (notes 1 , 2 ) oe# = v ih , 5 mhz 21 45 ma 10 mhz 46 70 i cc7 v cc active read-while-erase current (notes 1 , 2 ) oe# = v ih , 5 mhz 21 45 ma 10 mhz 46 70 i cc8 v cc active program-while-erase- suspended current (notes 2 , 5 ) oe# = v ih 17 25 ma i cc9 v cc active page read current (note 2) oe# = v ih , 8 word page read 10 15 ma v il input low voltage v io = 1.65?1.95 v (pl127j) ?0.4 0.4 v v io = 2.7?3.6 v ?0.5 0.8 v v ih input high voltage v io = 1.65?1.95 v (pl127j) v io ?0.4 v io +0.4 v v io = 2.7?3.6 v 2.0 v cc +0.3 v v hh voltage for acc program acceleration v cc = 3.0 v 10% 8.5 9.5 v v id voltage for autoselect and temporary sector unprotect v cc = 3.0 v 10% 11.5 12.5 v v ol output low voltage i ol = 100 a, v cc = v cc min , v io = 1.65? 1.95 v (pl127j) 0.1 v i ol = 2.0 ma, v cc = v cc min , v io = 2.7?3.6 v 0.4 v v oh output high voltage i oh = ?100 a, v cc = v cc min , v io = 1.65? 1.95 v (pl127j) v io ?0.1 v i oh = ?2.0 ma, v cc = v cc min , v io = 2.7?3.6 v 2.4 v v lko low v cc lock-out voltage (note 5) 2.3 2.5 v
62 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary ac characteristic test conditions note: diodes are in3064 or equivalent figure 9. test setups ta b l e 1 7 . test specifications test condition all speeds unit output load 1 ttl gate output load capacitance, c l (including jig capacitance) 30 pf input rise and fall times v io = 1.8 v (pl127j) 5 ns v io = 3.0 v input pulse levels v io = 1.8 v (pl127j) 0.0 - 1.8 v v io = 3.0 v 0.0?3.0 input timing measurement reference levels v io /2 v output timing measurement reference levels v io /2 v 2.7 k ? c l 6.2 k ? 3 . 6 v device under te s t c l device under te s t v io = 3.0 v v io = 1.8 v (pl127j)
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 63 preliminary switching waveforms vcc ramprate all dc characteristics are specified for a v cc ramp rate > 1v/100 s and v cc >=v ccq - 100 mv. if the v cc ramp rate is < 1v/100 s, a hardware reset required.+ ta b l e 1 8 . key to switching waveforms waveform inputs outputs steady changing from h to l changing from l to h don?t care, any change permitted changing, state unknown does not apply center line is high impedance state (high z) figure 10. input waveforms and measurement levels vio 0.0 v vio/2 vio/2 output measurement level in
64 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary read operations notes: 1. not 100% tested. 2. see figure 9 and table 17 for test specifications 3. measurements performed by placing a 50 ohm te rmination on the data pin with a bias of v cc /2. the time from oe# high to the data bus driven to v cc /2 is taken as t df . 4. for 70pf output load capacitance, 2 ns will be added to the above t acc ,t ce ,t pacc ,t oe values for all speed grades ta b l e 1 9 . read-only operations parameter description te s t s e t u p speed options jedec std. 55 60 65 70 unit t avav t rc read cycle time (note 1) min 55 60 65 70 ns t avqv t acc address to output delay ce#, oe# = v il max 55 60 65 70 ns t elqv t ce chip enable to output delay oe# = v il max 55 60 65 70 ns t pacc page access time max 20 25 30 ns t glqv t oe output enable to output delay max 20 25 30 ns t ehqz t df chip enable to output high z (note 3) max 16 ns t ghqz t df output enable to output high z (notes 1 , 3 ) max 16 ns t axqx t oh output hold time from addresses, ce# or oe#, whichever occurs first (note 3) min 5 ns t oeh output enable hold time (note 1) read min 0 ns toggle and data# polling min 10 ns figure 11. read operation timings t oh t ce data we# addresses ce# oe# high z valid data high z addresses stable t rc t acc t oeh t rh t oe t rh 0 v ry/by# reset# t df
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 65 preliminary reset note: not 100% tested. figure 12. page read operation timings ta b l e 2 0 . hardware reset (reset#) parameter description all speed options unit jedec std t ready reset# pin low (during embedded algorithms) to read mode (see note) max 35 s t ready reset# pin low (not during embedded algorithms) to read mode (see note) max 500 ns t rp reset# pulse width min 500 ns t rh reset high time before read (see note) min 50 ns t rpd reset# low to standby mode min 20 s t rb ry/by# recovery time min 0 ns a max - a3 ce# oe# a2 - a0 data same page aa ab ac ad qa qb qc qd t acc t pacc t pacc t pacc
66 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary figure 13. reset timings reset# ry/by# ry/by# t rp t ready reset timings not during embedded algorithms t ready ce#, oe# t rh ce#, oe# reset timings during embedded algorithms reset# t rp t rb
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 67 preliminary erase/program operations notes: 1. not 100% tested. 2. see the ?erase and programming perfo rmance? section for more information. ta b l e 2 1 . erase and program operations parameter speed options jedec std description 55 60 65 70 unit t avav t wc write cycle time (note 1) min 55 60 65 70 ns t avwl t as address setup time min 0 ns t aso address setup time to oe# low during toggle bit polling min 15 ns t wlax t ah address hold time min 30 35 ns t aht address hold time from ce# or oe# high during toggle bit polling min 0 ns t dvwh t ds data setup time min 25 30 ns t whdx t dh data hold time min 0 ns t oeph output enable high during toggle bit polling min 10 ns t ghwl t ghwl read recovery time before write (oe# high to we# low) min 0 ns t elwl t cs ce# setup time min 0 ns t wheh t ch ce# hold time min 0 ns t wlwh t wp write pulse width min 35 40 ns t whdl t wph write pulse width high min 20 25 ns t sr/w latency between read and write operations min 0 ns t whwh1 t whwh1 programming operation (note 2) typ 6 s t whwh1 t whwh1 accelerated programming operation (note 2) typ 4 s t whwh2 t whwh2 sector erase operation (note 2) typ 0.5 sec t vcs v cc setup time (note 1) min 50 s t rb write recovery time from ry/by# min 0 ns t busy program/erase valid to ry/by# delay max 90 ns
68 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary timing diagrams notes: 1. pa = program address, pd = program data, d out is the true data at the program address figure 14. program operation timings figure 15. accelerated program timing diagram oe# we# ce# v cc data addresses t ds t ah t dh t wp pd t whwh1 t wc t as t wph t vcs 555h pa pa read status data (last two cycles) a0h t cs status d out program command sequence (last two cycles) ry/by# t rb t busy t ch pa w p#/acc t vhh v hh v il or v ih v il or v ih t vhh
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 69 preliminary notes: 1. sa = sector address (for sector erase), va = valid address for reading status data (see ?write operation status? figure 16. chip/sector erase operation timings figure 17. back-to-back read/write cycle timings oe# ce# addresses v cc we# data 2aah sa t ah t wp t wc t as t wph 555h for chip erase 10 for chip erase 30h t ds t vcs t cs t dh 55h t ch status d out t whwh2 va va erase command sequence (last two cycles) read status data ry/by# t rb t busy oe# ce# we# addresses t oh data valid in valid in valid pa valid ra t wc t wph t ah t wp t ds t dh t as t rc t ce t ah valid out t oe t acc t oeh t ghwl t df valid in ce# controlled write cycles we# controlled write cycle valid pa valid pa t cp t cph t wc t wc read cycle t sr/w t as
70 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary note: va = valid address. illustration shows first status cycle after command sequence, last status read cycle, and array data read cycle figure 18. data# polling timings (during embedded algorithms) notes: 1. va = valid address; not required for dq6. illustration shows first two status cycle after command sequence, last status read cycle, and array data read cycle figure 19. toggle bit timings (during embedded algorithms) we# ce# oe# high z t oe high z dq7 dq6?dq0 ry/by# t busy complement tr u e addresses va t oeh t ce t ch t oh t df va va status data complement status data tr u e valid data valid data t acc t rc oe# ce# we# addresses t oeh t dh t aht t aso t oeph t oe valid data (first read) (second read) (stops toggling) t ceph t aht t as dq6/dq2 valid dat a valid status valid status valid status ry/by#
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 71 preliminary protect/unprotect note: not 100% tested. note: note: dq2 toggles only when read at an address within an erase-suspended sector. the system may use oe# or ce# to toggle dq2 and dq6. figure 20. dq2 vs. dq6 ta b l e 2 2 . temporary sector unprotect parameter all speed options jedec std description unit t vidr v id rise and fall time (see note) min 500 ns t vhh v hh rise and fall time (see note) min 250 ns t rsp reset# setup time for temporary sector unprotect min 4 s t rrb reset# hold time from ry/by# high for temporary sector unprotect min 4 s figure 21. temporary sector unprotect timing diagram enter erase erase erase enter erase suspend program erase suspend read erase suspend read erase we# dq6 dq2 erase complete erase suspend suspend program resume embedded erasing r eset# t vidr v id v il or v ih v id v il or v ih ce# we# ry/by# t vidr t rsp program or erase command sequence t rrb
72 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary notes: 1. for sector protect, a6 = 0, a1 = 1, a0 = 0. for sector unprotect, a6 = 1, a1 = 1, a0 = 0. figure 22. sector/sector block protect a nd unprotect timing diagram sector group protect: 150 s sector group unprot ect: 15 ms 1 s r eset# sa, a6, a1, a0 data ce# we# oe# 60h 60h 40h valid* valid* valid* status sector group protect/unprotect verify v id v ih
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 73 preliminary controlled erase operations notes: 1. not 100% tested. 2. see the ?erase and programming perfo rmance? section for more information. ta b l e 2 3 . alternate ce# controlled erase and program operations parameter speed options jedec std description 55 60 65 70 unit t avav t wc write cycle time (note 1) min 55 60 65 70 ns t avwl t as address setup time min 0 ns t elax t ah address hold time min 30 35 ns t dveh t ds data setup time min 25 30 ns t ehdx t dh data hold time min 0 ns t ghel t ghel read recovery time before write (oe# high to we# low) min 0 ns t wlel t ws we# setup time min 0 ns t ehwh t wh we# hold time min 0 ns t eleh t cp ce# pulse width min 35 40 ns t ehel t cph ce# pulse width high min 20 25 ns t whwh1 t whwh1 programming operation (note 2) typ 6 s t whwh1 t whwh1 accelerated programming operation (note 2) typ 4 s t whwh2 t whwh2 sector erase operation (note 2) typ 0.5 sec
74 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary notes: 1. figure indicates last two bus cycles of a program or erase operation. 2. pa = program address, sa = sector address, pd = program data. 3. dq7# is the complement of th e data written to the device. d out is the data wri tten to the device ta b l e 2 4 . alternate ce# controlled write (erase/program) operation timings t ghel t ws oe# ce# we# reset# t ds data t ah addresses t dh t cp dq7# d out t wc t as t cph pa data# polling a0 for program 55 for erase t rh t whwh1 or 2 ry/by# t wh pd for program 30 for sector erase 10 for chip erase 555 for program 2aa for erase pa for program sa for sector erase 555 for chip erase t busy
august 12, 2004 s29pl1 27j_064j_032j_mcp_00_a3 s29pl127j/s29pl064j/s29pl032j for mcp 75 preliminary notes: 1. typical program and erase times assume the following conditions: 25 c, 3.0 v v cc , 100,000 cycles. additionally, programming typicals assume checkerboard pa ttern. all values are subject to change. 2. under worst case conditions of 90 c, v cc = 2.7 v, 100,000 cycles. all values are subject to change. 3. the typical chip programming time is considerably less th an the maximum chip programmi ng time listed, since most bytes program faster than th e maximum program times listed. 4. in the pre-programming step of the embedded erase al gorithm, all bytes are programmed to 00h before erasure. 5. system-level overhead is the time required to execut e the two- or four-bus-cycle sequence for the program command. see table 13 for further information on command definitions. 6. the device has a minimum erase and prog ram cycle endurance of 100,000 cycles. bga pin capacitance notes: 1. sampled, not 100% tested. 2. test conditions t a = 25c, f = 1.0 mhz. ta b l e 2 5 . erase and programming performance parameter ty p (note 1) max (note 2) unit comments sector erase time 0.5 2 sec excludes 00h programming prior to erasure (note 4) chip erase time pl127j 135 216 sec pl064j 71 113.6 sec pl032j 39 62.4 sec word program time 6 100 s excludes system level overhead (note 5) accelerated word program time 4 60 s chip program time (note 3) pl127j 50.4 200 sec pl064j 25.2 50.4 sec pl032j 12.6 25.2 sec parameter symbol parameter description te s t s e t u p ty p max unit c in input capacitance v in = 0 6.3 7 pf c out output capacitance v out = 0 7.0 8 pf c in2 control pin capacitance v in = 0 5.5 8 pf c in3 wp#/acc pin capacitance v in = 0 11 12 pf
76 s29pl127j/s29pl064j/s29pl032j for mcp s29pl127j_064j_032j_mcp_ 00_a3 august 12, 2004 preliminary
this document contains information on a product under developmen t at spansion llc. the information is intended to help you eval uate this product. spansion llc reserves the right to change or discontinue work on this proposed product without notice. publication number s29glxxxn_mcp revision a amendment 1 issue date december 15, 2004 advance information s29glxxxn mirrorbit tm flash family s29gl512n, s29gl256n, s29gl128n 512 megabit, 256 megabit, and 128 megabit, 3.0 volt-only page mode flash memory featuring 110 nm mirrorbit process technology data sheet distinctive characteristics architectural advantages ? single power supply operation ? 3 volt read, erase, and program operations ? enhanced versatilei/o ? control ? all input levels (address, co ntrol, and dq input levels) and outputs are determined by voltage on v io input. v io range is 1.65 to v cc ? manufactured on 110 nm mirrorbit process technology ? secured silicon sector region ? 128-word/256-byte sector for permanent, secure identification through an 8-word/16-byte random electronic serial numb er, accessible through a command sequence ? may be programmed and lock ed at the factory or by the customer ? flexible sector architecture ? s29gl512n: five hundred twelve 64 kword (128 kbyte) sectors ? s29gl256n: two hundred fifty-six 64 kword (128 kbyte) sectors ? s29gl128n: one hundred twenty-eight 64 kword (128 kbyte) sectors ? compatibility with jedec standards ? provides pinout and software compatibility for single- power supply flash, and superior inadvertent write protection ? 100,000 erase cycles per sector typical ? 20-year data retention typical performance characteristics ? high performance ? 90 ns access time (s29gl128n, s29gl256n, s29gl512n) ? 8-word/16-byte page read buffer ? 25 ns page read times ? 16-word/32-byte write buffer reduces overall programming time for mu ltiple-word updates ? low power consumption (typical values at 3.0 v, 5 mhz) ? 25 ma typical active read current; ? 50 ma typical erase/program current ? 1 a typical standby mode current software & hardware features ? software features ? program suspend & resume: read other sectors before programming operation is completed ? erase suspend & resume: read/program other sectors before an erase operation is completed ? data# polling & toggle bits provide status ? unlock bypass program command reduces overall multiple-word programming time ? cfi (common flash interface) compliant: allows host system to identify and accommodate multiple flash devices ? hardware features ? advanced sector protection ? wp#/acc input accelerates programming time (when high voltage is applied) for greater throughput during system production. prot ects first or last sector regardless of sector protection settings ? hardware reset input (reset#) resets device ? ready/busy# output (ry/by#) detects program or erase cycle completion
78 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information general description the s29gl512/256/128n family of devices are 3.0v single power flash memory manufactured using 110 nm mirrorbit technology. the s29gl512n is a 512 mbit, organized as 33,554,432 words or 67,108,864 bytes. the s29gl256n is a 256 mbit, organized as 16,777,216 words or 33,554,432 bytes. the s29gl128n is a 128 mbit, organized as 8,388,608 words or 16,777,216 bytes. the device can be programmed either in the host system or in standard eprom programmers. access times as fast as 90 ns (s29gl128n, s29gl256n, s29gl512n) are avail- able. note that each access time ha s a specific operating voltage range (v cc ) and an i/o voltage range (v io ), as specified in the ?product selector guide? section. the devices are offered in a 56-pin tsop or 64-ball fortified bga package. each device has separate chip enable (ce#), write enable (we#) and output enable (oe#) controls. each device requires only a single 3.0 volt power supply for both read and write functions. in addition to a v cc input, a high-voltage accelerated program ( wp#/ acc) input provides shorter programming times through increased cur- rent. this feature is intended to facili tate factory throughp ut during system production, but may also be used in the field if desired. the devices are entirely comm and set compatible with the jedec single- power-supply flash standard . commands are written to the device using standard microprocessor write timing. write cycles also internally latch addresses and data needed for the programming and erase operations. the sector erase architecture allows memory sectors to be erased and repro- grammed without affecting the data contents of other sectors. the device is fully erased when shipped from the factory. device programming and erasure are in itiated through command sequences. once a program or erase operation has beg un, the host system need only poll the dq7 (data# polling) or dq6 (toggle) status bits or monitor the ready/busy# (ry/by#) output to determine whether the op eration is complete. to facilitate programming, an unlock bypass mode reduces command sequence overhead by requiring only two write cycles to program data instead of four. the enhanced versatilei/o? (v io ) control allows the host system to set the voltage levels that the device generates and tolerates on all input levels (address, chip control, and dq input levels) to the same voltage level that is asserted on the v io pin. this allows the device to operate in a 1.8 v or 3 v system environ- ment as required. hardware data protection measures include a low v cc detector that automat- ically inhibits write operatio ns during power transitions. persistent sector protection provides in-system, command-enabled protection of any combina- tion of sectors using a single power supply at v cc . password sector protection prevents unauthorized write and erase operations in any combination of sectors through a user-defined 64-bit password. the erase suspend/erase resume feature allows the host system to pause an erase operation in a given sector to read or program any other sector and then complete the erase operation. the program suspend/program resume fea- ture enables the host system to pause a program operation in a given sector to read any other sector and then complete the program operation. the hardware reset# pin terminates any operation in progress and resets the device, after which it is then ready for a new operation. the reset# pin may be
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 79 advance information tied to the system reset circ uitry. a system reset would thus also reset the device, enabling the host system to read boot -up firmware from the flash memory device. the device reduces powe r consumption in the standby mode when it detects specific voltage levels on ce# and reset# , or when addresses have been stable for a specified period of time. the secured silicon sector provides a 128-word/256-byte area for code or data that can be permanently protected. on ce this sector is protected, no further changes within the sector can occur. the write protect (wp#/acc) feature protects the first or last sector by as- serting a logic low on the wp# pin. mirrorbit flash technology combines years of flash memory manufacturing expe- rience to produce the highest levels of quality, reliability and cost effectiveness. the device electrically erases all bits wi thin a sector simultaneously via hot-hole assisted erase. the data is programmed using hot electron injection.
80 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information product selector guide s29gl512n s29gl256n s29gl128n part number s29gl512n speed option v cc = 2.7?3.6 v v io = 2.7?3.6 v 10 11 v io = 1.65?1.95 v 11 v cc = 3.0-3.6v v io = 3.0-3.6v 90 max. access time (ns) 90 100 110 110 max. ce# access time (ns) 90 100 110 110 max. page access time (ns) 25 25 25 30 max. oe# access time (ns) 25 25 25 30 part number s29gl256n speed option v cc = 2.7?3.6 v v io = 2.7?3.6 v 10 11 v io = 1.65?1.95 v 11 v cc = regulated (3.0-3.6v) v io = regulated (3.0-3.6v) 90 max. access time (ns) 90 100 110 110 max. ce# access time (ns) 90 100 110 110 max. page access time (ns) 25 25 25 30 max. oe# access time (ns) 25 25 25 30 part number s29gl128n speed option v cc = 2.7?3.6 v v io = 2.7?3.6 v 10 11 v io = 1.65?1.95 v 11 v cc = regulated (3.0-3.6v) v io = regulated (3.0-3.6v) 90 max. access time (ns) 90 100 110 110 max. ce# access time (ns) 90 100 110 110 max. page access time (ns) 25 25 25 30 max. oe# access time (ns) 25 25 25 30
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 81 advance information block diagram notes: 1. a max gl512n = a24, a max gl256n = a23, a max gl128n = a22 input/output buffers x-decoder y-decoder chip enable output enable logic erase voltage generator pgm voltage generator timer v cc detector state control command register v cc v ss v io we# wp#/acc ce# oe# stb stb dq15 ? dq0 (a-1) sector switches ry/by# reset# data latch y-gating cell matrix address latch a max **?a0
82 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information pin description a24?a0 = 25 address inputs (512 mb) a23?a0 = 24 address inputs (256 mb) a22?a0 = 23 address inputs (128 mb) dq14?dq0 = 15 data inputs/outputs dq15/a-1 = dq15 (data input/output, word mode), a-1 (lsb address input ce# = chip enable input oe# = output enable input we# = write enable input wp#/acc = hardware write protect input; acceleration input reset# = hardware reset pin input ry/by# = ready/busy output v cc = 3.0 volt-only single power supply (see product selector guide for speed options and voltage supply tolerances) v io = output buffer power v ss = device ground nc = pin not connected internally
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 83 advance information logic symbol s29gl512n s29gl256n s29gl128n 25 16 or 8 dq15?dq0 (a-1) a24?a0 ce# oe# we# reset# ry/by# wp#/acc v io 24 16 or 8 dq15?dq0 (a-1) a23?a0 ce# oe# we# reset# ry/by# wp#/acc v io 23 16 or 8 dq15?dq0 (a-1) a22?a0 ce# oe# we# reset# ry/by# wp#/acc v io
84 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information device bus operations this section describes the requirements and use of the device bus operations, which are initiated through the internal command register. the command register itself does not occupy any addressable me mory location. the register is a latch used to store the commands, along wi th the address and data information needed to execute the command. the contents of the register serve as inputs to the internal state machine. the state mach ine outputs dictate the function of the device. ta b l e 1 lists the device bus operations, th e inputs and control levels they require, and the resulting output. the fo llowing subsections describe each of these operations in further detail. ta b l e 1 . device bus operations legend: l = logic low = v il , h = logic high = v ih , v id = 11.5?12.5 v, v hh = 11.5?12.5v, x = don?t care, sa = sector address, a in = address in, d in = data in, d out = data out notes: 1. addresses are amax:a0 in word mode. sector addresses are a max :a16 in both modes. 2. if wp# = v il , the first or last sector group remains protected. if wp# = v ih , the first or last sector will be protected or unprotected as determined by the method described in ?write protect (wp#)?. all sectors are unprotected when shipped from the factory (the secured silicon sector may be factory protected depending on version ordered.) 3. d in or d out as required by command sequence, data polling, or sector protect algorithm (see figure 2 , figure 4 , and figure 5 ). ve r s at i le i o tm (v io ) control the versatileio tm (v io ) control allows the host syst em to set the voltage levels that the device generates and tolerates on ce# and dq i/os to the same voltage level that is asserted on v io . see ordering information for v io options on this device. for example, a v i/o of 1.65 v to 3.6 v allows for i/o at the 1.8 or 3 volt levels, driving and receiving signals to and from other 1.8-v or 3-v devices on the same data bus. requirements for reading array data to read array data from the outputs, the system must drive the ce# and oe# pins to v il . ce# is the power control and sele cts the device. oe# is the output control and gates array data to the ou tput pins. we# should remain at v ih . the internal state machine is set for re ading array data upon device power-up, or after a hardware reset. this ensures th at no spurious alteration of the memory operation ce# oe# we# reset# wp#/ acc addresses (note 1) dq0?dq15 read l l h h x a in d out write (program/erase) l h l h note 2 a in (note 3) accelerated program l h l h v hh a in (note 3) standby v cc 0.3 v x x v cc 0.3 v hxhigh-z output disable l h h h x x high-z reset x x x l x x high-z
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 85 advance information content occurs during the power transiti on. no command is necessary in this mode to obtain array data. standard microprocessor re ad cycles that assert valid addresses on the device address inputs produce valid data on the device data outputs. the device remains enabled for read access until the command register contents are altered. see ?reading array data? on page 127 for more information. refer to the ac read-only operations table for timing specifications and to figure 11 for the tim- ing diagram. refer to the dc characte ristics table for the active current specification on reading array data. page mode read the device is capable of fast page mode read and is compatible with the page mode mask rom read operation. this mode provides faster read access speed for random locations within a page. the page size of the device is 8 words/16 bytes. the appropriate page is selected by the higher address bits a(max)?a3. address bits a2?a0 determine the specific word within a page. this is an asynchronous operation; the microprocessor supplies the specific word location. the random or initial page access is equal to t acc or t ce and subsequent page read accesses (as long as the location s specified by the microprocessor falls within that page) is equivalent to t pacc . when ce# is de-asserted and reasserted for a subsequent access, the access time is t acc or t ce . fast page mode accesses are obtained by keeping the ?read-page addresses? constant and changing the ?intra-read page? addresses. writing commands/command sequences to write a command or command sequence (which includes programming data to the device and erasing sectors of me mory), the system must drive we# and ce# to v il , and oe# to v ih . the device features an unlock bypass mode to facilitate faster programming. once the device enters the unlock bypa ss mode, only two write cycles are re- quired to program a word or byte, inst ead of four. the ?word program command sequence? section has details on progra mming data to the device using both standard and unlock bypass command sequences. an erase operation can erase one sector, multiple sectors, or the entire device. ta b l e 2 , ta b l e 4 , and ta b l e 5 indicate the address space that each sector occupies. refer to the dc characteristics table for the active current specification for the write mode. the ac characteristics sectio n contains timing specification tables and timing diagrams for write operations. write buffer write buffer programming allows the system write to a maximum of 16 words/32 bytes in one programming operation. this results in faster effective programming time than the standard programming al gorithms. see ?write buffer? for more information. accelerated program operation the device offers accelerated program op erations through the acc function. this is one of two functions provided by the wp#/acc pin. this function is primarily intended to allow faster manufactu ring throughput at the factory.
86 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information if the system asserts v hh on this pin, the device au tomatically ente rs the afore- mentioned unlock bypass mode, temporar ily unprotects any protected sector groups, and uses the higher voltage on th e pin to reduce the time required for program operations. the system would use a two-cycle program command se- quence as required by the unlock bypass mode. removing v hh from the wp#/ acc pin returns the device to normal operation. note that the wp#/acc pin must not be at v hh for operations other than accele rated programming, or device dam- age may result. wp# has an internal pu llup; when unconnected, wp# is at v ih . autoselect functions if the system writes the autoselect comma nd sequence, the device enters the au- toselect mode. the system can then read autoselect codes from the internal register (which is separate from the me mory array) on dq7?dq0. standard read cycle timings apply in this mode. refer to the ?autoselect mode? section on page 113 and ?autoselect command sequence? section on page 127 sections for more information. standby mode when the system is not reading or writing to the device, it can place the device in the standby mode. in this mode, curre nt consumption is greatly reduced, and the outputs are placed in the high impedance state, independent of the oe# input. the device enters the cmos standby mo de when the ce# and reset# pins are both held at v io 0.3 v. (note that this is a mo re restricted voltage range than v ih .) if ce# and reset# are held at v ih , but not within v io 0.3 v, the device will be in the standby mode, but the stan dby current will be greater. the device requires standard access time (t ce ) for read access when the device is in either of these standby modes, before it is ready to read data. if the device is deselected during erasure or programming, the device draws ac- tive current until the operation is completed. refer to the ?dc characteristics? section on page 151 for the standby current specification. automatic sleep mode the automatic sleep mode minimizes flas h device energy consumption. the de- vice automatically enables this mode when addresses remain stable for t acc + 30 ns. the automatic sleep mode is inde pendent of the ce#, we#, and oe# con- trol signals. standard address access timings provide new data when addresses are changed. while in sleep mode, output data is latched and always available to the system. refer to the ?dc characteristics? section on page 151 for the automatic sleep mode current specification. reset#: hardware reset pin the reset# pin provides a hardware meth od of resetting the device to reading array data. when the reset# pin is dr iven low for at least a period of t rp , the device immediately terminates any operat ion in progress, tr istates all output pins, and ignores all read/write commands for the duration of the reset# pulse. the device also resets the internal stat e machine to reading array data. the op- eration that was interrupted should be reinitiated once the device is ready to accept another command sequence , to ensure data integrity.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 87 advance information current is reduced for the duration of th e reset# pulse. when reset# is held at v ss 0.3 v, the device draws cmos standby current (i cc5 ). if reset# is held at v il but not within v ss 0.3 v, the standby current will be greater. the reset# pin may be tied to the system reset circuitry. a system reset would thus also reset the flash memory, enabling the system to read the boot-up firm- ware from the flash memory. refer to the ac characteristics tabl es for reset# parameters and to figure 13 for the timing diagram. output disable mode when the oe# input is at v ih , output from the device is disabled. the output pins are placed in the high impedance state. ta b l e 2 . sector address table?s29gl512n sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal) sa0 0 0 0 0 0 0 0 0 0 128/64 0000000?000ffff sa1 0 0 0 0 0 0 0 0 1 128/64 0010000?001ffff sa2 0 0 0 0 0 0 0 1 0 128/64 0020000?002ffff sa3 0 0 0 0 0 0 0 1 1 128/64 0030000?003ffff sa4 0 0 0 0 0 0 1 0 0 128/64 0040000?004ffff sa5 0 0 0 0 0 0 1 0 1 128/64 0050000?005ffff sa6 0 0 0 0 0 0 1 1 0 128/64 0060000?006ffff sa7 0 0 0 0 0 0 1 1 1 128/64 0070000?007ffff sa8 0 0 0 0 0 1 0 0 0 128/64 0080000?008ffff sa9 0 0 0 0 0 1 0 0 1 128/64 0090000?009ffff sa10 0 0 0 0 0 1 0 1 0 128/64 00a0000?00affff sa11 0 0 0 0 0 1 0 1 1 128/64 00b0000?00bffff sa12 0 0 0 0 0 1 1 0 0 128/64 00c0000?00cffff sa13 0 0 0 0 0 1 1 0 1 128/64 00d0000?00dffff sa14 0 0 0 0 0 1 1 1 0 128/64 00e0000?00effff sa15 0 0 0 0 0 1 1 1 1 128/64 00f0000?00fffff sa16 0 0 0 0 1 0 0 0 0 128/64 0100000?010ffff sa17 0 0 0 0 1 0 0 0 1 128/64 0110000?011ffff sa18 0 0 0 0 1 0 0 1 0 128/64 0120000?012ffff sa19 0 0 0 0 1 0 0 1 1 128/64 0130000?013ffff sa20 0 0 0 0 1 0 1 0 0 128/64 0140000?014ffff sa21 0 0 0 0 1 0 1 0 1 128/64 0150000?015ffff sa22 0 0 0 0 1 0 1 1 0 128/64 0160000?016ffff sa23 0 0 0 0 1 0 1 1 1 128/64 0170000?017ffff
88 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa24 0 0 0 0 1 1 0 0 0 128/64 0180000?018ffff sa25 0 0 0 0 1 1 0 0 1 128/64 0190000?019ffff sa26 0 0 0 0 1 1 0 1 0 128/64 01a0000?01affff sa27 0 0 0 0 1 1 0 1 1 128/64 01b0000?01bffff sa28 0 0 0 0 1 1 1 0 0 128/64 01c0000?01cffff sa29 0 0 0 0 1 1 1 0 1 128/64 01d0000?01dffff sa30 0 0 0 0 1 1 1 1 0 128/64 01e0000?01effff sa31 0 0 0 0 1 1 1 1 1 128/64 01f0000?01fffff sa32 0 0 0 1 0 0 0 0 0 128/64 0200000?020ffff sa33 0 0 0 1 0 0 0 0 1 128/64 0210000?021ffff sa34 0 0 0 1 0 0 0 1 0 128/64 0220000?022ffff sa35 0 0 0 1 0 0 0 1 1 128/64 0230000?023ffff sa36 0 0 0 1 0 0 1 0 0 128/64 0240000?024ffff sa37 0 0 0 1 0 0 1 0 1 128/64 0250000?025ffff sa38 0 0 0 1 0 0 1 1 0 128/64 0260000?026ffff sa39 0 0 0 1 0 0 1 1 1 128/64 0270000?027ffff sa40 0 0 0 1 0 1 0 0 0 128/64 0280000?028ffff sa41 0 0 0 1 0 1 0 0 1 128/64 0290000?029ffff sa42 0 0 0 1 0 1 0 1 0 128/64 02a0000?02affff sa43 0 0 0 1 0 1 0 1 1 128/64 02b0000?02bffff sa44 0 0 0 1 0 1 1 0 0 128/64 02c0000?02cffff sa45 0 0 0 1 0 1 1 0 1 128/64 02d0000?02dffff sa46 0 0 0 1 0 1 1 1 0 128/64 02e0000?02effff sa47 0 0 0 1 0 1 1 1 1 128/64 02f0000?02fffff sa48 0 0 0 1 1 0 0 0 0 128/64 0300000?030ffff sa49 0 0 0 1 1 0 0 0 1 128/64 0310000?031ffff sa50 0 0 0 1 1 0 0 1 0 128/64 0320000?032ffff sa51 0 0 0 1 1 0 0 1 1 128/64 0330000?033ffff sa52 0 0 0 1 1 0 1 0 0 128/64 0340000?034ffff sa53 0 0 0 1 1 0 1 0 1 128/64 0350000?035ffff sa54 0 0 0 1 1 0 1 1 0 128/64 0360000?036ffff sa55 0 0 0 1 1 0 1 1 1 128/64 0370000?037ffff sa56 0 0 0 1 1 1 0 0 0 128/64 0380000?038ffff sa57 0 0 0 1 1 1 0 0 1 128/64 0390000?039ffff sa58 0 0 0 1 1 1 0 1 0 128/64 03a0000?03affff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 89 advance information sa59 0 0 0 1 1 1 0 1 1 128/64 03b0000?03bffff sa60 0 0 0 1 1 1 1 0 0 128/64 03c0000?03cffff sa61 0 0 0 1 1 1 1 0 1 128/64 03d0000?03dffff sa62 0 0 0 1 1 1 1 1 0 128/64 03e0000?03effff sa63 0 0 0 1 1 1 1 1 1 128/64 03f0000?03fffff sa64 0 0 1 0 0 0 0 0 0 128/64 0400000?040ffff sa65 0 0 1 0 0 0 0 0 1 128/64 0410000?041ffff sa66 0 0 1 0 0 0 0 1 0 128/64 0420000?042ffff sa67 0 0 1 0 0 0 0 1 1 128/64 0430000?043ffff sa68 0 0 1 0 0 0 1 0 0 128/64 0440000?044ffff sa69 0 0 1 0 0 0 1 0 1 128/64 0450000?045ffff sa70 0 0 1 0 0 0 1 1 0 128/64 0460000?046ffff sa71 0 0 1 0 0 0 1 1 1 128/64 0470000?047ffff sa72 0 0 1 0 0 1 0 0 0 128/64 0480000?048ffff sa73 0 0 1 0 0 1 0 0 1 128/64 0490000?049ffff sa74 0 0 1 0 0 1 0 1 0 128/64 04a0000?04affff sa75 0 0 1 0 0 1 0 1 1 128/64 04b0000?04bffff sa76 0 0 1 0 0 1 1 0 0 128/64 04c0000?04cffff sa77 0 0 1 0 0 1 1 0 1 128/64 04d0000?04dffff sa78 0 0 1 0 0 1 1 1 0 128/64 04e0000?04effff sa79 0 0 1 0 0 1 1 1 1 128/64 04f0000?04fffff sa80 0 0 1 0 1 0 0 0 0 128/64 0500000?050ffff sa81 0 0 1 0 1 0 0 0 1 128/64 0510000?051ffff sa82 0 0 1 0 1 0 0 1 0 128/64 0520000?052ffff sa83 0 0 1 0 1 0 0 1 1 128/64 0530000?053ffff sa84 0 0 1 0 1 0 1 0 0 128/64 0540000?054ffff sa85 0 0 1 0 1 0 1 0 1 128/64 0550000?055ffff sa86 0 0 1 0 1 0 1 1 0 128/64 0560000?056ffff sa87 0 0 1 0 1 0 1 1 1 128/64 0570000?057ffff sa88 0 0 1 0 1 1 0 0 0 128/64 0580000?058ffff sa89 0 0 1 0 1 1 0 0 1 128/64 0590000?059ffff sa90 0 0 1 0 1 1 0 1 0 128/64 05a0000?05affff sa91 0 0 1 0 1 1 0 1 1 128/64 05b0000?05bffff sa92 0 0 1 0 1 1 1 0 0 128/64 05c0000?05cffff sa93 0 0 1 0 1 1 1 0 1 128/64 05d0000?05dffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
90 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa94 0 0 1 0 1 1 1 1 0 128/64 05e0000?05effff sa95 0 0 1 0 1 1 1 1 1 128/64 05f0000?05fffff sa96 0 0 1 1 0 0 0 0 0 128/64 0600000?060ffff sa97 0 0 1 1 0 0 0 0 1 128/64 0610000?061ffff sa98 0 0 1 1 0 0 0 1 0 128/64 0620000?062ffff sa99 0 0 1 1 0 0 0 1 1 128/64 0630000?063ffff sa100 0 0 1 1 0 0 1 0 0 128/64 0640000?064ffff sa101 0 0 1 1 0 0 1 0 1 128/64 0650000?065ffff sa102 0 0 1 1 0 0 1 1 0 128/64 0660000?066ffff sa103 0 0 1 1 0 0 1 1 1 128/64 0670000?067ffff sa104 0 0 1 1 0 1 0 0 0 128/64 0680000?068ffff sa105 0 0 1 1 0 1 0 0 1 128/64 0690000?069ffff sa106 0 0 1 1 0 1 0 1 0 128/64 06a0000?06affff sa107 0 0 1 1 0 1 0 1 1 128/64 06b0000?06bffff sa108 0 0 1 1 0 1 1 0 0 128/64 06c0000?06cffff sa109 0 0 1 1 0 1 1 0 1 128/64 06d0000?06dffff sa110 0 0 1 1 0 1 1 1 0 128/64 06e0000?06effff sa111 0 0 1 1 0 1 1 1 1 128/64 06f0000?06fffff sa112 0 0 1 1 1 0 0 0 0 128/64 0700000?070ffff sa113 0 0 1 1 1 0 0 0 1 128/64 0710000?071ffff sa114 0 0 1 1 1 0 0 1 0 128/64 0720000?072ffff sa115 0 0 1 1 1 0 0 1 1 128/64 0730000?073ffff sa116 0 0 1 1 1 0 1 0 0 128/64 0740000?074ffff sa117 0 0 1 1 1 0 1 0 1 128/64 0750000?075ffff sa118 0 0 1 1 1 0 1 1 0 128/64 0760000?076ffff sa119 0 0 1 1 1 0 1 1 1 128/64 0770000?077ffff sa120 0 0 1 1 1 1 0 0 0 128/64 0780000?078ffff sa121 0 0 1 1 1 1 0 0 1 128/64 0790000?079ffff sa122 0 0 1 1 1 1 0 1 0 128/64 07a0000?07affff sa123 0 0 1 1 1 1 0 1 1 128/64 07b0000?07bffff sa124 0 0 1 1 1 1 1 0 0 128/64 07c0000?07cffff sa125 0 0 1 1 1 1 1 0 1 128/64 07d0000?07dffff sa126 0 0 1 1 1 1 1 1 0 128/64 07e0000?07effff sa127 0 0 1 1 1 1 1 1 1 128/64 07f0000?07fffff sa128 0 1 0 0 0 0 0 0 0 128/64 0800000?080ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 91 advance information sa129 0 1 0 0 0 0 0 0 1 128/64 0810000?081ffff sa130 0 1 0 0 0 0 0 1 0 128/64 0820000?082ffff sa131 0 1 0 0 0 0 0 1 1 128/64 0830000?083ffff sa132 0 1 0 0 0 0 1 0 0 128/64 0840000?084ffff sa133 0 1 0 0 0 0 1 0 1 128/64 0850000?085ffff sa134 0 1 0 0 0 0 1 1 0 128/64 0860000?086ffff sa135 0 1 0 0 0 0 1 1 1 128/64 0870000?087ffff sa136 0 1 0 0 0 1 0 0 0 128/64 0880000?088ffff sa137 0 1 0 0 0 1 0 0 1 128/64 0890000?089ffff sa138 0 1 0 0 0 1 0 1 0 128/64 08a0000?08affff sa139 0 1 0 0 0 1 0 1 1 128/64 08b0000?08bffff sa140 0 1 0 0 0 1 1 0 0 128/64 08c0000?08cffff sa141 0 1 0 0 0 1 1 0 1 128/64 08d0000?08dffff sa142 0 1 0 0 0 1 1 1 0 128/64 08e0000?08effff sa143 0 1 0 0 0 1 1 1 1 128/64 08f0000?08fffff sa144 0 1 0 0 1 0 0 0 0 128/64 0900000?090ffff sa145 0 1 0 0 1 0 0 0 1 128/64 0910000?091ffff sa146 0 1 0 0 1 0 0 1 0 128/64 0920000?092ffff sa147 0 1 0 0 1 0 0 1 1 128/64 0930000?093ffff sa148 0 1 0 0 1 0 1 0 0 128/64 0940000?094ffff sa149 0 1 0 0 1 0 1 0 1 128/64 0950000?095ffff sa150 0 1 0 0 1 0 1 1 0 128/64 0960000?096ffff sa151 0 1 0 0 1 0 1 1 1 128/64 0970000?097ffff sa152 0 1 0 0 1 1 0 0 0 128/64 0980000?098ffff sa153 0 1 0 0 1 1 0 0 1 128/64 0990000?099ffff sa154 0 1 0 0 1 1 0 1 0 128/64 09a0000?09affff sa155 0 1 0 0 1 1 0 1 1 128/64 09b0000?09bffff sa156 0 1 0 0 1 1 1 0 0 128/64 09c0000?09cffff sa157 0 1 0 0 1 1 1 0 1 128/64 09d0000?09dffff sa158 0 1 0 0 1 1 1 1 0 128/64 09e0000?09effff sa159 0 1 0 0 1 1 1 1 1 128/64 09f0000?09fffff sa160 0 1 0 1 0 0 0 0 0 128/64 0a00000?0a0ffff sa161 0 1 0 1 0 0 0 0 1 128/64 0a10000?0a1ffff sa162 0 1 0 1 0 0 0 1 0 128/64 0a20000?0a2ffff sa163 0 1 0 1 0 0 0 1 1 128/64 0a30000?0a3ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
92 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa164 0 1 0 1 0 0 1 0 0 128/64 0a40000?0a4ffff sa165 0 1 0 1 0 0 1 0 1 128/64 0a50000?0a5ffff sa166 0 1 0 1 0 0 1 1 0 128/64 0a60000?0a6ffff sa167 0 1 0 1 0 0 1 1 1 128/64 0a70000?0a7ffff sa168 0 1 0 1 0 1 0 0 0 128/64 0a80000?0a8ffff sa169 0 1 0 1 0 1 0 0 1 128/64 0a90000?0a9ffff sa170 0 1 0 1 0 1 0 1 0 128/64 0aa0000?0aaffff sa171 0 1 0 1 0 1 0 1 1 128/64 0ab0000?0abffff sa172 0 1 0 1 0 1 1 0 0 128/64 0ac0000?0acffff sa173 0 1 0 1 0 1 1 0 1 128/64 0ad0000?0adffff sa174 0 1 0 1 0 1 1 1 0 128/64 0ae0000?0aeffff sa175 0 1 0 1 0 1 1 1 1 128/64 0af0000?0afffff sa176 0 1 0 1 1 0 0 0 0 128/64 0b00000?0b0ffff sa177 0 1 0 1 1 0 0 0 1 128/64 0b10000?0b1ffff sa178 0 1 0 1 1 0 0 1 0 128/64 0b20000?0b2ffff sa179 0 1 0 1 1 0 0 1 1 128/64 0b30000?0b3ffff sa180 0 1 0 1 1 0 1 0 0 128/64 0b40000?0b4ffff sa181 0 1 0 1 1 0 1 0 1 128/64 0b50000?0b5ffff sa182 0 1 0 1 1 0 1 1 0 128/64 0b60000?0b6ffff sa183 0 1 0 1 1 0 1 1 1 128/64 0b70000?0b7ffff sa184 0 1 0 1 1 1 0 0 0 128/64 0b80000?0b8ffff sa185 0 1 0 1 1 1 0 0 1 128/64 0b90000?0b9ffff sa186 0 1 0 1 1 1 0 1 0 128/64 0ba0000?0baffff sa187 0 1 0 1 1 1 0 1 1 128/64 0bb0000?0bbffff sa188 0 1 0 1 1 1 1 0 0 128/64 0bc0000?0bcffff sa189 0 1 0 1 1 1 1 0 1 128/64 0bd0000?0bdffff sa190 0 1 0 1 1 1 1 1 0 128/64 0be0000?0beffff sa191 0 1 0 1 1 1 1 1 1 128/64 0bf0000?0bfffff sa192 0 1 1 0 0 0 0 0 0 128/64 0c00000?0c0ffff sa193 0 1 1 0 0 0 0 0 1 128/64 0c10000?0c1ffff sa194 0 1 1 0 0 0 0 1 0 128/64 0c20000?0c2ffff sa195 0 1 1 0 0 0 0 1 1 128/64 0c30000?0c3ffff sa196 0 1 1 0 0 0 1 0 0 128/64 0c40000?0c4ffff sa197 0 1 1 0 0 0 1 0 1 128/64 0c50000?0c5ffff sa198 0 1 1 0 0 0 1 1 0 128/64 0c60000?0c6ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 93 advance information sa199 0 1 1 0 0 0 1 1 1 128/64 0c70000?0c7ffff sa200 0 1 1 0 0 1 0 0 0 128/64 0c80000?0c8ffff sa201 0 1 1 0 0 1 0 0 1 128/64 0c90000?0c9ffff sa202 0 1 1 0 0 1 0 1 0 128/64 0ca0000?0caffff sa203 0 1 1 0 0 1 0 1 1 128/64 0cb0000?0cbffff sa204 0 1 1 0 0 1 1 0 0 128/64 0cc0000?0ccffff sa205 0 1 1 0 0 1 1 0 1 128/64 0cd0000?0cdffff sa206 0 1 1 0 0 1 1 1 0 128/64 0ce0000?0ceffff sa207 0 1 1 0 0 1 1 1 1 128/64 0cf0000?0cfffff sa208 0 1 1 0 1 0 0 0 0 128/64 0d00000?0d0ffff sa209 0 1 1 0 1 0 0 0 1 128/64 0d10000?0d1ffff sa210 0 1 1 0 1 0 0 1 0 128/64 0d20000?0d2ffff sa211 0 1 1 0 1 0 0 1 1 128/64 0d30000?0d3ffff sa212 0 1 1 0 1 0 1 0 0 128/64 0d40000?0d4ffff sa213 0 1 1 0 1 0 1 0 1 128/64 0d50000?0d5ffff sa214 0 1 1 0 1 0 1 1 0 128/64 0d60000?0d6ffff sa215 0 1 1 0 1 0 1 1 1 128/64 0d70000?0d7ffff sa216 0 1 1 0 1 1 0 0 0 128/64 0d80000?0d8ffff sa217 0 1 1 0 1 1 0 0 1 128/64 0d90000?0d9ffff sa218 0 1 1 0 1 1 0 1 0 128/64 0da0000?0daffff sa219 0 1 1 0 1 1 0 1 1 128/64 0db0000?0dbffff sa220 0 1 1 0 1 1 1 0 0 128/64 0dc0000?0dcffff sa221 0 1 1 0 1 1 1 0 1 128/64 0dd0000?0ddffff sa222 0 1 1 0 1 1 1 1 0 128/64 0de0000?0deffff sa223 0 1 1 0 1 1 1 1 1 128/64 0df0000?0dfffff sa224 0 1 1 1 0 0 0 0 0 128/64 0e00000?0e0ffff sa225 0 1 1 1 0 0 0 0 1 128/64 0e10000?0e1ffff sa226 0 1 1 1 0 0 0 1 0 128/64 0e20000?0e2ffff sa227 0 1 1 1 0 0 0 1 1 128/64 0e30000?0e3ffff sa228 0 1 1 1 0 0 1 0 0 128/64 0e40000?0e4ffff sa229 0 1 1 1 0 0 1 0 1 128/64 0e50000?0e5ffff sa230 0 1 1 1 0 0 1 1 0 128/64 0e60000?0e6ffff sa231 0 1 1 1 0 0 1 1 1 128/64 0e70000?0e7ffff sa232 0 1 1 1 0 1 0 0 0 128/64 0e80000?0e8ffff sa233 0 1 1 1 0 1 0 0 1 128/64 0e90000?0e9ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
94 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa234 0 1 1 1 0 1 0 1 0 128/64 0ea0000?0eaffff sa235 0 1 1 1 0 1 0 1 1 128/64 0eb0000?0ebffff sa236 0 1 1 1 0 1 1 0 0 128/64 0ec0000?0ecffff sa237 0 1 1 1 0 1 1 0 1 128/64 0ed0000?0edffff sa238 0 1 1 1 0 1 1 1 0 128/64 0ee0000?0eeffff sa239 0 1 1 1 0 1 1 1 1 128/64 0ef0000?0efffff sa240 0 1 1 1 1 0 0 0 0 128/64 0f00000?0f0ffff sa241 0 1 1 1 1 0 0 0 1 128/64 0f10000?0f1ffff sa242 0 1 1 1 1 0 0 1 0 128/64 0f20000?0f2ffff sa243 0 1 1 1 1 0 0 1 1 128/64 0f30000?0f3ffff sa244 0 1 1 1 1 0 1 0 0 128/64 0f40000?0f4ffff sa245 0 1 1 1 1 0 1 0 1 128/64 0f50000?0f5ffff sa246 0 1 1 1 1 0 1 1 0 128/64 0f60000?0f6ffff sa247 0 1 1 1 1 0 1 1 1 128/64 0f70000?0f7ffff sa248 0 1 1 1 1 1 0 0 0 128/64 0f80000?0f8ffff sa249 0 1 1 1 1 1 0 0 1 128/64 0f90000?0f9ffff sa250 0 1 1 1 1 1 0 1 0 128/64 0fa0000?0faffff sa251 0 1 1 1 1 1 0 1 1 128/64 0fb0000?0fbffff sa252 0 1 1 1 1 1 1 0 0 128/64 0fc0000?0fcffff sa253 0 1 1 1 1 1 1 0 1 128/64 0fd0000?0fdffff sa254 0 1 1 1 1 1 1 1 0 128/64 0fe0000?0feffff sa255 0 1 1 1 1 1 1 1 1 128/64 0ff0000?0ffffff sa256 1 0 0 0 0 0 0 0 0 128/64 1000000?100ffff sa257 1 0 0 0 0 0 0 0 1 128/64 1010000?101ffff sa258 1 0 0 0 0 0 0 1 0 128/64 1020000?102ffff sa259 1 0 0 0 0 0 0 1 1 128/64 1030000?103ffff sa260 1 0 0 0 0 0 1 0 0 128/64 1040000?104ffff sa261 1 0 0 0 0 0 1 0 1 128/64 1050000?105ffff sa262 1 0 0 0 0 0 1 1 0 128/64 1060000?106ffff sa263 1 0 0 0 0 0 1 1 1 128/64 1070000?107ffff sa264 1 0 0 0 0 1 0 0 0 128/64 1080000?108ffff sa265 1 0 0 0 0 1 0 0 1 128/64 1090000?109ffff sa266 1 0 0 0 0 1 0 1 0 128/64 10a0000?10affff sa267 1 0 0 0 0 1 0 1 1 128/64 10b0000?10bffff sa268 1 0 0 0 0 1 1 0 0 128/64 10c0000?10cffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 95 advance information sa269 1 0 0 0 0 1 1 0 1 128/64 10d0000?10dffff sa270 1 0 0 0 0 1 1 1 0 128/64 10e0000?10effff sa271 1 0 0 0 0 1 1 1 1 128/64 10f0000?10fffff sa272 1 0 0 0 1 0 0 0 0 128/64 1100000?110ffff sa273 1 0 0 0 1 0 0 0 1 128/64 1110000?111ffff sa274 1 0 0 0 1 0 0 1 0 128/64 1120000?112ffff sa275 1 0 0 0 1 0 0 1 1 128/64 1130000?113ffff sa276 1 0 0 0 1 0 1 0 0 128/64 1140000?114ffff sa277 1 0 0 0 1 0 1 0 1 128/64 1150000?115ffff sa278 1 0 0 0 1 0 1 1 0 128/64 1160000?116ffff sa279 1 0 0 0 1 0 1 1 1 128/64 1170000?117ffff sa280 1 0 0 0 1 1 0 0 0 128/64 1180000?118ffff sa281 1 0 0 0 1 1 0 0 1 128/64 1190000?119ffff sa282 1 0 0 0 1 1 0 1 0 128/64 11a0000?11affff sa283 1 0 0 0 1 1 0 1 1 128/64 11b0000?11bffff sa284 1 0 0 0 1 1 1 0 0 128/64 11c0000?11cffff sa285 1 0 0 0 1 1 1 0 1 128/64 11d0000?11dffff sa286 1 0 0 0 1 1 1 1 0 128/64 11e0000?11effff sa287 1 0 0 0 1 1 1 1 1 128/64 11f0000?11fffff sa288 1 0 0 1 0 0 0 0 0 128/64 1200000?120ffff sa289 1 0 0 1 0 0 0 0 1 128/64 1210000?121ffff sa290 1 0 0 1 0 0 0 1 0 128/64 1220000?122ffff sa291 1 0 0 1 0 0 0 1 1 128/64 1230000?123ffff sa292 1 0 0 1 0 0 1 0 0 128/64 1240000?124ffff sa293 1 0 0 1 0 0 1 0 1 128/64 1250000?125ffff sa294 1 0 0 1 0 0 1 1 0 128/64 1260000?126ffff sa295 1 0 0 1 0 0 1 1 1 128/64 1270000?127ffff sa296 1 0 0 1 0 1 0 0 0 128/64 1280000?128ffff sa297 1 0 0 1 0 1 0 0 1 128/64 1290000?129ffff sa298 1 0 0 1 0 1 0 1 0 128/64 12a0000?12affff sa299 1 0 0 1 0 1 0 1 1 128/64 12b0000?12bffff sa300 1 0 0 1 0 1 1 0 0 128/64 12c0000?12cffff sa301 1 0 0 1 0 1 1 0 1 128/64 12d0000?12dffff sa302 1 0 0 1 0 1 1 1 0 128/64 12e0000?12effff sa303 1 0 0 1 0 1 1 1 1 128/64 12f0000?12fffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
96 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa304 1 0 0 1 1 0 0 0 0 128/64 1300000?130ffff sa305 1 0 0 1 1 0 0 0 1 128/64 1310000?131ffff sa306 1 0 0 1 1 0 0 1 0 128/64 1320000?132ffff sa307 1 0 0 1 1 0 0 1 1 128/64 1330000?133ffff sa308 1 0 0 1 1 0 1 0 0 128/64 1340000?134ffff sa309 1 0 0 1 1 0 1 0 1 128/64 1350000?135ffff sa310 1 0 0 1 1 0 1 1 0 128/64 1360000?136ffff sa311 1 0 0 1 1 0 1 1 1 128/64 1370000?137ffff sa312 1 0 0 1 1 1 0 0 0 128/64 1380000?138ffff sa313 1 0 0 1 1 1 0 0 1 128/64 1390000?139ffff sa314 1 0 0 1 1 1 0 1 0 128/64 13a0000?13affff sa315 1 0 0 1 1 1 0 1 1 128/64 13b0000?13bffff sa316 1 0 0 1 1 1 1 0 0 128/64 13c0000?13cffff sa317 1 0 0 1 1 1 1 0 1 128/64 13d0000?13dffff sa318 1 0 0 1 1 1 1 1 0 128/64 13e0000?13effff sa319 1 0 0 1 1 1 1 1 1 128/64 13f0000?13fffff sa320 1 0 1 0 0 0 0 0 0 128/64 1400000?140ffff sa321 1 0 1 0 0 0 0 0 1 128/64 1410000?141ffff sa322 1 0 1 0 0 0 0 1 0 128/64 1420000?142ffff sa323 1 0 1 0 0 0 0 1 1 128/64 1430000?143ffff sa324 1 0 1 0 0 0 1 0 0 128/64 1440000?144ffff sa325 1 0 1 0 0 0 1 0 1 128/64 1450000?145ffff sa326 1 0 1 0 0 0 1 1 0 128/64 1460000?146ffff sa327 1 0 1 0 0 0 1 1 1 128/64 1470000?147ffff sa328 1 0 1 0 0 1 0 0 0 128/64 1480000?148ffff sa329 1 0 1 0 0 1 0 0 1 128/64 1490000?149ffff sa330 1 0 1 0 0 1 0 1 0 128/64 14a0000?14affff sa331 1 0 1 0 0 1 0 1 1 128/64 14b0000?14bffff sa332 1 0 1 0 0 1 1 0 0 128/64 14c0000?14cffff sa333 1 0 1 0 0 1 1 0 1 128/64 14d0000?14dffff sa334 1 0 1 0 0 1 1 1 0 128/64 14e0000?14effff sa335 1 0 1 0 0 1 1 1 1 128/64 14f0000?14fffff sa336 1 0 1 0 1 0 0 0 0 128/64 1500000?150ffff sa337 1 0 1 0 1 0 0 0 1 128/64 1510000?151ffff sa338 1 0 1 0 1 0 0 1 0 128/64 1520000?152ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 97 advance information sa339 1 0 1 0 1 0 0 1 1 128/64 1530000?153ffff sa340 1 0 1 0 1 0 1 0 0 128/64 1540000?154ffff sa341 1 0 1 0 1 0 1 0 1 128/64 1550000?155ffff sa342 1 0 1 0 1 0 1 1 0 128/64 1560000?156ffff sa343 1 0 1 0 1 0 1 1 1 128/64 1570000?157ffff sa344 1 0 1 0 1 1 0 0 0 128/64 1580000?158ffff sa345 1 0 1 0 1 1 0 0 1 128/64 1590000?159ffff sa346 1 0 1 0 1 1 0 1 0 128/64 15a0000?15affff sa347 1 0 1 0 1 1 0 1 1 128/64 15b0000?15bffff sa348 1 0 1 0 1 1 1 0 0 128/64 15c0000?15cffff sa349 1 0 1 0 1 1 1 0 1 128/64 15d0000?15dffff sa350 1 0 1 0 1 1 1 1 0 128/64 15e0000?15effff sa351 1 0 1 0 1 1 1 1 1 128/64 15f0000?15fffff sa352 1 0 1 1 0 0 0 0 0 128/64 1600000?160ffff sa353 1 0 1 1 0 0 0 0 1 128/64 1610000?161ffff sa354 1 0 1 1 0 0 0 1 0 128/64 1620000?162ffff sa355 1 0 1 1 0 0 0 1 1 128/64 1630000?163ffff sa356 1 0 1 1 0 0 1 0 0 128/64 1640000?164ffff sa357 1 0 1 1 0 0 1 0 1 128/64 1650000?165ffff sa358 1 0 1 1 0 0 1 1 0 128/64 1660000?166ffff sa359 1 0 1 1 0 0 1 1 1 128/64 1670000?167ffff sa360 1 0 1 1 0 1 0 0 0 128/64 1680000?168ffff sa361 1 0 1 1 0 1 0 0 1 128/64 1690000?169ffff sa362 1 0 1 1 0 1 0 1 0 128/64 16a0000?16affff sa363 1 0 1 1 0 1 0 1 1 128/64 16b0000?16bffff sa364 1 0 1 1 0 1 1 0 0 128/64 16c0000?16cffff sa365 1 0 1 1 0 1 1 0 1 128/64 16d0000?16dffff sa366 1 0 1 1 0 1 1 1 0 128/64 16e0000?16effff sa367 1 0 1 1 0 1 1 1 1 128/64 16f0000?16fffff sa368 1 0 1 1 1 0 0 0 0 128/64 1700000?170ffff sa369 1 0 1 1 1 0 0 0 1 128/64 1710000?171ffff sa370 1 0 1 1 1 0 0 1 0 128/64 1720000?172ffff sa371 1 0 1 1 1 0 0 1 1 128/64 1730000?173ffff sa372 1 0 1 1 1 0 1 0 0 128/64 1740000?174ffff sa373 1 0 1 1 1 0 1 0 1 128/64 1750000?175ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
98 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa374 1 0 1 1 1 0 1 1 0 128/64 1760000?176ffff sa375 1 0 1 1 1 0 1 1 1 128/64 1770000?177ffff sa376 1 0 1 1 1 1 0 0 0 128/64 1780000?178ffff sa377 1 0 1 1 1 1 0 0 1 128/64 1790000?179ffff sa378 1 0 1 1 1 1 0 1 0 128/64 17a0000?17affff sa379 1 0 1 1 1 1 0 1 1 128/64 17b0000?17bffff sa380 1 0 1 1 1 1 1 0 0 128/64 17c0000?17cffff sa381 1 0 1 1 1 1 1 0 1 128/64 17d0000?17dffff sa382 1 0 1 1 1 1 1 1 0 128/64 17e0000?17effff sa383 1 0 1 1 1 1 1 1 1 128/64 17f0000?17fffff sa384 1 1 0 0 0 0 0 0 0 128/64 1800000?180ffff sa385 1 1 0 0 0 0 0 0 1 128/64 1810000?181ffff sa386 1 1 0 0 0 0 0 1 0 128/64 1820000?182ffff sa387 1 1 0 0 0 0 0 1 1 128/64 1830000?183ffff sa388 1 1 0 0 0 0 1 0 0 128/64 1840000?184ffff sa389 1 1 0 0 0 0 1 0 1 128/64 1850000?185ffff sa390 1 1 0 0 0 0 1 1 0 128/64 1860000?186ffff sa391 1 1 0 0 0 0 1 1 1 128/64 1870000?187ffff sa392 1 1 0 0 0 1 0 0 0 128/64 1880000?188ffff sa393 1 1 0 0 0 1 0 0 1 128/64 1890000?189ffff sa394 1 1 0 0 0 1 0 1 0 128/64 18a0000?18affff sa395 1 1 0 0 0 1 0 1 1 128/64 18b0000?18bffff sa396 1 1 0 0 0 1 1 0 0 128/64 18c0000?18cffff sa397 1 1 0 0 0 1 1 0 1 128/64 18d0000?18dffff sa398 1 1 0 0 0 1 1 1 0 128/64 18e0000?18effff sa399 1 1 0 0 0 1 1 1 1 128/64 18f0000?18fffff sa400 1 1 0 0 1 0 0 0 0 128/64 1900000?190ffff sa401 1 1 0 0 1 0 0 0 1 128/64 1910000?191ffff sa402 1 1 0 0 1 0 0 1 0 128/64 1920000?192ffff sa403 1 1 0 0 1 0 0 1 1 128/64 1930000?193ffff sa404 1 1 0 0 1 0 1 0 0 128/64 1940000?194ffff sa405 1 1 0 0 1 0 1 0 1 128/64 1950000?195ffff sa406 1 1 0 0 1 0 1 1 0 128/64 1960000?196ffff sa407 1 1 0 0 1 0 1 1 1 128/64 1970000?197ffff sa408 1 1 0 0 1 1 0 0 0 128/64 1980000?198ffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 99 advance information sa409 1 1 0 0 1 1 0 0 1 128/64 1990000?199ffff sa410 1 1 0 0 1 1 0 1 0 128/64 19a0000?19affff sa411 1 1 0 0 1 1 0 1 1 128/64 19b0000?19bffff sa412 1 1 0 0 1 1 1 0 0 128/64 19c0000?19cffff sa413 1 1 0 0 1 1 1 0 1 128/64 19d0000?19dffff sa414 1 1 0 0 1 1 1 1 0 128/64 19e0000?19effff sa415 1 1 0 0 1 1 1 1 1 128/64 19f0000?19fffff sa416 1 1 0 1 0 0 0 0 0 128/64 1a00000?1a0ffff sa417 1 1 0 1 0 0 0 0 1 128/64 1a10000?1a1ffff sa418 1 1 0 1 0 0 0 1 0 128/64 1a20000?1a2ffff sa419 1 1 0 1 0 0 0 1 1 128/64 1a30000?1a3ffff sa420 1 1 0 1 0 0 1 0 0 128/64 1a40000?1a4ffff sa421 1 1 0 1 0 0 1 0 1 128/64 1a50000?1a5ffff sa422 1 1 0 1 0 0 1 1 0 128/64 1a60000?1a6ffff sa423 1 1 0 1 0 0 1 1 1 128/64 1a70000?1a7ffff sa424 1 1 0 1 0 1 0 0 0 128/64 1a80000?1a8ffff sa425 1 1 0 1 0 1 0 0 1 128/64 1a90000?1a9ffff sa426 1 1 0 1 0 1 0 1 0 128/64 1aa0000?1aaffff sa427 1 1 0 1 0 1 0 1 1 128/64 1ab0000?1abffff sa428 1 1 0 1 0 1 1 0 0 128/64 1ac0000?1acffff sa429 1 1 0 1 0 1 1 0 1 128/64 1ad0000?1adffff sa430 1 1 0 1 0 1 1 1 0 128/64 1ae0000?1aeffff sa431 1 1 0 1 0 1 1 1 1 128/64 1af0000?1afffff sa432 1 1 0 1 1 0 0 0 0 128/64 1b00000?1b0ffff sa433 1 1 0 1 1 0 0 0 1 128/64 1b10000?1b1ffff sa434 1 1 0 1 1 0 0 1 0 128/64 1b20000?1b2ffff sa435 1 1 0 1 1 0 0 1 1 128/64 1b30000?1b3ffff sa436 1 1 0 1 1 0 1 0 0 128/64 1b40000?1b4ffff sa437 1 1 0 1 1 0 1 0 1 128/64 1b50000?1b5ffff sa438 1 1 0 1 1 0 1 1 0 128/64 1b60000?1b6ffff sa439 1 1 0 1 1 0 1 1 1 128/64 1b70000?1b7ffff sa440 1 1 0 1 1 1 0 0 0 128/64 1b80000?1b8ffff sa441 1 1 0 1 1 1 0 0 1 128/64 1b90000?1b9ffff sa442 1 1 0 1 1 1 0 1 0 128/64 1ba0000?1baffff sa443 1 1 0 1 1 1 0 1 1 128/64 1bb0000?1bbffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
100 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa444 1 1 0 1 1 1 1 0 0 128/64 1bc0000?1bcffff sa445 1 1 0 1 1 1 1 0 1 128/64 1bd0000?1bdffff sa446 1 1 0 1 1 1 1 1 0 128/64 1be0000?1beffff sa447 1 1 0 1 1 1 1 1 1 128/64 1bf0000?1bfffff sa448 1 1 1 0 0 0 0 0 0 128/64 1c00000?1c0ffff sa449 1 1 1 0 0 0 0 0 1 128/64 1c10000?1c1ffff sa450 1 1 1 0 0 0 0 1 0 128/64 1c20000?1c2ffff sa451 1 1 1 0 0 0 0 1 1 128/64 1c30000?1c3ffff sa452 1 1 1 0 0 0 1 0 0 128/64 1c40000?1c4ffff sa453 1 1 1 0 0 0 1 0 1 128/64 1c50000?1c5ffff sa454 1 1 1 0 0 0 1 1 0 128/64 1c60000?1c6ffff sa455 1 1 1 0 0 0 1 1 1 128/64 1c70000?1c7ffff sa456 1 1 1 0 0 1 0 0 0 128/64 1c80000?1c8ffff sa457 1 1 1 0 0 1 0 0 1 128/64 1c90000?1c9ffff sa458 1 1 1 0 0 1 0 1 0 128/64 1ca0000?1caffff sa459 1 1 1 0 0 1 0 1 1 128/64 1cb0000?1cbffff sa460 1 1 1 0 0 1 1 0 0 128/64 1cc0000?1ccffff sa461 1 1 1 0 0 1 1 0 1 128/64 1cd0000?1cdffff sa462 1 1 1 0 0 1 1 1 0 128/64 1ce0000?1ceffff sa463 1 1 1 0 0 1 1 1 1 128/64 1cf0000?1cfffff sa464 1 1 1 0 1 0 0 0 0 128/64 1d00000?1d0ffff sa465 1 1 1 0 1 0 0 0 1 128/64 1d10000?1d1ffff sa466 1 1 1 0 1 0 0 1 0 128/64 1d20000?1d2ffff sa467 1 1 1 0 1 0 0 1 1 128/64 1d30000?1d3ffff sa468 1 1 1 0 1 0 1 0 0 128/64 1d40000?1d4ffff sa469 1 1 1 0 1 0 1 0 1 128/64 1d50000?1d5ffff sa470 1 1 1 0 1 0 1 1 0 128/64 1d60000?1d6ffff sa471 1 1 1 0 1 0 1 1 1 128/64 1d70000?1d7ffff sa472 1 1 1 0 1 1 0 0 0 128/64 1d80000?1d8ffff sa473 1 1 1 0 1 1 0 0 1 128/64 1d90000?1d9ffff sa474 1 1 1 0 1 1 0 1 0 128/64 1da0000?1daffff sa475 1 1 1 0 1 1 0 1 1 128/64 1db0000?1dbffff sa476 1 1 1 0 1 1 1 0 0 128/64 1dc0000?1dcffff sa477 1 1 1 0 1 1 1 0 1 128/64 1dd0000?1ddffff sa478 1 1 1 0 1 1 1 1 0 128/64 1de0000?1deffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 101 advance information sa479 1 1 1 0 1 1 1 1 1 128/64 1df0000?1dfffff sa480 1 1 1 1 0 0 0 0 0 128/64 1e00000?1e0ffff sa481 1 1 1 1 0 0 0 0 1 128/64 1e10000?1e1ffff sa482 1 1 1 1 0 0 0 1 0 128/64 1e20000?1e2ffff sa483 1 1 1 1 0 0 0 1 1 128/64 1e30000?1e3ffff sa484 1 1 1 1 0 0 1 0 0 128/64 1e40000?1e4ffff sa485 1 1 1 1 0 0 1 0 1 128/64 1e50000?1e5ffff sa486 1 1 1 1 0 0 1 1 0 128/64 1e60000?1e6ffff sa487 1 1 1 1 0 0 1 1 1 128/64 1e70000?1e7ffff sa488 1 1 1 1 0 1 0 0 0 128/64 1e80000?1e8ffff sa489 1 1 1 1 0 1 0 0 1 128/64 1e90000?1e9ffff sa490 1 1 1 1 0 1 0 1 0 128/64 1ea0000?1eaffff sa491 1 1 1 1 0 1 0 1 1 128/64 1eb0000?1ebffff sa492 1 1 1 1 0 1 1 0 0 128/64 1ec0000?1ecffff sa493 1 1 1 1 0 1 1 0 1 128/64 1ed0000?1edffff sa494 1 1 1 1 0 1 1 1 0 128/64 1ee0000?1eeffff sa495 1 1 1 1 0 1 1 1 1 128/64 1ef0000?1efffff sa496 1 1 1 1 1 0 0 0 0 128/64 1f00000?1f0ffff sa497 1 1 1 1 1 0 0 0 1 128/64 1f10000?1f1ffff sa498 1 1 1 1 1 0 0 1 0 128/64 1f20000?1f2ffff sa499 1 1 1 1 1 0 0 1 1 128/64 1f30000?1f3ffff sa500 1 1 1 1 1 0 1 0 0 128/64 1f40000?1f4ffff sa501 1 1 1 1 1 0 1 0 1 128/64 1f50000?1f5ffff sa502 1 1 1 1 1 0 1 1 0 128/64 1f60000?1f6ffff sa503 1 1 1 1 1 0 1 1 1 128/64 1f70000?1f7ffff sa504 1 1 1 1 1 1 0 0 0 128/64 1f80000?1f8ffff sa505 1 1 1 1 1 1 0 0 1 128/64 1f90000?1f9ffff sa506 1 1 1 1 1 1 0 1 0 128/64 1fa0000?1faffff sa507 1 1 1 1 1 1 0 1 1 128/64 1fb0000?1fbffff sa508 1 1 1 1 1 1 1 0 0 128/64 1fc0000?1fcffff sa509 1 1 1 1 1 1 1 0 1 128/64 1fd0000?1fdffff sa510 1 1 1 1 1 1 1 1 0 128/64 1fe0000?1feffff sa511 1 1 1 1 1 1 1 1 1 128/64 1ff0000?1ffffff table 2. sector address table?s29gl512n (continued) sector a24?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
102 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ta b l e 3 . sector address table?s29gl256n sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal) sa0 00000000 128/64 0000000?000ffff sa1 00000001 128/64 0010000?001ffff sa2 00000010 128/64 0020000?002ffff sa3 00000011 128/64 0030000?003ffff sa4 00000100 128/64 0040000?004ffff sa5 00000101 128/64 0050000?005ffff sa6 00000110 128/64 0060000?006ffff sa7 00000111 128/64 0070000?007ffff sa8 00001000 128/64 0080000?008ffff sa9 00001001 128/64 0090000?009ffff sa10 00001010 128/64 00a0000?00affff sa11 00001011 128/64 00b0000?00bffff sa12 00001100 128/64 00c0000?00cffff sa13 00001101 128/64 00d0000?00dffff sa14 00001110 128/64 00e0000?00effff sa15 00001111 128/64 00f0000?00fffff sa16 00010000 128/64 0100000?010ffff sa17 00010001 128/64 0110000?011ffff sa18 00010010 128/64 0120000?012ffff sa19 00010011 128/64 0130000?013ffff sa20 00010100 128/64 0140000?014ffff sa21 00010101 128/64 0150000?015ffff sa22 00010110 128/64 0160000?016ffff sa23 00010111 128/64 0170000?017ffff sa24 00011000 128/64 0180000?018ffff sa25 00011001 128/64 0190000?019ffff sa26 00011010 128/64 01a0000?01affff sa27 00011011 128/64 01b0000?01bffff sa28 00011100 128/64 01c0000?01cffff sa29 00011101 128/64 01d0000?01dffff sa30 00011110 128/64 01e0000?01effff sa31 00011111 128/64 01f0000?01fffff sa32 00100000 128/64 0200000?020ffff sa33 00100001 128/64 0210000?021ffff
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 103 advance information sa34 00100010 128/64 0220000?022ffff sa35 00100011 128/64 0230000?023ffff sa36 00100100 128/64 0240000?024ffff sa37 00100101 128/64 0250000?025ffff sa38 00100110 128/64 0260000?026ffff sa39 00100111 128/64 0270000?027ffff sa40 00101000 128/64 0280000?028ffff sa41 00101001 128/64 0290000?029ffff sa42 00101010 128/64 02a0000?02affff sa43 00101011 128/64 02b0000?02bffff sa44 00101100 128/64 02c0000?02cffff sa45 00101101 128/64 02d0000?02dffff sa46 00101110 128/64 02e0000?02effff sa47 00101111 128/64 02f0000?02fffff sa48 00110000 128/64 0300000?030ffff sa49 00110001 128/64 0310000?031ffff sa50 00110010 128/64 0320000?032ffff sa51 00110011 128/64 0330000?033ffff sa52 00110100 128/64 0340000?034ffff sa53 00110101 128/64 0350000?035ffff sa54 00110110 128/64 0360000?036ffff sa55 00110111 128/64 0370000?037ffff sa56 00111000 128/64 0380000?038ffff sa57 00111001 128/64 0390000?039ffff sa58 00111010 128/64 03a0000?03affff sa59 00111011 128/64 03b0000?03bffff sa60 00111100 128/64 03c0000?03cffff sa61 00111101 128/64 03d0000?03dffff sa62 00111110 128/64 03e0000?03effff sa63 00111111 128/64 03f0000?03fffff sa64 01000000 128/64 0400000?040ffff sa65 01000001 128/64 0410000?041ffff sa66 01000010 128/64 0420000?042ffff sa67 01000011 128/64 0430000?043ffff sa68 01000100 128/64 0440000?044ffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
104 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa69 01000101 128/64 0450000?045ffff sa70 01000110 128/64 0460000?046ffff sa71 01000111 128/64 0470000?047ffff sa72 01001000 128/64 0480000?048ffff sa73 01001001 128/64 0490000?049ffff sa74 01001010 128/64 04a0000?04affff sa75 01001011 128/64 04b0000?04bffff sa76 01001100 128/64 04c0000?04cffff sa77 01001101 128/64 04d0000?04dffff sa78 01001110 128/64 04e0000?04effff sa79 01001111 128/64 04f0000?04fffff sa80 01010000 128/64 0500000?050ffff sa81 01010001 128/64 0510000?051ffff sa82 01010010 128/64 0520000?052ffff sa83 01010011 128/64 0530000?053ffff sa84 01010100 128/64 0540000?054ffff sa85 01010101 128/64 0550000?055ffff sa86 01010110 128/64 0560000?056ffff sa87 01010111 128/64 0570000?057ffff sa88 01011000 128/64 0580000?058ffff sa89 01011001 128/64 0590000?059ffff sa90 01011010 128/64 05a0000?05affff sa91 01011011 128/64 05b0000?05bffff sa92 01011100 128/64 05c0000?05cffff sa93 01011101 128/64 05d0000?05dffff sa94 01011110 128/64 05e0000?05effff sa95 01011111 128/64 05f0000?05fffff sa96 01100000 128/64 0600000?060ffff sa97 01100001 128/64 0610000?061ffff sa98 01100010 128/64 0620000?062ffff sa99 01100011 128/64 0630000?063ffff sa100 01100100 128/64 0640000?064ffff sa101 01100101 128/64 0650000?065ffff sa102 01100110 128/64 0660000?066ffff sa103 01100111 128/64 0670000?067ffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 105 advance information sa104 01101000 128/64 0680000?068ffff sa105 01101001 128/64 0690000?069ffff sa106 01101010 128/64 06a0000?06affff sa107 01101011 128/64 06b0000?06bffff sa108 01101100 128/64 06c0000?06cffff sa109 01101101 128/64 06d0000?06dffff sa110 01101110 128/64 06e0000?06effff sa111 01101111 128/64 06f0000?06fffff sa112 01110000 128/64 0700000?070ffff sa113 01110001 128/64 0710000?071ffff sa114 01110010 128/64 0720000?072ffff sa115 01110011 128/64 0730000?073ffff sa116 01110100 128/64 0740000?074ffff sa117 01110101 128/64 0750000?075ffff sa118 01110110 128/64 0760000?076ffff sa119 01110111 128/64 0770000?077ffff sa120 01111000 128/64 0780000?078ffff sa121 01111001 128/64 0790000?079ffff sa122 01111010 128/64 07a0000?07affff sa123 01111011 128/64 07b0000?07bffff sa124 01111100 128/64 07c0000?07cffff sa125 01111101 128/64 07d0000?07dffff sa126 01111110 128/64 07e0000?07effff sa127 01111111 128/64 07f0000?07fffff sa128 10000000 128/64 0800000?080ffff sa129 10000001 128/64 0810000?081ffff sa130 10000010 128/64 0820000?082ffff sa131 10000011 128/64 0830000?083ffff sa132 10000100 128/64 0840000?084ffff sa133 10000101 128/64 0850000?085ffff sa134 10000110 128/64 0860000?086ffff sa135 10000111 128/64 0870000?087ffff sa136 10001000 128/64 0880000?088ffff sa137 10001001 128/64 0890000?089ffff sa138 10001010 128/64 08a0000?08affff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
106 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa139 10001011 128/64 08b0000?08bffff sa140 10001100 128/64 08c0000?08cffff sa141 10001101 128/64 08d0000?08dffff sa142 10001110 128/64 08e0000?08effff sa143 10001111 128/64 08f0000?08fffff sa144 10010000 128/64 0900000?090ffff sa145 10010001 128/64 0910000?091ffff sa146 10010010 128/64 0920000?092ffff sa147 10010011 128/64 0930000?093ffff sa148 10010100 128/64 0940000?094ffff sa149 10010101 128/64 0950000?095ffff sa150 10010110 128/64 0960000?096ffff sa151 10010111 128/64 0970000?097ffff sa152 10011000 128/64 0980000?098ffff sa153 10011001 128/64 0990000?099ffff sa154 10011010 128/64 09a0000?09affff sa155 10011011 128/64 09b0000?09bffff sa156 10011100 128/64 09c0000?09cffff sa157 10011101 128/64 09d0000?09dffff sa158 10011110 128/64 09e0000?09effff sa159 10011111 128/64 09f0000?09fffff sa160 10100000 128/64 0a00000?0a0ffff sa161 10100001 128/64 0a10000?0a1ffff sa162 10100010 128/64 0a20000?0a2ffff sa163 10100011 128/64 0a30000?0a3ffff sa164 10100100 128/64 0a40000?0a4ffff sa165 10100101 128/64 0a50000?0a5ffff sa166 10100110 128/64 0a60000?0a6ffff sa167 10100111 128/64 0a70000?0a7ffff sa168 10101000 128/64 0a80000?0a8ffff sa169 10101001 128/64 0a90000?0a9ffff sa170 10101010 128/64 0aa0000?0aaffff sa171 10101011 128/64 0ab0000?0abffff sa172 10101100 128/64 0ac0000?0acffff sa173 10101101 128/64 0ad0000?0adffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 107 advance information sa174 10101110 128/64 0ae0000?0aeffff sa175 10101111 128/64 0af0000?0afffff sa176 10110000 128/64 0b00000?0b0ffff sa177 10110001 128/64 0b10000?0b1ffff sa178 10110010 128/64 0b20000?0b2ffff sa179 10110011 128/64 0b30000?0b3ffff sa180 10110100 128/64 0b40000?0b4ffff sa181 10110101 128/64 0b50000?0b5ffff sa182 10110110 128/64 0b60000?0b6ffff sa183 10110111 128/64 0b70000?0b7ffff sa184 10111000 128/64 0b80000?0b8ffff sa185 10111001 128/64 0b90000?0b9ffff sa186 10111010 128/64 0ba0000?0baffff sa187 10111011 128/64 0bb0000?0bbffff sa188 10111100 128/64 0bc0000?0bcffff sa189 10111101 128/64 0bd0000?0bdffff sa190 10111110 128/64 0be0000?0beffff sa191 10111111 128/64 0bf0000?0bfffff sa192 11000000 128/64 0c00000?0c0ffff sa193 11000001 128/64 0c10000?0c1ffff sa194 11000010 128/64 0c20000?0c2ffff sa195 11000011 128/64 0c30000?0c3ffff sa196 11000100 128/64 0c40000?0c4ffff sa197 11000101 128/64 0c50000?0c5ffff sa198 11000110 128/64 0c60000?0c6ffff sa199 11000111 128/64 0c70000?0c7ffff sa200 11001000 128/64 0c80000?0c8ffff sa201 11001001 128/64 0c90000?0c9ffff sa202 11001010 128/64 0ca0000?0caffff sa203 11001011 128/64 0cb0000?0cbffff sa204 11001100 128/64 0cc0000?0ccffff sa205 11001101 128/64 0cd0000?0cdffff sa206 11001110 128/64 0ce0000?0ceffff sa207 11001111 128/64 0cf0000?0cfffff sa208 11010000 128/64 0d00000?0d0ffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
108 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa209 11010001 128/64 0d10000?0d1ffff sa210 11010010 128/64 0d20000?0d2ffff sa211 11010011 128/64 0d30000?0d3ffff sa212 11010100 128/64 0d40000?0d4ffff sa213 11010101 128/64 0d50000?0d5ffff sa214 11010110 128/64 0d60000?0d6ffff sa215 11010111 128/64 0d70000?0d7ffff sa216 11011000 128/64 0d80000?0d8ffff sa217 11011001 128/64 0d90000?0d9ffff sa218 11011010 128/64 0da0000?0daffff sa219 11011011 128/64 0db0000?0dbffff sa220 11011100 128/64 0dc0000?0dcffff sa221 11011101 128/64 0dd0000?0ddffff sa222 11011110 128/64 0de0000?0deffff sa223 11011111 128/64 0df0000?0dfffff sa224 11100000 128/64 0e00000?0e0ffff sa225 11100001 128/64 0e10000?0e1ffff sa226 11100010 128/64 0e20000?0e2ffff sa227 11100011 128/64 0e30000?0e3ffff sa228 11100100 128/64 0e40000?0e4ffff sa229 11100101 128/64 0e50000?0e5ffff sa230 11100110 128/64 0e60000?0e6ffff sa231 11100111 128/64 0e70000?0e7ffff sa232 11101000 128/64 0e80000?0e8ffff sa233 11101001 128/64 0e90000?0e9ffff sa234 11101010 128/64 0ea0000?0eaffff sa235 11101011 128/64 0eb0000?0ebffff sa236 11101100 128/64 0ec0000?0ecffff sa237 11101101 128/64 0ed0000?0edffff sa238 11101110 128/64 0ee0000?0eeffff sa239 11101111 128/64 0ef0000?0efffff sa240 11110000 128/64 0f00000?0f0ffff sa241 11110001 128/64 0f10000?0f1ffff sa242 11110010 128/64 0f20000?0f2ffff sa243 11110011 128/64 0f30000?0f3ffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 109 advance information sa244 11110100 128/64 0f40000?0f4ffff sa245 11110101 128/64 0f50000?0f5ffff sa246 11110110 128/64 0f60000?0f6ffff sa247 11110111 128/64 0f70000?0f7ffff sa248 11111000 128/64 0f80000?0f8ffff sa249 11111001 128/64 0f90000?0f9ffff sa250 11111010 128/64 0fa0000?0faffff sa251 11111011 128/64 0fb0000?0fbffff sa252 11111100 128/64 0fc0000?0fcffff sa253 11111101 128/64 0fd0000?0fdffff sa254 11111110 128/64 0fe0000?0feffff sa255 11111111 128/64 0ff0000?0ffffff ta b l e 4 . sector address table?s29gl128n sector a22?a16 sector size (kbytes/ kwords) address range (in hexadecimal) sa0 000000 128/64 0000000?000ffff sa1 000001 128/64 0010000?001ffff sa2 000010 128/64 0020000?002ffff sa3 000011 128/64 0030000?003ffff sa4 000100 128/64 0040000?004ffff sa5 000101 128/64 0050000?005ffff sa6 000110 128/64 0060000?006ffff sa7 000111 128/64 0070000?007ffff sa8 001000 128/64 0080000?008ffff sa9 001001 128/64 0090000?009ffff sa10 001010 128/64 00a0000?00affff sa11 001011 128/64 00b0000?00bffff sa12 001100 128/64 00c0000?00cffff sa13 001101 128/64 00d0000?00dffff sa14 001110 128/64 00e0000?00effff sa15 001111 128/64 00f0000?00fffff sa16 010000 128/64 0100000?010ffff sa17 010001 128/64 0110000?011ffff table 3. sector address table?s29gl256n (continued) sector a23?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
110 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa18 010010 128/64 0120000?012ffff sa19 010011 128/64 0130000?013ffff sa20 010100 128/64 0140000?014ffff sa21 010101 128/64 0150000?015ffff sa22 010110 128/64 0160000?016ffff sa23 010111 128/64 0170000?017ffff sa24 011000 128/64 0180000?018ffff sa25 011001 128/64 0190000?019ffff sa26 011010 128/64 01a0000?01affff sa27 011011 128/64 01b0000?01bffff sa28 011100 128/64 01c0000?01cffff sa29 011101 128/64 01d0000?01dffff sa30 011110 128/64 01e0000?01effff sa31 011111 128/64 01f0000?01fffff sa32 100000 128/64 0200000?020ffff sa33 100001 128/64 0210000?021ffff sa34 100010 128/64 0220000?022ffff sa35 100011 128/64 0230000?023ffff sa36 100100 128/64 0240000?024ffff sa37 100101 128/64 0250000?025ffff sa38 100110 128/64 0260000?026ffff sa39 100111 128/64 0270000?027ffff sa40 101000 128/64 0280000?028ffff sa41 101001 128/64 0290000?029ffff sa42 101010 128/64 02a0000?02affff sa43 101011 128/64 02b0000?02bffff sa44 101100 128/64 02c0000?02cffff sa45 101101 128/64 02d0000?02dffff sa46 101110 128/64 02e0000?02effff sa47 101111 128/64 02f0000?02fffff sa48 110000 128/64 0300000?030ffff sa49 110001 128/64 0310000?031ffff sa50 110010 128/64 0320000?032ffff sa51 110011 128/64 0330000?033ffff sa52 110100 128/64 0340000?034ffff table 4. sector address table?s29gl128n (continued) sector a22?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 111 advance information sa53 110101 128/64 0350000?035ffff sa54 110110 128/64 0360000?036ffff sa55 110111 128/64 0370000?037ffff sa56 111000 128/64 0380000?038ffff sa57 111001 128/64 0390000?039ffff sa58 111010 128/64 03a0000?03affff sa59 111011 128/64 03b0000?03bffff sa60 111100 128/64 03c0000?03cffff sa61 111101 128/64 03d0000?03dffff sa62 111110 128/64 03e0000?03effff sa63 111111 128/64 03f0000?03fffff sa64 000000 128/64 0400000?040ffff sa65 000001 128/64 0410000?041ffff sa66 000010 128/64 0420000?042ffff sa67 000011 128/64 0430000?043ffff sa68 000100 128/64 0440000?044ffff sa69 000101 128/64 0450000?045ffff sa70 000110 128/64 0460000?046ffff sa71 000111 128/64 0470000?047ffff sa72 001000 128/64 0480000?048ffff sa73 001001 128/64 0490000?049ffff sa74 001010 128/64 04a0000?04affff sa75 001011 128/64 04b0000?04bffff sa76 001100 128/64 04c0000?04cffff sa77 001101 128/64 04d0000?04dffff sa78 001110 128/64 04e0000?04effff sa79 001111 128/64 04f0000?04fffff sa80 010000 128/64 0500000?050ffff sa81 010001 128/64 0510000?051ffff sa82 010010 128/64 0520000?052ffff sa83 010011 128/64 0530000?053ffff sa84 010100 128/64 0540000?054ffff sa85 010101 128/64 0550000?055ffff sa86 010110 128/64 0560000?056ffff sa87 010111 128/64 0570000?057ffff table 4. sector address table?s29gl128n (continued) sector a22?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
112 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information sa88 011000 128/64 0580000?058ffff sa89 011001 128/64 0590000?059ffff sa90 011010 128/64 05a0000?05affff sa91 011011 128/64 05b0000?05bffff sa92 011100 128/64 05c0000?05cffff sa93 011101 128/64 05d0000?05dffff sa94 011110 128/64 05e0000?05effff sa95 011111 128/64 05f0000?05fffff sa96 100000 128/64 0600000?060ffff sa97 100001 128/64 0610000?061ffff sa98 100010 128/64 0620000?062ffff sa99 100011 128/64 0630000?063ffff sa100 100100 128/64 0640000?064ffff sa101 100101 128/64 0650000?065ffff sa102 100110 128/64 0660000?066ffff sa103 100111 128/64 0670000?067ffff sa104 101000 128/64 0680000?068ffff sa105 101001 128/64 0690000?069ffff sa106 101010 128/64 06a0000?06affff sa107 101011 128/64 06b0000?06bffff sa108 101100 128/64 06c0000?06cffff sa109 101101 128/64 06d0000?06dffff sa110 101110 128/64 06e0000?06effff sa111 101111 128/64 06f0000?06fffff sa112 110000 128/64 0700000?070ffff sa113 110001 128/64 0710000?071ffff sa114 110010 128/64 0720000?072ffff sa115 110011 128/64 0730000?073ffff sa116 110100 128/64 0740000?074ffff sa117 110101 128/64 0750000?075ffff sa118 110110 128/64 0760000?076ffff sa119 110111 128/64 0770000?077ffff sa120 111000 128/64 0780000?078ffff sa121 111001 128/64 0790000?079ffff sa122 111010 128/64 07a0000?07affff table 4. sector address table?s29gl128n (continued) sector a22?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 113 advance information autoselect mode the autoselect mode provides manufacturer and device identification, and sector group protection verification, through iden tifier codes output on dq7?dq0. this mode is primarily intended for programmi ng equipment to automatically match a device to be programmed with its corr esponding programming algorithm. how- ever, the autoselect codes can also be accessed in-system through the command register. when using programming equipment, the autoselect mode requires vid on ad- dress pin a9. address pins a6, a3, a2, a1, and a0 must be as shown in ta b l e 5 . in addition, when verifying sector protec tion, the sector address must appear on the appropriate highest order address bits (see ta b l e 2 ). ta b l e 5 shows the re- maining address bits that are don?t care. when all necessary bits have been set as required, the programming equipment may then read the corresponding iden- tifier code on dq7?dq0. to access the autoselect codes in-system, the host system can issue the autose- lect command via the command register, as shown in ta b l e 1 2 . this method does not require v id . refer to the autoselect command sequence section for more information. sa123 111011 128/64 07b0000?07bffff sa124 111100 128/64 07c0000?07cffff sa125 111101 128/64 07d0000?07dffff sa126 111110 128/64 07e0000?07effff sa127 111111 128/64 07f0000?07fffff table 4. sector address table?s29gl128n (continued) sector a22?a16 sector size (kbytes/ kwords) address range (in hexadecimal)
114 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ta b l e 5 . autoselect codes, (high voltage method) legend: l = logic low = v il , h = logic high = v ih , sa = sector address, x = don?t care. sector protection the device features several levels of sect or protection, which can disable both the program and erase operations in certain sectors or sector groups: persistent sector protection a command sector protection method that replaces the old 12 v controlled pro- tection method. password sector protection a highly sophisticated protection meth od that requires a password before changes to certain sectors or sector groups are permitted wp# hardware protection a write protect pin that can prevent progra m or erase operations in the outermost sectors. the wp# hardware protection feature is always available, independent of the software managed protection method chosen. selecting a sector protection mode all parts default to operate in the pers istent sector protec tion mode. the cus- tomer must then choose if the persistent or password protection method is most desirable. there are two one-time progra mmable non-volatile bits that define which sector protection method will be us ed. if the customer decides to continue description ce# oe# we # a22 to a15 a14 to a10 a9 a8 to a7 a6 a5 to a4 a3 to a2 a1 a0 dq8 to dq15 dq7 to dq0 manufacturer id : spansion product llhxxv id x l x l l l 00 01h device id s29gl512n cycle 1 llhxxv id xl x llh 22 7eh cycle 2 hh l 22 23h cycle 3 hhh 22 01h device id s29gl256n cycle 1 llhxxv id xl x llh 22 7eh cycle 2 hh l 22 22h cycle 3 hhh 22 01h device id s29gl128n cycle 1 llhxxv id xl x llh 22 7eh cycle 2 hh l 22 21h cycle 3 hhh 22 01h sector group protection verification llhsaxv id xl x l h l x 01h (protected), 00h (unprotected) secured silicon sector indicator bit (dq7), wp# protects highest address sector llhxxv id xl x l h h x 98h (factory locked), 18h (not factory locked) secured silicon sector indicator bit (dq7), wp# protects lowest address sector llhxxv id xl x l h h x 88h (factory locked), 08h (not factory locked)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 115 advance information using the persistent sector protection method, they must set the persistent sector protection mode locking bit . this will permanently set the part to op- erate only using persistent sector protec tion. if the customer decides to use the password method, they must set the password mode locking bit . this will permanently set the part to operate on ly using password sector protection. it is important to remember that setting either the persistent sector protec- tion mode locking bit or the password mode locking bit permanently selects the protection mode. it is not po ssible to switch between the two methods once a locking bit has been set. it is important that one mode is explicitly selected when the device is first programmed, rather than relying on the default mode alone. this is so that it is not possible for a system program or virus to later set the password mode lo cking bit, which would cause an unex- pected shift from the default persistent se ctor protection mode into the password protection mode. the device is shipped with all sectors unp rotected. the factory offers the option of programming and protecting sectors at the factory prior to shipping the device through the expressflash? service. contac t your sales representative for details. it is possible to determine whether a sector is protected or unprotected. see ?au- toselect command sequence? section on page 127 for details. advanced sector protection advanced sector protection features several levels of sector protection, which can disable both the program and erase operations in certain sectors. persistent sector protection is a method that replaces the old 12v controlled protection method. password sector protection is a highly sophisticated protection method that requires a password before changes to certain sectors are permitted. lock register the lock register consists of 3 bits (d q2, dq1, and dq0). these dq2, dq1, dq0 bits of the lock register are programmable by the user. users are not allowed to program both dq2 and dq1 bits of the lock register to the 00 state. if the user tries to program dq2 and dq1 bits of the lo ck register to the 00 state, the device will abort the lock register back to the default 11 state. the programming time of the lock register is same as the ty pical word programming time without uti- lizing the write buffer of the device. during a lock register programming sequence execution, the dq6 toggle bit i will toggle until the programming of the lock register has completed to indicate programming status. all lock register bits are readable to allow users to verify lock register statuses. the customer secured silicon sector protection bit is dq0, persistent protection mode lock bit is dq1, and password prot ection mode lock bit is dq2 are acces- sible by all users. each of these bits ar e non-volatile. dq15-dq3 are reserved and must be 1's when the user tries to program the dq2, dq1, and dq0 bits of the lock register. the user is not required to program dq2, dq1 and dq0 bits of the lock register at the same time. this allo ws users to lock the secured silicon sec- tor and then set the device either perman ently into password protection mode or persistent protection mode and then lock the secured silicon sector at separate instances and time frames. ? secured silicon sector prot ection allows the user to lock the secured silicon sector area
116 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ? persistent protection mode lock bit allows the user to set the device perma- nently to operate in the persistent protection mode ? password protection mode lock bit allo ws the user to set the device perma- nently to operate in the password protection mode ta b l e 6 . lock register persistent sector protection the persistent sector protection method replaces the old 12 v controlled protec- tion method while at the same time e nhancing flexibility by providing three different sector protection states: ? dynamically locked -the sector is protected and can be changed by a sim- ple command ? persistently locked -a sector is protected and cannot be changed ? unlocked -the sector is unprotected and can be changed by a simple com- mand in order to achieve these states, three types of ?bits? are going to be used: dynamic protection bit (dyb) a volatile protection bit is assigned for each sector. after power-up or hardware reset, the contents of all dyb bits are in the ?unprotected state?. each dyb is in- dividually modifiable through the dy b set command and dyb clear command. when the parts are first shipped, all of the persistent protect bits (ppb) are cleared into the unprotected state. the dyb bits and ppb lock bit are defaulted to power up in the cleared state or unpro tected state - meaning the all ppb bits are changeable. the protection state for each sector is determined by the logical or of the ppb and the dyb related to that sector. for the sectors that have the ppb bits cleared, the dyb bits control whether or not the se ctor is protected or unprotected. by is- suing the dyb set and dyb clear command sequences, the dyb bits will be protected or unprotected, thus placing each sector in the protected or unpro- tected state. these are the so-called dy namic locked or unlocked states. they are called dynamic states because it is very easy to switch back and forth be- tween the protected and un-protected conditions. this allows software to easily protect sectors against inadvertent chan ges yet does not prevent the easy re- moval of protection when changes are needed. the dyb bits maybe set or cleared as often as needed. the ppb bits allow for a more static, and difficult to change, level of protection. the ppb bits retain their state across power cycles because they ar e non-volatile. individual ppb bits are set with a program command but must all be cleared as a group through an erase command. the ppb lock bit adds an additional level of protection. once all ppb bits are pro- grammed to the desired settings, the ppb lock bit may be set to the ?freeze state?. setting the ppb lock bit to the ?freeze state? disables all program and erase commands to the non-volatile ppb bits . in effect, the ppb lock bit locks the ppb bits into their current state. the on ly way to clear the ppb lock bit to the dq15-3 dq2 dq1 dq0 don?t care password protection mode lock bit persistent protection mode lock bit secured silicon sector protection bit
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 117 advance information ?unfreeze state? is to go through a power cycle, or hardware reset. the software reset command will not clear the ppb lock bit to the ?unfreeze state?. system boot code can determine if any changes to the ppb bits are needed e.g. to allow new system code to be downloaded. if no changes are needed then the boot code can set the ppb lock bit to disable any further changes to the ppb bits during system operation. the wp# write protect pin adds a final leve l of hardware protection. when this pin is low it is not possible to change the contents of the wp# protected sectors. these sectors generally hold system boot code. so, the wp# pin can prevent any changes to the boot code th at could override the choices made while setting up sector protection during system initialization. it is possible to have sectors that have been persistently locked, and sectors that are left in the dynamic state. the sectors in the dynamic state are all unprotected. if there is a need to protect some of them, a simple dyb set command sequence is all that is necessary. the dyb set and dyb clear commands for the dynamic sectors switch the dyb bits to signify pr otected and unprotected, respectively. if there is a need to change the status of th e persistently locked sectors, a few more steps are required. first, the ppb lock bit must be disabled to the ?unfreeze state? by either putting the device through a power-cycle, or hardware reset. the ppb bits can then be changed to reflect the desired settings. setting the ppb lock bit once again to the ?freeze state? will lock the ppb bits, and the device operates normally again. note: to achieve the best protection, it 's recommended to execute the ppb lock bit set command early in the boot code, and protect the boot code by holding wp# = v il . persistent protection bit (ppb) a single persistent (non-volatile) protection bit is assigned to each sector. if a ppb is programmed to the protec ted state through the ?ppb program? command, that sector will be protected from program or erase operations will be read-only. if a ppb requires erasure, all of the sector ppb bits must first be erased in parallel through the ?all ppb erase? command. the ?all ppb erase? command will prepro- grammed all ppb bits prior to ppb erasing. all ppb bits erase in parallel, unlike programming where individual ppb bits are programmable. the ppb bits have the same endurance as the flash memory. programming the ppb bit requires the typi cal word programming time without uti- lizing the write buffer. during a ppb bit programming and a11 ppb bit erasing sequence execution, the dq6 toggle bit i will toggle until the programming of the ppb bit or erasing of all ppb bits has completed to indicate programming and erasing status. erasing all of the ppb bits at once requires typical sector erase time. during the erasing of all ppb bits, th e dq3 sector erase timer bit will output a 1 to indicate the erasure of all ppb bits are in progress. when the erasure of all ppb bits has completed, the dq3 sector erase timer bit will output a 0 to indicate that all ppb bits have been erased. readin g the ppb status bit requires the initial access time of the device. persistent protection bit lock (ppb lock bit) a global volatile bit. when set to the ?freeze state?, the ppb bits cannot be changed. when cleared to the ?unfreez e state?, the ppb bits are changeable. there is only one ppb lock bit per device. the ppb lock bit is cleared to the ?un-
118 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information freeze state? after power-up or hardware reset. there is no command sequence to unlock or ?unfreeze? the ppb lock bit. configuring the ppb lock bit to the freez e state requires approximately 100ns. reading the ppb lock status bit requires the initial access time of the device. ta b l e 7 . sector protection schemes ta b l e 7 contains all possible combinations of the dyb bit, ppb bit, and ppb lock bit relating to the status of the sector. in summary, if the ppb bit is set, and the ppb lock bit is set, the sector is prot ected and the protection cannot be removed until the next power cycle or hardware re set clears the ppb lo ck bit to ?unfreeze state?. if the ppb bit is cleared, the sector can be dynamically locked or unlocked. the dyb bit then controls whether or not the sector is protected or unprotected. if the user attempts to program or erase a protected sector, the device ignores the command and returns to read mode. a program command to a protected sec- tor enables status polling for approximately 1 s before the device returns to read mode without having modified the conten ts of the protected sector. an erase command to a protected sector enables st atus polling for approximately 50 s after which the device returns to read mo de without having erased the protected sector. the programming of the dyb bit, ppb bit, and ppb lock bit for a given sec- tor can be verified by writing a dyb status read, ppb status read, and ppb lock status read commands to the device. the autoselect sector protection verifica tion outputs the or function of the dyb bit and ppb bit per sector basis. when th e or function of the dyb bit and ppb bit is a 1, the sector is either protected by dyb or ppb or both. when the or function of the dyb bit and ppb bit is a 0, the se ctor is unprotected through both the dyb and ppb. persistent protection mode lock bit like the password protection mode lock bit, a persistent protection mode lock bit exists to guarantee that th e device remain in software sector protection. once programmed, the persistent protection mo de lock bit prevents programming of the password protection mode lock bit. this guarantees that a hacker could not place the device in password protection mode. the password protection mode lock bit resides in the ?lock register?. protection states sector state dyb bit ppb bit ppb lock bit unprotect unprotect unfreeze unprotect ed ? ppb and dyb are changeable unprotect unprotect freeze unprotected ? ppb not changeable, dyb is changeable unprotect protect unfreeze protected ? ppb and dyb are changeable unprotect protect freeze protected ? ppb not changeable, dyb is changeable protect unprotect unfreeze protected ? ppb and dyb are changeable protect unprotect freeze protected ? ppb not changeable, dyb is changeable protect protect unfreeze protected ? ppb and dyb are changeable protect protect freeze protected ? ppb not changeable, dyb is changeable
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 119 advance information password sector protection the password sector protection method allo ws an even higher level of security than the persistent sector protection me thod. there are two main differences be- tween the persistent sector protection and the password sector protection methods: ? when the device is first powered on, or comes out of a reset cycle, the ppb lock bit is set to the locked state, or the freeze state, rather than cleared to the unlocked state, or the unfreeze state. ? the only means to clear and unfreeze the ppb lock bit is by writing a unique 64-bit password to the device. the password sector protection method is otherwise identical to the persistent sector protection method. a 64-bit password is the only addition al tool utilized in this method. the password is stored in a one-time pr ogrammable (otp) region outside of the flash memory. once the password protection mode lock bit is set, the password is permanently set with no means to read , program, or erase it. the password is used to clear and unfreeze the ppb lock bit. the password unlock command must be written to the flash, along with a password. the flash device internally com- pares the given password with the pre-pr ogrammed password. if they match, the ppb lock bit is cleared to the ?unfreezed state?, and the ppb bits can be altered. if they do not match, the flash device does nothing. there is a built-in 2 s delay for each ?password check? after the va lid 64-bit password has been entered for the ppb lock bit to be cleared to the ?unf reezed state?. this delay is intended to thwart any efforts to run a program that tries all possible combinations in order to crack the password. password and password protection mode lock bit in order to select the password sector pr otection method, the customer must first program the password. the factory reco mmends that the password be somehow correlated to the unique electr onic serial number (esn) of the particular flash de- vice. each esn is different for every flas h device; therefore each password should be different for every flash device. while programming in the password region, the customer may perform password re ad operations. once the desired pass- word is programmed in, the customer must then set the password protection mode lock bit. this operation achieves two objectives: 1. it permanently sets the device to op erate using the password protection mode. it is not possible to reverse this function. 2. it also disables all further commands to the password region. all program, and read operations are ignored. both of these objectives are important, and if not carefully considered, may lead to unrecoverable errors. the user must be sure that the password sector protec- tion method is desired when programmi ng the password protection mode lock bit. more importantly, the user must be sure that the password is correct when the password protection mode lock bit is programmed. due to the fact that read operations are disabled, there is no me ans to read what the password is after- wards. if the password is lost after pr ogramming the password protection mode lock bit, there will be no way to clea r and unfreeze the ppb lock bit. the pass- word protection mode lock bit, once programmed, prevents reading the 64-bit password on the dq bus and further pa ssword programming. the password pro- tection mode lock bit is no t erasable. once password protection mode lock bit is
120 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information programmed, the persistent protection mode lock bit is disabled from program- ming, guaranteeing that no changes to the protection scheme are allowed. 64-bit password the 64-bit password is located in its ow n memory space and is accessible through the use of the password program and pa ssword read commands. the password function works in conjunction with the pa ssword protection mode lock bit, which when programmed, prevents the password read command from reading the con- tents of the password on the pins of the device. persistent protection bit lock (ppb lock bit) a global volatile bit. the ppb lock bit is a volatile bit that reflects the state of the password protection mode lock bit after power-up reset. if the password protec- tion mode lock bit is also programmed after programming the password, the password unlock command must be issued to clear and unfreeze the ppb lock bit after a hardware reset (reset# asserted) or a power-up reset. successful exe- cution of the password unlock command clears and unfreezes the ppb lock bit, allowing for sector ppb bits to be modifi ed. without issuing the password unlock command, while asserting reset#, taking the device through a power-on reset, or issuing the ppb lock bit set command sets the ppb lock bit to a the ?freeze state?. if the password protection mode lock bi t is not programmed, the device defaults to persistent protection mode. in the pers istent protection mo de, the ppb lock bit is cleared to the ?unfreeze state? after power-up or hardware reset. the ppb lock bit is set to the ?freeze state? by issu ing the ppb lock bit set command. once set to the ?freeze state? the only means for cl earing the ppb lock bit to the ?unfreeze state? is by issuing a hardware or po wer-up reset. the password unlock com- mand is ignored in pers istent protection mode. reading the ppb lock bit requires a 200ns access time. secured silicon sector flash memory region the secured silicon sector feature provid es a flash memory region that enables permanent part identification through an electronic serial number (esn). the secured silicon sector is 256 bytes in le ngth, and uses a secured silicon sector indicator bit (dq7) to indicate whether or not the secured silicon sector is locked when shipped from the factory. this bit is permanently set at the factory and can- not be changed, which prevents cloning of a factory locked pa rt. this ensures the security of the esn once the product is shipped to the field. the factory offers the device with the secured silicon sector either customer lockable (standard shipping option) or factory locked (contact an amd sales rep- resentative for ordering information). th e customer-lockable version is shipped with the secured silicon sector unprotect ed, allowing customers to program the sector after receiving the device. the customer-lockable version also has the se- cured silicon sector indicator bit permanently set to a ?0.? the factory-locked version is always protected when shipped from the factory, and has the secured silicon sector indicator bit permanently set to a ?1.? thus, the secured silicon sector indicator bit prevents customer-l ockable devices from being used to re- place devices that are factory locked. note that the acc function and unlock bypass modes are not available when th e secured silicon sector is enabled.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 121 advance information the secured silicon sector address space in this device is allocated as follows: the system accesses the secured silico n sector through a command sequence (see ?write protect (wp#)?). after the system has written the enter secured sil- icon sector command sequence, it may re ad the secured silicon sector by using the addresses normally occupied by the firs t sector (sa0). this mode of operation continues until the system issues the ex it secured silicon sector command se- quence, or until power is removed from the device. on power-up, or following a hardware reset, the device reverts to sending commands to sector sa0. customer lockable: secured sili con sector not programmed or protected at the factory unless otherwise specified, the device is shipped such that the customer may program and protect the 256-byte secured silicon sector. the system may program the secured silicon sector using the write-buffer, ac- celerated and/or unlock bypass metho ds, in addition to the standard programming command sequence. see ?command definitions? . programming and protecting the secured silicon sector must be used with cau- tion since, once protected, there is no procedure available for unprotecting the secured silicon sector area and none of the bits in the secured silicon sector memory space can be modified in any way. the secured silicon sector area can be protected using one of the following procedures: ? write the three-cycle enter secured silicon sector region command se- quence, and then follow the in-system sector protect algorithm, except that reset# may be at either v ih or v id . this allows in-syste m protection of the secured silicon sector without raising any device pin to a high voltage. note that this method is only applicab le to the secured silicon sector. ? to verify the protect/unprotect status of the secured silicon sector, follow the algorithm. once the secured silicon sector is prog rammed, locked and verified, the system must write the exit secured silicon sect or region command sequence to return to reading and writing within the remainder of the array. factory locked: secured sili con sector programmed and protected at the factory in devices with an esn, the secured silicon sector is protected when the device is shipped from the factory. the secured silicon sector cannot be modified in any way. an esn factory locked device has an 16-byte random esn at addresses 000000h?000007h. please contact your sales representative for details on order- ing esn factory locked devices. customers may opt to have their code programmed by the factory through the expressflash service (express flash fa ctory locked). the devices are then shipped from the factory with the secured silicon sector permanently locked. contact your sales representative for de tails on using the expressflash service. secured silicon sector address range customer lockable esn factory locked expressflash factory locked 000000h?000007h determined by customer esn esn or determined by customer 000008h?00007fh unavailable determined by customer
122 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information write protect (wp#) the write protect function provides a hard ware method of protecting the first or last sector group without using v id . write protect is one of two functions provided by the wp#/acc input. if the system asserts v il on the wp#/acc pin, the device disables program and erase functions in the first or last sector group independently of whether those sector groups were protected or unprotected using the method described in ?ad- vanced sector protection? section on page 115 . note that if wp#/acc is at v il when the device is in the standby mode, the maximum input load current is in- creased. see the table in ?dc characteristics? section on page 151 . if the system asserts v ih on the wp#/acc pin, the device reverts to whether the first or last sector was pr eviously set to be protected or un- protected using the method describe d in ?sector group protection and unprotection?. note that wp# has an internal pullup; when uncon- nected, wp# is at v ih . hardware data protection the command sequence requirement of unlock cycles for programming or erasing provides data protection against inadvertent writes (refer to ta b l e 1 2 for com- mand definitions). in addition, the follow ing hardware data protection measures prevent accidental erasure or programming , which might otherw ise be caused by spurious system level signals during v cc power-up and power- down transitions, or from system noise. low v cc write inhibit when v cc is less than v lko , the device does not accept any write cycles. this pro- tects data during v cc power-up and power-down. th e command register and all internal program/erase circuits are disabled, and the device resets to the read mode. subsequent writes are ignored until v cc is greater than v lko . the system must provide the proper signals to the cont rol pins to prevent unintentional writes when v cc is greater than v lko . write pulse ?glitch? protection noise pulses of less than 5 ns (typical) on oe#, ce# or we# do not initiate a write cycle. logical inhibit write cycles are inhibited by holding any one of oe# = v il , ce# = v ih or we# = v ih . to initiate a write cycle, ce# and we# must be a logical zero while oe# is a logical one. power-up write inhibit if we# = ce# = v il and oe# = v ih during power up, the device does not accept commands on the rising edge of we#. the internal state machine is automatically reset to the read mode on power-up. common flash memory interface (cfi) the common flash interface (cfi) specific ation outlines device and host system software interrogation hand shake, which allows specific vendor-specified soft- ware algorithms to be used for entire fa milies of devices. software support can
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 123 advance information then be device-independent, jedec id -independent, and forward- and back- ward-compatible for the specified flash device families. flash vendors can standardize their existing interfac es for long-term compatibility. this device enters the cfi query mode when the system writes the cfi query command, 98h, to address 55h, any time th e device is ready to read array data. the system can read cfi information at the addresses given in tables 8-11. to terminate reading cfi data, the system must write the reset command. the system can also write the cfi query command when the device is in the au- toselect mode. the device enters the cf i query mode, and the system can read cfi data at the addresses given in tables 8?11. the system must write the reset command to return the device to reading array data. for further information, please refer to the cfi specification and cfi publication 100, available via the world wide web at http://www.amd.com /flash/cfi. alter- natively, contact your sales representa tive for copies of these documents. table 8. cfi query identification string addresses (x16) data description 10h 11h 12h 0051h 0052h 0059h query unique ascii string ?qry? 13h 14h 0002h 0000h primary oem command set 15h 16h 0040h 0000h address for primary extended table 17h 18h 0000h 0000h alternate oem command set (00h = none exists) 19h 1ah 0000h 0000h address for alternate oem extend ed table (00h = none exists)
124 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information table 9. system interface string addresses (x16) data description 1bh 0027h v cc min. (write/erase) d7?d4: volt, d3?d0: 100 millivolt 1ch 0036h v cc max. (write/erase) d7?d4: volt, d3?d0: 100 millivolt 1dh 0000h v pp min. voltage (00h = no v pp pin present) 1eh 0000h v pp max. voltage (00h = no v pp pin present) 1fh 0007h typical timeout per single byte/word write 2 n s 20h 0007h typical timeout for min. size buffer write 2 n s (00h = not supported) 21h 000ah typical timeout per individual block erase 2 n ms 22h 0000h typical timeout for full chip erase 2 n ms (00h = not supported) 23h 0001h max. timeout for byte/word write 2 n times typical 24h 0005h max. timeout for buffer write 2 n times typical 25h 0004h max. timeout per individual block erase 2 n times typical 26h 0000h max. timeout for full chip erase 2 n times typical (00h = not supported)
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 125 advance information table 10. device geometry definition addresses (x16) data description 27h 001ah 0019h 0018h device size = 2 n byte 1a = 512 mb, 19 = 256 mb, 18 = 128 mb 28h 29h 0002h 0000h flash device interface description (refer to cfi publication 100) 2ah 2bh 0005h 0000h max. number of byte in multi-byte write = 2 n (00h = not supported) 2ch 0001h number of erase block regions within device (01h = uniform device, 02h = boot device) 2dh 2eh 2fh 30h 00xxh 000xh 0000h 000xh erase block region 1 information (refer to the cfi specification or cfi publication 100) 00ffh, 001h, 0000h, 0002h = 512 mb 00ffh, 0000h, 0000h, 0002h = 256 mb 007fh, 0000h, 0000h, 0002h = 128 mb 31h 32h 33h 34h 0000h 0000h 0000h 0000h erase block region 2 information (refer to cfi publication 100) 35h 36h 37h 38h 0000h 0000h 0000h 0000h erase block region 3 information (refer to cfi publication 100) 39h 3ah 3bh 3ch 0000h 0000h 0000h 0000h erase block region 4 information (refer to cfi publication 100)
126 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information table 11. primary vendor-specific extended query command definitions writing specific address and data comma nds or sequences into the command register initiates device operations. ta b l e 1 2 defines the valid register command sequences. writing incorrect address and data va lues or writing them in the im- proper sequence may place the device in an unknown state. a reset command is then required to return the device to reading array data. all addresses are latched on the falling edge of we# or ce#, whichever happens later. all data is latched on the rising edge of we# or ce#, whichever happens first. refer to the ac characteri stics section for timing diagrams. addresses (x16) data description 40h 41h 42h 0050h 0052h 0049h query-unique ascii string ?pri? 43h 0031h major version number, ascii 44h 0033h minor version number, ascii 45h 0010h address sensitive unlock (bits 1-0) 0 = required, 1 = not required process technology (bits 7-2) 0100b = 110 nm mirrorbit 46h 0002h erase suspend 0 = not supported, 1 = to read only, 2 = to read & write 47h 0001h sector protect 0 = not supported, x = number of sectors in per group 48h 0000h sector temporary unprotect 00 = not supported, 01 = supported 49h 0008h sector protect/unprotect scheme 0008h = advanced sector protection 4ah 0000h simultaneous operation 00 = not supported, x = number of sectors in bank 4bh 0000h burst mode type 00 = not supported, 01 = supported 4ch 0002h page mode type 00 = not supported, 01 = 4 word page, 02 = 8 word page 4dh 00b5h acc (acceleration) supply minimum 00h = not supported, d7-d4: volt, d3-d0: 100 mv 4eh 00c5h acc (acceleration) supply maximum 00h = not supported, d7-d4: volt, d3-d0: 100 mv 4fh 00xxh wp# protection 04h = uniform sectors bottom wp# protect, 05h = uniform sectors top wp# protect 50h 0001h program suspend 00h = not supported, 01h = supported
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 127 advance information reading array data the device is automatically set to readin g array data after device power-up. no commands are required to retrieve data. th e device is ready to read array data after completing an embedded program or embedded erase algorithm. after the device accepts an erase suspend command, the device enters the erase-suspend-read mode, after which th e system can read data from any non- erase-suspended sector. after completing a programming operation in the erase suspend mode, the system may once agai n read array data with the same ex- ception. see the erase suspend/erase resume commands section for more information. the system must issue the reset command to retu rn the device to the read (or erase-suspend-read) mode if dq5 goes hi gh during an active program or erase operation, or if the device is in the autoselect mode. see the next section, reset command, for more information. see also requirements for reading array data in the device bus operations sec- tion for more information. the read-o nly operations??ac characteristics? section provides the read parameters, and figure 11 shows the timing diagram. reset command writing the reset command resets the devi ce to the read or erase-suspend-read mode. address bits are don?t cares for this command. the reset command may be written between the sequence cycles in an erase command sequence before erasing begins. this resets the device to the read mode. once erasure begins, however, the device ignores reset commands until the operation is complete. the reset command may be written between the sequence cycles in a program command sequence before programming be gins. this resets the device to the read mode. if the program command sequence is written while the device is in the erase suspend mode, writing the rese t command returns the device to the erase-suspend-read mode. once programming begins, however, the device ig- nores reset commands until the operation is complete. the reset command may be written between the sequence cycles in an autoselect command sequence. once in the autosele ct mode, the reset command must be written to return to the read mode. if the device entered the autoselect mode while in the erase suspend mode, writin g the reset command returns the device to the erase-suspend-read mode. if dq5 goes high during a program or erase operation, writing the reset command returns the device to the read mode (or erase-suspend-read mode if the device was in erase suspend). note that if dq1 goes high during a write buffer programming operation, the sys- tem must write the write-to-buffer-abor t reset command sequence to reset the device for the next operation. autoselect command sequence the autoselect command sequence allows the host system to access the manu- facturer and device codes, and determine whether or not a sector is protected. ta b l e 1 2 shows the address and da ta requirements. this method is an alternative to that shown in ta b l e 5 , which is intended for prom programmers and requires v id on address pin a9. the autoselect co mmand sequence may be written to an
128 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information address that is either in the read or erase-suspend-read mode. the autoselect command may not be written while the device is actively programming or erasing. the autoselect command sequence is initia ted by first writing two unlock cycles. this is followed by a third write cycle that contains the autoselect command. the device then enters the autoselect mode. the system may read at any address any number of times without initiating an other autoselect command sequence: ? a read cycle at address xx00h returns the manufacturer code. ? three read cycles at addresses 01h, 0eh, and 0fh return the device code. ? a read cycle to an address containing a sector address (sa), and the address 02h on a7?a0 in word mode returns 01h if the sector is protected, or 00h if it is unprotected. the system must write the reset command to return to the read mode (or erase- suspend-read mode if the device was previously in erase suspend). enter secured silicon sect or/exit secured silicon sector command sequence the secured silicon sector region provides a secured data area containing an 8- word/16-byte random electronic serial number (esn). the system can access the secured silicon sector region by issu ing the three-cycle enter secured silicon sector command sequence. the device co ntinues to access the secured silicon sector region until the system issues th e four-cycle exit secured silicon sector command sequence. the exit secured sili con sector command sequence returns the device to normal operation. ta b l e 1 2 shows the address and data require- ments for both command sequences. see also ?secured silicon sector flash memory region? for further information. note that the acc function and unlock bypass modes are not available when th e secured silicon sector is enabled. word program command sequence programming is a four-bus-cycle operat ion. the program command sequence is initiated by writing two unlock write cycles, followed by the program set-up com- mand. the program address and data are wr itten next, which in turn initiate the embedded program algorithm. the system is not required to provide further con- trols or timings. the device automatically provides in ternally generated program pulses and verifies the programmed cell margin. ta b l e 1 2 shows the address and data requirements for the word program command sequence. when the embedded program algorithm is complete, the device then returns to the read mode and addresses are no long er latched. the system can determine the status of the program operation by using dq7 or dq6. refer to the write op- eration status section for information on these status bits. any commands written to the device du ring the embedded program algorithm are ignored. note that the secured silicon sector, autoselect, and cfi functions are unavailable when a pr ogram operation is in progress. note that a hardware reset immediately terminates the program operation. the pro- gram command sequence should be reinit iated once the device has returned to the read mode, to ensure data integrity. programming is allowed in any sequence of address locations and across sector boundaries. programming to the same wo rd address multiple times without in- tervening erases (incremental bit programming) requires a modified programming method. for such application requirements, please contact your
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 129 advance information local spansion representative. word pr ogramming is supported for backward compatibility with existing flash driver software and for occasional writing of in- dividual words. use of write buffer pr ogramming is strongly recommended for general programming use wh en more than a few words are to be programmed. the effective word programming time using write buffer programming is much shorter than the single word programming time. any word cannot be pro- grammed from ?0? back to a ?1.? attempting to do so may cause the device to set dq5 = 1, or cause the dq7 and dq6 status bits to indicate the operation was successful. however, a succeeding read wi ll show that the data is still ?0.? only erase operations can convert a ?0? to a ?1.? unlock bypass command sequence the unlock bypass feature allows the sy stem to program words to the device faster than using the standard progra m command sequence. the unlock bypass command sequence is initiated by first writ ing two unlock cycles. this is followed by a third write cycle containing the unlock bypass command, 20h. the device then enters the unlock bypass mode. a two-cycle unlock bypass program com- mand sequence is all that is required to program in this mode. the first cycle in this sequence contains the unlock bypa ss program command, a0h; the second cycle contains the program address and da ta. additional data is programmed in the same manner. this mode dispenses with the initial two unlock cycles required in the standard program command sequence, resulting in faster total program- ming time. ta b l e 1 2 shows the requirements for the command sequence. during the unlock bypass mode, only the unlock bypass program and unlock by- pass reset commands are valid. to exit the unlock bypass mode, the system must issue the two-cycle unlock bypass reset command sequence. (see ta b l e 12 ). write buffer programming write buffer programming allows the system write to a maximum of 16 words/32 bytes in one programming operation. this results in faster effective programming time than the standard programming al gorithms. the write buffer programming command sequence is initiated by first writ ing two unlock cycles. this is followed by a third write cycle containing the write buffer load command written at the sector address in which programming will occur. the fourth cycle writes the sec- tor address and the number of word locati ons, minus one, to be programmed. for example, if the system will program 6 uni que address locations, then 05h should be written to the device. this tells th e device how many write buffer addresses will be loaded with data and therefore wh en to expect the program buffer to flash command. the number of locations to program cannot exceed the size of the write buffer or the operation will abort. the fifth cycle writes the first address lo cation and data to be programmed. the write-buffer-page is selected by address bits a max ?a 4 . all subsequent address/ data pairs must fall within the select ed-write-buffer-page. the system then writes the remaining address/data pairs into the write buffer. write buffer loca- tions may be loaded in any order. the write-buffer-page address must be the same for all address/data pairs loaded into the write buffer. (this means write buffer programming cannot be performed across multiple write-buffer pages. this also means that write buffer program- ming cannot be performed across multiple se ctors. if the system attempts to load programming data outside of the select ed write-buffer page, the operation will abort.)
130 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information note that if a write buffer address location is loaded multiple times, the address/ data pair counter will be decremented fo r every data load operation. the host system must therefore account for load ing a write-buffer location more than once. the counter decrements for each da ta load operation, not for each unique write-buffer-address location. note also that if an address location is loaded more than once into the buffer, the final da ta loaded for that address will be programmed. once the specified number of write buffer locations have been loaded, the system must then write the program buffer to flash command at the sector address. any other address and data combination aborts the write buffer programming oper- ation. the device then begins progra mming. data polling should be used while monitoring the last address location loaded into the write buffer. dq7, dq6, dq5, and dq1 should be monitored to determin e the device status during write buffer programming. the write-buffer programm ing operation can be suspe nded using the standard program suspend/resume commands. upon su ccessful completion of the write buffer programming operation, the device is ready to execute the next command. the write buffer programming sequence ca n be aborted in the following ways: ? load a value that is greater than the pa ge buffer size during the number of locations to program step. ? write to an address in a sector different than the one specified during the write-buffer-load command. ? write an address/data pair to a different write-buffer-page than the one se- lected by the starting address during the write buffer data loading stage of the operation. ? write data other than the confirm co mmand after the specified number of data load cycles. the abort condition is indicated by dq1 = 1, dq7 = data# (for the last address location loaded), dq6 = toggle, and dq 5=0. a write-to-buffer-abort reset com- mand sequence must be written to reset the device for the next operation. note that the full 3-cycle write-to-buffer-abort reset command sequence is required when using write-buffer-programming features in unlock bypass mode. write buffer programming is allowed in any sequence. note that the secured sil- icon sector, autoselect, and cfi func tions are unavailable when a program operation is in progress. this flash device is capable of handling multiple write buffer programming operations on the sa me write buffer address range without intervening erases. for applications re quiring incremental bit programming, a modified programming method is required , please contact your local spansion representative. any bit in a write buffer ad dress range cannot be pro- grammed from ?0? back to a ?1.? attempting to do so may cause the device to set dq5 = 1, or cause the dq7 and dq6 status bits to indicate the operation was successful. however, a succeeding read wi ll show that the data is still ?0.? only erase operations can convert a ?0? to a ?1.? accelerated program the device offers accelerated program operations through the wp#/acc pin. when the system asserts v hh on the wp#/acc pin, the device automatically en- ters the unlock bypass mode. the system may then write the two-cycle unlock bypass program command sequence. the devi ce uses the higher voltage on the wp#/acc pin to accelerate the operation. note that the wp#/ acc pin must not
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 131 advance information be at v hh for operations other than accelera ted programming, or device damage may result. wp# has an internal pull up; when unconnected, wp# is at v ih . figure 2 illustrates the algorithm for the pr ogram operation. refer to the erase and program operations??ac characteristics? section for parameters, and figure 14 for timing diagrams. figure 1. write buffer programming operation write ?write to buffer? command and sector address write number of addresses to program minus 1(wc) and sector address write program buffer to flash sector address write first address/data write to a different sector address fail or abort pa s s read dq15 - dq0 at last loaded address read dq15 - dq0 with address = last loaded address write next address/data pair wc = wc - 1 wc = 0 ? part of ?write to buffer? command sequence ye s ye s ye s ye s ye s ye s no no no no no no abort write to buffer operation? dq7 = data? dq7 = data? dq5 = 1? dq1 = 1? write to buffer aborted. must write ?write-to-buffer abort reset? command sequence to return to read mode. (note 1) (note 2) (note 3) notes: 1. when sector address is specified, any address in the selected sector is acceptable. however, when loading write-buffer address locations with data, all addresses must fall within the selected write-buffer page. 2. dq7 may change simultaneously with dq5. therefore, dq7 shou ld be verified. 3. if this flowchart location was reached because dq5= ?1?, then the device failed. if this flowchart location was reached because dq1= ?1?, then the write to buffer operation was aborted. in either case, the proper reset command must be written before the device can begin another operation. if dq1=1, write the write- buffer-programming-abort-reset command. if dq5=1, write the reset command. 4. see table 12 for command sequences required for write buffer programming.
132 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information figure 2. program operation program suspend/program resume command sequence the program suspend command allows th e system to interrupt a programming operation or a write to buffer programmin g operation so that data can be read from any non-suspended sector. when the program suspend command is written during a programming process, the device halts the program operation within 15 s maximum (5 s typical) and updates the stat us bits. addresses are not re- quired when writing the program suspend command. after the programming operation has been suspended, the system can read array data from any non-suspended sector. the program suspend command may also be issued during a programming operation while an erase is suspended. in this case, data may be read from any addr esses not in erase suspend or program suspend. if a read is needed from the secured silicon sector area (one-time pro- gram area), then user must use the prop er command sequences to enter and exit this region. note that the secured silicon sector autoselect, and cfi functions are unavailable when program operation is in progress. the system may also write the autosele ct command sequence when the device is in the program suspend mode. the syst em can read as many autoselect codes as required. when the device exits the au toselect mode, the device reverts to the program suspend mode, and is ready for another valid operation. see autoselect command sequence for more information. start write program command sequence data poll from system verify data? no yes last address? no yes programming completed increment address embedded program algorithm in progress note: see table 12 for program command sequence.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 133 advance information after the program resume command is written, the device reverts to program- ming. the system can determine the stat us of the program operation using the dq7 or dq6 status bits, just as in the standard program operation. see write op- eration status for more information. the system must write the program re sume command (address bits are don?t care) to exit the program suspend mode and continue the programming opera- tion. further writes of the resume command are ignored. another program suspend command can be written after the device has resume programming. figure 3. program suspend/program resume chip erase command sequence chip erase is a six bus cycle operation. the chip erase command sequence is ini- tiated by writing two unlock cycles, followed by a set-up command. two additional unlock write cycles are then followed by the chip erase command, which in turn invokes the embedded erase algorithm. the device does not require the system to preprogram prior to eras e. the embedded erase algorithm auto- matically preprograms and verifies the enti re memory for an all zero data pattern prior to electrical erase. the system is no t required to provide any controls or tim- ings during these operations. ta b l e 1 2 shows the address and data requirements for the chip erase command sequence. when the embedded erase algorithm is co mplete, the device re turns to the read mode and addresses are no longer latche d. the system can determine the status of the erase operation by using dq7, dq6, or dq2. refer to the write operation status section for informat ion on these status bits. program operation or write-to-buffer sequence in progress write program suspend command sequence command is also valid for erase-suspended-program operations autoselect and secsi sector read operations are also allowed data cannot be read from erase- or program-suspended sectors write program resume command sequence read data as required done reading? no yes write address/data xxxh/30h device reverts to operation prior to program suspend write address/data xxxh/b0h wait 15 s
134 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information any commands written during the chip erase operation are ignored, including erase suspend commands. however, note that a hardware reset immediately terminates the erase operation. if that occurs, the chip erase command sequence should be reinitiated once the device ha s returned to reading array data, to en- sure data integrity. figure 4 illustrates the algorithm for the erase operation. note that the secured silicon sector, autosele ct, and cfi functions are unavailable when an erase operation in is progress. refer to the ?erase and programming perfor- mance? section on page 163 in the ac characteristics section for parameters, and figure 16 section for timing diagrams. sector erase command sequence sector erase is a six bus cycle operation. the sector erase command sequence is initiated by writing two unlock cycles, fo llowed by a set-up command. two addi- tional unlock cycles are written, and ar e then followed by the address of the sector to be erased, and the sector erase command. ta b l e 1 2 shows the address and data requirements for the sector erase command sequence. the device does not require the system to preprogram prior to erase. the em- bedded erase algorithm automatically prog rams and verifies the entire memory for an all zero data pattern prior to electrical erase. the system is not required to provide any controls or timi ngs during these operations. after the command sequence is written, a sector erase time-out of 50 s occurs. during the time-out period , additional sector addresses and sector erase com- mands may be written. loading the sector erase buffer may be done in any sequence, and the number of sectors may be from one sector to all sectors. the time between these additional cycles must be less than 50 s, otherwise erasure may begin. any sector erase address an d command following the exceeded time- out may or may not be accepted. it is recommended that processor interrupts be disabled during this time to ensure all commands are accepted. the interrupts can be re-enabled after the last sector erase command is written. any com- mand other than sector erase or erase suspend during the time-out period resets the device to the read mode. note that the secured silicon sector, autoselect, and cfi functions are unavailable when an erase op- eration in is progress. the system must rewrite the command sequence and any additional addresses and commands. the system can monitor dq3 to determine if the sector erase timer has timed out (see the section on dq3: sector erase ti mer.). the time-out begins from the ris- ing edge of the final we# pulse in the command sequence. when the embedded erase algorithm is co mplete, the device returns to reading array data and addresses are no longer latched. the system can determine the status of the erase operation by reading dq7, dq6, or dq2 in the erasing sector. refer to the write operation status section for information on these status bits. once the sector erase operation has begu n, only the erase suspend command is valid. all other commands are ignored. however, note that a hardware reset im- mediately terminates the erase operation. if that occurs, the sector erase command sequence should be reinitiated on ce the device has returned to reading array data, to ensure data integrity. figure 4 illustrates the algorith m for the erase operation. refer to the erase and program operations table in the ac char acteristics section for parameters, and figure 16 section for timing diagrams.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 135 advance information figure 4. erase operation erase suspend/erase resume commands the erase suspend command, b0h, allows the system to interrupt a sector erase operation and then read data from, or pr ogram data to, any sector not selected for erasure. this command is valid only during the sector erase operation, includ- ing the 50 s time-out period during the sector erase command sequence. the erase suspend command is ignored if wri tten during the chip erase operation or embedded program algorithm. when the erase suspend command is written during the sector erase operation, the device requires a typical of 5 s ( maximum of 20 s) to suspend the erase operation. however, when the erase suspend command is written during the sec- tor erase time-out, the device immediatel y terminates the time-out period and suspends the erase operation. after the erase operation has been suspen ded, the device enters the erase-sus- pend-read mode. the system can read data from or program data to any sector not selected for erasure. (the device ?erase suspends? all sectors selected for erasure.) reading at any address within erase-suspended sectors produces sta- tus information on dq7?d q0. the system can use dq7, or dq6 and dq2 together, to determine if a sector is actively erasing or is erase-suspended. refer to the write operation status section for information on these status bits. after an erase-suspended program operatio n is complete, the device returns to the erase-suspend-read mode. the system can determine the status of the pro- start write erase command sequence (notes 1, 2) data poll to erasing bank from system data = ffh? no yes erasure completed embedded erase algorithm in progress notes: 1. see table 12 for program command sequence. 2. see the section on dq3 for information on the sector erase timer.
136 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information gram operation using the dq7 or dq6 status bits, just as in the standard word program operation. refer to the write operation status section for more information. in the erase-suspend-read mode, the syst em can also issue the autoselect com- mand sequence. refer to the ?autoselect mode? section and ?autoselect command sequence? section on page 127 sections for details. to resume the sector erase operation, the system must write the erase resume command. the address of the erase-suspended sector is required when writing this command. further writes of the resume command are ignored. another erase suspend command can be written afte r the chip has resumed erasing. it is important to allow an interval of at le ast 5 ms between erase resume and erase suspend. lock register command set definitions the lock register command set permits the user to one-time program the se- cured silicon sector protection bit, persistent protection mode lock bit, and password protection mode lock bit. the lock register bits are all readable after an initial access delay. the lock register command set entry command sequence must be issued prior to any of the following commands listed, to enable proper command execution. note that issuing the lock register command set entry command disables reads and writes for the flash memory . ? lock register program command ? lock register read command the lock register command set exit command must be issued after the ex- ecution of the commands to reset the devi ce to read mode. otherwise the device will hang. if this happens, the flash device must be reset. please refer to reset# for more information. it is important to note that the device will be in either per- sistent protection mode or password protection mode depending on the mode selected prior to the device hang. for either the secured silicon sector to be locked, or the device to be perma- nently set to the persistent protection mo de or the password protection mode, the associated lock register bits must be programmed. note that the persistent protection mode lock bit and password protection mode lock bit can never be programmed together at the same time. if so, the lock register program operation will abort . the lock register command set exit command must be initiated to re- enable reads and writes to the main memory. password protection command set definitions the password protection command set perm its the user to program the 64-bit password, verify the programming of the 64-bit password, and then later unlock the device by issuing the valid 64-bit password. the password protection command set entry command sequence must be issued prior to any of the commands list ed following to enable proper command execution. note that issuing the password protection command set entry command disabled reads and writes the main memory.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 137 advance information ? password program command ? password read command ? password unlock command the password program command permits programming the password that is used as part of the hardware protection scheme. the actual password is 64-bits long. there is no special addressing order required for programming the pass- word. the password is programmed in 8-bit or 16-bit portions. each portion requires a password program command. once the password is written and verified , the password protection mode lock bit in the ?lock register? must be programmed in order to prevent verification. the password program command is only capa ble of programming ?0?s. programming a ?1? after a cell is programmed as a ?0? results in a time-out by the embedded program algorithm tm with the cell remaining as a ?0?. the password is all f?s when shipped from the factory. all 64-bit password combinations are valid as a password. the password read command is used to verify the password. the password is verifiable only when the password protecti on mode lock bit in the ?lock register? is not programmed. if the password protection mode lock bit in the ?lock regis- ter? is programmed and the user attempts to read the password, the device will always drive all f?s onto the dq databus. the lower two address bits (a1?a0) for word mode and (a1?a-1) for by byte mode are valid during the password read, password program, and password un- lock commands. writing a ?1? to any other address bits (a max -a2) will abort the password read and password program commands. the password unlock command is used to clear the ppb lock bit to the ?unfreeze state? so that the ppb bits can be modi fied. the exact password must be entered in order for the unlocking function to occur. this 64-bit password unlock com- mand sequence will take at least 2 s to process each time to prevent a hacker from running through the all 64-bit combinations in an attempt to correctly match the password. if another password unlock is issued before the 64-bit password check ex ecution window is completed, the command will be ignored. if the wron g address or data is given during password unlock command cycle, the device may enter the write-to- buffer abort state. in order to exit the write-to-abort state, the write-to- buffer-abort-reset command must be given. otherwise the device will hang. the password unlock function is accompli shed by writing password unlock com- mand and data to the device to perform the clearing of the ppb lock bit to the ?unfreeze state?. the password is 64 bits long. a1 and a0 are used for matching. writing the password unlock command do es not need to be address order spe- cific. an example sequence is starting with the lower address a1-a0=00, followed by a1-a0=01, a1-a0=10, and a1-a0=11 if the device is configured to operate in word mode. approximately 2 s is required for unlocking the device after the valid 64-bit password is given to the device. it is the responsibility of the mi- croprocessor to keep track of the en tering the portions of the 64-bit password with the password unlock command, the order, and when to read the ppb lock bit to confirm successful password unlock. in order to re-lock the device into the password prot ection mode, the ppb lock bit set com- mand can be re-issued.
138 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information the password protection command set exit command must be issued after the execution of the commands listed prev iously to reset the device to read mode. otherwise the device will hang. note that issuing the password protection command set exit command re- enables reads and writes for the main memory. non-volatile sector protection command set definitions the non-volatile sector protection comm and set permits the user to program the persistent protection bits (p pb bits), erase all of the persistent protection bits (ppb bits), and read the logic state of th e persistent protection bits (ppb bits). the non-volatile sector protection command set entry command se- quence must be issued prior to any of the commands listed following to enable proper command execution. note that issuing the non-volatile sector protection command set entry command disables reads and writes for the main memory . ? ppb program command the ppb program command is used to program, or set, a given ppb bit. each ppb bit is individually programmed (but is bu lk erased with the other ppb bits). the specific sector address (a24-a16 for s29gl512n, a23-a16 for s29gl256n, a22- a16 for s29gl128n) is written at the sa me time as the program command. if the ppb lock bit is set to the ?freeze stat e?, the ppb program command will not exe- cute and the command will time-out without programming the ppb bit. ? all ppb erase command the all ppb erase command is used to er ase all ppb bits in bulk. there is no means for individually erasing a specific ppb bit. unlike the ppb program, no spe- cific sector address is required. however, when the all ppb erase command is issued, all sector ppb bits are erased in parallel. if the ppb lock bit is set to ?freeze state?, the all ppb erase command will not execute and the command will time-out without erasing the ppb bits. the device will preprogram all ppb bits prior to erasing when issuing the all ppb erase command. also note that the total number of ppb program/erase cycles has the same endurance as the flash memory array. ? ppb status read command the programming state of the ppb for a given sector can be verified by writing a ppb status read command to the device. this requires an initial access time latency. the non-volatile sector prot ection command set exit command must be issued after the execution of the commands listed previously to reset the device to read mode. note that issuing the non-volatile sector protection command set exit command re-enables reads and writes for the main memory . global volatile sector protection freeze command set the global volatile sector protection fr eeze command set permits the user to set the ppb lock bit and reading the logic state of the ppb lock bit. the global volatile sector protec tion freeze command set entry com- mand sequence must be issued prior to any of the commands li sted following to enable proper command execution.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 139 advance information reads and writes from the main memory are not allowed. ? ppb lock bit set command the ppb lock bit set command is used to se t the ppb lock bit to the ?freeze state? if it is cleared either at reset or if the password unlock command was successfully executed. there is no ppb lock bit clea r command. once the ppb lock bit is set to the ?freeze state?, it cannot be cleare d unless the device is taken through a power-on clear (for persistent protecti on mode) or the password unlock command is executed (for password protection mode). if the password protection mode lock bit is programmed, the ppb lock bit status is reflected as set to the ?freeze state?, even after a power-on reset cycle. ? ppb lock bit status read command the programming state of the ppb lock bit can be verified by executing a ppb lock bit status read command to the device. the global volatile sector protection freeze command set exit command must be issued after the execution of the commands listed previously to reset the device to read mode. volatile sector protection command set the volatile sector protection command set permits the user to set the dynamic protection bit (dyb) to the ?protected state?, clear the dynamic protection bit (dyb) to the ?unprotected state?, and read the logic state of the dynamic protec- tion bit (dyb). the volatile sector protection command set entry command sequence must be issued prior to any of the comma nds listed following to enable proper command execution. note that issuing the volatile sector protection command set entry com- mand disables reads and writes from main memory . ? dyb set command ? dyb clear command the dyb set and dyb clear commands are used to protect or unprotect a dyb for a given sector. the high order address bits are issued at the same time as the code 00h or 01h on dq7-dq0. all other dq data bus pins are ignored during the data write cycle. the dyb bits are modifiab le at any time, regardless of the state of the ppb bit or ppb lock bit. the dyb bi ts are cleared to the ?unprotected state? at power-up or hardware reset. ?dyb status read command the programming state of the dyb bit for a given sector can be verified by writing a dyb status read command to the device. this requires an initial access delay. the volatile sector protection command set exit command must be issued after the execution of the commands listed pr eviously to reset the device to read mode. note that issuing the volatile sector protecti on command set exit com- mand re-enables reads and writes to the main memory .
140 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information secured silicon sector entry command the secured silicon sector entry command allows the following commands to be executed ? read from secured silicon sector ? program to secured silicon sector once the secured silicon sector entry command is issued, the secured silicon sector exit command has to be issued to exit secured silicon sector mode. secured silicon sector exit command the secured silicon sector exit command may be issued to exit the secured sil- icon sector mode.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 141 advance information command definitions ta b l e 1 2 . s29gl512n, s29gl256n, s29gl1 28n command definitions, x16 command (notes) cycles bus cycles (notes 2?5) first second third fourth fifth sixth addr data addr data addr data addr data addr data addr data read (6) 1 ra rd reset (7) 1 xxx f0 autoselect (note 8) manufacturer id 4 555 aa 2aa 55 555 90 x00 01 device id 4 555 aa 2aa 55 555 90 x01 227e x0e note 17 x0f note 17 sector protect verify 4 555 aa 2aa 55 555 90 (sa) x02 xx00 xx01 secure device verify (9) 4 555 aa 2aa 55 555 90 x03 note 10 cfi query (11) 1 55 98 program 4 555 aa 2aa 55 555 a0 pa pd write to buffer 3 555 aa 2aa 55 sa 25 sa wc pa pd wbl pd program buffer to flash (confirm) 1 sa 29 write-to-buffer-abort reset (16) 3 555 aa 2aa 55 555 f0 unlock bypass 3 555 aa 2aa 55 555 20 unlock bypass program (12) 2 xxx a0 pa pd unlock bypass sector erase (12) 2 xxx 80 sa 30 unlock bypass chip erase (12) 2 xxx 80 xxx 10 unlock bypass reset (13) 2 xxx 90 xxx 00 chip erase 6 555 aa 2aa 55 555 80 555 aa 2aa 55 555 10 sector erase 6 555 aa 2aa 55 555 80 555 aa 2aa 55 sa 30 erase suspend/program suspend (14) 1 xxx b0 erase resume/program resume (15) 1 xxx 30 sector command definitions secured silicon sector secured silicon sector entry 3 555 aa 2aa 55 555 88 secured silicon sector exit (18) 4 555 aa 2aa 55 555 90 xx 00 lock register command set definitions lock register lock register command set entry 3 555 aa 2aa 55 555 40 lock register bits program (22) 2 xxx a0 xxx data lock register bits read (22) 1 00 data lock register command set exit (18, 23) 2 xxx 90 xxx 00 password protection co mmand set definitions
142 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information legend: x = don?t care ra = address of the memory to be read. rd = data read from location ra during read operation. pa = address of the memory location to be programmed. addresses latch on the falling edge of the we# or ce# pulse, whichever happens later. pd = data to be programmed at location pa. data latches on th e rising edge of the we# or ce# pulse, whichever happens first. sa = address of the sector to be verified (in autoselect mode) or erased. address bits a max ?a16 uniquely select any sector. wbl = write buffer location. the address must be within the same write buffer page as pa. password password protection command set entry 3 555 aa 2aa 55 555 60 password program (20) 2 xxx a0 pwa x pwd x password read (19) 4 xxx pwd 0 01 pwd 1 02 pwd 2 03 pwd 3 password unlock (19) 7 00 25 00 03 00 pwd 0 01 pwd 1 02 pwd 2 03 pwd 3 00 29 password protection command set exit (18, 23) 2xxx 90 xxx 00 non-volatile sector protecti on command set definitions ppb nonvolatile sector protection command set entry 3 555 aa 2aa 55 555 c0 ppb program (24, 25) 2 xxx a0 sa 00 all ppb erase 2 xxx 80 00 30 ppb status read (25) 1 sa rd (0) non-volatile sector protection command set exit (18) 2xxx 90 xxx 00 global non-volatile sector protecti on freeze command set definitions ppb lock bit global non-volatile sector protection freeze command set entry 3 555 aa 2aa 55 555 50 ppb lock bit set (25) 2 xxx a0 xxx 00 ppb lock status read (25) 1 xxx rd (0) global non-volatile sector protection freeze command set exit (18) 2xxx 90 xxx 00 volatile sector protection command set definitions dyb volatile sector protection co mmand set entry 3 555 aa 2aa 55 555 e0 dyb set (24, 25) 2 xxx a0 sa 00 dyb clear (25) 2 xxx a0 sa 01 dyb status read (25) 1 sa rd (0) volatile sector protection command set exit (18) 2xxx 90 xxx 00 command (notes) cycles bus cycles (notes 2?5) first second third fourth fifth sixth addr data addr data addr data addr data addr data addr data
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 143 advance information wc = word count is the number of write buffer locations to load minus 1. pwd = password pwd x = password word0, word1, word2, and word3. data = lock register contents: pd(0) = secured silicon sector protection bit, pd(1) = persistent protection mode lock bit, pd(2 ) = password protection mode lock bit. notes: 1. see table 1 for description of bus operations. 2. all values are in hexadecimal. 3. except for the read cycle, an d the 4th, 5th, and 6th cycle of the autoselect command sequence, all bus cycles are write cycles. 4. data bits dq15-dq8 are don't cares for unlock and command cycles. 5. address bits a max :a16 are don't cares for unlock and command cycles, unless sa or pa required. (a max is the highest address pin.). 6. no unlock or command cycles re quired when read ing array data. 7. the reset command is required to return to reading array data when device is in the autosele ct mode, or if dq5 goes high (while the device is providing status data). 8. the fourth, fifth, and sixth cycle of the autoselect command sequence is a read cycle. 9. the data is 00h for an unpro tected sector and 01h for a protected sector . see ?autoselect command sequence? for more information. this is same as ppb stat us read except that the protect and unprotect stat uses are inverted here. 10. the data value for dq7 is ?1? for a seri alized and protected otp region and ?0? for an unserialized and unprotected secured silicon sector region. see ?secured silicon sector flash memo ry region? for more informatio n. for s29glxxxnh: xx18h/18h = not factory locked. xx98h/98h = fact ory locked. for s29glxxxnl: xx08h/08h = not factory lo cked. xx88h/88h = factory locked. 11. command is valid when device is ready to read ar ray data or when device is in autoselect mode. 12. the unlock-bypass command is required prior to the unlock-bypass-program command. 13. the unlock-bypass-reset command is required to return to reading array data when the device is in the unlock bypass mode. 14. the system may read and program/program suspend in non-er asing sectors, or enter the autoselect mode, when in the erase suspend mode. the erase su spend command is valid only du ring a sector erase operation. 15. the erase resume/program resume command is valid only during the erase susp end/program suspend modes. 16. issue this command sequence to return to read mode after de tecting device is in a write-to-buffer-abort state. note: the full command sequence is required if resetting out of abort while us ing unlock bypass mode. 17. s29gl512nh/l = 2223h/23h, 2201h/01h; s29gl256nh/l = 2222h/22h, 2201h/01h; s29g l128nh/l = 2221h/21h, 2201h/ 01h. 18. the exit command returns the device to reading the array. 19. note that the password portion can be entered or read in any order as long as the entire 64-bit password is entered or read. 20. for pwdx, only one portion of the password can be programmed per each ?a0? command. 21. the all ppb erase command embeds programming of all ppb bits before erasure. 22. all lock register bits are one-time pr ogrammable. note that the pr ogram state = ?0? and the eras e state = ?1?. also note that of both the persistent protection mode lock bit and the password protection mode lock bit cannot be programmed at the same time or the lock register bits program operation will abort and return the device to read mode. lock register bits that are reserved for future use will default to ?1's?. the lock register is shipped out as ?ffff's? before lock register bit progra m execution. 23. if any of the entry command was initiated, an exit command mu st be issued to reset the device into read mode. otherwise the device will hang. 24. if acc = v hh , sector protection will match when acc = v ih 25. protected state = ?00h?, unprotected state = ?01h?.
144 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information write operation status the device provides several bits to determine the status of a program or erase operation: dq2, dq3, dq5, dq6, and dq7. ta b l e 1 3 and the following subsec- tions describe the function of these bits. dq7 and dq6 each offer a method for determining whether a program or erase operation is complete or in progress. the device also provides a hardware-based output signal, ry/by#, to determine whether an embedded program or erase operation is in progress or has been completed. note that all write operation status dq bits are valid only after 4 s delay. dq7: data# polling the data# polling bit, dq7, indicates to the host system whether an embedded program or erase algorithm is in progress or completed, or whether the device is in erase suspend. data# polling is valid after the rising edge of the final we# pulse in the command sequence. during the embedded program algorithm, the device outputs on dq7 the com- plement of the datum programmed to dq7. this dq7 status also applies to programming during erase suspend. when the embedded program algorithm is complete, the device outputs the datum programmed to dq7. the system must provide the program address to read valid status information on dq7. if a pro- gram address falls within a protected sector, data# polling on dq7 is active for approximately 1 s, then the device returns to the read mode. during the embedded erase algorithm, data# polling produces a ?0? on dq7. when the embedded erase algorithm is co mplete, or if the device enters the erase suspend mode, data# polling produc es a ?1? on dq7. the system must provide an address within any of the sect ors selected for erasure to read valid status information on dq7. after an erase command sequence is written, if all sectors selected for erasing are protected, data# polling on dq7 is ac tive for approximately 100 s, then the device returns to the read mode. if not all selected sectors are protected, the em- bedded erase algorithm erases the unprotected sectors, and ignores the selected sectors that are protected. however, if th e system reads dq7 at an address within a protected sector, the status may not be valid. just prior to the completion of an em bedded program or erase operation, dq7 may change asynchronously with dq0?dq 6 while output enable (oe#) is as- serted low. that is, the device may chan ge from providing status information to valid data on dq7. depending on when the system samples the dq7 output, it may read the status or valid data. even if the device has completed the program or erase operation and dq7 has valid data, the data outputs on dq0?dq6 may be still invalid. valid data on dq0?dq7 will appear on successive read cycles. ta b l e 1 3 shows the outputs for data# polling on dq7. figure 5 shows the data# polling algorithm. figure 17 in the ac characteristics section shows the data# polling timing diagram.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 145 advance information figure 5. data# polling algorithm ry/by#: ready/busy# the ry/by# is a dedicated, open-drain output pin which indicates whether an embedded algorithm is in progress or complete. the ry/by# status is valid after the rising edge of the final we# pulse in the command sequence. since ry/by# is an open-drain output, several ry/by# pins can be tied together in parallel with a pull-up resistor to v cc . if the output is low (busy), the device is actively erasing or programming. (this includes programming in the erase suspend mode.) if the output is high (ready), the device is in the read mode, the stan dby mode, or in the erase-suspend-read mode. ta b l e 1 3 shows the outputs for ry/by#. dq7 = data? yes no no dq5 = 1 no yes yes fail pass read dq15?dq0 addr = va read dq15?dq0 addr = va dq7 = data? start notes: 1. va = valid address for prog ramming. during a sector erase operation, a valid address is any sector address within the sector being erased. during chip erase, a valid address is any non-protected sector address. 2. dq7 should be rechecked even if dq5 = ?1? because dq7 may change simultaneously with dq5.
146 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information dq6: toggle bit i toggle bit i on dq6 indicates whether an embedded program or erase algorithm is in progress or complete, or whether the device has entered the erase suspend mode. toggle bit i may be read at any address, and is valid after the rising edge of the final we# pulse in the command sequence (prior to the program or erase operation), and during the sector erase time-out. during an embedded program or erase algorithm operation, successive read cy- cles to any address cause dq6 to toggle. the system may use either oe# or ce# to control the read cycles. when the op eration is complete, dq6 stops toggling. after an erase command sequence is written, if all sectors selected for erasing are protected, dq6 toggles for approximately 100 s, then returns to reading array data. if not all selected sectors are protected, the embedded erase algo- rithm erases the unprotected sectors, an d ignores the selected sectors that are protected. the system can use dq6 and dq2 together to determine whether a sector is ac- tively erasing or is erase-suspended. when the device is actively erasing (that is, the embedded erase algorithm is in progre ss), dq6 toggles. when the device en- ters the erase suspend mode, dq6 stops toggling. however, the system must also use dq2 to determine which sectors are erasing or erase-suspended. alter- natively, the system can use dq7 (see the subsection on dq7: data# polling). if a program address falls within a protected sector, dq6 toggles for approxi- mately 1 s after the program command se quence is written, then returns to reading array data. dq6 also toggles during the erase-su spend-program mode, and stops toggling once the embedded program algorithm is complete. ta b l e 1 3 shows the outputs for toggle bit i on dq6. figure 6 shows the toggle bit algorithm. figure 18 in the ?ac characteristics? section shows the toggle bit tim- ing diagrams. figure 19 shows the differences between dq2 and dq6 in graphical form. see also the subsection on dq2: toggle bit ii.
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 147 advance information figure 6. toggle bit algorithm dq2: toggle bit ii the ?toggle bit ii? on dq2, when used wi th dq6, indicates whether a particular sector is actively erasing (that is, the embedded erase algorithm is in progress), or whether that sector is erase-suspended. toggle bit ii is valid after the rising edge of the final we# pulse in the command sequence. dq2 toggles when the system reads at a ddresses within those sectors that have been selected for erasure. (the system may use either oe# or ce# to control the start no yes yes dq5 = 1? no yes toggle bit = toggle? no program/erase operation not complete, write reset command program/erase operation complete read dq7?dq0 toggle bit = toggle? read dq7?dq0 twice read dq7?dq0 note: the system should recheck the toggle bit even if dq5 = ?1? because the toggle bit may stop toggling as dq5 changes to ?1.? see the subsections on dq6 and dq2 for more information.
148 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information read cycles.) but dq2 cannot distinguish whether the sector is actively erasing or is erase-suspended. dq6, by comparison, indicates whether the device is actively erasing, or is in erase suspend, but cannot distinguish which sectors are selected for erasure. thus, both status bits are re quired for sector an d mode information. refer to ta b l e 1 3 to compare outputs for dq2 and dq6. figure 6 shows the toggle bit algorithm in flowchart form, and the section ?dq2: toggle bit ii? explains the algorithm. see also the ry/by#: ready/busy# subsec- tion. figure 18 shows the toggle bit timing diagram. figure 19 shows the differences between dq2 and dq6 in graphical form. reading toggle bits dq6/dq2 refer to figure 6 and figure 19 for the following discussion. whenever the system initially begins reading toggle bit status, it must read dq7?dq0 at least twice in a row to determine whether a toggle bit is toggling. typically, the system would note and store the value of the toggle bi t after the first read. after the second read, the system would compare the new valu e of the toggle bit with the first. if the toggle bit is not toggli ng, the device has completed the program or erase op- eration. the system can read array data on dq7?dq0 on the following read cycle. however, if after the initial two read cycl es, the system determines that the toggle bit is still toggling, the system also shou ld note whether the value of dq5 is high (see the section on dq5). if it is, the system should then determine again whether the toggle bit is toggling, sinc e the toggle bit may have stopped toggling just as dq5 went high. if the toggle bit is no longer toggling, the device has suc- cessfully completed the program or erase operation. if it is still toggling, the device did not completed the operation successfully, and the system must write the reset command to return to reading array data. the remaining scenario is that the system initially determines that the toggle bit is toggling and dq5 has not gone high. the system may continue to monitor the toggle bit and dq5 through successive read cycles, determining the status as de- scribed in the previous paragraph. altern atively, it may choose to perform other system tasks. in this case, the system must start at the beginning of the algo- rithm when it returns to determine th e status of the operation (top of figure 6 ). dq5: exceeded timing limits dq5 indicates whether the program, erase, or write-to-buffer time has ex- ceeded a specified internal pulse co unt limit. under these conditions dq5 produces a ?1,? indicating that the program or erase cycle was not successfully completed. the device may output a ?1? on dq5 if the system tries to program a ?1? to a location that was previously programmed to ?0.? only an erase operation can change a ?0? back to a ?1.? under this condition, the device halts the opera- tion, and when the timing limit has been exceeded, dq5 produces a ?1.? in all these cases, the system must writ e the reset command to return the device to the reading the array (o r to erase-suspend-read if the device was previously in the erase-suspend-program mode). dq3: sector erase timer after writing a sector erase command sequ ence, the system may read dq3 to de- termine whether or not erasure has begu n. (the sector erase timer does not apply to the chip erase comm and.) if additional sectors are selected for erasure,
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 149 advance information the entire time-out also applies after each additional sector erase command. when the time-out period is complete, dq 3 switches from a ?0? to a ?1.? if the time between additional sector erase commands from the system can be as- sumed to be less than 50 s, the syst em need not monitor dq3. see also the sector erase command sequence section. after the sector erase command is written, the system should read the status of dq7 (data# polling) or dq6 (toggle bit i) to ensure that the device has accepted the command sequence, and then read dq3. if dq3 is ?1,? the embedded erase algorithm has begun; all further comma nds (except erase suspend) are ignored until the erase operation is complete. if dq3 is ?0,? the device will accept addi- tional sector erase commands. to ensure the command has been accepted, the system software should check the status of dq3 prior to and following each sub- sequent sector erase command. if dq3 is high on the second status check, the last command might not have been accepted. ta b l e 1 3 shows the status of dq3 relative to the other status bits. dq1: write-to-buffer abort dq1 indicates whether a write-to-buffer operation was aborted. under these conditions dq1 produces a ?1?. the syst em must issue the wr ite-to-buffer-abort- reset command sequence to return the de vice to reading array data. see write buffer section for more details. ta b l e 1 3 . write operation status notes: 1. dq5 switches to ?1? when an embedded program, embedded erase, or write-to-buffer operatio n has exceeded the maximum timing limits. refer to the sect ion on dq5 for more information. 2. dq7 and dq2 require a valid address when reading status information. refer to the appropriate subs ection for further details. 3. the data# polling algorithm should be used to monitor the last load ed write-buffer address location. 4. dq1 switches to ?1? when the device has aborted the write- to-buffer operation. status dq7 (note 2) dq6 dq5 (note 1) dq3 dq2 (note 2) dq1 ry/ by# standard mode embedded program algorithm dq7# toggle 0 n/a no toggle 0 0 embedded erase algorithm 0 toggle 0 1 toggle n/a 0 program suspend mode program- suspend read program-suspended sector invalid (not allowed) 1 non-program suspended sector data 1 erase suspend mode erase- suspend read erase-suspended sector 1 no toggle 0 n/a toggle n/a 1 non-erase suspended sector data 1 erase-suspend-program (embedded program) dq7# toggle 0 n/a n/a n/a 0 write-to- buffer busy (note 3) dq7# toggle 0 n/a n/a 0 0 abort (note 4) dq7# toggle 0 n/a n/a 1 0
150 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information absolute maximum ratings storage temperature, plastic packages . . . . . . . . . . . . . . . . ?65c to +150c ambient temperature with power applied . . . . . . . . . . . . . . ?65c to +125c voltage with respect to ground: v cc (note 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to +4.0 v v io . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ?0.5 v to +4.0 v a9, oe#, and acc (note 2) . . . . . . . . . . . . . . . . . . . ?0.5 v to +12.5 v all other pins (note 1) . . . . . . . . . . . . . . . . . . . . . ?0.5 v to v cc + 0.5v output short circuit current (note 3) . . . . . . . . . . . . . . . . . . . 200 ma notes: 1. minimum dc voltage on input or i/os is ?0.5 v. during voltage transitions, inputs or i/os may overshoot v ss to ?2.0 v for periods of up to 20 ns. see figure 7 . maximum dc voltage on input or i/os is v cc + 0.5 v. during voltage transitions, input or i/o pins may overshoot to v cc + 2.0 v for periods up to 20 ns. see figure 8 . 2. minimum dc input voltage on pins a9, oe#, and acc is ?0.5 v. during voltage transitions, a9, oe#, and acc may overshoot v ss to ?2.0 v for periods of up to 20 ns. see figure 7 . maximum dc input voltage on pin a9, oe#, and acc is +12.5 v which may overshoot to +14. 0v for periods up to 20 ns. 3. no more than one output may be shorted to ground at a time. duration of the short circuit should not be gr eater than one second. 4. stresses above those listed under ?a bsolute maximum ra tings? may cause permanent damage to the device. this is a stress rating only; functional operation of the device at these or any other conditions above those indicated in the operational sections of this data sheet is not implied. exposure of the device to absolute maximum rating conditions fo r extended periods may affect device reliability. operating ranges industrial (i) devices ambient temperature (t a ) . . . . . . . . . . . . . . . . . . . . . . . . . ?40c to +85c supply voltages v cc . . . . . . . . . . . . . . . . . . . . . . . . . . +2.7 v to +3.6 v or +3.0v to 3.6v v io (note 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . +1.65v to 1.95v or vcc notes: 1. operating ranges define those limits between whic h the functionality of th e device is guaranteed. 2. see ?product selector guid e? section on page 80 . figure 7. maximum negative overshoot waveform figure 8. maximum positive overshoot waveform 20 ns 20 ns +0.8 v ?0.5 v 20 ns ?2.0 v 20 ns 20 ns v cc +2.0 v v cc +0.5 v 20 ns 2.0 v
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 151 advance information dc characteristics cmos compatible-s29gl128n, s29gl256n, s29gl512n notes: 1. the i cc current listed is typically less than 2 ma/mhz, with oe# at v ih . 2. i cc active while embedded erase or embedded progra m or write buffer programming is in progress. 3. not 100% tested. 4. automatic sleep mode enables the lower power mode when addresses remain stable tor t acc + 30 ns. 5. v io = 1.65?1.95 v or 2.7?3.6 v 6. v cc = 3 v and v io = 3v or 1.8v. when v io is at 1.8v, i/o pins cannot operate at 3v. parameter symbol parameter description (notes) test conditions min typ max unit i li input load current (1) v in = v ss to v cc , v cc = v cc max wp/acc: 2.0 a others: 1.0 i lit a9 input load current v cc = v cc max ; a9 = 12.5 v 35 a i lo output leakage current v out = v ss to v cc , v cc = v cc max 1.0 a i cc1 v cc active read current (1) ce# = v il, oe# = v ih , v cc = v ccmax , f = 5 mhz 30 50 ma ce# = v il , oe# = v ih , v cc = v ccmax , f = 10 mhz 60 90 i cc2 v cc intra-page read current (1) ce# = v il, oe# = v ih, v cc = v ccmax f = 10 mhz 110 ma ce# = v il , oe# = v ih , v cc = v ccmax , f=33 mhz 520 i cc3 v cc active erase/program current (2, 3) ce# = v il, oe# = v ih, v cc = v ccmax 50 80 ma i cc4 v cc standby current ce#, reset# = v ss 0.3 v, oe# = v ih , v cc = v ccmax v il = v ss + 0.3 v/- 0.1v 15ma i cc5 v cc reset current v cc = v ccmax ; v il = v ss + 0.3 v/-0.1v, reset# = v ss 0.3 v 15a i cc6 automatic sleep mode (4) v cc = v ccmax v ih = v cc 0.3 v, v il = v ss + 0.3 v/-0.1v, wp#/a cc = v ih 15a i acc acc accelerated program current ce# = v il, oe# = v ih, v cc = v ccmax, wp#/acc = v ih wp#/acc pin 10 20 ma v cc pin 50 80 v il input low voltage (5) ?0.1 0.3 x v io v v ih input high voltage (5) 0.7 x v io v io + 0.3 v v hh voltage for acc erase/program acceleration v cc = 2.7 ?3.6 v 11.5 12.5 v v id voltage for autoselect and temporary sector unprotect v cc = 2.7 ?3.6 v 11.5 12.5 v v ol output low voltage (5) i ol = 100 a 0.15 x v io v v oh output high voltage (5) i oh = -100 a 0.85 x v io v v lko low v cc lock-out voltage (3) 2.3 2.5 v
152 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information test conditions note: if v io < v cc , the reference level is 0.5 v io . key to switching waveforms table 14. test specifications 2.7 k ? c l 6.2 k ? 3.3 v device under te s t note: diodes are in3064 or equivalent. figure 9. test setup test condition all speeds unit output load 1 ttl gate output load capacitance, c l (including jig capacitance) 30 pf input rise and fall times 5 ns input pulse levels 0.0?v io v input timing measurement reference levels (see note) 0.5v io v output timing measurement reference levels 0.5 v io v waveform inputs outputs steady changing from h to l changing from l to h don?t care, any change permitted changing, state unknown does not apply center line is high impedance state (high z) v io 0.0 v 0.5 v io 0.5 v io v output measurement level input note: if v io < v cc , the input measurement reference level is 0.5 v io . figure 10. input waveforms and measurement levels
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 153 advance information ac characteristics read-only operations?s29gl128n, s29gl256n, s29gl512n notes: 1. not 100% tested. 2. ce#, oe# = v il 3. oe# = v il 4. see figure 9 and table 14 for test specifications. 5. unless otherwise indicated, ac spec ifications for 90 ns, 100 ns, and 110 ns speed options are tested with v io = v cc = 3 v. ac specifications for 110 ns sp eed options are tested with v io = 1.8 v and v cc = 3.0 v. parameter description test setup speed options jedec std. 90 100 110 110 unit t avav t rc read cycle time v io = v cc = 3 v min 90 100 110 ns v io = 1.8 v, v cc = 3 v 110 t avqv t acc address to output delay (note 2) v io = v cc = 3 v max 90 100 110 ns v io = 1.8 v, v cc = 3 v 110 t elqv t ce chip enable to output delay (note 3) v io = v cc = 3 v max 90 100 110 ns v io = 1.8 v, v cc = 3 v 110 t pacc page access time max 25 25 25 30 ns t glqv t oe output enable to output delay max 25 25 35 35 ns t ehqz t df chip enable to output high z (note 1) max 20 ns t ghqz t df output enable to output high z (note 1) max 20 ns t axqx t oh output hold time from addresses, ce# or oe#, whicheve r occurs first min 0 ns t oeh output enable hold time (note 1) read min 0 ns toggle and data# polling min 10 ns t ceh chip enable hold time read min 35 ns
154 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ac characteristics notes: 1. figure shows word mode. figure 12. page read timings figure 11. read operation timings t oh t ce outputs we# addresses ce# oe# high z output valid high z addresses stable t rc t acc t oeh t rh t oe t rh 0 v ry/by# reset# t df t ceh amax - a2 ce# oe# a2 - a0* data bus same page aa ab ac ad qa qb qc qd t acc t pac c t pac c t pac c
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 155 advance information ac characteristics hardware reset (reset#) notes: 1. not 100% tested. if ramp rate is equal to or faster than 1v/100s with a falling edge of the reset# pin initiated, the reset# pin needs to be held low only for 100s for power-up. 2. next generation devices ma y have different reset speeds. parameter description speed (note 2) unit jedec std. t ready reset# pin low (during embedded algorithms) to read mode (see note) max 20 ns t ready reset# pin low (not during embedded algorithms) to read mode (see note) max 500 ns t rp reset# pulse width min 500 ns t rh reset high time before read (see note) min 50 ns t rpd reset# low to standby mode min 20 s t rb ry/by# recovery time min 0 ns reset# ry/by# ry/by# t rp t ready reset timings not during embedded algorithms t ready ce#, oe# t rh ce#, oe# reset timings during embedded algorithms reset# t rp t rb t rh figure 13. reset timings
156 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ac characteristics erase and program operations ?s29gl128n, s29gl256n, s29gl512n notes: 1. not 100% tested. 2. see the ?erase and programming perfo rmance? section for more information. 3. for 1?16 words/1?32 bytes programmed. 4. effective write buffer specification is base d upon a 16-word/32-byte write buffer operation. 5. unless otherwise indicated, ac specifications for 90 ns, 100 ns, and 110 ns speed options are tested with v io = v cc = 3 v. ac specifications for 110 ns speed options are tested with v io = 1.8 v and v cc = 3.0 v. parameter speed options jedec std. description 90 100 110 110 unit t avav t wc write cycle time (note 1) min 90 100 110 110 ns t avwl t as address setup time min 0 ns t aso address setup time to oe# low during toggle bit polling min 15 ns t wlax t ah address hold time min 45 ns t aht address hold time from ce# or oe# high during toggle bit polling min 0 ns t dvwh t ds data setup time min 45 ns t whdx t dh data hold time min 0 ns t ceph ce# high during toggle bit polling min 20 t oeph output enable high during toggle bit polling min 20 ns t ghwl t ghwl read recovery time before write (oe# high to we# low) min 0 ns t elwl t cs ce# setup time min 0 ns t wheh t ch ce# hold time min 0 ns t wlwh t wp write pulse width min 35 ns t whdl t wph write pulse width high min 30 ns t whwh1 t whwh1 write buffer program operation (notes 2, 3) typ 240 s effective write buffer program operation (notes 2, 4) per word typ s 15 accelerated effective write buffer program operation (notes 2, 4) per word typ s 13.5 program operation (note 2) word typ s 60 accelerated programming operation (note 2) word typ s 54 t whwh2 t whwh2 sector erase operation (note 2) typ 0.5 sec t vhh v hh rise and fall time (note 1) min 250 ns t vcs v cc setup time (note 1) min 50 s t busy erase/program valid to ry/by# delay min 90 ns
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 157 advance information ac characteristics notes: 1. not 100% tested. 2. ce#, oe# = v il 3. oe# = v il 4. see figure 9 and table 14 for test specifications. oe# we# ce# v cc data addresses t ds t ah t dh t wp pd t whwh1 t wc t as t wph t vcs 555h pa pa read status data (last two cycles) a0h t cs status d out program command sequence (last two cycles) ry/by# t rb t busy t ch pa n otes: 1 . pa = program address, pd = program data, d out is the true data at the program address. 2 . illustration shows device in word mode. figure 14. program operation timings acc t vhh v hh v il or v ih v il or v ih t vhh figure 15. accelerated program timing diagram
158 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ac characteristics oe# ce# addresses v cc we# data 2aah sa t ah t wp t wc t as t wph 555h for chip erase 10 for chip erase 30h t ds t vcs t cs t dh 55h t ch in progress complete t whwh2 va va erase command sequence (last two cycles) read status data ry/by# t rb t busy notes: 1. sa = sector address (for sector erase), va = valid addr ess for reading status data (see ?write operation status?. 2. these waveforms are for the word mode. figure 16. chip/sector erase operation timings
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 159 advance information ac characteristics figure 17. data# polling timings (during embedded algorithms) we# ce# oe# high z t oe high z dq7 dq6?dq0 ry/by# t busy complement tr u e addresses va t oeh t ce t ch t oh t df va va status data complement status data tr u e valid data valid data t acc t rc note: 1. va = valid address. illustration shows first status cycle after command sequence, last status read cycle, and array data read cycle. 2. t oe for data polling is 45 ns when v io = 1.65 to 2.7 v and is 35 ns when v io = 2.7 to 3.6 v
160 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ac characteristics oe# ce# we# addresses t oeh t dh t aht t aso t oeph t oe valid data (first read) (second read) (stops toggling) t ceph t aht t as d q2 and dq6 valid dat a valid status valid status valid status ry/by# note: va = valid address; not required for dq6. illustration shows first two status cycle after command sequence, last status read cycle, and array data read cycle figure 18. toggle bit timings (during embedded algorithms) note: dq2 toggles only when read at an address within an erase-suspended sector. the system may use oe# or ce# to toggle dq2 and dq6 . figure 19. dq2 vs. dq6 enter erase erase erase enter erase suspend program erase suspend read erase suspend read erase we# dq6 dq2 erase complete erase suspend suspend program resume embedded erasing
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 161 advance information ac characteristics alternate ce# controlle d erase and program operations- s29gl128n, s29gl256n, s29gl512n notes: 1. not 100% tested. 2. see the ?ac characteristics? section for more information. 3. for 1?16 words/1?32 bytes programmed. 4. effective write buffer specification is base d upon a 16-word/32-byte write buffer operation. 5. unless otherwise indicated, ac specifications for 90 ns, 100ns, and 110 ns speed options are tested with v io = v cc = 3 v. ac specifications for 110 ns speed options are tested with v io = 1.8 v and v cc = 3.0 v. parameter speed options jedec std. description 90 100 110 110 unit t avav t wc write cycle time (note 1) min 90 100 110 110 ns t avwl t as address setup time min 0 ns t aso address setup time to oe# low during toggle bit polling min 15 ns t elax t ah address hold time min 45 ns t aht address hold time from ce# or oe# high during toggle bit polling min 0 ns t dveh t ds data setup time min 45 ns t ehdx t dh data hold time min 0 ns t ceph ce# high during toggle bit polling min 20 ns t oeph oe# high during toggle bit polling min 20 ns t ghel t ghel read recovery time before write (oe# high to we# low) min 0 ns t wlel t ws we# setup time min 0 ns t ehwh t wh we# hold time min 0 ns t eleh t cp ce# pulse width min 35 ns t ehel t cph ce# pulse width high min 30 ns t whwh1 t whwh1 write buffer program operation (notes 2, 3) typ 240 s effective write buffer program operation (notes 2, 4) per word typ 15 s effective accelerated write buffer program operation (notes 2, 4) per word typ 13.5 s program operation (note 2) word typ 60 s accelerated programming operation (note 2) word typ 54 s t whwh2 t whwh2 sector erase operation (note 2) typ 0.5 sec
162 s29glxxxn mirrorbit tm flash family s29glxxxn_mcp_a1 december 15, 2004 advance information ac characteristics t ghel t ws oe# ce# we# reset# t ds data t ah addresses t dh t cp dq7# d out t wc t as t cph pa data# polling a0 for program 55 for erase t rh t whwh1 or 2 ry/by# t wh pd for program 30 for sector erase 10 for chip erase 555 for program 2aa for erase pa for program sa for sector erase 555 for chip erase t busy notes: 1. figure indicates last two bus cycles of a program or erase operation. 2. pa = program address, sa = sector address, pd = program data. 3. dq7# is the complement of th e data written to the device. d out is the data written to the device. 4. waveforms are fo r the word mode. figure 20. alternate ce# controlled write (erase/program) operation timings
december 15, 2004 s29glxxxn_mcp_a1 s29glxxxn mirrorbit tm flash family 163 advance information erase and programming performance notes: 1. typical program and erase times assume the following conditions: 25c, 3.0 v v cc , 10,000 cycles, checkerboard pattern. 2. under worst case conditions of 90c, v cc = 3.0 v, 100,000 cycles. 3. effective write buffer specification is ba sed upon a 16-word write buffer operation. 4. the typical chip programming time is considerably less th an the maximum chip programmi ng time listed, since most words program faster than th e maximum program times listed. 5. in the pre-programming step of the embedded erase al gorithm, all bits are programmed to 00h before erasure. 6. system-level overhead is the time required to execut e the two- or four-bus-cycle sequence for the program command. see table 12 for further information on command definitions. tsop pin and bga package capacitance notes: 1. sampled, not 100% tested. 2. test conditions t a = 25c, f = 1.0 mhz. parameter typ (note 1) max (note 2) unit comments sector erase time 0.5 3.5 sec excludes 00h programming prior to erasure (note 5) chip erase time s29gl128n 64 256 sec s29gl256n 128 512 s29gl512n 256 1024 total write buffer programming time (note 3) 240 s excludes system level overhead (note 6) total accelerated effective write buffer programming time (note 3) 200 s chip program time s29gl128n 123 sec s29gl256n 246 s29gl512n 492 parameter symbol parameter desc ription test setup typ max unit c in input capacitance v in = 0 tsop 6 7.5 pf bga 4.2 5.0 pf c out output capacitance v out = 0 tsop 8.5 12 pf bga 5.4 6.5 pf c in2 control pin capacitance v in = 0 tsop 7.5 9 pf bga 3.9 4.7 pf
164 psram type 2 psram_type02_15a0 may 3, 2004 advance information psram type 2 16mb (1mb word x 16-bit) 32mb (2mb word x 16-bit) 64mb (4mb word x 16-bit) features ? process technology: cmos ? organization: x16 bit ? power supply voltage: 2.7~3.1v ? three state outputs ? compatible with low power sram product information pin description density v cc range standby (isb1, max.) operating (icc2, max.) mode 16mb 2.7-3.1v 80 a 30 ma dual cs 16mb 2.7-3.1v 80 a 35 ma dual cs and page mode 32mb 2.7-3.1v 100 a 35 ma dual cs 32mb 2.7-3.1v 100 a 40 ma dual cs and page mode 64mb 2.7-3.1v tbd tbd dual cs 64mb 2.7-3.1v tbd tbd dual cs and page mode pin name description i/o cs1#, cs2 chip select i oe# output enable i we# write enable i lb#, ub# lower/upper byte enable i a0-a19 (16m) a0-a20 (32m) a0-a21 (64m) address inputs i i/o0-i/o15 data inputs/outputs i/o v cc /v ccq power supply ? v ss /v ssq ground ? nc not connection ? dnu do not use ?
may 3, 2004 psram_type02_15a0 psram type 2 165 advance information power up sequence 1. apply power. 2. maintain stable power (v cc min.=2.7v) for a minimum 200 s with cs1#=high or cs2=low.
166 psram type 2 psram_type02_15a0 may 3, 2004 advance information timing diagrams power up notes: 1. after v cc reaches v cc (min.), wait 200 s with cs1# high. then the device gets into the normal operation. notes: 1. after v cc reaches v cc (min.), wait 200 s with cs2 low. then the device gets into the normal operation. functional description legend: x = don?t care (must be low or high state). figure 21. power up 1 (cs1# controlled) figure 22. power up 2 (cs2 controlled) mode cs1# cs2 oe# we# lb# ub# i/o 1-8 i/o 9-16 power deselected h x x x x x high-z high-z standby deselected x l x x x x high-z high-z standby deselected x x x x h h high-z high-z standby output disabled l h h h l x high-z high-z active outputs disabled l h h h x l high-z high-z active lower byte read l h l h l h d out high-z active upper byte read l h l h h l high-z d out active word read l h l h l l d out d out active lower byte write l h x l l h d in high-z active upper byte write l h x l h l high-z d in active word write l h x l l l d in d in active min. 200 s v cc cs 1# cs2 v cc(min) normal operation power up mode ~ ~ ~ ~ ~ ~ ~ ~ min. 200 s v cc cs1# cs2 v cc(min) normal operation power up mode ~ ~ ~ ~ ~ ~ ~ ~
may 3, 2004 psram_type02_15a0 psram type 2 167 advance information absolute maximum ratings notes: 1. stresses greater than those listed under " absolute maximum ratings " section may cause permanent damage to the device. functional operation should be restricted to be used un der recommended operating condit ion. exposure to absolute maximum rating conditions longer th an 1 second may affect reliability. dc recommended operating conditions notes: 1. ta=-40 to 85c, otherwise specified. 2. overshoot: v cc +1.0v in case of pulse width 20ns. 3. undershoot: -1.0v in case of pulse width 20ns. 4. overshoot and undershoot ar e sampled, not 100% tested. capacitance (ta = 25c, f = 1 mhz) note: this parameter is sampled periodically and is not 100% tested. dc and operating characteristics common item symbol ratings unit voltage on any pin relative to v ss v in , v out -0.2 to v cc +0.3v v voltage on v cc supply relative to v ss v cc -0.2 to 3.6v v power dissipation p d 1.0 w operating temperature t a -40 to 85 c symbol parameter min ty p max unit v cc power supply voltage 2.7 2.9 3.1 v v ss ground 0 0 0 v ih input high voltage 2.2 ? v cc + 0.3 (note 2) v il input low voltage -0.2 (note 3) ? 0.6 symbol parameter test condition min max unit c in input capacitance v in = 0v ? 8 pf c oio input/output capacitance v out = 0v ? 10 pf item symbol test conditions min ty p max unit input leakage current i li v in =v ss to v cc -1 ? 1 a output leakage current i lo cs1#=v ih or cs2=v il or oe#=v ih or we#=v il or lb#=ub#=v ih , v io =v ss to v cc -1 ? 1 a output low voltage v ol i ol =2.1ma ? ? 0.4 v output high voltage v oh i oh =-1.0ma 2.4 ? ? v
168 psram type 2 psram_type02_15a0 may 3, 2004 advance information 16m psram notes: 1. standby mode is supposed to be set up after at least one ac tive operation after power up. is b1 is measure after 60ms from the time when standby mode is set up. 32m psram notes: 1. standby mode is supposed to be set up after at least one ac tive operation after power up. is b1 is measure after 60ms from the time when standby mode is set up. item symbol test conditions min ty p max unit average operating current i cc1 cycle time=1s, 100% duty, i io =0ma, cs1# 0.2v, lb# 0.2v and/or ub# 0.2v, cs2 v cc -0.2v, v in 0.2v or v in vcc-0.2v ? ? 7 ma i cc2 async cycle time=min, i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in =v ih or v il ? ? 30 ma page cycle time=t rc +3t pc , i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in -v ih or v il 35 ma standby current (cmos) i sb1 (note 1) other inputs=0-vcc 1. cs1# v cc - 0.2, cs2 v cc - 0.2v (cs1# controlled) or 2. 0v cs2 0.2v (cs2 controlled) ? ? 80 ma item symbol test conditions min ty p max unit average operating current i cc1 cycle time=1s, 100% duty, i io =0ma, cs1# 0.2v, lb# 0.2v and/or ub# 0.2v, cs2 v cc -0.2v, v in 0.2v or v in vcc-0.2v ? ? 7 ma i cc2 async cycle time=min, i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in =v ih or v il ? ? 35 ma page cycle time=t rc +3t pc , i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in -v ih or v il 40 ma standby current (cmos) i sb1 (note 1) other inputs=0-vcc 1. cs1# v cc - 0.2, cs2 v cc - 0.2v (cs1# controlled) or 2. 0v cs2 0.2v (cs2 controlled) ? ? 100 ma
may 3, 2004 psram_type02_15a0 psram type 2 169 advance information 64m psram notes: 1. standby mode is supposed to be set up after at least one ac tive operation after power up. is b1 is measure after 60ms from the time when standby mode is set up. ac operating conditions test conditions (test load and test input/output reference) ? input pulse level: 0.4 to 2.2v ? input rising and falling time: 5ns ? input and output reference voltage: 1.5v ? output load (see figure 23): cl=50pf note: including scope and jig capacitance. item symbol test conditions min ty p max unit average operating current i cc1 cycle time=1s, 100% duty, i io =0ma, cs1# 0.2v, lb# 0.2v and/or ub# 0.2v, cs2 v cc -0.2v, v in 0.2v or v in vcc-0.2v ? ? tbd ma i cc2 async cycle time=min, i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in =v ih or v il ? ? tbd ma page cycle time=t rc +3t pc , i io =0ma, 100% duty, cs1#=v il , cs2=v ih lb#=v il and/or ub#=v il , v in -v ih or v il tbd ma standby current (cmos) i sb1 (note 1) other inputs=0-vcc 1. cs1# v cc - 0.2, cs2 v cc - 0.2v (cs1# controlled) or 2. 0v cs2 0.2v (cs2 controlled) ? ? tbd ma figure 23. output load c l dout
170 psram type 2 psram_type02_15a0 may 3, 2004 advance information acc characteristics (ta = -40c to 85c, v cc = 2.7 to 3.1 v) notes: 1. t wp (min)=70ns for continuous write operation over 50 times. symbol parameter speed bins unit 70ns min max read t rc read cycle time 70 ? ns t aa address access time ? 70 ns t co chip select to output ? 70 ns t oe output enable to valid output ? 35 ns t ba ub#, lb# access time ? 70 ns t lz chip select to low-z output 10 ? ns t blz ub#, lb# enable to low-z output 10 ? ns t olz output enable to low-z output 5 ? ns t hz chip disable to high-z output 0 25 ns t bhz ub#, lb# disable to high-z output 0 25 ns t ohz output disable to high-z output 0 25 ns t oh output hold from address change 5 ? ns t pc page cycle time 25 ? ns t pa page access time ? 20 ns write t wc write cycle time 70 ? ns t cw chip select to end of write 60 ? ns t as address set-up time 0 ? ns t aw address valid to end of write 60 ? ns t bw ub#, lb# valid to end of write 60 ? ns t wp write pulse width 55 (note 1) ? ns t wr write recovery time 0 ? ns t whz write to output high-z 0 25 ns t dw data to write time overlap 30 ? ns t dh data hold from write time 0 ? ns t ow end write to output low-z 5 ? ns
may 3, 2004 psram_type02_15a0 psram type 2 171 advance information timing diagrams read timings notes: 1. address controlled, cs1#=oe#=v il , cs2=we#=v ih , ub# and/or lb#=v il . notes: 1. we#=v ih . notes: figure 24. timing waveform of read cycle(1) figure 25. timing waveform of read cycle(2) figure 26. timing waveform of read cycle(2) t aa t rc t oh address data out previous data valid data valid high-z t rc t oh t aa t ba t oe t olz t blz t lz t ohz t bhz t hz t co ub#, lb# oe# cs1# cs2 address data out data valid data valid data valid data valid data valid valid address valid address valid address valid address valid address t pc t pa high z a1~a0 dq15~dq0 oe# t ohz t oe t co t aa cs 1# cs 2 1) address
172 psram type 2 psram_type02_15a0 may 3, 2004 advance information 1. 16mb: a2 ~ a19, 32mb: a2 ~ a20, 64mb: a2 ~ a21. t hz and t ohz are defined as the time at which the outputs achieve the open circuit conditions and are not referenced to output voltage levels. at any given temperature and voltage condition, t hz (max.) is less than t lz (min.) both for a given device and from device to device interconnection. t oe (max) is met only when oe# becomes enabled after t aa (max). if invalid address signals shorter than min. t. rc are continuously re peated for over 4s, the device needs a normal read timing (t rc ) or needs to sustain standby state for min. t rc at least once in every 4s. write timings figure 27. write cycle #1 (we# controlled) figure 28. write cycle #2 (cs1# controlled) address cs1# data undefined ub#, lb# we# data in t wc t cw t wr t aw t bw t wp t as t dh t dw t whz t ow high-z high- z data valid cs2 data out data valid we# high-z t wc t cw t aw t bw t wp t dh t dw t wr t as cs 1# cs 2 address ub#, lb# data in data out
may 3, 2004 psram_type02_15a0 psram type 2 173 advance information notes: 1. a write occurs du ring the overlap (t wp ) of low cs1# and low we#. a write begins when cs1# goes low and we# goes low with asserting ub# or lb# for single byte operation or simult aneously asserting ub# and lb# for double byte operation. a write ends at the earliest transition when cs1# goes high and we# goes high. the t wp is measured from the beginning of write to the end of write. 2. t cw is measured from the cs1# going low to the end of write. 3. t as is measured from the address valid to the beginning of write. 4. t wr is measured from the end of write to the address change. t wr is applied in case a write ends with cs1# or we# going high. figure 29. timing waveform of write cycle(3)(cs2 controlled) figure 30. timing waveform of write cycle(4) (ub#, lb# controlled) data valid ub#, lb# we# data in data out high-z t wc t cw t aw t bw t wp(1) t dh t dw t wr t as cs1# cs2 address address ub #, lb# we# high-z t wc t cw t bw t wp t dh t dw t wr t aw t as cs 1# cs 2 data out data in data valid
ocotober 16, 2004 psram_type06_14_a1 psram type 6 174 preliminary psram type 6 2m word by 16-bit cmos pseu do static ram (32m density) 4m word by 16-bit cmos pse udo static ram (64m density) features ? single power supply voltage of 2.6 to 3.3 v ? direct ttl compatibility for all inputs and outputs ? deep power-down mode: memory cell data invalid ? page operation mode: ? page read operation by 8 words ? logic compatible with sram r/w ( ) pin ? standby current ? standby = 70 a (32m) ? standby = 100 a (64m) ? deep power-down standby = 5 a ? access times pin description 32m 64m access time 70 ns ce1# access time 70 ns oe# access time 25 ns page access time 30 ns pin name description a 0 to a 21 address inputs a0 to a2 page address inputs i/o1 to i/o16 data inputs/outputs ce1# chip enable input ce2 chip select input we# write enable input oe# output enable input lb#,ub# data byte control inputs v dd power supply gnd ground nc not connection
ocotober 16, 2004 psram_type06_14_a1 psram type 6 175 preliminary functional description legend: l = low-level input (v il ), h = high-level input (v ih ), x = v il or v ih , high-z = high impedence. absolute maximum ratings note: esd immunity: spansion flash memory multi-chip products (mcps) may contain component devices that are developed by spansion and component devices that are develo ped by a third party (third-party components). spansion components are tested and guaranteed to the esd immunity levels listed in the corresponding spansion flash memory qualification database. third-party components are neither tested nor guaranteed by spansion for esd immunity. how- ever, esd test results for third-party components may be available from the component manufacturer. component man- ufacturer contact information is listed in the spansion mc p qualification report, when available. the spansion flash memory qualification database and spansion mcp qualification report are available from amd and fujitsu sales offices. dc recommended operating conditi ons (ta = -40c to 85c) note: v ih (max) v dd = 1.0 v with 10 ns pulse width. v il (min) -1.0 v with 10 ns pulse width. mode ce1# ce2 oe# we# lb# ub# address i/o 1-8 i/o 9-16 power read(word) l h l h l l x d out d out i ddo read(lower byte) l h l h l h x d out high-z i ddo read(upper byte) l h l h h l x high-z d out i ddo write(word) l h x l l l x d in d in i ddo write(lower byte) l h x l l h x d in invalid i ddo write(upper byte) l h x l h l x invalid d in i ddo outputs disabled l h h h x x x high-z high-z i ddo standby h h x x x x x high-z high-z i ddo deep power-down standby h l x x x x x high-z high-z i ddsd symbol rating value unit v dd power supply voltage -1.0 to 3.6 v v in input voltage -1.0 to 3.6 v v out output voltage -1.0 to 3.6 v t opr operating temperature -40 to 85 c t strg storage temperature -55 to 150 c p d power dissipation 0.6 w i out short circuit output current 50 ma symbol parameter min ty p max unit v dd power supply voltage 2.6 2.75 3.3 v v ih input high voltage 2.0 ? v dd + 0.3 (note) v il input low voltage -0.3 (note) ? 0.4
ocotober 16, 2004 psram_type06_14_a1 psram type 6 176 preliminary dc characteristics (ta = -40c to 85c, vdd = 2.6 to 3.3 v) (see note 3 to 4) capacitance (ta = 25c, f = 1 mhz) note: this parameter is sampled periodically and is not 100% tested. ac characteristics and operating conditions (ta = -40c to 85c, vdd = 2.6 to 3.3 v) (see note 5 to 11) symbol parameter test condition min ty p . max unit i il input leakage current v in = 0 v to v dd -1.0 ? +1.0 a i lo output leakage current output disable, v out = 0 v to v dd -1.0 ? +1.0 a v oh output high voltage i oh = - 0.5 ma 2.0 ? v v v ol output low voltage i ol = 1.0 ma ? ? 0.4 v i ddo1 operating current ce1#= v il , ce2 = v ih , i out = 0 ma, t rc = min et5uz8a-43ds ? ? 40 ma et5vb5a-43ds ? ? 50 i ddo2 page access operating current ce1#= v il , ce2 = v ih , i out = 0 ma page add. cycling, t rc = min ? ? 25 ma i dds standby current(mos) ce1# = v dd - 0.2 v, ce2 = v dd - 0.2 v et5uz8a-43ds ? ? 70 ma et5vb5a-43ds ? ? 100 a i ddsd deep power-down standby current ce2 = 0.2 v ? ? 5 a symbol parameter test condition max unit c in input capacitance v in = gnd 10 pf c out output capacitance v out = gnd 10 pf symbol parameter min max unit t rc read cycle time 70 10000 ns t acc address access time ? 70 ns t co chip enable (ce1#) access time ? 70 ns t oe output enable access time ? 25 ns t ba data byte control access time ? 25 ns t coe chip enable low to output active 10 ? ns t oee output enable low to output active 0 ? ns t be data byte control low to output active 0 ? ns t od chip enable high to output high-z ? 20 ns t odo output enable high to output high-z ? 20 ns t bd data byte control high to output high-z ? 20 ns
ocotober 16, 2004 psram_type06_14_a1 psram type 6 177 preliminary ac test conditions t oh output data hold time 10 ? ns t pm page mode time 70 10000 ns t pc page mode cycle time 30 ? ns t aa page mode address access time ? 30 ns t aoh page mode output data hold time 10 ? ns t wc write cycle time 70 10000 ns t wp write pulse width 50 ? ns t cw chip enable to end of write 70 ? ns t bw data byte control to end of write 60 ? ns t aw address valid to end of write 60 ? ns t as address set-up time 0 ? ns t wr write recovery time 0 ? ns t ceh chip enable high pulse width 10 ? ns t weh write enable high pulse width 6 ? ns t odw we# low to output high-z ? 20 ns t oew we# high to output active 0 ns t ds data set-up time 30 ? ns t dh data hold time 0 ? ns t cs ce2 set-up time 0 ? ns t ch ce2 hold time 300 ? s t dpd ce2 pulse width 10 ? ms t chc ce2 hold from ce1# 0 ? ns t chp ce2 hold from power on 30 ? s parameter condition output load 30 pf + 1 ttl gate input pulse level v dd - 0.2 v, 0.2 v timing measurements v dd x 0.5 reference level v dd x 0.5 t r , t f 5 ns symbol parameter min max unit
ocotober 16, 2004 psram_type06_14_a1 psram type 6 178 preliminary timing diagrams read timings figure 1. read cycle t acc t od t oh valid da ta out t oe t be t oee t bd hi-z hi-z t co fix-h t ba t coe indetermi nate t odo t rc address a0 to a20(32m) a0 to a21(64m) ce1# ce2 oe# we# ub# , lb# d out i/o1 to i/ o16
ocotober 16, 2004 psram_type06_14_a1 psram type 6 179 preliminary figure 2. page read cycle (8 words access) t pm t pc t rc t aoh fix-h hi-z hi-z t be d out t acc t coe t co t oe t ba t oee t pc t aoh t pc d out t od t oh t bd t odo t aa * maximum 8 words d out t aoh d out t aa t aa address a0 to a2 address a3 to a20(32m) a3 to a21(64m) ce1# ce2 oe# we# ub# , lb# d out i/o1 to i/o1 6
ocotober 16, 2004 psram_type06_14_a1 psram type 6 180 preliminary write timings figure 3. write cycle #1 (we# controlled) (see note 8) ub# d in i/o1 to i/o1 6 d out i/o1 to i/o1 6 ce2 ce1# we# address a0 to a20 a0 to (32m ) a21(64m) t wc t as t bw t wr valid da ta in t odw t wp t ds t dh t oew (see note 11) (s ) ee note 10 hi-z t cw t wr t weh t aw t wr t ch (see note 9 ) (see note 9 ) , lb#
ocotober 16, 2004 psram_type06_14_a1 psram type 6 181 preliminary deep power-down timing power-on timing figure 4. write cycle #2 (ce# controlled) (see note 8) figure 5. deep power down timing figure 6. power-on timing t wc t wp t as t cw t wr valid da ta in t odw t ds t dh t coe hi-z hi-z t aw t wr t ceh t bw t be t wr t ch (see note 9 ) address a0 to a20 a0 to (32m ) a21(64m) we# ce1# ce2 ub# , lb# d out i/o1 to i/o1 6 d in i/o1 to i/o1 6 t cs t dpd t ch ce1# ce2 t chc t chp t ch v dd min v dd ce1# ce2
ocotober 16, 2004 psram_type06_14_a1 psram type 6 182 preliminary provisions of address skew read in case multiple invalid address cycles shorter than t rc min sustain over 10 s in an active status, at least one valid address cycle over t rc min is required during 10s. write in case multiple invalid address cycles shorter than t wc min sustain over 10 s in an active status, at least one valid address cycle over t wc min is required during 10 s. notes: 1. stresses greater than listed under " absolute maximum ratings " section may cause permanent damage to the device. 2. all voltages are reference to gnd. 3. i ddo depends on the cycle time. 4. i ddo depends on output loading. specified values are defined with the output open condition. 5. ac measurements are assumed t r , t f = 5 ns. 6. parameters t od , t odo , t bd and t od w define the time at which the output goes the open condition and are not output voltage reference levels. 7. data cannot be retained at deep power-down stand-by mode. 8. if oe# is high during the write cycle, the outputs will remain at high impedance. 9. during the output state of i/o signals, input signals of reverse polarity must not be applied. 10. if ce1# or lb#/ub# goes low coincident with or after we# goes low, the outputs w ill remain at high impedance. 11. if ce1# or lb#/ub# goes high coincident with or before we# goes high, the outputs w ill remain at high impedance. figure 7. read figure 8. write over 10 m s t rc min ce1# we# address t wp min t wc min ce1# we# address
january 6, 2005 s75pl127 j_00a0 S75PL127J mcps 183 preliminary revision summary revision a0 (november 9, 2004) initial release revision a1 (january 6, 2005) global changed text designations from flash to pl127j. pin connection changed pinout reference. block diagram changed pin names on a couple pins. changed device designations from flash to pl127j. s29glxxxn_mcp section added updated version to this section.
184 S75PL127J mcps s75pl127 j_00a0 january 6, 2005 prelimiary colophon the products described in this document are designed, developed and manufactured as contemplated for general use, including wit hout limitation, ordinary industrial use, general office use, personal use, and househol d use, but are not designed, developed and manufactured as contem plated (1) for any use that includes fatal risks or dangers that, unless extremely high safety is secured, could have a serious effect to the public, and c ould lead directly to death, personal injury, severe physical damage or other loss (i.e., nuclear re action control in nuclear facility, aircraft flight control, air traffic control, mass transport control, medical life support system, missile launch control in weapon sy stem), or (2) for any use where chance of failure is intolerabl e (i.e., submersible repeater and artificial satellite). please note that spansion will not be liable to you and/or any third party for any claims or damages ari sing in connection with above-men- tioned uses of the products. any semiconductor devices have an in herent chance of failure. you must protect against injury, dam age or loss from such failures by incorporating safety design measures into your facility and equipment such as redundancy, fire protection, and prevention of over-current levels and other abnormal operating conditions. if any products described in this document represent goods or technologies subject to certain re strictions on export under the foreign exchange and foreign trade law of japan, the us export administration regula tions or the applicable laws of any oth er country, the prior au- thorization by the respective government entity will be required for export of those products. trademarks and notice the contents of this document are subject to change without noti ce. this document may contain information on a spansion product under development by spansion llc. spansion llc reserves the righ t to change or discontinue work on any product without notice. the information in t his document is provided as is without warranty or guarantee of any kind as to its ac curacy, completeness, operability, fitness for particular purpose, merchantability, non-infringement of third-party rights, or any other warranty, express, implied, or statutory. spansion llc assu mes no liability for any damages of any kind arising out of the use of the informatio n in this document. copyright ? 2005 spansion llc. all rights reserved. spansion, th e spansion logo, mirrorbit, comb inations thereof, and expressfl ash are trademarks of span- sion llc. other company and product names used in this publicatio n are for identification purposes only and may be trademarks o f their respective compa- nies.

▲Up To Search▲

Price & Availability of S75PL127J

	To Download S75PL127J Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .