E ADVANCE INFORMATION
March 1999 Order Number: 290646-002
n
Flexible SmartVoltage Technology
1.65 V–1.95 V Read/Program/Erase
12 V for Fast Production
Programming
n
High Performance
1.65 V–1.95 V: 90 ns Max Access
Time
n
Optimized Architecture for Code Plus
Data Storage
Eight 4-Kword Blocks,
Top or Bottom Locations
Thirty One 32-Kword Blocks
Fast Program Suspend Capability
Fast Erase Suspend Capability
n
Flexible Block Locking
Lock/Unlock Any Block
Full Protection on Power-Up
WP# Pin for Hardware Block
Protection
VPP = GND Option
VCC Lockout Voltage
n
Low Power Consumption
9 mA Typical Read Power
10 µA Typical Standby Power with
Automatic Power Savings Feature
n
Extended Temperature Operation
–40 °C to +85 °C
n
128-bit Protection Register
64-bit Unique Device Identifier
64-bit User Programmable Cells
n
Extended Cycling Capability
Minimum 100,000 Block Erase
Cycles
n
Supports Flash Data Integrator
Software
Flash Memory Manager
System Interrupt Manager
Supports Parameter Storage,
Streaming Data (e.g., voice)
n
Automated Word Program and Block
Erase
Command User Interface
Status Register
n
Cross-Compatible Command Support
Intel Basic Command Set
Common Flash Interface
n
x16 I/O
55-Ball, 0.5mm pitch µBGA*
Package
48-Lead TSOP Package
n
0.25 µ ETOX™ VI Flash Technology
n
Improved 12 V Production
Programming
Faster Production Programming
No Additional System Logic
The 0.25 µm 1.8 Volt Advanc ed+ Boot Bloc k, manufactured on I ntel’s latest 0.25 µ technology, repres ents a
feature-rich solution for low power applications. These flash memory devices incorporate low voltage
capability (1.65 V read, program and erase) with high-speed, low-power operation. Flexible block locking
allows any block to be independently locked or unlocked. A 128-bit protection register enhances customers'
ability to develop secure systems. Add to this the Intel-developed Flash Data Integrator (FDI) software and
you have a cost-effec ti ve, flexi ble, monolit hic code plus dat a st orage solut ion. 1.8 Vol t A dvanc ed+ Boot B loc k
products will be available in 48-lead TSOP and 55-ball µBGA* packages.
1.8 VOLT ADVANCED+ BOOT BLOCK
FLASH MEMORY
28F160C18 (x16)
Information in this document is provided in connection with Intel products. No license, express or implied, by estoppel or
otherwise, to any intellectual property ri ghts is granted by thi s document. E xcept as provided i n Intel’s Terms and Condi tions of
Sale for such products, Intel assumes no liability whatsoever, and Intel disclaims any express or implied warranty, relating to
sale and/or use of Intel products including liability or warranties relating to fitness for a particular purpose, merchantability, or
infringement of any patent, copyright or other intellectual property right. Intel products are not intended for use in medical, life
saving, or life sustaining applications.
Intel may make changes to specifications and product descriptions at any time, without notice.
The 28F160C18 may contain design defects or errors known as errata whic h may cause the product to deviate from published
specifications. Current characterized errata are available on request.
Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order.
Copies of documents which have an ordering number and are referenced in this document, or other Intel literature, may be
obtained from:
Intel Corporation
P.O. Box 5937
Denver, CO 80217-9808
or call 1-800-548-4725
or visit Intel’s website at http://www.intel.com
COPYRIGHT © INTEL CORPORATION 1999 CG-041493
*Third-party brands and names are the property of their respective owners.
E28F160C18
3
ADVANCE INFORMATION
CONTENTS
PAGE PAGE
1. 0 INTRODUCTION.............................................5
1.1 1.8 Volt Advanced+ Boot Block Flash
Memory Enhancements...............................5
1.2 Product Overview.........................................6
2. 0 PRODUCT DESCRIPTION.............................6
2.1 Package Pinouts..........................................7
2.2 Block Organization.......................................9
2.2.1 Parameter Blocks.................................9
2.2.2 Main Blocks..........................................9
3. 0 PRINCIPLES OF OPERATION.......................9
3.1 Bus Operation..............................................9
3.1.1 Read...................................................10
3.1.2 Output Disable....................................10
3.1.3 Standby..............................................10
3.1.4 Reset..................................................10
3.1.5 Write...................................................11
3.2 Modes of Operation....................................11
3.2.1 Read Array.........................................11
3.2.2 Read Configuration.............................12
3.2.3 Read Status Register .........................12
3.2.3.1Clearing the Status Register..........12
3.2.4 Read Query........................................12
3.2.5 Program Mode....................................12
3.2.5.1Suspending and Resuming
Program.......................................13
3.2.6 Erase Mode........................................13
3.2.6.1Suspending and Resuming Erase..13
3.3 Flexible Block Locking ...............................19
3.3.1 Locking Operation ..............................19
3.3.2 Locked State ......................................19
3.3.3 Unlocked State...................................19
3.3.4 Lock-Down State................................19
3.3.5 Reading a Block’s Lock Status ...........20
3.3.6 Locking Operations During Erase
Suspend ............................................ 20
3.3.7 Status Register Error Checking.......... 20
3.4 128-Bit Protection Register........................ 21
3.4.1 Reading the Protection Register........ 21
3.4.2 Programming the Protection Register 21
3.4.3 Locking the Protection Register......... 22
3.5 VPP Program and Erase Voltages.............. 22
3.5.1 Improved 12 Volt Production
Programming..................................... 22
3.5.2 VPP ≤ VPPLK For Complete Protection 22
3.6 Power Consumption.................................. 23
3.6.1 Active Power (Program/Erase/Read). 23
3.6.2 Automatic Power Savings (APS)........ 23
3.6.3 Standby Power .................................. 23
3.7 Power-Up/Down Operation........................ 24
3.7.1 RST# Connected To System Reset... 24
3.7.2 VCC, VPP and RST# Transitions......... 24
3.8 Power Supply Decoupling ......................... 24
4. 0 ELECTRICAL SPECIFICATIONS................ 25
4.1 Absolute Maximum Ratings....................... 25
4.2 Operating Conditions................................. 25
4.3 Capacitance.............................................. 26
4.4 DC Characteristics.................................... 26
4.5 AC Characteristics—Read Operations—
Extended Temperature............................. 30
4.6 AC Characteristics—Write Operations—
Extended Temperature............................. 32
4.7 Erase and Program Timings...................... 33
4.8 Reset Operations...................................... 35
5.0 ORDERING INFORMATION........................ 36
6.0 ADDITIONAL INFORMATION..................... 37
28F160C18 E
4ADVANCE INFORMATION
APPENDIX A: WSM Current/Next States..........38
APPENDIX B: Program/Erase Flowcharts........40
APPENDIX C: CFI Query Structure...................46
APPENDIX D: Architecture Block Diagram ......48
APPENDIX E: Word-Wide Memory Map
Diagram .......................................................49
APPENDIX F: Device ID Table...........................51
APPENDIX G: Protection Register
Addressing..................................................52
REVISION HISTORY
Date of
Revision Version Description
03/01/99 -001 Original version
03/23/99 -002 Read access speed improved from 100 ns to 90 ns
Other minor changes
E28F160C18
5
ADVANCE INFORMATION
1.0 INTRODUCTION
This document contains the specifications for the
Intel® 1.8 Volt Advanc ed+ Boot Block flash memory
family, which is optimized for low power, portable
systems. This family of products features a low
VCC/VPP operating range 1.65 V–1.95 V for read,
program, and erase operations. In addition this
family is capable of fast programming at 12 V.
Throughout this document, the term “1.65 V” refers
to the full voltage range 1.65 V–1.95 V (except
where noted otherwise) and “VPP = 12 V” refers to
12 V ±5%. Section 1 and 2 provides an ov erview of
the flash memory family including applications,
pinouts, pin descriptions and memory organization.
Secti on 3 describes the operation of these produc ts
and Section 4 contains electrical specifications.
Finally, Section 5 contains ordering information.
1.1 1.8 Volt Advanced+ Boot Block
Flash Memory Enhancements
The 1.8 Volt Advanced+ Boot Block flash memory
features:
•Zero-latency, flexible block locking
•128-bit Protection Register
•Simple system implementation for 12 V
production programming with 1.65 V in-field
programming
•Ultra-low power operation at 1.65 V
•Minimum 100,000 block erase cycles
•Common Flash Interface for software query of
device specs and features
Table 1. 1.8 Volt Advanced+ Boot Block Feature Summary
Feature 16 Mbit Reference
VCC Operating Voltage 1.65 V – 1.95 V Table 10
VPP Voltage Provides complete write protection with
optional 12 V Fast Programming Table 10
VCCQ I/O Voltage 1.65 V – 1.95 V
Bus Width 16-bit
Speed (ns) 90, 120 ns @ 1.65 V Section 4.5
Blocking (top or bottom) 8 x 4-KW parameter
16-Mb: 31 x 32-KW main Section 2.2
Appendix E
Operating Temperature Extended: –40 °C to +85 °C Table 10
Program/Erase Cycling 100,000 cycles (minimum) Table 10
Packages 48-Lead TSOP
55-Ball µBGA* CSP Figures 1, 2
Block Locking Flexible locking of any block with zero latency Section 3.3
Protection Register 64-bit unique device number, 64-bit user programmable Section 3.4
28F160C18 E
6ADVANCE INFORMATION
1.2 Product Overview
The Intel 1.8V Advanced+ Boot Block Flash
memory provides secure low voltage memory
soluti ons. A new block loc king feature al l ows ins tant
locking/unlocking of any block with zero-latency. A
128-bit protection register allows unique flash
device identification.
Discret e supply pins provide ultra-low vol tage read,
program, and erase capability at 1.65 V while also
allowing 12 V VPP for faster production
programming. Improved 12 V production
programming, a new feature designed to reduce
external logic, simplifies board designs when
combining 12 V production programming with
1.65 V in-field programming.
The 1.8 Volt Advanced+ Boot Block flash memory
is available in a x16 package in the following
density (see Section 5,
Ordering Information
).
•16-Mbit (16,777,216 bit) flash memories
organized as either 1024 Kwords of 16 bits
each.
Eight 4-Kword parameter blocks are located at
either the top (denoted by -T suffix) or the bottom
(–B suffix) of the address map in order to
accommodate different microprocessor protocols
for kernel code location. The remaining memory is
grouped into 32-Kword main blocks.
All blocks can be locked or unlocked instantly to
provide complete protection for code or data. (see
Section 3.3 for details).
The Command User Interface (CUI) serves as the
interface between the microprocessor or
microcontroller and the internal operation of the
flash memory. The internal Write State Machine
(WSM) automatically executes the algorithms and
timings necessary for program and erase
operations, including verification, thereby
unburdening the microprocessor or microcontroller.
The status regist er indicates t he status of the WSM
by signifying block erase or word program
completion and status.
Program and erase aut omation allows program and
erase operations to be executed using an industry-
standard two-write command sequence to the CUI.
Program operations are performed in word
increments. Erase operations erase all locations
within a block simultaneously. Both program and
erase operations can be suspended by the system
software in order to read from any other block. In
addition, dat a can be programmed to another bloc k
during an erase suspend.
The 1.8 Volt Advanced+ Boot Block flash memory
offers two low power savings features: automatic
power savings (APS) and standby mode. The
device automat ic ally enters APS mode f ollowing the
completion of a read cycle. Standby mode is
initiated when the system deselects the device by
driving CE# inactive. Combined, these two power
saving features significantly reduce power
consumption.
The device c an be reset by lowering RST# t o GND.
This provides CPU-memory reset synchronization
and additional protection against bus noise that
may occur during system reset and power-up/down
sequences (see Section 3.7).
Refer to the
DC Characteristics
Section 4.4 for
complete current and voltage specifications. Refer
to the
AC Characteristics
Sections 4.5 and 4.6, for
read and write performance s pecif ications . Program
and erase times and shown in Section 4.7.
2.0 PRODUCT DESCRIPTION
This section provides device pin descriptions and
package pinout s for 1. 8 Volt Adv anced+ Boot Block
flash memory, which is available in 48-lead TSOP
(Figure 1) and 55-ball µBGA packages (Figure 2).
E28F160C18
7
ADVANCE INFORMATION
2.1 Package Pinouts
Advanced+ Boot Block
48-Lead TSOP
12 mm x 20 mm
TOP VIEW
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
24
23
22
21
20
19
17
18
1
2
3
4
5
6
7
8
9
10
11
12
13
14
16
15
25
26
27
28
29
30
31
32
16
15
7
14
6
13
5
12
4
A
V
CCQ
GND
DQ
DQ
DQ
DQ
DQ
DQ
DQ
DQ
DQ
V
DQ
DQ
DQ
DQ
DQ
DQ
DQ
OE#
GND
CE#
A
CC
11
3
10
2
9
1
8
0
0
WE#
RST#
WP#
V
PP
A
15
A
14
A
13
A
12
A
11
A
10
A
9
A
8
A
19
A
18
A
17
A
7
A
6
A
5
A
4
A
3
A
2
A
1
NC
NC
Figure 1. 48-Lead TSOP Package x16 Configurations
NC
NC
NCA
14
A
10
DQ
13
NC
A
8
DQ
12
DQ
5
WE#
RST#NC
DQ
4
V
PP
WP#
DQ
11
DQ
10
A
19
A
18
DQ
9
DQ
2
A
17
A
7
DQ
0
DQ
1
A
6
A
5
A
1
CE#
A
4
A
3
A
2
A
0
DQ
7
DQ
6
NC
V
CC
DQ
3
NC
DQ
8
OE#
V
SSQ
NC A
15
V
CCQ
A
11
A
12
A
16
DQ
15
A
9
DQ
14
A
13
GND
NC
B
A
C
D
E
12345678910 11
Figure 2. 55-Ball µBGA* Chip Size Package (Top View, Ball Down)
28F160C18 E
8ADVANCE INFORMATION
Table 2. 1.8 Volt Advanced+ Boot Block Pin Descriptions
Symbol Type Name and Function
A0–A19 INPUT ADDRESS INPUTS for memory addresses. Addresses are internally
latched during a program or erase cycle.
16-Mbit x 16: A[0-19]
DQ0–DQ7INPUT/OUTPUT DATA INPUTS/OUTPUTS: Inputs array data on the second CE# and
WE# cycle during a Program command. Inputs commands to the
Command User Interface when CE# and WE# are active. Data is
internally latched. Outputs array, configuration and status register data.
The data pins float to tri-state when the chip is de-selected or the outputs
are disabled.
DQ8–DQ15 INPUT/OUTPUT DATA INPUTS/OUTPUTS: Inputs array data on the second CE# and
WE# cycle during a Program command. Data is internally latched.
Outputs array and configuration data. The data pins float to tri-state when
the chip is de-selected.
CE# INPUT CHIP ENABLE: Activates the internal control logic, input buffers,
decoders and sense amplifiers. CE# is active low. CE# high de-selects
the memory device and reduces power consumption to standby levels.
OE# INPUT OUTPUT ENABLE: Enables the device’s outputs through the data
buffers during a read operation. OE# is active low.
WE# INPUT WRITE ENABLE: Controls writes to the Command Register and
memory array. WE# is active low. Addresses and data are latched on
the rising edge of the second WE# pulse.
RST# INPUT RESET: Uses two voltage levels (VIL, VIH) to control reset mode.
When RST# is at logic low, the device is in reset which drives the
outputs to High-Z and resets the Write State Machine.
When RST# is at logic high, the device is in standard operation.
When RST# transitions from logic-low to logic-high, the device resets all
blocks to locked and defaults to the read array mode.
WP# INPUT WRITE PROTECT: Controls the lock-down function of the flexible
Locking feature
When WP# is a logic low, the lock-down mechanism is enabled and
blocks marked lock-down cannot be unlocked through software.
When WP# is logic high, the lock-down mechanism is disabled and
blocks previously locked-down are now locked and can be unlocked and
locked through software. After WP# goes low, any blocks previously
marked lock-down revert to that state.
See Section 3.3 for details on block locking.
VCC SUPPLY DEVICE POWER SUPPLY: [1.65 V–1.95 V] Supplies power for device
operations.
VCCQ INPUT I/O POWER SUPPLY: Supplies power for input/output buffers.
[1.65 V–1.95 V] This input should be tied directly to VCC.
E28F160C18
9
ADVANCE INFORMATION
Table 2. 1.8 Volt Advanced+ Boot Block Pin Descriptions (Continued)
Symbol Type Name and Function
VPP INPUT/
SUPPLY PROGRAM/ERASE POWER SUPPLY: [0.9 V–1.95 V or 11.4 V–12.6 V]
Operates as a input at logic levels to control complete device protection.
Supplies power for accelerated program and erase operations in 12 V ±
5% range. This pin cannot be left floating.
Lower VPP ≤ VPPLK, to protect all contents against Program and
Erase commands.
Set VPP = VCC for in-system read, program and erase operations. In
this configuration, VPP can drop as low as 0.9 V to allow for resistor or
diode drop from the system supply. Note that if VPP is driven by a logic
signal, VIH = 0.9 V. That is, VPP must remain above 0.9 V to perform in-
system flash modifications.
Raise VPP to 12 V ± 5% for faster program and erase in a production
environment. Applying 12 V ± 5% to VPP can only be done for a
maximum of 1000 cycles on the main blocks and 2500 cycles on the
parameter blocks. VPP may be connected to 12 V for a total of 80 hours
maximum. See Section 3.4 for details on VPP voltage configurations.
VSSQ/
GND SUPPLY I/O GROUND / DEVICE GROUND: For all internal circuitry. All ground
inputs must be connected.
NC NO CONNECT: Pin may be driven or left floating.
2.2 Block Organization
The 1.8 Volt Advanced+ Boot Block is an
asymmetrically-blocked architecture that enables
system integration of code and data within a single
flash device. Each block can be erased
independently of the others up to 100,000 times.
For the address locations of each block, see the
memory maps in Appendix E.
2.2.1 PARAMETER BLOCKS
The 1.8 Volt Advanced+ Boot Block flash memory
architecture includes parameter blocks to facilitate
storage of frequently updated small parameters
(i.e., data that would normally be stored in an
EEPROM). Each device contains eight parameter
blocks of 4-Kwords.
2.2.2 MAIN BLOCKS
After the parameter blocks, the remainder of the
array is divided into equal size 32-Kword
main blocks for data or code storage. The 16-Mbit
contains 31 main blocks.
3.0 PRINCIPLES OF OPERATION
The 1.8 Volt Advanced+ Boot Block flash memory
architecture utilizes a CUI and automated
algorithms to simplify program and erase
operations. The CUI allows for 100% CMOS
-
level
control inputs and fixed power supplies during
erasure and programming.
The internal WSM completely automates program
and erase operations while t he CUI s ignal s t he st art
of an operation and the status register reports
status. The CUI handles the WE# interface to the
data and address latches, as well as system status
requests during WSM operation.
3.1 Bus Operation
The 1.8 Volt Advanced+ Boot Block flash memory
devices read, program and erase in
-
system via the
local CPU or microcontroller. All bus cycles to or
from the flash memory conform to standard
microcontroller bus cycles. Four control pins dictate
the data flow in and out of the flash component:
CE#, OE#, WE# and RST#. These bus operations
are summarized in Table 3.
28F160C18 E
10 ADVANCE INFORMATION
Table 3. Bus Operations
Mode Note RST# CE# OE# WE# DQ0–15
Read (Array, Status,
Configuration, or Query) 2,3 VIH VIL VIL VIH DOUT
Output Disable 1 VIH XV
IH X High Z
Standby 1 VIH VIH X X High Z
Reset 1,5 VIL X X X High Z
Write 4,5 VIH VIL VIH VIL DIN
NOTES:
1. X must be VIL, VIH for control pins and addresses.
2. See
DC Characteristics
for VPPLK, VPP1 and VPP2 voltages.
3. Manufacturer and device codes may also be accessed in read configuration mode (A
1–A19 = 0). See Table 4.
4. Refer to Table 5 for valid DIN during a write operation.
5. To program or erase the lockable blocks, hold WP# at VIH.
3.1.1 READ
The flash memory has four read modes available:
read array, read c onfiguration, read stat us and read
query. These modes are accessible independent of
the VPP voltage. The appropriate read mode
command must be issued to the CUI to enter the
corresponding mode. Upon initial device power
-
up
or after exit from reset, the device automatically
defaults to read array mode.
CE# and OE# must be driven active to obtain data
at the outputs. CE# is the device selection control;
when active it enables the flash memory device.
OE# is the data output control and it drives the
select ed memory data ont o the I /O bus . For al l read
modes, WE# and RST# must be at VIH. Figure 7
illustrates a read cycle.
3.1.2 OUTPUT DISABLE
With OE# at a logic
-
high level (VIH), the device
outputs are disabled. Output pins are placed in a
high
-
impedance state.
3.1.3 STANDBY
Deselecting the device by bringing CE# to a logic
-
high level (V IH) places the devic e in standby mode,
which substantially reduces device power
consumption without any latency for subsequent
read accesses. In standby, outputs are placed in a
high-impedance state independent of OE#. If
deselected during program or erase operation, the
device c ontinues to consume active power until t he
program or erase operation is complete.
3.1.4 RESET
From read mode, RST# at VIL for time tPLPH
deselects the memory, places output drivers in a
high
-
impedance state, and turns off all internal
circuits. After return from reset, a time tPHQV is
required until the initial read access outputs are
valid. A delay (tPHWL or tPHEL) is required after
return from reset before a write can be initiated.
After this wake
-
up interval, normal operation is
restored. The CUI resets to read array mode, the
status register is set to 80H, and all blocks are
locked. This case is shown in Figure 9A.
E28F160C18
11
ADVANCE INFORMATION
If RST# is taken low for time tPLPH during a program
or erase operation, the operation will be aborted
and the memory contents at the aborted location
(for a program) or bloc k (f or an erase) are no longer
valid, since the data may be partially erased or
written. The abort process goes through the
following sequence: When RST# goes low, the
device shuts down the operation in progress, a
process which takes time tPLRH to complete. After
this time tPLRH, the part will either reset to read
array mode (if RST# has gone high during tPLRH,
Figure 9B) or enter reset mode (if RST# is st ill logic
low after tPLRH, Figure 9C). In both cases, after
returning from an aborted operation, the relevant
time tPHQV or tPHWL/tPHEL must be waited before a
read or write operation is initiated, as discussed in
the previous paragraph. However, in this case,
these delays are referenced to the end of tPLRH
rather than when RST# goes high.
As with any automated device, it is important to
assert RST# during system reset. When the system
comes out of reset, proc essor expec ts t o read from
the flash memory. Automated flash memories
provide status information when read during
program or block erase operations. If a CPU reset
occurs with no flash memory reset, proper CPU
initialization may not occur because the flash
memory may be providing status information
instead of array data. Intel® Flash memories allow
proper CPU initialization following a system reset
through the use of the RST# input. In this
application, RST# is controlled by the same
RESET# signal that resets the system CPU.
3.1.5 WRITE
A write takes place when both CE# and WE# are
low and OE# is high. Commands are written to the
Command User Interface (CUI) using standard
microprocessor write timings to control flash
operations. The CUI does not occupy an
addressable memory location. The address and
data buses are latched on the rising edge of the
second WE# or CE# pulse, whichever occurs first.
Figure 8 illustrates a program and erase operation.
The available c ommands are s hown in Table 6, and
Appendix A provides detailed information on
moving between the different modes of operation
using CUI commands.
There are two commands that modify array data:
Program (40H) and Erase (20H). Writing either of
these commands to the internal Command User
Interface (CUI) initiates a sequence of internally
-
timed functions that culminate in the completion of
the requested t ask (unl ess that operation is aborted
by either RST# being driven to VIL for tPLRH or an
appropriate suspend command).
3.2 Modes of Operation
The flash memory has four read modes and two
write modes. The read modes are read array, read
configuration, read status, and read query. The
write modes are program and block erase. Three
additional modes (erase s uspend to program, erase
suspend to read and program suspend to read) are
available only during suspended operations. These
modes are reached using the commands
summarized in Tables 5 and 6. A comprehensive
chart showing the state transitions is in Appendix A.
3.2.1 READ ARRAY
When RST# transitions from VIL (reset) to VIH, the
device default s t o read array mode and will respond
to the read cont rol i nputs (CE#, addres s input s, and
OE#) without any additional CUI commands.
When the device is in read array mode, f our control
signals control data output:
•WE# must be logic high (VIH)
•CE# must be logic low (VIL)
•OE# must be logic low (VIL)
•RST# must be logic high (VIH)
In addition, the address of t he desi red loc ation m ust
be applied to the address pins. If the device is not
in read array mode, as would be the case after a
program or erase operation, the Read Array
command (FFH) must be written to the CUI before
array reads can take place.
28F160C18 E
12 ADVANCE INFORMATION
3.2.2 READ CONFIGURATION
The read configurat ion mode outputs t hree types of
information: the manufacturer/device identifier, the
block locking status, and the protection register.
The device is switched to this mode by writing the
Read Configuration command (90H). Once in this
mode, read cycles from addresses shown in Table
4 retrieve the specified information. To return to
read array mode, write the Read Array command
(FFH).
Table 4. Read Configuration Table
Item Address Data
Manufacturer Code (x16) 00000 0089
Device ID (See Appendix F) 00001 ID
Block Lock Configuration(2) XX002(1) LOCK
• Block Is Unlocked DQ0 = 0
• Block Is Locked DQ0 = 1
• Block Is Locked-Down DQ1 = 1
Protection Register Lock(3) 80 PR-LOCK
Protection Register 81–88 PR
NOTES:
1. “XX” specifies the block address of lock configuration
being read.
2. See Section 3.3 for valid lock status outputs.
3. See Section 3.4 for protection register information.
4. Other locations within the configuration address space
are reserved by Intel for future use.
3.2.3 READ STATUS REGISTER
The status register indicates the status of device
operations, and the success/failure of that
operation. The Read Status Register (70H)
command causes subsequent reads to output data
from the status register until another command is
issued. To return to reading from the array, iss ue a
Read Array (FFH) command.
The status register bits are output on DQ0–DQ7.
The upper byte, DQ8–DQ15, outputs 00H during a
Read Status Register command.
The contents of the status register are latched on
the falling edge of OE# or CE#, whichever occurs
last. This prevents possible bus errors which might
occur if status regi ster content s change while being
read. CE# or OE# must be toggled with each
subsequent status read, or the status register will
not indicate completion of a program or erase
operation.
When the WSM is active, SR.7 will indicate the
status of the WSM; the remaining bits in the status
register indicate whether the WSM was successful
in performing the desired operation (see Table 7).
3.2.3.1 Clearing the Status Register
The WSM sets status bits 1 through 7 to “1,” and
clears bi ts 2, 6 and 7 to “0, ” but cannot clear status
bits 1 or 3 t hrough 5 to “0. ” Bec ause bit s 1, 3, 4 and
5 indicate various error conditions, these bits can
only be cl eared through the use of the Clear Status
Register (50H) command. By allowing the system
software to control the resetting of these bits,
several operations may be performed (such as
cumulatively programming several addresses or
erasing multiple blocks in sequence) before reading
the stat us register to determine if an error occurred
during that series. Clear the Status Register before
beginning another command or sequence. Note
that the Read Array command must be issued
before data can be read from the memory array.
Resetting the device also clears the status register.
3.2.4 READ QUERY
The Read Query mode outputs Common Flash
Interface (CFI) data when the device is read. This
can be accessed by writing the Read Query
Command (98H). The CFI data structure contains
information such as block size, density, command
set and electric al specificat ions. Once in t his mode,
read cycles from addresses shown in Appendix C
retrieve the specified information. To return to read
array mode, write the Read Array command (FFH).
3.2.5 PROGRAM MODE
Programming is executed using a two
-
write
sequence. The Program Setup command (40H) is
written t o the CUI followed by a second write whi ch
specifies the address and data to be programmed.
E28F160C18
13
ADVANCE INFORMATION
The WSM will execute a sequence of internally
timed events to program desired bits of the
addressed location, then verify the bits are
sufficiently programmed. Programming the memory
results in specific bits within an address location
being changed to a “0.” If the user attempts to
program “1”s, the memory cell contents do not
change and no error occurs.
The status register indicates programming status:
while the program sequence executes, status bit 7
is “0.” The s tatus register c an be polled by toggling
either CE# or OE#. While programming, the only
valid commands are Read Status Register,
Program Suspend, and Program Resume.
When programming is complete, the Program
Status bits should be checked. If the programming
operation was unsuccessful, bit SR.4 of the status
register is set to indicate a program failure. If SR.3
is set then VPP was not wi thin acc eptable limi ts, and
the WSM did not execute the program command. If
SR.1 is set, a program operation was attempt ed on
a locked block and the operation was aborted.
The status register should be cleared before
attempting the next operation. Any CUI instruction
can follow after programming is completed;
however, to prevent inadvertent status register
reads, be sure to reset the CUI to read array mode.
3.2.5.1 Suspending and Resuming
Program
The Program Suspend command halts an in
-
progress program operation so that data can be
read from other locations of memory. Once the
programming process starts, writing the Program
Suspend command to the CUI requests that the
WSM suspend the program sequence (at
predetermined points in the program algorithm).
The device continues to output status register data
after the Program Suspend command is written.
Polling status register bits SR.7 and SR.2 will
determine when the program operation has been
suspended (both will be set to “1”). tWHRH1/tEHRH1
specify the program suspend latency.
A Read Array command can now be written to the
CUI to read data from blocks other than that which
is suspended. The only other valid commands,
while program is suspended, are Read Status
Register, Read Configuration, Read Query, and
Program Resume. After the Program Resume
command is written to the flash memory, the WSM
will continue with the programming process and
status register bit s S R.2 and SR.7 will automat ically
be cleared. The device aut omatically outputs st atus
register data when read (see Figure 11 in A ppendix
B,
Program Suspend/Resume Flowchart
) after the
Program Resume command is written. VPP must
remain at the same VPP level used for program
while in program suspend mode. RST# must also
remain at VIH.
3.2.6 ERASE MODE
To erase a block , write t he Eras e Set
-
up and Erase
Confirm commands to the CUI, along with an
address identifying the block to be erased. This
address is latched internally when the Erase
Confirm command is issued. Block erasure results
in all bits withi n the block being s et to “1.” Only one
block can be erased at a time. The WSM will
execute a sequence of internally timed events to
program all bits within t he block t o “0,” erase all bits
within t he block to “1, ” then verify t hat all bits within
the block are sufficiently erased. While the erase
executes, status bit 7 is a “0.”
When the status register indicates that erasure is
complete, check the erase status bit to verify that
the erase operation was successful. If the Erase
operation was unsuccessful, SR.5 of the status
register will be set to a “1,” indicating an erase
failure. If VPP was not within acceptable limits after
the Erase Confirm command was issued, the WSM
will not execute the erase sequence; instead, SR.5
of the status register is set to indicate an erase
error, and SR.3 is set to a “1” to identify that VPP
supply voltage was not within acceptable limits.
After an erase operation, clear the status register
(50H) before attempting the next operation. Any
CUI instruction can follow after erasure is
completed; however, to prevent inadvertent status
register reads, it is advisable to place the flash in
read array mode after the erase is complete.
3.2.6.1 Suspending and Resuming Erase
Since an erase operation requires on the order of
seconds to complet e, an Erase Suspend command
is provided to allow erase
-
sequence interruption in
order to read data from or program data to another
28F160C18 E
14 ADVANCE INFORMATION
block in memory. Once the erase sequence is
started, writing the Erase Suspend com mand to the
CUI suspends the erase sequence at a
predetermined point in the erase algorithm. The
device cont inues to output s tatus regis ter data after
the Erase Suspend command is written. Polling
status register bits SR.6 and SR.7 will determine
when the erase operation has been suspended
(both will be set to “1”). tWHRH2/tEHRH2 specify the
program suspend latency.
A Read Array/Program command can now be
written to the CUI to read/program data from/to
blocks other than that which is suspended. This
nested Program command can subsequently be
suspended to read yet another location. The only
other vali d commands whi l e erase is s uspended are
Read Status Register, Read Configuration, Read
Query, Program Setup, Program Resume, Erase
Resume, and Lock Setup. During erase suspend
mode, the chip can be placed in a pseudo
-
standby
mode by taking CE# to VIH. This reduces active
current consumption.
Issuing the Erase Res ume command conti nues the
erase sequence (when CE# = VIL) and status
register bits SR.6 and SR.7 will automatically be
cleared. The device automatically outputs status
register data when read (see Figure 13 in A ppendix
B,
Erase Suspend/Resume Flowchart
) after the
Erase Resume command is written. RST# must
also remain at VIH.
As with the end of a standard erase operation, the
status register must be read and c leared before the
next instruction is issued.
E28F160C18
15
ADVANCE INFORMATION
Table 5. Command Bus Definitions
First Bus Cycle Second Bus Cycle
Command Notes Oper Addr Data Oper Addr Data
Read Array 4 Write BA FFH
Read Configuration 2, 4 Write IA 90H Read IA ID
Read Query 2, 4 Write QA 98H Read QA QD
Read Status Register 4 Write BA 70H Read BA SRD
Clear Status Register 4 Write BA 50H
Program 3,4 Write WA 40H/10H Write WA WD
Block Erase/Confirm 4 Write BA 20H Write BA D0H
Program/Erase Suspend 4 Write BA B0H
Program/Erase Resume 4 Write BA D0H
Lock Block 4 Write BA 60H Write BA 01H
Unlock Block 4 Write BA 60H Write BA D0H
Lock-Down Block 4 Write BA 60H Write BA 2FH
Protection Program 4 Write PA C0H Write PA PD
NOTES:
1. Bus operations are defined in Table 3.
2. Following the Read Configuration or Read Query commands, read operations output device configuration or CFI query
information, respectively. See Section 3.2.2 and 3.2.4.
3. Either 40H or 10H command is valid, but the Intel standard is 40H.
4. When writing commands, the upper data bus [DQ8–DQ15] should be either VIL or VIH, to minimize current draw.
5. First cycle command addresses should be the same as the operation’s target address. Examples: the first-cycle address
for the Read Device Identification Codes command should be the same as the Identification Code address (IA); the first
cycle address for the Program command should be the same as the word address (WA) to be programmed; the first cycle
address for the Erase/Program Suspend command should be the same as the address within the block to be suspended;
etc.
IA = Identification code address.
BA = Address within the block..
PA = User programmable 4-word protection address in the device identification plane.
QA = Query code address.
WA = Word address of memory location to be written.
SRD = Data read from the status register.
WD = Data to be written at location WA is latched on the rising edge of WE# or CE# (whichever goes high first).
ID = Identification code data.
PD = User programmable 4-word protection data.
QD = Query code data.
28F160C18 E
16 ADVANCE INFORMATION
Table 6. Command Codes and Descriptions
Code Device Mode Description
FF Read Array Places device in read array mode, such that array data will be output on the
data pins.
40 Program
Set-Up This is a two
-
cycle command. The first cycle prepares the CUI for a program
operation. The second cycle latches addresses and data information and
initiates the WSM to execute the Program algorithm. The flash outputs status
register data when CE# or OE# is toggled. A Read Array command is required
after programming to read array data. See Section 3.2.5.
20 Erase
Set-Up Prepares the CUI for the Erase Confirm command. If the next command is not
an Erase Confirm command, then the CUI will (a) set both SR.4 and SR.5 of the
status register to a “1,” (b) place the device into the read status register mode,
and (c) wait for another command. See Section 3.2.6.
D0 Erase Confirm
Program/Erase
Resume
Unlock Block
If the previous command was an Erase Set-Up command, then the CUI will
close the address and data latches, and begin erasing the block indicated on the
address pins. During program/erase, the device will respond only to the Read
Status Register, Program Suspend and Erase Suspend commands and will
output status register data when CE# or OE# is toggled.
If a program or erase operation was previously suspended, this command will
resume that operation.
If the previous command was Configuration Set-Up, the CUI will latch the
address and unlock the block indicated on the address pins. If the block had
been previously set to Lock-Down, this operation will have no effect. (Sect. 3.3)
B0 Program
Suspend
Erase
Suspend
Issuing this command will begin to suspend the currently executing
program/erase operation. The status register will indicate when the operation
has been successfully suspended by setting either the program suspend (SR.2)
or erase suspend (SR.6) and the WSM Status bit (SR.7) to a “1” (ready). The
WSM will continue to idle in the SUSPEND state, regardless of the state of all
input control pins except RST#, which will immediately shut down the WSM and
the remainder of the chip if RST# is driven to VIL. See Sections 3.2.5.1 and
3.2.6.1.
70 Read Status
Register This command places the device into read status register mode. Reading the
device will output the contents of the status register, regardless of the address
presented to the device. The device automatically enters this mode after a
program or erase operation has been initiated. See Section 3.2.3.
50 Clear Status
Register The WSM can set the Block Lock Status (SR.1) , VPP Status (SR.3), Program
Status (SR.4), and Erase Status (SR.5) bits in the status register to “1,” but it
cannot clear them to “0.” Issuing this command clears those bits to “0.”
90 Read
Configuration Puts the device into the Read Configuration mode, so that reading the device
will output the manufacturer/device codes or block lock status. Section 3.2.2.
60 Configuration
Set-Up Prepares the CUI for changes to the device configuration, such as block locking
changes. If the next command is not Block Unlock, Block Lock, or Block Lock-
Down, then the CUI will set both the Program and Erase Status register bits to
indicate a command sequence error. See Section 3.3.
E28F160C18
17
ADVANCE INFORMATION
Table 6. Command Codes and Descriptions (Continued)
Code Device Mode Description
01 Lock-Block If the previous command was Configuration Set-Up, the CUI will latch the
address and lock the block indicated on the address pins. (Section 3.3)
2F Lock-Down If the previous command was a Configuration Set-Up command, the CUI will
latch the address and lock-down the block indicated on the address pins.
(Section 3.3)
98 Read
Query Puts the device into the read query mode, so that reading the device will output
Common Flash Interface information. See Section 3.2.4 and Appendix C.
C0 Protection
Program
Setup
This is a two-cycle command. The first cycle prepares the CUI for an program
operation to the protection register. The second cycle latches addresses and
data information and initiates the WSM to execute the Protection Program
algorithm to the protection register. The flash outputs status register data when
CE# or OE# is toggled. A Read Array command is required after programming
to read array data. See Section 3.4.
10 Alt. Prog Set-Up Operates the same as Program Set
-
up command. (See 40H/Program Set-Up)
00 Invalid/
Reserved Unassigned commands that should not be used. Intel reserves the right to
redefine these codes for future functions.
NOTE:
See Appendix A for mode transition information.
28F160C18 E
18 ADVANCE INFORMATION
Table 7. Status Register Bit Definition
WSMS ESS ES PS VPPS PSS BLS R
76543210
NOTES:
SR.7 WRITE STATE MACHINE STATUS
1 = Ready (WSMS)
0 = Busy
Check Write State Machine bit first to determine
Word Program or Block Erase completion, before
checking Program or Erase Status bits.
SR.6 = ERASE
-
SUSPEND STATUS (ESS)
1 = Erase Suspended
0 = Erase In Progress/Completed
When Erase Suspend is issued, WSM halts
execution and sets both WSMS and ESS bits to “1.”
ESS bit remains set to “1” until an Erase Resume
command is issued.
SR.5 = ERASE STATUS (ES)
1 = Error In Block Erase
0 = Successful Block Erase
When this bit is set to “1,” WSM has applied the
max. number of erase pulses to the block and is still
unable to verify successful block erasure.
SR.4 = PROGRAM STATUS (PS)
1 = Error in Programming
0 = Successful Programming
When this bit is set to “1,” WSM has attempted but
failed to program a word.
SR.3 = VPP STATUS (VPPS)
1 = VPP Low Detect, Operation Abort
0 = VPP OK
The VPP status bit does not provide continuous
indication of VPP level. The WSM interrogates VPP
level only after the Program or Erase command
sequences have been entered, and informs the
system if VPP has not been switched on. The VPP is
also checked before the operation is verified by the
WSM. The VPP status bit is not guaranteed to report
accurate feedback between VPPLK max and VPP1 min
or between VPP1 max and VPP2 min.
SR.2 = PROGRAM SUSPEND STATUS (PSS)
1 = Program Suspended
0 = Program in Progress/Completed
When Program Suspend is issued, WSM halts
execution and sets both WSMS and PSS bits to “1.”
PSS bit remains set to “1” until a Program Resume
command is issued.
SR.1 = BLOCK LOCK STATUS
1 = Prog/Erase attempted on a locked
block; Operation aborted.
0 = No operation to locked blocks
If a program or erase operation is attempted to one
of the locked blocks, this bit is set by the WSM. The
operation specified is aborted and the device is
returned to read status mode.
SR.0 = RESERVED FOR FUTURE
ENHANCEMENTS (R) This bit is reserved for future use and should be
masked out when polling the status register.
NOTE:
1. A Command Sequence Error is indicated when SR.4, SR.5, and SR.7 are set
E28F160C18
19
ADVANCE INFORMATION
3.3 Flexible Block Locking
The Intel 1.8 Volt Advanced+ Boot Block
architecture offers an instant, individual block
locking scheme that allows any block to be locked
or unlocked with no latency, enabling instant code
and data protection.
This locki ng scheme off ers two levels of protection.
The first level allows software-only control of block
locking (useful for data blocks that change
frequently), while the second level requires
hardware interact ion bef ore lock ing c an be c hanged
(useful for code blocks that change infrequently).
The following sections will discuss the operation of
the locking system. The term “state [XYZ]” will be
used to specify locking states; e.g., “state [001],”
where X = value of WP#, Y = bit DQ1 of the Block
Lock status register, and Z = bit DQ0 of the Block
Lock status register. Table 9 defines all of these
possible locking states.
3.3.1 LOCKING OPERATION
The following concisely summarizes the locking
functionality.
•All blocks power-up locked, then can be
unlocked or locked with the Unlock and Lock
commands.
•The Lock-Down command locks a block and
prevents it from being unlocked when WP# = 0.
When WP# = 1, Lock-Down is overridden
and commands can unlock/lock locked-
down blocks.
When WP# returns to 0, locked-down
blocks return to Lock-Down.
Lock-Down is cleared only when the dev ice
is reset or powered-down.
The locki ng status of each bloc k can set to Loc ked,
Unlocked, and Lock-Down, each of which will be
described in the following sections. A
comprehensive state table for the locking functions
is shown in Table 9, and a flowchart for locking
operations is shown in Figure 14.
3.3.2 LOCKED STATE
The default status of all blocks upon power-up or
reset is locked (states [001] or [101]). Locked
blocks are fully protected from alteration. Any
program or erase operati ons attempted on a l ocked
block will return an error on bit SR.1 of the status
register. The status of a locked block can be
changed to Unlocked or Lock-Down using the
appropriate software commands. An Unlocked
block can be locked by writing the Lock command
sequence, 60H followed by 01H.
3.3.3 UNLOCKED STATE
Unlocked blocks (states [000], [100], [110]) can be
programmed or erased. All unlocked blocks return
to the Locked state when the device is reset or
powered down. The status of an unlocked bloc k can
be changed to Locked or Locked-Down using the
appropriate software commands. A Locked block
can be unlocked by writing the Unlock command
sequence, 60H followed by D0H.
3.3.4 LOCK-DOWN STATE
Blocks that are Locked-Down (state [011]) are
protected from program and erase operations (just
like Locked blocks), but their protection status
cannot be changed using software commands
alone. A Loc ked or Unlocked block can be Locked-
down by writing the Lock-Down command
sequence, 60H followed by 2FH. Locked-Down
blocks revert to the Locked state when the device is
reset or powered down.
The Lock-Down function is dependent on the WP#
input pin. When WP# = 0, blocks in Lock-Down
[011] are protected from program, erase, and lock
status changes. When WP# = 1, the Lock-Down
functi on is disabled ([111]) and lock ed-down blocks
can be individually unlocked by software command
to the [110] state, where they can be erased and
programmed. These blocks can then be relocked
[111] and unlocked [110] as desired while WP#
remains high. When WP# goes low, blocks that
were previously locked-down return to the
Lock-Down state [011] regardless of any changes
made while WP# was high. Device reset or power-
down resets all blocks, including those in Lock-
Down, to Locked state.
28F160C18 E
20 ADVANCE INFORMATION
3.3.5 READING A BLOCK’S LOCK STATUS
The lock status of every block can be read in the
configurat ion read mode of the dev ic e. To ent er this
mode, writ e 90H t o the devic e. Subsequent reads at
Block Addres s + 00002 will output the loc k s tat us of
that block. The lock status is represented by the
lowest two output pins, DQ0 and DQ1. DQ0
indicat es the Block Lock /Unlock status and i s set by
the Lock command and cleared by the Unlock
command. It is als o autom atic ally s et when ent ering
Lock-Down. DQ1 indicat es Lock-Down s tatus and i s
set by the Lock-Down command. It cannot be
cleared by software, only by device res et or power-
down. Table 8. Block Lock Status
Item Address Data
Block Lock Configuration XX002 LOCK
• Block Is Unlocked DQ0 = 0
• Block Is Locked DQ0 = 1
• Block Is Locked-Down DQ1 = 1
3.3.6 LOCKING OPERATIONS DURING
ERASE SUSPEND
Changes to block lock status can be performed
during an erase suspend by using the standard
locking command sequences to unlock, lock, or
lock-down a block. This is useful in the case when
another block needs to be updated while an erase
operation is in progress.
To change block locking during an erase operation,
first write the erase suspend command (B0H), then
check the status register until it indicates that the
erase operation has been suspended. Next write
the desired lock c ommand sequenc e to a block and
the lock status will be changed. After completing
any desired lock, read, or program operations,
resume the erase operat ion with t he Erase Resum e
command (D0H).
If a block is locked or locked-down during a
suspended erase of the same block, the locking
status bits will be changed immediately, but when
the erase is resumed, the erase operation will
complete.
Locking operations cannot be performed during a
program suspend. Refer to Appendix A for detailed
information on which commands are valid during
erase suspend.
3.3.7 STATUS REGISTER ERROR
CHECKING
Using nested locking or program command
sequences during erase suspend can introduce
ambiguity into status register results.
Since locking changes are performed using a two
cycle command sequence, e.g., 60H followed by
01H to lock a block, following the Configuration
Setup command (60H) wit h an inval id c ommand wi ll
produce a lock command error (SR.4 and SR.5 will
be set to 1) in the status register. If a lock
command error occurs during an erase suspend,
SR.4 and SR.5 will be set to 1, and will remain at 1
after the erase is resumed. When erase is
complete, any possible error during the erase
cannot be detected via the status register because
of the previous locking command error.
A similar s ituat ion happens if an error oc curs duri ng
a program operation error nested within an erase
suspend.
E28F160C18
21
ADVANCE INFORMATION
Table 9. Block Locking State Transitions
Current State Erase/Prog Lock Command Input Result [Next State]
WP# DQ1DQ0Name Allowed? Lock Unlock Lock-Down
000 “Unlocked” Yes Goes To [001] No Change Goes To [011]
0 0 1 “Locked” (Default) No No Change Goes To [000] Goes To [011]
0 1 1 “Locked-Down” No No Change No Change No Change
1 0 0 “Unlocked” Yes Goes To [101] No Change Goes To [111]
1 0 1 “Locked” No No Change Goes To [100] Goes To [111]
1 1 0 Lock-Down Disabled Yes Goes To [111] No Change Goes To [111]
1 1 1 Lock-Down Disabled No No Change Goes To [110] No Change
NOTES:
1. In this table, the notation [XYZ] denotes the locking state of a block, where X = WP#, Y = DQ1, and Z = DQ0. The current
locking state of a block is defined by the state of WP# and the two bits of the block lock status (DQ0, DQ1). DQ0 indicates if
a block is locked (1) or unlocked (0). DQ1 indicates if a block has been locked-down (1) or not (0).
2. At power-up or device reset, all blocks default to Locked state [001] (if WP# = 0). Holding WP# = 0 is the recommended
default.
3. The “Erase/Program Allowed?” column shows whether erase and program operations are enabled (Yes) or disabled (No)
in that block’s current locking state.
4. The “Lock Command Input Result [Next State]” column shows the result of writing the three locking commands (Lock,
Unlock, Lock-Down) in the current locking state. For example, “Goes To [001]” would mean that writing the command to a
block in the current locking state would change it to [001].
3.4 128-Bit Protection Register
The Advanced+ Boot Block architecture includes a
128-bit protection register than can be used to
increase the security of a system design. For
example, the number contained in the protection
register c an be used to “mate” the fl ash component
with other system components such as the CPU or
ASIC, preventing device substitution. Additional
application information can be found in Intel
application note
AP-657
Designing with the
Advanced+ Boot Block Flash Memory Architecture
.
The 128-bits of the protection register are divided
into two 64-bit segments. One of the segments is
programmed at t he Int el fac tory with a unique 64-bit
number, whic h i s unchangeable. The other segment
is left blank for customer designs to program as
desired. Once the customer segment is
programmed, it can be locked to prevent
reprogramming.
3.4.1 READING THE PROTECTION
REGISTER
The protection register is read in the configuration
read mode. The device i s switched to t his mode by
writing the Read Configuration command (90H).
Once in this mode, read cycles from addresses
shown in Appendix G retrieve the specified
informat ion. To return to read array mode, write the
Read Array command (FFH).
3.4.2 PROGRAMMING THE PROTECTION
REGISTER
The protection register bits are programmed using
the two-cycle Protection Program command. The
64-bit number is programmed 16 bits at a time. Firs t
write the Protection Program Setup command,
C0H. The next write to the device will latch in
address and data and program the specified
location. The allowable addresses are shown in
Appendix G. See Figure 15 for the
Protection
Register Programming Flowchart
.
28F160C18 E
22 ADVANCE INFORMATION
Attem pts to addres s Protec tion Program com m ands
outside the defined protection register address
space should not be attempted. This space is
reserved for future use. Attempting to program to a
previously locked protection register segment will
result in a status register error (program error bit
SR.4 and lock error bit SR.1 will be set to 1).
3.4.3 LOCKING THE PROTECTION
REGISTER
The user-programmable segment of the protection
register is lockable by programming Bit 1 of the
PR-LOCK location to 0. Bit 0 of this location is
programmed to 0 at the Intel factory to protect the
unique device number. This bit is set using the
Protection Program c om m and to program “FFFD” to
the PR-LOCK location. After these bits have been
programmed, no further changes can be made to
the values stored in the protection register.
Protection Program commands to a locked section
will result in a status register error (Program Error
bit SR.4 and Lock Error bit SR.1 will be set to 1).
Protection register lockout state is not reversible.
4 Words
Factory Programmed
4 Words
User Programmed
PR Lock
88H
85H
84H
81H
80H
0645_05
Figure 3. Protection Register Memory Map
3.5 VPP Program and Erase
Voltages
Intel 1.8 Volt Advanced+ Boot Block products
provide in-system programming and erase in the
0.9 V–1.95 V range. For fast production
programming, it als o incl udes a l ow-cos t, back ward-
compatible 12 V programming feature.
3.5.1 IMPROVED 12 VOLT PRODUCTION
PROGRAMMING
When VPP is bet ween 0.9 V and 1.95 V, al l program
and erase current is drawn through the VCC pin.
Note that if VPP is driv en by a l ogic s ignal , VIH min =
0.9 V. That is, VPP must remain above 0.9 V to
perform in-system flash modifications. When VPP is
connected to a 12 V power supply, the device
draws program and erase current directly from the
VPP pin. This eliminates the need for an external
switching transistor to control the voltage VPP.
Figure 4 shows examples of how the flash power
supplies can be configured for various usage
models.
The 12 V VPP mode enhances programming
performance duri ng the short period of time t ypicall y
found in manufacturing processes; however, it is
not intended f or ext ended use. 12 V may be appl ied
to VPP during program and erase operations for a
maximum of 1000 cycles on the main blocks and
2500 cycles on the parameter blocks. VPP may be
connect ed to 12 V for a total of 80 hours maximum .
Stressing the devi ce beyond these limit s may c ause
permanent damage.
3.5.2 VPP ≤ VPPLK FOR COMPLETE
PROTECTION
In addition to the flexible block locking, the VPP
programming voltage can be held low for absolute
hardware write protection of all blocks in the flash
device. When VPP is below VPPLK, any program or
erase operation will result in a error, prompting the
corresponding status register bit (SR.3) to be set.
E28F160C18
23
ADVANCE INFORMATION
V
CC
V
PP
12 V Fast Programming
Absolute Write Protection With V
PP
≤
V
PPLK
System Supply
12 V Supply
10
≤
K
Ω
V
CC
V
PP
System Supply
12 V Supply
Low Voltage and 12 V Fast Programming
V
CC
V
PP
System Supply
Prot#
(Logic Signal)
V
CC
V
PP
System Supply
Low-Voltage Programming
Low-Voltage Programming
Absolute Write Protection via Logic Signal
(Note 1)
0646_02
NOTE:
1. A resistor can be used if the VCC supply can sink adequate current based on resistor value. Techniques used in
AP-657
Designing with the Advanced+ Boot Block Flash Memory Architecture
can be applied to determine resistor or diode
specifications.
Figure 4. Example Power Supply Configurations
3.6 Power Consumption
Intel’s flash devices have a tiered approach to
power savings that can significantly reduce overall
system power consumption. The Automatic Power
Savings (APS) feature reduces power consumption
when the device is selected but idle. If the CE# is
deasserted, the flash enters its standby mode,
where current consumption is even lower. The
combination of these features can minimize
memory power consumption, and therefore, overall
system power consumption.
3.6.1 ACTIVE POWER
(Program/Erase/Read)
With CE# at a logic
-
low level and RST# at a logic
-
high level, the devi ce i s in t he act iv e mode. Refer to
the DC Characteristic tables for ICC current values.
Active power is the largest contributor to overall
system power consumption. Minimizing the active
current could have a profound effect on system
power consumption, especially for battery
-
operated
devices.
3.6.2 AUTOMATIC POWER SAVINGS (APS)
Automatic Power Savings provides low
-
power
operation during read mode. After data i s read from
the memory array and the address lines are
quiescent, APS circuitry places the device in a
mode where typical current is comparable to ICCS.
The flash s tays in this s tati c stat e with output s v alid
until a new location is read.
3.6.3 STANDBY POWER
With CE# at a logic
-
high level (VIH) and device in
read mode, the flash memory is in standby mode,
which disables much of the device’s circuitry and
substantially reduces power consumption. Outputs
are placed in a high
-
impedance state independent
of the status of t he OE# signal. If CE # transiti ons to
a logic
-
high level during erase or program
operations, the device will continue to perform the
operation and cons ume c orrespondi ng ac ti ve power
until the operation is completed.
28F160C18 E
24 ADVANCE INFORMATION
Sys tem engi neers s hould analy ze t he breakdown of
standby time versus active time and quantify the
respective power consumption in each mode for
their specific application. This will provide a more
accurat e measure of applic ation
-
specif ic power and
energy requirements.
3.7 Power-Up/Down Operation
The device is protected against accidental block
erasure or programming during power transitions.
Power supply sequencing is not required, since the
device is indifferent as to which power supply, VPP
or VCC, powers-up first.
3.7.1 RST# CONNECTED TO SYSTEM
RESET
The use of RST# during system reset is important
with automated program/erase devices since the
system expects to read from the flash memory
when it comes out of reset. If a CPU reset occurs
without a flash memory reset, proper CPU
initialization will not occur because the flash
memory may be providing status information
instead of array data. Int el recommends c onnecting
RST# to the system CPU RESET# signal to allow
proper CPU/flash initialization following system
reset.
System designers must guard against spurious
writes when VCC voltages are above VLKO. Since
both WE# and CE# must be low for a command
write, driv ing either s ignal to VIH will inhibit wri tes to
the device. The CUI archit ect ure provides addit ional
protection since alteration of memory contents can
only occur after successful completion of the two-
step command sequences. The device is also
disabled until RST# is brought to V IH, regardless of
the stat e of its c ontrol inputs. By holding the devic e
in reset (RST# connected to system PowerGood)
during power-up/down, inval id bus c ondit ions during
power-up can be masked, providing yet another
level of memory protection.
3.7.2 VCC, VPP AND RST# TRANSITIONS
The CUI latches commands as issued by system
software and is not altered by VPP or CE#
transitions or WSM actions. Its default state upon
power-up, after exit from reset mode or after VCC
transitions above VLKO (Lockout voltage), is read
array mode.
After any program or block erase operation is
complete (even after VPP transitions down to
VPPLK), the CUI must be reset to read array mode
via the Read Array command if access to the flash
memory array is desired.
3.8 Power Supply Decoupling
Flash memory’s power switching characteristics
require careful device decoupling. System
designers should consider three supply current
issues:
1. Standby current levels (ICCS)
2. Read current levels (ICCR)
3. Transient peaks produced by falling and rising
edges of CE#.
Transient c urrent magnit udes depend on the device
outputs’ capacitive and inductive loading. Two-line
control and proper decoupling capacitor selection
will suppress these transient voltage peaks. Each
flash device should have a 0.1 µF ceramic
capacitor connected between each VCC and GND,
and between its VPP and GND. These high-
frequency, inherently low-inductance capacitors
should be placed as close as possible to the
package leads.
E28F160C18
25
ADVANCE INFORMATION
4.0 ELECTRICAL SPECIFICATIONS
4.1 Absolute Maximum Ratings
Extended Operating Temperature
During Read...........................–40 °C to +85 °C
During Block Erase
and Program..........................–40 °C to +85 °C
Temperature Under Bias........ –40 °C to +85 °C
Storage Temperature................. –65 °C to +125 °C
Voltage on Any Pin
(except VCC and VPP)
with Respect to GND .............–0.5 V to +3.0 V1
VPP Voltage (for Block
Erase and Program)
with Respect to GND .......–0.5 V to +13.5 V1,2,4
VCC and VCCQ Supply Voltage
with Respect to GND .............–0.2 V to +3.7 V5
Output Short Circuit Current...................... 100 mA3
NOTICE: This datasheet contains information on products in
the sampling and initial phases of development. Do not
finalize a design with this information. Revised information
will be published when the product is available. Verify with
your local Intel Sales office that you have the latest
datasheet before finalizing a design.
* WARNING: Stressing the device beyond the "Absolute
Maximum Ratings" may cause permanent damage. These
are stress ratings only. Operation beyond the "Operating
Conditions" is not recommended and extended exposure
beyond the "Operating Conditions" may effect device
reliability.
NOTES:
1. Minimum DC voltage is –0.5 V on input/output pins,
with allowable undershoot to –2.0 V for periods < 20 ns.
Maximum DC voltage on input/output pins is VCC +
0.5 V, with allowable overshoot to VCC + 1.5 V for
periods < 20 ns.
2. Maximum DC voltage on VPP may overshoot to +14.0 V
for periods < 20 ns.
3. Output shorted for no more than one second. No more
than one output shorted at a time.
4. VPP voltage is normally 0.9 V–1.95 V. Connection to
supply of 11.4 V–12.6 V can only be done for 1000
cycles on the main blocks and 2500 cycles on the
parameter blocks during program/erase. VPP may be
connected to 12 V for a total of 80 hours maximum.
See Section 3.5 for details.
5. Minimum DC voltage is –0.5 V on VCC and VCCQ, with
allowable undershoot to –2.0 V for periods < 20 ns.
Maximum DC voltage on VCC and VCCQ pins is VCC +
0.5 V, with allowable overshoot to VCC + 1.5 V for
periods < 20 ns.
4.2 Operating Conditions
Table 10. Temperature and Voltage Operating Conditions
Symbol Parameter Notes Min Max Units
TAOperating Temperature –40 +85 °C
VCC1 VCC Supply Voltage 1 1.65 1.95 Volts
VCCQ1 I/O Supply Voltage 1 1.65 1.95 Volts
VPP1 Supply Voltage, when used as logic
control 1 0.9 1.95 Volts
VPP2 1, 2 11.4 12.6 Volts
Cycling Block Erase Cycling 2 100,000 Cycles
NOTES:
1. VCC and VCCQ must share the same supply.
2. Applying VPP = 11.4 V–12.6 V during a program/erase can only be done for a maximum of 1000 cycles on the main blocks
and 2500 cycles on the parameter blocks. VPP may be connected to 12 V for a total of 80 hours maximum. See Section
3.5 for details.
28F160C18 E
26 ADVANCE INFORMATION
4.3 Capacitance
TA = 25 °C, f = 1 MHz
Sym Parameter Notes Typ Max Units Conditions
CIN Input Capacitance 1 6 8 pF VIN = 0 V
COUT Output Capacitance 1 10 12 pF VOUT = 0 V
NOTE:
1. Sampled, not 100% tested.
4.4 DC Characteristics
VCC 1.65 V–1.95 V
VCCQ 1.65 V–1.95 V
Sym Parameter Note Typ Max Unit Test Conditions
ILI Input Load Current 1,7 ± 1 µA VCC = VCCMax
VCCQ = VCCQMax
VIN = VCCQ or GND
ILO Output Leakage Current 1,7 0.2
± 1µA
VCC = VCCMax
VCCQ = VCCQMax
VIN = VCCQ or GND
ICCS VCC Standby Current 1 10 15 µA VCC = VCCMax
CE# = RST# = VCCQ
RST# = WP# = VCCQ or GND
VIN = VCCQ or GND
ICCR VCC Read Current 1,5,7 9 15 mA VCC = VCCMax
VCCQ = VCCQMax
OE# = VIH , CE# = VIL
f = 5 MHz, IOUT = 0 mA
Inputs = VIL or VIH
ICCW +
IPPW
Program Current 1,4 30 55 mA VPP = VPP1
Program in Progress
18 35 mA VPP = VPP2 (12 V)
Program in Progress
ICCE +
IPPE
Erase Current 1,4 30 45 mA VPP = VPP1
Erase in Progress
16 35 mA VPP = VPP2 (12 V)
Erase in Progress
E28F160C18
27
ADVANCE INFORMATION
4.4 DC Characteristics, Continued
VCC 1.65 V–1.95 V
VCCQ 1.65 V–1.95 V
Sym Parameter Note Typ Max Unit Test Conditions
ICCES VCC Erase Suspend
Current 1,2,4 5 15 µA CE# = VIH, Erase Suspend in
Progress
ICCWS VCC Program Suspend
Current 1,2,4 5 15 µA CE# = VIH, Program
Suspend in Progress
IPPS VPP Standby Current 1 0.5 1 µA VPP ≤ VCC
IPPR VPP Read Current 1 0.5 1 µA VPP ≤ VCC
1,4 50 200 µA VPP ≥ VCC
IPPES VPP Erase Suspend Current 1,4 0.5 1 µA VPP = VPP1
Erase Suspend in Progress
50 200 µA VPP = VPP2 (12 V)
Erase Suspend in Progress
IPPWS VPP Program Suspend Current 1,4 0.5 1 µA VPP = VPP1
Program Suspend in
Progress
50 200 µA VPP = VPP2 (12 V)
Program Suspend in
Progress
28F160C18 E
28 ADVANCE INFORMATION
4.4 DC Characteristics, Continued
VCC 1.65 V–1.95 V
VCCQ 1.65 V–1.95 V
Sym Parameter Note Min Max Unit Test Conditions
VIL Input Low Voltage -0.4 0.4 V
VIH Input High Voltage VCCQ -
0.4 V VCCQ +
0.3 V V
VOL Output Low Voltage 7 -0.10 0.10 V VCC = VCCMin
VCCQ = VCCQMin
IOL = 100 µA
VOH Output High Voltage 7 VCCQ -
0.1 V VVCC = VCCMin
VCCQ = VCCQMin
IOH = –100 µA
VPPLK VPP Lock-Out Voltage 3 0.4 V Complete Write Protection
VPP1 VPP during Program / Erase 3 0.9 1.95 V
VPP2 Operations 3,6 11.4 12.6
VLKO VCC Prog/Erase Lock Voltage 1.0 V
NOTES:
1. All currents are in RMS unless otherwise noted. Typical values at nominal VCC, TA = +25 °C.
2. ICCES and ICCWS are specified with device de-selected. If device is read while in erase suspend, current draw is sum of
ICCES and ICCR. If the device is read while in program suspend, current draw is the sum of ICCWS and ICCR.
3. Erase and Program are inhibited when VPP < VPPLK and not guaranteed outside the valid VPP ranges of VPP1 and VPP2.
4. Sampled, not 100% tested.
5. Automatic Power Savings (APS) reduces ICCR to approximately standby levels in static operation (CMOS inputs).
6. Applying VPP = 11.4 V–12.6 V during program/erase can only be done for a maximum of 1000 cycles on the main blocks
and 2500 cycles on the parameter blocks. VPP may be connected to 12 V for a total of 80 hours maximum. See Section
3.5 for details.
7. The test conditions VCCMax, VCCQMax, VCCMin, and VCCQMin refer to the maximum or minimum VCC or VCCQ voltage
listed at the top of each column.
E28F160C18
29
ADVANCE INFORMATION
INPUT OUTPUT
TEST POINTS
V
CCQ
0.0
V
CCQ
2V
CCQ
2
0645_07
Figure 5. Input/Output Reference Waveform
Device
Under Test Out
R
1
V
CCQ
C
L
R
2
0645_08
Figure 6. Test Configuration
Test Configuration Component Values Table
Test Configuration CL (pF) R1 (Ω)R
2 (Ω)
1.65 V–1.95 V Standard
Test 50 14.5K 14.5K
NOTE:
CL includes jig capacitance.
28F160C18 E
30 ADVANCE INFORMATION
4.5 AC Characteristics—Read Operations(1,4)—Extended Temperature
Product 16 Mbit
Access Time (ns) 90 120
# Symbol Parameter Note Min Max Min Max Unit
R1 tAVAV Read Cycle Time 90 120 ns
R2 tAVQV Address to Output Delay 90 120 ns
R3 tELQV CE# to Output Delay 2 90 120 ns
R4 tGLQV OE# to Output Delay 2 45 45 ns
R5 tPHQV RST# to Output Delay 150 150 ns
R6 tELQX CE# to Output in Low Z 3 0 0 ns
R7 tGLQX OE# to Output in Low Z 3 0 0 ns
R8 tEHQZ CE# to Output in High Z 3 25 25 ns
R9 tGHQZ OE# to Output in High Z 3 25 25 ns
R10 tOH Output Hold from
Address, CE#, or OE#
Change, Whichever
Occurs First
30 0 ns
NOTES:
1. See Figure 7:
AC Waveform: Read Operations
.
2. OE# may be delayed up to tELQV–tGLQV after the falling edge of CE# without impact on tELQV.
3. Sampled, but not 100% tested.
4. See Figure 5:
Input/Output Reference Waveform
for timing measurements and maximum allowable input slew rate.
E28F160C18
31
ADVANCE INFORMATION
Address Stable
Device and
Address Selection
IH
V
IL
V
ADDRESSES (A)
IH
V
IL
V
IH
V
IL
V
IH
V
IL
V
CE# (E)
OE# (G)
WE# (W)
DATA (D/Q)
IH
V
IL
V
RP#(P)
OL
V
OH
VHigh Z Valid Output
Data
Valid Standby
High Z
R1
R2
R3
R4
R5
R6
R7
R8
R9
R10
Figure 7. AC Waveform: Read Operations
28F160C18 E
32 ADVANCE INFORMATION
4.6 AC Characteristics—Write Operations(1,5,6)—Extended Temperature
Product 16 Mbit
Access Time (ns) 90 120
# Symbol Parameter Note Min Min Unit
W1 tPHWL /
tPHEL
RST# High Recovery to WE# (CE#) Going Low 150 150 ns
W2 tELWL /
tWLEL
CE# (WE#) Setup to WE# (CE#) Going Low 0 0 ns
W3 tWLWH /
tELEH
WE# (CE#) Pulse Width 4 70 70 ns
W4 tDVWH /
tDVEH
Data Setup to WE# (CE#) Going High 2 70 70 ns
W5 tAVWH /
tAVEH
Address Setup to WE# (CE#) Going High 2 70 70 ns
W6 tWHEH /
tEHWH
CE# (WE#) Hold Time from WE# (CE#) High 0 0 ns
W7 tWHDX /
tEHDX
Data Hold Time from WE# (CE#) High 2 0 0 ns
W8 tWHAX /
tEHAX
Address Hold Time from WE# (CE#) High 2 0 0 ns
W9 tWHWL /
tEHEL
WE# (CE#) Pulse Width High 4 30 30 Ns
W10 tVPWH /
tVPEH
VPP Setup to WE# (CE#) Going High 3 200 200 ns
W11 tQVVL VPP Hold from Valid SRD 3 0 0 ns
W12 tBHWH /
tBHEH
WP# Setup to WE# (CE#) Going High 3 0 0 ns
W13 tQVBL WP# Hold from Valid SRD 3 0 0 ns
W14 tWHGL Write Recovery before Read 3,7 30 ns
NOTES:
1. Write timing characteristics during erase suspend are the same as during write-only operations.
2. Refer to Table 5 for valid AIN or DIN.
3. Sampled, but not 100% tested.
4. Write pulse width (tWP) is defined from CE# or WE# going low (whichever goes low last) to CE# or WE# going high
(whichever goes high first). Hence, tWP = tWLWH = tELEH = tWLEH = tELWH. Similarly, Write pulse width high (tWPH) is defined
from CE# or WE# going high (whichever goes high first) to CE# or WE# going low (whichever goes low first). Hence,
tWPH = tWHWL = tEHEL = tWHEL = tEHWL.
5. See Figure 5:
Input/Output Reference Waveform
for timing measurements and maximum allowable input slew rate.
6. See Figure 8: AC Waveform: Program and Erase Operations
7. Delay is defined from WE#(CE#) high to OE# going low.
E28F160C18
33
ADVANCE INFORMATION
4.7 Erase and Program Timings(1)
VPP 0.9 V–1.95 V 11.4 V–12.6 V
Symbol Parameter Note Typ(1) Max Typ(1) Max Unit
tBWPB 4-KW Parameter Block
Program Time (Word) 2, 3 0.1 0.3 0.03 0.1 s
tBWMB 32-KW Main Block
Program Time(Word) 2, 3 0.8 2.4 0.24 0.80 s
tWHQV1 / tEHQV1 Word Program Time 2, 3 22 200 8 185 µs
tWHQV2 / tEHQV2 4-KW Parameter Block
Erase Time (Word) 2, 3 1 4 0.8 4 s
tWHQV3 / tEHQV3 32-KW Main Block
Erase Time (Word) 2, 3 1.8 5 1.1 5 s
tWHRH1 / tEHRH1 Program Suspend Latency 3 5 10 5 10 µs
tWHRH2 / tEHRH2 Erase Suspend Latency 3 5 20 5 20 µs
NOTES:
1. Typical values measured at TA = +25 °C and nominal voltages.
2. Excludes external system-level overhead.
3. Sampled, but not 100% tested.
28F160C18 E
34 ADVANCE INFORMATION
A
IN
A
IN
AB C D E F
W11
D
IN
W10
Valid
SRD
D
IN
D
IN
W7
W3
W4
High Z
W2
W9
W6
W5 W8
V
IH
V
IL
ADDRESSES [A]
V
IH
V
IL
CE# (WE#) [E(W)]
V
IH
V
IL
OE# [G]
V
IH
V
IL
WE# (CE) [W(E)]
V
IH
V
IL
DATA [D/Q]
V
IH
V
IL
WP#
V
PPH
1
V
IL
V
PP
[V]
V
PPH
2
V
IH
V
IL
RP# [P]
(Note 1)
(Note 1)
W13W12
W1
V
PPLK
NOTES:
1. CE# must be toggled low when reading Status Register Data. WE# must be inactive (high) when reading Status Register
Data.
A. VCC Power-Up and Standby.
B. Write Program or Erase Setup Command.
C. Write Valid Address and Data (for Program) or Erase Confirm Command.
D. Automated Program or Erase Delay.
E. Read Status Register Data (SRD): reflects completed program/erase operation.
F. Write Read Array Command.
Figure 8. AC Waveform: Program and Erase Operations
E28F160C18
35
ADVANCE INFORMATION
4.8 Reset Operations
IH
V
IL
V
RP# (P)
PLPH
t
IH
V
IL
V
RP# (P)
PLPH
t
(A) Reset during Read Mode
Abort
Complete PHQV
tPHWL
tPHEL
t
PHQV
tPHWL
tPHEL
t
(B) Reset during Program or B lock Erase, <
PLPH
tPLRH
t
PLRH
t
IH
V
IL
V
RP# (P)
PLPH
t
Abort
Complete PHQV
tPHWL
tPHEL
t
PLRH
t
Deep
Power-
Down
(C) Reset P rogram or Block Erase, >
PLPH
tPLRH
t
Figure 9. AC Waveform: Reset Operation
Table 11. Reset Specifications(1)
VCC 1.65 V–1.95 V
Symbol Parameter Notes Min Max Unit
tPLPH RST# Low to Reset during Read
(If RST# is tied to VCC, this specification is not
applicable)
2,4 100 ns
tPLRH1 RST# Low to Reset during Block Erase 3,4 22 µs
tPLRH2 RST# Low to Reset during Program 3,4 12 µs
NOTES:
1. See Section 3.1.4 for a full description of these conditions.
2. If tPLPH is < 100 ns the device may still reset but this is not guaranteed.
3. If RST# is asserted while a block erase or word program operation is not executing, the reset will complete within 100 ns.
4. Sampled, but not 100% tested.
28F160C18 E
36 ADVANCE INFORMATION
5.0 ORDERING INFORMATION
T E 2 8 F 1 6 0 C 1 T 9 0
Package
TE = 48-Lead TSOP
BG = 55-Ball 0.5 mm
µBGA* CSP
Product l i ne designator
for all Intel
®
Flash products
Access Speed (ns)
16 Mbit = 90, 120
Product Fami l y
C18 = 1.8 V Advanced+ Boot Block
V
CC
= 1.65 V - 1.95 V
V
PP
= 0.9 V - 1.95 V or
11.4 V - 12.6 V
Device Density
160 = x16 (16 Mbit)
T =
Top Blocking
B =
Bottom Blocking
8
VALID COMBINATIONS (All Extended Temperature)
48-Lead TSOP 48-Ball µBGA* CSP
Extended 16M TE28F160C18T90 BG28F160C18T90
TE28F160C18B90 BG28F160C18B90
TE28F160C18T120 BG28F160C18T120
TE28F160C18B120 BG28F160C18B120
NOTES:
1. The 48-ball µBGA package top side mark reads FXX0C18 where XX is the device density.
E28F160C18
37
ADVANCE INFORMATION
6.0 ADDITIONAL INFORMATION(1,2)
Order Number Document/Tool
210830
Flash Memory Databook
292215
AP-657 Designing with the Advanced+ Boot Block Flash Memory
Architecture
292204
AP-646 Common Flash Interface (CFI) and Command Sets
Contact your Intel
Representative
Flash Data Integrator (FDI) Software Developer’s Kit
297874
FDI Interactive: Play with Intel’s Flash Data Integrator on Your PC
NOTES:
1. Please call the Intel Literature Center at (800) 548-4725 to request Intel documentation. International customers should
contact their local Intel or distribution sales office.
2. Visit Intel’s World Wide Web home page at http://www.Intel.com or http://intel.com/design/flash for technical
documentation and tools.
28F160C18 E
38 ADVANCE INFORMATION
APPENDIX A
WSM CURRENT/NEXT STATES
Command Input (and Next State)
Current
State SR.7 Data
When
Read
Read
Array
(FFH)
Program
Setup
(10/40H)
Erase
Setup
(20H)
Erase
Confirm
(D0H)
Prog/Ers
Suspend
(B0H)
Prog/Ers
Resume
(D0)
Read
Status
(70H)
Clear
Status
(50H)
Read Array “1” Array Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Read Status “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Read
Config. “1” Config Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Read Query “1” CFI Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Lock Setup “1” Status Lock Command Error Lock
(Done) Lock
Cmd. Error Lock
(Done) Lock Cmd. Error
Lock Cmd.
Error “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Lock Oper.
(Done) “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Prot. Prog.
Setup “1” Status Protection Register Program
Prot. Prog.
(Not Done) “0” Status Protection Register Program (Not Done)
Prot. Prog.
(Done) “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Prog. Setup “1” Status Program
Program
(Not Done) “0” Status Program (Not Done) Prog. Sus.
Status Program (Not Done)
Prog. Susp.
Status “1” Status Prog. Sus.
Read Array Program Suspend
Read Array Program
(Not Done) Prog. Sus.
Rd. Array Program
(Not Done) Prog. Sus.
Status Prog. Sus.
Rd. Array
Prog. Susp.
Read Array “1” Array Prog. Sus.
Read Array Program Suspend
Read Array Program
(Not Done) Prog. Sus.
Rd. Array Program
(Not Done) Prog. Sus.
Status Prog. Sus.
Rd. Array
Prog. Susp.
Read Config “1” Config Prog. Sus.
Read Array Program Suspend
Read Array Program
(Not Done) Prog. Sus.
Rd. Array Program
(Not Done) Prog. Sus.
Status Prog. Sus.
Rd. Array
Prog. Susp.
Read Query “1” CFI Prog. Sus.
Read Array Program Suspend
Read Array Program
(Not Done) Prog. Sus.
Rd. Array Program
(Not Done) Prog. Sus.
Status Prog. Sus.
Rd. Array
Program
(Done) “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Erase Setup “1” Status Erase Command Error Erase
(Not Done) Erase
Cmd. Error Erase
(Not Done) Erase Command Error
Erase Cmd.
Error “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
Erase
(Not Done) “0” Status Erase (Not Done) Erase Sus.
Status Erase (Not Done)
Ers. Susp.
Status “1” Status Erase Sus.
Read Array Program Setup Ers. Sus.
Rd. Array Erase Ers. Sus.
Rd. Array Erase Erase Sus.
Status Ers. Sus.
Rd. Array
Erase Susp.
Array “1” Array Erase Sus.
Read Array Program Setup Ers. Sus.
Rd. Array Erase Ers. Sus.
Rd. Array Erase Erase Sus.
Status Ers. Sus.
Rd. Array
Ers. Susp.
Read Config “1” Config Erase Sus.
Read Array Program Setup Ers. Sus.
Rd. Array Erase Ers. Sus.
Rd. Array Erase Erase Sus.
Status Ers. Sus.
Rd. Array
Ers. Susp.
Read Query “1” CFI Erase Sus.
Read Array Program Setup Ers. Sus.
Rd. Array Erase Ers. Sus.
Rd. Array Erase Erase Sus.
Status Ers. Sus.
Rd. Array
Erase
(Done) “1” Status Read Array Program Setup Erase
Setup Read Array Read
Status Read
Array
E28F160C18
39
ADVANCE INFORMATION
APPENDIX A
WSM CURRENT/NEXT STATES (Continued)
Command Input (and Next State)
Current State Read Config
(90H) Read Query
(98H) Lock Setup
(60H) Prot. Prog.
Setup (C0H) Lock Confirm
(01H) Lock Down
Confirm
(2FH)
Unlock
Confirm
(D0H)
Read Array Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Read Status Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Read Config. Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Read Query Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Lock
Setup Locking Command Error Lock Operation (Done)
Lock Cmd.
Error Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Lock Operation
(Done) Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Prot. Prog.
Setup Protection Register Program
Prot. Prog.
(Not Done) Protection Register Program (Not Done)
Prot. Prog.
(Done) Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Prog. Setup Program
Program
(Not Done) Program (Not Done)
Prog. Susp.
Status Prog. Susp.
Read Config. Prog. Susp.
Read Query Program Suspend Read Array Program
(Not Done)
Prog. Susp.
Read Array Prog. Susp.
Read Config. Prog. Susp.
Read Query Program Suspend Read Array Program
(Not Done)
Prog. Susp.
Read Config. Prog. Susp.
Read Config. Prog. Susp.
Read Query Program Suspend Read Array Program
(Not Done)
Prog. Susp.
Read Query. Prog. Susp.
Read Config. Prog. Susp.
Read Query Program Suspend Read Array Program
(Not Done)
Program
(Done) Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Erase
Setup Erase Command Error Erase
(Not Done)
Erase Cmd.
Error Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
Erase
(Not Done) Erase (Not Done)
Erase Suspend
Status Erase Suspend
Read Config. Erase Suspend
Read Query Lock Setup Erase Suspend Read Array Erase
(Not Done)
Erase Suspend
Array Erase Suspend
Read Config. Erase Suspend
Read Query Lock Setup Erase Suspend Read Array Erase
(Not Done)
Eras Sus. Read
Config Erase Suspend
Read Config. Erase Suspend
Read Query Lock Setup Erase Suspend Read Array Erase
(Not Done)
Eras Sus. Read
Query Erase Suspend
Read Config. Erase Suspend
Read Query Lock Setup Erase Suspend Read Array Erase
(Not Done)
Ers.(Done) Read Config. Read Query Lock Setup Prot. Prog.
Setup Read Array
28F160C18 E
40 ADVANCE INFORMATION
APPENDIX B
PROGRAM/ERASE FLOWCHARTS
Start
Write 40H
Program Address/Data
Read Status Register
SR.7 = 1?
Full Status
Check if Desired
Program Complete
Read Status Register
Data (See Above)
V
PP
Range Error
Programming Error
Attempted Program to
Locked Block - Aborted
Program Successful
SR.3 =
SR.4 =
SR.1 =
FULL STATUS CHECK PROCEDURE
Bus Operation
Write
Write
Standby
Repeat for subsequent programming operations.
SR Full Status Check can be done after each program or after a sequence of
program operations.
Write FFH after the last program operation to reset device to read array mode.
Bus Operation
Standby
Standby
SR.3 MUST be cleared, if set during a program attempt, before further
attempts are allowed by the Write State Machine.
SR.1, SR.3 and SR.4 are only cleared by the Clear Staus Register Command,
in cases where multiple bytes are programmed before full status is checked.
If an error is detected, clear the status register before attempting retry or other
error recovery.
No
Yes
1
0
1
0
1
0
Command
Program Setup
Program
Comments
Data = 40H
Data = Data to Program
Addr = Location to Program
Check SR.7
1 = WSM Ready
0 = WSM Busy
Command Comments
Check SR.3
1 = V
PP
Low Detect
Check SR.1
1 = Attempted Program to
Locked Block - Program
Aborted
Read Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Standby Check SR.4
1 = V
PP
Program Error
Figure 10. Automated Word Programming Flowchart
E28F160C18
41
ADVANCE INFORMATION
Start
Write B0H
Read Status Register
No
Comments
Data = B0H
Addr = X
Data = FFH
Addr = X
SR.7 =
SR.2 =
1
Write FFH
Read Array Data
Program Completed
Done
Reading
Yes
Write FFHWrite D0H
Program Resumed Read Array Data
0
1
Read array data from block
other than the one being
programmed.
Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Addr = X
Check SR.7
1 = WSM Ready
0 = WSM Busy
Check SR.2
1 = Program Suspended
0 = Program Completed
Data = D0H
Addr = X
Bus
Operation Command
0
Write 70H
Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Addr = X
Write
Write
Write
Read
Read
Standby
Standby
Write
Data=70H
Addr=X
Command
Program
Suspend
Read Status
Read Array
Program
Resume
Figure 11. Program Suspend/Resume Flowchart
28F160C18 E
42 ADVANCE INFORMATION
Start
Write 20H
Write D0H and
Block Address
Read Status Register
SR.7 =
Full Status
Check if Desired
Block Erase Complete
FULL STATUS CHECK PROCEDURE
Bus Operation
Write
Write
Standby
Repeat for subsequent block erasures.
Full Status Check can be done after each block erase or after a sequence of
block erasures.
Write FFH after the last write operation to reset device to read array mode.
Bus Operation
Standby
SR. 1 and 3 MUST be cleared, if set during an erase attempt, before further
attempts are allowed by the Write State Machine.
SR.1, 3, 4, 5 are only cleared by the Clear Staus Register Command, in cases
where multiple bytes are erased before full status is checked.
If an error is detected, clear the status register before attempting retry or other
error recovery.
No Yes
Suspend Erase
Suspend
Erase Loop
1
0
Standby
Command
Erase Setup
Erase Confirm
Comments
Data = 20H
Addr = Within Block to Be
Erased
Data = D0H
Addr = Within Block to Be
Erased
Check SR.7
1 = WSM Ready
0 = WSM Busy
Command Comments
Check SR.3
1 = V
PP
Low Detect
Check SR.4,5
Both 1 = Command Sequence
Error
Read Status Register
Data (See Above)
V
PP
Range Error
Command Sequence
Error
Block Erase
Successful
SR.3 =
SR.4,5 =
1
0
1
0
Block Erase ErrorSR.5 = 1
0
Attempted Erase of
Locked Block - Aborted
SR.1 = 1
0
Read Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Standby Check SR.5
1 = Block Erase Error
Standby Check SR.1
1 = Attempted Erase of
Locked Block - Erase Aborted
Figure 12. Automated Block Erase Flowchart
E28F160C18
43
ADVANCE INFORMATION
Start
Write B0H
Read Status Register
No
Comments
Data = B0H
Addr = X
Data = FFH
Addr = X
SR.7 =
SR.6 =
1
Write FFH
Read Array Data
Erase Completed
Done
Reading
Yes
Write FFHWrite D0H
Erase Resumed Read Array Data
0
1
Read array data from block
other than the one being
erased.
Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Addr = X
Check SR.7
1 = WSM Ready
0 = WSM Busy
Check SR.6
1 = Erase Suspended
0 = Erase Completed
Data = D0H
Addr = X
Bus
Operation
Write
Standby
Write
Read
Standby
Read
Command
0
Write 70H
Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Addr = X
Write
Write
Data=70H
Addr=X
Command
Erase Suspend
Read Status
Read Array
Erase Resume
Figure 13. Erase Suspend/Resume Flowchart
28F160C18 E
44 ADVANCE INFORMATION
Start
Write 60H
(Configuration Setup)
Read Status Register
No
Comments
Data = 60H
Addr = X
SR.4, SR.5,
SR.7 =
Write 90H
(Read Configuration)
Read Block Lock Status
Locking
Change
Confirmed?
Locking Change
Complete
80H
Check Status Register
80H = no error
B0H = Lock Command
Sequence Error
Bus
Operation
Write
Command
B0H
Write
01H, D0H, or 2FH
Status Register Data
Addr = X
Write
Write
Read
(Optional)
Standby
(Optional)
Data= 01H (Lock Block)
D0H (Unlock Block)
2FH (Lockdown Block)
Addr=Within block to lock
Command
Config. Setup
Lock, Unlock,
or Lockdown
Lock Command
Sequence Error
Data = 90H
Addr = X
Write
(Optional) Read
Configuration
Block Lock Status Data
Addr = Second addr of block
Read
(Optional) Block Lock
Status
Confirm Locking Change on
DQ
1
, DQ
0
. (See Block Locking
State Table for valid
combinations.)
Standby
(Optional)
Figure 14. Locking Operations Flowchart
E28F160C18
45
ADVANCE INFORMATION
Start
Write C0H
(Protection Reg.
Program Setup)
Write Protect. Register
Address/Data
Read Status Register
SR.7 = 1?
Full Status
Check if Desired
Program Complete
Read Status Register
Data (See Above)
V
PP
Range Error
Protection Register
Programming Error
Attempted Program to
Locked Register -
Aborted
Program Successful
SR.3, SR.4 =
SR.1, SR.4 =
SR.1, SR.4 =
FULL STATUS CHECK PROCEDURE
Bus Operation
Write
Write
Standby
Protection Program operations can only be addressed within the protection
register address space. Addresses outside the defined space will return an
error.
Repeat for subsequent programming operations.
SR Full Status Check can be done after each program or after a sequence of
program operations.
Write FFH after the last program operation to reset device to read array mode.
Bus Operation
Standby
Standby
SR.3 MUST be cleared, if set during a program attempt, before further
attempts are allowed by the Write State Machine.
SR.1, SR.3 and SR.4 are only cleared by the Clear Staus Register Command,
in cases of multiple protection register program operations before full status is
checked.
If an error is detected, clear the status register before attempting retry or other
error recovery.
No
Yes
1, 1
0,1
1,1
Command
Protection Program
Setup
Protection Program
Comments
Data = C0H
Data = Data to Program
Addr = Location to Program
Check SR.7
1 = WSM Ready
0 = WSM Busy
Command Comments
SR.1 SR.3 SR.4
0 1 1 V
PP
Low
0 0 1 Prot. Reg.
Prog. Error
1 0 1 Register
Locked:
Aborted
Read Status Register Data Toggle
CE# or OE# to Update Status
Register Data
Standby
Figure 15. Protection Register Programming Flowchart
28F160C18 E
46 ADVANCE INFORMATION
APPENDIX C
COMMON FLASH INTERFACE QUERY STRUCTURE
This appendix defines the data s tructure or “databas e” returned by the Common Fl ash Interf ace (CFI) Query
command. Syst em software s houl d parse this structure to gain cri tical information such as block si ze, density,
x8/x16, and electrical specifications. Once this information has been obtained, the software will know which
command sets to use to enable flash writes, block erases, and otherwise control the flash component. The
Query is part of an overall specification for multiple command set and control interface descriptions called
Common Flash Interface, or CFI.
C.1 QUERY STRUCTURE OUTPUT
The Query “databas e” allows system software to gain critical information for controlling the flash component.
This section describes the device’s CFI-compliant interface that allows the host system to access Query data.
Query data are always present ed on the lowes t-order dat a output s (DQ0-7) only . The num eric al off set val ue is
the address relative t o the max imum bus wi dth supported by the devic e. On thi s famil y of dev ices, the Query
table device starting address is a 10h, which is a word address for x16 devices.
For a word-wide (x16) device, the first two bytes of the Query s tructure, “Q”, ”R”, and “Y” in ASCII, appear on
the low byte at word addresses 10h, 11h, and 12h. This CFI-compliant device outputs 00H data on upper
bytes. Thus, the device outputs ASCII “Q” in the low byte (DQ0-7) and 00h in the high byte (DQ8-15).
At Query addres ses containing t wo or more bytes of inf ormation, the least significant data byte is presented
at the lower address, and the most significant data byte is presented at the higher address.
In all of the following tables, addresses and data are represented in hexadecimal notation, so the “h” suffix
has been dropped. In addition, since the upper byte of word-wide devices is always “00h,” the leading “00”
has been dropped from t he table notati on and onl y the lower by t e value is shown. Any x16 devic e outputs c an
be assumed to have 00h on the upper byte in this mode.
Table C1. Summary of Query Structure Output As a Function of Device and Mode
Device Location Query Data
(Hex, ASCII)
16-Mbit x 16 10 51 “Q”
(Word Addresses) 11 52 “R”
12 59 “Y”
E28F160C18
47
ADVANCE INFORMATION
Table C2. Example of Query Structure Output for x16 Devices
Device
Address Word Addressing:
Query Data
A19–A0D15–D0
000010h
000011h
000012h
000013h
000014h
000015h
000016h
000017h
000018h
...
0051h “Q”
0052h “R”
0059h “Y”
P_IDLO PrVendor ID# (Lo byte)
P_IDHI PrVendor ID# (HI byte)
PLO PrVendor TblAddr (Lo)
PHI PrVendor TblAddr (Hi)
A_IDLO AltVendor ID# (Lo)
A_IDHI AltVendor ID# (Hi)
...
C.2 QUERY STRUCTURE OVERVIEW
The Query command causes the flash component to display the Common Flash Interface (CFI) Query
structure or “database.”
NOTE:
Detailed sections describe the Query structure sub-sections in detail are TBD.
28F160C18 E
48 ADVANCE INFORMATION
APPENDIX D
ARCHITECTURE BLOCK DIAGRAM
Output
Multiplexer
4-Kword
Parameter Block
32-Kword
Main Block
32-Kword
Main Block
4-Kword
Parameter Block
Y-Gating/Sensing Write State
Machine Program/Erase
Voltage Switch
Data
Comparator
Status
Register
Identifier
Register
Data
Register
I/O Logic
Address
Latch
Address
Counter
X-Decoder
Y-Decoder
Power
Reduction
Control
Input Buffer
Output Buffer
GND
V
CC
V
PP
CE#
WE#
OE#
RST#
Command
User
Interface
Input Buffer
A
0
-A
19
DQ
0
-DQ
15
V
CCQ
WP#
E28F160C18
49
ADVANCE INFORMATION
APPENDIX E
WORD-WIDE MEMORY MAP DIAGRAMS
16-Mbit Word-Wide Memory Addressing
Top Boot Bottom Boot
Size
(KW) 16M Size
(KW) 16M
4 FF000-FFFFF 32
4 FE000-FEFFF 32
4 FD000-FDFFF 32
4 FC000-FCFFF 32
4 FB000-FBFFF 32
4 FA000-FAFFF 32
4 F9000-F9FFF 32
4 F8000-F8FFF 32
32 F0000-F7FFF 32
32 E8000-EFFFF 32
32 E0000-E7FFF 32
32 D8000-DFFFF 32
32 D0000-D7FFF 32
32 C8000-CFFFF 32
32 C0000-C7FFF 32
32 B8000-BFFFF 32
32 B0000-B7FFF 32
32 A8000-AFFFF 32
32 A0000-A7FFF 32
32 98000-9FFFF 32
32 90000-97FFF 32
32 88000-8FFFF 32
32 80000-87FFF 32
32 78000-7FFFF 32
32 70000-77FFF 32
32 68000-6FFFF 32
32 60000-67FFF 32
32 58000-5FFFF 32
32 50000-57FFF 32
32 48000-4FFFF 32
32 40000-47FFF 32
32 38000-3FFFF 32
This column continued
on next page This column continued
on next page
28F160C18 E
50 ADVANCE INFORMATION
16-Mbit Word-Wide Memory Addressing (Continued)
Top Boot Bottom Boot
Size
(KW) 16M Size
(KW) 16M
32 30000-37FFF 32 F8000-FFFFF
32 28000-2FFFF 32 F0000-F7FFF
32 20000-27FFF 32 E8000-EFFFF
32 18000-1FFFF 32 E0000-E7FFF
32 10000-17FFF 32 D8000-DFFFF
32 08000-0FFFF 32 D0000-D7FFF
32 00000-07FFF 32 C8000-CFFFF
32 32 C0000-C7FFF
32 32 B8000-BFFFF
32 32 B0000-B7FFF
32 32 A8000-AFFFF
32 32 A0000-A7FFF
32 32 98000-9FFFF
32 32 90000-97FFF
32 32 88000-8FFFF
32 32 80000-87FFF
32 32 78000-7FFFF
32 32 70000-77FFF
32 32 68000-6FFFF
32 32 60000-67FFF
32 32 58000-5FFFF
32 32 50000-57FFF
32 32 48000-4FFFF
32 32 40000-47FFF
32 32 38000-3FFFF
32 32 30000-37FFF
32 32 28000-2FFFF
32 32 20000-27FFF
32 32 18000-1FFFF
32 32 10000-17FFF
32 32 08000-0FFFF
32 4 07000-07FFF
32 4 06000-06FFF
32 4 05000-05FFF
32 4 04000-04FFF
32 4 03000-03FFF
32 4 02000-02FFF
32 4 01000-01FFF
32 4 00000-00FFF
E28F160C18
51
ADVANCE INFORMATION
APPENDIX F
DEVICE ID TABLE
Read Configuration Addresses and Data
Item Address Data
Manufacturer Code x16 00000 0089
Device Code
16-Mbit x 16-T x16 00001 88C2
16-Mbit x 16-B x16 00001 88C3
NOTE: Other locations within the configuration address space
are reserved by Intel for future use.
28F160C18 E
52 ADVANCE INFORMATION
APPENDIX G
PROTECTION REGISTER ADDRESSING
Word-Wide Protection Register Addressing
Word Use A7 A6 A5 A4 A3 A2 A1 A0
LOCK Both 1 0 0 0 0 0 0 0
0 Factory 1 0 0 0 0 0 0 1
1 Factory 1 0 0 0 0 0 1 0
2 Factory 1 0 0 0 0 0 1 1
3 Factory 1 0 0 0 0 1 0 0
4 User 1 0 0 0 0 1 0 1
5 User 1 0 0 0 0 1 1 0
6 User 1 0 0 0 0 1 1 1
7 User 1 0 0 0 1 0 0 0
NOTE:
1. All address lines not specified in the above table must be 0 when accessing the Protection Register, i.e., A
19–A8 = 0.
