W39V040AQ

W39V040A 512K × 8 CMOS FLASH MEMORY WITH LPC INTERFACE 1. GENERAL DESCRIPTION The W39V040A is a 4-megabit, 3.3-volt only CMOS flash memory organized as 512K × 8 bits. For flexible erase capability, the 4Mbits of data are divided into 8 uniform sectors of 64 Kbytes, which are composed of 16 smaller even pages with 4 Kbytes. The device can be programmed and erased in-system with a standard 3.3V power supply. A 12-volt VPP is not required. The unique cell architecture of the W39V040A results in fast program/erase operations with extremely low current consumption. This device can operate at two modes, Programmer bus interface mode and LPC bus interface mode. As in the Programmer interface mode, it acts like the traditional flash but with a multiplexed address inputs. But in the LPC interface mode, this device complies with the Intel LPC specification. The device can also be programmed and erased using standard EPROM programmers. 2. FEATURES • Single 3.3-volt Operations: − 3.3-volt Read − 3.3-volt Erase − 3.3-volt Program • Hardware protection: − Optional 16K byte or 64K byte Top Boot Block with lockout protection − #TBL & #WP support the whole chip hardware protection • • • Fast Program Operation: − Byte-by-Byte programming: 35 µS (typ.) Flexible 4K-page size can be used as Parameter Blocks Low power consumption − Active current: 12.5 mA (typ. for LPC mode) Automatic program and erase timing with internal VPP generation End of program or erase detection − Toggle bit − Data polling • Fast Erase Operation: − Chip erase 100 mS (max.) − Sector erase 25 mS (max.) − Page erase 25 mS (max.) Fast Read access time: Tkq 11 nS Endurance: 10K cycles (typ.) Twenty-year data retention 8 Even sectors with 64K bytes each, which is composed of 16 flexible pages with 4K bytes Any individual sector or page can be erased • • • • • • • • • • Latched address and data TTL compatible I/O Available packages: 32L PLCC, 32L STSOP -1- Publication Release Date: December 19, 2002 Revision A2 W39V040A 3. PIN CONFIGURATIONS 4. BLOCK DIAGRAM #WP #TBL CLK LAD[3:0] #LFRAM MODE #RESET A 8 ^ G P I 2 v A 9 ^ G P I 3 v R / # C ^ C L K v A 1 0 ^ G P I 4 v LPC Interface BOOT BLOCK, 16K BYTES MAIN MEMORY SECTOR7, 64K BYTES 8K BYTES 7FFFF 7C000 PARAMETER BLOCK1, 7BFFF 7A000 PARAMETER BLOCK2, 79FFF 8K BYTES MEMORY BLOCK, 32K BYTES MAIN MEMORY SECTOR6, 64K BYTES MAIN MEMORY SECTOR5, 64K BYTES 78000 77FFF 70000 6FFFF # R E S V END TCD R/#C A[10:0] DQ[7:0] 29 28 27 26 25 24 23 22 21 MODE Vss NC NC VDD #OE(#INIT) #WE(#LFRAM) NC DQ7(RSV) MAIN MEMORY SECTOR4, 64K BYTES 43 A7(GPI1) A6(GPI0) A5(#WP) A4(#TBL) A3(RSV) A2(RSV) A1(RSV) A0(RSV) DQ0(LAD0) 5 6 7 8 9 10 11 12 13 2 1 32 31 30 Programmer Interface MAIN MEMORY SECTOR3, 64K BYTES MAIN MEMORY SECTOR2, 64K BYTES MAIN MEMORY SECTOR1, 64K BYTES MAIN MEMORY SECTOR0, 64K BYTES #OE #WE 60000 5FFFF 50000 4FFFF 40000 3FFFF 30000 2FFFF 20000 1FFFF 10000 0FFFF 00000 32L PLCC 5. PIN DESCRIPTION SYM. MODE #RESET INTERFACE PGM * * LPC * * * * * * * * * * * * * * * * * * * * * * * Reset Initialize Top Boot Block Lock Write Protect CLK Input General Purpose Inputs Identification Inputs Address/Data Inputs LPC Cycle Initial Row/Column Select Address Inputs Data Inputs/Outputs Output Enable Write Enable Power Supply Ground Reserve Pins No Connection PIN NAME Interface Mode Selection 14 15 16 17 18 19 20 D Q 1 ^ L A D 1 v DVDDDD QSQQQQ 2S3456 ^ ^^^^ L LRRR A ASSS D DVVV 2 3vvv v v #INIT #TBL #WP NC NC NC VSS MODE A10(GPI4) R/#C(CLK) VDD NC #RESET A9(GPI3) A8(GPI2) A7(GPI1) A6(GPI0) A5(#WP) A4(#TBL) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 #OE(#INIT) #WE(#LFRAM VDD DQ7(RSV) DQ6(RSV) DQ5(RSV) DQ4(RSV) DQ3(LAD3) VSS DQ2(LAD2) DQ1(LAD1) DQ0(LAD0) A0(RSV) A1(RSV) A2(RSV) A3(RSV) CLK GPI[4:0] ID[3:0] LAD[3:0] 32L STSOP #LFRAM R/#C A[10:0] DQ[7:0] #OE #WE VDD VSS RSV NC -2- W39V040A 6. FUNCTIONAL DESCRIPTION Interface Mode Selection And Description This device can be operated in two interface modes, one is Programmer interface mode, and the other is LPC interface mode. The MODE pin of the device provides the control between these two interface modes. These interface modes need to be configured before power up or return from #RESET. When MODE pin is set to high position, the device is in the Programmer mode; while the MODE pin is set to low position, it is in the LPC mode. In Programmer mode, this device just behaves like traditional flash parts with 8 data lines. But the row and column address inputs are multiplexed. The row address is mapped to the higher internal address A[18:11]. And the column address is mapped to the lower internal address A[10:0]. For LPC mode, It complies with the LPC Interface Specification Revision 1.0. Through the LAD[3:0] and #LFRAM to communicate with the system chipset . Read(Write) Mode In Programmer interface mode, the read(write) operation of the W39V040A is controlled by #OE (#WE). The #OE (#WE) is held low for the host to obtain(write) data from(to) the outputs(inputs). #OE is the output control and is used to gate data from the output pins. The data bus is in high impedance state when #OE is high. As in the LPC interface the "bit 1 of CYCLE TYPE+DIR" determines mode, the read or write. Refer to the timing waveforms for further details. Reset Operation The #RESET input pin can be used in some application. When #RESET pin is at high state, the device is in normal operation mode. When #RESET pin is at low state, it will halt the device and all outputs will be at high impedance state. As the high state re-asserted to the #RESET pin, the device will return to read or standby mode, it depends on the control signals. Boot Block Operation and Hardware Protection at Initial - #TBL and #WP There are two alternatives to set the boot block. Either 16K-byte or 64K-byte in the top location of this device can be locked as boot block, which can be used to store boot codes. It is located in the last 16K/64K bytes of the memory with the address range from 7C000(hex)/70000(hex) to 7FFFF(hex). See Command Codes for Boot Block Lockout Enable for the specific code. Once this feature is set the data for the designated block cannot be erased or programmed (programming lockout), other memory locations can be changed by the regular programming method. Besides the software method, there is a hardware method to protect the top boot block and other sectors. Before power on programmer, tie the #TBL pin to low state and then the top boot block will not be programmed/erased. If #WP pin is tied to low state before power on, the other sectors will not be programmed/erased. In order to detect whether the boot block feature is set on or not, users can perform software command sequence: enter the product identification mode (see Command Codes for Identification/Boot Block Lockout Detection for specific code), and then read from address 7FFF2(hex). If the DQ0/DQ1 output data is "1," the 64Kbytes/16Kbytes boot block programming lockout feature will be activated; if the DQ0/DQ1 output data is "0," the lockout feature will be inactivated and the boot block can be erased/programmed. But the hardware protection will override the software lock setting, i.e., while the #TBL pin is trapped at low state, the top boot block cannot be programmed/erased whether the output data, DQ0/DQ1 at the address 7FFF2, is "0" or "1". The #TBL will lock the whole 64Kbytes top boot Publication Release Date: December 19, 2002 Revision A2 -3- W39V040A block, it will not partially lock the 16Kbytes boot block. You can check the DQ2/DQ3 at the address 7FFF2 to see whether the #TBL/#WP pin is in low or high state. If the DQ2 is "0", it means the #TBL pin is tied to high state. In such condition, whether boot block can be programmed/erased or not will depend on software setting. On the other hand, if the DQ2 is "1", it means the #TBL pin is tied to low state, then boot block is locked no matter how the software is set. Like the DQ2, the DQ3 inversely mirrors the #WP state. If the DQ3 is "0", it means the #WP pin is in high state, then all the sectors except the boot block can be programmed/erased. On the other hand, if the DQ3 is "1", then all the sectors except the boot block are programmed/erased inhibited. To return to normal operation, perform a three-byte command sequence (or an alternate single-byte command) to exit the identification mode. For the specific code, see Command Codes for Identification/Boot Block Lockout Detection. Chip Erase Operation The chip-erase mode can be initiated by a six-byte command sequence. After the command loading cycle, the device enters the internal chip erase mode, which is automatically timed and will be completed within fast 100 mS (max). The host system is not required to provide any control or timing during this operation. If the boot block programming lockout is activated, only the data in the other memory sectors will be erased to FF(hex) while the data in the boot block will not be erased (remains as the same state before the chip erase operation). The entire memory array will be erased to FF(hex) by the chip erase operation if the “boot block programming lockout feature” is not activated. The device will automatically return to normal read mode after the erase operation completed. Data polling and/or Toggle Bits can be used to detect end of erase cycle. Sector/Page Erase Operation Sector/page erase is a six-bus cycles operation. There are two "unlock" write cycles, followed by writing the "set-up" command. Two more "unlock" write cycles then follows by the sector/page erase command. The sector/page address (any address location within the desired sector/page) is latched on the rising edge of R/C, while the command (30H/50H) is latched on the rising edge of #WE in programmer mode. Sector/page erase does not require the user to program the device prior to erase. When erasing a sector/page or sectors/pages the remaining unselected sectors/pages are not affected. The system is not required to provide any controls or timings during these operations. The automatic sector/page erase begins after the erase command is completed, right from the rising edge of the #WE pulse for the last sector/page erase command pulse and terminates when the data on DQ7, Data Polling, is "1" at which time the device returns to the read mode. Data Polling must be performed at an address within any of the sectors/pages being erased. Refer to the Erase Command flow Chart using typical command strings and bus operations. Program Operation The W39V040A is programmed on a byte-by-byte basis. Program operation can only change logical data "1" to logical data "0." The erase operation, which changed entire data in main memory and/or boot block from "0" to "1", is needed before programming. The program operation is initiated by a 4-byte command cycle (see Command Codes for Byte Programming). The device will internally enter the program operation immediately after the byte-program command is entered. The internal program timer will automatically time-out (50 µS max. TBP) once it is completed and then return to normal read mode. Data polling and/or Toggle Bits can be used to detect end of program cycle. -4- W39V040A Hardware Data Protection The integrity of the data stored in the W39V040A is also hardware protected in the following ways: (1) Noise/Glitch Protection: A #WE pulse of less than 15 nS in duration will not initiate a write cycle. (2) VDD Power Up/Down Detection: The programming and read operation is inhibited when VDD is less than 1.5V typical. (3) Write Inhibit Mode: Forcing #OE low or #WE high will inhibit the write operation. This prevents inadvertent writes during power-up or power-down periods. (4) VDD power-on delay: When VDD has reached its sense level, the devices will automatically time-out 5 mS before any write (erase/program) operation. Data Polling (DQ7)- Write Status Detection The W39V040A includes a data polling feature to indicate the end of a program or erase cycle. When the W39V040A is in the internal program or erase cycle, any attempts to read DQ7 of the last byte loaded will receive the complement of the true data. Once the program or erase cycle is completed, DQ7 will show the true data. Note that DQ7 will show logical "0" during the erase cycle, and become logical "1" or true data when the erase cycle has been completed. Toggle Bit (DQ6)- Write Status Detection In addition to data polling, the W39V040A provides another method for determining the end of a program cycle. During the internal program or erase cycle, any consecutive attempts to read DQ6 will produce alternating 0's and 1's. When the program or erase cycle is completed, this toggling between 0's and 1's will stop. The device is then ready for the next operation. Multi-Chip Operation Multiple devices can be wired on the single LPC bus. There are four ID pins can be used to support up to 16 devices. But in order not to violate the BIOS ROM memory space defined by Intel, Winbond W39V040A will only used 3 ID pins to allow up to 8 devices, 4Mbytes for BIOS code and 4Mbytes for registers memory space. Register There are two kinds of registers on this device, the General Purpose Input Registers and Product Identification Registers. Users can access these registers through respective address in the 4Gbytes memory map. There are detail descriptions in the sections below. General Purpose Inputs Register This register reads the states of GPI[4:0] pins on the W39V040A. This is a pass-through register, which can be read via memory address FFBxE100(hex). The "x" in the addresses represents the ID [3:0] pin straps. Since it is pass-through register, there is no default value. -5- Publication Release Date: December 19, 2002 Revision A2 W39V040A GPI Register BIT 7−5 4 3 2 1 0 Reserved Read GPI4 pin status Read GPI3 pin status Read GPI2 pin status Read GPI1 pin status Read GPI0 pin status FUNCTION Product Identification Registers There is an alternative software method (six commands bytes) to read out the Product Identification in both the Programmer interface mode and the LPC interface mode. Thus, the programming equipment can automatically matches the device with its proper erase and programming algorithms. In the software access mode, a six-byte (or JEDEC 3-byte) command sequence can be used to access the product ID for programmer interface mode. A read from address 0000(hex) outputs the manufacturer code, DA(hex). A read from address 0001(hex) outputs the device code, 3D(hex).” The product ID operation can be terminated by a three-byte command sequence or an alternate one-byte command sequence (see Command Definition table for detail). Identification Input Pins ID[3:0] These pins are part of mechanism that allows multiple parts to be used on the same bus. The boot device should be 0000b. And all the subsequent parts should use the up-count strapping. Note that a 1M byte ROM will occupy two Ids. For example: a 1MByte ROM's ID is 0000b, the next ROM's ID is 0010b. These pins all are pulled down with internal resistor. Memory Address Map There are 8M bytes space reserved for BIOS Addressing. The 8M bytes are mapped into a single 4M system address by dividing the ROMs into two 4M byte pages. For accessing the 4M byte BIOS storage space, the ID[2:0] pins are inverted in the ROM and are compared to address lines [21:19]. ID[3] can be used as like active low chip-select pin. The 32Mbit address space is as below: BLOCK 4M Byte BIOS ROM LOCK None ADDRESS RANGE FFFF, FFFFh: FFC0, 0000h The ROM responds to 640K (top 512K + bottom 128K) byte pages based on the ID pins strapping according to the following table: ID[2:0] PINS 000 001 010 011 ROM BASED ADDRESS RANGE FFFF, FFFFh: FFF8, 0000h & 000F, FFFFh: 000E, 00000h FFF7, FFFFh: FFF0, 0000h FFEF, FFFFh: FFE8, 0000h FFE7, FFFFh: FFE0, 0000h -6- W39V040A Continued 100 101 110 111 FFDF, FFFFh: FFD8, 0000h FFD7, FFFFh: FFD0, 0000h FFCF, FFFFh: FFC8, 0000h FFC7, FFFFh: FFC0, 0000h Table of Operating Modes Operating Mode Selection - Programmer Mode MODE PINS #OE VIL VIH X VIL X VIH #WE VIH VIL X X VIH X #RESET VIH VIH VIL VIH VIH VIH ADDRESS AIN AIN X X X X Dout Din High Z High Z/DOUT High Z/DOUT High Z DQ. Read Write Standby Write Inhibit Output Disable Operating Mode Selection - LPC Mode Operation modes in LPC interface mode are determined by "cycle type" when it is selected. When it is not selected, its outputs (LAD[3:0]) will be disable. Please reference to the "Standard LPC Memory Cycle Definition". Standard LPC Memory Cycle Definition FIELD NO. OF CLOCKS DESCRIPTION "0000b" appears on LPC bus to indicate the initial "010Xb" indicates memory read cycle; while "011xb" indicates memory write cycle. "X" mean don't have to care. Turned Around Time Address Phase for Memory Cycle. LPC supports the 32 bits address protocol. The addresses transfer most significant nibble first and least significant nibble last. (i.e. Address[31:28] on LAD[3:0] first , and Address[3:0] on LAD[3:0] last.) Synchronous to add wait state. "0000b" means Ready, "0101b" means Short Wait, "0110b" means Long Wait, "1001b" for DMA only, "1010b" means error, other values are reserved. Data Phase for Memory Cycle. The data transfer least significant nibble first and most significant nibble last. (i.e. DQ[3:0] on LAD[3:0] first , then DQ[7:4] on LAD[3:0] last.) Start Cycle Type & Dir TAR Addr. 1 1 2 8 Sync. N Data 2 -7- Publication Release Date: December 19, 2002 Revision A2 W39V040A Table of Command Definition COMMAND DESCRIPTION Read Chip Erase Sector Erase Page Erase Byte Program Top Boot Block Lockout – 64K/16KByte Product ID Entry Product ID Exit Product ID Exit (1) (1) NO. OF Cycles 1 6 6 6 4 6 3 3 1 1ST CYCLE Addr. Data AIN DOUT 5555 AA 5555 AA 5555 AA 5555 AA 5555 AA 5555 AA 5555 AA XXXX F0 2ND CYCLE Addr. Data 2AAA 55 2AAA 55 2AAA 55 2AAA 55 2AAA 55 2AAA 55 2AAA 55 3RD CYCLE Addr. Data 5555 80 5555 80 5555 80 5555 A0 5555 80 5555 90 5555 F0 4TH CYCLE Addr. Data 5555 AA 5555 AA 5555 AA AIN DIN 5TH CYCLE Addr. Data 2AAA 55 2AAA 55 2AAA 55 6TH CYCLE Addr. Data 5555 10 SA PA (3) (4) 30 50 5555 AA 2AAA 55 5555 40/70 Notes: 1. The cycle means the write command cycle not the LPC clock cycle. 2. The Column Address / Row Address are mapped to the Low / High order Internal Address. i.e. Column Address A[10:0] are mapped to the internal A[10:0], Row Address A[7:0] are mapped to the internal A[18:11] 3. Address Format: A14 − A0 (Hex); Data Format: DQ7 − DQ0 (Hex) 4. Either one of the two Product ID Exit commands can be used. 5. SA: Sector Address SA = 7XXXXh for Unique Sector7 (Boot Sector) SA = 6XXXXh for Unique Sector6 SA = 5XXXXh for Unique Sector5 SA = 4XXXXh for Unique Sector4 SA = 3XXXXh for Unique Sector3 SA = 2XXXXh for Unique Sector2 SA = 1XXXXh for Unique Sector1 SA = 0XXXXh for Unique Sector0 6. PA: Page Address PA = 7FXXXh for Page 15 in Sector 7 PA = 7EXXXh for Page 14 in Sector 7 PA = 7DXXXh for Page 13 in Sector 7 PA = 7CXXXh for Page 12 in Sector 7 PA = 7BXXXh for Page 11 in Sector 7 PA = 7AXXXh for Page 10 in Sector 7 PA = 79XXXh for Page 9 in Sector 7 PA = 78XXXh for Page 8 in Sector 7 PA = 77XXXh for Page 7 in Sector 7 PA = 76XXXh for Page 6 in Sector 7 PA = 75XXXh for Page 5 in Sector 7 PA = 74XXXh for Page 4 in Sector 7 PA = 73XXXh for Page 3 in Sector 7 PA = 72XXXh for Page 2 in Sector 7 PA = 71XXXh for Page 1 in Sector 7 PA = 70XXXh for Page 0 in Sector 7 PA = 6FXXXh to 60XXXh for Page 15 to Page 0 In Sector 6 (Reference to the first column) PA = 5FXXXh to 50XXXh for Page 15 to Page 0 In Sector 5 (Reference to the first column) PA = 4FXXXh to 40XXXh for Page 15 to Page 0 In Sector 4 (Reference to the first column) PA = 3FXXXh to 30XXXh for Page 15 to Page 0 In Sector 3 (Reference to the first column) PA = 2FXXXh to 20XXXh for Page 15 to Page 0 In Sector 2 (Reference to the firs column) PA = 1FXXXh to 10XXXh for Page 15 to Page 0 In Sector 1 (Reference to the first column) PA = 0FXXXh to 00XXXh for Page 15 to Page 0 In Sector 0 (Reference to the first column) -8- W39V040A Embedded Programming Algorithm Start Write Program Command Sequence (see below) #Data Polling/ Toggle bit Pause T BP No Increment Address Last Address ? Yes Programming Completed Program Command Sequence (Address/Command): 5555H/AAH 2AAAH/55H 5555H/A0H Program Address/Program Data -9- Publication Release Date: December 19, 2002 Revision A2 W39V040A Embedded Erase Algorithm Start Write Erase Command Sequence (see below) #Data Polling or Toggle Bit Successfully Completed Pause T EC /TSEC/TPEC Erasure Completed Chip Erase Command Sequence (Address/Command): 5555H/AAH Individual Sector Erase Command Sequence (Address/Command): 5555H/AAH Individual Page Erase Command Sequence (Address/Command): 5555H/AAH 2AAAH/55H 2AAAH/55H 2AAAH/55H 5555H/80H 5555H/80H 5555H/80H 5555H/AAH 5555H/AAH 5555H/AAH 2AAAH/55H 2AAAH/55H 2AAAH/55H 5555H/10H Sector Address/30H PageAddress/50H - 10 - W39V040A Embedded #Data Polling Algorithm Start VA = Byte address for programming = Any of the sector addresses within the sector being erased during sector erase operation = Any of the page addresses within the sector being erased during page erase operation = Any of the device addresses within the chip being erased during chip erase operation Read Byte (DQ0 - DQ7) Address = VA No DQ7 = Data ? Yes Pass Embedded Toggle Bit Algorithm Start Read Byte (DQ0 - DQ7) Address = Don't Care No DQ6 = Toggle ? Yes Fail - 11 - Publication Release Date: December 19, 2002 Revision A2 W39V040A Software Product Identification and Boot Block Lockout Detection Acquisition Flow Product Identification Entry (1) Load data AA to address 5555 Identification and Boot Block Lockout Detection Mode (3) Product Product Identification Exit (6) Load data AA to address 5555 (2) Load data 55 to address 2AAA Read address = 00000 data = DA Load data 55 to address 2AAA Load data 90 to address 5555 Read address = 00001 data = 3D (2) Load data F0 to address 5555 Pause 10 µS Read address = 00002 DQ0/DQ1 of data outputs = 1/0 (4) Pause 10 µS (5) Normal Mode Notes for software product identification/boot block lockout detection: (1) Data Format: DQ7 − DQ0 (Hex); Address Format: A14 − A0 (Hex) (2) A1 − A18 = VIL; manufacture code is read for A0 = VIL; device code is read for A0 = VIH. (3) The device does not remain in “identification and boot block lockout detection” mode if power down. (4) The DQ[3:0] to indicate the sectors protect status as below: DQ0 0 1 64Kbytes Boot Block Unlocked by Software 64Kbytes Boot Block Locked by Software DQ1 16Kbytes Boot Block Unlocked by Software 16Kbytes Boot Block Locked by Software DQ2 64Kbytes Boot Block Unlocked by #TBL hardware trapping 64Kbytes Boot Block Locked by #TBL hardware trapping DQ3 Whole Chip Unlocked by #WP hardware trapping Except Boot Block Whole Chip Locked by #WP hardware trapping Except Boot Block (5) The device returns to standard operation mode. (6) Optional 1-write cycle (write F0 hex at XXXX address) can be used to exit the “product identification/boot block lockout detection.” - 12 - W39V040A Boot Block Lockout Enable Acquisition Flow Boot Block Lockout Feature Set Flow Load data AA to address 5555 Load data 55 to address 2AAA Load data 80 to address 5555 Load data AA to address 5555 Load data 55 to address 2AAA Load data 40/70 to address 5555 40 to lock 64K Boot Block 70 to lcok 16K Boot Block Pause T BP Exit - 13 - Publication Release Date: December 19, 2002 Revision A2 W39V040A 7. DC CHARACTERISTICS Absolute Maximum Ratings PARAMETER Power Supply Voltage to VSS Potential Operating Temperature Storage Temperature D.C. Voltage on Any Pin to Ground Potential Transient Voltage (