28F128W18

28F128W18 INTEL | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 100

Technical content

Datasheet sections

Datasheet sections

• 10.0 Thermal and DC Characteristics
• 11.0 AC Characteristics

Datasheet sections

Datasheet sections

Datasheet sections

Datasheet sections

Intel® Wireless Flash Memory (W18) 28F320W18, 28F640W18, 28F128W18 Datasheet Product Features The Intel® Wireless Flash Memory (W18) device with flexible multi-partition dual operation, provides high-performance asynchronous and synchronous burst reads. It is an ideal memory for low-voltage burst CPUs. Combining high read performance with flash memory’s intrinsic non- volatility, the W18 device eliminates the traditional system-performance paradigm of shadowing redundant code memory from slow nonvolatile storage to faster execution memory. It reduces the total memory requirement that increases reliability and reduces overall system power consumption and cost. The W18 device’s flexible multi-partition architecture allows programming or erasing to occur in one partition while reading from another partition. This allows for higher data write throughput compared to single partition architectures. The dual-operation architecture also allows two processors to interleave code operations while program and erase operations take place in the background. The designer can also choose the size of the code and data partitions via the flexible multi-partition architecture. ■High Performance Read-While-Write/ Erase —Burst frequency at 66 MHz —60 ns Initial Access Read Speed —11 ns Burst-Mode Read Speed —20 ns Page-Mode Read Speed —4-, 8-, 16-, and Continuous-Word Burst Mode Reads —Burst and Page Mode Reads in all Blocks, across all partition boundaries —Burst Suspend Feature —Enhanced Factory Programming at 3.1 µs/word (typ.for 0.13 µm) ■Security —128-bit Protection Register —64-bits Unique Programmed by Intel —64-bits User-Programmable —Absolute Write Protection with VPP at Ground —Individual and Instantaneous Block Locking/Unlocking with Lock-Down Capability ■Quality and Reliability —Temperature Range: –40 °C to +85 °C —100k Erase Cycles per Block —0.13 µm ETOX™VIII Process —0.18 µm ETOX™VII Process ■Architecture —Multiple 4-Mbit Partitions —Dual Operation: RWW or RWE —8KB parameter blocks —64KB main blocks —Top or Bottom Parameter Devices —16-bit wide data bus ■Software —5 µs (typ.) Program and Erase Suspend Latency Time —Flash Data Integrator (FDI) and Common Flash Interface (CFI) Compatible —Programmable WAIT Signal Polarity ■Packaging and Power —0.13 µm: 32-, 64-, and 128-Mbit in VF Package —0.18 µm: 32- and 128-Mbit Densities in µBGA* Package —56 Active Ball Matrix, 0.75 mm Ball- Pitch —VCC = 1.70 V to 1.95 V —VCCQ = 1.70 V to 2.24 V or 1.35 V to 1.80 V —Standby current (0.13 µm): 8µA (typ.) —Read current: 7mA (typ.) 290701-009 December 2003 Notice: This document contains information on new products in production. The specifications are subject to change without notice. Verify with your local Intel sales office that you have the latest datasheet before finalizing a design.

INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. Intel products are not intended for use in medical, life saving, or life sustaining applications. Intel may make changes to specifications and product descriptions at any time, without notice. The 1.8 Volt Intel® wireless flash memory datasheet may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an ordering number and are referenced in this document, or other Intel literature may be obtained by calling 1-800- 548-4725 or by visiting Intel's website at http://www.intel.com. Copyright © 2003, Intel Corporation. *Other names and brands may be claimed as the property of others.

Intel® Wireless Flash Memory (W18) Datasheet 1.0 Introduction 1.1 Document Purpose This datasheet contains information about the 1.8 Volt Intel® Wireless Flash memory (W18) device memory functionality. Section 10.0 describes the electrical specifications for extended temperature product offerings. Packaging specifications and order information can be found in Appendix C and Appendix D, respectively. 1.2 Nomenclature Many acronyms that describe product features or usage are defined here:

• APS - Automatic Power Savings
• BBA - Block Base Address
• CFI - Common Flash Interface
• CUI - Command User Interface
• EFP - Enhanced Factory Programming
• FDI - Flash Data Integrator
• NC - No Connect
• OTP - One-Time Programmable
• PBA - Partition Base Address
• RWE - Read-While-Erase
• RWW - Read-While-Write
• SRD - Status Register Data
• VF BGA - Very thin, Fine pitch, Ball Grid Array
• WSM - Write State Machine 1.3 Conventions Many abbreviated terms and phrases are used throughout this document:
• The term “1.8 V” refers to the full VCC voltage range of 1.7 V – 1.95 V (except where noted) and “VPP = 12 V” refers to 12 V ±5%.
• When referring to registers, the term set means the bit is a logical 1, and clear means the bit is a logical 0.
• The terms pin and signal are often used interchangeably to refer to the external signal connections on the package. (ball is the term used for VF BGA).
• A word is 2 bytes, or 16 bits.

Intel® Wireless Flash Memory (W18) Datasheet

• Signal names are in all CAPS (see Section 2.3, “Signal Descriptions” on page 14.)
• Voltage applied to the signal is subscripted, for example, VPP. Throughout this document, references are made to top, bottom, parameter, and partition. To clarify these references, the following conventions have been adopted:
• A block is a group of bits (or words) that erase simultaneously with one block erase instruction.
• A main block contains 32 Kwords.
• A parameter block contains 4 Kwords.
• The Block Base Address (BBA) is the first address of a block.
• A partition is a group of blocks that share erase and program circuitry and a common status register.
• The Partition Base Address (PBA) is the first address of a partition. For example, on a 32- Mbit top-parameter device, partition number 5 has a PBA of 140000h.
• The top partition is located at the highest physical device address. This partition may be a main partition or a parameter partition.
• The bottom partition is located at the lowest physical device address. This partition may be a main partition or a parameter partition.
• A main partition contains only main blocks.
• A parameter partition contains a mixture of main blocks and parameter blocks.
• A top parameter device (TPD) has the parameter partition at the top of the memory map with the parameter blocks at the top of that partition. This was formerly referred to as top-boot device.
• A bottom parameter device (BPD) has the parameter partition at the bottom of the memory map with the parameter blocks at the bottom of that partition. This was formerly referred to as bottom-boot block flash device. 2.0 Device Description This section provides an overview of the W18 device features, packaging, signal naming, and device architecture. 2.1 Product Overview The W18 device provides Read-While-Write (RWW) and Read-White-Erase (RWE) capability with high-performance synchronous and asynchronous reads on package-compatible densities with a 16-bit data bus. Individually-erasable memory blocks are optimally sized for code and data storage. Eight 4-Kword parameter blocks are located in the parameter partition at either the top or bottom of the memory map. The rest of the memory array is grouped into 32-Kword main blocks. The memory architecture for the W18 device consists of multiple 4-Mbit partitions, the exact number depending on device density. By dividing the memory array into partitions, program or erase operations can take place simultaneously during read operations. Burst reads can traverse

Intel® Wireless Flash Memory (W18) Datasheet partition boundaries, but user application code is responsible for ensuring that they don’t extend into a partition that is actively programming or erasing. Although each partition has burst-read, write, and erase capabilities, simultaneous operation is limited to write or erase in one partition while other partitions are in a read mode. Augmented erase-suspend functionality further enhances the RWW capabilities of this device. An erase can be suspended to perform a program or read operation within any block, except that which is erase-suspended. A program operation nested within a suspended erase can subsequently be suspended to read yet another memory location. After device power-up or reset, the W18 device defaults to asynchronous read configuration. Writing to the device’s configuration register enables synchronous burst-mode read operation. In synchronous mode, the CLK input increments an internal burst address generator. CLK also synchronizes the flash memory with the host CPU and outputs data on every, or on every other, valid CLK cycle after an initial latency. A programmable WAIT output signals to the CPU when data from the flash memory device is ready. In addition to its improved architecture and interface, the W18 device incorporates Enhanced Factory Programming (EFP), a feature that enables fast programming and low-power designs. The EFP feature provides the fastest currently-available program performance, which can increase a factory’s manufacturing throughput. The device supports read operations at 1.8 V and erase and program operations at 1.8 V or 12 V. With the 1.8-V option, VCC and VPP can be tied together for a simple, ultra-low-power design. In addition to voltage flexibility, the dedicated VPP input provides complete data protection when VPP ≤VPPLK. This device allows I/O operation at voltages even lower than the minimum VCCQ of 1.7 V. This Extended VCCQ range, 1.35 V – 1.8 V, permits even greater system design flexibility. A 128-bit protection register enhances the user’s ability to implement new security techniques and data protection schemes. Unique flash device identification and fraud-, cloning-, or content- protection schemes are possible through a combination of factory-programmed and user-OTP data cells. Zero-latency locking/unlocking on any memory block provides instant and complete protection for critical system code and data. An additional block lock-down capability provides hardware protection where software commands alone cannot change the block’s protection status. The device’s Command User Interface (CUI) is the system processor’s link to internal flash memory operation. A valid command sequence written to the CUI initiates device Write State Machine (WSM) operation that automatically executes the algorithms, timings, and verifications necessary to manage flash memory program and erase. An internal status register provides ready/ busy indication results of the operation (success, fail, and so on). Three power-saving features– Automatic Power Savings (APS), standby, and RST#– can significantly reduce power consumption. The device automatically enters APS mode following read cycle completion. Standby mode begins when the system deselects the flash memory by de-asserting CE#. Driving RST# low produces power savings similar to standby mode. It also resets the part to read-array mode (important for system-level reset), clears internal status registers, and provides an additional level of flash write protection.

Figure 1. 56-Ball VF BGA / µBGA Ballout

1. On lower density devices, upper address balls can be treated as NC. (Example: For 32-Mbit density, A21 and A22 will be NC).
2. See Appendix C, “Mechanical Specifications” on page 95 for mechanical specifications for the package.

Figure 2. 88-Ball (80 Active Balls) QUAD+ Ballout

1. Unused upper address balls can be treated as NC (for 128Mbit, A[25:23] are not used).
2. See Appendix C, “Mechanical Specifications” on page 95 for mechanical specifications for the package.

Intel® Wireless Flash Memory (W18) Datasheet 2.3 Signal Descriptions Table 1 describes ball usage. Table 1. Signal Descriptions Symbol Type Name and Function A[22:0] I ADDRESS INPUTS: For memory addresses. 32 Mbit: A[20:0]; 64 Mbit: A[21:0]; 128 Mbit: A[22:0] D[15:0] I/O DATA INPUTS/OUTPUTS: Inputs data and commands during write cycles; outputs data during memory, status register, protection register, and configuration code reads. Data pins float when the chip or outputs are deselected. Data is internally latched during writes. ADV# I ADDRESS VALID: ADV# indicates valid address presence on address inputs. During synchronous read operations, all addresses are latched on ADV#’s rising edge or the next valid CLK edge with ADV# low, whichever occurs first. CE# I CHIP ENABLE: Asserting CE# activates internal control logic, I/O buffers, decoders, and sense amps. De-asserting CE# deselects the device, places it in standby mode, and tri-states all outputs. CLK I CLOCK: CLK synchronizes the device to the system bus frequency during synchronous reads and increments an internal address generator. During synchronous read operations, addresses are latched on ADV#’s rising edge or the next valid CLK edge with ADV# low, whichever occurs first. OE# I OUTPUT ENABLE: When asserted, OE# enables the device’s output data buffers during a read cycle. When OE# is deasserted, data outputs are placed in a high-impedance state. RST# I RESET: When low, RST# resets internal automation and inhibits write operations. This provides data protection during power transitions. de-asserting RST# enables normal operation and places the device in asynchronous read-array mode. WAIT O WAIT: The WAIT signal indicates valid data during synchronous read modes. It can be configured to be asserted-high or asserted-low based on bit 10 of the Configuration Register. WAIT is tri-stated if CE# is deasserted. WAIT is not gated by OE#. WE# I WRITE ENABLE: WE# controls writes to the CUI and array. Addresses and data are latched on the rising edge of WE#. WP# I WRITE PROTECT: Disables/enables the lock-down function. When WP# is asserted, the lock-down mechanism is enabled and blocks marked lock-down cannot be unlocked through software. See Section 7.1, “Block Lock Operations” on page 39 for details on block locking. VPP Pwr/I ERASE AND PROGRAM POWER: A valid voltage on this pin allows erasing or programming. Memory contents cannot be altered when VPP ≤VPPLK. Block erase and program at invalid VPP voltages should not be attempted. Set VPP = VCC for in-system program and erase operations. To accommodate resistor or diode drops from the system supply, the VIH level of VPP can be as low as VPP1 min. VPP must remain above VPP1 min to perform in-system flash modification. VPP may be 0 V during read operations. VPP2 can be applied to main blocks for 1000 cycles maximum and to parameter blocks for 2500 cycles. VPP can be connected to 12 V for a cumulative total not to exceed 80 hours. Extended use of this pin at 12 V may reduce block cycling capability. VCC Pwr DEVICE POWER SUPPLY: Writes are inhibited at VCC ≤VLKO. Device operations at invalid VCC voltages should not be attempted. VCCQ Pwr OUTPUT POWER SUPPLY: Enables all outputs to be driven at VCCQ. This input may be tied directly to VCC. VSS Pwr GROUND: Pins for all internal device circuitry must be connected to system ground.

Intel® Wireless Flash Memory (W18) Datasheet 2.4 Memory Map and Partitioning The W18 device is divided into 4-Mbit physical partitions, which allows simultaneous RWW or RWE operations and allows users to segment code and data areas on 4-Mbit boundaries. The device’s memory array is asymmetrically blocked, which enables system code and data integration within a single flash device. Each block can be erased independently in block erase mode. Simultaneous program and erase operations are not allowed; only one partition at a time can be actively programming or erasing. See Table 2, “Bottom Parameter Memory Map” on page 16 and Table 3, “Top Parameter Memory Map” on page 17. The 32-Mbit device has eight partitions, the 64-Mbit device has 16 partitions, and the 128-Mbit device has 32 partitions. Each device density contains one parameter partition and several main partitions. The 4-Mbit parameter partition contains eight 4-Kword parameter blocks and seven 32- Kword main blocks. Each 4-Mbit main partition contains eight 32-Kword blocks each. The bulk of the array is divided into main blocks that can store code or data, and parameter blocks that allow storage of frequently updated small parameters that are normally stored in EEPROM. By using software techniques, the word-rewrite functionality of EEPROMs can be emulated. VSSQ Pwr OUTPUT GROUND: Provides ground to all outputs which are driven by VCCQ. This signal may be tied directly to VSS. DU DON’T USE: Do not use this pin. This pin should not be connected to any power supplies, signals or other pins and must be floated. NC NO CONNECT: No internal connection; can be driven or floated. Table 1. Signal Descriptions Symbol Type Name and Function

Intel® Wireless Flash Memory (W18) Datasheet Table 2. Bottom Parameter Memory Map Size (KW) Blk #

32 Mbit

Blk #

64 Mbit

Blk #

128 Mbit

Intel® Wireless Flash Memory (W18) Datasheet Table 3. Top Parameter Memory Map Size (KW) Blk # Blk # Blk #

Intel® Wireless Flash Memory (W18) Datasheet 3.0 Device Operations This section provides an overview of device operations. The 1.8 Volt Intel®Wireless Flash memory family includes an on-chip WSM to manage block erase and program algorithms. Its CUI allows minimal processor overhead with RAM-like interface timings. 3.1 Bus Operations 3.1.1 Read The 1.8 Volt Intel Wireless Flash memory has several read configurations:

• Asynchronous page mode read.
• Synchronous burst mode read — outputs four, eight, sixteen, or continuous words, from main blocks and parameter blocks. Several read modes are available in each partition:
• Read-array mode: read accesses return flash array data from the addressed locations.
• Read identifier mode: reads return manufacturer and device identifier data, block lock status, and protection register data. Identifier information can be accessed starting at 4-Mbit partition base addresses; the flash array is not accessible in read identifier mode.
• Read query mode: reads return device CFI data. CFI information can be accessed starting at 4-Mbit partition base addresses; the flash array is not accessible in read query mode.
• Read status register mode: reads return status register data from the addressed partition. That partition’s array data is not accessible. A system processor can check the status register to determine an addressed partition’s state or monitor program and erase progress. All partitions support the synchronous burst mode that internally sequences addresses with respect to the input CLK to select and supply data to the outputs. Identifier codes, query data, and status register read operations execute as single-synchronous or asynchronous read cycles. WAIT is asserted during these reads. Table 4. Bus Operations Mode RST# CE# OE# WE# ADV# WAIT D[15:0] Notes Reset VIL X X X X High-Z High-Z 1,2 Write VIH VIL VIH VIL VIL Asserted DIN Read VIH VIL VIL VIH VIL Active DOUT Output Disable VIH VIL VIH VIH X Asserted High-Z Standby VIH VIH X X X High-Z High-Z NOTES: 1. X = Don’t Care (VIL or VIH). 2. RST# must be at VSS ± 0.2 V to meet the maximum specified power-down current. 3. Refer to the Table 6, “Bus Cycle Definitions” on page 23 for valid DIN during a write operation. 4. WAIT is only valid during synchronous array read operations.

Intel® Wireless Flash Memory (W18) Datasheet Access to the modes listed above is independent of VPP. An appropriate CUI command places the device in a read mode. At initial power-up or after reset, the device defaults to asynchronous read- array mode. Asserting CE# enables device read operations. The device internally decodes upper address inputs to determine which partition is accessed. Asserting ADV# opens the internal address latches. Asserting OE# activates the outputs and gates selected data onto the I/O bus. In asynchronous mode, the address is latched when ADV# is deasserted (when the device is configured to use ADV#). In synchronous mode, the address is latched by either the rising edge of ADV# or the rising (or falling) CLK edge while ADV# remains asserted, whichever occurs first. WE# and RST# must be at deasserted during read operations. Note: If only asynchronous reads are to be performed in your system, CLK should be tied to a valid VIH level, WAIT signal can be floated and ADV# must be tied to ground. 3.1.2 Burst Suspend The Burst Suspend feature allows the system to temporarily suspend a synchronous burst operation if the system needs to use the flash address and data bus for other purposes. Burst accesses can be suspended during the initial latency (before data is received) or after the device has output data. When a burst access is suspended, internal array sensing continues and any previously latched internal data is retained. Burst Suspend occurs when CE# is asserted, the current address has been latched (either ADV# rising edge or valid CLK edge), CLK is halted, and OE# is deasserted. CLK can be halted when it is at VIH or VIL. To resume the burst access, OE# is reasserted and CLK is restarted. Subsequent CLK edges resume the burst sequence where it left off. Within the device, CE# gates WAIT. Therefore, during Burst Suspend WAIT remains asserted and does not revert to a high-impedance state when OE# is deasserted. This can cause contention with another device attempting to control the system’s READY signal during a Burst Suspend. System using the Burst Suspend feature should not connect the device’s WAIT signal directly to the system’s READY signal. Refer to Figure 27, “Burst Suspend” on page 73. 3.1.3 Standby De-asserting CE# deselects the device and places it in standby mode, substantially reducing device power consumption. In standby mode, outputs are placed in a high-impedance state independent of OE#. If deselected during a program or erase algorithm, the device shall consume active power until the program or erase operation completes. 3.1.4 Reset The device enters a reset mode when RST# is asserted. In reset mode, internal circuitry is turned off and outputs are placed in a high-impedance state. After returning from reset, a time tPHQV is required until outputs are valid, and a delay (tPHWV) is required before a write sequence can be initiated. After this wake-up interval, normal operation is restored. The device defaults to read-array mode, the status register is set to 80h, and the configuration register defaults to asynchronous page-mode reads.

Intel® Wireless Flash Memory (W18) Datasheet If RST# is asserted during an erase or program operation, the operation aborts and the memory contents at the aborted block or address are invalid. See Figure 33, “Reset Operations Waveforms” on page 80 for detailed information regarding reset timings. Like any automated device, it is important to assert RST# during system reset. When the system comes out of reset, the processor expects to read from the flash memory array. Automated flash memories provide status information when read during program or erase operations. If a CPU reset occurs with no flash memory reset, proper CPU initialization may not occur because the flash memory may be providing status information instead of array data. 1.8 Volt Intel Flash memories allow proper CPU initialization following a system reset through the use of the RST# input. In this application, RST# is controlled by the same CPU reset signal, RESET#. 3.1.5 Write A write occurs when CE# and WE# are asserted and OE# is deasserted. Flash control commands are written to the CUI using standard microprocessor write timings. Proper use of the ADV# input is needed for proper latching of the addresses. Refer to Section 11.3, “AC Write Characteristics” on page 74 for details. The address and data are latched on the rising edge of WE#. Write operations are asynchronous; CLK is ignored (but still may be kept active/toggling). The CUI does not occupy an addressable memory location within any partition. The system processor must access it at the correct address range depending on the kind of command executed. Programming or erasing may occur in only one partition at a time. Other partitions must be in one of the read modes or erase suspend mode. Table 5, “Command Codes and Descriptions” on page 21 shows the available commands. Appendix A, “Write State Machine States” on page 83 provides information on moving between different operating modes using CUI commands. 3.2 Device Commands The device’s on-chip WSM manages erase and program algorithms. This local CPU (WSM) controls the device’s in-system read, program, and erase operations. Bus cycles to or from the flash memory conform to standard microprocessor bus cycles. RST#, CE#, OE#, WE#, and ADV# control signals dictate data flow into and out of the device. WAIT informs the CPU of valid data during burst reads. Table 4, “Bus Operations” on page 18 summarizes bus operations. Device operations are selected by writing specific commands into the device’s CUI. Table 5, “Command Codes and Descriptions” on page 21 lists all possible command codes and descriptions. Table 6, “Bus Cycle Definitions” on page 23 lists command definitions. Because commands are partition-specific, it is important to issue write commands within the target address range.

Intel® Wireless Flash Memory (W18) Datasheet Table 5. Command Codes and Descriptions (Sheet 1 of 2) Operation Code Device Command

Description

Places selected partition in read-array mode. 70h Read Status Register Places selected partition in status register read mode. The partition enters this mode after a Program or Erase command is issued to it. 90h Read Identifier Puts the selected partition in read identifier mode. Device reads from partition addresses output manufacturer/device codes, configuration register data, block lock status, or protection register data on D[15:0]. 98h Read Query Puts the addressed partition in read query mode. Device reads from the partition addresses output CFI information on D[7:0]. 50h Clear Status Register The WSM can set the status register’s block lock (SR[1]), VPP (SR[3]), program (SR[4]), and erase (SR[5]) status bits, but it cannot clear them. SR[5:3,1] can only be cleared by a device reset or through the Clear Status Register command. Program 40h Word Program Setup This preferred program command’s first cycle prepares the CUI for a program operation. The second cycle latches address and data, and executes the WSM program algorithm at this location. Status register updates occur when CE# or OE# is toggled. A Read Array command is required to read array data after programming. 10h Alternate Setup Equivalent to a Program Setup command (40h). 30h EFP Setup This program command activates EFP mode. The first write cycle sets up the command. If the second cycle is an EFP Confirm command (D0h), subsequent writes provide program data. All other commands are ignored after EFP mode begins. D0h EFP Confirm If the first command was EFP Setup (30h), the CUI latches the address and data, and prepares the device for EFP mode. Erase 20h Erase Setup This command prepares the CUI for Block Erase. The device erases the block addressed by the Erase Confirm command. If the next command is not Erase Confirm, the CUI sets status register bits SR[5:4] to indicate command sequence error and places the partition in the read status register mode. D0h Erase Confirm If the first command was Erase Setup (20h), the CUI latches address and data, and erases the block indicated by the erase confirm cycle address. During program or erase, the partition responds only to Read Status Register, Program Suspend, and Erase Suspend commands. CE# or OE# toggle updates status register data. Suspend B0h Program Suspend or Erase Suspend This command, issued at any device address, suspends the currently executing program or erase operation. Status register data indicates the operation was successfully suspended if SR[2] (program suspend) or SR[6] (erase suspend) and SR[7] are set. The WSM remains in the suspended state regardless of control signal states (except RST#). D0h Suspend Resume This command, issued at any device address, resumes the suspended program or erase operation. Block Locking 60h Lock Setup This command prepares the CUI lock configuration. If the next command is not Lock Block, Unlock Block, or Lock-Down, the CUI sets SR[5:4] to indicate command sequence error. 01h Lock Block If the previous command was Lock Setup (60h), the CUI locks the addressed block. D0h Unlock Block If the previous command was Lock Setup (60h), the CUI latches the address and unlocks the addressed block. If previously locked-down, the operation has no effect. 2Fh Lock-Down If the previous command was Lock Setup (60h), the CUI latches the address and locks-down the addressed block.

Intel® Wireless Flash Memory (W18) Datasheet Protection C0h Protection Program Setup This command prepares the CUI for a protection register program operation. The second cycle latches address and data, and starts the WSM’s protection register program or lock algorithm. Toggling CE# or OE# updates the flash status register data. To read array data after programming, issue a Read Array command. Configuration 60h Configuration Setup This command prepares the CUI for device configuration. If Set Configuration Register is not the next command, the CUI sets SR[5:4] to indicate command sequence error. 03h Set Configuration Register If the previous command was Configuration Setup (60h), the CUI latches the address and writes the data from A[15:0] into the configuration register. Subsequent read operations access array data. NOTE: Do not use unassigned commands. Intel reserves the right to redefine these codes for future functions. Table 5. Command Codes and Descriptions (Sheet 2 of 2) Operation Code Device Command

Intel® Wireless Flash Memory (W18) Datasheet Table 6. Bus Cycle Definitions Operation Command Bus Cycles First Bus Cycle Second Bus Cycle Oper Addr1 Data2,3 Oper Addr1 Data2,3 Read Read Array/Reset Write PnA FFh Read Read Address Array Data Read Identifier Write PnA 90h Read PBA+IA IC Read Query Write PnA 98h Read PBA+QA QD Read Status Register Write PnA 70h Read PnA SRD Clear Status Register Write XX 50h Program and Erase Block Erase Write BA 20h Write BA D0h Word Program Write WA 40h/10h Write WA WD EFP Write WA 30h Write WA D0h Program/Erase Suspend Write XX B0h Program/Erase Resume Write XX D0h Lock Lock Block Write BA 60h Write BA 01h Unlock Block Write BA 60h Write BA D0h Lock-Down Block Write BA 60h Write BA 2Fh Protection Protection Program Write PA C0h Write PA PD Lock Protection Program Write LPA C0h Write LPA FFFDh Configuration Set Configuration Register Write CD 60h Write CD 03h NOTES: 1. First-cycle command addresses should be the same as the operation’s target address. Examples: the first-cycle address for the Read Identifier command should be the same as the Identification code address (IA); the first-cycle address for the Word Program command should be the same as the word address (WA) to be programmed; the first-cycle address for the Erase/ Program Suspend command should be the same as the address within the block to be suspended; etc. XX = Any valid address within the device. IA = Identification code address. BA = Block Address. Any address within a specific block. LPA = Lock Protection Address is obtained from the CFI (through the Read Query command). The 1.8 Volt Intel Wireless Flash memory family’s LPA is at 0080h. PA = User programmable 4-word protection address. PnA = Any address within a specific partition. PBA = Partition Base Address. The very first address of a particular partition. QA = Query code address. WA = Word address of memory location to be written. 2. SRD = Status register data. WD = Data to be written at location WA. IC = Identifier code data. PD = User programmable 4-word protection data. QD = Query code data on D[7:0]. CD = Configuration register code data presented on device addresses A[15:0]. A[MAX:16] address bits can select any partition. See Table 13, “Configuration Register Definitions” on page 47 for configuration register bits descriptions. 3. Commands other than those shown above are reserved by Intel for future device implementations and should not be used.

Intel® Wireless Flash Memory (W18) Datasheet 4.0 Read Operations 4.1 Read Array The Read Array command places (or resets) the partition in read-array mode and is used to read data from the flash memory array. Upon initial device power-up, or after reset (RST# transitions from VIL to VIH), all partitions default to asynchronous read-array mode. To read array data from the flash device, first write the Read Array command (FFh) to the CUI and specify the desired word address. Then read from that address. If a partition is already in read-array mode, issuing the Read Array command is not required to read from that partition. If the Read Array command is written to a partition that is erasing or programming, the device presents invalid data on the bus until the program or erase operation completes. After the program or erase finishes in that partition, valid array data can then be read. If an Erase Suspend or Program Suspend command suspends the WSM, a subsequent Read Array command places the addressed partition in read-array mode. The Read Array command functions independently of VPP. 4.2 Read Device ID The read identifier mode outputs the manufacturer/device identifier, block lock status, protection register codes, and configuration register data. The identifier information is contained within a separate memory space on the device and can be accessed along the 4-Mbit partition address range supplied by the Read Identifier command (90h) address. Reads from addresses in Table 7 retrieve ID information. Issuing a Read Identifier command to a partition that is programming or erasing places that partition’s outputs in read ID mode while the partition continues to program or erase in the background. Table 7. Device Identification Codes (Sheet 1 of 2) Item Address1 Data Block Lock Status(2) Block 02h D0 = 0 Block is unlocked D0 = 1 Block is locked Block Lock-Down Status(2) Block 02h D1 = 0 Block is not locked-down D1 = 1 Block is locked down Configuration Register Partition 05h Register Data

Intel® Wireless Flash Memory (W18) Datasheet 4.3 Read Query (CFI) This device contains a separate CFI query database that acts as an “on-chip datasheet.” The CFI information within this device can be accessed by issuing the Read Query command and supplying a specific address. The address is constructed from the base address of a partition plus a particular offset corresponding to the desired CFI field. Appendix B, “Common Flash Interface” on page 86 shows accessible CFI fields and their address offsets. Issuing the Read Query command to a partition that is programming or erasing puts that partition in read query mode while the partition continues to program or erase in the background. 4.4 Read Status Register The device’s status register displays program and erase operation status. A partition’s status can be read after writing the Read Status Register command to any location within the partition’s address range. Read-status mode is the default read mode following a Program, Erase, or Lock Block command sequence. Subsequent single reads from that partition will return its status until another valid command is written. The read-status mode supports single synchronous and single asynchronous reads only; it doesn’t support burst reads. The first falling edge of OE# or CE# latches and updates status register data. The operation doesn’t affect other partitions’ modes. Because the status register is 8 bits wide, only DQ [7:0] contains valid status register data; DQ [15:8] contains zeros. See Table 8, “Status Register Definitions” on page 27 and Table 9, “Status Register Descriptions” on page 27. Each 4-Mbit partition contains its own status register. Bits SR[6:0] are unique to each partition, but SR[7], the Device WSM Status (DWS) bit, pertains to the entire device. SR[7] provides program and erase status of the entire device. By contrast, the Partition WSM Status (PWS) bit, SR[0], provides program and erase status of the addressed partition only. Status register bits SR[6:1] present information about partition-specific program, erase, suspend, VPP, and block-lock states. Table 10, “Status Register Device WSM and Partition Write Status Description” on page 27 presents descriptions of DWS (SR[7]) and PWS (SR[0]) combinations. Protection Register Lock Status Partition 80h Lock Data Protection Register Partition 81h - 88h Register Data Multiple reads required to read the entire 128-bit Protection Register. NOTES: 1. The address is constructed from a base address plus an offset. For example, to read the Block Lock Status for block number 38 in a BPD, set the address to the BBA (0F8000h) plus the offset (02h), i.e. 0F8002h. Then examine bit 0 of the data to determine if the block is locked. 2. See Section 7.1.4, “Block Lock Status” on page 41 for valid lock status. Table 7. Device Identification Codes (Sheet 2 of 2) Item Address1 Data

Intel® Wireless Flash Memory (W18) Datasheet Table 8. Status Register Definitions DWS ESS ES PS VPPS PSS DPS PWS Table 9. Status Register Descriptions Bit Name State 0 = Device WSM is Busy 1 = Device WSM is Ready SR[7] indicates erase or program completion in the device. SR[6:1] are invalid while SR[7] = 0. See Table 10 for valid SR[7] and SR[0] combinations. ESS Erase Suspend Status 0 = Erase in progress/completed 1 = Erase suspended After issuing an Erase Suspend command, the WSM halts and sets SR[7] and SR[6]. SR[6] remains set until the device receives an Erase Resume command. ES Erase Status 0 = Erase successful 1 = Erase error SR[5] is set if an attempted erase failed. A Command Sequence Error is indicated when SR[7,5:4] are set. PS Program Status 0 = Program successful 1 = Program error SR[4] is set if the WSM failed to program a word. VPPS VPP Status 0 = VPP OK 1 = VPP low detect, operation aborted The WSM indicates the VPP level after program or erase completes. SR[3] does not provide continuous VPP feedback and isn’t guaranteed when VPP ≠VPP1/2. PSS Program Suspend Status 0 = Program in progress/completed 1 = Program suspended After receiving a Program Suspend command, the WSM halts execution and sets SR[7] and SR[2]. They remain set until a Resume command is received. DPS Device Protect Status 0 = Unlocked 1 = Aborted erase/program attempt on locked block If an erase or program operation is attempted to a locked block (if WP# = VIL), the WSM sets SR[1] and aborts the operation. PWS Partition Write Status 0 = This partition is busy, but only if SR[7]=0 1 = Another partition is busy, but only if SR[7]=0 Addressed partition is erasing or programming. In EFP mode, SR[0] indicates that a data-stream word has finished programming or verifying depending on the particular EFP phase. See Table 10 for valid SR[7] and SR[0] combinations. Table 10. Status Register Device WSM and Partition Write Status Description The addressed partition is performing a program/erase operation. EFP: device has finished programming or verifying data, or is ready for data. A partition other than the one currently addressed is performing a program/erase operation. EFP: the device is either programming or verifying data. No program/erase operation is in progress in any partition. Erase and Program suspend bits (SR[6,2]) indicate whether other partitions are suspended. EFP: the device has exited EFP mode. Won’t occur in standard program or erase modes. EFP: this combination does not occur.

Intel® Wireless Flash Memory (W18) Datasheet 4.5 Clear Status Register The Clear Status Register command clears the status register and leaves all partition output states unchanged. The WSM can set all status register bits and clear bits SR[7:6,2,0]. Because bits SR[5,4,3,1] indicate various error conditions, they can only be cleared by the Clear Status Register command. By allowing system software to reset these bits, several operations (such as cumulatively programming several addresses or erasing multiple blocks in sequence) can be performed before reading the status register to determine error occurrence. If an error is detected, the Status Register must be cleared before beginning another command or sequence. Device reset (RST# = VIL) also clears the status register. This command functions independently of VPP. 5.0 Program Operations 5.1 Word Program When the Word Program command is issued, the WSM executes a sequence of internally timed events to program a word at the desired address and verify that the bits are sufficiently programmed. Programming the flash array changes specifically addressed bits to 0; 1 bits do not change the memory cell contents. Programming can occur in only one partition at a time. All other partitions must be in either a read mode or erase suspend mode. Only one partition can be in erase suspend mode at a time. The status register can be examined for program progress by reading any address within the partition that is busy programming. However, while most status register bits are partition-specific, the Device WSM Status bit, SR[7], is device-specific; that is, if the status register is read from any other partition, SR[7] indicates program status of the entire device. This permits the system CPU to monitor program progress while reading the status of other partitions. CE# or OE# toggle (during polling) updates the status register. Several commands can be issued to a partition that is programming: Read Status Register, Program Suspend, Read Identifier, and Read Query. The Read Array command can also be issued, but the read data is indeterminate. After programming completes, three status register bits can signify various possible error conditions. SR[4] indicates a program failure if set. If SR[3] is set, the WSM couldn’t execute the Word Program command because VPP was outside acceptable limits. If SR[1] is set, the program was aborted because the WSM attempted to program a locked block. After the status register data is examined, clear it with the Clear Status Register command before a new command is issued. The partition remains in status register mode until another command is written to that partition. Any command can be issued after the status register indicates program completion. If CE# is deasserted while the device is programming, the devices will not enter standby mode until the program operation completes.

on page 45 shows examples of flash power supply usage in various configurations. Figure 6. Word Program Flowchart Only the Clear Staus Register command clears SR[4:3,1]. attempting a program retry or other error recovery. Repeat for subsequent programming operations. after a sequence of program operations.

Intel® Wireless Flash Memory (W18) Datasheet The 12-V VPP mode enhances programming performance during the short time period typically found in manufacturing processes; however, it is not intended for extended use.12 V may be applied to VPP during program and erase operations as specified in Section 10.2, “Operating Conditions” on page 57. VPP may be connected to 12 V for a total of tPPH hours maximum. Stressing the device beyond these limits may cause permanent damage. 5.3 Enhanced Factory Program (EFP) EFP substantially improves device programming performance through a number of enhancements to the conventional 12 Volt word program algorithm. EFP's more efficient WSM algorithm eliminates the traditional overhead delays of the conventional word program mode in both the host programming system and the flash device. Changes to the conventional word programming flowchart and internal WSM routine were developed because of today's beat-rate-sensitive manufacturing environments; a balance between programming speed and cycling performance was attained. The host programmer writes data to the device and checks the Status Register to determine when the data has completed programming. This modification essentially cuts write bus cycles in half. Following each internal program pulse, the WSM increments the device's address to the next physical location. Now, programming equipment can sequentially stream program data throughout an entire block without having to setup and present each new address. In combination, these enhancements reduce much of the host programmer overhead, enabling more of a data streaming approach to device programming. EFP further speeds up programming by performing internal code verification. With this, PROM programmers can rely on the device to verify that it has been programmed properly. From the device side, EFP streamlines internal overhead by eliminating the delays previously associated to switch voltages between programming and verify levels at each memory-word location. EFP consists of four phases: setup, program, verify and exit. Refer to Figure 7, “Enhanced Factory Program Flowchart” on page 33 for a detailed graphical representation of how to implement EFP. 5.3.1 EFP Requirements and Considerations EFP Requirements Ambient temperature: TA = 25 °C ±5 °C VCC within specified operating range VPP within specified VPP2 range Target block unlocked EFP Considerations Block cycling below 100 erase cycles 1 RWW not supported2 EFP programs one block at a time EFP cannot be suspended NOTES: 1. Recommended for optimum performance. Some degradation in performance may occur if this limit is exceeded, but the internal algorithm will continue to work properly. 2. Code or data cannot be read from another partition during EFP.

Intel® Wireless Flash Memory (W18) Datasheet 5.3.2 Setup After receiving the EFP Setup (30h) and EFP Confirm (D0h) command sequence, SR[7] transitions from a 1 to a 0 indicating that the WSM is busy with EFP algorithm startup. A delay before checking SR[7] is required to allow the WSM time to perform all of its setups and checks (VPP level and block lock status). If an error is detected, status register bits SR[4], SR[3], and/or SR[1] are set and EFP operation terminates. Note: After the EFP Setup and Confirm command sequence, reads from the device automatically output status register data. Do not issue the Read Status Register command; it will be interpreted as data to program at WA0. 5.3.3 Program After setup completion, the host programming system must check SR[0] to determine “data-stream ready" status (SR[0]=0). Each subsequent write after this is a program-data write to the flash array. Each cell within the memory word to be programmed to 0 receives one WSM pulse; additional pulses, if required, occur in the verify phase. SR[0]=1 indicates that the WSM is busy applying the program pulse. The host programmer must poll the device's status register for the "program done" state after each data-stream write. SR[0]=0 indicates that the appropriate cell(s) within the accessed memory location have received their single WSM program pulse, and that the device is now ready for the next word. Although the host may check full status for errors at any time, it is only necessary on a block basis, after EFP exit. Addresses must remain within the target block. Supplying an address outside the target block immediately terminates the program phase; the WSM then enters the EFP verify phase. The address can either hold constant or it can increment. The device compares the incoming address to that stored from the setup phase (WA0); if they match, the WSM programs the new data word at the next sequential memory location. If they differ, the WSM jumps to the new address location. The program phase concludes when the host programming system writes to a different block address, and data supplied must be FFFFh. Upon program phase completion, the device enters the EFP verify phase. 5.3.4 Verify A high percentage of the flash bits program on the first WSM pulse. However, for those cells that do not completely program on their first attempt, EFP internal verification identifies them and applies additional pulses as required. The verify phase is identical in flow to the program phase, except that instead of programming incoming data, the WSM compares the verify-stream data to that which was previously programmed into the block. If the data compares correctly, the host programmer proceeds to the next word. If not, the host waits while the WSM applies an additional pulse(s). The host programmer must reset its initial verify-word address to the same starting location supplied during the program phase. It then reissues each data word in the same order as during the program phase. Like programming, the host may write each subsequent data word to WA0 or it may increment up through the block addresses.

Intel® Wireless Flash Memory (W18) Datasheet The verification phase concludes when the interfacing programmer writes to a different block address; data supplied must be FFFFh. Upon completion of the verify phase, the device enters the EFP exit phase. 5.3.5 Exit SR[7]=1 indicates that the device has returned to normal operating conditions. A full status check should be performed at this time to ensure the entire block programmed successfully. After EFP exit, any valid CUI command can be issued.

Figure 7. Enhanced Factory Program Flowchart

1. WA0 = first Word Address to be programmed within the target block. The BBA (Block Base

terminates the EFP program phase, and instructs the device to enter the EFP verify phase.

1. For proper verification to occur, the verify data stream must be presented to the device in the

terminates the EFP verify phase, and instructs the device to exit EFP .

1. Bits that did not fully program with the single WSM pulse of the EFP program phase receive

EFP has been exited for that block, and will indicate any error within the entire data stream. Repeat for subsequent operations. determine if any program error occurred.

Intel® Wireless Flash Memory (W18) Datasheet 6.0 Program and Erase Operations 6.1 Program/Erase Suspend and Resume The Program Suspend and Erase Suspend commands halt an in-progress program or erase operation. The command can be issued at any device address. The partition corresponding to the command’s address remains in its previous state. A suspend command allows data to be accessed from memory locations other than the one being programmed or the block being erased. A program operation can be suspended only to perform a read operation. An erase operation can be suspended to perform either a program or a read operation within any block, except the block that is erase suspended. A program command nested within a suspended erase can subsequently be suspended to read yet another location. Once a program or erase process starts, the Suspend command requests that the WSM suspend the program or erase sequence at predetermined points in the algorithm. The partition that is actually suspended continues to output status register data after the Suspend command is written. An operation is suspended when status bits SR[7] and SR[6] and/or SR[2] are set. To read data from blocks within the partition (other than an erase-suspended block), you can write a Read Array command. Block erase cannot resume until the program operations initiated during erase suspend are complete. Read Array, Read Status Register, Read Identifier (ID), Read Query, and Program Resume are valid commands during Program or Erase Suspend. Additionally, Clear Status Register, Program, Program Suspend, Erase Resume, Lock Block, Unlock Block, and Lock- Down Block are valid commands during erase suspend. To read data from a block in a partition that is not programming or erasing, the operation does not need to be suspended. If the other partition is already in read array, ID, or Query mode, issuing a valid address returns corresponding data. If the other partition is not in a read mode, one of the read commands must be issued to the partition before data can be read. During a suspend, CE# = VIH places the device in standby state, which reduces active current. VPP must remain at its program level and WP# must remain unchanged while in suspend mode. A resume command instructs the WSM to continue programming or erasing and clears status register bits SR[2] (or SR[6]) and SR[7]. The Resume command can be written to any partition. When read at the partition that is programming or erasing, the device outputs data corresponding to the partition’s last mode. If status register error bits are set, the status register can be cleared before issuing the next instruction. RST# must remain at VIH. See Figure 8, “Program Suspend / Resume Flowchart” on page 35, and Figure 9, “Erase Suspend / Resume Flowchart” on page 36. If a suspended partition was placed in read array, read status register, read identifier (ID), or read query mode during the suspend, the device remains in that mode and outputs data corresponding to that mode after the program or erase operation is resumed. After resuming a suspended operation, issue the read command appropriate to the read operation. To read status after resuming a suspended operation, issue a Read Status Register command (70h) to return the suspended partition to status mode.

Figure 8. Program Suspend / Resume Flowchart

Figure 9. Erase Suspend / Resume Flowchart

Intel® Wireless Flash Memory (W18) Datasheet After writing the Erase Confirm command, the selected partition is placed in read status register mode and reads performed to that partition return the current status data. The address given during the Erase Confirm command does not need to be the same address used in the Erase Setup command. So, if the Erase Confirm command is given to partition B, then the selected block in partition B will be erased even if the Erase Setup command was to partition A. The 2-cycle erase sequence cannot be interrupted with a bus write operation. For example, an Erase Setup command must be immediately followed by the Erase Confirm command in order to execute properly. If a different command is issued between the setup and confirm commands, the partition is placed in read-status mode, the status register signals a command sequence error, and all subsequent erase commands to that partition are ignored until the status register is cleared. The CPU can detect block erase completion by analyzing SR[7] of that partition. If an error bit (SR[5,3,1]) was flagged, the status register can be cleared by issuing the Clear Status Register command before attempting the next operation. The partition remains in read-status mode until another command is written to its CUI. Any CUI instruction can follow after erasing completes. The CUI can be set to read-array mode to prevent inadvertent status register reads.

one partition while programing or erasing in another partition; hence the terms, RWW and RWE. Both of these features greatly enhance data storage performance. Figure 10. Block Erase Flowchart Only the Clear Status Register command clears SR[5:3,1]. attempting an erase retry or other error recovery. Repeat for subsequent block erasures. or after a sequence of block erasures.

Intel® Wireless Flash Memory (W18) Datasheet The product does not support simultaneous program and erase operations. Attempting to perform operations such as these results in a command sequence error. Only one partition can be programming or erasing while another partition is reading. However, one partition may be in erase suspend mode while a second partition is performing a program operation, and yet another partition is executing a read command. Table 5, “Command Codes and Descriptions” on page 21 describes the command codes available for all functions. 7.0 Security Modes The 1.8 Volt Intel Wireless Flash memory offers both hardware and software security features to protect the flash data. The software security feature is used by executing the Lock Block command. The hardware security feature is used by executing the Lock-Down Block command and by asserting the WP# signal. Refer to Figure 11, “Block Locking State Diagram” on page 40 for a state diagram of the flash security features. Also see Figure 12, “Locking Operations Flowchart” on page 42. 7.1 Block Lock Operations Individual instant block locking protects code and data by allowing any block to be locked or unlocked with no latency. This locking scheme offers two levels of protection. The first allows software-only control of block locking (useful for frequently changed data blocks), while the second requires hardware interaction before locking can be changed (protects infrequently changed code blocks). The following sections discuss the locking system operation. The term “state [abc]” specifies locking states; for example, “state [001],” where a = WP# value, b = block lock-down status bit D1, and c = Block Lock status register bit D0. Figure 11, “Block Locking State Diagram” on page 40 defines possible locking states. The following summarizes the locking functionality.

• All blocks power-up in a locked state.
• Unlock commands can unlock these blocks, and lock commands can lock them again.
• The Lock-Down command locks a block and prevents it from being unlocked when WP# is asserted. — Locked-down blocks can be unlocked or locked with commands as long as WP# is deasserted — The lock-down status bit is cleared only when the device is reset or powered-down. Block lock registers are not affected by the VPP level. They may be modified and read even if VPP ≤VPPLK. Each block’s locking status can be set to locked, unlocked, and lock-down, as described in the following sections. See Figure 12, “Locking Operations Flowchart” on page 42.

error in SR[1]. Unlocked blocks can be locked by using the Lock Block command sequence. Figure 11. Block Locking State Diagram

1. [a,b,c] represents [WP#, D1, D0]. X = Don’t Care.
2. D1 indicates block Lock-down status. D1 = ‘0’, Lock-down has not been issued to

this block. D1 = ‘1’, Lock-down has been issued to this block.

1. D0 indicates block lock status. D0 = ‘0’, block is unlocked. D0 = ‘1’, block is locked.
2. Locked-down = Hardware + Software locked.
3. [011] states should be tracked by system software to determine difference between

Hardware Locked and Locked-Down states.

be unlocked by the Unlock Block command. bit cannot be cleared by software–only by device reset or power-down. See Table 11. when another block requires immediate updating. program operations, resume the erase operation with the Erase Resume command (D0h). bits change immediately. When the erase operation is resumed, it will complete normally. States” on page 83 shows valid commands during erase suspend. ambiguity into status register results. Table 11. Write Protection Truth Table

commands can then unlock the block (for erase or program operations) and subsequently re-lock it. Only device reset or power-down can clear the lock-down status bit and render WP# ineffective. value can match the flash component to the system’s CPU or ASIC to prevent device substitution. program. Once programmed, the customer segment can be locked to prevent further programming. Figure 12. Locking Operations Flowchart Confirm locking change on DQ[1:0].

Intel® Wireless Flash Memory (W18) Datasheet Note: The individual bits of the user segment of the protection register are OTP, not the register in total. The user may program each OTP bit individually, one at a time, if desired. After the protection register is locked, however, the entire user segment is locked and no more user bits can be programmed. The protection register shares some of the same internal flash resources as the parameter partition. Therefore, RWW is only allowed between the protection register and main partitions. Table 12 describes the operations allowed in the protection register, parameter partition, and main partition during RWW and RWE. 7.2.1 Reading the Protection Register Writing the Read Identifier command allows the protection register data to be read 16 bits at a time from addresses shown in Table 7, “Device Identification Codes” on page 25. The protection register is read from the Read Identifier command and can be read in any partition.Writing the Read Array command returns the device to read-array mode. 7.2.2 Programing the Protection Register The Protection Program command should be issued only at the parameter (top or bottom) partition followed by the data to be programmed at the specified location. It programs the upper 64 bits of the protection register 16 bits at a time. Table 7, “Device Identification Codes” on page 25 shows allowable addresses. See also Figure 13, “Protection Register Programming Flowchart” on page 44. Issuing a Protection Program command outside the register’s address space results in a status register error (SR[4]=1). Table 12. Simultaneous Operations Allowed with the Protection Register While programming or erasing in a main partition, the protection register can be read from any other partition. Reading the parameter partition data is not allowed if the protection register is being read from addresses within the parameter partition. See While programming or erasing in a main partition, read operations are allowed in the parameter partition. Accessing the protection registers from parameter partition addresses is not allowed. Read Read Write/Erase While programming or erasing in a main partition, read operations are allowed in the parameter partition. Accessing the protection registers in a partition that is different from the one being programmed or erased, and also different from the parameter partition, is allowed. Write No Access Allowed Read While programming the protection register, reads are only allowed in the other main partitions. Access to the parameter partition is not allowed. This is because programming of the protection register can only occur in the parameter partition, so it will exist in status mode. No Access Allowed Write/Erase Read While programming or erasing the parameter partition, reads of the protection registers are not allowed in any partition. Reads in other main partitions are supported.

NOTE: If the VCC supply can sink adequate current, you can use an appropriately valued resistor. Figure 14. Protection Register Locking Figure 15. Examples of VPP Power Supply Configurations

• 12 V fast programming
• Absolute write protection with VPP ≤VPPLK System supply (Note 1) VCC VPP

12 V supply

• Low voltage and 12 V fast programming System supply
• Low-voltage programming
• Absolute write protection via logic signal System supply Prot# (logic signal)
• Low-voltage programming System supply ≤10K Ω VCC VPP VCC VPP VCC VPP

Intel® Wireless Flash Memory (W18) Datasheet 8.0 Set Configuration Register The Set Configuration Register command sets the burst order, frequency configuration, burst length, and other parameters. A two-bus cycle command sequence initiates this operation. The configuration register data is placed on the lower 16 bits of the address bus (A[15:0]) during both bus cycles. The Set Configuration Register command is written along with the configuration data (on the address bus). This is followed by a second write that confirms the operation and again presents the configuration register data on the address bus. The configuration register data is latched on the rising edge of ADV#, CE#, or WE# (whichever occurs first). This command functions independently of the applied VPP voltage. After executing this command, the device returns to read-array mode. The configuration register’s contents can be examined by writing the Read Identifier command and then reading location 05h. (See Table 13 and Table 14.)

Intel® Wireless Flash Memory (W18) Datasheet Table 13. Configuration Register Definitions Table 14. Configuration Register Descriptions 0 = Synchronous Burst Reads Enabled 1 = Asynchronous Reads Enabled (Default) R Reserved 13-11 LC2-0 First Access Latency Count 001 = Reserved 010 = Code 2 011 = Code 3 100 = Code 4 101 = Code 5 111 = Reserved (Default) WT WAIT Signal Polarity 0 = WAIT signal is asserted low 1 = WAIT signal is asserted high (Default) DOC Data Output Configuration 0 = Hold Data for One Clock 1 = Hold Data for Two Clock (Default) WC WAIT Configuration 0 = WAIT Asserted During Delay 1 = WAIT Asserted One Data Cycle before Delay (Default) BS Burst Sequence 1 = Linear Burst Order (Default) CC Clock Configuration 0 = Burst Starts and Data Output on Falling Clock Edge 1 = Burst Starts and Data Output on Rising Clock Edge (Default) R Reserved R Reserved BW Burst Wrap 0 = Wrap bursts within burst length set by CR[2:0] 1 = Don’t wrap accesses within burst length set by CR[2:0].(Default) 2-0 BL2-0 Burst Length 001 = 4-Word Burst 010 = 8-Word Burst 011 = 16-Word Burst 111 = Continuous Burst (Default) NOTES: 1. Undocumented combinations of bits are reserved by Intel for future implementations. 2. Synchronous and page read mode configurations affect reads from main blocks and parameter blocks. Status register and configuration reads support single read cycles. CR[15]=1 disables configuration set by CR[14:0]. 3. Data is not ready when WAIT is asserted. 4. Set the synchronous burst length. In asynchronous page mode, the page size equals four words. 5. Set all reserved configuration register bits to zero. 6. Setting the configuration register for synchronous burst-mode with a latency count of 2 (RCR[13:11] = 010), data hold for 2 clocks (RCR.9 = 1), and WAIT asserted one data cycle before delay (RCR.8 =1) is not supported.

asynchronous page mode (default). CR[15] sets the read configuration to one of these modes. elapse from ADV# de-assertion (VIH) before the first data word should be driven onto its data pins. NOTE: Other First Access Latency Configuration settings are reserved. The 16-word boundary is the end of the device sense word-line. Figure 16. First Access Latency Configuration Figure 17. Word Boundary

16 Word Boundary

4 Word Boundary

Table 15. Latency Count Settings for VCCQ = 1.35 V - 1.8 V (.13 µm lithography) Table 16. Latency Count Setting for VCCQ = 1.7 V - 2.24 V (.13 µm lithography) Table 17. Latency Count Setting for VCCQ = 1.7 V - 2.24 V (.18 µm lithography)

0 on the WAIT signal indicates that data is not ready and the data bus contains invalid data. data is ready and valid. WAIT is asserted during asynchronous page mode reads. is only “deasserted” when data is valid on the bus. Signal in Synchronous Non-Read Array Operation Waveform” on page 72. about the validity of what is appearing on the data bus. Figure 18. Example: Latency Count Setting at 3

memory’s clock-to-data output delay determine whether one or two clocks are needed. 19, “Data Output Configuration with WAIT Signal Delay” on page 52. A method for determining this configuration setting is shown below. is long, hold for two cycles. Table 18. WAIT Signal Conditions

NOTE: WAIT shown asserted high (CR[10]=1). asserted either during, or one data cycle before, a valid output. sequence. The WAIT signal informs the system of this delay.

• Figure 23, “Single Synchronous Read-Array Operation Waveform” on page 69
• Figure 24, “Synchronous 4-Word Burst Read Operation Waveform” on page 70
• Figure 25, “WAIT Functionality for EOWL (End-of-Word Line) Condition Waveform” on page 71

Figure 19. Data Output Configuration with WAIT Signal Delay

1 CLK

2 CLK

Table 19. Sequence and Burst Length

Intel® Wireless Flash Memory (W18) Datasheet 8.8 Clock Edge (CR[6]) Configuring the valid clock edge enables a flexible memory interface to a wide range of burst CPUs. Clock configuration sets the device to start a burst cycle, output data, and assert WAIT on the clock’s rising or falling edge. 8.9 Burst Wrap (CR[3]) The burst wrap bit determines whether 4-, 8-, or 16-word burst accesses wrap within the burst- length boundary or whether they cross word-length boundaries to perform linear accesses. No- wrap mode (CR[3]=1) enables WAIT to hold off the system processor, as it does in the continuous burst mode, until valid data is available. In no-wrap mode (CR[3]=0), the device operates similarly to continuous linear burst mode but consumes less power during 4-, 8-, or 16-word bursts. For example, if CR[3]=0 (wrap mode) and CR[2:0] = 1h (4-word burst), possible linear burst If CR[3]=1 (no-wrap mode) and CR[2:0] = 1h (4-word burst length), then possible linear burst sequences are 0-1-2-3, 1-2-3-4, 2-3-4-5, and 3-4-5-6. CR[3]=1 not only enables limited non- aligned sequential bursts, but also reduces power by minimizing the number of internal read operations. Setting CR[2:0] bits for continuous linear burst mode (7h) also achieves the above 4-word burst sequences. However, significantly more power may be consumed. The 1-2-3-4 sequence, for example, consumes power during the initial access, again during the internal pipeline lookup as the processor reads word 2, and possibly again, depending on system timing, near the end of the sequence as the device pipelines the next 4-word sequence. CR[3]=1 while in 4-word burst mode (no-wrap mode) reduces this excess power consumption. 8.10 Burst Length (CR[2:0]) The Burst Length bit (BL[2:0]) selects the number of words the device outputs in synchronous read access of the flash memory array. The burst lengths are 4-word, 8-word, 16-word, and continuous word. Continuous-burst accesses are linear only, and do not wrap within any word length boundaries (see Table 19, “Sequence and Burst Length” on page 53). When a burst cycle begins, the device outputs synchronous burst data until it reaches the end of the “burstable” address space.

Intel® Wireless Flash Memory (W18) Datasheet 9.0 Power Consumption

1.8 Volt Intel® Wireless Flash memory devices have a layered approach to power savings that can

significantly reduce overall system power consumption. The APS feature reduces power consumption when the device is selected but idle. If CE# is deasserted, the memory enters its standby mode, where current consumption is even lower. Asserting RST# provides current savings similar to standby mode. The combination of these features can minimize memory power consumption, and therefore, overall system power consumption. 9.1 Active Power With CE# at VIL and RST# at VIH, the device is in the active mode. Refer to Section 10.3, “DC Current Characteristics (.13 µm and .18 µm)” on page 58, for ICC values. When the device is in “active” state, it consumes the most power from the system. Minimizing device active current therefore reduces system power consumption, especially in battery-powered applications. 9.2 Automatic Power Savings (APS) Automatic Power Saving (APS) provides low-power operation during a read’s active state. During APS mode, ICCAPS is the average current measured over any 5 ms time interval 5 µs after the following events happen:

• There is no internal sense activity;
• CE# is asserted;
• The address lines are quiescent, and at VSSQ or VCCQ. OE# may be asserted during APS. 9.3 Standby Power With CE# at VIH and the device in read mode, the flash memory is in standby mode, which disables most device circuitry and substantially reduces power consumption. Outputs are placed in a high- impedance state independent of the OE# signal state. If CE# transitions to VIH during erase or program operations, the device continues the operation and consumes corresponding active power until the operation is complete. ICCS is the average current measured over any 5 ms time interval 5 µs after a CE# de-assertion. 9.4 Power-Up/Down Characteristics The device is protected against accidental block erasure or programming during power transitions. Power supply sequencing is not required if VCC, VCCQ, and VPP are connected together; so it doesn’t matter whether VPP or VCC powers-up first. If VCCQ and/or VPP are not connected to the system supply, then VCC should attain VCCMIN before applying VCCQ and VPP. Device inputs should not be driven before supply voltage = VCCMIN. Power supply transitions should only occur when RST# is low.

Intel® Wireless Flash Memory (W18) Datasheet 9.4.1 System Reset and RST# The use of RST# during system reset is important with automated program/erase devices because the system expects to read from the flash memory when it comes out of reset. If a CPU reset occurs without a flash memory reset, proper CPU initialization will not occur because the flash memory may be providing status information instead of array data. To allow proper CPU/flash initialization at system reset, connect RST# to the system CPU RESET# signal. System designers must guard against spurious writes when VCC voltages are above VLKO. Because both WE# and CE# must be low for a command write, driving either signal to VIH inhibits writes to the device. The CUI architecture provides additional protection because alteration of memory contents can only occur after successful completion of the two-step command sequences. The device is also disabled until RST# is brought to VIH, regardless of its control input states. By holding the device in reset (RST# connected to system PowerGood) during power-up/down, invalid bus conditions during power-up can be masked, providing yet another level of memory protection. 9.4.2 VCC, VPP, and RST# Transitions The CUI latches commands issued by system software and is not altered by VPP or CE# transitions or WSM actions. Read-array mode is its power-up default state after exit from reset mode or after VCC transitions above VLKO (Lockout voltage). After completing program or block erase operations (even after VPP transitions below VPPLK), the Read Array command must reset the CUI to read-array mode if flash memory array access is desired. 9.5 Power Supply Decoupling When the device is accessed, many internal conditions change. Circuits are enabled to charge pumps and switch voltages. This internal activity produces transient noise. To minimize the effect of this transient noise, device decoupling capacitors are required. Transient current magnitudes depend on the device outputs’ capacitive and inductive loading. Two-line control and proper decoupling capacitor selection suppresses these transient voltage peaks. Each flash device should have a 0.1 µF ceramic capacitor connected between each power (VCC, VCCQ, VPP), and ground (VSS, VSSQ) signal. High-frequency, inherently low-inductance capacitors should be as close as possible to package signals.

Stressing the device beyond the “Absolute Maximum Ratings” may cause permanent damage. and extended exposure beyond the “Operating Conditions” may affect device reliability. here is subject to change without notice. Do not finalize a design with this information. Table 20. Absolute Maximum Ratings

1. All specified voltages are relative to VSS. Minimum DC voltage is –0.5 V on input/output pins and

ns which, during transitions, may overshoot to VCC +2.0 V for periods < 20 ns.

1. Maximum DC voltage on VPP may overshoot to +14.0 V for periods < 20 ns.
2. VPP program voltage is normally VPP1. VPP can be 12 V ± 0.6 V for 1000 cycles on the main blocks

and 2500 cycles on the parameter blocks during program/erase.

1. Output shorted for no more than one second. No more than one output shorted at a time.

Table 21. Extended Temperature Operation (Sheet 1 of 2)

1. See Section 10.3 and Section 10.4, “DC Voltage Characteristics” on page 60 for specific voltage-range
2. VPP is normally VPP1. VPP can be connected to 11.4 V–12.6 V for 1000 cycles on main blocks for

extended temperatures and 2500 cycles on parameter blocks at extended temperature.

1. Contact your Intel field representative for VCC/VCCQ operations down to 1.65 V.
2. See the tables in Section 10.0, “Thermal and DC Characteristics” on page 57 and in Section 11.0, “AC

Characteristics” on page 62 for operating characteristics within the Extended-VCCQ voltage range. Table 22. DC Current Characteristics (Sheet 1 of 3) Table 21. Extended Temperature Operation (Sheet 2 of 2)

4 Word Read

Table 22. DC Current Characteristics (Sheet 2 of 3)

1. All currents are RMS unless noted. Typical values at typical VCC, TA = +25°C.
2. Automatic Power Savings (APS) reduces ICCR to approximately standby levels in static operation. See ICCRQ specification
3. Sampled, not 100% tested.
4. VCC read + program current is the sum of VCC read and VCC program currents.
5. VCC read + erase current is the sum of VCC read and VCC erase currents.
6. ICCES is specified with device deselected. If device is read while in erase suspend, current is ICCES plus ICCR.
7. VPP <= VPPLK inhibits erase and program operations. Don’t use VPPL and VPPH outside their valid ranges.
8. VIL can undershoot to –0.4V and VIH can overshoot to VCCQ+0.4V for durations of 20 ns or less.
9. If VIN>VCC the input load current increases to 10 µA max.

10.ICCS is the average current measured over any 5ms time interval 5µs after a CE# de-assertion. 11.Refer to section Section 9.2, “Automatic Power Savings (APS)” on page 55 for ICCAPS measurement details. 12.TBD values are to be determined pending silicon characterization. Table 23. DC Voltage Characteristics (Sheet 1 of 2) Table 22. DC Current Characteristics (Sheet 3 of 3)

NOTE: For all numbered note references in this table, refer to the notes in Table 22, “DC Current Characteristics” on page 58. Table 23. DC Voltage Characteristics (Sheet 2 of 2)

Table 24. Read Operations— .13 µm Lithography (Sheet 1 of 2)

Table 24. Read Operations— .13 µm Lithography (Sheet 2 of 2)

Table 25. Read Operations — .18 µm Lithography (Sheet 1 of 2)

1. See Figure 34, “AC Input/Output Reference Waveform” on page 81 for timing measurements and maximum allowable input
2. AC specifications assume the data bus voltage is less than or equal to VCCQ when a read operation is initiated.
3. Address hold in synchronous-burst mode is defined as tCHAX or tVHAX, whichever timing specification is satisfied first.
4. OE# may be delayed by up to tELQV– tGLQV after the falling edge of CE# without impact to tELQV.
5. Sampled, not 100% tested.
6. Applies only to subsequent synchronous reads.
7. During the initial access of a synchronous burst read, data from the first word may begin to be driven onto the data bus as

early as the first clock edge after tAVQV.

1. All specs above apply to all densities.

Table 25. Read Operations — .18 µm Lithography (Sheet 2 of 2)

1. WAIT shown asserted (CR.10=0)
2. ADV# assumed to be driven to VIL in this waveform

Figure 20. Asynchronous Read Operation Waveform

Figure 21. Latched Asynchronous Read Operation Waveform

NOTE: WAIT shown asserted (CR.10 = 0). Figure 22. Page-Mode Read Operation Waveform

1. Section 8.2, “First Access Latency Count (CR[13:11])” on page 48 describes how to insert clock cycles during
2. WAIT (shown asserted; CR.10=0) can be configured to assert either during, or one data cycle before, valid
3. This waveform illustrates the case in which an x-word burst is initiated to the main array and it is terminated

reads, the asserted (low) WAIT signal would have remained asserted (low) as long as CE# is asserted (low). Figure 23. Single Synchronous Read-Array Operation Waveform

1. Section 8.2, “First Access Latency Count (CR[13:11])” on page 48 describes how to insert clock cycles during
2. WAIT (shown asserted; CR.10 = 0) can be configured to assert either during, or one data cycle before, valid

Figure 24. Synchronous 4-Word Burst Read Operation Waveform

1. Section 8.2, “First Access Latency Count (CR[13:11])” on page 48 describes how to insert clock cycles during
2. WAIT (shown asserted; CR.10=0) can be configured to assert either during, or one data cycle before, valid

Figure 25. WAIT Functionality for EOWL (End-of-Word Line) Condition Waveform

1. Section 8.2, “First Access Latency Count (CR[13:11])” on page 48 describes how to insert clock cycles during
2. WAIT shown asserted (CR.10=0).

Figure 26. WAIT Signal in Synchronous Non-Read Array Operation Waveform

1. During Burst Suspend Clock signal can be held high or low

Figure 27. Burst Suspend

Table 26. AC Write Characteristics – .13 µm Lithography

1. Write timing characteristics during erase suspend are the same as during write-only operations.
2. A write operation can be terminated with either CE# or WE#.
3. Sampled, not 100% tested.
4. Write pulse width low (tWLWH or tELEH) is defined from CE# or WE# low (whichever occurs last) to CE# or WE# high

(whichever occurs first). Hence, tWLWH = tELEH = tWLEH = tELWH.

1. Write pulse width high (tWHWL or tEHEL) is defined from CE# or WE# high (whichever is first) to CE# or WE# low (whichever is

last). Hence, tWHWL = tEHEL = tWHEL = tEHWL.

1. System designers should take this into account and may insert a software No-Op instruction to delay the first read after
2. For commands other than resume commands.
3. VPP should be held at VPP1 or VPP2 until block erase or program success is determined.
4. Applicable during asynchronous reads following a write.

the address latching event (either the rising/falling clock edge or the rising ADV# edge, whichever occurs first).

Table 27. AC Write Characteristics – .18 µm Lithography

1. Write timing characteristics during erase suspend are the same as during write-only operations.
2. A write operation can be terminated with either CE# or WE#.
3. Sampled, not 100% tested.
4. Write pulse width low (tWLWH or tELEH) is defined from CE# or WE# low (whichever occurs last) to CE# or WE#

high (whichever occurs first). Hence, tWLWH = tELEH = tWLEH = tELWH.

1. Write pulse width high (tWHWL or tEHEL) is defined from CE# or WE# high (whichever is first) to CE# or WE# low

(whichever is last). Hence, tWHWL = tEHEL = tWHEL = tEHWL.

1. System designers should take this into account and may insert a software No-Op instruction to delay the first

read after issuing a command.

1. For commands other than resume commands.
2. VPP should be held at VPP1 or VPP2 until block erase or program success is determined.
3. Applicable during asynchronous reads following a write.

1. VCC power-up and standby.
2. Write Program or Erase Setup command.
3. Write valid address and data (for program) or Erase Confirm command.
4. Automated program/erase delay.
5. Read status register data (SRD) to determine program/erase operation completion.
6. OE# and CE# must be asserted and WE# must be deasserted for read operations.
7. CLK is ignored. (but may be kept active/toggling)

Figure 28. Write Operations Waveform

Table 28. Erase and Program Times

1. Unless noted otherwise, all parameters are measured at TA = +25 °C and nominal voltages, and they are sampled, not 100%
2. Excludes external system-level overhead.
3. Exact results may vary based on system overhead.
4. W400-Typ is the calculated delay for a single programming pulse. W400-Max includes the delay when programming within a
5. Some EFP performance degradation may occur if block cycling exceeds 10.

Table 29. Reset Specifications

1. These specifications are valid for all product versions (packages and speeds).
2. The device may reset if tPLPH< tPLPHMin, but this is not guaranteed.
3. Not applicable if RST# is tied to VCC.
4. Sampled, but not 100% tested.
5. If RST# is tied to VCC, the device is not ready until tVCCPH occurs after when VCC ≥VCCMin.
6. If RST# is tied to any supply/signal with VCCQ voltage levels, the RST# input voltage must not exceed VCC until VCC ≥

Figure 33. Reset Operations Waveforms

Intel® Wireless Flash Memory (W18) Datasheet 11.7 Device Capacitance TA = +25 °C, f = 1 MHz Symbol Parameter§ Typ Max Unit Condition CIN Input Capacitance pF VIN = 0.0 V COUT Output Capacitance pF VOUT = 0.0 V CCE CE# Input Capacitance pF VIN = 0.0 V §Sampled, not 100% tested.

can be actively programming or erasing at a time. Figure 37. Write State Machine — Next State Table (Sheet 1 of 2)

1. The output state shows the type of data that appears at the outputs if the partition address is the same as the command

A partition can be placed in Read Array, Read Status or Read ID/CFI, depending on the command issued. not depend on the partition's output state. #4 (without issuing a new command) outputs the Status register. Figure 37. Write State Machine — Next State Table (Sheet 2 of 2)

Intel® Wireless Flash Memory (W18) Datasheet 2. Illegal commands are those not defined in the command set. 3. All partitions default to Read Array mode at power-up. A Read Array command issued to a busy partition results in undermined data when a partition address is read. 4. Both cycles of 2 cycles commands should be issued to the same partition address. If they are issued to different partitions, the second write determines the active partition. Both partitions will output status information when read. 5. If the WSM is active, both cycles of a 2 cycle command are ignored. This differs from previous Intel devices. 6. The Clear Status command clears status register error bits except when the WSM is running (Pgm Busy, Erase Busy, Pgm Busy In Erase Suspend, OTP Busy, EFP modes) or suspended (Erase Suspend, Pgm Suspend, Pgm Suspend In Erase Suspend). 7. EFP writes are allowed only when status register bit SR.0 = 0. EFP is busy if Block Address = address at EFP Confirm command. Any other commands are treated as data. 8. The "current state" is that of the WSM, not the partition. 9. Confirm commands (Lock Block, Unlock Block, Lock-down Block, Configuration Register) perform the operation and then move to the Ready State. 10.In Erase suspend, the only valid two cycle commands are "Program Word", "Lock/Unlock/Lockdown Block", and "CR Write". Both cycles of other two cycle commands ("OEM CAM program & confirm", "Program OTP & confirm", "EFP Setup & confirm", "Erase setup & confirm") will be ignored. In Program suspend or Program suspend in Erase suspend, both cycles of all two cycle commands will be ignored.

multiple command set and control interface descriptions called Common Flash Interface, or CFI. The Query database allows system software to obtain information for controlling the flash device. This section describes the device’s CFI-compliant interface that allows access to Query data. devices, the Query table device starting address is a 10h, which is a word address for x16 devices. bytes. The device outputs ASCII “Q” in the low byte (DQ0-7) and 00h in the high byte (DQ8-15). presented at the lower address, and the most significant data byte is presented at the higher address. shown. Any x16 device outputs can be assumed to have 00h on the upper byte in this mode. Table 31. Summary of Query Structure Output as a Function of Device and Mode Table 32. Example of Query Structure Output of x16- and x8 Devices

Intel® Wireless Flash Memory (W18) Datasheet B.2 Query Structure Overview The Query command causes the flash component to display the Common Flash Interface (CFI) Query structure or “database.” The structure sub-sections and address locations are summarized below. Table 33. Query Structure

1. Refer to the Query Structure Output section and offset 28h for the detailed definition of offset address as a

function of device bus width and mode.

1. BA = Block Address beginning location (i.e., 08000h is block 1’s beginning location when the block size is
2. Offset 15 defines “P” which points to the Primary Intel-specific Extended Query Table.

a given block is locked or can be accessed for flash program/erase operations. accidentally removed during an erase operation. Table 34. Block Status Register

1. BA = Block Address beginning location (i.e., 08000h is block 1’s beginning location when the block size is

Add. Value (BA+2)h(1) Block Lock Status Register BA+2 --00 or --01 BA+2 (bit 0): 0 or 1 BA+2 (bit 1): 0 or 1 BSR 2–7: Reserved for future use BA+2 (bit 2–7): 0 BSR.0 Block lock status 0 = Unlocked 1 = Locked BSR.1 Block lock-down status 0 = Not locked down 1 = Locked down

Intel® Wireless Flash Memory (W18) Datasheet Table 35. CFI Identification Table 36. System Interface Information Add. Hex Code Value 10h Query-unique ASCII string “QRY“ 10: --51 "Q" 11: --52 "R" 12: --59 "Y" 13h Primary vendor command set and control interface ID code. 13: --03 16-bit ID code for vendor-specified algorithms 14: --00 15h Extended Query Table primary algorithm address 15: --39 16: --00 17h Alternate vendor command set and control interface ID code. 17: --00 0000h means no second vendor-specified algorithm exists 18: --00 19h Secondary algorithm Extended Query Table address. 19: --00 0000h means none exists 1A: --00 Offset Length Add. Hex Code Value 1Bh 1B: --17 1.7V 1Ch 1C: --19 1.9V 1Dh 1D: --B4 11.4V 1Eh 1E: --C6 12.6V 1Fh “n” such that typical single word program time-out = 2n µ-sec 1F: --04 16µs 20h “n” such that typical max. buffer write time-out = 2n µ-sec 20: --00 NA 21h “n” such that typical block erase time-out = 2n m-sec 21: --0A 22h “n” such that typical full chip erase time-out = 2n m-sec 22: --00 NA 23h “n” such that maximum word program time-out = 2n times typical 23: --04 256µs 24h “n” such that maximum buffer write time-out = 2n times typical 24: --00 NA 25h “n” such that maximum block erase time-out = 2n times typical 25: --03 26h “n” such that maximum chip erase time-out = 2n times typical 26: --00 NA VCC logic supply minimum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 BCD volts VCC logic supply maximum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 BCD volts VPP [programming] supply minimum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 HEX volts VPP [programming] supply maximum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 HEX volts

Intel® Wireless Flash Memory (W18) Datasheet B.5 Device Geometry Definition Table 37. Device Geometry Definition “n” such that device size = 2 n in number of bytes 27: See table below 28h x64 x32 x16 28: --01 x16 29: --00 2Ah “n” such that maximum number of bytes in write buffer = 2 n 2A: --00 2B: --00 2Ch 2C: 2Dh Erase Block Region 1 Information 2D: bits 0–15 = y, y+1 = number of identical-size erase blocks 2E: bits 16–31 = z, region erase block(s) size are z x 256 bytes 2F: 30: 31h Erase Block Region 2 Information 31: bits 0–15 = y, y+1 = number of identical-size erase blocks 32: bits 16–31 = z, region erase block(s) size are z x 256 bytes 33: 34: 35h Reserved for future erase block region information 35: 36: 37: 38: See table below See table below See table below See table below Number of erase block regions (x) within device: 1. x = 0 means no erase blocking; the device erases in bulk 2. x specifies the number of device regions with one or more contiguous same-size erase blocks. 3. Symmetrically blocked partitions have one blocking region Flash device interface code assignment: "n" such that n+1 specifies the bit field that represents the flash device width capabilities as described in the table: Address 27: --16 --16 --17 --17 --18 --18 28: --01 --01 --01 --01 --01 --01 29: --00 --00 --00 --00 --00 --00 2A: --00 --00 --00 --00 --00 --00 2B: --00 --00 --00 --00 --00 --00 2C: --02 --02 --02 --02 --02 --02 2D: --07 --3E --07 --7E --07 --FE 2E: --00 --00 --00 --00 --00 --00 2F: --20 --00 --20 --00 --20 --00 30: --00 --01 --00 --01 --00 --01 31: --3E --07 --7E --07 --FE --07 32: --00 --00 --00 --00 --00 --00 33: --00 --20 --00 --20 --00 --20 34: --01 --00 --01 --00 --01 --00 35: --00 --00 --00 --00 --00 --00 36: --00 --00 --00 --00 --00 --00 37: --00 --00 --00 --00 --00 --00 38: --00 --00 --00 --00 --00 --00

Intel® Wireless Flash Memory (W18) Datasheet B.6 Intel-Specific Extended Query Table Table 38. Primary Vendor-Specific Extended Query P = 39h (Optional flash features and commands) Add. Code Value (P+0)h Primary extended query table 39: --50 "P" (P+1)h Unique ASCII string “PRI“ 3A: --52 "R" (P+2)h 3B: --49 "I" (P+3)h Major version number, ASCII 3C: --31 "1" (P+4)h Minor version number, ASCII 3D: --33 "3" (P+5)h Optional feature and command support (1=yes, 0=no) 3E: --E6 (P+6)h bits 10–31 are reserved; undefined bits are “0.” If bit 31 is 3F: --03 (P+7)h “1” then another 31 bit field of Optional features follows at 40: --00 (P+8)h the end of the bit–30 field. 41: --00 bit 0 Chip erase supported bit 0 = 0 No bit 1 Suspend erase supported bit 1 = 1 Yes bit 2 Suspend program supported bit 2 = 1 Yes bit 3 Legacy lock/unlock supported bit 3 = 0 No bit 4 Queued erase supported bit 4 = 0 No bit 5 Instant individual block locking supported bit 5 = 1 Yes bit 6 Protection bits supported bit 6 = 1 Yes bit 7 Pagemode read supported bit 7 = 1 Yes bit 8 Synchronous read supported bit 8 = 1 Yes bit 9 Simultaneous operations supported bit 9 = 1 Yes (P+9)h 42: --01 bit 0 Program supported after erase suspend bit 0 = 1 Yes (P+A)h Block status register mask 43: --03 (P+B)h bits 2–15 are Reserved; undefined bits are “0” 44: --00 bit 0 Block Lock-Bit Status register active bit 0 = 1 Yes bit 1 Block Lock-Down Bit Status active bit 1 = 1 Yes (P+C)h 45: --18 1.8V (P+D)h 46: --C0 12.0V Supported functions after suspend: read Array, Status, Query Other supported operations are: bits 1–7 reserved; undefined bits are “0” VCC logic supply highest performance program/erase voltage bits 0–3 BCD value in 100 mV bits 4–7 BCD value in volts VPP optimum program/erase supply voltage bits 0–3 BCD value in 100 mV bits 4–7 HEX value in volts

Intel® Wireless Flash Memory (W18) Datasheet Table 39. Protection Register Information Table 40. Burst Read Information for Non-muxed Device Table 41. Partition and Erase-block Region Information P = 39h (Optional flash features and commands) Add. Code Value (P+E)h 47: --01 (P+F)h Protection Field 1: Protection Description 48: --80 80h (P+10)h This field describes user-available One Time Programmable 49: --00 00h (P+11)h (OTP) Protection register bytes. Some are pre-programmed 4A: --03 8 byte (P+12)h 4B: --03 8 byte Number of Protection register fields in JEDEC ID space. “00h,” indicates that 256 protection fields are available with device-unique serial numbers. Others are user programmable. Bits 0–15 point to the Protection register Lock byte, the section’s first byte. The following bytes are factory pre-programmed and user-programmable. bits 0–7 = Lock/bytes Jedec-plane physical low address bits 8–15 = Lock/bytes Jedec-plane physical high address bits 16–23 = “n” such that 2n = factory pre-programmed bytes bits 24–31 = “n” such that 2n = user programmable bytes Offset(1) Length P = 39h (Optional flash features and commands) Add. Code Value (P+13)h 4C: --03 8 byte (P+14)h 4D: --04 (P+15)h 4E: --01 (P+16)h Synchronous mode read capability configuration 2 4F: --02 (P+17)h Synchronous mode read capability configuration 3 50: --03 (P+18)h Synchronous mode read capability configuration 4 51: --07 Cont Page Mode Read capability bits 0–7 = “n” such that 2n HEX value represents the number of read-page bytes. See offset 28h for device word width to determine page-mode data output width. 00h indicates no read page buffer. Number of synchronous mode read configuration fields that follow. 00h indicates no burst capability. Synchronous mode read capability configuration 1 Bits 3–7 = Reserved bits 0–2 “n” such that 2n+1 HEX value represents the maximum number of continuous synchronous reads when the device is configured for its maximum word width. A value of 07h indicates that the device is capable of continuous linear bursts that will output data until the internal burst counter reaches the end of the device’s burstable address space. This field’s 3-bit value can be written directly to the Read Configuration Register bits 0–2 if the device is configured for its maximum word width. See offset 28h for word width to determine the burst data output width. Offset(1) See table below P = 39h (Optional flash features and commands) Len Bot Top (P+19)h (P+19)h 52: 52: Number of device hardware-partition regions within the device. x = 0: a single hardware partition device (no fields follow). x specifies the number of device partition regions containing one or more contiguous erase block regions.

Intel® Wireless Flash Memory (W18) Datasheet Partition Region 1 Information Offset(1) See table below P = 39h (Optional flash features and commands) Len Bot Top (P+1A)h (P+1A)h Number of identical partitions within the partition region 53: 53: (P+1B)h (P+1B)h 54: 54: (P+1C)h (P+1C)h 55: 55: (P+1D)h (P+1D)h 56: 56: (P+1E)h (P+1E)h 57: 57: (P+1F)h (P+1F)h 58: 58: (P+20)h (P+20)h Partition Region 1 Erase Block Type 1 Information 59: 59: (P+21)h (P+21)h bits 0–15 = y, y+1 = number of identical-size erase blocks 5A: 5A: (P+22)h (P+22)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 5B: 5B: (P+23)h (P+23)h 5C: 5C: (P+24)h (P+24)h Partition 1 (Erase Block Type 1) 5D: 5D: (P+25)h (P+25)h Minimum block erase cycles x 1000 5E: 5E: (P+26)h (P+26)h 5F: 5F: (P+27)h (P+27)h 60: 60: (P+28)h Partition Region 1 Erase Block Type 2 Information 61: (P+29)h bits 0–15 = y, y+1 = number of identical-size erase blocks 62: (P+2A)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 63: (P+2B)h (bottom parameter device only) 64: (P+2C)h Partition 1 (Erase block Type 2) 65: (P+2D)h Minimum block erase cycles x 1000 66: (P+2E)h 67: (P+2F)h 68: Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Program mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Erase mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Number of program or erase operations allowed in a partition bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Partition 1 (erase block Type 1) bits per cell; internal ECC bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserve for future use Partition 1 (erase block Type 1) page mode and synchronous mode capabilities defined in Table 10. bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Partition 1 (Erase block Type 2) bits per cell bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserve for future use Partition 1 (Erase block Type 2) pagemode and synchronous mode capabilities defined in Table 10 bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Types of erase block regions in this Partition Region. x = 0 = no erase blocking; the Partition Region erases in bulk x = number of erase block regions w/ contiguous same-size erase blocks. Symmetrically blocked partitions have one blocking region. Partition size = (Type 1 blocks)x(Type 1 block sizes) + (Type 2 blocks)x(Type 2 block sizes) +…+ (Type n blocks)x(Type n block sizes)

Intel® Wireless Flash Memory (W18) Datasheet Partition Region 2 Information Offset(1) See table below P = 39h (Optional flash features and commands) Len Bot Top (P+30)h (P+28)h Number of identical partitions within the partition region 69: 61: (P+31)h (P+29)h 6A: 62: (P+32)h (P+2A)h 6B: 63: (P+33)h (P+2B)h 6C: 64: (P+34)h (P+2C)h 6D: 65: (P+35)h (P+2D)h 6E: 66: (P+36)h (P+2E)h Partition Region 2 Erase Block Type 1 Information 6F: 67: (P+37)h (P+2F)h bits 0–15 = y, y+1 = number of identical-size erase blocks 70: 68: (P+38)h (P+30)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 71: 69: (P+39)h (P+31)h 72: 6A: (P+3A)h (P+32)h Partition 2 (Erase block Type 1) 73: 6B: (P+3B)h (P+33)h Minimum block erase cycles x 1000 74: 6C: (P+3C)h (P+34)h 75: 6D: (P+3D)h (P+35)h 76: 6E: (P+36)h Partition Region 2 Erase Block Type 2 Information 6F: (P+37)h bits 0–15 = y, y+1 = number of identical-size erase blocks 70: (P+38)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 71: (P+39)h 72: (P+3A)h Partition 2 (Erase Block Type 2) 73: (P+3B)h Minimum block erase cycles x 1000 74: (P+3C)h 75: (P+3D)h 76: (P+3E)h (P+3E)h Features Space definitions (Reserved for future use) TBD 77: 77: (P+3F)h (P+3F)h Reserved for future use Resv'd 78: 78: Partition 2 (Erase Block Type 2) bits per cell bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserved for future use Partition 2 (Erase block Type 2) pagemode and synchronous mode capabilities as defined in Table 10. bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Erase mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Types of erase block regions in this Partition Region. x = 0 = no erase blocking; the Partition Region erases in bulk x = number of erase block regions w/ contiguous same-size erase blocks. Symmetrically blocked partitions have one blocking region. Partition size = (Type 1 blocks)x(Type 1 block sizes) + (Type 2 blocks)x(Type 2 block sizes) +…+ (Type n blocks)x(Type n block sizes) Partition 2 (Erase block Type 1) bits per cell bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserve for future use Partition 2 (erase block Type 1) pagemode and synchronous mode capabilities as defined in Table 10. bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Program mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Number of program or erase operations allowed in a partition bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations

Intel® Wireless Flash Memory (W18) Datasheet Partition and Erase-block Region Information NOTES: 1. The variable P is a pointer which is defined at CFI offset 15h. 2. TPD - Top parameter device; BPD - Bottom parameter device. 3. Partition: Each partition is 4Mb in size. It can contain main blocks OR a combination of both main and parameter blocks. 4. Partition Region: Symmetrical partitions form a partition region. (there are two partition regions, A. contains all the partitions that are made up of main blocks only. B. contains the partition that is made up of the parameter and the main blocks. Address 52: --02 --02 --02 --02 --02 --02 53: --01 --07 --01 --0F --01 --1F 54: --00 --00 --00 --00 --00 --00 55: --11 --11 --11 --11 --11 --11 56: --00 --00 --00 --00 --00 --00 57: --00 --00 --00 --00 --00 --00 58: --02 --01 --02 --01 --02 --01 59: --07 --07 --07 --07 --07 --07 5A: --00 --00 --00 --00 --00 --00 5B: --20 --00 --20 --00 --20 --00 5C: --00 --01 --00 --01 --00 --01 5D: --64 --64 --64 --64 --64 --64 5E: --00 --00 --00 --00 --00 --00 5F: --01 --01 --01 --01 --01 --01 60: --03 --03 --03 --03 --03 --03 61: --06 --01 --06 --01 --06 --01 62: --00 --00 --00 --00 --00 --00 63: --00 --11 --00 --11 --00 --11 64: --01 --00 --01 --00 --01 --00 65: --64 --00 --64 --00 --64 --00 66: --00 --02 --00 --02 --00 --02 67: --01 --06 --01 --06 --01 --06 68: --03 --00 --03 --00 --03 --00 69: --07 --00 --0F --00 --1F --00 6A: --00 --01 --00 --01 --00 --01 6B: --11 --64 --11 --64 --11 --64 6C: --00 --00 --00 --00 --00 --00 6D: --00 --01 --00 --01 --00 --01 6E: --01 --03 --01 --03 --01 --03 6F: --07 --07 --07 --07 --07 --07 70: --00 --00 --00 --00 --00 --00 71: --00 --20 --00 --20 --00 --20 72: --01 --00 --01 --00 --01 --00 73: --64 --64 --64 --64 --64 --64 74: --00 --00 --00 --00 --00 --00 75: --01 --01 --01 --01 --01 --01 76: --03 --03 --03 --03 --03 --03 64Mbit 128Mbit

**Figure 38. 64-Mb µBGA*CSP Package Drawing and Dimensions**

Table 42. 32-Mbit and 128-Mbit VFBGA Package Dimensions

**Figure 41. 32-, 64- and 128-Mb VF BGA*CSP Package Drawing** Table 43. 32-Mbit, 64-Mbit, and 128-Mbit VFBGA Package Dimensions

Figure 42. 128Mbit QUAD+ Package Drawing