290701-18

290701-18 NUMONYX | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 102

Technical content

Datasheet sections

• 1.0 Introduction
• 1.1 Nomenclature
• 1.2 Conventions
• 2.0 Functional Overview
• 2.1 Memory Map and Partitioning
• 3.0 Package Information
• 3.1 W18 — 90 nm Lithography
• 3.2 W18 — 130 nm
• 4.0 Ballout and Signal Descriptions
• 4.1 Signal Ballout
• 4.2 Signal Descriptions
• 5.0 Maximum Ratings and Operating Conditions
• 5.1 Absolute Maximum Ratings
• 5.2 Operating Conditions
• 6.0 Electrical Specifications
• 6.1 DC Current Characteristics
• 6.2 DC Voltage Characteristics
• 7.0 AC Characteristics
• 7.1 AC Write Characteristics
• 7.2 Erase and Program Times
• 7.3 Reset Specifications
• 7.4 AC I/O Test Conditions
• 7.5 Device Capacitance
• 8.0 Power and Reset Specifications
• 8.1 Active Power
• 8.2 Automatic Power Savings (APS)
• 8.3 Standby Power
• 8.4 Power-Up/Down Characteristics
• 8.4.1 System Reset and RST#
• 8.4.2 VCC, VPP, and RST# Transitions
• 8.5 Power Supply Decoupling
• 9.0 Bus Operations Overview
• 9.1 Bus Operations
• 9.1.1 Reads
• 9.1.2 Writes
• 9.1.3 Output Disable
• 9.1.4 Burst Suspend
• 9.1.5 Standby
• 9.1.6 Reset
• 9.2 Device Commands
• 9.3 Command Sequencing
• 10.0 Read Operations
• 10.1 Asynchronous Page Read Mode
• 10.2 Synchronous Burst Read Mode
• 10.3 Read Array
• 10.4 Read Identifier

Order Number: 290701-18 November 2007 Numonyx™ Wireless Flash Memory (W18) Datasheet Product Features „ High Performance Read-While-Write/Erase — Burst frequency at 66 MHz (zero wait states) —6 0 ns Initial access read speed — 11 ns Burst mode read speed — 20 ns Page mode read speed — 4-, 8-, 16-, and Continuous -Word Burst mode reads — Burst and Page mode reads in all Blocks, across all partition boundaries — Burst Suspend feature — Enhanced Factory Programming at 3.1 µs/ word „ Security —1 2 8-Bit OTP Protection Register: 64 unique pre-programmed bits + 64 user-programmable bits — Absolute Write Protection with V PP at ground — Individual and Instantaneous Block Locking/ Unlocking with Lock-Down Capability „ Quality and Reliability —T e m p e r a t u r e R a n g e: –40 °C to +85 °C — 100K Erase Cycles per Block — 90 nm ETOX™ IX Process — 130 nm ETOX™ VIII Process „ Architecture — Multiple 4-Mbit partitions — Dual Operation: RWW or RWE — Parameter block size = 4-Kword — Main block size = 32-Kword — Top or bottom parameter devices —1 6 -bit wide data bus „ Software — 5 µs (typ.) Program and Erase Suspend latency time — Flash Data Integrator (FDI) and Common Flash Interface (CFI) Compatible — Programmable WAIT signal polarity „ Packaging and Power — 90 nm: 32- and 64-Mbit in VF BGA — 130 nm: 32-, 64-, and 128-Mbit in VF BGA — 130 nm: 128-Mbit in QUAD+ package — 56 Active Ball Matrix, 0.75 mm Ball-Pitch CC = 1.70 V to 1.95 V —V CCQ (90 nm) = 1.7 V to 1.95 V —V CCQ (130 nm) = 1.7 V to 2.24 V or 1.35 V to 1.80 V —V CCQ (130 nm) = 1.35 V to 2.24 V — Standby current (130 nm): 8 µA (typ.) — Read current: 8 mA (4-word burst, typ.)

2 Order Number: 290701-18

Legal Lines and DisclaimersLegal Lines and Disclaimers INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH NUMONYX™ PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN NUMONYX'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, NUMONYX ASSUMES NO LIABILITY WHATSOEVER, AND NUMONYX DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF NUMONYX PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. Numonyx products are not intended for use in medical, life saving, life sustaining, critical control or safety systems, or in nuclear f acility applications. Numonyx B.V. may make changes to specifications and product descriptions at any time, without notice. Numonyx B.V. may have patents or pending patent applications, trademarks, copyrights, or other intellectual property rights tha t relate to the presented subject matter. The furnishing of documents and other materials and information does not provide any license, express or implie d, by estoppel or otherwise, to any such patents, trademarks, copyrights, or other intellectual property rights. Designers must not rely on the absence or characteristics of any features or instructions marked “reserved” or “undefined.” Numonyx reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. Contact your local Numonyx sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an order number and are referenced in this document, or other Numonyx literature may be obtained by visiting Numonyx's website at http://www.numonyx.com . Numonyx, the Numonyx logo, and StrataFlash are trademarks or registered trademarks of Numonyx B.V. or its subsidiaries in other countries. *Other names and brands may be claimed as the property of others. Copyright © 2007, Numonyx B.V., All Rights Reserved.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

4 Order Number: 290701-18

Order Number: 290701-18 5 Numonyx™ Wireless Flash Memory (W18)

Revision History

09/13/00 -001 Initial Release 01/29/01 -002 Deleted 16-Mbit density Revised ADV#, Section 2.2 Revised Protection Registers, Section 4.16 Revised Program Protection Register, Section 4.18 Revised Example in First Access Latency Count , Section 5.0.2 Revised Figure 5, Data Output with LC Setting at Code 3 Added WAIT Signal Function, Section 5.0.3 Revised WAIT Signal Polarity, Section 5.0.4 Revised Data Output Configuration , Section 5.0.5 Added Figure 7, Data Output Configuration with WAIT Signal Delay Revised WAIT Delay Configuration , Section 5.0.6 Operation Changed ICCS Spec from 15 µA to 18 µA in Section 8.4, DC Characteristics Changed ICCR Spec from 10 mA (CLK = 40 MHz, burst length = 4) and 13 mA (CLK = 52 MHz, burst length = 4) to 13 mA, and 16 mA respectively in Section 8.4, DC Characteristics Changed ICCWS Spec from 15 µA to 18 µA in Section 8.4, DC Characteristics Changed ICCES Spec from 15 µA to 18 µA in Section 8.4, DC Characteristics Changed tCHQX Spec from 5 ns to 3 ns in Section 8.6, AC Read Characteristics Added Figure 25, WAIT Signal in Synchronous Non-Read Array Operation Waveform Added Figure 26, WAIT Signal in Asynchronous Page Mode Read Operation Waveform Added Figure 27, WAIT Signal in Asynchronous Single Word Read Operation Waveform Revised Appendix E, Ordering Information 06/12/01 -003 Revised entire Section 4.10, Enhanced Factory Program Command (EFP) and Figure 6, Enhanced Factory Program Flowchart Revised Section 4.13, Protection Register Revised Section 4.15, Program Protection Register Revised Section 7.3, Capacitance, to include 128-Mbit specs Revised Section 7.4, DC Characteristics, to include 128-Mbit specs Revised Section 7.6, AC Read Characteristics, to include 128-Mbit device specifications Added tVHGL Spec in Section 7.6, AC Read Characteristics Revised Section 7.7, AC Write Characteristics, to include 128-Mbit device specifications Minor text edits 04/05/02 -004 New Sections Organization Added 16-Word Burst Feature Added Burst Suspend Section Revised Block Locking State Diagram Revised Active Power Section, Automatic Power Savings (APS) Section and Power-Up/Down Operation Section Revised Extended Temperature Operation Added 128 Mb DC Characteristics Table and AC Read Characteristics Table Revised Table 17. Test Configuration Component Values for Worst Case Speed Conditions Added 0.13 µm Product DC and AC Read Characteristics Revised AC Write Characteristics Added Read to Write and Write to Read Transition Waveforms Revised Reset Specifications Various text edits

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

6 Order Number: 290701-18

Updated Latency Count Section, including adding Latency Count Tables Added section 8.4 WAIT Function and WAIT Summary Table Updated Package Drawing and Dimensions 11/12/02 -006 Various text clarifications 01/14/03 -007 Removed Numonyx Burst Order Revised Table 10 “DC Current Characteristics” Various text edits 03/21/03 -008 Revised Table 22, Read Operations, t APA Added note to table 15, Configuration Register Descriptions Added note to section 3.1.1, Read 12/17/03 -009 Updated Block-Lock Operations (Section 7.1 and Figure 11) Updated Table 21 (128 Mb ICCR) Updated Table 4 (WAIT behavior) Added QUAD+ ballout, package mechanicals, and order information Various text edits including latest product-naming convention 02/12/04 -010 Added 90 nm product line; Removed µBGA* package Added Page- and Burst-Mode descriptions; Minor text edits 05/06/04 -011 Fixed omitted text for Table 21, note 1 regarding max DC voltage on I/O pins Removed Extended I/O Supply Voltage for 90 nm products Minor text edits 06/03/04 -012 Updated the title and layout of the datasheet 06/29/04 -013 V CCQ Max. changed for 90 nm products Updated “Absolute Maximum Ratings” table Typical I CCS updated as 35 μA Updated subtitle 01/21/05 -014 Typical ICCS updated as 22 μA Minor text edits 07-Dec-2005 -015 Typical 90nm APS updated to 22 µA in Table 11, “DC Current Characteristics” on page 23. Updated 90nm VLKO to 0.7 V in Table 12, “DC Voltage Characteristics” on page 24. Product ordering information updated. December 2006 016 Added line item RD48F1000W0YTQ0 and RD48F1000W0YBQ0, in QUAD+ ballout, 10x8x1.2 package. Removed extended range voltage specifications that are no longer supported. Removed tAVQV/tCHQV 80ns/14ns; Applied new template/format. August 2007 017 Updated ordering information November 2007 18 Applied Numonyx branding. Date Revision Description

Order Number: 290701-18 7 Numonyx™ Wireless Flash Memory (W18)

1.0 Introduction

This datasheet contains information about the Numonyx™ Wireless Flash Memory (W18) device family. This section describes nomenclature used in the datasheet. Section 2.0 provides an overview of the W18 flash memory device. Section 6.0, Section 7.0, and Section 8.0 describe the electrical specifications for extended temperature product offerings. Ordering information can be found in Section C. The Numonyx™ Wireless Flash Memory (W18) device with flexible multi-partition dual- operation architecture, provides high-performance Asynchronous and Synchronous Burst reads. It is an ideal memory for low-voltage burst CPUs. Combining high read performance with flash memory intrinsic non-volatility, the W18 device eliminates the traditional system-performance paradigm of shadowing redundant code memory from slow nonvolatile storage to faster execution memory. It reduces total memory requirement that increases reliability and reduces overall system power consumption and cost. The W18 device’s flexible multi-partition architecture allows program or erase to occur in one partition while reading from another partition. This allows for higher data write throughput compared to single-partition architectures and designers can choose code and data partition sizes. The dual-operation architecture allows two processors to interleave code operations while program and erase operations take place in the background.

1.1 Nomenclature

Table 1: Acronyms APS Automatic Power Savings BBA Block Base Address CFI Common Flash Interface CUI Command User Interface DU Don’t Use EFP Enhanced Factory Programming FDI Flash Data Integrator NC No Connect OTP One-Time Programmable PBA Partition Base Address RCR Read Configuration Register RWE Read-While-Erase RWW Read-While-Write SCSP Stacked Chip Scale Package SRD Status Register Data VF BGA Very-thin, Fine-pitch, Ball Grid Array WSM Write State Machine

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

8 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

1.2 Conventions

Table 2: Conventions “1.8 V” Refers to the full VCC voltage range of 1.7 V – 1.95 V (except where noted) and “V PP = 12 V” refers to 12 V ±5%. Set Refers to registers means the bit is a logical 1 and cleared means the bit is a logical 0. Pin and signal Often used interchangeably to refer to the external signal connections on the package (ball is the term used for VF BGA). Word 2 bytes or 16 bits. Signal N ames are in all CAPS (see Section 4.2, “Signal Descriptions” on page 18.) Voltage A pplied to the signal is subscripted for example V PP. Throughout this document, references are made to top, bottom, parameter, and partition. To clarify these references, the following conventions have been adopted: Block A group of bits (or words) that erase simultaneously with one block erase instruction. Main block Contains 32-Kwords. Parameter block Contains 4-Kwords. Block Base Address (BBA) The first address of a block. Partition A group of blocks that share erase and program circuitry and a common Status Register. Partition Base Address (PBA) The first address of a partition. For example, on a 32-Mbit top-parameter device partition number 5 has a PBA of 0x140000. Top partition Located at the highest physical device address. This partition may be a main partition or a parameter partition. Bottom partition Located at the lowest physical device address. This partition may be a main partition or a parameter partition. Main partition Contains only main blocks. Parameter partition Contains a mixture of main blocks and parameter blocks. Top parameter device Has the parameter partition at the top of the memory map with the parameter blocks at the top of that partition. This was formerly referred to as a Top-Boot device. Bottom parameter device (BPD) Has the parameter partition at the bottom of the memory map with the parameter blocks at the bottom of that partition. This was formerly referred to as a Bottom-Boot Block flash device.

Order Number: 290701-18 9 Numonyx™ Wireless Flash Memory (W18)

2.0 Functional Overview

This section provides an overview of the W18 device features and architecture. The W18 device provides Read-While-Write (RWW) and Read-White-Erase (RWE) capability with high-performance synchronous and asynchronous reads on package- compatible densities with a 16-bit data bus. Individually-erasable memory blocks are optimally sized for code and data storage. Eight 4-Kword parameter blocks are located in the parameter partition at either the top or bottom of the memory map. The rest of the memory array is grouped into 32-Kword main blocks. The memory architecture for the W18 device consists of multiple 4-Mbit partitions, the exact number depending on device density. By dividing the memory array into partitions, program or erase operations can take place simultaneously during read operations. Burst reads can traverse partition boundaries, but user application code is responsible for ensuring that they don’t extend into a partition that is actively programming or erasing. Although each partition has burst-read, write, and erase capabilities, simultaneous operation is limited to write or erase in one partition while other partitions are in a read mode. Augmented erase-suspend functionality further enhances the RWW capabilities of this device. An erase can be suspended to perform a program or read operation within any block, except that which is erase-suspended. A program operation nested within a suspended erase can subsequently be suspended to read yet another memory location. After device power-up or reset, the W18 device defaults to asynchronous page-mode read configuration. Writing to the device’s Read Configuration Register (RCR) enables synchronous burst-mode read operation. In synchronous mode, the CLK input increments an internal burst address generator. CLK also synchronizes the flash memory with the host CPU and outputs data on every, or on every other, valid CLK cycle after an initial latency. A programmable WAIT output signals to the CPU when data from the flash memory device is ready. In addition to its improved architecture and interface, the W18 device incorporates Enhanced Factory Programming (EFP), a feature that enables fast programming and low-power designs. The EFP feature provides the fastest currently-available program performance, which can increase a factory’s manufacturing throughput. The device supports read operations at 1.8 V and erase and program operations at 1.8 V or 12 V. With the 1.8 V option, VCC and VPP can be tied together for a simple, ultra- low-power design. In addition to voltage flexibility, the dedicated VPP input provides complete data protection when V PP ≤ VPPLK. This device (130 nm) allows I/O operation at voltages lower than the minimum VCCQ of 1.7 V. This Extended VCCQ range, 1.35 V – 1.8 V, permits even greater system design flexibility. A 128-bit protection register enhances the user’s ability to implement new security techniques and data protection schemes. Unique flash device identification and fraud-, cloning-, or content- protection schemes are possible through a combination of factory- programmed and user-OTP data cells. Zero-latency locking/unlocking on any memory block provides instant and complete protection for critical system code and data. An additional block lock-down capability provides hardware protection where software commands alone cannot change the block’s protection status. The Command User Interface (CUI) is the system processor’s link to internal flash memory operation. A valid command sequence written to the CUI initiates device Write State Machine (WSM) operation that automatically executes the algorithms, timings,

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

10 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) and verifications necessary to manage flash memory program and erase. An internal Status Register provides ready/busy indication results of the operation (success, fail, and so on). Three power-saving features– Automatic Power Savings (APS), standby, and RST# – can significantly reduce power consumption. The device automatically enters APS mode following read cycle completion. Standby mode begins when the system deselects the flash memory by de-asserting CE#. Driving RST# low produces power savings similar to standby mode. It also resets the part to read-array mode (important for system-level reset), clears internal Status Registers, and provides an additional level of flash write protection.

2.1 Memory Map and Partitioning

The W18 device is divided into 4-Mbit physical partitions, which allows simultaneous RWW or RWE operations and allows users to segment code and data areas on 4-Mbit boundaries. The device’s memory array is asymmetrically blocked, which enables system code and data integration within a single flash device. Each block can be erased independently in block erase mode. Simultaneous program and erase operations are not allowed; only one partition at a time can be actively programming or erasing. See Table 3, “Bottom Parameter Memory Map” on page 11 and Table 4, “Top Parameter Memory Map” on page 12. The 32-Mbit device has eight partitions, the 64-Mbit device has 16 partitions, and the 128-Mbit device has 32 partitions. Each device density contains one parameter partition and several main partitions. The 4-Mbit parameter partition contains eight 4- Kword parameter blocks and seven 32-Kword main blocks. Each 4-Mbit main partition contains eight 32-Kword blocks each. The bulk of the array is divided into main blocks that can store code or data, and parameter blocks that allow storage of frequently updated small parameters that are normally stored in EEPROM. By using software techniques, the word-rewrite functionality of EEPROMs can be emulated.

Order Number: 290701-18 11 Numonyx™ Wireless Flash Memory (W18) Table 3: Bottom Parameter Memory Map Size (KW) Blk # 32-Mbit Blk # 64-Mbit Blk # 128-Mbit Main Partitions Sixteen Partitions 32 262 7F8000-7FFFFF 32 135 400000-407FFF Eight Partitions 32 134 3F8000-3FFFFF 134 3F8000-3FFFFF 32 71 200000-207FFF 71 200000-207FFF Four Partitions 32 70 1F8000-1FFFFF 70 1F8000-1FFFFF 70 1F8000-1FFFFF.. 32 39 100000-107FFF 39 100000-107FFF 39 100000-107FFF One Partition 32 38 0F8000-0FFFFF 38 0F8000-0FFFFF 38 0F8000-0FFFFF.. 32 31 0C0000-0C7FFF 31 0C0000-0C7FFF 31 0C0000-0C7FFF One Partition 32 30 0B8000-0BFFFF 30 0B8000-0BFFFF 30 0B8000-0BFFFF.. 32 23 080000-087FFF 23 080000-087FFF 23 080000-087FFF One Partition 32 22 078000-07FFFF 22 078000-07FFFF 22 078000-07FFFF.. 32 15 040000-047FFF 15 040000-047FFF 15 040000-047FFF Parameter One Partition 32 14 038000-03FFFF 14 038000-03FFFF 14 038000-03FFFF.. 32 8 008000-00FFFF 8 008000-00FFFF 8 008000-00FFFF 4 7 007000-007FFF 7 007000-007FFF 7 007000-007FFF.. 4 0 000000-000FFF 0 000000-000FFF 0 000000-000FFF 128 Mbit is not available at 90 nm.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

12 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Table 4: Top Parameter Memory Map Size (KW) Blk # 32-Mbit Blk # 64-Mbit Blk # 128-Mbit Parameter Partition One Partition 4 70 1FF000-1FFFFF 134 3FF000-3FFFFF 262 7FF000-7FFFFF.. 4 63 1F8000-1F8FFF 127 3F8000-3F8FFF 255 7F8000-7F8FFF 32 62 1F0000-1F7FFF 126 3F0000-3F7FFF 254 7F0000-7F7FFF.. 32 56 1C0000-1C7FFF 120 3C0000- 3C7FFF 248 7C0000-7C7FFF Main Partitions One Partition 32 55 1B8000-1BFFFF 119 3B8000-3BFFFF 247 7B8000-7BFFFF.. 32 48 18000-187FFF 112 380000-387FFF 240 780000-787FFF One Partition 32 47 178000-17FFFF 111 378000-37FFFF 239 778000-77FFFF.. 32 40 140000-147FFF 104 340000-347FFF 232 740000-747FFF One Partition 32 39 138000-13FFFF 103 338000-33FFFF 231 738000-73FFFF.. 32 32 100000-107FFF 96 300000-307FFF 224 700000-707FFF Four Partitions 32 31 0F8000-0FFFFF 95 2F8000-2FFFFF 223 6F8000-6FFFFF.. 32 0 000000-007FFF 64 200000-207FFF 192 600000-607FFF Eight Partitions 32 63 1F8000-1FFFFF 191 5F8000-5FFFFF 32 0 000000-007FFF 128 400000-407FFF Sixteen Partitions 32 127 3F8000-3FFFFF 32 0 000000-007FFF 128 Mbit is not available at 90 nm.

Order Number: 290701-18 13 Numonyx™ Wireless Flash Memory (W18)

3.0 Package Information

3.1 W18 — 90 nm Lithography

Figure 1: 32- and 64-Mbit VF BGA Package Drawing E Seating Plane Top View - Bump Side Down Bottom View - Ball Side Up Y A D Ball A1 Corner 8765432 1 A B C D E F G S e b Ball A1 Corner 87654321 A B C D E F G Table 5: 32- and 64-Mbit VF BGA Package Dimensions Dimension Symbol Millimeters Inches Min Nom Max Min Nom Max Package Height A - - 1.000 - - 0.0394 Ball Height A 1 0.150 - - 0.0059 - - Package Body Thickness A 2 - 0.665 - - 0.0262 - Ball (Lead) Count N - 56 - - 56 - Seating Plane Coplanarity Y - - 0.100 - - 0.0039 Corner to Ball A1 Distance Along D S

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

14 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

3.2 W18 — 130 nm

Figure 2: 32-, 64-, and 128-Mbit VF BGA Package Drawing E Seating Plane Top View - Bump Side Down Bottom View - Ball Side Up Y A D Ball A1 Corner 8765432 1 A B C D E F G S e b Ball A1 Corner 87654321 A B C D E F G Table 6: 32-, 64-, and 128-Mbit VF BGA Package Dimensions Dimension Symbol Millimeters Inches Min Nom Max Min Nom Max Package Height A - - 1.000 - - 0.0394 Ball Height A 1 0.150 - - 0.0059 - - Package Body Thickness A 2 - 0.665 - - 0.0262 - Ball (Lead) Count N - 56 - - 56 - Seating Plane Coplanarity Y - - 0.100 - - 0.0039 Corner to Ball A1 Distance Along D (32/64-Mbit) S

Order Number: 290701-18 15 Numonyx™ Wireless Flash Memory (W18) Figure 3: 128-Mbit QUAD+ Package Drawing M illimeters Inches Dimensions Symbol Min Nom Max Notes Min Nom Max Package Height A 1.200 0.0472 Ball Height A1 0.200 0.0079 Package Body Thickness A2 0.860 0.0339 Pitch e 0.800 0.0315 Ball (Lead) Count N 88 88 Seating Plane Coplanarity Y 0.100 0.0039 Top View - Ball Down Bottom View - Ball Up A D E Y Drawing not to scale. A C B E D G F J H K L M e 12345678 b A C B E D G F J H K L M A1 Index Mark 12345678

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

16 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

4.0 Ballout and Signal Descriptions

4.1 Signal Ballout

The W18 device is available in a 56-ball VF BGA and µBGA Chip Scale Package with 0.75 mm ball pitch, or the 88-ball (80 active balls) QUAD+ SCSP package. Figure 4 shows the device ballout for the VF BGA package. Figure 5 shows the device ballout for the QUAD+ package. Figure 4: 56-Ball VF BGA Ballout Notes: 1. On lower density devices, upper address balls can be treated as NC.; for example, 32-Mbit density, A21 and A22 are NC). 2. See Section 3.0, “Package Information” on page 13 for mechanical specifications for the package. A B C D E F G A B C D E F G Top View - Ball Side Down Complete Ink Mark Not Shown 8 7 6 5 4 3 2 11 2 3 4 5 6 7 8 Bottom View - Ball Side Up A4 A6 A18 VPP VCC VSS A8 A11 A3 A5 A17 RST# CLK A20 A9 A12 A2 A7 WE# ADV#A19 A10 A13 A1 A14 WP# DQ12 A16 WAIT A15 A0 CE# DQ1 DQ2 DQ4 DQ6 DQ15 VCCQ OE# DQ0 DQ9 DQ10 DQ11 DQ13 DQ14 VSS VSSQ DQ8 VCCQ DQ3 VCC DQ5 VSSQ DQ7 A22 A21 A4A6A18VPPVCCVSSA8A11 A3A5A17RST#CLKA20A9A12 A2A7WE#ADV# A19A10A13 A1A14 WP# DQ12A16WAITA15 A0CE#DQ1DQ2DQ4DQ6DQ15VCCQ OE#DQ0DQ9DQ10DQ11DQ13DQ14VSS VSSQDQ8VCCQDQ3VCCDQ5VSSQDQ7 A22 A21

Order Number: 290701-18 17 Numonyx™ Wireless Flash Memory (W18) Figure 5: 88-Ball (80 Active Balls) QUAD+ Ballout Notes: 1. Unused upper address balls can be treated as NC; for example, 128-Mbit device, A[25:23] are not used. 2. See Section 3.0, “Package Information” on page 13 for the mechanical specifications for the package. Flash specific SRAM/PSRAM specific Global Legend: Top View - Ball Side Down 87654321 A B C D E F G H J K L M DU DU DU DU DUDUDU DU A2 A7 A1 A6 A18 A19 VSS VSSA23 A24 A25 A17 F2-VCC CLK A21 A22 A12 A11 A13A9P1-CS#F-VPP, F-VPEN A20 A10 A15 F-WE# A8 D8 D2 D10 D5 D13 WAIT A14 A16 F1-CE# P-Mode, P-CRE VSS VSS VSS P2-CS# F1-VCC F2-VCC VCCQF3-CE# D0 D1 D4 D6 D15D11 D12 D14 F1-OE# F2-OE# P-VCC S-CS2 R-WE# R-UB# R-LB# R-OE# S-VCC S-CS1# F1-VCC F-WP# ADV# F-RST# F2-CE# VCCQ VSS VSS VCCQ VSS

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

18 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

4.2 Signal Descriptions

Table 7 describes the signals used on the VF BGA package. Table 8 describes the signals used on the QUAD+ package. Table 7: Signal Descriptions - VF BGA Package Symbol Type Name and Function A[22:0] Input ADDRESS INPUTS: For memory addresses. 32-Mbit: A[20:0]; 64-Mbit: A[21:0]; 128-Mbit: A[22:0] D[15:0] Input/ Output DATA INPUTS/OUTPUTS: Inputs data and commands during write cycles; outputs data during memory, Status Register, protection register, and configuration code reads. Data pins float when the chip or outputs are deselected. Data is internally latched during writes. ADV# Input ADDRESS VALID: ADV# indicates valid address presence on address inputs. During synchronous read operations, all addresses are latched on ADV#’s rising edge or the next valid CLK edge with ADV# low, whichever occurs first. CE# Input CHIP ENABLE: Asserting CE# activates internal control logic, I/O buffers, decoders, and sense amps. De-asserting CE# deselects the device, places it in standby mode, and places all outputs in High-Z. CLK Input CLOCK: CLK synchronizes the device to the system bus frequency during synchronous reads and increments an internal address generator. During synchronous read operations, addresses are latched on ADV#’s rising edge or the next valid CLK edge with ADV# low, whichever occurs first. OE# Input OUTPUT ENABLE: When asserted, OE# enables the device’s output data buffers during a read cycle. When OE# is deasserted, data outputs are placed in a high-impedance state. RST# Input RESET: When low, RST# resets internal automation and inhibits write operations. This provides data protection during power transitions. de-asserting RST# enables normal operation and places the device in asynchronous read-array mode. WAIT Output WAIT: The WAIT signal indicates valid data during synchronous read modes. It can be configured to be asserted-high or asserted-low based on bit 10 of the Read Configuration Register. WAIT is tri-stated if CE# is deasserted. WAIT is not gated by OE#. WE# Input WRITE ENABLE: WE# controls writes to the CUI and array. Addresses and data are latched on the rising edge of WE#. WP# Input WRITE PROTECT: Disables/enables the lock-down function. When WP# is asserted, the lock-down mechanism is enabled and blocks marked lock-down cannot be unlocked through software. See Section 13.1, “Block Lock Operations” on page 71 for details on block locking. VPP Power ERASE AND PROGRAM POWER: A valid voltage on this pin allows erasing or programming. Memory contents cannot be altered when V PP ≤ VPPLK. Block erase and program at invalid V PP voltages should not be attempted. Set VPP = VCC for in-system program and erase operations. To accommodate resistor or diode drops from the system supply, the VIH level of VPP can be as low as VPP1 min. VPP must remain above VPP1 min to perform in-system flash modification. VPP may be 0 V during read operations. VPP2 can be applied to main blocks for 1000 cycles maximum and to parameter blocks for 2500 cycles. VPP can be connected to 12 V for a cumulative total not to exceed 80 hours. Extended use of this pin at 12 V may reduce block cycling capability. VCC Power DEVICE POWER SUPPLY: Writes are inhibited at VCC ≤ VLKO. Device operations at invalid VCC voltages should not be attempted. VCCQ Power OUTPUT POWER SUPPLY: Enables all outputs to be driven at VCCQ. This input may be tied directly to VCC. VSS Power GROUND: Pins for all internal device circuitry must be connected to system ground. VSSQ Power OUTPUT GROUND: Provides ground to all outputs which are driven by VCCQ. This signal may be tied directly to VSS. DU — DO NOT USE: Do not use this pin. This pin should not be connected to any power supplies, signals or other pins and must be floated. NC — NO CONNECT: No internal connection; can be driven or floated.

Order Number: 290701-18 19 Numonyx™ Wireless Flash Memory (W18) Table 8: Signal Descriptions - QUAD+ Package (Sheet 1 of 2) Symbol Type Description A[MAX:MIN] Input ADDRESS INPUTS: Inputs for all die addresses during read and write operations. —256-Mbit Die : AMAX= A23 —128-Mbit Die : AMAX = A22 —64-Mbit Die : AMAX = A21 —32-Mbit Die : AMAX = A20 —8-Mbit Die : AMAX = A18 A0 is the lowest-order 16-bit wide address. A[25:24] denote high-order addresses reserved for future device densities. D[15:0] Input/ Output DATA INPUTS/OUTPUTS: Inputs data and commands during write cycles, outputs data during read cycles. Data signals float when the device or its outputs are deselected. Data are internally latched during writes on the flash device. F[3:1]-CE# Input FLASH CHIP ENABLE: Low-true input. F[3:1]-CE# low selects the associated flash memory die. When asserted, flash internal control logic, input buffers, decoders, and sense amplifiers are active. When deasserted, the associated flash die is deselected, power is reduced to standby levels, data and WAIT outputs are placed in high-Z state. F1-CE# selects or deselects flash die #1; F2-CE# selects or deselects flash die #2 and is RFU on combinations with only one flash die. F3-CE# selects or deselects flash die #3 and is RFU on stacked combinations with only one or two flash dies. S-CS1# S-CS2 Input SRAM CHIP SELECT: Low-true / High-true input (S-CS1# / S-CS2 respectively). When either/both SRAM Chip Select signals are asserted, SRAM internal control logic, input buffers, decoders, and sense amplifiers are active. When either/both SRAM Chip Select signals are deasserted, the SRAM is deselected and its power is reduced to standby levels. S-CS1# and S-CS2 are available on stacked combinations with SRAM die and are RFU on stacked combinations without SRAM die. P[2:1]-CS# Input PSRAM CHIP SELECT: Low-true input. When asserted, PSRAM internal control logic, input buffers, decoders, and sense amplifiers are active. When deasserted, the PSRAM is deselected and its power is reduced to standby levels. P1-CS# selects PSRAM die #1 and is available only on stacked combinations with PSRAM die. This ball is an RFU on stacked combinations without PSRAM. P2-CS# selects PSRAM die #2 and is available only on stacked combinations with two PSRAM dies. This ball is an RFU on stacked combinations without PSRAM or with a single PSRAM. F[2:1]-OE# Input FLASH OUTPUT ENABLE: Low-true input. Fx-OE# low enables the selected flash’s output buffers. F[2:1]-OE# high disables the selected flash’s output buffers, placing them in High-Z. F1-OE# controls the outputs of flash die #1; F2-OE# controls the outputs of flash die #2 and flash die #3. F2-OE# is available on stacked combinations with two or three flash die and is RFU on stacked combinations with only one flash die. R-OE# Input RAM OUTPUT ENABLE: Low-true input. R-OE# low enables the selected RAM’s output buffers. R-OE# high disables the RAM output buffers, and places the selected RAM outputs in High-Z. R-OE# is available on stacked combinations with PSRAM or SRAM die, and is an RFU on flash-only stacked combinations. F-WE# Input FLASH WRITE ENABLE: Low-true input. F-WE# controls writes to the selected flash die. Address and data are latched on the rising edge of F- WE#. R-WE# Input RAM WRITE ENABLE: Low-true input. R-WE# controls writes to the selected RAM die. R-WE# is available on stacked combinations with PSRAM or SRAM die and is an RFU on flash-only stacked combinations. CLK Input CLOCK: Synchronizes the flash die with the system bus clock in synchronous read mode and increments the internal address generator. During synchronous read operations, addresses are latched on the rising edge of ADV#, or on the next valid CLK edge with ADV# low, whichever occurs first. In asynchronous mode, addresses are latched on the rising edge ADV#, or are continuously flow- through when ADV# is kept asserted.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

20 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) WAIT Output WAIT: Output signal. Indicates invalid data during synchronous array or non-array flash reads. Read Configuration Register bit 10 (RCR[10]) determines WAIT-asserted polarity (high or low). WAIT is High-Z if F-CE# is deasserted; WAIT is not gated by F-OE#.

• In synchronous array or non-array flash read modes, WAIT indicates invalid data when asserted and valid data when deasserted.
• In asynchronous flash page read, and all flash write modes, WAIT is asserted. F-WP# Input FLASH WRITE PROTECT: Low-true input. F-WP# enables/disables the lock-down protection mechanism of the selected flash die.
• F-WP# low enables the lock-down mechanism where locked down blocks cannot be unlocked with software commands.
• F-WP# high disables the lock-down mechanism, allowing locked down blocks to be unlocked with software commands. ADV# Input ADDRESS VALID: Low-true input. During synchronous flash read operations, addresses are latched on the rising edge of ADV#, or on the next valid CLK edge with ADV# low, whichever occurs first. In asynchronous flash read operations, addresses are latched on the rising edge of ADV#, or are continuously flow-through when ADV# is kept asserted. R-UB# R-LB# Input RAM UPPER / LOWER BYTE ENABLES: Low-true input. During RAM read and write cycles, R-UB# low enables the RAM high order bytes on D[15:8], and R- LB# low enables the RAM low-order bytes on D[7:0]. R-UB# and R-LB# are available on stacked combinations with PSRAM or SRAM die and are RFU on flash-only stacked combinations. F-RST# Input FLASH RESET: Low-true input. F-RST# low initializes flash internal circuitry and disables flash operations. F-RST# high enables flash operation. Exit from reset places the flash in asynchronous read array mode. P-Mode, P-CRE Input P-Mode (PSRAM Mode): Low-true input. P-Mode is used to program the Configuration Register, and enter/exit Low Power Mode of PSRAM die. P-Mode is available on stacked combinations with asynchronous-only PSRAM die. P-CRE (PSRAM Configuration Register Enable): High-true input. P-CRE is high, write operations load the refresh control register or bus control register. P-CRE is applicable only on combinations with synchronous PSRAM die. P-Mode, P-CRE is an RFU on stacked combinations without PSRAM die. F-VPP, F-VPEN Power FLASH PROGRAM AND ERASE POWER: Valid F-V PP voltage on this ball enables flash program/erase operations. Flash memory array contents cannot be altered when F-VPP(F-VPEN) < VPPLK (VPENLK). Erase / program operations at invalid F-VPP (F-VPEN) voltages should not be attempted. Refer to flash discrete product datasheet for additional details. F-VPEN (Erase/Program/Block Lock Enables) is not available for L18/L30 SCSP products. F[2:1]-VCC Power FLASH LOGIC POWER: F1-VCC supplies power to the core logic of flash die #1; F2-VCC supplies power to the core logic of flash die #2 and flash die #3. Write operations are inhibited when F-V CC < VLKO. Device operations at invalid F-VCC voltages should not be attempted. F2-VCC is available on stacked combinations with two or three flash dies, and is an RFU on stacked combinations with only one flash die. S-VCC Power SRAM POWER SUPPLY: Supplies power for SRAM operations. S-VCC is available on stacked combinations with SRAM die, and is RFU on stacked combinations without SRAM die. P-VCC Power PSRAM POWER SUPPLY: Supplies power for PSRAM operations. P-VCC is available on stacked combinations with PSRAM die, and is RFU on stacked combinations without PSRAM die. VCCQ Power DEVICE I/O POWER: Supply power for the device input and output buffers. VSS Power DEVICE GROUND: Connect to system ground. Do not float any VSS connection. RFU — RESERVED for FUTURE USE: Reserved for future device functionality/ enhancements. Contact Numonyx regarding the use of balls designated RFU. DU — DO NOT USE: Do not connect to any other signal, or power supply; must be left floating. Table 8: Signal Descriptions - QUAD+ Package (Sheet 2 of 2)

Order Number: 290701-18 21 Numonyx™ Wireless Flash Memory (W18)

5.0 Maximum Ratings and Operating Conditions

5.1 Absolute Maximum Ratings

Warning: Stressing the device beyond the “Absolute Maximum Ratings” may cause permanent damage. These are stress ratings only.

5.2 Operating Conditions

Warning: Operation beyond the “Operating Conditions” is not recommended and extended exposure beyond the “Operating Conditions”may affect device reliability. Notice: This datasheet contains information on products in the design phase of development. The information here is subject to change without notice. Do not finalize a design with this information. Table 9: Absolute Maximum Ratings Parameter Maximum Rating Notes Temperature under Bias –40 °C to +85 °C Storage Temperature –65 °C to +125 °C Voltage on Any Pin (except VCC, VCCQ, VPP) –0.5 V to +2.45 V 1,2 VPP Voltage –0.2 V to +13.1 V 1,3,4 VCC and VCCQ Voltage –0.2 V to +2.45 V 1,2 Output Short Circuit Current 100 mA 5 Notes: 1. Specified voltages are with respect to V SS. 2. During transitions, this level may: (130 nm) Undershoot –2.0 V for periods < 20 ns and overshoot to V CCQ +2.0 V for periods < 20 ns (90 nm) Undershoot –1.0 V for periods < 20 ns and overshoot to VCCQ +1.0 V for periods < 20 ns. 3. Maximum DC voltage on V PP may overshoot to +14.6 V for periods < 20 ns. 4. V PP program voltage is normally V PP1. VPP can be 12 V ± 0.6 V for 1000 cycles on the main blocks and 2500 cycles on the parameter blocks during program/erase. 5. Output shorted for no more than one second. No more than one output shorted at a time. Table 10: Extended Temperature Operation (Sheet 1 of 2) Symbol Parameter 1 Min Nom Max Unit Note TA Operating Temperature –40 25 85 °C VCC VCC Supply Voltage 1.7 1.8 1.95 V 2 I/O Supply Voltage (90 nm) 1.7 1.8 1.95 2 VCCQ I/O Supply Voltage (130 nm) 1.7 1.8 2.24 2 VPP1 VPP Voltage Supply (Logic Level) 0.90 1.80 1.95 1 VPP2 FactoryProgramming VPP 11.4 12.0 12.6 1 tPPH Maximum VPP Hours V PP = 12 V - - 80 Hours 1

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

22 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Block Erase Cycles Main and Parameter Blocks V PP ≤ VCC 100,000 - - Cycles Main Blocks V PP = 12 V - - 1000 1 Parameter Blocks V PP = 12 V - - 2500 1 Notes: 1. VPP is normally V PP1. VPP can be connected to 11.4 V–12.6 V for 1000 cycles on main blocks at extended temperatures and 2500 cycles on parameter blocks at extended temperatures. 2. Contact your Numonyx field representative for V CC/VCCQ operations down to 1.65 V. Table 10: Extended Temperature Operation (Sheet 2 of 2) Symbol Parameter 1 Min Nom Max Unit Note

Order Number: 290701-18 23 Numonyx™ Wireless Flash Memory (W18)

6.0 Electrical Specifications

6.1 DC Current Characteristics

Note: Specifications are for 130 nm and 90 nm devices unless otherwise stated; the 128 Mbit density is supported ONLY on 90 nm. Table 11: DC Current Characteristics (Sheet 1 of 2) Symbol Parameter (1) VCCQ= 1.8 V Unit Test Condition Note32/64-Mbit 128-Mbit T y pM a xT y pM a x ILI Input Load — ±1 — ±1 µA VCC = VCCMax VCCQ = VCCQMax VIN = VCCQ or GND ILO Output Leakage D[15:0] — ±1 — ±1 µA VCC = VCCMax VCCQ = VCCQMax VIN = VCCQ or GND 130 nm ICCS VCC Standby 85 087 0 µA VCC = VCCMax VCCQ = VCCQMax CE# = VCC RST# =VCCQ 90 nm ICCS 22 50 — — 130 nm ICCAPS APS 85 087 0 µA VCC = VCCMax VCCQ = VCCQMax CE# = VSSQ RST# =VCCQ All other inputs =VCCQ or VSSQ 90 nm ICCAPS 22 50 — — ICCR Average VCC Read Asynchronous Page Mode f=13 MHz 3647 m A 4 W o r d R e a d 3 Synchronous CLK = 40 MHz 6 13 6 13 mA Burst length = 4 8 14 8 14 mA Burst length = 8 10 18 11 19 mA Burst length =16 11 20 11 20 mA Burst length = Continuous Synchronous CLK = 54 MHz 7 16 7 16 mA Burst length = 4 10 18 10 18 mA Burst length = 8 12 22 12 22 mA Burst length = 16 13 25 13 25 mA Burst length = Continuous I CCR Average VCC Read Synchronous CLK = 66 MHz 8 17 — — mA Burst length = 4 3, 4 11 20 — — mA Burst length = 8 14 25 — — mA Burst length = 16 16 30 — — mA Burst length = Continuous I CCW VCC Program 18 40 18 40 mA VPP = VPP1, Program in Progress 4,5,6 81 581 5 m A VPP = VPP2, Program in Progress ICCE VCC Block Erase 18 40 18 40 mA VPP = VPP1, Block Erase in Progress 4,5,6 81 581 5 m A VPP = VPP2, Block Erase in Progress

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

24 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

6.2 DC Voltage Characteristics

Note: Specifications are for 130 nm and 90 nm devices unless otherwise stated; the 128 Mbit density is supported ONLY on 90 nm. 130nm ICCWS VCC Program Suspend 85 052 5 µ A CE# = VCC, Program Suspended 90nm ICCWS 22 50 — — µA 130nm ICCES VCC Erase Suspend 85 052 5 µ A CE# = VCC, Erase Suspended 90nm ICCWS 22 50 — — µA IPPS (IPPWS, IPPES) VPP Standby VPP Program Suspend VPP Erase Suspend 0.2 5 0.2 5 µA V PP <VCC 4 IPPR VPP R e a d 21 521 5 µ A VPP ≤ VCC IPPW VPP Program 0.05 0.10 0.05 0.10 mA VPP = VPP1, Program in Progress 8 2 21 63 7 V PP = VPP2, Program in Progress IPPE VPP Erase 0.05 0.10 0.05 0.10 mA VPP = VPP1, Erase in Progress 82 282 2 V PP = VPP2, Erase in Progress Notes: 1. All currents are RMS unless noted. Typical values at typical V CC, TA = +25° C. 2. V CCQ = 1.35 V - 1.8V is available on 130 nm products only. 3. Automatic Power Savings (APS) reduces I CCR to approximately standby levels in static operation. See ICCRQ specification for details. 4. Sampled, not 100% tested. 5. V CC read + program current is the sum of V CC read and VCC program currents. 6. V CC read + erase current is the sum of V CC read and VCC erase currents. 7. I CCES is specified with device deselected. If device is read while in erase suspend, current is I CCES plus ICCR. 8. If V IN>VCC the input load current increases to 10 µA max. 9. I CCS is the average current measured over any 5 ms time interval 5 μs after a CE# de-assertion. 10. Refer to section Section 8.2, “Automatic Power Savings (APS)” on page 46 for ICCAPS measurement details. Table 11: DC Current Characteristics (Sheet 2 of 2) Symbol Parameter (1) VCCQ= 1.8 V Unit Test Condition Note32/64-Mbit 128-Mbit T y pM a xT y pM a x Table 12: DC Voltage Characteristics (Sheet 1 of 2) Symbol Parameter VCCQ= 1.8 V Unit Test Condition Notes32/64-Mbit 128-Mbit Min Max Min Max VIL I n p u t L o w 00 . 400 . 4 V 2 VIH Input High V CCQ – 0.4 V CCQ VCCQ – 0.4 V CCQ V2 VOL Output Low - 0.1 - 0.1 V VCC = VCCMin VCCQ = VCCQMin IOL = 100 µA

Order Number: 290701-18 25 Numonyx™ Wireless Flash Memory (W18) VOH Output High V CCQ – 0.1 - V CCQ – 0.1 - V VCC = VCCMin VCCQ = VCCQMin IOH = –100 µA VPPLK VPP Lock-Out - 0.4 - 0.4 V 3 VLKO VCC Lock (130nm) 1.0 - 1.0 - V VCC Lock (90nm) 0.7 - - - V VILKOQ VCCQ Lock 0.9 - 0.9 - V Notes: 1. V CCQ = 1.35 V - 1.8V is available on 130 nm devices only. 2. V IL can undershoot to –1.0 V for durations of 2 ns or less and V IH can overshoot to VCCQ+1.0 V for durations of 2 ns or less. 3. V PP <= VPPLK inhibits erase and program operations. Don’t use VPPL and VPPH outside their valid ranges. 4. Block erases, programming and lock-bit configurations are inhibited when V CC<VLKO, and not guaranteed in the range between VLKOMIN and VCCMIN, and above VCCMAX. Table 12: DC Voltage Characteristics (Sheet 2 of 2) Symbol Parameter VCCQ= 1.8 V Unit Test Condition Notes32/64-Mbit 128-Mbit Min Max Min Max

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

26 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

7.0 AC Characteristics

Table 13: Read Operations — 90 nm (Sheet 1 of 2) # Symbol Parameter (1,2) VCCQ= 1.7 V – 1.95 V Unit Notes Min Max Asynchronous Specifications R1 t AVAV Read Cycle Time 60 -n s 7 , 8 R2 t AVQV Address to Output Valid - 60 ns 7,8 R3 t ELQV CE# Low to Output Valid - 60 ns 7,8 R4 t GLQV OE# Low to Output Valid - 20 ns 4 R5 t PHQV RST# High to Output Valid - 150 ns R6 t ELQX CE# Low to Output Low-Z 0 - ns 5 R7 t GLQX OE# Low to Output Low-Z 0 - ns 4,5 R8 t EHQZ CE# High to Output High-Z - 14 ns 5 R9 t GHQZ OE# High to Output High-Z - 14 ns 4,5 R10 t OH CE# (OE#) High to Output Low-Z 0 - ns 4,5 R11 t EHEL CE# Pulse Width High 14 - ns 6 R12 t ELTV CE# Low to WAIT Valid - 11 ns 6 R13 t EHTZ CE# High to WAIT High-Z - 11 ns 5,6 Latching Specifications R101 t AVVH Address Setup to ADV# High 7 - ns R102 t ELVH CE# Low to ADV# High 10 - ns R103 t VLQV ADV# Low to Output Valid - 60 ns 7,8 R104 t VLVH ADV# Pulse Width Low 7 - ns R105 t VHVL ADV# Pulse Width High 7 - ns R106 t VHAX Address Hold from ADV# High 7 - ns 3 R108 t APA Page Address Access Time - 20 ns Clock Specifications R200 f CLK CLK Frequency - 66 MHz R201 t CLK CLK Period 15 - ns R202 t CH/L CLK High or Low Time 3.5 - ns R203 t CHCL CLK Fall or Rise Time - 3 ns

Order Number: 290701-18 27 Numonyx™ Wireless Flash Memory (W18) Notes: 1. See Figure 20, “AC Input/Output Reference Waveform” on page 44 for timing measurements and maximum allowable input slew rate. 2. AC specifications assume the data bus voltage is less than or equal to V CCQ when a read operation is initiated. 3. Address hold in synchronous-burst mode is defined as t CHAX or tVHAX, whichever timing specification is satisfied first. 4. OE# may be delayed by up to t ELQV– tGLQV after the falling edge of CE# without impact to t ELQV. 5. Sampled, not 100% tested. 6. Applies only to subsequent synchronous reads. 7. During the initial access of a synchronous burst read, data from the first word may begin to be driven onto the data bus as early as the first clock edge after t AVQV. 8. All the preceding specifications apply to all densities. Synchronous Specifications R301 t AVCH Address Valid Setup to CLK 7 - ns R302 t VLCH ADV# Low Setup to CLK 7 - ns R303 t ELCH CE# Low Setup to CLK 7 - ns R304 t CHQV CLK to Output Valid - 11 ns 8 R305 t CHQX Output Hold from CLK 3 - ns R306 t CHAX Address Hold from CLK 7 - ns 3 R307 t CHTV CLK to WAIT Valid - 11 ns 8 Table 13: Read Operations — 90 nm (Sheet 2 of 2) # Symbol Parameter (1,2) VCCQ= 1.7 V – 1.95 V Unit Notes Min Max Table 14: Read Operations — 130 nm (Sheet 1 of 2) Symbol Parameter (1,2) VCCQ= 1.7 V – 2.24 V Unit Notes-60 Min Max Asynchronous Specifications R1 t AVAV Read Cycle Time 60 - ns 7,8 R2 t AVQV Address to Output Valid - 60 ns 7,8 R3 t ELQV CE# Low to Output Valid - 60 ns 7,8 R4 t GLQV OE# Low to Output Valid - 20 ns 4 R5 t PHQV RST# High to Output Valid - 150 ns R6 t ELQX CE# Low to Output Low-Z 0 - ns 5 R7 t GLQX OE# Low to Output Low-Z 0 - ns 4,5 R8 t EHQZ CE# High to Output High-Z - 14 ns 5 R9 t GHQZ OE# High to Output High-Z - 14 ns 4,5 R10 t OH CE# (OE#) High to Output Low-Z 0 - ns 4,5 R11 t EHEL CE# Pulse Width High - 14 ns 6 R12 t ELTV CE# Low to WAIT Valid - 11 ns 5,6 R13 t EHTZ CE# High to WAIT High-Z 14 - ns 6 Latching Specifications

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

28 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) R101 t AVVH Address Setup to ADV# High 7 - ns R102 t ELVH CE# Low to ADV# High 10 - ns R103 t VLQV ADV# Low to Output Valid - 60 ns 7,8 R104 t VLVH ADV# Pulse Width Low 7 - ns R105 t VHVL ADV# Pulse Width High 7 - ns R106 t VHAX Address Hold from ADV# High 7 - ns 3 R108 t APA Page Address Access Time - 20 ns Clock Specifications R200 f CLK CLK Frequency - 66 MHz R201 t CLK CLK Period 15 - ns R202 t CH/L CLK High or Low Time 3.5 - ns R203 t CHCL CLK Fall or Rise Time - 3 ns Synchronous Specifications R301 t AVCH Address Valid Setup to CLK 7 - ns R302 t VLCH ADV# Low Setup to CLK 7 - ns R303 t ELCH CE# Low Setup to CLK 7 - ns R304 t CHQV CLK to Output Valid - 11 ns 8 R305 t CHQX Output Hold from CLK 3 - ns R306 t CHAX Address Hold from CLK 7 - ns 3 R307 t CHTV CLK to WAIT Valid - 11 ns 8 Note: For all numbered note references in this table, refer to the notes in Table 13, “Read Operations — 90 nm” on page 26. Table 14: Read Operations — 130 nm (Sheet 2 of 2) Symbol Parameter (1,2) VCCQ= 1.7 V – 2.24 V Unit Notes-60 Min Max

Order Number: 290701-18 29 Numonyx™ Wireless Flash Memory (W18) Notes: 1. WAIT shown asserted (RCR[10]=0) 2. ADV# assumed to be driven to VIL in this waveform Figure 6: Asynchronous Read Operation Waveform VIH VIL Valid Address VIH VIL VIH VIL VIH VIL High ZVOH VOL Valid Output VIH VIL R10 Address [A] CE# [E] OE# [G] WE# [W] Data [D/Q] RST# [P] VOH VOL High Z WAIT [T] High Z Note 1

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

30 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Figure 7: Latched Asynchronous Read Operation Waveform VOH VOL High Z Valid Output VIH VIL VIH VIL VIH VIL Valid Address VIH VIL VIH VIL VIH VIL Data [Q] WE# [W] OE# [G] CE# [E] A[MAX:2] [A] ADV# [V] RST# [P] R102 R104 R10 R103 R101 R105 R106 A[1:0] [A] VIH VIL Valid Address Valid Address Valid Address

Order Number: 290701-18 31 Numonyx™ Wireless Flash Memory (W18) Note: WAIT shown asserted (RCR[10] = 0). Figure 8: Page-Mode Read Operation Waveform R105 VIH VIL VIH VIL VIH VIL VIH VIL VOH VOL High Z Valid Output Valid Output Valid Output Valid Output VIH VIL VIH VIL Valid Address VIH VIL Valid Address Valid Address Valid Address Valid Address R102 R104 ADV# [V] CE# [E] OE# [G] WE# [W] Data [D/Q] RST# [P] A[MAX:2] [A] A[1:0] [A] R101 R106 R103 R108 R10R5 VOH VOL High Z WAIT [T] High Z Note 1

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

32 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Notes: 1. Section 14.2, “First Access Latency Count (RCR[13:11])” on page 79 describes how to insert clock cycles during the initial access. 2. WAIT (shown asserted; RCR[10]=0) can be configured to assert either during, or one data cycle before, valid data. 3. This waveform illustrates the case in which an x-word burst is initiated to the main array and it is terminated by a CE# de- assertion after the first word in the burst. If this access had been done to Status, ID, or Query reads, the asserted (low) WAIT signal would have remained asserted (low) as long as CE# is asserted (low). Figure 9: Single Synchronous Read-Array Operation Waveform R12 R13

Order Number: 290701-18 33 Numonyx™ Wireless Flash Memory (W18) Notes: 1. Section 14.2, “First Access Latency Count (RCR[13:11])” on page 79 describes how to insert clock cycles during the initial access. 2. WAIT (shown asserted; RCR[10] = 0) can be configured to assert either during, or one data cycle before, valid data. Figure 10: Synchronous 4-Word Burst Read Operation Waveform R12 R11 R13

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

34 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Notes: 1. Section 14.2, “First Access Latency Count (RCR[13:11])” on page 79 describes how to insert clock cycles during the initial access. 2. WAIT (shown asserted; RCR[10]=0) can be configured to assert either during, or one data cycle before, valid data (assumed wait delay of two clocks, for example). Figure 11: WAIT Functionality for EOWL (End-of-Word Line) Condition Waveform R12

Order Number: 290701-18 35 Numonyx™ Wireless Flash Memory (W18) Notes: 1. Section 14.2, “First Access Latency Count (RCR[13:11])” on page 79 describes how to insert clock cycles during the initial access. 2. WAIT shown asserted (RCR[10]=0). Figure 12: WAIT Signal in Synchronous Non-Read Array Operation Waveform R12 R13

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

36 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Note: During Burst Suspend, Clock signal can be held high or low.

7.1 AC Write Characteristics

Figure 13: Burst Suspend Q0 Q1 Q1 Q2 R304R304 R13 R12 R9R4R9R4 R8R3 R106 R101 R105R105 R1R1 R305R305R305R304 CLK Addres s [A] ADV# CE# [E] OE# [G] WAIT [T] WE# [W] DATA [D/Q] Table 15: AC Write Characteristics — 90 nm (Sheet 1 of 2) # Sym Parameter (1,2) VCCQ = 1.7 V – 1.95 V Unit Notes Min Max W1 t PHWL (tPHEL) RST# High Recovery to WE# (CE#) Low 150 - ns 3 W2 t ELWL (tWLEL) CE# (WE#) Setup to WE# (CE#) Low 0 - ns W3 t WLWH (tELEH) WE# (CE#) Write Pulse Width Low 40 - ns 4 W4 t DVWH (tDVEH) Data Setup to WE# (CE#) High 40 - ns W5 t AVWH (tAVEH) Address Setup to WE# (CE#) High 40 - ns W6 t WHEH (tEHWH) CE# (WE#) Hold from WE# (CE#) High 0 - ns W7 t WHDX (tEHDX) Data Hold from WE# (CE#) High 0 - ns W8 t WHAX (tEHAX) Address Hold from WE# (CE#) High 0 - ns W9 t WHWL (tEHEL) WE# (CE#) Pulse Width High 20 - ns 5,6,7 W10 t VPWH (tVPEH) VPP Setup to WE# (CE#) High 200 - ns 3 W11 t QVVL VPP Hold from Valid SRD 0 - ns 3,8 W12 t QVBL WP# Hold from Valid SRD 0 - ns 3,8

Order Number: 290701-18 37 Numonyx™ Wireless Flash Memory (W18) W13 t BHWH (tBHEH) WP# Setup to WE# (CE#) High 200 - ns 3 W14 t WHGL (tEHGL) Write Recovery before Read 0 - ns W16 t WHQV WE# High to Valid Data t AVQV +20 - ns 3,6,10 W18 t WHAV WE# High to Address Valid 0 - ns 3,9,10 W19 t WHCV WE# High to CLK Valid 12 - ns 3,10 W20 t WHVH WE# High to ADV# High 12 - ns 3,10 W21 t VHWL ADV# High to WE# Low < 21 ns 11 W22 t CHWL CLK to WE# Low < 21 ns 11 W27 t WHEL WE# High to CE# Low 0 W28 t WHVL WE# High to ADV# Low 0 Notes: 1. Write timing characteristics during erase suspend are the same as during write-only operations. 2. A write operation can be terminated with either CE# or WE#. 3. Sampled, not 100% tested. 4. Write pulse width low (t WLWH or tELEH) is defined from CE# or WE# low (whichever occurs last) to CE# or WE# high (whichever occurs first). Hence, t WLWH = tELEH = tWLEH = tELWH. 5. Write pulse width high (t WHWL or tEHEL) is defined from CE# or WE# high (whichever is first) to CE# or WE# low (whichever is last). Hence, t WLWH = tEHEL = tWHEL = tEHWL. 6. System designers should take this into account and may insert a software No-Op instruction to delay the first read after issuing a command. 7. For commands other than resume commands. 8. V PP should be held at VPP1 or VPP2 until block erase or program success is determined. 9. Applicable during asynchronous reads following a write. 10. t WHCH/L OR tWHVH must be met when transitioning from a write cycle to a synchronous burst read. t WHCH/L and tWHVH both refer to the address latching event (either the rising/falling clock edge or the rising ADV# edge, whichever occurs first). 11. The specifications t VHWL and tCHWL can be ignored if there is no clock toggling during the write bus cycle. Table 15: AC Write Characteristics — 90 nm (Sheet 2 of 2) # Sym Parameter (1,2) VCCQ = 1.7 V – 1.95 V Unit Notes Min Max Table 16: AC Write Characteristics — 130 nm (Sheet 1 of 2) # Sym Parameter (1,2) VCCQ = 1.7 V – 2.24 V Unit Notes-60 Min Max W1 t PHWL (tPHEL) RST# High Recovery to WE# (CE#) Low 150 - ns 3 W2 t ELWL (tWLEL) CE# (WE#) Setup to WE# (CE#) Low 0 - ns W3 t WLWH (tELEH) WE# (CE#) Write Pulse Width Low 40 - ns 4 W4 t DVWH (tDVEH) Data Setup to WE# (CE#) High 40 - ns W5 t AVWH (tAVEH) Address Setup to WE# (CE#) High 40 - ns W6 t WHEH (tEHWH) CE# (WE#) Hold from WE# (CE#) High 0 - ns W7 t WHDX (tEHDX) Data Hold from WE# (CE#) High 0 - ns W8 t WHAX (tEHAX) Address Hold from WE# (CE#) High 0 - ns W9 t WHWL (tEHEL) WE# (CE#) Pulse Width High 20 - ns 5,6,7 W10 t VPWH (tVPEH) VPP Setup to WE# (CE#) High 200 - ns 3 W11 t QVVL VPP Hold from Valid SRD 0 - ns 3,8 W12 t QVBL WP# Hold from Valid SRD 0 - ns 3,8

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

38 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) W13 t BHWH (tBHEH) WP# Setup to WE# (CE#) High 200 - ns 3 W14 t WHGL (tEHGL) Write Recovery before Read 0 - ns W16 t WHQV WE# High to Valid Data t AVQV +20 - ns 3,6,10 W18 t WHAV WE# High to Address Valid 0 - ns 3,9,10 W19 t WHCV WE# High to CLK Valid 12 - ns 3,10 W20 t WHVH WE# High to ADV# High 12 - ns 3,10 Notes: For all numbered note references in this table, refer to the notes in Table 15, “AC Write Characteristics — 90 nm” on page 36. Table 16: AC Write Characteristics — 130 nm (Sheet 2 of 2) # Sym Parameter (1,2) VCCQ = 1.7 V – 2.24 V Unit Notes-60 Min Max

Order Number: 290701-18 39 Numonyx™ Wireless Flash Memory (W18) Notes: 1. V CC power-up and standby. 2. Write Program or Erase Setup command. 3. Write valid address and data (for program) or Erase Confirm command. 4. Automated program/erase delay. 5. Read Status Register data (SRD) to determine program/erase operation completion. 6. OE# and CE# must be asserted and WE# must be deasserted for read operations. 7. CLK is ignored. (but may be kept active/toggling) Figure 14: Write Operations Waveform Note 1 Note 2 Note 3 Note 4 Note 5 Address [A] VIH VIL Valid Address Valid Address CE# (WE#) [E(W)] VIH VIL Note 6 OE# [G] VIH VIL WE# (CE#) [W(E)] VIH VIL RST# [P] VIH VIL W11 W12 R105 VPP [V] VPPH VPPLK VIL WP# [B] VIH VIL Data [Q] VIH VIL Data In Valid SRD ADV# [V] VIH VIL W16W1 W10 W13 W14 R101 R106 Data In Valid Address Note 6 R104 W18 W19 W20 CLK [C] VIH VIL

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

40 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Figure 15: Asynchronous Read to Write Operation Waveform Figure 16: Asynchronous Write to Read Operation Q D W4R10 W3W3 R9R4 R8R3 W8W5 Address [A] CE# [E} OE# [G] WE# [W] Data [D/Q] RST# [P] D Q R2W7 W14 W18W3W3 R10W6W2 R1R1W8W5 Addres s [A] CE# [E} WE# [W] OE# [G] Data [D/Q] RST# [P]

Order Number: 290701-18 41 Numonyx™ Wireless Flash Memory (W18) Figure 17: Synchronous Read to Write Operation Latency Count Q D D R13 R305 R304 R307R12 W15 W19 W9W3W3 W6R11R11 R303 W20 R104R104R106 R102 R105R105 W18 R101 R306 R302 R301 CLK [ C] Address [ A] AD V# [V] CE# [ E] OE# [G] WE# WAIT [T] Data [D /Q]

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

42 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

7.2 Erase and Program Times

Note: Specifications are for 130 nm and 90 nm devices unless otherwise stated. Figure 18: Synchronous Write To Read Operation Latency Count D Q Q R304 R305 R304 R307R12 W1 8 W19W3W3 R11 R303 R11 W2 0 R104 R106 R104 R306W8W5 R302 R301 CLK Address [A] ADV# CE# [E} WE# [W] OE# [G] WAIT [T] Data [D/Q] RST# [P] Table 17: Erase and Program Times (Sheet 1 of 2) Operation Symbol Parameter Description (1) Notes VPP1 VPP2 Unit T y pM a xT y pM a x Erasing and Suspending Erase Time W500 tERS/PB 4-Kword Parameter Block 2,3 0.3 2.5 0.25 2.5 s W501 t ERS/MB 32-Kword Main Block 2,3 0.7 4 0.4 4 s Suspend Latency W600 t SUSP/P P r o g r a m S u s p e n d 2 51 051 0 µ s W601 t SUSP/E Erase Suspend 2 5 20 5 20 µs Programming Program Time W200 tPROG/W Single Word 2 12 150 8 130 µs W201 tPROG/PB 4-Kword Parameter Block 2,3 0.05 .23 0.03 0.07 s W202 tPROG/MB 32-Kword Main Block 2,3 0.4 1.8 0.24 0.6 s Enhanced Factory Programming (5)

Order Number: 290701-18 43 Numonyx™ Wireless Flash Memory (W18)

7.3 Reset Specifications

Note: Specifications are for 130 nm and 90 nm devices unless otherwise stated. Program W400 tEFP/W Single Word 4 N/A N/A 3.1 16 µs W401 tEFP/PB 4-Kword Parameter Block 2,3 N/A - 15 - ms W402 tEFP/MB 32-Kword Main Block 2,3 N/A - 120 - ms Operation Latency W403 t EFP/SETUP EFP Setup - N/A - 5 µs W404 t EFP/TRAN Program to Verify Transition N/A N/A 2.7 5.6 µs W405 t EFP/VERIFY Verify N/A N/A 1.7 130 µs Notes: 1. Unless noted otherwise, all parameters are measured at T A = +25 °C and nominal voltages, and they are sampled, not 100% tested. 2. Excludes external system-level overhead. 3. Exact results may vary based on system overhead. 4. W400-Typ is the calculated delay for a single programming pulse. W400-Max includes the delay when programming within a new word-line. 5. Some EFP performance degradation may occur if block cycling exceeds 10. Table 17: Erase and Program Times (Sheet 2 of 2) Operation Symbol Parameter Description (1) Notes VPP1 VPP2 Unit Typ Max Typ Max Table 18: Reset Specifications # Symbol Parameter (1) Notes Min Max Unit P1 t PLPH RST# Low to Reset during Read 1, 2, 3, 4 100 - ns P2 t PLRH RST# Low to Reset during Block Erase 1, 3, 4, 5 - 20 µs RST# Low to Reset during Program 1, 3, 4, 5 - 10 µs P3 t VCCPH VCC Power Valid to Reset 1,3,4,5,6 60 - µs Notes: 1. These specifications are valid for all product versions (packages and speeds). 2. The device may reset if t PLPH< tPLPHMin, but this is not guaranteed. 3. Not applicable if RST# is tied to VCC. 4. Sampled, but not 100% tested. 5. If RST# is tied to VCC, the device is not ready until t VCCPH occurs after when VCC ≥ VCCMin. 6. If RST# is tied to any supply/signal with V CCQ voltage levels, the RST# input voltage must not exceed V CC until VCC ≥ VCCMin.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

44 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

7.4 AC I/O Test Conditions

Note: Input timing begins, and output timing ends, at V CCQ/2. Input rise and fall times (10% to 90%) < 5 ns. Worst case speed conditions are when VCC = VCCMin. Note: See Table 18 on page 43 for component values. Figure 19: Reset Operations Waveforms Figure 20: AC Input/Output Reference Waveform Figure 21: Transient Equivalent Testing Load Circuit (A) Reset during read mode (B) Reset during program or block erase P1 ≤ P2 (C) Reset during program or block erase P1 ≥ P2 VIH VIL VIH VIL VIH VIL RST# [P] RST# [P] RST# [P] Abort Complete Abort Complete VCC VCC(D) VCC Power-up to RST# high P1 R5 P2 R5 VCCQ VCCQ/2 V CCQ/2Test PointsInput Outpu t Device Under Test VCCQ CL R2 Out

Order Number: 290701-18 45 Numonyx™ Wireless Flash Memory (W18)

7.5 Device Capacitance

TA = +25 °C, f = 1 MHz Table 19: Test Configuration Component Values for Worst Case Speed Conditions Test Configuration C L (pF) R 1 (kΩ)R 2 (kΩ) VCCQMin (1.7 V) Standard Test 30 16.7 16.7 Note: CL includes jig capacitance. Figure 22: Clock Input AC Waveform CLK [C] VIH VIL R203R202 R201 Table 20: Capacitance Symbol Parameter § Typ Max Unit Condition CIN Input Capacitance 6 8 pF V IN = 0.0 V COUT Output Capacitance 8 12 pF V OUT = 0.0 V CCE CE# Input Capacitance 10 12 pF V IN = 0.0 V §Sampled, not 100% tested.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

46 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

8.0 Power and Reset Specifications

Numonyx™ Wireless Flash Memory (W18) devices have a layered approach to power savings that can significantly reduce overall system power consumption. The APS feature reduces power consumption when the device is selected but idle. If CE# is deasserted, the memory enters its standby mode, where current consumption is even lower. Asserting RST# provides current savings similar to standby mode. The combination of these features can minimize memory power consumption, and therefore, overall system power consumption.

8.1 Active Power

With CE# at VIL and RST# at VIH, the device is in the active mode. Refer to Section 6.1, “DC Current Characteristics” on page 23, for ICC values. When the device is in “active” state, it consumes the most power from the system. Minimizing device active current therefore reduces system power consumption, especially in battery-powered applications.

8.2 Automatic Power Savings (APS)

Automatic Power Saving (APS) provides low-power operation during a read’s active state. During APS mode, ICCAPS is the average current measured over any 5 ms time interval 5 µs after the following events happen:

• There is no internal sense activity;
• CE# is asserted;
• The address lines are quiescent, and at V SSQ or VCCQ. OE# may be asserted during APS.

8.3 Standby Power

With CE# at VIH and the device in read mode, the flash memory is in standby mode, which disables most device circuitry and substantially reduces power consumption. Outputs are placed in a high-impedance state independent of the OE# signal state. If CE# transitions to VIH during erase or program operations, the device continues the operation and consumes corresponding active power until the operation is complete. ICCS is the average current measured over any 5 ms time interval 5 µs after a CE# de- assertion.

8.4 Power-Up/Down Characteristics

The device is protected against accidental block erasure or programming during power transitions. Power supply sequencing is not required if V CC, VCCQ, and VPP are connected together; so it doesn’t matter whether VPP or VCC powers-up first. If VCCQ and/or VPP are not connected to the system supply, then VCC should attain VCCMIN before applying VCCQ and VPP. Device inputs should not be driven before supply voltage = V CCMIN. Power supply transitions should only occur when RST# is low.

8.4.1 System Reset and RST#

The use of RST# during system reset is important with automated program/erase devices because the system expects to read from the flash memory when it comes out of reset. If a CPU reset occurs without a flash memory reset, proper CPU initialization

Order Number: 290701-18 47 Numonyx™ Wireless Flash Memory (W18) will not occur because the flash memory may be providing status information instead of array data. To allow proper CPU/flash initialization at system reset, connect RST# to the system CPU RESET# signal. System designers must guard against spurious writes when VCC voltages are above V LKO. Because both WE# and CE# must be low for a command write, driving either signal to VIH inhibits writes to the device. The CUI architecture provides additional protection because alteration of memory contents can only occur after successful completion of the two-step command sequences. The device is also disabled until RST# is brought to V IH, regardless of its control input states. By holding the device in reset (RST# connected to system PowerGood) during power-up/down, invalid bus conditions during power-up can be masked, providing yet another level of memory protection.

8.4.2 VCC, VPP, and RST# Transitions

The CUI latches commands issued by system software and is not altered by VPP or CE# transitions or WSM actions. Read-array mode is its power-up default state after exit from reset mode or after VCC transitions above VLKO (Lockout voltage). After completing program or block erase operations (even after VPP transitions below VPPLK), the Read Array command must reset the CUI to read-array mode if flash memory array access is desired.

8.5 Power Supply Decoupling

When the device is accessed, many internal conditions change. Circuits are enabled to charge pumps and switch voltages. This internal activity produces transient noise. To minimize the effect of this transient noise, device decoupling capacitors are required. Transient current magnitudes depend on the device outputs’ capacitive and inductive loading. Two-line control and proper decoupling capacitor selection suppresses these transient voltage peaks. Each flash device should have a 0.1 µF ceramic capacitor connected between each power (VCC, VCCQ, VPP) , and ground (VSS, VSSQ) signal. High-frequency, inherently low-inductance capacitors should be as close as possible to package signals.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

48 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

9.0 Bus Operations Overview

This section provides an overview of device bus operations. The Numonyx™ Wireless Flash Memory (W18) family includes an on-chip WSM to manage block erase and program algorithms. Its Command User Interface (CUI) allows minimal processor overhead with RAM-like interface timings. Device commands are written to the CUI using standard microprocessor timings.

9.1 Bus Operations

Bus cycles to/from the W18 device conform to standard microprocessor bus operations. Table 21 summarizes the bus operations and the logic levels that must be applied to the device’s control signal inputs.

9.1.1 Reads

Device read operations are performed by placing the desired address on A[22:0] and asserting CE# and OE#. ADV# must be low, and WE# and RST# must be high. All read operations are independent of the voltage level on VPP. CE#-low selects the device and enables its internal circuits. OE#-low or WE#-low determine whether DQ[15:0] are outputs or inputs, respectively. OE# and WE# must not be low at the same time - indeterminate device operation will result. In asynchronous-page mode, the rising edge of ADV# can be used to latch the address. If only asynchronous read mode is used, ADV# can be tied to ground. CLK is not used in asynchronous-page mode and should be tied high. In synchronous-burst mode, ADV# is used to latch the initial address - either on the rising edge of ADV# or the rising (or falling) edge of CLK with ADV# low, whichever occurs first. CLK is used in synchronous-burst mode to increment the internal address counter, and to output read data on DQ[15:0]. Each device partition can be placed in any of several read states:

• Read Array: Returns flash array data from the addressed location.
• Read Identifier (ID): Returns manufacturer ID and device ID codes, block lock status, and protection register data. Read Identifier information can be accessed from any 4-Mbit partition base address. Table 21: Bus Operations Summary Bus Operation RST# CLK ADV# CE# OE# WE# WAIT DQ[15:0 ] Notes Read Asynchronous V IH XL L L H Asserted Output Synchronous V IH Running L L L H Driven Output 1 Burst Suspend V IH Halted X L H H Active Output Write V IH X L L H L Asserted Input 2 Output Disable V IH X X L H H Asserted High-Z 3 Standby V IH X X H X X High-Z High-Z 3 Reset V IL X X X X X High-Z High-Z 3,4 Notes: 1. WAIT is only valid during synchronous array-read operations. 2. Refer to the Table 23, “Bus Cycle Definitions” on page 52 for valid DQ[15:0] during a write operation. 3. X = Don’t Care (H or L). 4. RST# must be at V SS ± 0.2 V to meet the maximum specified power-down current.

Order Number: 290701-18 49 Numonyx™ Wireless Flash Memory (W18)

• CFI Query: Returns Common Flash Interface (CFI) information. CFI information can be accessed starting at 4-Mbit partition base addresses.
• Read Status Register: Returns Status Register (SR) data from the addressed partition. The appropriate CUI command must be written to the partition in order to place it in the desired read state (see Table 22, “Command Codes and Descriptions” on page 51). Non-array read operations (Read ID, CFI Query, and Read Status Register) execute as single synchronous or asynchronous read cycles. WAIT is asserted throughout non- array read operations.

9.1.2 Writes

Device write operations are performed by placing the desired address on A[22:0] and asserting CE# and WE#. OE# and RST# must be high. Data to be written at the desired address is placed on DQ[15:0]. ADV# must be held low throughout the write cycle or it can be toggled to latch the address. If ADV# is held low, the address and data are latched on the rising edge of WE#. CLK is not used during write operations, and is ignored; it can be either free-running or halted at V IL or VIH. All write operations are asynchronous. Table 22, “Command Codes and Descriptions” on page 51 shows the available device commands. Appendix A, “Write State Machine States” on page 86 provides information on moving between different device operations by using CUI commands.

9.1.3 Output Disable

When OE# is deasserted, device outputs DQ[15:0] are disabled and placed in a high - impedance (High-Z) state.

9.1.4 Burst Suspend

The Burst Suspend feature allows the system to temporarily suspend a synchronous- burst read operation. This can be useful if the system needs to access another device on the same address and data bus as the flash during a burst-read operation. Synchronous-burst accesses can be suspended during the initial latency (before data is received) or after the device has output data. When a burst access is suspended, internal array sensing continues and any previously latched internal data is retained. Burst Suspend occurs when CE# is asserted, the current address has been latched (either ADV# rising edge or valid CLK edge), CLK is halted, and OE# is deasserted. CLK can be halted when it is at V IH or VIL. To resume the burst access, OE# is reasserted and CLK is restarted. Subsequent CLK edges resume the burst sequence where it left off. Within the device, CE# gates WAIT. Therefore, during Burst Suspend WAIT is still driven. This can cause contention with another device attempting to control the system’s READY signal during a Burst Suspend. Systems using the Burst Suspend feature should not connect the device’s WAIT signal directly to the system’s READY signal. Refer to Figure 13, “Burst Suspend” on page 36.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

50 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

9.1.5 Standby

De-asserting CE# deselects the device and places it in standby mode, substantially reducing device power consumption. In standby mode, outputs are placed in a high- impedance state independent of OE#. If deselected during a program or erase algorithm, the device shall consume active power until the program or erase operation completes.

9.1.6 Reset

The device enters a reset mode when RST# is asserted. In reset mode, internal circuitry is turned off and outputs are placed in a high-impedance state. After returning from reset, a time tPHQV is required until outputs are valid, and a delay (tPHWV) is required before a write sequence can be initiated. After this wake-up interval, normal operation is restored. The device defaults to read-array mode, the Status Register is set to 80h, and the Configuration Register defaults to asynchronous page-mode reads. If RST# is asserted during an erase or program operation, the operation aborts and the memory contents at the aborted block or address are invalid. See Figure 19, “Reset Operations Waveforms” on page 44 for detailed information regarding reset timings. Like any automated device, it is important to assert RST# during system reset. When the system comes out of reset, the processor expects to read from the flash memory array. Automated flash memories provide status information when read during program or erase operations. If a CPU reset occurs with no flash memory reset, proper CPU initialization may not occur because the flash memory may be providing status information instead of array data. Numonyx flash memories allow proper CPU initialization following a system reset through the use of the RST# input. In this application, RST# is controlled by the same CPU reset signal.

9.2 Device Commands

The device’s on-chip WSM manages erase and program algorithms. This local CPU (WSM) controls the device’s in-system read, program, and erase operations. Bus cycles to or from the flash memory conform to standard microprocessor bus cycles. RST#, CE#, OE#, WE#, and ADV# control signals dictate data flow into and out of the device. WAIT informs the CPU of valid data during burst reads. Table 21, “Bus Operations Summary” on page 48 summarizes bus operations. Device operations are selected by writing specific commands into the device’s CUI. Table 22, “Command Codes and Descriptions” on page 51 lists all possible command codes and descriptions. Table 23, “Bus Cycle Definitions” on page 52 lists command definitions. Because commands are partition-specific, it is important to issue write commands within the target address range.

Order Number: 290701-18 51 Numonyx™ Wireless Flash Memory (W18) Table 22: Command Codes and Descriptions (Sheet 1 of 2) Operation Code Device Command Description Read FFh Read Array Places selected partition in Read Array mode. 70h Read Status Register Places selected partition in Status Register read mode. After issuing this command, reading from the partition outputs SR data on DQ[15:0]. A partition automatically enters this mode after issuing the Program or Erase command. 90h Read Identifier Places the selected partition in Read ID mode. Device reads from partition addresses output manufacturer/device codes, Configuration Register data, block lock status, or protection register data on DQ[15:0]. 98h CFI Query Puts the addressed partition in CFI Query mode. Device reads from the partition addresses output CFI information on DQ[7:0]. 50h Clear Status Register The WSM can set the Status Register’s block lock (SR[1]), VPP (SR[3]), program (SR[4]), and erase (SR[5]) status bits, but it cannot clear them. SR[5:3,1] can only be cleared by a device reset or through the Clear Status Register command. Program 40h Word Program Setup This preferred program command’s first cycle prepares the CUI for a program operation. The second cycle latches address and data, and executes the WSM program algorithm at this location. Status register updates occur when CE# or OE# is toggled. A Read Array command is required to read array data after programming. 10h Alternate Setup Equivalent to a Program Setup command (40h). 30h EFP Setup This program command activates EFP mode. The first write cycle sets up the command. If the second cycle is an EFP Confirm command (D0h), subsequent writes provide program data. All other commands are ignored after EFP mode begins. D0h EFP Confirm If the first command was EFP Setup (30h), the CUI latches the address and data, and prepares the device for EFP mode. Erase 20h Erase Setup This command prepares the CUI for Block Erase. The device erases the block addressed by the Erase Confirm command. If the next command is not Erase Confirm, the CUI sets Status Register bits SR[5:4] to indicate command sequence error and places the partition in the read Status Register mode. D0h Erase Confirm If the first command was Erase Setup (20h), the CUI latches address and data, and erases the block indicated by the erase confirm cycle address. During program or erase, the partition responds only to Read Status Register , Program Suspend, and Erase Suspend commands. CE# or OE# toggle updates Status Register data. Suspend B0h Program Suspend or Erase Suspend This command, issued at any device address, suspends the currently executing program or erase operation. Status register data indicates the operation was successfully suspended if SR[2] (program suspend) or SR[6] (erase suspend) and SR[7] are set. The WSM remains in the suspended state regardless of control signal states (except RST#). D0h Suspend Resume This command, issued at any device address, resumes the suspended program or erase operation. Block Locking 60h Lock Setup This command prepares the CUI lock configuration. If the next command is not Lock Block, Unlock Block, or Lock-Down, the CUI sets SR[5:4] to indicate command sequence error. 01h Lock Block If the previous command was Lock Setup (60h), the CUI locks the addressed block. D0h Unlock Block If the previous command was Lock Setup (60h), the CUI latches the address and unlocks the addressed block. If previously locked-down, the operation has no effect. 2Fh Lock-Down If the previous command was Lock Setup (60h), the CUI latches the address and locks-down the addressed block.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

52 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Protection C0h Protection Program Setup This command prepares the CUI for a protection register program operation. The second cycle latches address and data, and starts the WSM’s protection register program or lock algorithm. Toggling CE# or OE# updates the flash Status Register data. To read array data after programming, issue a Read Array command. Configuration 60h Configuration Setup This command prepares the CUI for device configuration. If Set Configuration Register is not the next command, the CUI sets SR[5:4] to indicate command sequence error. 03h Set Configuration Register If the previous command was Configuration Setup (60h), the CUI latches the address and writes the data from A[15:0] into the configuration register. Subsequent read operations access array data. Note: Do not use unassigned commands. Numonyx reserves the right to redefine these codes for future functions. Table 23: Bus Cycle Definitions Operation Command Bus Cycles First Bus Cycle Second Bus Cycle Oper Addr 1 Data2,3 Oper Addr 1 Data2,3 Read Read Array/Reset ≥1 Write PnA FFh Read Read Address Array Data Read Identifier ≥ 2 Write PnA 90h Read PBA+IA IC CFI Query ≥ 2 Write PnA 98h Read PBA+QA QD Read Status Register 2 Write PnA 70h Read PnA SRD Clear Status Register 1 Write XX 50h Program and Erase Block Erase 2 Write BA 20h Write BA D0h Word Program 2 Write WA 40h/10h Write WA WD EFP >

2 Write WA 30h Write WA D0h

Program/Erase Suspend 1 Write XX B0h Program/Erase Resume 1 Write XX D0h Lock L o c k B l o c k 2W r i t eB A 6 0 h W r i t eB A 0 1 h Unlock Block 2 Write BA 60h Write BA D0h Lock-Down Block 2 Write BA 60h Write BA 2Fh Table 22: Command Codes and Descriptions (Sheet 2 of 2) Operation Code Device Command Description

Order Number: 290701-18 53 Numonyx™ Wireless Flash Memory (W18)

9.3 Command Sequencing

When issuing a 2-cycle write sequence to the flash device, a read operation is allowed to occur between the two write cycles. The setup phase of a 2-cycle write sequence places the addressed partition into read-status mode, so if the same partition is read before the second “confirm” write cycle is issued, Status Register data will be returned. Reads from other partitions, however, can return actual array data assuming the addressed partition is already in read-array mode. Figure 23 and Figure 24 illustrate these two conditions. Protection Protection Program 2 Write PA C0h Write PA PD Lock Protection Program 2 Write LPA C0h Write LPA FFFDh Configuration Set Configuration Register 2 Write CD 60h Write CD 03h Notes: 1. First-cycle command addresses should be the same as the operation’s target address. Examples: the first-cycle address for the Read Identifier command should be the same as the Identification code address (IA); the first-cycle address for the Word Program command should be the same as the word address (WA) to be programmed; the first-cycle address for the Erase/Program Suspend command should be the same as the address within the block to be suspended; etc. XX = Any valid address within the device. IA = Identification code address. BA = Block Address. Any address within a specific block. LPA = Lock Protection Address is obtained from the CFI (through the CFI Query command). The Numonyx Wireless Flash Memory (W18) family’s LPA is at 0080h. PA = User programmable 4-word protection address. PnA = Any address within a specific partition. PBA = Partition Base Address. The very first address of a particular partition. QA = CFI code address. WA = Word address of memory location to be written. 2. SRD = Status register data. WD = Data to be written at location WA. IC = Identifier code data. PD = User programmable 4-word protection data. QD = Query code data on DQ[7:0]. CD = Configuration register code data presented on device addresses A[15:0]. A[MAX:16] address bits can select any partition. See Table 31, “Read Configuration Register Descriptions” on page 78 for Configuration Register bits descriptions. 3. Commands other than those shown above are reserved by Numonyx for future device implementations and should not be used. Table 23: Bus Cycle Definitions Operation Command Bus Cycles First Bus Cycle Second Bus Cycle Oper Addr 1 Data2,3 Oper Addr 1 Data2,3

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

54 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) By contrast, a write bus cycle may not interrupt a 2-cycle write sequence. Doing so causes a command sequence error to appear in the Status Register. Figure 25 illustrates a command sequence error. Figure 23: Normal Write and Read Cycles Figure 24: Interleaving a 2-Cycle Write Sequence with an Array Read Partition A Partition A Par tition A 20h D0h FFh Block Erase Setup Block Erase Conf irm Read Array Address [A] WE# [W] OE# [G] Data [Q] Partition B Partition A Par tition B Partition A FFh 20h Array Data D0h Read Array Erase Setup Bus Read Erase Conf irm Address [A] WE# [W] OE# [G] Data [Q] Figure 25: Improper Command Sequencing Partition X Part ition Y Partition X Partition X 20h FFh D0h SR Data Addres s [A] WE# [W] OE# [G] Data [D/Q]

Order Number: 290701-18 55 Numonyx™ Wireless Flash Memory (W18)

10.0 Read Operations

The device supports two read modes - asynchronous page and synchronous burst mode. Asynchronous page mode is the default read mode after device power-up or a reset. The Read Configuration Register (RCR) must be configured to enable synchronous burst reads of the flash memory array (see Section 14.0, “Set Read Configuration Register” on page 78). Each partition of the device can be in any of four read states: Read Array, Read Identifier, Read Status or CFI Query. Upon power-up, or after a reset, all partitions of the device default to the Read Array state. To change a partition’s read state, the appropriate read command must be written to the device (see Section 9.2, “Device Commands” on page 50). The following sections describe device read modes and read states in detail.

10.1 Asynchronous Page Read Mode

Following a device power-up or reset, asynchronous page mode is the default read mode and all partitions are set to Read Array. However, to perform array reads after any other device operation (e.g. write operation), the Read Array command must be issued in order to read from the flash memory array. Note: Asynchronous page-mode reads can only be performed when Read Configuration Register bit RCR[15] is set (see Section 14.0, “Set Read Configuration Register” on page 78). To perform an asynchronous page mode read, an address is driven onto A[MAX:0], and CE#, OE# and ADV# are asserted. WE# and RST# must be deasserted. WAIT is asserted during asynchronous page mode. ADV# can be driven high to latch the address, or it must be held low throughout the read cycle. CLK is not used for asynchronous page-mode reads, and is ignored. If only asynchronous reads are to be performed, CLK should be tied to a valid V IH level, WAIT signal can be floated and ADV# must be tied to ground. Array data is driven onto DQ[15:0] after an initial access time t AVQV delay. (see Section 7.0, “AC Characteristics” on page 26). In asynchronous page mode, four data words are “sensed” simultaneously from the flash memory array and loaded into an internal page buffer. The buffer word corresponding to the initial address on A[MAX:0] is driven onto DQ[15:0] after the initial access delay. Address bits A[MAX:2] select the 4-word page. Address bits A[1:0] determine which word of the 4-word page is output from the data buffer at any given time.

10.2 Synchronous Burst Read Mode

Read Configuration Register bits RCR[15:0] must be set before synchronous burst operation can be performed. Synchronous burst mode can be performed for both array and non-array reads such as Read ID, Read Status or Read Query (See for details). Synchronous burst mode outputs 4, 8, 16, or . To perform a synchronous burst- read, an initial address is driven onto A[MAX:0], and CE# and OE# are asserted. WE# and RST# must be deasserted. ADV# is asserted, and then deasserted to latch the address. Alternately, ADV# can remain asserted throughout the burst access, in which case the address is latched on the next valid CLK edge after ADV# is asserted. See Section 14.0, “Set Read Configuration Register” on page 78 During synchronous array and non-array read modes, the first word is output from the data buffer on the next valid CLK edge after the initial access latency delay (see Section 14.2, “First Access Latency Count (RCR[13:11])” on page 79). Subsequent data is

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

56 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) output on valid CLK edges following a minimum delay. However, for a synchronous non- array read, the same word of data will be output on successive clock edges until the burst length requirements are satisfied. See During synchronous read operations, WAIT indicates invalid data when asserted, and valid data when deasserted with respect to a valid clock edge. See Section 7.0, “AC Characteristics” on page 26 for additional details.

10.3 Read Array

The Read Array command places (or resets) the partition in read-array mode and is used to read data from the flash memory array. Upon initial device power-up, or after reset (RST# transitions from V IL to VIH), all partitions default to asynchronous read- array mode. To read array data from the flash device, first write the Read Array command (FFh) to the CUI and specify the desired word address. Then read from that address. If a partition is already in read-array mode, issuing the Read Array command is not required to read from that partition. If the Read Array command is written to a partition that is erasing or programming, the device presents invalid data on the bus until the program or erase operation completes. After the program or erase finishes in that partition, valid array data can then be read. If an Erase Suspend or Program Suspend command suspends the WSM, a subsequent Read Array command places the addressed partition in read-array mode. The Read Array command functions independently of V PP.

10.4 Read Identifier

The Read Identifier mode outputs the manufacturer/device identifier, block lock status, protection register codes, and Configuration Register data. The identifier information is contained within a separate memory space on the device and can be accessed along the 4-Mbit partition address range supplied by the Read Identifier command (90h) address. Reads from addresses in Table 24 retrieve ID information. Issuing a Read Identifier command to a partition that is programming or erasing places that partition’s outputs in read ID mode while the partition continues to program or erase in the background. Table 24: Device Identification Codes (Sheet 1 of 2) Item Address1 Data Description Base Offset Manufacturer ID Partition 00h 0089h Numonyx Device ID Partition 01h 8862h 32-Mbit, Top Parameter Device 8863h 32-Mbit, Bottom Parameter Device 8864h 64-Mbit, Top Parameter Device 8865h 64-Mbit, Bottom Parameter Device 8866h 128-Mbit, Top Parameter Device 8867h 128-Mbit, Bottom Parameter Device Block Lock Status (2) Block 02h D0 = 0 Block is unlocked D0 = 1 Block is locked Block Lock-Down Status(2) Block 02h D1 = 0 Block is not locked-down D1 = 1 Block is locked down Configuration Register Partition 05h Register Data

Order Number: 290701-18 57 Numonyx™ Wireless Flash Memory (W18)

10.5 CFI Query

This device contains a separate CFI query database that acts as an “on-chip datasheet.” The CFI information within this device can be accessed by issuing the Read Query command and supplying a specific address. The address is constructed from the base address of a partition plus a particular offset corresponding to the desired CFI field. Appendix B, “Common Flash Interface (CFI)” on page 89 shows accessible CFI fields and their address offsets. Issuing the Read Query command to a partition that is programming or erasing puts that partition in read query mode while the partition continues to program or erase in the background.

10.6 Read Status Register

The device’s Status Register displays program and erase operation status. A partition’s status can be read after writing the Read Status Register command to any location within the partition’s address range. Read-status mode is the default read mode following a Program, Erase, or Lock Block command sequence. Subsequent single reads from that partition will return its status until another valid command is written. The read-status mode supports single synchronous and single asynchronous reads only; it doesn’t support burst reads. The first falling edge of OE# or CE# latches and updates Status Register data. The operation doesn’t affect other partitions’ modes. Because the Status Register is 8 bits wide, only DQ [7:0] contains valid Status Register data; DQ [15:8] contains zeros. See Table 25, “Status Register Definitions” on page 57 and Table 26, “Status Register Descriptions” on page 58. Each 4-Mbit partition contains its own Status Register. Bits SR[6:0] are unique to each partition, but SR[7], the Device WSM Status (DWS) bit, pertains to the entire device. SR[7] provides program and erase status of the entire device. By contrast, the Partition WSM Status (PWS) bit, SR[0], provides program and erase status of the addressed partition only. Status register bits SR[6:1] present information about partition-specific program, erase, suspend, V PP, and block-lock states. Table 27, “Status Register Device WSM and Partition Write Status Description” on page 58 presents descriptions of DWS (SR[7]) and PWS (SR[0]) combinations. Protection Register Lock Status Partition 80h Lock Data Protection Register Partition 81h - 88h Register Data Multiple reads required to read the entire 128-bit Protection Register . Notes: 1. The address is constructed from a base address plus an offset. For example, to read the Block Lock Status for block number 38 in a BPD, set the address to the BBA (0F8000h) plus the offset (02h), i.e. 0F8002h. Then examine bit 0 of the data to determine if the block is locked. 2. See Section 13.1.4, “Block Lock Status” on page 73 for valid lock status. Table 24: Device Identification Codes (Sheet 2 of 2) Item Address1 Data Description Base Offset Table 25: Status Register Definitions DWS ESS ES PS VPPS PSS DPS PWS 76543210

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

58 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

10.7 Clear Status Register

The Clear Status Register command clears the Status Register and leaves all partition output states unchanged. The WSM can set all Status Register bits and clear bits SR[7:6,2,0]. Because bits SR[5,4,3,1] indicate various error conditions, they can only be cleared by the Clear Status Register command. By allowing system software to reset these bits, several operations (such as cumulatively programming several addresses or erasing multiple blocks in sequence) can be performed before reading the Status Register to determine error occurrence. If an error is detected, the Status Register must be cleared before beginning another command or sequence. Device reset (RST# = V IL) also clears the Status Register. This command functions independently of VPP. Table 26: Status Register Descriptions Bit Name State Description

7 DWS

0 = Device WSM is Busy 1 = Device WSM is Ready SR[7] indicates erase or program completion in the device. SR[6:1] are invalid while SR[7] = 0. See Table 27 for valid SR[7] and SR[0] combinations.

6 ESS

0 = Erase in progress/completed 1 = Erase suspended After issuing an Erase Suspend command, the WSM halts and sets SR[7] and SR[6]. SR[6] remains set until the device receives an Erase Resume command. 5 ES Erase Status 0 = Erase successful 1 = Erase error SR[5] is set if an attempted erase failed. A Command Sequence Error is indicated when SR[7,5:4] are set. 4 PS Program Status 0 = Program successful 1 = Program error SR[4] is set if the WSM failed to program a word.

3 VPPS

0 = VPP OK 1 = VPP low detect, operation aborted The WSM indicates the VPP level after program or erase completes. SR[3] does not provide continuous V PP feedback and isn’t guaranteed when VPP ≠ VPP1/2. PSS Program Suspend Status 0 = Program in progress/completed 1 = Program suspended After receiving a Program Suspend command, the WSM halts execution and sets SR[7] and SR[2]. They remain set until a Resume command is received.

1 DPS

0 = Unlocked 1 = Aborted erase/program attempt on locked block If an erase or program operation is attempted to a locked block (if WP# = V IL), the WSM sets SR[1] and aborts the operation.

0 PWS

0 = This partition is busy, but only if SR[7]=0 1 = Another partition is busy, but only if SR[7]=0 Addressed partition is erasing or programming. In EFP mode, SR[0] indicates that a data-stream word has finished programming or verifying depending on the particular EFP phase. See Table 27 for valid SR[7] and SR[0] combinations. Table 27: Status Register Device WSM and Partition Write Status Description DWS (SR[7]) PWS (SR[0]) Description 00 The addressed partition is performing a program/erase operation. EFP: device has finished programming or verifying data, or is ready for data. 01 A partition other than the one currently addressed is performing a program/erase operation. EFP: the device is either programming or verifying data. No program/erase operation is in progress in any partition. Erase and Program suspend bits (SR[6,2]) indicate whether other partitions are suspended. EFP: the device has exited EFP mode. 11 Won’t occur in standard program or erase modes. EFP: this combination does not occur.

Order Number: 290701-18 59 Numonyx™ Wireless Flash Memory (W18)

11.0 Program Operations

11.1 Word Program

When the Word Program command is issued, the WSM executes a sequence of internally timed events to program a word at the desired address and verify that the bits are sufficiently programmed. Programming the flash array changes specifically addressed bits to 0; 1 bits do not change the memory cell contents. Programming can occur in only one partition at a time. All other partitions must be in either a read mode or erase suspend mode. Only one partition can be in erase suspend mode at a time. The Status Register can be examined for program progress by reading any address within the partition that is busy programming. However, while most Status Register bits are partition-specific, the Device WSM Status bit, SR[7], is device-specific; that is, if the Status Register is read from any other partition, SR[7] indicates program status of the entire device. This permits the system CPU to monitor program progress while reading the status of other partitions. CE# or OE# toggle (during polling) updates the Status Register. Several commands can be issued to a partition that is programming: Read Status Register, Program Suspend, Read Identifier, and Read Query. The Read Array command can also be issued, but the read data is indeterminate. After programming completes, three Status Register bits can signify various possible error conditions. SR[4] indicates a program failure if set. If SR[3] is set, the WSM couldn’t execute the Word Program command because V PP was outside acceptable limits. If SR[1] is set, the program was aborted because the WSM attempted to program a locked block. After the Status Register data is examined, clear it with the Clear Status Register command before a new command is issued. The partition remains in Status Register mode until another command is written to that partition. Any command can be issued after the Status Register indicates program completion. If CE# is deasserted while the device is programming, the devices will not enter standby mode until the program operation completes.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

60 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

11.2 Factory Programming

The standard factory programming mode uses the same commands and algorithm as the Word Program mode (40h/10h). When VPP is at VPP1, program and erase currents are drawn through VCC. If VPP is driven by a logic signal, VPP1 must remain above the VPP1Min value to perform in-system flash modifications. When VPP is connected to a 12 V power supply, the device draws program and erase current directly from VPP. This eliminates the need for an external switching transistor to control the V PP voltage. Figure 35, “Examples of VPP Power Supply Configurations” on page 77 shows examples of flash power supply usage in various configurations. Figure 26: Word Program Flowchart Suspend Program Loop Start Write 40h, Word Address Write Data Word Address Read Status Register SR[7] = Full Program Status Check (if desired) Program Complete FULL PROGRAM STATUS CHECK PROCEDURE Suspend Program Read Status Register Program Successful SR[3] = SR[1] = SR[4] = No Yes VPP Range Error Device Protect Error Program Error WORD PROGRAM PROCEDURE SR[3] MUST be cleared before the WSM will allow further program attempts Only the Clear Staus Register command clears SR[4:3,1]. If an error is detected, clear the status register before attempting a program retry or other error recovery. Standby Standby Bus Operation Command Check SR[3] 1 = V PP error Check SR[4] 1 = Data program error Comments Repeat for subsequent programming operations. Full status register check can be done after each program or after a sequence of program operations. CommentsBus Operation Command Data = 40h Addr = Location to program (WA) Write Program Setup Data = Data to program (WD) Addr = Location to program (WA) Write Data Read SRD Toggle CE# or OE# to update SRD Read Check SR[7] 1 = WSM ready 0 = WSM busy Standby Standby Check SR[1] 1 = Attempted program to locked block Program aborted

Order Number: 290701-18 61 Numonyx™ Wireless Flash Memory (W18) The 12-V VPP mode enhances programming performance during the short time period typically found in manufacturing processes; however, it is not intended for extended use.12 V may be applied to V PP during program and erase operations as specified in Section 5.0, “Maximum Ratings and Operating Conditions” on page 21. VPP may be connected to 12 V for a total of tPPH hours maximum. Stressing the device beyond these limits may cause permanent damage.

11.3 Enhanced Factory Program (EFP)

EFP substantially improves device programming performance through a number of enhancements to the conventional 12 Volt word program algorithm. EFP's more efficient WSM algorithm eliminates the traditional overhead delays of the conventional word program mode in both the host programming system and the flash device. Changes to the conventional word programming flowchart and internal WSM routine were developed because of today's beat-rate-sensitive manufacturing environments; a balance between programming speed and cycling performance was attained. The host programmer writes data to the device and checks the Status Register to determine when the data has completed programming. This modification essentially cuts write bus cycles in half. Following each internal program pulse, the WSM increments the device's address to the next physical location. Now, programming equipment can sequentially stream program data throughout an entire block without having to setup and present each new address. In combination, these enhancements reduce much of the host programmer overhead, enabling more of a data streaming approach to device programming. EFP further speeds up programming by performing internal code verification. With this, PROM programmers can rely on the device to verify that it has been programmed properly. From the device side, EFP streamlines internal overhead by eliminating the delays previously associated to switch voltages between programming and verify levels at each memory-word location. EFP consists of four phases: setup, program, verify and exit. Refer to Figure 27, “Enhanced Factory Program Flowchart” on page 64 for a detailed graphical representation of how to implement EFP.

11.3.1 EFP Requirements and Considerations

Ambient temperature: TA = 25 °C ± 5 °C VCC within specified operating range VPP within specified VPP2 range Target block unlocked EFP Considerations Block cycling below 100 erase cycles 1 RWW not supported2 EFP programs one block at a time EFP cannot be suspended Notes: 1. Recommended for optimum performance. Some degradation in performance may occur if this limit is exceeded, but the internal algorithm will continue to work properly. 2. Code or data cannot be read from another partition during EFP.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

62 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

11.3.2 Setup

After receiving the EFP Setup (30h) and EFP Confirm (D0h) command sequence, SR[7] transitions from a 1 to a 0 indicating that the WSM is busy with EFP algorithm startup. A delay before checking SR[7] is required to allow the WSM time to perform all of its setups and checks (V PP level and block lock status). If an error is detected, Status Register bits SR[4], SR[3], and/or SR[1] are set and EFP operation terminates. Note: After the EFP Setup and Confirm command sequence, reads from the device automatically output Status Register data. Do not issue the Read Status Register command; it will be interpreted as data to program at WA0.

11.3.3 Program

After setup completion, the host programming system must check SR[0] to determine “data-stream ready" status (SR[0]=0). Each subsequent write after this is a program- data write to the flash array. Each cell within the memory word to be programmed to 0 receives one WSM pulse; additional pulses, if required, occur in the verify phase. SR[0]=1 indicates that the WSM is busy applying the program pulse. The host programmer must poll the device's Status Register for the "program done" state after each data-stream write. SR[0]=0 indicates that the appropriate cell(s) within the accessed memory location have received their single WSM program pulse, and that the device is now ready for the next word. Although the host may check full status for errors at any time, it is only necessary on a block basis, after EFP exit. Addresses must remain within the target block. Supplying an address outside the target block immediately terminates the program phase; the WSM then enters the EFP verify phase. The address can either hold constant or it can increment. The device compares the incoming address to that stored from the setup phase (WA 0); if they match, the WSM programs the new data word at the next sequential memory location. If they differ, the WSM jumps to the new address location. The program phase concludes when the host programming system writes to a different block address, and data supplied must be FFFFh. Upon program phase completion, the device enters the EFP verify phase.

11.3.4 Verify

A high percentage of the flash bits program on the first WSM pulse. However, for those cells that do not completely program on their first attempt, EFP internal verification identifies them and applies additional pulses as required. The verify phase is identical in flow to the program phase, except that instead of programming incoming data, the WSM compares the verify-stream data to that which was previously programmed into the block. If the data compares correctly, the host programmer proceeds to the next word. If not, the host waits while the WSM applies an additional pulse(s). The host programmer must reset its initial verify-word address to the same starting location supplied during the program phase. It then reissues each data word in the same order as during the program phase. Like programming, the host may write each subsequent data word to WA 0 or it may increment up through the block addresses. The verification phase concludes when the interfacing programmer writes to a different block address; data supplied must be FFFFh. Upon completion of the verify phase, the device enters the EFP exit phase.

Order Number: 290701-18 63 Numonyx™ Wireless Flash Memory (W18)

11.3.5 Exit

SR[7]=1 indicates that the device has returned to normal operating conditions. A full status check should be performed at this time to ensure the entire block programmed successfully. After EFP exit, any valid CUI command can be issued.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

64 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Figure 27: Enhanced Factory Program Flowchart EFP Setup EFP Program EFP Verify EFP Exit 1. WA 0 = first Word Address to be programmed within the target block. The BBA (Block Base Address) must remain constant throughout the program phase data stream; WA can be held constant at the first address location, or it can be written to sequence up through the addresses within the block. Writing to a BBA not equal to that of the block currently being written to terminates the EFP program phase, and instructs the device to enter the EFP verify phase. 2. For proper verification to occur , the verify data stream must be presented to the device in the same sequence as that of the program phase data stream. Writing to a BBA not equal to WA terminates the EFP verify phase, and instructs the device to exit EFP . 3. Bits that did not fully program with the single WSM pulse of the EFP program phase receive additional program-pulse attempts during the EFP verify phase. The device w ill report any program failure by setting SR[4]=1; this check can be performed during the full status check after EFP has been exited for that block, and will indicate any error within the entire data stream. CommentsBus State Repeat for subsequent operations. After EFP exit, a Full Status Check can determine if any program error occurred. See the Full Status Check procedure in the Word Program flowchart. Write Standby Read Write Write (note 2) Read Standby Write Read Standby EFP Setup Program Done? Exit Program Phase Last Data? Exit Verify Phase EFP Exited? Write EFP Confirm Read Standby EFP Setup Done? Read Standby Verify Stream Ready? Write Unlock Block Write (note 1) Standby Last Data? Standby (note 3) Verify Done? SR [ 0 ] =1 =N Write Data Address = WA0 Last Data? Write FFFFh Address ≠ BBA Program Done? Read Status Register SR[0]=0=Y Y SR [ 0 ] =1 =N N Write Data Address = WA0 Verify Done? Last Data? Read Status Register Write FFFFh Address ≠ BBA Y Verify Stream Ready? Read Status Register SR[7]=0=N Full Status Check Procedure Operation Complete Read Status Register EFP Exited? SR[7]=1=Y SR[0]=1=N Start Write 30h Address = WA0 VPP = 12V Unlock Block Write D0h Address = WA0 EFP Setup Done? Read Status Register SR[7]=1=N Exit N EFP Program EFP Verify EFP ExitEFP Setup CommentsBus State Data = 30h Address = WA Data = D0h Address = WA Status Register Check SR[7] 0 = EFP ready 1 = EFP not ready VPP = 12V Unlock block Check SR[0] 0 = Program done 1 = Program not done Status Register Data = FFFFh Address not within same BBA Data = Data to program Address = WA Device automatically increments address. CommentsBus State Data = Word to verify Address = WA Status Register Device automatically increments address. Data = FFFFh Address not within same BBA Status Register Check SR[0] 0 = Ready for verify 1 = Not ready for verify Check SR[0] 0 = Verify done 1 = Verify not done Status Register Check SR[7] 0 = Exit not finished 1 = Exit completed Check VPP & Lock errors (SR[3,1]) Data Stream Ready? Read Status Register SR[0] =0=Y SR [ 7 ] =0=Y SR[0]=1=N Standby Read Data Stream Ready? Check SR[0] 0 = Ready for data 1 = Not ready for data Status Register SR[0]=0=Y SR[0] =0=Y EFP setup time Standby EFP setup time Standby Error Condition Check If SR[7] = 1: Check SR[3,1] SR[3] = 1 = VPP error SR[1] = 1 = locked block

Order Number: 290701-18 65 Numonyx™ Wireless Flash Memory (W18)

12.0 Program and Erase Operations

12.1 Program/Erase Suspend and Resume

The Program Suspend and Erase Suspend commands halt an in -progress program or erase operation. The command can be issued at any device address. The partition corresponding to the command’s address remains in its previous state. A suspend command allows data to be accessed from memory locations other than the one being programmed or the block being erased. A program operation can be suspended only to perform a read operation. An erase operation can be suspended to perform either a program or a read operation within any block, except the block that is erase suspended. A program command nested within a suspended erase can subsequently be suspended to read yet another location. Once a program or erase process starts, the Suspend command requests that the WSM suspend the program or erase sequence at predetermined points in the algorithm. The partition that is actually suspended continues to output Status Register data after the Suspend command is written. An operation is suspended when status bits SR[7] and SR[6] and/or SR[2] are set. To read data from blocks within the partition (other than an erase-suspended block), you can write a Read Array command. Block erase cannot resume until the program operations initiated during erase suspend are complete. Read Array, Read Status Register, Read Identifier (ID), Read Query, and Program Resume are valid commands during Program or Erase Suspend. Additionally, Clear Status Register, Program, Program Suspend, Erase Resume, Lock Block, Unlock Block, and Lock-Down Block are valid commands during erase suspend. To read data from a block in a partition that is not programming or erasing, the operation does not need to be suspended. If the other partition is already in Read Array, ID, or Query mode, issuing a valid address returns corresponding data. If the other partition is not in a read mode, one of the read commands must be issued to the partition before data can be read. During a suspend, CE# = V IH places the device in standby state, which reduces active current. VPP must remain at its program level and WP# must remain unchanged while in suspend mode. A resume command instructs the WSM to continue programming or erasing and clears Status Register bits SR[2] (or SR[6]) and SR[7]. The Resume command can be written to any partition. When read at the partition that is programming or erasing, the device outputs data corresponding to the partition’s last mode. If Status Register error bits are set, the Status Register can be cleared before issuing the next instruction. RST# must remain at V IH. See Figure 28, “Program Suspend / Resume Flowchart” on page 66, and Figure 29, “Erase Suspend / Resume Flowchart” on page 67. If a suspended partition was placed in Read Array, Read Status Register, ID, or Query mode during the suspend, the device remains in that mode and outputs data corresponding to that mode after the program or erase operation is resumed. After resuming a suspended operation, issue the read command appropriate to the read operation. To read status after resuming a suspended operation, issue a Read Status Register command (70h) to return the suspended partition to status mode.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

66 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Figure 28: Program Suspend / Resume Flowchart Read Status Register SR.7 = SR.2 = Write FFh Susp Partition Read Array Data Program Completed Done Reading Write FFh Pgm'd Partition Write D0h Any Address Program Resumed Read Array Data No Yes PROGRAM SUSPEND / RESUME PROCEDURE Write Program Resume Data = D0h Addr = Suspended block (BA) Bus Operation Command Comments Write Program Suspend Data = B0h Addr = Block to suspend (BA) Standby Check SR.7 1 = WSM r eady 0 = WSM busy Standby Check SR.2 1 = Program suspended 0 = Program completed Write Read Array Data = FFh Addr = Any address within the suspended partition Read Read array data from block other than the one being programmed Read Status register data Toggle CE# or OE# to update Status register Addr = Suspended block (BA) PGM_SUS.WMF Start Write B0h Any Address Program Suspend Read Status Program Resume Read Array Read Array Write 70h Same Partition Write Read Status Data = 70h Addr = Same partition If the suspended partition was placed in Read Array mode: Write Read Status Return partition to Status mode: Data = 70h Addr = Same partition Write 70h Same Partition Read Status

Order Number: 290701-18 67 Numonyx™ Wireless Flash Memory (W18)

12.2 Block Erase

The 2-cycle block erase command sequence, consisting of Erase Setup (20h) and Erase Confirm (D0h), initiates one block erase at the addressed block. Only one partition can be in an erase mode at a time; other partitions must be in a read mode. The Erase Confirm command internally latches the address of the block to be erased. Erase forces all bits within the block to 1. SR[7] is cleared while the erase executes. After writing the Erase Confirm command, the selected partition is placed in read Status Register mode and reads performed to that partition return the current status data. The address given during the Erase Confirm command does not need to be the same address used in the Erase Setup command. So, if the Erase Confirm command is given to partition B, then the selected block in partition B will be erased even if the Erase Setup command was to partition A. Figure 29: Erase Suspend / Resume Flowchart Erase Completed Write FFh Erased Partition Read Array Data No Read Program Program Loop Read Array Data Yes Start Write B0h Any Address Read Status Register SR.7 = SR.6 = Write D0h Any Address Erase Resumed Read or Program? Done? Write Write Standby Standby Write Erase Suspend Read Array or Program Program Resume Data = B0h Addr = Any address Data = FFh or 40h Addr = Block to program or read Check SR.7 1 = WSM ready 0 = WSM busy Check SR.6 1 = Erase suspended 0 = Erase completed Data = D0h Addr = Any address Bus Operation Command Comments Read Status register data. Toggle CE# or OE# to update Status register Addr = Same partition Read or Write Read array or program data from/to block other than the one being erased ERASE SUSPEND / RESUME PROCEDURE ERAS_SUS.WMF Write 70h Same Partition Write Read Status Data = 70h Addr = Same partition Erase Resume Erase Suspend Read Status Read Array Write 70h Same Partition Read Status If the suspended partition was placed in Read Array mode or a Program Loop: Write Read Status Return partition to Status mode: Data = 70h Addr = Same partition

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

68 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) The 2-cycle erase sequence cannot be interrupted with a bus write operation. For example, an Erase Setup command must be immediately followed by the Erase Confirm command in order to execute properly. If a different command is issued between the setup and confirm commands, the partition is placed in read-status mode, the Status Register signals a command sequence error, and all subsequent erase commands to that partition are ignored until the Status Register is cleared. The CPU can detect block erase completion by analyzing SR[7] of that partition. If an error bit (SR[5,3,1]) was flagged, the Status Register can be cleared by issuing the Clear Status Register command before attempting the next operation. The partition remains in read-status mode until another command is written to its CUI. Any CUI instruction can follow after erasing completes. The CUI can be set to read-array mode to prevent inadvertent Status Register reads.

Order Number: 290701-18 69 Numonyx™ Wireless Flash Memory (W18)

12.3 Read-While-Write and Read-While-Erase

The Numonyx™ Wireless Flash Memory (W18) supports flexible multi-partition dual- operation architecture. By dividing the flash memory into many separate partitions, the device can read from one partition while programing or erasing in another partition; hence the terms, RWW and RWE. Both of these features greatly enhance data storage performance. Figure 30: Block Erase Flowchart SR[3,1] must be cleared before the WSM will allow further erase attempts. Only the Clear Status Register command clears SR[5:3,1]. If an error is detected, clear the Status register before attempting an erase retry or other error recovery. Start FULL ERASE STATUS CHECK PROCEDURE Repeat for subsequent block erasures. Full status register check can be done after each block erase or after a sequence of block erasures. No Suspend Erase

0 Yes

SR[7] = Full Erase Status Check (if desired) Block Erase Complete Read Status Register Block Erase Successful SR[1] = Erase of Locked Block Aborted BLOCK ERASE PROCEDURE Bus Operation Command Comments Write Block Erase Setup Data = 20h Addr = Block to be erased (BA) Write Erase Confirm Data = D0h Addr = Block to be erased (BA) Read Read SRD Toggle CE# or OE# to update SRD Standby Check SR[7] 1 = WSM ready 0 = WSM busy Bus Operation Command Comments SR[3] = VPP Range Error SR[5:4] = Command Sequence Error SR[5] = Block Erase Error Standby Check SR[3] 1 = V PP error Standby Check SR[5:4] Both 1 = Command sequence error Standby Check SR[5] 1 = Block erase error Standby Check SR[1] 1 = Attempted erase of locked block Erase aborted

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

70 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) The product does not support simultaneous program and erase operations. Attempting to perform operations such as these results in a command sequence error. Only one partition can be programming or erasing while another partition is reading. However, one partition may be in erase suspend mode while a second partition is performing a program operation, and yet another partition is executing a read command. Table 22, “Command Codes and Descriptions” on page 51 describes the command codes available for all functions.

Order Number: 290701-18 71 Numonyx™ Wireless Flash Memory (W18)

13.0 Security Modes

The Numonyx Wireless Flash Memory (W18) offers both hardware and software security features to protect the flash data. The software security feature is used by executing the Lock Block command. The hardware security feature is used by executing the Lock-Down Block command and by asserting the WP# signal. Refer to Figure 31, “Block Locking State Diagram” on page 72 for a state diagram of the flash security features. Also see Figure 32, “Locking Operations Flowchart” on page 74.

13.1 Block Lock Operations

Individual instant block locking protects code and data by allowing any block to be locked or unlocked with no latency. This locking scheme offers two levels of protection. The first allows software-only control of block locking (useful for frequently changed data blocks), while the second requires hardware interaction before locking can be changed (protects infrequently changed code blocks). The following sections discuss the locking system operation. The term “state [abc]” specifies locking states; for example, “state [001],” where a = WP# value, b = block lock-down status bit D1, and c = Block Lock Status Register bit D0. Figure 31, “Block Locking State Diagram” on page 72 defines possible locking states. The following summarizes the locking functionality.

• All blocks power-up in a locked state.
• Unlock commands can unlock these blocks, and lock commands can lock them again.
• The Lock-Down command locks a block and prevents it from being unlocked when WP# is asserted. — Locked-down blocks can be unlocked or locked with commands as long as WP# is deasserted. — The lock-down status bit is cleared only when the device is reset or powered- down. Block lock registers are not affected by the V PP level. They may be modified and read even if VPP ≤ VPPLK. Each block’s locking status can be set to locked, unlocked, and lock-down, as described in the following sections. See Figure 32, “Locking Operations Flowchart” on page 74.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

72 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

13.1.1 Lock

All blocks default to locked (state [x01]) after initial power-up or reset. Locked blocks are fully protected from alteration. Attempted program or erase operations to a locked block will return an error in SR[1]. Unlocked blocks can be locked by using the Lock Block command sequence. Similarly, a locked block’s status can be changed to unlocked or lock-down using the appropriate software commands.

13.1.2 Unlock

Unlocked blocks (states [x00] and [110]) can be programmed or erased. All unlocked blocks return to the locked state when the device is reset or powered-down. An unlocked block’s status can be changed to the locked or locked-down state using the appropriate software commands. A locked block can be unlocked by writing the Unlock Block command sequence if the block is not locked-down.

13.1.3 Lock-Down

Locked-down blocks (state [011]) offer the user an additional level of write protection beyond that of a regular locked block. A block that is locked-down cannot have it’s state changed by software if WP# is asserted. A locked or unlocked block can be locked-down by writing the Lock-Down Block command sequence. If a block was set to locked-down, then later changed to unlocked, a Lock-Down command should be issued prior asserting WP# will put that block back to the locked-down state. When WP# is deasserted, locked-down blocks are changed to the locked state and can then be unlocked by the Unlock Block command. Figure 31: Block Locking State Diagram [X00] [X01] Power-Up/Reset Unlocked Locked [011] [111] [110] Locked- Down4,5 Software Locked [011] Hardware Locked5 Unlocked WP# Hardware Control Notes: 1. [a,b,c] represents [WP#, D1, D0]. X = Don’t Care. 2. D1 indicates block Lock-down status. D1 = ‘0’, Lock-down has not been issued to this block. D1 = ‘1’, Lock-down has been issued to this block. 3. D0 indicates block lock status. D0 = ‘0’, block is unlocked. D0 = ‘1’, block is locked. 4. Locked-down = Hardware + Software locked. 5. [011] states should be tracked by system software to determine difference between Hardware Locked and Locked-Down states. Software Block Lock (0x60/0x01) or Software Block Unlock (0x60/0xD0) Software Block Lock-Down (0x60/0x2F) WP# hardware control

Order Number: 290701-18 73 Numonyx™ Wireless Flash Memory (W18)

13.1.4 Block Lock Status

Every block’s lock status can be read in read identifier mode. To enter this mode, issue the Read Identifier command to the device. Subsequent reads at BBA + 02h will output that block’s lock status. For example, to read the block lock status of block 10, the address sent to the device should be 50002h (for a top-parameter device). The lowest two data bits of the read data, DQ1 and DQ0, represent the lock status. DQ0 indicates the block lock status. It is set by the Lock Block command and cleared by the Block Unlock command. It is also set when entering the lock-down state. DQ1 indicates lock- down status and is set by the Lock-Down command. The lock-down status bit cannot be cleared by software–only by device reset or power-down. See Table 28.

13.1.5 Lock During Erase Suspend

Block lock configurations can be performed during an erase suspend operation by using the standard locking command sequences to unlock, lock, or lock-down a block. This feature is useful when another block requires immediate updating. To change block locking during an erase operation, first write the Erase Suspend command. After checking SR[6] to determine the erase operation has suspended, write the desired lock command sequence to a block; the lock status will be changed. After completing lock, unlock, read, or program operations, resume the erase operation with the Erase Resume command (D0h). If a block is locked or locked-down during a suspended erase of the same block, the locking status bits change immediately. When the erase operation is resumed, it will complete normally. Locking operations cannot occur during program suspend. Appendix A, “Write State Machine States” on page 86 shows valid commands during erase suspend.

13.1.6 Status Register Error Checking

Using nested locking or program command sequences during erase suspend can introduce ambiguity into Status Register results. Because locking changes require 2-cycle command sequences, for example, 60h followed by 01h to lock a block, following the Configuration Setup command (60h) with an invalid command produces a command sequence error (SR[5:4]=11b). If a Lock Block command error occurs during erase suspend, the device sets SR[4] and SR[5] to 1 even after the erase is resumed. When erase is complete, possible errors during the erase cannot be detected from the Status Register because of the previous locking command error. A similar situation occurs if a program operation error is nested within an erase suspend. Table 28: Write Protection Truth Table VPP WP# RST# Write Protection XX V IL Device inaccessible VIL XV IH Word program and block erase prohibited XV IL VIH All lock-down blocks locked XV IH VIH All lock-down blocks can be unlocked

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

74 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

13.1.7 WP# Lock-Down Control

The Write Protect signal, WP#, adds an additional layer of block security. WP# only affects blocks that once had the Lock-Down command written to them. After the lock- down status bit is set for a block, asserting WP# forces that block into the lock-down state [011] and prevents it from being unlocked. After WP# is deasserted, the block’s state reverts to locked [111] and software commands can then unlock the block (for erase or program operations) and subsequently re-lock it. Only device reset or power- down can clear the lock-down status bit and render WP# ineffective.

13.2 Protection Register

The Numonyx Wireless Flash Memory (W18) includes a 128-bit Protection Register. This protection register is used to increase system security and for identification purposes. The protection register value can match the flash component to the system’s CPU or ASIC to prevent device substitution. The lower 64 bits within the protection register are programmed by Numonyx with a unique number in each flash device. The upper 64 OTP bits within the protection register are left for the customer to program. Once programmed, the customer segment can be locked to prevent further programming. Note: The individual bits of the user segment of the protection register are OTP, not the register in total. The user may program each OTP bit individually, one at a time, if desired. After the protection register is locked, however, the entire user segment is locked and no more user bits can be programmed. Figure 32: Locking Operations Flowchart No Optional Start Write 60h Block Address Write 90h BBA + 02h Read Block Lock Status Locking Change? Lock Change Complete Write 01,D0,2Fh Block Address Write FFh Partition Address Yes Write Write Write (Optional) Read (Optional) Standby (Optional) Write Lock Setup Lock, Unlock, or Lockdown Confirm Read ID Plane Block Lock Status Read Array Data = 60h Addr = Block to lock/unlock/lock-down (BA) Data = 01h (Lock block) D0h (Unlock block) 2Fh (Lockdown block) Addr = Block to lock/unlock/lock-down (BA) Data = 90h Addr = BBA + 02h Block Lock status data Addr = BBA + 02h Confirm locking change on DQ[1:0]. (See Block Locking State Transitions Table for valid combinations.) Data = FFh Addr = Any address in same partition Bus Operation Command Comments LOCKING OPERATIONS PROCEDURE

Order Number: 290701-18 75 Numonyx™ Wireless Flash Memory (W18) The protection register shares some of the same internal flash resources as the parameter partition. Therefore, RWW is only allowed between the protection register and main partitions. Table 29 describes the operations allowed in the protection register, parameter partition, and main partition during RWW and RWE.

13.2.1 Reading the Protection Register

Writing the Read Identifier command allows the protection register data to be read 16 bits at a time from addresses shown in Table 24, “Device Identification Codes” on page 56. The protection register is read from the Read Identifier command and can be read in any partition.Writing the Read Array command returns the device to read-array mode.

13.2.2 Programing the Protection Register

The Protection Program command should be issued only at the parameter (top or bottom) partition followed by the data to be programmed at the specified location. It programs the upper 64 bits of the protection register 16 bits at a time. Table 24, “Device Identification Codes” on page 56 shows allowable addresses. See also Figure 33, “Protection Register Programming Flowchart” on page 76. Issuing a Protection Program command outside the register’s address space results in a Status Register error (SR[4]=1).

13.2.3 Locking the Protection Register

PR-LK.0 is programmed to 0 by Numonyx to protect the unique device number. PR-LK.1 can be programmed by the user to lock the user portion (upper 64 bits) of the protection register (See Figure 34, “Protection Register Locking). This bit is set using the Protection Program command to program “FFFDh” into PR-LK. After PR-LK register bits are programmed (locked), the protection register’s stored values can’t be changed. Protection Program commands written to a locked section result in a Status Register error (SR[4]=1, SR[5]=1). Table 29: Simultaneous Operations Allowed with the Protection Register Protection Register Parameter Partition Array Data Main Partitions Description Read See Description Write/Erase While programming or erasing in a main partition, the protection register can be read from any other partition. Reading the parameter partition data is not allowed if the protection register is being read from addresses within the parameter partition. See Description Read Write/Erase While programming or erasing in a main partition, read operations are allowed in the parameter partition. Accessing the protection registers from parameter partition addresses is not allowed. Read Read Write/Erase While programming or erasing in a main partition, read operations are allowed in the parameter partition. Accessing the protection registers in a partition that is different from the one being programmed or erased, and also different from the parameter partition, is allowed. Write No Access Allowed Read While programming the protection register, reads are only allowed in the other main partitions. Access to the parameter partition is not allowed. This is because programming of the protection register can only occur in the parameter partition, so it will exist in status mode. No Access Allowed Write/Erase Read While programming or erasing the parameter partition, reads of the protection registers are not allowed in any partition. Reads in other main partitions are supported.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

76 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Figure 33: Protection Register Programming Flowchart FULL STATUS CHECK PROCEDURE Protection Program operations addresses must be within the protection register address space. Addresses outside this space will return an error. Repeat for subsequent programming operations. Full status register check can be done after each program or after a sequence of program operations. SR[3] MUST be cleared before the WSM will allow further program attempts. Only the Clear Staus Register command clears SR[4:3,1]. If an error is detected, clear the status register before attempting a program retry or other error recovery. Yes No 1,1 1,0 1,1 PROTECTION REGISTER PROGRAMMING PROCEDURE Start Write C0h Addr=Prot addr Write Protect. Register Address / Data Read Status Register SR[7] = 1? Full Status Check (if desired) Program Complete Read SRD Program Successful SR[4:3] = SR[4,1] = SR[4,1] = VPP Range Error Programming Error Locked-Register Program Aborted Standby Standby Bus Operation Command SR[1] SR[3] SR[4]

011 V PP Error

Data = C0h Addr = Protection address Data = Data to program Addr = Protection addressCheck SR[7] 1 = WSM Ready 0 = WSM Busy Bus Operation Command Comments Read Read SRD Toggle CE# or OE# to update SRD Standby 1 0 1 Register locked; Operation aborted

Order Number: 290701-18 77 Numonyx™ Wireless Flash Memory (W18)

13.3 VPP Protection

The Numonyx™ Wireless Flash Memory (W18) provides in-system program and erase at VPP1. For factory programming, it also includes a low-cost, backward-compatible 12 V programming feature.(Section 11.2, “Factory Programming” on page 60) The EFP feature can also be used to greatly improve factory program performance as explained in Section 11.3, “Enhanced Factory Program (EFP)” on page 61. In addition to the flexible block locking, holding the V PP programming voltage low can provide absolute hardware write protection of all flash-device blocks. If V PP is below VPPLK, program or erase operations result in an error displayed in SR[3]. (See Figure 35.) Note: If the VCC supply can sink adequate current, you can use an appropriately valued resistor. Figure 34: Protection Register Locking 0x84 0x88 0x85 0x81 0x80 PR Lock Register 0 User-Programmable Intel Factory-Programmed 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Figure 35: Examples of VPP Power Supply Configurations

• 12 V fast programming
• Absolute write protection with VPP ≤ VPPLK System supply (Note 1) VCC VPP

12 V supply

• Low voltage and 12 V fast programming System supply
• Low-voltage programming
• Absolute write protection via logic signal System supply Prot# (logic signal)
• Low-voltage programming System supply ≤ 10K Ω VCC VPP VCC VPP VCC VPP

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

78 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

14.0 Set Read Configuration Register

The Set Read Configuration Register (RCR) command sets the burst order, frequency configuration, burst length, and other parameters. A two-bus cycle command sequence initiates this operation. The Read Configuration Register data is placed on the lower 16 bits of the address bus (A[15:0]) during both bus cycles. The Set Read Configuration Register command is written along with the configuration data (on the address bus). This is followed by a second write that confirms the operation and again presents the Read Configuration Register data on the address bus. The Read Configuration Register data is latched on the rising edge of ADV#, CE#, or WE# (whichever occurs first). This command functions independently of the applied V PP voltage. After executing this command, the device returns to read-array mode. The Read Configuration Register’s contents can be examined by writing the Read Identifier command and then reading location 05h. See Table 30 and Table 31. Table 30: Read Configuration Register Summary Read Mode Res’d First Access Latency Count WAIT Polarity Data Output Config WAIT Config Burst Seq Clock Config Res’d Res’d Burst Wrap Burst Length RM R LC2 LC1 LC0 WT DOC WC BS CC R R BW BL2 BL1 BL0 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Table 31: Read Configuration Register Descriptions (Sheet 1 of 2) Bit Name Description 1 Notes 15 RM Read Mode 0 = Synchronous Burst Reads Enabled 1 = Asynchronous Reads Enabled (Default) 2

14 R Reserved 5

13-11 LC[2:0] First Access Latency Count 001 = Reserved 010 = Code 2 011 = Code 3 100 = Code 4 101 = Code 5 111 = Reserved (Default) 10 WT WAIT Signal Polarity 0 = WAIT signal is asserted low 1 = WAIT signal is asserted high (Default) 3

9 DOC

0 = Hold Data for One Clock 1 = Hold Data for Two Clock (Default) 6

8 WC WAIT Configuration 0 = WAIT Asserted During Delay

1 = WAIT Asserted One Data Cycle before Delay (Default) 6 7 BS Burst Sequence 1 = Linear Burst Order (Default) 6 CC Clock Configuration 0 = Burst Starts and Data Output on Falling Clock Edge 1 = Burst Starts and Data Output on Rising Clock Edge (Default) 5R R e s e r v e d 5 4R R e s e r v e d 5

Order Number: 290701-18 79 Numonyx™ Wireless Flash Memory (W18)

14.1 Read Mode (RCR[15])

All partitions support two high-performance read configurations: synchronous burst mode and asynchronous page mode (default). RCR[15] sets the read configuration to one of these modes. Status register, query, and identifier modes support only asynchronous and single- synchronous read operations.

14.2 First Access Latency Count (RCR[13:11])

The First Access Latency Count (RCR[13:11]) configuration tells the device how many clocks must elapse from ADV# de-assertion (V IH) before the first data word should be driven onto its data pins. The input clock frequency determines this value. See Table 31, “Read Configuration Register Descriptions” on page 78 for latency values. Figure 36 shows data output latency from ADV# assertion for different latencies. Refer to Section , “” on page 80 for Latency Code Settings. Note: Other First Access Latency Configuration settings are reserved. 3 BW Burst Wrap 0 = Wrap bursts within burst length set by CR[2:0] 1 = Don’t wrap accesses within burst length set by CR[2:0].(Default) 2-0 BL[2:0] Burst Length 001 = 4-Word Burst 010 = 8-Word Burst 011 = 16-Word Burst 111 = Continuous Burst (Default) Notes: 1. Undocumented combinations of bits are reserved by Numonyx for future implementations. 2. Synchronous and page read mode configurations affect reads from main blocks and parameter blocks. Status Register and configuration reads support single read cycles. RCR[15]=1 disables configuration set by RCR[14:0]. 3. Data is not ready when WAIT is asserted. 4. Set the synchronous burst length. In asynchronous page mode, the page size equals four words. 5. Set all reserved Read Configuration Register bits to zero. 6. Setting the Read Configuration Register for synchronous burst-mode with a latency count of 2 (RCR[13:11] = 010), data hold for 2 clocks (RCR[9] = 1), and WAIT asserted one data cycle before delay (RCR[8] =1) is not supported. Table 31: Read Configuration Register Descriptions (Sheet 2 of 2) Bit Name Description 1 Notes Figure 36: First Access Latency Configuration Code 5 Code 4 Code 3 Code 2 Valid Address Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Valid Output Address [A] ADV# [V] CLK [C] D[15:0] [Q] D[15:0] [Q] D[15:0] [Q] D[15:0] [Q]

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

80 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Note: The 16-word boundary is the end of the device sense word-line.

14.2.1 Latency Count Settings

Note: RCR bits[9:8] must be set to 0 for latency count of 2 . Figure 37: Word Boundary 0123456789ABC DEF

16 Word Boundary

Word 0 - 3 Word 4 - 7 Word 8 - B Word C - F

4 Word Boundary

Table 32: Latency Count Setting for V CCQ = 1.7 V - 1.95 V (90 nm) VCCQ = 1.7 - 1.95 V Unit tAVQV/tCHQV (60ns/11ns) Latency Count Settings 2 * 34 , 5 — Frequency Support < 40 < 61 < 66 MHz Table 33: Latency Count Setting for V CCQ = 1.7 V - 2.24 V (130 nm) VCCQ = 1.7 - 2.24 V Unit tAVQV/tCHQV (60ns/11ns) Latency Count Settings 2 3 4, 5 — Frequency Support < 40 < 61 < 66 MHz

Order Number: 290701-18 81 Numonyx™ Wireless Flash Memory (W18)

14.3 WAIT Signal Polarity (RCR[10])

If the WAIT bit is cleared (RCR[10]=0), then WAIT is configured to be asserted low. This means that a 0 on the WAIT signal indicates that data is not ready and the data bus contains invalid data. Conversely, if RCR[10] is set, then WAIT is asserted high. In either case, if WAIT is deasserted, then data is ready and valid. WAIT is asserted during asynchronous page mode reads.

14.4 WAIT Signal Function

The WAIT signal indicates data valid when the device is operating in synchronous mode (RCR[15]=0), and when addressing a partition that is currently in read-array mode. The WAIT signal is only “deasserted” when data is valid on the bus. When the device is operating in synchronous non-read-array mode, such as read status, read ID, or read query, WAIT is set to an “asserted” state as determined by RCR[10]. See Figure 12, “WAIT Signal in Synchronous Non-Read Array Operation Waveform” on page 35. When the device is operating in asynchronous page mode or asynchronous single word read mode, WAIT is set to an “asserted” state as determined by RCR[10]. See Figure 8, “Page-Mode Read Operation Waveform” on page 31, and Figure 6, “Asynchronous Read Operation Waveform” on page 29. From a system perspective, the WAIT signal is in the asserted state (based on RCR[10]) when the device is operating in synchronous non-read-array mode (such as Read ID, Read Query, or Read Status), or if the device is operating in asynchronous mode (RCR[15]=1). In these cases, the system software should ignore (mask) the WAIT signal, because it does not convey any useful information about the validity of what is appearing on the data bus. Figure 38: Example: Latency Count Setting at 3 AMAX-0 (A) DQ15-0 (D/Q) CLK (C) CE# (E) ADV# (V) R103 Valid Output Valid Output High Z tADD-DELAY tDATA 1nd0st 2rd 3th 4th Valid Address Code 3

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

82 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

14.5 Data Hold (RCR[9])

The Data Output Configuration (DOC) bit (RCR[9]) determines whether a data word remains valid on the data bus for one or two clock cycles. The processor’s minimum data set-up time and the flash memory’s clock-to-data output delay determine whether one or two clocks are needed. A DOC set at 1-clock data hold corresponds to a 1-clock data cycle; a DOC set at 2- clock data hold corresponds to a 2-clock data cycle. The setting of this configuration bit depends on the system and CPU characteristics. For clarification, see Figure 39, “Data Output Configuration with WAIT Signal Delay” on page 83. A method for determining this configuration setting is shown below. To set the device at 1-clock data hold for subsequent reads, the following condition must be satisfied: tCHQV (ns) + tDATA (ns) ≤ One CLK Period (ns) As an example, use a clock frequency of 66 MHz and a clock period of 15 ns. Assume the data output hold time is one clock. Apply this data to the formula above for the subsequent reads: 11 ns + 4 ns ≤ 15 ns This equation is satisfied, and data output will be available and valid at every clock period. If tDATA is long, hold for two cycles. During page-mode reads, the initial access time can be determined by the formula: tADD-DELAY (ns) + tDATA (ns) + tAVQV (ns) Subsequent reads in page mode are defined by: tAPA (ns) + tDATA (ns) (minimum time) Table 34: WAIT Signal Conditions CONDITION WAIT CE# = VIH CE# = VIL Tri-State Active OE# No-Effect Synchronous Array Read Active Synchronous Non-Array Read Asserted All Asynchronous Read and all Write Asserted

Order Number: 290701-18 83 Numonyx™ Wireless Flash Memory (W18) Note: WAIT shown asserted high (RCR[10]=1).

14.6 WAIT Delay (RCR[8])

The WAIT configuration bit (RCR[8]) controls WAIT signal delay behavior for all synchronous read-array modes. Its setting depends on the system and CPU characteristics. The WAIT can be asserted either during, or one data cycle before, a valid output. In synchronous linear read array (no-wrap mode RCR[3]=1) of 4-, 8-, 16-, or continuous-word burst mode, an output delay may occur when a burst sequence crosses its first device-row boundary (16-word boundary). If the burst start address is 4-word boundary aligned, the delay does not occur. If the start address is misaligned to a 4-word boundary, the delay occurs once per burst-mode read sequence. The WAIT signal informs the system of this delay.

14.7 Burst Sequence (RCR[7])

The burst sequence specifies the synchronous-burst mode data order (see Table 35, “Sequence and Burst Length” on page 84). When operating in a linear burst mode, either 4-, 8-, or 16-word burst length with the burst wrap bit (RCR[3]) set, or in continuous burst mode, the device may incur an output delay when the burst sequence crosses the first 16-word boundary. (See Figure 37, “Word Boundary” on page 80 for word boundary description.) This depends on the starting address. If the starting address is aligned to a 4-word boundary, there is no delay. If the starting address is the end of a 4-word boundary, the output delay is one clock cycle less than the First Access Latency Count; this is the worst-case delay. The delay takes place only once, and only if the burst sequence crosses a 16-word boundary. The WAIT pin informs the system of this delay. For timing diagrams of WAIT functionality, see these figures:

• Figure 9, “Single Synchronous Read-Array Operation Waveform” on page 32
• Figure 10, “Synchronous 4-Word Burst Read Operation Waveform” on page 33
• Figure 11, “WAIT Functionality for EOWL (End-of-Word Line) Condition Waveform” on page 34 Figure 39: Data Output Configuration with WAIT Signal Delay DQ15-0 [Q] CLK [C] Valid Output Valid Output Valid Output DQ15-0 [Q] Valid Output

1 CLK

WAIT (CR.8 = 1) WAIT (CR.8 = 0) tCHQV tCHQV WAIT (CR.8 = 0) WAIT (CR.8 = 1)

2 CLK

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

84 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18)

14.8 Clock Edge (RCR[6])

Configuring the valid clock edge enables a flexible memory interface to a wide range of burst CPUs. Clock configuration sets the device to start a burst cycle, output data, and assert WAIT on the clock’s rising or falling edge.

14.9 Burst Wrap (RCR[3])

The burst wrap bit determines whether 4-, 8-, or 16-word burst accesses wrap within the burst-length boundary or whether they cross word-length boundaries to perform linear accesses. No-wrap mode (RCR[3]=1) enables WAIT to hold off the system processor, as it does in the continuous burst mode, until valid data is available. In no- wrap mode (RCR[3]=0), the device operates similarly to continuous linear burst mode but consumes less power during 4-, 8-, or 16-word bursts. For example, if RCR[3]=0 (wrap mode) and RCR[2:0] = 1h (4-word burst), possible linear burst sequences are 0-1-2-3, 1-2-3-0, 2-3-0-1, 3-0-1-2. Table 35: Sequence and Burst Length Start Addr. (Dec) Burst Addressing Sequence (Decimal) 4-Word Burst RCR[2:0]=001b 8-Word Burst RCR[2:0]=010b 16-Word Burst RCR[2:0]=011b Continuous Burst RCR[2:0]=111b Linear Linear Linear Linear Wrap (RCR[3]=0) ... ... ... ... ... No-Wrap (RCR[3]=1) ... ... ... ... ...

Order Number: 290701-18 85 Numonyx™ Wireless Flash Memory (W18) If RCR[3]=1 (no-wrap mode) and RCR[2:0] = 1h (4-word burst length), then possible linear burst sequences are 0-1-2-3, 1-2-3-4, 2-3-4-5, and 3-4-5-6. RCR[3]=1 not only enables limited non-aligned sequential bursts, but also reduces power by minimizing the number of internal read operations. Setting RCR[2:0] bits for continuous linear burst mode (7h) also achieves the above 4- word burst sequences. However, significantly more power may be consumed. The 1-2- 3-4 sequence, for example, consumes power during the initial access, again during the internal pipeline lookup as the processor reads word 2, and possibly again, depending on system timing, near the end of the sequence as the device pipelines the next 4-word sequence. RCR[3]=1 while in 4-word burst mode (no-wrap mode) reduces this excess power consumption.

14.10 Burst Length (RCR[2:0])

The Burst Length bit (BL[2:0]) selects the number of words the device outputs in synchronous read access of the flash memory array. The burst lengths are 4-word, 8- word, 16-word, and continuous word. Continuous-burst accesses are linear only, and do not wrap within any word length boundaries (see Table 35, “Sequence and Burst Length” on page 84). When a burst cycle begins, the device outputs synchronous burst data until it reaches the end of the “burstable” address space.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

86 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Appendix A Write State Machine States This table shows the command state transitions based on incoming commands. Only one partition can be actively programming or erasing at a time. Figure 40: Write State Machine — Next State Table (Sheet 1 of 2) Chi p Next St at e af ter Com m and I n p ut Read Ar r ay (3) Pr ogr am Set up (4,5) Er ase Set up (4 ,5) Enhanced Fact or y Pgm Set up (4 ) BE Conf i r m, P/ E Resume, ULB Conf i r m (9 ) Pr ogr am/ Er ase Suspend Read St at us Cl ear St at us Regi st er (6) Read ID /Q u ery Ready Ready Pr ogr am Set up Er ase Set up EFP Set up Ready Lock/CR Setup Ready (Lock Error) Ready Ready (Lock Error) Set up OTP Busy Busy Set up Pr ogr am Busy Busy Pr ogr am Busy Pgm Susp Pr ogr am Busy Suspend Progr am Suspend Pgm Busy Pr ogram Suspend Setup Ready (Error) Erase Busy Ready (Error) Busy Er ase Busy Er ase Susp Er ase Busy Suspend Er ase Suspend Pgm i n Er ase Susp Set up Er ase Suspend Er ase Busy Er ase Suspend Set up Progr am i n Erase Suspend Busy Busy Pr ogr am i n Er ase Suspend Busy Pgm Susp i n Er ase Susp Pr ogr am i n Er ase Suspend Busy Suspend Program Suspend i n Erase Suspend Pgm i n Er ase Susp Busy Pr ogram Suspend i n Er ase Suspend Erase Suspend (Lock Error) Erase Susp Er ase Suspend (Lo ck E rro r) Setup Ready (Error) EFP Busy Ready (Error) EFP Busy EFP Bus y (7) EFP Ver i f y Ver i f y Bus y (7) Out p ut Next State after Com m and I n p ut St at us St at us St at us ID /Q u ery Wri te State M achi ne (WSM ) Next State Tabl eO utput Next State Tabl e (1) Lock/CR Setup, Lock/CR Setup i n Erase Susp OTP Busy Cur r ent Chi p St at e (8) Ready, Pgm Busy, Pgm Suspend, Er ase Busy, Er ase Suspend, Pgm In Erase Susp Busy, P gm S u sp In E rase S u sp Pgm Set up, Erase Setup, OTP Set up, Pgm i n Er ase Susp Set up, EFP Set up, EFP Busy, V erify B u sy Lock/CR Setup i n Erase Suspend Er ase Pr ogr am Pr ogr am i n Erase Suspend OTP Enhanced Fact ory Pr ogr am Ou t pu t does not change Ar r ay (3) St at us Out put does not change St at us

Order Number: 290701-18 87 Numonyx™ Wireless Flash Memory (W18) Notes: 1. The output state shows the type of data that appears at the outputs if the partition address is the same as the command address. A partition can be placed in Read Array, Read Status or Read ID/CFI, depending on the command issued. Each partition stays in its last output state (Array, ID/CFI or Status) until a new command changes it. The next WSM state does not depend on the partition's output state. For example, if partition #1's output state is Read Array and partition #4's output state is Read Status, every read from partition #4 (without issuing a new command) outputs the Status register. 2. Illegal commands are those not defined in the command set. Figure 40: Write State Machine — Next State Table (Sheet 2 of 2) Chi p Next St at e af t er Com m and I n p ut Lock, Unl ock, Lock-down, CR set up (5) OTP Set up (5 ) Lock Bl o ck Conf i r m (9) Lock- Down Bl o ck Conf i r m (9 ) Wr i t e CR Conf i r m (9 ) Enhanced Fact Pgm E x it (b lk a d d < > W A 0) I l l egal comm ands or EFP dat a (2 ) (60H) (C0H) (01H) (2FH) (03H) (X XXX H) (other codes) Ready Lock/ CR Set up OTP Se t up Ready Lock/ CR Set up Ready ( Lock Er ror) Ready Ready Ready Ready (Lock Err or ) Se t up OTP Bu sy Busy Ready Se t up Pr og r am Bu sy N/ A Busy Pr og r am Bu sy Ready Suspend Pr ogr am Suspend Se t up R eady (E rror) Busy Er ase Busy Er ase Busy Ready Suspend Lock/ CR Set up i n Er ase Susp Er ase Suspend S etup P rogram i n E rase S uspend B usy Bu sy Pr og r a m i n Er ase Su spe nd Bu sy Er ase Su spe nd Suspend Pr ogram Suspend i n Er ase Suspend Er ase Suspend ( Lock Err or) Er ase Susp Er ase Susp Er ase Susp Er ase Suspend ( Lock Er r or ) Se t up R eady (E rror) EFP Busy EFP Bu s y (7 ) EFP Ver i f y EFP Bus y (7 ) EFP Ver i f y Ver i f y Bu s y (7 ) Ready EFP Ver i f y (7) Ready Out p ut Next State aft er Com m and I n p ut St at us St at us Ar r ay St at us W ri t e St at e M achi ne ( W SM ) Next St at e Tabl eO ut put Next St at e Tabl e (1) Pr ogr am Er ase Pr ogr am i n Er ase Suspend Cur r ent Chi p St at e (8) OTP Lock/CR S etup i n Erase Suspend Enhanced Fact ory Pr ogr am Out put does not change Out put does not change WS M Operati on Compl et es N/ A N/ A N/ A N/ A Output does not change A rraySt at us Pgm Set up, Er ase Set up, OTP Set up, Pgm i n Er ase Susp Set up, EFP Set up, EFP Busy, V erify B u sy Lock/CR S etup, Lock/CR S etup i n Erase Susp OTP Busy Ready, Pgm Busy, Pgm Suspend, Er ase Busy, Er ase Suspend, Pgm I n Er ase Susp Busy, P gm S u sp In E rase S u sp

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

88 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) 3. All partitions default to Read Array mode at power-up. A Read Array command issued to a busy partition results in undermined data when a partition address is read. 4. Both cycles of 2 cycles commands should be issued to the same partition address. If they are issued to different partitions, the second write determines the active partition. Both partitions will output status information when read. 5. If the WSM is active, both cycles of a 2 cycle command are ignored. This differs from previous Numonyx devices. 6. The Clear Status command clears Status Register error bits except when the WSM is running (Pgm Busy, Erase Busy, Pgm Busy In Erase Suspend, OTP Busy, EFP modes) or suspended (Erase Suspend, Pgm Suspend, Pgm Suspend In Erase Suspend). 7. EFP writes are allowed only when Status Register bit SR.0 = 0. EFP is busy if Block Address = address at EFP Confirm command. Any other commands are treated as data. 8. The "current state" is that of the WSM, not the partition. 9. Confirm commands (Lock Block, Unlock Block, Lock-down Block, Configuration Register) perform the operation and then move to the Ready State. 10. In Erase suspend, the only valid two cycle commands are "Program Word", "Lock/Unlock/Lockdown Block", and "CR Write". Both cycles of other two cycle commands ("OEM CAM program & confirm", "Program OTP & confirm", "EFP Setup & confirm", "Erase setup & confirm") will be ignored. In Program suspend or Program suspend in Erase suspend, both cycles of all two cycle commands will be ignored.

Order Number: 290701-18 89 Numonyx™ Wireless Flash Memory (W18) Appendix B Common Flash Interface (CFI) This appendix defines the data structure or “database” returned by the Common Flash Interface (CFI) Query command. System software should parse this structure to gain critical information such as block size, density, x8/x16, and electrical specifications. Once this information has been obtained, the software will know which command sets to use to enable flash writes, block erases, and otherwise control the flash component. The Query is part of an overall specification for multiple command set and control interface descriptions called Common Flash Interface, or CFI. B.1 Query Structure Output The Query database allows system software to obtain information for controlling the flash device. This section describes the device’s CFI-compliant interface that allows access to Query data. Query data are presented on the lowest-order data outputs (DQ0-7) only. The numerical offset value is the address relative to the maximum bus width supported by the device. On this family of devices, the Query table device starting address is a 10h, which is a word address for x16 devices. For a word-wide (x16) device, the first two Query-structure bytes, ASCII “Q” and “R,” appear on the low byte at word addresses 10h and 11h. This CFI-compliant device outputs 00h data on upper bytes. The device outputs ASCII “Q” in the low byte (DQ 0-7) and 00h in the high byte (DQ8-15). At Query addresses containing two or more bytes of information, the least significant data byte is presented at the lower address, and the most significant data byte is presented at the higher address. In all of the following tables, addresses and data are represented in hexadecimal notation, so the “h” suffix has been dropped. In addition, since the upper byte of word- wide devices is always “00h,” the leading “00” has been dropped from the table notation and only the lower byte value is shown. Any x16 device outputs can be assumed to have 00h on the upper byte in this mode. Table 36: Summary of Query Structure Output as a Function of Device and Mode Device Hex Offset Hex Code ASCII Value Device Addresses 00010 51 “Q” 00011 52 “R” 00012 59 “Y”

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

90 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) B.2 Query Structure Overview The Query command causes the flash component to display the Common Flash Interface (CFI) Query structure or “database.” The structure sub-sections and address locations are summarized below. Table 38: Query Structure Notes: 1. Refer to the Query Structure Output section and offset 28h for the detailed definition of offset address as a function of device bus width and mode. 2. BA = Block Address beginning location (i.e., 08000h is block 1’s beginning location when the block size is 32K-word). 3. Offset 15 defines “P” which points to the Primary Numonyx-specific Extended Query Table. B.3 Block Status Register The Block Status Register indicates whether an erase operation completed successfully or whether a given block is locked or can be accessed for flash program/erase operations. Block Erase Status (BSR.1) allows system software to determine the success of the last block erase operation. BSR.1 can be used just after power-up to verify that the VCC supply was not accidentally removed during an erase operation. Table 37: Example of Query Structure Output of x16 Device Word Addressing Byte Addressing Offset Hex Code Value Offset Hex Code Value AX - A0 D16 - D0 AX - A0 D7 - D0 00010h 0051 “Q” 00010h 51 “Q” 00011h 0052 “R” 00011h 52 “R” 00012h 0059 “Y” 00012h 59 “Y” 00013h P ID LO P rVendor 00013h P ID LO P rVendor 00014h P ID HI ID # 00014h P ID LO ID # 00015h P LO P rVendor 00015h P ID HI ID # Offset Sub-Section Name Description(1) 00000h Manufacturer Code 00001h Device Code (BA+2)h(2) Block Status register Block-specific information 00004-Fh Reserved Reserved for vendor-specific information 00010h CFI query identification string Command set ID and vendor data offset 0001Bh System interface information Device timing & voltage information 00027h Device geometry definition Flash device layout P (3) Primary Intel-specific Extended Query Table Vendor-defined additional information specific to the Primary Vendor Algorithm

Order Number: 290701-18 91 Numonyx™ Wireless Flash Memory (W18) Table 39: Block Status Register Notes: 1. BA = Block Address beginning location (i.e., 08000h is block 1’s beginning location when the block size is 32K-word). B.4 CFI Query Identification String The Identification String provides verification that the component supports the Common Flash Interface specification. It also indicates the specification version and supported vendor-specified command set(s). Offset Len gth Description Add. Value (BA+2)h(1) 1 Block Lock Status Register BA+2 --00 or --01 BA+2 (bit 0): 0 or 1 BA+2 (bit 1): 0 or 1 BSR 2–7: Reserved for future use BA+2 (bit 2–7): 0 BSR.0 Block lock status 0 = Unlocked 1 = Locked BSR.1 Block lock-down status 0 = Not locked down 1 = Locked down

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

92 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Table 41: System Interface Information Table 40: CFI Identification Offset Length Description Addr. Hex Code Value 10h 3 Query-unique ASCII string “QRY” 10: 11: 12: --51 --52 --59 “Q” “R” “Y” 13h 2 Primary vendor command set and control interface ID code. 16-bit ID code for vendor-specific algorithms. 13: 14: --03 --00 — 15h 2 Extended Query Table primary algorithm address 15: 16: --39 --00 — 17h 2 Alternate vendor command set and control interface ID code. 0000h means no second vendor-specified algorithm exists. 17: 18: --00 --00 — 19h 2 Secondary algorithm Extended Query Table address. 0000h means none exists. 19: 1A: --00 --00 — Offset Length Description Add. Hex Code Value 1Bh 1 1B: --17 1.7V 1Ch 1 1C: --19 1.9V 1Dh 1 1D: --B4 11.4V 1Eh 1 1E: --C6 12.6V 1Fh 1 “n” such that typical single word program time-out = 2n μ-sec 1F: --04 16 μs 20h 1 “n” such that typical max. buffer write time-out = 2n μ-sec 20: --00 NA 21h 1 “n” such that typical block erase time-out = 2n m-sec 21: --0A 1s 22h 1 “n” such that typical full chip erase time-out = 2n m-sec 22: --00 NA 23h 1 “n” such that maximum word program time-out = 2n times typical 23: --04 256 μs 24h 1 “n” such that maximum buffer write time-out = 2n times typical 24: --00 NA 25h 1 “n” such that maximum block erase time-out = 2n times typical 25: --03 8s 26h 1 “n” such that maximum chip erase time-out = 2n times typical 26: --00 NA VCC logic supply minimum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 BCD volts VCC logic supply maximum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 BCD volts VPP [programming] supply minimum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 HEX volts VPP [programming] supply maximum program/erase voltage bits 0–3 BCD 100 mV bits 4–7 HEX volts

Order Number: 290701-18 93 Numonyx™ Wireless Flash Memory (W18) B.5 Device Geometry Definition Table 42: Device Geometry Definition Offset Length Description Code 27h 1 “n” such that device size = 2 n in number of b ytes 27: See table below 76543210 2 8 h 2 ———— x 6 4 x 3 2 x 1 6 x 8 2 8 : - - 0 1 x 1 6 15 14 13 12 11 10 9 8 2Ah 2 “n” such that maximum number of b ytes in write buffer = 2 n 2A: --00 0 2B: --00 2Ch 1 2C: 2Dh 4 Erase Block Region 1 Information 2D: bits 0–15 = y, y+1 = number of identical-size erase blocks 2E: bits 16–31 = z, region erase block(s) size are z x 256 bytes 2F: 30: 31h 4 Erase Block Region 2 Information 31: bits 0–15 = y, y+1 = number of identical-size erase blocks 32: bits 16–31 = z, region erase block(s) size are z x 256 bytes 33: 34: 35h 4 Reserved for future erase block region information 35: 36: 37: 38: See table below See table below See table below See table below Number of erase block regions (x) within device: 1. x = 0 means no erase blocking; the device erases in bulk 2. x specifies the number of device regions with one or more contiguous same-size erase blocks. 3. S ymmetricall y blocked partitions have one blockin g region Flash device interface code assignment: "n" such that n+1 specifies the bit field that represents the flash device width ca pabilities as described in the table: Address 32 Mbit

64 Mbit 128 Mbit

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

94 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) B.6 Numonyx-Specific Extended Query Table Table 43: Primary Vendor-Specific Extended Query Offset(1) Length Description Hex P = 39h (Optional flash features and commands) Add. Code Value (P+0)h 3 Primary extended query table 39: --50 "P" (P+1)h Unique ASCII string “PRI“ 3A: --52 "R" (P+3)h 1 Major version number, ASCII 3C: --31 "1" (P+4)h 1 Minor version number, ASCII 3D: --33 "3" (P+5)h 4 Optional feature and command support (1=yes, 0=no) 3E: --E6 (P+6)h bits 10–31 are reserved; undefined bits are “0.” If bit 31 is 3F: --03 (P+7)h “1” then another 31 bit field of Optional features follows at 40: --00 (P+8)h the end of the bit–30 field. 41: --00 bit 0 Chip erase supported bit 0 = 0 No bit 1 Suspend erase supported bit 1 = 1 Yes bit 2 Suspend program supported bit 2 = 1 Yes bit 3 Legacy lock/unlock supported bit 3 = 0 No bit 4 Queued erase supported bit 4 = 0 No bit 5 Instant individual block locking supported bit 5 = 1 Yes bit 6 Protection bits supported bit 6 = 1 Yes bit 7 Pagemode read supported bit 7 = 1 Yes bit 8 Synchronous read supported bit 8 = 1 Yes bit 9 Simultaneous operations supported bit 9 = 1 Yes (P+9)h 1 42: --01 bit 0 Program supported after erase suspend bit 0 = 1 Yes (P+A)h 2 Block status register mask 43: --03 (P+B)h bits 2–15 are Reserved; undefined bits are “0” 44: --00 bit 0 Block Lock-Bit Status register active bit 0 = 1 Yes bit 1 Block Lock-Down Bit Status active bit 1 = 1 Yes Supported functions after suspend: read Array, Status, Query Other supported operations are: bits 1–7 reserved; undefined bits are “0” V CC logic supply highest performance program/erase voltage bits 0–3 BCD value in 100 mV bits 4–7 BCD value in volts VPP optimum program/erase supply voltage bits 0–3 BCD value in 100 mV bits 4–7 HEX value in volts

Order Number: 290701-18 95 Numonyx™ Wireless Flash Memory (W18) Table 45: Burst Read Information for Non-muxed Device Table 44: Protection Register Information Offset P = 39h Length Description (Optional Flash Features and Commands) Add. Hex Code Value (P + E)h 1 Number of Protectuib Register fields in JEDEC ID space. “00h” indicates that 256 protection fields are available. 47: --01 1 (P + E)h (P + 10)h (P + 11)h (P + 12)h Protection Field 1: Protection Description This field describes user-available One Time Programmable (OTP) Protection Register bytes, Some are pre-programmed with device- unique serial numbers. Others are user-programmable. Bits are 0-15 point to the Protection Register lock byte, the section’s first byte. The following bytes are factory pre-programmed and user-programmable:

• bits 0-7 = Lock/bytes JEDEC-plane physical low address
• bites 8-15 = Lock/bytes JEDEC-plane physical high address
• bits 16-23 = “n” such that 2n = factory pre- programmed bytes
• bits 24-31 = “n” such that 2n = user-programmable bytes 48: 49: 4A: 4B: --80 --00 --03 --03 80h 00h 8 byte 8 byte Offset(1) Length Description Hex P = 39h (Optional flash features and commands) Add. Code Value (P+13)h 1 4C: --03 8 byte (P+16)h 1 Synchronous mode read capability configuration 2 4F: --02 8 (P+17)h 1 Synchronous mode read capability configuration 3 50: --03 16 (P+18)h 1 Synchronous mode read capability configuration 4 51: --07 Cont Page Mode Read capability bits 0–7 = “n” such that 2n HEX value represents the number of read-page bytes. See offset 28h for device word width to determine page-mode data output width. 00h indicates no read page buffer. Number of synchronous mode read configuration fields that follow. 00h indicates no burst capability. Synchronous mode read capability configuration 1 Bits 3–7 = Reserved bits 0–2 “n” such that 2n+1 HEX value represents the maximum number of continuous synchronous reads when the device is configured for its maximum word width. A value of 07h indicates that the device is capable of continuous linear bursts that will output data until the internal burst counter reaches the end of the device’s burstable address space. This field’s 3-bit value can be written directly to the Read Configuration Register bits 0–2 if the device is configured for its maximum word width. See offset 28h for word width to determine the burst data out put width.

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

96 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Table 46: Partition and Erase-block Region Information Offset(1) See table below P = 39h Description Address Bottom Top (Optional flash features and commands) Len Bot Top (P+19)h (P+19)h 1 52: 52:Number of device hardware-partition regions within the device. x = 0: a single hardware partition device (no fields follow). x specifies the number of device partition regions containing one or more contiguous erase block regions.

Order Number: 290701-18 97 Numonyx™ Wireless Flash Memory (W18) Table 47: Partition Region 1 Information Offset(1) See table below P = 39h Description Address Bottom Top (Optional flash features and commands) Len Bot Top (P+1A)h (P+1A)h Number of identical partitions within the partition region 2 53: 53: (P+1B)h (P+1B)h 54: 54: (P+20)h (P+20)h Partition Region 1 Erase Block Type 1 Information 4 59: 59: (P+21)h (P+21)h bits 0–15 = y, y+1 = number of identical-size erase blocks 5A: 5A: (P+22)h (P+22)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 5B: 5B: (P+23)h (P+23)h 5C: 5C: (P+24)h (P+24)h Partition 1 (Erase Block Type 1) 25 D : 5 D : (P+25)h (P+25)h Minimum block erase cycles x 1000 5E: 5E: (P+28)h Partition Region 1 Erase Block Type 2 Information 4 61: (P+29)h bits 0–15 = y, y+1 = number of identical-size erase blocks 62: (P+2A)h bits 16–31 = z, region erase block(s) size are z x 256 bytes 63: (P+2B)h (bottom parameter device only) 64: (P+2C)h Partition 1 (Erase block Type 2) 2 65: (P+2D)h Minimum block erase cycles x 1000 66: (P+2E)h 1 67: (P+2F)h 1 68: Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Program mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Simultaneous program or erase operations allowed in other partitions while a partition in this region is in Erase mode bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Number of program or erase operations allowed in a partition bits 0–3 = number of simultaneous Program operations bits 4–7 = number of simultaneous Erase operations Partition 1 (erase block Type 1) bits per cell; internal ECC bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserve for future use Partition 1 (erase block Type 1) page mode and synchronous mode capabilities defined in Table 10. bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Partition 1 (Erase block Type 2) bits per cell bits 0–3 = bits per cell in erase region bit 4 = reserved for “internal ECC used” (1=yes, 0=no) bits 5–7 = reserve for future use Partition 1 (Erase block Type 2) pagemode and synchronous mode capabilities defined in Table 10 bit 0 = page-mode host reads permitted (1=yes, 0=no) bit 1 = synchronous host reads permitted (1=yes, 0=no) bit 2 = synchronous host writes permitted (1=yes, 0=no) bits 3–7 = reserved for future use Types of erase block regions in this Partition Region. x = 0 = no erase blocking; the Partition Region erases in bulk x = number of erase block regions w/ contiguous same-size erase blocks. Symmetrically blocked partitions have one blocking region. Partition size = (Type 1 blocks)x(Type 1 block sizes) + (Type 2 blocks)x(Type 2 block sizes) +…+ (Type n blocks)x(Type n block sizes)

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

98 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Notes: 1. The variable P is a pointer which is defined at CFI offset 15h. 2. TPD - Top parameter device; BPD - Bottom parameter device. 3. Partition: Each partition is 4-Mbit in size. It can contain main blocks OR a combination of both main and parameter blocks. 4. Partition Region: Symmetrical partitions form a partition region. There are two partition regions: A contains all the partitions that are made up of main blocks only; B contains the partition made up of the parameter and the main blocks. Table 48: Partition and Erase Block Region Information Address 32 Mbit 64Mbit 128Mbit

Order Number: 290701-18 99 Numonyx™ Wireless Flash Memory (W18) Appendix C Ordering Information To order samples, obtain datasheets or inquire about any stack combination, please contact your local Numonyx representative. Table 49: 38F Type Stacked Components PF 38F 5070 M0 Y 0 B 0 Package Designator Product Line Designator Product Die/ Density Configuration NOR Flash Product Family Voltage/NOR Flash CE# Configuration Parameter / Mux Configuration Ballout Identifier Device Details PF = SCSP, RoHS RD = SCSP, Leaded Stacked NOR Flash + RAM Char 1 = Flash die #1 Char 2 = Flash die #2 Char 3 = RAM die #1 Char 4 = RAM die #2 (See Table 51, “38F / 48F Density Decoder” on page 100 for details) First character applies to Flash die #1 Second character applies to Flash die #2 (See Table 52, “NOR Flash Family Decoder” on page 101 for details) V =

1.8 V Core

and I/O; Separate Chip Enable per die (See Table 53, “Voltage / NOR Flash CE# Configurati on Decoder” on page 101 for details) 0 = No parameter blocks; Non- Mux I/O interface (See Table 54, “Paramete r / Mux Configurati on Decoder” on page 101 for details) B = x16D Ballout (See Table 5 “Ballout Decoder ” on page 10 for details) 0 = Original released version of this product

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

100 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) Table 50: 48F Type Stacked Components PC 48F 4400 P0 V B 0 0 Package Designator Product Line Designator Product Die/ Density Configuration NOR Flash Product Family Voltage/NOR Flash CE# Configuration Parameter / Mux Configuration Ballout Identifier Device Details PC = Easy BGA, RoHS RC = Easy BGA, Leaded JS = TSOP, RoHS TE = TSOP, Leaded PF = SCSP , RoHS RD = SCSP , Leaded Stacked NOR Flash only Char 1 = Flash die #1 Char 2 = Flash die #2 Char 3 = Flash die #3 Char 4 = Flash die #4 (See Table 51, “38F / 48F Density Decoder” on page 100 for details) First character applies to Flash dies #1 and #2 Second character applies to Flash dies #3 and #4 (See Table 52, “NOR Flash Family Decoder” on page 101 for details) V = and 3 V I/O; Virtual Chip Enable (See Table 53, “Voltage / NOR Flash CE# Configurati on Decoder” on page 101 for details) B = Bottom parameter; Non-Mux I/O interface (See Table 54, “Paramete r / Mux Configurati on Decoder” on page 101 for details) 0 = Discrete Ballout (See Table 5 “Ballout Decoder ” on page 10 2 for details) 0 = Original released version of this product Table 51: 38F / 48F Density Decoder Code Flash Density RAM Density

0 No Die No Die

Order Number: 290701-18 101 Numonyx™ Wireless Flash Memory (W18) Table 52: NOR Flash Family Decoder Code Family Marketing Name C C3 Numonyx Advanced+ Boot Block Flash Memory J J3v.D Numonyx Embedded Flash Memory L L18 / L30 Numonyx StrataFlash® Wireless Memory M M18 Numonyx StrataFlash® Cellular Memory P P30 / P33 Numonyx StrataFalsh® Embedded Memory W W18 / W30 Numonyx Wireless Flash Memory 0(zero) - No Die Table 53: Voltage / NOR Flash CE# Configuration Decoder Code I/O Voltage (Volt) Core Voltage (Volt) CE# Configuration Z 3.0 1.8 Seperate Chip Enable per die Y 1.8 1.8 Seperate Chip Enable per die X 3.0 3.0 Seperate Chip Enable per die V 3.0 1.8 Virtual Chip Enable U 1.8 1.8 Virtual Chip Enable T 3.0 3.0 Virtual Chip Enable R3 . 0 1 . 8 V i r t u a l A d d r e s s Q1 . 8 1 . 8 V i r t u a l A d d r e s s P3 . 0 3 . 0 V i r t u a l A d d r e s s Table 54: Parameter / Mux Configuration Decoder Code, Mux Identification Number of Flash Die Bus Width Flash Die 1 Flash Die 2 Flash Die 3 Flash Die 4 0 = Non Mux 1 = AD Mux1 2= AAD Mux 3 =Full" AD Mux2 Any NA Notation used for stacks that contain no parameter blocks B = Non Mux C = AD Mux F = "Full" Ad Mux X16 B o t t o m ---

2 Bottom Top - -

3 Bottom Bottom Top -

4 Bottom Top Bottom Top

4 Bottom Bottom Top Top

Numonyx™ Wireless Flash Memory (W18) Datasheet November 2007

102 Order Number: 290701-18

Numonyx™ Wireless Flash Memory (W18) T = Non Mux U = AD Mux W = "Full" Ad Mux X16 T o p ---

2 Top Bottom - -

3 Top Top Bottom -

4 Top Bottom Top Bottom

4 Top Top Bottom Bottom

1. Only Flash is Muxed and RAM is non-Muxed 2. Both Flash and RAM are AD-Muxed Table 54: Parameter / Mux Configuration Decoder Code, Mux Identification Number of Flash Die Bus Width Flash Die 1 Flash Die 2 Flash Die 3 Flash Die 4 Table 55: Ballout Decoder Code Ballout Definition 0 (Zero) SDiscrete ballout (Easay BGA and TSOP) B x16D ballout, 105 ball (x16 NOR + NAND + DRAM Share Bus) C x16C ballout, 107 ball (x16 NOR + NAND + PSRAM Share Bus) Q QUAD/+ ballout, 88 ball (x16 NOR + PSRAM Share Bus) U x32SH ballout, 106 ball (x32 NOR only Share Bus) V x16SB ballout, 165 ball (x16 NOR / NAND + x16 DRAM Split Bus W x48D ballout, 165 ball (x16/x32 NOR + NAND + DRAM Split Bus