MBM29BS12DH15

MBM29BS12DH15 SPANSION | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 84

Technical content

DS05-20910-2EFUJITSU SEMICONDUCTOR DATA SHEET BURST MODE FLASH MEMORY CMOS MBM29BS/FS12DH 15 n DESCRIPTION The MBM29BS/FS12DH is a 128 Mbit, 1.8 Volt-only, Burst mode and dual operation Flash memory organized as 8M words of 16 bits each. The device offered in a 80-ball FBGA package. This device is designed to be programmed in-system with the standard system 1.8 V V CC supply. 12.0 V VPP and 5.0 V VCC are not required for write or erase operations. The device can also be programmed in standard EPROM programmers. (Continued) n PRODUCT LINE UP n PACKAGE Part No. MBM29BS12DH MBM29FS12DH Handshaking On/Off Non-Handshaking Handshaking Synchronous/Burst Max Latency (even address in case of Handshaking) Time (ns) 71 56 Max Burst Access Time (ns) 11 11 Max OE Access Time (ns) 11 11 Asynchronous Max Address Access Time (ns) 50 50 Max CE Access Time (ns) 50 50 Max OE Access Time (ns) 11 11 80-ball plastic FBGA (BGA-80P-M04)

(Continued) The device provides truly high performance non-volatile memory solution. The device offers fast burst access frequency of 66 MHz with initial access times of 56 ns at Handshaking mode, allowing operation of high-speed microprocessors without wait states. T o eliminate bus connection the device has separate chip enable (CE write enable (WE), address valid (AVD) and output enable (OE) controls. For burst operations, the device additionally requires Ready (RDY) at Handshaking mode, and Clock (CLK). This implementation allows easy interface with minimal glue logic to a wide range of microprocessors/ microcontrollers for high performance read operations. The burst read mode feature gives system designers flexibility in the interface to the device. The user can preset the burst length and wrap through the same memory space. At 66 MHz, the device provides a burst access of 11 ns with a latency of 56 ns at 30 pF (Handshaking mode). The dual operation function provides simultaneous operation by dividing the memory space into four banks. The device can improve overall system performance by allowing a host system to program or erase in one bank, then immediately and simultaneously read from another bank, with zero latency. This releases the system from waiting for the completion of program or erase operations. The device is command set compatible with JEDEC standard E 2PROMs. Commands are written to the command register using standard microprocessor write timing. Register contents serve as inputs to an internal state- machine which controls the erase and programming circuitry. Write cycles also internally latch addresses and data needed for the programming and erase operations. Reading data out of the device is similar to reading from 5.0 V and 12.0 V Flash or EPROM devices. The device is programmed by executing the program command sequence. This will invoke the Embedded Program Algorithm which is an internal algorithm that automatically times the program pulse widths and verifies proper cell margins. T ypically, each 32K words sector can be programmed and verified in about 0.3 second. Erase is accomplished by executing the erase command sequence. This will invoke the Embedded Erase Algorithm which is an internal algorithm that automatically preprograms the array if it is not already programmed before executing the erase operation. During erase, the device automatically times the erase pulse widths and verifies proper cell margins. Any individual sector is typically erased and verified in 0.5 second. (If already preprogrammed.) The device also features a sector erase architecture. The sector mode allows each sector to be erased and reprogrammed without affecting other sectors. The device is erased when shipped from the factory. The Enhanced V I/O (VCCQ ) feature allows the output voltage generated on the device to be determined based on the VI/O level. This feature allows this device to operate in the 1.8 V I/O environment, driving and receiving signals to and from other 1.8 V devices on the same bus. The device features single 1.8 V power supply operation for both read and write functions. Internally generated and regulated voltages are provided for the program and erase operations. The end of program or erase is detected by Data Polling of DQ7, by the T oggle Bit feature on DQ6, output pin. Once the end of a program or erase cycle has been completed, the device internally resets to the read mode. Fujitsu’s Flash technology combines years of Flash memory manufacturing experience to produce the highest levels of quality, reliability and cost effectiveness. The device electrically erases all bits within a sector simulta- neously via Fowler-Nordheim tunneling. The data is programmed using hot electron injection.

• 0 . 1 3 mmmmm process technology
• Single 1.8 V read, program and erase (1.65 V to 1.95 V)
• Simultaneous Read/Write operation (Dual Bank)
• FlexBankTM *1 Bank A: 16 Mbit (4 Kwords · 8 and 32 Kwords · 31) Bank B: 48 Mbit (32 Kwords · 96) Bank C: 48 Mbit (32 Kwords · 96) Bank D: 16 Mbit (4 Kwords · 8 and 32 Kwords · 31)
• Enhanced VI/OTM *2 (VCCQ ) Feature Input/ Output voltage generated on the device is determined based on the VI/O level
• High Performance Burst frequency reach at 66 MHz Burst access times of 11 ns @ 30 pF at industrial temperature range Asynchronous random access times of 50 ns (at 30 pF) Synchronous latency of 56 ns with 1.8 V VCCQ for Handshaking mode
• Programmable Burst Interface Linear Burst: 8, 16, and 32 words with wrap-around
• Compatible with JEDEC-standard commands Uses same software commands as E2PROMs
• Minimum 100,000 program/erase cycles
• Sector Erase Architecture Eight 4 Kwords, two hundred fifty-four 32 Kwords sectors, eight 4 Kwords sectors. Any combination of sectors can be concurrently erased. Also supports full chip erase.
• HiddenROM region 64 words for factory and 64 words for customer of HiddenROM, accessible through a new “HiddenROM Enable” command sequence Factory serialized and protected to provide a sector secure serial number (ESN)
• Write Protect Pin (WP) At VIL, allows protection of “outermost” 4·4 K words on low, high end or both ends of boot sectors, regardless of sector protection/unprotection status
• Accelerate Pin (ACC) At VACC , increases program performance. ; all sectors locked when ACC = VIL
• Embedded EraseTM *2 Algorithms Automatically preprograms and erases the chip or any sector
• Embedded Program TM *2 Algorithms Automatically writes and verifies data at specified address
• D a t a Polling and Toggle Bit feature for detection of program or erase cycle completion
• Ready Output (RDY) In Synchronous Mode, indicates the status of the Burst read. In Asynchronous Mode, indicates the status of the internal program and erase function.
• Automatic sleep mode When address remain stable, the device automatically switches itself to low power mode
• Erase Suspend/Resume Suspends the erase operation to allow a read data and/or program in another sector within the same device
• In accordance with CFI (Common Flash Interface)
• Hardware reset pin (RESET) Hardware method to reset the device for reading array data *1 : FlexBankTM is a trademark of Fujitsu Limited. *2 : Embedded EraseTM , Embedded ProgramTM and Enhanced VI/OTM are trademarks of Advanced Micro Devices, Inc. (Continued)

(Continued)

• Sector Protection Persistent sector protection Password sector protection ACC protects all sectors WP protects the outermost 4 x 4 K words on both ends of boot sectors, regardless of sector protection / unprotection status.
• Handshaking feature available (MBM29FS12DH) Provides host system with minimum possible latency by monitoring RDY
• CMOS compatible inputs, CMOS compatible outputs

MBM29BS/FS12DH Pin Configuration Table Pin name Function A22 to A0 Address Inputs DQ 15 to DQ0 Data Inputs/Outputs CLK CLK Input CE Chip Enable OE Output Enable WE Write Enable AVD Address Valid Input RDY Ready Output. (In asynchronous mode, RY/BY Output) RESET Hardware Reset WP Hardware Write Protection ACC Program Acceleration N.C. Pin Not Connected Internally VSS Device Ground VCC Device Power Supply VSSQ Input & Output Buffer Ground VCCQ Input & Output Buffer Power Supply (BGA-80P-M04) FBGA (TOP VIEW) Marking Side A22 A13 VCC VSSQ D8 E8 F8 G8 H8 J8 A12 A14 A15 A16 N.C. DQ 15 VSS C7 D7 E7 F7 G7 H7 J7 K7 A8 A10 A11 DQ 7 DQ 14 DQ 13 DQ 6 C6 D6 E6 F6 G6 H6 J6 K6 WE RESET A 21 DQ 12 VCC DQ 4 C5 D5 E5 H5 J5 K5 DQ 10A18RDY ACC DQ 11 DQ 3 D4 E4C4 H4 J4 K4 A17 A6 A5 DQ 0 DQ 8 DQ 9 DQ 1 C3 D3 E3 F3 G3 H3 J3 K3 A2 A1 A0 CE OE V SS C2 D2 E2 F2 G2 H2 J2 K2 CLK WP AVD VCCQ D1 J1E1 F1 G1 H1 A19 DQ 5 A20 DQ 2 L8K8 L7 M7 N.C. N.C. L1 M1 N.C. N.C. N.C. N.C. A1 B1 N.C. N.C. N.C. N.C. A7 B7 N.C. N.C. N.C. N.C. N.C. N.C. N.C.

16 Mbit

(Bank A) X-Decoder Y -Gating Cell Matrix (Bank D) X-Decoder Y -Gating Cell Matrix

48 Mbit

(Bank B) X-Decoder Y -Gating Cell Matrix (Bank C) X-Decoder Y -Gating VSSQ VSS VCCQ CLK ACC A22 to A0 OE ACC CE WP CLK DQ 15 to DQ0 WE RDY RESET AVD

MBM29BS/FS12DH User Bus Operations Table Legend: L = VIL, H = VIH, X = VIL or VIH, = Pulse input. See “n DC CHARACTERISTICS” for voltage levels. *1 : WE can be VIL if OE is VIL, OE at VIH initiates the write operations. *2 : At WP=V IL, SA0-SA3 and SA266-SA269 are protected. At ACC=VIL, all sectors are protected. *3 : Write Operation: at asynchronous mode, addresses are latched on the last falling edge of WE pulse while AVD is held low or rising edge of AVD pulse whichever comes first. Data is latched on the 1st rising edge of WE. *4 : Write Operation: at synchronous mode, addresses are latched on the falling edge of WE while AVD is held low or active edge of CLK while AVD is held low whichever happens first. Data is latched on the 1st rising edge of WE. Operation CE OE WE WP ACC A 22 to A0 DQ 15 to DQ0 CLK AVD RESET Asynchronous Mode Operations (Default) Asynchronous Read Addresses Latched *1 L L H X X Addr In D OUT XL H Standby H X X X X X High-Z X X H Output Disable L H H X X X High-Z X X H Write - WE address latched *3 LH LX * 2 H*2 Addr In D IN XL H Write - AVD address latched *3 LH X * 2 H*2 Addr In D IN XH Boot Block Sector Write Protection *2 XX X L X X X X X H All Sector Write Protection *2 XX X X L X X X X H RESET X X X X X X High-Z X X L Synchronous Mode Operations (need to set the configuration register) Load Starting Burst Address (CLK latch) *1 L X H X X Addr In X H Advance Burst to next address with appropriate Data presented on the Data Bus * LLH X X X D OUT HH Terminate current Burst read cycle H X H X X X High-Z X H Terminate current Burst read via RESET X X H X X X High-Z X X L Terminate current Burst read cycle and start new Burst read cycleL X H X X Addr In D OUT H Burst Suspend L H H X X X High-Z X H H Standby H X X X X X High-Z X X H Output Disable L H H X X X High-Z X X H Write - WE address latched *4 LH LX * 2 H*2 Addr In D IN H/L L H Write - CLK address latched *4 LH X * 2 H*2 Addr In D IN H Write - AVD address latched *4 LH X * 2 H*2 Addr In D IN H/L H Boot Block Sector Write Protection *2 XX X L X X X X X H All Sector Write Protection *2 XX X X L X X X X H RESET X X X X X X High-Z X X L

MBM29BS/FS12DH Command Definitions Table (Continued) Command Sequence Bus Write Cycles Req’d First Bus Write Cycle Second Write Cycle Third Write Cycle Fourth Write Cycle Fifth Write Cycle Sixth Write Cycle Seventh Write Cycle Read / Reset 3 555h AAh 2AAh 55h 555h F0h RA RD —————— Autoselect 3 555h AAh 2AAh 55h (BA) Program 4 555h AAh 2AAh 55h 555h A0h PA PD —————— Chip Erase 6 555h AAh 2AAh 55h 555h 80h 555h AAh 2AAh 55h 555h 10h —— Sector Erase 6 555h AAh 2AAh 55h 555h 80h 555h AAh 2AAh 55h SA 30h —— Set to Fast Mode 3 555h AAh 2AAh 55h 555h 20h — — —————— Reset from Fast Set Burst Mode Configuration Register 555h AAh 2AAh 55h (CR) Query 1 (BA) HiddenROM Entry 3 555h AAh 2AAh 55h 555h 88h — — —————— HiddenROM Program*2 4 555h AAh 2AAh 55h 555h A0h (HRA) HiddenROM Exit *2 4 555h AAh 2AAh 55h (HRBA) HiddenROM Protect *2 6 555h AAh 2AAh 55h 555h 60h OPBP 68h OPBP 48h XXXh RD (0) —— Password Program 4 555h AAh 2AAh 55h 555h 38h XX0h PD0 —————— 555h AAh 2AAh 55h 555h 38h XX1h PD1 —————— 555h AAh 2AAh 55h 555h 38h XX2h PD2 —————— 555h AAh 2AAh 55h 555h 38h XX3h PD3 —————— Password Unlock 7 555h AAh 2AAh 55h 555h 28h XX0h PD0 XX1h PD1 XX2h PD2 XX3h PD3

(Continued) Legend: RA = Address of the memory location to be read. PA = Address of the memory location to be programmed. Addresses latch on the rising edge of the AVD pulse or active edge of CLK while AVD = VIL whichever comes first or falling edge of write pulse while AVD = VIL. SA = Address of the sector to be erased. The combination of A22, A21, A20, A19, A18, A17, A16, A15, A14, A13, and A12 will uniquely select any sector. BA = Bank Address. Address settled by A22, A21, A20 will select Bank A, Bank B, Bank C and Bank D. RD = Data read from location RA during read operation. PD = Data to be programmed at location PA. Data latches on the rising edge of write pulse. SGA = Sector group address to be protected. SD = Sector group protection verify data. Output 01h at protected sector group addresses and output 00h at unprotected sector group addresses. HRA = Address of the HiddenROM area 000000h to 00007Fh HRBA = Bank Address of the HiddenROM area (A 22 = A21 = A20 = VIL) RD (0) = Read Data bit. If programmed, DQ0 = 1, if erase, DQ0 = 0 RD (1) = Read Data bit. If programmed, DQ1 = 1, if erase, DQ1 = 0 PWA/PWD = Password Address/Password Data CR = Configuration Register address bits A19 to A12. (Continued) Command Sequence Bus Write Cycles Req’d First Bus Write Cycle Second Write Cycle Third Write Cycle Fourth Write Cycle Fifth Write Cycle Sixth Write Cycle Seventh Write Cycle Password Verify 4 555h AAh 2AAh 55h 555h C8h PWA PWD —— — — — — Password Mode Locking Bit Program 555h AAh 2AAh 55h 555h 60h PL 68h PL 48h XXh RD (0) —— Persistent Protection Mode Locking Bit Program 555h AAh 2AAh 55h 555h 60h SPML 68h SPML 48h XXh RD (0) —— PPB Program 6 555h AAh 2AAh 55h 555h 60h SGA+ WP 68h SGA+ WP 48h XXh RD (0) —— PPB Verify 4 555h AAh 2AAh 55h (BA) 555h 90h SGA+ WP RD All PPB Erase 6 555h AAh 2AAh 55h 555h 60h WPE 60h WPE 40h XXh RD (0) —— PPB Lock Bit Set 6 555h AAh 2AAh 55h 555h 78h ———— — — — — PPB Lock Bit Verify 4 555h AAh 2AAh 55h 555h 58h SA RD DPB Write 4 555h AAh 2AAh 55h 555h 48h SA X1h —— — — — — DPB Erase 4 555h AAh 2AAh 55h 555h 48h SA X0h —— — — — — DPB Verify 4 555h AAh 2AAh 55h 555h 58h SA RD

(Continued) *1: This command is valid during Fast Mode. *2: This command is valid during HiddenROM mode. *3: The data “00h” is also acceptable. Notes : • Address bits A22 to A11 = X = “H” or “L” for all address commands except for PA, SA, BA, SGA, OPBP, PWA, PL, SPML, WP, WPE.

• Bus operations are defined in “MBM29BS/FS12DH User Bus Operations Table”.
• Both Read/Reset commands are functionally equivalent, resetting the device to the read mode.
• Command Combinations not described in “MBM29BS/FS12DH Command Definitions Table” are illegal. MBM29BS/FS12DH Sector Protection Verify Autoselect Codes Table *1 : Outputs 01h at protected sector group addresses and outputs 00h at unprotected sector group addresses. *2 : A read cycle at address (BA) 01h outputs device code. When 227Eh is output, it indicates that two additional codes, called Extended Device Codes, will be required. Therefore the system may continue reading out these Extended Device Codes at the address of (BA) 0Eh, as well as at (BA) 0Fh. Extended Autoselect Code Table Type A 22 to A12 A 7 A 6 A 5 A 4 A 3 A 2 A 1 A 0 Code (HEX) Manufacture’s Code BA V IL VIL VIL VIL VIL VIL VIL VIL 04h Device Code BA V IL VIL VIL VIL VIL VIL VIL VIH 227Eh Extended Device Code*2 BA V IL VIL VIL VIL VIH VIH VIH VIL 2218h BA V IL VIL VIL VIL VIH VIH VIH VIH 2200h Sector Group Protection Sector Group Addresses VIL VIL VIL VIL VIL VIL VIH VIL 01h*1 Indicator Bits BA V IL VIL VIL VIL VIL VIL VIH VIH DQ 7 - Factory Lock Bit 1 = Locked, 0 = Not Locked DQ 6 - Customer Lock Bit 1 = Locked, 0 = Not Locked DQ 5 - Handshake Bit 1 = Handshake (FS12), 0 = non-Handshake(BS12) Type Code DQ

15 DQ 14 DQ 13 DQ 12 DQ 11 DQ 10 DQ 9 DQ 8 DQ 7 DQ 6 DQ 5 DQ 4 DQ 3 DQ 2 DQ 1 DQ 0

Manufacture’s Code 0 4 h 000000 0 0 0 0 0 0 0 1 0 0 D e v i c e C o d e2 2 7 E h 001000 1 0 0 1 1 1 1 1 1 0 Extended Device Code 2 2 1 8 h 001000 1 0 0 0 0 1 1 0 0 0 2 2 0 0 h 001000 1 0 0 0 0 0 0 0 0 0 Sector Group Protection 0 0 h 000000 0 0 0 0 0 0 0 0 0 0 0 1 h 000000 0 0 0 0 0 0 0 0 0 1

n FLEXIBLE SECTOR-ERASE ARCHITECTURE Sector Address Table (Bank A) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank A SA0 0 0 0 0 0 0 0 0 0 0 0 4 000000h to 000FFFh SA1 0 0 0 0 0 0 0 0 0 0 1 4 001000h to 001FFFh SA2 0 0 0 0 0 0 0 0 0 1 0 4 002000h to 002FFFh SA3 0 0 0 0 0 0 0 0 0 1 1 4 003000h to 003FFFh SA4 0 0 0 0 0 0 0 0 1 0 0 4 004000h to 004FFFh SA5 0 0 0 0 0 0 0 0 1 0 1 4 005000h to 005FFFh SA6 0 0 0 0 0 0 0 0 1 1 0 4 006000h to 006FFFh SA7 0 0 0 0 0 0 0 0 1 1 1 4 007000h to 007FFFh SA8 0 0 0 0 0 0 0 1 X X X 32 008000h to 00FFFFh SA9 0 0 0 0 0 0 1 0 X X X 32 010000h to 017FFFh SA10 0 0 0 0 0 0 1 1 X X X 32 018000h to 01FFFFh SA11 0 0 0 0 0 1 0 0 X X X 32 020000h to 027FFFh SA12 0 0 0 0 0 1 0 1 X X X 32 028000h to 02FFFFh SA13 0 0 0 0 0 1 1 0 X X X 32 030000h to 037FFFh SA14 0 0 0 0 0 1 1 1 X X X 32 038000h to 03FFFFh SA15 0 0 0 0 1 0 0 0 X X X 32 040000h to 047FFFh SA16 0 0 0 0 1 0 0 1 X X X 32 048000h to 04FFFFh SA17 0 0 0 0 1 0 1 0 X X X 32 050000h to 057FFFh SA18 0 0 0 0 1 0 1 1 X X X 32 058000h to 05FFFFh SA19 0 0 0 0 1 1 0 0 X X X 32 060000h to 06FFFFh SA20 0 0 0 0 1 1 0 1 X X X 32 068000h to 06FFFFh SA21 0 0 0 0 1 1 1 0 X X X 32 070000h to 077FFFh SA22 0 0 0 0 1 1 1 1 X X X 32 078000h to 07FFFFh SA23 0 0 0 1 0 0 0 0 X X X 32 080000h to 087FFFh SA24 0 0 0 1 0 0 0 1 X X X 32 088000h to 08FFFFh SA25 0 0 0 1 0 0 1 0 X X X 32 090000h to 097FFFh SA26 0 0 0 1 0 0 1 1 X X X 32 098000h to 09FFFFh SA27 0 0 0 1 0 1 0 0 X X X 32 0A0000h to 0A7FFFh SA28 0 0 0 1 0 1 0 1 X X X 32 0A8000h to 0AFFFFh SA29 0 0 0 1 0 1 1 0 X X X 32 0B0000h to 0B7FFFh SA30 0 0 0 1 0 1 1 1 X X X 32 0B8000h to 0BFFFFh SA31 0 0 0 1 1 0 0 0 X X X 32 0C0000h to 0C7FFFh SA32 0 0 0 1 1 0 0 1 X X X 32 0C8000h to 0CFFFFh SA33 0 0 0 1 1 0 1 0 X X X 32 0D0000h to 0D7FFFh SA34 0 0 0 1 1 0 1 1 X X X 32 0D8000h to 0DFFFFh SA35 0 0 0 1 1 1 0 0 X X X 32 0E0000h to 0E7FFFh SA36 0 0 0 1 1 1 0 1 X X X 32 0E8000h to 0EFFFFh SA37 0 0 0 1 1 1 1 0 X X X 32 0F0000h to 0F7FFFh SA38 0 0 0 1 1 1 1 1 X X X 32 0F8000h to 0FFFFFh

Sector Address Table (Bank B) (Continued) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank B SA39 0 0 1 0 0 0 0 0 X X X 32 100000h to 107FFFh SA40 0 0 1 0 0 0 0 1 X X X 32 108000h to 10FFFFh SA41 0 0 1 0 0 0 1 0 X X X 32 110000h to 117FFFh SA42 0 0 1 0 0 0 1 1 X X X 32 118000h to 11FFFFh SA43 0 0 1 0 0 1 0 0 X X X 32 120000h to 127FFFh SA44 0 0 1 0 0 1 0 1 X X X 32 128000h to 12FFFFh SA45 0 0 1 0 0 1 1 0 X X X 32 130000h to 137FFFh SA46 0 0 1 0 0 1 1 1 X X X 32 138000h to 13FFFFh SA47 0 0 1 0 1 0 0 0 X X X 32 140000h to 147FFFh SA48 0 0 1 0 1 0 0 1 X X X 32 148000h to 14FFFFh SA49 0 0 1 0 1 0 1 0 X X X 32 150000h to 157FFFh SA50 0 0 1 0 1 0 1 1 X X X 32 158000h to 15FFFFh SA51 0 0 1 0 1 1 0 0 X X X 32 160000h to 167FFFh SA52 0 0 1 0 1 1 0 1 X X X 32 168000h to 16FFFFh SA53 0 0 1 0 1 1 1 0 X X X 32 170000h to 177FFFh SA54 0 0 1 0 1 1 1 1 X X X 32 178000h to 17FFFFh SA55 0 0 1 1 0 0 0 0 X X X 32 180000h to 187FFFh SA56 0 0 1 1 0 0 0 1 X X X 32 188000h to 18FFFFh SA57 0 0 1 1 0 0 1 0 X X X 32 190000h to 197FFFh SA58 0 0 1 1 0 0 1 1 X X X 32 198000h to 19FFFFh SA59 0 0 1 1 0 1 0 0 X X X 32 1A0000h to 1A7FFFh SA60 0 0 1 1 0 1 0 1 X X X 32 1A8000h to 1AFFFFh SA61 0 0 1 1 0 1 1 0 X X X 32 1B0000h to 1B7FFFh SA62 0 0 1 1 0 1 1 1 X X X 32 1B8000h to 1BFFFFh SA63 0 0 1 1 1 0 0 0 X X X 32 1C0000h to 1C7FFFh SA64 0 0 1 1 1 0 0 1 X X X 32 1C8000h to 1CFFFFh SA65 0 0 1 1 1 0 1 0 X X X 32 1D0000h to 1D7FFFh SA66 0 0 1 1 1 0 1 1 X X X 32 1D8000h to 1DFFFFh SA67 0 0 1 1 1 1 0 0 X X X 32 1E0000h to 1E7FFFh SA68 0 0 1 1 1 1 0 1 X X X 32 1E8000h to 1EFFFFh SA69 0 0 1 1 1 1 1 0 X X X 32 1F0000h to 1F7FFFh SA70 0 0 1 1 1 1 1 1 X X X 32 1F8000h to 1FFFFFh SA71 0 1 0 0 0 0 0 0 X X X 32 200000h to 207FFFh SA72 0 1 0 0 0 0 0 1 X X X 32 208000h to 20FFFFh SA73 0 1 0 0 0 0 1 0 X X X 32 210000h to 217FFFh SA74 0 1 0 0 0 0 1 1 X X X 32 218000h to 21FFFFh SA75 0 1 0 0 0 1 0 0 X X X 32 220000h to 227FFFh SA76 0 1 0 0 0 1 0 1 X X X 32 228000h to 22FFFFh SA77 0 1 0 0 0 1 1 0 X X X 32 230000h to 237FFFh

(Continued) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank B SA78 0 1 0 0 0 1 1 1 X X X 32 238000h to 23FFFFh SA79 0 1 0 0 1 0 0 0 X X X 32 240000h to 247FFFh SA80 0 1 0 0 1 0 0 1 X X X 32 248000h to 24FFFFh SA81 0 1 0 0 1 0 1 0 X X X 32 250000h to 257FFFh SA82 0 1 0 0 1 0 1 1 X X X 32 258000h to 25FFFFh SA83 0 1 0 0 1 1 0 0 X X X 32 260000h to 267FFFh SA84 0 1 0 0 1 1 0 1 X X X 32 268000h to 26FFFFh SA85 0 1 0 0 1 1 1 0 X X X 32 270000h to 277FFFh SA86 0 1 0 0 1 1 1 1 X X X 32 278000h to 27FFFFh SA87 0 1 0 1 0 0 0 0 X X X 32 280000h to 287FFFh SA88 0 1 0 1 0 0 0 1 X X X 32 288000h to 28FFFFh SA89 0 1 0 1 0 0 1 0 X X X 32 290000h to 297FFFh SA90 0 1 0 1 0 0 1 1 X X X 32 298000h to 29FFFFh SA91 0 1 0 1 0 1 0 0 X X X 32 2A0000h to 2A7FFFh SA92 0 1 0 1 0 1 0 1 X X X 32 2A8000h to 2AFFFFh SA93 0 1 0 1 0 1 1 0 X X X 32 2B0000h to 2B7FFFh SA94 0 1 0 1 0 1 1 1 X X X 32 2B8000h to 2BFFFFh SA95 0 1 0 1 1 0 0 0 X X X 32 2C0000h to 2C7FFFh SA96 0 1 0 1 1 0 0 1 X X X 32 2C8000h to 2CFFFFh SA97 0 1 0 1 1 0 1 0 X X X 32 2D0000h to 2D7FFFh SA98 0 1 0 1 1 0 1 1 X X X 32 2D8000h to 2DFFFFh SA99 0 1 0 1 1 1 0 0 X X X 32 2E0000h to 2E7FFFh SA100 0 1 0 1 1 1 0 1 X X X 32 2E8000h to 2EFFFFh SA101 0 1 0 1 1 1 1 0 X X X 32 2F0000h to 2F7FFFh SA102 0 1 0 1 1 1 1 1 X X X 32 2F8000h to 2FFFFFh SA103 0 1 1 0 0 0 0 0 X X X 32 300000h to 307FFFh SA104 0 1 1 0 0 0 0 1 X X X 32 308000h to 30FFFFh SA105 0 1 1 0 0 0 1 0 X X X 32 310000h to 317FFFh SA106 0 1 1 0 0 0 1 1 X X X 32 318000h to 31FFFFh SA107 0 1 1 0 0 1 0 0 X X X 32 320000h to 327FFFh SA108 0 1 1 0 0 1 0 1 X X X 32 328000h to 32FFFFh SA109 0 1 1 0 0 1 1 0 X X X 32 330000h to 337FFFh SA110 0 1 1 0 0 1 1 1 X X X 32 338000h to 33FFFFh SA111 0 1 1 0 1 0 0 0 X X X 32 340000h to 347FFFh SA112 0 1 1 0 1 0 0 1 X X X 32 348000h to 34FFFFh SA113 0 1 1 0 1 0 1 0 X X X 32 350000h to 357FFFh SA114 0 1 1 0 1 0 1 1 X X X 32 358000h to 35FFFFh SA115 0 1 1 0 1 1 0 0 X X X 32 360000h to 367FFFh SA116 0 1 1 0 1 1 0 1 X X X 32 368000h to 36FFFFh

(Continued) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank B SA117 0 1 1 0 1 1 1 0 X X X 32 370000h to 377FFFh SA118 0 1 1 0 1 1 1 1 X X X 32 378000h to 37FFFFh SA119 0 1 1 1 0 0 0 0 X X X 32 380000h to 387FFFh SA120 0 1 1 1 0 0 0 1 X X X 32 388000h to 38FFFFh SA121 0 1 1 1 0 0 1 0 X X X 32 390000h to 397FFFh SA122 0 1 1 1 0 0 1 1 X X X 32 398000h to 39FFFFh SA123 0 1 1 1 0 1 0 0 X X X 32 3A0000h to 3A7FFFh SA124 0 1 1 1 0 1 0 1 X X X 32 3A8000h to 3AFFFFh SA125 0 1 1 1 0 1 1 0 X X X 32 3B0000h to 3B7FFFh SA126 0 1 1 1 0 1 1 1 X X X 32 3B8000h to 3BFFFFh SA127 0 1 1 1 1 0 0 0 X X X 32 3C0000h to 3C7FFFh SA128 0 1 1 1 1 0 0 1 X X X 32 3C8000h to 3CFFFFh SA129 0 1 1 1 1 0 1 0 X X X 32 3D0000h to 3D7FFFh SA130 0 1 1 1 1 0 1 1 X X X 32 3D8000h to 3DFFFFh SA131 0 1 1 1 1 1 0 0 X X X 32 3E0000h to 3E7FFFh SA132 0 1 1 1 1 1 0 1 X X X 32 3E8000h to 3EFFFFh SA133 0 1 1 1 1 1 1 0 X X X 32 3F0000h to 3F7FFFh SA134 0 1 1 1 1 1 1 1 X X X 32 3F8000h to 3FFFFFh

(Continued) Sector Address Table (Bank C) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank C S A 1 3 5 1 0 0 00000XXX 3 2 4 00000h to 407FFFh S A 1 3 6 1 0 0 00001XXX 3 2 4 0 8000h to 40FFFFh S A 1 3 7 1 0 0 00010XXX 3 2 4 10000h to 417FFFh S A 1 3 8 1 0 0 00011XXX 3 2 4 1 8000h to 41FFFFh S A 1 3 9 1 0 0 00100XXX 3 2 4 20000h to 427FFFh S A 1 4 0 1 0 0 00101XXX 3 2 4 2 8000h to 42FFFFh S A 1 4 1 1 0 0 00110XXX 3 2 4 30000h to 437FFFh S A 1 4 2 1 0 0 00111XXX 3 2 4 3 8000h to 43FFFFh S A 1 4 3 1 0 0 01000XXX 3 2 4 40000h to 447FFFh S A 1 4 4 1 0 0 01001XXX 3 2 4 4 8000h to 44FFFFh S A 1 4 5 1 0 0 01010XXX 3 2 4 50000h to 457FFFh S A 1 4 6 1 0 0 01011XXX 3 2 4 5 8000h to 45FFFFh S A 1 4 7 1 0 0 01100XXX 3 2 4 60000h to 467FFFh S A 1 4 8 1 0 0 01101XXX 3 2 4 6 8000h to 46FFFFh S A 1 4 9 1 0 0 01110XXX 3 2 4 70000h to 477FFFh S A 1 5 0 1 0 0 01111XXX 3 2 4 7 8000h to 47FFFFh S A 1 5 1 1 0 0 10000XXX 3 2 4 80000h to 487FFFh S A 1 5 2 1 0 0 10001XXX 3 2 4 8 8000h to 48FFFFh S A 1 5 3 1 0 0 10010XXX 3 2 4 90000h to 497FFFh S A 1 5 4 1 0 0 10011XXX 3 2 4 9 8000h to 49FFFFh S A 1 5 5 1 0 0 10100XXX 3 2 4 A 0 0 0 0 h t o 4 A 7 F F F h S A 1 5 6 1 0 0 10101XXX 3 2 4 A 8000h to 4AFFFFh S A 1 5 7 1 0 0 10110XXX 3 2 4 B 0 0 0 0 h t o 4 B 7 F F F h S A 1 5 8 1 0 0 10111XXX 3 2 4 B 8000h to 4BFFFFh S A 1 5 9 1 0 0 11000XXX 3 2 4 C 0 0 0 0 h t o 4 C 7 F F F h S A 1 6 0 1 0 0 11001XXX 3 2 4 C 8000h to 4CFFFFh S A 1 6 1 1 0 0 11010XXX 3 2 4 D 0 0 0 0 h t o 4 D 7 F F F h S A 1 6 2 1 0 0 11011XXX 3 2 4 D 8000h to 4DFFFFh S A 1 6 3 1 0 0 11100XXX 3 2 4 E 0 0 0 0 h t o 4 E 7 F F F h S A 1 6 4 1 0 0 11101XXX 3 2 4 E 8000h to 4EFFFFh S A 1 6 5 1 0 0 11110XXX 3 2 4 F 0 0 0 0 h t o 4 F 7 F F F h S A 1 6 6 1 0 0 11111XXX 3 2 4 F 8000h to 4FFFFFh S A 1 6 7 1 0 1 00000XXX 3 2 5 00000h to 507FFFh S A 1 6 8 1 0 1 00001XXX 3 2 5 0 8000h to 50FFFFh S A 1 6 9 1 0 1 00010XXX 3 2 5 10000h to 517FFFh S A 1 7 0 1 0 1 00011XXX 3 2 5 1 8000h to 51FFFFh S A 1 7 1 1 0 1 00100XXX 3 2 5 20000h to 527FFFh S A 1 7 2 1 0 1 00101XXX 3 2 5 2 8000h to 52FFFFh S A 1 7 3 1 0 1 00110XXX 3 2 5 30000h to 537FFFh

(Continued) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank C SA174 1 0 1 0 0 1 1 1 X X X 32 538000h to 53FFFFh SA175 1 0 1 0 1 0 0 0 X X X 32 540000h to 547FFFh SA176 1 0 1 0 1 0 0 1 X X X 32 548000h to 54FFFFh SA177 1 0 1 0 1 0 1 0 X X X 32 550000h to 557FFFh SA178 1 0 1 0 1 0 1 1 X X X 32 558000h to 55FFFFh SA179 1 0 1 0 1 1 0 0 X X X 32 560000h to 567FFFh SA180 1 0 1 0 1 1 0 1 X X X 32 568000h to 56FFFFh SA181 1 0 1 0 1 1 1 0 X X X 32 570000h to 577FFFh SA182 1 0 1 0 1 1 1 1 X X X 32 578000h to 57FFFFh SA183 1 0 1 1 0 0 0 0 X X X 32 580000h to 587FFFh SA184 1 0 1 1 0 0 0 1 X X X 32 588000h to 58FFFFh SA185 1 0 1 1 0 0 1 0 X X X 32 590000h to 597FFFh SA186 1 0 1 1 0 0 1 1 X X X 32 598000h to 59FFFFh SA187 1 0 1 1 0 1 0 0 X X X 32 5A0000h to 5A7FFFh SA188 1 0 1 1 0 1 0 1 X X X 32 5A8000h to 5AFFFFh SA189 1 0 1 1 0 1 1 0 X X X 32 5B0000h to 5B7FFFh SA190 1 0 1 1 0 1 1 1 X X X 32 5B8000h to 5BFFFFh SA191 1 0 1 1 1 0 0 0 X X X 32 5C0000h to 5C7FFFh SA192 1 0 1 1 1 0 0 1 X X X 32 5C8000h to 5CFFFFh SA193 1 0 1 1 1 0 1 0 X X X 32 6D0000h to 5D7FFFh SA194 1 0 1 1 1 0 1 1 X X X 32 6D8000h to 5DFFFFh SA195 1 0 1 1 1 1 0 0 X X X 32 5E0000h to 5E7FFFh SA196 1 0 1 1 1 1 0 1 X X X 32 5E8000h to 5EFFFFh SA197 1 0 1 1 1 1 1 0 X X X 32 5F0000h to 5F7FFFh SA198 1 0 1 1 1 1 1 1 X X X 32 5F8000h to 5FFFFFh SA199 1 1 0 0 0 0 0 0 X X X 32 600000h to 607FFFh SA200 1 1 0 0 0 0 0 1 X X X 32 608000h to 60FFFFh SA201 1 1 0 0 0 0 1 0 X X X 32 610000h to 617FFFh SA202 1 1 0 0 0 0 1 1 X X X 32 618000h to 61FFFFh SA203 1 1 0 0 0 1 0 0 X X X 32 620000h to 627FFFh SA204 1 1 0 0 0 1 0 1 X X X 32 628000h to 62FFFFh SA205 1 1 0 0 0 1 1 0 X X X 32 630000h to 637FFFh SA206 1 1 0 0 0 1 1 1 X X X 32 638000h to 63FFFFh SA207 1 1 0 0 1 0 0 0 X X X 32 640000h to 647FFFh SA208 1 1 0 0 1 0 0 1 X X X 32 648000h to 64FFFFh SA209 1 1 0 0 1 0 1 0 X X X 32 650000h to 657FFFh SA210 1 1 0 0 1 0 1 1 X X X 32 658000h to 65FFFFh SA211 1 1 0 0 1 1 0 0 X X X 32 660000h to 667FFFh SA212 1 1 0 0 1 1 0 1 X X X 32 668000h to 66FFFFh

(Continued) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank C SA213 1 1 0 0 1 1 1 0 X X X 32 670000h to 677FFFh SA214 1 1 0 0 1 1 1 1 X X X 32 678000h to 67FFFFh SA215 1 1 0 1 0 0 0 0 X X X 32 680000h to 687FFFh SA216 1 1 0 1 0 0 0 1 X X X 32 688000h to 68FFFFh SA217 1 1 0 1 0 0 1 0 X X X 32 690000h to 697FFFh SA218 1 1 0 1 0 0 1 1 X X X 32 698000h to 69FFFFh SA219 1 1 0 1 0 1 0 0 X X X 32 6A0000h to 6A7FFFh SA220 1 1 0 1 0 1 0 1 X X X 32 6A8000h to 6AFFFFh SA221 1 1 0 1 0 1 1 0 X X X 32 6B0000h to 6B7FFFh SA222 1 1 0 1 0 1 1 1 X X X 32 8B8000h to 6BFFFFh SA223 1 1 0 1 1 0 0 0 X X X 32 6C0000h to 6C7FFFh SA224 1 1 0 1 1 0 0 1 X X X 32 6C8000h to 6CFFFFh SA225 1 1 0 1 1 0 1 0 X X X 32 6D0000h to 6D7FFFh SA226 1 1 0 1 1 0 1 1 X X X 32 6D8000h to 6DFFFFh SA227 1 1 0 1 1 1 0 0 X X X 32 6E0000h to 6E7FFFh SA228 1 1 0 1 1 1 0 1 X X X 32 6E8000h to 6EFFFFh SA229 1 1 0 1 1 1 1 0 X X X 32 6F0000h to 6F7FFFh SA230 1 1 0 1 1 1 1 1 X X X 32 6F8000h to 6FFFFFh

Sector Address Table (Bank D) Bank Sector Sector Address Sector Size (Kwords) (· 16) Address Range Bank Address A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Bank D S A 2 3 1 1 1 1 00000XXX 3 2 700000h to 707FFFh S A 2 3 2 1 1 1 00001XXX 3 2 7 08000h to 70FFFFh S A 2 3 3 1 1 1 00010XXX 3 2 710000h to 717FFFh S A 2 3 4 1 1 1 00011XXX 3 2 7 18000h to 71FFFFh S A 2 3 5 1 1 1 00100XXX 3 2 720000h to 727FFFh S A 2 3 6 1 1 1 00101XXX 3 2 7 28000h to 72FFFFh S A 2 3 7 1 1 1 00110XXX 3 2 730000h to 737FFFh S A 2 3 8 1 1 1 00111XXX 3 2 7 38000h to 73FFFFh S A 2 3 9 1 1 1 01000XXX 3 2 740000h to 747FFFh S A 2 4 0 1 1 1 01001XXX 3 2 7 48000h to 74FFFFh S A 2 4 1 1 1 1 01010XXX 3 2 750000h to 757FFFh S A 2 4 2 1 1 1 01011XXX 3 2 7 58000h to 75FFFFh S A 2 4 3 1 1 1 01100XXX 3 2 760000h to 767FFFh S A 2 4 4 1 1 1 01101XXX 3 2 7 68000h to 76FFFFh S A 2 4 5 1 1 1 01110XXX 3 2 770000h to 777FFFh S A 2 4 6 1 1 1 01111XXX 3 2 7 78000h to 77FFFFh S A 2 4 7 1 1 1 10000XXX 3 2 780000h to 787FFFh S A 2 4 8 1 1 1 10001XXX 3 2 7 88000h to 78FFFFh S A 2 4 9 1 1 1 10010XXX 3 2 790000h to 797FFFh S A 2 5 0 1 1 1 10011XXX 3 2 7 98000h to 79FFFFh S A 2 5 1 1 1 1 10100XXX 3 2 7 A 0 0 00h to 7A7FFFh S A 2 5 2 1 1 1 10101XXX 3 2 7 A 8 0 0 0 h t o 7 A F F F F h S A 2 5 3 1 1 1 10110XXX 3 2 7 B 0 0 00h to 7B7FFFh S A 2 5 4 1 1 1 10111XXX 3 2 7 B 8 0 0 0 h t o 7 B F F F F h S A 2 5 5 1 1 1 11000XXX 3 2 7 C 0 0 00h to 7C7FFFh S A 2 5 6 1 1 1 11001XXX 3 2 7 C 8 0 0 0 h t o 7 C F F F F h S A 2 5 7 1 1 1 11010XXX 3 2 7 D 0 0 00h to 7D7FFFh S A 2 5 8 1 1 1 11011XXX 3 2 7 D 8 0 0 0 h t o 7 D F F F F h S A 2 5 9 1 1 1 11100XXX 3 2 7 E 0 0 00h to 7E7FFFh S A 2 6 0 1 1 1 11101XXX 3 2 7 E 8 0 0 0 h t o 7 E F F F F h S A 2 6 1 1 1 1 11110XXX 3 2 7 F 0 0 00h to 7F7FFFh S A 2 6 2 1 1 1 11111000 4 7 F 8 0 00h to 7F8FFFh S A 2 6 3 1 1 1 11111001 4 7 F 9 0 00h to 7F9FFFh S A 2 6 4 1 1 1 11111010 4 7 F A 0 00h to 7FAFFFh S A 2 6 5 1 1 1 11111011 4 7 F B 0 00h to 7FBFFFh S A 2 6 6 1 1 1 11111100 4 7 F C 0 00h to 7FCFFFh S A 2 6 7 1 1 1 11111101 4 7 F D 0 00h to 7FDFFFh S A 2 6 8 1 1 1 11111110 4 7 F E 0 00h to 7FEFFFh S A 2 6 9 1 1 1 11111111 4 7 F F 0 00h to 7FFFFFh

(Continued) Sector Group Address Table Sector Group A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Sectors S G A 0 00000000000 S A 0 S G A 1 00000000001 S A 1 S G A 2 00000000010 S A 2 S G A 3 00000000011 S A 3 S G A 4 00000000100 S A 4 S G A 5 00000000101 S A 5 S G A 6 00000000110 S A 6 S G A 7 00000000111 S A 7 S G A 8 00000001XXX S A 8 S G A 9 00000010XXX S A 9 S G A 1 0 00000011XXX S A 1 0 SGA11 0 0 0 0 0 1 X X X X X SA11 to SA14 SGA12 0 0 0 0 1 0 X X X X X SA15 to SA18 SGA13 0 0 0 0 1 1 X X X X X SA19 to SA22 SGA14 0 0 0 1 0 0 X X X X X SA23 to SA26 SGA15 0 0 0 1 0 1 X X X X X SA27 to SA30 SGA16 0 0 0 1 1 0 X X X X X SA31 to SA34 SGA17 0 0 0 1 1 1 X X X X X SA35 to SA38 SGA18 0 0 1 0 0 0 X X X X X SA39 to SA42 SGA19 0 0 1 0 0 1 X X X X X SA43 to SA46 SGA20 0 0 1 0 1 0 X X X X X SA47 to SA50 SGA21 0 0 1 0 1 1 X X X X X SA51 to SA54 SGA22 0 0 1 1 0 0 X X X X X SA55 to SA58 SGA23 0 0 1 1 0 1 X X X X X SA59 to SA62 SGA24 0 0 1 1 1 0 X X X X X SA63 to SA66 SGA25 0 0 1 1 1 1 X X X X X SA67 to SA70 SGA26 0 1 0 0 0 0 X X X X X SA71 to SA74 SGA27 0 1 0 0 0 1 X X X X X SA75 to SA78

(Continued) Sector Group A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Sectors SGA28 0 1 0 0 1 0 X X X X X SA79 to SA82 SGA29 0 1 0 0 1 1 X X X X X SA83 to SA86 SGA30 0 1 0 1 0 0 X X X X X SA87 to SA90 SGA31 0 1 0 1 0 1 X X X X X SA91 to SA94 SGA32 0 1 0 1 1 0 X X X X X SA95 to SA98 SGA33 0 1 0 1 1 1 X X X X X SA99 to SA102 SGA34 0 1 1 0 0 0 X X X X X SA103 to SA106 SGA35 0 1 1 0 0 1 X X X X X SA107 to SA110 SGA36 0 1 1 0 1 0 X X X X X SA111 to SA114 SGA37 0 1 1 0 1 1 X X X X X SA115 to SA118 SGA38 0 1 1 1 0 0 X X X X X SA119 to SA122 SGA39 0 1 1 1 0 1 X X X X X SA123 to SA126 SGA40 0 1 1 1 1 0 X X X X X SA127 to SA130 SGA41 0 1 1 1 1 1 X X X X X SA131 to SA134 SGA42 1 0 0 0 0 0 X X X X X SA135 to SA138 SGA43 1 0 0 0 0 1 X X X X X SA139 to SA142 SGA44 1 0 0 0 1 0 X X X X X SA143 to SA146 SGA45 1 0 0 0 1 1 X X X X X SA147 to SA150 SGA46 1 0 0 1 0 0 X X X X X SA151 to SA154 SGA47 1 0 0 1 0 1 X X X X X SA155 to SA158 SGA48 1 0 0 1 1 0 X X X X X SA159 to SA162 SGA49 1 0 0 1 1 1 X X X X X SA163 to SA166 SGA50 1 0 1 0 0 0 X X X X X SA167 to SA170 SGA51 1 0 1 0 0 1 X X X X X SA171 to SA174

(Continued) Sector Group A 22 A 21 A 20 A 19 A 18 A 17 A 16 A 15 A 14 A 13 A 12 Sectors SGA52 1 0 1 0 1 0 X X X X X SA175 to SA178 SGA53 1 0 1 0 1 1 X X X X X SA179 to SA182 SGA54 1 0 1 1 0 0 X X X X X SA183 to SA186 SGA55 1 0 1 1 0 1 X X X X X SA187 to SA190 SGA56 1 0 1 1 1 0 X X X X X SA191 to SA194 SGA57 1 0 1 1 1 1 X X X X X SA195 to SA198 SGA58 1 1 0 0 0 0 X X X X X SA199 to SA202 SGA59 1 1 0 0 0 1 X X X X X SA203 to SA206 SGA60 1 1 0 0 1 0 X X X X X SA207 to SA210 SGA61 1 1 0 0 1 1 X X X X X SA211 to SA214 SGA62 1 1 0 1 0 0 X X X X X SA215 to SA218 SGA63 1 1 0 1 0 1 X X X X X SA219 to SA222 SGA64 1 1 0 1 1 0 X X X X X SA223 to SA226 SGA65 1 1 0 1 1 1 X X X X X SA227 to SA230 SGA66 1 1 1 0 0 0 X X X X X SA231 to SA234 SGA67 1 1 1 0 0 1 X X X X X SA235 to SA238 SGA68 1 1 1 0 1 0 X X X X X SA239 to SA242 SGA69 1 1 1 0 1 1 X X X X X SA243 to SA246 SGA70 1 1 1 1 0 0 X X X X X SA247 to SA250 SGA71 1 1 1 1 0 1 X X X X X SA251 to SA254 SGA72 1 1 1 1 1 0 X X X X X SA255 to SA258 SGA73 1 1 1 1 1 1 0 0 X X X SA259 SGA74 1 1 1 1 1 1 0 1 X X X SA260 SGA75 1 1 1 1 1 1 1 0 X X X SA261 S G A 7 6 11111111000 S A 2 6 2 S G A 7 7 11111111001 S A 2 6 3 S G A 7 8 11111111010 S A 2 6 4 S G A 7 9 11111111011 S A 2 6 5 S G A 8 0 11111111100 S A 2 6 6 S G A 8 1 11111111101 S A 2 6 7 S G A 8 2 11111111110 S A 2 6 8 S G A 8 3 11111111111 S A 2 6 9

Common Flash Memory Interface Code Table Description A 6 to A0 DQ 15 to DQ0 Query-unique ASCII string “QRY” 10h 11h 12h 0051h 0052h 0059h Primary OEM Command Set 2h: AMD/FJ standard type 13h 14h 0002h 0000h Address for Primary Extended Table 15h 16h 0040h 0000h Alternate OEM Command Set (00h = not applicable) 17h 18h 0000h 0000h Address for Alternate OEM Extended Table 19h 1Ah 0000h 0000h VCC Min (write/erase) DQ 7 to DQ4: 1 V, DQ 3 to DQ0: 100 mV 1Bh 0017h VCC Max (write/erase) DQ 7 to DQ4: 1 V, DQ 3 to DQ0: 100 mV 1Ch 0019h VPP Min voltage 1Dh 0000h VPP Max voltage 1Eh 0000h Typical timeout per single byte/ word write 2N ms 1Fh 0004h Typical timeout for Min size buff- er write 2N ms 20h 0000h Typical timeout per individual block erase 2N ms 21h 0009h Typical timeout for full chip erase 2N ms 22h 0000h Max timeout for byte/word write N times typical 23h 0004h Max timeout for buffer write 2N times typical 24h 0000h Max timeout per individual block erase 2N times typical 25h 0004h Max timeout for full chip erase N times typical 26h 0000h Device Size = 2N byte 27h 0018h Flash Device Interface

description

multi-byte write = 2N 2Ah 2Bh 0000h 0000h Number of Erase Block Regions within device 2Ch 0003h Erase Block Region 1 Information 2Dh 2Eh 2Fh 30h 0007h 0000h 0020h 0000h Erase Block Region 2 Information 31h 32h 33h 34h 00FDh 0000h 0000h 0001h Erase Block Region 3 Information 35h 36h 37h 38h 0007h 0000h 0020h 0000h Description A 6 to A0 DQ 15 to DQ0 Erase Block Region 4 Information 39h 3Ah 3Bh 3Ch 0000h 0000h 0000h 0000h Query-unique ASCII string “PRI” 40h 41h 42h 0050h 0052h 0049h Major version number, ASCII 43h 0031h Minor version number, ASCII 44h 0033h Address Sensitive Unlock 0h = Required 1h = Not Required 45h 000Ch Erase Suspend 0h = Not Supported 1h = To Read Only 2h = To Read & Write 46h 0002h Sector Protection 0h = Not Supported X = Number of sectors in per group 47h 0001h Sector Temporary Unprotection 00h = Not Supported 01h = Supported 48h 0000h Sector Protection Algorithm 49h 0007h Simultaneous Operation 00h = Not Supported, X = Total number of sectors in all Banks except Bank A 4Ah 00E7h Burst Mode Type 00h = Not Supported 4Bh 0001h Page Mode Type 00h = Not Supported 4Ch 0000h ACC (Acceleration) Supply Minimum 00h = Not Supported, DQ 7 to DQ4: 1 V, DQ 3 to DQ0: 100 mV 4Dh 00B5h ACC (Acceleration) Supply Maximum 00h = Not Supported, DQ 7 to DQ4: 1 V, DQ 3 to DQ0: 100 mV 4Eh 00C5h Boot Type 4Fh 0001h Program Suspend 00h = Not Supported, 01h = Supported 50h 0000h Bank Organization 57h 0004h Bank A Region Information 58h 0027h Bank B Region Information 59h 0060h Bank C Region Information 5Ah 0060h Bank D Region Information 5Bh 0027h

Asynchronous Read Operation (Non-Burst) Mode When the device first powers up, it is enabled for asynchronous read operation. CLK is ignored in this operation. T o read data from the memory array, the system must first assert a valid address on A22 to A0, while driving AVD and CE to VIL. WE should remain at VIH. The addresses are latched on the falling edge of CE while AVD is held low or the address transition while AVD is held low. The data will appear on DQ15 to DQ0. Since the memory array is divided into four banks, each bank remains enabled for read access until the command register contents are altered. Address access time (t ACC ) is equal to the delay from stable addresses to valid output data. The chip enable access time (tCE ) is the delay from the stable addresses and stable CE to valid data at the outputs. The output enable access time (tOE ) is the delay from the falling edge of OE to valid data at the output. The internal state machine is set for reading array data in asynchronous mode upon device power-up, or after a hardware reset. During power transition RESET must be held low. (Refer to "Power On/Off Timing Diagram") This ensures that no spurious alteration of the memory content occurs during the power transition. Synchronous (Burst) Read Operation Mode The device is capable of linear burst operation of a preset length. Prior to entering burst mode, the system should determine how many wait states are desired for the initial word (tIACC) of each burst access, what mode of burst operation is desired, which edge of the clock will be the active clock edge, and how the RDY signal will transition with valid data. The system would then write the configuration register set command sequence. See "Configuration Register Set Command" and "Command Definitions" for further details. Once the system has written the "Configuration Register Set" command sequence, the device Read mode is enabled for synchronous reads only. The initial word is output t IACC after the active edge of the first CLK cycle. Subsequent words are output tBACC after the active edge of each successive clock cycle, which automatically increments the internal address counter. 8-, 16-, and 32-Word Linear Burst with Wrap Around The device provides Linear burst mode, in which a fixed number of words are read from consecutive addresses. In each of these modes, the burst addresses read are determined by the group within which the starting address falls. The groups are sized according to the number of words read in a single burst sequence for a given mode. As an example: if the starting address in the 8-word with wrap-around mode is 39h, the address range to be read would be 38-3Fh, and the burst sequence would be 39-3A-3B-3C-3D-3E-3F-38h-etc. The burst sequence begins with the starting address written to the device, but wraps back to the first address in the selected group. In a similar fashion, the 16-word and 32-word Linear Wrap modes begin their burst sequence on the starting address written to the device, and then wrap back to the first address in the selected address group. The RDY pin indicates when data is valid on the bus in synchronous read mode. The devices can wrap through a maximum of 128 words of data (8 words up to 16 times, 16 words up to 8 times, or 32 words up to 4 times) before requiring a new synchronous access (latching of a new address). Burst Address Groups Table Mode Group Size Group Address Ranges 8-word with wrap-around 8 words 0h-7h, 8h-Fh, 10h-17h, ... 16-word with wrap-around 16 words 0h-Fh, 10h-1Fh, 20h-2Fh, ... 32-word with wrap-around 32 words 00h-1Fh, 20h-3Fh, 40h-5Fh, ...

The device uses a configuration register to set the various burst parameters: number of wait states, burst read mode, active clock edge, RDY configuration, and synchronous mode active. Burst Suspend / Resume The Burst Suspend / Resume feature allows the system temporarily suspend a synchronous burst operation during the initial access (before data is available) or after the device is outputting data. When the burst operation is suspended, any previously latched internal data and the current state are retained. At Handshaking mode, when the Burst Suspend is enabled the device will enter power down mode, in which the current consumption is reduced to typically 1mA. At Non-Handshaking mode, the device does not go to power down mode. Burst plus Burst Suspend should not last longer than t RCC without relaching an address or crossing address boundary. Burst Suspend requires CE to be asserted, WE deasserted, and the initial address latched by the CLK edge. Burst Suspend occurs when OE is deasserted. T o resume the burst access, OE must be re-asserted. The next active CLK edge will resume the burst sequence where it had been suspended. The RDY pin is only controlled by CE. RDY will remain active and is not placed into a high-impedance state when OE is de-asserted. When using Burst Suspend feature, the host system should set the configuration register to "RDY active with data (A18=1)". Refer to "Configuration Register Set Command". Handshaking Option The device is equipped with a handshaking feature that brings out the fastest initial latency of this burst mode flash memory by simply monitoring the RDY signal from the device to determine when the initial word of burst data is ready to be read. In this handshaking mode, the microprocessor does not need to set its register the number of initial wait clocks. The device will indicate when the initial word of burst data is valid by the rising edge of RDY after OE goes low. The presence of the handshaking feature may be verified by writing the autoselect command sequence to the device. See "Autoselect Command Sequence" for details. For optimal burst mode performance on devices with the handshaking option, the host system must set the appropriate number of wait states in the flash device depending on clock frequency. See "Configuration Register Set Command" section for more information. Non-Handshaking Option In Non-Handshaking option, the device does not require the host system monitoring RDY signal. The micropro- cessor will know the number of initial wait count to be required by setting its own register. The device always provides initial data with same initial clock latency that is set by Configuration Register. See "Configuration Register Set Command" section for more information. Simultaneous Operation The device features functions that enable reading of data from one memory bank while a program or erase operation is in progress in the other memory bank (simultaneous operation) , in addition to conventional features (read, program, erase, erase-suspend read, and erase-suspend program) . The bank can be selected by bank address (A 22, A21, A20)with zero latency. The device consists of the following four banks : Bank A : 8 X 4 Kword and 31 X 32 Kword; Bank B : 96 X 32 Kword; Bank C : 96 X 32 Kword; Bank D : 8 X 4 Kword and 31 X 32 Kword. The device can execute simultaneous operations between Bank 1, a bank chosen from among the four banks, and Bank 2, a bank consisting of the three remaining banks. (See “Burst Address Groups Table”. ) This is what we call a “FlexBank”, for example, the rest of banks B, C and D to let the system read while Bank A is in the process of program (or erase) operation. However, the different types of operations for the three banks are impossible, e.g.Bank A writing, Bank B erasing, and Bank C reading out. With this “FlexBank”, as described in “FlexBank TM Architecture Table”,the system gets to select from four combinations of data volume for Bank 1 and Bank 2, which works well to meet the system requirement. The simultaneous operation cannot execute multi-function mode in the same bank. “Simultaneous Operation Table” shows the possible combinations for simultaneous operation. (Refer to “Bank-to-Bank Read/Write Timing Diagram” in “n TIMING DIAGRAM”. )

FlexBankTM Architecture Table Example of Virtual Banks Combination Table Note : When multiple sector erase over several banks is operated, the system cannot read out of the bank to which a sector being erased belongs. For example, suppose that erasing is taking place at both Bank A and Bank B, neither Bank A nor Bank B is read out (they would output the sequence flag once they were selected. ) Meanwhile the system would get to read from either Bank C or Bank D. Simultaneous Operation Table Note : Bank 1 and Bank 2 are divided for the sake of convenience at Simultaneous Operation. Actually, the Bank consists of 4 banks, Bank A, Bank B, BankC and Bank D. Bank Address (BA) meant to specify each of the Banks. Bank Splits Bank 1 Bank 2 Volume Combination Volume Combination 1 16 Mbit Bank A 112 Mbit Remember (Bank B, C, D) 2 48 Mbit Bank B 96 Mbit Remember (Bank A, C, D) 3 48 Mbit Bank C 96 Mbit Remember (Bank A, B, D) 4 16 Mbit Bank D 112 Mbit Remember (Bank A, B, C) Bank Splits Bank 1 Bank 2 Megabits Combination of Memory Bank Sector Sizes Megabits Combination of Memory Bank Sector Sizes 1 16 Mbit Bank A Eight 4K word, thirty-one 32K word112 Mbit Bank B Bank C Bank D Eight 4K word, two hundred twenty- three 32K word 23 2 M b i t Bank A Bank D Sixteen 4K word, sixty-two 32K word96 Mbit Bank B Bank C One hundred ninety- two 32K word 3 48 Mbit Bank B Ninety-six 32K word 80 Mbit Bank A Bank C Bank D Sixteen 4K word, one hundred fifty- eight 32K word 46 4 M b i t Bank A Bank B Eight 4K word, one hundred twenty- seven 32K word

64 Mbit

Eight 4K word, one hundred twenty- seven 32K word Case Bank 1 Status Bank 2 Status

1 Read mode Read mode

2 Read mode Autoselect mode

3 Read mode Program mode

4 Read mode Erase mode

5 Autoselect mode Read mode

6 Program mode Read mode

7 Erase mode Read mode

There are two ways to implement the standby mode on the device, one using both the CE and RESET pins, and the other via the RESET pin only. When using both pins, a CMOS standby mode is achieved with CE and RESET input held at VCC ±0.2 V . Under this condition the current consumed is less than 10 µA Max. During Embedded Algorithm operation, VCC active current (ICC2 ) is required even if CE=“H”. The device can be read with standard access time (tCE ) from either of these standby modes. When using the RESET pin only, a CMOS standby mode is achieved with RESET input held at VSS ±0.3 V (CE=“H” or “L”) . Under this condition the current consumed is less than 5µA Max. Once the RESET pin is set high, the device requires tRH as a wake-up time for output to be valid for read access. During standby mode, the output is in the high impedance state, regardless of OE input. ICC3 in the DC Characteristics table represents the standby current specification. Automatic Sleep Mode Automatic sleep mode works to restrain power consumption during read-out of the device data. This mode can be useful in the application such as a handy terminal which requires low power consumption. While in asynchronous mode, the device automatically enables this mode when addresses remain stable for tACC +60 ns. The automatic sleep mode is independent of the CE, WE, and OE control signals. Standard address access timings provide new data when addresses are changed. While in sleep mode, output data is latched and always available to the system. Under the mode, the current consumed is typically 0.2 mmmmA (CMOS Level). Since the data are latched during this mode, the data are continuously read out. When the addresses are changed, the mode is automatically canceled and the device reads the data for changed addresses. While in synchronous mode, the device automatically enables this mode when the first active CLK level (if rising edge is acitive, the first period of CLK=V IH) is greater than tACC . During this mode on Handshaking devices, initial latency will be same between even and odd address. The device always outputs data with the same latency to even address. In case of Non-Handshaking devices, initial latecny is fixed same as normal operation. When the deivce is in the Automatic sleep mode, the device outputs burst data with the CLK. Please note that if CLK runs faster (active CLK level is shorter than t ACC ) during burst access in the Automatic speep mode, the device will output incorrect data. In this case, a new burst operations (addresses must be re-latched) is required to provide correct data. Under the mode, the current consumed is typically TBD mmmmA (CMOS Level). During simultaneous operation, V CC active current (ICC2 ) is required. Output Disable When the OE input is at VIH, output from the device is disabled. The outputs are placed in the high impedance state. Write Device erasure and programming are accomplished via the command register. The contents of the register serve as input to the internal state machine. The state machine output dictates the function of the device. The command register itself does not occupy any addressable memory location. The register is a latch used to store the commands, along with the address and data information needed to execute the command. The programming operation is dependent of the Set Device Read Mode bit in the Configuration Register. - At Asynchronous Mode Clock is ignored when the Configuration Register is set to Asynchronous mode, the device has the capability of performing two types of programming operation. WE latch - The system must drive CE, WE, and AVD to VIL and OE to VIH when providing an address and data. Addresses are latched on the falling edge of WE while data is latched on the rising edge of WE. (Refer to "Program Operation Timing at Asynchronous Mode (WE latch)"). AVD latch - The system must drive CE and AVD to VIL, and OE to VIH when providing an address to the device, and drive WE and CE to VIL, and OE to VIH when wiring data. Addresses are latched on the rising edge of AVD and data is latched on the rising edge of WE. (Refer to "Program Operation Timing at Asynchronous Mode (AVD latch)").

• At Synchronous Mode When the Configuration Register is set to Synchronous mode, the device has the capability of performing two types of programming operation. WE latch - The system must drive CE, WE, and AVD to VIL and OE to VIH when providing an address and data. Addresses are latched on the falling edge of WE while AVD is held VIL and data is latched on the rising edge of WE . (Refer to "Program Operation Timing at Synchronous Mode (WE latch)"). Refer to AC Write Characteristics and the Erase/Program Waveforms for specific timing parameters. Note : Addresses are latched on the first of either the falling edge of WE or active edge of CLK. CLK latch - The system must drive CE and AVD to VIL, and OE to VIH when providing an address to the device, and drive WE and CE to VIL, and OE to VIH when wiring data. Addresses are latched on the active edge of clock while AVD is held VIL and data is latched on the rising edge of WE. (Refer to "Program Operation Timing at Synchronous Mode (CLK latch)"). RESET Hardware Reset The device may be reset by driving the RESET pin to VIL. The RESET pin has a pulse requirement and has to be kept low (VIL) for at least “tRP ” in order to properly reset the internal state machine. Any operation in the process of being executed will be terminated and the internal state machine will be reset to the read mode “tREADY ” after the RESET pin is driven low. Furthermore, once the RESET pin goes high the device requires an additional “tRH ” before it will allow read access. When the RESET pin is low, the device will be in the standby mode for the duration of the pulse and all the data output pins will be tri-stated. If a hardware reset occurs during a program or erase operation, the data at that particular location will be corrupted. Accelerated Program Operation The device offers accelerated program operation which enables the programming in high speed. If the system asserts V ACC to the ACC pin, the device automatically enters the acceleration mode and the time required for program operation will reduce to about 60%. This function is primarily intended to allow high speed program, so caution is needed as the sector group will temporarily be unprotected. When at V IL, ACC locks all sectors. Should be at VIH for all other conditions. The system would use a fast program command sequence when programming during acceleration mode. Set command to fast mode and reset command from fast mode are not necessary. When the device enters the acceleration mode, the device automatically set to fast mode. Therefore, the pressent sequence could be used for programming and detection of completion during acceleration mode. Removing V ACC from the ACC pin returns the device to normal operation. Do not remove VACC from ACC pin while programming. See “Accelerated Fast mode Programming Timing” in “n TIMING DIAGRAM”. HiddenROM Region The HiddenROM feature provides a Flash memory region that the system may access through a new command sequence. This is primarily intended for customers who wish to use an Electronic Serial Number (ESN) in the device with the ESN protected against modification. Once the HiddenROM region is protected, any further modification of that region becomes impossible. This ensures the security of the ESN once the product is shipped to the field. ONL Y Program is possible in this area until it is protected. Once it is protected, it is impossible to unprotect, so please use this with caution. HiddenROM area is 128 words (64 words for factory and 64 words for customer) in length and is stored at the same address of the "outermost" 4 Kwords boot sector. The device occupies the address of the 000000h - 00007Fh. After the system has written the Enter HiddenROM command sequence, the system may read the HiddenROM region by using the addresses normally occupied by the boot sector (particular area of SA0). That is, the device sends all commands that would normally be sent to the boot sector to the HiddenROM region. This mode of operation continues until the system issues the Exit HiddenROM command sequence, or until power is removed from the device. On power-up, or following a hardware reset, the device reverts to sending commands to the boot sector.

HiddenROM area is devided into two regions, which are Factory Locked area and Customer Locked area. The Factory Locked area is 64 words (address: 000000h - 00003Fh) that is programmed and locked at Fujitsu. The Customer Locked area is also 64 words (address: 000040h - 00007Fh) that is programmed and locked at user. The Factory indicator Bit (DQ7) is used to indicate whether or not the Factory Locked area is locked when shipped from the factory. The Customer Indicator Bit (DQ6) is used to indicate whether or not the Customer Locked area is locked. The Factory Locked area can be programmed and protected at Fujitsu ONL Y and is always protected when shipped from the factory regardless of the conditon whether or not this area is programmed. Therefore this area has the Factory Indicator Bit (DQ7) permanently set to a "1". The Factory Locked area cannot be modified in any way. The Customer Locked area is shipped unprotected, allowing users to utilize that area in any manner they choose. The Customer Indicator Bit set to "0". Once the Customer Locked area is protected, the Customer Indicator Bit will be permanently set to "1". <Protection> The MBM29BS/FS12DH features several levels of sector protection, which can disable both the program and erase operations (1) Write Protect (WP )[Hardware Protection] The device features a hardware protection option using a write protect pin that prevents programming or erasing, regardless of the state of the sector’s Persistent or Dynamic Protection Bits. The WP pin is associated with the “outermost” 4 · 4K words on both ends of boot sectors (SA0-SA3 and SA266-SA269). The WP pin has no effect on any other sector. When WP is taken to VIL, programming and erase operations of the “outermost” 4 · 4K words sectors on both ends are disabled. By taking WP back to VIH, the “outermost” 4 · 4K words sectors are enabled for program and erase operations, depending upon the status of the individual sector Persistent or Dynamic Protection Bits. If either of the four outermost sectors Persistent or Dynamic Protection Bits are pro- grammed, program or erase operations are inhibited. If the sector Persistent or Dynamic Protection Bits are both erased, the four outermost sectors are available for programming or erasing as long as WP remains at VIH. (2) ACC Protect (ACC)[Hardware Protection2] The device has also hardware protect feature by ACC pin. When ACC is VIL, all sectors are locked. Should be at VIH for all other condition. (3) New Sector Protection [Software Protection] A command sector protection method that replaces the old VID controlled protection method. a) Persistent Protection Bit (PPB) A single Persistent (non-volatile) Protection Bit is assigned to a maximum four sectors (see the “sector group address table” in “n FLEXIBLE SECTOR-ERASE ARCHITECTURE” for specific sector protection groupings). All 4 K words boot-block sectors have individual sector Persistent Protection Bits (PPBs) for greater flexibility. Each PPB is individually modifiable through the PPB Write Command. Note : If a PPB requires erasure, all of the sector PPBs must first be preprogrammed prior to PPB erasing. All PPBs erase in parallel, unlike programming where individual PPBs are programmable. It is the responsibility of the user to perform the preprogramming operation. Otherwise, an already erased sector PPBs has the potential of being over-erased. There is no hardware mechanism to prevent sector PPBs over-erasure. b) Dynamic Protection Bit (DPB) A volatile protection bit is assigned for each sector. After power-up or hardware reset, the contents of all DPBs is “0”. Each DPB is individually modifiable through the DPB Write Command. When the parts are first shipped, the PPBs are cleared, the DPBs are cleared, and PPB Lock is defaulted to power up in the cleared state - meaning the PPBs are changeable. When the device is first powered on the DPBs power up cleared (sectors not protected). The Protection State for each sector is determined by the logical OR of the PPB and the DPB related to that sector. For the sectors that have the PPBs cleared, the DPBs control whether or not the sector is protected or unprotected. By issuing the DPB Write/Erase command sequences, the DPBs will be set or cleared, thus placing each sector in the protected or unprotected state. These are the so-called Dynamic Locked or Unlocked states. They are called

dynamic states because it is very easy to switch back and forth between the protected and unprotected conditions. This allows software to easily protect sectors against inadvertent changes yet does not prevent the easy removal of protection when changes are needed. The DPBs maybe set or cleared as often as needed. PPB vs DPB The PPBs allow for a more static, and difficult to change, level of protection. The PPBs retain their state across power cycles because they are Non-Volatile. Individual PPBs are set with a command but must all be cleared as a group through a complex sequence of program and erasing commands. The PPBs are also limited to 100 erase cycles. The PBB Lock bit adds an additional level of protection. Once all PPBs are programmed to the desired settings, the PPB Lock may be set to “1”. Setting the PPB Lock disables all program and erase commands to the Non- Volatile PPBs. In effect, the PPB Lock Bit locks the PPBs into their current state. The only way to clear the PPB Lock is to go through a power cycle. System boot code can determine if any changes to the PPB are needed e.g. to allow new system code to be downloaded. If no changes are needed then the boot code can set the PBB Lock to disable any further changes to the PBBs during system operation. It is possible to have sectors that have been persistently locked, and sectors that are left in the dynamic state. The sectors in the dynamic state are all unprotected. If there is a need to protect some of them, a simple DPB Write command sequence is all that is necessary. The DPB write/erase command for the dynamic sectors switch the DPBs to signify protected and unprotected, respectively. If there is a need to change the status of the persistently locked sectors, a few more steps are required. First, the PPB Lock bit must be disabled by either putting the device through a power-cycle, or hardware reset. The PPBs can then be changed to reflect the desired settings. Setting the PPB lock bit once again will lock the PPBs, and the device operates normally again. Note : to achieve the best protection, it’s recommended to execute the PPB lock bit set command early in the boot code, and protect the boot code by holding WP = VIL. The above table contains all possible combinations of the DPB, PPB, and PPB lock relating to the status of the sector. In summary, if the PPB is set, and the PPB lock is set, the sector is protected and the protection can not be removed until the next power cycle clears the PBB lock. If the PPB is cleared, the sector can be dynamically locked or unlocked. The DPB then controls whether or not the sector is protected or unprotected. If the user attempts to program or erase a protected sector, the device ignores the command and returns to read mode. A program command to a protected sector enables status polling for approximately 1 ms before the device returns to read mode without having modified the contents of the protected sector. An erase command to a protected sector enables status polling for approximately 50 ms after which the device returns to read mode without having erased the protected sector. The programming of the DPB, PPB, and PPB lock for a given sector can be verified by writing a DPB/PPB lock verify command to the device. DPB PPB PPB Lock Sector State 0 0 0 Unprotected — PPB and DPB are changeable 1 0 0 Protected — PPB and DPB are changeable 0 1 0 Protected — PPB and DPB are changeable 1 1 0 Protected — PPB and DPB are changeable

001 Unprotected— PPB not changeable, DPB is

1 0 1 Protected — PPB not changeable, DPB is changeable 0 1 1 Protected — PPB not changeable, DPB is changeable 1 1 1 Protected — PPB not changeable, DPB is changeable

–DPB Status The programming of the DPB for a given sector can be verified by writing a DPB status verify command to the device. –PPB Status The programming of the PPB for a given sector can be verified by writing a PPB status verify command to the device. –PPB Lock Bit Status The programming of the PPB Lock Bit for a given sector can be verified by writing a PPB Lock Bit status verify command to the device. c) Persistent Protection Bit Lock (PPB Lock)

• PPB Locked
• PPB Locked with Password A highly sophisticated protection method that requires a password before changes to certain sectors or sector groups are permitted. All parts default to operate in the Persistent Sector Protection mode. The customer must then choose if the Persistent or Password Protection method is most desirable. There are two one-time programmable non-volatile bits that define which sector protection method will be used. If the customer decides to continue using the Persistent Sector Protection method, they must set the Persistent Sector Protection Mode Locking Bit. This will permanently set the part to operate only using Persistent Sector Protection. If the customer decides to use the password method, they must set the Password Mode Locking Bit. This will permanently set the part to operate only using password sector protection. It is important to remember that setting either the Persistent Sector Protection Mode Locking Bit or the Password Mode Locking Bit permanently selects the protection mode. It is not possible to switch between the two methods once a locking bit has been set. It is important that one mode is explicitly selected when the device is first programmed, rather than relying on the default mode alone. This is so that it is not possible for a system program or virus to later set the Password Mode Locking Bit, which would cause an unexpected shift from the default Persistent Sector Protection Mode into the Password Protection Mode. The WP and ACC Hardware Protection feature is always available, independent of the software managed protection method chosen. PPB lock bit is a global volatile bit. When set to “1”, the PPBs cannot be changed. When cleared (“0”), the PPBs are changeable. There is only one PPB Lock bit per device. The PPB Lock is cleared after power-up or hardware reset. There is no command sequence to unlock the PPB Lock. The Persistent Protection Bit (PPB) Lock is a volatile bit that reflects the state of the Password Mode Locking Bit after power-up reset. If the Password Mode Locking Bit is set, which indicates the device is in Password Protection Mode, the PPB Lock Bit is also set after a hardware reset (RESET asserted) or a power-up reset. The ONL Y means for clearing the PPB Lock Bit in Password Protection Mode is to issue the Password Unlock command. Successful execution of the Password Unlock command clears the PPB Lock Bit, allowing for sector PPBs modifications. Asserting RESET , taking the device through a power-on reset, or issuing the PPB Lock Bit Set command sets the PPB Lock Bit back to a “1”. If the Password Mode Locking Bit is not set, indicating Persistent Sector Protection Mode, the PPB Lock Bit is cleared after power-up or hardware reset. The PPB Lock Bit is set by issuing the PPB Lock Bit Set command. Once set the only means for clearing the PPB Lock Bit is by issuing a hardware or power-up reset. The Password Unlock command is ignored in Persistent Sector Protection Mode.

-Password and Password Mode Locking Bit In order to select the Password sector protection scheme, the customer must first program the password. Fujitsu recommends that the password be somehow correlated to the unique Electronic Serial Number (ESN) of the particular flash device. Each ESN is different for every flash device; therefore each password should be different for every flash device. While programming in the password region, the customer may perform Password Verify operations. Once the desired password is programmed in, the customer must then set the Password Mode Locking Bit. This operation achieves two objectives: (1) It permanently sets the device to operate using the Password Protection Mode. It is not possible to reverse this function. (2) It also disables all further commands to the password region. All program, and read operations are ignored. Both of these objectives are important, and if not carefully considered, may lead to unrecoverable errors. The user must be sure that the Password Protection method is desired when setting the Password Mode Locking Bit. More importantly, the user must be sure that the password is correct when the Password Mode Locking Bit is set. Due to the fact that read operations are disabled, there is no means to verify what the password is afterwards. If the password is lost after setting the Password Mode Locking Bit, there will be no way to clear the PPB Lock bit. The Password Mode Locking Bit, once set, prevents reading the 64-bit password on the DQ bus and further password programming. The Password Mode Locking Bit is not erasable. Once Password Mode Locking Bit is programmed, the Persistent Sector Protection Locking Bit is disabled from programming, guaranteeing that no changes to the protection scheme are allowed. 64-bit Password The 64-bit Password is located in its own memory space and is accessible through the use of the Password Program and Verify commands (see “Password Veri fy Command”). The password function works in conjunction with the Password Mode Locking Bit, which when set, prevents the Password Verify command from reading the contents of the password on the pins of the device. -Persistent Sector Protection Mode Locking Bit Like the password mode locking bit, a Persistent Sector Protection mode locking bit exists to guarantee that the device remain in software sector protection. Once set, the Persistent Sector Protection locking bit prevents programming of the password protection mode locking bit. This guarantees that a hacker could not place the device in password protection mode.

Device operations are selected by writing specific address and data sequences into the command register. Some commands require Bank Address (BA) input. When command sequences are input into a bank reading, the commands have priority over the reading. “MBM29BS/FS12DH Command Definitons Table” shows the valid register command sequences. Note that the Erase Suspend (B0h) and Erase Resume (30h) commands are valid only while the Sector Erase operation is in progress. Moreover, Read/Reset commands are functionally equivalent, resetting the device to the read mode. Please note that commands are always written at DQ 7 to DQ0 and DQ15 to DQ8 bits are ignored. Read/Reset Command In order to return from Autoselect mode or Exceeded Timing Limits (DQ5 = 1) to Read/Reset mode, verify mode of secter protect commands the Reset operation is initiated by writing the Reset command sequence into the command register. Microprocessor read cycles retrieve array data from the memory. The device remains enabled for reads until the command register contents are altered. The device will automatically power-up in the Asynchronous Read/Reset state. In this case, a command se- quence is not required to read data. Standard microprocessor read cycles will retrieve array data. Refer to the AC Read Characteristics and Waveforms for specific timing parameters. Configuration Register Set Command The device uses a configuration register to set the various burst parameters: number of wait states, burst read mode(burst length), active clock edge, RDY configuration, and synchronous mode active. The configuration register must be set before the device will enter burst mode. The configuration register is loaded with a three-cycle command sequence. The first two cycles are standard unlock sequences. On the third cycle, the data should be C0h, address bits A 11 to A0 should be 555h, address bits A19 to A12 set the code to be latched. The device will power up or after a hardware reset with the default setting, which is in asynchronous mode. The register must be set before the device can enter synchronous mode. The configuration register can not be changed during device operations (program, erase, or New Sector Protection). Read Mode Setting On power-up or hardware reset, the device is set to be in asynchronous read mode. This setting allows the system to enable or disable burst mode during system operations. Address A 19 determines this setting: "1’ for asynchronous mode, "0" for synchronous mode. Programmable Wait State Configuration Setting The programmable wait state feature informs the device of the number of clock cycles that must elapse after AVD is driven active before data will be available. This value is determined by the input frequency of the device. Address bits A14 to A12 determine the setting (see “Third Cycle Address/Data Table”). The wait state command sequence instructs the device to set a particular number of clock cycles for the initial access in burst mode. The number of wait states that should be programmed into the device is directly related to the clock frequency. Third Cycle Address/Data Table A

14 A 13 A 12 Total Initial Access Cycles

• Handshaking Option If the device is equipped with the handshaking option, the host system should set address bits (A14,A13, A12) = (0, 1, 0)for a clock frequency of 54/66 MHz for the system/device to execute at maximum speed. The device will automatically delay RDY by one additional clock cycle when the starting address is odd. “Third Cycle Address/Data Table” describes the typical number of clock cycles (wait states) for various conditions. The autoselect function allows the host system to determine whether the flash device is enabled for handshaking. See the "Autoselect Command" section for more information. - Non-Handshaking Option For optimal burst mode performance on devices without the handshaking option, the host system must set the appropriate number of wait states in the flash device depending on the clock frequency. Wait States for Non-Handshaking Table Burst Read Mode Configuration Setting(Burst Length) The device supports three different burst read modes: 8, 16, and 32 word linear wrap around modes. A continuous sequence begins at the starting address and advances the address pointer until the burst operation is complete. For example, an eight-word linear burst with wrap around begins on the starting burst address written to the device and then advances to the next 8-word boundary. The address pointer then returns to the 1st word after the previous eight-word boundary, wrapping through the starting location. The sixteen- and thirty-two linear wrap around modes operate in a fashion similar to the eight-word mode. “Wait States for Handshaking Table” shows the address bits and settings for the three burst read modes. Active Clock Edge Configuration Setting The device can be set so that either the rising clock edge or falling clock edge is active for all synchronous access. Address bit A17 determines this setting; "1" for rising active, "0" for falling active. Wait States for Handshaking Table Conditions at Address Typical No. of Clock Cycles after AVD Low 66/54 MHz Initial address is even 4 Initial address is odd 5 Conditions at Address Typical No. of Clock Cycles after AVD Low 66/54 MHz Initial address is even 5 Initial address is odd 5 Burst Read Mode Settings Table Burst Modes Address Bits A 16 A 15 8-word linear wrap around 0 1 16-word linear wrap around 1 0 32-word linear wrap around 1 1

The device can be set so that RDY goes active either with valid data or one data cycle before active data. Address bit A18 determines this setting; "1" for RDY active with data, "0" for RDY active one clock cycle before valid data. “Configuration Register Table” shows the address bits that determine the configuration register settings for various device functions. Configuration Register Table Autoselect Command Flash memories are intended for use in applications where the local CPU alters memory contents. Therefore, manufacture and device codes must be accessible while the device resides in the target system. PROM pro- grammers typically access the signature codes by raising A 9 to a higher voltage. However, multiplexing high voltage onto the address lines is not generally desired system design practice. The device contains an Autoselect command operation to supplement traditional PROM programming method- ology. The operation is initiated by writing the Autoselect command sequence into the command register. The Autoselect command sequence is initiated first by writing two unlock cycles. This is followed by a third write cycle that contains the bank address (BA) and the Autoselect command. Then the manufacture and device codes can be read from the bank, and actual data from the memory cell can be read from another bank. The higher order address (A 22, A21, A20) required for reading out the manufacture and device codes demands the bank address (BA) set at the third write cycle. Following the command write ,a read cycle from address (BA)00h returns the manufacturer’s code (Fujitsu= 04h) . And a read cycle at address (BA)01h outputs device code. When 227Eh was output, this indicates that two additional codes, called Extended Device Codes will be required. Therefore the system may continue reading out these Extended Device Codes at the address of (BA) 0Eh, as well as at (BA) 0Fh. (Refer to “MBM29BS/ FS12DH Sector Protection Verify Autoselect Codes Table” and “Extended Autoselect Code Table” in “n DEVICE BUS OPERATIION”. ) The sector state (PPB protection or PPB unprotection) will be informed by address (BA) XX02h. Scanning the sector group addresses (A 22, A21, A20, A19, A18, A17, A16, A15, A14, A13, and A12) while(A7, A6, A5, A4, A3, A2, A1,A0) = (0, 0, 0, 0, 0, 0, 1, 0) will produce a logical “1” at device output DQ0 for a protected sector group. The programming Address BIt Function Settings (Binary) A19 Set Device Read Mode 0 = Synchronous Read (Burst Mode) Enabled 1 = Asynchronous Mode (Default) A18 RDY 0 = RDY active one clock cycle before data 1 = RDY active with data A17 Clock 0 = Burst starts and data is output on the falling edge of CLK 1 = Burst starts and data is output on the rising edge of CLK A16 Burst Read Mode 00 = Reserved 01 = 8-word linear with wrap around 10 = 16-word linear with wrap around 11 = 32-word linear with wrap around A A14 Programmable Wait State 000 = Data is valid on the 2th active CLK edge after AVD transition to VIH 001 = Data is valid on the 3th active CLK edge after AVD transition to VIH 010 = Data is valid on the 4th active CLK edge after AVD transition to VIH 011 = Data is valid on the 5th active CLK edge after AVD transition to VIH 100 = Data is valid on the 6th active CLK edge after AVD transition to VIH 101 = Data is valid on the 7th active CLK edge after AVD transition to VIH 110 = Reserved 111 = Reserved A13 A12

verification should be performed by verifying sector group protection on the protected sector. (See “MBM29BS/ FS12DH User Bus Operations Table” in “n DEVICE BUS OPERATIION”. ) The manufacture and device codes can be read from the selected bank. T o read the manufacture and device codes and sector protection status from a non-selected bank, it is necessary to write the Read/Reset command sequence into the register. Autoselect command should then be written into the bank to be read. If the software (program code) for Autoselect command is stored in the Flash memory, the device and manu- facture codes should be read from the other bank, which does not contain the software. No subsequent data will be made available if the autoselect data is read in synchronous mode. T o terminate the operation, it is necessary to write the Read/Reset command sequence into the register. T o execute the Autoselect command during the operation, Read/Reset command sequence must be written before the Autoselect command. Word Programming Command The device is programmed on word-by-word basis. Programming is a four bus cycle operation. There are two “unlock” write cycles. These are followed by the program set-up command and data write cycles. Upon executing the Embedded Program Algorithm command sequence, the system is not required to provide further controls or timings. The device will automatically provide adequate internally generated program pulses and verify the programmed cell margin. The system can determine the status of the program operation by using DQ 7 (Data Polling), DQ6 (T oggle Bit). The Data Polling and T oggle Bit must be performed at the memory location which is being programmed. The automatic programming operation is completed when the data on DQ7 is equivalent to data written to this bit at which time the device returns to the read mode and addresses are no longer latched (see “Hardware Sequence Flags Table”). Therefore, the device requires that a valid address to the device be supplied by the system in this particular instance. Hence, Data Polling must be performed at the memory location which is being programmed. If hardware reset occurs during the programming operation, the data being written is not guaran- teed. Programming is allowed in any sequence and across sector boundaries. Beware that a data “0” cannot be programmed back to a “1”. Attempting to do so may either hang up the device or result in an apparent success according to the data polling algorithm but a read from Read/Reset mode will show that the data is still “0”. Only erase operations can convert from “0”s to “1”s. “Embedded Program TM Algorithm” in “n FLOW CHART” illustrates the Embedded ProgramTM Algorithm using typical command strings and bus operations. Chip Erase Command Chip erase is a six-bus cycle operation. There are two “unlock” write cycles. These are followed by writing the “set-up” command. T wo more “unlock” write cycles are then followed by the chip erase command. Chip erase does not require the user to program the device prior to erase. Upon executing the Embedded Erase Algorithm command sequence the device will automatically program and verify the entire memory for an all zero data pattern prior to electrical erase. (Preprogram Function). The system is not required to provide any controls or timings during these operations. The system can determine the status of the erase operation by using DQ 7 (Data Polling), or DQ6 (T oggle Bit). The chip erase begins on the rising edge of the last WE, whichever happens first in the command sequence and terminates when the data on DQ7 is “1” (See Write Operation Status section. ) at which time the device returns to read the mode. Chip Erase Time; Sector Erase Time · All sectors + Chip Program Time (Preprogramming) “Embedded EraseTM Algorithm” in “n FLOW CHART” illustrates the Embedded EraseTM Algorithm using typical command strings and bus operations.

Sector erase is a six bus cycle operation. There are two “unlock” write cycles. These are followed by writing the “set-up” command. T wo more “unlock” write cycles are then followed by the Sector Erase command. After time- out of “t TOW ” from the rising edge of the last sector erase command, the sector erase operation will begin. Multiple sectors may be erased concurrently by writing the six bus cycle operations on “MBM29BS/FS12DH Command Definitions Table” in “n DEVICE BUS OPERATION”. This sequence is followed with writes of the Sector Erase command to addresses in other sectors desired to be concurrently erased. The time between writes must be less than “t TOW ” otherwise that command will not be accepted and erasure will not start. It is recommended that processor interrupts be disabled during this time to guarantee this condition. The interrupts can be re-enabled after the last Sector Erase command is written. A time-out of “t TOW ” from the rising edge of last WE will initiate the execution of the Sector Erase command(s). If another falling edge of CE or WE, whichever happens first occurs within the “tTOW ” time-out window the timer is reset. (Monitor DQ3 to determine if the sector erase timer window is still open, see section DQ3, Sector Erase Timer. ) Any command other than Sector Erase or Erase Suspend during this time-out period will reset the device to the read mode, ignoring the previous command string. Resetting the device once execution has begun will corrupt the data in the sector. In that case, restart the erase on those sectors and allow them to complete. (Refer to Write Operation Status section for Sector Erase Timer operation. ) Loading the sector erase buffer may be done in any sequence and with any number of sectors. Sector erase does not require the user to program the device prior to erase. The device automatically programs all memory locations in the sector(s) to be erased prior to electrical erase (Preprogram function). When erasing a sector or sectors the remaining unselected sectors are not affected. The system is not required to provide any controls or timings during these operations. The system can determine the status of the erase operation by using DQ 7 (Data Polling), or DQ6 (T oggle Bit). The sector erase begins after the “tTOW ” time out from the rising edge of WE for the last sector erase command pulse and terminates when the data on DQ7 is “1” (See Write Operation Status section. ) at which time the device returns to the read mode. Data polling and T oggle Bit must be performed at an address within any of the sectors being erased. Multiple Sector Erase Time; [Sector Erase Time + Sector Program Time (Preprogramming)] · Number of Sector Erase. In case of multiple sector erase across bank boundaries, a read from the bank (read-while-erase) to which sectors being erased belong cannot be performed. “Embedded EraseTM Algorithm” in “n FLOW CHART” illustrates the Embedded EraseTM Algorithm using typical command strings and bus operations. Erase Suspend/Resume Command The Erase Suspend command allows the user to interrupt a Sector Erase operation and then perform data reads from or programs to a sector not being erased. This command is applicable ONL Y during the Sector Erase operation which includes the time-out period for sector erase. The Erase Suspend command will be ignored if written during the Chip Erase operation or Embedded Program Algorithm. Writting the Erase Suspend command (B0h) during the Sector Erase time-out results in immediate termination of the time-out period and suspension of the erase operation. Writing the Erase Resume command (30h) resumes the erase operation. The addresses are “DON’T CARES” when writting the Erase Suspend or Erase Resume command. When the Erase Suspend command is written during the Sector Erase operation, the device will take a maximum of “t SPD ” to suspend the erase operation. When the device has entered the erase-suspended mode, the DQ7 bit will be at logic “1”, and DQ6 will stop toggling. The user must use the address of the erasing sector for reading DQ6 and DQ7 to determine if the erase operation has been suspended. Further writes of the Erase Suspend command are ignored. When the erase operation has been suspended, the device defaults to the erase-suspend-read mode. Reading data in this mode is the same as reading from the standard read mode except that the data must be read from

sectors that have not been erase-suspended. Successively reading from the erase-suspended sector while the device is in the erase-suspend-read mode will cause DQ2 to toggle. (See the section on DQ2. ) After entering the erase-suspend-read mode, the user can program the device by writing the appropriate com- mand sequence for Program. This program mode is known as the erase-suspend-program mode. Again, pro- gramming in this mode is the same as programming in the regular Program mode except that the data must be programmed to sectors that are not erase-suspended. Successively reading from the erase-suspended sector while the device is in the erase-suspend-program mode will cause DQ 2 to toggle. The end of the erase-suspended Program operation is detected by the Data polling of DQ7 or by the T oggle Bit I (DQ6) which is the same as the regular Program operation. Note that DQ7 must be read from the Program address while DQ6 can be read from any address within Bank being programmed (erase-suspend program). T o resume the operation of Sector Erase, the Resume command (30h) should be written. Any further writes of the Resume command at this point will be ignored. Another Erase Suspend command can be written after the chip has resumed erasing. Extended Command (1) Fast Mode The device has Fast Mode function. This mode dispenses with the initial two unlock cycles required in the standard program command sequence writing Fast Mode command into the command register. In this mode, the required bus cycle for programming is two cycles instead of four bus cycles in standard program command. Do not write any other commands, except Fast Program Command and Reset from Fast Program Command. The read operation is also executed after exiting this mode. T o exit this mode, it is necessary to write Fast Mode Reset command into the command register. (Refer to “Embedded Programming Algorithm for Fast Mode” in “n FLOW CHART”. ) The V CC active current is required even CE = VIH during Fast Mode. (2) Fast Programming During Fast Mode, the programming can be executed with two bus cycles operation. The Embedded Program Algorithm is executed by writing program set-up command (A0h) and data write cycles (P A/PD). (Refer to “Embedded Programming Algorithm for Fast Mode” in “n FLOW CHART”. ) (3) CFI (Common Flash Memory Interface) The CFI (Common Flash Memory Interface) specification outlines device and host system software interro gation handshake which allows specific vendor-specified software algorithms to be used for entire families of device. This allows device-independent, JEDEC ID-independent, and forward-and backward-compatible software sup- port for the specified flash device families. Refer to CFI specification in detail. The operation is initiated by writing the query command (98h) into the command register. Following the command write, a read cycle from specific address retrives device information. Please note that output data of upper byte (DQ 15 to DQ8) is “0” in word mode (16 bit) read. Refer to the CFI code table. T o terminate operation, it is necessary to write the Read/Reset command sequence into the register. HiddenROM Entry Command The device has a HiddenROM area with One Time Protect function. This area is to enter the security code and to unable the change of the code once set. Program/erase is possible in this area until it is protected. However, once it is protected, it is impossible to unprotect, so please use this with caution. The HiddenROM area is 128 words (64 words for factory and 64 words for customer). This area is normally the “outermost” 4 Kwords boot block area in Bank A. Therefore, write the HiddenROM entry command sequence to enter the HiddenROM area. It is called HiddenROM mode when the HiddenROM area appears. The following commands are not allowed when the HiddenROM is enabled. 1. CFI 2. Set to Fast Mode 3. Fast Program 4. Reset from Fast Mode 5. Sector Erase Suspend 6. Sector Erase Resume 7. Chip Erase Command

T o program the data to the HiddenROM area, write the HiddenROM program command sequence during HiddenROM mode. This command is the same as the program command in usual except to write the command during HiddenROM mode. Therefore the detection of completion method is the same as in the past, using the DQ 7 data polling, and DQ6 toggle bit. Need to pay attention to the address to be programmed. If the address other than the HiddenROM area is selected to program, data of the address will be changed. HiddenROM Protect Command T o protect the HiddenROM area, write the HiddenROM Protect command sequence during HiddenROM mode. After issuing "OPBP/48h" at 4th bus cycle, the device requires approximately 150us time out period for protecting HiddenROM area. Then by writing "OPBP/48h" at 5th bus cycle, the device outputs verify data at DQ0. If DQ0=1 then HiddenROM area is protected. If not, then the user needs to repeat this program sequence from the 4th cycle of "OPBP/48h". Password Program Command The Password Program Command permits programming the password that is used as part of the hardware protection scheme. The actual password is 64-bits long. 4 Password Program commands are required to program the password. The user must enter the unlock cycle, password program command (38h) and the program address/data for each portion of the password when programming. There are no provisions for entering the 2-cycle unlock cycle, the password program command, and all the password data. There is no special addressing order required for programming the password. Also, when the password is undergoing programming, Simulta- neous Operation is disabled. Read operations to any memory location will return the programming status. Once the Password is written and verified, the Password Mode Locking Bit must be set in order to prevent verification. The Password Program Command is only capable of programming “0”s. Programming a “1” after a cell is programmed as a “0” results in a time-out by the Embedded Program Algorithm with the cell remaining as a “0”. The password is all F’s when shipped from the factory. All 64-bit password combinations are valid as a password. Writing the HiddenROM Exit command returns the device back to normal operation. Password Verify Command The Password Verify Command is used to verify the Password. The Password is verifiable only when the Password Mode Locking Bit is not programmed. If the Password Mode Locking Bit is programmed and the user attempts to verify the Password, the device will always drive all F’s onto the DQ data bus. Also, the device will not operate in Simultaneous Operation when the Password Verify command is executed. Only the password is returned regardless of the bank address. The lower two address bits (A 1:A0) are valid during the Password Verify. Writing the HiddenROM Exit command returns the device back to normal operation. Password Protection Mode Locking Bit Program Command The Password Protection Mode Locking Bit Program Command programs the Password Protection Mode Locking Bit, which prevents further verifies or updates to the Password. Once programmed, the Password Protection Mode Locking Bit cannot be erased and the Persistent Sector Protection Locking Bit program circuitry is disabled, thereby forcing the device to remain in the Password Protection mode. After issuing "PL/68h" at 4th bus cycle, the device requires approximately 150µs time out period for programming the Password Protection Mode Locking Bit. Then by writing "PL/48h" at 5th bus cycle, the device outputs verify data at DQ0. If DQ0=1 then Password Protection Mode Locking Bit is programmed. If not, then the user needs to repeat this program sequence from the 4th cycle of "PL/68h". Exiting the Password Protection Mode Locking Bit Program command is accomplished by writing the HiddenROM Exit command. Persistent Sector Protection Mode Locking Bit Program Command The Persistent Sector Protection Mode Locking Bit Program Command programs the Persistent Sector Protection Mode Locking Bit, which prevents the Password Mode Locking Bit from ever being programmed. By disabling the program circuitry of the Password Mode Locking Bit, the device is forced to remain in the Persistent Sector Protection mode of operation, once this bit is set. After issuing "SPML/68h" at 4th bus cycle, the device requires approximately 150 µs time out period for programming the Persistent Protection Mode Locking Bit. Then by writing "SPML/48h" at 5th bus cycle, the device outputs verify data at DQ0. If DQ0=1 then Persistent Protection

Mode Locking Bit is programmed. If not, then the user needs to repeat this program sequence from the 4th cycle of "SPML/68h". Exiting the Persistent Protection Mode Locking Bit Program command is accomplished by writing the HiddenROM Exit command. PPB Lock Bit Set Command The PPB Lock Bit Set command is used to set the PPB Lock bit if it is cleared either at reset or if the Password Unlock command was successfully executed. There is no PPB Lock Bit Clear command. Once the PPB Lock Bit is set, it cannot be cleared unless the device is taken through a power-on clear or the Password Unlock command is executed. If the Password Mode Locking Bit is set, the PPB Lock Bit status is reflected as set, even after a power-on reset cycle. Exiting the PPB Lock Bit Set command is accomplished by writing the HiddenROM Exit command. DPB Write(Erase) Command The DPB Write command is used to set or clear a DPB for a given sector. The high order address bits (A 22 to A12) are issued at the same time as the code 01h or 00h on DQ7 to DQ0. All other DQ data bus pins are ignored during the data write cycle. The DPBs are modifiable at any time, regardless of the state of the PPB or PPB Lock Bit. The DPBs are cleared at power-up or hardware reset. Exiting the DPB Write command is accomplished by writing the HiddenROM Exit command. DPB verify command DPB verify command is uesed to verify the status of a DPB for given sector. Scanning the sector addresses (SA) will produce a logical "1" at the device output DQ0 for a protected sector. Otherwise the device will produce "0" at DQ0 for the sector which is not protected. Writing the HiddenROM Exit Command returns the device back to normal operation. PPB Lock Bit verify command PPB Lock Bit verify command is used to verify the status of a PPB Lock Bit. A logical "1" at the device output DQ1 indicates that the PPB Lock Bit is set. If PPB Lock Bit is not set, DQ1 will output"0". Writing the HiddenROM Exit Command returns the device back to normal operation. Password Unlock Command The Password Unlock command is used to clear the PPB Lock Bit so that the PPBs can be unlocked for modification, thereby allowing the PPBs to become accessible for modification. The exact password must be entered in order for the unlocking function to occur. This command cannot be issued any faster than 2 ms at a time to prevent a hacker from running through the all 64-bit combinations in an attempt to correctly match a password. If the command is issued before the 2 ms execution window for each portion of the unlock, the command will be ignored. The Password Unlock function is accomplished by writing Password Unlock command and data to the device to perform the clearing of the PPB Lock Bit. A 0 and A1 are used to determine the 16 bit data quantity is used to match separated 16 bits. Writing the Password Unlock command is address order specific. In other words, the lowers address A 1:A0 = 00, the next cycle command is to A1:A0 = 01, then to A1:A0 = 10, and finally to A1:A0 = 11. Writing out of sequence results in the Password Unlock not returning a match with the password and the PPB Lock Bit remains set. Once the Password Unlock command is entered, the RY/BY pin goes LOW indicating that the device is busy. Also, reading the Bank A results in the DQ6 pin toggling, indicating that the Password Unlock function is in progress. Reading the other bank returns actual array data. Approximately 2µs is required for each portion of the unlock. Once the first portion of the password unlock completes (RY/BY is not driven and DQ6 does not toggle when read), the next cycle is issued, only this time with the next part of the password. Seven cycles Password Unlock commands are required to successfully clear the PPB Lock Bit. As with the first Password Unlock command, the RY/BY signal goes LOW and reading the device results in the DQ6 pin toggling on successive read operations until complete. It is the responsibility of the microprocessor to keep track of the number of Password Unlock cycles, the order, and when to read the PPB Lock bit to confirm successful password unlock. Writing the HiddenROM Exit Command returns the device back to normal operation.

The PPB Program command is used to program, or set, a given PPB. Each PPB is individually programmed (but is bulk erased with the other PPBs). The specific sector address (A22 to A12) are written at the same time as the program command 60h. If the PPB Lock Bit is set and the corresponding PPB is set for the sector, the PPB Program command will not execute and the command will time-out without programming the PPB. After issuing "SGA+WP/68h" at 4th bus cycle, the device requires approximately 150µs time out period for program- ming the PPB. Then by writing "SGA+WP/48h" at 5th bus cycle, the device outputs verify data at DQ0. If DQ0=1 then PPB is programmed. If not, then the user needs to repeat this program sequence from the 4th cycle of "SGA+WP/68h". The PPB Program command does not follow the Embedded Program algorithm. Writing the HiddenROM Exit Command returns the device back to normal operation. All PPB Erase Command The All PPB Erase command is used to erase all PPBs in bulk. There is no means for individually erasing a specific PPB. Unlike the PPB program, no specific sector address is required. However, when the PPB erase command is written (60h), all Sector PPBs are erased in parallel. If the PPB Lock Bit is set the ALL PPB Erase command will not execute and the command will time-out without erasing the PPBs. After issuing "WPE/60h" at 4th bus cycle, the device requires approximately 1.5ms time out period for programming the PPB. Then by writing "WPE/40h" at 5th bus cycle, the device outputs verify data at DQ0. If DQ0=0 then PPB is successfully erased. If not, then the user needs to repeat this program sequence from the 4th cycle of "WPE/60h". It is the responsibility of the user to preprogram all PPBs prior to issuing the All PPB Erase command. If the user attempts to erase a cleared PPB, over-erasure may occur making it difficult to program the PPB at a later time. Also note that the total number of PPB program/erase cycles is limited to 100 cycles. Cycling the PPBs beyond 100 cycles is not guaranteed. Writing the HiddenROM Exit Command returns the device back to normal oper- ation. WRITE OPERATION STATUS Detailed in “Hardware Sequence Flags Table” are all the status flags which can determine the status of the bank for the current mode operation. The read operation from the bank which doesn’t operate Embedded Algorithm returns data of memory cells. These bits offer a method for determining whether an Embedded Algorithm is properly completed. The information on DQ 2 is address-sensitive. This means that if an address from an erasing sector is consecutively read, the DQ2 bit will toggle. However, DQ2 will not toggle if an address from a non-erasing sector is consecutively read. This allows users to determine which sectors are in erase and which are not. The status flag is not output from banks (non-busy banks) which do not execute Embedded Algorithms. For example, a bank (busy bank) is executing an Embedded Algorithm. When the read sequence is [1] < busy bank >, [2] < non-busy bank >, [3] < busy bank >, the DQ6 toggles in the case of [1] and [3]. In case of [2], the data of memory cells are output. In the erase-suspend read mode with the same read sequence, DQ6 will not be toggled in [1] and [3].

Hardware Sequence Flags Table *1: Successive reads from the erasing or erase-suspend sector will cause DQ2 to toggle. *2: Reading from non-erase suspend sector address will indicate logic “1” at the DQ2 bit. *3: When the device is se to Asynchronous mode, these status flags should be read by CE toggle. DQ 7 Data Polling The device features Data Polling as a method to indicate to the host that the Embedded Algorithms are in progress or completed. During the Embedded Program Algorithm, an attempt to read the device will produce a complement of data last written to DQ 7. Upon completion of the Embedded Program Algorithm, an attempt to read the device will produce true data last written to DQ7. During the Embedded Erase Algorithm, an attempt to read the device will produce a “0” at the DQ7 output. Upon completion of the Embedded Erase Algorithm, an attempt to read device will produce a “1” on DQ7. The flowchart for Data Polling (DQ7) is shown in “Data Polling Algorithm” in “n FLOW CHART”. For programming, the Data Polling is valid after the rising edge of the fourth write pulse in the four write pulse sequences. For chip erase and sector erase, the Data Polling is valid after the rising edge of the sixth write pulse in the six write pulse sequences. Data Polling must be performed at sector addresses of sectors being erased, not pro- tected sectors. Otherwise the status may become invalid. If a program address falls within a protected sector, Data Polling on DQ7 is active for approximately 1 ms, then that bank returns to the read mode. After an erase command sequence is written, if all sectors selected for erasing are protected, Data Polling on DQ7 is active for approximately 400 ms, then the bank returns to read mode. Once the Embedded Algorithm operation is close to being completed, the device data pins (DQ7) may change asynchronously while the output enable (OE) is asserted low. This means that device is driving status information on DQ7 at one instant, and then that byte’s valid data at the next instant. Depending on when the system samples the DQ7 output, it may read the status or valid data. Even if device has completed the Embedded Algorithm operation and DQ7 has a valid data, data outputs on DQ0 to DQ6 may still be invalid. The valid data on DQ0 to DQ 7 will be read on successive read attempts. The Data Polling feature is active only during the Embedded Programming Algorithm, Embedded Erase Algorithm or sector erase time-out. (See “Hardware Sequence Flags Table”. ) See “Data Polling Timings/T oggle Bit Timings (During Embedded Algorithm) ” and “Synchronous Data Polling Timings/T oggle Bit Timings” in “n TIMING DIAGRAM” for the Data Polling timing specifications and diagrams. Status DQ 7 DQ 6 DQ 5 DQ 3 DQ 2 In Progress Embedded Program Algorithm DQ 7 Toggle 0 0 No Toggle* 3 Embedded Erase Algorithm Erase Sector 0T o g g l e0 1 Toggle* Non-Erase Sector No Toggle* 3 Erase Suspended Mode Erase Suspend Read (Erase Suspended Sector) 1 No Toggle 3 0 0 Toggle Erase Suspend Read (Non-Erase Suspended Sector)Data Data Data Data Data Erase Suspend Program (Non-Erase Suspended Sector) DQ 7 Toggle 0 0 No Toggle* 2,*3 Exceeded Time Limits Embedded Program Algorithm DQ 7 Toggle 1 0 No Toggle* 3 Embedded Erase Algorithm 0 Toggle 1 1 N/A Erase Suspended Mode Erase Suspend Program (Non-Erase Suspended Sector) DQ

7 Toggle 1 0 N/A

The device also features the “T oggle Bit I” as a method to indicate to the host system that the Embedded Algorithms are in progress or completed. During Embedded Program or Erase Algorithm cycle, successive attempts to read (CE toggling) data from the busy bank will result in DQ6 toggling between one and zero. Once the Embedded Program or Erase Algorithm cycle is completed, DQ6 will stop toggling and valid data will be read on the next successive attempts. During programming, the T oggle Bit I is valid after the rising edge of the fourth write pulse in the four write pulse sequences. For chip erase and sector erase, the T oggle Bit I is valid after the rising edge of the sixth write pulse in the six write pulse sequences. The T oggle Bit I is active during the sector time out. In programming, if the sector being written is protected, the toggle bit will toggle for about 1 ms and then stop toggling with data unchanged. In erase, the device will erase all selected sectors except for protected ones. If all selected sectors are protected, the chip will toggle the toggle bit for about 400 µs and then drop back into read mode, having data kept remained. CE toggling will cause DQ6 to toggle. In addition, an Erase Suspend/Resume command will cause DQ6 to toggle. The system can use DQ6 to determine whether a sector is actively erased or is erase-suspended. When a bank is actively erased (that is, the Embedded Erase Algorithm is in progress) , DQ6 toggles. When a bank enters the Erase Suspend mode, DQ6 stops toggling. Successive read cycles during erase-suspend-program cause DQ6 to toggle. T o operate toggle bit function properly, CE must be high when bank address is changed. See “Data Polling Timings/T oggle Bit Timings (During Embedded Algorithm) ” and “Synchronous Data Polling Timings/T oggle Bit Timings” in “n TIMING DIAGRAM” for the T oggle Bit I timing specifications and diagrams. DQ 5 Exceeded Timing Limits DQ 5 will indicate if the program or erase time has exceeded the specified limits (internal pulse count) . Under these conditions DQ5 will produce “1”. This is a failure condition indicating that the program or erase cycle was not successfully completed. Data Polling is only operating function of the device under this condition. The CE circuit will partially power down device under these conditions (to approximately 2 mA) . The OE and WE pins will control the output disable functions as described in “MBM29BS/FS12DH User Bus Operations Table” in “n DEVICE BUS OPERATIION”. The DQ 5 failure condition may also appear if a user tries to program a non-blank location without pre-erase. In this case the device locks out and never completes the Embedded Algorithm operation. Hence, the system never reads valid data on DQ 7 bit and DQ6 never stop toggling. Once the device has exceeded timing limits, the DQ5 bit will indicate a “1”. Please note that this is not a device failure condition since the device was incorrectly used. If this occurs, reset device with the command sequence. DQ Sector Erase Timer After completion of the initial sector erase command sequence, sector erase time-out begins. DQ3 will remain low until the time-out is completed. Data Polling and T oggle Bit are valid after the initial sector erase command sequence. If Data Polling or the T oggle Bit I indicates that a valid erase command has been written, DQ3 may be used to determine whether the sector erase timer window is still open. If DQ3 is high (“1”) the internally controlled erase cycle has begun. If DQ3 is low (“0”) , the device will accept additional sector erase commands. T o insure the command has been accepted, the system software should check the status of DQ3 prior to and following each subsequent Sector Erase command. If DQ3 were high on the second status check, the command may not have been accepted. See “Configuration Register Table” : Hardware Sequence Flags.

This toggle bit II, along with DQ6, can be used to determine whether the device is in the Embedded Erase Algorithm or in Erase Suspend. Successive reads from the erasing sector will cause DQ2 to toggle during the Embedded Erase Algorithm. If the device is in the erase-suspended-read mode, successive reads from the erase-suspended sector will cause DQ 2 to toggle. When the device is in the erase-suspended-program mode, successive reads from the non-erase suspended sector will indicate a logic “1” at the DQ2 bit. DQ 6 is different from DQ2 in that DQ6 toggles only when the standard program or Erase, or Erase Suspend Program operation is in progress. The behavior of these two status bits, along with that of DQ7, is summarized as follows : For example, DQ2 and DQ6 can be used together to determine if the erase-suspend-read mode is in progress. (DQ 2 toggles while DQ6 does not. ) See also “Hardware Sequence Flags Table”. Furthermore DQ2 can also be used to determine which sector is being erased. At the erase mode, DQ2 toggles if this bit is read from an erasing sector. T o operate toggle bit function properly, CE or OE must be high when bank address is changed. Reading Toggle Bits DQ6/DQ2 Whenever the system initially begins reading toggle bit status, it must read DQ7 to DQ0 at least twice in a row to determine whether a toggle bit is toggling. T ypically a system would note and store the value of the toggle bit after the first read. After the second read, the system would compare the new value of the toggle bit with the first. If the toggle bit is not toggling, the device has completed the program or erase operation. The system can read array data on DQ 7 to DQ0 on the following read cycle. However, if, after the initial two read cycles, the system determines that the toggle bit is still toggling, the system also should note whether the value of DQ5 is high (see the section on DQ5) . If it is, the system should then determine again whether the toggle bit is toggling, since the toggle bit may have stopped toggling just as DQ5 went high. If the toggle bit is no longer toggling, the device has successfully completed the program or erase operation. If it is still toggling, the device did not complete the operation successfully, and the system must write the reset command to return to reading array data. The remaining scenario is that the system initially determines that the toggle bit is toggling and DQ 5 has not gone high. The system may continue to monitor the toggle bit and DQ5 through successive read cycles, deter- mining the status as described in the previous paragraph. Alternatively, it may choose to perform other system tasks. In this case, the system must start at the beginning of the algorithm when it returns to determine the status of the operation. (Refer to “T oggle Bit Algorithm” in “n FLOW CHART”. ) RDY: Ready The RDY is a dedicated output that, when the device is configured in the Synchronous mode, indicates (when at logic low) the system should wait 1 clock cycle before expecting the next word of data. Using the RDY Configuration Command Sequence, RDY can be set so that a logic low indicates the system should wait 2 clock cycles before expecting valid data. In Synchronous mode RDY functions only data valid indicator. The RDY output to be low during the initial access in burst mode. When the device is configured in Asynchronous mode, the RDY is an open-drain output which indicates whether an Embedded Alogorithm is in progress or completed (RY/BY ). If output is low, the device is busy with either a program or erase operation. If output is high (RY/BY should be pulled up), the device is ready to accept any read/write or erase operation. If the device is placed in an Erase Suspend mode, RDY output will be High-Z. During programming at Asynchronous mode, the RDY pin is driven low after the rising edge of the fourth write pulse. During an erase operation, the RY/BY pin is driven low after the rising edge of the sixth write pulse. The RDY pin will indicate a busy condition during RESET pulse. Since this is an open-drain output at Asynchronous mode, RDY pins can be tied together in parallel with a pull- up resistor to VCCQ .

The device is designed to offer protection against accidental erasure or programming caused by spurious system level signals that may exist during power transitions. During power up device automatically resets internal state machine to Read mode. Also, with its control register architecture, alteration of memory contents only occurs after successful completion of specific multi-bus cycle command sequence. Device also incorporates several features to prevent inadvertent write cycles resulting from V CC power-up and power-down transitions or system noise. Write Pulse "Glitch" Protection Noise pulses of less than 3 ns (typical) on OE, CE, or WE will not initiate a write cycle. Logical Inhibit Write cycles are inhibited by holding any one of OE = VIL, CE = VIH or WE = VIH. T o initiate a write cycle, CE and WE must be a logical zero while OE is a logical one. Power-Up Write Inhibit Power-up of the device with WE = CE = VIL and OE = VIH will not accept commands on the rising edge of WE. The internal state machine is automatically reset to read mode on power-up.

n ABSOLUTE MAXIMUM RATINGS *1 : Voltage is defined on the basis of VSS = GND = 0 V. *2 : Minimum DC voltage on input or l/O pins is –0.5 V . During voltage transitions, input or I/O pins may undershoot VSS to –2.0 V for periods of up to 20 ns. Maximum DC voltage on input or l/O pins is VCC +0.5 V . During voltage transitions, input or I/O pins may overshoot to VCC +2.0 V for periods of up to 20 ns. *3 : Minimum DC input voltage on ACC pin is –0.5 V . During voltage transitions, ACC pin may undershoot VSS to –2.0 V for periods of up to 20 ns. Voltage difference between input and supply voltage (VIN - VCC ) does not exceed +8.0 V . Maximum DC input voltage on ACC pin is +10.5 V which may overshoot to +12.5 V for periods of up to 20 ns. WARNING: Semiconductor devices can be permanently damaged by application of stress (voltage, current, temperature, etc.) in excess of absolute maximum ratings. Do not exceed these ratings. n RECOMMENDED OPERATING CONDITIONS * : Voltage is defined on the basis of VSS = GND = 0 V. Notes:Operating ranges define those limits between which the functionality of the device is quaranteed. WARNING: The recommended operating conditions are required in order to ensure the normal operation of the semiconductor device. All of the device’s electrical characteristics are warranted when the device is operated within these ranges. Always use semiconductor devices within their recommended operating conditionranges. Operation outside these ranges may adversely affect reliability and could result in device failure. No warranty is made with respect to uses, operating conditions, or combinations not represented on the data sheet. Users considering application outside the listed conditions are advised to contact their FUJITSU representatives beforehand. Parameter Symbol Rating UnitMin Max Storage Temperature Tstg –55 +125 °C Ambient Temperature with Power Applied T A –40 +85 °C Voltage with Respect to Ground All inputs and I/Os pins except as noted below*1,*2 VIN, VOUT –0.5 V CCQ +0.5 V Power Supply Voltage*1 VCC –0.5 +2.5 V I/O’s Power Supply Voltage V CCQ –0.5 +2.5 V ACC* 1,*3 VACC –0.5 +10.5 V Parameter Symbol Part No. Value Unit Min Max Ambient Temperature T A MBM29BS/FS12DH 12 –40 +85 °C Power Supply Voltage* V CC MBM29BS/FS12DH 12 +1.65 +1.95 V VCCQ Supply Voltage* V CCQ MBM29BS/FS12DH 12 +1.65 +V CC V

• CMOS Compatible *1: The lCC current listed includes both the DC operating current and the frequency dependent component. *2: lCC active while Embedded Algorithm (Program or Erase) is in progress. *3: Automatic sleep mode enables the low power mode when address remain stable for tACC + 60 ns. *4: Embedded Algorithm (Program or Erase) is in progress. (@5 MHz) *5: Applicable for only V CC . Parameter Symbol Conditions Value UnitMin Typ Max Input Leakage Current I LI VIN = VSS to Vcc, VCC = Vcc Max — — –1.0 µA Output Leakage Current I LO VOUT = VSS to Vcc, VCC = Vcc Max — — –1.0 µA VCC Active Burst Read Current ICCB CE = VIL, OE = VIH, WE = VIH,

66 MHz —1 53 0 m A

Read Current*1 ICC1 CE = VIL, OE = VIH, WE = VIH

10 MHz — 20 30 mA5 MHz 10 15

VCC Active Current*2 ICC2 CE = VIL, OE = VIH, VPP = VIH —1 54 0 m A VCC Current (Standby) I CC3 CE = RESET = VCC – 0.2 V — 0.2 50 µA VCC Current (Standby, Reset)*3 ICC4 RESET = VSSQ – 0.2 V, CLK = VIL — 0.2 50 µA VCC Current (Automatic Sleep Mode) ICC5 VCC = VCC Max, CE = VSSQ – 0.2 V, RESET = VCCQ – 0.2 V, VIN = VCCQ –0.2 V or VSSQ – 0.2 V — 0.2 50 µA VCC Active Current (Read-While-Program )*4 ICC6 CE = VIL, OE = VIH —2 56 0 m A VCC Active Current (Read-While-Erase)*4 ICC7 CE = VIL, OE = VIH —2 56 0 m A Input Low Level V IL VCCQ = 1.8 V –0.5 — 0.4 V Input High Level V IH VCCQ = 1.8 V V CCQ –0.4 — V CCQ +0.4 V Output Low Voltage Level V OL IOL = 100 µA, VCC = VCC Min = VCCQ —— 0 . 1V Output High Voltage Level V OH IOH = –100 µA, VCC = VCC Min = VCCQ VCCQ –0.1 — — V Voltage for ACC Program Acceleration*5 VACC — 11.5 — 12.5 V

• Synchronous/Burst Read *: Addresses are latched on the active edge of CLK. Note : Test Conditions: Output Load: VCCQ = 1.65 V to 1.95 V : 30 pF Input rise and fall times: 5 ns Input pulse levels: 0.0 V to V CCQ Timing measurement reference level Input: 0.5 · V CCQ Output: 0.5 · VCCQ Parameter Symbols Value Unit54 MHz 66 MHz Standard Min Max Min Max Latency (Even Address in Handshake Mode) t IACC —6 9—5 6 n s Latency—(Non-Handshake or Odd Address in Handshake mode) tIACC — 87.5 — 71 ns Burst Access Time Valid Clock to Output Delay t BACC — 13.5 — 11 ns Address Setup Time to CLK* t ACS 5—4— n s Address Hold Time from CLK* t ACH 7—6— n s Data Hold Time from Next Clock Cycle t BDH 4—3— n s Chip Enable to RDY Valid t CR — 13.5 — 11 ns Output Enable to Output Valid t OE — 13.5 — 11 ns Chip Enable to High-Z t CEZ —1 0— 8 n s Output Enable to High-Z t OEZ —1 0— 8 n s CE Setup Time to CLK t CES 5— —4 n s Ready Access Time from CLK t RACC — 13.5 — 11 ns CE Setup Time to AVD tCAS 0—0— n s AVD Set Up Time to CLK t AVSC 5—4— n s AVD Hold Time to CLK t AVHC 7—6— n s Access Time t ACC —5 5—5 0 n s CLK to access resume t CKA — 13.5 — 11 ns CLK to High-Z t CKZ —1 0— 8 n s Output Enable Setup Time t OES 5—4— n s Read Cycle for Continuous suspend t RCC —1—1 m s Read Cycle Time t RC 55 — 50 — ns

• Asynchronous Read * : Asynchronous Access Time is from the last of either stable addresses or the falling edge of AVD.
• Hardware Reset (RESET) Parameter Symbols Value Unit54 MHz 66 MHz JEDEC Standard Min Max Min Max Read Cycle Time — t RC 55 — 50 — ns Access Time from CE Low — t CE — 55 — 50 ns Asynchronous Access Time* — t ACC — 55 — 50 ns Output Enable to Output Valid — t OE — 13.5 — 11 ns Output Enable Hold Time Read OEH 0—0— n s Toggle and Data Polling 10 — 8 — ns Chip Enable to High-Z — t CEZ —1 0— 8 n s CE High During Toggle Bit Polling — t CEPH 20 — 20 — ns Output Enable to High-Z — t OEZ —1 0— 8 n s Parameter Symbols All Speed Options Unit JEDEC Standard RESET Pin Low (During Embedded Algorithms) to Read Mode —t READY —2 0µ s RESET Pulse Width — t RP 500 — ns Reset High Time Before Read — t RH 200 — ns Power On/Off Time — t PS 0— n s

• Write (Erase/Program) Operations *: Does not include the preprogramming time. Note : See the "Erase and Programming Performance" section for more information.1. Parameter Symbols Value Unit54 MHz 66 MHz JEDEC Standard Min Typ Max Min Typ Max Write Cycle Time t AVAV tWC 55 — — 50 — — ns Address Setup Time t AVWL tAS 0— — 0— —n s Address Hold Time t WLAX tAH 20 — — 20 — — ns AVD Low Time — t AVDP 12 — — 10 — — ns CE Low to AVD High — t CLAH 12 — — 10 — — ns Data Setup Time t DVWH tDS 45 — — 20 — — ns Data Hold Time t WHDX tDH 0— — 0— —n s Read Recovery Time Before Write t GHWL tGHWL 0— — 0— —n s CE Hold Time t WHEH tCH 0— — 0— —n s Write Pulse Width t EHWH tWP 30 — — 20 — — ns Write Pulse Width High t WHWL tWPH 20 — — 20 — — ns Latency Between Read and Write Operations — t SR/W 0— — 0— —n s Programming Operation t WHWH1 tWHWH1 —6——6—µ s Sector Erase Operation* t WHWH2 tWHWH2 —0 . 5— —0 . 5— s VACC Rise and Fall Time — t VID 500 — — 500 — — ns VACC Setup Time (During Accelerated Programming) —t VIDS 1— — 1— —µ s VCC Setup Time — t VCS 50 — — 50 — — µs CE Setup Time to WE tELWL tCS 0— — 0— —n s AVD Set Up Time to CLK — t AVSC 5— — 4— —n s AVD Hold Time to CLK — t AVHC 7— — 6— —n s AVD Setup Time to WE —t AVSW 5— — 4— —n s AVD Hold Time to WE —t AVHW 7— — 6— —n s Address Setup Time to CLK — t ACS 5— — 4— —n s Address Hold Time to CLK — t ACH 7— — 6— —n s Address Setup Time to AVD —t AAS 5— — 4— —n s Address Hold Time to AVD —t AAH 7— — 6— —n s WE Low to CLK — t WLC 0— — 0— —n s AVD High to WE Low — t AHWL 5— — 5— —n s CLK to WE Low — t CWL 5— — 5— —n s Erase Time-out TIme — t TOW 50 — — 50 — — µs

n ERASE AND PROGRAMMING PERFORMANCE Note : Test conditions TA = +25°C, Typical Erase conditions TA = +25°C, VCC = 1.8 V, Typical Program conditions TA = +25°C, VCC = 1.8 V, Data = checker n FBGA PIN CAPACITANCE Note : Test conditions TA = +25°C, f = 1.0 MHz Parameter Limit Unit Comments Min Typ Max Sector Erase Time — 0.5 2 s Excludes programming prior to erasure Word Programming Time — 6.0 100 µs Excludes system level overhead Chip Programming Time — 25.2 95 s Excludes system level overhead Erase/Program Cycle 100,000 — — cycle Parameter Symbol Test Setup Typ Max Unit Input Capacitance C IN VIN = 0 TBD TBD pF Output Capacitance C OUT VOUT = 0 TBD TBD pF Control Pin Capacitance C IN2 VIN = 0 TBD TBD pF

• Key to Switching Wavwforms WAVEFORM INPUTS OUTPUTS Steady Change from H to L Change from L to H Don’t Care Any Change Permitted Does Not Apply Steady Change from H to L Change from L to H Changing, State Unknown Center Line is High- Impedance State(High-Z) Figure 3 Synchronous Burst Mode Read (Latched By Rising Active CLK) Da Da + 1 Da + n OE DQ 15 to DQ 0 A22 to A0 Aa AVD RDY CLK CE tCES tACS tAVSC tAVHC tACH tOES tCR tRACC tCEZ tIACC tACC tBDH 7 cycles for initial access shown. High-Z High-Z High-Z 1234567 tBACC tCKA Notes : • Figure shows total number of wait states set to seven cycles. The total number of wait states can be programmed from two cycles to seven cycles.
• The device is in synchronous mode.

Figure 4 Synchronous Burst Mode Read (Latched By Falling Active CLK) Notes : • Figure shows total number of wait states set to four cycles. The total number of wait states can be programmed from two cycles to seven cycles. Clock is set for active falling edge.

• The device is in synchronous mode. Da Da + 1 Da + n OE DQ 15 to DQ0 A22 to A0 Aa AVD RD Y CLK CE tCES tACS tAVSC tAVHC tACH tOES tCR tCEZ tACC tBDH 4 cycles for initial access shown. tRACC High-Z High-Z High-Z 1234 5 tBACC tCKA tIACC

7 cycles for initial access shown. tIACC tCKA tACC Figure 5 8-word Linear Burst Note : Figure assumes 7 wait states for initial access, synchronous read. D0 to D7 in data waveform indicate the order of data within a given 8-word address range, from lowest to highest. See "Requirements for Synchronous (Burst) Read Operation". The Set Configuration Register command sequence has been written with A 18 = 1; device will output RDY with valid data.

7 cycles for initial access shown. tIACC tACC tCKA Note : Figure assumes 7 wait states for initial access, synchronous read. D0 to D7 in data waveform indicate the order of data within a given 8-word address range, from lowest to highest. Starting address in figure is the 7th address in range (A 6). See "Requirements for Synchronous (Burst) Read Operation". The Set Configuration Register command sequence has been written with A 18 = 1; device will output RDY with valid data. Figure 6 8-word Linear Burst with Wrap Around

6 wait cycles for initial access shown. High-Z High-Z High-Z 12 3456 tBACC tACC tOES tCKA tIACC Figure 7 Linear Burst with RDY Set One Cycle Before Data Note : Figure assumes 6 wait states for initial access, 66 MHz clock, and synchronous read. The Set Configuration Register command sequence has been written with A18 = 0; device will output RDY one cycle before valid data.

D20D20 D21 D22 D23 D23 D23 D24 AVD RDY Data tOES tCKZ tCKA tOES tRACC tRACC CE VIH VIL tRACC tRACC Figure 8 Handshake Mode Burst Suspend at an even address Note : Figure is for any even address other than 3Eh (or multiple thereof). The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care. When the Burst Suspend is enabled the device will enter power down mode.

D23D23 D24 D25 D25 D25 D26 D27 AVD RDY Data tOES tCKZ tCKA tOES tRACC tRACC CE VIH VIL tRACC tRACC Figure 9 Handshake Mode Burst Suspend at an odd address Note : Figure is for any odd address other than 3Fh (or multiple thereof). The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care. When the Burst Suspend is enabled the device will enter power down mode.

D(0) D(1) AVD RDY Data A(0) tCKA tOES CE tRACC tRACC tRACC Figure 10 Handshake Mode Burst Suspend prior to Initial Access when the starting address is Even Note : Figure assumes 6 wait states for initial access and synchronous read. The starting address is Even. The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care. When the Burst Suspend is enabled the device will enter power down mode.

D(1) D(2) AVD RDY Data A(1) tCKA tOES CE tRACC tRACC tRACC Figure 11 Handshake Mode Burst Suspend prior to Initial Access when the starting address is Odd Note : Figure assumes 6 wait states for initial access and synchronous read. The starting address is Odd. The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care. When the Burst Suspend is enabled the device will enter power down mode.

D20D20 D21 D22 D23 D24 D25 D26 AVD RDY Data tOES tCKZ tCKA tOES tRACC tRACC CE VIH VIL Figure 12 No-Handshake Mode Burst Suspend Note : The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care.

D(n) D(n+1) D(n+2) D(n+3) D(n+4) AVD RDY Data A(n) tCKA tOES CE tRACC Figure 13 No-Handshake Mode Burst Suspend prior to Initial Access Note : Figure assumes 6 wait states for initial access and synchronous read. The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care.

A(n) tCKA tOES CE tRCC tRCC D(n) Invalid DataData RDY Figure 14 Read Cycle for No-Handshake Mode Continuous Suspend Notes : • Figure assumes 6 wait states for initial access and synchronous read. The Set Configuration Register command sequence must be written with A18=1; device will output RDY with valid data. The clock during Burst Suspend is Don’t care.

• Burst plus Burst Suspend should not last longer than t RCC without relaching an address. After the period of tRCC the device will output invalid data.

Figure 15 Asynchronous Mode Read Notes : • AVD is assumed to be VIL.

• Configuration Register is set to Asynchronous mode.

Program Command Sequence (last two cycles)Read Status Data AVD Data A0h PD DQ 7 D OUT D OUT tDS tDH tCEZ tOH VIL tAVSW tAVHW tOEZ 3rd Bus Cycle VA Figure 18 Program Operation Timings at Asynchronous Mode (WE latch) Notes : • PA = Program Address, PD = Program Data, VA = Valid Address for reading status bits.

• "In progress" and "complete" refer to status of program operation.
• A22 to A12 are don’t care during command sequence unlock cycles.
• CLK is Don’t care.
• Configuration Register is set to Asynchronous mode.

Program Command Sequence (last two cycles) Read Status Data tDS tAVDP tCLAH A0h tCS Figure 19 Program Operation Timings at Asynchronous Mode (AVD latch) Notes : • PA = Program Address, PD = Program Data, VA = Valid Address for reading status bits.

• "In progress" and "complete" refer to status of program operation.
• A22 to A12 are don’t care during command sequence unlock cycles.
• CLK is Don’t care.
• Configuration Register is set to Asynchronous mode.
• Addresses are latched on the rising edge of AVD.

Program Command Sequence (last two cycles) Read Status Data tDS tAVHW A0h tWLC tAS tAH Figure 20 Program Operation Timings at Synchronous Mode (WE latch) Notes : • PA = Program Address, PD = Program Data, VA = Valid Address for reading status bits.

• "In progress" and "complete" refer to status of program operation.
• A22 to A12 are don’t care during command sequence unlock cycles.
• Configuration Register is set to Synchronous mode.
• Addresses are latched on the first of either the falling edge of WE or active edge of CLK. When "tWLC " is not met then AVD/address set up and hold time to CLK will be required.

Program Command Sequence (last two cycles) Read Status Data A0h tCWL tACH tVCS Vcc tCAS tDS tDH Figure 21 Program Operation Timings at Synchronous Mode (CLK latch) Notes : • PA = Program Address, PD = Program Data, VA = Valid Address for reading status bits.

• "In progress" and "complete" refer to status of program operation.
• A22 to A12 are don’t care during command sequence unlock cycles.
• Configuration Register is set to Synchronous mode.
• Addresses are latched on the first of either the active edge of CLK or the rising edge of AVD.

Program Command Sequence (last two cycles) Read Status Data tDS tAVSW 55h tWLC tAVHW tAS tAH 10h for chip erase 555h for chip erase tAVSC Figure 22 Chip/Sector Erase Command Sequence Notes : • SA is the sector address for Sector Erase.

• Address bits A22 to A12 are don’t cares during unlock cycles in the command sequence.
• This timing is for Synchronous mode.

Don't Care Don't CareA0h Don't Care PA PD VID VIL or VIH tVID tVIDS Figure 23 Accelerated Fast mode Programming Timing Note : Use setup and hold times from conventional program operation.

Figure 24 Data Polling Timings/Toggle Bit Timings (During Embedded Algorithm) Notes : • Status reads in figure are shown as asynchronous mode.

• VA = Valid Address. Two read cycles are required to determine status. When the Embedded Algorithm operation is complete, and Data Polling will output true data and the toggle bits will stop toggling.

Figure 25 Synchronous Data Polling Timings/Toggle Bit Timings Notes : • The timings are similar to synchronous read timings.

• VA = Valid Address. Two read cycles are required to determine status. When the Embedded Algorithm operation is complete, the toggle bits will stop toggling.
• RDY is active with data (A18 = 0 in the Burst Mode Configuration Register). When A 18 = 1 in the Burst Mode Configuration Register, RDY is active one clock cycle before data.

total number of clock cycles following AVD falling edge Rising edge of next clock cycle following last wait state triggers next burst data number of clock cycles programmed Figure 26 Example of Wait States Insertion (Non-Handshaking Device) Wait State Decoding Addresses: A14, A13, A12 = "101" Þ 5 programmed, 7 total A14, A13, A12 = "100" Þ 4 programmed, 6 total A14, A13, A12 = "011" Þ 3 programmed, 5 total A14, A13, A12 = "010" Þ 2 programmed, 4 total A14, A13, A12 = "001" Þ 1 programmed, 3 total A14, A13, A12 = "000" Þ 0 programmed, 2 total Note : Figure assumes address D0 is not at an address boundary, active clock edge is rising, and wait state is set to "101".

Read status (at least two cycles) in same bank and/or array data from other bank Begin another write or program command sequence RD RA 555h RD tWPH Figure 27 Bank-to-Bank Read/Write Cycle Timings Note : Breakpoints in waveforms indicate that system may alternately read array data from the "non-busy bank" while checking the status of the program or erase operation in the "busy" bank. The system should read status twice to ensure valid information.

(A19 = 0) Set Burst Mode Configuration Register Command for Asynchronous Mode (A19 = 1) Figure 28 Synchronous/Asynchronous State Diagram

Figure 29 Embedded ProgramTM Algorithm No Yes Start Program Command Sequence (Address/Command): 555h/AAh 2AAh/55h 555h/A0h Write Program Command Sequence (See Below) Data Polling Device Increment Address Verify Data Program Address/Program Data Programming Completed Last Address Yes No EMBEDDED ALGORITHM Embedded Program Algorithm in progress

Figure 30 Embedded EraseTM Algorithm 555h/AAh 2AAh/55h 555h/AAh 555h/80h 555h/10h 2AAh/55h 555h/AAh 2AAh/55h 555h/AAh 555h/80h 2AAh/55h Additional sector erase commands are optional. Write Erase Command Sequence (See Below) Data Polling or Toggle Bit from Device Erasure Completed Chip Erase Command Sequence (Address/Command): Individual Sector/Multiple Sector Erase Command Sequence (Address/Command): Sector Address/30h Sector Address/30h Sector Address/30h Start Data = FFh No Yes EMBEDDED ALGORITHM Embedded Erase Algorithm in progress Notes : • See “MBM29BS/FS12DH Command Definitions” in “n DEVICE BUS OPERATION” for erase command sequence.

• See the section on DQ3 for information on the sector erase timer.

Figure 31 Data Polling Algorithm * : DQ7 is rechecked even if DQ5 = “1” because DQ7 may change simultaneously with DQ5. VA = Address for programming = Any of the sector addresses within the sector being erased during sector erase or multiple erases operation. = Any of the sector addresses within the sector not being protected during sector erase or multiple sector erases operation. Fail DQ 7 = Data? No No DQ 7 = Data? DQ 5 = 1? Pass Yes Yes No Start Read Byte (DQ 7 to DQ0) Addr. = VA Read Byte (DQ 7 to DQ0) Addr. = VA Yes

DQ 6 = Toggle? DQ 5 = 1? Yes No Yes Read DQ 7 to DQ 0 Addr. = VA Read DQ 7 to DQ 0 Addr. = VA Read DQ 7 to DQ 0 Addr. = VA Start DQ 6 = Toggle? Yes No Program/Erase Operation Not Complete, Write Reset Command Program/Erase Operation Complete *1,*2 Read DQ 7 to DQ 0 Addr. = VA *1,*2 Figure 32 Toggle Bit Algorithm *1 : Read toggle bit twice to determine whether it is toggling. *2 : Recheck toggle bit because it may stop toggling as DQ5 changes to “1”. VA = Bank address being executed Embedded Algorithm

Figure 33 Embedded Programming Algorithm for Fast Mode Yes No 555h/AAh Verify Data? Start FAST MODE ALGORITHM 555h/20h 2AAh/55h XXXXh/A0h Program Address/Program Data Data Polling Device Last Address Programming Completed XXXXh/90h XXXXh/F0h Increment Address Yes No Set Fast Mode In Fast Program Reset Fast Mode

Part No. Package Access Time(ns) Remarks MBM29BS/FS12DH15PBT 80-ball plastic FBGA (BGA-80P-M04) 15 MBM29BS/FS12 D H 15 PBT DEVICE NUMBER/DESCRIPTION MBM29BS12

128 Mega-bit (8M · 16-Bit) Burst Mode Flash Memory

1.8 V-only Read, Write, and Erase with Non-Handshake

1.8 V-only Read, Write, and Erase with Handshake

PBT = 80-Ball Fine Pitch Ball Grid Array Package (FBGA) SPEED OPTION See Product Selector Guide DEVICE REVISION Boot Sector Architecture D = Dual Boot Type

(BGA-80P-M04) Dimensions in mm (inches) Note : The values in parentheses are reference values. C 2003 FUJITSU LIMITED B80004S-c-1-1 8.00±0.10 (.315±.004) 0.10(.004) 0.38±0.10 (.015±.004)(Stand off) .043–.005 +.005 –0.13 +0.12 1.08 (Mounting height) ABCDEFGHJK (INDEX AREA) 80-ø0.45±0.05 (80-ø.018±.002) ML BASM0.08(.003) REF 0.80(.031) B REF 0.40(.016) A S (INDEX AREA) S

All Rights Reserved. The contents of this document are subject to change without notice. Customers are advised to consult with FUJITSU sales representatives before ordering. The information, such as descriptions of function and application circuit examples, in this document are presented solely for the purpose of reference to show examples of operations and uses of Fujitsu semiconductor device; Fujitsu does not warrant proper operation of the device with respect to use based on such information. When you develop equipment incorporating the device based on such information, you must assume any responsibility arising out of such use of the information. Fujitsu assumes no liability for any damages whatsoever arising out of the use of the information. Any information in this document, including descriptions of function and schematic diagrams, shall not be construed as license of the use or exercise of any intellectual property right, such as patent right or copyright, or any other right of Fujitsu or any third party or does Fujitsu warrant non-infringement of any third-party’s intellectual property right or other right by using such information. Fujitsu assumes no liability for any infringement of the intellectual property rights or other rights of third parties which would result from the use of information contained herein. The products described in this document are designed, developed and manufactured as contemplated for general use, including without limitation, ordinary industrial use, general office use, personal use, and household use, but are not designed, developed and manufactured as contemplated (1) for use accompanying fatal risks or dangers that, unless extremely high safety is secured, could have a serious effect to the public, and could lead directly to death, personal injury, severe physical damage or other loss (i.e., nuclear reaction control in nuclear facility, aircraft flight control, air traffic control, mass transport control, medical life support system, missile launch control in weapon system), or (2) for use requiring extremely high reliability (i.e., submersible repeater and artificial satellite). Please note that Fujitsu will not be liable against you and/or any third party for any claims or damages arising in connection with above-mentioned uses of the products. Any semiconductor devices have an inherent chance of failure. You must protect against injury, damage or loss from such failures by incorporating safety design measures into your facility and equipment such as redundancy, fire protection, and prevention of over-current levels and other abnormal operating conditions. If any products described in this document represent goods or technologies subject to certain restrictions on export under the Foreign Exchange and Foreign Trade Law of Japan, the prior authorization by Japanese government will be required for export of those products from Japan. F0312 ª FUJITSU LIMITED Printed in Japan