S70GL01GN00FFI022

S70GL01GN00 SPANSION | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 83

Technical content

Publication Number S70GL01GN00_00 Revision A Amendment 1 Issue Date June 1, 2005 S70GL01GN00 MirrorBit™ Flash

1024 Megabit,

3.0 Volt-only Page Mode Flash Memory Featuring

110 nm MirrorBit™ Process T echnology Data Sheet ADVANCE INFORMATION Notice to Readers: The Advance Information st atus indicates that this document contains information on one or more products under development at Spansion LLC. The information is intended to help you evaluate this product. Do not design in this product without contacting the factory. Spansion LLC reserves the right to change or discont inue work on this proposed product without notice.

ii S70GL01GN00 MirrorBit™ Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Notice On Data Sheet Designations Spansion LLC issues data sheets with Advance Information or Preliminary designations to advise readers of product information or intended spec ifications throughout th e product life cycle, in - cluding development, qualification, initial produc tion, and full production. In all cases, however, readers are encouraged to verify that they have the latest information before finalizing their de - sign. The following descriptions of Spansion data sheet designations are presented here to high - light their presence and definitions. Advance Information The Advance Information designation indicates that Spansion LLC is developing one or more spe- cific products, but has not committed any design to production. Information presented in a doc - ument with this designation is likely to change , and in some cases, development on the product may discontinue. Spansion LLC therefore places the following conditions upon Advance Informa- tion content: “This document contains information on one or more products under development at Spansion LLC. The information is intended to help you evaluate this product. Do not design in this product without con- tacting the factory. Spansion LLC reserves the right to change or discontinue work on this proposed product without notice.” Preliminary The Preliminary designation indicates that the pr oduct development has progressed such that a commitment to production has taken place. This designation covers several aspects of the prod- uct life cycle, including product qualification, initial production, and the subsequent phases in the manufacturing process that occur before full pr oduction is achieved. Ch anges to the technical specifications presented in a Preliminary document should be expected while keeping these as - pects of production under consideration. Spansion places the following conditions upon Prelimi - nary content: “This document states the current technical specifications regarding the Spansion product(s) described herein. The Preliminary status of this document indicates that product qualification has been completed, and that initial production has begun. Due to the phases of the manufacturi ng process that require maintaining efficiency and quality, this document may be revised by subsequent versions or modifica- tions due to changes in technical specifications.” Combination Some data sheets will contain a combination of products with different designations (Advance In- formation, Preliminary, or Full Production). This type of document will distinguish these products and their designations wherever necessary, typica lly on the first page, the ordering information page, and pages with DC Characteristics table and AC Erase and Program table (in the table notes). The disclaimer on the first page refers the reader to the notice on this page. Full Production (No Designation on Document) When a product has been in production for a period of time such that no changes or only nominal changes are expected, the Preliminary designatio n is removed from the data sheet. Nominal changes may include those affecting the number of ordering part numbers available, such as the addition or deletion of a speed option, temperature range, package type, or V IO range. Changes may also include those needed to clarify a description or to correct a typographical error or incor- rect specification. Spansion LLC applies the following conditions to documents in this category: “This document states the current technical specifications regarding the Spansion product(s) described herein. Spansion LLC deems the products to have been in sufficient production volume such that sub- sequent versions of this document are not expected to change. However, typographical or specification corrections, or modifications to the valid combinations offered may occur.” Questions regarding these document designations may be directed to your local AMD or Fujitsu sales office.

This document contains information on a product under development at Spansion LLC. The information is intended to help you eval uate this product. Spansion LLC reserves the right to change or discontinue work on this proposed product without notice. Publication Number S70GL01GN00_00 Revision A Amendment 1 Issue Date June 1, 2005 ADVANCE INFORMATION S70GL01GN00 MirrorBit TM Flash 110 nm MirrorBit™ Process T echnology Data Sheet Distinctive Characteristics Architectural Advantages „ Two 512 Megabit (S29GL512N) in a single 64-ball Fortified-BGA package „ Two Chip Enable pins — Two CE# pins to control selection of each internal S29GL512N devices „ Single power supply operation — 3 volt read, erase, and program operations „ Manufactured on 110 nm MirrorBit process technology „ Secured Silicon Sector region — 128-word/256-byte sector for permanent, secure identification through an 8-word/16-byte random Electronic Serial Number, accessible through a command sequence „ Flexible sector architecture — Each internal S29GL512N device has five hundred- twelve 64Kword (128Kbyte) sector „ Compatibility with JEDEC standards — Provides pinout and software compatibility for single- power supply flash, and superior inadvertent write protection „ 100,000 erase cycles per sector typical „ 20-year data retention typical Performance Characteristics „ High performance — 110 ns (S29GL512N) — 8-word/16-byte page read buffer — 25 ns page read times — 16-word/32-byte write buffer reduces overall programming time for multiple-word updates „ Low power consumption (typical values at 3.0 V, 5 MHz) — 25 mA typical active read current; — 50 mA typical erase/program current — 1 µA typical standby mode current „ Package options — 64-ball Fortified BGA Software & Hardware Features „ Software features — Program Suspend and Resume: read other sectors before programming operation is completed — Erase Suspend and Resume: read/program other sectors before an erase operation is completed — Data# polling and toggle bits provide status — Unlock Bypass Program command reduces overall multiple-word programming time — CFI (Common Flash Interface) compliant: allows host system to identify and accommodate multiple flash devices „ Hardware features — Advanced Sector Protection — WP#/ACC input accelera tes programming time (when high voltage is applied) for greater throughput during system production. Protects first or last sector regardless of sector protection settings — Hardware reset input (RESET#) resets device — Ready/Busy# output (RY/BY#) detects program or erase cycle completion

2 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information General Description The S70GL01GN00 is a 1024 Mbit, single power supply flash memory device or- ganized as two S29GL512N dies in a single 64-ball Fortified-BGA package. Each S29GL512N die is 512 Mbit, organized as 33,554,432 words or 67,108,864 bytes. The devices have a 16-bit wide data bus that can also function as an 8-bit wide data bus by using the BYTE# input. The device can be programmed either in the host system or in standard EPROM programmers. Access times as fast as 110 ns is available. Note that each access time has a spe- cific operating voltage range (VCC) and an I/O voltage range (VIO), as specified in the Product Selector Guide‚ on page 5 and the Ordering Information‚ on page 9. The devices are offered in a 56-pin TSOP or 64-ball Fortified BGA pack- age. Each device has separate chip enable (CE# or CE2#), write enable (WE#) and output enable (OE#) controls. Each device requires only a single 3.0 volt power supply for both read and write functions. In addition to a V CC input, a high-voltage accelerated program (WP#/ACC) input provides shorter programm ing times through increased cur- rent. This feature is intended to fac ilitate factory throughput during system production, but may also be used in the field if desired. The devices are entirely command set compatible with the JEDEC single- power-supply Flash standard . Commands are written to the device using standard microprocessor write timing. Write cycles also internally latch addresses and data needed for the programming and erase operations. The sector erase architecture allows memory sectors to be erased and repro- grammed without affecting the data contents of other sectors. The device is fully erased when shipped from the factory. Device programming and erasure are in itiated through command sequences. Once a program or erase operation starts, the host system need only poll the DQ7 (Data# Polling) or DQ6 (toggle) status bits or monitor the Ready/Busy# (RY/ BY#) output to determine whether the operation is complete. To facilitate pro- gramming, an Unlock Bypass mode reduces command sequence overhead by requiring only two write cycles to program data instead of four. Hardware data protection measures include a low VCC detector that automat- ically inhibits write operations during power transitions. Persistent Sector Protection provides in-system, command-enabled protection of any combina- tion of sectors using a single power supply at VCC. Password Sector Protection prevents unauthorized write and erase operations in any combination of sectors through a user-defined 64-bit password. The Erase Suspend/Erase Resume feature allows the host system to pause an erase operation in a given sector to read or program any other sector and then complete the erase operation. The Program Suspend/Program Resume fea- ture enables the host system to pause a program operation in a given sector to read any other sector and then complete the program operation. The hardware RESET# pin terminates any operation in progress and resets the device, after which it is then ready for a new operation. The RESET# pin may be tied to the system reset circuitry. A system reset would thus also reset the device, enabling the host system to read b oot-up firmware from the Flash memory device.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 3 Advance Information The device reduces powe r consumption in the standby mode when it detects specific voltage levels on CE# and RESET#, or when addresses are stable for a specified period of time. The Secured Silicon Sector provides a 128-word/256-byte area for code or data that can be permanently protected. Once this sector is protected, no further changes within the sector can occur. The Write Protect (WP#/ACC) feature protects the first or last sector by as- serting a logic low on the WP# pin. MirrorBit flash technology combines years of Flash memory manufacturing expe- rience to produce the highest levels of quality, reliability and cost effectiveness. The device electrically erases all bits within a sector simultaneously via hot-hole assisted erase. The data is programmed using hot electron injection.

4 S70GL01GN00 MirrorBit

Table 10. Command Definitions for Each of S29GL512N, x 16 ..54 Figure 8. Maximum Positive Figure 20. Alternate CE# Controlled Write (Erase/Program)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 5 Advance Information Product Selector Guide S70GL01GN00 Part Number S70GL01GN00 Speed Option V CC = 2.7–3.6 V V IO = 2.7–3.6 V 11 Max. Access Time (ns) 110 Max. CE# Access Time (ns) 110 Max. Page access time (ns) 25 Max. OE# Access Time (ns) 35

6 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Block Diagram ** AMax GL512N = A24

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 7 Advance Information Connection Diagrams Special Package Handling Instructions Special handling is required for Flash Memory products in molded packages (BGA). The package and/or data integr ity may be compromised if the package body is exposed to temperatures above 150°C for prolonged periods of time. A2 C2 D2 E2 F2 G2 H2 A3 C3 D3 E3 F3 G3 H3 A4 C4 D4 E4 F4 G4 H4 A5 C5 D5 E5 F5 G5 H5 A6 C6 D6 E6 F6 G6 H6 A7 C7 D7 E7 F7 G7 H7 DQ15/A-1 VSSBYTE#A16A15A14A12A13 DQ13 DQ6DQ14DQ7A11A10A8A9 VCC DQ4DQ12DQ5A19A21RESET#WE# DQ11 DQ3DQ10DQ2A20A18WP#/ACCRY/BY# DQ9 DQ1DQ8DQ0A5A6A17A7 OE# VSSCE#A0A1A2A4A3 A1 C1 D1 E1 F1 G1 H1 CE2# NCVIONCNCNCNCNC A8 C8 B8 D8 E8 F8 G8 H8 NC NCA24VSSVIOA23A22NC 64-ball Fortified BGA Top View, Balls Facing Down

8 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Pin Description A24–A0 = 25 Address inputs (512 Mb) DQ14–DQ0 = 15 Data inputs/outputs DQ15/A-1 = DQ15 (Data input/output, word mode), A-1 (LSB Address input, byte mode) CE# = Chip Enable input CE2# = Chip Enable input for second die OE# = Output Enable input WE# = Write Enable input WP#/ACC = Hardware Write Protect input; Acceleration input RESET# = Hardware Reset Pin input BYTE# = Selects 8-bit or 16-bit mode RY/BY# = Ready/Busy output V CC = 3.0 volt-only single power supply (see Product Selector Guide for speed options and voltage supply tolerances) V IO = Output Buffer power VSS = Device Ground NC = Pin Not Conne cted Internally Logic Symbol S70GL01GN 16 or 8 DQ15–DQ0 (A-1) A24–A0 CE# OE# WE# RESET# RY/BY# WP#/ACC VIO BYTE# CE2#

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 9 Advance Information

Ordering Information

The ordering part number is formed by a valid combination of the following: Notes: 1. Type 0 is standard. Specify other options as re quired.BGAs can be packed in Types 0, 2, or 3. 2. BGA package Note 2marking omits leading S29 and packing type designator from ordering part number. Valid Combinations Valid Combinations list configurations planned to be supported in volume for this device. Consult your local sales office to confirm availability of specific valid combinations and to check on newly released combinations. S70GL01GN00 F A I 00 0 PACKING TYPE 0 = Tray (standard; see note 1) 2 = 7” Tape and Reel 3 = 13” Tape and Reel MODEL NUMBER (VIO range, protection when WP# =VIL) 01 = V IO = VCC = 2.7 to 3.6 V, highest address sector protected for both Flash-1 and Flash-2 02 = V IO = VCC = 2.7 to 3.6 V, lowest address sector protected for both Flash-1 and Flash-2 12 = V IO = VCC = 2.7 to 3.6 V, highest address sector protected for Flash1, lowest address sector protected for Flash-2 TEMPERATURE RANGE I = Industrial (–40 °C to +85°C) PACKAGE MATERIALS SET A= S t a n d a r d F= P b - f r e e PACKAGE TYPE F = Fortified Ball Grid Array, 1.0 mm pitch package DEVICE NUMBER/DESCRIPTION

3.0 Volt-only, 1024 Megabit (2x32 M x 16-Bit/2x64 M x 8-Bit) Page-Mode Flash Memory

Manufactured on 110 nm MirrorBit TM process technology S70GL01GN00 Valid Ordering Part Numbers Comments 1Gb Package & Temperature Model Number Pack Type (Note 1) S70GL01GN00 FAI, FFI ( Note 2) 01, 02, 12 0, 2, 3 Speed = 110 ns

10 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Device Bus Operations This section describes the requirements and use of the device bus operations, which are initiated through the internal command register. The command register itself does not occupy any addressable memory location. The register is a latch used to store the commands, along wi th the address and data information needed to execute the command. The contents of the register serve as inputs to the internal state machine. The state machine outputs dictate the function of the device. Table 1 lists the device bus operations, the inputs and control levels they require, and the resulting output. The following subsections describe each of these operations in further detail. Ta ble 1 . Device Bus Operations Legend: L = Logic Low = VIL, H = Logic High = VIH, VID = 11.5–12.5 V, VHH = 11.5–12.5V, X = Don’t Care, SA = Sector Address, AIN = Address In, DIN = Data In, DOUT = Data Out Notes: 1. Addresses are AMax:A0 in word mode; A Max:A-1 in byte mode. Sector addresses are AMax:A16 in both modes. 2. If WP# = V IL, the first or last sector group remains protected. If WP# = VIH, the first or last sector is protected or unprotected as determined by the method described in “Write Protect (WP#)”. All sectors are unprotected when shipped from the factory (The Secured Silicon Sector may be factory protected depending on version ordered.) 3. D IN or DOUT as required by command sequence, data polling, or sector protect algorithm (see Figure 2, Figure 4, and Figure 5). 4. CE# can be replaced with CE2# when referring to the second die in the package. CE# and CE2# must not be driven at the same time. Word/Byte Configuration The BYTE# pin controls whether the device data I/O pins operate in the byte or word configuration. If the BYTE# pin is set at logic 1, the device is in word con- figuration, DQ0–DQ15 are active and controlled by CE# or CE2# and OE#. If the BYTE# pin is set at logic 0, the device is in byte configuration, and only data I/O pins DQ0–DQ7 are active and controlled by CE# or CE2# and OE#. The data I/O pins DQ8–DQ14 are tri-stated, and the DQ15 pin is used as an input for the LSB (A-1) address function. Requirements for Reading Array Data To read array data from the outputs, the system must drive the CE# or CE2# and OE# pins to VIL. CE# or CE2# is the power control and selects the device. OE# is the output control and gates array data to the output pins. WE# should remain at V IH. Operation CE# (Note 4)O E # WE # RESET# WP#/ ACC Addresses (Note 1) DQ0– DQ7 DQ8–DQ15 BYTE# = VIH BYTE# = VIL Read L L H H X A IN DOUT DOUT DQ8–DQ14 = High-Z, DQ15 = A-1 Write (Program/Erase) L H L H Note 2 A IN (Note 3)( Note 3) Accelerated Program L H L H V HH AIN (Note 3)( Note 3) Standby VCC ±

0.3 V XX VCC ±

0.3 V H X High-Z High-Z High-Z

Output Disable L H H H X X High-Z High-Z High-Z Reset X X X L X X High-Z High-Z High-Z

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 11 Advance Information The internal state machine is set for re ading array data upon device power-up, or after a hardware reset. This ensures that no spurious alteration of the memory content occurs during the power transiti on. No command is necessary in this mode to obtain array data. Standard microprocessor read cycles that assert valid addresses on the device address inputs produce valid data on the device data outputs. The device remains enabled for read access until the command register contents are altered. See Reading Array Data‚ on page 40 for more information. Refer to the AC Read- Only Operations table for timing specifications and to Figure 11, on page 70 for the timing diagram. Refer to the DC Characteristics table for the active current specification on reading array data. Page Mode Read The device is capable of fast page mode read and is compatible with the page mode Mask ROM read operation. This mode provides faster read access speed for random locations within a page. The page size of the device is 8 words/16 bytes. The appropriate page is selected by the higher address bits A(max)–A3. Address bits A2–A0 in word mode (A2–A-1 in byte mode) determine the specific word within a page. This is an asynchronous operation; the microprocessor supplies the specific word location. The random or initial page access is equal to t ACC or tCE and subsequent page read accesses (as long as the locations specified by the microprocessor falls within that page) is equivalent to tPACC. When CE# is de-asserted and reasserted for a subsequent access, the access time is tACC or tCE. Fast page mode accesses are obtained by keeping the “read-page addresses” constant and changing the “intra-read page” addresses. Writing Commands/Command Sequences To write a command or command sequence (which includes programming data to the device and erasing sectors of memory), the system must drive WE# and CE# or CE2# to VIL, and OE# to VIH. The device features an Unlock Bypass mode to facilitate faster programming. Once the device enters the Unlock Bypa ss mode, only two write cycles are re- quired to program a word or byte, instead of four. The Word Program Command Sequence‚ on page 41 contains details on programming data to the device using both standard and Unlock Bypass command sequences. An erase operation can erase one sector, multiple sectors, or the entire device. Table 2 on page 13, and Table 3 on page 28 indicate the address space that each sector occupies. Refer to the DC Characteristics table for the active current specification for the write mode. The AC Characteristics sectio n contains timing specification tables and timing diagrams for write operations. Write Buffer Write Buffer Programming allows the system write to a maximum of 16 words/32 bytes in one programming operation. This results in faster effective programming time than the standard programming algorithms. See Write Buffer‚ on page 11 for more information.

12 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Accelerated Program Operation The device offers accelerated program operations through the ACC function. This is one of two functions provided by the WP#/ACC pin. This function is primarily intended to allow faster manufacturing throughput at the factory. If the system asserts V HH on this pin, the device automatically enters the afore- mentioned Unlock Bypass mode, tempor arily unprotects any protected sector groups, and uses the higher voltage on th e pin to reduce the time required for program operations. The system would use a two-cycle program command se- quence as required by the Unlock Bypass mode. Removing VHH from the WP#/ ACC pin returns the device to normal operation. Note that the WP#/ACC pin must not be at VHH for operations other than accelerated programming, or device dam- age may result. WP# contains an internal pullup; when unconnected, WP# is at VIH. Autoselect Functions If the system writes the autoselect command sequence, the device enters the au- toselect mode. The system can then read autoselect codes from the internal register (which is separate from the memory array) on DQ7–DQ0. Standard read cycle timings apply in this mode. Refer to the Autoselect Mode‚ on page 28 and Autoselect Command Sequence‚ on page 40, for more information. Standby Mode When the system is not reading or writing to the device, it can place the device in the standby mode. In this mode, current consumption is greatly reduced, and the outputs are placed in the high im pedance state, independent of the OE# input. The device enters the CMOS standby mode when the CE# or CE2# and RESET# pins are both held at V IO ± 0.3 V. (Note that this is a more restricted voltage range than VIH.) If CE# or CE2# and RESET# are held at VIH, but not within VIO ± 0.3 V, the device is in the standby mode, but the standby current is greater. The device requires standard access time (t CE) for read access when the device is in either of these standby modes, before it is ready to read data. If the device is deselected during erasure or programming, the device draws ac- tive current until the operation is completed. Refer to DC Characteristics‚ on page 67 for the standby current specification. Automatic Sleep Mode The automatic sleep mode minimizes Flash device energy consumption. The de- vice automatically enables this mode when addresses remain stable for t ACC + 30 ns. The automatic sleep mode is independent of the CE# or CE2#, WE#, and OE# control signals. Standard address access timings provide new data when ad- dresses are changed. While in sleep mode , output data is latched and always available to the system. Refer to DC Characteristics‚ on page 67 for the automatic sleep mode current specification. RESET#: Hardware Reset Pin The RESET# pin provides a hardware method of resetting the device to reading array data. When the RESET# pin is dr iven low for at least a period of t RP, the device immediately terminates any operat ion in progress, tristates all output pins, and ignores all read/write commands for the duration of the RESET# pulse. The device also resets the internal state machine to reading array data. The op-

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 13 Advance Information eration that was interrupted should be re initiated once the device is ready to accept another command sequence, to ensure data integrity. Current is reduced for the duration of the RESET# pulse. When RESET# is held at VSS±0.3 V, the device draws CMOS standby current (ICC5). If RESET# is held at VIL but not within VSS±0.3 V, the standby current is greater. The RESET# pin may be tied to the system reset circuitry. A system reset would thus also reset the Flash memory, enabling the system to read the boot-up firm- ware from the Flash memory. Refer to the AC Characteristics tables for RESET# parameters and to Figure 13, on page 71 for the timing diagram. Output Disable Mode When the OE# input is at VIH, output from the device is disabled. The output pins are placed in the high impedance state. T able 2. Sector Address T able for CE# or CE2# (Sheet 1 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal) S A 0 000000000 1 2 8 / 6 4 0000000–001FFFF 0000000–000FFFF S A 1 000000001 1 2 8 / 6 4 0020000–003FFFF 0010000–001FFFF S A 2 000000010 1 2 8 / 6 4 0040000–005FFFF 0020000–002FFFF S A 3 000000011 1 2 8 / 6 4 0060000–007FFFF 0030000–003FFFF S A 4 000000100 1 2 8 / 6 4 0080000–009FFFF 0040000–004FFFF S A 5 000000101 1 2 8 / 6 4 0 0 A 0 0 0 0–00BFFFF 0050000–005FFFF S A 6 000000110 1 2 8 / 6 4 0 0 C 0 0 0 0–00DFFFF 0060000–006FFFF S A 7 000000111 1 2 8 / 6 4 0 0 E 0000–00FFFFF 0070000–007FFFF S A 8 000001000 1 2 8 / 6 4 0100000–011FFFF 0080000–008FFFF S A 9 000001001 1 2 8 / 6 4 0120000–013FFFF 0090000–009FFFF S A 1 0 000001010 1 2 8 / 6 4 0140000–015FFFF 00A0000–00AFFFF S A 1 1 000001011 1 2 8 / 6 4 0160000–017FFFF 00B0000–00BFFFF S A 1 2 000001100 1 2 8 / 6 4 0180000–019FFFF 00C0000–00CFFFF S A 1 3 000001101 1 2 8 / 6 4 0 1 A 0 0 0 0–01BFFFF 00D0000–00DFFFF S A 1 4 000001110 1 2 8 / 6 4 0 1 C 0 0 0 0–01DFFFF 00E0000–00EFFFF S A 1 5 000001111 1 2 8 / 6 4 0 1 E 0000–01FFFFF 00F0000–00FFFFF S A 1 6 000010000 1 2 8 / 6 4 0200000–021FFFF 0100000–010FFFF S A 1 7 000010001 1 2 8 / 6 4 0220000–023FFFF 0110000–011FFFF S A 1 8 000010010 1 2 8 / 6 4 0240000–025FFFF 0120000–012FFFF S A 1 9 000010011 1 2 8 / 6 4 0260000–027FFFF 0130000–013FFFF S A 2 0 000010100 1 2 8 / 6 4 0280000–029FFFF 0140000–014FFFF S A 2 1 000010101 1 2 8 / 6 4 0 2 A 0 0 0 0–02BFFFF 0150000–015FFFF S A 2 2 000010110 1 2 8 / 6 4 0 2 C 0 0 0 0–02DFFFF 0160000–016FFFF

14 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 2 3 000010111 1 2 8 / 6 4 0 2 E 0000–02FFFFF 0170000–017FFFF S A 2 4 000011000 1 2 8 / 6 4 0300000–031FFFF 0180000–018FFFF S A 2 5 000011001 1 2 8 / 6 4 0320000–033FFFF 0190000–019FFFF S A 2 6 000011010 1 2 8 / 6 4 0340000–035FFFF 01A0000–01AFFFF S A 2 7 000011011 1 2 8 / 6 4 0360000–037FFFF 01B0000–01BFFFF S A 2 8 000011100 1 2 8 / 6 4 0380000–039FFFF 01C0000–01CFFFF S A 2 9 000011101 1 2 8 / 6 4 0 3 A 0 0 0 0–03BFFFF 01D0000–01DFFFF S A 3 0 000011110 1 2 8 / 6 4 0 3 C 0 0 0 0–03DFFFF 01E0000–01EFFFF S A 3 1 000011111 1 2 8 / 6 4 0 3 E 0000–0EFFFFF 01F0000–01FFFFF S A 3 2 000100000 1 2 8 / 6 4 0400000–041FFFF 0200000–020FFFF S A 3 3 000100001 1 2 8 / 6 4 0420000–043FFFF 0210000–021FFFF S A 3 4 000100010 1 2 8 / 6 4 0440000–045FFFF 0220000–022FFFF S A 3 5 000100011 1 2 8 / 6 4 0460000–047FFFF 0230000–023FFFF S A 3 6 000100100 1 2 8 / 6 4 0480000–049FFFF 0240000–024FFFF S A 3 7 000100101 1 2 8 / 6 4 0 4 A 0 0 0 0–04BFFFF 0250000–025FFFF S A 3 8 000100110 1 2 8 / 6 4 0 4 C 0 0 0 0–04DFFFF 0260000–026FFFF S A 3 9 000100111 1 2 8 / 6 4 0 4 E 0000–04FFFFF 0270000–027FFFF S A 4 0 000101000 1 2 8 / 6 4 0500000–051FFFF 0280000–028FFFF S A 4 1 000101001 1 2 8 / 6 4 0520000–053FFFF 0290000–029FFFF S A 4 2 000101010 1 2 8 / 6 4 0540000–055FFFF 02A0000–02AFFFF S A 4 3 000101011 1 2 8 / 6 4 0560000–057FFFF 02B0000–02BFFFF S A 4 4 000101100 1 2 8 / 6 4 0580000–059FFFF 02C0000–02CFFFF S A 4 5 000101101 1 2 8 / 6 4 0 5 A 0 0 0 0–05BFFFF 02D0000–02DFFFF S A 4 6 000101110 1 2 8 / 6 4 0 5 C 0 0 0 0–05DFFFF 02E0000–02EFFFF S A 4 7 000101111 1 2 8 / 6 4 0 5 E 0000–05FFFFF 02F0000–02FFFFF S A 4 8 000110000 1 2 8 / 6 4 0600000–061FFFF 0300000–030FFFF S A 4 9 000110001 1 2 8 / 6 4 0620000–063FFFF 0310000–031FFFF S A 5 0 000110010 1 2 8 / 6 4 0640000–065FFFF 0320000–032FFFF S A 5 1 000110011 1 2 8 / 6 4 0660000–067FFFF 0330000–033FFFF S A 5 2 000110100 1 2 8 / 6 4 0680000–069FFFF 0340000–034FFFF S A 5 3 000110101 1 2 8 / 6 4 0 6 A 0 0 0 0–06BFFFF 0350000–035FFFF S A 5 4 000110110 1 2 8 / 6 4 0 6 C 0 0 0 0–06DFFFF 0360000–036FFFF S A 5 5 000110111 1 2 8 / 6 4 0 6 E 0000–06FFFFF 0370000–037FFFF S A 5 6 000111000 1 2 8 / 6 4 0700000–071FFFF 0380000–038FFFF S A 5 7 000111001 1 2 8 / 6 4 0720000–073FFFF 0390000–039FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 2 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 15 Advance Information S A 5 8 000111010 1 2 8 / 6 4 0740000–075FFFF 03A0000–03AFFFF S A 5 9 000111011 1 2 8 / 6 4 0760000–077FFFF 03B0000–03BFFFF S A 6 0 000111100 1 2 8 / 6 4 0780000–079FFFF 03C0000–03CFFFF S A 6 1 000111101 1 2 8 / 6 4 0 7 A 0 0 0 0–07BFFFF 03D0000–03DFFFF S A 6 2 000111110 1 2 8 / 6 4 0 7 C 0 0 0 0–07DFFFF 03E0000–03EFFFF S A 6 3 000111111 1 2 8 / 6 4 0 7 E 0000–07FFFFF 03F0000–03FFFFF S A 6 4 001000000 1 2 8 / 6 4 0800000–081FFFF 0400000–040FFFF S A 6 5 001000001 1 2 8 / 6 4 0820000–083FFFF 0410000–041FFFF S A 6 6 001000010 1 2 8 / 6 4 0840000–085FFFF 0420000–042FFFF S A 6 7 001000011 1 2 8 / 6 4 0860000–087FFFF 0430000–043FFFF S A 6 8 001000100 1 2 8 / 6 4 0880000–089FFFF 0440000–044FFFF S A 6 9 001000101 1 2 8 / 6 4 0 8 A 0 0 0 0–08BFFFF 0450000–045FFFF S A 7 0 001000110 1 2 8 / 6 4 0 8 C 0 0 0 0–08DFFFF 0460000–046FFFF S A 7 1 001000111 1 2 8 / 6 4 0 8 E 0000–08FFFFF 0470000–047FFFF S A 7 2 001001000 1 2 8 / 6 4 0900000–091FFFF 0480000–048FFFF S A 7 3 001001001 1 2 8 / 6 4 0920000–093FFFF 0490000–049FFFF S A 7 4 001001010 1 2 8 / 6 4 0940000–095FFFF 04A0000–04AFFFF S A 7 5 001001011 1 2 8 / 6 4 0960000–097FFFF 04B0000–04BFFFF S A 7 6 001001100 1 2 8 / 6 4 0980000–099FFFF 04C0000–04CFFFF S A 7 7 001001101 1 2 8 / 6 4 0 9 A 0 0 0 0–09BFFFF 04D0000–04DFFFF S A 7 8 001001110 1 2 8 / 6 4 0 9 C 0 0 0 0–09DFFFF 04E0000–04EFFFF S A 7 9 001001111 1 2 8 / 6 4 0 9 E 0000–09FFFFF 04F0000–04FFFFF S A 8 0 001010000 1 2 8 / 6 4 0 A 00000–0A1FFFF 0500000–050FFFF S A 8 1 001010001 1 2 8 / 6 4 0 A 20000–0A3FFFF 0510000–051FFFF S A 8 2 001010010 1 2 8 / 6 4 0 A 40000–0A5FFFF 0520000–052FFFF S A 8 3 001010011 1 2 8 / 6 4 0 A 60000–0A7FFFF 0530000–053FFFF S A 8 4 001010100 1 2 8 / 6 4 0 A 80000–0A9FFFF 0540000–054FFFF S A 8 5 001010101 1 2 8 / 6 4 0 A A 0 0 0 0–0ABFFFF 0550000–055FFFF S A 8 6 001010110 1 2 8 / 6 4 0 A C 0 0 0 0–0ADFFFF 0560000–056FFFF S A 8 7 001010111 1 2 8 / 6 4 0 A E 0000–0AFFFFF 0570000–057FFFF S A 8 8 001011000 1 2 8 / 6 4 0 B 00000–0B1FFFF 0580000–058FFFF S A 8 9 001011001 1 2 8 / 6 4 0 B 20000–0B3FFFF 0590000–059FFFF S A 9 0 001011010 1 2 8 / 6 4 0 B 40000–0B5FFFF 05A0000–05AFFFF S A 9 1 001011011 1 2 8 / 6 4 0 B 60000–0B7FFFF 05B0000–05BFFFF S A 9 2 001011100 1 2 8 / 6 4 0 B 80000–0B9FFFF 05C0000–05CFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 3 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

16 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 9 3 001011101 1 2 8 / 6 4 0 B A 0 0 0 0–0BBFFFF 05D0000–05DFFFF S A 9 4 001011110 1 2 8 / 6 4 0 B C 0 0 0 0–0BDFFFF 05E0000–05EFFFF S A 9 5 001011111 1 2 8 / 6 4 0 B E 0000–0BFFFFF 05F0000–05FFFFF S A 9 6 001100000 1 2 8 / 6 4 0 C 00000–0C1FFFF 0600000–060FFFF S A 9 7 001100001 1 2 8 / 6 4 0 C 20000–0C3FFFF 0610000–061FFFF S A 9 8 001100010 1 2 8 / 6 4 0 C 40000–0C5FFFF 0620000–062FFFF S A 9 9 001100011 1 2 8 / 6 4 0 C 60000–0C7FFFF 0630000–063FFFF S A 1 0 0 001100100 1 2 8 / 6 4 0 C 80000–0C9FFFF 0640000–064FFFF S A 1 0 1 001100101 1 2 8 / 6 4 0 C A 0 0 0 0–0CBFFFF 0650000–065FFFF S A 1 0 2 001100110 1 2 8 / 6 4 0 C C 0 0 0 0–0CDFFFF 0660000–066FFFF S A 1 0 3 001100111 1 2 8 / 6 4 0 C E 0000–0CFFFFF 0670000–067FFFF S A 1 0 4 001101000 1 2 8 / 6 4 0 D 00000–0D1FFFF 0680000–068FFFF S A 1 0 5 001101001 1 2 8 / 6 4 0 D 20000–0D3FFFF 0690000–069FFFF S A 1 0 6 001101010 1 2 8 / 6 4 0 D 40000–0D5FFFF 06A0000–06AFFFF S A 1 0 7 001101011 1 2 8 / 6 4 0 D 60000–0D7FFFF 06B0000–06BFFFF S A 1 0 8 001101100 1 2 8 / 6 4 0 D 80000–0D9FFFF 06C0000–06CFFFF S A 1 0 9 001101101 1 2 8 / 6 4 0 D A 0 0 0 0–0DBFFFF 06D0000–06DFFFF S A 1 1 0 001101110 1 2 8 / 6 4 0 D C 0 0 0 0–0DDFFFF 06E0000–06EFFFF S A 1 1 1 001101111 1 2 8 / 6 4 0 D E 0000–0DFFFFF 06F0000–06FFFFF S A 1 1 2 001110000 1 2 8 / 6 4 0 E 00000–0E1FFFF 0700000–070FFFF S A 1 1 3 001110001 1 2 8 / 6 4 0 E 20000–0E3FFFF 0710000–071FFFF S A 1 1 4 001110010 1 2 8 / 6 4 0 E 40000–0E5FFFF 0720000–072FFFF S A 1 1 5 001110011 1 2 8 / 6 4 0 E 60000–0E7FFFF 0730000–073FFFF S A 1 1 6 001110100 1 2 8 / 6 4 0 E 80000–0E9FFFF 0740000–074FFFF S A 1 1 7 001110101 1 2 8 / 6 4 0 E A 0 0 0 0–0EBFFFF 0750000–075FFFF S A 1 1 8 001110110 1 2 8 / 6 4 0 E C 0 0 0 0–0EDFFFF 0760000–076FFFF S A 1 1 9 001110111 1 2 8 / 6 4 0 E E 0000–0EFFFFF 0770000–077FFFF S A 1 2 0 001111000 1 2 8 / 6 4 0 F 00000–0F1FFFF 0780000–078FFFF S A 1 2 1 001111001 1 2 8 / 6 4 0 F 20000–0F3FFFF 0790000–079FFFF S A 1 2 2 001111010 1 2 8 / 6 4 0 F 40000–0F5FFFF 07A0000–07AFFFF S A 1 2 3 001111011 1 2 8 / 6 4 0 F 60000–0F7FFFF 07B0000–07BFFFF S A 1 2 4 001111100 1 2 8 / 6 4 0 F 80000–0F9FFFF 07C0000–07CFFFF S A 1 2 5 001111101 1 2 8 / 6 4 0 F A 0000–0FBFFFF 07D0000–07DFFFF S A 1 2 6 001111110 1 2 8 / 6 4 0 F C 0 0 0 0–0FDFFFF 07E0000–07EFFFF S A 1 2 7 001111111 1 2 8 / 6 4 0 F E 0000–0FFFFFF 07F0000–07FFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 4 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 17 Advance Information S A 1 2 8 010000000 1 2 8 / 6 4 1000000–101FFFF 0800000–080FFFF S A 1 2 9 010000001 1 2 8 / 6 4 1020000–103FFFF 0810000–081FFFF S A 1 3 0 010000010 1 2 8 / 6 4 1040000–105FFFF 0820000–082FFFF S A 1 3 1 010000011 1 2 8 / 6 4 1060000–017FFFF 0830000–083FFFF S A 1 3 2 010000100 1 2 8 / 6 4 1080000–109FFFF 0840000–084FFFF S A 1 3 3 010000101 1 2 8 / 6 4 1 0 A 0 0 0 0–10BFFFF 0850000–085FFFF S A 1 3 4 010000110 1 2 8 / 6 4 1 0 C 0 0 0 0–10DFFFF 0860000–086FFFF S A 1 3 5 010000111 1 2 8 / 6 4 1 0 E 0000–10FFFFF 0870000–087FFFF S A 1 3 6 010001000 1 2 8 / 6 4 1100000–111FFFF 0880000–088FFFF S A 1 3 7 010001001 1 2 8 / 6 4 1120000–113FFFF 0890000–089FFFF S A 1 3 8 010001010 1 2 8 / 6 4 1140000–115FFFF 08A0000–08AFFFF S A 1 3 9 010001011 1 2 8 / 6 4 1160000–117FFFF 08B0000–08BFFFF S A 1 4 0 010001100 1 2 8 / 6 4 1180000–119FFFF 08C0000–08CFFFF S A 1 4 1 010001101 1 2 8 / 6 4 1 1 A 0 0 0 0–11BFFFF 08D0000–08DFFFF S A 1 4 2 010001110 1 2 8 / 6 4 1 1 C 0 0 0 0–11DFFFF 08E0000–08EFFFF S A 1 4 3 010001111 1 2 8 / 6 4 1 1 E 0000–11FFFFF 08F0000–08FFFFF S A 1 4 4 010010000 1 2 8 / 6 4 1200000–121FFFF 0900000–090FFFF S A 1 4 5 010010001 1 2 8 / 6 4 1220000–123FFFF 0910000–091FFFF S A 1 4 6 010010010 1 2 8 / 6 4 1240000–125FFFF 0920000–092FFFF S A 1 4 7 010010011 1 2 8 / 6 4 1260000–127FFFF 0930000–093FFFF S A 1 4 8 010010100 1 2 8 / 6 4 1280000–129FFFF 0940000–094FFFF S A 1 4 9 010010101 1 2 8 / 6 4 1 2 A 0 0 0 0–12BFFFF 0950000–095FFFF S A 1 5 0 010010110 1 2 8 / 6 4 1 2 C 0 0 0 0–12DFFFF 0960000–096FFFF S A 1 5 1 010010111 1 2 8 / 6 4 1 2 E 0000–12FFFFF 0970000–097FFFF S A 1 5 2 010011000 1 2 8 / 6 4 1300000–131FFFF 0980000–098FFFF S A 1 5 3 010011001 1 2 8 / 6 4 1320000–133FFFF 0990000–099FFFF S A 1 5 4 010011010 1 2 8 / 6 4 1340000–135FFFF 09A0000–09AFFFF S A 1 5 5 010011011 1 2 8 / 6 4 1360000–137FFFF 09B0000–09BFFFF S A 1 5 6 010011100 1 2 8 / 6 4 1380000–139FFFF 09C0000–09CFFFF S A 1 5 7 010011101 1 2 8 / 6 4 1 3 A 0 0 0 0–13BFFFF 09D0000–09DFFFF S A 1 5 8 010011110 1 2 8 / 6 4 1 3 C 0 0 0 0–13DFFFF 09E0000–09EFFFF S A 1 5 9 010011111 1 2 8 / 6 4 1 3 E 0000–13FFFFF 09F0000–09FFFFF S A 1 6 0 010100000 1 2 8 / 6 4 1400000–141FFFF 0A00000–0A0FFFF S A 1 6 1 010100001 1 2 8 / 6 4 1420000–143FFFF 0A10000–0A1FFFF S A 1 6 2 010100010 1 2 8 / 6 4 1440000–145FFFF 0A20000–0A2FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 5 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

18 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 1 6 3 010100011 1 2 8 / 6 4 1460000–147FFFF 0A30000–0A3FFFF S A 1 6 4 010100100 1 2 8 / 6 4 1480000–149FFFF 0A40000–0A4FFFF S A 1 6 5 010100101 1 2 8 / 6 4 1 4 A 0 0 0 0–14BFFFF 0A50000–0A5FFFF S A 1 6 6 010100110 1 2 8 / 6 4 1 4 C 0 0 0 0–14DFFFF 0A60000–0A6FFFF S A 1 6 7 010100111 1 2 8 / 6 4 1 4 E 0000–14FFFFF 0A70000–0A7FFFF S A 1 6 8 010101000 1 2 8 / 6 4 1500000–151FFFF 0A80000–0A8FFFF S A 1 6 9 010101001 1 2 8 / 6 4 1520000–153FFFF 0A90000–0A9FFFF S A 1 7 0 010101010 1 2 8 / 6 4 1540000–155FFFF 0AA0000–0AAFFFF S A 1 7 1 010101011 1 2 8 / 6 4 1560000–157FFFF 0AB0000–0ABFFFF S A 1 7 2 010101100 1 2 8 / 6 4 1580000–159FFFF 0AC0000–0ACFFFF S A 1 7 3 010101101 1 2 8 / 6 4 1 5 A 0 0 0 0–15BFFFF 0AD0000–0ADFFFF S A 1 7 4 010101110 1 2 8 / 6 4 1 5 C 0 0 0 0–15DFFFF 0AE0000–0AEFFFF S A 1 7 5 010101111 1 2 8 / 6 4 1 5 E 0000–15FFFFF 0AF0000–0AFFFFF S A 1 7 6 010110000 1 2 8 / 6 4 160000–161FFFF 0B00000–0B0FFFF S A 1 7 7 010110001 1 2 8 / 6 4 1620000–163FFFF 0B10000–0B1FFFF S A 1 7 8 010110010 1 2 8 / 6 4 1640000–165FFFF 0B20000–0B2FFFF S A 1 7 9 010110011 1 2 8 / 6 4 1660000–167FFFF 0B30000–0B3FFFF S A 1 8 0 010110100 1 2 8 / 6 4 1680000–169FFFF 0B40000–0B4FFFF S A 1 8 1 010110101 1 2 8 / 6 4 1 6 A 0 0 0 0–16BFFFF 0B50000–0B5FFFF S A 1 8 2 010110110 1 2 8 / 6 4 1 6 C 0 0 0 0–16DFFFF 0B60000–0B6FFFF S A 1 8 3 010110111 1 2 8 / 6 4 1 6 E 0000–16FFFFF 0B70000–0B7FFFF S A 1 8 4 010111000 1 2 8 / 6 4 1700000–171FFFF 0B80000–0B8FFFF S A 1 8 5 010111001 1 2 8 / 6 4 1720000–173FFFF 0B90000–0B9FFFF S A 1 8 6 010111010 1 2 8 / 6 4 1740000–175FFFF 0BA0000–0BAFFFF S A 1 8 7 010111011 1 2 8 / 6 4 1760000–177FFFF 0BB0000–0BBFFFF S A 1 8 8 010111100 1 2 8 / 6 4 1780000–179FFFF 0BC0000–0BCFFFF S A 1 8 9 010111101 1 2 8 / 6 4 1 7 A 0 0 0 0–17BFFFF 0BD0000–0BDFFFF S A 1 9 0 010111110 1 2 8 / 6 4 1 7 C 0 0 0 0–17DFFFF 0BE0000–0BEFFFF S A 1 9 1 010111111 1 2 8 / 6 4 1 7 E 0000–17FFFFF 0BF0000–0BFFFFF S A 1 9 2 011000000 1 2 8 / 6 4 1800000–181FFFF 0C00000–0C0FFFF S A 1 9 3 011000001 1 2 8 / 6 4 1820000–183FFFF 0C10000–0C1FFFF S A 1 9 4 011000010 1 2 8 / 6 4 1840000–185FFFF 0C20000–0C2FFFF S A 1 9 5 011000011 1 2 8 / 6 4 1860000–187FFFF 0C30000–0C3FFFF S A 1 9 6 011000100 1 2 8 / 6 4 1880000–189FFFF 0C40000–0C4FFFF S A 1 9 7 011000101 1 2 8 / 6 4 1 8 A 0 0 0 0–18BFFFF 0C50000–0C5FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 6 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 19 Advance Information S A 1 9 8 011000110 1 2 8 / 6 4 1 8 C 0 0 0 0–18DFFFF 0C60000–0C6FFFF S A 1 9 9 011000111 1 2 8 / 6 4 1 8 E 0000–18FFFFF 0C70000–0C7FFFF S A 2 0 0 011001000 1 2 8 / 6 4 1900000–191FFFF 0C80000–0C8FFFF S A 2 0 1 011001001 1 2 8 / 6 4 1920000–193FFFF 0C90000–0C9FFFF S A 2 0 2 011001010 1 2 8 / 6 4 1940000–195FFFF 0CA0000–0CAFFFF S A 2 0 3 011001011 1 2 8 / 6 4 1960000–197FFFF 0CB0000–0CBFFFF S A 2 0 4 011001100 1 2 8 / 6 4 1980000–199FFFF 0CC0000–0CCFFFF S A 2 0 5 011001101 1 2 8 / 6 4 1 9 A 0 0 0 0–19BFFFF 0CD0000–0CDFFFF S A 2 0 6 011001110 1 2 8 / 6 4 1 9 C 0 0 0 0–19DFFFF 0CE0000–0CEFFFF S A 2 0 7 011001111 1 2 8 / 6 4 1 9 E 0000–19FFFFF 0CF0000–0CFFFFF S A 2 0 8 011010000 1 2 8 / 6 4 1 A 00000–1A1FFFF 0D00000–0D0FFFF S A 2 0 9 011010001 1 2 8 / 6 4 1 A 20000–1A3FFFF 0D10000–0D1FFFF S A 2 1 0 011010010 1 2 8 / 6 4 1 A 40000–1A5FFFF 0D20000–0D2FFFF S A 2 1 1 011010011 1 2 8 / 6 4 1 A 60000–1A7FFFF 0D30000–0D3FFFF S A 2 1 2 011010100 1 2 8 / 6 4 1 A 80000–1A9FFFF 0D40000–0D4FFFF S A 2 1 3 011010101 1 2 8 / 6 4 1 A A 0 0 0 0–1ABFFFF 0D50000–0D5FFFF S A 2 1 4 011010110 1 2 8 / 6 4 1 A C 0 0 0 0–1ADFFFF 0D60000–0D6FFFF S A 2 1 5 011010111 1 2 8 / 6 4 1 A E 0000–1AFFFFF 0D70000–0D7FFFF S A 2 1 6 011011000 1 2 8 / 6 4 1 B 00000–1B1FFFF 0D80000–0D8FFFF S A 2 1 7 011011001 1 2 8 / 6 4 1 B 20000–1B3FFFF 0D90000–0D9FFFF S A 2 1 8 011011010 1 2 8 / 6 4 1 B 40000–1B5FFFF 0DA0000–0DAFFFF S A 2 1 9 011011011 1 2 8 / 6 4 1 B 60000–1B7FFFF 0DB0000–0DBFFFF S A 2 2 0 011011100 1 2 8 / 6 4 1 B 80000–1B9FFFF 0DC0000–0DCFFFF S A 2 2 1 011011101 1 2 8 / 6 4 1 B A 0 0 0 0–1BBFFFF 0DD0000–0DDFFFF S A 2 2 2 011011110 1 2 8 / 6 4 1 B C 0 0 0 0–1BDFFFF 0DE0000–0DEFFFF S A 2 2 3 011011111 1 2 8 / 6 4 1 B E 0000–1BFFFFF 0DF0000–0DFFFFF S A 2 2 4 011100000 1 2 8 / 6 4 1 C 00000–1C1FFFF 0E00000–0E0FFFF S A 2 2 5 011100001 1 2 8 / 6 4 1 C 20000–1C3FFFF 0E10000–0E1FFFF S A 2 2 6 011100010 1 2 8 / 6 4 1 C 40000–1C5FFFF 0E20000–0E2FFFF S A 2 2 7 011100011 1 2 8 / 6 4 1 C 60000–1C7FFFF 0E30000–0E3FFFF S A 2 2 8 011100100 1 2 8 / 6 4 1 C 80000–1C9FFFF 0E40000–0E4FFFF S A 2 2 9 011100101 1 2 8 / 6 4 1 C A 0 0 0 0–1CBFFFF 0E50000–0E5FFFF S A 2 3 0 011100110 1 2 8 / 6 4 1 C C 0 0 0 0–1CDFFFF 0E60000–0E6FFFF S A 2 3 1 011100111 1 2 8 / 6 4 1 C E 0000–1CFFFFF 0E70000–0E7FFFF S A 2 3 2 011101000 1 2 8 / 6 4 1 D 00000–1D1FFFF 0E80000–0E8FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 7 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

20 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 2 3 3 011101001 1 2 8 / 6 4 1 D 20000–1D3FFFF 0E90000–0E9FFFF S A 2 3 4 011101010 1 2 8 / 6 4 1 D 40000–1D5FFFF 0EA0000–0EAFFFF S A 2 3 5 011101011 1 2 8 / 6 4 1 D 60000–1D7FFFF 0EB0000–0EBFFFF S A 2 3 6 011101100 1 2 8 / 6 4 1 D 80000–1D9FFFF 0EC0000–0ECFFFF S A 2 3 7 011101101 1 2 8 / 6 4 1 D A 0 0 0 0–1DBFFFF 0ED0000–0EDFFFF S A 2 3 8 011101110 1 2 8 / 6 4 1 D C 0 0 0 0–1DDFFFF 0EE0000–0EEFFFF S A 2 3 9 011101111 1 2 8 / 6 4 1 D E 0000–1DFFFFF 0EF0000–0EFFFFF S A 2 4 0 011110000 1 2 8 / 6 4 1 E 00000–1E1FFFF 0F00000–0F0FFFF S A 2 4 1 011110001 1 2 8 / 6 4 1 E 20000–1E3FFFF 0F10000–0F1FFFF S A 2 4 2 011110010 1 2 8 / 6 4 1 E 40000–1E5FFFF 0F20000–0F2FFFF S A 2 4 3 011110011 1 2 8 / 6 4 1 E 60000–1E7FFFF 0F30000–0F3FFFF S A 2 4 4 011110100 1 2 8 / 6 4 1 E 80000–1E9FFFF 0F40000–0F4FFFF S A 2 4 5 011110101 1 2 8 / 6 4 1 E A 0 0 0 0–1EBFFFF 0F50000–0F5FFFF S A 2 4 6 011110110 1 2 8 / 6 4 1 E C 0 0 0 0–1EDFFFF 0F60000–0F6FFFF S A 2 4 7 011110111 1 2 8 / 6 4 1 E E 0000–1EFFFFF 0F70000–0F7FFFF S A 2 4 8 011111000 1 2 8 / 6 4 1 F 00000–1F1FFFF 0F80000–0F8FFFF S A 2 4 9 011111001 1 2 8 / 6 4 1 F 20000–1F3FFFF 0F90000–0F9FFFF S A 2 5 0 011111010 1 2 8 / 6 4 1 F 40000–1F5FFFF 0FA0000–0FAFFFF S A 2 5 1 011111011 1 2 8 / 6 4 1 F 60000–1F7FFFF 0FB0000–0FBFFFF S A 2 5 2 011111100 1 2 8 / 6 4 1 F 80000–1F9FFFF 0FC0000–0FCFFFF S A 2 5 3 011111101 1 2 8 / 6 4 1 F A 0000–1FBFFFF 0FD0000–0FDFFFF S A 2 5 4 011111110 1 2 8 / 6 4 1 F C 0 0 0 0–1FDFFFF 0FE0000–0FEFFFF S A 2 5 5 011111111 1 2 8 / 6 4 1 F E 0000–1FFFFFF 0FF0000–0FFFFFF S A 2 5 6 100000000 1 2 8 / 6 4 2000000–201FFFF 1000000–100FFFF S A 2 5 7 100000001 1 2 8 / 6 4 2020000–203FFFF 1010000–101FFFF S A 2 5 8 100000010 1 2 8 / 6 4 2040000–205FFFF 1020000–102FFFF S A 2 5 9 100000011 1 2 8 / 6 4 2060000–207FFFF 1030000–103FFFF S A 2 6 0 100000100 1 2 8 / 6 4 2080000–209FFFF 1040000–104FFFF S A 2 6 1 100000101 1 2 8 / 6 4 2 0 A 0 0 0 0–20BFFFF 1050000–105FFFF S A 2 6 2 100000110 1 2 8 / 6 4 2 0 C 0 0 0 0–20DFFFF 1060000–106FFFF S A 2 6 3 100000111 1 2 8 / 6 4 2 0 E 0000–20FFFFF 1070000–107FFFF S A 2 6 4 100001000 1 2 8 / 6 4 2100000–211FFFF 1080000–108FFFF S A 2 6 5 100001001 1 2 8 / 6 4 2120000–213FFFF 1090000–109FFFF S A 2 6 6 100001010 1 2 8 / 6 4 2140000–215FFFF 10A0000–10AFFFF S A 2 6 7 100001011 1 2 8 / 6 4 2160000–217FFFF 10B0000–10BFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 8 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 21 Advance Information S A 2 6 8 100001100 1 2 8 / 6 4 2180000–219FFFF 10C0000–10CFFFF S A 2 6 9 100001101 1 2 8 / 6 4 2 1 A 0 0 0 0–21BFFFF 10D0000–10DFFFF S A 2 7 0 100001110 1 2 8 / 6 4 2 1 C 0 0 0 0–21DFFFF 10E0000–10EFFFF S A 2 7 1 100001111 1 2 8 / 6 4 2 1 E 0000–21FFFFF 10F0000–10FFFFF S A 2 7 2 100010000 1 2 8 / 6 4 2200000–221FFFF 1100000–110FFFF S A 2 7 3 100010001 1 2 8 / 6 4 2220000–223FFFF 1110000–111FFFF S A 2 7 4 100010010 1 2 8 / 6 4 2240000–225FFFF 1120000–112FFFF S A 2 7 5 100010011 1 2 8 / 6 4 2260000–227FFFF 1130000–113FFFF S A 2 7 6 100010100 1 2 8 / 6 4 2280000–229FFFF 1140000–114FFFF S A 2 7 7 100010101 1 2 8 / 6 4 2 2 A 0 0 0 0–22BFFFF 1150000–115FFFF S A 2 7 8 100010110 1 2 8 / 6 4 2 2 C 0 0 0 0–22DFFFF 1160000–116FFFF S A 2 7 9 100010111 1 2 8 / 6 4 2 2 E 0000–22FFFFF 1170000–117FFFF S A 2 8 0 100011000 1 2 8 / 6 4 2300000–231FFFF 1180000–118FFFF S A 2 8 1 100011001 1 2 8 / 6 4 2320000–233FFFF 1190000–119FFFF S A 2 8 2 100011010 1 2 8 / 6 4 2340000–235FFFF 11A0000–11AFFFF S A 2 8 3 100011011 1 2 8 / 6 4 2360000–237FFFF 11B0000–11BFFFF S A 2 8 4 100011100 1 2 8 / 6 4 2380000–239FFFF 11C0000–11CFFFF S A 2 8 5 100011101 1 2 8 / 6 4 2 3 A 0 0 0 0–23BFFFF 11D0000–11DFFFF S A 2 8 6 100011110 1 2 8 / 6 4 2 3 C 0 0 0 0–23DFFFF 11E0000–11EFFFF S A 2 8 7 100011111 1 2 8 / 6 4 2 3 E 0000–23FFFFF 11F0000–11FFFFF S A 2 8 8 100100000 1 2 8 / 6 4 2400000–241FFFF 1200000–120FFFF S A 2 8 9 100100001 1 2 8 / 6 4 2420000–243FFFF 1210000–121FFFF S A 2 9 0 100100010 1 2 8 / 6 4 2440000–245FFFF 1220000–122FFFF S A 2 9 1 100100011 1 2 8 / 6 4 2460000–247FFFF 1230000–123FFFF S A 2 9 2 100100100 1 2 8 / 6 4 2480000–249FFFF 1240000–124FFFF S A 2 9 3 100100101 1 2 8 / 6 4 2 4 A 0 0 0 0–24BFFFF 1250000–125FFFF S A 2 9 4 100100110 1 2 8 / 6 4 2 4 C 0 0 0 0–24DFFFF 1260000–126FFFF S A 2 9 5 100100111 1 2 8 / 6 4 2 4 E 0000–24FFFFF 1270000–127FFFF S A 2 9 6 100101000 1 2 8 / 6 4 2500000–251FFFF 1280000–128FFFF S A 2 9 7 100101001 1 2 8 / 6 4 2520000–253FFFF 1290000–129FFFF S A 2 9 8 100101010 1 2 8 / 6 4 2540000–255FFFF 12A0000–12AFFFF S A 2 9 9 100101011 1 2 8 / 6 4 2560000–257FFFF 12B0000–12BFFFF S A 3 0 0 100101100 1 2 8 / 6 4 2580000–259FFFF 12C0000–12CFFFF S A 3 0 1 100101101 1 2 8 / 6 4 2 5 A 0 0 0 0–25BFFFF 12D0000–12DFFFF S A 3 0 2 100101110 1 2 8 / 6 4 2 5 C 0 0 0 0–25DFFFF 12E0000–12EFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 9 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

22 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 3 0 3 100101111 1 2 8 / 6 4 2 5 E 0000–25FFFFF 12F0000–12FFFFF S A 3 0 4 100110000 1 2 8 / 6 4 2600000–261FFFF 1300000–130FFFF S A 3 0 5 100110001 1 2 8 / 6 4 2620000–263FFFF 1310000–131FFFF S A 3 0 6 100110010 1 2 8 / 6 4 2640000–265FFFF 1320000–132FFFF S A 3 0 7 100110011 1 2 8 / 6 4 2660000–267FFFF 1330000–133FFFF S A 3 0 8 100110100 1 2 8 / 6 4 2680000–269FFFF 1340000–134FFFF S A 3 0 9 100110101 1 2 8 / 6 4 2 6 A 0 0 0 0–26BFFFF 1350000–135FFFF S A 3 1 0 100110110 1 2 8 / 6 4 2 6 C 0 0 0 0–26DFFFF 1360000–136FFFF S A 3 1 1 100110111 1 2 8 / 6 4 2 6 E 0000–26FFFFF 1370000–137FFFF S A 3 1 2 100111000 1 2 8 / 6 4 2700000–271FFFF 1380000–138FFFF S A 3 1 3 100111001 1 2 8 / 6 4 2720000–273FFFF 1390000–139FFFF S A 3 1 4 100111010 1 2 8 / 6 4 2740000–275FFFF 13A0000–13AFFFF S A 3 1 5 100111011 1 2 8 / 6 4 2760000–277FFFF 13B0000–13BFFFF S A 3 1 6 100111100 1 2 8 / 6 4 2780000–279FFFF 13C0000–13CFFFF S A 3 1 7 100111101 1 2 8 / 6 4 2 7 A 0 0 0 0–27BFFFF 13D0000–13DFFFF S A 3 1 8 100111110 1 2 8 / 6 4 2 7 C 0 0 0 0–27DFFFF 13E0000–13EFFFF S A 3 1 9 100111111 1 2 8 / 6 4 2 7 E 0000–27FFFFF 13F0000–13FFFFF S A 3 2 0 101000000 1 2 8 / 6 4 2800000–281FFFF 1400000–140FFFF S A 3 2 1 101000001 1 2 8 / 6 4 2820000–283FFFF 1410000–141FFFF S A 3 2 2 101000010 1 2 8 / 6 4 2840000–285FFFF 1420000–142FFFF S A 3 2 3 101000011 1 2 8 / 6 4 2860000–287FFFF 1430000–143FFFF S A 3 2 4 101000100 1 2 8 / 6 4 2880000–289FFFF 1440000–144FFFF S A 3 2 5 101000101 1 2 8 / 6 4 2 8 A 0 0 0 0–28BFFFF 1450000–145FFFF S A 3 2 6 101000110 1 2 8 / 6 4 2 8 C 0 0 0 0–28DFFFF 1460000–146FFFF S A 3 2 7 101000111 1 2 8 / 6 4 2 8 E 0000–28FFFFF 1470000–147FFFF S A 3 2 8 101001000 1 2 8 / 6 4 2900000–291FFFF 1480000–148FFFF S A 3 2 9 101001001 1 2 8 / 6 4 2920000–293FFFF 1490000–149FFFF S A 3 3 0 101001010 1 2 8 / 6 4 2940000–295FFFF 14A0000–14AFFFF S A 3 3 1 101001011 1 2 8 / 6 4 2960000–297FFFF 14B0000–14BFFFF S A 3 3 2 101001100 1 2 8 / 6 4 2980000–299FFFF 14C0000–14CFFFF S A 3 3 3 101001101 1 2 8 / 6 4 2 9 A 0 0 0 0–29BFFFF 14D0000–14DFFFF S A 3 3 4 101001110 1 2 8 / 6 4 2 9 C 0 0 0 0–29DFFFF 14E0000–14EFFFF S A 3 3 5 101001111 1 2 8 / 6 4 2 9 E 0000–29FFFFF 14F0000–14FFFFF S A 3 3 6 101010000 1 2 8 / 6 4 2 A 00000–2A1FFFF 1500000–150FFFF S A 3 3 7 101010001 1 2 8 / 6 4 2 A 20000–2A3FFFF 1510000–151FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 10 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 23 Advance Information S A 3 3 8 101010010 1 2 8 / 6 4 2 A 40000–2A5FFFF 1520000–152FFFF S A 3 3 9 101010011 1 2 8 / 6 4 2 A 60000–2A7FFFF 1530000–153FFFF S A 3 4 0 101010100 1 2 8 / 6 4 2 A 80000–2A9FFFF 1540000–154FFFF S A 3 4 1 101010101 1 2 8 / 6 4 2 A A 0 0 0 0–2ABFFFF 1550000–155FFFF S A 3 4 2 101010110 1 2 8 / 6 4 2 A C 0 0 0 0–2ADFFFF 1560000–156FFFF S A 3 4 3 101010111 1 2 8 / 6 4 2 A E 00000–2EFFFFF 1570000–157FFFF S A 3 4 4 101011000 1 2 8 / 6 4 2 B 00000–2B1FFFF 1580000–158FFFF S A 3 4 5 101011001 1 2 8 / 6 4 2 B 20000–2B3FFFF 1590000–159FFFF S A 3 4 6 101011010 1 2 8 / 6 4 2 B 40000–2B5FFFF 15A0000–15AFFFF S A 3 4 7 101011011 1 2 8 / 6 4 2 B 60000–2B7FFFF 15B0000–15BFFFF S A 3 4 8 101011100 1 2 8 / 6 4 2 B 80000–2B9FFFF 15C0000–15CFFFF S A 3 4 9 101011101 1 2 8 / 6 4 2 B A 0 0 0 0–2BBFFFF 15D0000–15DFFFF S A 3 5 0 101011110 1 2 8 / 6 4 2 B C 0000–2DFFFFF 15E0000–15EFFFF S A 3 5 1 101011111 1 2 8 / 6 4 2 B E 0000–2BFFFFF 15F0000–15FFFFF S A 3 5 2 101100000 1 2 8 / 6 4 2 C 00000–2C1FFFF 1600000–160FFFF S A 3 5 3 101100001 1 2 8 / 6 4 2 C 20000–2C3FFFF 1610000–161FFFF S A 3 5 4 101100010 1 2 8 / 6 4 2 C 40000–2C5FFFF 1620000–162FFFF S A 3 5 5 101100011 1 2 8 / 6 4 2 C 60000–2C7FFFF 1630000–163FFFF S A 3 5 6 101100100 1 2 8 / 6 4 2 C 80000–2C9FFFF 1640000–164FFFF S A 3 5 7 101100101 1 2 8 / 6 4 2 C A 0 0 0 0–2CBFFFF 1650000–165FFFF S A 3 5 8 101100110 1 2 8 / 6 4 2 C C 0 0 0 0–2CDFFFF 1660000–166FFFF S A 3 5 9 101100111 1 2 8 / 6 4 2 C E 0000–2CFFFFF 1670000–167FFFF S A 3 6 0 101101000 1 2 8 / 6 4 2 D 00000–2D1FFFF 1680000–168FFFF S A 3 6 1 101101001 1 2 8 / 6 4 2 D 20000–2D3FFFF 1690000–169FFFF S A 3 6 2 101101010 1 2 8 / 6 4 2 D 40000–2D5FFFF 16A0000–16AFFFF S A 3 6 3 101101011 1 2 8 / 6 4 2 D 60000–2D7FFFF 16B0000–16BFFFF S A 3 6 4 101101100 1 2 8 / 6 4 2 D 80000–2D9FFFF 16C0000–16CFFFF S A 3 6 5 101101101 1 2 8 / 6 4 2 D A 0 0 0 0–2DBFFFF 16D0000–16DFFFF S A 3 6 6 101101110 1 2 8 / 6 4 2 D C 0 0 0 0–2DDFFFF 16E0000–16EFFFF S A 3 6 7 101101111 1 2 8 / 6 4 2 D E 0000–2DFFFFF 16F0000–16FFFFF S A 3 6 8 101110000 1 2 8 / 6 4 2 E 00000–2E1FFFF 1700000–170FFFF S A 3 6 9 101110001 1 2 8 / 6 4 2 E 20000–2E3FFFF 1710000–171FFFF S A 3 7 0 101110010 1 2 8 / 6 4 2 E 40000–2E5FFFF 1720000–172FFFF S A 3 7 1 101110011 1 2 8 / 6 4 2 E 60000–2E7FFFF 1730000–173FFFF S A 3 7 2 101110100 1 2 8 / 6 4 2 E 80000–2E9FFFF 1740000–174FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 11 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

24 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 3 7 3 101110101 1 2 8 / 6 4 2 E A 0 0 0 0–2EBFFFF 1750000–175FFFF S A 3 7 4 101110110 1 2 8 / 6 4 2 E C 0 0 0 0–2EDFFFF 1760000–176FFFF S A 3 7 5 101110111 1 2 8 / 6 4 2 E E 0000–2EFFFFF 1770000–177FFFF S A 3 7 6 101111000 1 2 8 / 6 4 2 F 00000–2F1FFFF 1780000–178FFFF S A 3 7 7 101111001 1 2 8 / 6 4 2 F 20000–2F3FFFF 1790000–179FFFF S A 3 7 8 101111010 1 2 8 / 6 4 2 F 40000–2F5FFFF 17A0000–17AFFFF S A 3 7 9 101111011 1 2 8 / 6 4 2 F 60000–2F7FFFF 17B0000–17BFFFF S A 3 8 0 101111100 1 2 8 / 6 4 2 F 80000–2F9FFFF 17C0000–17CFFFF S A 3 8 1 101111101 1 2 8 / 6 4 2 F A 0000–2FBFFFF 17D0000–17DFFFF S A 3 8 2 101111110 1 2 8 / 6 4 2 F C 0 0 0 0–2FDFFFF 17E0000–17EFFFF S A 3 8 3 101111111 1 2 8 / 6 4 3 F E 0000–3FFFFFF 17F0000–17FFFFF S A 3 8 4 110000000 1 2 8 / 6 4 3000000–301FFFF 1800000–180FFFF S A 3 8 5 110000001 1 2 8 / 6 4 3020000–303FFFF 1810000–181FFFF S A 3 8 6 110000010 1 2 8 / 6 4 3040000–305FFFF 1820000–182FFFF S A 3 8 7 110000011 1 2 8 / 6 4 3060000–307FFFF 1830000–183FFFF S A 3 8 8 110000100 1 2 8 / 6 4 3080000–309FFFF 1840000–184FFFF S A 3 8 9 110000101 1 2 8 / 6 4 3 0 A 0 0 0 0–30BFFFF 1850000–185FFFF S A 3 9 0 110000110 1 2 8 / 6 4 3 0 C 0 0 0 0–30DFFFF 1860000–186FFFF S A 3 9 1 110000111 1 2 8 / 6 4 3 0 E 0000–30FFFFF 1870000–187FFFF S A 3 9 2 110001000 1 2 8 / 6 4 3100000–311FFFF 1880000–188FFFF S A 3 9 3 110001001 1 2 8 / 6 4 3120000–313FFFF 1890000–189FFFF S A 3 9 4 110001010 1 2 8 / 6 4 3140000–315FFFF 18A0000–18AFFFF S A 3 9 5 110001011 1 2 8 / 6 4 3160000–317FFFF 18B0000–18BFFFF S A 3 9 6 110001100 1 2 8 / 6 4 3180000–319FFFF 18C0000–18CFFFF S A 3 9 7 110001101 1 2 8 / 6 4 3 1 A 0 0 0 0–31BFFFF 18D0000–18DFFFF S A 3 9 8 110001110 1 2 8 / 6 4 3 1 C 0 0 0 0–31DFFFF 18E0000–18EFFFF S A 3 9 9 110001111 1 2 8 / 6 4 3 1 E 0000–31FFFFF 18F0000–18FFFFF S A 4 0 0 110010000 1 2 8 / 6 4 3200000–321FFFF 1900000–190FFFF S A 4 0 1 110010001 1 2 8 / 6 4 3220000–323FFFF 1910000–191FFFF S A 4 0 2 110010010 1 2 8 / 6 4 3240000–325FFFF 1920000–192FFFF S A 4 0 3 110010011 1 2 8 / 6 4 3260000–327FFFF 1930000–193FFFF S A 4 0 4 110010100 1 2 8 / 6 4 3280000–329FFFF 1940000–194FFFF S A 4 0 5 110010101 1 2 8 / 6 4 3 2 A 0 0 0 0–32BFFFF 1950000–195FFFF S A 4 0 6 110010110 1 2 8 / 6 4 3 2 C 0 0 0 0–32DFFFF 1960000–196FFFF S A 4 0 7 110010111 1 2 8 / 6 4 3 2 E 0000–32FFFFF 1970000–197FFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 12 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 25 Advance Information S A 4 0 8 110011000 1 2 8 / 6 4 3300000–331FFFF 1980000–198FFFF S A 4 0 9 110011001 1 2 8 / 6 4 3320000–333FFFF 1990000–199FFFF S A 4 1 0 110011010 1 2 8 / 6 4 3340000–335FFFF 19A0000–19AFFFF S A 4 1 1 110011011 1 2 8 / 6 4 3360000–337FFFF 19B0000–19BFFFF S A 4 1 2 110011100 1 2 8 / 6 4 3380000–339FFFF 19C0000–19CFFFF S A 4 1 3 110011101 1 2 8 / 6 4 3 3 A 0 0 0 0–33BFFFF 19D0000–19DFFFF S A 4 1 4 110011110 1 2 8 / 6 4 3 3 C 0 0 0 0–33DFFFF 19E0000–19EFFFF S A 4 1 5 110011111 1 2 8 / 6 4 3 3 E 0000–33FFFFF 19F0000–19FFFFF S A 4 1 6 110100000 1 2 8 / 6 4 3400000–341FFFF 1A00000–1A0FFFF S A 4 1 7 110100001 1 2 8 / 6 4 3420000–343FFFF 1A10000–1A1FFFF S A 4 1 8 110100010 1 2 8 / 6 4 3440000–345FFFF 1A20000–1A2FFFF S A 4 1 9 110100011 1 2 8 / 6 4 3460000–347FFFF 1A30000–1A3FFFF S A 4 2 0 110100100 1 2 8 / 6 4 3480000–349FFFF 1A40000–1A4FFFF S A 4 2 1 110100101 1 2 8 / 6 4 3 4 A 0 0 0 0–34BFFFF 1A50000–1A5FFFF S A 4 2 2 110100110 1 2 8 / 6 4 3 4 C 0 0 0 0–34DFFFF 1A60000–1A6FFFF S A 4 2 3 110100111 1 2 8 / 6 4 3 4 E 0000–34FFFFF 1A70000–1A7FFFF S A 4 2 4 110101000 1 2 8 / 6 4 3500000–351FFFF 1A80000–1A8FFFF S A 4 2 5 110101001 1 2 8 / 6 4 3520000–353FFFF 1A90000–1A9FFFF S A 4 2 6 110101010 1 2 8 / 6 4 3540000–355FFFF 1AA0000–1AAFFFF S A 4 2 7 110101011 1 2 8 / 6 4 3560000–357FFFF 1AB0000–1ABFFFF S A 4 2 8 110101100 1 2 8 / 6 4 3580000–359FFFF 1AC0000–1ACFFFF S A 4 2 9 110101101 1 2 8 / 6 4 3 5 A 0 0 0 0–35BFFFF 1AD0000–1ADFFFF S A 4 3 0 110101110 1 2 8 / 6 4 3 5 C 0 0 0 0–35DFFFF 1AE0000–1AEFFFF S A 4 3 1 110101111 1 2 8 / 6 4 3 5 E 0000–35FFFFF 1AF0000–1AFFFFF S A 4 3 2 110110000 1 2 8 / 6 4 3600000–361FFFF 1B00000–1B0FFFF S A 4 3 3 110110001 1 2 8 / 6 4 3620000–363FFFF 1B10000–1B1FFFF S A 4 3 4 110110010 1 2 8 / 6 4 3640000–365FFFF 1B20000–1B2FFFF S A 4 3 5 110110011 1 2 8 / 6 4 3660000–367FFFF 1B30000–1B3FFFF S A 4 3 6 110110100 1 2 8 / 6 4 3680000–369FFFF 1B40000–1B4FFFF S A 4 3 7 110110101 1 2 8 / 6 4 3 6 A 0 0 0 0–36BFFFF 1B50000–1B5FFFF S A 4 3 8 110110110 1 2 8 / 6 4 3 6 C 0 0 0 0–36DFFFF 1B60000–1B6FFFF S A 4 3 9 110110111 1 2 8 / 6 4 3 6 E 0000–36FFFFF 1B70000–1B7FFFF S A 4 4 0 110111000 1 2 8 / 6 4 3700000–371FFFF 1B80000–1B8FFFF S A 4 4 1 110111001 1 2 8 / 6 4 3720000–373FFFF 1B90000–1B9FFFF S A 4 4 2 110111010 1 2 8 / 6 4 3740000–375FFFF 1BA0000–1BAFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 13 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

26 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information S A 4 4 3 110111011 1 2 8 / 6 4 3760000–377FFFF 1BB0000–1BBFFFF S A 4 4 4 110111100 1 2 8 / 6 4 3780000–379FFFF 1BC0000–1BCFFFF S A 4 4 5 110111101 1 2 8 / 6 4 3 7 A 0 0 0 0–37BFFFF 1BD0000–1BDFFFF S A 4 4 6 110111110 1 2 8 / 6 4 3 7 C 0 0 0 0–37DFFFF 1BE0000–1BEFFFF S A 4 4 7 110111111 1 2 8 / 6 4 3 7 E 0000–37FFFFF 1BF0000–1BFFFFF S A 4 4 8 111000000 1 2 8 / 6 4 3800000–381FFFF 1C00000–1C0FFFF S A 4 4 9 111000001 1 2 8 / 6 4 3820000–383FFFF 1C10000–1C1FFFF S A 4 5 0 111000010 1 2 8 / 6 4 3840000–385FFFF 1C20000–1C2FFFF S A 4 5 1 111000011 1 2 8 / 6 4 3860000–387FFFF 1C30000–1C3FFFF S A 4 5 2 111000100 1 2 8 / 6 4 3880000–389FFFF 1C40000–1C4FFFF S A 4 5 3 111000101 1 2 8 / 6 4 3 8 A 0 0 0 0–38BFFFF 1C50000–1C5FFFF S A 4 5 4 111000110 1 2 8 / 6 4 3 8 C 0 0 0 0–38DFFFF 1C60000–1C6FFFF S A 4 5 5 111000111 1 2 8 / 6 4 3 8 E 0000–38FFFFF 1C70000–1C7FFFF S A 4 5 6 111001000 1 2 8 / 6 4 3900000–391FFFF 1C80000–1C8FFFF S A 4 5 7 111001001 1 2 8 / 6 4 3920000–393FFFF 1C90000–1C9FFFF S A 4 5 8 111001010 1 2 8 / 6 4 3940000–395FFFF 1CA0000–1CAFFFF S A 4 5 9 111001011 1 2 8 / 6 4 3960000–397FFFF 1CB0000–1CBFFFF S A 4 6 0 111001100 1 2 8 / 6 4 3980000–399FFFF 1CC0000–1CCFFFF S A 4 6 1 111001101 1 2 8 / 6 4 3 9 A 0 0 0 0–39BFFFF 1CD0000–1CDFFFF S A 4 6 2 111001110 1 2 8 / 6 4 3 9 C 0 0 0 0–39DFFFF 1CE0000–1CEFFFF S A 4 6 3 111001111 1 2 8 / 6 4 3 9 E 0000–39FFFFF 1CF0000–1CFFFFF S A 4 6 4 111010000 1 2 8 / 6 4 3 A 00000–3A1FFFF 1D00000–1D0FFFF S A 4 6 5 111010001 1 2 8 / 6 4 3 A 20000–3A3FFFF 1D10000–1D1FFFF S A 4 6 6 111010010 1 2 8 / 6 4 3 A 40000–3A5FFFF 1D20000–1D2FFFF S A 4 6 7 111010011 1 2 8 / 6 4 3 A 60000–3A7FFFF 1D30000–1D3FFFF S A 4 6 8 111010100 1 2 8 / 6 4 3 A 80000–3A9FFFF 1D40000–1D4FFFF S A 4 6 9 111010101 1 2 8 / 6 4 3 A A 0 0 0 0–3ABFFFF 1D50000–1D5FFFF S A 4 7 0 111010110 1 2 8 / 6 4 3 A C 0 0 0 0–3ADFFFF 1D60000–1D6FFFF S A 4 7 1 111010111 1 2 8 / 6 4 3 A E 0000–3AFFFFF 1D70000–1D7FFFF S A 4 7 2 111011000 1 2 8 / 6 4 3 B 00000–3B1FFFF 1D80000–1D8FFFF S A 4 7 3 111011001 1 2 8 / 6 4 3 B 20000–3B3FFFF 1D90000–1D9FFFF S A 4 7 4 111011010 1 2 8 / 6 4 3 B 40000–3B5FFFF 1DA0000–1DAFFFF S A 4 7 5 111011011 1 2 8 / 6 4 3 B 60000–3B7FFFF 1DB0000–1DBFFFF S A 4 7 6 111011100 1 2 8 / 6 4 3 B 80000–3B9FFFF 1DC0000–1DCFFFF S A 4 7 7 111011101 1 2 8 / 6 4 3 B A 0 0 0 0–3BBFFFF 1DD0000–1DDFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 14 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 27 Advance Information S A 4 7 8 111011110 1 2 8 / 6 4 3 B C 0 0 0 0–3BDFFFF 1DE0000–1DEFFFF S A 4 7 9 111011111 1 2 8 / 6 4 3 B E 0000–3BFFFFF 1DF0000–1DFFFFF S A 4 8 0 111100000 1 2 8 / 6 4 3 C 00000–3C1FFFF 1E00000–1E0FFFF S A 4 8 1 111100001 1 2 8 / 6 4 3 C 20000–3C3FFFF 1E10000–1E1FFFF S A 4 8 2 111100010 1 2 8 / 6 4 3 C 40000–3C5FFFF 1E20000–1E2FFFF S A 4 8 3 111100011 1 2 8 / 6 4 3 C 60000–3C7FFFF 1E30000–1E3FFFF S A 4 8 4 111100100 1 2 8 / 6 4 3 C 80000–3C9FFFF 1E40000–1E4FFFF S A 4 8 5 111100101 1 2 8 / 6 4 3 C A 0 0 0 0–3CBFFFF 1E50000–1E5FFFF S A 4 8 6 111100110 1 2 8 / 6 4 3 C C 0 0 0 0–3CDFFFF 1E60000–1E6FFFF S A 4 8 7 111100111 1 2 8 / 6 4 3 C E 0000–3CFFFFF 1E70000–1E7FFFF S A 4 8 8 111101000 1 2 8 / 6 4 3 D 0 0000–3D1FFFFF 1E80000–1E8FFFF S A 4 8 9 111101001 1 2 8 / 6 4 3 D 20000–3D3FFFF 1E90000–1E9FFFF S A 4 9 0 111101010 1 2 8 / 6 4 3 D 40000–3D5FFFF 1EA0000–1EAFFFF S A 4 9 1 111101011 1 2 8 / 6 4 3 D 60000–3D7FFFF 1EB0000–1EBFFFF S A 4 9 2 111101100 1 2 8 / 6 4 3 D 80000–3D9FFFF 1EC0000–1ECFFFF S A 4 9 3 111101101 1 2 8 / 6 4 3 D A 0 0 0 0–3DBFFFF 1ED0000–1EDFFFF S A 4 9 4 111101110 1 2 8 / 6 4 3 D C 0 0 0 0–3DDFFFF 1EE0000–1EEFFFF S A 4 9 5 111101111 1 2 8 / 6 4 3 D E 0000–3DFFFFF 1EF0000–1EFFFFF S A 4 9 6 111110000 1 2 8 / 6 4 3 E 00000–3E1FFFF 1F00000–1F0FFFF S A 4 9 7 111110001 1 2 8 / 6 4 3 E 20000–3E3FFFF 1F10000–1F1FFFF S A 4 9 8 111110010 1 2 8 / 6 4 3 E 40000–3E5FFFF 1F20000–1F2FFFF S A 4 9 9 111110011 1 2 8 / 6 4 3 E 60000–3E7FFFF 1F30000–1F3FFFF S A 5 0 0 111110100 1 2 8 / 6 4 3 E 80000–3E9FFFF 1F40000–1F4FFFF S A 5 0 1 111110101 1 2 8 / 6 4 3 E A 0 0 0 0–3EBFFFF 1F50000–1F5FFFF S A 5 0 2 111110110 1 2 8 / 6 4 3 E C 00000–3EDFFFF 1F60000–1F6FFFF S A 5 0 3 111110111 1 2 8 / 6 4 3 E E 0000–3EFFFFF 1F70000–1F7FFFF S A 5 0 4 111111000 1 2 8 / 6 4 3 F 00000–3F1FFFF 1F80000–1F8FFFF S A 5 0 5 111111001 1 2 8 / 6 4 3 F 20000–3F3FFFF 1F90000–1F9FFFF S A 5 0 6 111111010 1 2 8 / 6 4 3 F 40000–3F5FFFF 1FA0000–1FAFFFF S A 5 0 7 111111011 1 2 8 / 6 4 3 F 60000–3F7FFFF 1FB0000–1FBFFFF S A 5 0 8 111111100 1 2 8 / 6 4 3 F 80000–3F9FFFF 1FC0000–1FCFFFF S A 5 0 9 111111101 1 2 8 / 6 4 3 F A 0000–3FBFFFF 1FD0000–1FDFFFF S A 5 1 0 111111110 1 2 8 / 6 4 3 F C 0 0 0 0–3FDFFFF 1FE0000–1FEFFFF S A 5 1 1 111111111 1 2 8 / 6 4 3 F E 0000–3FFFFFF 1FF0000–1FFFFFF T able 2. Sector Address T able for CE# or CE2# (Sheet 15 of 15) Sector A24–A16 Sector Size (Kbytes/ Kwords) 8-bit Address Range (in hexadecimal) 16-bit Address Range (in hexadecimal)

28 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Autoselect Mode The autoselect mode provides manufacturer and device identification, and sector group protection verification, through identifier codes output on DQ7–DQ0. This mode is primarily intended for programming equipment to automatically match a device to be programmed with its corresponding programming algorithm. How- ever, the autoselect codes can also be accessed in-system through the command register. When using programming equipment, the autoselect mode requires VID on ad- dress pin A9. Address pins A6, A3, A2, A1, and A0 must be as shown in Table 3. In addition, when verifying sector protection, the sector address must appear on the appropriate highest order address bits (see Table 2 on page 13 ). Table 3 shows the remaining address bits that are don’t care. When all necessary bits are set as required, the programming equipment may then read the corresponding identifier code on DQ7–DQ0. To access the autoselect codes in-system, the host system can issue the autose- lect command via the command register, as shown in Table 10 on page 54 and Table 11 on page 57. This method does not require V ID. Refer to the Autoselect Command Sequence section for more information. Ta b l e 3 . Autoselect Codes, (High Voltage Method) Legend: L = Logic Low = VIL, H = Logic High = VIH, SA = Sector Address, X = Don’t care. Note: CE# can be replaced by CE2# if referring to the second die in the package. Sector Protection The device features several levels of sector protection, which can disable both the program and erase operations in certain sectors or sector groups: Persistent Sector Protection A command sector protection method that replaces the old 12 V controlled pro- tection method.

Description

CE# (See Note) OE# WE A22 to A15 A14 to A10 to to to A1 A0 DQ8 to DQ15 DQ7 to DQ0BYTE# = VIH BYTE# = VIL Manufacturer ID: Spansion Product LL H X X V ID X L XLLL 0 0 X 0 1 h Device ID for each S29GL512N Cycle 1 LL H X X V ID XLX LLH 2 2 X 7 E h Cycle 2 H H L 22 X 23h Cycle 3 HHH 2 2 X 0 1 h Sector Group Protection Verification LL H S A X V ID XLX L H L X X 01h (protected), 00h (unprotected) Secured Silicon Sector Indicator Bit (DQ7), WP# protects highest address sector LL H X X V ID XLX L H H X X 98h (factory locked), 18h (not factory locked) Secured Silicon Sector Indicator Bit (DQ7), WP# protects lowest address sector LL H X X V ID XLX L H H X X 88h (factory locked), 08h (not factory locked)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 29 Advance Information Password Sector Protection A highly sophisticated protection meth od that requires a password before changes to certain sectors or sector groups are permitted WP# Hardware Protection A write protect pin that can prevent program or erase operations in the outermost sectors. The WP# Hardware Protection feature is always available, independent of the software managed protection method chosen. Selecting a Sector Protection Mode All parts default to operate in the Pers istent Sector Protection mode. The cus- tomer must then choose if the Persistent or Password Protection method is most desirable. There are two on e-time programmable non-volatile bits that define which sector protection method is used. If the customer decides to continue using the Persistent Sector Protection method, they must set the Persistent Sector Protection Mode Locking Bit. This permanently sets the part to operate only using Persistent Sector Protection. If the customer decides to use the password method, they must set the Password Mode Locking Bit. This permanently sets the part to operate only using password sector protection. It is important to remember that setting either the Persistent Sector Protec- tion Mode Locking Bit or the Password Mode Locking Bit permanently selects the protection mode. It is not possible to switch between the two methods once a locking bit is set. It is important that one mode is explicitly selected when the device is first programmed, rather than relying on the default mode alone. This is so that it is not possibl e for a system program or virus to later set the Password Mode Locking Bit, which would cause an unexpected shift from the default Persistent Sector Protection Mode into the Password Protection Mode. The device is shipped with all sectors unprotected. The factory offers the option of programming and protecting sectors at the factory prior to shipping the device through the ExpressFlash™ Service. Contact your sales representative for details. It is possible to determine whether a sector is protected or unprotected. See Autoselect Command Sequence‚ on page 40 for details. Advanced Sector Protection Advanced Sector Protection features several levels of sector protection, which can disable both the program and erase operations in certain sectors. Persistent Sector Protection is a method that replaces the old 12V controlled protection method. Password Sector Protection is a highly sophisticated protection method that requires a password before changes to certain sectors are permitted. Lock Register The Lock Register consists of three bits (DQ2, DQ1, and DQ0). These DQ2, DQ1, DQ0 bits of the Lock Register are prog rammable by the user. Users are not al- lowed to program both DQ2 and DQ1 bits of the Lock Register to the 00 state. If the user tries to program DQ2 and DQ1 bits of the Lock Register to the 00 state, the device aborts the Lock Register back to the default 11 state. The program- ming time of the Lock Register is same as the typical word programming time

30 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information without utilizing the Write Buffer of the device. During a Lock Register program- ming sequence execution, the DQ6 Toggle Bit I toggles until the programming of the Lock Register is completed which indicates programming status. All Lock Reg- ister bits are readable to allow users to verify Lock Register statuses. The Customer Secured Silicon Sector Protection Bit is DQ0, Persistent Protection Mode Lock Bit is DQ1, and Password Protection Mode Lock Bit is DQ2 are acces- sible by all users. Each of these bits are non-volatile. DQ15-DQ3 are reserved and must be 1's when the user tries to program the DQ2, DQ1, and DQ0 bits of the Lock Register. The user is not required to program DQ2, DQ1 and DQ0 bits of the Lock Register at the same time. This allows users to lock the Secured Silicon Sec- tor and then set the device either permanently into Password Protection Mode or Persistent Protection Mode and then lock the Secured Silicon Sector at separate instances and time frames. „ Secured Silicon Sector Protection allows the user to lock the Secured Silicon Sector area „ Persistent Protection Mode Lock Bit allows the user to set the device perma- nently to operate in the Persistent Protection Mode „ Password Protection Mode Lock Bit allows the user to set the device perma- nently to operate in the Password Protection Mode Persistent Sector Protection The Persistent Sector Protection method replaces the old 12 V controlled protec- tion method while at the same time e nhancing flexibility by providing three different sector protection states: „ Dynamically Locked—The sector is protected and can be changed by a sim- ple command „ Persistently Locked—A sector is protected and cannot be changed „ Unlocked—The sector is unprotected and can be changed by a simple com- mand In order to achieve these states, three types of bits are going to be used: Dynamic Protection Bit (DYB) A volatile protection bit is assigned for each sector. After power-up or hardware reset, the contents of all DYB bits are in the unprotected state. Each DYB is indi- vidually modifiable through the DYB Set Command and DYB Clear Command. When the parts are first shipped, all of the Persistent Protect Bits (PPB) are cleared into the unprotected state. The DYB bits and PPB Lock bit are defaulted to power up in the cleared state or unprotected state - meaning the all PPB bits are changeable. The Protection State for each sector is determined by the logical OR of the PPB and the DYB related to that sector. For the sectors that have the PPB bits cleared, the DYB bits control whether or not the sector is protected or unprotected. By is- suing the DYB Set and DYB Clear command sequences, the DYB bits is protected or unprotected, thus placing each sector in the protected or unprotected state. These are the so-called Dynamic Locked or Unlocked states. They are called dy- Ta b l e 4 . L o c k R e g i s t e r DQ15-3 DQ2 DQ1 DQ0 Don’t Care Password Protection Mode Lock Bit Persistent Protection Mode Lock Bit Secured Silicon Sector Protection Bit

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 31 Advance Information namic states because it is very easy to switch back and forth between the protected and un-protected conditions. This allows software to easily protect sec- tors against inadvertent changes yet do es not prevent the easy removal of protection when changes are needed. The DYB bits maybe set or cleared as often as needed. The PPB bits allow for a more static, and difficult to change, level of protection. The PPB bits retain their state across power cycles because they are Non-Volatile. Individual PPB bits are set with a program command but must all be cleared as a group through an erase command. The PPB Lock Bit adds an additional level of protection. Once all PPB bits are pro- grammed to the desired settings, the PPB Lock Bit may be set to the freeze state. Setting the PPB Lock Bit to the freeze state disables all program and erase com- mands to the Non-Volatile PPB bits. In effect, the PPB Lock Bit locks the PPB bits into their current state. The only wa y to clear the PPB Lock Bit to the unfreeze state is to go through a power cycle, or hardware reset. The Software Reset com- mand does not clear th e PPB Lock Bit to the unfreeze state. System boot code can determine if any changes to the PPB bits are needed e.g. to allow new system code to be downloaded. If no changes are needed then the boot code can set the PPB Lock Bit to disable any further ch anges to the PPB bi ts during system operation. The WP# write protect pin adds a final le vel of hardware protection. When this pin is low it is not possible to change the contents of the WP# protected sectors. These sectors generally hold system boot code. So, the WP# pin can prevent any changes to the boot code that could override the choices made while setting up sector protection during system initialization. It is possible to have sectors that are persistently locked, and sectors that are left in the dynamic state. The sectors in the dynamic state are all unprotected. If there is a need to protect some of them, a simple DYB Set command sequence is all that is necessary. The DYB Set and DYB Clear commands for the dynamic sec- tors switch the DYB bits to signify prot ected and unprotected, respectively. If there is a need to change the status of the persistently locked sectors, a few more steps are required. First, the PPB Lock Bit must be disabled to the unfreeze state by either putting the device through a power-cycle, or hardware reset. The PPB bits can then be changed to reflect the desired settings. Setting the PPB Lock Bit once again to the freeze state locks the PPB bits, and the device operates nor- mally again. Note: to achieve the best protection, it is recommended to execute the PPB Lock Bit Set command early in the boot code, and protect the boot code by holding WP# = VIL. Persistent Protection Bit (PPB) A single Persistent (non-volatile) Protection Bit is assigned to each sector. If a PPB is programmed to the protected state through the PPB Program command, that sector is protected from program or erase operations is read-only. If a PPB re- quires erasure, all of the sector PPB bits must first be erased in parallel through the All PPB Erase command. The All PPB Erase command preprograms all PPB bits prior to PPB erasing. All PPB bits erase in parallel, unlike programming where in- dividual PPB bits are programmable. The PPB bits have the same endurance as the flash memory. Programming the PPB bit requires the typical word programming time without uti- lizing the Write Buffer. During a PPB bit programming and A11 PPB bit erasing

32 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information sequence execution, the DQ6 Toggle Bit I toggles until the programming of the PPB bit or erasing of all PPB bits is completed which indicates programming and erasing status. Erasing all of the PPB bits at once requires typical sector erase time. During the erasing of all PPB bits, the DQ3 Sector Erase Timer bit outputs a 1 to indicate the erasure of all PPB bits are in progress. When the erasure of all PPB bits is completed, the DQ3 Sector Erase Timer bit outputs a 0 to indicate that all PPB bits are erased. Reading the PPB Status bit requires the initial access time of the device. Persistent Protection Bit Lock (PPB Lock Bit) A global volatile bit. When set to the freeze state, the PPB bits cannot be changed. When cleared to the unfreeze state, the PPB bits are changeable. There is only one PPB Lock Bit per device. The PPB Lock Bit is cleared to the unfreeze state after power-up or hardware reset. There is no command sequence to unlock or un- freeze state the PPB Lock Bit. Configuring the PPB Lock Bit to the freeze state requir es approximately 100ns. Reading the PPB Lock Status bit requires the initial access time of the device. Tabl e 5 . Sector Protection Schemes Table 5 contains all possible combinations of the DYB bit, PPB bit, and PPB Lock Bit relating to the status of the sector. In summary, if the PPB bit is set, and the PPB Lock Bit is set, the sector is protected and the protection cannot be removed until the next power cycle or hardware reset clears the PPB Lock Bit to unfreeze state. If the PPB bit is cleared, the sector can be dynamically locked or unlocked. The DYB bit then controls whether or not the sector is protected or unprotected. If the user attempts to program or erase a protected sector, the device ignores the command and returns to read mode. A program command to a protected sec- tor enables status polling for approximately 1 µs before the device returns to read mode without having modified the conten ts of the protected sector. An erase command to a protected sect or enables status pollin g for approximately 50 µs after which the device returns to read mode without having erased the protected sector. The programming of the DYB bit, PPB bit, and PPB Lock Bit for a given sec- tor can be verified by writing a DYB Status Read, PPB Status Read, and PPB Lock Status Read commands to the device. The Autoselect Sector Protection Verification outputs the OR function of the DYB bit and PPB bit per sector basis. When the OR function of the DYB bit and PPB bit is a 1, the sector is either protected by DYB or PPB or both. When the OR function Protection States Sector State DYB Bit PPB Bit PPB Lock Bit Unprotect Unprotect Unfreeze Unprotec ted – PPB and DYB are changeable Unprotect Unprotect Freeze Unprotected – PPB not changeable, DYB is changeable Unprotect Protect Unfreeze Protected – PPB and DYB are changeable Unprotect Protect Freeze Protected – PPB not changeable, DYB is changeable Protect Unprotect Unfreeze Protected – PPB and DYB are changeable Protect Unprotect Freeze Protected – PPB not changeable, DYB is changeable Protect Protect Unfreeze Protected – PPB and DYB are changeable Protect Protect Freeze Protected – PPB not changeable, DYB is changeable

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 33 Advance Information of the DYB bit and PPB bit is a 0, the sector is unprotected through both the DYB and PPB. Persistent Protection Mode Lock Bit Like the Password Protection Mode Lock Bit, a Persistent Protection Mode Lock Bit exists to guarantee that the device rema in in software sector protection. Once programmed, the Persistent Protection Mode Lock Bit prevents programming of the Password Protection Mode Lock Bit. This guarantees that a hacker could not place the device in Password Protection Mode. The Password Protection Mode Lock Bit resides in the Lock Register. Password Sector Protection The Password Sector Protection method allows an even higher level of security than the Persistent Sector Protection method. There are two main differences be- tween the Persistent Sector Protection and the Password Sector Protection methods: „ When the device is first powered on, or comes out of a reset cycle, the PPB Lock Bit is set to the locked state, or the freeze state, rather than cleared to the unlocked state, or the unfreeze state. „ The only means to clear and unfreeze the PPB Lock Bit is by writing a unique 64-bit Password to the device. The Password Sector Protection method is otherwise identical to the Persistent Sector Protection method. A 64-bit password is the only additional tool utilized in this method. The password is stored in a one-time programmable (OTP) region outside of the flash memory. Once the Password Protection Mode Lock Bit is set, the password is permanently set with no means to read, program, or erase it. The password is used to clear and unfreeze the PPB Lock Bit. The Password Unlock command must be written to the flash, along with a password. The flash device internally com- pares the given password with the pre-programmed password. If they match, the PPB Lock Bit is cleared to the unfreezed state, and the PPB bits can be altered. If they do not match, the flash device does nothing. There is a built-in 2 µs delay for each password check after the valid 64-bit passw ord is entered for the PPB Lock Bit to be cleared to the unfreeze state. This delay is intended to thwart any efforts to run a program that tries all possible combinations in order to crack the password. Password and Password Protection Mode Lock Bit In order to select the Password Sector Protection method, the customer must first program the password. The factory recommends that the password be somehow correlated to the unique Electronic Serial Number (ESN) of the particular flash de- vice. Each ESN is different for every flash device; therefore each password should be different for every flash device. Wh ile programming in the password region, the customer may perform Password Read operations. Once the desired pass- word is programmed in, the customer mu st then set the Password Protection Mode Lock Bit. This operation achieves two objectives: „ It permanently sets the device to op erate using the Password Protection Mode. It is not possible to reverse this function. „ It also disables all further commands to the password region. All program, and read operations are ignored.

34 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Both of these objectives are important, and if not carefully considered, may lead to unrecoverable errors. The user must be sure that the Password Sector Protec- tion method is desired when programm ing the Password Protection Mode Lock Bit. More importantly, the user must be sure that the password is correct when the Password Protection Mode Lock Bit is programmed. Due to the fact that read operations are disabled, there is no me ans to read what the password is after- wards. If the password is lost after programming the Password Protection Mode Lock Bit, there is no way to clear an d unfreeze the PPB Lock Bit. The Password Protection Mode Lock Bit, once programmed, prevents reading the 64-bit pass- word on the DQ bus and further password programming. The Password Protection Mode Lock Bit is not erasable. Once Pa ssword Protection Mode Lock Bit is pro- grammed, the Persistent Protection Mode Lock Bit is disabled from programming, guaranteeing that no changes to the protection scheme are allowed. 64-bit Password The 64-bit Password is located in its own memory space and is accessible through the use of the Password Program and Password Read commands. The password function works in conjunction with the Password Protection Mode Lock Bit, which when programmed, prevents the Password Read command from reading the con- tents of the password on the pins of the device. Persistent Protection Bit Lock (PPB Lock Bit) A global volatile bit. The PPB Lock Bit is a volatile bit that reflects the state of the Password Protection Mode Lock Bit after power-up reset. If the Password Protec- tion Mode Lock Bit is also programme d after programming the Password, the Password Unlock command must be issued to clear and unfreeze the PPB Lock Bit after a hardware reset (RESET# asserted) or a power-up reset. Successful exe- cution of the Password Unlock command clears and unfreezes the PPB Lock Bit, allowing for sector PPB bits to be modified. Without issuing the Password Unlock command, while asserting RESET#, taking the device through a power-on reset, or issuing the PPB Lock Bit Set command sets the PPB Lock Bit to a the freeze state. If the Password Protection Mode Lock Bit is not programmed, the device defaults to Persistent Protection Mode. In the Persistent Protection Mode, the PPB Lock Bit is cleared to the unfreeze state after power-up or hardware reset. The PPB Lock Bit is set to the freeze state by issuing the PPB Lock Bit Set command. Once set to the freeze state the only means for clearing the PPB Lock Bit to the unfreeze state is by issuing a hardware or power-up reset. The Password Unlock command is ignored in Persistent Protection Mode. Reading the PPB Lock Bit requires a 200ns access time. Secured Silicon Sector Flash Memory Region The Secured Silicon Sector feature provides a Flash memory region that enables permanent part identification through an Electronic Serial Number (ESN). The Secured Silicon Sector is 256 bytes in length, and uses a Secured Silicon Sector Indicator Bit (DQ7) to indicate whether or not the Secured Silicon Sector is locked when shipped from the factory. This bit is permanently set at the factory and can- not be changed, which prevents cloning of a factory locked part. This ensures the security of the ESN once the product is shipped to the field. The factory offers the device with the Secured Silicon Sector either customer lockable (standard shipping option) or factory locked (contact an AMD sales rep-

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 35 Advance Information resentative for ordering information). The customer-lockable version is shipped with the Secured Silicon Sector unprotected, allowing customers to program the sector after receiving the device. The customer-lockable version also has the Se- cured Silicon Sector Indicato r Bit permanently set to a 0. The factory-locked version is always protected when shipped from the factory, and has the Secured Silicon Sector Indicator Bit permanently set to a 1. Thus, the Secured Silicon Sec- tor Indicator Bit prevents customer-lockable devices from being used to replace devices that are factory locked. Note that the ACC function and unlock bypass modes are not available when the Secured Silicon Sector is enabled. The Secured Silicon sector address space in this device is allocated as follows: The system accesses the Secured Silico n Sector through a command sequence (see Write Protect (WP#)‚ on page 36). After the system writes the Enter Se- cured Silicon Sector command sequence, it may read the Secured Silicon Sector by using the addresses normally occupied by the first sector (SA0). This mode of operation continues until the system issues the Exit Secured Silicon Sector com- mand sequence, or until power is remo ved from the device. On power-up, or following a hardware reset, the device reverts to sending commands to sector SA0. Customer Lockable: Secured Silicon Sector NOT Programmed or Protected At the Factory Unless otherwise specified, the device is shipped such that the customer may program and protect the 256-byte Secured Silicon sector. The system may program the Secured Silicon Sector using the write-buffer, ac- celerated and/or unlock bypass method s, in addition to the standard programming command sequence. See Command Definitions‚ on page 39. Programming and protecting the Secured Silicon Sector must be used with cau- tion since, once protected, there is no procedure available for unprotecting the Secured Silicon Sector area and none of the bits in the Secured Silicon Sector memory space can be modified in any way. The Secured Silicon Sector area can be protected using one of the following procedures: „ Write the three-cycle Enter Secured Silicon Sector Region command se- quence, and then follow the in-system sector protect algorithm, except that RESET# may be at either VIH or VID. This allows in-system protection of the Secured Silicon Sector without raising any device pin to a high voltage. Note that this method is only applicable to the Secured Silicon Sector. „ To verify the protect/unprotect status of the Secured Silicon Sector, follow the algorithm. Once the Secured Silicon Sector is programmed, locked and verified, the system must write the Exit Secured Silicon Sector Region command sequence to return to reading and writing within the remainder of the array. Secured Silicon Sector Address Range Customer Lock able ESN Factory Locked ExpressFlash Factory Locked 000000h–000007h Determined by customer ESN ESN or determined by customer 000008h–00007Fh Unavailable Determined by customer

36 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Factory Locked: Secured Silicon Sector Programmed and Protected At the Factory In devices with an ESN, the Secured Silicon Sector is protected when the device is shipped from the factory. The Secured Silicon Sector cannot be modified in any way. An ESN Factory Locked device has an 16-byte random ESN at addresses 000000h–000007h. Please contact your sales representative for details on order- ing ESN Factory Locked devices. Customers may opt to have their code programmed by the factory through the ExpressFlash service (Express Flash Factory Locked). The devices are then shipped from the factory with the Secured Silicon Sector permanently locked. Contact your sales representative for details on using the ExpressFlash service. Write Protect (WP#) The Write Protect function provides a hardware method of protecting the first or last sector group without using VID. Write Protect is one of two functions provided by the WP#/ACC input. If the system asserts VIL on the WP#/ACC pin, the device disables program and erase functions in the first or last sect or group independently of whether those sector groups were protected or unprotected using the method described in Advanced Sector Protection‚ on page 29. Note that if WP#/ACC is at V IL when the device is in the standby mode, the maximum input load current is increased. See the table in DC Characteristics‚ on page 67. If the system asserts V IH on the WP#/ACC pin, the device reverts to whether the first or last sector was previously set to be protected or un- protected using the method described in Sector Group Protection and Unprotection. Note that WP# contains an internal pullup; when uncon- nected, WP# is at V IH. Hardware Data Protection The command sequence requirement of unlock cycles for programming or erasing provides data protection against inadvertent writes (refer to Table 10 on page 54 and Table 11 on page 57 for command definitions). In addition, the following hardware data protection measures prevent accidental erasure or programming, which might otherwise be caused by sp urious system level signals during V CC power-up and power-down transitions, or from system noise. Low VCC Write Inhibit When VCC is less than VLKO, the device does not accept any write cycles. This pro- tects data during VCC power-up and power-down. The command register and all internal program/erase circuits are disabl ed, and the device resets to the read mode. Subsequent writes are ignored until VCC is greater than VLKO. The system must provide the proper signals to the control pins to prevent unintentional writes when VCC is greater than VLKO. Write Pulse Glitch Protection Noise pulses of less than 5 ns (typical) on OE#, CE#, CE2#, or WE# do not ini- tiate a write cycle.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 37 Advance Information Logical Inhibit Write cycles are inhibited by holding any one of OE# = VIL, CE# or CE2# = VIH or WE# = VIH. To initiate a write cycle, CE# or CE2# and WE# must be a logical zero while OE# is a logical one. Power-Up Write Inhibit If WE# = CE# (or CE2#) = VIL and OE# = VIH during power up, the device does not accept commands on the rising edge of WE#. The internal state machine is automatically reset to the read mode on power-up. Common Flash Memory Interface (CFI) The Common Flash Interface (CFI) specification outlines device and host system software interrogation handshake, which allows specific vendor-specified soft- ware algorithms to be used for entire families of devices. Software support can then be device-independent, JEDEC ID -independent, and forward- and back- ward-compatible for the specified flas h device families. Flash vendors can standardize their existing interfaces for long-term compatibility. This device enters the CFI Query mode when the system writes the CFI Query command, 98h, to address 55h, any time the device is ready to read array data. The system can read CFI information at the addresses given in Table 6, Table 7 on page 38, and Table 8 on page 38. To terminate reading CFI data, the system must write the reset command. The system can also write the CFI query command when the device is in the au- toselect mode. The device enters the CFI query mode, and the system can read CFI data at the addresses given in Table 6, Table 7 on page 38 , Table 8 on page 38, and Table 9 on page 39. The system must write the reset command to return the device to reading array data. For further information, please refer to the CFI Specification and CFI Publication 100, available via the World Wide Web at http://www.amd.com/flash/cfi. Alter- natively, contact your sales representative for copies of these documents. Ta b l e 6 . CFI Query Identification String Addresses (x16) Addresses (x8) Data Description 10h 11h 12h 20h 22h 24h 0051h 0052h 0059h Query Unique ASCII string “QRY” 13h 14h 26h 28h 0002h 0000h Primary OEM Command Set 15h 16h 2Ah 2Ch 0040h 0000h Address for Primary Extended Table 17h 18h 2Eh 30h 0000h 0000h Alternate OEM Command Set (00h = none exists) 19h 1Ah 32h 34h 0000h 0000h Address for Alternate OEM Extended Table (00h = none exists)

38 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Ta b l e 7 . System Interface String Ta bl e 8 . Device Geometry Definition Addresses (x16) Addresses (x8) Data Description 1Bh 36h 0027h VCC Min. (write/erase) D7–D4: volt, D3–D0: 100 millivolt 1Ch 38h 0036h VCC Max. (write/erase) D7–D4: volt, D3–D0: 100 millivolt 1Dh 3Ah 0000h V PP Min. voltage (00h = no VPP pin present) 1Eh 3Ch 0000h V PP Max. voltage (00h = no VPP pin present) 1Fh 3Eh 0007h Typical timeout per single byte/word write 2 N µs 20h 40h 0007h Typical timeout for Min. size buffer write 2 N µs (00h = not supported) 21h 42h 000Ah Typical timeout per individual block erase 2 N ms 22h 44h 0000h Typical timeout for full chip erase 2 N ms (00h = not supported) 23h 46h 0003h Max. timeout for byte/word write 2 N times typical 24h 48h 0005h Max. timeout for buffer write 2 N times typical 25h 4Ah 0004h Max. timeout per individual block erase 2 N times typical 26h 4Ch 0000h Max. timeout for full chip erase 2 N times typical (00h = not supported) Addresses (x16) Addresses (x8) Data Description 27h 4Eh 001Ah 0019h 0018h Device Size = 2 N byte, 1A = 512 Mb. 28h 29h 50h 52h 0002h 0000h Flash Device Interface description (refer to CFI publication 100) 2Ah 2Bh 54h 56h 0005h 0000h Max. number of byte in multi-byte write = 2 N (00h = not supported) 2Ch 58h 0001h Number of Erase Block Regions within device (01h = uniform device, 02h = boot device) 2Dh 2Eh 2Fh 30h 5Ah 5Ch 5Eh 60h 00xxh 000xh 0000h 000xh Erase Block Region 1 Information (refer to the CFI specification or CFI publication 100) 00FFh, 001h, 0000h, 0002h = 512 Mb 31h 32h 33h 34h 60h 64h 66h 68h 0000h 0000h 0000h 0000h Erase Block Region 2 Information (refer to CFI publication 100) 35h 36h 37h 38h 6Ah 6Ch 6Eh 70h 0000h 0000h 0000h 0000h Erase Block Region 3 Information (refer to CFI publication 100) 39h 3Ah 3Bh 3Ch 72h 74h 76h 78h 0000h 0000h 0000h 0000h Erase Block Region 4 Information (refer to CFI publication 100)

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 39 Advance Information Ta b l e 9 . Primary Vendor-Specific Extended Query Command Definitions Writing specific address and data co mmands or sequences into the command register initiates device operations. Table 10 on page 54 and Table 11 on page 57 define the valid register command sequences. Writing incorrect address and data values or writing them in the improper sequence may place the device in an un- known state. A reset command is then required to return the device to reading array data. All addresses are latched on the falling edge of WE# or CE# (or CE2#), whichever happens later. All data is latched on the rising edge of WE# or CE# (or CE2#), whichever happens first. Refer to the AC Characteristics section for timing diagrams. Addresses (x16) Addresses (x8) Data Description 40h 41h 42h 80h 82h 84h 0050h 0052h 0049h Query-unique ASCII string “PRI” 43h 86h 0031h Major version number, ASCII 44h 88h 0033h Minor version number, ASCII 45h 8Ah 0010h Address Sensitive Unlock (Bits 1-0) 0 = Required, 1 = Not Required Process Technology (Bits 7-2) 0100b = 110 nm MirrorBit 46h 8Ch 0002h Erase Suspend 0 = Not Supported, 1 = To Read Only, 2 = To Read & Write 47h 8Eh 0001h Sector Protect 0 = Not Supported, X = Number of sectors in per group 48h 90h 0000h Sector Temporary Unprotect 00 = Not Supported, 01 = Supported 49h 92h 0008h Sector Protect/Unprotect scheme 0008h = Advanced Sector Protection 4Ah 94h 0000h Simultaneous Operation 00 = Not Supported, X = Number of Sectors in Bank 4Bh 96h 0000h Burst Mode Type 00 = Not Supported, 01 = Supported 4Ch 98h 0002h Page Mode Type 00 = Not Supported, 01 = 4 Word Page, 02 = 8 Word Page 4Dh 9Ah 00B5h ACC (Acceleration) Supply Minimum 00h = Not Supported, D7-D4: Volt, D3-D0: 100 mV 4Eh 9Ch 00C5h ACC (Acceleration) Supply Maximum 00h = Not Supported, D7-D4: Volt, D3-D0: 100 mV 4Fh 9Eh 00xxh WP# Protection 04h = Uniform sectors bottom WP# protect, 05h = Uniform sectors top WP# protect 50h A0h 0001h Program Suspend 00h = Not Supported, 01h = Supported

40 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Reading Array Data The device is automatically set to reading array data after device power-up. No commands are required to retrieve data. The device is ready to read array data after completing an Embedded Program or Embedded Erase algorithm. After the device accepts an Erase Suspend command, the device enters the erase-suspend-read mode, after which the system can read data from any non- erase-suspended sector. After completing a programming operation in the Erase Suspend mode, the system may once agai n read array data with the same ex- ception. See the Erase Suspend/Erase Resume Commands section for more information. The system must issue the reset command to return the device to the read (or erase-suspend-read) mode if DQ5 goes high during an active program or erase operation, or if the device is in the autoselect mode. See the next section, Reset Command, for more information. See also Requirements for Reading Array Data in the Device Bus Operations sec- tion for more information. The Read-Only Operations– AC Characteristics‚ on page 69 section provides the read parameters, and Figure 11, on page 70 shows the timing diagram. Reset Command Writing the reset command resets the device to the read or erase-suspend-read mode. Address bits are don’t cares for this command. The reset command may be written between the sequence cycles in an erase command sequence before erasing begins. This resets the device to the read mode. Once erasure begins, however, the device ignores reset commands until the operation is complete. The reset command may be written between the sequence cycles in a program command sequence before programming begins. This resets the device to the read mode. If the program command sequence is written while the device is in the Erase Suspend mode, writing the rese t command returns the device to the erase-suspend-read mode. Once programming begins, however, the device ig- nores reset commands until the operation is complete. The reset command may be written between the sequence cycles in an autoselect command sequence. Once in the autoselect mode, the reset command must be written to return to the read mode. If the device entered the autoselect mode while in the Erase Suspend mode, writing the reset command returns the device to the erase-suspend-read mode. If DQ5 goes high during a program or erase operation, writing the reset command returns the device to the read mode (or erase-suspend-read mode if the device was in Erase Suspend). Note that if DQ1 goes high during a Write Buffer Programming operation, the sys- tem must write the Write-to-Buffer-Abort Reset command sequence to reset the device for the next operation. Autoselect Command Sequence The autoselect command sequence allows the host system to access the manu- facturer and device codes, and determine whether or not a sector is protected. Table 10 on page 54 and Table 11 on page 57 show the address and data require- ments. This method is an alternative to that shown in Table 3 on page 28, which

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 41 Advance Information is intended for PROM programmers and requires VID on address pin A9. The au- toselect command sequence may be written to an address that is either in the read or erase-suspend-read mode. The autoselect command may not be written while the device is actively programming or erasing. The autoselect command sequence is initiated by first writing two unlock cycles. This is followed by a third write cycle that contains the autoselect command. The device then enters the autoselect mode. The system may read at any address any number of times without initiating another autoselect command sequence: „ A read cycle at address XX00h returns the manufacturer code. „ Three read cycles at addresses 01h, 0Eh, and 0Fh return the device code. „ A read cycle to an address containing a sector address (SA), and the address 02h on A7–A0 in word mode returns 01h if the sector is protected, or 00h if it is unprotected. The system must write the reset command to return to the read mode (or erase- suspend-read mode if the device was previously in Erase Suspend). Enter Secured Silicon Sector/Exit Secured Silicon Sector Command Sequence The Secured Silicon Sector region provides a secured data area containing an 8- word/16-byte random Electronic Serial Number (ESN). The system can access the Secured Silicon Sector region by issuing the three-cycle Enter Secured Silicon Sector command sequence. The device continues to access the Secured Silicon Sector region until the system issues th e four-cycle Exit Secured Silicon Sector command sequence. The Exit Secured Silicon Sector command sequence returns the device to normal operation. Table 10 on page 54 shows the address and data requirements for both command sequences. See also “Secured Silicon Sector Flash Memory Region” for further information. Note that the ACC function and un- lock bypass modes are not available when the Secured Silicon Sector is enabled. Word Program Command Sequence Programming is a four-bus-cycle operation. The program command sequence is initiated by writing two unlock write cycles, followed by the program set-up com- mand. The program address and data are written next, which in turn initiate the Embedded Program algorithm. The system is not required to provide further con- trols or timings. The device automatically provides internally generated program pulses and verifies the programmed cell margin. Table 10 on page 54 and Table 11 on page 57 show the address and data requirements for the word pro- gram command sequence. When the Embedded Program algorithm is complete, the device then returns to the read mode and addresses are no longer latched. The system can determine the status of the program operation by using DQ7 or DQ6. Refer to the Write Op- eration Status section for information on these status bits. Any commands written to the device during the Embedded Program Algorithm are ignored. Note that the Secured Silicon Sector, autoselect, and CFI functions are unavailable when a program operation is in progress. Note that a hardware reset immediately terminates the program operation. The pro- gram command sequence should be reinitiated once the device returns to the read mode, to ensure data integrity. Programming is allowed in any sequence of address locations and across sector boundaries. Programming to the same word address multiple times without in- tervening erases (incremental bit programming) requires a modified

42 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information programming method. For such applicatio n requirements, please contact your local Spansion representative. Word pr ogramming is supported for backward compatibility with existing Flash driver software and for occasional writing of in- dividual words. Use of Wr ite Buffer Programming is strongly recommended for general programming use when more than a few words are to be programmed. The effective word programming time using Write Buffer Programming is much shorter than the single word programming time. Any word cannot be pro- grammed from 0 back to a 1. Attempting to do so may cause the device to set DQ5 = 1, or cause the DQ7 and DQ6 status bits to indicate the operation was successful. However, a succeeding read shows that the data is still 0. Only erase operations can convert a 0 to a 1. Unlock Bypass Command Sequence The unlock bypass feature allows the sy stem to program words to the device faster than using the standard program command sequence. The unlock bypass command sequence is initiated by first writing two unlock cycles. This is followed by a third write cycle containing the unlock bypass command, 20h. The device then enters the unlock bypass mode. A two-cycle unlock bypass program com- mand sequence is all that is required to program in this mode. The first cycle in this sequence contains the unlock by pass program command, A0h; the second cycle contains the program address and data. Additional data is programmed in the same manner. This mode dispenses with the initial two unlock cycles required in the standard program command sequence, resulting in faster total program- ming time. Table 10 on page 54 and Table 11 on page 57 show the requirements for the command sequence. During the unlock bypass mode, only the Unlock Bypass Program and Unlock By- pass Reset commands are valid. To exit the unlock bypass mode, the system must issue the two-cycle unlock bypass reset command sequence. (See Table 10 on page 54 and Table 11 on page 57). Write Buffer Programming Write Buffer Programming allows the system write to a maximum of 16 words/32 bytes in one programming operation. This results in faster effective programming time than the standard programming algorithms. The Write Buffer Programming command sequence is initiated by first writing two unlock cycles. This is followed by a third write cycle containing the Wr ite Buffer Load command written at the Sector Address in which programming occurs. The fourth cycle writes the sector address and the number of word location s, minus one, to be programmed. For example, if the system programs six unique address locations, then 05h should be written to the device. This tells the device how many write buffer addresses are loaded with data and therefore when to expect the Program Buffer to Flash command. The number of loca tions to program cannot exceed the size of the write buffer or the operation aborts. The fifth cycle writes the first address location and data to be programmed. The write-buffer-page is selected by address bits A MAX–A4. All subsequent address/ data pairs must fall within the select ed-write-buffer-page . The system then writes the remaining address/data pairs into the write buffer. Write buffer loca- tions may be loaded in any order. The write-buffer-page address must be the same for all address/data pairs loaded into the write buffer. (This means Write Buffer Programming cannot be performed across multiple write-buffer pages. This also means that Write Buffer Program- ming cannot be performed across multiple sectors. If the system attempts to load

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 43 Advance Information programming data outside of the select ed write-buffer page, the operation aborts.) Note that if a Write Buffer address location is loaded multiple times, the address/ data pair counter is decremented for every data load operation. The host system must therefore account for loading a write-buffer location more than once. The counter decrements for each data load operation, not for each unique write- buffer-address location. Note also that if an address location is loaded more than once into the buffer, the final data loaded for that address is programmed. Once the specified number of write buffer locations are loaded, the system must then write the Program Buffer to Flash command at the sector address. Any other address and data combination aborts th e Write Buffer Programming operation. The device then begins programming. Data polling should be used while monitor- ing the last address location loaded into the write buffer. DQ7, DQ6, DQ5, and DQ1 should be monitored to determine the device status during Write Buffer Programming. The write-buffer programming operation can be suspended using the standard program suspend/resume commands. Upon successful completion of the Write Buffer Programming operation, the device is ready to execute the next command. The Write Buffer Programming Sequence can be aborted in the following ways: „ Load a value that is greater than the page buffer size during the Number of Locations to Program step. „ Write to an address in a sector different than the one specified during the Write-Buffer-Load command. „ Write an Address/Data pair to a different write-buffer-page than the one se- lected by the Starting Address during the write buffer data loading stage of the operation. „ Write data other than the Confirm Command after the specified number of data load cycles. The abort condition is indicated by DQ1 = 1, DQ7 = DATA# (for the last address location loaded), DQ6 = toggle, and DQ5=0. A Write-to-Buffer-Abort Reset com- mand sequence must be written to reset the device for the next operation. Note that the full 3-cycle Write-to-Buffer-Abort Reset command sequence is required when using Write-Buffer-Programming features in Unlock Bypass mode. Write buffer programming is allowed in any sequence. Note that the Secured Sil- icon sector, autoselect, and CFI functions are unavailable when a program operation is in progress. This flash devi ce is capable of handling multiple write buffer programming operations on the same write buffer address range without intervening erases. For applications re quiring incremental bit programming, a modified programming method is required , please contact your local Spansion representative. Any bit in a write buffer address range cannot be pro- grammed from 0 back to a 1. Attempting to do so may cause the device to set DQ5 = 1, or cause the DQ7 and DQ6 status bits to indicate the operation was successful. However, a succeeding read shows that the data is still 0. Only erase operations can convert a 0 to a 1. Accelerated Program The device offers accelerated program operations through the WP#/ACC pin. When the system asserts VHH on the WP#/ACC pin, the device automatically en- ters the Unlock Bypass mode. The system may then write the two-cycle Unlock Bypass program command sequence. The device uses the higher voltage on the WP#/ACC pin to accelerate the operation. Note that the WP#/ACC pin must not

44 S70GL01GN00 MirrorBit

may result. WP# contains an internal pullup; when unconnected, WP# is at VIH. ters, and Figure 14, on page 73 for timing diagrams. Figure 1. Write Buffer Programming Operation

1. When Sector Address is specified, any
2. DQ7 may change simultaneously with

DQ5. Therefore, DQ7 should be verified.

1. If this flowchart location was reached

because DQ5= 1, then the device FAILED.

1. See Table 10 on page 54 and Table 11 on

for write buffer programming.

Figure 2. Program Operation quired when writing the Program Suspend command. data may be read from any addresses not in Erase Suspend or Program Suspend. available when program operation is in progress. Command Sequence‚ on page 40 for more information. page 57 for program command sequence.

46 S70GL01GN00 MirrorBit

Operation Status‚ on page 60 for more information. Suspend command can be written after the device resumes programming. Figure 3. Program Suspend/Program Resume the address and data requirements for the chip erase command sequence. tus‚ on page 60 for information on these status bits.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 47 Advance Information Any commands written during the chip erase operation are ignored, including erase suspend commands. However, note that a hardware reset immediately terminates the erase operation. If that occurs, the chip erase command sequence should be reinitiated once the device returns to reading array data, to ensure data integrity. Figure 4, on page 48 illustrates the algorithm for the erase operation. Note that the Secured Silicon Sector, autoselect, and CFI functions are unavailable when an erase operation in is progress. Refer to the Erase and Program Op- erations table in the AC Characteristics section for parameters, and Figure 16, on page 74 section for timing diagrams. Sector Erase Command Sequence Sector erase is a six bus cycle operation. The sector erase command sequence is initiated by writing two unlock cycles, followed by a set-up command. Two addi- tional unlock cycles are written, and are then followed by the address of the sector to be erased, and the sector erase command. Table 10 on page 54 and Table 11 on page 57 shows the address and data requirements for the sector erase command sequence. The device does not require the system to preprogram prior to erase. The Em- bedded Erase algorithm automatically programs and verifies the entire memory for an all zero data pattern prior to electrical erase. The system is not required to provide any controls or timings during these operations. After the command sequence is written, a sector erase time-out of 50 µs occurs. During the time-out period, additional sector addresses and sector erase com- mands may be written. Loading the sector erase buffer may be done in any sequence, and the number of sectors may be from one sector to all sectors. The time between these additional cycles must be less than 50 µs, otherwise erasure may begin. Any sector erase address and command following the exceeded time- out may or may not be accepted. It is recommended that processor interrupts be disabled during this time to ensure all commands are accepted. The interrupts can be re-enabled after the last Sector Erase command is written. Any com- mand other than Sector Erase or Erase Suspend during the time-out period resets the device to the read mode. Note that the Secured Silicon Sector, autoselect, and CFI functions are unavailable when an erase op- eration in is progress. The system must rewrite the command sequence and any additional addresses and commands. The system can monitor DQ3 to determine if the sector erase timer has timed out (See the section on DQ3: Sector Erase Timer.). The time-out begins from the ris- ing edge of the final WE# pulse in the command sequence. When the Embedded Erase algorithm is complete, the device returns to reading array data and addresses are no longer latched. The system can determine the status of the erase operation by reading DQ7, DQ6, or DQ2 in the erasing sector. Refer to the Write Operation Status section for information on these status bits. Once the sector erase operation begins, only the Erase Suspend command is valid. All other commands are ignored. However, note that a hardware reset im- mediately terminates the erase operation. If that occurs, the sector erase command sequence should be reinitiated once the device returns to reading array data, to ensure data integrity.

48 S70GL01GN00 MirrorBit

Figure 16, on page 74 for timing diagrams. Figure 4. Erase Operation suspends the erase operation.

1. See Table 10 on page 54 and Table 11 on page 57 for
2. See the section on DQ3 for information on the sector

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 49 Advance Information a sector is actively erasing or is eras e-suspended. Refer to the Write Operation Status section for information on these status bits. After an erase-suspended program operation is complete, the device returns to the erase-suspend-read mode. The system can determine the status of the pro- gram operation using the DQ7 or DQ6 status bits, just as in the standard word program operation. Refer to Write Operation Status‚ on page 60 for more information. In the erase-suspend-read mode, the system can also issue the autoselect com- mand sequence. Refer to the Autoselect Mode‚ on page 28 section and Autoselect Command Sequence‚ on page 40 for details. To resume the sector erase operation, the system must write the Erase Resume command. The address of the erase-suspended sector is required when writing this command. Further writes of the Resume command are ignored. Another Erase Suspend command can be written after the chip resumes erasing. It is im- portant to allow an interval of at le ast 5 ms between Erase Resume and Erase Suspend. Lock Register Command Set Definitions The Lock Register Command Set permits the user to one-time program the Se- cured Silicon Sector Protection Bit, Pers istent Protection Mode Lock Bit, and Password Protection Mode Lock Bit. The Lock Register bits are all readable after an initial access delay. The Lock Register Command Set Entry command sequence must be issued prior to any of the following command s listed, to enable proper command execution. Note that issuing the Lock Register Command Set Entry command disables reads and writes for the flash memory. „ Lock Register Program Command „ Lock Register Read Command The Lock Register Command Set Exit command must be issued after the ex- ecution of the commands to reset the device to read mode. Otherwise the device hangs. If this happens, the flash device must be reset. Please refer to RESET# for more information. It is important to note that the device is in either Persistent Protection mode or Password Protection mode depending on the mode selected prior to the device hang. For either the Secured Silicon Sector to be locked, or the device to be perma- nently set to the Persistent Protection Mode or the Password Protection Mode, the associated Lock Register bits must be programmed. Note that the Persistent Pro- tection Mode Lock Bit and Password Pr otection Mode Lock Bit can never be programmed together at the same time. If so, the Lock Register Program opera- tion aborts. The Lock Register Command Set Exit command must be initiated to re-enable reads and writes to the main memory. Password Protection Command Set Definitions The Password Protection Command Set permits the user to program the 64-bit password, verify the programming of the 64-bit password, and then later unlock the device by issuing the valid 64-bit password.

50 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information The Password Protection Command Set Entry command sequence must be issued prior to any of the commands listed following to enable proper command execution. Note that issuing the Password Protection Command Set Entry command disabled reads and writes the main memory. „ Password Program Command „ Password Read Command „ Password Unlock Command The Password Program command permits programming the password that is used as part of the hardware protection scheme. The actual password is 64-bits long. There is no special addressing or der required for programming the pass- word. The password is programmed in 8- bit or 16-bit portions. Each portion requires a Password Program Command. Once the Password is written and verified, the Password Protection Mode Lock Bit in the Lock Register must be programmed in orde r to prevent verification. The Password Program command is only capable of programming 0s. Programming a 1 after a cell is programmed as a 0 results in a time-out by the Embedded Pro- gram Algorithm TM with the cell remaining as a 0. The password is all F’s when shipped from the factory. All 64-bit password combinations are valid as a password. The Password Read command is used to verify the Password. The Password is verifiable only when the Password Protection Mode Lock Bit in the Lock Register is not programmed. If the Password Protection Mode Lock Bit in the Lock Register is programmed and the user attempts to read the Password, the device always drives all F’s onto the DQ databus. The lower two address bits (A1–A0) for word mode and (A1–A-1) for by byte mode are valid during the Password Read, Password Program, and Password Un- lock commands. Writing a 1 to any other address bits (A MAX-A2) aborts the Password Read and Password Program commands. The Password Unlock command is used to clear the PPB Lock Bit to the unfreeze state so that the PPB bits can be modified. The exact password must be entered in order for the unlocking function to occur. This 64-bit Password Unlock com- mand sequence takes at least 2 µs to process each time to prevent a hacker from running through the all 64-bit combinations in an attempt to correctly match the password. If another password unlock is issued before the 64-bit password check execution window is completed, the command is ignored. If the wrong address or data is given during password unlock command cycle, the device may enter the write-to-buffer abort state. In order to exit the write-to-abort state, the write- to-buffer-abort-reset command must be given. Otherwise the device hangs. The Password Unlock function is accomplished by writing Password Unlock com- mand and data to the device to perform the clearing of the PPB Lock Bit to the unfreeze state. The password is 64 bits long. A1 and A0 are used for matching in word mode and A1, A0, A-1 in byte mode. Writing the Password Unlock command does not need to be address order specific. An example sequence is starting with the lower address A1-A0=00, followed by A1-A0=01, A1-A0=10, and A1-A0=11 if the device is configured to operate in word mode. Approximately 2 µs is required for unloc king the device after the valid 64-bit password is given to the device. It is the responsibility of the microprocessor to keep track of the entering the portions of the 64-bit password with the Password Unlock command, the order, and when to read the PPB Lock bit to confirm suc-

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 51 Advance Information cessful password unlock. In order to re-lock the device into the Password Protection Mode, the PPB Lock Bit Set command can be re-issued. Note: The Password Protection Command Set Exit command must be issued after the execution of the commands listed previously to reset the device to read mode. Otherwise the device hangs. Note: Issuing the Password Protection Command Set Exit command re- enables reads and writes for the main memory. Non-Volatile Sector Protection Command Set Definitions The Non-Volatile Sector Protection Command Set permits the user to program the Persistent Protection Bits (PPB bits), er ase all of the Persistent Protection Bits (PPB bits), and read the logic state of the Persistent Protection Bits (PPB bits). The Non-Volatile Sector Protection Command Set Entry command se- quence must be issued prior to any of the commands listed following to enable proper command execution. Note that issuing the Non-Volatile Sector Protection Command Set Entry command disables reads and writes for the main memory. „ PPB Program Command The PPB Program command is used to program, or set, a given PPB bit. Each PPB bit is individually programmed (but is bulk erased with the other PPB bits). The specific sector address (A24-A16 for S29GL512N, A23-A16 for S29GL256N, A22- A16 for S29GL128N) is written at the same time as the program command. If the PPB Lock Bit is set to the freeze state, the PPB Program command does not exe- cute and the command times-out without programming the PPB bit. „ All PPB Erase Command The All PPB Erase command is used to er ase all PPB bits in bulk. There is no means for individually erasing a specific PPB bit. Unlike the PPB program, no spe- cific sector address is required. However, when the All PPB Erase command is issued, all Sector PPB bits are erased in parallel. If the PPB Lock Bit is set to freeze state, the ALL PPB Erase command does not execute and the command times- out without erasing the PPB bits. The device preprograms all PPB bits prior to erasing when issuing the All PPB Erase command. Also note that the total number of PPB program/erase cycles has the same endurance as the flash memory array. „ PPB Status Read Command The programming state of the PPB for a given sector can be verified by writing a PPB Status Read Command to the device. This requires an initial access time latency. The Non-Volatile Sector Protection Command Set Exit command must be issued after the execution of the commands listed previously to reset the device to read mode. Note that issuing the Non-Volatile Sector Protection Command Set Exit command re-enables reads and writes for the main memory. Global Volatile Sector Protection Freeze Command Set The Global Volatile Sector Protection Freeze Command Set permits the user to set the PPB Lock Bit and reading the logic state of the PPB Lock Bit.

52 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information The Global Volatile Sector Protection Freeze Command Set Entry com- mand sequence must be issued prior to any of the commands listed following to enable proper command execution. Reads and writes from the main memory are not allowed. „ PPB Lock Bit Set Command The PPB Lock Bit Set command is used to set the PPB Lock Bit to the freeze state if it is cleared either at reset or if the Password Unlock command was successfully executed. There is no PPB Lock Bit Clear command. Once the PPB Lock Bit is set to the freeze state, it cannot be cleared unless the device is taken through a power-on clear (for Persistent Protection Mode) or the Password Unlock command is executed (for Password Protection Mode). If the Password Protection Mode Lock Bit is programmed, the PPB Lock Bit status is reflected as set to the freeze state, even after a power-on reset cycle. „ PPB Lock Bit Status Read Command The programming state of the PPB Lock Bi t can be verified by executing a PPB Lock Bit Status Read command to the device. The Global Volatile Sector Protection Freeze Command Set Exit command must be issued after the execution of the commands listed previously to reset the device to read mode. Volatile Sector Protection Command Set The Volatile Sector Protection Command Set permits the user to set the Dynamic Protection Bit (DYB) to the protected state , clear the Dynamic Protection Bit (DYB) to the unprotected state, and read the logic state of the Dynamic Protec- tion Bit (DYB). The Volatile Sector Protec tion Command Set Entry command sequence must be issued prior to any of the comm ands listed following to enable proper command execution. Note that issuing the Volatile Sector Protection Command Set Entry com- mand disables reads and writes from main memory. „ DYB Set Command „ DYB Clear Command The DYB Set and DYB Clear commands are used to protect or unprotect a DYB for a given sector. The high order address bits are issued at the same time as the code 00h or 01h on DQ7-DQ0. All other DQ data bus pins are ignored during the data write cycle. The DYB bits are modifiable at any time, regardless of the state of the PPB bit or PPB Lock Bit. The DYB bits are cleared to the unprotected state at power-up or hardware reset. „ DYB Status Read Command The programming state of the DYB bit for a given sector can be verified by writing a DYB Status Read command to the device. This requires an initial access delay. The Volatile Sector Protection Command Set Exit command must be issued after the execution of the commands listed previously to reset the device to read mode. Note that issuing the Volatile Sector Protecti on Command Set Exit com- mand re-enables reads and writes to the main memory.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 53 Advance Information Secured Silicon Sector Entry Command The Secured Silicon Sector Entry command allows the following commands to be executed „ Read from Secured Silicon Sector „ Program to Secured Silicon Sector Once the Secured Silicon Sector Entry Command is issued, the Secured Silicon Sector Exit command has to be issued to exit Secured Silicon Sector Mode. Secured Silicon Sector Exit Command The Secured Silicon Sector Exit command may be issued to exit the Secured Sil- icon Sector Mode.

54 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Command Definitions Ta bl e 1 0 . Command Definitions for Each of S29GL512N, x 16 (Sheet 1 of 2) Command (Notes) Cycles Bus Cycles (Notes 2, 3, 4, and 5) First Second Third Fourth Fifth Sixth Addr Data Addr Data Addr Data Addr Data Addr Data Addr Data Read (6)1 RA RD Reset (7)1 X X X F 0 Autoselect (Note 8) Manufacturer ID 4 555 AA 2AA 55 555 90 X00 01 Device ID 4 555 AA 2AA 55 555 90 X01 227E X0E Note

17 X0F Note

Sector Protect Verify 4 555 AA 2AA 55 555 90 (SA) X02 XX00 XX01 Secure Device Verify (9) 4 555 AA 2AA 55 555 90 X03 Note CFI Query (11)1 5 5 9 8 Program 4 555 AA 2AA 55 555 A0 PA PD Write to Buffer 3 555 AA 2AA 55 SA 25 SA WC PA PD WBL PD Program Buffer to Flash (confirm) 1 SA 29 Write-to-Buffer-Abort Reset (16) 3 555 AA 2AA 55 555 F0 Unlock Bypass 3 555 AA 2AA 55 555 20 Unlock Bypass Program (12)2 X X X A 0 P A P D Unlock Bypass Sector Erase (12)2 X X X 8 0 S A 3 0 Unlock Bypass Chip Erase (12) 2 XXX 80 XXX 10 Unlock Bypass Reset (13) 2 XXX 90 XXX 00 Chip Erase 6 555 AA 2AA 55 555 80 555 AA 2AA 55 555 10 Sector Erase 6 555 AA 2AA 55 555 80 555 AA 2AA 55 SA 30 Erase Suspend/Program Suspend (14)1 X X X B 0 Erase Resume/Program Resume (15)1 X X X 3 0 Sector Command Definitions Secured Silicon SEctor Secured Silicon Sector Entry 3 555 AA 2AA 55 555 88 Secured Silicon Sector Exit (18) 4 555 AA 2AA 55 555 90 XX 00 Lock Register Command Set Definitions Lock Register Lock Register Command Set Entry 3 555 AA 2AA 55 555 40 Lock Register Bits Program (22) 2 XXX A0 XXX Data Lock Register Bits Read (22)1 0 0 D a t a Lock Register Command Set Exit (18, 23) 2 XXX 90 XXX 00 Password Protection Command Set Definitions

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 55 Advance Information Legend: X = Don’t care RA = Address of the memory to be read. RD = Data read from location RA during read operation. PA = Address of the memory location to be programmed. Addresses latch on the falling edge of the WE# or CE# (or CE2#) pulse, whichever happens later. PD = Data to be programmed at location PA. Data latches on the rising edge of the WE# or CE# (or CE2#) pulse, whichever happens first. SA = Address of the sector to be verified (in autoselect mode) or erased. Address bits Amax–A16 uniquely select any sector. Password Password Protection Command Set Entry 3 555 AA 2AA 55 555 60 Password Program (20)2 X X X A 0 PWA x PWD x Password Read (19)4 X X X PWD 0 01 PWD 1 02 PWD 2 03 PWD Password Unlock (19)7 00 25 00 03 00 PWD 0 01 PWD 1 02 PWD 2 03 PWD 00 29 Password Protection Command Set Exit (18, 23) 2 XXX 90 XXX 00 Non-Volatile Sector Protection Command Set Definitions PPB Nonvolatile Sector Protection Command Set Entry 3 555 AA 2AA 55 555 C0 PPB Program (24, 25)2 X X X A 0 S A 0 0 All PPB Erase 2 XXX 80 00 30 PPB Status Read (25)1 S A RD (0) Non-Volatile Sector Protection Command Set Exit (18) 2 XXX 90 XXX 00 Global Non-Volatile Sector Protection Freeze Command Set Definitions PPB Lock Bit Global Non-Volatile Sector Protection Freeze Command Set Entry 3 555 AA 2AA 55 555 50 PPB Lock Bit Set (25) 2 XXX A0 XXX 00 PPB Lock Status Read (25)1 X X X RD (0) Global Non-Volatile Sector Protection Freeze Command Set Exit (18) 2 XXX 90 XXX 00 Volatile Sector Protection Command Set Definitions DYB Volatile Sector Protection Command Set Entry 3 555 AA 2AA 55 555 E0 DYB Set (24, 25)2 X X X A 0 S A 0 0 DYB Clear (25)2 X X X A 0 S A 0 1 DYB Status Read (25)1 S A RD (0) Volatile Sector Protection Command Set Exit (18) 2 XXX 90 XXX 00 T able 10. Command Definitions for Each of S29GL512N, x 16 (Sheet 2 of 2) Command (Notes) Cycles Bus Cycles (Notes 2, 3, 4, and 5) First Second Third Fourth Fifth Sixth Addr Data Addr Data Addr Data Addr Data Addr Data Addr Data

56 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information WBL = Write Buffer Location. The address must be within the same write buffer page as PA. WC = Word Count is the number of write buffer locations to load minus 1. PWD = Password PWDx = Password word0, word1, word2, and word3. DATA = Lock Register Contents: PD(0) = Secured Silicon Sector Protection Bit, PD(1) = Persistent Protection Mode Lock Bit, PD(2) = Password Protection Mode Lock Bit. Notes: 1. See Table 1 on page 10 for description of bus operations. 2. All values are in hexadecimal. 3. Except for the read cycle, and the 4th, 5th, and 6th cycle of the autoselect command sequence, all bus cycles are write cycles. 4. Data bits DQ15-DQ8 are don't ca res for unlock and command cycles. 5. Address bits A MAX:A16 are don't cares for unlock and command cycles, unless SA or PA required. (AMAX is the Highest Address pin.). 6. No unlock or command cycles required when reading array data. 7. The Reset command is required to return to reading array data when device is in the autoselect mode, or if DQ5 goes high (while the device is providing status data). 8. The fourth, fifth, and sixth cycle of the autoselect command sequence is a read cycle. 9. The data is 00h for an unprotected se ctor and 01h for a protected sector. See Autoselect Command Sequence‚ on page 40 for more information. This is same as PPB Status Read except that the protect and unprotect statuses are inverted here. 10. The data value for DQ7 is 1 for a serialized and protected OTP region and 0 for an unserialized and unprotected Secured Silicon Sector region. See Secured Silicon Sector Flash Memory Region‚ on page 34 for more information. For S29GL-NH: XX18h/18h = Not Factory Locked. XX98h/98h = Factory Locked. For S29GL-NL: XX08h/08h = Not Factory Locked. XX88h/88h = Factory Locked. 11. Command is valid when device is ready to read array data or when device is in autoselect mode. 12. The Unlock-Bypass command is required prior to the Unlock-Bypass-Program command. 13. The Unlock-Bypass-Reset command is required to return to reading array data when the device is in the unlock bypass mode. 14. The system may read and program/program suspend in non-erasing sectors, or enter the autoselect mode, when in the Erase Suspend mode. The Erase Suspend command is valid only during a sector erase operation. 15. The Erase Resume/Program Resume command is valid only during the Erase Suspend/Program Suspend modes. 16. Issue this command sequence to return to READ mode after detecting device is in a Write-to-Buffer-Abort state. NOTE: the full command sequence is required if resetting out of ABORT while using Unlock Bypass Mode. 17. S29GL512NH/L = 2223h/23h, 2201h/01h. 18. The Exit command returns the device to reading the array. 19. Note that the password portion can be entered or read in any order as long as the entire 64-bit password is entered or read. 20. For PWDx, only one portion of the password can be programmed per each A0 command. 21. The All PPB Erase command embeds programming of all PPB bits before erasure. 22. All Lock Register bits are one-time programmable. Note that the program state = 0 and the erase state = 1. Also note that of both the Persistent Protection Mode Lock Bit and the Password Protection Mode Lock Bit cannot be programmed at the same time or the Lock Register Bits Program operation aborts and returns the device to read mode. Lock Register bits that are reserved for future use defaults to 1's. The Lock Register is shipped out as FFFF's before Lock Register Bit program execution. 23. If any of the Entry command was initiated, an Exit command must be issued to reset the device into read mode. Otherwise the device hangs. 24. If ACC = V HH, sector protection matches when ACC = VIH 25. Protected State = 00h, Unprotected State = 01h.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 57 Advance Information T able 11. Command Definitions for Each S29GL512N, x8 (Sheet 1 of 2) Command (Notes) Cycles Bus Cycles (Notes 2, 3, 4, and 5) First Second Third Fourth Fifth Sixth Addr Data Addr Data Addr Data Addr Data Addr Data Addr Data Read (6)1 RA RD Reset (7)1 X X X F 0 Autoselect Manufacturer ID 4 AAA AA 555 55 AAA 90 X00 01 Device ID 4 AAA AA 555 55 AAA 90 X02 XX7E X1C Note

17 X1E Note

Sector Protect Verify 4 AAA AA 555 55 AAA 90 (SA) X04 Secure Device Verify (9) 4 AAA AA 555 55 AAA 90 X06 Note CFI Query (11)1 A A 9 8 Write to Buffer 3 AAA AA 555 55 SA 25 SA WC PA PD WBL PD Program Buffer to Flash (confirm) 1 SA 29 Write-to-Buffer-Abort Reset (16)3 A A A A A P A 5 5 5 5 5 F 0 Chip Erase 6 AAA AA 555 55 AAA 80 AAA AA 555 55 AAA 10 Sector Erase 6 AAA AA 555 55 AAA 80 AAA AA 555 55 SA 30 Erase Suspend/Program Suspend (14)1 X X X B 0 Erase Resume/Program Resume (15)1 X X X 3 0 Secured Silicon Sector Command Definitions Secured Silicon SEctor Secured Silicon Sector Entry 3 AAA AA 555 55 AAA 88 Secured Silicon Sector Exit (18) 4 AAA AA 555 55 AAA 90 XX 00 Lock Register Command Set Definitions Lock Register Lock Register Command Set Entry 3 AAA AA 555 55 AAA 40 Lock Register Bits Program (22) 2 XXX A0 XXX Data Lock Register Bits Read (22)1 0 0 D a t a Lock Register Command Set Exit (18, 23) 2 XXX 90 XXX 00 Password Protection Command Set Definitions

58 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Legend: X = Don’t care RA = Address of the memory to be read. RD = Data read from location RA during read operation. PA = Address of the memory location to be programmed. Addresses latch on the falling edge of the WE# or CE# (or CE2#) pulse, whichever happens later. Password Password Protection Command Set Entry 3 AAA AA 555 55 AAA 60 Password Program (20)2 X X X A 0 PWA x PWD x Password Read (19)8

00 PWD

02 PWD

06 PWD

Password Unlock (19)1 1 00 25 00 03 00 PWD 0 01 PWD 1 02 PWD 2 03 PWD

04 PWD

Password Protection Command Set Exit (18, 23) 2 XXX 90 XXX 00 Non-Volatile Sector Protection Command Set Definitions PPB Nonvolatile Sector Protection Command Set Entry 3 AAA AA 55 55 AAA C0 PPB Program (24, 25)2 X X X A 0 S A 0 0 All PPB Erase 2 XXX 80 00 30 PPB Status Read (25)1 S A RD (0) Non-Volatile Sector Protection Command Set Exit (18) 2 XXX 90 XXX 00 Global Non-Volatile Sector Protection Freeze Command Set Definitions PPB Lock Bit Global Non-Volatile Sector Protection Freeze Command Set Entry 3 AAA AA 555 55 AAA 50 PPB Lock Bit Set (25) 2 XXX A0 XXX 00 PPB Lock Status Read (25)1 X X X RD (0) Global Non-Volatile Sector Protection Freeze Command Set Exit (18) 2 XXX 90 XXX 00 Volatile Sector Protection Command Set Definitions DYB Volatile Sector Protection Command Set Entry 3 AAA AA 555 55 AAA E0 DYB Set (24, 25)2 X X X A 0 S A 0 0 DYB Clear (25)2 X X X A 0 S A 0 1 DYB Status Read (25)1 S A RD (0) Volatile Sector Protection Command Set Exit (18) 2 XXX 90 XXX 00 T able 11. Command Definitions for Each S29GL512N, x8 (Sheet 2 of 2) Command (Notes) Cycles Bus Cycles (Notes 2, 3, 4, and 5) First Second Third Fourth Fifth Sixth Addr Data Addr Data Addr Data Addr Data Addr Data Addr Data

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 59 Advance Information PD = Data to be programmed at location PA. Data latches on the rising edge of the WE# or CE# (or CE2#) pulse, whichever happens first. SA = Address of the sector to be verified (in autoselect mode) or erased. Address bits Amax–A16 uniquely select any sector. WBL = Write Buffer Location. The address must be within the same write buffer page as PA. WC = Word Count is the number of write buffer locations to load minus 1. PWD = Password PWDx = Password word0, word1, word2, word3. word 4, word 5, word 6, and word 7. DATA = Lock Register Contents: PD(0) = Secured Silicon Sector Protection Bit, PD(1) = Persistent Protection Mode Lock Bit, PD(2) = Password Protection Mode Lock Bit. Notes: 1. See Table 1 on page 10 for description of bus operations. 2. All values are in hexadecimal. 3. Except for the read cycle, and the 4th, 5th, and 6th cycle of the autoselect command sequence, all bus cycles are write cycles. 4. Data bits DQ15-DQ8 are don't ca res for unlock and command cycles. 5. Address bits A MAX:A16 are don't cares for unlock and command cycles, unless SA or PA required. (AMAX is the Highest Address pin.). 6. No unlock or command cycles required when reading array data. 7. The Reset command is required to return to reading array data when device is in the autoselect mode, or if DQ5 goes high (while the device is providing status data). 8. The fourth, fifth, and sixth cycle of the autoselect command sequence is a read cycle. 9. The data is 00h for an unprotected se ctor and 01h for a protected sector. See Autoselect Command Sequence‚ on page 40 for more information. This is same as PPB Status Read except that the protect and unprotect statuses are inverted here. 10. The data value for DQ7 is 1 for a serialized and protected OTP region and 0 for an unserialized and unprotected Secured Silicon Sector region. See Secured Silicon Sector Flash Memory Region‚ on page 34 for more information. For S29GL- NH.: XX18h/18h = Not Factory Locked. XX98h/98h = Factory Locked. For S29GL-NL: XX08h/08h = Not Factory Locked. XX88h/88h = Factory Locked. 11. Command is valid when device is ready to read array data or when device is in autoselect mode. 12. The system may read and program/program suspend in non-erasing sectors, or enter the autoselect mode, when in the Erase Suspend mode. The Erase Suspend command is valid only during a sector erase operation. 13. The Erase Resume/Program Resume command is valid only during the Erase Suspend/Program Suspend modes. 14. Issue this command sequence to return to READ mode after detecting device is in a Write-to-Buffer-Abort state. NOTE: the full command sequence is required if resetting out of ABORT while using Unlock Bypass Mode. 15. S29GL512NH/L = 2223h/23h, 2201h/01h. 16. The Exit command returns the device to reading the array. 17. Note that the password portion can be entered or read in any order as long as the entire 64-bit password is entered or read. 18. For PWDx, only one portion of the password can be programmed per each A0 command. 19. The All PPB Erase command embeds programming of all PPB bits before erasure. 20. All Lock Register bits are one-time programmable. Note that the program state = 0 and the erase state = 1. Also note that of both the Persistent Protection Mode Lock Bit and the Password Protection Mode Lock Bit cannot be programmed at the same time or the Lock Register Bits Program operation aborts and returns the device to read mode. Lock Register bits that are reserved for future use defaults to 1's. The Lock Register is shipped out as FFFF's before Lock Register Bit program execution. 21. If any of the Entry command was initiated, an Exit command must be issued to reset the device into read mode. Otherwise the device hangs. 22. If ACC = V HH, sector protection matches when ACC = VIH 23. Protected State = 00h, Unprotected State = 01h.

60 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Write Operation Status The device provides several bits to dete rmine the status of a program or erase operation: DQ2, DQ3, DQ5, DQ6, and DQ7. Table 12 on page 65 and the follow- ing subsections describe the function of these bits. DQ7 and DQ6 each offer a method for determining whether a program or erase operation is complete or in progress. The device also provides a hardware-based output signal, RY/BY#, to determine whether an Embedded Program or Erase operation is in progress or is completed. Note that all Write Operation Status DQ bits are valid only after 4 µs delay. DQ7: Data# Polling The Data# Polling bit, DQ7, indicates to the host system whether an Embedded Program or Erase algorithm is in progress or completed, or whether the device is in Erase Suspend. Data# Polling is valid after the rising edge of the final WE# pulse in the command sequence. During the Embedded Program algorithm, the device outputs on DQ7 the com- plement of the datum progra mmed to DQ7. This DQ7 status also applies to programming during Erase Suspend. When the Embedded Program algorithm is complete, the device outputs the datum programmed to DQ7. The system must provide the program address to read valid status information on DQ7. If a pro- gram address falls within a protected sector, Data# Polling on DQ7 is active for approximately 1 µs, then the device returns to the read mode. During the Embedded Erase algorithm, Data# Polling produces a 0 on DQ7. When the Embedded Erase algorithm is complete, or if the device enters the Erase Sus- pend mode, Data# Polling produces a 1 on DQ7. The system must provide an address within any of the sectors selected for erasure to read valid status infor- mation on DQ7. After an erase command sequence is writte n, if all sectors selected for erasing are protected, Data# Polling on DQ7 is active for approximately 100 µs, then the device returns to the read mode. If not all selected sectors are protected, the Em- bedded Erase algorithm erases the unprotected sectors, and ignores the selected sectors that are protected. However, if the system reads DQ7 at an address within a protected sector, the status may not be valid. Just prior to the completion of an Em bedded Program or Erase operation, DQ7 may change asynchronously with DQ0–DQ6 while Output Enable (OE#) is as- serted low. That is, the device may change from providing status information to valid data on DQ7. Depending on when the system samples the DQ7 output, it may read the status or valid data. Even if the device completes the program or erase operation and DQ7 contains valid data, the data outputs on DQ0–DQ6 may be still invalid. Valid data on DQ0–DQ7 appears on successive read cycles. Table 12 on page 65 shows the outputs for Data# Polling on DQ7. Figure 5, on page 61 shows the Data# Polling algorithm. Figure 14, on page 73 shows the Data# Polling timing diagram.

1. VA = Valid address for programming. During a sector

address is any non-protected sector address.

1. DQ7 should be rechecked even if DQ5 = 1 because DQ7

may change simultaneously with DQ5. Figure 5. Data# Polling Algorithm mode. Table 12 on page 65 shows the outputs for RY/BY#.

62 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information DQ6: T oggle Bit I Toggle Bit I on DQ6 indicates whether an Embedded Program or Erase algorithm is in progress or complete, or whethe r the device entered the Erase Suspend mode. Toggle Bit I may be read at any address, and is valid after the rising edge of the final WE# pulse in the command sequence (prior to the program or erase operation), and during the sector erase time-out. During an Embedded Program or Erase algorithm operation, successive read cy- cles to any address cause DQ6 to toggle. The system may use either OE# or CE# (or CE2#) to control the read cycles. When the operation is complete, DQ6 stops toggling. After an erase command sequence is writte n, if all sectors selected for erasing are protected, DQ6 toggles for approxim ately 100 µs, then returns to reading array data. If not all sele cted sectors are protected, the Embedded Erase algo- rithm erases the unprotected sectors, and ignores the selected sectors that are protected. The system can use DQ6 and DQ2 together to determine whether a sector is ac- tively erasing or is erase-suspended. When the device is actively erasing (that is, the Embedded Erase algorithm is in progress), DQ6 toggles. When the device en- ters the Erase Suspend mode, DQ6 stops toggling. However, the system must also use DQ2 to determine which sectors are erasing or erase-suspended. Alter- natively, the system can use DQ7 (see the subsection on DQ7: Data# Polling). If a program address falls within a pr otected sector, DQ6 toggles for approxi- mately 1 µs after the program command se quence is written, then returns to reading array data. DQ6 also toggles during the erase-su spend-program mode, and stops toggling once the Embedded Program algorithm is complete. Table 12 on page 65 shows the outputs for Toggle Bit I on DQ6. Figure 6, on page 63 shows the toggle bit algorithm. Figure 18, on page 76 shows the toggle bit timing diagrams. Figure 19, on page 76 shows the differences between DQ2 and DQ6 in graphical form. See also the subsection on DQ2: Toggle Bit II.

Figure 6. T oggle Bit Algorithm edge of the final WE# pulse in the command sequence.

64 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information erasing or is erase-suspended. DQ6, by comparison, indicates whether the device is actively erasing, or is in Erase Suspend, but cannot distinguish which sectors are selected for erasure. Thus, both status bits are required for sector and mode information. Refer to Table 12 on page 65 to compare outputs for DQ2 and DQ6. Figure 6, on page 63 shows the toggle bit algorithm in flowchart form, and the section DQ2: Toggle Bit II explains the algorithm. See also the RY/BY#: Ready/ Busy# subsection. Figure 18, on page 76 shows the toggle bit timing diagram. Figure 19, on page 76 shows the differences between DQ2 and DQ6 in graphical form. Reading T oggle Bits DQ6/DQ2 Refer to Figure 6, on page 63 and Figure 19, on page 76 for the following discus- sion. Whenever the system initially begins reading toggle bit status, it must read DQ7–DQ0 at least twice in a row to dete rmine whether a toggle bit is toggling. Typically, the system would note and store the value of the toggle bit after the first read. After the second read, the system would compare the new value of the toggle bit with the first. If the toggle bit is not toggling, the device has completed the program or erase operation. The system can read array data on DQ7–DQ0 on the following read cycle. However, if after the initial two read cycles, the system determines that the toggle bit is still toggling, the system also should note whether the value of DQ5 is high (see the section on DQ5). If it is, th e system should then determine again whether the toggle bit is toggling, since the toggle bit may have stopped toggling just as DQ5 went high. If the toggle bit is no longer toggling, the device success- fully completed the program or erase operation. If it is still toggling, the device did not completed the operation successfully, and the system must write the reset command to return to reading array data. The remaining scenario is that the system initially determines that the toggle bit is toggling and DQ5 did not go high. The system may continue to monitor the tog- gle bit and DQ5 through successive read cycles, determining the status as described in the previous paragraph. Alte rnatively, it may choose to perform other system tasks. In this case, the system must start at the beginning of the algorithm when it returns to determine the status of the operation (top of Figure 6, on page 63). DQ5: Exceeded Timing Limits DQ5 indicates whether the program, erase, or write-to-buffer time exceeded a specified internal pulse count limit. Under these conditions DQ5 produces a 1, in- dicating that the program or erase cycle was not successfully completed. The device may output a 1 on DQ5 if the system tries to program a 1 to a location that was previously programmed to 0. Only an erase operation can change a 0 back to a 1. Under this condition, the device halts the operation, and when the timing limit is exceeded, DQ5 produces a 1. In all these cases, the system must write the reset command to return the device to the reading the array (or to erase-suspend-read if the device was previously in the erase-suspend-program mode). DQ3: Sector Erase Timer After writing a sector erase command sequence, the system may read DQ3 to de- termine whether or not erasure began. (The sector erase timer does not apply to the chip erase command.) If additional sectors are selected for erasure, the entire

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 65 Advance Information time-out also applies afte r each additional sector erase command. When the time-out period is complete, DQ3 switches from a 0 to a 1. If the time between additional sector erase commands from th e system can be assumed to be less than 50 µs, the system need not monitor DQ3. See also Sector Erase Command Sequence‚ on page 47. After the sector erase command is written, the system should read the status of DQ7 (Data# Polling) or DQ6 (Toggle Bit I) to ensure that the device accepted the command sequence, and then read DQ3. If DQ3 is 1, the Embedded Erase algo- rithm started; all further commands (except Erase Suspend) are ignored until the erase operation is complete. If DQ3 is 0, the device accepts additional sector erase commands. To ensure the command is accepted, the system software should check the status of DQ3 prior to and following each subsequent sector erase command. If DQ3 is high on the se cond status check, the last command might not have been accepted. Table 12 on page 65 shows the status of DQ3 relative to the other status bits. DQ1: Write-to-Buffer Abort DQ1 indicates whether a Write-to-Buffe r operation was aborted. Under these conditions DQ1 produces a 1. The system must issue the Write-to-Buffer-Abort- Reset command sequence to return the device to reading array data. See Write Buffer‚ on page 11 for more details. Ta bl e 1 2 . Write Operation Status Notes: 1. DQ5 switches to 1 when an Embedded Program, Embedded Erase, or Write-to-Buffer operation exceeds the maximum timing limits. Refer to the section on DQ5 for more information. 2. DQ7 and DQ2 require a valid address when reading status in formation. Refer to the appropriate subsection for further details. 3. The Data# Polling algorithm should be used to moni tor the last loaded write-buffer address location. 4. DQ1 switches to 1 when the device aborts the write-to-buffer operation. Status DQ7 (Note 2)D Q 6 DQ5 (Note 1)D Q 3 DQ2 (Note 2)D Q 1 RY/ BY# Standard Mode Embedded Program Algorithm DQ7# Toggle 0 N/A No toggle 0 0 Embedded Erase Algorithm 0 Toggle 0 1 Toggle N/A 0 Program Suspend Mode Program- Suspend Read Program-Suspended Sector Invalid (not allowed) 1 Non-Program Suspended Sector Data 1 Erase Suspend Mode Erase- Suspend Read Erase-Suspended Sector 1 No toggle 0 N/A Toggle N/A 1 Non-Erase Suspended Sector Data 1 Erase-Suspend-Program (Embedded Program) DQ7# Toggle 0 N/A N/A N/A 0 Write-to- Buffer Busy (Note 3) DQ7# Toggle 0 N/A N/A 0 0 Abort (Note 4) DQ7# Toggle 0 N/A N/A 1 0

66 S70GL01GN00 MirrorBit

1. Minimum DC voltage on input or I/Os is –0.5 V. During voltage transitions, inputs or I/

Os may overshoot VSS to –2.0 V for periods of up to 20 ns. See Figure 7, on page 66.

1. Minimum DC input voltage on pins A9, OE#, and ACC is –0.5 V. During voltage

transitions, A9, OE#, and ACC may overshoot VSS to –2.0 V for periods of up to 20 ns. V which may overshoot to +14.0V for periods up to 20 ns.

1. No more than one output may be shorted to ground at a time. Duration of the short

circuit should not be greater than one second.

1. Stresses above those listed under Absolute Maximum Ratings may cause permanent

for extended periods may affect device reliability.

1. Operating ranges define those lim its between which the functionality of the device is guaranteed.

Figure 7. Maximum Negative

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 67 Advance Information DC Characteristics CMOS Compatible for Each S29GL512N Notes: 1. The I CC current listed is typically less than 2 mA/MHz, with OE# at VIH. 2. I CC active while Embedded Erase or Embedded Program or Write Buffer Programming is in progress. 3. Not 100% tested. 4. Automatic sleep mode enables the lower powe r mode when addresses remain stable tor t ACC + 30 ns. 6. V CC = 3 V. 7. CE# can be replaced with CE2# when re ferring to the second die in the package. Parameter Symbol Parameter Description (Notes) Test Conditions Min Typ Max Unit ILI Input Load Current (Note 1) VIN = VSS to VCC, VCC = VCC max WP/ACC: ±2.0 µA Others: ±1.0 ILIT A9 Input Load Current V CC = VCC max; A9 = 12.5 V 35 µA ILO Output Leakage Current VOUT = VSS to VCC, VCC = VCC max ±1.0 µA ICC1 VCC Active Read Current (Note 1, and Note 7) CE# = VIL, OE# = VIH, VCC = VCCmax, f = 1 MHz, Byte Mode 62 0 mACE# = VIL, OE# = VIH, VCC = VCCmax, f = 5 MHz, Word Mode 30 50 CE# = VIL, OE# = VIH, VCC = VCCmax, f = 10 MHz 60 90 ICC2 VCC Intra-Page Read Current (Note 1, and Note 7) CE# = VIL, OE# = VIH, VCC = VCCmax f = 10 MHz 11 0 mA CE# = VIL, OE# = VIH, VCC = VCCmax, f=33 MHz 52 0 ICC3 VCC Active Erase/Program Current (Note 2, Note 3, Note 7) CE# = VIL, OE# = VIH, VCC = VCCmax 50 90 mA ICC4 VCC Standby Current (Note 7) CE#, RESET# = VSS ± 0.3 V, OE# = VIH, VCC = VCCmax VIL = VSS + 0.3 V/- 0.1V VIO = VCC 15 µ A ICC5 VCC Reset Current VCC = VCCmax; VIL = VSS + 0.3 V/-0.1V, RESET# = VSS ± 0.3 V VIO = VCC 15 µ A ICC6 Automatic Sleep Mode (Note 4) VCC = VCCmax VIH = VCC ± 0.3 V, VIL = VSS + 0.3 V/-0.1V, WP#/ACC = VIH VIO = VCC 15 µ A IACC ACC Accelerated Program Current (Note CE# = VIL, OE# = VIH, VCC = VCCmax, WP#/ACC = VIH WP#/ACC pin 10 20 mA VCC pin 50 90 VIL Input Low Voltage (Note 5) –0.1 0.3 x V IO V VIH Input High Voltage (Note 5)0 . 7 x V IO VIO + 0.3 V VHH Voltage for ACC Erase/Program Acceleration VCC = 2.7 –3.6 V 11.5 12.5 V VID Voltage for Autoselect and Temporary Sector Unprotect VCC = 2.7 –3.6 V 11.5 12.5 V VOL Output Low Voltage (Note 5)I OL = 100 µA 0.15 x V IO V VOH Output High Voltage (Note 5)I OH = -100 µA 0.85 x V IO V VLKO Low VCC Lock-Out Voltage (Note 3)2 . 3 2 . 5 V

68 S70GL01GN00 MirrorBit

1. If V IO < VCC, the reference level is 0.5 VIO.
2. Diodes are IN3064 or equivalent

Figure 9. T est Setup Note: If VIO < VCC, the input measurement reference level is 0.5 VIO. Figure 10. Input Waveforms and Measurement Levels

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 69 Advance Information AC Characteristics Read-Only Operations for Each S29GL512N Notes: 1. Not 100% tested. 2. CE# (CE2#), OE# = V IL 3. OE# = V IL 4. See Figure 9, on page 68 and Table 13 on page 68 for test specifications. 5. Unless otherwise indicated, AC specificatio ns 110 ns speed options are tested with VIO = VCC = 3 V. 6. CE# can be replaced with CE2# when re ferring to the second die in the package. Parameter Description (Note 6) Test Setup Speed Options JEDEC Std. 110 Unit tAVAV tRC Read Cycle Time VIO = VCC = 3 V Min 110 ns tAVQV tACC Address to Output Delay (Note 2) Max 110 tELQV tCE Chip Enable to Output Delay (Note 3) Max 110 tPACC Page Access Time Max 25 tGLQV tOE Output Enable to Output Delay Max 35 nstEHQZ tDF Chip Enable to Output High Z (Note 1) Max 20 tGHQZ tDF Output Enable to Output High Z (Note 1) Max 20 tAXQX tOH Output Hold Time From Addresses, CE# or OE#, Whichever Occurs First Min 0 nstOEH Output Enable Hold Time (Note 1) Read Min 0 Toggle and Data# Polling Min 10 tCEH Chip Enable Hold Time Read Min 35

70 S70GL01GN00 MirrorBit

Note: Figure shows word mode. Addresses are A2–A-1 for byte mode. Figure 12. Page Read Timings Figure 11. Read Operation Timings

0 VRY/BY#

1. Not 100% tested. If ramp rate is equal to or faster than 1V/100µs with a falling edge of the RESET# pin initiated, the

RESET# pin needs to be held low only for 100µs for power-up. Description Speed UnitJEDEC Std. Figure 13. Reset Timings

72 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information AC Characteristics Erase and Program Operations for Each S29GL512N Notes: 1. Not 100% tested. 2. See the Erase And Programming Performance‚ on page 79 for more information. 3. For 1–16 words/1–32 bytes programmed. 4. Effective write buffer specification is based upon a 16-word/32-byte write buffer operation. 5. Unless otherwise indicated, AC specifications the 110 ns speed options are tested with VIO = VCC = 3 V. 6. CE# can be replaced with CE2# when re ferring to the second die in the package. Parameter Description Speed Options JEDEC Std. (Note 6) 110 Unit tAVAV tWC Write Cycle Time (Note 1) Min 110 ns tAVWL tAS Address Setup Time Min 0 ns tASO Address Setup Time to OE# low during toggle bit polling Min 15 ns tWLAX tAH Address Hold Time Min 45 ns tAHT Address Hold Time From CE# or OE# high during toggle bit polling Min 0 ns tDVWH tDS Data Setup Time Min 45 ns tWHDX tDH Data Hold Time Min 0 ns tCEPH CE# High during toggle bit polling Min 20 tOEPH Output Enable High during toggle bit polling Min 20 ns tGHWL tGHWL Read Recovery Time Before Write (OE# High to WE# Low) Min 0 ns tELWL tCS CE# Setup Time Min 0 ns tWHEH tCH CE# Hold Time Min 0 ns tWLWH tWP Write Pulse Width Min 35 ns tWHDL tWPH Write Pulse Width High Min 30 ns tWHWH1 tWHWH1 Write Buffer Program Operation (Note 2, and Note 3) Typ 240 µs Effective Write Buffer Program Operation (Note 2, and Note 4) Per Word Typ µs Accelerated Effective Write Buffer Program Operation (Note 2, and Note 4) Per Word Typ µs 13.5 Program Operation (Note 2)W o r d T y p µ s Accelerated Programming Operation (Note 2)W o r d T y p µ s tWHWH2 tWHWH2 Sector Erase Operation (Note 2)T y p 0 . 5 s e c tVHH VHH Rise and Fall Time (Note 1) Min 250 ns tVCS VCC Setup Time (Note 1)M i n 5 0 µ s tBUSY Erase/Program Valid to RY/BY# Delay Min 90 ns

74 S70GL01GN00 MirrorBit

1. SA = sector address (for Sector Erase), VA = Valid Address for reading status data (see Write Operation Status‚ on page 60”.
2. These waveforms are for the word mode.

Figure 16. Chip/Sector Erase Operation Timings

Figure 17. Data# Polling Timings

1. VA = Valid address. Illustration shows fi rst status cycle after command sequence, last status read cycle, and array data
2. t OE for data polling is 35 ns when VIO = 2.7 to 3.6 V

76 S70GL01GN00 MirrorBit

Figure 18. T oggle Bit Timings (During Embedded Algorithms) Figure 19. DQ2 vs. DQ6

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 77 Advance Information AC Characteristics Alternate CE# Controlled Erase and Program Operations for Each S29GL512N Notes: 1. Not 100% tested. 2. See AC Characteristics‚ on page 69 for more information. 3. For 1–16 words/1–32 bytes programmed. 4. Effective write buffer specification is based upon a 16-word/32-byte write buffer operation. 5. Unless otherwise indicated, AC specifications for the 110 ns speed options are tested with VIO = VCC = 3 V. 6. CE# can be replaced with CE2# when re ferring to the second die in the package. Parameter Description Speed Options JEDEC Std. (Note 6) 110 Unit tAVAV tWC Write Cycle Time (Note 1) Min 110 ns tAVWL tAS Address Setup Time 0 TASO Address Setup Time to OE# low during toggle bit polling 15 tELAX tAH Address Hold Time 45 tAHT Address Hold Time From CE# or OE# high during toggle bit polling 0 tDVEH tDS Data Setup Time 45 tEHDX tDH Data Hold Time 0 tCEPH CE# High during toggle bit polling tOEPH OE# High during toggle bit polling tGHEL tGHEL Read Recovery Time Before Write (OE# High to WE# Low) 0tWLEL tWS WE# Setup Time tEHWH tWH WE# Hold Time tELEH tCP CE# Pulse Width 35 tEHEL tCPH CE# Pulse Width High 30 tWHWH1 tWHWH1 Write Buffer Program Operation (Note 2, and Note 3) Typ 240 µs Effective Write Buffer Program Operation (Note 2, and 4) Per Word Effective Accelerated Write Buffer Program Operation (Notes 2, 4) 13.5 Program Operation (Note 2) Word Accelerated Programming Operation (Note 2) 54 tWHWH2 tWHWH2 Sector Erase Operation (Note 2) 0.5 sec

78 S70GL01GN00 MirrorBit

1. Figure indicates last two bus cycles of a program or erase operation.
2. PA = program address, SA = sector address, PD = program data.
3. DQ7# is the complement of th e data written to the device. D

OUT is the data written to the device.

1. Waveforms are for the word mode.

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 79 Advance Information Erase And Programming Performance Notes: 1. Typical program and erase times assume the following conditions: 25°C, 3.0 V VCC, 10,000 cycles, checkerboard pattern. 2. Under worst case conditions of 90°C, V CC = 3.0 V, 100,000 cycles. 3. Effective write buffer spec ification is based upon a 16-word write buffer operation. 4. The typical chip programming time is considerably less than the maximum chip programming time listed, since most words program faster than the maximum program times listed. 5. In the pre-programming step of the Embedded Erase algorithm, all bits are programmed to 00h before erasure. 6. System-level overhead is the time required to execute the two- or four-bus-cycle sequence for the program command. See Table 10 on page 54 and Table 11 on page 57 for further information on command definitions. TSOP Pin and BGA Package Capacitance Notes: 1. Sampled, not 100% tested. 2. Test conditions T A = 25°C, f = 1.0 MHz. Parameter for Each S29GL512N Typ (Note 1) Max (Note 2) Unit Comments Sector Erase Time 0.5 3.5 sec Excludes 00h programming prior to erasure (Note 5)Chip Erase Time S29GL512N 256 1024 sec Total Write Buffer Programming Time (Note 3) 240 µs Excludes system level overhead (Note 6)Total Accelerated Effective Write Buffer Programming Time (Note 3) 200 µs Chip Program Time S29GL512N 492 sec Parameter Symbol Parameter Description Test Setup Typ Max Unit CIN Input Capacitance V IN = 0 BGA 4.2 5.0 pF COUT Output Capacitance V OUT = 0 BGA 5.4 6.5 pF CIN2 Control Pin Capacitance V IN = 0 BGA 3.9 4.7 pF

80 S70GL01GN00 MirrorBit

Flash S70GL01GN00_00_A1 June 1, 2005 Advance Information Physical Dimensions LSE 064—64-Ball Fortified Ball Grid Array (FBGA) DIRECTION LSE

June 1, 2005 S70GL01GN00_00_A1 S70GL01GN00 MirrorBit TM Flash 81 Advance Information Revision Summary Revision A0 (April 29, 2005) Initial Release. Revision A1 (June 1, 2005) Connection Diagrams Updated ball descriptions for A5, B5, A4, and B4 Updated Package Materials Set to include lead (Pb)-free option Valid Combinations table Added lead (Pb)-free option Colophon The products described in this document are designed, developed and manufactured as contemplated for general use, including without limitation, ordinary industrial use, general office use, personal use, and household use, but are not designed, developed and manufactured as contemplated (1) for any use that includes fatal risks or dangers that, unless extremely high safety is secured, could have a serious effect to the public, and could lead directly to death, personal injury, severe physical damage or other loss (i.e., nuclear reaction control in nuclear facility, aircraft flight control, air traffic control, mass transport control, medical life support system, missile launch control in weapon system), or (2) for any use where chance of failure is intolerable (i.e., submersible repeater and artificial satellite). Please note that Spansion will not be liable to you and/or any third party for any claims or damages arising in connection with above-men- tioned uses of the products. Any semiconductor devices have an inherent chance of failure. Y ou must protect against injury, damage or loss from such failures by incorporating safety design measures into your facility and equipment such as redundancy, fire protection, and prevention of over-current levels and other abnormal operating conditions. If any products described in this document represent goods or technologies subject to certain restrictions on export under the Foreign Exchange and Foreign Trade Law of Japan, the US Export Administration Regulations or the applicable laws of any other country, the prior au- thorization by the respective government entity will be required for export of those products. Trademarks and Notice The contents of this document are subject to change without notice. This document may contain information on a Spansion LLC product under development by Spansion LLC. Spansion LLC reserves the right to change or discontinue work on any product without notice. The information in this document is provided as is without warranty or guarantee of any kind as to its accuracy, completeness, operability, fitness for particular purpose, merchantability, non-infringement of third-party rights, or any other warranty, express, implied, or statutory. Spansion LLC assumes no liability for any damages of any kind arising out of the use of the information in this document. Copyright ©2004-2005 Spansion LLC. All rights reserved. Spansion, the Spansion logo, and MirrorBit are trademarks of Spansion LLC. Other company and product names used in this publication are for identification purposes only and may be trademarks of their respective companies.