View M28R400C-ZBU_1865746.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1/48 june 2004 m28r400ct m28r400cb 4 mbit (256kb x16, boot block) 1.8v supply flash memory features summary supply voltage ?v dd = 1.65v to 2.2v core power supply ?v ddq = 1.65v to 2.2v for input/output ?v pp = 12v for fast program (optional) access times: 90ns, 120ns programming time ? 10s typical ? double word programming option common flash interface ? 64 bit security code memory blocks ? parameter blocks (top or bottom location) ? main blocks block locking ? all blocks locked at power up ? any combination of blocks can be locked ?wp for block lock-down security ? 64 bit user programmable otp cells ? 64 bit unique device identifier ? one parameter block permanently lockable automatic stand-by mode program and erase suspend 100,000 program/erase cycles per block electronic signature ? manufacturer code: 20h ? top device code, m28r400ct: 882ah ? bottom device code, m28r400cb: 882bh figure 1. package fbga tfbga46 (zb) 6.39 x 6.37mm
m28r400ct, m28r400cb 2/48 table of contents features summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 figure 1. package. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 summary description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 figure 2. logic diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 table 1. signal names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 figure 3. tfbga connections (top view through package) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 figure 4. block addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 figure 5. security block memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 address inputs (a0-a17). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 data input/output (dq0-dq15). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 chip enable (e ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 output enable (g ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 write enable (w ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 write protect (wp ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 reset (rp ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 v dd supply voltage (1.65v to 2.2v) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 v ddq supply voltage (1.65v to 2.2v). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 v pp program supply voltage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 v ss ground. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 bus operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 output disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 standby. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 automatic standby. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 reset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 table 2. bus operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 command interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 read memory array command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 read status register command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 read electronic signature command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 read cfi query command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 block erase command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 chip erase command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 program command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 double word program command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 clear status register command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 program/erase suspend command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3/48 m28r400ct, m28r400cb program/erase resume command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 protection register program command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 block lock command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 block unlock command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 block lock-down command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 table 3. commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 table 4. read electronic signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 table 5. read block lock signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 4 table 6. read protection register and lock register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 table 7. program, erase times and program/erase endurance cycles . . . . . . . . . . . . . . . . . . . 14 block locking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 reading a block?s lock status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 locked state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 unlocked state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 lock-down state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 locking operations during erase suspend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 table 8. block lock status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 table 9. protection status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 status register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 program/erase controller status (bit 7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 erase suspend status (bit 6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 erase status (bit 5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 program status (bit 4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 v pp status (bit 3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 program suspend status (bit 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 block protection status (bit 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 reserved (bit 0). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 table 10. status register bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 maximum rating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 table 11. absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 9 dc and ac parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 table 12. operating and ac measurement conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 figure 6. ac measurement i/o waveform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 figure 7. ac measurement load circuit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 table 13. capacitance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 table 14. dc characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 figure 8. read ac waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 table 15. read ac characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 figure 9. write ac waveforms, write enable controlled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 table 16. write ac characteristics, write enable controlled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 figure 10.write ac waveforms, chip enable controlled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 table 17. write ac characteristics, chip enable controlled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
m28r400ct, m28r400cb 4/48 figure 11.power-up and reset ac waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 table 18. power-up and reset ac characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 package mechanical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 figure 12.tfbga46 6.39x6.37mm - 8x6 ball array, 0.75 mm pitch, bottom view package outline28 table 19. tfbga46 6.39x6.37mm - 8x6 ball array, 0.75 mm pitch, package mechanical data. . . 28 figure 13.tfbga46 daisy chain - package connections (top view through package) . . . . . . . . 29 figure 14.tfbga46 daisy chain - pcb connections proposal (top view through package) . . . . 29 part numbering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 table 20. ordering information scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 0 table 21. daisy chain ordering scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 appendix a.block address tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 table 22. top boot block addresses, m28r400ct . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 table 23. bottom boot block addresses, m28r400cb. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 appendix b.common flash interface (cfi) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 table 24. query structure overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 table 25. cfi query identification string. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 table 26. cfi query system interface information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 table 27. device geometry definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 table 28. primary algorithm-specific extended query table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 table 29. security code area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 appendix c.flowcharts and pseudo codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 figure 15.program flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 figure 16.double word program flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 figure 17.program suspend & resume flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . 39 figure 18.block erase flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 figure 19.erase suspend & resume flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . . . 41 figure 20.locking operations flowchart and pseudo code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 figure 21.protection register program flowchart and pseudo code. . . . . . . . . . . . . . . . . . . . . . . 43 appendix d.command interface and program/e rase controller state. . . . . . . . 44 table 30. write state machine current/next, sheet 1 of 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 table 31. write state machine current/next, sheet 2 of 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 table 32. document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5/48 m28r400ct, m28r400cb summary description the m28r400c is a 4 mbit (256kbit x 16) non-vol- atile flash memory that can be erased electrically at the block level and programmed in-system on a word-by-word basis. these operations can be performed using a single low voltage (1.65 to 2.2v) supply. v ddq allows to drive the i/o pin down to 1.65v. an optional 12v v pp power supply is provided to speed up customer programming. the device features an asymmetrical blocked ar- chitecture. the m28r400c has an array of 15 blocks: 8 parameter blocks of 4 kword and 7 main blocks of 32 kword. m28r400ct has the parameter blocks at the top of the memory ad- dress space while the m28r400cb locates the parameter blocks starting from the bottom. the memory maps are shown in figure 4., block ad- dresses . the m28r400c features an instant, individual block locking scheme that allows any block to be locked or unlocked with no latency, enabling in- stant code and data protection. all blocks have three levels of protection. they can be locked and locked-down individually preventing any acciden- tal programming or erasure. there is an additional hardware protection against program and block erase. when v pp v pplk all blocks are protected against program or block erase. all blocks are locked at power-up. each block can be erased separately. erase can be suspended in order to perform either read or program in any other block and then resumed. program can be suspended to read data in any other block and then resumed. each block can be programmed and erased over 100,000 cycles. the device includes a 128 bit protection register and a security block to increase the protection of a system design. the protection register is divid- ed into two 64 bit segments, the first one contains a unique device number written by st, while the second one is one-time-programmable by the us- er. the user programmable segment can be per- manently protected. the security block, parameter block 0, can be permanently protected by the user. figure 5. , shows the security block memory map. program and erase commands are written to the command interface of the memory. an on-chip program/erase controller takes care of the tim- ings necessary for program and erase operations. the end of a program or erase operation can be detected and any error conditions identified. the command set required to control the memory is consistent with jedec standards. the memory is offered in a tfbga46 (0.75mm pitch) package and is supplied with all the bits erased (set to ?1?). figure 2. logic diagram table 1. signal names a0-a17 address inputs dq0-dq15 data input/output e chip enable g output enable w write enable rp reset wp write protect v dd core power supply v ddq power supply for input/output v pp optional supply voltage for fast program & erase v ss ground nc not connected internally ai04392 18 a0-a17 w dq0-dq15 v dd m28r400ct m28r400cb e v ss 16 g rp wp v ddq v pp
m28r400ct, m28r400cb 6/48 figure 3. tfbga connections (top view through package) ai04142 c b a 8 7 6 5 4 3 2 1 e d f a4 a7 v pp a8 a11 a13 a0 e dq8 dq5 dq14 a16 v ss dq0 dq9 dq3 dq6 dq15 v ddq dq1 dq10 v dd dq7 v ss dq2 a2 a5 a17 w a10 a14 a1 a3 a6 a9 a12 a15 rp nc dq4 dq13 g dq12 dq11 wp nc
7/48 m28r400ct, m28r400cb figure 4. block addresses note: also see appendix a. , tables 22 and 23 for a full listing of the block addresses. figure 5. security block memory map ai04393 4 kwords 3ffff 3f000 32 kwords 0ffff 08000 32 kwords 07fff 00000 m28r400ct top boot block addresses 4 kwords 38fff 38000 32 kwords 30000 37fff total of 8 4 kword blocks total of 7 32 kword blocks 4 kwords 3ffff 38000 32 kwords 32 kwords 00fff 00000 m28r400cb bottom boot block addresses 4 kwords 37fff 0ffff 32 kwords 30000 08000 total of 7 32 kword blocks total of 8 4 kword blocks 07fff 07000 ai03523 parameter block # 0 user programmable otp unique device number protection register lock 2 1 0 88h 85h 84h 81h 80h
m28r400ct, m28r400cb 8/48 signal descriptions see figure 2., logic diagram and table 1., signal names , for a brief overview of the signals connect- ed to this device. address inputs (a0-a17). the address inputs select the cells in the memory array to access dur- ing bus read operations. during bus write opera- tions they control the commands sent to the command interface of the internal state machine. data input/output (dq0-dq15). the data i/o outputs the data stored at the selected address during a bus read operation or inputs a command or the data to be programmed during a write bus operation. chip enable (e ). the chip enable input acti- vates the memory control logic, input buffers, de- coders and sense amplifiers. when chip enable is at v il and reset is at v ih the device is in active mode. when chip enable is at v ih the memory is deselected, the outputs are high impedance and the power consumption is reduced to the stand-by level. output enable (g ). the output enable controls data outputs during the bus read operation of the memory. write enable (w ). the write enable controls the bus write operation of the memory?s command interface. the data and address inputs are latched on the rising edge of chip enable, e, or write en- able, w , whichever occurs first. write protect (wp ). write protect is an input that gives an additional hardware protection for each block. when write protect is at v il , the lock- down is enabled and the protection status of the block cannot be changed. when write protect is at v ih , the lock-down is disabled and the block can be locked or unlocked. (refer to table 6., read protection register and lock register ). reset (rp ). the reset input provides a hard- ware reset of the memory. when reset is at v il , the memory is in reset mode: the outputs are high impedance and the current consumption is mini- mized. after reset all blocks are in the locked state. when reset is at v ih , the device is in normal operation. exiting reset mode the device enters read array mode, but a negative transition of chip enable or a change of the address is required to ensure valid data outputs. v dd supply voltage (1.65v to 2.2v). v dd provides the power supply to the internal core of the memory device. it is the main power supply for all operations (read, program and erase). v ddq supply voltage (1.65v to 2.2v). v ddq provides the power supply to the i/o pins and en- ables all outputs to be powered independently from v dd . v ddq can be tied to v dd or can use a separate supply. v pp program supply voltage. v pp is both a control input and a power supply pin. the two functions are selected by the voltage range ap- plied to the pin. the supply voltage v dd and the program supply voltage v pp can be applied in any order. if v pp is kept in a low voltage range (0v to 3.6v) v pp is seen as a control input. in this case a volt- age lower than v pplk gives protection against pro- gram or block erase, while v pp > v pp1 enables these functions (see table 14., dc characteris- tics , for the relevant values). v pp is only sampled at the beginning of a program or block erase; a change in its value after the operation has started does not have any effect and program or erase op- erations continue. if v pp is in the range 11.4v to 12.6v it acts as a power supply pin. in this condition v pp must be stable until the program/erase algorithm is com- pleted (see table 16 and 17 ). v ss ground. v ss is the reference for all voltage measurements. note: each device in a system should have v dd , v ddq and v pp decoupled with a 0.1f ca- pacitor close to the pin. see figure 7., ac mea- surement load circuit . the pcb track widths should be sufficient to carry the required v pp program and erase currents.
9/48 m28r400ct, m28r400cb bus operations there are six standard bus operations that control the device. these are bus read, bus write, out- put disable, standby, automatic standby and re- set. see table 2., bus operations , for a summary. typically glitches of less than 5ns on chip enable or write enable are ignored by the memory and do not affect bus operations. read. read bus operations are used to output the contents of the memory array, the electronic signature, the status register and the common flash interface. both chip enable and output en- able must be at v il in order to perform a read op- eration. the chip enable input should be used to enable the device. output enable should be used to gate data onto the output. the data read de- pends on the previous command written to the memory (see command interface section). see figure 8., read ac waveforms , , and table 15., read ac characteristics , for details of when the output becomes valid. read mode is the default state of the device when exiting reset or after power-up. write. bus write operations write commands to the memory or latch input data to be programmed. a write operation is initiated when chip enable and write enable are at v il with output enable at v ih . commands, input data and addresses are latched on the rising edge of write enable or chip enable, whichever occurs first. see figures 9 and 10 , write ac waveforms, and tables 16 and 17 , write ac characteristics, for details of the timing requirements. output disable. the data outputs are high im- pedance when the output enable is at v ih . standby. standby disables most of the internal circuitry allowing a substantial reduction of the cur- rent consumption. the memory is in stand-by when chip enable is at v ih and the device is in read mode. the power consumption is reduced to the stand-by level and the outputs are set to high impedance, independently from the output enable or write enable inputs. if chip enable switches to v ih during a program or erase operation, the de- vice enters standby mode when finished. automatic standby. automatic standby pro- vides a low power consumption state during read mode. following a read operation, the device en- ters automatic standby after 150ns of bus inactiv- ity even if chip enable is low, v il , and the supply current is reduced to i dd1 . the data inputs/out- puts will still output data if a bus read operation is in progress. reset. during reset mode when output enable is low, v il , the memory is deselected and the out- puts are high impedance. the memory is in reset mode when reset is at v il . the power consump- tion is reduced to the standby level, independently from the chip enable, output enable or write en- able inputs. if reset is pulled to v ss during a pro- gram or erase, this operation is aborted and the memory content is no longer valid. table 2. bus operations note: x = v il or v ih , v pph = 12v 5%. operation e g w rp wp v pp dq0-dq15 bus read v il v il v ih v ih x don't care data output bus write v il v ih v il v ih x v dd or v pph data input output disable v il v ih v ih v ih x don't care hi-z standby v ih xx v ih x don't care hi-z reset x x x v il x don't care hi-z
m28r400ct, m28r400cb 10/48 command interface all bus write operations to the memory are inter- preted by the command interface. commands consist of one or more sequential bus write oper- ations. an internal program/erase controller han- dles all timings and verifies the correct execution of the program and erase commands. the pro- gram/erase controller provides a status register whose output may be read at any time during, to monitor the progress of the operation, or the pro- gram/erase states. see appendix d. , table 30., write state machine current/next, sheet 1 of 2. , for a summary of the command interface. the command interface is reset to read mode when power is first applied, when exiting from re- set or whenever v dd is lower than v lko . com- mand sequences must be followed exactly. any invalid combination of commands will reset the de- vice to read mode. refer to table 3., commands , in conjunction with the text descriptions below. read memory array command the read command returns the memory to its read mode. one bus write cycle is required to is- sue the read memory array command and return the memory to read mode. subsequent read op- erations will read the addressed location and out- put the data. when a device reset occurs, the memory defaults to read mode. read status register command the status register indicates when a program or erase operation is complete and the success or failure of the operation itself. issue a read status register command to read the status register?s contents. subsequent bus read operations read the status register at any address, until another command is issued. see table 10., status regis- ter bits , for details on the definitions of the bits. the read status register command may be is- sued at any time, even during a program/erase operation. any read attempt during a program/ erase operation will automatically output the con- tent of the status register. read electronic signature command the read electronic signature command reads the manufacturer and device codes and the block locking status, or the protection register. the read electronic signature command consists of one write cycle, a subsequent read will output the manufacturer code, the device code, the block lock and lock-down status, or the protec- tion and lock register. see tables 4 , 5 and 6 for the valid address. read cfi query command the read query command is used to read data from the common flash interface (cfi) memory area, allowing programming equipment or appli- cations to automatically match their interface to the characteristics of the device. one bus write cycle is required to issue the read query com- mand. once the command is issued subsequent bus read operations read from the common flash interface memory area. see appendix b., common flash interface (cfi) , tables 24 , 25 , 26 , 27 , 28 and 29 for details on the information contained in the common flash interface memory area. block erase command the block erase command can be used to erase a block. it sets all the bits within the selected block to ?1?. all previous data in the block is lost. if the block is protected then the erase operation will abort, the data in the block will not be changed and the status register will output the error. two bus write cycles are required to issue the command. the first bus cycle sets up the erase command. the second latches the block address in the internal state machine and starts the program/ erase controller. if the second bus cycle is not write erase confirm (d0h), status register bits b4 and b5 are set and the command aborts. erase aborts if reset turns to v il . as data integrity cannot be guaranteed when the erase operation is aborted, the block must be erased again. during erase operations the memory will accept the read status register command and the pro- gram/erase suspend command, all other com- mands will be ignored. typical erase times are given in table 7., program, erase times and pro- gram/erase endurance cycles . see appendix c. , figure 18., block erase flow- chart and pseudo code , for a suggested flowchart for using the block erase command. chip erase command the chip erase command can be used to erase the entire chip. it sets all of the bits in unprotected blocks of the memory to ?1?. all previous data is lost. two bus write operations are required to is- sue the chip erase command. the first bus cycle sets up the chip erase command. the second confirms the chip erase command and starts the program/erase controller. the command can be issued to any address. if any blocks are protected then these are ignored and all the other blocks are erased. if all of the blocks are protected the chip erase operation ap-
11/48 m28r400ct, m28r400cb pears to start but will terminate, leaving the data unchanged. no error condition is given when pro- tected blocks are ignored. during the erase operation the memory will only accept the read status register command. all other commands will be ignored, including the erase suspend command. it is not possible to is- sue any command to abort the operation. chip erase commands should be limited to a max- imum of 100 program/erase cycles. after 100 pro- gram/erase cycles the internal algorithm will still operate properly but some degradation in perfor- mance may occur. typical chip erase times are given in table 7. program command the memory array can be programmed word-by- word. two bus write cycles are required to issue the program command. the first bus cycle sets up the program command. the second latches the address and the data to be written and starts the program/erase controller. during program operations the memory will ac- cept the read status register command and the program/erase suspend command. typical pro- gram times are given in table 7., program, erase times and program/erase endurance cycles . programming aborts if reset goes to v il . as data integrity cannot be guaranteed when the program operation is aborted, the block containing the memory location must be erased and repro- grammed. see appendix c. , figure 15., program flow- chart and pseudo code , for the flowchart for using the program command. double word program command this feature is offered to improve the programming throughput, writing a page of two adjacent words in parallel.the two words must differ only for the address a0. programming should not be attempt- ed when v pp is not at v pph . the command can be executed if v pp is below v pph but the result is not guaranteed. three bus write cycles are necessary to issue the double word program command. the first bus cycle sets up the double word program command. the second bus cycle latches the address and the data of the first word to be written. the third bus cycle latches the address and the data of the second word to be written and starts the program/erase controller. read operations output the status register con- tent after the programming has started. program- ming aborts if reset goes to v il . as data integrity cannot be guaranteed when the program opera- tion is aborted, the block containing the memory location must be erased and reprogrammed. see appendix c. , figure 16., double word pro- gram flowchart and pseudo code , for the flow- chart for using the double word program command. clear status register command the clear status register command can be used to reset bits 1, 3, 4 and 5 in the status register to ?0?. one bus write cycle is required to issue the clear status register command. the bits in the status register do not automatical- ly return to ?0? when a new program or erase com- mand is issued. the error bits in the status register should be cleared before attempting a new program or erase command. program/erase suspend command the program/erase suspend command is used to pause a program or erase operation. one bus write cycle is required to issue the program/erase command and pause the program/erase control- ler. during program/erase suspend the command in- terface will accept the program/erase resume, read array, read status register, read electron- ic signature and read cfi query commands. ad- ditionally, if the suspend operation was erase then the program, block lock, block lock-down or protection program commands will also be ac- cepted. the block being erased may be protected by issuing the block protect, block lock or protec- tion program commands. when the program/ erase resume command is issued the operation will complete. only the blocks not being erased may be read or programmed correctly. during a program/erase suspend, the device can be placed in a pseudo-standby mode by taking chip enable to v ih . program/erase is aborted if reset turns to v il . see appendix c. , figure 17., program suspend & resume flowchart and pseudo code , and fig- ure 19., erase suspend & resume flowchart and pseudo code , for flowcharts for using the pro- gram/erase suspend command. program/erase resume command the program/erase resume command can be used to restart the program/erase controller after a program/erase suspend operation has paused it. one bus write cycle is required to issue the command. once the command is issued subse- quent bus read operations read the status reg- ister. see appendix c. , figure 17., program suspend & resume flowchart and pseudo code , and fig-
m28r400ct, m28r400cb 12/48 ure 19., erase suspend & resume flowchart and pseudo code , for flowcharts for using the pro- gram/erase resume command. protection register program command the protection register program command is used to program the 64 bit user one-time-pro- grammable (otp) segment of the protection reg- ister. the segment is programmed 16 bits at a time. when shipped all bits in the segment are set to ?1?. the user can only program the bits to ?0?. two write cycles are required to issue the protec- tion register program command. the first bus cycle sets up the protection register program command. the second latches the address and the data to be written to the protection register and starts the program/erase controller. read operations output the status register con- tent after the programming has started. the segment can be protected by programming bit 1 of the protection lock register. bit 1 of the pro- tection lock register protects bit 2 of the protec- tion lock register. programming bit 2 of the protection lock register will result in a permanent protection of the security block (see figure 5., se- curity block memory map ). attempting to program a previously protected protection register will re- sult in a status register error. the protection of the protection register and/or the security block is not reversible. the protection register program cannot be sus- pended. see appendix c. , figure 21., protec- tion register program flowchart and pseudo code , for the flowchart for using the protection register program command. block lock command the block lock command is used to lock a block and prevent program or erase operations from changing the data in it. all blocks are locked at power-up or reset. two bus write cycles are required to issue the block lock command. the first bus cycle sets up the block lock command. the second bus write cycle latches the block address. the lock status can be monitored for each block using the read electronic signature command. table 9. shows the protection status after issuing a block lock command. the block lock bits are volatile, once set they re- main set until a hardware reset or power-down/ power-up. they are cleared by a blocks unlock command. refer to the section, block lock- ing , for a detailed explanation. block unlock command the blocks unlock command is used to unlock a block, allowing the block to be programmed or erased. two bus write cycles are required to is- sue the blocks unlock command. the first bus cycle sets up the block unlock command. the second bus write cycle latches the block address. the lock status can be monitored for each block using the read electronic signature command. table 9. shows the protection status after issuing a block unlock command. refer to the section, block locking , for a detailed explanation. block lock-down command a locked block cannot be programmed or erased, or have its protection status changed when wp is low, v il . when wp is high, v ih, the lock-down function is disabled and the locked blocks can be individually unlocked by the block unlock com- mand. two bus write cycles are required to issue the block lock-down command. the first bus cycle sets up the block lock command. the second bus write cycle latches the block address. the lock status can be monitored for each block using the read electronic signature command. locked-down blocks revert to the locked (and not locked-down) state when the device is reset on power-down. table 9. shows the protection status after issuing a block lock-down command. refer to the section, block locking , for a detailed explanation.
13/48 m28r400ct, m28r400cb table 3. commands note: 1. x = don't care. 2. the signature addresses are listed in tables 4 , 5 and 6 . 3. addr 1 and addr 2 must be consecutive addresses differing only for a0. table 4. read electronic signature note: rp = v ih . commands no. of cycles bus write operations 1st cycle 2nd cycle 3nd cycle bus op. addr data bus op. addr data bus op. addr data read memory array 1+ write x ffh read read addr data read status register 1+ write x 70h read x status register read electronic signature 1+ write x 90h read signature addr (2) signature read cfi query 1+ write 55h 98h read cfi addr query block erase 2 write x 20h write block addr d0h chip erase 2 write x 80h write x d0h program 2 write x 40h or 10h write addr data input double word program (3) 3 write x 30h write addr 1 data input write addr 2 data input clear status register 1 write x 50h program/erase suspend 1 write x b0h program/erase resume 1 write x d0h block lock 2 write x 60h write block address 01h block unlock 2 write x 60h write block address d0h block lock-down 2 write x 60h write block address 2fh protection register program 2writexc0hwrite address data input code device e g w a0 a1 a2-a7 a8-a17 dq0-dq7 dq8-dq15 manufacture. code v il v il v ih v il v il 0 don't care 20h 00h device code m28r400ct v il v il v ih v ih v il 0 don't care 2ah 88h m28r400cb v il v il v ih v ih v il 0 don't care 2bh 88h
m28r400ct, m28r400cb 14/48 table 5. read block lock signature note: 1. a locked-down block can be locked "dq0 = 1" or unlocked "dq0 = 0"; see block locking section. table 6. read protection register and lock register table 7. program, erase times and program/erase endurance cycles block status e g w a0 a1 a2-a7 a8-a11 a12-a17 dq0 dq1 dq2-dq15 locked block v il v il v ih v il v ih 0 don't care block address 1 0 00h unlocked block v il v il v ih v il v ih 0 don't care block address 0 0 00h locked-down block v il v il v ih v il v ih 0 don't care block address x (1) 1 00h word e g w a0-a7 a8-a17 dq0 dq1 dq2 dq3-dq7 dq8-dq15 lock v il v il v ih 80h don't care 0 otp prot. data security prot. data 00h 00h unique id 0 v il v il v ih 81h don't care id data id data id data id data id data unique id 1 v il v il v ih 82h don't care id data id data id data id data id data unique id 2 v il v il v ih 83h don't care id data id data id data id data id data unique id 3 v il v il v ih 84h don't care id data id data id data id data id data otp 0 v il v il v ih 85h don't care otp data otp data otp data otp data otp data otp 1 v il v il v ih 86h don't care otp data otp data otp data otp data otp data otp 2 v il v il v ih 87h don't care otp data otp data otp data otp data otp data otp 3 v il v il v ih 88h don't care otp data otp data otp data otp data otp data parameter test conditions m28r400c unit min typ max word program v pp = v dd 10 200 s double word program v pp = 12v 5% 10 200 s main block program v pp = 12v 5% 0.16 5 s v pp = v dd 0.32 5 s parameter block program v pp = 12v 5% 0.02 4 s v pp = v dd 0.04 4 s main block erase v pp = 12v 5% 110 s v pp = v dd 110 s chip erase (preprogrammed) v pp = 12v 5% 210 s v pp = v dd 210 s chip program v pp = 12v 5% 1.25 s v pp = v dd 25 s parameter block erase v pp = 12v 5% 0.8 10 s v pp = v dd 0.8 10 s program/erase cycles (per block) 100,000 cycles
15/48 m28r400ct, m28r400cb block locking the m28r400c features an instant, individual block locking scheme that allows any block to be locked or unlocked with no latency. this locking scheme has three levels of protection. lock/unlock - this first level allows software- only control of block locking. lock-down - this second level requires hardware interaction before locking can be changed. v pp v pplk - the third level offers a hardware protection against program and block erase on all blocks. the lock status of each block can be set to locked, unlocked, and lock-down. table 9. , de- fines all of the possible protection states (wp , dq1, dq0), and appendix c. , figure 20. , shows a flowchart for the locking operations. reading a block?s lock status the lock status of every block can be read in the read electronic signature mode of the device. to enter this mode write 90h to the device. subse- quent reads at the address specified in table 5. , will output the lock status of that block. the lock status is represented by dq0 and dq1. dq0 indi- cates the block lock/unlock status and is set by the lock command and cleared by the unlock command. it is also automatically set when enter- ing lock-down. dq1 indicates the lock-down sta- tus and is set by the lock-down command. it cannot be cleared by software, only by a hardware reset or power-down. the following sections explain the operation of the locking system. locked state the default status of all blocks on power-up or af- ter a hardware reset is locked (states (0,0,1) or (1,0,1)). locked blocks are fully protected from any program or erase. any program or erase oper- ations attempted on a locked block will return an error in the status register. the status of a locked block can be changed to unlocked or lock-down using the appropriate software com- mands. an unlocked block can be locked by issu- ing the lock command. unlocked state unlocked blocks (states (0,0,0), (1,0,0) (1,1,0)), can be programmed or erased. all unlocked blocks return to the locked state after a hardware reset or when the device is powered-down. the status of an unlocked block can be changed to locked or locked-down using the appropriate software commands. a locked block can be un- locked by issuing the unlock command. lock-down state blocks that are locked-down (state (0,1,x))are protected from program and erase operations (as for locked blocks) but their lock status cannot be changed using software commands alone. a locked or unlocked block can be locked-down by issuing the lock-down command. locked-down blocks revert to the locked state when the device is reset or powered-down. the lock-down function is dependent on the wp input pin. when wp =0 (v il ), the blocks in the lock-down state (0,1,x) are protected from pro- gram, erase and protection status changes. when wp =1 (v ih ) the lock-down function is disabled (1,1,1) and locked-down blocks can be individu- ally unlocked to the (1,1,0) state by issuing the software command, where they can be erased and programmed. these blocks can then be relocked (1,1,1) and unlocked (1,1,0) as desired while wp remains high. when wp is low , blocks that were previously locked-down return to the lock-down state (0,1,x) regardless of any changes made while wp was high. device reset or power-down resets all blocks , including those in lock-down, to the locked state. locking operations during erase suspend changes to block lock status can be performed during an erase suspend by using the standard locking command sequences to unlock, lock or lock-down a block. this is useful in the case when another block needs to be updated while an erase operation is in progress. to change block locking during an erase opera- tion, first write the erase suspend command, then check the status register until it indicates that the erase operation has been suspended. next write the desired lock command sequence to a block and the protection status will be changed. after completing any desired lock, read, or program op- erations, resume the erase operation with the erase resume command. if a block is locked or locked-down during an erase suspend of the same block, the locking status bits will be changed immediately, but when the erase is resumed, the erase operation will complete. locking operations cannot be performed during a program suspend. refer to appendix d., com- mand interface and program/erase controller state , for detailed information on which commands are valid during erase sus- pend.
m28r400ct, m28r400cb 16/48 table 8. block lock status table 9. protection status note: 1. the protection status is defined by the write protect pi n and by dq1 (?1? for a locked-down block) and dq0 (?1? for a lo cked block) as read in the read electronic signature command with a1 = v ih and a0 = v il . 2. all blocks are locked at power-up, so the default configuration is 001 or 101 according to wp status. 3. a wp transition to v ih on a locked block will restore the previous dq0 value, giving a 111 or 110. item address data block lock configuration xx002 lock block is unlocked dq0=0 block is locked dq0=1 block is locked-down dq1=1 current protection status (1) (wp , dq1, dq0) next protection status (1) (wp , dq1, dq0) current state program/erase allowed after block lock command after block unlock command after block lock-down command after wp transition 1,0,0 yes 1,0,1 1,0,0 1,1,1 0,0,0 1,0,1 (2) no 1,0,1 1,0,0 1,1,1 0,0,1 1,1,0 yes 1,1,1 1,1,0 1,1,1 0,1,1 1,1,1 no 1,1,1 1,1,0 1,1,1 0,1,1 0,0,0 yes 0,0,1 0,0,0 0,1,1 1,0,0 0,0,1 (2) no 0,0,1 0,0,0 0,1,1 1,0,1 0,1,1 no 0,1,1 0,1,1 0,1,1 1,1,1 or 1,1,0 (3)
17/48 m28r400ct, m28r400cb status register the status register provides information on the current or previous program or erase operation. the various bits convey information and errors on the operation. to read the status register the read status register command can be issued, re- fer to read status register command section. to output the contents, the status register is latched on the falling edge of the chip enable or output enable signals, and can be read until chip enable or output enable returns to v ih . either chip en- able or output enable must be toggled to update the latched data. bus read operations from any address always read the status register during program and erase operations. the bits in the status register are summarized in table 10., status register bits . refer to table 10. in conjunction with the following text descriptions. program/erase controller status (bit 7). the pro- gram/erase controller status bit indicates whether the program/erase controller is active or inactive. when the program/erase controller status bit is low (set to ?0?), the program/erase controller is active; when the bit is high (set to ?1?), the pro- gram/erase controller is inactive, and the device is ready to process a new command. the program/erase controller status is low im- mediately after a program/erase suspend com- mand is issued until the program/erase controller pauses. after the program/erase controller paus- es the bit is high . during program, erase, operations the program/ erase controller status bit can be polled to find the end of the operation. other bits in the status reg- ister should not be tested until the program/erase controller completes the operation and the bit is high. after the program/erase controller completes its operation the erase status, program status, v pp status and block lock status bits should be tested for errors. erase suspend status (bit 6). the erase sus- pend status bit indicates that an erase operation has been suspended or is going to be suspended. when the erase suspend status bit is high (set to ?1?), a program/erase suspend command has been issued and the memory is waiting for a pro- gram/erase resume command. the erase suspend status should only be consid- ered valid when the program/erase controller sta- tus bit is high (program/erase controller inactive). bit 7 is set within 30s of the program/erase sus- pend command being issued therefore the memo- ry may still complete the operation rather than entering the suspend mode. when a program/erase resume command is is- sued the erase suspend status bit returns low. erase status (bit 5). the erase status bit can be used to identify if the memory has failed to verify that the block has erased correctly. when the erase status bit is high (set to ?1?), the program/ erase controller has applied the maximum num- ber of pulses to the block and still failed to verify that the block has erased correctly. the erase sta- tus bit should be read once the program/erase controller status bit is high (program/erase con- troller inactive). once set high, the erase status bit can only be re- set low by a clear status register command or a hardware reset. if set high it should be reset be- fore a new program or erase command is issued, otherwise the new command will appear to fail. program status (bit 4). the program status bit is used to identify a program failure. when the program status bit is high (set to ?1?), the pro- gram/erase controller has applied the maximum number of pulses to the byte and still failed to ver- ify that it has programmed correctly. the program status bit should be read once the program/erase controller status bit is high (program/erase con- troller inactive). once set high, the program status bit can only be reset low by a clear status register command or a hardware reset. if set high it should be reset be- fore a new command is issued, otherwise the new command will appear to fail. v pp status (bit 3). the v pp status bit can be used to identify an invalid voltage on the v pp pin during program and erase operations. the v pp pin is only sampled at the beginning of a program or erase operation. indeterminate results can oc- cur if v pp becomes invalid during an operation. when the v pp status bit is low (set to ?0?), the volt- age on the v pp pin was sampled at a valid voltage; when the v pp status bit is high (set to ?1?), the v pp pin has a voltage that is below the v pp lockout voltage, v pplk , program and block erase opera- tions cannot be performed. once set high, the v pp status bit can only be reset low by a clear status register command or a hardware reset. if set high it should be reset be- fore a new program or erase command is issued, otherwise the new command will appear to fail. program suspend status (bit 2). the program suspend status bit indicates that a program oper- ation has been suspended. when the program suspend status bit is high (set to ?1?), a program/ erase suspend command has been issued and the memory is waiting for a program/erase re- sume command. the program suspend status should only be considered valid when the pro-
m28r400ct, m28r400cb 18/48 gram/erase controller status bit is high (program/ erase controller inactive). bit 2 is set within 5s of the program/erase suspend command being is- sued therefore the memory may still complete the operation rather than entering the suspend mode. when a program/erase resume command is is- sued the program suspend status bit returns low. block protection status (bit 1). the block pro- tection status bit can be used to identify if a pro- gram or erase operation has tried to modify the contents of a locked block. when the block protection status bit is high (set to ?1?), a program or erase operation has been at- tempted on a locked block. once set high, the block protection status bit can only be reset low by a clear status register com- mand or a hardware reset. if set high it should be reset before a new command is issued, otherwise the new command will appear to fail. reserved (bit 0). bit 0 of the status register is reserved. its value must be masked. note: refer to appendix c., flowcharts and pseudo codes , for using the status register. table 10. status register bits note: logic level '1' is high, '0' is low. bit name logic level definition 7 p/e.c. status '1' ready '0' busy 6 erase suspend status '1' suspended '0' in progress or completed 5 erase status '1' erase error '0' erase success 4 program status '1' program error '0' program success 3 v pp status '1' v pp invalid, abort '0' v pp ok 2 program suspend status '1' suspended '0' in progress or completed 1 block protection status '1' program/erase on protected block, abort '0' no operation to protected blocks 0 reserved
19/48 m28r400ct, m28r400cb maximum rating stressing the device above the rating listed in the absolute maximum ratings table may cause per- manent damage to the device. these are stress ratings only and operation of the device at these or any other conditions above those indicated in the operating sections of this specification is not im- plied. exposure to absolute maximum rating con- ditions for extended periods may affect device reliability. refer also to the stmicroelectronics sure program and other relevant quality docu- ments. table 11. absolute maximum ratings note: 1. depends on range. symbol parameter value unit min max t a ambient operating temperature (1) ?40 85 c t bias temperature under bias ?40 125 c t stg storage temperature ?55 155 c v io input or output voltage ?0.5 v ddq + 0.5 v v dd , v ddq supply voltage ?0.5 2.7 v v pp program voltage ?0.5 13 v t vpph time for v pp at v pph 100 hours
m28r400ct, m28r400cb 20/48 dc and ac parameters this section summarizes the operating and mea- surement conditions, and the dc and ac charac- teristics of the device. the parameters in the dc and ac characteristics tables that follow, are de- rived from tests performed under the measure- ment conditions summarized in table 12., operating and ac measurement conditions . de- signers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters. table 12. operating and ac measurement conditions figure 6. ac measurement i/o waveform figure 7. ac measurement load circuit table 13. capacitance note: sampled only, not 100% tested. parameter m28r400ct, m28r400cb units 90 120 min max min max v dd supply voltage 1.7 2.0 1.65 2.2 v v ddq supply voltage (v ddq v dd ) 1.7 2.0 1.65 2.2 v ambient operating temperature ? 40 85 ? 40 85 c load capacitance (c l ) 30 30 pf input rise and fall times 10 10 ns input pulse voltages 0 to v ddq 0 to v ddq v input and output timing ref. voltages v ddq /2 v ddq /2 v ai00610 v ddq 0v v ddq /2 ai00609c v ddq c l c l includes jig capacitance 25k ? device under test 0.1f v dd 0.1f v ddq 25k ? symbol parameter test condition min max unit c in input capacitance v in = 0v 6pf c out output capacitance v out = 0v 12 pf
21/48 m28r400ct, m28r400cb table 14. dc characteristics symbol parameter test condition min typ max unit i li input leakage current 0v v in v ddq 1 a i lo output leakage current 0v v out v ddq 10 a i dd supply current (read) e = v ss , g = v ih , f = 5mhz 10 20 ma i dd1 supply current (stand-by or automatic stand-by) e = v ddq 0.2v, rp = v ddq 0.2v 15 50 a i dd2 supply current (reset) rp = v ss 0.2v 15 50 a i dd3 supply current (program) program in progress v pp = 12v 5% 10 20 ma program in progress v pp = v dd 10 20 ma i dd4 supply current (erase) erase in progress v pp = 12v 5% 520ma erase in progress v pp = v dd 520ma i dd5 supply current (program/erase suspend) e = v ddq 0.2v, erase suspended 50 a i pp program current (read or stand-by) v pp > v dd 400 a i pp1 program current (read or stand-by) v pp v dd 5a i pp2 program current (reset) rp = v ss 0.2v 5a i pp3 program current (program) program in progress v pp = 12v 5% 10 ma program in progress v pp = v dd 5a i pp4 program current (erase) erase in progress v pp = 12v 5% 10 ma erase in progress v pp = v dd 5a v il input low voltage ?0.5 0.4 v v ih input high voltage v ddq ?0.4 v ddq +0.4 v v ol output low voltage i ol = 100a, v dd = v dd min, v ddq = v ddq min 0.1 v v oh output high voltage i oh = ?100a, v dd = v dd min, v ddq = v ddq min v ddq ?0.1 v v pp1 program voltage (program or erase operations) 1.65 2.2 v v pph program voltage (program or erase operations) 11.4 12.6 v v pplk program voltage (program and erase lock-out) 1v v lko v dd supply voltage (program and erase lock-out) 2v
m28r400ct, m28r400cb 22/48 figure 8. read ac waveforms table 15. read ac characteristics note: 1. sampled only, not 100% tested. 2. g may be delayed by up to t elqv - t glqv after the falling edge of e without increasing t elqv . symbol alt parameter m28r400c unit 90 120 t avav t rc address valid to next address valid min 90 120 ns t avqv t acc address valid to output valid max 90 120 ns t axqx (1) t oh address transition to output transition min 0 0 ns t ehqx (1) t oh chip enable high to output transition min 0 0 ns t ehqz (1) t hz chip enable high to output hi-z max 25 30 ns t elqv (2) t ce chip enable low to output valid max 90 120 ns t elqx (1) t lz chip enable low to output transition min 0 0 ns t ghqx (1) t oh output enable high to output transition min 0 0 ns t ghqz (1) t df output enable high to output hi-z max 25 30 ns t glqv (2) t oe output enable low to output valid max 30 35 ns t glqx (1) t olz output enable low to output transition min 0 0 ns dq0-dq15 ai04144b valid a0-a17 e taxqx tavav valid tavqv telqv telqx tglqv tglqx addr. valid chip enable outputs enabled data valid standby g tghqx tghqz tehqx tehqz
23/48 m28r400ct, m28r400cb figure 9. write ac waveforms, write enable controlled e g w dq0-dq15 command cmd or data status register v pp valid a0-a17 tavav tqvvpl tavwh twhax program or erase telwl twheh twhdx tdvwh twlwh twhwl tvphwh set-up command confirm command or data input status register read 1st polling telqv ai04145b twphwh wp twhgl tqvwpl twhel
m28r400ct, m28r400cb 24/48 table 16. write ac characteristics, write enable controlled note: 1. sampled only, not 100% tested. 2. applicable if v pp is seen as a logic input (v pp < 2.2v). symbol alt parameter m28r400c unit 90 120 t avav t wc write cycle time min 90 120 ns t avwh t as address valid to write enable high min 50 50 ns t dvwh t ds data valid to write enable high min 50 50 ns t elwl t cs chip enable low to write enable low min 0 0 ns t elqv chip enable low to output valid min 90 120 ns t qvvpl (1,2) output valid to v pp low min 0 0 ns t qvwpl output valid to write protect low min 0 0 ns t vphwh (1) t vps v pp high to write enable high min 200 200 ns t whax t ah write enable high to address transition min 0 0 ns t whdx t dh write enable high to data transition min 0 0 ns t wheh t ch write enable high to chip enable high min 0 0 ns t whel write enable high to chip enable low min 30 30 ns t whgl write enable high to output enable low min 30 30 ns t whwl t wph write enable high to write enable low min 30 30 ns t wlwh t wp write enable low to write enable high min 50 50 ns t wphwh write protect high to write enable high min 50 50 ns
25/48 m28r400ct, m28r400cb figure 10. write ac waveforms, chip enable controlled e g dq0-dq15 command cmd or data status register v pp valid a0-a17 tavav tqvvpl taveh tehax program or erase twlel tehwh tehdx tdveh teleh tehel tvpheh power-up and set-up command confirm command or data input status register read 1st polling telqv ai04146b w twpheh wp tehgl tqvwpl
m28r400ct, m28r400cb 26/48 table 17. write ac characteristics, chip enable controlled note: 1. sampled only, not 100% tested. 2. applicable if v pp is seen as a logic input (v pp < 2.2v). symbol alt parameter m28r400c unit 90 120 t avav t wc write cycle time min 90 120 ns t aveh t as address valid to chip enable high min 50 50 ns t dveh t ds data valid to chip enable high min 50 50 ns t ehax t ah chip enable high to address transition min 0 0 ns t ehdx t dh chip enable high to data transition min 0 0 ns t ehel t cph chip enable high to chip enable low min 30 30 ns t ehgl chip enable high to output enable low min 30 30 ns t ehwh t wh chip enable high to write enable high min 0 0 ns t eleh t cp chip enable low to chip enable high min 50 50 ns t elqv chip enable low to output valid min 90 120 ns t qvvpl (1,2) output valid to v pp low min 0 0 ns t qvwpl data valid to write protect low min 0 0 ns t vpheh (1) t vps v pp high to chip enable high min 200 200 ns t wlel t cs write enable low to chip enable low min 0 0 ns t wpheh write protect high to chip enable high min 50 50 ns
27/48 m28r400ct, m28r400cb figure 11. power-up and reset ac waveforms table 18. power-up and reset ac characteristics note: 1. the device reset is possible but not guaranteed if t plph < 100ns. 2. sampled only, not 100% tested. 3. it is important to assert rp in order to allow proper cpu initialization during power up or reset. symbol parameter test condition m28r400c unit 90 120 t phwl t phel t phgl reset high to write enable low, chip enable low, output enable low during program and erase min 50 50 s others min 30 30 ns t plph (1,2) reset low to reset high min 100 100 ns t vdhph (3) supply voltages high to reset high min 50 50 s ai03537b w, rp tphwl tphel tphgl e, g vdd, vddq tvdhph tphwl tphel tphgl tplph power-up reset
m28r400ct, m28r400cb 28/48 package mechanical figure 12. tfbga46 6.39x6.37mm - 8x6 ball array, 0.75 mm pitch, bottom view package outline note: drawing is not to scale. table 19. tfbga46 6.39x6.37mm - 8x6 ball array, 0.75 mm pitch, package mechanical data symbol millimeters inches typ min max typ min max a 1.200 0.0472 a1 0.200 0.0079 a2 1.000 0.0394 b 0.400 0.350 0.450 0.0157 0.0138 0.0177 d 6.390 6.290 6.490 0.2516 0.2476 0.2555 d1 5.250 ? ? 0.2067 ? ? ddd 0.100 0.0039 e 6.370 6.270 6.470 0.2508 0.2469 0.2547 e 0.750 ? ? 0.0295 ? ? e1 3.750 ? ? 0.1476 ? ? fd 0.570 ? ? 0.0224 ? ? fe 1.310 ? ? 0.0516 ? ? sd 0.375 ? ? 0.0148 ? ? se 0.375 ? ? 0.0148 ? ? e1 e d1 d b a2 a1 a bga-z13 ddd e e fd fe sd se ball "a1"
29/48 m28r400ct, m28r400cb figure 13. tfbga46 daisy chain - package connections (top view through package) figure 14. tfbga46 daisy chain - pcb connections proposal (top view through package) ai03860 c b a 8 7 6 5 4 3 2 1 e d f ai03861 c b a 8 7 6 5 4 3 2 1 e d f start point end point
m28r400ct, m28r400cb 30/48 part numbering table 20. ordering information scheme table 21. daisy chain ordering scheme note:devices are shipped from the factory with the memory content bits erased to ?1?. for a list of available options (speed, package, etc.) or for further information on any aspect of this device, please contact the st sales office nearest to you. example: m28r400ct 120 zb 6 t device type m28 operating voltage r = v dd = 1.65v to 2.2v; v ddq = 1.65v or 2.2v device function 400c = 4 mbit (256kb x16), boot block array matrix t = top boot b = bottom boot speed 90 = 90ns 120 = 120ns package zb = tfbga46: 0.75mm pitch temperature range 1 = 0 to 70 c 6 = ?40 to 85 c option t = tape & reel packing u = lead-free package, tape & reel packing, 16mm example: m28r400c -zb t device type m28r400c daisy chain -zb = tfbga46: 0.75 mm pitch option t = tape & reel packing u = lead-free package, tape & reel packing, 16mm
31/48 m28r400ct, m28r400cb appendix a. block address tables table 22. top boot block addresses, m28r400ct table 23. bottom boot block addresses, m28r400cb # size (kword) address range 0 4 3f000-3ffff 1 4 3e000-3efff 2 4 3d000-3dfff 3 4 3c000-3cfff 4 4 3b000-3bfff 5 4 3a000-3afff 6 4 39000-39fff 7 4 38000-38fff 8 32 30000-37fff 9 32 28000-2ffff 10 32 20000-27fff 11 32 18000-1ffff 12 32 10000-17fff 13 32 08000-0ffff 14 32 00000-07fff # size (kword) address range 14 32 38000-3ffff 13 32 30000-37fff 12 32 28000-2ffff 11 32 20000-27fff 10 32 18000-1ffff 9 32 10000-17fff 8 32 08000-0ffff 7 4 07000-07fff 6 4 06000-06fff 5 4 05000-05fff 4 4 04000-04fff 3 4 03000-03fff 2 4 02000-02fff 1 4 01000-01fff 0 4 00000-00fff
m28r400ct, m28r400cb 32/48 appendix b. common flash interface (cfi) the common flash interface is a jedec ap- proved, standardized data structure that can be read from the flash memory device. it allows a system software to query the device to determine various electrical and timing parameters, density information and functions supported by the mem- ory. the system can interface easily with the de- vice, enabling the software to upgrade itself when necessary. when the cfi query command (rcfi) is issued the device enters cfi query mode and the data structure is read from the memory. tables 24 , 25 , 26 , 27 , 28 and 29 show the addresses used to re- trieve the data. the cfi data structure also contains a security area where a 64 bit unique security number is writ- ten (see table 29., security code area ). this area can be accessed only in read mode by the final user. it is impossible to change the security num- ber after it has been written by st. issue a read command to return to read mode. table 24. query structure overview note: query data are always presented on the lowest order data outputs. table 25. cfi query identification string note: query data are always presented on the lowest order data outputs (dq7-dq0) only. dq8-dq15 are ?0?. offset sub-section name description 00h reserved reserved for algorithm-specific information 10h cfi query identification string command set id and algorithm data offset 1bh system interface information device timing & voltage information 27h device geometry definition flash device layout p primary algorithm-specific extended query table additional information specific to the primary algorithm (optional) a alternate algorithm-specific extended query table additional information specific to the alternate algorithm (optional) offset data description value 00h 0020h manufacturer code st 01h 882ah 882bh device code top bottom 02h-0fh reserved reserved 10h 0051h "q" 11h 0052h query unique ascii string "qry" "r" 12h 0059h "y" 13h 0003h primary algorithm command set and control interface id code 16 bit id code defining a specific algorithm intel compatible 14h 0000h 15h 0035h address for primary algorithm extended query table (see table 28. )p = 35h 16h 0000h 17h 0000h alternate vendor command set and control interface id code second vendor - specified algorithm supported (0000h means none exists) na 18h 0000h 19h 0000h address for alternate algorithm extended query table (0000h means none exists) na 1ah 0000h
33/48 m28r400ct, m28r400cb table 26. cfi query system interface information offset data description value 1bh 0017h v dd logic supply minimum program/erase or write voltage bit 7 to 4 bcd value in volts bit 3 to 0 bcd value in 100 mv 1.7v 1ch 0022h v dd logic supply maximum program/erase or write voltage bit 7 to 4 bcd value in volts bit 3 to 0 bcd value in 100 mv 2.2v 1dh 00b4h v pp [programming] supply minimum program/erase voltage bit 7 to 4 hex value in volts bit 3 to 0 bcd value in 100 mv 11.4v 1eh 00c6h v pp [programming] supply maximum program/erase voltage bit 7 to 4 hex value in volts bit 3 to 0 bcd value in 100 mv 12.6v 1fh 0004h typical time-out per single word program = 2 n s 16s 20h 0004h typical time-out for double word program = 2 n s 16s 21h 000ah typical time-out per individual block erase = 2 n ms 1s 22h 000ch typical time-out for full chip erase = 2 n ms 4s 23h 0005h maximum time-out for word program = 2 n times typical 512s 24h 0005h maximum time-out for double word program = 2 n times typical 512s 25h 0003h maximum time-out per individual block erase = 2 n times typical 8s 26h 0003h maximum time-out for chip erase = 2 n times typical 32s
m28r400ct, m28r400cb 34/48 table 27. device geometry definition offset word mode data description value 27h 0013h device size = 2 n in number of bytes 512 mbyte 28h 29h 0001h 0000h flash device interface code description x16 async. 2ah 2bh 0002h 0000h maximum number of bytes in multi-byte program or page = 2 n 4 2ch 0002h number of erase block regions within the device. it specifies the number of regions within the device containing contiguous erase blocks of the same size. 2 m28r400ct 2dh 2eh 0006h 0000h region 1 information number of identical-size erase block = 0006h+1 7 2fh 30h 0000h 0001h region 1 information block size in region 1 = 0100h * 256 byte 64 kbyte 31h 32h 0007h 0000h region 2 information number of identical-size erase block = 0007h+1 8 33h 34h 0020h 0000h region 2 information block size in region 2 = 0020h * 256 byte 8 kbyte m28r400cb 2dh 2eh 0007h 0000h region 1 information number of identical-size erase block = 0007h+1 8 2fh 30h 0020h 0000h region 1 information block size in region 1 = 0020h * 256 byte 8 kbyte 31h 32h 0006h 0000h region 2 information number of identical-size erase block = 0006h+1 7 33h 34h 0000h 0001h region 2 information block size in region 2 = 0100h * 256 byte 64 kbyte
35/48 m28r400ct, m28r400cb table 28. primary algorithm-specific extended query table note: 1. see table 25. , offset 15 for p pointer definition. offset p = 35h (1) data description value (p+0)h = 35h 0050h primary algorithm extended query table unique ascii string ?pri? "p" (p+1)h = 36h 0052h "r" (p+2)h = 37h 0049h "i" (p+3)h = 38h 0031h major version number, ascii "1" (p+4)h = 39h 0030h minor version number, ascii "0" (p+5)h = 3ah 0067h extended query table contents for primary algorithm. address (p+5)h contains less significant byte. bit 0 chip erase supported (1 = yes, 0 = no) bit 1 suspend erase supported (1 = yes, 0 = no) bit 2 suspend program supported (1 = yes, 0 = no) bit 3 legacy lock/unlock supported (1 = yes, 0 = no) bit 4 queued erase supported (1 = yes, 0 = no) bit 5 instant individual block locking supported (1 = yes, 0 = no) bit 6 protection bits supported (1 = yes, 0 = no) bit 7 page mode read supported (1 = yes, 0 = no) bit 8 synchronous read supported (1 = yes, 0 = no) bit 31 to 9 reserved; undefined bits are ?0? yes yes yes no no yes yes no no (p+6)h = 3bh 0000h (p+7)h = 3ch 0000h (p+8)h = 3dh 0000h (p+9)h = 3eh 0001h supported functions after suspend read array, read status register and cfi query are always supported during erase or program operation bit 0 program supported after erase suspend (1 = yes, 0 = no) bit 7 to 1 reserved; undefined bits are ?0? yes (p+a)h = 3fh 0003h block lock status defines which bits in the block status register section of the query are implemented. address (p+a)h contains less significant byte bit 0 block lock status register lock/unlock bit active(1 = yes, 0 = no) bit 1 block lock status register lock-down bit active (1 = yes, 0 = no) bit 15 to 2 reserved for future use; undefined bits are ?0? yes yes (p+b)h = 40h 0000h (p+c)h = 41h 0022h v dd logic supply optimum program/erase voltage (highest performance) bit 7 to 4 hex value in volts bit 3 to 0 bcd value in 100 mv 2.2v (p+d)h = 42h 00c0h v pp supply optimum program/erase voltage bit 7 to 4 hex value in volts bit 3 to 0 bcd value in 100 mv 12v (p+e)h = 43h 0001h number of protection register fields in jedec id space. "00h," indicates that 256 protection bytes are available 01 (p+f)h = 44h 0080h protection field 1: protection description this field describes user-available. one time programmable (otp) protection register bytes. some are pre-programmed with device unique serial numbers. others are user programmable. bits 0?15 point to the protection register lock byte, the section?s first byte. the following bytes are factory pre-programmed and user-programmable. bit 0 to 7 lock/bytes jedec-plane physical low address bit 8 to 15 lock/bytes jedec-plane physical high address bit 16 to 23 "n" such that 2 n = factory pre-programmed bytes bit 24 to 31 "n" such that 2 n = user programmable bytes 80h (p+10)h = 45h 0000h 00h (p+11)h = 46h 0003h 8 byte (p+12)h = 47h 0003h 8 byte (p+13)h = 48h reserved
m28r400ct, m28r400cb 36/48 table 29. security code area offset data description 80h 00xx protection register lock 81h xxxx 64 bits: unique device number 82h xxxx 83h xxxx 84h xxxx 85h xxxx 64 bits: user programmable otp 86h xxxx 87h xxxx 88h xxxx
37/48 m28r400ct, m28r400cb appendix c. flowcharts and pseudo codes figure 15. program flowchart and pseudo code note: 1. status check of b1 (protected block), b3 (v pp invalid) and b4 (program error) can be made after each program operation or after a sequence. 2. if an error is found, the status register must be cleared before further program/erase controller operations. write 40h or 10h ai03538b start write address & data read status register yes no b7 = 1 yes no b3 = 0 no b4 = 0 v pp invalid error (1, 2) program error (1, 2) program_command (addresstoprogram, datatoprogram) {: writetoflash (any_address, 0x40) ; /*or writetoflash (any_address, 0x10) ; */ do { status_register=readflash (any_address) ; /* e or g must be toggled*/ } while (status_register.b7== 0) ; if (status_register.b3==1) /*vpp invalid error */ error_handler ( ) ; yes end yes no b1 = 0 program to protected block error (1, 2) writetoflash (addresstoprogram, datatoprogram) ; /*memory enters read status state after the program command*/ if (status_register.b4==1) /*program error */ error_handler ( ) ; if (status_register.b1==1) /*program to protect block error */ error_handler ( ) ; }
m28r400ct, m28r400cb 38/48 figure 16. double word program flowchart and pseudo code note: 1. status check of b1 (protected block), b3 (v pp invalid) and b4 (program error) can be made after each program operation or after a sequence. 2. if an error is found, the status register must be cleared before further program/erase operations. 3. address 1 and address 2 must be consecutive addresses differing only for bit a0. write 30h ai03539b start write address 1 & data 1 (3) read status register yes no b7 = 1 yes no b3 = 0 no b4 = 0 v pp invalid error (1, 2) program error (1, 2) yes end yes no b1 = 0 program to protected block error (1, 2) write address 2 & data 2 (3) double_word_program_command (addresstoprogram1, datatoprogram1, addresstoprogram2, datatoprogram2) { writetoflash (any_address, 0x30) ; writetoflash (addresstoprogram1, datatoprogram1) ; /*see note (3) */ writetoflash (addresstoprogram2, datatoprogram2) ; /*see note (3) */ /*memory enters read status state after the program command*/ do { status_register=readflash (any_address) ; /* e or g must be toggled*/ } while (status_register.b7== 0) ; if (status_register.b3==1) /*vpp invalid error */ error_handler ( ) ; if (status_register.b4==1) /*program error */ error_handler ( ) ; if (status_register.b1==1) /*program to protect block error */ error_handler ( ) ; }
39/48 m28r400ct, m28r400cb figure 17. program suspend & resume flowchart and pseudo code write 70h ai03540b read status register yes no b7 = 1 yes no b2 = 1 program continues write d0h read data from another address start write b0h program complete write ffh read data program_suspend_command ( ) { writetoflash (any_address, 0xb0) ; writetoflash (any_address, 0x70) ; /* read status register to check if program has already completed */ do { status_register=readflash (any_address) ; /* e or g must be toggled*/ } while (status_register.b7== 0) ; if (status_register.b2==0) /*program completed */ { writetoflash (any_address, 0xff) ; read_data ( ) ; /*read data from another block*/ /*the device returns to read array (as if program/erase suspend was not issued).*/ } else { writetoflash (any_address, 0xff) ; read_data ( ); /*read data from another address*/ writetoflash (any_address, 0xd0) ; /*write 0xd0 to resume program*/ } } write ffh
m28r400ct, m28r400cb 40/48 figure 18. block erase flowchart and pseudo code note: if an error is found, the status register must be cleared before further program/erase operations. write 20h ai03541b start write block address & d0h read status register yes no b7 = 1 yes no b3 = 0 yes b4, b5 = 1 v pp invalid error (1) command sequence error (1) no no b5 = 0 erase error (1) end yes no b1 = 0 erase to protected block error (1) yes erase_command ( blocktoerase ) { writetoflash (any_address, 0x20) ; writetoflash (blocktoerase, 0xd0) ; /* only a12-a20 are significannt */ /* memory enters read status state after the erase command */ } while (status_register.b7== 0) ; do { status_register=readflash (any_address) ; /* e or g must be toggled*/ if (status_register.b3==1) /*vpp invalid error */ error_handler ( ) ; if ( (status_register.b4==1) && (status_register.b5==1) ) /* command sequence error */ error_handler ( ) ; if (status_register.b1==1) /*program to protect block error */ error_handler ( ) ; if ( (status_register.b5==1) ) /* erase error */ error_handler ( ) ; }
41/48 m28r400ct, m28r400cb figure 19. erase suspend & resume flowchart and pseudo code write 70h ai03542b read status register yes no b7 = 1 yes no b6 = 1 erase continues write d0h read data from another block or program/protection program or block protect/unprotect/lock start write b0h erase complete write ffh read data write ffh erase_suspend_command ( ) { writetoflash (any_address, 0xb0) ; writetoflash (any_address, 0x70) ; /* read status register to check if erase has already completed */ do { status_register=readflash (any_address) ; /* e or g must be toggled*/ } while (status_register.b7== 0) ; if (status_register.b6==0) /*erase completed */ { writetoflash (any_address, 0xff) ; read_data ( ) ; /*read data from another block*/ /*the device returns to read array (as if program/erase suspend was not issued).*/ } else { writetoflash (any_address, 0xff) ; read_program_data ( ); /*read or program data from another address*/ writetoflash (any_address, 0xd0) ; /*write 0xd0 to resume erase*/ } }
m28r400ct, m28r400cb 42/48 figure 20. locking operations flowchart and pseudo code write 01h, d0h or 2fh ai04364 read block lock states yes no locking change confirmed? start write 60h locking_operation_command (address, lock_operation) { writetoflash (any_address, 0x60) ; /*configuration setup*/ if (readflash (address) ! = locking_state_expected) error_handler () ; /*check the locking state (see read block signature table )*/ writetoflash (any_address, 0xff) ; /*reset to read array mode*/ } write ffh write 90h end if (lock_operation==lock) /*to protect the block*/ writetoflash (address, 0x01) ; else if (lock_operation==unlock) /*to unprotect the block*/ writetoflash (address, 0xd0) ; else if (lock_operation==lock-down) /*to lock the block*/ writetoflash (address, 0x2f) ; writetoflash (any_address, 0x90) ;
43/48 m28r400ct, m28r400cb figure 21. protection register program flowchart and pseudo code note: 1. status check of b1 (protected block), b3 (v pp invalid) and b4 (program error) can be made after each program operation or after a sequence. 2. if an error is found, the status register must be cleared before further program/erase controller operations. write c0h ai04381 start write address & data read status register yes no b7 = 1 yes no b3 = 0 no b4 = 0 v pp invalid error (1, 2) program error (1, 2) protection_register_program_command (addresstoprogram, datatoprogram) {: writetoflash (any_address, 0xc0) ; do { status_register=readflash (any_address) ; /* e or g must be toggled*/ } while (status_register.b7== 0) ; if (status_register.b3==1) /*vpp invalid error */ error_handler ( ) ; yes end yes no b1 = 0 program to protected block error (1, 2) writetoflash (addresstoprogram, datatoprogram) ; /*memory enters read status state after the program command*/ if (status_register.b4==1) /*program error */ error_handler ( ) ; if (status_register.b1==1) /*program to protect block error */ error_handler ( ) ; }
m28r400ct, m28r400cb 44/48 appendix d. command interface and program/erase controller state table 30. write state machine current/next, sheet 1 of 2. current state sr bit 7 data when read command input (and next state) read array (ffh) program setup (10/40h) block erase setup (20h) erase confirm (d0h) prog/ers suspend (b0h) prog/ers resume (d0h) read status (70h) clear status (50h) read array ?1? array read array prog.setup ers. setup read array read sts. read array read status ?1? status read array program setup erase setup read array read status read array read elect.sg. ?1? electronic signature read array program setup erase setup read array read status read array read cfi query ?1? cfi read array program setup erase setup read array read status read array lock setup ?1? status lock command error lock (complete) lock cmd error lock (complete) lock command error lock cmd error ?1? status read array program setup erase setup read array read status read array lock (complete) ?1? status read array program setup erase setup read array read status read array prot. prog. setup ?1? status protection register program prot. prog. (continue) ?0? status protection register program continue prot. prog. (complete) ?1? status read array program setup erase setup read array read status read array prog. setup ?1? status program program (continue) ?0? status program (continue) prog. sus read sts program (continue) prog. sus status ?1? status prog. sus read array program suspend to read array program (continue) prog. sus read array program (continue) prog. sus read sts prog. sus read array prog. sus read array ?1? array prog. sus read array program suspend to read array program (continue) prog. sus read array program (continue) prog. sus read sts prog. sus read array prog. sus read elect.sg. ?1? electronic signature prog. sus read array program suspend to read array program (continue) prog. sus read array program (continue) prog. sus read sts prog. sus read array prog. sus read cfi ?1? cfi prog. sus read array program suspend to read array program (continue) prog. sus read array program (continue) prog. sus read sts prog. sus read array program (complete) ?1? status read array program setup erase setup read array read status read array block erase setup ?1? status erase command error erase (continue) erase cmderror erase (continue) erase command error block erase cmd.error ?1? status read array program setup erase setup read array read status read array block erase (continue) ?0? status block erase (continue) erase sus read sts block erase (continue) block erase sus read sts ?1? status erase sus read array program setup erase sus read array erase (continue) erase sus read array erase (continue) erase sus read sts erase sus read array block erase sus read array ?1? array erase sus read array program setup erase sus read array erase (continue) erase sus read array erase (continue) erase sus read sts erase sus read array block erase sus read elect.sg. ?1? electronic signature erase sus read array program setup erase sus read array erase (continue) erase sus read array erase (continue) erase sus read sts erase sus read array
45/48 m28r400ct, m28r400cb note: cmd = command, elect.sg. = electronic signature, ers = erase, prog. = program, prot = protection, sus = suspend. table 31. write state machine current/next, sheet 2 of 2. block erase sus read cfi ?1? cfi erase sus read array program setup erase sus read array erase (continue) erase sus read array erase (continue) erase sus read sts erase sus read array block erase (complete) ?1? status read array program setup erase setup read array read status read array chip erase setup ?1? status chip erase command error chip erase (continue) chip erase command error chip erase cmd.error ?1? status read array program setup erase setup read array read status read array chip erase (continue) ?0? status erase (continue) chip erase (complete) ?1? status read array program setup erase setup read array read status read array current state command input (and next state) read elect.sg. (90h) read cfi query (98h) lock setup (60h) prot. prog. setup (c0h) lock confirm (01h) lock down confirm (2fh) unlock confirm (d0h) chip erase set up (80h) read array read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up read status read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up read elect.sg. read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up read cfi query read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up lock setup lock command error lock (complete) lock command error lock cmd error read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up lock (complete) read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up prot. prog. setup protection register program prot. prog. (continue) protection register program (continue) prot. prog. (complete) read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up prog. setup program program (continue) program (continue) prog. suspend read status prog. suspend read elect.sg. prog. suspend read cfi query program suspend read array program (continue) program suspend read array prog. suspend read array prog. suspend read elect.sg. prog. suspend read cfi query program suspend read array program (continue) program suspend read array current state sr bit 7 data when read command input (and next state) read array (ffh) program setup (10/40h) block erase setup (20h) erase confirm (d0h) prog/ers suspend (b0h) prog/ers resume (d0h) read status (70h) clear status (50h)
m28r400ct, m28r400cb 46/48 note: cmd = command, elect.sg. = electronic signature, prog. = program, prot = protection. prog. suspend read elect.sg. prog. suspend read elect.sg. prog. suspend read cfi query program suspend read array program (continue) program suspend read array prog. suspend read cfi prog. suspend read elect.sg. prog. suspend read cfi query program suspend read array program (continue) program suspend read array program (complete) read elect.sg. read cfiquery lock setup prot. prog. setup read array chip erase set up block erase setup block erase command error erase (continue) block erase command error block erase cmd.error read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up block erase (continue) block erase (continue) block erase suspend read status erase suspend read elect.sg. erase suspend read cfi query lock setup erase suspend read array erase (continue) erase suspend read array block erase suspend read array erase suspend read elect.sg. erase suspend read cfi query lock setup erase suspend read array erase (continue) erase suspend read array block erase suspend read elect.sg. erase suspend read elect.sg. erase suspend read cfi query lock setup erase suspend read array erase (continue) erase suspend read array block erase suspend read cfi query erase suspend read elect.sg. erase suspend read cfi query lock setup erase suspend read array erase (continue) erase suspend read array block erase (complete) read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up chip erase setup chip erase command error erase (continue) chip erase command error chip erase cmd.error read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up chip erase (continue) chip erase (continue) chip erase (complete) read elect.sg. read cfi query lock setup prot. prog. setup read array chip erase set up current state command input (and next state) read elect.sg. (90h) read cfi query (98h) lock setup (60h) prot. prog. setup (c0h) lock confirm (01h) lock down confirm (2fh) unlock confirm (d0h) chip erase set up (80h)
47/48 m28r400ct, m28r400cb revision history table 32. document revision history date version revision details january 2001 -01 first issue 20-feb-2001 -02 chip erase command added tfbga package connections modified tfbga package mechanical data and outline drawing modified tfbga package daisy chain drawings modified 27-jul-2001 -03 completely rewritten and restructured, document status changed to preliminary data. 05-mar-2002 -04 document status changed to data sheet 03-mar-2003 4.1 revision numbering modified: a minor revision will be indicated by incrementing the digit after the dot, and a major revision, by incrementing the digit before the dot (revision version 04 equals 4.0). revision history moved to end of document. 90ns speed class added. chip erase cycles limited to 100,000. t vpph parameter added to table 11 , absolute maximum ratings . 15-jun-2004 5.0 package specifications updated. u option added to table 20., ordering information scheme and table 21., daisy chain ordering scheme .
m28r400ct, m28r400cb 48/48 information furnished is believed to be accurate and reliable. however, stmicroelectronics assumes no responsibility for the co nsequences of use of such information nor for any infringement of patents or other rights of third parties which may result from its use. no license is granted by implication or otherwise under any patent or patent rights of stmicroelectronics. specifications mentioned in this publicati on are subject to change without notice. this publication supersedes and replac es all information previously supplied. stmicroelectronics prod ucts are not authorized for use as critical components in life support devices or systems without express written approval of stmicroelectro nics. the st logo is a registered trademark of stmicroelectronics. all other names are the property of their respective owners. ? 2004 stmicroelectronics - all rights reserved stmicroelectronics group of companies australia - belgium - brazil - canada - china - czech republic - finland - france - germany - hong kong - india - israel - italy - japan - malaysia - malta - morocco - singapore - spain - sweden - switzerland - united kingdom - united states www.st.com

▲Up To Search▲

Price & Availability of M28R400C-ZBU

	To Download M28R400C-ZBU Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .