 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| S25FS512S 512 mbit, 1.8 v serial peripheral interface with multi-i/o flash cypress semiconductor corporation ? 198 champion court ? san jose , ca 95134-1709 ? 408-943-2600 document number: 002-00488 rev. *g revised december 22, 2017 features serial peripheral interfa ce (spi) with multi-i/o ? spi clock polarity and phase modes 0 and 3 ? double data rate (ddr) option ? extended addressing C 24 o r 32-bit address options ? serial command subset and f ootprint compatible with s25fl-a, s25fl-k, s25fl-p , and s25fl-s spi families ? multi i/o command subset and footprint compatible with s25fl-p, and s25fl-s spi families read ? commands: normal, fast, dual i/o, quad i/o, ddr quad i/o ? modes: burst wrap, continuous (xip), qpi ? serial flash discoverable parameters (sfdp) and common flash interface (cfi), for configuration information. program ? 256 or 512 bytes page programming buffer ? program suspend and resume ? automatic error checking and correction (ecc) C internal hardware ecc with single bit error correction erase ? hybrid sector option ? physical set of eight 4 -kbytes sectors and one 224-kbytes sector at the top or bottom of address space with all remaining se ctors of 256 kbytes ? uniform sector option ? uniform 256 kbyte blocks ? erase suspend and resume ? erase status evaluation cycling endurance ? 100,000 program-erase cycles, minimum data retention ? 20 year data ret ention, minimum security features ? one time program (otp) array of 1024 bytes ? block protection: ? status register bits to control protection against program or erase of a contiguous range of sectors. ? hardware and softwar e control options ? advanced sector protection (asp) ? individual sector protection controlled by boot code or password ? option for password c ontrol of read access technology ? cypress 65-nm mirrorbit ? technology with eclipse ? architecture supply voltage ? 1.7 v to 2.0 v temperature range / grade ? industrial ( ? 40 c to +85 c) ? industrial plus ( ? 40 c to +105 c) ? automotive, aec-q100 grade 3 ( ? 40 c to +85 c) ? automotive, aec-q100 grade 2 ( ? 40 c to +105 c) ? automotive, aec-q100 grade 1 ( ? 40 c to +125 c) packages (all pb-free) ? 16-lead soic 300 mil (so3016) ? wson 6 ? 8 mm (wnh008) ? bga-24 6 ? 8 mm ?5 ? 5 ball (fab024) footprint ? known good die and known tested die
S25FS512S document number: 002-00488 rev. *g page 2 of 135 logic block diagram performance summary maximum read rates command clock rate (mhz) mbytes/s read 50 6.25 fast read 133 16.5 dual read 133 33 quad read 133 66 ddr quad i/o read 80 80 typical program and erase rates operation kbytes/s page programming (256-bytes page buffer) 712 page programming (512-bytes page buffer) 1080 4-kbytes physical sector era se (hybrid sector option) 28 256-kbytes sector erase (unifo rm logical sector option) 250 typical current consumption, ? 40c to +85c operation current (ma) serial read 50 mhz 10 serial read 133 mhz 20 quad read 133 mhz 60 quad ddr read 80 mhz 70 program 60 erase 60 standby 0.07 deep power down 0.006 sram mirrorbit array control logic data path x decoders cs# sck si/io0 so/io1 reset#/io3 wp#/io2 i/o y decoders data latch document number: 002-00488 rev. *g page 3 of 135 S25FS512S contents 1. overview ............................................................... ........ 4 1.1 general description ......................................... .............. 4 1.2 migration notes............................................. ................. 4 1.3 glossary.................................................... ..................... 7 1.4 other resources............................................. ............... 7 hardware interface 2. signal descriptions ..................................................... 8 2.1 input/output summary........................................ ........... 8 2.2 multiple input / output (mio)............................... ........... 9 2.3 serial clock (sck) .......................................... ............... 9 2.4 chip select (cs#) ........................................... ............... 9 2.5 serial input (si) / io0 ..................................... ................ 9 2.6 serial output (so) / io1.................................... ............. 9 2.7 write protect (wp#) / io2 ................................... ........... 9 2.8 io3 / reset# ... ............ ........... ........... .......... .............. 10 2.9 voltage supply (v cc )................................................... 10 2.10 supply and signal ground (v ss ) ................................. 10 2.11 not connected (nc) ......................................... ........... 10 2.12 reserved for fu ture use (rfu).............................. ..... 10 2.13 do not use (dnu) ............ ........... ........... ......... ............ 10 2.14 block diagrams............................................. ............... 11 3. signal protocols ......................................................... 12 3.1 spi clock modes ............................................. ............ 12 3.2 command protocol ............................................ .......... 13 3.3 interface states............................................ ................ 16 3.4 configuration register effects on the interface ........... 2 0 3.5 data protection ............................................. ............... 20 4. electrical specifications ............................................ 21 4.1 absolute maximum ratings .................................... ..... 21 4.2 thermal resistance .......................................... ........... 21 4.3 latchup characteristics ..................................... .......... 21 4.4 operating ranges............................................ ............ 21 4.5 power-up and power-down ..................................... ... 22 4.6 dc characteristics .......................................... ............. 24 5. timing specifications ................................................ 26 5.1 key to switching waveforms .................................. ..... 26 5.2 ac test conditions .......................................... ............ 26 5.3 reset....................................................... ..................... 27 5.4 sdr ac characteristics ..................................... ......... 29 5.5 ddr ac characteristics. ..................................... ........ 31 6. physical interface ...................................................... 34 6.1 soic 16-lead package ........................................ ....... 34 6.2 8-connector package ....... .............. ........... ......... ......... 36 6.3 bga 24-ball, 5x5 ball foot print (fab024)................... 38 software interface 7. address space maps .................................................. 40 7.1 overview.................................................... ................... 40 7.2 flash memory array.......................................... ............ 40 7.3 id-cfi address space ........................................ .......... 41 7.4 jedec jesd216 serial flash discoverable parameters (sfdp) space ..... ................................... ... 41 7.5 otp address space ........................................... .......... 42 7.6 registers................................................... .................... 43 8. data protection ........................................................... 60 8.1 secure silicon region (ot p)........... ........... ........... ....... 60 8.2 write enable command........ ........... ........... .......... ........ 61 8.3 block protection ............................................ ................ 61 8.4 advanced sector protection .................................. ....... 62 8.5 recommended protection process .............................. 67 9. commands ............................................................... ... 68 9.1 command set summary......................................... ...... 69 9.2 identification commands ..................................... ......... 75 9.3 register access commands.................................... ..... 77 9.4 read memory array commands . ............ ............ ......... 88 9.5 program flash array commands ................................ . 95 9.6 erase flash array commands.................................. .... 97 9.7 one time program array commands ........................ 103 9.8 advanced sector protection commands .................... 104 9.9 reset commands .............................................. ......... 109 9.10 dpd commands ............................................... .......... 111 10. embedded algorithm performance tables ............. 113 11. data integrity ............................................................. 1 14 11.1 erase endurance ............................................ ............ 114 11.2 data retention ............................................. ............... 114 11.3 serial flash disco verable parameters (sfdp) address map............................................. ..... 114 11.4 device id and common flash interface (id-cfi) address map........................................... ...... 117 11.5 initial delive ry state ..................................... ............... 130 ordering information 12. ordering part number .............................................. 131 13. contact ............................................................... ....... 132 14. revision history ........................................................ 133 sales, solutions, and legal information ....................... ..135 worldwide sales and design supp ort ............ ............. 135 products ...................................................... ................ 135 psoc? solutions ............................................... ......... 135 cypress developer community . .................................. 135 technical support ........... .................................. .......... 135 document number: 002-00488 rev. *g page 4 of 135 S25FS512S 1. overview 1.1 general description the cypress S25FS512S device is a flash non-volat ile memory pro duct using: ? mirrorbit technology that stores two data bits in each memory array transistor ? eclipse architecture that dramatically improves program and e rase performance ? 65 nm process lithography the S25FS512S connects to a host system via a serial peripheral interface (spi). traditional sp i single bit serial input and o utput (single i/o or sio) is supporte d as well as opt ional two-bit (d ual i/o or dio) and four-bit wid e quad i/o (qio) or quad periph eral interface (qpi) serial commands. this multiple-width interface is called spi multi-i/o or mio. in addition, there are double d ata rate (ddr) read commands for qio and qpi that transfer address and r ead data on both edges of the clock. the fs-s eclipse architecture features a page programming buffe r that allows up to 512 bytes to be programmed in one operation , resulting in faster effective pr ogramming and erase than prior generation spi program o r erase algorithms. executing code directly from flash memory is often called execu te-in-place or xip. by using S25FS512S devices at the higher cl ock rates supported, with quad or ddr -quad commands, the instructio n read transfer rate can match or exceed traditional parallel interface, asynchronou s, nor flash memories, while reducing sig nal count dramatically. the S25FS512S products offer hig h densities coupled with the fl exibility and fast performance re quired by a variety of mobile or embedded applications. they are an excellent solution for syste ms with limited space, signal co nnections, and power. they are ideal for code shadowing to ram, executi ng code directly (xip), and s toring reprogrammable data. 1.2 migration notes 1.2.1 features comparison the S25FS512S is command subset and footprint com patible with p rior generation fl-s, fl-k, an d fl-p families. however, the power supply and interface voltages are nominal 1.8v. table 1. cypress spi families comparison parameter fs-s fl-s fl-k fl-p technology node 65 nm 65 nm 90 nm 90 nm architecture mirrorbit ? eclipse ? mirrorbit ? eclipse ? floating gate mirrorbit ? density 128 mb - 512 mb 128 mb - 1 gb 4 mb - 128 mb 32 mb - 256 m b bus width x1, x2, x4 x1, x2 , x4 x1, x2, x4 x1, x2, x4 supply voltage 1.7v - 2.0v 2.7v - 3.6v / 1.65v - 3.6v v io 2.7v - 3.6v 2.7v - 3.6v normal read speed (sdr) 6 mb/s (50 mhz) 6 mb/s (50 mhz) 6 mb/s (50 mhz) 5 mb/s (40 mhz) fast read speed (sdr) 16.5 mb/s (133 mhz) 17 mb/s (133 mhz) 13 mb/s (104 mhz) 13 mb/s (104 mhz) dual read speed (sdr) 33 mb/s (133 mhz) 26 mb/s (104 mhz) 26 mb /s (104 mhz) 20 mb/s (80 mhz) quad read speed (sdr) 66 mb/s (133 mhz) 52 mb/s (104 mhz) 52 mb /s (104 mhz) 40 mb/s (80 mhz) quad read speed (ddr) 80 mb/s (80 mhz) 80 mb/s (80 mhz) program buffer size 256b / 512b 256b / 512b 256b 256b erase sector size 64 kb / 256 kb 64 kb / 256 kb 4 kb / 32 kb / 64 kb 64 kb / 256 kb parameter sector size 4 kb (option) 4 kb (option) 4 kb 4 kb sector erase rate (typ.) 500 kb/s 500 kb/s 136 kb/s (4 kb) 437 kb/s (64 kb) 130 kb/s page programming rate (typ.) 0.71 mb/s (256b) 1.08 mb/s (512b) 1.2 mb/s (256b) 1.5 mb/s (512b) 365 kb/s 170 kb/s otp 1024b 1024b 768b (3x256b) 506b advanced sector protection yes yes no no auto boot mode no yes no no document number: 002-00488 rev. *g page 5 of 135 S25FS512S notes: 1. 256b program page option only for 128 mb and 256 mb density fl-s devices. 2. fl-p column indicates fl129p mio spi device (for 128 mb densi ty), fl128p does not support mio, otp, or 4 kb sectors. 3. 64-kb sector erase option only for 128 mb / 256 mb density fl-p, fl-s, and fs-s devices. 4. fl-k family devices can erase 4-kb sectors in groups of 32 kb or 64 kb. 5. only 128 mb/256 mb density fl-s devic es have 4-kb parameter sector option. 6. 512 mb / 1 gb fl-s devices support 256 kb-sector only. 7. the fs512 device does no t support 64 kb-sectors. 8. refer to individual product data sheets for further details. 1.2.2 known differences fr om prior generations 1.2.2.1 error reporting fl-k and fl-p memories either do not have e rror status bits or do not set them if program or eras e is attempted on a protected sector. the fs-s and fl-s familie s do have error reporting stat us bits for program an d erase operations. t hese can be set when there is an internal failure to program or erase, or when there is an attempt to program or eras e a protected sector. in these cases the program or erase operation did not comp lete as requested by the command. the p_err or e_er r bits and the wip bit will be set to and remain 1 in sr1v. the clear status register command must be sent to clear the errors and return the device to stand by state. 1.2.2.2 secure silicon region (otp) the fs-s size and format (address map) of the one time program area is different fro m fl-k and fl-p generations. the method for protecting each portion of the otp area is different. for a dditional details see secure silicon region (otp) on page 60 . 1.2.2.3 configuration register freeze bit the configuratio n register 1 freeze bi t cr1v[0], lo cks the stat e of the block protec tion bits (sr1nv[4:2] and sr1v[4:2]), tbparm_o bit (cr1nv[2]), and tbpr ot_o bit (cr1nv[5]), as in pri or generations. in the fs-s a nd fl-s families the freeze bit also locks the state of the confi guration register 1 bpnv_o bit (cr1nv[3]), and the secure silicon region (otp) area. 1.2.2.4 sector erase commands the command for erasing a 4-kbyt es sector is supported only for use on 4-kbytes parameter secto rs at the top or bottom of the fs-s device address space. the command for erasing an 8-kbyt e area (two 4-kbytes sectors) is not supported. the command for erasing a 32-kbyt e area (eight 4-k bytes sectors ) is not supported. the 64 kbytes erase co mmand is not support ed for the 512 mbits density fs-s device. 1.2.2.5 deep power-down a deep power-down (dpd) function is supported in the fs-s famil y devices. erase suspend/resume yes yes yes no program suspend/resume yes yes yes no deep power-down mode yes no yes yes operating temperature -40c to +85c / +105c -40c to +85c / +105c / +125c -40c to +85c -40c to +85c / +105c table 1. cypress spi families comparison (continued) parameter fs-s fl-s fl-k fl-p document number: 002-00488 rev. *g page 6 of 135 S25FS512S 1.2.2.6 wrr single register write in some legacy spi devices, a wri te registers (wrr) command wit h only one data byte would update status r egister 1 and clear some bits in configuration regist er 1, including the quad mode bit. this could result in unin tended exit from quad mode. the S25FS512S only updates status register 1 when a single data byt e is provided. the configuration register 1 is not modified in this case. 1.2.2.7 hold input not supported in some legacy spi devices, the io3 input has an alternate func tion as a hold# input used to p ause information transfer withou t stopping the serial c lock. this function is not supported in th e fs-s family. 1.2.2.8 separate reset input not supported in some legacy spi devices, a s eparate hardware reset# input is supported in packages having more than eight connections. the fs-s family does not support a separate reset# in put. the fs-s family provides an alternate f unction for the io3 input as a reset# input. when the cs# si gnal is high and the io3 / reset f eature is enabled, the io3 / reset# input is used to initiate a hardware reset when the input goes low. 1.2.2.9 other legacy commands not supported ? autoboot related commands ? bank address related commands ? dual output read ? quad output read ? quad page program (qpp) replac ed by page program in qpi mode ? ddr fast read ? ddr dual i/o read 1.2.2.10 new features the fs-s family introduces new fe atures to cypres s spi category memories: ? single 1.8v power supply for core and i/o voltage. ? configurable initial read latency (number o f dummy cycles) for faster initial access time or hi gher clock rate read commands. ? qpi (qpi, 4-4-4) read mode in whi ch all transfers are 4 bits wi de, including instructions. ? jedec jesd216 standard, serial flash discoverable parameters (s fdp) that provide device feature and c onfiguration information. ? evaluate erase status c ommand to determine if the last erase op eration on a sector completed su ccessfully. this command can be used to detect incomplete era se due to power loss or other c auses. this command can be hel pful to flash file system software in file system recovery after a power loss. ? advanced sector protection (asp) p ermanent protection. a bit is added to the asp register to provide the option to make protection of the persistent p rotection bits (ppb) permanent. a lso, when one of the two asp protection modes is selected, all otp configuration bits in all r egisters are prot ected from furt her programming so that all otp co nfiguration settings are made permanent. the otp address space is not protected by the select ion of an asp protection mode. the freeze bit (cr1v[0]) may be used to protect the otp address space. document number: 002-00488 rev. *g page 7 of 135 S25FS512S 1.3 glossary 1.4 other resources 1.4.1 cypress flash memory roadmap www.cypress.com/product-roadmaps /cypress-flash-memory-roadmap 1.4.2 links to software www.cypress.com/software-and-d rivers-cypress-flash-memory 1.4.3 links to application notes www.cypress.com/appnotes bcd binary coded decimal . a value in which each 4-bit n ibble represents a decimal numer al. command all information transferred between the host system and memory during one period while cs# is low. this includes the instruction (sometimes call ed an operation code or opcode) and any required address, mode bi ts, latency cycles, or data. ddp dual die package . two die stacked within the same package to increase the memor y capacity of a single package. often also referred to as a multi-chip package (mcp). ddr double data rate . when input and output are latched on every edge of sck. ecc ecc unit = 16 byte aligned and length data groups in the main f lash array and otp array, each of which has its own hidden ecc syndrome to enable error correction on each group. flash the name for a type of electrical erase programmable read only memory (eeprom) that erases large blocks of memory bits in parallel, making the erase operation much faster than early eeprom. high a signal voltage level ? v ih or a logic level representing a binary one (1). instruction 8-bit code indicating the functi on to be performed by a command (sometimes called an operation code or opcode). the instruction is always the firs t 8 bits transferred from host sy stem to the memory in any command. low a signal voltage level ? v il or a logic level representing a binary zero (0). lsb least significant bit . generally the right most bit, w ith the lowest order of magnit ude value, within a group of bits of a register or data value. msb most significant bit . generally the left most bit, w ith the highest order of magnit ude value, within a group of bits of a register or data value. n/a not applicable . a value is not relevan t to situation described. non-volatile no power is needed to maintain data stored in the memory. opn ordering part number . the alphanumeric string specif ying the memory device type, de nsity, package, factory non-volatile configuration, etc . used to select the desired dev ice. page 512-byte or 256-byte aligned and length group of data. the size assigned for a page depends on the ordering part number. pcb printed circuit board. register bit references format: register_name[bit_number] or register_name[bit_range_ms b: bit_range_lsb]. sdr single data rate . when input is latched on the rising edge and output on the fa lling edge of sck. sector erase unit size; depending on devi ce model and sector location this may be 4 kbytes, 64 kbytes, or 256 kbytes. write an operation that changes data within volatile or non-volatile registers bits or non-volatile flash memory. when changing non-volatile data, an erase and reprogramming of any unchanged non-volatile data is done, as part of the operation, such that the non-volatile data is modified by the write operat ion, in the same way that volatile data is modified C as a single operation. the non-volati le data appears to the host sys tem to be updated by the single write command, without the need for separate commands for erase and reprogram of adjac ent, but unaffected data. document number: 002-00488 rev. *g page 8 of 135 S25FS512S hardware interface serial peripheral interface wi th multiple inpu t / output (spi-m io) many memory devices connect to t heir host system with separate parallel control, address, and d ata signals that require a larg e number of signal connections and larger package size. the large number of connections increase power consumption due to so many signals switchin g and the larger pack age increases cost. the S25FS512S reduces the numbe r of signals for connection to t he host system by seri ally transferr ing all contro l, address, a nd data information over 4 to 6 si gnals. this reduces the cost of the memory package, reduces sig nal switching power, and either reduces the host connection count or frees host connectors for use in providing other features. the S25FS512S uses the industry standard single bit serial peri pheral interface (spi) and als o supports optio nal extension commands for two-bit (dual) and four-bit (quad) wide serial tra nsfers. this multiple width int erface is called spi multi-i/o o r spi-mio. 2. signal descriptions 2.1 input/output summary table 2. signal list signal name type description sck input serial clock. cs# input chip select. si / io0 i/o serial input for single bit data commands or io0 for dual or quad commands. so / io1 i/o serial output for single bit data commands. io 1 for dual or quad commands. wp# / io2 i/o write protect when not in quad mode (cr1v[1] = 0 and sr1nv[7] = 1). see table 19 on page 44 . io2 when in quad mode (cr1v[1] = 1). the signal has an internal pul l-up resistor and may be left unc onnected in the host system if not used for quad commands or write protecti on. if write protection is enabl ed by sr1nv[7] = 1 and cr1v[1] = 0, the host system is required to drive wp# high or low during a wrr or wra r command. io3 / reset# i/o io3 in quad-i/o mode, when configurat ion register 1 quad bit, cr1v [1] =1, and cs# is low. reset# when enabled by cr2v[5]=1 and not in quad-i/o mode, cr1v[1] = 0, or when enabled in quad mode, cr1v[1] = 1 and cs# is high. the signal has an internal pul l-up resistor and may be left unc onnected in the host system if not used for quad commands or reset#. v cc supply power supply. v ss supply ground. nc unused not connected. no device internal signal is connected to the package connecto r nor is there any future plan to use the connector for a signal . the connection may safely be used for routing space for a signal on a printed circuit board (pcb). how ever, any signal connected to a n nc must not have voltage levels higher than v cc . rfu reserved reserved for future use. no device internal signal is currently connected to the packag e connector but there is potential future use of the connector for a signal. it is recommended to not use rfu connectors for pcb routing channels so that the pcb may take advantage of futu re enhanced features in compatible footprint devices. dnu reserved do not use. a device internal signal may be connected to the package conne ctor. the connection may be used by cypress for test or ot her purposes and is not intended for connection to any host system signal. any dnu signal related function will be inactive when the signal is at v il . the signal has an internal pull-down resistor and may be left unconnected in the host system or may be tied to v ss . do not use these connections for pcb signal routing channels . do not connect any host system signal to this connection. document number: 002-00488 rev. *g page 9 of 135 S25FS512S 2.2 multiple input / output (mio) traditional spi single bit wide commands (single or sio) send i nformation from the host to the memory only on the serial input (si) signal. data may be sent back to the host serially on the seria l output (so) signal. dual or quad input / output (i/o ) commands send instructions to the memory only on the si / io 0 signal. address or data is sen t from the host to the memory as bit pairs on io0 and io1 or four -bit (nibble) groups on io0, io1, io2, and io3. data is returne d to the host similarly as bit pairs on io0 and io1 or four-bit (nibble) groups on io0, io1 , io2, and io3. qpi mode transfers all instructions, address, and data from the host to the memory as four-bit (nibble) groups on io0, io1, io 2, and io3. data is returned to the host similarly as four-bit (nibble ) groups on io0, io1, io2, and io3. 2.3 serial clock (sck) this input signal provides the syn chronization re ference for th e spi interface. instructions, addresses, or data input are lat ched on the rising edge of the sck signa l. data output changes after th e falling edge of sck, in sdr co mmands, and after every edge in ddr commands. 2.4 chip select (cs#) the chip select signal indicates when a command is transferring information to or from the device and the other signals are re levant for the memory device. when the cs# signal is at the logic high st ate, the device is n ot selected and all input signa ls are ignored and all output si gnals are high impedance. the device will be in the standby power mode, u nless an internal embedded o peration is in progress. an embedded operation is indicated by the status register 1 write- in-progress bit (sr1v[ 1]) set to 1, until t he operation is comp leted. some example embedded operations are: program, erase, or write registers (wrr) operations. driving the cs# input to the logic low state enables the device , placing it in the active power mode. after power-up, a fallin g edge on cs# is required prior to the start of any command. 2.5 serial input (si) / io0 this input signal is used to trans fer data serially into the de vice. it receives instructions, a ddresses, and data to be progr ammed. values are latched on the risi ng edge of serial sck clock signa l. si becomes io0 an i nput and output during dual and quad comma nds for receiving in structions, addre sses, and data to be programmed (values latched on ris ing edge of serial sck clock s ignal) as well as shifting out data (on the falling edge of sck , in sdr commands, and on every edge of sck, in ddr commands). 2.6 serial output (so) / io1 this output signal is used to tra nsfer data serially out of the device. data is shifted out on the falling edge of the serial sck clock signal. so becomes io1 an i nput and output during dual and quad comma nds for receiving addresses, and data to be programmed (values latched on rising edge of serial sck clock signal) as w ell as shifting out data (on the falling edge of sck, in sdr co mmands, and on every edge of sck, in ddr commands). 2.7 write protect (wp#) / io2 when wp# is driven low (v il ), during a wrr or wrar comman d and while the status register w rite disable (srwd_nv) bit of status register 1 (sr1nv[7]) is s et to a 1, it is not possible to write to status register 1 or configuration register 1 relat ed registers. in this situation, a wrr command is ignored, a wrar command sel ecting sr1nv, sr1v, cr1nv, or cr1v is ignored, and no error is set. this prevents any alteration of t he block protection settings. as a consequence, all the data bytes in the memory area that ar e protected by the block protection feature are also hardware pro tected against data modification if wp# is low during a wrr or wrar command with sr wd_nv set to 1. the wp# function is not available when the quad mode is enabled (cr1v[1]=1). the wp# function is replaced by io2 for input and output during quad mode for receiving addresses, and data to be programmed (values are latched on rising edge of the sck signa l) as well as shifting out data ( on the falling edge of sck, in sd r commands, and on every edg e of sck, in ddr commands). document number: 002-00488 rev. *g page 10 of 135 S25FS512S wp# has an internal pull-up resi stance when unconnected, wp# i s at v ih and may be left unc onnected in the host system if not used for quad mode or protection. 2.8 io3 / reset# io3 is used for input and output during quad mode (cr1v[1]=1) f or receiving addresse s, and data to be progr ammed (values are latched on rising edge of the sc k signal) as well as shifting o ut data (on the falling edge of sck, in sdr commands, and on ev ery edge of sck, in ddr commands). the io3 / reset# signal may also be used to initia te the hardwa re reset function when the reset feature is enabled by writing configuration register 2 non-vol atile bit 5 (cr2v[5]=1). the in put is only treated as reset# when the devic e is not in quad-i/ o mode, cr1v[1] = 0, or when cs# is high. when quad i/o mode is i n use, cr1v[1]=1, and t he device is select ed with cs# low, the io3 / reset# is used only as io 3 for information transfer. when cs# is high, the io3 / reset# is not in use for information tr ansfer and is used as the r eset# input. by c onditioning th e reset oper ation on cs# high du ring quad mode, the re set function remains available during quad mode. when the system enters a reset co ndition, the cs# signal must b e driven high as par t of the reset process and the io3 / reset# signal is driven low . when cs# goes high the io3 / reset# input transitions from being io3 to being the reset# input. the rese t condition is then detected when c s# remains high and the io3 / reset# signal remains low for t rp . if a reset is no t intended, the system is required to actively d rive io3 / reset# to high along with cs# being driven high at t he end of a transf er of data to the memory. following tr ansfers of data to t he host system, the mem ory will drive io 3 high during t cs . this will ensure that io3 / reset is not left floating or being pul led slowly to high by the inte rnal or an external passive pull- up. thus, an unintended reset is not triggered by the io3 / reset# not be ing recognized as high befo re the end of t rp . the io3 / reset# signal is unus ed when the reset feature is dis abled (cr2v[5]=0). the io3 / reset# signal has an internal pull-up resistor and ma y be left unconnected in the host system if not used for quad m ode or the reset function. the internal pull-up will hold io3 / res et high after the host system has actively driven the signal hi gh and then stops driving the signal. note that io3 / reset# cannot be shared by more than one spi-mi o memory if any of them are ope rating in quad i/o mode as io3 being driven to or from one selec ted memory may look like a res et signal to a second non-select ed memory sharing the same io3 / reset# signal. 2.9 voltage supply (v cc ) v cc is the voltage sour ce for all device internal logic. it is the single voltage used for all devi ce internal functions includin g read, program, and erase. 2.10 supply and signal ground (v ss ) v ss is the common voltage drain a nd ground reference for the devic e core, input signal receivers, and output drivers. 2.11 not connected (nc) no device internal signal is co nnected to the package connector nor is there any future plan to use the connector for a signal . the connection may safely be used for routing space for a signal on a printed circuit board (pcb). 2.12 reserved for future use (rfu) no device internal signal is cur rently connected to the package connector but there is potentia l future use of the connector. it is recommended to not use rfu connec tors for pcb routing channels so that the pcb may take adv antage of fut ure enhanced features in compatib le footprint devices. 2.13 do not use (dnu) a device internal signal may be connected to the package connec tor. the connection may be used b y cypress for test or other purposes and is not intended for connecti on to any host system signal. any dnu signal related fun ction will be inactive when t he signal is at v il . the signal has an internal pull-down resistor and may be left unconnected in t he host system or may be tied to v ss . do not use these connections fo r pcb signal routing channels. d o not connect any host system si gnal to these connections. document number: 002-00488 rev. *g page 11 of 135 S25FS512S 2.14 block diagrams figure 1. bus master and memory devices on the spi bus singl e bit data path figure 2. bus master and memory devices on the spi bus dual bit data path figure 3. bus master and memory devices on the spi bus quad bit data path spi bus master reset# wp# so si sck cs2# cs1# fs-s flash fs-s flash reset# wp# so si sck cs2# cs1# spi bus master reset# wp# io1 io0 sck cs2# cs1# fs-s flash fs-s flash reset# wp# io0 io1 sck cs2# cs1# spi bus master io3 / reset# io2 io1 io0 sck cs1# fs -s flash reset# / io3 io2 io0 io1 sck cs1# document number: 002-00488 rev. *g page 12 of 135 S25FS512S 3. signal protocols 3.1 spi clock modes 3.1.1 single data rate (sdr) the S25FS512S can be driven by an embedded microcontroller (bus master) in either of the two following clocking modes. ? mode 0 with clock polarity (cpol) = 0 and, clock phase (cpha) = 0 ? mode 3 with cpol = 1 and, cpha = 1 for these two modes, input data into the device is always latch ed in on the rising edg e of the sck signal and the output data is always available from the falling edge of the sck clock signal. the difference betw een the two modes is t he clock polarity when the bus master is in standby mo de and not transferring any dat a. ? sck will stay at logic low st ate with cpol = 0, cpha = 0 ? sck will stay at logic high st ate with cpol = 1, cpha = 1 figure 4. spi sdr modes supported timing diagrams throughout the remainder of the document are ge nerally shown as both mode 0 and 3 by showing sck as both high and low at the f all of cs#. in some cases a timing diagram may show only mode 0 with sck lo w at the fall of cs#. in such a case, mode 3 timing simply means clock is high at the fall of c s# so no sck rising edge set up o r hold time to the falling edg e of cs# is needed for mode 3. sck cycles are measured (counted) from one fallin g edge of sck to the next falling edge of sck. i n mode 0 the beginning of the first sck cycle in a command is measured from the falling edge of cs# to the first falling edge of sck because sck is already low at the beginning of a command. 3.1.2 double data rate (ddr) mode 0 and mode 3 are also supported for ddr commands. in ddr c ommands, the instruction bits are always latched on the rising edge of clock, the same as in s dr commands. however, the addres s and input data that follow t he instruction are latched on bot h the rising and falling edges of sck. the first address bit is l atched on the first rising edge of sck following the falling ed ge at the end of the last instruction bit. the first bit of output data is dr iven on the falling edge at the end of the la st access latency (dummy) cycle. sck cycles are measured (counted) in the same way as in sdr com mands, from one falling edge of sck to the next falling edge of sck. in mode 0 th e beginning of th e first sck cycle in a comman d is measured from the falling edge of cs# to the first falling edge of sck because sck is already lo w at the beginning of a command . figure 5. spi ddr modes supported cpol=0_cpha=0_sck cpol=1_cpha=1_sck cs# si so msb msb cpol=0_cpha=0_sck cpol=1_cpha=1_sck cs# transfer_phase si so inst. 7 inst. 0 a31 a30 a0 m7 m6 m0 dlp7 dlp0 d0 d1 dummy / dlp address mode instruction read data document number: 002-00488 rev. *g page 13 of 135 S25FS512S 3.2 command protocol all communication between the ho st system and S25FS512S devices is in the form of uni ts called commands. all commands begin with an 8-bit i nstruction that selects the t ype of information transfer or d evice operation to be performed . commands may also have an addre ss, instruction modifier, latenc y period, data transfer to the memory, or da ta transfer from th e memory. all instruction, addre ss, and data information is trans ferred sequentially between the host system and memory device. command protocols are also classi fied by a numerical nomenclatu re using three numbers to referenc e the transfer w idth of three command phases: ? instruction ? address and instruction modifie r (continuous read mode bits) ? data single-bit wide comm ands start with an instruction and may prov ide an address or data, all sent only on the si signal. data ma y be sent back to the host serially on the so signal. this is refere nced as a 1-1-1 command protocol for single-bit width instructi on, single-bit width address and modifier, single-bit data. dual or quad input / output (i/o ) commands provide an address s ent from the host as bit pairs on io0 and io1 or, four-bit (nib ble) groups on io0, io1, io2, and io3 . data is returned to the host similarly as bit pairs on io0 and io1 or, f our-bit (nibble) gro ups on io0, io1, io2, and io3. this is r eferenced as 1-2-2 for dual i/ o and 1-4-4 for quad i /o command protocols. the S25FS512S also supports a qp i mode in which all information is transferred in 4-bit width, in cluding the instruction, addr ess, modifier, and data. this is refer enced as a 4-4-4 command proto col. commands are structured as follows: ? each command begins with cs# goi ng low and ends with cs# return ing high. the memory device is selected by the host driving the chip select (cs#) signal low throughout a command. ? the serial clock (sck ) marks the transfer of each bit or group of bits between t he host and memory. ? each command begins with an eight bit (byte) instruction. the i nstruction selects the type of i nformation transfer or device operation to be performed. the instruction transfers occur on s ck rising edges. however, some read commands are modified by a prior read command, such that the instruction is implied from the earlier command. this is called continuous read mode. when the device is in continuous read mode, the instruction bits are not transmitted at the beginning of the command because the instruction is the sam e as the read command that initiated the continuous read mode. in conti nuous read mode the command will begin with the r ead address. thus, continuous read mode re moves eight instruct ion bits from each read command in a series of same type read commands. ? the instruction may be stand alone or may be followed by addres s bits to select a loca tion within one of several address space s in the device. the instruction determines the address space use d. the address may be either a 24-bit or a 32-bit, byte boundar y, address. the address tr ansfers occur on sck rising edge, in sdr commands, or on every sck edge, in ddr commands. ? in legacy spi mode, the width o f all transfers following the in struction are determined by the i nstruction sent. following tra nsfers may continue to be single bit seri al on only the s i or serial o utput (so) signals, they may be done in two bit groups per (dua l) transfer on the io0 and io1 signa ls, or they may be done in 4-b it groups per (quad) transfer on the io0-io3 signals. within th e dual or quad groups t he least significant b it is on io0. more s ignificant bits are placed in si gnificance order on each higher numbered io signal. single bits or parallel bit groups are tran sferred in most to least significant bit order. ? in qpi mode, the width of all transfers is a 4-bit wide (quad) transfer on the io0-io3 signals. ? dual and quad i/o read instructi ons send an instru ction modifie r called continuous read mode bits , following the address, to indicate whether the next comma nd will be of the same type with an implied, rather t han an explicit, instr uction. these mode b its initiate or end the continuous read mode. in continuous read mo de, the next command thus does no t provide an instruction byte, only a new address and mode bits . this reduces the time needed to send each command when the same command type is repeated in a sequence of commands. the mode bit transfers occu r on sck rising edge, in sdr commands, or on every sck edge, in ddr commands. ? the address or mode bits may be followed by write data to be st ored in the memory device or by a read latency period before read data is returned to the host. ? write data bit transfers occur on sck rising edge, in sdr comma nds, or on every sck edge, in ddr commands. document number: 002-00488 rev. *g page 14 of 135 S25FS512S ? sck continues to toggle during any read access latency period. the latency may be ze ro to several sck cycl es (also referred to as dummy cycles). at the end of the read latency cycles, the fi rst read data bits are driven from the outputs on sck falling e dge at the end of the last read laten cy cycle. the first read data bit s are considered transferred to t he host on the following sck r ising edge. each following transfer occurs on the next sck rising edg e, in sdr commands, or on every sck edge, in ddr commands. ? if the command returns read data to the host, the device contin ues sending data transfers until the host takes the cs# signal high. the cs# signal can be driven high after a ny transfer in the rea d data sequence. this will terminate the command. ? at the end of a command that does not retur n data, the host dri ves the cs# input high. the cs# signal must go high after the eighth bit, of a stand alone instruction or, of the last write data byte that is transferred. that is, the cs# signal must be driven high when the number of bits after the cs# signal was driven low is an exact multiple of e ight bits. if the cs# signal does not go high exactly at the eight-bit bounda ry of the instruction or write d ata, the command is reje cted and not executed. ? all instruction, address, and m ode bits are shi fted into the de vice with the most si gnificant bits (msb) f irst. the data bits are shifted in and out of the device msb first. all data is transfe rred in byte units with the lowe st address byte sent first. fol lowing bytes of data are sent in lowe st to highest byt e address order i.e. the byte address increments. ? all attempts to read the flash memory array during a program, e rase, or a write cycle (embedded operations) are ignored. the embedded operation will continue t o execute without any affect. a very limited set of comma nds are accepted during an embedded operation. these are discussed in the individual comma nd descriptions. ? depending on the command, the time for execution varies. a comm and to read status information from an executing command is available to determine when the command completes execution and whether the command was successful. 3.2.1 command sequence examples figure 6. stand alone instruction command figure 7. single bit wide input command figure 8. single bit wide output command cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input data cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction data 1 data 2 document number: 002-00488 rev. *g page 15 of 135 S25FS512S figure 9. single bit wide i/o command without latency figure 10. single bit wide i/o command with latency figure 11. dual i/o command figure 12. quad i/o command figure 13. quad i/o read command in qpi mode cs# sck si so phase 7 6 5 4 3 2 1 0 31 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction address data 1 data 2 cs# sck si so phase 7 6 5 4 3 2 1 0 31 1 0 7 6 5 4 3 2 1 0 instruction address dummy cycles data 1 cs# sck io0 io1 phase 7 6 5 4 3 2 1 0 30 2 0 6 4 2 0 6 4 2 0 6 4 2 0 31 3 1 7 5 3 1 7 5 3 1 7 5 3 1 instruction mode dum data 1 data 2 address cs# sck io0 io1 io2 io3 phase 7 6 5 4 3 2 1 0 28 4 0 4 0 4 0 4 0 4 0 4 0 29 5 1 5 1 5 1 5 1 5 1 5 1 30 6 2 6 2 6 2 6 2 6 2 6 2 31 7 3 7 3 7 3 7 3 7 3 7 3 instruction address mode dummy d1 d2 d3 d4 cs# sck io0 io1 io2 io3 phase 4 0 28 4 0 4 0 4 0 4 0 4 0 4 0 5 1 29 5 1 5 1 5 1 5 1 5 1 5 1 6 2 30 6 2 6 2 6 2 6 2 6 2 6 2 7 3 31 7 3 7 3 7 3 7 3 7 3 7 3 instruct. address mode dummy d1 d2 d3 d4 document number: 002-00488 rev. *g page 16 of 135 S25FS512S figure 14. ddr quad i/o read figure 15. ddr quad i/o read in qpi mode additional sequence diagrams, sp ecific to each co mmand, are pro vided in commands onpage68 . 3.3 interface states this section describes the input and output signal levels as re lated to the spi interface behavior. table 3. interface states summary interface state v cc sck cs# io3 / reset# wp# / io2 so / io1 si / io0 power-off document number: 002-00488 rev. *g page 18 of 135 S25FS512S a deep power down (dpd) mode is supported by the S25FS512S devi ces. if the device has been placed in dpd mode by the dpd (b9h) command, the interf ace standby current is (i dpd ). the dpd command is accepted only while the device is not per forming an embedded algorithm as indicated b y the status register-1 volati le write in progress (w ip) bit being cleared to zero (sr1v[0] = 0). while in dpd mode the device ignores all commands except the re lease from dpd (res abh) command, that will return the device to the interface standby s tate after a delay of t res . 3.3.6 instruction cyc le (legacy spi mode) when the host drives the msb o f an instruction and cs# goes low , on the next rising edge of sck the device capt ures the msb of the instruction that begins the new command. on each following rising edge of sck the device ca ptures the next lower significa nce bit of the 8-bit instruction. the host keeps cs# low, and drive s the write protect (w p#) and io3/reset si gnals as n eeded for t he instruction. however, wp# is onl y relevant during instruction c ycles of a wrr or wrar command a nd is otherwise i gnored. io3 / reset# is driven high when the device is not in quad mode (cr1v [1]=0) or qpi mode (cr2v[6]=0) and hardware reset is not required. each instruction selects the addr ess space that is operated on and the transfer format used dur ing the remainder of the comman d. the transfer format may be single, dual i/o, quad i/o, or ddr q uad i/o. the expected next in terface state depends on the instruction received. some commands are stand alone, n eeding no address or data trans fer to or from the memory. the h ost returns cs# high after the rising edge of sck for the eighth bit of the instruction in suc h commands. the next interface s tate in this case is interface standby. 3.3.7 instruction cycle (qpi mode) in qpi mode, when cr2v[6]=0, inst ructions are transferred 4 bit s per cycle. in this mode instru ction cycles are the same as a quad input cycle. see quad input cycle host to memory transfer on page 19 . 3.3.8 single input cycle host to memory transfer several commands transfer information after the instruction on the single serial input (si) signal from host to the memory dev ice. the host keeps reset# high, cs# low, and drives si as needed for th e command. the memory does not d rive the serial output (so) signal. the expected next interface stat e depends on the i nstruction. s ome instructions con tinue sending address or data to the memory using additional single input c ycles. others may transition to single latency, or directly to single, dual, or quad output cyc le states. 3.3.9 single latency (dummy) cycle read commands may have zero to s everal latency cycles during wh ich read data is read f rom the main f lash memory array before transfer to the host. the number o f latency cycles are determin ed by the latency code in the c onfiguration register (cr2v[3:0] ). during the latency cycles, the hos t keeps reset# high, cs# low. the write protect (wp#) signal is ignored. the host may drive the si signal during these cycles or the host may leave si floating . the memory does not use any d ata driven on si / i/o0 or other i /o signals during the latency cycles . the memory doe s not drive th e serial output (so) or i/o signals duri ng the latency cycles. the next interface state depends on the command structure, i.e. , the number of latency cycles, and whether the read is single, dual, or quad width. 3.3.10 single output cycle memory to host transfer several commands transfer information back to the host on the s ingle serial output (so) signal . the host keeps reset# high, cs # low. the write protect (wp#) sig nal is ignored. th e memory igno res the serial input (si) signal . the memory drives so with dat a. the next interface state continue s to be single output cycle un til the host returns cs# to high ending the command. 3.3.11 dual input cycle ho st to memory transfer the read dual i/o command transfe rs two address or mode bits to the memory in each cycle. the host keep s reset# high, cs# low. the write protect (wp#) si gnal is ignored. the host drives address on si / io 0 and so / io1. the next interface state following the delivery of address and mode bits is a dual latency cycl e if there are latency cycles n eeded or dual output cycle if no latency is required. document number: 002-00488 rev. *g page 19 of 135 S25FS512S 3.3.12 dual latency (dummy) cycle read commands may have zero to s everal latency cycles during wh ich read data is read f rom the main f lash memory array before transfer to the host. the number o f latency cycles are determin ed by the latency code in the c onfiguration register (cr2v[3:0] ). during the latency cycles, the hos t keeps reset# high, cs# low. the write protect (wp#) signal is ignored. the host may drive the si / io0 and so / io1 signals during these cycles or the host may l eave si / io0 and so / io1 floatin g. the memory does not use any data driven on s i / io0 and so / io1 duri ng the latency cycles. the host must stop dr iving si / io0 and so / io1 on the falling edge at the end of the last la tency cycle. it is recommended th at the host stop driving them d uring all latency cycles so that there is sufficient time for the host drivers to turn off before the mem ory begins to drive at the end of the late ncy cycles. this prev ents driver conflict between host and memory when the signal direction chan ges. the memory does not drive the si / io0 and so / io1 signals during the latency cycles. the next interface s tate following the last laten cy cycle is a dual output cycle. 3.3.13 dual output cycle memory to host transfer the read dual output and read dual i/o return data to the host two bits in each cycle. the host keeps reset# high, cs# low. th e write protect (wp#) signal is i gnored. the memory drives data o n the si / io0 and so / io1 signals during the dual output cycles. the next interface state continue s to be dual out put cycle unti l the host returns cs# to high ending the command. 3.3.14 quad input cycle ho st to memory transfer the quad i/o read command transfers four address or mode bits t o the memory in each cycle. in qpi mode the quad i/o read and page program commands transfer f our data bits to the memory in each cycle, including the instruction cycles . the host keeps cs # low, and drives the io signals. for quad i/o read the next inte rface state following the delive ry of address and mode bits is a quad latency cycle if there ar e latency cycles needed or quad outp ut cycle if no latency is req uired. for qpi mode page progr am, the host returns cs# high following the delivery of data to be programmed and the interfa ce returns to standby state. 3.3.15 quad latency (dummy) cycle read commands may have zero to s everal latency cycles during wh ich read data is read f rom the main f lash memory array before transfer to the host. the number o f latency cycles are determin ed by the latency code in the c onfiguration register (cr2v[3:0] ). during the latency cycles, the ho st keeps cs# low. the host may drive the io si gnals during these cycles or the host may leave the io floating. the memory does not use any data driven on io duri ng the latency cycles. the host must stop driving the io signal s on the falling edge at the end of the last latency cycle. it is re commended that the host stop driving them during all latency cy cles so that there is sufficient time for the host drivers to turn off befor e the memory begins to drive at the end of the latency cycles. this prevents driver conflict between host and memory when the signal directi on changes. the memory does not dr ive the io signals during the latency cycles. the next interface s tate following the last laten cy cycle is a quad output cycle. 3.3.16 quad output cycle memory to host transfer the quad i/o read returns data to the host four b its in each cy cle. the host keeps cs# low. the memory drives data on io0-io3 signals during the quad output cycles. the next interface state conti nues to be quad output cycle unti l the host returns cs# to high ending the command. 3.3.17 ddr quad input cycle host to memory transfer the ddr quad i/o read command sends address, and mode bits to t he memory on all the io signals . four bits are transferred on the rising edge of sck and f our bits on the falling edge in eac h cycle. the host keeps cs# low. the next interface state follo wing the delivery of address and mode bits is a d dr latency cycle. document number: 002-00488 rev. *g page 20 of 135 S25FS512S 3.3.18 ddr latency cycle ddr read commands may have one to several latency cycles during which read data is read from the main flash memory array before transfer to t he host. the number of latency cycles are d etermined by the lat ency code in the configuration register (cr2v[3:0]). during the laten cy cycles, the host keeps cs# low. the host may not drive the i o signals during these cycles. so that there is sufficient time for t he host drivers to turn off befor e the memory begins to drive. this prevents driver conflict bet ween host and memory when the signal direc tion changes. the memory has an option to drive all t he io signals with a data learning patter n (dlp) during the last four late ncy cycles. the dlp option shoul d not be enabled when there are fewer than five latency cycles so that there is at least one cycle of high impedance for turn aro und of the io signals before the memory begins driving the dlp. when there are more than four cycles of latency the memory does not drive the io signals until the last four cycles of latency. the next interface s tate following the last laten cy cycle is a ddr single, or quad output cycl e, depending on the instruction. 3.3.19 ddr quad out put cycle memory to host transfer the ddr quad i/o read command returns bits to the host on all t he io signals. four bits are transferred on the rising edge of sck and four bits on the falling edge in each cy cle. the host keeps cs# low. the next interface state conti nues to be ddr quad output cycle until the host returns cs # to high ending the command. 3.4 configuration register effects on the interface the configuration register 2 vol atile bits 3 to 0 (cr2v[3:0]) s elect the variable latency for a ll array read commands except r ead and read sdfp (rsfdp). read alwa ys has zero laten cy cycles. rsf dp always has eight latency cycl es. the variable latency is also used in the otpr and rdar commands. the configuration regi ster bit 1 (cr1v[1]) selects whether quad mode is enabled to s witch wp# to io2 func tion, reset# to io3 function, and thus allow quad i/o read and qpi mode commands. q uad mode must also be selected to allow ddr quad i/o read commands. 3.5 data protection some basic protection against unintended changes to stored data are provided and controlled purely by the hardware design. the se are described below. other softw are managed protection methods are discussed in the softwar e section of this document. 3.5.1 power-up when the core supply voltage is at or below the v cc (low) voltage, the device is consider ed to be powered off. the devic e does not react to external signals, and is prevented from performing any program or erase operation. pro gram and erase operations conti nue to be prevented during the power-on reset (por) because no comm and is accepted unt il the exit from po r to the interface standby state. 3.5.2 low power when v cc is less than v cc (cut-off) the memory device will ignore c ommands to ensure that program and erase operations can not start when the core supply volta ge is out of the operating rang e. 3.5.3 clock pulse count the device verifies that all non- volatile memory and register d ata modifying commands consist o f a clock pulse count that is a multiple of eight bit transfers (byte boundary) before executin g them. a command not ending on an 8-bit (byte) boundary is ign ored and no error status is set for the command. 3.5.4 deep power down (dpd) in dpd mode the device responds on ly to the release from dpd co mmand (res abh). all other c ommands are ignored during dpd mode, thereby protecting the memory from program and erase operations. document number: 002-00488 rev. *g page 21 of 135 S25FS512S 4. electrical specifications 4.1 absolute maximum ratings notes 1. see input signal overshoot on page 22 for allowed maximums during signal transition. 2. no more than one output may be shorted to ground at a time. d uration of the short circuit should not be greater than one sec ond. 3. stresses above those listed under absolute maximum ratings may cause permanent damage to the device. this is a stress rati ng only; functional operation of the device at these or any other conditions above those indicated i n the operational sections of this data sheet is not implied. e xposure of the device to absolute maximum rating conditions for extended per iods may affect device reliab ility. 4.2 thermal resistance 4.3 latchup characteristics note 4. excludes power supply v cc . test conditions: v cc = 1.8 v, one connection at a time tested, connections not bein g tested are at v ss . 4.4 operating ranges operating ranges defi ne those limits between which the function ality of the device is guaranteed. 4.4.1 power supply voltages 4.4.2 temperature ranges note 5. industrial plus operating and performance parameters will be determined by device characteri zation and may vary from standar d industrial temperature range devices as currently shown in this specification. storage temperature plastic packages -65c to +150c ambient temperature with power applied -65c to +150c v cc -0.5 v to +2.5v input voltage with respect to ground (v ss ) (note 1) -0.5 v to v cc + 0.5v output short circuit current (note 2) 100 ma table 4. thermal resistance parameter description so3016 wnh008 fab024 unit theta ja thermal resistance (junction to ambient) 38 18 39 c table 5. latchup specification description min max unit input voltage with respect to v ss on all input only connections -1.0 v cc + 1.0 v input voltage with respect to v ss on all i/o connections -1.0 v cc + 1.0 v v cc current -100 +100 ma v cc 1.7v to 2.0v parameter symbol devices spec unit min max ambient temperature t a industrial (i) -40 +85 c industrial plus devices (v) -40 +105 automotive, aec-q100 grade 3 (a) -40 +85 automotive, aec-q100 grade 2 (b) -40 +105 automotive, aec-q100 grade 1 (m) -40 +125 document number: 002-00488 rev. *g page 22 of 135 S25FS512S 4.4.3 input signal overshoot during dc conditions, input or i/o signals should remain equal to or between v ss and v cc . during voltage transitions, inputs or i/os may overshoot v ss to -1.0v or overshoot to v cc +1.0v, for periods up to 20 ns. figure 16. maximum negative overshoot waveform figure 17. maximum posi tive overshoot waveform 4.5 power-up and power-down the device must not be selected at power-up or power-down (that is, cs# must follow the voltage applied on v cc ) until v cc reaches the correct value as follows: ? v cc (min) at power-up, and then for a further delay of t pu ? v ss at power-down a simple pull-up resistor on chi p select (cs#) can usually be u sed to insure safe and proper power-up and power-down. the device ignores all instruct ions until a time delay of t pu has elapsed after the moment that v cc rises above the minimum v cc threshold. see figure 18 . however, correct operation of t he device is not guaranteed if v cc returns below v cc (min) during t pu . no command should be sent to t he device until the end of t pu . the device draws i por during t pu . after power-up (t pu ), the device is in standby mode, draws cmos standby current (i sb ), and the wel bit is reset. during power-down or v oltage drops below v cc (cut-off), the voltage must drop below v cc (low) for a period of t pd for the part to initialize correctly on power-up. see figure 19 . if during a voltage drop the v cc stays above v cc (cut-off) the part will stay initialized and will work correctly when v cc is again above v cc (min). in the event power-on rese t (por) did not complete corre ctly after power up, the asse rtion of the r eset# signal or receiving a sof tware reset command (reset) will restart the por process. normal precautions must be tak en for supply rail decoupling to stabilize the v cc supply at the device. ea ch device in a system should have the v cc rail decoupled by a suitable capacitor close to the package su pply connection (this capacitor is generally of the order of 0.1f). v ss to v cc - 1.0v 20 ns < v dd + 1.0v < 20 ns v ss to v cc table 6. fs-s power-up / po wer-down voltage and timing symbol parameter min max unit v cc (min) v cc (minimum operation voltage) 1.7 v v cc (cut-off) v cc (cut 0ff where re-initialization is needed) 1.5 v v cc (low) v cc (low voltage for initialization to occur) 0.7 v t pu v cc (min) to read operation 300 s t pd v cc (low) time 10.0 s document number: 002-00488 rev. *g page 23 of 135 S25FS512S figure 18. power-up figure 19. power-down and voltage drop tpu full device access v cc (min) v cc (max) time v cc (max) v cc (min) v cc (cut-off) v cc (low) tpu device acces s no device access allowed tpd time document number: 002-00488 rev. *g page 24 of 135 S25FS512S 4.6 dc characteristics notes 6. typical values are at t ai = 25c and v cc = 1.8v. 7. outputs unconnected during read data return. output switching current is not included. table 7. dc characteristics operating temperature range C40 c to +85c symbol parameter test conditions min typ [6] max unit v il input low voltage -0.5 0.3xv cc v v ih input high voltage 0.7xv cc v cc +0.4 v v ol output low voltage i ol = 0.1 ma 0.2 v v oh output high voltage i oh = C0.1 ma v cc - 0.2 v i li input leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 2 a i lo output leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 2 a i cc1 active power supply current (read) [7] serial sdr@54 mhz serial sdr@133 mhz quad sdr@133 mhz quad ddr@80 mhz 10 25 60 70 18 30 65 90 ma i cc2 active power supply current (page program) cs# = v cc 60 100 ma i cc3 active power supply current (wrr or wrar) cs# = v cc 60 100 ma i cc4 active power supply current (se) cs# = v cc 60 100 ma i cc5 active power supply current (be) cs# = v cc 60 100 ma i sb standby current io3 / reset#, cs# = v cc ; si, sck = v cc or v ss 25 100 a i dpd deep power-down current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 850a i por power on reset current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 80 ma table 8. dc characteristics operating temperature range C40 c to +105c symbol parameter test conditions min typ [8] max unit v il input low voltage -0.5 0.3xv cc v v ih input high voltage 0.7xv cc v cc +0.4 v v ol output low voltage i ol = 0.1 ma 0.2 v v oh output high voltage i oh = C0.1 ma v cc - 0.2 v i li input leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 4 a i lo output leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 4 a i cc1 active power supply current (read) [9] serial sdr@54 mhz serial sdr@133 mhz quad sdr@133 mhz quad ddr@80 mhz 10 25 60 70 18 30 65 90 ma i cc2 active power supply current (page program) cs# = v cc 60 100 ma i cc3 active power supply current (wrr or wrar) cs# = v cc 60 100 ma i cc4 active power supply current (se) cs# = v cc 60 100 ma i cc5 active power supply current (be) cs# = v cc 60 100 ma i sb standby current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 25 300 a document number: 002-00488 rev. *g page 25 of 135 S25FS512S notes 8. typical values are at t ai = 25c and v cc = 1.8v. 9. outputs unconnected during read data return. output switching current is not included. notes 10. typical values are at t ai = 25c and v cc = 1.8v. 11. outputs unconnected during read data return. output switchin g current is not included. 4.6.1 active power and standby power modes the device is enabled and in the active power mode when chip se lect (cs#) is low. when cs# is hi gh, the device is disabled, bu t may still be in an active power m ode until all program, erase, and write operations have completed. the de vice then goes into the standby power mode, and powe r consumption drops to i sb . a deep power down (dpd) mode is supported by the S25FS512S devi ces. if the device has been placed in dpd mode by the dpd (b9h) command, the interf ace standby current is (i dpd ). the dpd command is accepted only while the device is not per forming an embedded algorithm as indicated b y the status register-1 volati le write in progress (w ip) bit being cleared to zero (sr1v[0] = 0). while in dpd mode the device ignores all commands except the re lease from dpd (res abh) command, that will return the device to the interface standby s tate after a delay of t res . i dpd deep power-down current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 8 150 a i por power on reset current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 80 ma table 8. dc characteristics operating temperature range C40 c to +105c (continued) symbol parameter test conditions min typ [8] max unit table 9. dc characteristics operating temperature range C40 c to +125c symbol parameter test conditions min typ [10] max unit v il input low voltage -0.5 0.3xv cc v v ih input high voltage 0.7xv cc v cc +0.4 v v ol output low voltage i ol = 0.1 ma 0.2 v v oh output high voltage i oh = C0.1 ma v cc - 0.2 v i li input leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 4 a i lo output leakage current v cc = v cc max, v in = v ih or v ss , cs# = v ih 4 a i cc1 active power supply current (read) [11] serial sdr@54 mhz serial sdr@133 mhz quad sdr@133 mhz quad ddr@80 mhz 10 25 60 70 18 40 65 90 ma i cc2 active power supply current (page program) cs# = v cc 60 100 ma i cc3 active power supply current (wrr or wrar) cs# = v cc 60 100 ma i cc4 active power supply current (se) cs# = v cc 60 100 ma i cc5 active power supply current (be) cs# = v cc 60 100 ma i sb standby current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 25 300 a i dpd deep power-down current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 8 250 a i por power on reset current io3 / reset#, cs# =v cc ; si, sck = v cc or v ss 80 ma document number: 002-00488 rev. *g page 26 of 135 S25FS512S 5. timing specifications 5.1 key to switching waveforms figure 20. waveform element meanings 5.2 ac test conditions figure 21. test setup notes 12. input slew rate measured from input pulse min to max at v cc max. example: (1.9v x 0.8) - (1.9v x 0.2) = 1.14v; 1.14v/1.25v/ ns = 0.9 ns rise or fall time. 13. ac characteristics tables ass ume clock and data signals have the same slew rate (slope). figure 22. input, output, and timing reference levels table 10. ac measurement conditions symbol parameter min max unit c l load capacitance 30 pf input pulse voltage 0.2 x v cc 0.8 v cc v input slew rate 0.23 1.25 v/ns input rise and fall times 0.9 5 ns input timing ref voltage 0.5 v cc v output timing ref voltage 0.5 v cc v input symbol output valid at logic high or low high impedance any change permitted logic high logic low changing, state unknown logic high logic low valid at logic high or low high impedance device under test c l v cc + 0.4v 0.7 x v cc 0.3 x v cc - 0.5v timing reference level 0.5 x v cc v cc - 0.2v 0.2v input levels output levels document number: 002-00488 rev. *g page 27 of 135 S25FS512S 5.2.1 capacitance characteristics note 14. parameter values are not 100% tested. for more details, plea se refer to the ibis models. 5.3 reset 5.3.1 power on (cold) reset the device executes a power-on reset (por) process until a time delay of t pu has elapsed after the moment that v cc rises above the minimum v cc threshold. see figure 18 on page 23 , table6 onpage22 . the device must not be selected (cs# to go high with v cc ) during power-up (t pu ), i.e. no commands may be sent to the device until the end of t pu . the io3 / reset# signal functions as the reset# input when cs# is high for more than t cs time or when qu ad mode is not enabled cr1v[1]=0. reset# is ignored during por. if reset# is low during por and r emains low through and beyond the end of t pu , cs# must remain high until t rh after reset# returns high. reset# must retur n high for greater than t rs before returning low to initiate a hardware reset. figure 23. reset low at the end of por figure 24. reset high at the end of por figure 25. por follow ed by hardware reset table 11. fs512s capacitance parameter test conditions min max unit c in input capacitance (applies to sck, cs#, io3 / reset#) 1 mhz 8 pf c out output capacitance (applies to all i/o) 1 mhz 8 pf vcc reset# cs# if reset# is low at tpu end cs# must be high at tpu end tpu trh vcc reset# cs# if reset# is high at tpu end cs# may stay high or go low at tpu end tpu tpu vcc reset# cs# trs tpu tpu document number: 002-00488 rev. *g page 28 of 135 S25FS512S 5.3.2 io3 / reset# input init iated hardware (warm) reset the io3 / reset# signal functions as the reset# input when cs# is high for more than t cs time or when qu ad mode is not enabled cr1v[1]=0. the io3 / reset# input has an internal pull- up to v cc and may be left unconnected if quad mode is not used. the t cs delay after cs# goes high gives the memory or ho st system time to drive io3 high after its u se as a quad mode i/o signal while cs# was low. the internal pull-up to v cc will then hold io3 / reset# high until the host system begins driving io3 / reset#. the io3 / reset# input is ignored while cs# remains high during t cs , to avoid an unintended reset operation. if cs# is driven low to start a new command, io 3 / reset# is used as io3. when the device is not in quad mode or, when cs# is high, and i o3 / reset# transitions from v ih to v il for > t rp , following t cs , the device will reset register states in the same manner as power-o n reset but, does not go through the full reset process that is performed during por. the hardwa re reset process requires a per iod of t rph to complete. if the por p rocess did no t complete correctly for any rea son during power-up (t pu ), reset# going low will initiate the full por process instead of the hardware reset process and will require t pu to complete th e por process. the reset command is independent o f the state of io3 / reset#. if io3 / reset# is high or unconnected, and the reset instruction is issued, the dev ice will perform software reset. additional io3 reset# notes: ? io3 / reset# must be high for t rs following t pu or t rph , before going low again to initiate a hardware reset. ? when io3 / reset# is driven low for at least a minimum period o f time (t rp ), following t cs , the device terminates any operation in progress, makes all outputs high impedance, and ignores all rea d/write commands for the duration of t rph . the device resets the interface to standby state. ? if quad mode and the io 3 / reset# feature ar e enabled, the host system should not drive io3 low during t cs, to avoid driver contention on io3. immediately fo llowing commands that transfer data to the host in quad mode, e.g. q uad i/o read, the memory drives io3 / reset high during t cs, to avoid an unintended reset ope ration. immediately following c ommands that transfer data to the memory in quad mode, e.g. page program, th e host system should drive io3 / reset high during t cs, to avoid an unintended reset operation. ? if quad mode is not enabled, and if cs# is low at the time io3 / reset# is asserted low, cs# must return high during t rph before it can be asserted l ow again after t rh . notes 15. io3 / reset# low is i gnored during power-up (t pu ). if reset# is asserted during the end of t pu , the device will remain in the reset state and t rh will determine when cs# may go low. 16. if quad mode is enabled, io3 / reset# low is ignored during t cs. 17. sum of t rp and t rh must be equal to or greater than t rph. figure 26. hardware reset when qu ad mode is not e nabled and io 3 / reset# is enabled table 12. hardware reset parameters parameter description limit time unit t rs reset setup Cprior reset end and reset# high before reset# low m in 50 ns t rph reset pulse hold C reset# low to cs# low min 35 s t rp reset# pulse width min 200 ns t rh reset hold C reset# high before cs# low min 50 ns io3_reset# cs# any prior reset trs trp trh trh trph trph document number: 002-00488 rev. *g page 29 of 135 S25FS512S figure 27. hardware reset when quad mode and io3 / reset# are enabled 5.4 sdr ac characteristics notes 18. only applicable as a constraint for wrr or wrar instruction when srwd is set to a 1. 19. full v cc range and cl = 30 pf. 20. full v cc range and cl = 15 pf. 21. output hi-z is defined as the point where data is no longer driven. 22. t cs and t dis require additional time when the reset feature and quad mode ar e enabled (cr2v[5]=1 and cr1v[1]=1). table 13. ac characteristics symbol parameter min typ max unit f sck, r sck clock frequency for read and 4read instructions dc 50 mhz f sck, c sck clock frequency for the following dual and quad commands: qor, 4qor, dior, 4dior, qior, 4qior dc 133 mhz f sck, d sck clock frequency for the following ddr commands: qior, 4qior dc 80 mhz p sck sck clock period 1/ f sck ? t wh , t ch clock high time 50% p sck -5% 50% p sck +5% ns t wl , t cl clock low time 50% p sck -5% 50% p sck +5% ns t crt , t clch clock rise time (slew rate) 0.1 v/ns t cft , t chcl clock fall time (slew rate) 0.1 v/ns t cs cs# high time (read instructions) cs# high time (read instructions when reset feature and quad mode are both enabled) cs# high time (program / erase instructions) 10 20 [22] 50 ns t css cs# active setup time (relative to sck) 2 ns t csh cs# active hold time (relative to sck) 3 ns t su data in setup time 2 ns t hd data in hold time 3 ns t v clock low to output valid 8 [19] 6 [20] ns t ho output hold time 1 ns t dis output disable time [21] output disable time (when reset feature and quad mode are both enabled) 8 20 [22] ns t wps wp# setup time [18] 20 ns t wph wp# hold time [18] 100 ns t dpd cs# high to power-down mode 3 s t res cs# high to standby mode without electronic signature read 30 s io3_reset# cs # reset pulse prior access using io3 for data trp trh trph tcs tdis document number: 002-00488 rev. *g page 30 of 135 S25FS512S 5.4.1 clock timing figure 28. clock timing 5.4.2 input / output timing figure 29. spi single bit input timing figure 30. spi single bit output timing figure 31. spi sdr mio timing v il max v ih min tch tcrt tcft tcl v cc / 2 p sck cs# sck si so msb in lsb in tcss tcss tcsh tcsh tcs tsu thd cs# sck si so msb out lsb out tcs tho tv tdis cs# sck io msb in lsb in msb out lsb out tcsh tcss tcss tsu thd tho tcs tdis tv tv tcsh document number: 002-00488 rev. *g page 31 of 135 S25FS512S figure 32. wp# input timing 5.5 ddr ac characteristics. note 23. cl=15 pf. table 14. ddr 80 mhz ac ch aracteristics operation symbol parameter min typ max unit f sck, r sck clock frequency for ddr read instruction dc 80 mhz p sck, r sck clock period for ddr read instruction 12.5 ? ns t wh , t ch clock high time 50% p sck - 5% 50% p sck + 5% ns t wl , t cl clock low time 50% p sck - 5% 50% p sck + 5% ns t cs cs# high time (read instructions) cs# high time (read instructions when reset feature is enabled) 10 20 ns t css cs# active setup time (relative to sck) 2 ns t csh cs# active hold time (relative to sck) 3 ns t su io in setup time 1.5 ns t hd io in hold time 1.5 ns t v clock low to output valid 1.5 4.5 [23] ns t ho output hold time 1 ns t dis output disable time output disable time (when reset feature is enabled) 8 20 ns t io_skew first io to last io data valid time 400 ps t dpd cs# high to power-down mode 3s t res cs# high to standby mode without electronic signature read 30 s cs# wp# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 wrr or wrar instruction input data twps twph document number: 002-00488 rev. *g page 32 of 135 S25FS512S 5.5.1 ddr input timing figure 33. spi ddr input timing 5.5.2 ddr output timing figure 34. spi ddr output timing cs# sck io's inst. msb msb in lsb in tcss tcss tcsh tcsh tcs tsu tsu thd thd tho cs# sck io's msb lsb tcs tv tv tdis tho document number: 002-00488 rev. *g page 33 of 135 S25FS512S 5.5.3 ddr data valid timing using dlp figure 35. spi ddr data valid window the minimum data valid window (t dv ) and t v minimum can be calculated as follows: t dv = minimum half cl ock cycle time (t clh ) [24] - t ott [26] - t io_skew [25] t v _min = t ho + t io_skew + t ott example: 80 mhz clock frequency = 12.5 n s clock period, ddr operations a nd duty cycle o f 45% or higher t clh = 0.45 x psck = 0.45 x 12.5 ns = 5.625 ns bus impedance of 45 oh m and capacitance of 22 pf, with timing r eference of 0.75v cc, the rise time from 0 to 1 or fall time 1 to 0 is 1.4 [29] x rc time constant (tau) [28] = 1.4 x 0.99 ns = 1.39 ns t ott = rise time + fall time = 1.39 ns + 1.39 ns = 2.78 ns. data valid window t dv = t clh - t io_skew - t ott = 5.625 ns - 400 ps - 2.78 ns = 2.45ns t v minimum t v _min = t ho + t io_skew + t ott = 1.0 ns + 400 ps + 2 .78 ns = 4.38 ns notes 24. t clh is the shorter duration of t cl or t ch . 25. t io_skew is the maximum difference (delta) between the minimum and maxi mum t v (output valid) across all io signals. 26. t ott is the maximum output transition time from one valid data valu e to the next valid data value on each io. t ott is dependent on system l evel considerations including: a. memory device output impedance (drive strength). b. system level parasitics on the ios (primarily bus capacitance ). c. host memory controller input v ih and v il levels at which 0 to 1 and 1 to 0 transitions are recognized. d. t ott is not a specification tested by cypress, it is system depende nt and must be derived by the system designer based on the abov e considerations. 27. t dv is the data valid window. 28. tau = r (output impedance) x c (load capacitance) 29. multiplier of tau time for voltage to rise to 75% of v cc sck io slow io fast io_valid slow d1 s . slow d2 fast d1 fast d2 d1 d2 t v t io_skew t dv t cl t ch t ott p sck t ho t v _min t v document number: 002-00488 rev. *g page 34 of 135 S25FS512S 6. physical interface 6.1 soic 16-lead package 6.1.1 soic 16 connection diagram figure 36. 16-lead soic package, top view note 30. the reset# input has an internal pull-up and may be left unc onnected in the system if quad mode and hardware reset are not in use. 1 2 3 4 16 15 14 13 io3/reset# vcc rfu nc dnu rfu si/io0 sck 5 6 7 8 12 11 10 9 wp#/io2 vss dnu dnu nc rfu cs# so/io1 document number: 002-00488 rev. *g page 35 of 135 S25FS512S 6.1.2 soic 16 physical diagram figure 37. soic 16-lead, 300-mil body width (so3016) sheet of rev spec no. this drawing contains information which is the proprietary property of cypress semiconductor corporation. this drawing is received in confidence and its contents may not be disclosed without written consent of cypress semiconductor corporation. cypress title scale : company confidential package code(s) drawn by approved by date date 0.33 c 0.25 m d ca-b 0.20 c a-b 0.10 c 0.10 c 0.10 c d 2x 2. dimensioning and tolerancing per asme y14.5m - 1994. 3. dimension d does not include mold flash, protrusions or gate burrs. end. dimension e1 does not include interlead flash or protrusion. interlead flash or protrusion shall not exceed 0.25 mm per side. 1. all dimensions are in millimeters. notes: d and e1 dimensions are determined at datum h. flash, but inclusive of any mismatch between the top and bottom of exclusive of mold flash, tie bar burrs, gate burrs and interlead 4. the package top may be smaller than the package bottom. dimensions 5. datums a and b to be determined at datum h. 6. "n" is the maximum number of terminal positions for the specified 7. the dimensions apply to the flat section of the lead between 0.10 to maximum material condition. the dambar cannot be located on the 8. dimension "b" does not include dambar protrusion. allowable dambar lower radius of the lead foot. identifier must be located within the index area indicated. 9. this chamfer feature is optional. if it is not present, then a pin 1 10. lead coplanarity shall be within 0.10 mm as measured from the h 0 d l2 n e a1 b c e e1 a 0.75 10.30 bsc 1.27 bsc 0.30 10.30 bsc 0.33 0 0.25 16 0.20 7.50 bsc 0.10 0.31 8 0.51 2.65 2.35 a2 2.05 2.55 b1 0.27 0.48 0.30 0.20 c1 l1 0.40 l 1.27 1.40 ref 0.25 bsc 0 5 15 0 0 1 2 - dimensions symbol min. nom. max. - - - - - - - - - - - - mold flash, protrusions or gate burrs shall not exceed 0.15 mm per d and e1 are determined at the outmost extremes of the plastic body 0.25 mm from the lead tip. protrusion shall be 0.10 mm total in excess of the "b" dimension at the plastic body. package length. seating plane. so3016 kota besy 24-oct-16 24-oct-16 *a 002-15547 package outline, 16 lead soic 12 to fit 10.30x7.50x2.65 mm so3016/sl3016/ss3016 sl3016 ss3016 document number: 002-00488 rev. *g page 36 of 135 S25FS512S 6.2 8-connector package 6.2.1 8-connector diagram figure 38. 8-connector p ackage (wson 6x8), top view notes 31. the reset# input has an internal pull-up and may be left unc onnected in the system if quad mode and hardware reset are not in use. 32. there is an exposed central pad on the underside of the wson package. this should not be connected to any voltage or signal line on the pcb. connecting the central pad to gnd (vss) is possible, provided pcb routing ensures 0mv difference between voltage at the wson gnd (vss) lead and the c entral exposed pad. 1 2 3 4 5 6 7 8 cs# so/io1 io3/reset # sck si/io0 wson wp#/io2 vcc vss document number: 002-00488 rev. *g page 37 of 135 S25FS512S 6.2.2 8-connector p hysical diagram figure 39. wson 8-contact 6x8 mm leadless (wnh008) sheet of rev spec no. this drawing contains information which is the proprietary property of cypress semiconductor corporation. this drawing is received in confidence and its contents may not be disclosed without written consent of cypress semiconductor corporation. cypress title scale : company confidential package code(s) drawn by approved by date date jedec specification no. ref. : n/a coplanarity zone applies to the exposed heat sink pin #1 id on top will be located within the indicated zone. dimension "b" applies to metallized terminal and is measured n is the total number of terminals. all dimensions are in millimeters. notes: 5 4 1. 3 2. 6 7. the optional radius on the other end of the terminal, the dimension "b" should not be measured in that radius area. nd refers to the number of terminals on d side. 8 4 1.27 bsc. 0.40 8.00 bsc 6.00 bsc 4.00 3.40 0.20 0.75 - 0.50 a1 k a e2 d e d2 b l nd n e 0.00 3.30 0.70 3.90 0.35 0.45 3.50 0.05 0.80 4.10 0.45 0.55 a3 0.20 ref dimensions symbol min. nom. max. between 0.15 and 0.30mm from terminal tip. if the terminal has slug as well as the terminals. -- kota besy 22-nov-16 22-nov-16 *a 12 to fit wnh008 002-15552 package outline, 8 lead dfn 6.0x8.0x0.8 mm wnh008 4.0x3.4 mm epad (sawn) document number: 002-00488 rev. *g page 38 of 135 S25FS512S 6.3 bga 24-ball, 5x5 ball footprint (fab024) 6.3.1 bga connection diagram figure 40. 24-ball bga, 5x5 bal l footprint (fab024), top view notes 33. signal connections are in the same relative positions as fac 024 bga, allowing a single pcb footprint to use either package. 34. the reset# input has an internal pull-up and may be left unc onnected in the system if quad mode and hardware reset are not in use. 3 25 4 1 nc nc nc rfu b d e a c vss sck nc vcc dnu rfu cs# nc wp#/io2 dnu si/io0 so/io1 nc io3/ reset# dnu nc nc nc rfu nc document number: 002-00488 rev. *g page 39 of 135 S25FS512S 6.3.2 bga physical diagram figure 41. ball grid array 24-ball 6x8 mm (fab024) 6.3.3 special handling inst ructions for fbga packages flash memory devices in bga pa ckages may be damaged if exposed to ultrasonic cleaning meth ods. the package and/or data integrity may be compr omised if the package body is exposed to temperatures above 150c for prolonged periods of time. sheet of rev spec no. this drawing contains information which is the proprietary property of cypress semiconductor corporation. this drawing is received in confidence and its contents may not be disclosed without written consent of cypress semiconductor corporation. cypress title scale : company confidential package code(s) drawn by approved by date date metallized mark indentation or other means. a1 corner to be identified by chamfer, laser or ink mark, n is the number of populated solder ball positions for matrix size md x me. when there is an even number of solder balls in the outer row, "sd" = ed/2 and when there is an odd number of solder balls in the outer row, "sd" or "se" = 0. position of the center solder ball in the outer row. "sd" and "se" are measured with respect to datums a and b and define the symbol "me" is the ball matrix size in the "e" direction. symbol "md" is the ball matrix size in the "d" direction. e represents the solder ball grid pitch. dimension "b" is measured at the maximum ball diameter in a plane ball position designation per jep95, section 3, spp-020. dimensioning and tolerancing methods per asme y14.5m-1994. "+" indicates the theoretical center of depopulated balls. 8. 9. 7 all dimensions are in millimeters. parallel to datum c. 5. 6 4. 3. 2. 1. notes: sd b ed ee me n 0.35 0.00 bsc 1.00 bsc 1.00 bsc 0.40 24 5 0.45 d1 md e1 e d a a1 0.20 - 4.00 bsc 4.00 bsc 5 6.00 bsc 8.00 bsc - - 1.20 - se 0.00 bsc dimensions symbol min. nom. max. "se" = ee/2. fab024 kota besy 18-jul-16 18-jul-16 ** 002-15534 package outline, 24 ball fbga 12 to fit 8.0x6.0x1.2 mm fab024 document number: 002-00488 rev. *g page 40 of 135 S25FS512S software interface this section discusses the feat ures and behaviors most relevant to host system software that interacts with the S25FS512S devi ce. 7. address space maps 7.1 overview 7.1.1 extended address the S25FS512S supports 32-bit (4- byte) addresses to enable high er density devices than allowed by previous generation (legacy) spi devices that supported only 24-bit (3-byte) addresses. a 24 -bit, byte resolution, address can access only 16 mbytes (128 m bits) maximum density. a 32-bit, byte r esolution, address allows dire ct addressing of up to a 4 gby tes (32 gbits) address space. legacy commands continue to suppor t 24-bit addresses for backwa rd software compatibility. e xtended 32-bit addresses are enabled in two ways: ? extended address mode a volatil e configuration register bit t hat changes all legacy commands to expect 32 bits of address supplied from the host system. ? 4-byte address commands tha t perform both legacy and new func tions, which always expect 32-bit address. the default condition for extend ed address mode, after power-up or reset, is contro lled by a non-volatile configuration bit. t he default extended address mode may be set for 24- or 32-bit addr esses. this enables legacy softwa re compatible access to the fi rst 128 mbits of a device or for the d evice to start directly in 32- bit address mode. 7.1.2 multiple address spaces many commands operate on the main flash mem ory array. some comm ands operate on addr ess spaces separate from the main flash array. each separate addr ess space uses the full 24- or 3 2-bit address but may only defin e a small portion of the availa ble address space. 7.2 flash memory array the main flash array is divided into erase units called physica l sectors. the fs-s family physical sectors may be configured as a hybrid combination of eight 4-kb paramet er sectors at the top or botto m of the address space with all but one of the remain ing sectors bei ng uniform size. because the grou p of eight 4-kb parameter sect ors is in total smaller than a uni form sector, the group of 4-kb ph ysical sectors respectively overl ay (replace) the top or bottom 32 kb of the highest or lowest address uniform sector. the parameter sector erase commands (20h or 21h) must be used t o erase the 4-kb sectors individually. the sector (uniform bloc k) erase commands (d8h or dch) must be used to erase any of the re maining sectors, including the portion of highest or lowest address sector that is not overl aid by the parameter sectors. t he uniform block erase command has no effect on parameter secto rs. configuration register 1 non-volatile bit 2 (cr1nv[2]) equal to 0 overlays the parameter sectors at the bottom of the lowest a ddress uniform sector. cr1nv[2] = 1 ov erlays the paramet er sectors at the top of the highest address uniform sector. see registers on page 43 for more information. there is also a configuration op tion to remove the 4-kb paramet er sectors from the address map so that all sectors are uniform size. configuration register 3 volatil e bit 3 (cr3v[3]) equal to 0 se lects the hybrid sector architec ture with 4-kb p arameter sector s. cr3v[3]=1 select s the uniform sector arc hitecture without param eter sectors. uniform ph ysical sectors are: ? 256 kbytes in fs512s the sector erase (se) commands er ase the physical 256 kb sectors of the 512 mb device. document number: 002-00488 rev. *g page 41 of 135 S25FS512S note : these are condensed tables that use a couple of sectors as re ferences. there are address ranges that are not explicitly list ed. all 4-kb sectors have the patte rn xxxx000h-xxxxfffh. all 256-kb sectors have the patt ern xx00000h-xx3ffffh, xx40000h-xx7ffffh, xx80000h-xxcffffh, or xxd0000h-xxfffffh. 7.3 id-cfi address space the rdid command (9fh) reads information fro m a separate flash memory address space for devic e identificatio n (id) and common flash interface ( cfi) information. see device id and common flash interface (id-cfi) address map on pag e117 for the tables defining the contents of the id-cf i address space. the i d-cfi address space is programme d by cypress and read-only for the host system. 7.4 jedec jesd216 serial flash dis coverable parameters (sfdp) sp ace the rsfdp command (5ah) reads inf ormation from a separate flash memory address space for device identification, feature, and configuration information, in acco rd with the jede c jesd216 sta ndard for serial flash discoverable parameters. the id-cfi address space is incorporated as one of the sfdp parameters. se e serial flash discove rable parameters (sfdp) address map on page 114 for the tables defining the c ontents of the sfd p address space . the sfdp address space is programmed by cypress and read-only for the host system. table 15. S25FS512S sector address map, bottom 4-kb sectors sector size (kbyte) sector count sector range address range (byte address) notes 4 8 sa00 00000000h-00000fffh sector starting address sector ending address : : sa7 00007000h-00007fffh 224 1 sa8 00008000h-0003ffffh 256 255 sa9 00040000h-0007ffffh : : sa263 03fc0000h-03ffffffh table 16. S25FS512S sector address map, top 4-kb sectors sector size (kbyte) sector count sector range address range (byte address) notes 256 255 sa00 0000000h-003ffffh sector starting address sector ending address :: sa254 03f80000h - 03fbffffh 224 1 sa255 03fc0000h -03ff7fffh 48 sa256 03ff8000h-03ff8fffh :: sa263 03fff000h-03ffffffh table 17. S25FS512S sector a ddress map (uniform sectors) sector size (kbyte) sector count sector range address range (byte address) notes 256 256 sa00 00000000h-0003ffffh sector starting address sector ending address : : sa255 03fc0000h-03ffffffh document number: 002-00488 rev. *g page 42 of 135 S25FS512S 7.5 otp address space each fs-s family memory device h as a 1024-byte one time program (otp) address space that is separate from the main flash array. the otp area is divided into 32, individually lockable, 32-byte aligned and length regions. in the 32-byte region star ting at address zero: ? the 16 lowest address bytes are programmed by cypress with a 12 8-bit random number. only cypress is able to program zeros in these bytes. programming ones i n these byte locations is ign ored and does not affect the va lue programmed by cypress. attempting to program any zero in these byte locations will fai l and set p_err. ? the next four higher address byte s (otp lock bytes) are used to provide one bit per otp regio n to permanently protect each region from programming. the by tes are erased when shipped from cypress. after an otp region is programmed, it can be locked to prevent further programming, by programming the relat ed protection bit in the otp lock bytes. ? the next higher 12 by tes of the lowest add ress region are reser ved for future use (rfu). the bits in these rfu bytes may be programmed by the host system but it must be understood that a future device may use those bits for protect ion of a larger otp space. the bytes are erased when shipped from cypress. the remaining regions are eras ed when shipped from cypress, and are available for pr ogramming of additional permanent data. refer to figure 42 on page 42 for a pictorial representat ion of the otp memory space. the otp memory space is intende d for increased system security. otp values, such as the r andom number programmed by cypress, can be used to mate a flash co mponent with the syste m cpu/asic to prevent device substitution. the configuration register freez e (cr1v[0]) bit protects the en tire otp memory space from pr ogramming when set to 1. this allows trusted boot code to contro l programming of otp regions then set the freeze bit to prev ent further otp memory space programming during the remainder of normal power-on system oper ation. figure 42. otp address space 32-byte otp region 31 32-byte otp region 30 32 byte otp region 29 32-byte otp region 3 32-byte otp region 2 32-byte otp region 1 32-byte otp region 0 16-byte random number lock bits 31 to 0 reserved . . . region 0 expanded view when programmed to 0, each lock bit protects its related 32-byte otp region from any further programming ... byte 0h byte 10h byte 1fh document number: 002-00488 rev. *g page 43 of 135 S25FS512S 7.6 registers registers are small groups of m emory cells used to configure ho w the S25FS512S memor y device operates or to report the status of device operations. the regist ers are accessed by specific co mmands. the commands ( and hexadecimal instruction codes) used for each register are noted in each register description. in legacy spi memory devices the individual register bits could be a mixture of vol atile, non-volatile, or one time programmab le (otp) bits within the same regist er. in some conf iguration opti ons the type of a register bit could change e.g. from non-volat ile to volatile. the S25FS512S uses separate non-v olatile or volatile memory cel l groups (areas) to implement the different register bit types. however, the legacy registers and commands continue to appear a nd behave as they always have for legacy software compatibility . there is a non-volatile and a volatile version of each legacy r egister when that legacy register has volatile bits or when the command to read the legacy register has zero read latency. when such a register is read the volatile ver sion of the register is delive red. during power-on reset (por), hardware re set, or software reset, the no n-volatile version of a register is copied to the volatile vers ion to provide the default state of the vo latile register. when non-vo latile register bits are writt en the non-volatile version of th e register is erased and programmed with the new bit values and the volatile version of the register is update d with the new contents of the non-volatile version. when otp bits are programmed the non-vola tile version of the register i s programmed and the appropriate bits are updated in the volatile version of the register. when volat ile register bits are written, only the volatile version of the register has the appropriate bits updated. the type for each bit is noted in each register description. th e default state shown for each b it refers to the state after po wer-on reset, hardware reset, or softwa re reset if the bit is volatile . if the bit is non-volatile or otp, the default state is the v alue of the bit when the device is shipped from cypress. non-volatile bits have the same cycling (erase and program) endurance as the main fla sh array. table 18. otp address map region byte address range (hex) contents initial delivery state (hex) region 0 000 least significant byte of cypress programmed random number cypress programmed random number ... ... 00f most significant byte of cypress programmed random number 010 to 013 region locking bits byte 10 [bit 0] locks region 0 from programming when = 0 ... byte 13 [bit 7] locks region 31from programming when = 0 all bytes = ff 014 to 01f reserved for future use (rfu) all bytes = ff region 1 020 to 03f available for user programming all bytes = ff region 2 040 to 05f available for user programming all bytes = ff ... ... available for user programming all bytes = ff region 31 3e0 to 3ff available for user programming all bytes = ff document number: 002-00488 rev. *g page 44 of 135 S25FS512S 7.6.1 status register 1 7.6.1.1 status register 1 non-volatile (sr1nv) related commands: write register s (wrr 01h), read any register (rdar 65h), write any register (wrar 71h). table 19. register descriptions register abbreviation type bit location status register 1 sr1nv[7:0] non-volatile 7:0 status register 1 sr1v[7:0] volatile 7:0 status register 2 sr2v[7:0] volatile 7:0 configuration register 1 cr1nv[7:0] non-volatile 7:0 configuration register 1 cr1v[7:0] volatile 7:0 configuration register 2 cr2nv[7:0] non-volatile 7:0 configuration register 2 cr2v[7:0] volatile 7:0 configuration register 3 cr3nv[7:0] non-volatile 7:0 configuration register 3 cr3v[7:0] volatile 7:0 configuration register 4 cr4nv[7:0] non-volatile 7:0 configuration register 4 cr4v[7:0] volatile 7:0 ecc status register eccsr [7:0] volatile 7:0 asp register aspr[15:1] otp 15:1 asp register aspr[0] rfu 0 password register pass[63:0] non-volatile otp 63:0 ppb lock register ppbl[7:1] volatile 7:1 ppb lock register ppbl[0] volatile read only 0 ppb access register ppbar[7:0] non-volatile 7:0 dyb access register dybar[7:0] volatile 7:0 spi ddr data learning registers nvdlr[7:0] non-volatile 7:0 spi ddr data learning registers vdlr[7:0] volatile 7:0 table 20. status register 1 non-volatile (sr1nv) bits field name function type default state description 7 srwd_nv status register write disable default non-volatile 0 1 = locks state of srwd, bp, and configuration register-1 bits when wp# is low by not executing wrr or wrar commands that would affect sr1nv, sr1v, cr1nv, or cr1v. 0 = no protection, even when wp# is low. 6 p_err_d programming error default non-volatile read only 0 provides the default state for the programming error status. no t user programmable. 5 e_err_d erase error default non-volatile read only 0 provides the default state for the erase error status. not user programmable. 4 bp_nv2 block protection non-volatile non-volatile 000b protects the selected range of sectors (block) from program or erase when the bp bits are configured as non-volatile (cr1nv[3]=0). programmed to 111b when bp bits are configured to volatile (cr1nv[3]=1).- after which t hese bits are no longer user programmable. 3 bp_nv1 2 bp_nv0 1 wel_d wel default non-volatile read only 0 provides the default state for the wel status. not user programmable. 0 wip_d wip default non-volatile read only 0 provides the default state for the wip status. not user progr ammable. document number: 002-00488 rev. *g page 45 of 135 S25FS512S status register write non-volatile (srwd_nv) sr1nv[7] : places the device in the hardware protected mode when this bi t is set to 1 and the wp# input is driven low. in this mode, the write r egisters (wrr) and write any r egister (wrar) commands (that select status register 1 or conf iguration register 1) are ignor ed and not accepted for executi on, effectively locking the stat e of the status register 1 and configurati on register 1 (sr1nv, sr1v, cr 1nv, or cr1v) bits, by making the registers read-only. if wp# i s high, status register 1 and config uration register 1 may be cha nged by the wrr or w rar commands. if srwd_nv is 0, wp# has no effect and status register 1 and configuration register 1 may be changed by t he wrr or wrar commands. wp# has no effect on the writing of any oth er registers. the srwd_nv bit h as the same non-volatile endur ance as the main flash array. the srwd (sr1v[7]) bit serves only a s a copy of the srwd_nv bit to provide zero read latency. program error default (p_err_d) sr1nv[6] : provides the default state for the programming error status i n sr1v[6]. this bit is not user programmable. erase error (e_err) sr1v[5] : provides the default state for the erase error status in sr1v [5]. this bit is not user programmable. block protection (bp_nv2, bp_nv1, bp_nv0) sr1nv[4:2] : these bits define the main flash array area to be software-pr otected against program and er ase commands. the bp bits are selected as either volatile or non-volatile , depending on th e state of the bp non-volatile bit (bpnv_o) in the configuration register cr1nv[3 ]. when cr1nv[3]=0 the non-vola tile version of the bp bits (sr1nv[4:2]) are used to contro l block protecti on and the wrr c ommand writes sr1nv[4:2] and updates sr1v[4:2] to the same value. when cr1nv[3]=1 the volati le version of the bp bits (sr1 v[4:2]) are used to control block protection and the wrr command writes sr1v[4:2] and does not affect sr1nv[4:2]. when o ne or more of the bp bits is set to 1, the relevant memory area is protected against program and erase. the bulk erase (be) com mand can be executed only when the bp bits are cleared to 0s. see block protection on page 61 for a description of how the bp bit values select the memory a rray area protected. the non-volatile version of the bp bits have the same non-vo latile endurance as the main flash array. write enable latch default (wel_d) sr1nv[1] : provides the default state for the wel status in sr1v[1]. thi s bit is programmed by cypress and is not user programmable. write in progress default (wip_d) sr1nv[0] : provides the default state for the wip status in sr1v[0]. thi s bit is programmed by cypress and is not user programmable. 7.6.1.2 status register 1 volatile (sr1v) related commands: read status reg ister (rdsr1 05h), write regis ters (wrr 01h), write enable (wren 06h), write disable (wrdi 04h), clear status register (clsr 30h or 82h), read any r egister (rdar 65h), write any regi ster (wrar 71h). this is the register displayed by the rdsr1 command. table 21. status register 1 volatile (sr1v) bits field name function type default state description 7 srwd status register write disable volatile read only sr1nv volatile copy of sr1nv[7]. 6 p_err programming error occurred volatile read only 1 = error occurred. 0 = no error. 5 e_err erase error occurred volatile read only 1 = error occurred. 0 = no error. 4 bp2 block protection volatile volatile protects selected range of sectors (block) from program or eras e when the bp bits are configured as volatile (cr1nv[3]=1). volat ile copy of sr1nv[4:2] when bp bits are configured as non-volatile. user writable when bp bits are configured as volatile. 3 bp1 2 bp0 1 wel write enable latch volatile 1 = device accepts write registers (wrr and wrar), program, or erase commands. 0 = device ignores write registers (wrr and wrar), program, or erase commands. this bit is not affected by wrr or wrar, only wren and wrdi commands affect this bit. 0 wip write in progress volatile read only 1= device busy, an embedded operation is in progress such as program or erase. 0 = ready device is in standby mode and can accept commands. this bit is not affected by wrr or wrar, it only provides wip status. document number: 002-00488 rev. *g page 46 of 135 S25FS512S status register wr ite (srwd) sr1v[7] : srwd is a volatile copy of sr 1nv[7]. this bit tracks any chan ges to the non-volatile version of this bit. program error (p_err) sr1v[6] : the program error bit is used as a program operation success or failure indication. when the program error bit is set to a 1, it indicates that there was an error in the last program operation. this bit will also be set when the user attempts to program within a pro tected main memo ry sector, or p rogram within a locked otp regio n. when the program error bit i s set to a 1, this bit can be clea red to zero with the clear stat us register (clsr) command. this is a read-only bit and is not affected by the wrr or wrar commands. erase error (e_err) sr1v[5] : the erase error bit is used as an erase operation success or failure indication. when the erase error bit is set to a 1, it indica tes that there was an error i n the last erase operation. thi s bit will also be set when the user attempts to erase an individual protected main memory sector. the bulk e rase command will not set e_err if a protected sector is found during the command execution. whe n the erase erro r bit is set t o a 1, this bit can be cleared to zero with the clear status re gister (clsr) command. this is a read-on ly bit and is not affected by the wrr or wrar commands. block protection (bp2 , bp1, bp0) sr1v[4:2] : these bits define the main fla sh array area to be software-pr otected against program and erase commands. the bp bits are selected as either volatile or non-volatile, depending on the state of the bp non-volatile bit (bpnv_o) in the configuration register cr1nv[3 ]. when cr1nv[3]=0 the non-vola tile version of the bp bits (sr1nv[4:2]) are used to contro l block protecti on and the wrr c ommand writes sr1nv[4:2] and updates sr1v[4:2] to the same value. when cr1nv[3]=1 the volati le version of the bp bits (sr1 v[4:2]) are used to control block protection and the wrr command writes sr1v[4:2] and does not affect sr1nv[4:2]. when o ne or more of the bp bits is set to 1, the relevant memory area is protected against program and erase. the bulk erase (be) com mand can be executed only when the bp bits are cleared to 0s. see block protection on page 61 for a description of how the bp bit values select the memory array area protected. write enable latch (wel) sr1v[1] : the wel bit must be set to 1 t o enable program, write, or era se operations as a means to provide protection against inadv ertent changes to memory or reg ister values. the write enable ( wren) command execution sets the write enable latch to a 1 to allow any program, erase, or w rite commands to execu te afterwards. the write disable (wrdi) command can be used to set the wr ite enable latch to a 0 to pre vent all program, erase, and write commands from execution. the wel bit is cleared to 0 at the end of any successful program, w rite, or erase operation. following a failed operation the wel bit may remain set and should be cleare d with a wrdi c ommand following a clsr command. after a power down / power up sequence, hardware reset, or software reset, the write enable latch is se t to a 0 the wrr or wrar comma nd does not affect this bit. write in progress (wip) sr1v[0] : indicates whether the device i s performing a program, write, erase operation, or any other operation, during which a new operation command will be ignored . when the bit is set to a 1, the device is busy performing an operation. while wip is 1, only read status (rdsr1 or rdsr2), r ead any register (rdar), erase suspend (ersp), program suspend (pgsp), clear status register (clsr), and software rese t (reset) commands are accept ed. ersp and pgsp will only be accepted if memory array erase or program operations are in progress. the status register e_err and p_err bits are updated while wip =1. when p_err or e_err bits are set to one, the wip bit will remain set to one indicating the device remains busy a nd unable to receive new operation commands. a clear status regist er (clsr) command must be rece ived to return the device to standby mode. when the wip bit i s cleared to 0 no operation is in progress. this is a read-only bit. 7.6.2 status register 2 volatile (sr2v) related commands: read status r egister 2 (rdsr2 07h), read any register (rdar 65h). status r egister-2 does not have user programmable non-volatile bits, a ll defined bits are volatile r ead only status. the default stat e of these bits are set by har dware. table 22. status register 2 volatile (sr2v) bits field name function type default state description 7 rfu reserved 0 reserved for future use. 6 rfu reserved 0 reserved for future use. 5 rfu reserved 0 reserved for future use. 4 rfu reserved 0 reserved for future use. 3 rfu reserved 0 reserved for future use. 2 estat erase status volatile read only 0 1 = sector erase status command result = erase completed. 0 = sector erase status command result = erase not completed. 1 es erase suspend volatile read only 0 1 = in erase suspend mode. 0 = not in erase suspend mode. document number: 002-00488 rev. *g page 47 of 135 S25FS512S erase status (estat) sr2v[2]: the erase status bit i ndicates whether the sector, selected by an immediately preceding erase status command, compl eted the last erase command on that sector . the erase status command must be issued immediately before reading sr2v to get valid erase status. reading sr2v during a p rogram or erase suspend does not provide valid erase status. th e erase status bit can be used by system software to detect any s ector that failed its last erase operation. this can be used to detect erase operations failed due to lo ss of power during the erase o peration. erase suspend (es) sr2v[1] : the erase suspend bi t is used to determi ne when the device is in erase suspend mode. this is a status bit that cannot be written by the user. when erase suspe nd bit is set to 1, the device is in erase suspend mode. when e rase suspend bit is cleared to 0, the device is not in erase suspend mode. refer to erase or program suspend (eps 85h, 75h, b0h) on page 100 for details about the erase suspend / resume commands. program suspend (ps) sr2v[0]: the program suspend bit is used to determine when the device i s in program suspend mode. this is a status bit that cannot be written by the user. when p rogram suspend bit is set to 1, the device is in program suspen d mode. when the program suspe nd bit is cleared to 0 , the device is not in program suspe nd mode. refer to erase or program suspend (eps 85h, 75h, b0h) on page 100 for details. 7.6.3 configuration register 1 configuration register 1 control s certain interface and data pr otection functions. the regist er bits can be changed using the wrr command with sixteen input cycl es or with the wrar command. 7.6.3.1 configuration register 1 non-volatile (cr1nv) related commands: write register s (wrr 01h), read any register (rdar 65h), write any register (wrar 71h). top or bottom protection (tbprot_o) cr1nv[5]: this bit defines the operation of the block protection bits bp 2, bp1, and bp0 in the status register. as descri bed in the status register sec tion, the bp2-0 bits allow the user to optionally protect a por tion of the array, ranging from 1/64, ?, ?, etc., up to the entire array. w hen tbprot_o is set to a 0, the block protection is defined to start from the top (maximum address) of the array. when tbprot_o is s et to a 1, the block protection is defined to start from the bo ttom (zero address) of the array. the tbprot_o bit is otp and set to a 0 when shipped from cypress. if tbprot_o is programmed to 1, writing the bit with a zero does not change the value or set the program error bit (p_err in sr1v[6]). 0 ps program suspend volatile read only 0 1 = in program suspend mode. 0 = not in program suspend mode. table 23. configuration register 1 non-volatile (cr1nv) bits field name function type default state description 7 rfu reserved for future use non-volatile 0 reserved. 6 rfu 0 5 tbprot_o configures start of block protection otp 0 1 = bp starts at bottom (low address). 0 = bp starts at top (high address). 4 rfu reserved for future use rfu 0 reserved. 3 bpnv_o configures bp2-0 in status register otp 0 1 = volatile. 0 = non-volatile. 2 tbparm_o configures parameter sectors location otp 0 1 = 4-kb physical sectors at top, (high address). 0 = 4-kb physical sectors at top, (low address). rfu in uniform sector configuration. 1 quad_nv quad non-volatile non-volatile 0 provides the default state for the quad bit. 0 freeze_d freeze default non-volatile read only 0 provides the default state for the freeze bit. not user programmable. table 22. status register 2 volatile (sr2v) (continued) bits field name function type default state description document number: 002-00488 rev. *g page 48 of 135 S25FS512S the desired state of tbprot_o mus t be selected dur ing the initi al configuration of the device during system ma nufacture befor e the first program or erase oper ation on the main flash array. t bprot_o must not be pr ogrammed after programming or erasing is done in the main flash array. cr1nv[4]: reserved for future use. block protection non-vol atile (bpnv_o) cr1nv[3] : the bpnv_o bit defines whether the bp_nv 2-0 bits or the bp 2 -0 bits in the status register are selected to control the block protectio n feature. the bpnv_o bit is otp and cleared to a 0 with the bp _nv bits cleared to 000 when shipped from cypress. when bpnv_o is set to a 0 the bp_nv 2-0 bits in the status register are selec ted to control the block protection and are written by the wrr comm and. the time required to write the bp_nv bits is t w . when bpnv is set to a 1, the bp2-0 bits in the status register are select ed to control the block protec tion and the bp_nv 2-0 bits will be programmed to binary 111. this will cause the bp 2-0 bits to be set to binary 111 after por, hardware reset, or command rese t. when bpnv is set to a 1, the wrr command writes only the volati le version of the bp bits (sr1v[ 4:2]). the non-volatile version of the bp bits (sr1nv[4:2]) are no longer affected by the wrr comm and. this allows the bp bits to be written an unlimited number of times because they are volatile and the time to write the volat ile bp bits is the much faster t cs volatile register wri te time. if bpnv_o is programmed to 1, writing the bit with a zero does not change the value or set the program error bit (p_err in sr1v[6]). tbparm_o cr1nv[2] : tbparm_o defines the logical l ocation of the parameter block. the parameter block consists of eight 4-kb parameter sectors, whi ch replace a 32 kb por tion of the highest or lowest address sector. when tbparm_o is se t to a 1 , the parameter block is in the top of the memory array address space . when tbparm_o is se t to a 0 the paramete r block is at the bottom of the array. tbparm_o is otp and set to a 0 when it shi ps from cypress. if tbparm_o is programmed to 1, writing the bi t with a zero does not change the value or s et the program error bit (p_err in sr1v[6]). the desired state of t bparm_o must be select ed during the initi al configuration of t he device during system manufactu re; befor e the first program or erase oper ation on the main flash array. t bparm_o must not be programmed af ter programming or erasing is done in the main flash array. tbprot_o can be set or cleared independent of the tbparm_o bit. therefore, the user can elect to store p arameter information from the bottom of the array and protect boot code starting at the top of the array, or vice ve rsa. or, the user can elect to store and protect the parameter information starting from the top or bott om together. when the memory array is configur ed as uniform sectors, the tbp arm_o bit is reserved for future use (rfu) and has no effect because all sectors are uniform size. quad data width non-volatile (quad_nv) cr1nv[1] : provides the default state for t he quad bit in cr1v[1]. the w rr or wrar command affects this bit. non-volatile selection of qpi mo de, by programming cr2nv[6] =1 , will also program quad_nv =1 to change the non-volatile default to quad data width mode. while qpi mode is selected by cr2 v[6]=1, the quad_nv bit cannot be cleared to 0. freeze protection defa ult (freeze) cr1nv[0] : provides the default state for the freeze bit in cr1v[0]. thi s bit is not user programmable. 7.6.3.2 configuration register 1 volatile (cr1v) related commands: read configur ation register (rdcr 35h), write registers (wrr 01h), read any register (rdar 65h), write any register (wrar 71h). this is the register dis played by the rdcr command. document number: 002-00488 rev. *g page 49 of 135 S25FS512S tbprot, bpnv, and tb parm cr1v[5,3,2]: these bits are volatile copies o f the related non-volatile bit s of cr1nv. these bits track any changes to the related non-volatile version of these bits. quad data width (quad) cr1v[1] : when set to 1, this bit switches the data width of the device to 4-bit quad mode. that is, wp# becomes io2 and i o3 / reset# becomes an a ctive i/o signal when cs# is low or the reset# inpu t when cs# is high. the wp# input is not monitored for its normal function and is internall y set to high (inactive). the commands for serial, and dual i/o read still function normally but, there is no need to drive the wp# input for those commands when switch ing between commands using different data path widths. simi larly, there is no requirement to drive the io3 / reset# during those commands (while cs# is l ow). the quad bit must be set to one w hen using the quad i/o read, d dr quad i/o read, qpi mode ( cr2v[6] = 1), and read quad id commands. while qpi mode is s elected by cr2v[ 6]=1, the quad bit cannot be cleared to 0. the wrr command writes the non-volatile version of the quad bit (cr1nv[1]), which also cau ses an update to the volatile ver sion cr1v[1]. th e wrr command can not write the volatile versi on cr1v[1] without first affect ing the non-volatile version cr1nv [1]. the wrar command must be used when it is desired to write the volatile quad bit cr1v[1] without affecting the non-v olatile version cr1nv[1]. freeze protection (freeze) cr1v[0] : the freeze bit, when set to 1, locks the current state of the block protection control bits and otp area: ? bpnv_2-0 bits in the non-volatile status register 1 (sr1nv[4:2] ) ? bp 2-0 bits in the volatile s tatus register 1 (sr1v[4:2]) ? tbprot_o, tbparm_o, and bpnv_o bi ts in the non-volatile configu ration register (cr1nv[5,3, 2]) ? tbprot, tbparm, and bpnv bits in the volatile configuration reg ister (cr1v[5, 3, 2]) are indire ctly protected in that they are shadows of the related cr1nv otp bits and are read only ? the entire otp memory space any attempt to change the above l isted bits while freeze = 1 is prevented: ? the wrr command does not affect the listed bits and no error st atus is set. ? the wrar command does not affect the listed bits and no error s tatus is set. ? the otpp command, with an address within the otp area, fails an d the p-err status is set. as long as the freeze bit remai ns cleared to logic 0 the block protection control bits and freez e are writable, and the otp address space is programmable. table 24. configuration register 1 volatile (cr1v) bits field name function type default state description 7 rfu reserved for future use volatile cr1nv reserved. 6 rfu 5 tbprot volatile copy of tbprot_o volatile read only not user writable. see cr1nv[5] tbprot_o. 4 rfu reserved for future use rfu reserved. 3 bpnv volatile copy of bpnv_o volatile read only not user writable. see cr1nv[3] bpnv_o. 2 tbparm volatile copy of tbparm_o volatile read only not user writable.see cr1nv[2] tbparm_o. 1 quad quad i/o mode volatile 1 = quad. 0 = dual or serial. 0 freeze lock-down block protection until next power cycle volatile lock current state of block pr otection control bits, and otp regions. 1 = block protection and otp locked. 0 = block protection and otp unlocked. document number: 002-00488 rev. *g page 50 of 135 S25FS512S once the freeze bit has been written to a logic 1 it can only b e cleared to a logic 0 by a power-off to power-on cycle or a ha rdware reset. software reset will not a ffect the state of the freeze b it. the cr1v[0] freeze bi t is volatile and the default state of fre eze after powe r-on comes from freeze_d in cr1nv[0]. the freeze bit can be set in parallel wi th updating other values in cr1v by a single wrr or wrar command. the freeze bit does not prevent the wrr or wrar commands from c hanging the srwd_nv (sr1nv[7]), quad_nv (cr1nv[1]), or quad (cr1v[1]) bits. 7.6.4 configuration register 2 configuration register 2 controls certain interface functions. the register bits can be read and changed using the read any re gister and write any register commands. the non-vo latile version of th e register provides the ability to set the por, hardware reset, or software reset state of the controls. these configuration bits are otp and may only have their default state changed to the op posite value one time during system conf iguration. the v olatile versio n of the register co ntrols the feature behavior during normal operation. 7.6.4.1 configuration register 2 non-volatile (cr2nv) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h). address length non- volatile cr2nv[7]: this bit controls the por, hard ware reset, or software reset s tate of the expected address length for all commands that require address and are no t fixed 3-byte only or 4-byte (32 b it) only address. most comman ds that need an address are legacy spi commands that traditionally used 3-byte (24 bit) address. f or device densit ies greater than 128 mbit a 4-byte address is re quired to access the entire memor y array. the address length confi guration bit is used to change most 3-byte address commands to expect 4-byte address. see table 44, S25FS512S command set (sorted by function) on page 71 for command address length. this non-volatile address length c onfiguration bit enables the device to start immediately (boot) in 4-byte address mode ra ther than the le gacy 3-byte add ress mode. qpi non-volatile cr2nv[6]: this bit controls the por, hardware reset, or software reset s tate of the expected instruction width for all commands. legacy spi command s always send the instruction o ne bit wide (serial i/ o) on the si (io0) signal. the S25FS512S also supports the qpi mode in wh ich all transfers between the h ost system and memory are 4 bits wide on io0 to io3, including all instructions. this non-volatile qpi configuration bit enables t he device to start immediately ( boot) in qqpipi mode rather tha n the legacy serial instruction mode. w hen this bit is programmed to qpi mode, the quad_nv bit is also programmed to quad mode (cr1nv[1]=1). the recommended pr ocedure for moving to qpi mode is to first use the wrar co mmand to set cr2v[6]=1, qpi mode. the volatile register write for qpi mode has a short and well defined time (t cs ) to switch the device i nterface into qpi mode. following commands c an then be immediately sent in qpi protocol . the wrar command can be use d to program cr2nv[6]=1, followed by polling of sr1v[0] to know when the programming ope ration is completed. similarly , to exit qpi mode, the wrar command is used to clear cr2v[6] =0. cr2nv[6] cannot be erased t o 0 because it is otp. table 25. configuration register 2 non-volatile (cr2nv) bits field name function type default state description 7 al_nv address length otp 0 1 = 4-byte address. 0 = 3-byte address. 6 qa_nv qpi 0 1 = enabled C qpi (4-4-4) protocol in use. 0 = disabled C legacy spi protocols in use, instruction is alwa ys serial on si. 5 io3r_nv io3 reset 0 1 = enabled C io3 is used as res et# input when cs# is high or quad mode is disabled cr1v[1]=1. 0 = disabled C io3 has no alternate function, hardware reset is disabled. 4 rfu reserved 0 reserved for future use. 3 rl_nv read latency 1 0 to 15 latency (dummy) cycles following read address or contin uous mode bits. note that bit 3 has a default value of 1 and may be programmed one time to 0 but cannot be returned to 1. 2 0 1 0 0 0 document number: 002-00488 rev. *g page 51 of 135 S25FS512S io3 reset non-volatile cr2nv[5]: this bit controls the por, hardw are reset, or software reset s tate of the io3 signal behavior. most legacy spi devices do not hav e a hardware reset input sign al due to the limited signal cou nt and connections available in traditional spi device packages. t he S25FS512S provides the opt ion to use the io3 signal as a ha rdware reset input when the io 3 signal is not in use for transfe rring information between the h ost system and the mem ory. this non-volatile io3 reset configur ation bit enables the device to start i mmediately (boot) with io3 ena bled for use as a reset# signal. read latency non-volatile cr2nv[3:0]: this bit controls the por, hard ware reset, or software reset s tate of the read latency (dummy cycle) delay in all vari able latency read commands. the following read commands have a va riable latency period between the end of address or m ode and the beginning of read data retur ning to the host: ? fast read ? dual i/o read ? quad i/o read ? ddr quad i/o read ? otpr ? rdar this non-volatile read latency c onfiguration bit sets the numbe r of read laten cy (dummy cycles) in use s o the device can start immediately (boot) wit h an appropriate read latency for the hos t system. notes 35. sck frequency > 133 mhz sdr, or 80 mhz ddr is not supported by this family of devices. 36. the dual i/o, quad i/o, qpi, ddr quad i/o, and ddr qpi, comm and protocols include continuous read mode bits following the a ddress. the clock cycles for these bits are not counted as part of t he latency cycles shown in the table. example: the legacy quad i/o command has 2 continuous r ead mode cycles following the address. therefore, the legacy quad i/o command without additio nal read latency is supported only up to the frequency shown in the table for a read latency of 0 cycles. by increasing the variabl e read latency the frequency o f the quad i/o command can be increased to allow operation up t o the maximum supported 133 mhz frequency. 37. other read commands have fixed latency, e.g. read always has zero read latency. rsfdp always has eight cycles of latency. 38. ddr qpi is only suppor ted for latency c ycles 1 through 7 and for clock frequency of up to 92 mhz. table 26. latency code (cycles) versus frequency latency code read command maximum frequency (mhz) fast read (1-1-1) otpr (1-1-1) rdar (1-1-1) rdar (4-4-4) dual i/o (1-2-2) quad i/o (1-4-4) quad i/o (4-4-4) ddr quad i/o (1-4-4) ddr quad i/o (4-4-4) (note 38) mode cycles = 0 mode cycles = 4 mode cycles = 2 mode cycles = 1 0 508040n/a 1 66925322 2 80 104 66 34 3 92 116 80 45 4 104 129 92 57 5 116 133 104 68 6 129 133 116 80 7 133 133 129 80 8 133 133 133 80 9 133 133 133 80 10 133 133 133 80 11 133 133 133 80 12 133 133 133 80 13 133 133 133 80 14 133 133 133 80 15 133 133 133 80 document number: 002-00488 rev. *g page 52 of 135 S25FS512S 7.6.4.2 configuration register 2 volatile (cr2v) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h), 4bam. address length cr2v[7]: this bit controls the expected ad dress length for all commands that require address and are not fixed 3-byte only or 4-byte (32 bit) only address. see table 44 on page 71 for command address length. this volatile address length configuration bit enables the a ddress length to be changed duri ng normal operation. the 4-byt e address mode (4bam) command directly sets this bit i nto 4-byte address mode. qpi cr2v[6]: this bit controls the expected in struction width for all comma nds. this volatile qpi con figuration bit enables the device to enter and exit qpi mode during normal operation. when this bit is set to qpi mode, the quad bit is also set to quad mode (cr1v[1]=1). when this bit is cl eared to legacy spi mode, the q uad bit is not affected. io3 reset cr2v[5]: this bit controls the io3 / reset# signal behavior. this volat ile io3 reset configuration bit enables the use of io3 as a reset# input dur ing normal operation. read latency cr2v[3:0]: this bit controls the read latency (dummy cycle) delay in vari able latency read commands these volatile configuration bits enable the user to adjust the r ead latency d uring normal operation to optimize the latency for different co mmands or, at different operating frequencies, as needed. 7.6.5 configuration register 3 configuration register 3 control s certain command behaviors. th e register bits can be read a nd changed using the read any register and write any register commands. the non-volatile regi ster provides the por, hardware reset, or software reset state of the controls. these co nfiguration bits are otp and may be progr ammed to their opposite state on e time during system configurat ion if needed. the volatile version of configuration register 3 all ows the configuration to be changed during system operation or testing. 7.6.5.1 configuration register 3 non-volatile (cr3nv) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h). table 27. configuration register 2 volatile (cr2v) bits field name function type default state description 7 al address length volatile cr2nv 1 = 4-byte address. 0 = 3-byte address. 6 qa qpi 1 = enabled C qpi (4-4-4) protocol in use. 0 = disabled C legacy spi protoco ls in use, instr uction is alwa ys serial on si. 5 io3r_s io3 reset 1 = enabled C io3 is used as reset # input when cs# is high or q uad mode is disabled cr1v[1]=1. 0 = disabled C io3 has no altern ate function, hardware reset is disabled. 4 rfu reserved reserved for future use. 3 rl read latency 0 to 15 latency (du mmy) cycles following read add ress or continuous mode bits. 2 1 0 document number: 002-00488 rev. *g page 53 of 135 S25FS512S blank check non-vo latile cr3nv[5]: this bit controls the por, hard ware reset, or software reset s tate of the blank check during erase feature. 02h non-volatile cr3nv[4]: this bit controls the por, hard ware reset, or software reset s tate of the page programming buffer address wrap point. 20h non-volatile cr3nv[3]: this bit controls the por, hardware reset, or software reset s tate of the availability of 4-kb parameter sectors in the main flas h array address map. 30h non-volatile cr3nv[2]: this bit controls the por, hard ware reset, or software reset s tate of the 30h instru ction code is used. d8h non-volatile cr3nv[1]: this bit controls the por, hardw are reset, or software reset s tate of the configurat ion for the size of the area erased by the d8 h or dch instructions. f0h non-volatile cr3nv[0]: this bit controls the por, hard ware reset, or software reset s tate of the availabi lity of the cypress legacy fl-s family softwar e reset instruction. table 28. configuration register 3 non-volatile (cr3nv) bits field name function type default state description 7 rfu reserved otp 0 reserved for future use. 6 rfu reserved 0 reserved for future use. 5 bc_nv blank check 0 1 = blank check during erase enabled. 0 = blank check disabled. 4 02h_nv page buffer wrap 0 1 = wrap at 512 bytes. 0 = wrap at 256 bytes. 3 20h_nv 4 kb erase 0 1 = 4-kb erase disabled (uniform sector architecture). 0 = 4-kb erase enabled (hybrid sector architecture). 2 30h_nv clear status / resume select 0 1 = 30h is erase or program resume command. 0 = 30h is clear status command. 1 d8h_nv block erase size 1 1 = 256 kb erase. this bit is reserved / ignored in fs512s C all uniform sectors are physical 256 kb. 0 f0h_nv legacy software reset enable 0 1 = f0h software reset is enabled. 0 = f0h software reset is disabled (ignored). document number: 002-00488 rev. *g page 54 of 135 S25FS512S 7.6.5.2 configuration register 3 volatile (cr3v) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h). blank check volatile cr3v[5]: this bit controls the blank ch eck during erase feature. when t his feature is enabled an erase command first evaluates the eras e status of the sector. if the sector is found to have not com pleted its last erase successful ly, the sector is unconditionally erased. if the last erase was success ful, the sector is read to dete rmine if the sect or is still era sed (blank). the erase operation is started immediately after finding any pr ogrammed zero. if the sector is already blank (no programmed ze ro bit found) the remainder of the erase operation is skipped. thi s can dramatically reduce erase time when sectors being erased do not need the erase operation. w hen enabled the blank check feat ure is used within the parameter erase, sector erase, and bulk erase commands. when blank check is disabled an erase command u nconditionally starts the erase operation. 02h volatile cr3v[4]: this bit controls t he page programming bu ffer address wrap poi nt. legacy spi devices generally have used a 256-byte page programming buffe r and defined tha t if data is loaded into the buffer beyond the 255-byte location, the addres s at which additional bytes are loade d would be wrapped to address z ero of the buffer. the s25fs5 12s provides a 512-byte page programming buffer that can increase programming performance. f or legacy software compatibility, t his configuration bit provid es the option to continue the wrapping behavior at the 256-byte bo undary or to enable full use of the available 512-byte buffer b y not wrapping the load address at the 256-byte boundary. 20h volatile cr3v[3]: this bit controls the availab ility of 4-kb parameter sectors i n the main flash array address map. the parameter sectors can overlay th e highest or lowest 32-kb addre ss range of the device or they ca n be removed from the address map so that all sectors are unifo rm size. this bit shall not be written to a value different t han the value of cr3nv[3]. the v alue of cr3v[3] may only be change d by writing cr3nv[3]. 30h volatile cr3v[2]: this bit controls how the 30h in struction code i s used. the in struction may be use d as a clear status command or as an alternate prog ram / erase resume command. this allows software compatibility with either cypress legacy spi devices or alternat e vendor devices. d8h volatile cr3v[1]: this bit controls the area erased by the d 8h or dch instructio ns in 128-mbit and 256-mbit members of the S25FS512S. this bit is reserved (ignored) in the S25FS512S devi ce because all uniform sectors in this devic e are 256-kb physic al sectors. the option to erase 256-kb blocks in the lower density family members allows for consis tent software behavior across all densities that can ease migrat ion between diffe rent densities. f0h volatile cr3v[0]: this bit controls the availability of the cypress legacy fl-s family software reset instruction. the S25FS512S supports the industry common 66h + 99h instruction sequence for software reset. this configuration bit allows the option to co ntinue use of the legacy f0h single c ommand for software reset. table 29. configuration register 3 volatile (cr3v) bits field name function type default state description 7 rfu reserved volatile cr3nv reserved for future use. 6 rfu reserved reserved for future use. 5 bc_v blank check 1 = blank check during erase enabled. 0 = blank check disabled. 4 02h_v page buffer wrap 1 = wrap at 512 bytes. 0 = wrap at 256 bytes. 3 20h_v 4 kb erase volatile, read only 1 = 4-kb erase disabled (uniform sector architecture). 0 = 4-kb erase enabled (hybrid sector architecture). 2 30h_v clear status / resume select volatile 1 = 30h is erase or program resume command. 0 = 30h is clear status command. 1 d8h_v block erase size 1 = 256-kb erase . this bit is reserved / ignored in fs512s C all uniform sectors are physical 256 kb. 0 f0h_v legacy software reset enable 1= f0h software reset is enabled . 0= f0h software reset is disabled (ignored). document number: 002-00488 rev. *g page 55 of 135 S25FS512S 7.6.6 configuration register 4 configuration register 4 control s the main flash array read com mands burst wrap behavior. the bu rst wrap configuration does no t affect commands reading from area s other than the main flash ar ray e.g. read comma nds for registers or otp array. the non-volatile version of the register provides the ability to se t the start up (boot) state of th e controls as the contents are copied to the volatile version of the register during the por, hardware reset , or software reset. the volatile version of the register contr ols the feature behavior during normal operation. the register bits can be read and changed using the re ad any register and write any register commands. the volatile v ersion of the r egister can als o be written by the set b urst length (c0h) command. 7.6.6.1 configuration register 4 non-volatile (cr4nv) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h). output impedance non- volatile cr4nv[7:5]: these bits control the por, hardware reset, or software reset state of the io signal output impedance (drive strength) . multiple drive strength are available to help match the output impedance with the system pr inted circuit board environment to mi nimize overshoot and ringing. th ese non-volatile outpu t impedance configuration bits enable the device to start immediately (boo t) with the appr opriate drive s trength. wrap enable non-vo latile cr4nv[4]: this bit controls the por, hard ware reset, or software reset s tate of the wrap enable. the commands affected by wrap enable are: quad i/o read, and ddr qu ad i/o read. this configuration bit enables the device to start immediately (boot) in wrapped bur st read mode rather than the l egacy sequential read mode. wrap length non-vo latile cr4nv[1:0]: these bits controls the por, hardware reset, or software reset state of the wrapped read length and alignment. these non-volatile configuration bits ena ble the device to start immediately (boot) in wrapped burst rea d mode rather than the legacy sequential read mode. table 30. configuration register 4 non-volatile (cr4nv) bits field name function type default state description 7 oi_o output impedance otp 0 see table 31 on page 55 6 0 5 0 4 we_o wrap enable 1 0 = wrap enabled 1 = wrap disabled 3 rfu reserved 0 reserved for future use 2 rfu reserved 0 reserved for future use 1 wl_o wrap length 0 00 = 8-byte wrap 01 = 16-byte wrap 10 = 32-byte wrap 11 = 64-byte wrap 0 0 table 31. output impedance control cr4nv[7:5] impedance selection typical impedance to v ss (ohms) typical impedance to v cc (ohms) notes 000 47 45 factory default 001 124 105 010 71 64 011 47 45 100 34 35 101 26 28 110 22 24 111 18 21 document number: 002-00488 rev. *g page 56 of 135 S25FS512S 7.6.6.2 configuration register 4 volatile (cr4v) related commands: read any regi ster (rdar 65h), write any regis ter (wrar 71h), set burst length (sbl c0h). output impedance cr2v[7:5]: these bits control the io signa l output impedance (drive stren gth). this volatile output impedance configuration bit enables the use r to adjust the drive strength during normal operation. wrap enable cr4v[4]: this bit controls the burst wra p feature. this volatile config uration bit enables the dev ice to enter and exit burst wrapped read mode during normal operation. wrap length cr4v[1:0]: these bits controls the wrapped read length and alignment duri ng normal operation. these volatile configuration bits enable the us er to adjust the burst wrapped read length during normal operation. 7.6.7 ecc status register (eccsr) related commands: ecc read (ec crd 18h or 19h). e ccsr does not h ave user programmable non-vol atile bits, all defined bits are volatile read only status. the default state of these bits are set by hardware. the status of ecc in each ecc un it is provided b y the 8-bit ecc status register (eccsr). the ecc register read command is written followed by an ecc uni t address. the contents of the st atus register then indicates, for the selected ecc unit, whethe r there is an error in the ecc, the ecc unit data, or that ecc is disab led for that ecc unit. eccsr[2] = 1 indicates an error was corrected in the ecc. eccsr [1] = 1 indicates an error was co rrected in the ecc unit data. eccsr[0] = 1 indicates the ecc is disabled. the default state o f 0 for all these bits indicate s no failures and ecc is enabl ed. the eccsr[7:3] are reserved. the se have undefined high or low v alues that can change from one ecc status re ad to another. these bits should be treated as dont care and ignored by any software reading status. table 32. configuration register 4 volatile (cr4v) bits field name function type default state description 7 oi output impedance volatile cr4nv see table 31 on page 55 . 6 5 4 we wrap enable 0 = wrap enabled 1 = wrap disabled 3 rfu reserved reserved for future use 2 rfu reserved reserved for future use 1 wl wrap length 00 = 8-byte wrap 01 = 16-byte wrap 10 = 32-byte wrap 11 = 64-byte wrap 0 table 33. ecc status register (eccsr) bits field name function type default state description 7 to 3 rfu reserved 0 reserved for future use 2 eecc error in ecc volatile, read only 0 1 = single bit error found in the ecc unit error correction code 0 = no error. 1 eeccd error in ecc unit data volatile, read only 0 1 = single bit error corrected in ecc unit data. 0 = no error. 0 eccdi ecc disabled volatile, read only 0 1 = ecc is disabled in the selected ecc unit. 0 = ecc is enabled in the selected ecc unit. document number: 002-00488 rev. *g page 57 of 135 S25FS512S 7.6.8 asp register (aspr) related commands: asp read (asprd 2bh) and asp program (aspp 2f h), read any register (rdar 65h), write any register (wrar 71h). the asp register is a 16-bit otp memory location used to perman ently configure the behavior of advanced sector protection (asp ) features. aspr does no t have user programma ble volatile bits, a ll defined bits are otp. the default stat e of the aspr bits are programmed by cypress. password protection mode l ock bit (pwdmlb) aspr[2]: when programmed to 0, the pa ssword protection mode is permanently selected. persistent protection mode lock bit (pstmlb) aspr[1]: when programmed to 0, the p ersistent protection mode is permanently selected. pwdmlb (aspr[2]) and pstmlb (aspr[ 1]) are mutually exclusive, o nly one may be programmed to zero. aspr bits may only be programmed while aspr[2:1] = 11b. attempt ing to program aspr bits w hen aspr[2:1] is not = 11b will result in a programming error with p_err (sr1v[6]) set to 1. af ter the asp protection mode is selected by programming aspr[2:1 ] = 10b or 01b, the st ate of all aspr bits are locked and permane ntly protected from fu rther programming. at tempting to program aspr[2:1] = 00b will re sult in a programming error with p_err ( sr1v[6]) set to 1. similarly, otp configur ation bits listed in the asp register de scription ( asp register on page 64 ), may only be p rogrammed while aspr[2:1] = 11b. the otp configur ation must be se lected before selecting the asp prot ection mode. the otp configuration bits are permanently protected from f urther change when the asp prot ection mode is selected. att empting to program these otp configuration bits wh en aspr[2:1] is not = 11b will result in a programming error with p_ err (sr1v[6]) set to 1. the asp protection mode should b e selected during system config uration to ensure that a malicio us program does not select an undesired protection mode at a la ter time. by locking all the p rotection configurat ion via the asp mode se lection, later alter ation of the protection methods by malic ious programs is prevented. table 34. asp register (aspr) bits field name function type default state description 15 to 9 rfu reserved otp 1 reserved for future use 8 rfu reserved otp 1 reserved for future use 7 rfu reserved otp 1 reserved for future use 6 rfu reserved otp 1 reserved for future use 5 rfu reserved otp 1 reserved for future use 4 rfu reserved otp 1 reserved for future use 3 rfu reserved otp 1 reserved for future use 2 pwdmlb password protection mode lock bit otp 1 0 = password protection mode permanently enabled. 1 = password protection mode not permanently enabled. 1 pstmlb persistent protection mode lock bit otp 1 0 = persistent protection mode permanently enabled. 1 = persistent protection mode not permanently enabled. 0 rfu reserved rfu 1 reserved for future use document number: 002-00488 rev. *g page 58 of 135 S25FS512S 7.6.9 password register (pass) related commands: pas sword read (passrd e7h) and password progr am (passp e8h), read any register (rdar 65h), write any register (wrar 71h). the pass register is a 64-bit otp memo ry location used to permanent ly define a password for the advanced sector protection (asp) feature. pass does not have us er programmable volatile bits, a ll defined bits are otp. a vola tile copy of pass is used to satisfy r ead latency requirements but t he volatile register is not user writable or fur ther described. 7.6.10 ppb lock register (ppbl) related commands: ppb lock read (plbrd a7h, plbwr a6h), read an y register (rdar 65h). ppbl does not have sepa rate user programmab le non-volatile bits , all defined bits are volatile r ead only status. the default s tate of the rfu bits is set by hardware . the default sta te of the ppblo ck bit is defined by the asp prot ection mode bits in aspr[2:1]. there is no non-volatile version of the ppbl register. the ppblock bit is used to prote ct the ppb bits. when ppbl[0] = 0, the ppb bits can not be programmed. 7.6.11 ppb access register (ppbar) related commands: ppb read (ppbrd fch or 4 ppbrd e2h), ppb progr am (ppbp fdh or 4ppbp e3 h), ppb erase (ppbe e4h). ppbar does not have user writable volatile bits, all ppb array bits are non-volatile . the default state o f the ppb array is er ased to ffh by cypress. there is no volatile versi on of the ppbar regis ter. 7.6.12 dyb access register (dybar) related commands: dyb read (dybr d fah or 4dybrd e0h) and dyb wr ite (dybwr fbh or 4dybwr e1h). dybar does no t have user programmable non-volatile b its, all bi ts are a representation of the v olatile bits in t he dyb array. the default state of the dyb array bi ts is set by hardware. there i s no non-volatile version of the dybar register. table 35. password register (pass) bits field name function type default state description 63 to 0 pwd hidden password otp ffffffff-ffffffffh non-volatile otp storage of 64- bit password. the password is no longer readable after the password protection mode is selected by programming asp register bit 2 to zero. table 36. ppb lock register (ppbl) bits field name function type default state description 7 to 1 rfu reserved volatile 00h reserved for future use 0 ppblock protect ppb array volatile read only aspr[2:1] = 1xb = persistent protection mode = 1 aspr[2:1] = 01b = password protection mode = 0 0 = ppb array protected 1 = ppb array may be programmed or erased. table 37. ppb access register (ppbar) bits field name function type default state description 7 to 0 ppb read or program per sector ppb non-volatile ffh 00h = ppb for the sector addressed by the ppbrd or ppbp command is programmed to 0, protecting that sector from program or erase o perations. ffh = ppb for the sector addressed by the ppbrd command is 1, n ot protecting that sector from program or erase operations. table 38. dyb access register (dybar) bits field name function type default state description 7 to 0 dyb read or write per sector dyb volatile 00h 00h = dyb for the sector addressed by the dybrd or dybwr comman d is cleared to 0, protecting that sector from program or erase oper ations. ffh = dyb for the sector addressed by the dybrd or dybwr comman d is set to 1, not protecting that sector from program or erase operations. document number: 002-00488 rev. *g page 59 of 135 S25FS512S 7.6.13 spi ddr data l earning registers related commands: program nvdlr (pnvdlr 43h), write vdlr (wvdlr 4ah), data learning pattern read (dlprd 41h), read any register (rdar 65h), writ e any register (wrar 71h). the data learning pattern (dlp) resides in an 8-bit non-volatil e data learning register (nvdlr) as well as an 8 -bit volatile d ata learning register (vdlr). when shipped from cypress, the nvdlr value is 00h. once progra mmed, the nvdlr cannot be reprogrammed or erased; a copy o f the data pattern in the nvdlr will also be written to the vdl r. the vdlr can be written to a t any time, but on power cycles the data patter n will revert back to what is in the nvdlr. during the learning phase described i n the spi ddr modes, the dlp will come from the vdlr. each io will ou tput the same dlp value for eve ry clock edge. for example, if the dlp is 34h (or binary 0011010 0) then during the first clock edge all ios will output 0; s ubsequently, the 2nd clock edge all i/os will output 0, the 3rd will output 1, etc. when the vdlr value is 00h, no preamble dat a pattern is present ed during the dummy pha se in the ddr commands. table 39. non-volatile data learning register (nvdlr) bits field name function type default state description 7 to 0 nvdlp non-volatile data learning pattern otp 00h otp value that may be transferred to the host during ddr read command latency (dummy) cycles to provide a training pattern to help the host more accurately center th e data capture point in the r eceived data bits. table 40. volatile data learning register (vdlr) bits field name function type default state description 7 to 0 vdlp volatile data learning pattern volatile takes the value of nvdlr during por or reset volatile copy of the nvdlp used to enable and deliver the data learning pattern (dlp) to the outputs. the vdlp may be changed by the ho st during system operation. document number: 002-00488 rev. *g page 60 of 135 S25FS512S 8. data protection 8.1 secure silicon region (otp) the device has a 1024-byte one ti me program (otp) address space that is separate from the main flash array. the otp area is divided into 32, individually lockable, 32-byte aligned and len gth regions. the otp memory space is intende d for increased system security. otp values can mate a flas h component wit h the system cpu/asic to prevent device substitution. see otp address space on page 42 , otp program (otpp 42h) on page 103 , and otp read (otpr 4bh) on page 103 . 8.1.1 reading otp memory space the otp read command uses the sa me protocol as fast read. otp r ead operations outside the valid 1-kb otp address range will yield indeterminate data. 8.1.2 programming otp memory space the protocol of the otp programming command is the same as page program. the otp program command can be issued multiple times to any given otp address, but this address space can neve r be erased. automatic ecc is programmed on t he first progra mming operation to each 16 byte region. progra mming within a 16 byte region more than once disables the ecc. it is recommended to program e ach 16 byte portion of each 32 byte region once so that ecc remains enabled to provide the best data integrity. the valid address range for otp program is depicted in figure 42 on page 42 . otp program operations outside the valid otp address range will be ignored, without p_err in sr1v set to 1. otp program operations within the valid otp address range, whil e freeze = 1, will fail with p_err in sr1v set to 1 . the otp addr ess space is not protected by t he selection of an asp protectio n mode. the freeze bit (cr1v[0]) ma y be used to protect the otp a ddress space. 8.1.3 cypress programmed random number cypress standard practice is to p rogram the low order 16 bytes of the otp memory spac e (locations 0x0 to 0xf) with a 128-bit random number using the linear congruential random number metho d. the seed value for the alg orithm is a random number concatenated with the day and time of tester insertion. 8.1.4 lock bytes the lsb of each lock byte protect s the lowest address region re lated to the byte, the msb protec ts the highest address region related to the byte. the next hi gher address byte similarly pro tects the next higher eight reg ions. the lsb bit of the lowest address lock byte protects the higher add ress 16 bytes of the lowest ad dress region. in other words, t he lsb of location 0x10 protects all the lock bytes and rfu bytes in the l owest address region from furt her programming. see otp address space on page 42 . document number: 002-00488 rev. *g page 61 of 135 S25FS512S 8.2 write enable command the write enable (wren ) command must be writ ten prior to any co mmand that modifie s non-volatile data. the wren command sets the write enable latch (wel) bit. the wel bit is cleared t o 0 (disables writes) during power-up, hardware reset, or after the device completes the following commands: reset page program (pp or 4pp) parameter 4-kb erase (p4e or 4p4e) sector erase (se or 4se) bulk erase (be) write disable (wrdi) write registers (wrr) write any register (wrar) otp byte programming (otpp) advanced sector protectio n register program (aspp) persistent pro tection bit program (ppbp) persistent protect ion bit erase (ppbe) password program (passp) program non-volatile data learning register (pnvdlr) 8.3 block protection the block protect bits (status r egister bits bp2, bp1, bp0) in combination with the configuratio n register tbprot_o bit can be used to protect an address range of the main flash array from p rogram and erase operations. the size of the range is determine d by the value of the bp bits and the upper or lower starting point of the range is selected by the tbprot_o bit of the configurati on register (cr1nv[5]). table 41. upper array start of protection (tbprot_o = 0) status register content protected fraction of memory array protected memory (kbytes) bp2 bp1 bp0 fs512s 512 mb 0 0 0none0 0 0 1 upper 64th 1024 0 1 0 upper 32nd 2048 0 1 1 upper 16th 4096 1 0 0 upper 8th 8192 1 0 1 upper 4th 16384 1 1 0 upper half 32768 1 1 1 all sectors 65536 document number: 002-00488 rev. *g page 62 of 135 S25FS512S when block protection is enabled (i.e., any bp2-0 are set to 1) , advanced sector pro tection (asp) can sti ll be used t o protect sectors not protected by the block protec tion scheme. in the ca se that both asp and block protec tion are used on the same sect or the logical or of asp and block pr otection relate d to the secto r is used. 8.3.1 freeze bit bit 0 of configuration register 1 (cr1v[0]) is the freeze bit. t he freeze bit, when set to 1, lo cks the current state of the bl ock protection control bits and otp area until the next power off-o n cycle. additional details in configuration register 1 volatile (cr1v) on page 48 8.3.2 write protect signal the write protect (wp#) input in combination with the status re gister write disable (srwd) bit (sr1nv[7]) provide hardware inp ut signal controlled protection. when wp# is low and srwd is set t o 1 status register-1 (sr1nv and sr1v) and configuration register 1 (cr1nv and cr1v) are p rotected from alteration. this prevents disabling or changing the protection defined by the b lock protect bits. see status register 1 vola tile (sr1v) on page 45 . 8.4 advanced sector protection advanced sector protection (asp) i s the name used for a set of independent hardware and softwar e methods used to disable or enable programming or erase opera tions, individually, in any or all sectors. every main flash array sector h as a non-volatile persistent pro tection bit (ppb) and a volatile dynamic p rotection bit (dyb) associated with it. when either b it is 0, the sect or is protect ed from program and erase operati ons. the ppb bits are protecte d from program and erase when the volati le ppb lock bit is 0. there ar e two methods for managing t he state of the ppb lock bit: password protection, and persiste nt protection. an overview of these methods is shown in figure 44 on page 63 . table 42. lower array start of protection (tbprot_o = 1) status register content protected fraction of memory array protected memory (kbytes) bp2 bp1 bp0 fs512s 512 mb 0 0 0none0 0 0 1 lower 64th 1024 0 1 0 lower 32nd 2048 0 1 1 lower 16th 4096 1 0 0 lower 8th 8192 1 0 1 lower 4th 16384 1 1 0 lower half 32768 1 1 1 all sectors 65536 document number: 002-00488 rev. *g page 63 of 135 S25FS512S block protection and asp protect ion settings for each sector ar e logically ored to define the pr otection for each sector i.e. if either mechanism is protecting a sector the sector cannot be programme d or erased. refer to block protection on page 61 for full details of the bp2-0 bits. figure 43. sector protection control figure 44. advanced sec tor protection overview sector 0 logical or sector 0 sector 0 block sector 1 logical or sector 1 sector 1 sector n logical or sector n sector n ... ... ... ... protection logic persistent protection bits array (ppb) dynamic protection bits array (dyb) flash memory array power on / reset aspr[2]=0 aspr[1]=0 ppblock = 0 ppb bits locked ppblock = 1 ppb bits erasable aspr bits locked aspr bits locked aspr bits are programmable and programmable password unlock ppblock = 1 ppb bits erasable and programmable password protection persistent protection default persistent protection ppb lock bit write ppb lock bit write ppblock = 0 ppb bits locked yes yes yes yes yes no no no no no password protection mode protects the ppb after power up. a password unlock command will enable changes to ppb. a ppb lock bit write command turns protection back on. persistent protection mode does not protect the ppb after power up. the ppb bits may be changed. a ppb lock bit write command protects the ppb bits until the next power off or reset. default mode allows aspr to be programmed to permanently select the protection mode. the default mode otherwise acts the same as the persistent protection mode. after one of the protection modes is selected, aspr is no longer programmable, making the selected protection mode permanent. document number: 002-00488 rev. *g page 64 of 135 S25FS512S the persistent protection method sets the ppb lock bit to 1 dur ing por, or hardware reset so th at the ppb bits are unprotected by a device reset. there is a comma nd to clear the ppb lock bit to 0 to protect the ppb. there is no command in the persistent protection method to set the ppb lock bit to 1, therefore the p pb lock bit will remain at 0 until the next power-off or hardwa re reset. the persistent protection meth od allows boot c ode the option of changing sector protection by p rogramming or erasing the ppb, then protecting the ppb from fur ther change for the remainder o f normal system operation by cle aring the ppb lo ck bit to 0. th is is sometimes called boot-code con trolled sector protection. the password method c lears the ppb lock bit t o 0 during por, or hardware reset to protect the ppb. a 64-bit password may be permanently programmed and hidden for the password method. a co mmand can be used to provide a password for comparison with the hidden password. i f the password matc hes, the ppb lock bit is set to 1 to unprot ect the ppb. a command can be used to clea r the ppb lock bit to 0. this method requires use of a password t o control ppb protection. the selection of the ppb lock bit management method is made by programming otp bits in the asp register so as to permanently select the method used. 8.4.1 asp register the asp register is used to perm anently configure the behavior of advanced sector protect ion (asp) features. see table 34, asp register (aspr) on page 57 . as shipped from the factory, all devices default asp to the per sistent protection mo de, with all sectors unprotected, when pow er is applied. the device programmer or host system must then choose which sector protectio n method to use. pr ogramming either of the, one-time programmable, pro tection mode lo ck bits, locks th e part permanently i n the selected mode: ? aspr[2:1] = 11 = no asp mode sele cted, persistent protection mode is the default. ? aspr[2:1] = 10 = per sistent protection m ode permanently selec ted. ? aspr[2:1] = 01 = pas sword protection mo de permanently selecte d. ? aspr[2:1] = 00 is an illegal conditi on, attempti ng to program more than one bit to zero results in a programming failure. asp register programming rules: ? if the password mode is chosen, the password must be programmed prior to setting the pro tection mode lock bits. ? once the protection mode is selected, the following otp configu ration register bits are permanently protected from programming and no further changes to the otp register bits is allowed: Ccr1nv[5:2] Ccr2nv Ccr3nv Ccr4nv Caspr Cpass Cnvdlr Cif an attempt to change any of t he registers above, after the asp mode is selected, the op eration will fail and p_err (sr1v[6]) will be set to 1. the programming time of the asp r egister is the same as the typ ical page programming time. the system can determine the status of the asp register programming op eration by reading the wip bi t in the status register. see status register 1 non-volatile (sr1nv) on page 44 for information on wip. see sector protection st ates summary on page 65 . document number: 002-00488 rev. *g page 65 of 135 S25FS512S 8.4.2 persistent protection bits the persistent protection bits (ppb) are located in a separate nonvolatile flash array. one of the ppb bits is re lated to each sector. when a ppb is 0, its related sector is protected from program a nd erase operations. the ppb are programmed individually but mu st be erased as a group, similar to the way individual words may b e programmed in the main array but an entire sector must be era sed at the same time. the ppb have the same pr ogram and erase endur ance as the ma in flash memory array. preprogramming and verification prior to erasure are handled by the device. programming a ppb bit requires the typical page programming tim e. erasing all the ppbs requires typical sector erase time. dur ing ppb bit programming and ppb bit erasing, status is available by reading the status register. re ading of a ppb bit requires the initial access time of the device. notes ? each ppb is individually programme d to 0 and all are erased to 1 in parallel. ? if the ppb lock bit is 0, the ppb program or ppb erase command does not execute and fails witho ut programming or erasing the ppb. ? the state of the ppb fo r a given sector can be verifie d by usin g the ppb read command. 8.4.3 dynamic protection bits dynamic protection bits are volatile and unique for each sector and can be individually modified. dyb only control the protect ion for sectors that have their ppb set to 1. by issuing the dyb write command, a dyb is cleared to 0 or set to 1, thus placing each s ector in the protected or unprotected state respectively. this featur e allows software to easily protect sectors against inadvertent changes, yet does not prevent the easy removal of protection when change s are needed. the dybs can be set or cleared as often as needed as they are volatile bits. 8.4.4 ppb lock bit (ppbl[0]) the ppb lock bit is a volatile bit for protecting all ppb bits. when cleared to 0, it locks all ppbs, when set to 1, it allows the ppbs to be changed. see ppb lock register (ppbl) on page 58 for more information. the plbwr comman d is used to clear the ppb lock bit t o 0. the p pb lock bit must be cleared to 0 only after al l the ppbs are configured to the desired settings. in persistent protect ion mode, the ppb lock is set to 1 during por or a hardware reset. when cl eared to 0, no so ftware command sequence can set the ppb lock bit to 1, only another hardware r eset or power-up can set the ppb lock bit. in the password protection mode , the ppb lock bit is cleared to 0 during por or a hardware re set. the ppb lock bi t can only be set to 1 by the passw ord unlock command. 8.4.5 sector protect ion states summary each sector can be in one of t he following prot ection states: ? unlocked the sector is unprote cted and protecti on can be chan ged by a simple command. the pr otection state defaults to unprotected when the devic e is shipped from cypress. ? dynamically locked a sector is protected and protection can b e changed by a simple command. the protection state is not saved across a powe r cycle or reset. ? persistently locked a sector i s protected and protection can only be changed if the ppb lock bi t is set to 1. t he protection state is non-volatile and saved across a power cycle or reset. changing the protection state requires programming and or erase of the ppb bits. document number: 002-00488 rev. *g page 66 of 135 S25FS512S 8.4.6 persistent protection mode the persistent protection met hod sets the ppb lock bit to 1 dur ing por or hardware reset so tha t the ppb bits are unprotected by a device hardware reset. software reset does not affect the ppb lock bit. the plbwr command can clear the ppb lock bit to 0 to protect the ppb. there is no co mmand to set the ppb lock bit th erefore the ppb lock bit will remain at 0 until the next power- off or hardware reset. 8.4.7 password protection mode password protection mode allows an even higher level of securit y than the persistent s ector protection mod e, by requiring a 64 -bit password for unlocking the ppb lock bit. in addition to this pa ssword requirement, after power up and hardware reset, the ppb lock bit is cleared to 0 to ensure pr otection at power-up. successfu l execution of the password unlo ck command by ent ering the enti re password sets the ppb lock bit to 1, allowing for sector ppb mo difications. password protection notes: ? once the password is programmed and verified, the password mode (aspr[2]=0) must be s et in order to pre vent reading the password. ? the password program command is only capable of programming 0s. programming a 1 after a cell is programmed as a 0 results in the cell left as a 0 wit h no programming error set. ? the password is all 1s when shipped from cypress. it is located in its own memory space and is accessible through the use of t he password program, password r ead, rdar, and wrar commands. ? all 64-bit password combinations are valid as a password. ? the password mode, once programme d, prevents reading the 64-bit password and further passwo rd programming . all further program and read commands to the password region are disabled a nd these commands are ignored o r return undefined data. there is no means to verify what the password is after the pass word mode lock bit is selected. password verification is only allowed before selecting th e password prot ection mode. ? the protection mode lock bits are not erasable. ? the exact password must be enter ed in order for the unlocking f unction to occur. if the pa ssword unlock command provided password does not match the hidd en internal password, the unloc k operation fails in the s ame manner as a programming operation on a protected sector. the p_err bit is set to one, t he wip bit remains set, and the ppb lock bit remains cleared to 0. ? the password unlock command cann ot be accepted an y faster than once every 100 s 20 s . this makes it take an unreasonably long time (58 million years) for a hacker to run t hrough all the 64-bit combinati ons in an attempt to correctly m atch a password. the read status registe r 1 command may be used to rea d the wip bit to determine w hen the device has completed the password unlock command or is ready to accept a new passwor d command. when a valid pa ssword is provided the password unlock command does not insert the 100 s delay before returning the wip bit to zero. ? if the password is lost after sel ecting the password mode, ther e is no way to set the ppb lock bit. ? ecc status may only be read from sectors that are readable. in read protection mode the addresses are forced to the boot secto r address. ecc status is only in that sector while read protectio n mode is active. table 43. sector protection states protection bit values sector state ppb lock ppb dyb 1 1 1 unprotected C ppb and dyb are changeable 1 1 0 protected C ppb and dyb are changeable 1 0 1 protected C ppb and dyb are changeable 1 0 0 protected C ppb and dyb are changeable 0 1 1 unprotected C ppb not changeable, dyb is changeable 0 1 0 protected C ppb not changeable, dyb is changeable 0 0 1 protected C ppb not changeable, dyb is changeable 0 0 0 protected C ppb not changeable, dyb is changeable document number: 002-00488 rev. *g page 67 of 135 S25FS512S 8.5 recommended protection process during system manufacture, the fl ash device configuration shoul d be defined by: ? programming the otp configuratio n bits in cr1nv[5, 3:2], cr2nv, cr3nv, and cr4nv as desired. ? program the secure silicon re gion (otp area) as desired. ? program the ppb bits as desi red via the ppbp command. ? program the non-volatile data learning pattern (nvdlr) if it wi ll be used in ddr read commands. ? program the password register ( pass) if password protection wil l be used. ? program the asp register as desired, including the selection of the persistent or password asp pr otection mode in aspr[2:1]. i t is very important to explicitly s elect a protection mode so tha t later accidental or malicious programming of the asp register and otp configuration is p revented. this is to ensure that only the intended otp protecti on and configuration features are enabled . during system power up and boot code execution: ? trusted boot code can determine whether th ere is any need to pr ogram additional ssr (otp ar ea) informati on. if no ssr changes are needed the freeze bit (cr1v[0]) can be set to 1 to protect the ssr from changes during the remainder of normal system operation while power remains on. ? if the persistent protection mo de is in use, tru sted boot code can determine whether t here is any nee d to modify the persisten t (ppb) sector protection via th e ppbp or ppbe commands. if no pp b changes are needed the ppblock bit can be cleared to 0 via the ppbl to p rotect the ppb bits from changes during the re mainder of normal system opera tion while power remains on. ? the dynamic (dyb) sector protecti on bits can be wr itten as desi red via th e dybar. document number: 002-00488 rev. *g page 68 of 135 S25FS512S 9. commands all communication between the ho st system and S25FS512S memory devices is in the form of units called commands. all commands begin with an instruction that selects the type of information transfer or device operation to be performed. comm ands may also have an address, instruc tion modifier, latency period, data transfer to the memory, or data transfer from the memory. all instruction, address, and data information is transferred seque ntially between the host system and memory device. command protocols are also classi fied by a numerical nomenclatu re using three numbers to referenc e the transfer w idth of three command phases: ? instruction ? address and instruction modifier (mode) ? data single bit wide commands start with an instructio n and may prov ide an address or data, all sen t only on the si signal. data ma y be sent back to the host serially on the so signal. this is refere nced as a 1-1-1 command protocol for single bit width instructi on, single bit width address and mod ifier, single bit data. dual or quad input / output (i/o ) commands provide an address s ent from the host as bit pairs on io0 and io1 or, four-bit (nib ble) groups on io0, io1, io2, and io3 . data is returned to the host similarly as bit pairs on io0 and io1 or, f our-bit (nibble) gro ups on io0, io1, io2, and io3. this is r eferenced as 1-2-2 for dual i/ o and 1-4-4 for quad i /o command protocols. the S25FS512S also supports a qp i mode in which all information is transferred in 4-bit width, in cluding the instruction, addr ess, modifier, and data. this is refer enced as a 4-4-4 command proto col. commands are structured as follows: ? each command begins with an eight bit (byte) instruction. howev er, some read commands are m odified by a prior read command, such that the instruction is implied from the earlier command. this is called continuous read mode. when the device is in continuous read mode, the instruction bits are not transm itted at the beginning of the command because the instruction i s the same as the read command that initiated the continuous read mod e. in continuous read mode the command will begin with the read address. thus, continuous r ead mode removes eight instruct ion bits from each read comma nd in a series of same type read commands. ? the instruction may be stand alone or may be followed by addres s bits to select a loca tion within one of several address space s in the device. the address may be either a 24-bit or 32-bit, by te boundary, address. ? the serial peripheral interface with multiple io provides the o ption for each transfer of addre ss and data information to be d one one, two, or four bits in parallel. this enables a trade off be tween the number of signal connecti ons (io bus width) and the s peed of information transfer. if the host system can support a two o r four bit wide io bus the memory performance can be increased by using the instructions that provi de parallel two bit (dual) or parallel four bit (quad) transfers. ? in legacy spi multiple io mode, the width of all transfers foll owing the instruction are determ ined by the instruction sent. f ollowing transfers may continue to be single bit serial on only the si o r serial output (so) signals, they may be done in two bit group s per (dual) transfer on the io0 and io1 signals, or they may be done in 4-bit groups per (quad) transfer on the io0-io3 signals. wi thin the dual or quad groups the leas t significant bit is on io0. mo re significant bits are placed i n significance or der on each hi gher numbered io signal. single bits or parallel bit groups are tran sferred in most to least significant bit order. ? in qpi mode, the width of all tr ansfers, including instructions , is a 4-bit wide (quad) trans fer on the io0-io3 signals. ? dual i/o and quad i/o read instru ctions send an instruction mod ifier called mode bits, followi ng the address, to indicate that the next command will be of the sam e type with an implied, rather t han an explicit, instruction. t he next command thus does not provide an instruction byte, only a new address and mode bits. this reduces the time needed to send each command when the same command type is repeat ed in a sequence of commands. ? the address or mode bits may be followed by write data to be st ored in the memory device or by a read latency period before read data is returned to the host. ? read latency may be zero to sever al sck cycles (also referred t o as dummy cycles). ? all instruction, address, mode, and data information is transfe rred in byte granularity. addre sses are shifted into the device with the most significant byte first. all data is transferred with t he lowest address byte sent firs t. following bytes of data are sent in lowest to highest byte address or der i.e. the byte address incr ements. document number: 002-00488 rev. *g page 69 of 135 S25FS512S ? all attempts to read the flash memory array during a program, e rase, or a write cycle (embedded operations) are ignored. the embedded operation will continue t o execute without any affect. a very limited set of comma nds are accepted during an embedded operation. these are discussed in the individual comma nd descriptions. while a program, erase, or write operation is in progress, it is recommended to check that the write-in progr ess (wip) bit is 0 before issuing most commands to the device, to ensure the new command can be accepted. ? depending on the command, the time for execution varies. a comm and to read status information from an executing command is available to determine when the command completes execution and whether the command was successful. ? although host software in some cases is used to directly contro l the spi interface signals, the hardware interfa ces of the hos t system and the memory device gener ally handle the details of si gnal relationships and timing. for this reason, signal relation ships and timing are not cove red in detail within this software inter face focused section of the document. inst ead, the focus is on the logical sequence of bits transferred in each command rather tha n the signal timing and relationships. following are some gener al signal relationship descriptions to keep in mind. for additiona l information on the bit level format and signal timing relatio nships of commands, see command protocol on page 13 . C the host always controls the chip select (cs#), serial clock ( sck), and serial input (si) C si for single bit wide transfers. the memory drives serial output (so) for single bit read transfers. the host and memory alternatel y drive the io 0-io3 signals during dual and quad transfers. C all commands begin with the host selecting the memory by drivi ng cs# low before the first ris ing edge of sck. cs# is kept low throughout a comma nd and when cs# is r eturned high the comm and ends. generally, cs# re mains low for eight bit transfer multiples to transfer byte granularity information. so me commands will not be accepted if cs# is returned high not at an 8-bit boundary. 9.1 command set summary 9.1.1 extended addressing to accommodate addressing above 12 8 mb, there ar e two options: 1. instructions that a lways require a 4-byte address, used to ac cess up to 32 gb of memory. command name function instruction (hex) 4read read 13 4fast_read read fast 0c 4dior dual i/o read bc 4qior quad i/o read ec 4ddrqior ddr quad i/o read ee 4pp page program 12 4p4e parameter 4-kb erase 21 4se erase 64 / 256 kb dc 4eccrd ecc status read 18 4dybrd dyb read e0 4dybwr dybwr e1 4ppbrd ppb read e2 4ppbp ppb program e3 document number: 002-00488 rev. *g page 70 of 135 S25FS512S 2. a 4-byte address mode for backw ard compatibility to the 3-byt e address instructions. the standard 3-byte instructions can be used in conunction with a 4-byte address mode controlle d by the address length config uration bit (cr2v[7]). the default value of cr2v[7] is loade d from cr2nv[7] (following pow er up, hardware reset, or software reset), to enable default 3-byte (24-bit) or 4-by te (32 bit) addressing. when the address length (cr2v[ 7]) set to 1, the legacy commands are changed to require 4 bytes ( 32-bits) for the address field. the following instructions c an be used in conunction with the 4-byte address mode configur ation to switch from 3 bytes to 4 bytes of address field. command name function instruction (hex) read read 03 fast_read read fast 0b dior dual i/o read bb qior quad i/o read eb ddrqior ddr quad i/o read) ed pp page program 02 p4e parameter 4 kb erase 20 se erase 256 kb d8 rdar read any register 65 wrar write any register 71 ees evaluate erase status d0 otpp otp program 42 otpr otp read 4b eccrd ecc status read 19 dybrd dyb read fa dybwr dybwr fb ppbrd ppb read fc ppbp ppb program fd document number: 002-00488 rev. *g page 71 of 135 S25FS512S 9.1.2 command summary by function table 44. S25FS512S command set (sorted by function) function command name command description instruction value (hex) maximum frequency (mhz) address length (bytes) qpi read device id rdid read id (jedec manufacturer id and jedec cfi) 9f 133 0 yes rsfdp read jedec serial flash discoverable parameters 5a 50 3 yes rdqid read quad id af 133 0 yes register access rdsr1 read status register 1 05 133 0 yes rdsr2 read status register 2 07 133 0 no rdcr read configuration register 1 35 133 0 no rdar read any register 65 133 3 or 4 yes wrr write register (status 1, configuration 1) 01 133 0 yes wrdi write disable 04 133 0 yes wren write enable 06 133 0 yes wrar write any register 71 133 3 or 4 yes clsr clear status register 1 e rase / program fail reset this command may be disabled and the instruction value instead used for a program / erase resume command - see configuration register 3 on page 52 30 133 0 yes clsr clear status register 1 (alternate instruction) erase / program fail reset 82 133 0 yes 4bam enter 4-byte address mode b7 133 0 no sbl set burst length c0 133 0 no ees evaluate erase status d0 133 3 or 4 yes eccrd ecc read 19 133 3 or 4 yes 4eccrd ecc read 18 133 4 yes dlprd data learning pattern read 41 133 0 no pnvdlr program nv data learning register 43 133 0 no wvdlr write volatile data learning register 4a 133 0 no read flash array read read 03 50 3 or 4 no 4read read 13 50 4 no fast_read fast read 0b 133 3 or 4 no 4fast_read fast read 0c 133 4 no dior dual i/o read bb 66 3 or 4 no 4dior dual i/o read bc 66 4 no qior quad i/o read eb 133 3 or 4 yes 4qior quad i/o read ec 133 4 yes ddrqior ddr quad i/o read ed 80 3 or 4 yes 4ddrqior ddr quad i/o read ee 80 4 yes program flash array pp page program 02 133 3 or 4 yes 4pp page program 12 133 4 yes document number: 002-00488 rev. *g page 72 of 135 S25FS512S note: 1. commands not supported in qpi mode have undefined behavior if sent when the device is in qpi mode. erase flash array p4e parameter 4 kb-sector erase 20 133 3 or 4 yes 4p4e parameter 4 kb-sector erase 21 133 4 yes se erase 256 kb d8 133 3 or 4 yes 4se erase 256 kb dc 133 4 yes be bulk erase 60 133 0 yes be bulk erase (alternate instruction) c7 133 0 yes erase /program suspend /resume eps erase / program suspend 75 133 0 yes eps erase / program suspend (alternate instruction) 85 133 0 yes eps erase / program suspend (alternate instruction b0 133 0 yes epr erase / program resume 7a 133 0 yes epr erase / program resume (a lternate instruction) 8a 133 0 yes epr erase / program resume (alternate instruction this command may be disabled and the instruction value instead used for a clear status command see configuration register 3 on page 52 30 133 0 yes one time program array otpp otp program 42 133 3 or 4 no otpr otp read 4b 133 3 or 4 no advanced sector protection dybrd dyb read fa 133 3 or 4 yes 4dybrd dyb read e0 133 4 yes dybwr dyb write fb 133 3 or 4 yes 4dybwr dyb write e1 133 4 yes ppbrd ppb read fc 133 3 or 4 no 4ppbrd ppb read e2 133 4 no ppbp ppb program fd 133 3 or 4 no 4ppbp ppb program e3 133 4 no ppbe ppb erase e4 133 0 no asprd asp read 2b 133 0 no aspp asp program 2f 133 0 no plbrd ppb lock bit read a7 133 0 no plbwr ppb lock bit write a6 133 0 no passrd password read e7 133 0 no passp password program e8 133 0 no passu password unlock e9 133 0 no reset rsten software reset enable 66 133 0 yes rst software reset 99 133 0 yes reset legacy software reset f0 133 0 no mbr mode bit reset ff 133 0 yes dpd dpd enter deep power-down mode b9 133 0 yes res release from deep power-down mode ab 133 0 yes table 44. S25FS512S command set (sorted by function) (continu ed) function command name command description instruction value (hex) maximum frequency (mhz) address length (bytes) qpi document number: 002-00488 rev. *g page 73 of 135 S25FS512S 9.1.3 read device identification there are multiple commands to read informatio n about the devic e manufacturer, device type, an d device features. spi memories from different vendors have used different commands and formats for reading information about the memories. the S25FS512S supports the three device information commands. 9.1.4 register read or write there are multiple registers for reporting embedded operation s tatus or controlling device conf iguration options. there are commands for reading or writing t hese registers. registers cont ain both volatile and non-volatile bits. non-volatile bits in r egisters are automatically erased and pro grammed as a single (write) ope ration. 9.1.4.1 monitoring operation status the host system can determine wh en a write, program, erase, sus pend or other embedded operation is complete by m onitoring the write in progress (wip) bit in t he status register. the read fr om status register 1 command o r read any register command provides the state of the wip b it. the program error (p_err) an d erase error (e_err) bits in t he status register indicate whet her the most recent program or erase command has not completed succ essfully. when p_err or e_err bits are set t o one, the wip bit will remain set to one indicating the device remains busy a nd unable to receive most new operation commands. only status r ead (rdsr1 05h), read any register ( rdar 65h), status clear (clsr 3 0h or 82h), and so ftware reset (rste n 66h, rst 99h or reset f0h) are valid commands whe n p_err or e_err is set to 1. a clear status register (clsr) followed by a write disable (wrdi) command must be sent to re turn the device to standby sta te. clear status register cl ears the wip, p_err, and e_err bits. wrdi clears the wel bit. a lternatively, hardware reset, o r software reset (rst or reset) may be used to return the devic e to standby state. 9.1.4.2 configuration there are commands to read, writ e, and protect re gisters that c ontrol interface path width, interface timing, interface addres s length, and some aspects of data protection. 9.1.5 read flash array data may be read from the memory starting at any byte boundary. data bytes are sequentially read from incrementally higher byt e addresses until the host ends th e data transfer by driving cs# input high. if the byte address re aches the maximum address of the memory array, the read will con tinue at address zero of the arr ay. there are several different re ad commands to specify different access latency and data path widths. double data rate (ddr) commands also define the addre ss and data bit relationship to b oth sck edges: ? the read command provides a si ngle address bit per sck rising e dge on the si signal wit h read data returning a single bit per sck falling edge on the so signal. this command has zero latenc y between the address and the re turning data but is limited to a maximum sck rate of 50 mhz. ? other read commands have a latency period between the address a nd returning data but can operat e at higher sck frequencies. the latency depends o n a configuration r egister read latency va lue. ? the fast read command provides a single address bit per sck ris ing edge on the si sig nal with read d ata returning a single bit per sck falling edge on the so signal. ? dual or quad i/o read commands pr ovide address two bits or four bits per sck rising edge with rea d data returning two bits, or four bits of data per sck fall ing edge on the io0-io3 signals. ? quad double data rate read comm ands provide address four bits p er every sck edge with read dat a returning four bits of data per every sck edge on t he io0-io3 signals. document number: 002-00488 rev. *g page 74 of 135 S25FS512S 9.1.6 program flash array programming data requires two commands: write enable (wren), an d page program (pp). the page program command accepts from 1 byte up to 256 or 512 cons ecutive bytes of data (page) t o be programmed in one operation. programming means that bits c an either be left at 1, or progra mmed from 1 to 0. changing bits f rom 0 to 1 requires an erase operation. 9.1.7 erase flash array the parameter sector erase, sector erase, or bulk erase command s set all the bits in a sector or the entire memory array to 1. a bit needs to be first erased to 1 bef ore programming can change it to a 0. while bits can be indivi dually programmed from a 1 to 0 , erasing bits from 0 to 1 must be done on a sector-wide or array -wide (bulk) level. the write enable (wren) command must preced e an erase command. 9.1.8 otp, block protection, a nd advanced sector protection there are commands to read and program a separate one time prog rammable (otp) array for permanent data such as a serial number. there are commands to control a contiguous group (block ) of flash memory arra y sectors that are p rotected from program and erase operations .there are commands to control which indivi dual flash memory array sectors are protected fr om program and erase operations. 9.1.9 reset there are commands to reset to the default conditions present a fter power on to the device. however, the software reset comman ds do not affect the cu rrent state of the fr eeze or ppb lock bits. in all other respects a softwar e reset is the same as a hardwa re reset. there is a command to reset (exi t from) the continuous read mod e. 9.1.10 dpd a deep power-down (dpd) mode is supported by the S25FS512S devi ces. if the device has been placed in dpd mode by the dpd (b9h) command, the interf ace standby current is (i dpd ). the dpd command is accepted only while the device is not per forming an embedded algorithm as indicated b y the status register-1 volati le write in progress (w ip) bit being cleared to zero (sr1v[0] = 0). while in dpd mode the device ignores all commands except the re lease from dpd (res abh) command, that will return the device to the interface standby s tate after a delay of t res . 9.1.11 reserved some instructions are reserved fo r future use. in this generati on of the S25FS512S some of the se command instru ctions may be unused and not affect device oper ation, some may have undefined results. some commands are re served to ensure that a legacy or alternate source device command is allo wed without effect. this allows legacy software to issu e some commands that are not relevant fo r the current generation s25fs 512s with the assurance these commands do not cause s ome unexpect ed action. some commands are rese rved for use in special versions of the f s-s not addressed by this document or for a future generation. this allows new host memory con troller designs to plan the flex ibility to issue these command in structions. the command format is defined if known at t he time this documen t revision is publishe d. document number: 002-00488 rev. *g page 75 of 135 S25FS512S 9.2 identification commands 9.2.1 read identification (rdid 9fh) the read identification (rdid) command provides read access to manufacturer identification, dev ice identificatio n, and common flash interface (cfi) information. the manufacturer identificat ion is assigned by jedec. the cfi structure is defined by jedec standard. the device identifica tion and cfi values are assigned by cypress. the jedec common flash interface (cfi) specification defines a device information structure, which allows a vendor-specified software flash management progra m (driver) to be used for entir e families of flash devices. s oftware support can then be device-independent, jedec manufacturer id independent, forward and backward-compatible for the specified flash device families . system vendors can standardize t heir flash drivers for long-ter m software compatibility by using the cfi values to configure a family driver from the cfi informa tion of the device in use. any rdid command issued while a p rogram, erase, or write cycle is in progress is ignored and has no effect on execution of the program, erase, or write cycle that is in progress. the rdid instruction is shifted on si. after the last bit of th e rdid instruction is shifted i nto the device, a byte of manufa cturer identification, two bytes of device identification, extended de vice identification, and cfi information will be shifted sequen tially out on so. as a whole this information is referred to as id-cfi. see device id and common flash in terface (id-cfi) address map on page 117 for the detail description of the id-cfi contents. continued shifting of o utput beyond the end of the defined id-c fi address space will provide undef ined data. the rdid command sequence is terminated by driving cs# to the logic high state a nytime during data output. the maximum clock frequency for the rdid command is 133 mhz. figure 45. read identificatio n (rdid) command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0-io3 and the returning data is shi fted out on io0-io3. figure 46. read identification (rdid) qpi mode command cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction data 1 data n cs# sck io0 io1 io2 io3 phase 4 0 4 0 4 0 4 0 4 0 4 0 5 1 5 1 5 1 5 1 5 1 5 1 6 2 6 2 6 2 6 2 6 2 6 2 7 3 7 3 7 3 7 3 7 3 7 3 instruction d1 d2 d3 d4 d5 document number: 002-00488 rev. *g page 76 of 135 S25FS512S 9.2.2 read quad identification (rdqid afh) the read quad identification (rdq id) command provides read acce ss to manufacturer identificatio n, device identification, and common flash interface (cfi) inf ormation. this command is an al ternate way of reading the same information provided by the rdid command while in qpi mode. in all other respects the comma nd behaves the same as the rdid command. the command is recognized only when the device is in qpi mode ( cr2v[6]=1). the instruction is s hifted in on io0-io3. after the last bit of the instruction is shifted into the device, a byte of ma nufacturer identificat ion, two bytes of device identification, extended device identification, and cfi i nformation will be shifted sequ entially out on io0-io3. as a w hole this information is referre d to as id-cfi. see device id and common flash interfa ce (id-cfi) address map on pag e117 for the detail description of the id-cfi contents. continued shifting of o utput beyond the end of the defined id-c fi address space will provide un defined data. the command sequence is terminated by driving cs# to the logic high state a nytime during data output. the maximum clock frequency for the command is 133 mhz. figure 47. read quad identification (rdqid) command sequence 9.2.3 read serial flash discover able parameters (rsfdp 5ah) the command is initiated by shifting on si the instruction code 5ah, followed by a 24-bit address of 000000h, followed by 8 dummy cycles. the sfdp bytes are then shifted out on so starting at t he falling edge of sck after the dummy cycles. the sfdp bytes a re always shifted out with the msb first. if the 24-bit address is set to any other value, the sele cted location in the sfdp spac e is the starting point of the data read. this enables random access to any parameter in the sfdp spa ce. the rsfdp command is supported up to 50 mhz. figure 48. rsfdp command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0-io3 and the returning data is shi fted out on io0-io3. figure 49. rsfdp qpi mode command sequence cs# sck io0 io1 io2 io3 phase 4 0 4 0 4 0 4 0 4 0 4 0 5 1 5 1 5 1 5 1 5 1 5 1 6 2 6 2 6 2 6 2 6 2 6 2 7 3 7 3 7 3 7 3 7 3 7 3 instruction d1 d2 d3 d4 d5 cs# sck si so phase 7 6 5 4 3 2 1 0 23 1 0 7 6 5 4 3 2 1 0 instruction address dummy cycles data 1 cs# sck io0 io1 io2 io3 phase 4 0 20 4 0 4 0 4 0 4 0 4 0 5 1 21 5 1 5 1 5 1 5 1 5 1 6 2 22 6 2 6 2 6 2 6 2 6 2 7 3 23 7 3 7 3 7 3 7 3 7 3 instruct. address dummy d1 d2 d3 d4 document number: 002-00488 rev. *g page 77 of 135 S25FS512S 9.3 register access commands 9.3.1 read status regi ster 1 (rdsr1 05h) the read status register 1 (rdsr1 ) command allows the status re gister 1 contents to b e read from so. the volatile version of status register 1 (sr1v ) contents may be rea d at any time, even while a program, era se, or write operation is in progress. it is possible to read status register 1 continuously by providing mu ltiples of eight clo ck cycles. the status i s updated for each e ight cycle read. the maximum clock fr equency for the rdsr1 (05h) com mand is 133 mhz. figure 50. read status regist er 1 (rdsr1) command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0-io3 and the returning data is shi fted out on io0-io3 , two clock cycles per byte. figure 51. read status regist er 1 (rdsr1) qpi mode command 9.3.2 read status regi ster 2 (rdsr2 07h) the read status register 2 (rdsr2 ) command allows the status re gister 2 contents to be read from so. the status register 2 contents may be read at any time , even while a p rogram, erase, or write operation is in progre ss. it is possible to read the s tatus register 2 continuously by provid ing multiples of eight clock c ycles. the status is updated for each eight cycle read. the max imum clock frequency for the rdsr2 command is 133 mhz. figure 52. read status register 2 (rdsr2) command in qpi mode, status register 2 may be read via the read any reg ister command, see read any register (rdar 65h) on page 84 . cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction status updated status cs# sck io0 io1 io2 io3 phase 4 0 4 0 4 0 4 0 4 0 4 0 5 1 5 1 5 1 5 1 5 1 5 1 6 2 6 2 6 2 6 2 6 2 6 2 7 3 7 3 7 3 7 3 7 3 7 3 instruct. d1 d2 d3 d4 d5 cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction status updated status document number: 002-00488 rev. *g page 78 of 135 S25FS512S 9.3.3 read configurati on register (rdcr 35h) the read configuration register (rdcr) command allows the volat ile configuration register (cr1 v) contents to be read from so. it is possible to read cr1v continuously by providing multiples of eight clock cycles. the config uration register contents may be read at any time, even while a program , erase, or write operation is in progress. figure 53. read configuration register (rdcr) command sequence in qpi mode, configuration regi ster 1 may be read via the read any register command, see read any register (rdar 65h) on page 84 9.3.4 write registers (wrr 01h) the write registers (wrr) command allows new values to be writt en to both the status r egister 1 and config uration register 1. before the write registers (wrr) command can be accepted by the device, a write enable (wren) command must be received. after the write enable (wren) command has been decoded successf ully, the device will set the w rite enable latch (wel) in the status register to enable any write operations. the write registers (wrr) comm and is entered by shifting the in struction and the data bytes on si . the status register is one data byte in length. the wrr operation first erases t he register then programs the n ew value as a single operation. the write registers (wrr) command will set the p_err or e_err bits if there is a failure in the wrr operation. see status register 1 volatile (sr1v) on page 45 for a description of the error b its. any status or configurati on register bit reserved for the future must be written as a 0. cs# must be driven to the logic high state after the eighth or sixteenth bit of data has been l atched. if not, the write regis ters (wrr) command is not executed. if cs# is driven high after the eighth cycle then only the status register 1 is written; otherwise, a fter the sixteenth cycle both the status and configuration registers are written. as soon as cs# is driven to the logic high state, the self-time d write registers (wrr) operation is initiat ed. while the write registers (wrr) operation is in progress, the status register m ay still be read to check the value of the write-in progress (w ip) bit. the write-in progress (wip) bit is a 1 during the self-timed wr ite registers (wrr) operation, and is a 0 when it is completed. when the write registers (wrr) operat ion is completed, the write ena ble latch (wel) is set to a 0. the maximum clock frequency for the wrr command is 133 mhz. this command is also supported in qpi mode. in qpi mode the ins truction and data is shifted in on io0-io3, two clock cycles pe r byte. figure 54. write regi sters (wrr) command sequence C 8 data bit s cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction register read repeat register read cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input status register-1 document number: 002-00488 rev. *g page 79 of 135 S25FS512S figure 55. write registers (wrr) command sequence C 16 data bi ts figure 56. write registers (wrr) command sequence C 16 data bi ts qpi mode the write registers (wrr) comma nd allows the user to change the values of the block protect ( bp2, bp1, and bp0) bits in either the non-volatile status register 1 or in the volatile status re gister 1, to define the size of the area that is to be treated as read-only. the bpnv_o bit (cr1nv[3]) contro ls whether wrr writes the non-v olatile or volatile version of status register 1. when cr1nv[3]=0 wrr writes sr1nv[4:2 ]. when cr1nv[3]= 1 wrr writes sr 1v[4:2]. the write registers (wrr) command also allows the user to set t he status register write disable (srwd) bit to a 1 or a 0. the status register write disable (sr wd) bit and write protect (wp# ) signal allow the bp bits t o be hardware protected. when the status register write disable (srwd) bit of the status register is a 0 (its initial delivery state), it is possible t o write to the status register provid ed that the write enable latch (wel) bit has previously been set by a write enable (wren) command, regardless of the whether write protect (wp#) signal is driven to the logic high o r logic low state. when the status register write disable (srwd) bit of the status register is set to a 1, two cases need to be considered, depen ding on the state of write protect (wp#): ? if write protect (wp#) signal is d riven to the log ic high state , it is possible to wri te to the status and configuration regis ters provided that the writ e enable latch (wel) bit has previously b een set to a 1 by initiating a write enable (wren) command. ? if write protect (wp#) signal is driven to the logic low state, it is not possible to write to the status and configuration re gisters even if the write enable latch (wel) b it has previousl y been set to a 1 by a write enable (wren) command. attempts to write to the status and configurat ion registers are re jected, not accepted f or execution, and no error indication is provided. as a consequ ence, all the data bytes in the memory a rea that are protected by the block protect (bp2, bp1, bp0) bits of the status register, are also hardware protected by wp#. the wp# hardware prote ction can be provided: ? by setting the status register write disable (srwd) bit after d riving write protec t (wp#) signal to the logic low state; ? or by driving write pr otect (wp#) signal to the logic low state after setting the status regis ter write disable (srwd) bit to a 1. the only way to rele ase the hardware prot ection is to pull the write protect (wp#) signal to the logic high state. if wp# is permanently tied high, hardware protection of the bp bits can n ever be activated. cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input status register-1 input configuration register-1 cs# sck io0 io1 io2 io3 phase 4 0 4 0 4 0 5 1 5 1 5 1 6 2 6 2 6 2 7 3 7 3 7 3 instruct. input status input config document number: 002-00488 rev. *g page 80 of 135 S25FS512S notes 39. the status register originally shows 00h when the device is first shipped from cypress to the customer. 40. hardware protection is disabled when quad mode is enabled (c r1v[1] = 1). wp# becomes io2; therefore, it cannot be utilized. 9.3.5 write enable (wren 06h) the write enable (wren ) command sets the wr ite enable latch (we l) bit of the status register 1 (sr1v[1]) to a 1. the write enable latch (wel) bit must be s et to a 1 by issuing the write enable (wren) command to enable write, program and erase commands. cs# must be driven into the logi c high state aft er the eighth b it of the instructi on byte has been latc hed in on si. without c s# being driven to the logic high state a fter the eighth bit of the inst ruction byte has been latched in on si, the writ e enable operat ion will not be executed. figure 57. write enable (wren) command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 58. write enable (wren) command sequence qpi mode table 45. block protection modes wp# srwd bit mode write protection of registers memory content protected area unprotected area 11 software protected status and configuration registers are writable (if wren command has set the wel bit). the values in the srwd, bp2, bp1, and bp0 bits and those in the configuration register can be changed protected against page program, sector erase, and bulk erase ready to accept page program, and sector erase commands 10 00 01 hardware protected status and configuration registers are hardware write protected. the values in the srwd, bp2, bp1, and bp0 bits and those in the configuration register cannot be changed protected against page program, sector erase, and bulk erase ready to accept page program or erase commands cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 81 of 135 S25FS512S 9.3.6 write disable (wrdi 04h): the write disable (wrdi) command clears the write enable latch (wel) bit of the status re gister 1 (sr1v[1]) to a 0. the write enable latch (wel) bit may be cleared to a 0 by issui ng the write disable ( wrdi) command to d isable page program (pp), sector erase (se), bulk erase (be), write registers (wrr or wrar), otp program (otpp), and other commands, that require wel be set to 1 for execution. the wrdi command can be used by the user to protect memo ry areas against inadvertent writes that can possibly corrupt the contents of the memory. th e wrdi command is ignored durin g an embedded operation while wip bit =1. cs# must be driven into the logi c high state aft er the eighth b it of the instructi on byte has been latc hed in on si. without c s# being driven to the logic high state a fter the eighth bit of the inst ruction byte has been latched in o n si, the write disable opera tion will not be executed. figure 59. write disable (wrdi) command sequence this command is also supported in qpi mode. in q pi mode, the in struction is shifted in on io0 -io3, two clock cycles per byte. figure 60. write disable (wrdi ) command sequence qpi mode 9.3.7 clear status regi ster (clsr 30h or 82h) the clear status register command resets bit sr1v[5] (erase fai l flag) and bit sr1v[6] (program fail flag). it is not necessar y to set the wel bit before a clear sta tus register command is execu ted. the clear status register c ommand will be accepted even when the device remains busy with wip set to 1, as the device d oes remain busy when either erro r bit is set. the wel bit will be unchanged after this command is executed. the legacy clear status register (clsr 30h) instruction may be disabled and the 30h instruction value instead used for a progr am / erase resume command, see configuration register 3 on page 52 . the clear status register alter nate instruction (clsr 82h) is always available to cle ar the status register. figure 61. clear status regis ter (clsr) command sequence cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 instruction document number: 002-00488 rev. *g page 82 of 135 S25FS512S this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 62. clear status register (clsr) command sequence qpi m ode 9.3.8 ecc status register rea d (eccrd 19h or 4eecrd 18h) to read the ecc status register, the command is followed by the ecc unit address, the four least significant bits (lsb) of add ress must be set to zero. this is followed by the number of dummy cy cles selected by the read laten cy value in cr2v[3:0]. then the 8-bit contents of the ecc register, for the ecc unit selected, are sh ifted out on so 16 times, once fo r each byte in the ecc unit. i f cs# remains low the next ecc unit sta tus is sent through so 16 time s, once for each byt e in the ecc unit. the maximum operating clock frequency for the ecc read command is 133 mhz. figure 63. ecc status register read command sequence note 41. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command 19h. 42. a = msb of address = 31 with command 18h. this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 64. eccrd (19h), qpi mod e, cr2[7] = 0, command sequence cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 instruction address dummy cycles data 1 cs# sclk io0 io1 io2 io3 phase 4 0 20 4 0 4 0 4 0 4 0 4 0 5 1 21 5 1 5 1 5 1 5 1 5 1 6 2 22 6 2 6 2 6 2 6 2 6 2 7 3 23 7 3 7 3 7 3 7 3 7 3 instruct. address dummy d1 d2 d3 d4 document number: 002-00488 rev. *g page 83 of 135 S25FS512S figure 65. eccrd (19h), qpi mod e, cr2[7] = 1, o r 4eccrd (18h) command sequence 9.3.9 program nvd lr (pnvdlr 43h) before the program nvdlr (pnvdlr ) command can be accepted by th e device, a write enable (wren) command must be issued and decoded by the device. after the write enable (wren) command has been decoded successfully, the device will set the write enable latch (wel) to enable the pnvdlr operation. the pnvdlr command is entered by shifting the instruction and t he data byte on si. cs# must be driven to the logic high state after the eighth (8t h) bit of data has been latched . if not, the pnvdlr command is not executed. as soon as cs # is driven to the lo gic high state, the self-timed pnvdlr operation is initiated. while the pnvdlr operation is in progress, the sta tus register may be read to ch eck the value of the write-in pr ogress (wip) bit. the write-in progress (wip) bit is a 1 durin g the self-timed pnvdlr cycle, a nd is a 0 when it is completed. t he pnvdlr operation can report a program error in the p_err bit of the status register. when the pnvdlr operation is completed, t he write enable latch (wel) is set to a 0 the maximum clock frequency for the pnvdlr command i s 133 mhz. figure 66. program nvdlr (pnvdlr) command sequence 9.3.10 write vdlr (wvdlr 4ah) before the write vdlr (wvdlr) command can be accepted by the de vice, a write enable (wren) command must be issued and decoded by the device. after the write enable (wren) command ha s been decoded successfully, the device will se t the write enable latch (wel) to enable wvdlr operation. the wvdlr command is entered by shifting the instruction and th e data byte on si. cs# must be driven to the logic high state after the eighth (8t h) bit of data has been latched . if not, the wvdlr command is n ot executed. as soon as cs # is driven to the lo gic high state, the wvdlr operation is initiated with no delays. the maximum clock frequency for the pnvdlr command is 133 mhz. figure 67. write vdlr (wvdlr) command sequence cs# sclk io0 io1 io2 io3 phase 4 0 28 4 0 4 0 4 0 4 0 4 0 5 1 29 5 1 5 1 5 1 5 1 5 1 6 2 30 6 2 6 2 6 2 6 2 6 2 7 3 31 7 3 7 3 7 3 7 3 7 3 instruct. address dummy d1 d2 d3 d4 cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input data cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input data document number: 002-00488 rev. *g page 84 of 135 S25FS512S 9.3.11 data learning pattern read (dlprd 41h) the instruction is s hifted on si, then the 8-bit dlp is shifted out on so. it is possible to rea d the dlp continuously by prov iding multiples of eight clock cycles. the maximum operating clock fr equency for the dlprd command is 133 mhz. figure 68. dlp read (dlprd) command sequence 9.3.12 enter 4-byte address mode (4bam b7h) the enter 4-byte addres s mode (4bam) comma nd sets the volatile address length bit (cr2v[7]) to 1 to change most 3-byte address commands to require 4 byte s of address. the read sfdp (r sfdp) command is the only 3 -byte command that is not affected by the address length bi t. rsfdp is required by the je dec jesd216 standard to always have only 3 bytes of address. a hardware or software reset is required to exit the 4-byte add ress mode. figure 69. enter 4-byte address mode (4bam b7h) command sequen ce 9.3.13 read any register (rdar 65h) the read any register (rdar) com mand provides a w ay to read all device registers - non-volatile and volatile. the instruction is followed by a 3- or 4-byte add ress (depending on the address le ngth configuration cr2v[7], fo llowed by a number of latency (dummy) cycles set by cr2v[3:0]. then the se lected register con tents are returned. if the read access is continued the same addressed register contents ar e returned until t he command is t erminated C only one register is read by each rdar command. reading undefined locations provides undefined data. the rdar command may be used during embedded operations to read status register 1 (sr1v). the rdar command is no t used for reading r egisters that act as a window into a larger array: ppbar, and dyba r. there are separate commands required to sel ect and read the location in t he array accessed. cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction register read repeat register read cs# sck si so phase 7 6 5 4 3 2 1 0 instruction document number: 002-00488 rev. *g page 85 of 135 S25FS512S the rdar command will r ead invalid data from the pass register locations if the asp password prot ection mode is selected by programming aspr[2] to 0. figure 70. read any regis ter read command sequence note 43. a = msb of address = 23 for address length cr2v[7] = 0, or 3 1 for cr2v[7]=1. table 46. register address map byte address (hex) register name description 00000000 sr1nv non-volatile status and configuration registers 00000001 n/a 00000002 cr1nv 00000003 cr2nv 00000004 cr3nv 00000005 cr4nv ... n/a 00000010 nvdlr non-volatile data learning register ... n/a 00000020 pass[7:0] non-volatile password register 00000021 pass[15:8] 00000022 pass[23:16] 00000023 pass[31:24] 00000024 pass[39:32] 00000025 pass[47:40] 00000026 pass[55:48] 00000027 pass[63:56] ... n/a 00000030 aspr[7:0] non-volatile 00000031 aspr[15:8] ... n/a 00800000 sr1v volatile status and configuration registers 00800001 sr2v 00800002 cr1v 00800003 cr2v 00800004 cr3v 00800005 cr4v ... n/a 00800010 vdlr volatile data learning register ... n/a 00800040 ppbl volatile ppb lock register ... n/a cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 instruction dummy cycles data 1 address document number: 002-00488 rev. *g page 86 of 135 S25FS512S this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 71. read any register , qpi mode, command sequence note 44. a = msb of address = 23 for address length cr2v[7] = 0, or 3 1 for cr2v[7] = 1. 9.3.14 write any register (wrar 71h) the write any register (wrar) command provi des a way to write a ny device register - non-volatile or volatile. the instruction is followed by a 3- or 4-byte address (depending on the address le ngth configuration cr2 v[7], followed by one byte of data to wri te in the address selected register. before the wrar command can be accepted by the device, a write enable (wren) command must be issued and decoded by the device, which sets the write enable latch (wel) in the status r egister to enable any write operations. the wip bit in sr1v may be checked to determine when the o peration is completed. the p_err and e_err bits in sr 1v may be checked to determine if any error occurred during the operation. some registers have a mixture o f bit types and individual rules controlling which bits may be modified. some bits are read onl y, some are otp. read only bits are never modified and the related bits in the w rar command data byte are ignored without se tting a program or erase error indication (p_err or e_err in sr1v). hence, the val ue of these bits in the wra r data byte do not matter. otp bits may only be programmed to the level opposite of their default state. writing of otp b its back to their default state is ignored and no error is set. non-volatile bits which are cha nged by the wrar data, require n on-volatile register write time (t w) to be updated. the update process involves an erase and a program operation on the non-vo latile register bits. if either t he erase or progr am portion of the update fails the related error bi t and wip in sr1v will be set to 1. volatile bits which are changed by the wrar data, require the v olatile register write time (t cs ) to be updated. status register 1 may be repeatedly read (p olled) to monitor th e write-in-progress (wip) bit (sr1v[0]) and the error bits (sr1v[6,5]) to determi ne when the register write is completed o r failed. if there is a write failure, the clear status command is used to clear the error status and enable the device to return to stand by state. however, the ppbl regi ster can not be writte n by the wrar comma nd. only the ppb lock bit write (plbwr) command can write the ppbl register. the command sequence and behavior is the same as the pp or 4pp command with only a single b yte of data provided. see page program (pp 02h or 4pp 12h) on page 96 . the address map of the register s is the same as shown for read any register (rdar 65h) on page 84 . cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 0 4 0 4 0 4 0 5 1 a-2 5 1 5 1 5 1 5 1 5 1 6 2 a-1 6 2 6 2 6 2 6 2 6 2 7 3 a 7 3 7 3 7 3 7 3 7 3 instruct. address dummy d1 d2 d3 d4 document number: 002-00488 rev. *g page 87 of 135 S25FS512S 9.3.15 set burst length (sbl c0h) the set burst length (sbl) comm and is used to configure the bur st wrap feature. burst wrap is used in conjunction with quad i/ o read and ddr quad i/o read, in legacy spi or qpi mode, to acces s a fixed length and alignment of data. certain applications ca n benefit from this feature by im proving the overall system code execution performance. the burs t wrap feature a llows applicatio ns that use cache, to start filling a cache line with instruction or data from a critical address first, then fill the remainder of the cache line afterwards within a fixed length (8/16/32/64-bytes) of data, wi thout issuing multiple read commands. the set burst length (sbl) command writes the cr4v register bit s 4, 1, and 0 to enable or dis able the wrapped read feature and set the wrap boundary. other bits of the cr4v regi ster are not affected by the sbl command. when enabled the wrapped read feature changes the related read commands from sequentially rea ding until the command ends, to reading sequentially wrapped within a group of bytes. when cr4v[4]=1, the wrap mode is not enabled and unlimited leng th sequential read is performed. when cr4v[4]=0, the wrap mode is enabled and a fi xed length and aligned group of 8, 16, 32, or 64 bytes is read starting at th e byte address provided by the read command and wrapping around a t the group alignment boundary. the group of bytes is of length an d aligned on an 8, 16, 32, or 64 byte boundary. cr4v[1:0] selects the boundary. see configuration register 4 volatile (cr4v) on page 56 . the starting address of the read command sel ects the group of b ytes and the first dat a returned is the addr essed byte. bytes a re then read sequentially until the end of the group boundary is r eached. if the read continues the address wraps to the beginnin g of the group and continues to read sequentially. this wrapped read seq uence continues unt il the command is end ed by cs# returning high. the power-on reset, hardware reset, or software reset default b urst length can be changed by programming cr4nv with the desire d value using the wrar command. figure 72. set burst length command sequence table 47. example burst wrap sequences cr4v[4,1:0] value (hex) wrap boundary (bytes) start address (hex) address sequence (hex) 1x sequential xxxxxx03 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 10, 11, 12, 13, 14, 15, 16, 17, 18, ... 00 8 xxxxxx00 00, 01, 02, 03, 04, 05, 06, 07, 00, 01, 02, ... 00 8 xxxxxx07 07, 00, 01, 02, 03, 04, 05, 06, 07, 00, 01, ... 01 16 xxxxxx02 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 00, 01, 02, 03, ... 01 16 xxxxxx0c 0c, 0d, 0e, 0f, 00, 01, 02, 03, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, ... 02 32 xxxxxx0a 0a, 0b, 0c, 0d, 0e, 0f, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1a, 1b, 1c, 1d, 1e, 1f, 00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, ... 02 32 xxxxxx1e 1e, 1f, 00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1a, 1b, 1c, 1d, 1e, 1f, 00, ... 03 64 xxxxxx03 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1a, 1b, 1c, 1d, 1e, 1f, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 2a, 2b, 2c, 2d, 2e, 2f, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 3a, 3b, 3c, 3d, 3e, 3f, 00, 01, 02 ... 03 64 xxxxxx2e 2e, 2f, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 3a, 3b, 3c, 3d, 3e, 3f, 00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1a, 1b, 1c, 1d, 1e, 1f, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 2a, 2b, 2c, 2d, 2e, 2f, ... cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input data document number: 002-00488 rev. *g page 88 of 135 S25FS512S 9.4 read memory array commands read commands for the main flash array prov ide many options for prior generation spi compatibility or enha nced performance spi : ? some commands transfer address or data on each rising edge of s ck. these are called single data rate commands (sdr). ? some sdr commands transfer address one bit per rising edge of s ck and return data 1 bit of data per rising edge of sck. these are called single width commands. ? some sdr commands transfer both address and data 2 or 4 bits pe r rising edge of sck. these are called dual i/o for 2 bit, quad i/o, and qpi for 4 bit. qpi also transfers instructions 4 bits per rising edge. ? some commands transfer address and data on both the rising edge and falling edge of sck. these are called double data rate (ddr) commands. ? there are ddr commands for 4 bits of address or data per sck ed ge. these are called quad i/o ddr and qpi ddr for 4 bit per edge transfer. all of these commands, except qpi read, begin wit h an instructi on code that is transf erred one bit per sck rising edge. qpi re ad transfers the instruction 4 bits per sck rising edge.the instru ction is followed by either a 3 - or 4-byte address transferred at sdr or ddr. commands transferring addres s or data 2 or 4 bits per cloc k edge are called multiple i/o (mio) commands. for S25FS512S devices, the traditional spi 3-b yte addresses are unable to dir ectly address all locations in the memory array. separate 4-byt e address read commands are provid ed for access to the entire add ress space. these devices may be configured to take a 4-byte address from the host system with the traditional 3-byte addres s commands. the 4-byte address mode for trad itional commands is activated by setting the addres s length bit in configuration re gister 2 to 0. the quad i/o and qpi commands pro vide a performance improvement option controlled by mode bit s that are sent following the address bits. the mode bits indi cate whether the command follow ing the end of the cur rent read will be anot her read of the sam e type, without an instruction at t he beginning of the read. thes e mode bits give the option to eliminat e the instru ction cycles when doing a series of quad read accesses. some commands require delay cycl es following t he address or mod e bits to allow time to access th e memory array - read latency. the delay or read latency cycles are traditionally called dummy cycles. the dummy cycles are i gnored by the memory thus any da ta provided by the host during these cycles i s dont c are and th e host may also leave the si sig nal at high impedance during th e dummy cycles. when mio commands ar e used the host must stop dri ving the io signals (outputs ar e high impedance) before the end of last dummy cyc le. when ddr commands are used the host mu st not drive the i/o signals during any dummy cycle. the number of dummy cycles varies wit h the sck frequency or perform ance option selected via the configuration register 2 (cr2v[3:0]) latency code. dummy cycles are measur ed from sck fa lling edge to next sck falli ng edge. spi outputs are traditionally driven to a new v alue on the fa lling edge of each sck. zero dummy cycles means the returning data is driven by t he memory on the same falling edge of sck that the host stops driv ing address or mode bits. the ddr commands may opt ionally have an 8-edge data learning pa ttern (dlp) driven b y the memory, on all data outputs, in the dummy cycles immediatel y before the s tart of data. the dlp can help the host memory controller determine the phase shift from sck to data edges so that the mem ory controller can capture dat a at the center of the data eye. when using sdr i/o commands at h igher sck frequencies (>50 mhz) , an lc that provi des 1 or more dumm y cycles should be selected to allow additional ti me for the host to stop driving before the memory starts driving data, to minimiz e i/o driver c onflict. when using ddr i/o commands with the dlp enabled, an lc that pr ovides 5 or more dummy cycles s hould be selected to allow 1 cycle of additional ti me for the host to st op driving before th e memory starts driving the 4-cycle dlp. each read command ends when cs# is returned high at any point d uring data return. cs# must no t be returned high during the mode or dummy cycles before data r eturns as this may cause mode bits to be captured in correctly; making it indeterminate as to whether the device remain s in continuous read mode. 9.4.1 read (read 03h or 4read 13h) the instruction ? 03h (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? 03h (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? 13h is followed by a 4-byte address (a31-a0) then the memory cont ents, at the address gi ven, are shifted out on so. the maximum operating clock frequency for the read command is 50 mhz. document number: 002-00488 rev. *g page 89 of 135 S25FS512S the address can start at any byte location of the memory array. the address is automatically incremented to the next higher ad dress in sequential order after each by te of data is shifted out. the entire memory can t herefore be read out with one single read instruction and address 000000h provided. when the highest addr ess is reached, the address counter will wrap around and roll b ack to 000000h, allowing the read se quence to be continued indefini tely. figure 73. read command sequen ce (3-byte address, 03h or 13h) note 45. a = msb of address = 23 for cr2v[7]=0, or 31 for cr2v[7]=1 o r command 13h. 9.4.2 fast read (fast_read 0bh or 4fast_read 0ch) the instruction ? 0bh (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? 0bh (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? 0ch is followed by a 4 -byte address (a31-a0) the address is followed by dum my cycles dependi ng on the latenc y code set in the configuration register cr2v[3:0]. the dummy cycles allow the device internal c ircuits additi onal time for a ccessing the initial address loca tion. during th e dummy cycles the data value on so is dont care and may be high impedance. then the memory contents, at the address given, are shifted out on so. the maximum operating clock fre quency for fast read command is 133 mhz. the address can start at any byte location of the memory array. the address is automatically incremented to the next higher ad dress in sequential order after each by te of data is shifted out. the entire memory can t herefore be read out with one single read instruction and address 000000h provided. when the highest addr ess is reached, the address counter will wrap around and roll b ack to 000000h, allowing the read se quence to be continued indefini tely. figure 74. fast read (fast_read) command sequence (3-byte addr ess, 0bh [cr2v[7]=0) note 46. a = msb of address = 23 for cr2v[7]=0, or 31 for cr2v[7]=1 o r command 0ch. cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction data 1 data n address cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 instruction dummy cycles data 1 address document number: 002-00488 rev. *g page 90 of 135 S25FS512S 9.4.3 dual i/o read (di or bbh or 4dior bch) the instruction ? bbh (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? bbh (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? bch is followed by a 4-byte address (a31-a0) the dual i/o read commands impro ve throughput with two i/o sign als io0 (si) and io1 (so). thi s command takes input of the address and returns read data t wo bits per sck rising edge. in some applications, the reduced ad dress input and data output ti me might allow for code execution in place (xip) i.e. directly fro m the memory device. the maximum operating clock fre quency for dual i/o read is 133 mhz. the dual i/o read command has co ntinuous read mode bits that fo llow the address so, a series of dual i/o read commands may eliminate the 8 bit in struction after the first dual i/o read c ommand sends a mode bit pattern o f axh that indicates the follo wing command will also be a dual i/o r ead command. the first dual i/ o read command in a series star ts with the 8 bit instruction, followed by address, followed by four cycl es of mode bits, foll owed by an optional lat ency period. if the mode bit pattern is axh the next command is assumed to be an additional dual i/o read comma nd that does not provide instruct ion bits. that command starts with address, followed by mode bits, followed by optional laten cy. variable latency may be added af ter the mode bits are shifted i nto si and so before da ta begins shifting out of io0 and io1. t his latency period (dummy cycles) allo ws the device internal circui try enough time to a ccess data at the initial address. during t he dummy cycles, the data value on s i and so are d ont care and may be high impedance. the number of dummy cycles is determined by the frequency of s ck. the latency is configured i n cr2v[3:0]. the continuous read f eature removes the need for the instructio n bits in a sequence of read accesses and gr eatly improves code execution (xip) performance. the upper nibble (bits 7-4) of the mode bits control the length of the next dual i/o read command through the inclusion or exclusi on of the first b yte instructio n code. the lower nibble (bits 3 -0) of the mode b its are dont care (x) and may be high impedance. if t he mode bits equal axh, then the device remains in dual i/o cont inuous read mode and the next address can be entered (after cs # is raised high and then asser ted low) without the bbh or bch instruction, as shown in figure 76 ; thus, eliminating eight cycles of the command sequence. the fol lowing sequences will release the device from dual i/o continuo us read mode; after which, the device can acce pt standard spi comm ands: 1. during the dual i/o continuou s read command sequence, if the mode bits are any value ot her than axh, then the next time cs# is raised high the dev ice will be released from dual i /o continuous read mode. 2. send the mode reset command. note that the four-mode bit cyc les are part of the devices int ernal circuitry latency time to access the init ial address afte r the last address cycle that is clocked into io0 (si) and io1 (so). it is important that t he i/o signals be set to high-impedance a t or before the falling edge of t he first data out clock. at hi gher clock speeds the time available to tur n off the host outputs before t he memory device begins to drive (bus turn around) is diminishe d. it is allowed and may be helpful in preventing i/o signal contention, for the host system to turn off the i/o signal outputs (make t hem high impedance) during the last two dont care mode cycles or duri ng any dummy cycles. following the latency period the memory content, at the address given, is shifted out two bits at a time through io0 (si) and io1 (so). two bits are shifted out at the sck frequency at the fall ing edge of sck signal. the address can start at any byte location of the memory array. the address is automatically incremented to the next higher ad dress in sequential order after each by te of data is shifted out. the entire memory can t herefore be read out with one single read instruction and address 000000h provided. when the highest addr ess is reached, the address counter will wrap around and roll b ack to 000000h, allowing the read se quence to be continued indefini tely. cs# should not be driven high dur ing mode or dummy bits as this may make the mode bits indeterminate. document number: 002-00488 rev. *g page 91 of 135 S25FS512S figure 75. dual i/o read command sequence (bbh) notes 47. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command bbh. 48. a = msb of address = 31 with command bbh. 49. least significant 4 bits of mode are dont care and it is op tional for the host to drive these bits. the host may turn off drive during these cycles to increase bus turn around time between mode bits from host and returning data from the memory. figure 76. dual i/o continuous read command sequence (bbh]) notes 50. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command bbh. 51. a = msb of address = 31 with command bbh. 9.4.4 quad i/o read (qi or ebh or 4qior ech) the instruction ? ebh (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? ebh (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? ech is followed by a 4-byte address (a31-a0) the quad i/o read command improve s throughput with four i/o sig nals: io0-io3. it allows input o f the address bits four bits pe r serial sck clock. in some applications, the reduced instruction overhead might allow for code e xecution (xip) directly from S25FS512S devices. the quad bit o f the configuration register m ust be set (cr1v[1]=1) to en able the quad capability of S25FS512S devices. the maximum operating clock fre quency for quad i/o read is 133 mhz. for the quad i/o read command, there is a latency required afte r the mode bits (described below ) before data begins shifting o ut of io0-io3. this latency period (i .e., dummy cycles) allows the de vices internal circuitry enoug h time to access data at the ini tial address. during latency cycles, th e data value on io0-io3 are dont care and may be high im pedance. the number of dummy cycles is determined by the freq uency of sck. the latency is co nfigured in cr2v[3:0]. following the latency period, t he memory contents at the addres s given, is shifted out four bit s at a time through io0-io3. ea ch nibble (4 bits) is shifted out a t the sck frequen cy by the fall ing edge of the sck signal. the address can start at any byte location of the memory array. the address is automatically incremented to the next higher ad dress in sequential order after each by te of data is shifted out. the entire memory can t herefore be read out with one single read instruction and address 000000h provided. when the highest addr ess is reached, the address counter will wrap around and roll b ack to 000000h, allowing the read se quence to be continued indefini tely. address jumps can be done without the need for additional quad i/o read instructions. this is con trolled through the setting o f the mode bits (after the address sequence, as shown in figure 77 on page 92 ). this added feature removes the need for the instruction sequence and greatly improves c ode execution (x ip). the upper n ibble (bits 7-4) of t he mode bits control t he length of the nex t quad i/o instruction through th e inclusion or exclusion of the first byte instruction code. the lower nibble (bits 3-0) of the mode bits are dont care (x). if the mode bits equal axh, then the devi ce remains in quad i/o high perf ormance read mod e and the next address can be entered (after cs# is raised high and then asser ted low) without requiring the ebh or ech instruction, as shown in figure 79 on page 92 ; thus, eliminating eight cycles for the command sequence. cs# sck io0 io1 phase 7 6 5 4 3 2 1 0 a-1 2 0 6 4 2 0 6 4 2 0 6 4 2 0 a 3 1 7 5 3 1 7 5 3 1 7 5 3 1 instruction address mode dum data 1 data 2 cs# sck io0 io1 phase 6 4 2 0 a-1 2 0 6 4 2 0 6 4 2 0 6 4 2 0 7 5 3 1 a 3 1 7 5 3 1 7 5 3 1 7 5 3 1 data n address mode dum data 1 data 2 document number: 002-00488 rev. *g page 92 of 135 S25FS512S the following sequences will releas e the device fr om quad i/o h igh performance read m ode after which, th e device can accept standard spi commands: 1. during the quad i/o read command sequence, if the mode bits a re any value other than axh, then the next time cs# is raised high the device will be re leased from quad i/o high perf ormance read mode. 2. send the mode reset command. note that the two mode bit c lock cycles and add itional wait sta tes (i.e., dummy cycles ) allow the devices internal circuitry latency time to access the init ial address after t he last address cycle that is clocked into io0-io3. it is important that the io0-io3 signals be set to high-impedan ce at or before the falling edge of the first data out clock. a t higher clock speeds the time available to turn off the host outputs be fore the memory device begins to drive (bus turn around) is dim inished. it is allowed and may be helpful in preventing io0-io3 signal c ontention, for the ho st system to turn off the io0-io3 signal o utputs (make them high impedance) during the last dont care mode cy cle or during any dummy cycles. cs# should not be driven high dur ing mode or dummy bits as this may make the mode bits indeterminate. in qpi mode (cr2v[6]=1) the quad i/o instructions are sent 4 bit s per sck rising edge. the remai nder of the command protocol is identical to the quad i/o commands. figure 77. quad i/o read command sequence (ebh or ech) notes 52. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command ebh. 53. a = msb of address = 31 with command ech. figure 78. quad i/o read command sequence (ebh or ech), qpi mo de notes 54. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command ebh. 55. a = msb of address = 31 with command ech. figure 79. continuous quad i/o read command sequence (ebh or e ch) notes 56. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command ebh. 57. a = msb of address = 31 with command ech. cs# sck io0 io1 io2 io3 phase 7 6 5 4 3 2 1 0 a-3 4 0 4 0 4 0 4 0 4 0 4 0 a-2 5 1 5 1 5 1 5 1 5 1 5 1 a-1 6 2 6 0 6 2 6 2 6 2 6 2 a 7 3 7 1 7 3 7 3 7 3 7 3 instruction address mode dummy d1 d2 d3 d4 cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 4 0 4 0 4 0 4 0 5 1 a-2 5 1 5 5 1 5 1 5 1 5 1 6 2 a-1 6 2 6 0 6 2 6 2 6 2 6 2 7 3 a 7 3 7 1 7 3 7 3 7 3 7 3 instruct. address mode dummy d1 d2 d3 d4 cs# sck io0 io1 io2 io3 phase 4 0 4 0 a-3 4 0 4 0 4 0 4 0 4 0 4 0 5 1 5 1 a-2 5 1 5 1 5 1 5 1 5 1 5 1 6 2 6 2 a-1 6 2 6 2 6 2 6 2 6 2 6 2 7 3 7 3 a 7 3 7 3 7 3 7 3 7 3 7 3 dn-1 dn address mode dummy d1 d2 d3 d4 document number: 002-00488 rev. *g page 93 of 135 S25FS512S 9.4.5 ddr quad i/o read (edh, eeh) the ddr quad i/o read command improves throughput with four i/o signals: io0-io3. it is similar to the quad i/o read command but allows input of the address four bits on ev ery edge of the clock. in some applications, t he reduced instruction overhead m ight allow for code execution (xip) di rectly from S25FS512S devices. the quad bit of the configur ation register must be set (cr1v[1]=1) to enable the quad capability. the instruction ? edh (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? edh (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? eeh is followed by a 4 -byte address (a31-a0) the address is followed by mode bits. then the memory contents, at the address given, is shifted out, in a ddr fashion, with f our bits at a time on each cl ock edge through io0-io3. the maximum operating clock fr equency for ddr quad i/o read com mand is 80 mhz. for ddr quad i/o read, there is a latency required after the la st address and mode bits are shifted into the io0-io3 signals b efore data begins shifting out of io0- io3. this latency period (dummy cycles) allows the dev ices internal circu itry enough time to access the initial address. during these laten cy cycles, the data valu e on io0-io3 are dont care and may be high impedance. when t he data learning pattern (dlp) is enabled the host system must not drive the io signals during the dummy cycles. the io signals m ust be left high impedance by the host so that the memory device ca n drive the dlp duri ng the dummy cycles. the number of dummy cyc les is determined by the frequency of sc k. the latency is conf igured in cr2v[3:0]. mode bits allow a series of quad i/o ddr commands to eliminate the 8 bit instruction after the first command sends a complementary mode bit pattern, as shown in figure 80 on page 94 . this feature removes the need for the eight bit sdr instructi on sequence and dramatically reduces initial access times (improve s xip performance). the mode bit s control the length of the nex t ddr quad i/o read operation thr ough the inclusion or exclusion of the first byte instruction c ode. if the upper nibble (io[7:4 ]) and lower nibble (io[3:0]) of the mode bits are complementary (i.e. 5h and ah) the device transitions to continuous ddr quad i/o r ead mode and the next address can be entered (after cs# is raised h igh and then asserted low) wi thout requiring the edh or eeh instruction, as shown in figure 81 on page 94 , thus eliminating eight cycles from the command sequence. the following sequences will release the device from con tinuous ddr quad i/o read mode; after which, the de vice can accept standard spi commands: 1. during the ddr quad i/o read command sequence, if the mode bi ts are not complementary the next time cs# is raised high and then asserted low the device will be released from ddr quad i/o read mode. 2. send the mode reset command. the address can start at any byte location of the memory array. the address is automatically incremented to the next higher ad dress in sequential order after each by te of data is shifted out. the entire memory can t herefore be read out with one single read instruction and address 000000h provided. when the highest addr ess is reached, the address counter will wrap around and roll b ack to 000000h, allowing the read se quence to be continued indefini tely. cs# should not be driven high dur ing mode or dummy bits as this may make the mode b its indeterminate. not e that the memory devices may drive the ios with a preamble prior to the first da ta value. the preamble is a data learning pattern (dlp) that is used by the host controller to optimize data capture at higher frequ encies. the preamble drives the io bus for the four clock cycle s immediately before data is outpu t. the host must be sure to sto p driving the io bus p rior to the time tha t the memory starts outputting the preamble. the preamble is intended to give the host controller an indicat ion about the round trip time from when the host drives a clock edge to when the corresponding data valu e returns from the memory devic e. the host controller will skew t he data captur e point during the preamble period to optimize timi ng margins and t hen use the sam e skew time to capture the data during the rest of the read operation. the optimized capture point will be determined durin g the preamble period of every r ead operation. this optimizatio n strategy is intended to compensate for both the pvt (process, v oltage, temperature) of both t he memory device and the host controller as well as any system level del ays caused by flight time on the pcb. document number: 002-00488 rev. *g page 94 of 135 S25FS512S although the data learning patte rn (dlp) is programmable, the f ollowing example shows example of the dlp of 34h . the dlp 34h (or 00110100) will be dr iven on each of the active outputs (i.e . all four sios). this pattern was chosen to cover both dc an d ac data transition scenarios. the tw o dc transition scenarios incl ude data low for a long period of time (two half clocks) follow ed by a high going transition (001) and the complementary low going tra nsition (110). the two ac transition scenarios include data low for a short period of time (one half clock) followed by a high going transition (101) and the complementary low going transition (01 0). the dc transitions will typically occu r with a starting point close r to the supply rail than the ac transiti ons that may not have fully settled to their steady state (dc) level s. in many cases the dc transit ions will bound the beginning of t he data valid period and the ac transitions will bound the ending of the data valid period. the se transitions will allow the hos t controller to identify the b eginning and ending of the valid data eye. once the data eye has been charac terized the optimal data capture point can be chosen. see spi ddr data learning registers on page 59 for more details. in qpi mode (cr2v[6]=1) the ddr quad i/o instructions are sent 4 bits per sck rising edge. th e remainder of the command protocol is identical to the ddr quad i/o commands. figure 80. ddr quad i/o read initial access (edh or eeh) notes 58. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command edh. 59. a = msb of address = 31 with command eeh. figure 81. continuous ddr quad i/o read subsequent access (edh or eeh) notes 60. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command edh. 61. a = msb of address = 31 with command eeh. figure 82. ddr quad i/o read ini tial access (edh or eeh), qpi mode notes 62. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command edh. 63. a = msb of address = 31 with command eeh. cs# sck io0 io1 io2 io3 phase 7 6 5 4 3 2 1 0 12 8 4 0 4 0 7 6 5 4 3 2 1 0 4 0 4 0 13 9 5 1 5 1 7 6 5 4 3 2 1 0 5 1 5 1 a-1 14 10 6 2 6 2 7 6 5 4 3 2 1 0 6 2 6 2 a 15 11 7 3 7 3 7 6 5 4 3 2 1 0 7 3 7 3 instruction address mode dummy dlp d1 d2 a-2 a-2 cs# sck io0 io1 io2 io3 phase a-3 12 8 4 0 4 0 4 0 4 0 4 0 4 0 4 0 a-2 13 9 5 1 5 1 5 1 5 1 5 1 5 1 5 1 a-1 14 10 6 2 6 2 6 2 6 2 6 2 6 2 6 2 a 15 11 7 3 7 3 7 3 7 3 7 3 7 3 7 3 address mode dummy d1 d2 d3 d4 d5 cs# sck io0 io1 io2 io3 phase 4 0 a-3 12 8 4 0 4 0 7 6 5 4 3 2 1 0 4 0 4 0 5 1 a-2 13 9 5 1 5 1 7 6 5 4 3 2 1 0 5 1 5 1 6 2 a-1 14 10 6 2 6 2 7 6 5 4 3 2 1 0 6 2 6 2 7 3 a 15 11 7 3 7 3 7 6 5 4 3 2 1 0 7 3 7 3 instruct. address mode dummy dlp d1 d2 document number: 002-00488 rev. *g page 95 of 135 S25FS512S 9.5 program flash array commands 9.5.1 program granularity 9.5.1.1 automatic ecc each 16 byte aligned and 16 by te length programming block has a n automatic error correction code (ecc) value. the data block plus ecc form an ecc unit. in comb ination with error detection and correction (edc) logic the ecc is used to detect and correc t any single bit error found during a read access. when data is f irst programmed within an ecc unit the ecc value is set for the entire ecc unit. if the same ecc uni t is programmed more than once the ecc value is changed to disable the edc function. a sector erase is needed to again enable au tomatic ecc on that programmi ng block. the 16 byte program b lock is the smallest program granularity on which a utomatic ecc is enabled. these are automatic operations t ransparent to the user. the tra nsparency of the automatic ecc feature enhances data accuracy for typical programming operations which write data once to eac h ecc unit but, facilitates softw are compatibility to previous generations of fl family of pro ducts by still al lowing for sing le byte programming and bit walki ng in which the same ecc unit is programmed more than once. when an ecc unit has a utomatic ecc d isabled, edc is not done on data read from the ecc unit location. an ecc status register is provi ded for determini ng if ecc is en abled on an ecc unit and whether any errors have been detected and corrected in the ecc unit data or the ecc. the ecc status r egister read (eccrd) command is used to read the ecc status on any ecc unit. error detection and correction (edc) is applied to all parts of the flash address spaces other than registers. an error correc tion code (ecc) is calculated for each group of bytes protected and the ecc is stored in a hidden area related to the group of byte s. the group of protected bytes and the related ecc are together calle d an ecc unit. ? ecc is calculated for each 16 byte aligned and length ecc unit ? single bit edc is supported with 8 ecc bits per ecc unit, plus 1 bit for an ecc disable flag ? sector erase resets a ll ecc disable flags in a sector to the de fault state (enabled) ? ecc is programmed as part of the standard program commands oper ation ? ecc is disabled automatically if multiple programming operation s are done on the same ecc unit. ? single byte programming or bit walking is allowed but disables ecc on the second program t o the same 16 byte ecc unit. ? the ecc disable flag is prog rammed when ecc is disabled ? to re-enable ecc for an ecc unit t hat has been disabled, the se ctor that includes the ecc unit must be erased ? to ensure the best dat a integrity provided by edc, each ecc uni t should be programmed only once so that ecc is stored for that unit and not disabled. ? the calculation, programming, and disabling of ecc is done auto matically as part of programming operations. the detection and correction if needed is done au tomatically as part of read oper ations. the host system sees onl y corrected data from a read operation. ? ecc protects the otp region ho wever a second program operatio n on the same ecc unit will disable ecc permanently on that ecc unit (otp is one time pr ogrammable, hence an erase ope ration to re-enable the ecc enabl e/indicator bit is prohibited) 9.5.1.2 page programming page programming is done by loadi ng a page buffer with data to be programmed and i ssuing a programming command to move data from the buffer to the memor y array. this sets an upper li mit on the amount of da ta that can be progr ammed with a single programming command. page programming allows up to a page size (either 256 or 512 bytes) to be programmed in one operation. the page size is determined by t he configuration register bit c r3v[4]. the page is aligned on th e page size address boundary. it is possible to program from one bit up to a page size in each page programming operation. it is re commended that a multiple of 16-byte length and aligned program blocks be written. this insu res that automatic ecc is not disabled . for the very best performance, programming should be done in full pages of 512 by tes aligned on 512-byte bound aries with ea ch page being programmed only once. document number: 002-00488 rev. *g page 96 of 135 S25FS512S 9.5.1.3 single byte programming single byte programming allows full backward compatibility to t he legacy standard spi page pro gramming (pp) command by allowing a single byte to be pr ogrammed anywhere in the memory array. while single byte progr amming is suppor ted, this will disable automatic ecc on the 16 byte ecc unit where the byte is located. 9.5.2 page program (pp 02h or 4pp 12h) the page program (pp) command al lows bytes to be programmed in the memory (changing bits fro m 1 to 0). bef ore the page program (pp) commands can be acce pted by the device, a write en able (wren) command must be issued and decoded by the device. after the write enable ( wren) command has been decoded successfully, the device sets the write enable latch (wel) in the status register to enable any write operations. the instruction ? 02h (cr2v[7]=0) is followed by a 3-byte address (a23-a0) or ? 02h (cr2v[7]=1) is followed by a 4-byte address (a31-a0) or ? 12h is followed by a 4-byte address (a31-a0) and at least one data byte on si. depending on cr3v[4], the pag e size can either be 256 or 51 2 bytes. up to a page can be provided on si after the 3-byte address with instruction 02h or 4-byte address with instruc tion 12h has been provided. if more data is sent to the device than the space between the s tarting address and the page al igned end boundary, the data loa ding sequence will wrap from the last byte in the pag e to the zero b yte location of the same page and begin overwriting any data previously loaded in the page. t he last page worth of data is p rogrammed in the page. this is a result of the device being equ ipped with a page program buffer that i s only page size in length. if less than a page of dat a is sent to the device, these data byt es will be programmed in sequence, starting at the provided address within the page, without having any a ffect on the other bytes of the same page. using the page program (pp) co mmand to load an entire page, wit hin the page boundary, will save overall programming time versus loading less than a pag e into the program buffer. the programming proc ess is managed by the flash memory device i nternal control logic. after a programming command is issued, the programming operatio n status can be che cked using the read status register 1 comm and. the wip bit (sr1 v[0]) will indicate when the programming operation is completed . the p_err bit (sr1 v[6]) will indicate if an erro r occurs in the programming operation that prevent s successful completi on of programming. t his includes attempted progr amming of a pr otected area. figure 83. page program (pp 02h or 4pp 12h) command sequence note 64. a = msb of address = a23 for pp 02h, or a31 for 4pp 12h. this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 84. page program (pp 02h or 4pp 12h) qpi mode command s equence note 65. a = msb of address = a23 for pp 02h, or a31 for 4pp 12h. cs# sck si so phase 7 6 5 4 3 2 1 0 a 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction address input data 1 input data 2 cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 0 4 0 4 0 4 0 5 1 a-2 5 1 5 1 5 1 5 1 5 1 6 2 a-1 6 2 6 2 6 2 6 2 6 2 7 3 a 7 3 7 3 7 3 7 3 7 3 instruct. input d1 input d2 input d3 input d4 address document number: 002-00488 rev. *g page 97 of 135 S25FS512S 9.6 erase flash array commands 9.6.1 parameter 4 kb-sector e rase (p4e 20h or 4p4e 21h) the main flash array address map may be configured to overlay 4 -kb parameter sectors over the lowest address portion of the lowest address uniform sector (bo ttom parameter sectors) or ove r the highest address portion of the highest address uniform se ctor (top parameter sectors). the main flash array address map may a lso be configured to have only uniform size sectors. the parameter sector confi guration is controll ed by the configurati on bit cr3v[3]. the p4e and 4p4e commands are ignored when the device is configured for uni form sectors only (cr3v[3]=1). the parameter 4 kb-sector erase commands set all the bits of a 4-kbyte parameter sector to 1 (all bytes are ffh). before the p 4e or 4p4e command can be accepted by the device, a write enable (wre n) command must be issued and decoded by the device, which sets the write enable latch (wel) in the status register to enable any write operations. the instruction ? 20h [cr2v[7]=0] is followed by a 3-byte address (a23-a0), or ? 20h [cr2v[7]=1] is followed by a 4-byte address (a31-a0), or ? 21h is followed by a 4-byte address (a31-a0) cs# must be driven into the logi c high state after the twenty-f ourth or thirty-second bit of the address has been latched in o n si. this will initiate the beginning of internal erase cycle, which invo lves the pre-programmi ng and erase of the chosen se ctor of the flash memory array. if cs# is not driven high a fter the last bit of a ddress, the sector erase o peration will not be executed. as soon as cs# is driven high, t he internal erase cycle will be initiated. with the internal erase cycle in progress, the user can read the value of the write -in progress (wip) b it to determine when the operation has been completed. the wip bit will indicate a 1 . when the erase cycle is in progress and a 0 when the erase cycl e has been completed. a p4e or 4p4e command applied to a sector that has been write p rotected through the block prote ction bits or asp, will not be executed and will set the e_err st atus. a p4e command applied t o a sector that is larger than 4 kbytes will not be executed and will not set the e_err status. figure 85. parameter sector er ase (p4e 20h or 4p4e 21h) comman d sequence note 66. a = msb of address = a23 for p4e 20h with cr2v[7]=0, or a31 for p4e 20h with cr2v[7]=1 or 4p4e 21h. this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 86. parameter sector era se (p4e 20h or 4p4e 21h) qpi mo de command sequence note 67. a = msb of address = a23 for p4e 20h with cr2v[7]=0, or a31 for p4e 20h with cr2v[7]=1 or 4p4e 21h. cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 instruction address cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 5 1 a-2 5 1 6 2 a-1 6 2 7 3 a 7 3 instructtion address document number: 002-00488 rev. *g page 98 of 135 S25FS512S 9.6.2 sector erase (s e d8h or 4se dch) the sector erase (se) command se ts all bits in the addressed se ctor to 1 (all bytes are ffh). before the sector erase (se) command can be accepted by the device, a write enable (wren) co mmand must be issued and decoded by the device, which sets the write enable latch (wel) i n the status register to enable a ny write operations. the instruction ? d8h [cr2v[7]=0] is followed by a 3-byte address (a23-a0), or ? d8h [cr2v[7]=1] is followed by a 4-byte address (a31-a0), or ? dch is followed by a 4 -byte address (a31-a0) cs# must be driven into the logi c high state after the twenty-f ourth or thirty-second bit of address has been latched in on si . this will initiate the era se cycle, which i nvolves the pre- programming an d erase of the chosen sector. if cs# is not driven high after t he last bit of address, the sector eras e operation will not be executed . as soon as cs# is driven into th e logic high state, the interna l erase cycle will be in itiated. with the in ternal erase cycle in progress, the user can read the value of the write-in progress (wip) bit to check if the operation has been completed. the wip bit will indicate a 1 when the erase cycl e is in progress and a 0 when the erase cycle has been completed. a sector erase (se) command applie d to a sector th at has been w rite protected through the block protection bits or asp, will n ot be executed and will se t the e_err status. a device configuration option ( cr3v[3]) determines whether 4-kb parameter sectors are in use. w hen cr3v[3] = 0, 4-kb parameter sectors overlay a po rtion of the highest or lowest address 32-k b of the device address space. if a sector erase command is app lied to a 256-kb range that is overlaid by 4-kb sectors, the overlai d 4-kb sectors are not affected by the erase. when cr3v[3] = 1, there are no 4-kb parameter sectors in the device address space and t he sector erase command always operates on fully visible 256-kb sectors. asp has a ppb and a dyb protection bit for each physical sector , including any 4-kb sectors. figure 87. sector erase (se d8h or 4se dch) command sequence note 68. a = msb of address = a23 for se d8h with cr2v[7]=0, or a31 f or se d8h with cr2v[7]=1 or 4p4e dch. this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 88. sector erase (se d8h or 4se dch) qpi mode command s equence note 69. a = msb of address = a23 for se d8h with cr2v[7]=0, or a31 f or se d8h with cr2v[7]=1 or 4p4e dch. cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 instruction address cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 5 1 a-2 5 1 6 2 a-1 6 2 7 3 a 7 3 instruction address document number: 002-00488 rev. *g page 99 of 135 S25FS512S 9.6.3 bulk erase (be 60h or c7h) the bulk erase (be) command sets all bits to 1 (all bytes are f fh) inside the entire flash memory array. before the be command can be accepted by the device, a write enable (wren) command mu st be issued and decoded by the device, which sets the write enable latch (wel) in the stat us register to enable any write o perations. cs# must be driven int o the logic high state after the eighth b it of the instruction byte has been latched in on si. this will initiate the erase cycle, which involves the pre-programming and erase of th e entire flash memory array. if cs# is not d riven high after th e last bit of instruction, the be ope ration will not b e executed. as soon as cs# is driven into th e logic high state, the erase c ycle will be initiated. with the erase cycle in progress, the u ser can read the value of the write-in progress (wip) bit to determine when the operation has been completed. the wip bit will indicat e a 1 when the erase cycle is in progress and a 0 when the erase cycl e has been completed. a be command can be executed onl y when the block protection (bp 2, bp1, bp0) bits are set to 0s. if the bp bits are not zero, t he be command is not executed and e_ err is not set. the be command will skip any secto rs protected by t he dyb or ppb and the e_err status will not be set. figure 89. bulk er ase command sequence this command is also supported in qpi mode. in q pi mode, the in struction is shifted in on io0 -io3, two clock cycles per byte. figure 90. bulk erase co mmand sequence qpi mode 9.6.4 evaluate erase status (ees d0h) the evaluate erase status (ees) command verifies that the last erase operation on the addre ssed sector was completed successfully. if the selected sec tor was successf ully erased th e erase status bit (sr2v[2]) is set to 1. if the selected secto r was not completely erased sr2v[2] is 0. the ees command c an be used to de tect erase operations failed d ue to loss of power, reset, or fa ilure during the erase operati on. the ees instruction is followed by a 3- or 4-byte address, depe nding on the address length con figuration (cr2v[7]). the ees command requires tees to complete and updat e the erase status i n sr2v. the wip bit (sr1v[0]) may be read u sing the rdsr1 (05h) command, to dete rmine when the ees command is finished. t hen the rdsr2 (07h) or the rdar (65h) command can be used to read sr2v[2]. if a sector is found not erased with sr2v [2]=0, the sector must be erased again to ensure reliable stora ge of data in the sector. the write enable command (to set the wel bit) is not required b efore the ees command. however, the wel bit is set by the devic e itself and cleared at the end o f the operation, as visible in s r1v[1] when reading status. cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 100 of 135 S25FS512S figure 91. ees command sequence note 70. a = msb of address = a23 for cr2v[7]=0, or a31 for cr2v[7]=1 . this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 92. ees qpi mode command sequence note 71. a = msb of address = a23 for cr2v[7]=0, or a31 for cr2v[7]=1 . 9.6.5 erase or program sus pend (eps 85h, 75h, b0h) there are three instruction codes for program or erase suspend (eps) to enable legacy and alternate source software compatibil ity. the eps command a llows the system to interrupt a programming or erase operation and then read from any other non-erase-suspended sector or non-program-suspended-page. progr am or erase suspend is valid only during a programming or sector erase operati on. a bulk erase oper ation cannot be suspen ded. the write in progress (wip) bit i n status register 1 (sr1v[0]) must be checked to know when the programming or erase operation has stopped. the program suspend s tatus bit in the status regis ter 2 (sr2[0]) can be used to determine if a programming operation has been suspended or was completed at the time wip c hanges to 0. the erase suspend st atus bit in the status registe r 2 (sr2[1]) can be used to determine if an erase operation has b een suspended or was completed at the time wip changes to 0. th e time required for the suspend operation to complete is t sl , see table 50 on page 113 . an erase can be suspended to allow a program operation or a rea d operation. during an erase suspend, the dyb array may be read to examine sector protection and written to remove or restore p rotection on a sector to be programmed. a program operation may be sus pended to allow a read operation. a new erase operation is not a llowed with an already suspended erase or program ope ration. an erase comm and is ignored in this situation. cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 instruction address cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 5 1 a-2 5 1 6 2 a-1 6 2 7 3 a 7 3 instruction address table 48. commands allowed du ring program or erase suspend instruction name instruction code (hex) allowed during erase suspend allowed during program suspend comment pp 02 x required for array program duri ng erase suspend. only allowed i f there is no other program suspended program operation (sr2v[0]=0). a program comm and will be ignored while there is a suspended program. if a program comman d is sent for a location within an erase suspended sector the program operation will fail with the p_err bit set. document number: 002-00488 rev. *g page 101 of 135 S25FS512S read 03 all array reads allowed in suspend. rdsr1 05 needed to read wip to determine end of suspend process . rdar 65 alternate way to read wip to determine end of suspend p rocess. wren 06 required for program command within erase suspend. rdsr2 07 needed to read suspend status to determine whether the operatio n is suspended or complete. 4pp 12 required for array program duri ng erase suspend. only allowed i f there is no other program suspended program operation (sr2v[0]=0). a program comm and will be ignored while there is a suspended program. if a program comman d is sent for a location within an erase suspended sector the program operation will fail with the p_err bit set. 4read 13 all array reads allowed in suspend. clsr 30 clear status may be used if a program operation fails during er ase suspend. note the instruction is only valid if enabled for clear status by cr 4nv[2=1]. clsr 82 clear status may be used if a program operation fails du ring erase suspend. epr 30 required to resume from erase or program suspend. note the comm and must be enabled for use as a resume command by cr3nv[2]=1. epr 7a required to resume from erase or program suspend. epr 8a required to resume from erase or program suspend. rsten 66 reset allowed anytime. rst 99 reset allowed anytime. fast_read 0b all array reads allowed in suspend. 4fast_read 0c all array reads allowed in suspend. epr 7a required to resume from erase suspend. epr 8a required to resume from erase suspend. dior bb all array reads allowed in suspend. 4dior bc all array reads allowed in suspend. dybrd fa it may be necessary to remove and restore dynamic protection du ring erase suspend to allow programming during erase suspend. dybwr fb it may be necessary to remove and restore dynamic protection du ring erase suspend to allow programming during erase suspend. ppbrd fc allowed for checking persistent protection before attempting a program command during erase suspend. 4dybrd e0 it may be necessary to remove and restore dynamic protection du ring erase suspend to allow programming during erase suspend. 4dybwr e1 it may be necessary to remove and restore dynamic protection du ring erase suspend to allow programming during erase suspend. 4ppbrd e2 allowed for checking persistent protection before attempting a program command during erase suspend. qior eb all array reads allowed in suspend. 4qior ec all array reads allowed in suspend. ddrqior ed all array reads allowed in suspend. 4ddrqior ee all array reads allowed in suspend. reset f0 reset allowed anytime. mbr ff may need to reset a read operation during suspend. table 48. commands allowed duri ng program or erase suspend (co ntinued) instruction name instruction code (hex) allowed during erase suspend allowed during program suspend comment document number: 002-00488 rev. *g page 102 of 135 S25FS512S reading at any address within an e rase-suspended sector or prog ram-suspended page produc es undetermined data. the wrr, wrar, or ppb erase comm ands are not allowed during era se or program suspend, it is ther efore not possible to alter the block protection or ppb bits d uring erase suspend. if there are sectors that may need programming dur ing erase suspend, these sectors should be protected only by d yb bits that can be turned off during erase suspend. after an erase-suspended program operation is complete, the dev ice returns to the erase-suspend mode. the system can determine the status of the pr ogram operation by reading the wi p bit in the status register, ust as in the standard program operation. figure 93. program or erase suspend command sequence figure 94. erase or program suspend command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 95. erase or program suspe nd command sequence qpi mode 9.6.6 erase or program resu me (epr 7ah, 8ah, 30h) an erase or program resume comm and must be writte n to resume a suspended operation. there are t hree instruction codes for erase or program resume (epr) to enable legacy and alternate so urce software compatibility. after program or read operations are completed during a program or erase suspend th e erase or program r esume command is sent to continue the suspended operation. after an erase or program resume command is issued, the wip bit in the status register 1 will be set to a 1 and the programmin g operation will resume if one is s uspended. if no program operat ion is suspended the suspended erase operation will resume. if there is no suspended program or erase operation the resume command i s ignored. cs# sck si so phase phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 suspend instruction read status instruction status instr. during suspend repeat status read until suspended tsl cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 103 of 135 S25FS512S program or erase operations may be interrupted as often as nece ssary, e.g. a program suspend co mmand could immediately follow a program resume command but, in order for a program or erase o peration to progress to completion there must be some periods o f time between resume and the nex t suspend command greater than o r equal to t rs . see table 50 on page 113 . figure 96. erase or program resume command sequence figure 97. erase or program resume command sequence qpi mode 9.7 one time program array commands 9.7.1 otp program (otpp 42h) the otp program command programs data in the one time program r egion, which is in a different address space from the main array data. the otp region is 1024 bytes so, the address bits f rom a31 to a10 must be zero for this command. refer to otp address space on page 42 for details on t he otp region. before the otp program command can be accepted by the device, a write enable (wren) command must be issued and decoded by the device, which se ts the write enable latch (wel) in the s tatus register to enable any writ e operations. the wip bit in s r1v may be checked to determine when the operation is completed. th e p_err bit in sr1v may be chec ked to determine if any error occurred during the operation. to program the otp array in bit granularity, the rest of the bi ts within a data by te can be set to 1. each region in the otp memory space can be programmed one or mo re times, provided that the region is not locked. attempting to program zeros in a r egion that is locked will fail with the p_e rr bit in sr1v set to 1. progra mming ones, even i n a protected area does not cause an error and does not set p_err. subsequent otp programming can be performed only on the un-programmed bits (that is, 1 data). progra mming more than once within an ec c unit will disabl e ecc on that unit. the protocol of the ot p program command is the same as the page program command. see page program (pp 02h or 4pp 12h) on page 96 for the command sequence. 9.7.2 otp read (otpr 4bh) the otp read command reads data from the otp region. the otp re gion is 1024 bytes so, the address bits from a31 to a10 must be zero for this command. refer to otp address space on page 42 for details on the otp region. the proto col of the otp read command is similar to the fast read comma nd except that it will not wrap to the star ting address after the otp address is at i ts maximum; instead, t he data beyond th e maximum otp address will be undefined. the otp read command read latency is set by the latency value in cr2v[3:0]. see fast read (fast_read 0bh or 4fast_read 0ch) on page 89 for the command sequence. cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 104 of 135 S25FS512S 9.8 advanced sector protection commands 9.8.1 asp read (asprd 2bh) the asp read instruction 2bh is s hifted into si by the rising e dge of the sck signal. then the 16-bit asp register contents ar e shifted out on the serial outpu t so, least significant byte fir st. each bit is shifted out at t he sck frequency by the falling edge of the sck signal. it is po ssible to read the asp re gister continuousl y by providing multip les of 16 clock cycles . the maximum operat ing clock frequency for the asp read (asprd) c ommand is 133 mhz. figure 98. asprd command 9.8.2 asp program (aspp 2fh) before the asp program (aspp) command can be accepted by the de vice, a write enable (wren) command must be issued. after the write enable (wren) command has been decoded, the device wi ll set the write enable latch (we l) in the status register to enable any write operations. the aspp command is entered by driving cs# to the logic low sta te, followed by the inst ruction and two data bytes on si, least significant byte firs t. the asp register is two data bytes in l ength. the aspp command affect s the p_err and wip bits of the status a nd configuration registers in t he same manner as any other programming operation. cs# input must be driven to the logic high state after the sixt eenth bit of data has been latc hed in. if not, the aspp command is not executed. as soon as cs# is driven to the logic high state, the self-timed aspp operation is ini tiated. while the aspp operati on is in progress, the status register ma y be read to check the value of the write-in progress (wip) bit. the write- in progress (wip) b it is a 1 during the self-tim ed aspp operation, and i s a 0 when it is c ompleted. when the aspp operation is completed, the write enabl e latch (wel) is set to a 0. figure 99. aspp command 9.8.3 dyb read (dybrd f ah or 4dybrd e0h) the instruction is latched into si by the rising edge of the sc k signal. the instruction is followed by the 24- or 32-bit addr ess, depending on the addres s length configurati on cr2v[7], selectin g location zero within the desir ed sector. note, the high order address bits not used by a particular density device must be ze ro. then the 8-bit dyb access register contents are shifted out on the serial output so. each bit is s hifted out at the sck frequency by the falling edge of the sck signal. it is possible to read t he same dyb access register continuously b y providing multiples of eigh t clock cycles. the address of the dyb register does not increm ent so this is not a means to read t he entire dyb array. each locat ion must be read with a separate dyb read command. the maximum operating clock frequency for read command is 133 mhz. cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction output aspr low byte output aspr high byte cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input aspr low byte input aspr high byte document number: 002-00488 rev. *g page 105 of 135 S25FS512S figure 100. dybrd command sequence notes 72. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fah. 73. a = msb of address = 31 with command e0h. this command is also supported in qpi mode. in qpi mode the ins truction and address is shifted in on io0-io3 a nd returning dat a is shifted out on io0-io3. figure 101. dybrd qpi mode command sequence notes 74. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fah. 75. a = msb of address = 31 with command e0h. 9.8.4 dyb write (dybw r fbh or 4dybwr e1h) before the dyb write (dybwr) command can be accepted by the dev ice, a write enable (wren) command must be issued. after the write enable (wren) command has been decoded, the device wi ll set the write enable latch (we l) in the status register to enable any write operations. the dybwr command is entered by d riving cs# to the logic low st ate, followed by the instruction , followed by the 24- or 32-bit address, depending on the address length configur ation cr2v[7], selecting location zero within the desired sector (note, the h igh order address bits not used by a p articular density device must be zero), then the data byte on si. the dyb access register is one data byte in length. the data va lue must be 00h t o protect or f fh to unprotect the selected sector. the dybwr command affects the p_err and wip bits of the status and configuration registers in the same manner as any other programming operation. cs# must be driven to the logic high sta te after the eighth bit of dat a has been latched in. as soon as cs# is driven to the logic high state , the self-timed dybwr operati on is initiated. while the dybw r operation is in progress, the status register may be read to check t he value of the write-in progres s (wip) bit. the write-in progress (wip ) bit is a 1 during the self-timed dybwr operation, and i s a 0 when it is completed. wh en the dybwr operation is compl eted, the write enable latch (wel) is set to a 0. figure 102. dybwr command sequence notes: 1. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fbh. 2. a = msb of address = 31 with command e1h. cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction address register repeat register cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 0 5 1 a-2 5 1 5 1 6 2 a-1 6 2 6 2 7 3 a 7 3 7 3 instruction address output dybar cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 0 5 1 a-2 5 1 5 1 6 2 a-1 6 2 6 2 7 3 a 7 3 7 3 instruction address input dybar document number: 002-00488 rev. *g page 106 of 135 S25FS512S this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 103. dybwr qpi mode command sequence notes 76. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fbh. 77. a = msb of address = 31 with command e1h. 9.8.5 ppb read (ppbrd f ch or 4ppbrd e2h) the instruction e2h is shifted into si by the rising edges of t he sck signal, followed by the 24- or 32-bit address, depending on the address length configuration cr2v[7], selecting location zero w ithin the desired sector (note, the high order address bits not used by a particular density device must be zero). then the 8-bit ppb a ccess register contents ar e shifted out on so. it is possible to read the same ppb access register continuousl y by providing multiples of eight clock cycles. the address of the ppb register does not increment so this is not a means to read the entire ppb array. eac h location must be re ad with a s eparate pp b read command. the maximum operat ing clock frequency for the ppb read command is 133 mhz. figure 104. ppbrd command sequence notes 78. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fch. 79. a = msb of address = 31 with command e2h. 9.8.6 ppb program (ppbp fdh or 4ppbp e3h) before the ppb program (ppbp) command can be accepted by the de vice, a write enable (wren) command must be issued. after the write enable (wren) command has been decoded, the device wi ll set the write enable latch (we l) in the status register to enable any write operations. the ppbp command is entered by driving cs# to the logic low sta te, followed by the instruction , followed by the 24 or 32-bit address, depending on the address length configur ation cr2v[7], selecting location zero within the desired sector (note, the h igh order address bits not used by a particular density device must be zero). the ppbp command affect s the p_err and wip bits of the status a nd configuration registers in t he same manner as any other programming operation. cs# must be driven to the logic high state after the last bit o f address has been l atched in. if not, t he ppbp command is not executed. as soon as cs# is driven to the logic high state, the self-timed ppbp operation is ini tiated. while the ppbp operati on is in progress, the status register ma y be read to check the value of the write-in progress (wip) bit. the write- in progress (wip) b it is a 1 during the self-tim ed ppbp operation, and i s a 0 when it is c ompleted. when the ppbp operation is completed, the write enabl e latch (wel) is set to a 0. cs# sck io0 io1 io2 io3 phase 4 0 a-3 4 0 4 0 5 1 a-2 5 1 5 1 6 2 a-1 6 2 6 2 7 3 a 7 3 7 3 instruction address input dybar cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction address register repeat register document number: 002-00488 rev. *g page 107 of 135 S25FS512S figure 105. ppbp command sequence notes 80. a = msb of address = 23 for address length (cr2v[7] = 0, or 31 for cr2v[7]=1 with command fdh. 81. a = msb of address = 31 with command e3h. 9.8.7 ppb erase (ppbe e4h) the ppb erase (ppbe) command sets all ppb bits to 1. before the ppb erase command can be accep ted by the device, a write enable (wren) command must be i ssued and decoded by the device, which sets the write enable latch (wel) in the status register to enable any write operations. the instruction e4h is shifted into si by the rising edges of t he sck signal. cs# must be driven int o the logic high state after the eighth b it of the instruction byte has been latched in on si. this will initiate the beginning of internal erase cycle, which involves the pre-progr amming and erase of t he entire ppb memory array. without cs# being driven to the logic high s tate after the eighth bit of th e instruction, the ppb erase operation wil l not be executed. with the internal erase cycle in progress, the user can read th e value of the write-in progress (wip) bit to check if the oper ation has been completed. the wip bit will indicate a 1 when the erase cy cle is in progress and a 0 when the erase cycle has been comple ted. erase suspend is not allowed during ppb erase. figure 106. ppb erase command sequence 9.8.8 ppb lock bit read (plbrd a7h) the ppb lock bit read (plbrd) com mand allows the ppb lock regis ter contents to be r ead out of so. it is possible to read the ppb lock register continuously by providing multiples of eight clock cycles. the ppb lock regist er contents may only be read w hen the device is in standby state with no other operation in progr ess. it is recommended to check th e write-in progress (wip) bit of the status register before issui ng a new command to the device. figure 107. ppb lock regi ster read command sequence cs# sck si so phase 7 6 5 4 3 2 1 0 a 1 0 instruction address cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction register read repeat register read document number: 002-00488 rev. *g page 108 of 135 S25FS512S 9.8.9 ppb lock bit write (plbwr a6h) the ppb lock bit write (plbwr) command cle ars the ppb lock regi ster to zero. before the plbw r command can be accepted by the device, a write enable (wren) command must be issued and decoded by the device, which sets the write enable latch (wel) in the status register to enable any write operations. the plbwr command is entered by d riving cs# to the logic low st ate, followed by the instruction. cs# must be driven to the logic high state after the eighth bit of instruction has been latched in. if not, the plbwr command is not executed. as soon as cs# is driven to the logic high state, the self-timed plbwr operation is i nitiated. while the plbwr opera tion is in progress, the status register may still be read to check the value of the write-in progres s (wip) bit. the write-in prog ress (wip) bit is a 1 during the self-timed plbwr ope ration, and is a 0 wh en it is completed. wh en the plbwr operation is completed, the write enable latch (wel) is set to a 0. the maximum clock frequ ency for the plbwr command is 133 mhz. figure 108. ppb lock bit write command sequence 9.8.10 password read (passrd e7h) the correct password value may be read only after it is program med and before the password mode has been selected by programming the password protecti on mode bit to 0 in the asp re gister (asp[2]). after the passwor d protection mode is selected the password is no lo nger readable, the passrd command will out put undefined data. the passrd command is shifted into si. then the 64 -bit password is shifted out on the serial out put so, least significant byte first, most significant bit of each byt e first. each bit is shifted ou t at the sck frequency by the falling edge of the sck signal. i t is possible to read the password continuously by providing mu ltiples of 64 clock cycles. the maximum oper ating clock fr equency for the passrd command is 133 mhz. figure 109. password read command sequence 9.8.11 password program (passp e8h) before the password pr ogram (passp) command c an be accepted by the device, a write enable (wren) command must be issued and decoded by t he device. after the write enable (wren) command has been decoded, the d evice sets the write enable latch (wel) to enabl e the passp operation. the password can only be programmed before the password mode is selected by programming the password protection mode bit to 0 in the asp register (asp[2]). after the password protectio n mode is select ed the passp command is ignored. the passp command is ente red by driving cs# t o the logic low st ate, followed by the instruction and the password data bytes on si, least significant byte first, most significant bit of each byte first. the password is 64 bits in length. cs# must be driven to the lo gic high state after the 64 th bit of data has been latched. if not, the passp command is not executed. as soon as cs# is driven to the logic high state, the self-time d passp operation is initiated . while the passp operation is in progress, the status register ma y be read to check the value of the write-in progress (wip) bit. the write- in progress (wip) b it is a 1 during the self-timed passp cycl e, and is a 0 when it is comp leted. the passp command can report a prog ram error in the p_err bit of the status regi ster. when the passp operation is c ompleted, the write enable latch (wel) is set to a 0. the maximum clock frequency for the passp command is 133 mhz. cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction data 1 data n document number: 002-00488 rev. *g page 109 of 135 S25FS512S figure 110. password program command sequence 9.8.12 password unlock (passu e9h) the passu command is ent ered by driving cs# to the logic low st ate, followed by the in struction and the password data bytes on si, least significant byte first, most significant bit of each byte first. the password is 64 bits in length. cs# must be driven to the lo gic high state after the 64 th bit of data has been latched. i f not, the passu command is not executed. as soon as cs# is driven to the logic high state, the self-time d passu operation is initiated. while the passu operation is in progress, the status register ma y be read to check the value of the write-in progress (wip) bit. the write- in progress (wip) b it is a 1 during the self-timed passu cycle, and is a 0 when it is comp leted. if the passu command supplied passw ord does not ma tch the hidde n password in the password regi ster, an error is reported by setting the p_err bit to 1. the wip bit of the status register also remains set to 1. it is nec essary to use the clsr command to clear the status register, the reset command to software reset the device, or drive the reset# i nput low to initiate a hardwar e reset, in order to return the p_er r and wip bits t o 0. this ret urns the device to sta ndby state, ready for new commands such a s a retry of the passu command. if the password does match, the ppb lock bit is set to 1. the m aximum clock frequency for t he passu command is 133 mhz. figure 111. password unlock command sequence 9.9 reset commands software controlled reset command s restore the device to its in itial power up state, by reloadi ng volatile registers from non- volatile default values. however, the volatile freeze bit in the configu ration register cr1v[ 0] and the volatile ppb lock bit in the pp b lock register are not changed by a software reset. the software reset cannot be used to circumv ent the freeze or ppb lock bit protection mechanisms for the other security configuration bits . the freeze bit and the ppb lock bit will remain set at their la st value prior to the software reset. to clear the freeze bit a nd set the ppb lock bit to its prot ection mode sel ected power o n state, a full power-on-reset sequence or hardware reset must be done. the non-volatile bits in the con figuration regist er (cr1nv), tb prot_o, tbparm, and bpnv_o, retai n their previous state after a software reset. the block protection bits bp2, bp1, and bp0 , in the status regi ster (sr1v) will only be reset to their default v alue if freeze = 0. a reset command (rst or reset) is executed when cs# is brought high at the end of the in struction and requires t rph time to execute. in the case of a previous power-u p reset (por) failure to compl ete, a reset command triggers a full power-up sequence requirin g t pu to complete. cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input password low byte input password high byte cs# sck si so phase 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 instruction input password low byte input password high document number: 002-00488 rev. *g page 110 of 135 S25FS512S figure 112. software reset command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 113. software reset command sequence qpi mode 9.9.1 software reset e nable (rsten 66h) the reset enable (rsten) command is required imm ediately before a reset command (rst) such that a software reset is a sequence of the two commands. any command other than rst follow ing the rsten command, will clear the reset enable condition and prevent a later rst co mmand from being recognized. 9.9.2 software reset (rst 99h) the reset (rst) comm and immediately following a rsten command, initiates the softwa re reset process. 9.9.3 legacy softwar e reset (reset f0h) the legacy softwa re reset (reset) is a sin gle command that init iates the software reset process. this command is disabled by default but can be enabled by pr ogramming cr3v[0] =1, for softwa re compatibility with cypress legacy fl-s devices. 9.9.4 mode bit r eset (mbr ffh) the mode bit reset (mbr) command is used to return the device f rom continuous high performa nce read mode back to normal standby awaiting any new command. because so me device packages lack a hardware reset # input and a devic e that is in a continuous high performance re ad mode may not r ecognize any nor mal spi command, a system hardw are reset or software reset command may not be recognized by the device. it is recommended to use the mbr command aft er a system reset when the reset# signal is not available or , before sending a software re set, to ensure the device is r eleased from continuous high performance read mode. the mbr command send s ones on si or io0 for 8 sck cycles. io1 t o io3 are don t care during these cycles. figure 114. mode bit reset command sequence cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 instruction document number: 002-00488 rev. *g page 111 of 135 S25FS512S this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 115. mode bit reset command sequence qpi mode 9.10 dpd commands 9.10.1 enter deep pow er-down (dpd b9h) although the standby current duri ng normal operat ion is relativ ely low, standby current can be f urther reduced with the deep power-down command. the lower power consumption makes the deep power-down (dpd) command esp ecially useful for battery powered applications (see i dpd in dc characteristics on page 24 ). the dpd command is accepted only while the device is not perfor ming an embedded algorithm as ind icated by the status register 1 volatile write in progress (w ip) bit being cleared to zero (s r1v[0] = 0). the command is initiated by driving the cs# pin low and shiftin g the instruction code b9h as shown in figure 116 on page 111 . the cs# pin must be driven high aft er the eighth bit has been latch ed. if this is not done the deep power-down command will not be executed. after cs# is driven hi gh, the power-dow n state will b e entered within the time duration of t dpd (refer to timing specifications on page 26 ). while in the power-down state only the release from deep power- down command, which restores the device to normal operation, will be recognized. a ll other commands are ignored. this includ es the read status register co mmand, which is always available during normal operation. ignorin g all but one command also make s the power down state useful for write pr otection. the device always powers-up in the interfac e standby state with the standb y current of i cc1 . figure 116. deep power-down command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 117. dpd command sequence qpi mode cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 112 of 135 S25FS512S 9.10.2 release from deep p ower-down (res abh) the release from deep power-down command is used to release the device from the deep power-down state. in some legacy spi devices the res command could also be used to obtain the device electronic identifica tion (id) number. however, the device id function is not suppor ted by the res command. to release the device from the deep power-down st ate, the comma nd is issued by driving the cs# p in low, shifting the instructi on code abh and driving cs# high as shown in figure 118 on page 112 . release from deep power-down will take the time duration of t res ( timing specifications on page 26 ) before the device will resume n ormal operation and other comm ands are accepted. the cs# pin must remain high during the t res time duration. hardware reset will also release the device from the dpd state as part of the hardware reset process. figure 118. release from deep power-down command sequence this command is also supported in qpi mode. in qpi mode the ins truction is shifted in on io0- io3, two clock c ycles per byte. figure 119. res comma nd sequence qpi mode cs# sck si so phase 7 6 5 4 3 2 1 0 instruction cs# sck io0 io1 io2 io3 phase 4 0 5 1 6 2 7 3 instruction document number: 002-00488 rev. *g page 113 of 135 S25FS512S 10. embedded algorithm performance tables notes 82. not 100% tested. 83. typical program and erase times assume the following conditi ons: 25c, v cc = 1.8v; random data pattern. 84. the programming time for any otp programming command is the same as t pp . this includes otpp 42h, pnvdlr 43h, aspp 2fh, and passp e8h. 85. the programming time for the ppbp e3h command is the same as t pp . the erase time for ppbe e 4h command is the same as t se . 86. data retention of 20 years is based on 1k erase cycles or le ss. table 49. program and erase performance symbol parameter min typ [83] max unit t w non-volatile register write time 240 750 ms t pp page programming (512 bytes) page programming (256 bytes) 475 360 2000 2000 s t se sector erase time (256 kb physical sectors) 930 2900 ms sector erase time (4 kb sectors) 240 725 t be [82] bulk erase time (S25FS512S) 220 720 sec tees evaluate erase status time (64-kb or 4-kb physical sectors) 20 25 s evaluate erase status time (256- kb physical or logical sectors) 80 100 table 50. program or er ase suspend ac parameters parameter typical max unit comments suspend latency (t sl ) 50 s the time from suspend command until the wip bit is 0. resume to next program suspend (t rs ) 100 s minimum is the time needed to issue the next suspend command bu t typical periods are needed for program or erase to progress to completi on. document number: 002-00488 rev. *g page 114 of 135 S25FS512S 11. data integrity 11.1 erase endurance note 87. each write command to a non-volatile register causes a p/ e cycle on the entire non-volatile register array. otp bits and r egisters internally reside in a separate array that is not p/e cycled. 11.2 data retention contact cypress sales or an f ae representative for additional i nformation on data int egrity. an applicatio n note is available at: www.cypress.com/appnotes . 11.3 serial flash discoverable parameters (sfdp) address map the sfdp address spac e has a header starti ng at address zero th at identifies the sfdp data stru cture and provides a pointer to each parameter. one parameter is mandated by the jedec jesd216 standard. cypress provides an additional parameter by pointing to the id-cfi address space, i.e. the id-cfi address s pace is a sub-set of the sfdp address space. the jedec paramete r is located within the id-cfi add ress space and is thus both a c fi parameter and an sfdp parameter. in this way both sfdp and id-cfi information can be accessed by either the rsfdp or rdid commands. table 51. erase endurance parameter minimum unit program/erase cycles per main flash array sectors 100k p/e cycle program/erase cycles per ppb arr ay or non-volatile register arr ay [87] 100k p/e cycle table 52. data retention parameter test conditions minimum time unit data retention time 10k program/erase cycles 20 years 100k program/erase cycles 2 years table 53. sfdp overview map byte address description 0000h location zero within jedec jesd216b sfdp space C start of sfdp header ,,, remainder of sfdp header followed by undefined space 1000h location zero within id-cfi space C start of id-cfi parame ter tables ... id-cfi parameters 1090h start of sfdp parameter tables which are also grouped as one of the cfi parameter tables (the cf i parameter itself starts at 108eh, the sfdp parameter table data is double word aligned sta rting at 1090h) ... remainder of sfdp parameter tables followed by either more c fi parameters or undefined space document number: 002-00488 rev. *g page 115 of 135 S25FS512S 11.3.1 field definitions table 54. sfdp header sfdp byte address sfdp dword name data description 00h sfdp header 1st dword 53h this is the entry point for read sfdp (5ah) command i.e. locati on zero within sfdp space ascii s 01h 46h ascii f 02h 44h ascii d 03h 50h ascii p 04h sfdp header 2nd dword 06h sfdp minor revision (06h = jedec jesd216 revision b) this revision is backward compat ible with all prior minor revis ions. minor revisi ons are changes that define previously reserved fi elds, add fields to the end, or th at clarify definitions of existing fields. increments of the minor revisio n value indicate that previously reserved parameter fields may have been assigned a new definition or entire dwords may have been added to the parameter table. however, the definition of previously exist ing fields is unchanged and there fore remain backward compatible with earlier sfdp parameter table revi sions. software can safely ign ore increments of the minor revision number, as long as only those parameters the software was desig ned to support are used i.e. previously reserved fields and additional dwo rds must be masked or ignored . do not do a simple compare on the minor revision number, looking onl y for a match with the revisi on number that the software is designed to handle. there is no problem with using a higher number minor re vision. 05h 01h sfdp major revision this is the original major revis ion. this major revision is com patible with all sfdp reading and parsing software. 06h 05h number of parameter headers (zero based, 05h = 6 paramete rs) 07h ffh unused 08h parameter header 0 1st dword 00h parameter id lsb (00h = jedec sfdp basic spi flash parameter ) 09h 00h parameter minor revision (00h = jesd216) - this older revision paramet er header is provided for any lega cy sfdp reading and parsing software that requires seeing a minor revision 0 parameter header. sfdp software designed to handle later minor revisions should continue reading parameter headers looking for a higher numbered minor revision that contains additional parameters for that software revision. 0ah 01h parameter major revision (01h = t he original major revision - a ll sfdp software is compatible with this major revision. 0bh 09h parameter table length (in double words = dwords = 4 byte units) 09h = 9 dwords 0ch parameter header 0 2nd dword 90h parameter table pointer byte 0 (dword = 4-byte aligned) jedec basic spi flash parameter byte offset = 1090h 0dh 10h parameter table pointer byte 1 0eh 00h parameter table pointer byte 2 0fh ffh parameter id msb (ffh = jedec defined legacy parameter id ) 10h parameter header 1 1st dword 00h parameter id lsb (00h = jedec sfdp basic spi flash parameter ) 11h 05h parameter minor revision (05h = jesd216 revision a) - this older revision paramet er header is provided for any lega cy sfdp reading and parsing software that requires seeing a minor revision 5 parameter header. sfdp software designed to handle later minor revisions should continue reading parameter headers looking for a later minor revis ion that contains additional parameters. 12h 01h parameter major revision (01h = t he original major revision - a ll sfdp software is compatible with this major revision. 13h 10h parameter table length (in double words = dwords = 4 byte units) 10h = 16 dwords 14h parameter header 1 2nd dword 90h parameter table pointer byte 0 (dword = 4 byte aligned) jedec basic spi flash paramet er byte offset = 1090h address 15h 10h parameter table pointer byte 1 16h 00h parameter table pointer byte 2 17h ffh parameter id msb (ffh = jedec defined parameter) document number: 002-00488 rev. *g page 116 of 135 S25FS512S 18h parameter header 2 1st dword 00h parameter id lsb (00h = jedec sfdp basic spi flash parameter ) 19h 06h parameter minor revisio n (06h = jesd216 revision b) 1ah 01h parameter maor revision (01h = t he original maor revision - a ll sfdp software is compatible with this maor revision. 1bh 10h parameter table length (in double words = dwords = 4 byte units) 10h = 16 dwords 1ch parameter header 2 2nd dword 90h parameter table pointer byte 0 (dword = 4 byte aligned) jedec basic spi flash paramet er byte offset = 1090h address 1dh 10h parameter table pointer byte 1 1eh 00h parameter table pointer byte 2 1fh ffh parameter id msb (ffh = jedec defined parameter) 20h parameter header 3 1st dword 81h parameter id lsb (81h = sfdp sector map parameter) 21h 00h parameter minor revision ( 00h = initial version as define d in jesd216 revision b) 22h 01h parameter maor revision (01h = t he original maor revision - a ll sfdp software t hat recognizes this parameters id is compatible with this maor revision. 23h 10h (512 mb) parameter table length (in double words = dwords = 4 byte units ) opn dependent 16 = 10h (512 mb) 24h parameter header 3 2nd dword d8h parameter table pointer byte 0 (dword = 4 byte aligned) jedec parameter byte offset = 10d8h 25h 10h parameter table pointer byte 1 26h 00h parameter table pointer byte 2 27h ffh parameter id msb (ffh = jedec defined parameter) 28h parameter header 4 1st dword 84h parameter id lsb (00h = sfdp 4 byte address instructions par ameter) 29h 00h parameter minor revision ( 00h = initial version as define d in jesd216 revision b) 2ah 01h parameter maor revision (01h = t he original maor revision - a ll sfdp software t hat recognizes this parameters id is compatible with this maor revision. 2bh 02h parameter table length (in double words = dwords = 4 byte units) (2h = 2 dwords) 2ch parameter header 4 2nd dword d0h parameter table pointer byte 0 (dword = 4 byte aligned) jedec parameter byte offset = 10d0h 2dh 10h parameter table pointer byte 1 2eh 00h parameter table pointer byte 2 2fh ffh parameter id msb (ffh = jedec defined parameter) 30h parameter header 5 1st dword 01h parameter id lsb (cypress vendor specific id-cfi parameter) legacy manufacturer id 01h = amd / cypress 31h 01h parameter minor revision (01h = id-cfi updated with sfdp rev b table) 32h 01h parameter maor revision (01h = t he original maor revision - a ll sfdp software t hat recognizes this parameters id is compatible with this maor revision. 33h 47h (512 mb) parameter table length (in double words = dwords = 4 byte units ) parameter table length (in double words = dwords = 4 byte units) 34h parameter header 5 2nd dword 00h parameter table pointer byte 0 (dword = 4 byte aligned) entry point for id-cfi parameter is byte offset = 1000h relativ e to sfdp location zero. 35h 10h parameter table pointer byte 1 36h 00h parameter table pointer byte 2 37h 01h parameter id msb (01h = jedec jep106 bank number 1) table 54. sfdp header (continued) sfdp byte address sfdp dword name data description document number: 002-00488 rev. *g page 117 of 135 S25FS512S 11.4 device id and common flash interface (id-cfi) address map 11.4.1 field definitions table 55. manufacturer and device id byte address data description 00h 01h manufacturer id for cypress 01h 02h (512 mb) device id most si gnificant byte memory interfa ce type 02h 20h (512 mb) device id least significant byte density 03h 4dh id-cfi length - number bytes following. adding this value to th e current location of 03h gives the address of the last v alid location in the id-cfi lega cy address map. the legacy cfi address map ends with the primary vendor-specific extended query. the original legacy length is maintained for backward software compatibility . however, the cfi query identification string also incl udes a pointer to the alternate vendor-specific extended query that contains additional information related to the fs-s family. 04h 00h (uniform 256-kb physical sectors) physical sector architecture the S25FS512S may be configured with or without 4-kb parameter sectors in addition to the uniform sectors. 05h 81h (S25FS512S) family id 06h xxh ascii characters for model. refer to ordering part number on page 131 for the model number definitions. 07h xxh 08h xxh reserved 09h xxh reserved 0ah xxh reserved 0bh xxh reserved 0ch xxh reserved 0dh xxh reserved 0eh xxh reserved 0fh xxh reserved table 56. cfi query identification string byte address data description 10h 11h 12h 51h 52h 59h query unique ascii string qry 13h 14h 02h 00h primary oem command set fl-p backward compatible command set id 15h 16h 40h 00h address for primary extended table 17h 18h 53h 46h alternate oem command set ascii characters fs for spi (f) interface, s technology 19h 1ah 51h 00h address for alternate oem extended table document number: 002-00488 rev. *g page 118 of 135 S25FS512S table 57. cfi system interface string byte address data description 1bh 17h v cc min. (erase / program): 100 millivolts bcd) 1ch 19h v cc max. (erase / program) : 100 millivolts bcd) 1dh 00h v pp min. voltage (00h = no v pp present) 1eh 00h v pp max. voltage (00h = no v pp present) 1fh 09h typical timeout per single byte program 2 n s 20h 09h typical timeout for min. size page program 2 n s (00h = not supported) 21h 0ah (256 kb) typical timeou t per individual sector erase 2 n ms 22h 11h (512 mb) typical timeout for full chip erase 2 n ms (00h = not supported) 23h 02h max. timeout for byte program 2 n times typical 24h 02h max. timeout for page program 2 n times typical 25h 03h max. timeout per individual sector erase 2 n times typical 26h 03h max. timeout for full chip erase 2 n times typical (00h = not supported) table 58. device geometry defini tion for bottom boot initial d elivery state byte address data description 27h 1ah (512 mb) device size = 2 n bytes 28h 02h flash device inte rface description: 0000h = x8 only 0001h = x16 only 0002h = x8/x16 capable 0003h = x32 only 0004h = single i/o spi, 3-byte address 0005h = multi i/o spi, 3-byte address 0102h = multi i/o spi, 3- or 4-byte address 29h 01h 2ah 08h max. number of bytes in multi-byte write = 2 n 0000h = not supported 0008h = 256b page 0009h = 512b page 2bh 00h 2ch 03h number of erase block regions within device 1 = uniform device, >1 = boot device 2dh 07h erase block region 1 information (refer to jedec jep137) 8 sectors = 8-1 = 0007h 4-kb sectors = 256 bytes x 0010h 2eh 00h 2fh 10h 30h 00h 31h 00h erase block region 2 information (refer to jedec jep137) 512 mb: 1 sectors = 1-1 = 0000h 224-kb sector = 256 bytes x 0380h 32h 00h 33h 80h 34h 00h (128 mb) 00h (256 mb) 03h (512 mb) document number: 002-00488 rev. *g page 119 of 135 S25FS512S note 88. fs512s devices are user configurable to have either a hybrid sector architecture (with eight 4-kb sectors / one 224-kb sect or and all remaining sectors are uniform 256 kb) or a uniform sector architecture with all sectors unifo rm 256 kb. fs-s devices are also user configurable to have the 4-kb parameter sectors at the top of memory address space. the cfi geometry information of the above table is relevant only to the initial delivery state. all devi ces are initially shipped from cypress with the hybrid sector architecture with the 4-kb sectors located at the bottom of the array address map. however, the device confi guration tbparm bit cr1nv[2] may be programed to invert the sector map to place the 4-kb sectors at the top of the array address map. the 20h_nv bit (cr3nv[3} may be programmed to remove the 4-kb sectors from the address map. the flash device driver software must examine the tbparm and 20h_nv bits to determine if the sec tor map was inverted or hybrid sectors removed at a later time. 35h feh erase block region 3 information 512 mb: 255 sectors = 255-1 = 00feh 256-kb sectors = 0400h x 256 bytes 36h 00h (128 mb) 01h (256 mb) 00h (512 mb) 01h (1 gb 37h 00h 38h 01h (128 mb) 01h (256 mb) 04h (512 mb) 04h (1 gb) 39h thru 3fh ffh rfu table 58. device geometry defini tion for bottom boot initial d elivery state (continued) byte address data description table 59. cfi primary vendo r-specific extended query byte address data description 40h 50h query-unique ascii string pri 41h 52h 42h 49h 43h 31h major version number = 1, ascii 44h 33h minor version number = 3, ascii 45h 21h address sensitive unlock (bits 1-0) 00b = required, 01b = not required process technology (bits 5-2) 0000b = 0.23 m floating gate 0001b = 0.17 m floating gate 0010b = 0.23 m mirrorbit 0011b = 0.11 m floating gate 0100b = 0.11 m mirrorbit 0101b = 0.09 m mirrorbit 1000b = 0.065 m mirrorbit 46h 02h erase suspend 0 = not supported, 1 = read only, 2 = read and program 47h 01h sector protect 00 = not supported, x = number of sectors in group 48h 00h temporary sector unprotect 00 = not supported, 01 = supported 49h 08h sector protect/unprotect scheme 04 = high voltage method 05 = software command locking method 08 = advanced sector protection method 4ah 00h simultaneous operation 00 = not supported, x = number of sectors 4bh 01h burst mode (synchronous sequential read) support 00 = not supported, 01 = supported document number: 002-00488 rev. *g page 120 of 135 S25FS512S the alternate vendor-specific e xtended query provides informati on related to the expanded comm and set provided by the fs-s family. the alternate query para meters use a fo rmat in which ea ch parameter begins with an identifier byte and a parameter len gth byte. driver software can check each parameter id and can use t he length value to skip to the next parameter if the parameter is not needed or not recogni zed by the software. 4ch 03h page mode type, initial delivery configuration, user configurab le for 512b page 00 = not supported, 01 = 4 word read page, 02 = 8 read word pag e, 03 = 256 byte program page, 04 = 512 byte program page 4dh 00h acc (acceleration) supply minimum 00 = not supported, 100 mv 4eh 00h acc (acceleration) supply maximum 00 = not supported, 100 mv 4fh 07h wp# protection 01 = whole chip 04 = uniform device with bottom wp protect 05 = uniform device with top wp protect 07 = uniform device with top or bottom write protect (user conf igurable) 50h 01h program suspend 00 = not supported, 01 = supported table 60. cfi alternate vendor- specific extended query header byte address data description 51h 41h query-unique ascii string alt 52h 4ch 53h 54h 54h 32h major version number = 2, ascii 55h 30h minor version number = 0, ascii table 61. cfi alternate vendor- specific extended query paramet er 0 parameter relative byte address offset data description 00h 00h parameter id (ordering part number) 01h 10h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h 53h ascii s for manufacturer (cypress) 03h 32h ascii 25 for product characters (single die spi) 04h 35h 05h 46h ascii fs for interface characters (spi 1.8volt) 06h 53h 07h 35h (512 mb) ascii characters for density 08h 31h (512 mb) 09h 32h (512 mb) 0ah 53h ascii s for technology (65nm mirrorbit) 0bh ffh reserved for future use 0ch ffh 0dh ffh reserved for future use 0eh ffh 0fh ffh reserved for future use table 59. cfi primary vendor-sp ecific extended query (continue d) byte address data description document number: 002-00488 rev. *g page 121 of 135 S25FS512S 10h xxh ascii characters for model. refer to ordering part number on page 131 for the model number definitions. 11h xxh table 62. cfi alternate vendor- specific extended query paramet er 80h address options parameter relative byte address offset data description 00h 80h parameter id (ordering part number) 01h 01h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h ebh bits 7:5 C reserved = 111b bit 4 C address length bit in cr2v[7] C yes= 0b bit 3 C autoboot support C no = 1b bit 2 C 4 byte address instructions supported C yes= 0b bit 1 C bank address + 3 byte a ddress instructions supported Cn o = 1b bit 0 - 3 byte address instructions supported C no = 1b table 63. cfi alternate vendor- specific extended query paramet er 84h suspend commands parameter relative byte address offset data description 00h 84h parameter id (suspend commands 01h 08h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h 75h program suspend instruction code 03h 32h program suspend latency maximum (s) 04h 7ah program resume instruction code 05h 64h program resume to next suspend typical (s) 06h 75h erase suspend instruction code 07h 32h erase suspend latency maximum (s) 08h 7ah erase resume instruction code 09h 64h erase resume to next suspend typical (s) table 64. cfi alternate vendor- specific extended query paramet er 88h data protection parameter relative byte address offset data description 00h 88h parameter id (data protection) 01h 04h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h 0ah otp size 2 n bytes, ffh = not supported 03h 01h otp address map format, 01h = fl-s and fs-s format, ffh = not supported 04h xxh block protect type, model dependent 00h = fl-p, fl-s, fs-s ffh = not supported 05h xxh advanced sector protection type, model dependent 01h = fl-s and fs-s asp table 61. cfi alternate vendor- specific extended query paramet er 0 (continued) parameter relative byte address offset data description document number: 002-00488 rev. *g page 122 of 135 S25FS512S this parameter type (parameter i d f0h) may appear multiple time s and have a different length each time. the parameter is used to reserve space in the id-cfi ma p or to force space (pad) to alig n a following parameter to a required boundary. 11.4.1.1 jedec sfdp rev b parameter tables from the view point of the cfi d ata structure, a ll of the sfdp parameter tables are combined into a single cfi parameter as a contiguous byte sequence. from the viewpoint of the sfdp d ata structure, there are three independent parameter tables. two of the tables have a fixed le ngth and one table has a variable st ructure and length depending on the device density ordering part number (opn). the basic flash parameter table and the 4-byte address instructions parameter t able have a fixed length and are presented below as a single ta ble. this table is section 1 of th e overall cfi parameter. the jedec sector map parameter table structure and length depen ds on the density opn and is presented as a set of tables, one for each device density. the appr opriate table for the opn is s ection 2 of the overall cfi par ameter and is appended to sectio n 1. table 65. cfi alternate vendor- specific extended query paramet er 8ch reset timing parameter relative byte address offset data description 00h 8ch parameter id (reset timing) 01h 06h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h 96h por maximum value 03h 01h por maximum exponent 2 n s 04h 23h hardware reset maximum value, ffh = not supported (the initial delivery state has hardware reset disabled but it may be enabl ed by the user at a later tim e) 05h 00h hardware reset maximum exponent 2 n s 06h 23h software reset maximum value, ffh = not supported 07h 00h software reset maximum exponent 2 n s table 66. cfi alternate vendor- specific extended query paramet er 94h ecc parameter relative byte address offset data description 00h 94h parameter id (ecc) 01h 01h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h 10h ecc unit size byte , ffh = ecc disabled table 67. cfi alternate vendor- specific extended query paramet er f0h rfu parameter relative byte address offset data description 00h f0h parameter id (rfu) 01h 09h parameter length (the number of following bytes in this paramet er. adding this value to the current location value +1 = the first byte of the next paramete r) 02h ffh rfu ... ffh rfu 0ah ffh rfu document number: 002-00488 rev. *g page 123 of 135 S25FS512S table 68. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 1, basic flash parameter and 4-byte address instructions parameter cfi parameter relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description 00h -- n/a a5h cfi parameter id (jedec sfdp) 01h -- n/a 88h (512 mb) cfi parameter length (the number of following bytes in this par ameter. adding this value to the current location value +1 = the first byte of the next parameter). opn dependent: 18dw + 16dw = 34dw * 4b = 136b = 88h b (512 mb) 02h 00h jedec basic flash parameter dword-1 e7h start of sfdp jedec parameter, located at 1090h in the overall sfdp address space. bits 7:5 = unused = 111b bit 4:3 = 06h is status register write instruction and status r egister is default non-volatile= 00b bit 2 = program buffer > 64 bytes = 1 bits 1:0 = uniform 4-kb erase unavailable = 11b 03h 01h ffh bits 15:8 = uniform 4-kb erase opcode = not supported = ffh 04h 02h b2h (fsxxxsag) bah (fsxxxsds) bit 23 = unused = 1b bit 22 = supports quad out read = no = 0b bit 21 = supports quad i/o read = yes =1b bit 20 = supports dual i/o read = yes = 1b bit19 = supports ddr 0= no, 1 = yes; fs-sag = 0b, fs-sds = 1b bit 18:17 = number of address bytes, 3 or 4 = 01b bit 16 = supports dual out read = no = 0b 05h 03h ffh bits 31:24 = unused = ffh 06h 04h jedec basic flash parameter dword-2 ffh density in bits, zero based, 512 mb = 1fffffffh 07h 05h ffh 08h 06h ffh 09h 07h 1fh (512 mb) 0ah 08h jedec basic flash parameter dword-3 48h bits 7:5 = number of quad i/ o (1-4-4) mode cycles = 010b bits 4:0 = number of quad i/o dummy cycles = 01000b (initial de livery state) 0bh 09h ebh quad i/o instruction code 0ch 0ah ffh bits 23:21 = number of quad out (1-1-4) mode cycles = 111b bits 20:16 = number of quad out dummy cycles = 11111b 0dh 0bh ffh quad out instruction code 0eh 0ch jedec basic flash parameter dword-4 ffh bits 7:5 = number of dual out (1-1-2) mode cycles = 111b bits 4:0 = number of dual out dummy cycles = 11111b 0fh 0dh ffh dual out instruction code 10h 0eh 88h bits 23:21 = number of dual i /o (1-2-2) mode cycles = 100b bits 20:16 = number of dual i/o dummy cycles = 01000b (initial delivery state) 11h 0fh bbh dual i/o instruction code 12h 10h jedec basic flash parameter dword-5 feh bits 7:5 rfu = 111b bit 4 = qpi supported = yes = 1b bits 3:1 rfu = 111b bit 0 = dual all not supported = 0b 13h 11h ffh bits 15:8 = rfu = ffh 14h 12h ffh bits 23:16 = rfu = ffh 15h 13h ffh bits 31:24 = rfu = ffh 16h 14h jedec basic flash parameter dword-6 ffh bits 7:0 = rfu = ffh 17h 15h ffh bits 15:8 = rfu = ffh 18h 16h ffh bits 23:21 = number of dual all mode cycles = 111b bits 20:16 = number of dual all dummy cycles = 11111b 19h 17h ffh dual all instruction code 1ah 18h jedec basic flash parameter dword-7 ffh bits 7:0 = rfu = ffh 1bh 19h ffh bits 15:8 = rfu = ffh 1ch 1ah 48h bits 23:21 = number of qpi mode cycles = 010b bits 20:16 = number of qpi dummy cycles = 01000b 1dh 1bh ebh qpi mode quad i/o (4-4-4) instruction code document number: 002-00488 rev. *g page 124 of 135 S25FS512S 1eh 1ch jedec basic flash parameter dword-8 0ch erase type 1 size 2 n bytes = 4 kb = 0ch for hybrid (initial delivery state) 1fh 1dh 20h erase type 1 instruction 20h 1eh 10h erase type 2 size 2 n bytes = 64 kb = 10h 21h 1fh d8h erase type 2 instruction 22h 20h jedec basic flash parameter dword-9 12h erase type 3 size 2 n bytes = 256 kb = 12h 23h 21h d8h erase type 3 instruction 24h 22h 00h erase type 4 size 2 n bytes = not supported = 00h 25h 23h ffh erase type 4 instruction = not supported = ffh 26h 24h jedec basic flash parameter dword-10 82h bits 31:30 = erase type 4 erase, typical time units (00b: 1 ms, 01b: 16 ms, 10b: 128 ms, 11b: 1 s) = 1s = 11b (rfu) bits 29:25 = erase type 4 er ase, typical time count = 11111b (rfu) bits 24:23 = erase type 3 erase, typical time units (00b: 1 ms, 01b: 16 ms, 10b: 128 ms, 11b: 1 s) = 128ms = 10b bits 22:18 = erase type 3 erase, typical time count = 00100b (t yp erase time = count +1 units = 5128ms = 640ms) bits 17:16 = erase type 2 erase, typical time units (00b: 1 ms, 01b: 16 ms, 10b: 128 ms, 11b: 1 s) = 16ms = 01b bits 15:11 = erase type 2 erase, typical time count = 01000b ( typ erase time = count +1 units = 916ms = 144ms) bits 10:9 = erase type 1 erase, typical time units (00b: 1 ms, 01b: 16 ms, 10b: 128 ms, 11b: 1 s) = 16ms = 01b bits 8:4 = erase type 1 erase, typical time count = 01000b ( ty p erase time = count +1 units = 916ms = 144ms) bits 3:0 = multiplier from typical erase time to maximum erase time = 2(n+1), n=2h = 6x multiplier binary fields: 11-11111-10-00100-01-01 000-01-01000-0010 nibble format: 1111_1111_0001_0001_0100_0010_1000_0010 hex format: ff_11_42_82 27h 25h 42h 28h 26h 11h 29h 27h ffh 2ah 28h jedec basic flash parameter dword-11 91h bit 31 reserved = 1b bits 30:29 = chip erase, typical time units (00b: 16 ms, 01b: 2 56 ms, 10b: 4 s, 11b: 64 s) = 512 mb = 64s = 11b bits 28:24 = chip erase, typical time count, (count+1)units, 512 mb = 00010b = 2+164us = 192s bits 23 = byte program typical time, additional byte units (0b: 1us, 1b:8us) = 1us = 0b bits 22:19 = byte program typical time, additional byte count, (count+1)units, count = 0000b, (typ program time = count +1 units = 11us = 1us bits 18 = byte program typical time, first byte units (0b:1us, 1b:8us) = 8us = 1b bits 17:14 = byte program typical time, first byte count, (coun t+1)units, count = 1100b, ( typ program time = count +1 units = 138us = 104us bits 13 = page program typical time units (0b:8us, 1b:64us) = 6 4us = 1b bits 12:8 = page program typical time count, (count+1)units, c ount = 00110b, ( typ program time = count +1 units = 764us = 448us) bits 7:4 = page size 2 n , n=9h, = 512b page bits 3:0 = multiplier from typical time to maximum for page or byte program = 2(n+1), n=1h = 4x multiplier 128 mb binary fields: 1-10-01000-0-0000-1-1100-1-00110-1001-0001 nibble format: 1100_1000_0000_0111_0010_0110_1001_0001 hex format: c8_07_26_91 256 mb binary fields: 1-10-10001-0-0000-1-1100-1-00110-1001-0001 nibble format: 1101_0001_0000_0111_0010_0110_1001_0001 hex format: d1_07_26_91 512 mb binary fields: 1-11-00010-0-0000-1-1100-1-00110-1001-0001 nibble format: 1110_0010_0000_0111_0010_0110_1001_0001 hex format: e2_07_26_91 2bh 29h 26h 2ch 2ah 07h 2dh 2bh e2h (512 mb) table 68. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 1, basic flash parameter and 4-byte address instructions parameter (continued ) cfi parameter relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 125 of 135 S25FS512S 2eh 2ch jedec basic flash parameter dword-12 ech bit 31 = suspend and resume supported = 0b bits 30:29 = suspend in-progress erase max latency units (00b: 128ns, 01b: 1us, 10b: 8us, 11b: 64us) = 8us= 10b bits 28:24 = suspend in-progress erase max latency count = 0010 0b, max erase suspend latency = count +1 units = 58us = 40us bits 23:20 = erase resume to suspend interval count = 0001b, in terval = count +1 64us = 2 64us = 128us bits 19:18 = suspend in-progress program max latency units (00b : 128ns, 01b: 1us, 10b: 8us, 11b: 64us) = 8us= 10b bits 17:13 = suspend in-progress program max latency count = 00 100b, max erase suspend latency = count +1 units = 58us = 40us bits 12:9 = program resume to suspend interval count = 0001b, i nterval = count +1 64us = 2 64us = 128us bit 8 = rfu = 1b bits 7:4 = prohibited operations during erase suspend = xxx0b: may not initiate a new erase anywhere (erase nesting n ot permitted) + xx1xb: may not initiate a page program in the erase suspended sector size + x1xxb: may not initiate a read in the erase suspended sector size + 1xxxb: the erase and program r estrictions in bits 5:4 are suf ficient = 1110b bits 3:0 = prohibited operations during program suspend = xxx0b: may not initiate a new erase anywhere (erase nesting n ot permitted) + xx0xb: may not initiate a new page program anywhere (program nesting not permitted) + x1xxb: may not initiate a read in the program suspended page size + 1xxxb: the erase and program r estrictions in bits 1:0 are suf ficient = 1100b binary fields: 0-10-00100-0001-10-00100-0001-1-1110-1100 nibble format: 0100_0100_0001_1000_1000_0011_1110_1100 hex format: 44_18_83_ec 2fh 2dh 83h 30h 2eh 18h 31h 2fh 44h 32h 30h jedec basic flash parameter dword-13 8ah bits 31:24 = erase suspend instruction = 75h bits 23:16 = erase resume instruction = 7ah bits 15:8 = program suspend instruction = 85h bits 7:0 = program resume instruction = 8ah 33h 31h 85h 34h 32h 7ah 35h 33h 75h 36h 34h jedec basic flash parameter dword-14 f7h bit 31 = deep power down supported = supported = 0 bits 30:23 = enter deep power down instruction = b9h bits 22:15 = exit deep power down instruction = abh bits 14:13 = exit deep power down to next operation delay units = (00b: 128ns, 01b: 1us, 10b: 8us, 11b: 64us) = 1us = 01b bits 12:8 = exit deep power down to next operation delay count = 11101b, exit deep power down to next operation delay = (count+1)units = 29+1 1us = 30us bits 7:4 = rfu = fh bit 3:2 = status regist er polling device busy = 01b: legacy status polling supported = use legacy polling by reading the status register with 05h instruction and checking wip bit[0] (0=ready 1=busy). = 01b bits 1:0 = rfu = 11b binary fields: 0-10111001-10101011-01-11101- 1111-01-11 nibble format: 0101_1100_1101_0101_1011_1101_ 1111_0111 hex format: 5c_d5_bd_f7 37h 35h bdh 38h 36h d5h 39h 37h 5ch table 68. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 1, basic flash parameter and 4-byte address instructions parameter (continued ) cfi parameter relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 126 of 135 S25FS512S 3ah 38h jedec basic flash parameter dword-15 8ch bits 31:24 = rfu = ffh bit 23 = hold and wp disable = not supported = 0b bits 22:20 = quad enable requirements = 101b: qe is bit 1 of the status register 2. status register 1 is read using read status instruction 05h. status register 2 is read using instruction 35h. qe is set via write status instruction 01h with two data bytes where bit 1 of the second byte is one. it is cleared via write status with two data bytes where bit 1 of the second byte is zero. bits 19:16 0-4-4 mode entry method = xxx1b: mode bits[7:0] = a5h note: qe must be set prior to usi ng this mode + x1xxb: mode bit[7:0]=axh + 1xxxb: rfu = 1101b bits 15:10 0-4-4 mode exit method = xx_xxx1b: mode bits[7:0] = 00h will terminate this mode at th e end of the current read operation + xx_1xxxb: input fh (mode bit reset) on dq0-dq3 for 8 clocks. this will terminate the mode prior to the next read operation. + x1_xxxxb: mode bit[7:0] = axh + 1x_x1xx: rfu = 11_1101 bit 9 = 0-4-4 mode supported = 1 bits 8:4 = 4-4-4 mode enable sequences = x_1xxxb: device uses a read-modify-write sequence of operatio ns: read configuration using instruction 65h followed by address 800003h, set bit 6, write configuration usi ng instruction 71h followed by address 800003h. this configuration is volatile. = 01000b bits 3:0 = 4-4-4 mode disable sequences = x1xxb: device uses a read-modi fy-write sequence of operations : read configuration using instruction 65h followed by address 800003h, clear bit 6, write configuration u sing instruction 71h followed by address 800003h.. this configuration is volatile. + 1xxxb: issue the soft reset 66/99 sequence = 1100b binary fields: 11111111-0-101-1101-111101-1- 01000-1100 nibble format: 1111_1111_0101_1101_ 1111_0110_1000-1100 hex format: ff_5d_f6_8c 3bh 39h f6h 3ch 3ah 5dh 3dh 3bh ffh 3eh 3ch jedec basic flash parameter dword-16 f0h bits 31:24 = enter 4-byte addressing = xxxx_xxx1b: issue instruction b7h (preceding w rite enable not required) + xx1x_xxxxb: supports dedicated 4-byte address instruction set . consult vendor data sheet for the instruction set definition. + 1xxx_xxxxb: reserved = 10100001b bits 23:14 = exit 4-byte addressing = xx_xx1x_xxxxb: hardware reset + xx_x1xx_xxxxb: software reset (see bits 13:8 in this dword) + xx_1xxx_xxxxb: power cycle + x1_xxxx_xxxxb: reserved + 1x_xxxx_xxxxb: reserved = 11_1110_0000b bits 13:8 = soft reset and rescue sequence support = x1_xxxxb: issue reset enable instruction 66h, then issue rese t instruction 99h. the reset enable, reset sequence may be issued on 1, 2, or 4 wires depend ing on the device operating mode. + 1x_xxxxb: exit 0-4-4 mode is required prior to other reset se quences above if the device may be operating in this mode. = 110000b bit 7 = rfu = 1 bits 6:0 = volatile or non-volatile register and write enable i nstruction for status register 1 = + xx1_xxxxb: status register 1 contains a mix of volatile and non-volatile bits. the 06h instruction is used to enable writing of the register. + x1x_xxxxb: reserved + 1xx_xxxxb: reserved = 1110000b binary fields: 10100001- 1111 100000-110000-1-1110000 nibble format: 1010_0001_ 1111_1000_0011_0000_ 1111_ 0000 hex format: a1_f8_30_f0 3fh 3dh 30h 40h 3eh f8h 41h 3fh a1h table 68. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 1, basic flash parameter and 4-byte address instructions parameter (continued ) cfi parameter relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 127 of 135 S25FS512S sector map parameter table notes the sector map parameter table provides a means to ident ify how the device address map is configured and provides a sector map for each supported conf iguration. this is d one by defining a se quence of commands to read out the relevant configuration regis ter bits that affect the selection o f an address map. when more tha n one configuration bi t must be read, all the bits are concaten ated into an index value that is us ed to select the current address map. to identify the sector map confi guration in fs512s the followin g configuration bits a re read in the following msb to lsb order to form the configuration map index value: ? cr3nv[3] 0 = hybrid architec ture, 1 = unifo rm architecture ? cr1nv[2] 0 = 4-kb parameter se ctors at bottom, 1 = 4-kb secto rs at top ? cr3nv[1] 1 = 256-kb uniform sector size the value of some configuration bits may make other configurati on bit values not relevant (don t care), hence not all possible combinations of the index value define valid address maps. only selected configuration bit combinations are supported by the s fdp sector map parameter table. other combinations must not be used in configuring the sector address map wh en using this sfdp parameter table to determine t he sector map. the following inde x value combinations are supported. table 69. sector map parameter 42h 40h jedec 4 byte address instructions parameter dword-1 6bh supported = 1, not supported = 0 bits 31:20 = rfu = fffh bit 19 = support for non-volatile individual sector lock write command, instruction=e3h = 1 bit 18 = support for non-volatile individual sector lock read c ommand, instruction=e2h = 1 bit 17 = support for volatile individual sector lock write comm and, instruction=e1h = 1 bit 16 = support for volatile individual sector lock read comma nd, instruction=e0h = 1 bit 15 = support for (1-4-4) dtr_read command, instruction=eeh = 1 bit 14 = support for (1-2-2) dtr_read command, instruction=beh = 0 bit 13 = support for (1-1-1) dtr_read command, instruction=0eh = 0 bit 12 = support for erase command C type 4 = 0 bit 11 = support for erase command C type 3 = 1 bit 10 = support for erase command C type 2 = 1 bit 9 = support for erase command C type 1 = 1 bit 8 = support for (1-4-4) page program command, instruction=3 eh =0 bit 7 = support for (1-1-4) page program command, instruction=3 4h = 0 bit 6 = support for (1-1-1) page program command, instruction=1 2h = 1 bit 5 = support for (1-4-4) fast_read command, instruction=ech = 1 bit 4 = support for (1-1-4) fast_read command, instruction=6ch = 0 bit 3 = support for (1-2-2) fast_read command, instruction=bch = 1 bit 2 = support for (1-1-2) fast_read command, instruction=3ch = 0 bit 1 = support for (1-1-1) fast_read command, instruction=0ch = 1 bit 0 = support for (1-1-1) read command, instruction=13h = 1 43h 41h 8eh 44h 42h ffh 45h 43h ffh 46h 44h jedec 4 byte address instructions parameter dword-2 21h bits 31:24 = ffh = instruction for erase type 4: rfu bits 23:16 = dch = instruction for erase type 3 bits 15:8 = dch = instruction for erase type 2 bits 7:0 = 21h = instruction for erase type 1 47h 45h dch 48h 46h dch 49h 47h ffh device cr3nv[3] cr1nv[2] cr3nv[1] index value description fs512s 0 0 1 01h 4-kb sectors at bottom with remainder 256-kb sectors 0 1 1 03h 4-kb sectors at top with remainder 256-kb sectors 1 0 1 05h uniform 256-kb sectors table 68. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 1, basic flash parameter and 4-byte address instructions parameter (continued ) cfi parameter relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 128 of 135 S25FS512S table 70. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 2, sector map pa rameter table, 512 mb cfi paramete r relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description 4ah 48h jedec sector map parameter dword-1 config. detect-1 fch bits 31:24 = read data mask = 0000_1000b: select bit 3 of th e data byte for 20h_nv value 0= hybrid map with 4-kb parameter sectors 1= uniform map bits 23:22 = configuration detection command address length = 1 1b: variable length bits 21:20 = rfu = 11b bits 19:16 = configuration detection command latency = 1111b: v ariable latency bits 15:8 = configuration detection instruction = 65h: read any register bits 7:2 = rfu = 111111b bit 1 = command descriptor = 0 bit 0 = not the end descriptor = 0 4bh 49h 65h 4ch 4ah ffh 4dh 4bh 08h 4eh 4ch jedec sector map parameter dword-2 config. detect-1 04h bits 31:0 = sector map configuration detection command address = 00_00_00_04h: address of cr3nv 4fh 4dh 00h 50h 4eh 00h 51h 4fh 00h 52h 50h jedec sector map parameter dword-3 config. detect-2 fch bits 31:24 = read data mask = 0000_0100b: select bit 2 of th e data byte for tbparm_o value 0= 4-kb parameter sectors at bottom 1= 4-kb parameter sectors at top bits 23:22 = configuration detection command address length = 1 1b: variable length bits 21:20 = rfu = 11b bits 19:16 = configuration detection command latency = 1111b: v ariable latency bits 15:8 = configuration detection instruction = 65h: read any register bits 7:2 = rfu = 111111b bit 1 = command descriptor = 0 bit 0 = not the end descriptor = 0 53h 51h 65h 54h 52h ffh 55h 53h 04h 56h 54h jedec sector map parameter dword-4 config. detect-2 02h bits 31:0 = sector map configuration detection command address = 00_00_00_02h: address of cr1nv 57h 55h 00h 58h 56h 00h 59h 57h 00h 5ah 58h jedec sector map parameter dword-5 config. detect-3 fdh bits 31:24 = read data mask = 0000_0010b: select bit 1 of th e data byte for d8h_nv value 0= 64-kb uniform sectors 1= 256-kb uniform sectors bits 23:22 = configuration detection command address length = 1 1b: variable length bits 21:20 = rfu = 11b bits 19:16 = configuration detection command latency = 1111b: v ariable latency bits 15:8 = configuration detection instruction = 65h: read any register bits 7:2 = rfu = 111111b bit 1 = command descriptor = 0 bit 0 = the end descriptor = 1 5bh 59h 65h 5ch 5ah ffh 5dh 5bh 02h 5eh 5ch jedec sector map parameter dword-6 config. detect-3 04h bits 31:0 = sector map configuration detection command address = 00_00_00_04h: address of cr3nv 5fh 5dh 00h 60h 5eh 00h 61h 5fh 00h 62h 60h jedec sector map parameter dword-7 config-1 header feh bits 31:24 = rfu = ffh bits 23:16 = region count (dwords -1) = 02h: three regions bits 15:8 = configuration id = 01h: 4-kb sectors at bottom with remainder 256-kb sectors bits 7:2 = rfu = 111111b bit 1 = map descriptor = 1 bit 0 = not the end descriptor = 0 63h 61h 01h 64h 62h 02h 65h 63h ffh 66h 64h jedec sector map parameter dword-8 config-1 region-0 f1h bits 31:8 = region size = 00007fh: region size as count-1 of 256 byte units = 8 x 4 kb sectors = 3 2 kb count = 32 kb/256 = 128, value = count -1 = 128 -1 = 127 = 7fh bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 0b --- erase type 3 is 256-kb erase and is supported in the 4-kb s ector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 4-k b sector region bit 0 = erase type 1 support = 1b --- erase type 1 is 4-kb erase and is supported in the 4-kb sec tor region 67h 65h 7fh 68h 66h 00h 69h 67h 00h document number: 002-00488 rev. *g page 129 of 135 S25FS512S 6ah 68h jedec sector map parameter dword-9 config-1 region-1 f4h bits 31:8 = region size = 00037fh: region size as count-1 of 256 byte units = 1 x 224 kb sectors = 224 kb count = 224 kb/256 = 896, value = count -1 = 896 -1 = 895 = 37f h bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 1b --- erase type 3 is 256-kb erase and is supported in the 32-kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 32- kb sector region bit 0 = erase type 1 support = 0b --- erase type 1 is 4-kb erase and is not supported in the 32-k b sector region 6bh 69h 7fh 6ch 6ah 03h 6dh 6bh 00h 6eh 6ch jedec sector map parameter dword-10 config-1 region-2 f4h bits 31:8 = 512 mb device region size = 03fbffh: region size as count-1 of 256 byte units = 255 x 256 kb sectors = 65280 kb count = 65280 kb/256 = 261120, value = count -1 = 261120 -1 = 2 61119 = 3fbffh bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 1b --- erase type 3 is 256-kb erase and is supported in the 64-kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 64- kb sector region bit 0 = erase type 1 support = 0b --- erase type 1 is 4-kb erase and is not supported in the 64-k b sector region 6fh 6dh ffh 70h 6eh fbh 71h 6fh 03h (512 mb 72h 70h jedec sector map parameter dword-11 config-3 header feh bits 31:24 = rfu = ffh bits 23:16 = region count (dwords -1) = 02h: three regions bits 15:8 = configuration id = 03h: 4 kb sectors at top with re mainder 256 kb sectors bits 7:2 = rfu = 111111b bit 1 = map descriptor = 1 bit 0 = not the end descriptor = 0 73h 71h 03h 74h 72h 02h 75h 73h ffh 76h 74h jedec sector map parameter dword-12 config-3 region-0 f4h bits 31:8 = 512 mb device region size = 03fbffh: region size as count-1 of 256 byte units = 255 x 256 kb sectors = 65280 kb count = 65280 kb/256 = 261120, value = count -1 = 261120 -1 = 2 61119 = 3fbffh bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 1b --- erase type 3 is 256-kb erase and is supported in the 64-kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 64- kb sector region bit 0 = erase type 1 support = 0b --- erase type 1 is 4-kb erase and is not supported in the 64-k b sector region 77h 75h ffh 78h 76h fbh 79h 77h 03h (512 mb 7ah 78h jedec sector map parameter dword-13 config-3 region-1 f4h bits 31:8 = region size = 00037fh: region size as count-1 of 256 byte units = 1 x 224 kb sectors = 224 kb count = 224 kb/256 = 896, value = count -1 = 896 -1 = 895 = 37f h bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 1b --- erase type 3 is 256-kb erase and is supported in the 224-kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 224 -kb sector region bit 0 = erase type 1 support = 0b --- erase type 1 is 4-kb erase and is not supported in the 224- kb sector region 7bh 79h 7fh 7ch 7ah 03h 7dh 7bh 00h 7eh 7c jedec sector map parameter dword-14 config-3 region-2 f1h bits 31:8 = region size = 00007fh: region size as count-1 of 256 byte units = 8 x 4 kb sectors = 3 2 kb count = 32 kb/256 = 128, value = count -1 = 128 -1 = 127 = 7fh bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 0b --- erase type 3 is 256-kb erase and is not supported in the 4- kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 4-k b sector region bit 0 = erase type 1 support = 1b --- erase type 1 is 4-kb erase and is supported in the 4-kb sec tor region 7fh 7d 7fh 80h 7e 00h 81h 7f 00h table 70. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 2, sector map parameter table, 512 mb (continued) cfi paramete r relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 130 of 135 S25FS512S 11.5 initial delivery state the device is shipped from cyp ress with non-volatile bits set a s follows: ? the entire memory array is eras ed: i.e., all bits are set to 1 (each byte contains ffh). ? the otp address space has the fir st 16 bytes programmed to a ra ndom number. all other by tes are erased to ffh. ? the sfdp address space contains the values as def ined in the de scription of the sfdp address space. ? the id-cfi address space contains the values as defined in the description of the id-cfi address space. ? the status register 1 non-volat ile contains 00h (all sr1nv bits are cleared to 0s). ? the configuration register 1 non-volatile contains 00h. ? the configuration register 2 non-volatile contains 08h. ? the configuration register 3 non-volatile contains 00h. ? the configuration register 4 non-volatile contains 10h. ? the password register contains ffffffff-ffffffffh. ? all ppb bits are 1. ? the asp register b its are ffffh. 82h 80h jedec sector map parameter dword-15 config-4 header ffh bits 31:24 = rfu = ffh bits 23:16 = region count (dwords -1) = 00h: one region bits 15:8 = configuration id = 05h: uniform 256-kb sectors bits 7:2 = rfu = 111111b bit 1 = map descriptor = 1 bit 0 = the end descriptor = 1 83h 81h 05h 84h 82h 00h 85h 83h ffh 86h 84h jedec sector map parameter dword-16 config-4 region-0 f4h bits 31:8 = 512 mb device region size = 03ffffh: region size as count-1 of 256 byte units = 256 x 256 kb sectors = 65536 kb count = 65536 kb/256 = 262144, value = count -1 = 262144 -1 = 2 62143 = 3ffffh bits 7:4 = rfu = fh erase type not supported = 0/ supported = 1 bit 3 = erase type 4 support = 0b --- erase type 4 is not defined bit 2 = erase type 3 support = 1b --- erase type 3 is 256-kb erase and is supported in the 256-kb sector region bit 1 = erase type 2 support = 0b --- erase type 2 is 64-kb erase and is not supported in the 256 -kb sector region bit 0 = erase type 1 support = 0b --- erase type 1 is 4-kb erase and is not supported in the 256- kb sector region 87h 85h ffh 88h 86h ffh 89h 87h 03h table 70. cfi alternate vendor- specific extended query paramet er a5h, jedec sfdp rev b, section 2, sector map parameter table, 512 mb (continued) cfi paramete r relative byte address offset sfdp parameter relative byte address offset sfdp dword name data description document number: 002-00488 rev. *g page 131 of 135 S25FS512S ordering information 12. ordering part number the ordering part number is form ed by a valid combination of th e following: note 89. halogen free definition is in accordance with ie 61249-2-21 specification. s25fs 512 s ag m f i 01 1 packing type 0 = tray 1 = tube 3 = 13 tape and reel model number (additional ordering options) 01 = soic16 / wson 6 x 8 footprint, 256-kb physical sector 21 = 5x5 ball bga footprint, 256-kb physical sector temperature range / grade i = industrial (-40c to +85c) v = industrial plus (-40c to +105c) a = automotive, aec-q100 grade 3 (-40c to +85c) b = automotive, aec-q100 grade 2 (-40c to +105c) m = automotive, aec-q100 grade 1 (-40c to +125c) package materials f = halogen-free, lead (pb)-free h = halogen-free, lead (pb)-free package type m = 16-pin soic n = 8-contact wson 6 x 8 mm b = 24-ball bga 6 x 8 mm package, 1.00 mm pitch speed ag = 133 mhz ds = 80 mhz ddr device technology s = 65 nm mirrorbit process technology density 512 = 512 mbit device family s25fs cypress memory 1.8 v-only, serial peripheral interface (spi) fl ash memory document number: 002-00488 rev. *g page 132 of 135 S25FS512S valid combinations standard valid combinations list configur ations planned to be supported in volume for th is device. contact the lo cal sales office to co nfirm availability of specific valid c ombinations and to check on new ly released combinations. valid combinations aut omotive grade / aec-q100 the table below lists configurations that are automotive grade / aec-q100 qualified and are planned to be available in volume. the table will be updated as new com binations are released. consult your local sales representative to confirm availability of spe cific combinations and to check on newly released combinations. production part approval process (ppap) support is only provide d for aec-q100 grade products. products to be used in end-use applications that require iso/ts -16949 compliance must be aec-q100 grade products in combination with ppap. nonCaec-q 100 grade products are not manu factured or documented i n full compliance with iso/ts-16949 requirements. aec-q100 grade products are also offered without ppap support f or end-use applications that do not require iso/ts-16949 compliance. 13. contact obtain the latest list of company locations and contact informa tion at www.cypress.com/contact-us . valid combinations standard base ordering part number speed option package and temperature model number packing type package marking S25FS512S ag mfi, mfv 01 0, 1, 3 fs512s + a +(temp) + f + (model number) nfi, nfv 01 0, 1, 3 fs512s + a +(temp) + f + (model number) bhi, bhv 21 0, 3 fs512s + a +(temp) + h + (model number) ds mfi, mfv 01 0, 1, 3 fs512s + d +(temp) + f + (model number) nfi, nfv 01 0, 1, 3 fs512s + d +(temp) + f + (model number) bhi, bhv 21 0, 3 fs512s + d +(temp) + h + (model number) valid combinations automotive grade / aec-q100 base ordering part number speed option package and temperature model number packing type package marking S25FS512S ag mfa, mfb, mfm 01 0, 1, 3 fs512s + a +(temp) + f + (model number) nfa, nfb, nfm 01 0, 1, 3 fs512s + a +(temp) + f + (model number) bha, bhb, bhm 21 0, 3 fs512s + a +(temp) + h + (model number) ds mfa, mfb, mfm 01 0, 1, 3 fs512s + d +(temp) + f + (model number) nfa, nfb, nfm 01 0, 1, 3 fs512s + d +(temp) + f + (model number) bha, bhb, bhm 21 0, 3 fs512s + d +(temp) + h + (model number) S25FS512S document number: 002-00488 rev. *g page 133 of 135 14. revision history document title: s25fs5 12s, 512 mbit, 1.8 v serial peripheral in terface with mul ti-i/o flash document number: 002-00488 rev. ecn no. orig. of change submission date description of change ** ? ansi 10/14/2014 initial release *a ? ansi 12/17/2014 general promoted data sheet from advance information to preliminary 8-connector package 8-connector package (wson 6x8), top view figure: added second n ote *b 5043169 ansi 12/09/2015 updated to cypress template *c 5057701 ansi 12/23/2015 changed document status from preliminary to final. replaced automotive and automot ive - in cabin with industrial plus in all instances across the document. updated 12., ordering part number on page 131 : added industrial plus with aecq-100 and gt grade temperature range related information. *d 5126709 bwha 02/05/2016 updated 5., timing specifications on page 26 : updated 5.5, ddr ac characteristics. on page 31 : updated 5.5.2, ddr output timing on page 32 : replaced 4.125 ns with 4. 325 ns in note 5c below figure 35 . updated 12., software interface reference on page 126: updated 11.4, device id and common flash in terface (id-cfi) address map on page 117 : updated 11.4.1, field definitions on page 117 : updated table 62 : replaced 02h with 0 1h in data column. updated table 63 : replaced 09h with 0 8h in data column. updated table 64 : replaced 05h with 0 4h in data column. updated table 65 : replaced 07h with 0 6h in data column. updated table 67 : replaced 0ah with 09h in data column. *e 5459641 bwha 10/03/2016 added automotive grade to features on page 1 . added extended temperature range to features on page 1 . logic block diagram typical program and erase rates: corrected 256-kbytes sector erase (uniform logical sector option) value. added thermal resistance on page 21 . added automotive grade to temperature ranges on page 21 . added ecc status register (eccsr) on page 56 . added ecc to otp address space on page 42 . added ecc to password protection mode on page 66 . added ecc to extended addressing on page 69 . added ecc to command set summary on page 69 . added ecc status register read (eccrd 19h or 4eecrd 18h) on page 82 . updated read any register (rdar 65h) on page 84 . updated dual i/o read (dior bbh or 4dior bch) on page 90 . updated figures in quad i/o read (qior ebh or 4qior ech) on page 91 . updated figures in ddr quad i/o read (edh, eeh) on page 93 . S25FS512S document number: 002-00488 rev. *g page 134 of 135 *e (cont.) 5459641 bwha 10/03/2016 added automatic ecc on page 95 . added data integrity on page 114 . added ecc to table 12.1, S25FS512S command set (sorted by instr uction) on page 126. added table 66 on page 122 . removed software interface reference section. ordering information : added automotive grade. *f 5649411 ecao 03/03/2017 removed extended temperature range options (-40c to +125c) in datasheet. updated sales and copyright information. *g 5688179 bwha 12/22/2017 updated package drawings on physical interface on page 34 . updated cypress logo and sales page. updated ordering part number on page 131 definition of letters in opn indicating package material. changed v dd to v cc updated ddr data valid timing using dlp on page 33 , example added logic block diagram on page 2 updated sales page. document title: s25fs5 12s, 512 mbit, 1.8 v serial peripheral in terface with mul ti-i/o flash document number: 002-00488 rev. ecn no. orig. of change submission date description of change document number: 002-00488 rev. *g revised december 22, 2017 pag e 135 of 135 ? cypress semiconductor corporation, 2014-2017. this document i s the property of cypress semiconductor corporation and its sub sidiaries, including spansion llc ("cypress"). this document, including any software or firmware included or referenced in th is document ("software"), is owned by cypress under the intelle ctual property laws and treaties of the united states and other countries worldwide. cypress reserves all rights under such laws and trea ties and does not, except as spec ifically stated in this paragr aph, grant any license under its patents, copyrights, trademark s, or other intellectual property rights. if the software is not accompani ed by a license agreement and you do not otherwise have a writt en agreement with cypress governing the use of the software, th en cypress hereby grants you a personal, non-exclusive, nontransferable li cense (without the right to sublicense) (1) under its copyright rights in the software (a) for software provided in source cod e form, to modify and reproduce the software solely for use with cypress h ardware products, only internally within your organization, and (b) to distribute the software in binary code form externally to end users (either directly or indirectly through resellers and distributo rs), solely for use on cypress hardware product units, and (2) under those claims of cypress's patents that are infringed by t he software (as provided by cypress, unmodified) to make, use, distribute, and import the software solely for use with cypress hardware produc ts. any other use, reproduction , modification, translation, or compilation of the software is prohibited. to the extent permitted by applicable law, cypress makes no war ranty of any kind, express or implied, with regard to this docu ment or any software or accompanying hardware, including, but not limited to, the im plied warranties of merchantability and fitness for a particula r purpose. no computing device can be absolutely secure. therefore, despite security me asures implemented in cypress hardware or software products, cy press does not assume any liability arising out of any security breach, such as unauthorized access to or use of a cypress product. in addition, the products described in these materials may contai n design defects or errors known as errata which may cause the product to deviate from published specifications. to the extent permitt ed by applicable law, cypress reserves the right to make change s to this document without further notice. cypress does not ass ume any liability arising out of the application or use of any product or circuit described in this document. any information provide d in this document, including any sample design information or programming code, is provided only for reference purposes. it is the respon sibility of the user of this document to properly design, progr am, and test the functionality and safety of any application ma de of this information and any resulting product. cypress products are not designed, intended, or authorized for use as critical componen ts in systems designed or intended for the operation of weapons , weapons systems, nuclear installations, life-support devices or systems , other medical devices or system s (including resuscitation equ ipment and surgical implants), pollution control or hazardous s ubstances management, or other uses where the failure of the device or sy stem could cause personal injury, death, or property damage ("u nintended uses"). a critical component is any component of a de vice or system whose failure to perform can be reasonably expected t o cause the failure of the device or system, or to affect its s afety or effectiveness. cypress is not liable, in whole or in p art, and you shall and hereby do release cypress from any claim, damage, or other liability arising from or related to all unintended uses of cypress products. you shall in demnify and hold cypress harml ess from and against all claims, costs, damages, and other liabilities, including claims for personal inj ury or death, arising from or related to any unintended uses of cypress products. cypress, the cypress logo, spansion, the spansion logo, and com binations thereof, wiced, psoc, capsense, ez-usb, f-ram, and tr aveo are trademarks or registered trademarks of cypress in the united states and other countries. for a more complete list of cypress trademarks, visit cypress.com. other names and bran ds may be claimed as property of their respective owners. S25FS512S sales, solutions, an d legal information worldwide sales and design support cypress maintains a worldwide network of offices, solution cent ers, manufacturers representativ es, and distributors. to find the office closest to you, visit us at cypress locations . products arm ? cortex ? microcontrollers cypress.com/arm automotive cypress.com/automotive clocks & buffers cypress.com/clocks interface cypress.com/interface internet of things cypress.com/iot memory cypress.com/memory microcontrollers cypress.com/mcu psoc cypress.com/psoc power management ics cypress.com/pmic touch sensing cypress.com/touch usb controllers cypress.com/usb wireless connectivity cypress.com/wireless psoc ? solutions psoc 1 | psoc 3 | psoc 4 | psoc 5lp | psoc 6 mcu cypress developer community community | projects | video | blogs | training | components technical support cypress.com/support |
Price & Availability of S25FS512S
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |