- Hardware method of locking a sector to prevent
any program or erase operation within that sector
- Two methods are provided :
- In-system method by RESET# pin
- A9 high-voltage method for PROM programmers
• Temporary Sector Unprotection ( RESET# )
- Allows temporary unprotection of previously
protected sectors to change data in-system
ES29LV320D
1
Rev. 2D Jan 5, 2006
GENERAL PRODUCT DESCRIPTION
ESI
ESI
Excel Semiconductor inc.
The ES29LV320 is a 32 megabit, 3.0 volt-only flash
memory device, organized as 4M x 8 bits (Byte
mode) or 2M x 16 bits (Word mode) which is configurable by BYTE#. Eight boot sectors and sixty three
main sectors with uniform size are provided :
8Kbytes x 8 and 64Kbytes x 63. The device is manufactured with ESI’s proprietary, high performance
and highly reliable 0.18um CMOS flash technology.
The device can be programmed or erased in-system with standard 3.0 Volt Vcc supply ( 2.7V-3.6V)
and can also be programmed in standard EPROM
programmers. The device offers minimum e ndurance of 100,000 program/erase cycles and more
than 10 years of data retention.
The ES29LV320 offers access time as fast as 80ns
or 90ns, allowing operation of high-speed microprocessors without wait states. Three separate control
pins are provided to eliminate bus contention : chip
enable (CE#), write enable (WE#) and output
enable (OE#).
All program and erase operation are automatically
and internally performed and controlled by embedded program/erase algorithms built in the device.
The device automatically generates and times the
necessary high-voltage pulses to be applied to the
cells, performs the verification, and counts the number of sequences. Some status bits (DQ7, DQ6 and
DQ5) read by data# polling or toggling between
consecutive read cycles provide to the users the
internal status of program/erase operation: whether
it is successfully done or still being progressed.
Extra Security Sector of 256 bytes
In the device, an extra security sector of 256 bytes is
provided to customers. This extra sector can be
used for various purposes such as storing ESN
(Electronic Serial Number) or customer’s security
codes. Once after the extra sector is written, it can
be permanently locked by the device manufacturer(
factory-locked) or a customer( customer-lockable). At the same time, a lock indicator bit (DQ7)
is permanently set to a 1 if the part is factory- locked,
or set to 0 if it is customer-lockable. Therefore, this
lock indicator bit (DQ7) can be properly used to
avoid that any customer-lockable part is used to
replace a factory-locked part. The extra security
sector is an extra memory space for customers
when it is used as a customer-lockable version. So,
it can be read and written like any other sectors. But
it should be noted that the number of E/W(Erase and
Write) cycles is limited to 300 times (maximum) only
in the Security Sector.
Special services such as ESN and factory-lock are
available to customers ( ESI’s Special-Code ser-vice ) The ES29L V320 is completely comp atible with
the JEDEC standard command set of single power
supply Flash. Commands are written to the internal
command register using standard write timings of
microprocessor and data can be re ad out from the
cell array in the device with the same way as used i n
other EPROM or flash devices.
Several device operational modes are provided in
the ES29LV320 device. Commands are used to initiate the device operations. They are latched and
stored into internal registers with the address and
data information needed to execute the device
operation.
The available device operational modes are listed
in Table 1 with the required inputs, controls, and the
resulting outputs. Each operational mode is
described in further detail in the following subsections.
Read
The internal state of the device is set for the read
mode and the device is ready for reading arra y da t a
upon device power-up, or after a hardware reset. To
read the stored data from the cell array of the
device, CE# and OE# pins should be driven to V
while WE# pin remains at VIH. CE# is the power
control and selects the device. OE# is the output
control and gates array data to the output pins.
Word or byte mode of output data is determined by
the BYTE# pin. No additional command is needed
in this mode to obtain array data. Standard microprocessor read cycles that assert valid addresses
on the device address inputs produce valid data on
the device data outputs. The device st ays at the read
mode until another operation is activated by writing
commands into the internal command register. Refer
to the AC read cycle timing diagrams for further
details ( Fig. 18 ).
Word/Byte Mode Configuration ( BYTE# )
The device data output can be configured by BYTE#
into one of two modes : word and byte modes. If the
BYTE# pin is set at logic ‘1’, the device is configured
in word mode, DQ0 - DQ15 are active and controlled
by CE# and OE#. If the BYTE# pin is set at logic ‘0’,
the device is configured in byte mode, and only data
I/O pins DQ0 - DQ7 are active and controlled by CE#
and OE#. The data I/O pins DQ8 - DQ14 are tristated, and the DQ15 pin is used as an input for the
LSB (A-1) address.
IL
Standby Mode
When the device is not selected or activated in a
system, it needs to stay at the standby mode, in
which current consumption is greatly reduced with
outputs in the high impedance state.
ES29LV320D
6
Rev. 2D Jan 5, 2006
ESI
ESI
Excel Semiconductor inc.
The device enters the CMOS standby mode when
CE# and RESET# pins are both held at Vcc
+
0.3V.
(Note that this is a more restricted voltage range
than V
not within Vcc
) If CE# and RESET# are held at VIH, but
IH.
+
0.3V, the device will be still in the
standby mode, but the standby current will be
greater than the CMOS standby current (0.2uA typically). When the device is in the standby mode, only
standard access time (t
) is required for read
CE
access, before it is ready for read data. And even if
the device is deselected by CE# pin during erase or
programming operation, the device draws active cur rent until the operation is completely done. While the
device stays in the standby mode, the output is
placed in the high impedance state, independent of
the OE# input.
The device can enter the deep power-down mode
where current consumption is greatly reduced down
to less than 0.2uA typically by the following three
ways:
- CMOS standby ( CE#, RESET# = Vcc + 0.3V )
- During the device reset ( RESET# = Vss
- In Autosleep Mode ( after t
ACC
+ 30ns )
+ 0.3V )
Refer to the CMOS DC characteristics Table11 for
further current specification .
Autosleep Mode
The device automatically enters a deep power-down
mode called the autosleep mode when addresses
remain stable for t
consumption is greatly reduced ( less than 0.2uA
typical ), regardless of CE#, WE# and OE# control
signals.
+30ns. In this mode, current
ACC
set-up cycle and the last cycle with the program
data and addresses. In this mode, two unlock
cycles are saved ( or bypassed ).
Sector Addresses
The entire memory space of cell array is divided
into a many of small sectors: 8kbytes x 8 boot sectors and 64Kbytes x 63 main sectors. In erase
operation, a single sector, multiple sectors, or the
entire device (chip erase) can be selected for
erase. The address space that each sector occupies is shown in detail in the Table 3-4.
Accelerated Program Mode
The device offers accelerated program operations
through the ACC function. This is one of two functions provided by the WP#/ACC pin. This function
is primarily intended to allow faster manufacturing
throughput at the factory. If the system asserts V
(11.5~12.5V) on this pin, the device automatically
enters the previously mentioned Unlock Bypassmode, temporarily unprotects any protected sectors, and uses the higher voltage on the pin to
reduce the time required for program operations.
Only two-cycle program command sequences are
required because the unlock bypass mode is automatically activated in this acceleration mode. The
device returns to the normal operation when V
removed from the WP#/ACC pin. It should be
noted that the WP#/ACC pin must not be at V
operations other than accelerated programming, or
device damage may result. In addition, the WP#/
ACC pin must not be left floating or unconnected;
inconsistent or undesired behavior of the device
may result.
HH
HH
HH
for
is
Writing Commands
To write a command or command sequences to initiate some operations such as program or erase, the
system must drive WE# and CE# to V
. For program operations, the BYTE# pin deter-
V
IH
, and OE# to
IL
mines whether the device accepts pro gram data in
bytes or words. Refer to “BYTE# timings for Write
Operations” in the Fig. 21 for more information.
Unlock Bypass Mode
To reduce more the programming time, an unlockbypass mode is provided. Once the device enters
this mode, only two write cycles are required to initiate the programming operation instead of four
cycles in the normal program command sequences
which are composed of two unlock cycles, program
ES29LV320D
7
Autoselect Mode
Flash memories are intended for use in applications where the local CPU alter s me mory cont ents.
In such applications, manufacturer and device
identification (ID) codes must be accessible while
the device resides in the target system ( the so
called “in-system program”). On the other hand,
signature codes have been typically accessed by
raising A9 pin to a high voltage in PROM programmers. However, multiplexing high voltage onto
address lines is not the generally desired system
design practice. Therefore, in the ES29LV320
device an autoselect command is provided to
allow the system to access the signature codes
without any high voltage. The conventional A9high-voltage method used in the PROM progra mers for signature codes are still supported in this
device.
Rev. 2D Jan 5, 2006
ESI
ESI
Excel Semiconductor inc.
If the system writes the autoselect command
sequence, the device enters the Autoselect mode.
The system can then read some useful codes such
as manufacturer and device ID from the internal registers on DQ7 - DQ0. Standard read cycle timings
apply in this mode. In the Autoselect mode, the following four informations can be accessed through
either autoselect command method or A9 high-voltage autoselect method. Refer to the Table 2.
-
-
-
-
Manufacturer ID
Device ID
Security Sector Lock-indicator
Sector protection verify
Hardware Device Reset ( RESET# )
The RESET# pin provides a hardware method of
resetting the device to read array data. When the
RESET# pin is driven low for at least a period of t
the device immediately terminates any operation in
progress, tristates all output pins, and ignores all
read/write commands for the duration of the
RESET# pulse The device also resets the internal
state machine to reading array data. The operation
that was interrupted should be reinitiated once after
the device is ready to accept another command
sequence, to ensure data integrity.
RP
CMOS Standby during Device Reset
Flash memory, enabling the system to read the
boot-up firmware from the Flash memory.Refer to
the AC Characteristics tables for RESET# parameters and to Fig. 19 for the timing diagram.
SECTOR GROUP PROTECTION
The ES29LV320 features hardware sector group
protection. A sector group consists of two or more
adjacent sectors that are protected or unprotected
at the same time. In the device, sector protection is
performed on the group of sectors previously
defined in the Table 3-4. Once after a group of sectors are protected, any program or erase operation
is not allowed in the protected sector group. The
previously protected sectors must be unprotected
by one of the unprotect methods provided here
before changing data in those sectors. Sector protection can be implemented via two methods.
,
-
-
To check whether the sector group protection was
successfully executed or not, another operation
called “protect verification” needs to be performed after the protection oper ation on a group of
sectors. All protection and protect verifications provided in the device are summarized in detail at the
Table 1.
In-system protection
A9 High-voltage protection
Current is reduced for the duration of the RESET#
pulse. When RESET# is held at Vss
device draws the greatly reduced CMOS standby
current ( I
within Vss
). If RESET# is held at VIL but not
CC4
+
0.3V, the standby current will be greater.
+
0.3V, the
RY/BY# and Terminating Operations
If RESET# is asserted during a program or erase
operation, the RY/BY# pin remains a “0” (busy) until
the internal reset operation is completed, which
requires a time of t
rithms). The system can thus monitor RY/BY# to
determine whether the reset operation is completed.
If RESET# is asserted when a program or erase
operation is not executing (RY/BY# pin is “1”), the
reset operation is completed within a time of t
(not during Embedded Algorithms). The system can
read data after the RESET# pin returns to V
requires a time of t
READY
RH.
(during Embedded Algo-
READY
, which
IH
RESET# tied to the System Reset
The RESET# pin may be tied to the system reset circuitry. A system reset would thus also reset the
In-System Protection
“In-system protection”, the primary method,
requires V
A6=0, A1=1, and A0=0. This method can be implemented either in-system or via programming equipment. This method uses standard microprocessor
bus cycle timing. Refer to Fig. 29 for timing diagram
and Fig. 3 for the protection algorithm.
(11.5V~12.5V) on the RESET# with
ID
A9 High-Voltage Protection
“High-voltage protection”, the alternate method
intended only for programming equipment, must
force V
trol pin OE# with A6=0, A1=1 and A0=0. Refer to
Fig. 31 for timing diagram and Fig. 5 for the protection algorithm.
(11.5~12.5V) on address pin A9 and con-
ID
SECTOR UNPROTECTION
The previously protected sectors must be unprotected before modifying any data in the sectors.
The sector unprotection algorithm unprotects all
sectors in parallel. All unprotected sectors must first
ES29LV320D
8
Rev. 2D Jan 5, 2006
ESI
ESI
Excel Semiconductor inc.
be protected prior to the first sector unprotection
write cycle to avoid any over-erase due to the intrinsic erase characteristics of the protection cell. After
the unprotection operation, all previously protected
sectors will need to be individually re-protected.
Standard microprocessor bus cycle timings are used
in the unprotection and unprotect verification operations. Three unprotect methods are provided in the
ES29LV320 device. All unprotection and unprotect
verification cycles are summarized in detail at the
Table 1.
-
-
-
In-system unprotection
A9 High-voltage unprotection
T emporary sector unprotection
In-System Unprotection
“In-system unprotection”, the primary method,
requires V
A6=1, A1=1, and A0=0. This method can be implemented either in-system or via programming equipment. This method uses standard microprocessor
bus cycle timing. Refer to Fig. 29 for timing diagram
and Fig. 4 for the unprotection algorithm.
(11.5V~12.5V) on the RESET# with
ID
If the system asserts V
on the WP#/ACC pin, the
IL
device disables program and erase func tions in the
two “outermost” 8Kbytes boo t sectors independently of whether those sectors were protected or
unprotected using the method described in “Sector
Group Protection and Unprotection”. The two outermost of 8 Kbyte boot sectors are the two sectors
containing the lowest addresses in a bottom-bootconfigured device, or the two sectors containing the
highest addresses in a top-boot-configured device.
If the system asserts V
on the WP#/ACC pin, the
IH
device reverts to whether the two outermost 8
Kbyte boot sectors were last set to be protected or
unprotected. That is, sector protection or unprotection for these two sectors depends on whether they
were last protected or unprotected using the
method described in “Sector Group Protection and
Unprotection”.
Note that the WP#/ACC pin must not be left floating
or unconnected; inconsistent behavior of the device
may result.
A9 High-Voltage Unprotection
“High-voltage unprotection”, the alternate method
intended only for programming equipment, must
force V
(11.5~12.5V) on address pin A9 and con-
ID
trol pin OE# with A6=1, A1=1 and A0=0. Refer to
Fig. 32 for timing diagram and Fig. 6 for the unprotection algorithm.
Temporary Sector Unprotect
This feature allows temporary unprotection of previously protected sectors to change data in-system.
The Sector Unprotect mode is activated by setting
the RESET# pin to V
(11.5V-12.5V). During this
ID
mode, formerly protected sectors can be programmed or erased by selecting the sector
addresses. Once V
is removed from the RESET#
ID
pin, all the previously protected sectors are protected again. Fig. 1 shows the algorithm, and Fig. 27
shows the timing diagrams for this feature.
WRITE PROTECT ( WP# )
The Write Protect function provides a hardware
method of protecting certain boot sectors without
using V
WP#/ACC pin.
. This function is one of two provided by the
ID
START
RESET# = V
(Note 1)
Perform Erase or
Program Operations
RESET# = V
Temporary Sector
Unprotect Completed
(Note 2)
Notes:
1. All protected sectors are unprotected (If WP#/ACC = VIL,
outermost boot sectors will remain protected).
2. All previously protected sectors are protected once again.
ID
IH
Figure 1. Temporary Sector Unprotect
Operation
ES29LV320D
9
Rev. 2D Jan 5, 2006
SECURITY SECTOR
The security sector of the ES29LV320 device provides an extra flash memory space that enables
permanent part identification through an Electronic
Serial Number (ESN). The security sector uses a
security lock-Indicator Bit (DQ7) to indicate
whether or not the security sector is locked when
shipped from the factory. This bit is permanently set
at the factory and cannot be changed, which prevents cloning of a factory locked part. This ensures
the security of the ESN once the product is shipped
to the field. Note that the ES29LV320 has a security
sector size of 256 bytes.
Security Lock-Indicator Bit (DQ7)
In the device, the security sector can be provided in
either factory locked version or customer lockable
version. The factory-locke d version is always protected when shipped from the factory, and has the
security lock-Indicator Bit permanently set to a “1”.
The customer-lockable version is shipped with
the security sector unprotected, allowing customers
to utilize the sector in any manner they choose. The
customer-lockable version has the security lockIndicator Bit permanently set to a “0”. Thus, the
security lock-Indicator Bit prevents customer-lockable devices from being used to replace devices
that are factory locked.
ESI
ESI
Excel Semiconductor inc.
- A random, secure ESN (16 bytes ) only
- Customer code through the ESI’s Special-Code
service
- Both a random, secure ESN and customer
code through the ESI’s Special-Code service.
ESN ( Electronic Serial Number )
In devices that have an ESN, a Bottom Boot device
will have the 16-byte (8-word) ESN in sector 0 at
addresses 000000h-00000Fh in byte mode (or
000000h-000007h in word mode). In the Top Boot
device the ESN will be in sector 70 at addresses
3FFF00h-3FFF0Fh in byte mode (or 1FFF80h1FFF87h in word mode). Note that in upcoming top
boot versions of this device, the ESN will be located
in sector 70 at addresses 3FFF00h-3FFF0Fh in byte
mode (or 1FFF80h-1FFF87h in word mode).
ESI’s Special-Code Service
Customers may opt to have their code programmed
by ESI through the ESI’s Special-Code service. ESI
programs the customer’s code, with or without the
random ESN. The devices are then shipped from
ESI’s factory with the Security Sector permanently
locked. Contact an ESI representative for details on
using ESI’s Special-Code service.
Customer-Lockable Device
Access to the Security Sector
The security sector can be accessed through a
command sequence: Enter security and Exitsecurity sector commands. After the system has
written the Enter security sector command
sequence, it may read the security sector by using
the addresses normally occupied by the boot sectors. This mode of operation continues until the system issues the Exit security sector command
sequence, or until power is removed from the
device. On power-up, or following a hardware reset,
the device returns to read mode in which the normal boot sectors can be accessed, instead of the
security sector.
Factory-Locked Device
In a factory-locked device, the security sector is
protected when the device is shipped from the factory. The security sector cannot be mo dified in any
way. The device is available preprogrammed with
one of the following:
The customer lockable version allows the security
sector to be freely programmed or erased and then
permanently locked. Note that the ES29LV320 has
a security sector size of 256 bytes (128 words). Note
that the accelerated programming (ACC) and unlock
bypass functions are not available when programming the security sector.
Protection of the Security Sector
The security sector area can be prot ected using the
following procedures: Write the three-cycle “Entersecurity sector command” sequence, and then following the in-system sector protect algorithm as
shown in Fig. 2, except that RESET# may be at
either V
of the security sector without raising any device pin
to a high voltage. Note that this method is only applicable to the security sector. To verify the protect/
unprotect status of the security sector. follow the
algorithm shown in Fig. 2.
or VID. This allows in-system protection
IH
ES29LV320D
10
Rev. 2D Jan 5, 2006
Start
RESET# =
or V
V
IH
ID
Wait 1us
Write 60h to
any address
Write 40h to security
sector address with
A6=0, A1=1,A0=0
Read from security
sector address with
A6=0,A1=1,A0=0
If data=00h, security
sector is unprotected.
If data=01h, security
sector is protected
Remove V
from RESET#
Write reset
command
Security sector
Protect Verify
complete
IH
or V
ID
ESI
ESI
Excel Semiconductor inc.
can only occur after successful completion of specific command sequences. And several features are
incorporated to prevent inadvertent write cycles
resulting from Vcc power-up and power-down transition or system noise.
Low Vcc Write inhibit
When Vcc is less than V
accept any write cycles. This protects data during
Vcc power-up and power-down. The command register and all internal program/erase circuits are disabled, and the device resets to the read mode.
Subsequent writes are ignored until Vcc is greater
than V
. The system must provide proper signals
LKO
to the control pins to prevent unintentional writes
when Vcc is greater than V
, the device does not
LKO
.
LKO
Write Pulse “Glitch” Protection
Noise pulses of less than 5ns (typical) on OE#, CE#
or WE# do not initiate a write cycle.
Figure 2. Security Sector Protect Verify
Exit from the Security Sector
Once the Security Sector is locked protected and
verified, the system must write the Exit Security
Sector Region command sequence to return to
reading and writing the remainder of the array.
Caution for the Security Sector Protection
The security sector protection must be used with
caution since, once protected, there is no procedure available for unprotecting the security sector
area and none of the bits in the security sector
memory space can be modified in any way.
HARDWARE DATA PROTECTION
The ES29LV320 device provides some protection
measures against accidental erasure or programming caused by spurious system level signals that
may exist during power transition. During powerup, all internal registers and latches in the device
are cleared and the device automatically resets to
the read mode. In addition, with its internal state
machine built-in the device, any alteration of the
memory contents or any initiation of new operation
Logical inhibit
Write cycles are inhibited by holding any one of
OE#=V
, CE#=VIH or WE#=VIH. To initiate a write
IL
cycle, CE# and WE# must be a logical zero while
OE# is a logical one.
Power-up Write Inhibit
If WE#=CE#=VIL and OE#=VIH during power up, the
device does not accept any commands on the rising
edge of WE#. The internal state machine is automatically reset to the read mode on power-up.
ES29LV320D
11
Rev. 2D Jan 5, 2006
Table 1. ES29LV320 Device Bus Operations
ESI
ESI
Excel Semiconductor inc.
OperationCE# OE# WE# RESET# WP#/ACCAddresses
Read
Accelerated ProgramLHLH
Standby
Output Disable
Reset
Sector Protect
(Note 2)
In-system
A9 High-Voltage Method
Sector Unprotect
(Note 2)LHLV
Temporary Sector UnprotectXXX
Sector protect
Sector unprotect
L
L
Vcc+
0.3V
LHHHL/HXHigh-ZHigh-Z
XXXLL/HXHigh-ZHigh-Z
LHL
L
L
H
L
L
H
XXVcc+
V
ID
V
ID
0.3V
L
L
HL/H
H(Note 3)
V
HH
HXHigh-ZHigh-Z
V
ID
ID
V
ID
H
H
L/H
L/H
(Note 3)
H
(Note 3)
H
(Note 3)
H
(Note 3)
(Note 1)
A
IN
A
IN
A
IN
SA,A6=L,
A1=H,A0=L
SA,A6=H,
A1=H,A0=L
A
IN
SA,A9=V
A6=L,
A1=H,A0=L
SA,A9=V
A6=H,
A1=H,A0=L
DQ0
~
DQ7
D
OUT
(Note 4)(Note 4)
(Note 4)(Note 4)
(Note 4)XX
(Note 4)XX
(Note 4)(Note 4)High-Z
,
ID
(Note 4)(Note 4)High-Z
,
ID
BYTE#
= V
D
OUT
DQ8~DQ15
IH
BYTE#
= V
IL
DQ8~DQ14 = High-Z,
DQ15 = A-1Write
High-Z
Legend:
A
L=Logic Low=VIL, H=Logic High=VIH, VID=11.5-12.5V, VHH=11.5-12.5V, X=Don’t Care, SA=Sector Address,
=Address In, DIN=Data In, D
IN
=Data Out
OUT
Notes:
1. Addresses are A20:A0 in word mode (BYTE#=VIH) , A20:A-1 in byte mode (BYTE#=VIL).
2. The sector protect and sector unprotect funct ions may als o be implement ed via programming eq uipment. See the “Sector/ Sector
Block Protection and Unprotection” section.
3. If WP#/ACC=V
, the two outermost boot sectors remain protected. If WP#/ACC=VIH, the two outermost boot sector protection
IL
depends on whether they were last protected or unprotected using the method described in “Sector/Sector Block Protection and
Unprotection”. If WP#/ACC=V
4. D
IN
or D
as required by command sequence, data polling, or sector protection algorithm.