Cypress S29XS128R User manual

S29VS256R
S29VS128R
S29XS256R
S29XS128R
256/128-Mbit (32/16 Mbyte), 1.8 V, 16-bit
Data Bus, Multiplexed MirrorBit® Flash
Cypress Semiconductor Corporation • 198 Champion Court • San Jose,CA 95134-1709 • 408-943-2600
Document Number: 002-00833 Rev. *L Revised May 27, 2019
Features
Single 1.8 V supply for read/program/erase (1.70–1.95 V)
65nm MirrorBit® Technology
Address and Data Interface Options
– Address and Data Multiplexed for reduced I/O count
(ADM) S29VS-R
– Address-High, Address-Low, Data Multiplexed for minimum
I/O count (AADM) S29XS-R
Simultaneous Read/Write operation
32-word Write Buffer
Bank architecture
– Eight-bank
Four 32-KB sectors at the top or bottom of memory array
255/127 of 128-KB sectors
Programmable linear (8/16-word) with wrap around and
continuous burst read modes
Secured Silicon Sector region consisting of 128 words each
for factory and customer
10-year data retention (typical)
Cycling Endurance: 100,000 cycles per sector (typical)
RDY output indicates data available to system
Command set compatible with JEDEC (42.4) standard
Hardware sector protection via VPP pin
Handshaking by monitoring RDY
Offered Packages
– 44-ball FBGA (6.2 mm  7.7 mm  1.0 mm)
Low VCC write inhibit
Write operation status bits indicate program and erase
operation completion
Suspend and Resume commands for Program and Erase
operations
Asynchronous program operation, independent of burst
control register settings
VPP input pin to reduce factory programming time
Support for Common Flash Interface (CFI)
General Description
The Cypress S29VS256/128R and S29XS256/128R are MirrorBit® Flash products fabricated on 65nm process technology. These
burst mode Flash devices are capable of performing simultaneous read and write operations with zero latency on two separate
banks using multiplexed data and address pins. These products can operate up to 108 MHz and use a single VCC of 1.7 V to 1.95 V
that makes them ideal for the demanding wireless applications of today that require higher density, better performance, and lowered
power consumption. The S29VS256/128R operates in ADM mode, while the S29XS256/128R can operate in the AADM mode.
Performance Characteristics
Read Access Times
Speed Option (MHz) 108
Max. Synch. Latency, ns (tIA) 72.34
Max. Synch. Burst Access, ns (tBACC) 6.75
Max. Asynch. Access Time, ns (tACC)80
Max OE# Access Time, ns (tOE)15
Current Consumption (typical values)
Continuous Burst Read @ 108 MHz 32 mA
Simultaneous Operation @ 108 MHz 71 mA
Program/Erase 30 mA
Standby Mode 30 µA
Typical Program & Erase Times
Single Word Programming 170 µs
Effective Write Buffer Programming (VCC) Per
Word 14.1 µs
Effective Write Buffer Programming (VPP) Per
Word 9 µs
Sector Erase (16 Kword Sector) 350 ms
Sector Erase (64 Kword Sector) 800 ms

Document Number: 002-00833 Rev. *L Page 2 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Contents
Ordering Information ............................................................ 3
Valid Combinations ................................................................. 3
Input/Output Descriptions and Logic Symbol ................... 4
Block Diagram ...................................................................... 5
Physical Dimensions/Connection Diagrams ..................... 6
Related Documents ................................................................ 6
Special Handling Instructions for FBGA Package .................. 6
Product Overview ................................................................. 8
Address Space Maps ........................................................... 9
Data Address and Quantity Nomenclature ........................... 10
Flash Memory Array ............................................................. 11
Address/Data Interface ......................................................... 13
Bus Operations ..................................................................... 14
Device ID and CFI (ID-CFI) .................................................. 15
Device Operations .............................................................. 17
Asynchronous Read ............................................................. 17
Synchronous (Burst) Read Mode
and Configuration Register .......................................... 18
Status Register ..................................................................... 25
Blank Check ......................................................................... 29
Simultaneous Read/Write ..................................................... 29
Writing Commands/Command Sequences .......................... 30
Program/Erase Operations ................................................... 30
Handshaking ......................................................................... 37
Hardware Reset .................................................................... 37
Software Reset ..................................................................... 37
Sector Protection/Unprotection ........................................ 39
Sector Lock/Unlock Command ............................................. 39
Sector Lock Range Command ............................................. 39
Hardware Data Protection Methods ......................................40
SSR Lock ...............................................................................40
Secure Silicon Region ...........................................................40
Power Conservation Modes ...............................................42
Standby Mode .......................................................................42
Automatic Sleep Mode ..........................................................42
Output Disable (OE#) ............................................................42
Electrical Specifications .....................................................43
Absolute Maximum Ratings ...................................................43
Operating Ranges .................................................................44
DC Characteristics .................................................................44
Capacitance ...........................................................................45
AC Test Conditions ................................................................46
Key to Switching Waveforms .................................................46
VCC Power-Up and Power Down ...........................................47
CLK Characterization ............................................................48
AC Characteristics .................................................................49
Appendix ..............................................................................57
Command Definitions ............................................................57
Device ID and Common Flash Memory Interface
Address Map .................................................................59
Revision History ..................................................................72
Document History Page ......................................................72
Sales, Solutions, and Legal Information ...........................75
Worldwide Sales and Design Support ............................75
Products .........................................................................75
PSoC® Solutions ...........................................................75
Cypress Developer Community ......................................75
Technical Support ..........................................................75

Document Number: 002-00833 Rev. *L Page 3 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
1. Ordering Information
The ordering part number is formed by a valid combination of the following:
1.1 Valid Combinations
Valid Combination list configurations are planned to be supported in volume for this device. Consult your local sales office to confirm
availability of specific valid combinations and to check on newly released combinations.
Notes:
1. Type 0 is standard. Specify other options as required.
2. BGA package marking omits leading S29 and packing type designator from ordering part number.
3. Industrial Temperature Range is also available. For device specification differences, please refer to the Specification Supplement with Publication Number
S29VS_XS-R_SP.
S29VS 256 R xx BH W 00 0
Packing Type
0 = Tray (standard; see note (Note 1))
3 = 13-inch Tape and Reel
Model Number
00 = Top
01 = Bottom
Temperature Range
W = Wireless (–25°C to +85°C)
Package Type and Material
B = Very Thin Fine-Pitch BGA, Low Halogen Lead (Pb)-Free Package
Speed Option (Burst Frequency)
0S = 83 MHz
AA = 104 MHz
AB = 108 MHz
Process Technology
R = 65 nm MirrorBit® Technology
Flash Density
256 = 256 Mb
128 = 128 Mb
Device Family
S29VS256R = 1.8 Volt-only Simultaneous Read/Write, Burst-Mode Address and Data
Multiplexed Flash Memory
S29XS256R = 1.8 Volt-only Simultaneous Read/Write, Burst-Mode Address Low,
Address High and Data Multiplexed Flash Memory
S29VS-R Valid Combinations (1) (2)
Model
Numbers
Package Type
(2)
Base Ordering
Part Number Speed Option
Package Type, Material,
and Temperature Range
Packing
Type
S29VS256R
0S, AA, AB BHW (3) 0, 3 (1) 00, 01 6.2 mm x 7.7 mm, 44-ball
S29VS128R
S29XS256R
S29XS128R

Document Number: 002-00833 Rev. *L Page 4 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
2. Input/Output Descriptions and Logic Symbol
Table 1 identifies the input and output package connections provided on the device.
Table 1. Input/Output Descriptions
Symbol Type Description
Amax – A16 Higher order address lines. Amax = A23 for VS256R, A22 for VS128R.
On the XS256R and XS128R, these inputs can be left unconnected in AADM mode.
A/DQ15 – A/DQ0 I/O Multiplexed Address/Data input/output
CE# Input Flash Chip Enable. Asynchronous relative to CLK.
OE# Input Output Enable. Asynchronous relative to CLK for the Burst mode.
WE# Input Write Enable
VCC Supply Device Power Supply
VCCQ Supply Input/Output Power Supply (must be ramped simultaneously with VCC)
VSS I/O Ground
VSSQ I/O Input/Output Ground
NC No Connect No Connected internally
RDY Output Ready. Indicates when valid burst data is ready to be read
CLK Input
The first rising edge of CLK in conjunction with AVD# low latches address input and activates
burst mode operation. After the initial word is output, subsequent rising edges of CLK increment
the internal address counter. CLK should remain low during asynchronous access
AVD# Input
Address Valid input. Indicates to device that the valid address is present on the address inputs
(address bits A15 – A0 are multiplexed, address bits Amax – A16 are address only).
VIL = for asynchronous mode, indicates valid address; for burst mode, cause staring address to
be latched on rising edge of CLK.
VIH = device ignores address inputs
RESET# Input Hardware Reset. Low = device resets and returns to reading array data.
VPP Input
Accelerated input.
At VHH, accelerates programming; automatically places device in unlock bypass mode.
At VIL, disables all program and erase functions.
Should be at VIH for all other conditions.
RFU Reserved Reserved for future use

Document Number: 002-00833 Rev. *L Page 5 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
3. Block Diagram
Figure 1. Simultaneous Operation Circuit
Notes:
1. Amax = A23 for S29VS/XS256R, A22 for S29VS/XS128R.
2. Bank(n) = 8 (S29VS/XS256/128R).
V
SS
V
CC
Bank Address
RESET#
VPP
WE#
CE#
AVD#
RDY
DQ15–DQ0
STATE
CONTROL
&
COMMAND
REGISTER
Bank 1
X-Decoder
Y-Decoder
Latches and
Control Logic
Bank 0
X-Decoder
Y-Decoder
Latches and
Control Logic
DQ15–DQ0
DQ15–DQ0
DQ15–DQ0
DQ15–DQ0
DQ15–DQ0
Bank (n-1)
Y-Decoder
X-Decoder
Latches and
Control Logic
Bank (n)
Y-Decoder
X-Decoder
Latches and
Control Logic
OE#
Status
Control
Amax–A0
Amax–A0
Amax–A0
Amax–A0
Bank Address
Bank Address
Bank Address
V
SSQ

Document Number: 002-00833 Rev. *L Page 6 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
4. Physical Dimensions/Connection Diagrams
This section shows the I/O designations and package specifications for the S29VS-R/S29XS-R.
4.1 Related Documents
The following document contains information relating to the S29VS-R/S29XS-R devices. Click on the title or go to www.cypress.com,
or request a copy from your sales office.
Considerations for X-ray Inspection of Surface-Mounted Flash Integrated Circuits
4.2 Special Handling Instructions for FBGA Package
Special handling is required for Flash Memory products in FBGA packages.
Flash memory devices in FBGA packages may be damaged if exposed to ultrasonic cleaning methods. The package and/or data
integrity may be compromised if the package body is exposed to temperatures above 150°C for prolonged periods of time.
4.2.1 44-Ball Very Thin Fine-Pitch Ball Grid Array, S29VS256R/S29XS256R/
S29VS128R/S29XS128R
Figure 2. 44-Ball Very Thin Fine-Pitch Ball Grid Array, Top View, Balls Facing Down
Notes:
1. Ball D7 is NC for S29VS128R.
2. Balls D7, C12, C4, D5, C10, D10, C11, D4 are NC for S29XS256R and S29XS128R
32910547681 1312 1411
NC NC
B
D
E
F
G
H
A
C
RDY VPP A19VSSA21 VCCCLK WE# A22A17
VCCQ NC A18A20A16 A23AVD# RESET# VSSQCE#
VSS A/DQ2 A/DQ9A/DQ6A/DQ7 A/DQ12A/DQ13 A/DQ3 OE#A/DQ8
A/DQ15 A/DQ10 VCCQVSSQA/DQ14 A/DQ4A/DQ5 A/DQ11 A/DQ0A/DQ1
NC NC

Document Number: 002-00833 Rev. *L Page 7 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
4.2.2 VDJ044-44-Ball Very Thin Fine-Pitch Ball Grid Array, 6.2 mm x 7.7 mm
Figure 3. VDJ044—44-Ball Very Thin Fine-Pitch Ball Grid Array
002-24745 **

Document Number: 002-00833 Rev. *L Page 8 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
5. Product Overview
The S29VS/XS-R family is 1.8-V only, simultaneous read/write, burst-mode, Flash devices. These devices have a 16 bit (word) wide
data bus. All read accesses provide 16 bits of data on each bus transfer cycle. All writes take 16 bits of data from each bus transfer
cycle.
The Flash memory array is divided into banks. A bank is the address range within which one program, or erase operation may be in
progress at the same time as one read operation is in progress in any other bank of the memory. This multiple bank structure
enables Simultaneous Read and Write (SRW) so that code may be executed or data read from one bank while a group of data is
programmed, or erased as a background task in one other bank.
Each bank is divided into sectors. A sector is the minimum address range of data which can be erased to an all Ones state. Most of
the sectors are 128 KBytes each. Depending on the option ordered, either the top-4 sectors or the bottom-4 sectors are 32 KBytes
each. These are called boot sectors because they are often used for holding boot code or parameters that need to be protected or
erased separately from other data in the Flash array.
Programming is done via a 64 Byte write buffer. It is possible to program from one to 32 words (64 bytes) in each programming
operation.
The S29VS/XS family is capable of continuous, synchronous (burst) read or linear read (8- or 16-word aligned group) with wrap
around. A wrapped burst begins at the initial location and continues to the end of an 8, or 16-word aligned group then
“wraps-around” to continue at the beginning of the 8, or 16-word aligned group. The burst completes with the last word before the
initial location. Word wrap around burst is generally used for processor cache line fill.
Device Mbits Mbytes Mwords Banks Mbytes / Bank
S29VS128R/S29XS128R 128 16 8 8 2
S29VS256R/S29XS256R 256 32 16 8 4

Document Number: 002-00833 Rev. *L Page 9 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
6. Address Space Maps
There are five address spaces within each device:
A Non-Volatile Flash Memory Array used for storage of data that may be randomly accessed by asynchronous or burst read
operations.
A Read Only Memory Array used for factory programmed permanent device characteristics information. This area contains the
Device Identification (ID) and Common Flash Interface (CFI) information.
A One Time Programmable (OTP) Non-volatile Flash array used for factory programmed permanent data, and customer
programmable permanent data. This is called the Secure Silicon Region (SSR).
An OTP location used to permanently protect the SSR. This is call the SSR Lock.
A volatile register used to configure device behavior options. This is called the Configuration Register.
The main Flash Memory Array is the primary and default address space but, it may be partially overlaid by the other four address
spaces with one alternate address space available at any one time. The location where the alternate address space is overlaid is
defined by the address provided in the command that enables each overlay. The portion of the command address that is sufficient to
select a sector is used to select the sector that is overlaid by an alternate Address Space Overlay (ASO).
Any address range, within the overlaid sector, not defined by an overlay address map, is reserved for future use. All read accesses
outside of an address map within the selected sector, return non-valid data. The locations will display actively driven data but the
meaning of whatever ones or zeros appear are not defined.
There are three operation modes for each bank that determine what portions of the address space are readable at any given time:
Read Mode
Embedded Algorithm (EA) Mode
Address Space Overlay (ASO) Mode
Each bank of the device can be in any operation mode but, only one bank can be in EA or ASO mode at any one time.
In Read Mode, a Flash Memory Array bank may be directly read by asynchronous or burst accesses from the host system bus. The
Control Unit (CU) puts all banks in Read mode during Power-on, a Hardware Reset, after a Command Reset, or after a bank is
returned to Read mode from EA mode.
In EA mode the Flash memory array data in a bank is stable but undefined, and effectively unavailable for read access from the host
system. While in EA mode the bank is used by the CU in the execution of commands. Typical EA mode operations are programming
or erasing of data in the Flash array. All other banks are available for read access while the one bank is in EA mode. This ability to
read from one bank while another bank is used in the execution of a command is called Simultaneous Read and Write (SRW) and
allows for continued operation of the system via the reading of data or execution of code from other banks while one bank is
programming or erasing data as a relatively long time frame background task.
In ASO mode, one of the overlay address spaces are overlaid in a bank (entered). That bank is in ASO mode and no other bank may
be in EA or ASO mode. All EA activity must be completed before entering any ASO mode. A command for entering an EA or ASO
mode while another bank is in EA or ASO mode will be ignored.
While an ASO mode is active (entered) in a bank, a read for Flash array data to any other bank is allowed. ASO mode selects a
specific sector for the overlaid address space. Other sectors in the ASO bank still provide Flash array data and may be read during
ASO mode.
The ASOs are functionally tied to the lowest address bank. The commands used to overlay (enter) these areas must select a sector
address within the lowest address bank.
While SSR Lock, SSR, or Configuration Register is overlaid only the SSR Lock, SSR, or Configuration Register respectively may be
programmed in the overlaid sector. While any of these ASO areas are being programmed the ASO bank switches to EA mode. The
ID/CFI and factory portion of the SSR ASO is not customer programmable.
The address nomenclature used in this document is a shorthand form that shows addresses are formed from a concatenation of
high order bits, sufficient to select a Sector Address (SA), with low order bits to select a location within the sector. When in Read
mode and reading from the Flash Array the entire address is used to select a specific word for asynchronous read or the starting
word address of a burst read. When writing a command, the address bits between SA and the command specified least significant
bits must be Zero to allow for future extension of an overlay address map.

Document Number: 002-00833 Rev. *L Page 10 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
6.1 Data Address and Quantity Nomenclature
A Bit is a single One or Zero data value. A Byte is a group of 8 bits aligned on an 8 bit boundary. A Word is a group of 16 bits aligned
on a 16 bit boundary.
Throughout this document quantities of data are generally expressed in terms of byte units. Example: most sectors have 128
Kilo Bytes of data and is written as 128 KBytes or 128 KB. Addresses are also expressed in byte units. A 128 KByte sector has
an address range from 00000h to 1FFFFh Byte locations. Byte units are used because most host systems and software for these
systems use byte resolution addresses. Software & hardware developers most often calculate code and data sizes in terms of bytes,
so this is more familiar terminology than describing data sizes in bits or words. In general, data units will not be abbreviated if
possible so that full unit names of Byte, Word, or bit are used. However, there may be cases where capital B is used for byte units
and lower case b is used for bit units, in situations where space is limited such as in table column headers.
In some cases data quantities will also be expressed in word or bit units in addition to the quantity shown in bytes. This may be done
as an aid to readers familiar with prior device generation documentation which often provided only word or bit unit values. Word units
may also be used to emphasize that, in the memory devices described in this documentation, data is always exchanged with the
host system in word units. Each bus cycle transfer of read or write data on the host system bus is a transfer 16 bits of data. A read
bus cycle is always a16 bit wide transfer of data to the host system whether the host system chooses to look at all the bits or not. A
write bus cycle is always a transfer of 16 bits to the memory device and the device will store all 16 bits to a register. In the case of a
program operation all 16 bits of each word to be programmed will be stored in the Flash array.
Because data is always transferred in word units, the memory devices being discussed use only the address signals from the
system necessary to select words. The host system byte address uses system address a0 to select bytes and a1 to select words.
Flash memories with word wide data paths have traditionally started their address signal numbering with A0 being the selector for
words because a byte select input is not needed. So, system address a-maximum to a1 are connected to Flash A-maximum to A0
(the documentation convention here is to use lower case for system address signal numbering and upper case for Flash address
signals). In prior generation Flash documentation, address values used in commands to the flash were documented from the
viewpoint of the Flash device - the bit pattern appearing on Flash address inputs A10 to A0. However, most software is written with
addresses expressed in bytes. This means the address patterns shown in Flash command tables have traditionally been shifted by
one bit to express them as byte address values in Flash control programs. Example: a prior generation Flash data sheet would show
a command write of data value xxA0h to address 555h; this is an address pattern of 10101010101b on Flash address inputs A10 to
A0; but software would define this as a byte address value of AAAh since the least significant address bit is not used by the Flash);
which is 101010101010b on system address bus a11 to a0. Because system a11 to a1 is connected to Flash A10 to A0 the Flash
word address of 555h and the system byte address of AAAh provides the same bit pattern on the same address inputs. Because all
address values are being documented as system byte addresses, that are more familiar to software writers, the command tables
have addresses that are shifted from those shown in prior generation devices.

Document Number: 002-00833 Rev. *L Page 11 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
6.2 Flash Memory Array
The Non-Volatile Flash Memory Array is organized as shown in the following tables. Devices are factory configured to have either all
uniform size sectors or four smaller sectors at either the top of the device.
Note:
All tables have been condensed to show sector-related information for an entire device on a single page. Sectors and their address ranges that are not explicitly listed
(such as SA008–SA009) have sector starting and ending addresses that form the same pattern as all other sectors of that size. For example, all 128 KB sectors have the
byte address pattern x000000h–x1FFFFh.
Table 2. System Versus Flash View of Address
System Address Signals a11 a10 a9 a8 a7 a6 a5 a4 a3 a2 a1 a0
System Byte Address Hex AAA
Binary Pattern 101010101010
Flash Word Address Hex 55 5
Flash Address Signals A10A9A8A7A6A5A4A3A2A1A0
Table 3. S29VS/XS256R Sector and Memory Address Map (Top Boot)
Bank
Size
(Mbit)
Sector
Count
Sector Size
(KByte) Bank Sector Range
Address
Range (word)
Address
Range (byte) Notes
32
224 128
0 SA000-SA031 000000h–1FFFFFh 000000h–3FFFFFh
Sector Starting
Address –
Sector Ending
Address
1 SA032–SA063
… …
2 SA064–SA095
… …
3 SA096–SA127
… …
4 SA128–SA159
… …
5 SA160–SA191
… …
6 SA192–SA223
… …
31 128
7
SA224–SA254 E00000h–FEFFFFh 1C00000h–1FDFFFFh
432
SA255 FF0000h–FF3FFFh 1FE0000h–1FE7FFFh
SA256 FF4000h-FF7FFFh 1FE8000h-1FEFFFFh
SA257 FF8000h–FFBFFFh 1FF0000h–1FF7FFFh
SA258 FFC000h–FFFFFFh 1FF8000h–1FFFFFFh

Document Number: 002-00833 Rev. *L Page 12 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Note:
All tables have been condensed to show sector-related information for an entire device on a single page. Sectors and their address ranges that are not explicitly listed
(such as SA008–SA009) have sector starting and ending addresses that form the same pattern as all other sectors of that size. For example, all 128 KB sectors have the
byte address pattern x000000h–x1FFFFh.
Note:
All tables have been condensed to show sector-related information for an entire device on a single page. Sectors and their address ranges that are not explicitly listed
(such as SA008–SA009) have sector starting and ending addresses that form the same pattern as all other sectors of that size. For example, all 128 KB sectors have the
byte address pattern x000000h–x1FFFFh.
Table 4. S29VS/XS256R Sector and Memory Address Map (Bottom Boot)
Bank
Size
(Mbit)
Sector
Count
Sector Size
(Kbyte) Bank Sector Range
Address
Range (word)
Address
Range (byte) Notes
32
432
0
SA000 000000h–003FFFh 000000h–007FFFh
Sector Starting
Address –
Sector Ending
Address
SA001 004000h–007FFFh 008000h–00FFFFh
SA002 008000h–00BFFFh 010000h–017FFFh
SA003 00C000h–00FFFFh 018000h–01FFFFh
31 128 SA004–SA034 010000h–1FFFFFh 020000h–3FFFFFh
224 128
1 SA035–SA066
… …
2 SA067–SA098
… …
3 SA099–SA130
… …
4 SA131–SA162
… …
5 SA163–SA194
… …
6 SA195–SA226
… …
7 SA227–SA258 E00000h–FFFFFFh 1C00000h–1FFFFFFh
Table 5. S29VS/XS128R Sector and Memory Address Map (Top Boot)
Bank
Size
(Mbit)
Sector
Count
Sector Size
(KByte) Bank Sector Range
Address
Range (word)
Address
Range (byte) Notes
16
112 128
0 SA000-SA015 000000h–0FFFFFh 000000h–1FFFFFh
Sector Starting
Address –
Sector Ending
Address
1 SA016–SA031
… …
2 SA032–SA047
… …
3 SA048–SA063
… …
4 SA064–SA079
… …
5 SA080–SA095
… …
6 SA096–SA111
… …
15 128
7
SA112–SA126 700000h–7EFFFFh E00000h–FDFFFFh
432
SA127 7F0000h–7F3FFFh FE0000h–FE7FFFh
SA128 7F4000h-7F7FFFh FE8000h-FEFFFFh
SA129 7F8000h–7FBFFFh FF0000h–FF7FFFh
SA130 7FC000h–7FFFFFh FF8000h–FFFFFFh

Document Number: 002-00833 Rev. *L Page 13 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Note:
All tables have been condensed to show sector-related information for an entire device on a single page. Sectors and their address ranges that are not explicitly listed
(such as SA008–SA009) have sector starting and ending addresses that form the same pattern as all other sectors of that size. For example, all 128 KB sectors have the
byte address pattern x000000h–x1FFFFh.
6.3 Address/Data Interface
There are two options for connection to the address and data buses.
Address and Data Multiplexed (ADM) mode. On the S29VS-R devices, the upper address is supplied on separate signal inputs
and the lower 16-bits of address are multiplexed with 16-bit data on the A/DQ15 to A/DQ0 I/Os.
Address-high, Address-low, and Data Multiplexed (AADM) mode. On the S29XS-R devices, the upper and lower address are
multiplexed with 16-bit data on the A/DQ15 to A/D0 signal I/Os.
The two options allow use with the traditional address/data multiplexed NOR interface (S29NS family), or an address
multiplexed/data multiplexed interface with the lowest signal count.
6.3.1 ADM Interface (S29VS256R and S29VS128R)
A number of processors use ADM interface as a way to reduce pin count. The system permanently connects the upper address bits
(A[MAX:16] to the device. When AVD# is LOW it connects A[15:0] to DQ[15:0]. The address is latched on the rising edge of AVD#.
When AVD# is HIGH, the system connects the data bus to DQ[15:0]. This results in 16-pin savings from the traditional Address and
Data in Parallel (ADP) interface.
6.3.2 AADM Interface (S29XS256R and S29XS128R)
Signal input and output (I/O) connections on a high complexity component such as an Application Specific Integrated Circuit (ASIC)
are a limited resource. Reducing signal count on any interface of the ASIC allows for either more features or lower package cost.
The memory interface described in this section is intended to reduce the I/O signal count associated with the Flash memory interface
with an ASIC.
The interface is called Address-High, Address-Low, and Data Multiplexed (AADM) because all address and data information is time
multiplexed on a single 16-bit wide bus. This interface is electrically compatible with existing ADM 16-bit wide random access static
memory interfaces but uses fewer address signals. In that sense AADM is a signal count subset of existing static memory interfaces.
This interface can be implemented in existing memory controller designs, as an additional mode, with minimal changes. No new
I/O technology is needed and existing memory interfaces can continue to be supported while the electronics industry adopts this
new interface. ASIC designers can reuse the existing memory address signals above A15 for other functions when an AADM
memory is in use.
Table 6. S29VS/XS128R Sector and Memory Address Map (Bottom Boot)
Bank
Size
(Mbit)
Sector
Count
Sector Size
(Kbyte) Bank Sector Range
Address
Range (word)
Address
Range (byte) Notes
16
432
0
SA000 000000h–003FFFh 000000h–007FFFh
Sector Starting
Address –
Sector Ending
Address
SA001 004000h–007FFFh 008000h–00FFFFh
SA002 008000h–00BFFFh 010000h–017FFFh
SA003 00C000h–00FFFFh 018000h–01FFFFh
15 128 SA004–SA018 010000h–0FFFFFh 020000h–1FFFFFh
112 128
1 SA019–SA034
… …
2 SA035–SA050
… …
3 SA051–SA066
… …
4 SA067–SA082
… …
5 SA083–SA098
… …
6 SA099–SA114
… …
7 SA115–SA130 700000h–7FFFFFh E00000h–FFFFFFh

Document Number: 002-00833 Rev. *L Page 14 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
By breaking up the memory address in to two time slots the address is naturally extended to be a 32-bit word address. But, using
two bus cycles to transfer the address increases initial access latency by increasing the time address is using the bus. However,
many memory accesses are to locations in memory nearby the previous access. Very often it is not necessary to provide both cycles
of address. This interface stores the high half of address in the memory so that if the high half of address does not change from the
previous access, only the low half of address needs to be sent on the bus. If a new upper address is not captured at the beginning of
an access the last captured value of the upper address is used. This allows accesses within the same 128-KByte address range to
provide only the lower address as part of each access.
In AADM mode two signal rising edges are needed to capture the upper and lower address portions in asynchronous mode or two
signal combinations over two clocks is needed in synchronous mode. In asynchronous mode the upper address is captured by an
AVD# rising edge when OE# is Low; the lower address is captured on the rising edge of AVD# with OE# High. In synchronous mode
the upper address is captured at the rising clock edge when AVD# and OE# are Low; the lower address is captured at the rising
edge of clock when AVD# is Low and OE# is High.
CE# going High at any time during the access or OE# returning High after RDY is first asserted High during an access, terminates
the read access and causes the address/data bus direction to switch back to input mode. The address/data bus direction switches
from input to output mode only after an Address-Low capture when AVD# is Low and OE# is High. This prevents the assertion of
OE# during Address-High capture from causing a bus conflict between the host address and memory data signals. Note, in burst
mode, this implies at least one cycle of CE# or OE# High before an Address-high for a new access may be placed on the bus so that
there is time for the memory to recognize the end of the previous access, stop driving data outputs, and ignore OE# so that assertion
of OE# with the new Address-high does not create a bus conflict with a new address being driven on the bus. At high bus
frequencies more than one cycle may be need in order to allow time for data outputs to stop driving and new address to be driven
(bus turn around time).
During a write access, the address/data bus direction is always in the input mode.
The upper address is set to Zero or all Ones, for bottom or top boot respectively, during a Hardware Reset, operate in ADM mode
during the early phase of boot code execution where only a single address cycle would be issued with the lower 16 bit of the address
reaching the memory in AADM mode. The default high order address bits will direct the early boot accesses to the 128 Kbytes at the
boot end of the device. Note that in AADM interface mode this effectively requires that one of the boot sectors is selected for any
address overlay mode because in the initial phase of AADM mode operation the host memory controller may only issue the low
order address thus limiting the early boot time address space to the 128 Kbytes at the boot end of the device.
6.3.3 Default Access Mode
Upon power-up or hardware reset, the device defaults to the Asynchronous Access mode.
6.4 Bus Operations
Table 7 describes the required state of each input signal for each bus operation.
Table 7. Device Bus Operations
Operation CE# OE# WE# CLK AVD# A28-A16 A/DQ 15-A/DQ0 RESET#
Standby & Reset
Standby (CE# deselect) H X X X X X High-Z H
Hardware Reset X X X X X X High-Z L
Asynchronous Mode Operations
Asynchronous Address Latch
(S29VS256R and S29VS128R) L H X X Addr In Addr In H
Asynchronous Upper Address Latch
(S29XS256R and S29XS128R Only) L L H X X Addr In H
Asynchronous Lower Address Latch
(S29XS256R and S29XS128R Only) L H X X X Addr In H
Asynchronous Read L L H X H X Data Output Valid H
Asynchronous Write Latched Data L H X H X Data Input Valid H

Document Number: 002-00833 Rev. *L Page 15 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Legend:
L = Logic 0, H = Logic 1, X = can be either VIL or VIH. = rising edge.
Note:
1. Data is delivered by a read operation only after the burst initial wait state count has been satisfied.
6.5 Device ID and CFI (ID-CFI)
There are two traditional methods for systems to identify the type of Flash memory installed in the system. One has been
traditionally been called Autoselect and is now referred to as Device Identification (ID). A command is used to enable an address
space overlay where up to 16 word locations can be read to get JEDEC manufacturer identification (ID), device ID, and some
configuration and protection status information from the Flash memory. The system can use the manufacturer and device IDs to
select the appropriate driver software to use with the Flash device. The other method is called Common Flash Interface (CFI). It also
uses a command to enable an address space overlay where an extendable table of standard information about how the Flash
memory is organized and behaves can be read. With this method the driver software does not have to be written with the specifics of
each possible memory device in mind. Instead the driver software is written in a more general way to handle many different devices
but adjusts the driver behavior based on the information in the CFI table stored in the Flash memory. Traditionally these two address
spaces have used separate commands and were separate overlays. However, the mapping of these two address spaces are
non-overlapping and so can be combined in to a single address space and appear together in a single overlay. Either of the
traditional commands used to access (enter) the Autoselect (ID) or CFI overlay will cause the now combined ID-CFI address map to
appear.
A write at any sector address, in bank zero, having the least significant byte address value of AAh, with xx98h or xx90h data,
switches the addressed sector to an overlay of the ID-CFI address map. These are called ID-CFI Enter commands and are only valid
when written to the specified bank when it is in read mode. The ID-CFI address map appears within, and replaces Flash Array data
of, the selected sector address range. The ID-CFI enter commands use the same address and data values used on previous
generation memories to access the JEDEC Manufacturer ID (Autoselect) and Common Flash Interface (CFI) information,
respectively. While the ID-CFI address space is overlaid, any write with xxF0h data to the device will remove the overlay and return
the selected sector to showing Flash memory array data. Thus, the ID-CFI address space and commands are backward compatible
with standard memory discovery algorithms.
Within the ID-CFI address map there are two subsections:
For the complete address map, see Tables in Section 11.2, Device ID and Common Flash Memory Interface Address Map
on page 59.
Synchronous Mode Operations
Latch Starting Burst Address by CLK
- ADM mode L H H L Addr In Addr In H
Latch Upper Starting Burst Address by CLK
(S29XS256R and S29XS128R Only) L L H L X Addr In H
Latch Lower Starting Burst Address by CLK
(S29XS256R and S29XS128R Only) L H H L X Addr In H
Burst Read and advance to next address (1) L L H H X Data Output Valid H
Terminate current Burst cycle X X X X X High-Z H
Table 7. Device Bus Operations (Continued)
Operation CE# OE# WE# CLK AVD# A28-A16 A/DQ 15-A/DQ0 RESET#
Table 8. ID-CFI Address Map Overview
Byte Address Description Size Allocated (Bytes) Read/Write
(SA) + 00000h to 0001Fh JEDEC ID (traditional Autoselect values) 32 Read Only
(SA) + 00020h to CEh h CFI data structure 174 Read Only

Document Number: 002-00833 Rev. *L Page 16 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
6.5.1 JEDEC Device ID
The Joint Electron Device Engineering Council (JEDEC) standard JEP106T defines a method for reading the manufacturer ID and
device ID of a compliant memory. This information is primarily intended for programming equipment to automatically match a device
with the corresponding programming algorithm.
The JEDEC ID information is structured to work with any memory data bus width e.g. x8, x16, x32. The code values are always byte
wide but are located at bus width address boundaries such that incrementing the device address inputs will read successive byte,
word, or double word locations with the codes always located in the least significant byte location of the data bus. Because the data
bus is word wide each code byte is located in the lower half of each word location and the high order byte is always zero.
6.5.2 Common Flash Memory Interface
The Common Flash Interface (CFI) specification defines a standardized data structure that may be read from a flash memory
device, which allows vendor-specified software algorithms to be used for entire families of devices. The data structure contains
information for system configuration such as various electrical and timing parameters, and special functions supported by the
device. Software support can then be device-independent, JEDEC ID-independent, and forward-and-backward-compatible for the
specified flash device families.
The system can read CFI information at the addresses within the selected sector as shown in Section 11.2, Device ID and Common
Flash Memory Interface Address Map on page 59.
Like the JEDEC Device ID information, CFI information is structured to work with any memory data bus width e.g. x8, x16, x32. The
code values are always byte wide but are located at data bus width address boundaries such that incrementing the device address
reads successive byte, word, or double word locations with the codes always located in the least significant byte location of the data
bus. Because the data bus is word wide each code byte is located in the lower half of each word location and the high order byte is
always zero.
For further information, please refer to the Cypress CFI Version 1.4 (or later) Specification and the Cypress CFI Publication 100 (see
also JEDEC publications JEP137-A and JESD68.01). Please contact JEDEC (http://www.jedec.org) for their standards and the
Cypress CFI Publications may be found at the Cypress Web site
(http://www.cypress.com/appnotes/CFI_v1.4_VendorSpec_Ext_A1.pdf at the time of this document’s publication).
6.5.3 Secured Silicon Region
The Secured Silicon region provides an extra Flash memory area that can be programmed once and permanently protected from
further changes. The Secured Silicon Region is 512 bytes in length. It consists of 256 bytes for factory data and 256 bytes for
customer-secured data.
The Secured Silicon Region (SSR) is overlaid in the sector address specified by the SSR enter command.
6.5.4 Configuration Register
The Configuration Register Enter command is only valid when written to a bank that is in Read mode. The configuration register
mode address map appears within, and replaces Flash Array data of, the selected sector address range. The meaning of the
configuration register bits is defined in the configuration register operation description. In configuration register mode, a write of
00F0h to any address will return the sector to Read mode.
Table 9. Secured Silicon Region
Byte Address Range Secure Silicon Region Size
(SA) + 0000h to 00FFh Factory 256 Bytes
(SA) + 0100h to 01FFh Customer 256 Bytes

Document Number: 002-00833 Rev. *L Page 17 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
7. Device Operations
This section describes the read and write bus operations, program, erase, simultaneous read/write, handshaking, and reset features
of the Flash devices.
The address space of the Flash Memory Array is divided into banks. There are three operation modes for each bank:
Read Mode
Embedded Algorithm (EA) Mode
Address Space Overlay (ASO) Mode
Each bank of the device can be in any operation mode but, only one bank can be in EA or ASO mode at any one time.
In Read Mode a Flash Memory Array bank may be read by simply selecting the memory, supplying the address, and taking read
data when it is ready. This is done by asynchronous or burst accesses from the host system bus. The CU puts all banks in Read
mode during Power-on, a Hardware Reset, after a Command Reset, or after a bank is returned to Read mode from EA mode.
During a burst read access valid read data is indicated by the RDY signal being High. When RDY is Low burst read data is not valid
and wait states must be added. The use of the RDY signal to indicate when valid data is transferred on the system data bus is called
handshaking or flow control.
EA and ASO modes are initiated by writing specific address and data patterns into command registers (see Table 43 on page 57).
The command registers do not occupy any memory locations; they are loaded by write bus cycles with the address and data
information needed to execute a command. The contents of the registers serve as input to the Control Unit (CU) and the CU dictates
the function of the device. Writing incorrect address and data values or writing them in an improper sequence may place the device
in an unknown state, in which case the system must write the reset command to return all banks to Read mode.
The Flash memory array data in a bank that is in EA mode, is stable but undefined, and effectively unavailable for read access from
the host system. While in EA mode the bank is used by the CU in the execution of commands. Typical command operations are
programming or erasing of data in the Flash array. All other banks are available for read access while the one bank is in EA mode.
This ability to read from one bank while another bank is used in the execution of a command is called Simultaneous Read and Write
(SRW) and allows for continued operation of the system via the reading of data or code from other banks while one bank is
programming or erasing data as a relatively long time frame background task. Only a status register read command can be used in
a bank in EA mode to retrieve the EA status.
While any one of the overlay address spaces are overlaid in a bank (entered) that bank is in ASO mode and no other bank may be
in EA or ASO mode. All EA activity must be completed or suspended before entering any ASO mode. A command for entering an EA
or ASO mode while another bank is in EA or ASO mode will be ignored.
While an ASO mode is active (entered) in a bank, a read for Flash array data to any other bank is allowed. ASO mode selects a
specific sector for the overlaid address space. Other sectors in the ASO bank still provide Flash array data and may be read during
ASO mode.
While SSR Lock, SSR, or Configuration Register is overlaid only the SSR Lock, SSR, or Configuration Register respectively may be
programmed in the overlaid sector. While any of these ASO areas are being programmed the ASO bank switches to EA mode. The
ID/CFI and factory portion of the SSR ASO is not customer programmable. An attempt to program in these areas will fail.
7.1 Asynchronous Read
The device defaults to reading array data asynchronously after device power-up or hardware reset. The device is in the
Asynchronous mode when Bit 15 of the Configuration register is set to '1'. To read data from the memory array, the system must first
assert CE# and AVD# to VIL with WE# at VIH and a valid address.
Address access time (tACC) is equal to the delay from stable addresses to valid output data. The chip enable access time (tCE) is the
delay from stable CE# to valid data at the outputs. See 10.9.2, AC Characteristics–Asynchronous Read on page 50. Any input on
CLK is ignored while in Asynchronous mode.

Document Number: 002-00833 Rev. *L Page 18 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
7.1.1 S29VS-R ADM Access
With CE# at VIL, WE# at VIH, and OE# at VIH, the system presents the address to the device and drives AVD# to VIL. AVD# is kept
at VIL for at least tAVDP ns. The address is latched on the rising edge of AVD#.
7.1.2 S29XS-R AADM Access
With CE# at VIL, WE# at VIH, and OE# at VIL, the system presents the upper address bits to DQ and drives AVD# to VIL. The upper
address bits are latched when AVD# transitions to VIH. The system then drives AVD# to VIL again, with OE# at VIH and the lower
address bits on the DQ signals. The lower address bits are latched on the next rising edge of AVD#.
7.2 Synchronous (Burst) Read Mode and Configuration Register
The device is capable of continuous sequential burst operation and linear burst operation of a preset length.
In order to use Synchronous (Burst) Read Mode the configuration register bit 15 must be set to 0.
Prior to entering burst mode, the system should determine how many wait states are needed for the initial word of each burst access
(see table below), what mode of burst operation is desired, how the RDY signal transitions with valid data, and output drive strength.
The system would then write the configuration register command sequence. See Configuration Register on page 23 for further
details.
When the appropriate number of Wait States have occurred, data is output after the rising edge of the CLK. Subsequent words are
output tBACC after the rising edge of each successive clock cycle, which automatically increments the internal address counter. RDY
indicates the initial latency and any subsequent waits.
7.2.1 S29VS-R ADM Access
To burst read data from the memory array in ADM mode, the system must assert CE# to VIL, and provide a valid address while
driving AVD# to VIL for one cycle. OE# must remain at VIH during the one cycle that AVD# is at VIL. The data appears on A/DQ15
-A/DQ0 when CE# remains at VIL, after OE# is driven to VIL and the synchronous access times are satisfied. The next data in the
burst sequence is read on each clock cycle that OE# and CE# remain at VIL.
OE# does not terminate a burst access if it rises to VIH during a burst access. The outputs will go to high impedance but the burst
access will continue until terminated by CE# going to VIH, or AVD# returns to VIL with a new address to initiate a another burst
access.
7.2.2 S29XS-R AADM Access
To burst read data from the memory array in AADM mode, the system must assert CE# to VIL, OE# must be driven to VIL with AVD#
for one cycle while the upper address is valid. The rising edge of CLK when OE# and AVD# are at VIL captures the upper 16 bits of
address. The rising edge of CLK when OE# is at VIH and AVD# is at VIL latches the lower 16 bits of address. The data appears on
A/DQ15 -A/DQ0 when CE# remains at VIL, after OE# is driven to VIL and the synchronous access times are satisfied. The next data
in the burst sequence is read on each clock cycle that OE# and CE# remain at VIL.
Once OE# returns to VIH during a burst read the OE# no longer enables the outputs until after AVD# is at VIL with OE# at VIH - which
signals that address-low has been captured for the next burst access. This is so that OE# at VIL may be used in conjunction with
AVD# at VIL to indicate address-high on the A/DQ signals without enabling the A/DQ outputs, thus avoiding data output contention
with Address-high.
The device has a fixed internal address boundary that occurs every 256 Bytes (128 words). A boundary crossing latency of one or
two additional wait states may be required. The device also reads data in 16 byte (8 word) aligned and length groups. When the
initial address is not aligned at the beginning of a 16 byte boundary, additional wait states may be needed when crossing the first 16
byte boundary. The number of additional wait states depends on the clock frequency and starting address location.

Document Number: 002-00833 Rev. *L Page 19 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Table 10 through Table 18 provide the latency for initial and boundary crossing wait state operation (note that ws = wait state).
Note:
The default initial wait state delay after power on or reset is 13 wait states.
Note:
1. This column applies to the 256 Byte boundary only.
Note:
1. This column applies to the 256 Byte boundary only.
Table 10. Initial Wait State vs. Frequency
Wait State Frequency (Maximum MHz)
327
440
554
666
780
895
9 104
10 120
Table 11. Address Latency for 10 -13 Wait States
Word Initial Wait Subsequent Clock Cycles After Initial Wait States
0
10 -13 wait states
D0 D1 D2 D3 D4 D5 D6 D7 +2 ws (1) D8
1 D1D2D3D4D5D6D71 ws+2 wsD8
2 D2D3D4D5D6D71 ws1 ws+2 wsD8
3 D3D4D5D6D71 ws1 ws1 ws+2 wsD8
4 D4 D5 D6 D7 1 ws 1 ws 1 ws 1 ws +2 wsD8
5 D5 D6 D7 1 ws 1 ws 1 ws 1 ws 1 ws +2 ws D8
6 D6 D7 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws +2 ws D8
7 D7 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws +2 ws D8
Table 12. Address Latency for 9 Wait States
Word Initial Wait Subsequent Clock Cycles After Initial Wait States
0
9 wait states
D0 D1 D2 D3 D4 D5 D6 D7 +1 ws (1) D8
1 D1D2D3D4D5D6D71 ws+1 wsD8
2 D2D3D4D5D6D71 ws1 ws+1 wsD8
3 D3D4D5D6D71 ws1 ws1 ws+1 wsD8
4 D4 D5 D6 D7 1 ws 1 ws 1 ws 1 ws +1 ws D8
5 D5 D6 D7 1 ws 1 ws 1 ws 1 ws 1 ws +1 ws D8
6 D6 D7 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws +1 ws D8
7 D7 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws +1 ws D8

Document Number: 002-00833 Rev. *L Page 20 of 74
S29VS256R
S29VS128R
S29XS256R
S29XS128R
Table 13. Address Latency for 8 Wait States
Word Initial Wait Subsequent Clock Cycles After Initial Wait States
0
8 wait states
D0 D1 D2 D3 D4 D5 D6 D7 D8
1 D1D2D3D4D5D6D71 wsD8
2 D2D3D4D5D6D71 ws1 wsD8
3 D3D4D5D6D71 ws1 ws1 wsD8
4 D4 D5 D6 D7 1 ws 1 ws 1 ws 1 ws D8
5 D5D6 D7 1 ws1 ws1 ws1 ws1 wsD8
6 D6 D7 1 ws 1 ws 1 ws 1 ws 1 ws 1 ws D8
7 D71 ws1 ws1 ws1 ws1 ws1 ws1 wsD8
Table 14. Address Latency for 7 Wait States
Word Initial Wait Subsequent Clock Cycles After Initial Wait States
0
7 wait states
D0 D1 D2 D3 D4 D5 D6 D7 D8
1 D1D2D3D4D5D6D7D8D9
2 D2D3D4D5D6D71 wsD8D9
3 D3D4D5D6D71 ws1 wsD8D9
4 D4D5D6D71 ws1 ws1 wsD8D9
5 D5D6 D7 1 ws1 ws1 ws1 wsD8D9
6 D6D7 1 ws1 ws1 ws1 ws1 wsD8D9
7 D71 ws1 ws1 ws1 ws1 ws1 wsD8D9
Table 15. Address Latency for 6 Wait States
Word Initial Wait Subsequent Clock Cycles After Initial Wait States
0
6 wait states
D0 D1 D2 D3 D4 D5 D6 D7 D8
1 D1D2D3D4D5D6D7D8D9
2 D2D3D4D5D6D7D8D9D10
3 D3D4D5D6D71 wsD8D9D10
4 D4 D5 D6 D7 1 ws 1 ws D8 D9 D10
5 D5 D6 D7 1 ws 1 ws 1 ws D8 D9 D10
6 D6D7 1 ws1 ws1 ws1 wsD8D9D10
7 D71 ws1 ws1 ws1 ws1 wsD8D9D10