APPLICATION NOTE Serial Flash Secured OTP Area Introduction 1. Introduction Macronix Serial Flash provides an additional 512 bits or 4K bits of secured OTP (One Time Programmable) memory that resides outside the main memory array. This OTP memory area provides a “one time program” function to permanently store information. The OTP area can be programmed and locked by the factory before shipping or programmed and locked by the customer later. This application note will explain how the customer can use this OTP area as extra memory. 2. Factory Locked and Customer Locked Normally, serial flash are shipped from the factory with the OTP area unprogrammed (all FFh) and unlocked. Through “Special Order”, customers can request that the factory program an ESN (Electronic Serial Number) into the OTP area and then lock the OTP area so that it cannot be altered. 2-1. Factory Locked In a Factory Locked device, the factory pre-programs a 128-bit ESN into the OTP area and locks the entire OTP area before shipping. Bit0 (Secured OTP indicator bit) of the Security Register will also be set to ‘1’ indicating that the device was factory locked. Since this bit cannot be set by the customer, cloning a factory locked device would be extremely difficult and provides a higher level of security. To order factory locked devices, please contact Macronix sales directly. Tables 2-1 and 2-2 show the Secured OTP structure and usage for factory and customer locked devices. To determine the Secured OTP memory size of a serial flash device, refer to its datasheet or Table 7-1. Table 2-1: 512-bit Secured OTP Format Address range Size xxxx00~xxxx0F xxxx10~xxxx3F 128 bits 384 bits Table 2-2: 4K-bit Secured OTP Format Address range Size xxxx00~xxxx0F xxxx10~xxx1FF P/N: AN-0218 128 bits 3968 bits Standard Factory Lock Customer Lock ESN (electronic serial number) N/A Determined by customer Standard Factory Lock Customer Lock ESN (electronic serial number) N/A Determined by customer 1 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction 2-2. Customer Locked In a Customer Locked device, bit0 of the Security Register remains set to ‘0’, indicating that the Secured OTP memory has not been programmed or protected at the factory. In this state, the Secured OTP area is available for use as extra OTP memory space. The bits of the OTP memory area can be programmed to ‘0’, but there is no means to change a ‘0’ bit back to a ‘1’. If the user wants to protect the OTP from further updates, the Secured OTP area can be permanently locked-down by setting bit1 (LDSO) of the Security Register to ‘1’. The LDSO bit is OTP. Once it has been set to ‘1’, the Secured OTP area becomes permanently locked and can no longer be programmed. Table 2-3 shows the Security Register bit definitions. Users should refer to the datasheet for more detailed information about setting the Security Register values. Table 2-3: Security Register Bit Definitions bit7 bit6 bit5 bit4 WPSEL 1= individual WP mode non-volatile bit OTP bit3 bit2 bit1 bit0 Secured OTP indicator bit E_FAIL P_FAIL Continuously Program x x LDSO (lock-down OTP) 1= erase fail 1= program fail 1= CP mode reserved reserved 1= lock-down 1 = factory lock volatile bit volatile bit volatile bit reserved reserved non-volatile bit non-volatile bit read only read only read only reserved reserved OTP read only Note: 1. Some serial flash part numbers only define bit0 and bit1 and reserve the other bits for future use. P/N: AN-0218 2 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction 3. Programming Secured OTP Area If the Secured OTP area has not been factory locked, the Secured OTP area provides either 512 bits or 4K bits of extra OTP memory space. To program the extra memory space, the device must enter the OTP region using the ENSO command (B1h). After entering the OTP region, the normal program flow may be used to program OTP data. The system may check bit0 of the Status Register to determine when the Program operation has completed. Finally, the EXSO command (C1h) is used to exit the OTP region and return to the main memory array. Figure 3-1 shows this flow. Figure 3-1: Secured OTP Area Program Flow Start ENSO (B1h) *Change from main memory array to Secured OTP area. WREN (06h) RDSR (05h) No WEL=1? Yes PP (02h) * Same as normal program flow RDSR (05h) No WIP=0? Yes Yes Another page? No EXSO (C1h) *Return from Secured OTP area to main memory array. End P/N: AN-0218 3 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction 4. Reading Secured OTP Area To read the Secured OTP area, the ENSO (B1h) command must be executed first to enter the OTP area. The system may use the normal READ (03h) command to read the Secured OTP memory. While in the OTP area, the main array is not accessible. When finished, the EXSO (C1h) command is used to exit the OTP area and return to the main memory array. Figure 4-1 shows the flow. Figure 4-1: Secured OTP Area Read Flow Start ENSO (B1h) *Change from main memory array to secured OTP area. READ (03h) * Same as normal read flow EXSO (C1h) *Returnfrom fromsecured secured OTP *Return OTP area to main memory array. area to normal array. End P/N: AN-0218 4 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction 5. Lock Down of Secured OTP Area Once the user is finished programming the OTP area and wishes that no further updates be allowed, the OTP area can be permanently locked. This is accomplished by issuing the WRSCUR (2Fh) command to set bit1 (LDSO) of the Security Register to ‘1’. LDSO is an OTP bit. After it has been set to ‘1’, the OTP area is permanently write-protected and can no longer be programmed. Figure 5-1 shows the flow. Figure 5-1: Secured OTP Area Lock Down Flow Start WREN (06h) RDSR (05h) No WEL=1? Yes WRSCUR (2Fh) Program LDSO bit of Security Register to ‘1’ RDSCUR (2Bh) No LDSO=1? Yes End 6. Summary The Secured OTP area provides an extra OTP memory space. It can be programmed and locked by the factory before shipping or programmed and locked by the customer later. If not locked by the factory, the Secured OTP area can be used by the application for data storage. P/N: AN-0218 5 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction 7. Macronix Parallel Flash with Security OTP Region The following Macronix serial flash devices support the Secured OTP area. Table 7-1: Secured OTP Area Support List Density Voltage Macronix Device 2Mb 4Mb 1.8V 2.5V 1.8V 3V 8Mb 16Mb 2.5V 1.8V 3V 1.8V 32Mb 3V 1.8V 64Mb 3V 1.8V 128Mb 3V 1.8V 256Mb 512Mb 3V 1.8V 3V MX25U2033E MX25V4035 MX25U4033E MX25L8006E MX25L8035E/36E/73E/75E MX25V8006E/35 MX25U8033E/35E MX25L1606E/33E/73E/75E MX25L1635E/36E MX25U1635E/35F MX25L3206E MX25L3235E/39E/73E/75E MX25U3235E/35F MX25L6406E MX25L6435E/39E/73E/75E MX25U6435F MX25L12835F MX25L12839F MX25L12873F MX25L12875F MX25U12835F MX25L25635F MX25L25639F MX25L25735F MX25U25635F MX66L51235F OTP size 4Kbit 512bit 4Kbit 512bit 4Kbit 512bit 4Kbit 512bit 4Kbit 4Kbit 512bit 4Kbit 4Kbit 512bit 4Kbit 4Kbit 4Kbit 4Kbit 4Kbit 4Kbit 8. References Table 8-1 shows the datasheet versions used for comparison in this application note. For the most current, detailed specification, please refer to the Macronix website. Table 8-1: Datasheet Version Datasheet MX25U2033E MX25U4033E MX25V4035/8035 MX25L8006E MX25L8035E MX25L8036E P/N: AN-0218 Location Data Issued Version Website Website Website Website Website Website JAN. 04, 2013 JAN. 04, 2013 JUL. 23, 2010 FEB. 10, 2012 DEC. 12, 2012 JUN. 13, 2012 Rev. 1.2 Rev. 1.4 Rev. 1.2. Rev. 1.2 Rev. 1.2 Rev. 1.1 6 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction MX25L8073E MX25L8075E MX25V8006E MX25U8033E MX25U8035E MX25L1606E MX25L1633E MX25L1635E MX25L1636E MX25L1673E MX25L1675E MX25U1635F Mx25U1635E/3235E MX25L3206E MX25L3235E MX25L3239E MX25L3273E Mx25L3275E MX25U3235F/6435F MX25L6406E MX25L6435E MX25L6439E MX25L6473E MX25L6475E MX25L12835F MX25L12839F MX25L12873F MX25L12875F MX25U12835F MX25L25635F MX25L25639F MX25L25735F MX25U25635F MX66L51235F Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website Website NOV. 13, 2012 NOV. 30, 2012 FEB. 10, 2012 MAR. 20, 2012 DEC. 24, 2012 FEB. 23, 2012 JAN. 09, 2013 DEC. 12, 2012 JUN. 13, 2012 JAN. 02, 2013 OCT. 18, 2012 DEC. 04, 2012 DEC. 12, 2012 FEB. 23, 2012 SEP. 24, 2012 JUN. 29, 2012 DEC. 25, 2012 SEP. 24, 2012 FEB. 03, 2012 JUN. 13, 2012 SEP. 06, 2012 OCT. 09, 2012 DEC 25, 2012 SEP. 06, 2012 DEC. 26, 2012 AUG. 10, 2012 NOV. 14, 2012 JUL. 11, 2012 DEC. 17, 2012 DEC. 26, 2012 SEP. 05, 2012 OCT. 30, 2012 DEC. 14, 2012 AUG. 08, 2012 Rev. 0.00 Rev. 1.1 Rev. 1.2 Rev. 1.2 Rev. 1.3 Rev. 1.4 Rev. 1.7 Rev. 1.6 Rev. 1.3 Rev. 1.0 Rev. 1.1 Rev. 0.00 Rev. 1.7 Rev. 1.4 Rev. 1.2 Rev. 1.0 Rev. 1.0 Rev. 1.1 Rev. 1.0 Rev. 1.5 Rev. 1.0 Rev. 1.0 Rev. 1.0 Rev. 1.0 Rev. 1.1 Rev. 0.00 Rev. 0.00 Rev. 0.00 Rev. 1.2 Rev. 1.1 Rev. 0.01 Rev. 1.0 Rev. 1.0 Rev. 0.00 9. Revision Table 9-1: Revision History Revision Rev. 1.0 P/N: AN-0218 Description Date Issued Initial Release Feb. 25, 2012 7 Ver. 01 Jun. 17, 2013 APPLICATION NOTE Serial Flash Secured OTP Area Introduction Except for customized products which have been expressly identified in the applicable agreement, Macronix's products are designed, developed, and/or manufactured for ordinary business, industrial, personal, and/or household applications only, and not for use in any applications which may, directly or indirectly, cause death, personal injury, or severe property damages. In the event Macronix products are used in contradicted to their target usage above, the buyer shall take any and all actions to ensure said Macronix's product qualified for its actual use in accordance with the applicable laws and regulations; and Macronix as well as it’s suppliers and/or distributors shall be released from any and all liability arisen therefrom. Copyright© Macronix International Co., Ltd. 2013. All rights reserved, including the trademarks and tradename thereof, such as Macronix, MXIC, MXIC Logo, MX Logo, Integrated Solutions Provider, NBit, Nbit, NBiit, Macronix NBit, eLiteFlash, HybridNVM, HybridFlash, XtraROM, Phines, KH Logo, BE-SONOS, KSMC, Kingtech, MXSMIO, Macronix vEE, Macronix MAP, Rich Au-dio, Rich Book, Rich TV, and FitCAM. The names and brands of third party referred thereto (if any) are for identification purposes only For the contact and order information, please visit Macronix’s Web site at: http://www.macronix.com P/N: AN-0218 8 Ver. 01 Jun. 17, 2013