From S1MP3 Wiki
Jump to: navigation, search

NAND flash memory

Samsung hynix nands.jpg

Each s1mp3 player has a NAND flash memory block, mostly manufactured by Samsung or Hynix. If you want to read the technical specifications of these components, download the PDF datasheets for Samsung & Hynix NAND Flash memories

NAND memories have a technical lifetime of some thousands of write cycles, consult the relative datasheet for precise information about it.

NAND flash concepts

Unlike NOR flash, NAND was designed to replace traditional mass-storage block-oriented devices such as hard drives, and so also has a block-oriented structure. The basic structure is shown below:


The storage array is conceptually 3-dimensional, with one dimension, the width, being quiescent as the individual bits in the width cannot be accessed or referenced directly. Since the ATJ multimedia SoCs only have an 8-bit external data bus, all s1mp3 devices use "x8", i.e. 8-bit wide NAND flash. Note that there are somewhat rarer x16 parts available. Pages can be viewed as the equivalents of sectors (blocks) in a traditional mass storage device, and each one consists of a main data area followed by a spare area; the use of the spare area is explained below.

In NAND flash, storage is achieved using floating-gate transistors that form NAND gates. As such, the non-programmed state of a bit is 1, while the programming operation injects charge into the floating gate and its resultant bit becomes 0. The opposite operation, erase, extracts the stored charge and reverts the state to 1. MLC flash increases density by storing multiple levels of charge in one cell, at the expense of decreased reliability and endurance. Thus, reading bytes from a non-programmed or erased area will return FF. The erase and program operations inherently cause degradation of the oxide layer isolating the floating gate; this is the reason for NAND flash's finite lifespan (100K-1M erase/program cycles for SLC typically, 2.5K-10K erase/program cycles for MLC) and data retention time.

There is an important distinction between blocks and pages. NAND flash can be programmed on a page-granular basis, but must be erased on a block-granular basis. For typical devices, one block consists of multiple pages. These limitations arise due to factors such as space conservation, as providing erase and program circuitry to e.g. individual bits would result in excessively low densities.

Following the block-device command-response model, NAND flash is read, programmed, and erased using commands sent through a single data bus; there are no separate address bus signals as in the case of traditional RAM. The principal commands (read, erase, program, read ID) used by various manufacturers of NAND flash are, in most cases, identical; however, there is a distinction between small-block and large-block flash, which have differing internal organization and command sets.

Small Block

The main distinction of small-block flash is a page width of 512 bytes with a 16-byte spare area. In addition, addresses within the device are specified in a "split-page" scheme, with one command used to operate on the first 256 bytes in a page, another for the second, and a third for the spare area. This is because the address cycles themselves do not specify the uppermost bit of the 9-bit column address.

A typical small-block device has 32 or 64 512-byte + 16-spare pages per block, giving a blocksize of 16K+512 or 32K+1K bytes. Due to using 3 or 4 address cycles, up to 65,536 or 16,777,216 pages of 512 bytes can be accessed, for a maximum capacity of 32MB or 8GB; however, in practice small-block flash is only produced in sizes up to 128MB.

Large Block

The main distinction of large-block flash is a page width of 2048 bytes with a 64-byte spare area; in effect, one page of a large-block flash is equivalent to 4 pages of a small-block. However, the differences go beyond this; the address cycles fully specify the address of a byte within the device, and the column address is now 2 bytes to accommodate the 2112-byte page width. The row address may be 2 or 3 bytes, allowing for up to 128MB and 32GB devices, respectively.

A typical large-block device has 64 or 128 pages of 2K+64 bytes, giving 128K+4K and 256K+8K block sizes, respectively.

Huge Block

Unofficially termed huge-block because of the increased page width, huge-block devices otherwise share the same structure and command set of large-block devices. As NAND flash densities continue to increase, some manufacturers have decided to, instead of increasing the number of rows, to increase the width of each row/page from 2048+64 to 4096+128. As noted above, except for this difference huge-block flash is operationally equivalent to large-block --- the column address contains an additional active bit in order to address the increased width.

A typical huge-block device has 64 or 128 pages of 4K+128 bytes, giving 256K+8K and 512K+16K block sizes, respectively.

NAND flash content

Some example locations from a 1Gbit Hynix HY27UF081G2M NAND flash (128 MB):

  • page 0x0000: contains flash boot record (BRECFxxx.BIN, the 2nd-stage bootloader)
  • page 0x0040: contains a mirror/backup of the first flash boot record
  • page 0x0060: ???
  • page 0x0AC0: firmware image (FWIMAGE.FW)
  • page 0x1480: filesystem?

Around 117.78MB are left for the filesystem. FAT16/FAT32 is used to store the files.

NAND flash boot

On power-on, the 1st-stage bootloader from BROM loads the first NAND flash page into ZRAM1. If no error occures, it jumps to address 0x0000 and executes the first instruction of the 2nd-stage bootloader. Otherwise, the 1st-stage bootloader enters ADFU recovery mode and waits for healing.

Read more about the 2nd-stage bootloader.

Accessing the NAND

The NAND is wired together with the LCD and possibly other NAND chips, so prior to accessing the NAND, make sure that you have activated the CE line of the NAND you want to access, on the Extended Memory High port. The primary NAND chip is always connected to CE1.

There are 2 ways to access the nand:

  • Control the NAND directly by toggling the CLE and ALE lines (bits 0 and 1 of port 1) and writing commands/addresses to extended memory
  • Use the NAND controller's state machine.

For the addresses of the mentioned ports, see Port map.


ECC is short for "error correction code" See Wikipedia. It is used in NAND flash chips to correct any single bit errors when reading the NAND chips.

The ATJ2085 can automatically calculate ECC values, it's kind of easy to use:

  1. Setup the NAND chip ready for a read/write
  2. Set port 0xCC to 0x10
  3. Transfer 512 bytes of data to/from the NAND
  4. Wait for port 0xCC to change from 0x10
  5. Read the ECC values from ports 0xCC, 0xCD, 0xCE, 0xCF

Now you can write the values to the flash in the ECC area, or XOR the values with ones from ECC area. If the data is correct the XORing the values should result in all 0's

The ATJ209x has two options for ECC, 1-bit Hamming code or Reed-Solomon. The former should be the identical format to the ATJ208x, and is well-documented by Samsung here. Intended for SLC flash, the configuration used by the FLASHLDR can correct one single-bit error in each 256-byte block, and stores 22 bits of redundancy for each block in the spare area. All two-bit errors are detectable but uncorrectable, while not all errors of 3 or more bits are detectable although they are all uncorrectable.

The latter is a more powerful ECC that is recommended for MLC flash; the implementation used on the ATJ209x can correct up to 4 error bursts of 9 bits in length in each 512-byte block, and stores 9 bytes of redundancy for each block in the spare area. It is a Reed-Solomon (511,503) code, i.e. using 9-bit symbols. Each 512-byte block is converted to 503-symbol GF(512) polynomial coefficients, stored in "big-endian" order. The primitive polynomial used is 0x211 (x^9 + x^4 + 1).

Adding a second NAND memory

It's possible - instructions at How to add/change a memory chip

NAND Controller

See NAND_controller

Related pages