W25Q128JV is a 128-Mbit serial NOR Flash family providing 16 MiB of storage. For a firmware image, that capacity is only the starting point: the storage plan also needs update space, recovery information and an explicit power-loss strategy. This guide develops an example layout and the tests needed to evaluate it.
Separate the family name from the ordering code
Read the complete suffix before configuring the host. Quad data transfer does not automatically mean a four-line instruction protocol or DTR support. Use the applicable device document, rather than adding every option associated with the family name to a driver. See Winbond W25Q128JV datasheet, Rev. G (April 8, 2019) and the W25Q128JVSIQ suffix and pinout guide.
In this article, the partition sizes, update sequence and acceptance tests are proposed design examples. They are not a Winbond reference bootloader, and a host's boot ROM may impose different addresses or image formats.
A 16 MiB layout with room for recovery
| Region | Example allocation |
|---|---|
| Boot/recovery code | 512 KiB |
| Image slot A | 6 MiB |
| Image slot B | 6 MiB |
| Configuration and update metadata | 512 KiB |
| Logs or application assets | 3 MiB |
| Total | 16 MiB |
The arithmetic is 0.5 + 6 + 6 + 0.5 + 3 = 16 MiB. Those allocations are assumptions for this example, not required addresses. They leave two equal application slots but no unallocated capacity, so any growth in one region must be taken from another.
A 5.5 MiB image leaves 0.5 MiB within a 6 MiB slot. Count the actual stored artifact, including headers, signatures, padding and any assets bundled into the update. If a build grows beyond its slot, fail the build or packaging step before distributing it. Test with the largest supported image, not just a small development binary.
Record each partition's start, length, owner and erase alignment in one machine-readable layout file. Generate linker or update-tool constants from that record where practical. Add a check for overlap and out-of-range writes. This reduces the chance that a firmware update tool and the running application interpret the same storage differently.
Page programming needs boundary-aware writes
The device uses 256-byte program pages. A program request crossing the page boundary can wrap within that page; split the write instead. Issue the required write-enable sequence, check protection and poll completion within a bounded timeout. Refer to the program, status and erase instruction sections of Winbond W25Q128JV datasheet, Rev. G (April 8, 2019).
Example: writing 40 bytes from address 0x00F0 leaves only 16 bytes before the 0x0100 boundary. Divide it into 16 bytes at 0x00F0 and 24 bytes at 0x0100. Verify both regions and the bytes immediately outside them. A driver test that always starts at a page-aligned address will miss this class of error.
Keep erase ownership explicit. If several small settings share one erase region, rewriting one setting can affect its neighbors. Build a test containing different patterns in adjacent records, update one record, and compare the others afterward. The storage layer should make the required preservation work visible rather than treating Flash like byte-writable RAM.
Designing an interrupted-update recovery path
For the two-slot example, keep the currently accepted image intact while writing the other slot. Validate the new image before changing the boot selection. Store enough version and integrity metadata for the bootloader to distinguish complete, incomplete and previously rejected images. Define a trial-boot result and a fallback decision that do not depend on an update finishing without interruption.
The selection record also needs a recovery design: a second image slot does not protect a single metadata sector that is erased at the wrong moment. One possible approach is redundant records with sequence numbers and integrity checks, but the exact commit format must be reviewed against the host and storage behavior. Do not describe this example as atomic or power-fail safe until it has passed interruption tests.
Interrupt power at several controlled points: before erase, during image writing, before selection change and on the first boot of the new image. Log which image starts after recovery and whether the previous accepted image remains readable. Repeat around boundary conditions, including a full metadata region and an image at the maximum supported size.
Protecting firmware is a system responsibility
The part has three 256-byte Security Registers and a unique identifier; neither feature alone authenticates a firmware image. See Winbond W25Q128JV datasheet, Rev. G (April 8, 2019). If malicious updates are part of the threat model, define where signature verification occurs, how trust keys are provisioned and how rollback is controlled. An ordinary checksum is useful for corruption detection, but should not be presented as proof of a trusted publisher.
Before production, retain the tested flash suffix, host revision, storage map and update-tool version together. Review a replacement Flash against this complete workflow. A readable device ID or successful initial programming operation is not a complete update qualification.
Ordering and sources
Send the complete manufacturer order code, quantity, required date and any lot or documentation requirements. WWDParts confirms availability, price and delivery terms in the written quotation. Search W25Q128JV or prepare an RFQ.
- Winbond W25Q128JV datasheet, Rev. G (April 8, 2019)
- Winbond current W25Q128JVSIQ documentation index
Reviewed October 12, 2026. Document revisions are identified above. Engineering budgets and test plans are examples, not measured results or replacement approvals.