A monitor comes back from a cardiac ward with a note taped to the housing. It ran: ECG, SpO2, NIBP. But the alarm limits had reset to factory values and the calibration offset for that ward's reusable SpO2 probe was gone. On the bench it passes power-on self-test every single time. It only misbehaves in the field.
That pattern, settings that survive a bench test but not a ward, is rarely a solder joint or a counterfeit reel. It is a selection problem on one small part. The Cypress FM24C16B-GTR is a 16-Kbit I2C F-RAM running from 4.5 V to 5.5 V, with no power management circuitry beyond a simple internal power-on reset. Below that 4.5 V floor, or before the part is ready after power-up, a settings write is not guaranteed, and the monitor cannot tell you.
The call is short. Behind a solid 5 V rail, with firmware that waits for power to settle, the FM24C16B-GTR is a clean fit: fast, simple, effectively unlimited on writes. On a 3.3 V or 1.8 V rail, or sharing a rail with a high-current peripheral, the same part produces exactly those returns. Four datasheet numbers decide which side of that line your design lands on.
What the failure looks like in the field
There are three shapes of this failure, and they surface in different places, which is why they take so long to connect.
Configuration lost after a brownout. The monitor shares a mains circuit with a lot of hospital equipment. When something large switches, a powered bed, a compressor, a defibrillator on the same ring, the 5 V rail dips for a few milliseconds. The microcontroller resets and starts talking to the memory before the rail has settled. The write in flight is partially landed or lost, the configuration block fails checksum on the next boot, and the application loads defaults. The nurse re-enters the alarm limits by hand and nobody files a report, because the unit works.
Cold start after storage. A unit powered immediately after a night in an unheated delivery bay sits at the corner of both the operating and the storage window. The first settings read can fail, and the monitor runs the rest of the shift on defaults. It does not repeat on a bench, so it gets dismissed as a fluke.
Silent single-field corruption. Only one value is wrong: an alarm limit, the units flag, one calibration coefficient. It looks exactly like a firmware bug and gets triaged as one. F-RAM writes at bus speed with no write delay, so there is no busy flag to poll and no write-complete status bit. A rejected or mis-addressed write reports nothing at all.
The thread through all three is that the monitor never crashes. It boots, it runs, and the alarm limits are wrong, which is why this failure class reaches the returns desk even though every unit passes final test.
Why it happens at the silicon level
Four datasheet facts explain all three shapes.
The supply window is 4.5 V to 5.5 V, with no brownout protection. Pages 1 and 9 give VDD as 4.5 V to 5.5 V. Page 4 is blunt: the device "contains no power management circuits other than a simple internal power-on reset", and keeping VDD inside tolerance is the user's responsibility. It also says that if the supply drops below the minimum during operation, a START condition should be issued before the next operation. Nothing inside the chip holds the rail up or warns the firmware. A design that hangs this memory on a 3.3 V rail, or on a 5 V rail that sags under a transient, is asking for those returns. Catalogues sometimes list this part at the wrong supply voltage, so read page 9, not the listing.
Startup timing is a real number. Page 12 gives three of them. Power-up from VDD minimum to first access is 1 ms minimum, so firmware must stay off the bus for a millisecond after the rail is valid. Supply ramp rate is 30 µs/V minimum in both directions, so a rail that snaps back in tens of microseconds after a brownout is rising faster than the guaranteed condition. Last access to power-down is 0 µs, so the bus must be parked with a STOP before the rail collapses, or the write in flight is aborted.
The three low address bits are a page select, not address pins. Page 6 lays it out: bits 7 to 4 are fixed at 1010b, bits 3 to 1 select one of eight 256-byte pages, and bit 0 is the read/write bit. There are no A0, A1 or A2 pins to strap; those bits move the pointer through the array. Firmware carried over from a smaller I2C EEPROM, where those bits were hardware address inputs, will write settings into the wrong 256-byte block. The same page notes the address counter wraps from 7FFh to 000h and that there is no page buffering.
A rejected write is silent. WP is pulled down internally, so leaving it open is normally safe, but tying it high protects the whole memory map (page 3). Page 6 gives the consequence: the device will not acknowledge data bytes written to protected addresses, and the address counter will not increment. A driver that skips the ACK check reports a save that never happened, and the setting disappears on the next power cycle.
The numbers that fix it
From the FM24C16B datasheet, document 001-84450 Rev \*I:
| Parameter | Value | Source |
|---|---|---|
| Density and organisation | 16 Kbit, 2 K × 8 (2,048 × 8) | p. 1, p. 4 |
| Supply voltage VDD | 4.5 – 5.5 V | p. 1, p. 9 |
| Operating temperature | −40 to +85 °C, industrial | p. 1, p. 9 |
| Interface | I2C up to 1 MHz, legacy 100 kHz and 400 kHz timings | p. 1 |
| Slave address | Device type 1010b, three page-select bits, R/W bit | p. 6 |
| Word address | 11-bit, 8-bit row plus 3-bit page | p. 4 |
| Endurance | 100 trillion (10^14) read/write cycles | p. 1, p. 10 |
| Data retention | 10 years at 85 °C, 38 years at 75 °C, 151 years at 65 °C | p. 10 |
| Write behaviour | No write delay, no ACK polling, no page buffering | p. 1, p. 6 |
| Standby current | 4 µA typical, 10 µA maximum | p. 1, p. 9 |
| Active current | 100 µA max at 100 kHz, 200 µA at 400 kHz, 400 µA at 1 MHz | p. 9 |
| Power-up to first access | 1 ms minimum | p. 12 |
| Supply ramp rate, both directions | 30 µs/V minimum | p. 12 |
| Last access to power-down | 0 µs minimum | p. 12 |
| Clock low to data valid | 3 µs max at 100 kHz, 0.9 µs at 400 kHz, 0.55 µs at 1 MHz | p. 11 |
| Bus free before new transmission | 4.7 µs at 100 kHz, 1.3 µs at 400 kHz, 0.5 µs at 1 MHz | p. 11 |
| Output LOW at IOL = 3 mA | 0.4 V maximum | p. 9 |
| Input levels | VIH at least 0.7 × VDD, VIL at most 0.3 × VDD | p. 9 |
| Write protect | WP pulled down internally, high protects the whole map | p. 3, p. 6 |
| ESD | 4 kV HBM, 1.25 kV CDM, 100 V machine model | p. 9 |
| Package | 8-pin SOIC, 150 mils, Pb-free | p. 13, p. 14 |
Three rows decide the design: the 4.5 V supply minimum, the 1 ms power-up delay and the 30 µs/V ramp limit. Satisfy all three at the memory pin, in the worst case and at the cold end of the range, and the returns stop.
If your design needs a different interface or density, the family continues in the same direction, and every one is a different silicon decision from the I2C 4.5 V part. MB85RS16 keeps 16 Kbit but moves from I2C to SPI and down to a 2.7 to 3.6 V supply. MB85RS16N holds 16 Kbit on SPI but trades endurance down to 10^10 cycles per byte at 95 °C, a different grade of part. Step the density up and the interface stays SPI: MB85RS64 is 64 Kbit, MB85RS128B is 128 Kbit, MB85RS1MT is 1 Mbit as 128 K × 8 and adds a 1.7 to 2.7 V option in a wafer-level package, and MB85RS4MT is 4 Mbit as 512 K × 8 at 1.8 to 3.6 V. When bandwidth rather than density is the constraint, MB85RQ4ML is a 4-Mbit Quad SPI part moving data on four lines instead of one. None of them drops into an I2C 5 V footprint without a new driver.
Verification you can run before the next build
Six checks, roughly an afternoon of scope time.
- Audit the rail at the memory pin, not the regulator. Probe VDD at the F-RAM during the largest load transient on that rail, and again cold if you have a chamber. It must stay above 4.5 V whenever the part could be written.
- Measure the first START. Time from VDD crossing 4.5 V to the first START the microcontroller issues; it has to exceed 1 ms. Check the slew on the rising edge, and add soft-start or bulk capacitance if the rail climbs faster than 30 µs/V.
- Dump the whole 2 Kbyte map. Write one byte into each of the eight 256-byte pages, read each back, and confirm the pointer arithmetic. A port from a smaller EEPROM is the usual source of an off-by-one page.
- Force a NACK. Tie WP high, attempt a write, and confirm the firmware reports an error rather than a successful save.
- Run a real cold start. Leave a unit cold overnight and power it straight into a read of the configuration block, before any warm-up.
- Close out endurance cheaply. Compute the worst-case write rate into the hottest 8-byte block. The device applies an endurance cycle to a whole 64-bit row on every access (page 8), and even 3000 accesses per second to one row takes 10 years to reach a trillion cycles, so you can stop suspecting wear.
Keep the application boundary in view. The datasheet states the product is not warranted or intended for medical, life-support, life-saving, critical control or safety applications without a separate written agreement (page 17). Configuration storage and event logging sit inside that boundary; therapy-critical parameters do not.
Frequently asked questions
Do I have to change the hardware if I swap an I2C EEPROM for this part?
The pinout is the same 8-pin SOIC and the datasheet calls it a direct hardware replacement for serial I2C EEPROM (page 1), so the footprint usually stays. Two electrical things change. It is a 4.5 V to 5.5 V part, so if the old memory ran at 3.3 V or 1.8 V the same footprint now sits on the wrong rail. And the driver changes, because there is no write delay or ACK polling (pages 1 and 6) and because bits 3 to 1 of the slave address are a page select rather than address pins (page 6).
What else in a monitor produces the same lost-settings symptom?
A serial EEPROM with the same missing brownout protection. A real-time clock with battery-backed SRAM once the backup cell dies. A reset supervisor with too short a window, letting the microcontroller start before the memory is ready. A rail shared with a high-current peripheral, where a transient pulls the memory below its minimum. The symptom is identical across all four and the fixes differ, so measure before replacing anything.
How do I verify the fix quickly?
Scope VDD at the memory pin under worst-case load, confirm the first START happens more than 1 ms after the rail is valid, then write and read back all eight 256-byte pages. If those three pass, the configuration path is inside the datasheet window.
How does the cost compare with the original EEPROM plan?
Per unit, a 16-Kbit I2C F-RAM costs more than a commodity I2C EEPROM. The honest comparison is the whole settings path, not one part. F-RAM removes the write-delay handling, the ACK polling loop and the page-buffer bookkeeping (page 6), and the datasheet rates endurance at 100 million times the write cycles of EEPROM (page 1). It also removes the bulk capacitance some designs add just to survive a write.
Sourcing note
The FM24C16B-GTR ships in tape and reel in the 8-pin SOIC over the industrial temperature range (page 13); send your annual quantity and target supply rail and we will quote from stock with the current datasheet revision.