microcontroller ROM copy trouble ?

One possibility is that the speed grade of the EPROM is slower than that of the original ROM chip. There should be a couple of digits after a dash on each chip, like -12 or -70. What are they?

ROM

M27C256B)

than

digits

Thanks for reply Rich,

I have a variety of ROMs i have tested

i have a set of uv eraseable and OTP both of the 10 12 15 variety (ie. 100/120/150 ns)

the original equipment is from 1987-89 ...so i do not think it is terribly fast, the clock is 12 Mhz. I could not locate an exact datasheet for the (NEC D23256AC 016 8437k9) but the one 23256ac i did find was rated at 150 ns i tried to match or better that number.

faster than spec chip is OK i presume ?

the 8031 processor has a Time of Address Valid to Instruction Read Valid of 300 ns (max value)

do any of these numbers sound close (bad) ?

****And more info**** ... There is no funny business with 8031 processor because i was able to sub in a **brand new/ not used ** Atmel 8031 processor in place of the original 8031 and worked great ???? with the original ROM if that means anything

Thanks again for your help i am really stuck here and wondering if there is some security measure installed on the original ROM but that just seems unlikely ???? unless that funny stuff with the Address line has something to do with it ???

but my reconing on that is.... if i have the same raw image on the two ROM chips then the processor sould see no difference in the data it reads from either chip using the same interface to those two chips ? yes /no /maybe ?

Thanks again for help Rich, robb

[condense]

Thinking there might be some MCU 8031 funny business/security i swapped a ** brand new / not used** (Atmel 80C31x2-UM) in place of original 8031 and works like a charm...

........with the **Original ROM ONLY ***

could really use some ideas , i am stumped, robb

My guess is that here is a subtle pin difference between the eproms... speed is definitely NOT an issue.

Well guessed, the ROMs have a different pinout compared to EPROMs. Think about the obvious differences: ROMs don't have a PGM pin, mostly OE and/or CE are swapped with some address lines. Get a datasheet and wire an adapter and you're done.

It *looks* like the memory chips are faster than the processor, so that may not be the issue. The original was probably 160 ns.

The note at the back of the TMM23256P data sheet (I'm guessing that is the one that you also found) does reference a required initialization sequence. If you can, scope out which of the two sequences are used and perhaps determine whether that sequence is disturbing the alternate chip in some way.

--
Rich Webb     Norfolk, VA

Some mask ROMs could also be made with only 1 OE or CE pin, and have the other one not connected.

If either pin 20 or 22 is not connected on the board, try a pull down on that pin.

--
If the same image is programmed into both devices and they both have
identical pinouts, then I\'d look at I/O level differences.

if memory serves me right the 27... is a progamable chip and you apply a programming voltage to a certain pin. To read that chip you must change "that" pin to hi or low. I got on datasheets here.

find

so

that

initialization

used

alternate

Thanks Rich, I scoped the working chip in operation and i saw wave forms i was not expecting ? the (pin 1) was particulalry different /peculiar.

i will ooku pthe sequence next and see if i can decipher what i see. thanks again , robb

ROM

M27C256B)

Vcc?).

programmer),

well oddly on this board the (pin 1) is hardwired to (pin 27)

for the original chip that is ( NC to Addr 14) on the **new**

27c256 that would be (Vpp to Addr 14)

so i **tried** insert new 27C256 into socket with (pin 1) not making contact(bend pin and slide to outside of socket) then attach micro-jumper hooks from (pin 1) to Vcc

and this did not have any effect ??

so now i am wondeing if i am even reading the original Chip correctly it is ***NOT*** directly supported /mentioned in my ROM reader but it has similar equivalents by my judgement but the data does not look like it is thr 8051 processor instructions as i would expect.

thanks for help , robb

robb wrote: [snip...snip...]

*Reading* is (nearly) universal for memory chips with a standard pinout. *Programming* is often vendor-specific and not well documented in end-user data sheets.

Have you tried running the object code through a disassembler? I've used D52, which is available at

--
Rich Webb     Norfolk, VA

find

Instruction

so

that

initialization

used

alternate

uhmm.... any ideas on how to scope an initializing sequence ? it's to fast or my adjusting or triggering is a problem ???

robb

Use a NE555 oscillator and the output to RESET the CPU. You can trigger the scope with the output too.

You now have a stable startup picture.

In some designs I made that with the MAX691 watchdog. Dual function:

- hit the reset button short and you have a RESET including debounced switch

- hit and holt it longer: You have a stable repeating startup code.

- Henry

--
www.ehydra.dyndns.info

Vpp needs to be held at Vcc for reading. If it floats you will get garbage results.

**new**

i think i may not be clear ? i am saying pin 1 and pin 27 of the memory chip are connected on the controller board so that would cause special consideration if one wanted to use a 27c512 ?

ROM

the

as

close , it is a series of sections of 64 duplicate bytes followed by another section of 64 duplicate bytes..... all the waty to the end

each section of byte values is different and i get the exact same series for each successive chip reading attempts.

unless i choose a different chip size like 27c128 then the series of byte duplicates changes. where the first set maybe 7A in place of the 02

here is a clip from begining of my read

:020000040000FA :1000000002020202020202020202020202020202D0 :1000100002020202020202020202020202020202C0 :1000200002020202020202020202020202020202B0 :1000300002020202020202020202020202020202A0 :100040000202020202020202020202020202020290 :100050000202020202020202020202020202020280 :100060000202020202020202020202020202020270 :100070000202020202020202020202020202020260 :10008000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9E0 :10009000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D0 :1000A000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9C0 :1000B000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9B0 :1000C000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9A0 :1000D000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D990 :1000E000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D980 :1000F000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D970 :10010000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E68F :10011000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E67F :10012000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E66F :10013000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E65F :10014000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E64F :10015000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E63F :10016000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E62F :10017000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E61F :1001800039393939393939393939393939393939DF :1001900039393939393939393939393939393939CF :1001A00039393939393939393939393939393939BF :1001B00039393939393939393939393939393939AF :1001C000393939393939393939393939393939399F :1001D000393939393939393939393939393939398F :1001E000393939393939393939393939393939397F :1001F000393939393939393939393939393939396F :1002000013131313131313131313131313131313BE :1002100013131313131313131313131313131313AE :10022000131313131313131313131313131313139E :10023000131313131313131313131313131313138E :10024000131313131313131313131313131313137E :10025000131313131313131313131313131313136E :10026000131313131313131313131313131313135E :10027000131313131313131313131313131313134E :100280001E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E8E .... till the end

I mapped the pins on the board so as to be reasonably certain that the ROM chip was compatible with the 27cXXX series of chips

all the pin/address/data lines seem to be consistent with the

27cXXX series pin out. the data and address lines match to the MCU adressing pins according to 27cXXX datasheet even the funny 8 through 11 pin jumble.

(pin 22) ROM goes to (pin 29) 8051 (PSEN- prog store enable) (pin 20) ROM goes to (pin 30)8051 (ALE-Addr Latch Enable)

on the PCB the 8 data lines are all connected with the first 8 Address lines so D0 is connected to A0 and (D1 to A1) and these shared connection s all go back to MCU

thanks for the help, robb

Honestly, I just skimmed the replies, and don't have the time to get into great detail about what might be wrong....

However, if I recall correctly, parallel EPROMs used to have "Signature Bytes". In the old days, that's how a programmer "knew" what programming voltage / algorithm to use....

Could be the 8031 code is reading this, before allowing normal operation. (Wild ass guess, btw) Or, perhaps more likely, your programmer isn't really programming the new EPROM and its just lying to you.??

Hope you figure it out. Good luck.

-mpm

Utter rubbish.....the 8031 isn't reading sig bytes... Your programmer is not reading the eprom correctly.

It would seem your original rom has an internal address latch. There is *some* evidence that 23256 roms with this feature may have been used by HP, but I have had no success finding a NEC data sheet for your rom. This would explain why the eprom reader reads the same value 64 times and also why there is no 8 bit latch chip between the multiplexed d0-7/A0-7 MCU bus and the rom's A0-7 address inputs. Try a different algorithm for reading the rom on the programmer. When you've go the correct contents that dissasemble to something reasonable, you'll need to put a little board together to insert a latch between the combined bus and the adddress pins, then program a 27c256 and try it.

HTH

--
Ian Malcolm.   London, ENGLAND.  (NEWSGROUP REPLY PREFERRED)
ianm[at]the[dash]malcolms[dot]freeserve[dot]co[dot]uk
[at]=@, [dash]=- & [dot]=. *Warning* HTML & >32K emails --> NUL:
\'Stingo\' Albacore #1554 - 15\' Early 60\'s, Uffa Fox designed,
All varnished hot moulded wooden racing dinghy.

I agree, now that I have read the replies more thoroughly, esp, post #3, it would appear that your programmer is not reading the original masked ROM part correctly.

This is what I have found out about UPD23C256E..... The OE signal is mask option selectable and can be active hi, low or don't care.

Put the chip in your reader, but bend out the OE leg ( pin 22). Connect it via a 1K resistor to Vcc and then read as 'any' 27256 EPROM. Look at the data and see if it looks 'real'. If not, leave pin 22 'not connected 'and read again...... I don't think it's worth trying to connect OE to GND as that is the default for all generic 27356 devices.