microcontroller ROM copy trouble ?

Active HIGH versus Active LOW on CS and OE pins? Maybe the EPROM programmer is able to compensate for that and "do the right thing", but your target circuit can't? Been through that recently with some EPROM/ROMs and it is a pain.

Get data sheets for both chips and look closely.

--
--------------------------------------+------------------------------------
Mike Brown: mjb[at]pootle.demon.co.uk | http://www.pootle.demon.co.uk/
Reply to
Mike
Loading thread data ...

"Nearly" tell that to Apple and Sinclair.

Apple II Europlus O/S ROMS wouldn't read on my EPROM programmer without some fiddling about to come up with CS (Chip select) HIGH and VPP/OE LOW. (Normal would be BOTH low)

Sinclair QL OS ROMS are odder still: OE required to be HIGH, CS is active LOW on one chip, active HIGH on another. The CS lines are tied together in the computer, so it makes sense. However, for an EPROM programmer, it's backwards.

Also run it through an ASCII dump, look for any copyright strings that make sense.

--
--------------------------------------+------------------------------------
Mike Brown: mjb[at]pootle.demon.co.uk | http://www.pootle.demon.co.uk/
Reply to
Mike

Exactly.

Robb,

I don't think the Easy Pro 90 can read the D23256ac because the chip is too slow, (150 to 250ns).

Here what I would do. Build a simple adapter to your printer port and strobe the address lines to read the data bits off the D23256ac. Remember the slower the read the better for you. Also the speed of you computer will affect your reading. If you can connect an oscilloscope to you printer port (even the Easypro 90 to pin A1 ), you can figure how fast it is reading the D23256ac.

Once you got the image file you can burn the ST M27C256B (45ns) with your Easypro 90.

In case you want to update the Easypro 90 software, you can grab it from

formatting link

Don't bother contacting tech support because they never reply.

Reply to
Romdump

Judging by the age of this system that may typically be an 8751.

Can you provide the exact part number of the 8051 with suspected internal program please ?

You can tell if it's using the internal ROM because pin 31 (/EA/Vpp) will be tied high. It's still possible to read an external ROM in this mode but it will appear as an 'extension' to the interal ROM with a start address offset by the size of the internal ROM.

I'm beginning to think you might benefit from a cheap and cheerful Chinese Eprom/uC reader writer btw. Especially if you need to read the contents of an 8751 type device.

formatting link

formatting link

Graham

Reply to
Eeyore

I'd love to see someone make an 8051 do that. The 'controller' is the 8051.

None of this would prevent a simply copy working though ! Think about it guys.

Graham

Reply to
Eeyore

Do you have a plain 'vanilla' example of an 8051 application circuit with external ROM showing the connection of the address and data lines (and address latch) ?

In view of comments made, I suggest that you 'buzz out' all the address and data line connections between the 8051 and the ROM on your board and report back to establish if there's anything unusual here.

Graham

Reply to
Eeyore

formatting link

formatting link

Unfortunately he *has* a chinese multi-device programmer

It appears likely that it is the source of his problems, and getting another similar one *UNLESS* it has *FULL* instructions on implementing one's own programming and reading algorithms

It is *supposed* to have lifetime support so it might be worth it for the OP to contact them with his part number ;-)

The available evidence suggests that the EasyPRO90 he has reads 27xnn EPROMS using a 'fast' algorithm that reads 64 bytes at a time, activating /CE continuously and strobing /OE for each byte. Unfortunately he needs a 'slow' algorithm that strobes *both* signals, with adequate setup and hold time :-(

A bit of research leads me to the 87C256 Latched EPROM which is intended for use in applications with /ALE on pin 20. If his programmer supports this device or equivalent he should be golden.

If so, and he could source one, or someone can suggest a device with the same functionality, it would be a drop in replacement, otherwise, well I've built all sorts of ROM adaptors 'dead bug' fashion using two stacked turned pin sockets with the top soldered into the bottom one with various pins I needed to intercept cut away in between them, kynar wire, some cotton thread to lace the kynar in place, some SMD TTL and a few drops of superglue to hold everything together. Keeps the pins clean & fit to insert in the programmer and also avoids needing to mod the equipment PCB (assuming there is ~1cm vertical clearance). :-)

--
Ian Malcolm.   London, ENGLAND.  (NEWSGROUP REPLY PREFERRED)
ianm[at]the[dash]malcolms[dot]freeserve[dot]co[dot]uk
 Click to see the full signature
Reply to
Ian Malcolm

Where are you located in the UK?

Reply to
TT_Man

circuit

data lines

address

board and

Appologies for late turn around reply, finishing up X-mas mode, returned from 4 hour drive to relatives this PM.

Just wanted to give a quick reply before sleep.... so that you didn't think i gave up on your much appreciated help.

The ROM/MCU does connect to other chips but does not go through them. That is, my original pinout diagram of the ROM lines to MC line relations holds true, there are direct traces from the ROM Addr/Data lines to MCU's ports 0 and 2.

but also the ROM Addr 0-7 is connected to the inputs 1D,2D etc.... of 3 diff SN74LS377 (D-Type Flip-Flops) the output of the Flip-FLops 1Q,2Q ... connect to either a Static Ram chip's (SRM2016) Address lines and the SRM data lines are also connected to the I/O port 1 of MCU

the LS377 has connections to other chips around the MCU eg. (74LS251, 74LS28B, 4049, others)

I will work on a more complete pin connections, i origianlly just posted to show that the ROM pins were consistent with 27cXXX series chips.

My chepao chim=nese reader did supoprt the chip that someone suggested the D87c257 and i get something alot more promissing shown below...

i do not know if it is good yet as i do not have any more blank ROM chips to burn and i have not tried to load into a 8051 dis-asembler

thanks for all the help Graham, robb

D87c257 read....

---------------------- :020000040000FA :1000000002096FC0D0C0E0020173FFC0D0C0E0029F :1000100001BEFF30B202D22A32FFFFC0D0C0E0C022 :1000200082C083C000904058E531540F204C073007 :1000300045036001040423F893F58DE80493F58BE0 :10004000E542540790405093F8E541540793C44863 :10005000758360F0206F26D294E530758350F0E50B :100060002D543F7041C245C28E206F19205D1E1273 :100070000F39D000D083D082D0E0D0D032204DD9FB :100080007530FF80D4205C4C12154A80E5E5422093 :10009000E002C294E530758350F080D6E54120E05F :1000A000F353307780EE14601314147002D24CE5D1 :1000B0003130450C540F600215313164316480B227 :1000C000C4B53109C24C1046F1D24580ED104CEA5E :1000D000053180E6104DC5E520440F20E701C4F549 :1000E00030758DFBD28ED24D53200F80854320F08A :1000F000E52D543F603AFDF5317842306F0118E646 :1001000030E0021531E531C313B4020575310A80C0 :100110000DC394035001E4C3139246C4F531E6D2F3 :100120004C20E009C24CED1460031201641201641A :10013000208E20306F06E530C4B53009758DFF750F ........... ........... :10096000D23D22D23C22E0540F24F650F3808D7504 :1009700090CC797E7802760008D9FB75B8E175894C :1009800011758CFE75880575A8867583607444F0B2 :1009900075835074FFF530F0758D88D28ED2137543 :1009A000530AD28C120D60308FFA7583507477F52C :1009B00030F07455758360F0C28F758D88120D60AC :1009C000308FFA906007E030E002D20A756DE0D215 :1009D00014D2131230A8754400C22C121808C28E0B :1009E000C28FD2AB1229FCD2192019F82018F5A217 :1009F000B492E0A2B592E1F45403F52B3014102028 :100A0000200D204A472010031218EAC214C2131204 :100A100029FC304A082011E4200DE1800DE5445402 :100A2000F0B4F006202FD52010D220182AD293D26D :100A300092C295C2D3C2D4A2B492E0A2B592E1F41C :100A40005403FAE52B5403B5023980B02011BC20C1 :100A50000DB91231A780B4D2193014057553008036 :100A60009B3018C93092298043501E120CAEEA60A8 :100A700030B4030A205A12D25A1213157403120DFD :100A8000428006EA20E0E250E2532BFC422B21FC9C :100A9000C293D295C291E543B4569CC290D2A8802D :100AA00096305AE5C25A120EA5E480DD7552A0C2F6 :100AB00093D292C20A304102D291E543B45602D297 :100AC00090752E00750600D215754D00120CAEC241 :100AD00089D2A8301E04C22AC21EC25A205646E538

Reply to
robb

programand

8751.

suspected

getting

implementing

it for

27xnn

signals,

intended

supports

Thanks for the help Ian,

And the EasyPRO90B does happen to support a couple of different varieties of that chip well its cale a (D87c257 Intel , M87c257 ST) and when i read selecting these devices i get a more promising read that i will need to test burn or verify in 8051 disasembler.

i show the output at the end of the reply below...

interestingly a different (NEC D23128AC) gives similar trouble

with the

otherwise, well

two

bottom one

them, kynar

TTL and a

pins

to mod

:-)

by ROM adaptor ? you mean to make the D23256AC look or behave like some other chip that is supported ??? eg 27C256 etc...

the only difference these amateur eyes could see with the 87c257 was the addition of a latch strobe on the pin 1 ??? and it coincided almost nearly with the CE . that seems easy enough to fabricate ?

any ways below is a dump using the 87c257 device

thank you, i appreciate all the effort and help, robb

D87c257 read....

---------------------- :020000040000FA :1000000002096FC0D0C0E0020173FFC0D0C0E0029F :1000100001BEFF30B202D22A32FFFFC0D0C0E0C022 :1000200082C083C000904058E531540F204C073007 :1000300045036001040423F893F58DE80493F58BE0 :10004000E542540790405093F8E541540793C44863 :10005000758360F0206F26D294E530758350F0E50B :100060002D543F7041C245C28E206F19205D1E1273 :100070000F39D000D083D082D0E0D0D032204DD9FB :100080007530FF80D4205C4C12154A80E5E5422093 :10009000E002C294E530758350F080D6E54120E05F :1000A000F353307780EE14601314147002D24CE5D1 :1000B0003130450C540F600215313164316480B227 :1000C000C4B53109C24C1046F1D24580ED104CEA5E :1000D000053180E6104DC5E520440F20E701C4F549 :1000E00030758DFBD28ED24D53200F80854320F08A :1000F000E52D543F603AFDF5317842306F0118E646 :1001000030E0021531E531C313B4020575310A80C0 :100110000DC394035001E4C3139246C4F531E6D2F3 :100120004C20E009C24CED1460031201641201641A :10013000208E20306F06E530C4B53009758DFF750F ........... skip ........... :10096000D23D22D23C22E0540F24F650F3808D7504 :1009700090CC797E7802760008D9FB75B8E175894C :1009800011758CFE75880575A8867583607444F0B2 :1009900075835074FFF530F0758D88D28ED2137543 :1009A000530AD28C120D60308FFA7583507477F52C :1009B00030F07455758360F0C28F758D88120D60AC :1009C000308FFA906007E030E002D20A756DE0D215 :1009D00014D2131230A8754400C22C121808C28E0B :1009E000C28FD2AB1229FCD2192019F82018F5A217 :1009F000B492E0A2B592E1F45403F52B3014102028 :100A0000200D204A472010031218EAC214C2131204 :100A100029FC304A082011E4200DE1800DE5445402 :100A2000F0B4F006202FD52010D220182AD293D26D :100A300092C295C2D3C2D4A2B492E0A2B592E1F41C :100A40005403FAE52B5403B5023980B02011BC20C1 :100A50000DB91231A780B4D2193014057553008036 :100A60009B3018C93092298043501E120CAEEA60A8 :100A700030B4030A205A12D25A1213157403120DFD :100A8000428006EA20E0E250E2532BFC422B21FC9C :100A9000C293D295C291E543B4569CC290D2A8802D :100AA00096305AE5C25A120EA5E480DD7552A0C2F6 :100AB00093D292C20A304102D291E543B45602D297 :100AC00090752E00750600D215754D00120CAEC241 :100AD00089D2A8301E04C22AC21EC25A205646E538

Reply to
robb
[trim]

and/or data

hard to

location after

around.

Hello Don and Kiefer, thanks for taking time and trying to help.

I wondered about the encryption myself considering all the trouble reading a simple ROM chip to burn another,

i wondered if they might have tried to protect it somehow but then these are very speacialized controlers so the only real protectin they might want is trying to hide their ideas from a potential competitor then that would make sense.

but with any of that i should be able to just duplicate the ROM memory and have it work ?? yes ??

i do not want to debug or decipher just duplicate ROM to replace my fried ROM

no other chips between the data path and ROM/MCU

**BUT** there are chips connected to those ROM/MCU address lines

- SN74LS377 (D-Type Flip-Flops)

- 74LS251, (data selector multiplexer, 3 state out)

- 74LS28J, (2 input positive NOR buffers )

- 4049

the ROM Addr 0-7 is connected to the inputs 1D,2D etc.... of 3 diff SN74LS377 (D-Type Flip-Flops) the output of the Flip-FLops 1Q,2Q ... connect to a Static Ram chip's (SRM2016) Address lines and the SRM data lines are connected to the I/O port 1 of MCU p1.0-7

the LS377 has connections to the other chips around the MCU also eg. (74LS251, 74LS28B, 4049, others)

i posted a PIC in alt.binaries.schematics.electrionics of all the chips involved. i know it is not a schematic but it shows the chips i am talking about.

thanks again donald for all the help, robb

Reply to
robb

First thanks for all the help,

I have new ROM dump below (bottom of post)using a chip suggested by Ian an D87C257 this loks better if you could take a peek and comment i would appreciate that/

i don't want anyone shooting in the dark i want to make it bright and clear

i give the information i have first and then whatever will help you experts help me i try to provide as best i can.

I originally tried to approached this as simple as possible... copy ROM(orig) image , burn ROM(new), test ROM(new) on the working board

so that i would not need to worry with encryption and adress shifts and all the other tricks of the trade.

so now the ROM reader is suspect

thanks again, robb

D87c257 read....

---------------------- :020000040000FA :1000000002096FC0D0C0E0020173FFC0D0C0E0029F :1000100001BEFF30B202D22A32FFFFC0D0C0E0C022 :1000200082C083C000904058E531540F204C073007 :1000300045036001040423F893F58DE80493F58BE0 :10004000E542540790405093F8E541540793C44863 :10005000758360F0206F26D294E530758350F0E50B :100060002D543F7041C245C28E206F19205D1E1273 :100070000F39D000D083D082D0E0D0D032204DD9FB :100080007530FF80D4205C4C12154A80E5E5422093 :10009000E002C294E530758350F080D6E54120E05F :1000A000F353307780EE14601314147002D24CE5D1 :1000B0003130450C540F600215313164316480B227 :1000C000C4B53109C24C1046F1D24580ED104CEA5E :1000D000053180E6104DC5E520440F20E701C4F549 :1000E00030758DFBD28ED24D53200F80854320F08A :1000F000E52D543F603AFDF5317842306F0118E646 :1001000030E0021531E531C313B4020575310A80C0 :100110000DC394035001E4C3139246C4F531E6D2F3 :100120004C20E009C24CED1460031201641201641A :10013000208E20306F06E530C4B53009758DFF750F ........... snip ........... :10096000D23D22D23C22E0540F24F650F3808D7504 :1009700090CC797E7802760008D9FB75B8E175894C :1009800011758CFE75880575A8867583607444F0B2 :1009900075835074FFF530F0758D88D28ED2137543 :1009A000530AD28C120D60308FFA7583507477F52C :1009B00030F07455758360F0C28F758D88120D60AC :1009C000308FFA906007E030E002D20A756DE0D215 :1009D00014D2131230A8754400C22C121808C28E0B :1009E000C28FD2AB1229FCD2192019F82018F5A217 :1009F000B492E0A2B592E1F45403F52B3014102028 :100A0000200D204A472010031218EAC214C2131204 :100A100029FC304A082011E4200DE1800DE5445402 :100A2000F0B4F006202FD52010D220182AD293D26D :100A300092C295C2D3C2D4A2B492E0A2B592E1F41C :100A40005403FAE52B5403B5023980B02011BC20C1 :100A50000DB91231A780B4D2193014057553008036 :100A60009B3018C93092298043501E120CAEEA60A8 :100A700030B4030A205A12D25A1213157403120DFD :100A8000428006EA20E0E250E2532BFC422B21FC9C :100A9000C293D295C291E543B4569CC290D2A8802D :100AA00096305AE5C25A120EA5E480DD7552A0C2F6 :100AB00093D292C20A304102D291E543B45602D297 :100AC00090752E00750600D215754D00120CAEC241 :100AD00089D2A8301E04C22AC21EC25A205646E538

Reply to
robb

Looking hopefull. I dont have any 8051 tools installed so I cant easily check it, but it looks too regular to be garbage and doesn't repeat in the ways I'd expect from a bad read. It dosn't contain any ASCII text (unless the address and/or data lines are scrambled (not wired 1-1 2-22 etc.)) but I wouldn't expect that unless the original unit has a LCD (or LED) dot matrix display or a serial port.

Probably the wrong algorithm. without checking its data sheet, I cant match it up to a supported device, or are you telling me you tried this chiptype reading the D23256AC? Unless you have a D23128AC you need to read, IMHO its not worth the effort.

*MUCH* the best option if you can get an 87c257 to program.

So you ran out of blank roms :-) If you are doing much of this, you

*need* a UV EPROM eraser. Easy enough to make if you can get the UV tube and a torch with the same size tube to gut for the tube mounting and invertor. *DONT* look at the light - if you value your eyes (if you catch a brief glimpse it wont hurt you). At its minimum, its just the tube powered up and supported 1 diameter above the window in the EPROM in a bit of antistatic foam, with a box over it all so you cant see the light from the tube. The timing is important. You need to find how long it takes to wipe the chip then add about 50% for reliability. I suggest starting with 3 minute increments. and expect a result in the 10-20 minute range Once you know how powerful your eraser is, you can just use that time, but an occasional check for blank at 2/3 time is good incase yor UV tube is getting weak. Get this project out of the way then box up the eraser nicely, painting the inside of the box matt black and maybe add a timer.

NO, completely the other way round, make a supported 27C256 look like a D23256AC or 87c257 so it can be used to *REPLACE* the D23256AC in the equipment after programming it without the adaptor.

YES, you need to intercept the high address lines (A0-A7 stay directly connected) and insert a latch between them and the combined address/data lines clocked by the ALE signal. SMD TTL octal latch chip, some very fine solid core wire and get at it. N.B. when building SMD 'dead bug' fashion, solder all the kynar (wire wrap wire) to the chip pins first. You will probably need a bit of very thin stiff plastic to glue the chip to. The plastic is glued on top of the frame of the lower socket. You cut back the pins of the top socket that you need to divert and solder the wires to the stubs. You solder all the pins left on the top socket with the top socket not quite fully inserted into the bottom one. do corner pins first and get it level. The actual sockets on a turned pin socket take solder quite nicely but you only get one shot to put a pin in there. Put the bottom socket in another one or some scrap perfboard while you work to stop the pins moving if the plastic softens from the heat. Lay off the Coffee for 24 hours before hand and get a good nights sleep first!

It *MAY* be possible to get away with a normal flat pin socket with the high address pins bent out and patched to the outputs of one of the octal latches on the board if the address demultiplexing for the RAM has its outputs permanently enabled (or pick it up at the RAM). If the latch has a chip other than the 8051 feeding /OE or CLK, its probably no good for the signals you need. Pin 20 would need to be tied low.

I recccomend you find a file sharing service to post the dump to then give us a link for anyone with 8051 experience can then take a look at it. It would be nice to know make model and description of the unit you are trying to repair as well.

Good luck with it, I admire your persistance HAPPY NEW YEAR.

P.S. I have a new year resolution for you: If it aint broke dont fix it! (Unless you can afford to sacrifice one to your curiosity)

--
Ian Malcolm.   London, ENGLAND.  (NEWSGROUP REPLY PREFERRED)
ianm[at]the[dash]malcolms[dot]freeserve[dot]co[dot]uk
 Click to see the full signature
Reply to
Ian Malcolm

The address is obviously being latched in the ROM. Otherwise, when the

8051 switches to reading the ROM's data, the address that it was providing to the ROM will be gone.
Reply to
Andy

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I was wondering about that.

I have not found a data sheet for the D23256.

Is the OP trying to insert a 27256 into the same socket that the D23256 came out of ??

That would explain why the 27256 would not work in the same socket.

donald

Reply to
donald

when the

the D23256

socket.

was

Hello OP here, The reason for trying to use a 27c256 in place of the D23256AC is.....

that was some advice given on the MCU-Mall user forum where they sell lots of cheap chinese ROM programmers.

one of the regular posters thought 23256 was just a read only / mask rom version of the 27c256 ? so i went with that.

i kind of half convinced myself that the latching mechanism could be superceeded with a fast enough 27c256 operation ????

the 23256 was 150ns and many 27c256 are 50-90 ns so that 27c256 is ready long before the read occurs ??? that was my thinking

thanks for any help , robb

robb

Reply to
robb

For such a scheme to possibly work, your replacement ROM has to be a lot slower, not faster. A 150ns ROM means the MCU has to wait at least

150ns before the data is valid for reading. A 90ns replacement ROM means the data is guaranteed to have changed at most 90ns after an address change, long before the MCU is set to read it.
Reply to
Andy

Andy,

I do not believe this is 100% correct.

You are correct that the data is stable 150ns or 90ns after the Chip Select line is stable. The data will stay stable as long as the CS line and address lines are stable.

The CPU involve is an 8051. The date of the circuit the OP has (1985) is old enough to believe that it is a 12Mhz processor with an internal divide by 12.

So the memory cycle time of the CPU is 1us, the cpu will "wait" most of that 1us before it latches the data from the ROM.

I'll check an old 8051 data sheet later, but a 90ns ROM will work just fine.

doanld

Reply to
donald

to be a

at least

replacement ROM

after an

Chip

CS line

(1985) is

internal

most of

work just fine.

Donald, you are correct about the 8051, it is running at 12Mhz .

and in case i have not mentioned before the D23256AC lines/pins are consistent with the 27c256 in terms of conections made to the

8051

now i am just awaiting new mouser ROMs to test the new style ROM reads that look like real code.

no readable ascii strings such as copyright strings or company name in the new style ROM reads though ?? so that has me still a little suspicious but as code the new ROM download actually runs and loop in an 8051 simulator so that is promising.

Thanks for all the help donald, robb

Reply to
robb

is intended

programmer supports

[trim -- lots of very helpful advice]

Thanks Ian,

For all the help and useful advice. I forgot to thank you for taking time and effort to help. I do appreciate all the help.

Now, still waiting for new ROMs to try out all the advice.

to then

look at

unit you

Ah persistance, well i have always enjoyed challenges of big problems, trying to figure out how things function and elegant/simple solutions.

dont fix it!

I guess the original problem was not challenging enough to supress curiosity?

This project happened to be affordable, i usually check cavalier at the door where affordability is a dominant factor.

thanks again for all the help, robb

NUL:

Reply to
robb

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.