microcontroller ROM copy trouble ?

**new**

i think i may not be clear ? i am saying pin 1 and pin 27 of the memory chip are connected on the controller board so that would cause special consideration if one wanted to use a 27c512 ?

ROM

the

as

close , it is a series of sections of 64 duplicate bytes followed by another section of 64 duplicate bytes..... all the waty to the end

each section of byte values is different and i get the exact same series for each successive chip reading attempts.

unless i choose a different chip size like 27c128 then the series of byte duplicates changes. where the first set maybe 7A in place of the 02

here is a clip from begining of my read

:020000040000FA :1000000002020202020202020202020202020202D0 :1000100002020202020202020202020202020202C0 :1000200002020202020202020202020202020202B0 :1000300002020202020202020202020202020202A0 :100040000202020202020202020202020202020290 :100050000202020202020202020202020202020280 :100060000202020202020202020202020202020270 :100070000202020202020202020202020202020260 :10008000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9E0 :10009000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D0 :1000A000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9C0 :1000B000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9B0 :1000C000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9A0 :1000D000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D990 :1000E000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D980 :1000F000D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D970 :10010000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E68F :10011000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E67F :10012000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E66F :10013000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E65F :10014000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E64F :10015000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E63F :10016000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E62F :10017000E6E6E6E6E6E6E6E6E6E6E6E6E6E6E6E61F :1001800039393939393939393939393939393939DF :1001900039393939393939393939393939393939CF :1001A00039393939393939393939393939393939BF :1001B00039393939393939393939393939393939AF :1001C000393939393939393939393939393939399F :1001D000393939393939393939393939393939398F :1001E000393939393939393939393939393939397F :1001F000393939393939393939393939393939396F :1002000013131313131313131313131313131313BE :1002100013131313131313131313131313131313AE :10022000131313131313131313131313131313139E :10023000131313131313131313131313131313138E :10024000131313131313131313131313131313137E :10025000131313131313131313131313131313136E :10026000131313131313131313131313131313135E :10027000131313131313131313131313131313134E :100280001E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E8E .... till the end

I mapped the pins on the board so as to be reasonably certain that the ROM chip was compatible with the 27cXXX series of chips

all the pin/address/data lines seem to be consistent with the

27cXXX series pin out. the data and address lines match to the MCU adressing pins according to 27cXXX datasheet even the funny 8 through 11 pin jumble.

(pin 22) ROM goes to (pin 29) 8051 (PSEN- prog store enable) (pin 20) ROM goes to (pin 30)8051 (ALE-Addr Latch Enable)

on the PCB the 8 data lines are all connected with the first 8 Address lines so D0 is connected to A0 and (D1 to A1) and these shared connection s all go back to MCU

thanks for the help, robb

Reply to
robb
Loading thread data ...

Honestly, I just skimmed the replies, and don't have the time to get into great detail about what might be wrong....

However, if I recall correctly, parallel EPROMs used to have "Signature Bytes". In the old days, that's how a programmer "knew" what programming voltage / algorithm to use....

Could be the 8031 code is reading this, before allowing normal operation. (Wild ass guess, btw) Or, perhaps more likely, your programmer isn't really programming the new EPROM and its just lying to you.??

Hope you figure it out. Good luck.

-mpm

Utter rubbish.....the 8031 isn't reading sig bytes... Your programmer is not reading the eprom correctly.

Reply to
TT_Man

It would seem your original rom has an internal address latch. There is *some* evidence that 23256 roms with this feature may have been used by HP, but I have had no success finding a NEC data sheet for your rom. This would explain why the eprom reader reads the same value 64 times and also why there is no 8 bit latch chip between the multiplexed d0-7/A0-7 MCU bus and the rom's A0-7 address inputs. Try a different algorithm for reading the rom on the programmer. When you've go the correct contents that dissasemble to something reasonable, you'll need to put a little board together to insert a latch between the combined bus and the adddress pins, then program a 27c256 and try it.

HTH

--
Ian Malcolm.   London, ENGLAND.  (NEWSGROUP REPLY PREFERRED)
ianm[at]the[dash]malcolms[dot]freeserve[dot]co[dot]uk
 Click to see the full signature
Reply to
Ian Malcolm

Looks like gibberish to me.

What happens if you try reading it as a 27C512 ? Just an idea.

Graham

Reply to
Eeyore

The above seems to be the problem. Your programmer is not reading the original ROM (23xxx) chip correctly. However, it "is" reading something. Later you burn another chip, and this chip correctly burns what was read previously. The only problem is, the original read was not right, so it matters not if the two compare!!

I still contend this is a read problem on the original ROM, likely related to the signature byte. To my knowledge, you are unlikely to blow up the original ROM using read voltages. As long as you don't try to program it. So, if you feel its worth the attempt, you could try other 27256 settings and see if you can get something that looks reasonably close to 8031 opcodes. (?)

Another posted commented that your 23xxx might have internal address latches. Honestly, I've never heard of that. I doubt they exist, but I could be wrong. I am assuming the 23xxx is a factory-masked ROM (i.e., no eprom quartz window). If that's the case, very often the 23xxx programming info is on the same datasheet as the 27xxx of the same manufacturer and model series. It might be worth googeling...

And of course, if there are pinout differences between the masked-rom and eprom versions, your programmer would need to know about these... and hence we're back to the signature bytes. Good luck.

-mpm

Reply to
mpm

I agree, now that I have read the replies more thoroughly, esp, post #3, it would appear that your programmer is not reading the original masked ROM part correctly.

Reply to
mpm

I agree, now that I have read the replies more thoroughly, esp, post #3, it would appear that your programmer is not reading the original masked ROM part correctly.

This is what I have found out about UPD23C256E..... The OE signal is mask option selectable and can be active hi, low or don't care.

Put the chip in your reader, but bend out the OE leg ( pin 22). Connect it via a 1K resistor to Vcc and then read as 'any' 27256 EPROM. Look at the data and see if it looks 'real'. If not, leave pin 22 'not connected 'and read again...... I don't think it's worth trying to connect OE to GND as that is the default for all generic 27356 devices.

Reply to
TT_Man

Not to mention that if /OE is tied in some unusual way on his board, it also won't work with standard Eproms.

It might be an idea to see if pin22 of the ROM socker is tied low.

Graham

Reply to
Eeyore

ROM

the

as

was

matters

likely

using

27256

close

Thanks for all the help and info mpm,

i am really stuck and appreciate your's and everyones efforts to get me going.

that is exactly what i have been trying since the latest round of

**bad ROM read** diagnosis.

I have been selecting a variety of different chip makers versions of 27cXXX where XXX is {64,128,256,512}... additionally i have been choosing different sizes of reads to see if i get anything that looks like some 8051/8031 op codes. so 0xf to 0x7fff bytes and in between

the only difference is that sometimes the sequence of bytes i get have a different values for the different sized chips

so.... that means a (27c128) read will get me a different sequence of repeated chars than say a (27c256) read

address

well that advice was based on the fact that i traced the pins connection on the controller circuit board to try and decipher what this chip might actaulally be and i found that the

Address lines 0-7 were tied to the Data lines 0-7 and then they made ther way to the appropriate 8051 lines so being multiplexed someone though there must be latching operation...

the only 23xxx datasheet i found (toshiba TMM23256P) says ... that it uses a Address Latch on the falling edge of (CE) and latches all inputs except for (OE) to provide data bus compatibility and has a reference to 3-State outputs or Wired OR capability ????? what that means ????

My pin trace is..... Where Rom is the same ROM there is only 1 ROM this views best in fixed width eg. courier

Rom(pin) Rom(pin) 8051 (pin)

------------------------------------------ A0 (p10) D0 (p11) P0.0 (p39) A1 (p9) D1 (p12) P0.1 (p38) A2 (p8) D2 (p13) P0.2 (p37) ...... A8 (p25) --- P2.0 (p21) A9 (p24) --- P2.1 (p22) ..... A14 (p27) A15 (p1) P2.6 (p27) ..... OE (p22) --- PSEN (p29) CE (p20) --- ALE (p30)

I could

quartz

the

masked-rom

these...

thanks again MPM,

i really do appreciate the help. hopefully i will solve or find more useful info that someone can give me an indication of what i need to do to solve this problem

i am thinikng i will need to use some 8051 development board and write my own application to grab data and put somewhere to upload or print on serial port or something

sound feasible,...

Thanks again for help, robb

Reply to
robb

post

original

low or don't

22). Connect it

the default

thanks TT_MAN,

ok, interesting experiment,

when i tie the p22 (oe) high then i read all 0xFF all the way floating gives similar as when connected

reading a troshiba 23256 mask rom datasheet it showed that the latch occurs at trailing edge of (CE) so (CE) falls about halfway through the adress valid ... but most timing diagrams for 27cXXX chips show the (CE) falling at or just before the address valid section

so i do not know how that timing could affect what i am doing. i suppose i need to find out what the ROM programmer is doing.

programmer is an "Easypro90" if anyone has any knowledge of these?

thanks for helping, robb

Reply to
robb

Now tie it low.

AND look at how it's connected on the equipment pcb.

Graham

Reply to
Eeyore

Lets start with a few basics.

Plesae post from your reader the first 16 bytes of the ROM file.

If this does not look right, then everything else will be off.

If the reader can not read it, it won't be able to write anything that makes sense.

You could always run the exorcised binary file thru a dis-assembler, re-assemble it, program your EEPROM and see if that runs.

donald

Reply to
donald

esp, post

original

low or don't

22). Connect it

is the default

board, it also

low.

Thanks for the help,

I tried out the ideas you suggested.

that is .... select different ROM types and i also tried with differing read lengths for 0xf to 0x7fff or whatever the max size is and all the same results

except that different 27cXXX types gives me different sequence of repeated bytes

i tried the OE pin out and jumpering pins and such

i think maybe my programmer is just crap it is an "Easypro90" and it supports lots of chips but apparently not the one i need

i highlighted the pinout and traces of the ROM chip in another post i will put it here ....

My pin trace is..... Where Rom is the same ROM there is only 1 ROM this views best in fixed width eg. courier

Rom(pin) Rom(pin) 8051 (pin)

------------------------------------------ A0 (p10) D0 (p11) P0.0 (p39) A1 (p9) D1 (p12) P0.1 (p38) A2 (p8) D2 (p13) P0.2 (p37) ...... A8 (p25) --- P2.0 (p21) A9 (p24) --- P2.1 (p22) ..... A14 (p27) A15 (p1) P2.6 (p27) ..... OE (p22) --- PSEN (p29) CE (p20) --- ALE (p30)

one thing i have come across that may help is that the oly mask ROM datasheet i have found (Toshiba TMM23256P) says that the chip has Adress latch on falling edge of (CE) and the timing diagrm shows the falling CE edge occurs in middle of address valid section, on most 27cXXX chips the timing diagram shows the falling edge of CE occurs just at or before the valid address section but i do not know if that should make a diference ??

Thanks for all the help Graham, as i relly need it to get out of this jam.

do you think it would be difficult to program a 8051 development board to read this data and say dump it somewhere to pick it up .

seems like it should be easy enough ??? i have a PJRC Rev 4 board

formatting link
that i got with the ROM programmer pretty cheap

i do not know if my Programmer will alloew you to write a custom algorithm but i ahve not found any info on the easypro site to that regard.

thanks again, robb

Reply to
robb

file.

anything that

dis-assembler,

Hello donald thanks for the help,

i agree if you getting crap you write crap,

i though i had allready tested the ROM reads previously and had success but when i went to recheck i found that the other microcontroller board was using a 8051 with internal programand not even uing the ROM

so now i realise that it is reading the ROM that is my problem.

so now how to get programmer to read these ROMS ??

here are first lines from "Easypro90B" programmer read

:020000040000FA :1000000002020202020202020202020202020202D0 :1000100002020202020202020202020202020202C0

any experience dumping memorywith a 8051 development board ? i have PJRC Rev 4 board

formatting link

easier than getting the EasyPRO90B to do it ???

thanks again for the help, robb

Reply to
robb

Ok, here is your first problem.

At address 0x000 should be a jump to a start address.

02 is a long jmp op-code a nd the target address looks like 0x0202.

formatting link

But then all the interrupt vectors are long jumping to the same address.

This is a problem.

If you can share the entire hex file, maybe someone here be able to help you read it.

Another idea.

Maybe the address lines are mixed up, so a strait copy would be worng.

good luck.

donald

Reply to
donald

Active HIGH versus Active LOW on CS and OE pins? Maybe the EPROM programmer is able to compensate for that and "do the right thing", but your target circuit can't? Been through that recently with some EPROM/ROMs and it is a pain.

Get data sheets for both chips and look closely.

--
--------------------------------------+------------------------------------
Mike Brown: mjb[at]pootle.demon.co.uk | http://www.pootle.demon.co.uk/
Reply to
Mike

"Nearly" tell that to Apple and Sinclair.

Apple II Europlus O/S ROMS wouldn't read on my EPROM programmer without some fiddling about to come up with CS (Chip select) HIGH and VPP/OE LOW. (Normal would be BOTH low)

Sinclair QL OS ROMS are odder still: OE required to be HIGH, CS is active LOW on one chip, active HIGH on another. The CS lines are tied together in the computer, so it makes sense. However, for an EPROM programmer, it's backwards.

Also run it through an ASCII dump, look for any copyright strings that make sense.

--
--------------------------------------+------------------------------------
Mike Brown: mjb[at]pootle.demon.co.uk | http://www.pootle.demon.co.uk/
Reply to
Mike

Exactly.

Robb,

I don't think the Easy Pro 90 can read the D23256ac because the chip is too slow, (150 to 250ns).

Here what I would do. Build a simple adapter to your printer port and strobe the address lines to read the data bits off the D23256ac. Remember the slower the read the better for you. Also the speed of you computer will affect your reading. If you can connect an oscilloscope to you printer port (even the Easypro 90 to pin A1 ), you can figure how fast it is reading the D23256ac.

Once you got the image file you can burn the ST M27C256B (45ns) with your Easypro 90.

In case you want to update the Easypro 90 software, you can grab it from

formatting link

Don't bother contacting tech support because they never reply.

Reply to
Romdump

Judging by the age of this system that may typically be an 8751.

Can you provide the exact part number of the 8051 with suspected internal program please ?

You can tell if it's using the internal ROM because pin 31 (/EA/Vpp) will be tied high. It's still possible to read an external ROM in this mode but it will appear as an 'extension' to the interal ROM with a start address offset by the size of the internal ROM.

I'm beginning to think you might benefit from a cheap and cheerful Chinese Eprom/uC reader writer btw. Especially if you need to read the contents of an 8751 type device.

formatting link

formatting link

Graham

Reply to
Eeyore

Do you have a plain 'vanilla' example of an 8051 application circuit with external ROM showing the connection of the address and data lines (and address latch) ?

In view of comments made, I suggest that you 'buzz out' all the address and data line connections between the 8051 and the ROM on your board and report back to establish if there's anything unusual here.

Graham

Reply to
Eeyore

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.