microcontroller ROM copy trouble ?

[Mike]

My guess is that here is a subtle pin difference between the eproms... speed
is definitely NOT an issue.

Active HIGH versus Active LOW on CS and OE pins? Maybe the EPROM programmer
is able to compensate for that and "do the right thing", but your target
circuit can't? Been through that recently with some EPROM/ROMs and it is
a pain.

Get data sheets for both chips and look closely.

 

[Mike]

*Reading* is (nearly) universal for memory chips with a standard
pinout.

"Nearly" tell that to Apple and Sinclair.

Apple II Europlus O/S ROMS wouldn't read on my EPROM programmer without
some fiddling about to come up with CS (Chip select) HIGH and VPP/OE LOW.
(Normal would be BOTH low)

Sinclair QL OS ROMS are odder still: OE required to be HIGH, CS is active
LOW on one chip, active HIGH on another. The CS lines are tied together
in the computer, so it makes sense. However, for an EPROM programmer,
it's backwards.

Have you tried running the object code through a disassembler?

Also run it through an ASCII dump, look for any copyright strings that
make sense.

 

[Romdump]

Exactly.

Robb,

I don't think the Easy Pro 90 can read the D23256ac because the chip
is too slow, (150 to 250ns).

Here what I would do. Build a simple adapter to your printer port and
strobe the address lines to read the data bits off the D23256ac.
Remember the slower the read the better for you.
Also the speed of you computer will affect your reading. If you can
connect an oscilloscope to you printer port (even the Easypro 90 to
pin A1 ), you can figure how fast it is reading the D23256ac.

Once you got the image file you can burn the ST M27C256B (45ns) with
your Easypro 90.

In case you want to update the Easypro 90 software, you can grab it
from http://www.programtec.com/english/main.asp.

Don't bother contacting tech support because they never reply.

 

[Eeyore]

but when i went to recheck i found that the other
microcontroller board was using a 8051 with internal programand
not even uing the ROM

Judging by the age of this system that may typically be an 8751.

Can you provide the exact part number of the 8051 with suspected
internal program please ?

You can tell if it's using the internal ROM because pin 31 (/EA/Vpp)
will be tied high. It's still possible to read an external ROM in this
mode but it will appear as an 'extension' to the interal ROM with a
start address offset by the size of the internal ROM.

I'm beginning to think you might benefit from a cheap and cheerful
Chinese Eprom/uC reader writer btw. Especially if you need to read the
contents of an 8751 type device.

http://cgi.ebay.co.uk/ADVANCED-EPRO...ryZ40004QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

http://cgi.ebay.co.uk/USB-TOP2005-U...ageNameZWD2VQQcmdZViewItem?_trksid=p1638.m122



Graham

 

[Eeyore]

Hint if you read garbage:
Sometimes there is added simple encryption by mixing address and/or data
lines between controller and memory. You should check that!

I'd love to see someone make an 8051 do that. The 'controller' is the 8051.

None of this would prevent a simply copy working though ! Think about it guys.

Graham

 

[Eeyore]

I have a working (ie. tested) microcontroller board uses a
(Philips MAB-8031-AH-12p) MCU a 8051 variant, maybe romless ?
with a (NEC 23256AC) ROM chip.

Do you have a plain 'vanilla' example of an 8051 application circuit
with external ROM showing the connection of the address and data lines
(and address latch) ?

In view of comments made, I suggest that you 'buzz out' all the address
and data line connections between the 8051 and the ROM on your board and
report back to establish if there's anything unusual here.


Graham

 

[Ian Malcolm]

robb wrote:




Judging by the age of this system that may typically be an 8751.

Can you provide the exact part number of the 8051 with suspected
internal program please ?

You can tell if it's using the internal ROM because pin 31 (/EA/Vpp)
will be tied high. It's still possible to read an external ROM in this
mode but it will appear as an 'extension' to the interal ROM with a
start address offset by the size of the internal ROM.

I'm beginning to think you might benefit from a cheap and cheerful
Chinese Eprom/uC reader writer btw. Especially if you need to read the
contents of an 8751 type device.

http://cgi.ebay.co.uk/ADVANCED-EPRO...ryZ40004QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

http://cgi.ebay.co.uk/USB-TOP2005-U...ageNameZWD2VQQcmdZViewItem?_trksid=p1638.m122



Graham

Unfortunately he *has* a chinese multi-device programmer
<http://www.programtec.com/english/products/EasyPRO90B.asp>

It appears likely that it is the source of his problems, and getting
another similar one *UNLESS* it has *FULL* instructions on implementing
one's own programming and reading algorithms

It is *supposed* to have lifetime support so it might be worth it for
the OP to contact them with his part number ;-)

The available evidence suggests that the EasyPRO90 he has reads 27xnn
EPROMS using a 'fast' algorithm that reads 64 bytes at a time,
activating /CE continuously and strobing /OE for each byte.
Unfortunately he needs a 'slow' algorithm that strobes *both* signals,
with adequate setup and hold time :-(


A bit of research leads me to the 87C256 Latched EPROM which is intended
for use in applications with /ALE on pin 20. If his programmer supports
this device or equivalent he should be golden.

If so, and he could source one, or someone can suggest a device with the
same functionality, it would be a drop in replacement, otherwise, well
I've built all sorts of ROM adaptors 'dead bug' fashion using two
stacked turned pin sockets with the top soldered into the bottom one
with various pins I needed to intercept cut away in between them, kynar
wire, some cotton thread to lace the kynar in place, some SMD TTL and a
few drops of superglue to hold everything together. Keeps the pins
clean & fit to insert in the programmer and also avoids needing to mod
the equipment PCB (assuming there is ~1cm vertical clearance).

 

[TT_Man]

t does **NOT** work ... a no go.

i removed the ROM (ST) and put the ROM (NEC) back and works like
a charm... no problems

i download ROM images from both (NEC) and (ST) and compare in
file compare program which declares them as exactly the same
?????

HELP please?? any ideas what is going on here.

the only funny thing about the microboard (that i know) is that
the ROM memory socket has (pin1) tied to (pin 27) that is Addr15
(pin 1) and Addr 14 (pin 27) ??? do not know why ????

thanks for any help i am stuck again,
robb

Where are you located in the UK?

 

[robb]

Do you have a plain 'vanilla' example of an 8051 application circuit
with external ROM showing the connection of the address and data lines
(and address latch) ?

In view of comments made, I suggest that you 'buzz out' all the address
and data line connections between the 8051 and the ROM on your board and
report back to establish if there's anything unusual here.

Appologies for late turn around reply,
finishing up X-mas mode, returned from 4 hour drive to relatives
this PM.

Just wanted to give a quick reply before sleep.... so that you
didn't think i gave up on your much appreciated help.

The ROM/MCU does connect to other chips but does not go through
them. That is, my original pinout diagram of the ROM lines to MC
line relations holds true, there are direct traces from the ROM
Addr/Data lines to MCU's ports 0 and 2.

but also the ROM Addr 0-7 is connected to the inputs 1D,2D
etc.... of 3 diff SN74LS377 (D-Type Flip-Flops) the output of
the Flip-FLops 1Q,2Q ... connect to either a Static Ram chip's
(SRM2016) Address lines and the SRM data lines are also connected
to the I/O port 1 of MCU

the LS377 has connections to other chips around the MCU eg.
(74LS251, 74LS28B, 4049, others)

I will work on a more complete pin connections, i origianlly just
posted to show that the ROM pins were consistent with 27cXXX
series chips.

My chepao chim=nese reader did supoprt the chip that someone
suggested the D87c257 and i get something alot more promissing
shown below...

i do not know if it is good yet as i do not have any more blank
ROM chips to burn and i have not tried to load into a 8051
dis-asembler

thanks for all the help Graham,
robb

D87c257 read....
----------------------
:020000040000FA
:1000000002096FC0D0C0E0020173FFC0D0C0E0029F
:1000100001BEFF30B202D22A32FFFFC0D0C0E0C022
:1000200082C083C000904058E531540F204C073007
:1000300045036001040423F893F58DE80493F58BE0
:10004000E542540790405093F8E541540793C44863
:10005000758360F0206F26D294E530758350F0E50B
:100060002D543F7041C245C28E206F19205D1E1273
:100070000F39D000D083D082D0E0D0D032204DD9FB
:100080007530FF80D4205C4C12154A80E5E5422093
:10009000E002C294E530758350F080D6E54120E05F
:1000A000F353307780EE14601314147002D24CE5D1
:1000B0003130450C540F600215313164316480B227
:1000C000C4B53109C24C1046F1D24580ED104CEA5E
:1000D000053180E6104DC5E520440F20E701C4F549
:1000E00030758DFBD28ED24D53200F80854320F08A
:1000F000E52D543F603AFDF5317842306F0118E646
:1001000030E0021531E531C313B4020575310A80C0
:100110000DC394035001E4C3139246C4F531E6D2F3
:100120004C20E009C24CED1460031201641201641A
:10013000208E20306F06E530C4B53009758DFF750F
............
............
:10096000D23D22D23C22E0540F24F650F3808D7504
:1009700090CC797E7802760008D9FB75B8E175894C
:1009800011758CFE75880575A8867583607444F0B2
:1009900075835074FFF530F0758D88D28ED2137543
:1009A000530AD28C120D60308FFA7583507477F52C
:1009B00030F07455758360F0C28F758D88120D60AC
:1009C000308FFA906007E030E002D20A756DE0D215
:1009D00014D2131230A8754400C22C121808C28E0B
:1009E000C28FD2AB1229FCD2192019F82018F5A217
:1009F000B492E0A2B592E1F45403F52B3014102028
:100A0000200D204A472010031218EAC214C2131204
:100A100029FC304A082011E4200DE1800DE5445402
:100A2000F0B4F006202FD52010D220182AD293D26D
:100A300092C295C2D3C2D4A2B492E0A2B592E1F41C
:100A40005403FAE52B5403B5023980B02011BC20C1
:100A50000DB91231A780B4D2193014057553008036
:100A60009B3018C93092298043501E120CAEEA60A8
:100A700030B4030A205A12D25A1213157403120DFD
:100A8000428006EA20E0E250E2532BFC422B21FC9C
:100A9000C293D295C291E543B4569CC290D2A8802D
:100AA00096305AE5C25A120EA5E480DD7552A0C2F6
:100AB00093D292C20A304102D291E543B45602D297
:100AC00090752E00750600D215754D00120CAEC241
:100AD00089D2A8301E04C22AC21EC25A205646E538

 

[robb]

Unfortunately he *has* a chinese multi-device programmer
<http://www.programtec.com/english/products/EasyPRO90B.asp>

It appears likely that it is the source of his problems, and getting
another similar one *UNLESS* it has *FULL* instructions on implementing
one's own programming and reading algorithms

It is *supposed* to have lifetime support so it might be worth it for
the OP to contact them with his part number ;-)

The available evidence suggests that the EasyPRO90 he has reads 27xnn
EPROMS using a 'fast' algorithm that reads 64 bytes at a time,
activating /CE continuously and strobing /OE for each byte.
Unfortunately he needs a 'slow' algorithm that strobes *both* signals,
with adequate setup and hold time :-(

A bit of research leads me to the 87C256 Latched EPROM which is intended
for use in applications with /ALE on pin 20. If his programmer supports
this device or equivalent he should be golden.

Thanks for the help Ian,

And the EasyPRO90B does happen to support a couple of different
varieties of that chip well its cale a (D87c257 Intel , M87c257
ST) and when i read selecting these devices i get a more
promising read that i will need to test burn or verify in 8051
disasembler.

i show the output at the end of the reply below...

interestingly a different (NEC D23128AC) gives similar trouble

If so, and he could source one, or someone can suggest a device with the
same functionality, it would be a drop in replacement, otherwise, well
I've built all sorts of ROM adaptors 'dead bug' fashion using two
stacked turned pin sockets with the top soldered into the bottom one
with various pins I needed to intercept cut away in between them, kynar
wire, some cotton thread to lace the kynar in place, some SMD TTL and a
few drops of superglue to hold everything together. Keeps the pins
clean & fit to insert in the programmer and also avoids needing to mod
the equipment PCB (assuming there is ~1cm vertical clearance).

by ROM adaptor ? you mean to make the D23256AC look or behave
like some other chip that is supported ??? eg 27C256 etc...

the only difference these amateur eyes could see with the 87c257
was the addition of a latch strobe on the pin 1 ??? and it
coincided almost nearly with the CE . that seems easy enough to
fabricate ?

any ways below is a dump using the 87c257 device

thank you, i appreciate all the effort and help,
robb


D87c257 read....
----------------------
:020000040000FA
:1000000002096FC0D0C0E0020173FFC0D0C0E0029F
:1000100001BEFF30B202D22A32FFFFC0D0C0E0C022
:1000200082C083C000904058E531540F204C073007
:1000300045036001040423F893F58DE80493F58BE0
:10004000E542540790405093F8E541540793C44863
:10005000758360F0206F26D294E530758350F0E50B
:100060002D543F7041C245C28E206F19205D1E1273
:100070000F39D000D083D082D0E0D0D032204DD9FB
:100080007530FF80D4205C4C12154A80E5E5422093
:10009000E002C294E530758350F080D6E54120E05F
:1000A000F353307780EE14601314147002D24CE5D1
:1000B0003130450C540F600215313164316480B227
:1000C000C4B53109C24C1046F1D24580ED104CEA5E
:1000D000053180E6104DC5E520440F20E701C4F549
:1000E00030758DFBD28ED24D53200F80854320F08A
:1000F000E52D543F603AFDF5317842306F0118E646
:1001000030E0021531E531C313B4020575310A80C0
:100110000DC394035001E4C3139246C4F531E6D2F3
:100120004C20E009C24CED1460031201641201641A
:10013000208E20306F06E530C4B53009758DFF750F
............
skip
............
:10096000D23D22D23C22E0540F24F650F3808D7504
:1009700090CC797E7802760008D9FB75B8E175894C
:1009800011758CFE75880575A8867583607444F0B2
:1009900075835074FFF530F0758D88D28ED2137543
:1009A000530AD28C120D60308FFA7583507477F52C
:1009B00030F07455758360F0C28F758D88120D60AC
:1009C000308FFA906007E030E002D20A756DE0D215
:1009D00014D2131230A8754400C22C121808C28E0B
:1009E000C28FD2AB1229FCD2192019F82018F5A217
:1009F000B492E0A2B592E1F45403F52B3014102028
:100A0000200D204A472010031218EAC214C2131204
:100A100029FC304A082011E4200DE1800DE5445402
:100A2000F0B4F006202FD52010D220182AD293D26D
:100A300092C295C2D3C2D4A2B492E0A2B592E1F41C
:100A40005403FAE52B5403B5023980B02011BC20C1
:100A50000DB91231A780B4D2193014057553008036
:100A60009B3018C93092298043501E120CAEEA60A8
:100A700030B4030A205A12D25A1213157403120DFD
:100A8000428006EA20E0E250E2532BFC422B21FC9C
:100A9000C293D295C291E543B4569CC290D2A8802D
:100AA00096305AE5C25A120EA5E480DD7552A0C2F6
:100AB00093D292C20A304102D291E543B45602D297
:100AC00090752E00750600D215754D00120CAEC241
:100AD00089D2A8301E04C22AC21EC25A205646E538

 

[robb]

Henry Kiefer wrote: [trim]

Sometimes there is added simple encryption by mixing address and/or data
lines between controller and memory. You should check that!

This encryption type does allow copying the ROM but makes it hard to
disassemble it.

You are correct, the bytes and bits should be in the same location after
the copy, even if the address/data lines are mixed up.

Encryption would imply that the data/address path is moved around.

So, OP, is there any other chips in the data/address path ??

donald

Hello Don and Kiefer,
thanks for taking time and trying to help.

I wondered about the encryption myself considering all the
trouble reading a simple ROM chip to burn another,

i wondered if they might have tried to protect it somehow but
then these are very speacialized controlers so the only real
protectin they might want is trying to hide their ideas from a
potential competitor then that would make sense.

but with any of that i should be able to just duplicate the ROM
memory and have it work ?? yes ??

i do not want to debug or decipher just duplicate ROM to replace
my fried ROM

no other chips between the data path and ROM/MCU
**BUT** there are chips connected to those ROM/MCU address lines
- SN74LS377 (D-Type Flip-Flops)
- 74LS251, (data selector multiplexer, 3 state out)
- 74LS28J, (2 input positive NOR buffers )
- 4049

the ROM Addr 0-7 is connected to the inputs 1D,2D
etc.... of 3 diff SN74LS377 (D-Type Flip-Flops) the output of
the Flip-FLops 1Q,2Q ... connect to a Static Ram chip's
(SRM2016) Address lines and the SRM data lines are connected
to the I/O port 1 of MCU p1.0-7

the LS377 has connections to the other chips around the MCU also
eg.
(74LS251, 74LS28B, 4049, others)

i posted a PIC in alt.binaries.schematics.electrionics of all the
chips involved.
i know it is not a schematic but it shows the chips i am talking
about.


thanks again donald for all the help,
robb

 

[robb]

That is my job to shot. I like it since 25 years.

Greetings -
Henry

First thanks for all the help,

I have new ROM dump below (bottom of post)using a chip suggested
by Ian an D87C257 this loks better if you could take a peek and
comment i would appreciate that/

i don't want anyone shooting in the dark i want to make it
bright and clear

i give the information i have first and then whatever will help
you experts help me i try to provide as best i can.

I originally tried to approached this as simple as possible...
copy ROM(orig) image , burn ROM(new), test ROM(new) on the
working board

so that i would not need to worry with encryption and adress
shifts and all the other tricks of the trade.

so now the ROM reader is suspect

thanks again,
robb

D87c257 read....
----------------------
:020000040000FA
:1000000002096FC0D0C0E0020173FFC0D0C0E0029F
:1000100001BEFF30B202D22A32FFFFC0D0C0E0C022
:1000200082C083C000904058E531540F204C073007
:1000300045036001040423F893F58DE80493F58BE0
:10004000E542540790405093F8E541540793C44863
:10005000758360F0206F26D294E530758350F0E50B
:100060002D543F7041C245C28E206F19205D1E1273
:100070000F39D000D083D082D0E0D0D032204DD9FB
:100080007530FF80D4205C4C12154A80E5E5422093
:10009000E002C294E530758350F080D6E54120E05F
:1000A000F353307780EE14601314147002D24CE5D1
:1000B0003130450C540F600215313164316480B227
:1000C000C4B53109C24C1046F1D24580ED104CEA5E
:1000D000053180E6104DC5E520440F20E701C4F549
:1000E00030758DFBD28ED24D53200F80854320F08A
:1000F000E52D543F603AFDF5317842306F0118E646
:1001000030E0021531E531C313B4020575310A80C0
:100110000DC394035001E4C3139246C4F531E6D2F3
:100120004C20E009C24CED1460031201641201641A
:10013000208E20306F06E530C4B53009758DFF750F
............
snip
............
:10096000D23D22D23C22E0540F24F650F3808D7504
:1009700090CC797E7802760008D9FB75B8E175894C
:1009800011758CFE75880575A8867583607444F0B2
:1009900075835074FFF530F0758D88D28ED2137543
:1009A000530AD28C120D60308FFA7583507477F52C
:1009B00030F07455758360F0C28F758D88120D60AC
:1009C000308FFA906007E030E002D20A756DE0D215
:1009D00014D2131230A8754400C22C121808C28E0B
:1009E000C28FD2AB1229FCD2192019F82018F5A217
:1009F000B492E0A2B592E1F45403F52B3014102028
:100A0000200D204A472010031218EAC214C2131204
:100A100029FC304A082011E4200DE1800DE5445402
:100A2000F0B4F006202FD52010D220182AD293D26D
:100A300092C295C2D3C2D4A2B492E0A2B592E1F41C
:100A40005403FAE52B5403B5023980B02011BC20C1
:100A50000DB91231A780B4D2193014057553008036
:100A60009B3018C93092298043501E120CAEEA60A8
:100A700030B4030A205A12D25A1213157403120DFD
:100A8000428006EA20E0E250E2532BFC422B21FC9C
:100A9000C293D295C291E543B4569CC290D2A8802D
:100AA00096305AE5C25A120EA5E480DD7552A0C2F6
:100AB00093D292C20A304102D291E543B45602D297
:100AC00090752E00750600D215754D00120CAEC241
:100AD00089D2A8301E04C22AC21EC25A205646E538

 

[Ian Malcolm]

Thanks for the help Ian,

And the EasyPRO90B does happen to support a couple of different
varieties of that chip well its cale a (D87c257 Intel , M87c257 ST)
and when i read selecting these devices i get a more promising read
that i will need to test burn or verify in 8051 disasembler.

i show the output at the end of the reply below...

Looking hopefull. I dont have any 8051 tools installed so I cant easily
check it, but it looks too regular to be garbage and doesn't repeat in
the ways I'd expect from a bad read. It dosn't contain any ASCII text
(unless the address and/or data lines are scrambled (not wired 1-1 2-22
etc.)) but I wouldn't expect that unless the original unit has a LCD (or
LED) dot matrix display or a serial port.

interestingly a different (NEC D23128AC) gives similar trouble

Probably the wrong algorithm. without checking its data sheet, I cant
match it up to a supported device, or are you telling me you tried this
chiptype reading the D23256AC? Unless you have a D23128AC you need to
read, IMHO its not worth the effort.

*MUCH* the best option if you can get an 87c257 to program.

So you ran out of blank roms If you are doing much of this, you
*need* a UV EPROM eraser. Easy enough to make if you can get the UV
tube and a torch with the same size tube to gut for the tube mounting
and invertor. *DONT* look at the light - if you value your eyes (if you
catch a brief glimpse it wont hurt you). At its minimum, its just the
tube powered up and supported 1 diameter above the window in the EPROM
in a bit of antistatic foam, with a box over it all so you cant see the
light from the tube. The timing is important. You need to find how long
it takes to wipe the chip then add about 50% for reliability. I suggest
starting with 3 minute increments. and expect a result in the 10-20
minute range Once you know how powerful your eraser is, you can just
use that time, but an occasional check for blank at 2/3 time is good
incase yor UV tube is getting weak. Get this project out of the way
then box up the eraser nicely, painting the inside of the box matt black
and maybe add a timer.

by ROM adaptor ? you mean to make the D23256AC look or behave like
some other chip that is supported ??? eg 27C256 etc...

NO, completely the other way round, make a supported 27C256 look like a
D23256AC or 87c257 so it can be used to *REPLACE* the D23256AC in the
equipment after programming it without the adaptor.

the only difference these amateur eyes could see with the 87c257 was
the addition of a latch strobe on the pin 1 ??? and it coincided
almost nearly with the CE . that seems easy enough to fabricate ?

YES, you need to intercept the high address lines (A0-A7 stay directly
connected) and insert a latch between them and the combined address/data
lines clocked by the ALE signal. SMD TTL octal latch chip, some very
fine solid core wire and get at it. N.B. when building SMD 'dead bug'
fashion, solder all the kynar (wire wrap wire) to the chip pins first.
You will probably need a bit of very thin stiff plastic to glue the chip
to. The plastic is glued on top of the frame of the lower socket. You
cut back the pins of the top socket that you need to divert and solder
the wires to the stubs. You solder all the pins left on the top socket
with the top socket not quite fully inserted into the bottom one. do
corner pins first and get it level. The actual sockets on a turned pin
socket take solder quite nicely but you only get one shot to put a pin
in there. Put the bottom socket in another one or some scrap perfboard
while you work to stop the pins moving if the plastic softens from the
heat. Lay off the Coffee for 24 hours before hand and get a good nights
sleep first!

It *MAY* be possible to get away with a normal flat pin socket with the
high address pins bent out and patched to the outputs of one of the
octal latches on the board if the address demultiplexing for the RAM has
its outputs permanently enabled (or pick it up at the RAM). If the
latch has a chip other than the 8051 feeding /OE or CLK, its probably no
good for the signals you need. Pin 20 would need to be tied low.

any ways below is a dump using the 87c257 device

thank you, i appreciate all the effort and help, robb


D87c257 read.... ----------------------
:020000040000FA
:1000000002096FC0D0C0E0020173FFC0D0C0E0029F
:1000100001BEFF30B202D22A32FFFFC0D0C0E0C022
:1000200082C083C000904058E531540F204C073007
:1000300045036001040423F893F58DE80493F58BE0

<IntelHEX dump snipped>

I recccomend you find a file sharing service to post the dump to then
give us a link for anyone with 8051 experience can then take a look at
it. It would be nice to know make model and description of the unit you
are trying to repair as well.

Good luck with it, I admire your persistance
HAPPY NEW YEAR.

P.S. I have a new year resolution for you: If it aint broke dont fix it!
(Unless you can afford to sacrifice one to your curiosity)

 

[Andy]

well that advice was based on the fact that i traced the pins
connection on the controller circuit board to try and decipher
what this chip might actaulally be and i found that the

Address lines 0-7 were tied to the Data lines 0-7 and then they
made ther way to the appropriate 8051 lines so being multiplexed
someone though there must be latching operation...

the only 23xxx datasheet i found (toshiba TMM23256P) says ...
that it uses a Address Latch on the falling edge of (CE) and
latches all inputs except for (OE) to provide data bus
compatibility and has a reference to 3-State outputs or Wired
OR capability ????? what that means ????

My pin trace is.....
Where Rom is the same ROM there is only 1 ROM
this views best in fixed width eg. courier

Rom(pin) Rom(pin) 8051 (pin)
------------------------------------------
A0 (p10) D0 (p11) P0.0 (p39)
A1 (p9) D1 (p12) P0.1 (p38)
A2 (p8) D2 (p13) P0.2 (p37)
......
A8 (p25) --- P2.0 (p21)
A9 (p24) --- P2.1 (p22)
.....
A14 (p27) A15 (p1) P2.6 (p27)
.....
OE (p22) --- PSEN (p29)
CE (p20) --- ALE (p30)

The address is obviously being latched in the ROM. Otherwise, when the
8051 switches to reading the ROM's data, the address that it was
providing to the ROM will be gone.

 

[donald]

The address is obviously being latched in the ROM. Otherwise, when the

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I was wondering about that.

I have not found a data sheet for the D23256.

Is the OP trying to insert a 27256 into the same socket that the D23256
came out of ??

That would explain why the 27256 would not work in the same socket.

donald

 

[robb]

when the
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I was wondering about that.

I have not found a data sheet for the D23256.

Is the OP trying to insert a 27256 into the same socket that the D23256
came out of ??

That would explain why the 27256 would not work in the same socket.

Hello OP here,
The reason for trying to use a 27c256 in place of the D23256AC
is.....

that was some advice given on the MCU-Mall user forum where they
sell lots of cheap chinese ROM programmers.

one of the regular posters thought 23256 was just a read only /
mask rom version of the 27c256 ?
so i went with that.

i kind of half convinced myself that the latching mechanism could
be superceeded with a fast enough 27c256 operation ????

the 23256 was 150ns and many 27c256 are 50-90 ns so that 27c256
is ready long before the read occurs ??? that was my thinking


thanks for any help ,
robb

robb

 

[Andy]

Hello OP here,
The reason for trying to use a 27c256 in place of the D23256AC
is.....

that was some advice given on the MCU-Mall user forum where they
sell lots of cheap chinese ROM programmers.

one of the regular posters thought 23256 was just a read only /
mask rom version of the 27c256 ?
so i went with that.

i kind of half convinced myself that the latching mechanism could
be superceeded with a fast enough 27c256 operation ????

the 23256 was 150ns and many 27c256 are 50-90 ns so that 27c256
is ready long before the read occurs ??? that was my thinking

For such a scheme to possibly work, your replacement ROM has to be a
lot slower, not faster. A 150ns ROM means the MCU has to wait at least
150ns before the data is valid for reading. A 90ns replacement ROM
means the data is guaranteed to have changed at most 90ns after an
address change, long before the MCU is set to read it.

 

[donald]

For such a scheme to possibly work, your replacement ROM has to be a
lot slower, not faster. A 150ns ROM means the MCU has to wait at least
150ns before the data is valid for reading. A 90ns replacement ROM
means the data is guaranteed to have changed at most 90ns after an
address change, long before the MCU is set to read it.

Andy,

I do not believe this is 100% correct.

You are correct that the data is stable 150ns or 90ns after the Chip
Select line is stable. The data will stay stable as long as the CS line
and address lines are stable.

The CPU involve is an 8051. The date of the circuit the OP has (1985) is
old enough to believe that it is a 12Mhz processor with an internal
divide by 12.

So the memory cycle time of the CPU is 1us, the cpu will "wait" most of
that 1us before it latches the data from the ROM.

I'll check an old 8051 data sheet later, but a 90ns ROM will work just fine.

doanld

 

[robb]

Andy,

I do not believe this is 100% correct.

You are correct that the data is stable 150ns or 90ns after the Chip
Select line is stable. The data will stay stable as long as the CS line
and address lines are stable.

The CPU involve is an 8051. The date of the circuit the OP has (1985) is
old enough to believe that it is a 12Mhz processor with an internal
divide by 12.

So the memory cycle time of the CPU is 1us, the cpu will "wait" most of
that 1us before it latches the data from the ROM.

I'll check an old 8051 data sheet later, but a 90ns ROM will work just fine.

Donald,
you are correct about the 8051, it is running at 12Mhz .

and in case i have not mentioned before the D23256AC lines/pins
are consistent with the 27c256 in terms of conections made to the
8051

now i am just awaiting new mouser ROMs to test the new style
ROM reads that look like real code.

no readable ascii strings such as copyright strings or company
name in the new style ROM reads though ?? so that has me still
a little suspicious but as code the new ROM download actually
runs and loop in an 8051 simulator so that is promising.

Thanks for all the help donald,
robb

 

[robb]

[trim -- lots of very helpful advice]

Thanks Ian,

For all the help and useful advice.
I forgot to thank you for taking time and effort to help.
I do appreciate all the help.

Now, still waiting for new ROMs to try out all the advice.

I recccomend you find a file sharing service to post the dump to then
give us a link for anyone with 8051 experience can then take a look at
it. It would be nice to know make model and description of the unit you
are trying to repair as well.

Good luck with it, I admire your persistance
HAPPY NEW YEAR.

Ah persistance, well i have always enjoyed challenges of big
problems, trying to figure out how things function and
elegant/simple solutions.

P.S. I have a new year resolution for you: If it aint broke dont fix it!
(Unless you can afford to sacrifice one to your curiosity)

I guess the original problem was not challenging enough to
supress curiosity?

This project happened to be affordable, i usually check
cavalier at the door where affordability is a dominant factor.


thanks again for all the help,
robb


NUL: