Proprietary Motherboard BIOS Cloning

[300EVIL]

Hi Everyone,
I'm diving into a project that is a little above my head and could really use some guidance.

So, I have a bunch of late 90's proprietary motherboards for a custom control system that is no longer supported. The problem with all these units is that the battery for the BIOS has died and the boards will no longer boot.

Now, I have ONE motherboard with BIOS that is still alive. I would like to read the chip and clone the BIOS to the bad motherboards to get them working again.

The chip that contains the BIOS is a 28 pin SOIC SRAM M48T18-100MH1. Datasheet can be found here.... http://pdf1.alldatasheet.com/datasheet-pdf/view/158323/STMICROELECTRONICS/M48T18-100MH1.html

Piggybacked on this chip is one M4T28-BR12SH1 which is a socketed lithium battery / clock crystal combination to keep the SRAM data alive.
Datasheet... http://www.st.com/web/en/resource/technical/document/datasheet/CD00149846.pdf

If I can,,,,, Big IF... I need to come up with a procedure to copy the only good BIOS and clone it over to the other chips while replacing the battery / crystal module.

So, my questions are.....

1. Does this sound feasible to just clone the BOIS and get a working motherboard?

2. Can I clone the chip with it soldered to the board? I see no JTAG plugs or any external programming ports.

3. I need to come up with a plan to keep the good BIOS alive when I replace the battery pack. What is the best route?

4. This #^$@ battery / crystal piggyback pack blocks the ability to use an SOIC pin clip to reach the pins. I'd need to come up with some sort of custom rig to touch the pins for reading / writing or desolder the chip with the battery in place.

5. Can I really do this...... 

I really have no clue what I'm doing, any help or advice would be GREATLY appreciated! I can supply detailed pictures and data on everything within my knowledge.
Thanks!
Adam

[nctnico]

That SRAM is too small to contain a BIOS. Just replace the SRAM or the battery and I'm pretty sure the systems will boot again since the SRAM is highly likely to only contain data and the clock.

[300EVIL]

That SRAM is too small to contain a BIOS. Just replace the SRAM or the battery and I'm pretty sure the systems will boot again since the SRAM is highly likely to only contain data and the clock.

Hi nctnico.
Thanks for the reply. As I know next to nothing about BIOS, I was told the "Chip with the battery" is the problem on this board. I do have some experience with NVRAM chips in copiers and I know if the data on the chip is lost, it stops the machine from working. We cloned these chips from other machines to get them working again. Now, there are two EPROMs located near this "BIOS chip" and maybe they contain the instructions to boot? Again, above my level of expertise.

So, do you really think just replacing the battery will fix my problem? I can't imagine the SRAM is burned out but I guess it could be? If the battery is just there to hold a date, that doesn't make sense. Though, maybe the real problem lies within the two EPROMS. Maybe they need to be erased and cloned??? It does seem the motherboards are just "dead to the world". They need some basic instructions to look at the HDD and / or floppy drive to gather further instructions.

FYI... My simple understanding of computer language is VERY limited. I'm literally grabbing words and ideas out of the air on this one.

Thanks Again!
Adam

[Rasz]

So, I have a bunch of late 90's proprietary motherboards for a custom control system

that sounds expensive, cnc? huge industrial printer? pictures of the boards and model numbers wouldnt hurt

FYI... My simple understanding of computer language is VERY limited. I'm literally grabbing words and ideas out of the air on this one.

maybe find a specialist before you kill the last one working

[Ziginox]

The actual programming will be in either flash or burned into a ROM. Typically that SRAM holds configuration only, which means that if you replace it you'll be able to just reconfigure the machine and get it going again. That's how Sun workstations  and PC compatibles work, at least.

[dcarr]

How about a picture of the overall board and the SRAM/battery?

David

[poot36]

I once had a "industrial" p3 pc that appeared totaly dead and I measured the standard CR2032 coin cell and it was at 0.7V and once I removed it and replaced it with a new battery the board started turning on again.  I would try removing the battery section on one of the dead boards and see what it does.  I am going to guess that the SRAM contents are corrupt from a low battery voltage and is preventing the system from turning on.

[300EVIL]

that sounds expensive, cnc? huge industrial printer? pictures of the boards and model numbers wouldnt hurt

It's an interactive training simulator.

Here are some pictures of the overall board along with the SRAM chip and battery.















I have an new battery on order, I guess the first thing I can try is to just replace it and see what happens. Though, I can't imagine that will do it.
Thanks!
Adam

[Fraser]

I have to agree with others here.

The Timekeeper chip is a real time clock and is not where the Firmware would reside. The firmware will be in the two PROM chips adjacent.

I have met some horrible battery backed timekeeper chips that are designed so that when the battery fails the whole chip goes into an unrecoverable fault mode, stopping the host system. Fitting a new battery does nothing with those awful chips but they have a fixed battery and not a power cap like yours.

If you look inside the cap on your chips you will find a small lithium cell and a 32KHz clock crystal. Make sure your replacement cap has the crystal fitted as some power caps are designed for RAM and have no crystal. These have only 2 pins instead of 4.

When the SBC tries to boot, it will poll the RTC for a valid time date group and any other configurations data stored in the SRAM. If it cannot find the data it expects or it finds corrupt data, it will likely HALT. There may be an error code produced but you would need to know where to read it from. most SBC boards have an engineering port that is serial data from a UART.

Fit a new battery or power cap and you may be lucky and the SBC will boot. If the OEM has been a pig, there may have been an ID or serial number in the Timekeeper that must be present for boot completion. That would be really nasty but sadly not unheard of.

If you take a pair of side cutters or a dremel tool to one of the dead power caps (snap hat) you will find a small PCB with the crystal and the lithium cell. You could easily attach a lithium button cell to replace the flat cell. Just ensure you cut the tags on the old cell and ensure the polarity is correct. Even a pair of AA cells in series will do. You can then attach the cap to the SRAM Timekeeper and test it.

Hope this works for you.

Fraser

[300EVIL]

Hi Fraser,
Thanks for your input. I do think everyone is right about the BIOS being on the EPROM's instead of this SRAM chip. I have a new Timekeeper battery on order and hope installing that is all that is needed.

If the OEM has been a pig, there may have been an ID or serial number in the Timekeeper that must be present for boot completion. That would be really nasty but sadly not unheard of.

I'm really hoping this is not the case, if so, I'm basically screwed.

I think I will hack apart the old timekeeper battery and rig up a coin cell just to test before the correct replacement arrives.

Thanks again for your advice!
Adam

[Rasz]

MVME 147-024 edit: $500-1500
swapping battery should be enough
worst case scenario you dump your firmware and pay someone to patch around SRAM magic value check (if there is one), or copy sram contents from working one

[300EVIL]

MVME 147-024 edit: $500-1500
swapping battery should be enough
worst case scenario you dump your firmware and pay someone to patch around SRAM magic value check (if there is one), or copy sram contents from working one

Well, I tried swapping the battery module.... Still no good.

Thanks for identifying the board model number, I'm sure that will be a great help.

I have noticed there are board repair companies who repair these boards. Do you think this is a problem that could be fixed this way?
Thanks!
Adam

[paschulke2]

On the MVME147 this chip contains only configuration data (NVRAM, 4k used) and the RTC. The MVME 147 does not have a "BIOS". Instead of a "BIOS" the MVME147 was usually delivered with a Debugger (147Bug) in two of the EPROMS (U22 and U30).

Does your system have the MVME712 interface board? If so, you could connect to Serial 1 (most likely 9600 baud, 8 bit ,1 stop bit) and see what's going on. 147Bug would complain about the NVRAM being corrupted and would ask you to reconfigure the system. Judging from the stickers on the EPROMS your board does not have 147Bug installed but EPROMS with a custom software. If the software engineers did their job well, their software will also realize that the NVRAM is corrupted and prompt for some action over the serial line.

I'm quite sure that replacing the battery has "fixed" the board but of course it hasn't brought back the data lost …

Thomas

[300EVIL]

On the MVME147 this chip contains only configuration data (NVRAM, 4k used) and the RTC. The MVME 147 does not have a "BIOS". Instead of a "BIOS" the MVME147 was usually delivered with a Debugger (147Bug) in two of the EPROMS (U22 and U30).

Does your system have the MVME712 interface board? If so, you could connect to Serial 1 (most likely 9600 baud, 8 bit ,1 stop bit) and see what's going on. 147Bug would complain about the NVRAM being corrupted and would ask you to reconfigure the system. Judging from the stickers on the EPROMS your board does not have 147Bug installed but EPROMS with a custom software. If the software engineers did their job well, their software will also realize that the NVRAM is corrupted and prompt for some action over the serial line.

I'm quite sure that replacing the battery has "fixed" the board but of course it hasn't brought back the data lost …

Thomas

Hi Thomas,
Thanks for your input. There is another board, unsure of the model, that has a header for "RS232 Debug" and one labeled "Memory Debug" in the card legend. Please see pics below....

I could easily make a serial cable to attach to these headers but I don't know the pinout of the headers. Would reading this be as simple as making a cable with the known pinout and running a terminal on a laptop?

Thanks Again!
Adam

[paschulke2]

Thanks for your input. There is another board, unsure of the model, that has a header for "RS232 Debug" and one labeled "Memory Debug" in the card legend. Please see pics below....

Now this is what I would call a "proprietary" board …

I could easily make a serial cable to attach to these headers but I don't know the pinout of the headers. Would reading this be as simple as making a cable with the known pinout and running a terminal on a laptop?

Yes.

The MVME147 has 4 serial lines which are connected to P2. Now the question is whether your MULTI I/O board uses these lines (if so, you should be able to trace the serial port headers on the front back to P2) or whether it uses its own serial line interfaces. The P2 pin-out can be found in the MVME712 manual (712aum.pdf).

Thomas

[justanothercanuck]

M48T18-100MH1 is the chip under the battery - looks like mouser used to stock them at one point, but they're listed as obsolete now.  found one on ebay for $5 though.

however, before you go and buy some fancy SRAM/timekeeper hybrid, if you have more than one of these boards and a ROM dumper, you could dump the contents and verify that they aren't any random bit-flips mucking up the works.  if the ROMs look good (if the chip has a window on it, as long as the sticker stays on, i'd say 90% of the time it's still fine), swap the SRAM.