Author Topic: Programming (non-JTAG) MAX7000 devices  (Read 48906 times)

0 Members and 2 Guests are viewing this topic.

Offline c64

  • Frequent Contributor
  • **
  • Posts: 300
  • Country: au
Re: Programming (non-JTAG) MAX7000 devices
« Reply #100 on: June 12, 2022, 03:38:01 am »
Anyone know cheap programmer for ATF1508AS ? I'm not aware of any cheap clones on eBay. Programmer for Altera parts can be bought under $10
 

Offline c64

  • Frequent Contributor
  • **
  • Posts: 300
  • Country: au
Re: Programming (non-JTAG) MAX7000 devices
« Reply #101 on: June 12, 2022, 03:39:17 am »
Some people report that the same trick with 12v on OE pin (with series resistor) also works on MAX7000s. I haven't tried
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #102 on: June 13, 2022, 04:42:25 pm »
Anyone know cheap programmer for ATF1508AS ? I'm not aware of any cheap clones on eBay. Programmer for Altera parts can be bought under $10
Any JTAG debugger with SVF support, such as J-Link, CMSIS, FT232, USB Blaster, ByteBlaster, Platform Cable, etc.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline GTT95

  • Contributor
  • Posts: 21
  • Country: fr
Re: Programming (non-JTAG) MAX7000 devices
« Reply #103 on: June 21, 2022, 01:26:08 pm »
Quote
and its jtag can be re-enabled by putting 12 volts on OE pin.
Is it specific to one version of ATF150? Schematic here:  https://www.hackup.net/2020/01/erasing-and-programming-the-atf1504-cpld/ has the alternate feature Vpp labelled for /OE1, however, the datasheet specifies only /OE1/I?

 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #104 on: June 21, 2022, 04:27:45 pm »
Quote
and its jtag can be re-enabled by putting 12 volts on OE pin.
Is it specific to one version of ATF150? Schematic here:  https://www.hackup.net/2020/01/erasing-and-programming-the-atf1504-cpld/ has the alternate feature Vpp labelled for /OE1, however, the datasheet specifies only /OE1/I?
No programming information is available from the datasheets. Only programmer manufacturers had the access to them, so just do some reverse engineering!
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline GTT95

  • Contributor
  • Posts: 21
  • Country: fr
Re: Programming (non-JTAG) MAX7000 devices
« Reply #105 on: June 22, 2022, 01:43:25 pm »
Maybe applying +12V to /OE1 through resistor and measuring the voltage on this pin. As regular Inputs shall have clamps, measuring +12 V would mean it is OK to accept Vpp, and not accept if mearuring +5V.
 

Offline ale500

  • Frequent Contributor
  • **
  • Posts: 415
Re: Programming (non-JTAG) MAX7000 devices
« Reply #106 on: June 23, 2022, 04:21:08 am »
I'll try that with the MAX7128S I got from ali...
 

Offline ale500

  • Frequent Contributor
  • **
  • Posts: 415
Re: Programming (non-JTAG) MAX7000 devices
« Reply #107 on: June 23, 2022, 01:19:00 pm »
When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE1 (PIN 84), I measure 11.97 V at PIN 84.
When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE2 (PIN   2), I measure 12.10 V at PIN  2.

Could it be that it needs 12 V on both pins ?... That I didn't try before.

When I apply 12 V to both PINs TDO changes from HIGH (~5 V), to LOW ~ 0 V.

Nothing, the chips are still not being detected :(
« Last Edit: June 23, 2022, 01:43:23 pm by ale500 »
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #108 on: June 23, 2022, 01:47:34 pm »
When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE1 (PIN 84), I measure 11.97 V at PIN 84.
When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE2 (PIN   2), I measure 12.10 V at PIN  2.

Could it be that it needs 12 V on both pins ?... That I didn't try before.

When I apply 12 V to both PINs TDO changes from HIGH (~5 V), to LOW ~ 0 V.

Nothing, the chips are still not being detected :(
You entered the parallel programming mode of Altera.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline GTT95

  • Contributor
  • Posts: 21
  • Country: fr
Re: Programming (non-JTAG) MAX7000 devices
« Reply #109 on: June 23, 2022, 02:34:47 pm »
Quote
You entered the parallel programming mode of Altera

Does it mean to stay in serial JTAG based programming mode only /OE1 shall be put to 12V. Or is it specific to ATF150X devices?
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #110 on: June 23, 2022, 04:13:07 pm »
Quote
You entered the parallel programming mode of Altera

Does it mean to stay in serial JTAG based programming mode only /OE1 shall be put to 12V. Or is it specific to ATF150X devices?
MAX 7000AE/3000A/ATF1500 specific, these families are JTAG only.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #111 on: August 10, 2022, 01:53:31 pm »
I am the original starter of this thread.

To recap, I have a bunch of NON-JTAG EPM7032/EPM7064/EPM7128 devices, obtained when there was a lab clear out of non-ROHS devices.

I have used GALs in a number of recent projects for which I have had PCBs made, and it would be nice to use these CPLDs in future projects. However I do not have a programmer for the MAX7000 devices.

I mentioned that the ALL03 programmer has been reverse engineered and information is available on the "benoit" website. I am able to run the programming software for the ALL03 in DOSBOX. The programs are DOS EXE files and use character graphics, as was common in the late 80's and 90's. Each device type has it's own EXE. There are several EXEs to support the Altera CPLD parts.

Last year I worked on an 8088 based IBM PC XT clone PCB/project. I needed a BIOS and found a disassembly of the Tandy1000 BIOS on GitHub. The author used a tool called "IDA Pro" to do the disassembly. It is an intelligent disassembler. there is a free version of this tool available for download. I downloaded and "had a play". As usual there's a learning curve.

Just recently I had the idea to re-visit the MAX7000 project with the idea of looking at the EXE code, so see if the programming algorithm could be determined.

I made a false start by using the wrong EXE ! I stated with the EXE which allowed the ALL03 programmer to program the EPM7064/96/128. Nevertheless it was a useful introduction to IDA Pro (Free). The biggest frustration is forgetting to click to select the current line of disassembly before assigning a label. Firstly the EXE is compressed using PKLITE, so I had to find a tool to remove this compression. Having done this the new EXE loads into IDA Pro and the tool does lots of work with no input needed. At the end of the file you can find lots of text strings. Some decompiled as strings, and others which are a list of bytes (not yet referenced by the code). It is also possible to search and find the I/O out and in instructions. I spent quite a few hours over the course of a week playing with the tool and adding labels and defining data types. I started to see code (C switch?) which used the selected device type and jumped to different code depending upon the device selected in the simple GUI. Then the penny dropped, I was looking at the wrong EXE.

So I found the EXE which programmed the ALL03 for the EPM7032 only, and I started a new IDA Pro project. I was able to make quick work thanks to the knowledge already gained.  I now started to see where the strings seen in the data section of the EXE were referenced, so the subroutine call could be assigned a readable name. I didn't understand what all the parameters do, but that is not necessary. This helped figure out where other stuff was. I then found the code for the main menu. When running the code (in DOSBOX) a single character selects an action. I found the jump table which mapped character pressed to subroutine. Interestingly some characters vector off, but they are not seen in the GUI on-screen. I don't know what they do, but at the moment this is not of interest.

I also downloaded the "debug" version of DOSBOX. This version of the code allows writing a trace file, which shows disassembly of the instructions as they are executed and gives a register dump. I was able to use grep and vim to process this file to extract all the I/O instructions, where the code speaks to the two ports on the PC ISA card. This gives a pretty clear picture on how the hardware is sequenced. Again thanks to the "benoit" website, the mapping of ALL03 pins (there are 40) to the pins of the EPM7032, are known.

When I run the EXE I get the message "Error Identification on hardware". Thanks to having schematics of the PC ISA card, and some example C source code (which allows users to write there own driver software), I realised this came from checking the magic counter in the PALs on the ISA card. IDK but perhaps it is a simple form of copy protection? I was able to find the code and hack it to return a "pass" result.

When I run the EXE and now get into the GUI and select the ERASE operation, I get the error message "ID code ERROR !". This string appears several times, but I was able to find it in code related to the 'E' (ERASE) command. After quite some effort I found the function which returned a Boolean false and triggered the message. I hacked the code to fix this too. When the code was run again, the programming software did "more stuff", so having the fail result, due to no real device in a socket, gives an incomplete DOSBOX trace file. I figured out that the first thing that the programmer does is try to determine if there is an ALTERA device in the socket. It does this by applying a stimulus, grabbing the resulting 160 bits, "fiddling" with them in some way, then comparing the resulting 9 bytes to an array of 10 strings, the first of which is "ALTERA92". If no string match is found the "ID code ERROR !" string is the result. By now I think(!) that I know how to stimulate the EPM7032 part in order to get the identification string response. Now over to my hardware to see what happens in practice.
 
The following users thanked this post: YetAnotherTechie, c64, vvervvurm, Beta_vulgaris

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #112 on: August 10, 2022, 02:17:58 pm »
If you have no familiarity with the ALL03 programmer, this will make no sense  ;D

BTW there are currently a couple of ALL03 programmers for sale on Ebay US, both around $500. If I lived in the US I would probably just bid on one of these and save a lot of my time!

Any for those interested in the EPM7032 and how the device identification string is "accessed", please read on.

The device VCC is powered to 5V. The NTPW pin is set to '1'. I'm unsure if it needs to already by '1' during power up, but the programmer sets it first before enabling VCC.
Vpp is ramped to 12V. I am pretty sure that this puts the device into test (or programming) mode where the user settings are switched off and various pins are put into input or output mode for programming purposes.
The 7 "ADDR" pins are forced with the value "0x7C". I have no idea why, or what these pins do, but I guess that the address selects different blocks of EEPROM.
Then 80 bits are shifted into SDINA and SDINB (the same data) using SCK (SCK is normally used for the name of a shift clock). The data shifted in is "00001" repeated 16 times.
Next data is shifted out using SK in blocks of 16 bits. The data on SCOA and SCOB is captured. I believe that this data stream should contain the device identifier (ALTERA92) coded in some way.
After each 16 bit clock SCK is clocked.
There are 5 blocks of 16 so 80 x 2 = 160 bits are shifted out and captured.

So over to my hardware.

I recently made a EPM7032 PLCC to DIL breakout PCB. I now find that I got the pin out incorrect and the PCB is useless   |O

So back to the old hardware, which uses a hand wired perf board, a breadboard for two DACs (VCC and Vpp) and a MEGA 2560 for control.

So I modified the code to apply the newly determined sequence.

I power the device on, ramp Vpp, do the toggling of SCK and CK clocks and drive SDINA/B and then ramp down Vpp and power off. In the Arduino code I loop on this sequence in order to look at the signals using my Rigol scope. The good news is that there is genuine serial data, the bad news is that it is random for each read. I must be missing something which resets the sequence.
 
The following users thanked this post: YetAnotherTechie, c64

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #113 on: August 10, 2022, 02:22:19 pm »
Some waveforms captured using the Rigol scope.

The good news is that I get a digital serial stream shifted out from SCOA and SCOB. SCOA is always zero, but SCOB waveform/data changed from run to run.

1562284-0
 
The following users thanked this post: YetAnotherTechie

Offline Rasz

  • Super Contributor
  • ***
  • Posts: 2617
  • Country: 00
    • My random blog.
Re: Programming (non-JTAG) MAX7000 devices
« Reply #114 on: August 11, 2022, 02:51:15 am »
:-+

migry, I've tried to disassemble the AMAX70.EXE a bit and have identified the erase function. I can see the 10 42 08 21 84 10 42 08 21 84 pattern matching your log, the ReadID function sends it and receives 5x16 bits back from the chip.

Then 80 bits are shifted into SDINA and SDINB (the same data) using SCK (SCK is normally used for the name of a shift clock). The data shifted in is "00001" repeated 16 times.

which is it?
also have you compared to ATF1502 A1500.exe?
Who logs in to gdm? Not I, said the duck.
My fireplace is on fire, but in all the wrong places.
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #115 on: August 11, 2022, 11:56:16 am »
:-+

migry, I've tried to disassemble the AMAX70.EXE a bit and have identified the erase function. I can see the 10 42 08 21 84 10 42 08 21 84 pattern matching your log, the ReadID function sends it and receives 5x16 bits back from the chip.

Then 80 bits are shifted into SDINA and SDINB (the same data) using SCK (SCK is normally used for the name of a shift clock). The data shifted in is "00001" repeated 16 times.

which is it?
also have you compared to ATF1502 A1500.exe?
ATF15xx (ISP) CPLDs only have JTAG programming, when JTAG is "disabled" it can be re-enabled by Vpp high voltage.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #116 on: August 11, 2022, 02:46:05 pm »


Quote
>> migry, I've tried to disassemble the AMAX70.EXE a bit and have identified the erase function. I can see the 10 42 08 21 84 10 42 08 21 84 pattern matching your log, the ReadID function sends it and receives 5x16 bits back from the chip.

>> Then 80 bits are shifted into SDINA and SDINB (the same data) using SCK (SCK is normally used for the name of a shift clock). The data shifted in is "00001" repeated 16 times.

which is it?

They are the same pattern.

SDINA is the top trace in the third picture (above). You can see the 00001-00001-00001- ..etc.. sequence applied to SDINA (same is applied to SDINB). It is clocked in by "SCK" (bottom trace).

In the software the data is shifted in, in 16 bit chunks, stored as 16 bit words in a table. The values shifted in are: 0842-1084-2108-4210-8421.

It's the same bit pattern.

The data read back on SCOA and SCOB is shifted out by the clock "SK", with a pulse of "SCK" every 16 clocks of "SK". The relationship of the two clocks are shown in the Rigol screen grab.

 

Offline pityokas

  • Contributor
  • Posts: 11
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #117 on: August 16, 2022, 10:42:48 am »
Hi, I'm try to figure out the pin-out for MAX7000 PLD-1 PLCC84 Beeprog.
Almost done, except last part of memory read incorrectly (wrong and repetition of data)
Maybe with combined information we can figure out what pins used for last part of memory and not involved in fist part.
Last part meaning from 0x6E00 (1bit) or 0xDC0(8bit) from total of 0x732F/0xE6F(8bit) for EPM7064 plcc84
I guessed will be same as parallel eproms addressing but it's not.

Attaching a read of epm7032S read in parallel mode.For 7064 almost identical except using more pins. Don't 100% trust on data because I have to make an experimental 48bit logic analyzer (FX2LA+CPLD) and I'm not sure if everything working but promising.
Use pulseview to open files.
 

Offline vvervvurm

  • Newbie
  • Posts: 4
  • Country: de
Re: Programming (non-JTAG) MAX7000 devices
« Reply #118 on: August 16, 2022, 10:42:05 pm »
@migry
Quote
The good news is that there is genuine serial data, the bad news is that it is random for each read. I must be missing something which resets the sequence.

maybe the real programmer has inverted logic? It could explain the random output of the chip. maybe have a look if the data changes on rising or falling edge of the clock signal?
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #119 on: August 17, 2022, 09:58:13 am »
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #120 on: August 17, 2022, 12:57:01 pm »
Hi, I'm try to figure out the pin-out for MAX7000 PLD-1 PLCC84 Beeprog.
Almost done, except last part of memory read incorrectly (wrong and repetition of data)
Maybe with combined information we can figure out what pins used for last part of memory and not involved in fist part.
Last part meaning from 0x6E00 (1bit) or 0xDC0(8bit) from total of 0x732F/0xE6F(8bit) for EPM7064 plcc84
I guessed will be same as parallel eproms addressing but it's not.


Hi Pityokas, I was confused about what information you were asking for help with.

My interpretation was that you have a Beeprog programmer (nice programmer unit supporting lots of ICs!) and you are trying to figure out the mapping from the ZIF socket to the pins of the EDPM7064 device?

While following various links I diid find an adaptor for this programmer for the EPM7032 (I recall) which was around $70. I thought that this wasn't bad value, as I have seen adapters (for various ICs) sell for hundreds of dollars for other programmers.

If I understand better what you are trying to do I may be able to help. I can run the EPM7064 software (A70X.EXE) in my DSBOX emulator, and I can collect some waveforms similar to the ones you collected.

I did look at your waveforms for the EPM7032 and there was a lot of things which looked familiar. Since the trace was quite long I got a little lost. If you were to capture another trace, such as ERASE, which is quite short, I can do the same thing, and we can compare waveforms?
 

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #121 on: August 17, 2022, 01:35:58 pm »
@migry
Quote
The good news is that there is genuine serial data, the bad news is that it is random for each read. I must be missing something which resets the sequence.

maybe the real programmer has inverted logic? It could explain the random output of the chip. maybe have a look if the data changes on rising or falling edge of the clock signal?

Hi @vvervvurm,

I have actually made some progress with the read out of the device ID "serial bit stream", since my last (big) posting. BTW my programmer is home made and is based around an Arduino Mega 2560 running custom C code.I have DAC control of VCC and Vpp (or Vpg - the high voltage ~12V programming voltage). The circuitry is based around cheap Arduino MCP4725 modules, an OP-amp and a couple of transistors.

So in the past I have made the mistake of continuing to "flog a dead horse", i.e. I have tried to debug a chip which is dead, but which I assumed was working  |O

So I realised that I needed to try some other devices. I had a few at hand. Here is the summary

1) EPM7032LC44-10 : original device, SCOA/B shows serial data but changes from run to run (involves a complete power down).
2) EPM7032LC44-12 : also show random serial data, but is more biases to a string of ones.
3) EPM7032SLC-44-10 (*) : a "newer" device which has JTAG pins - denotes by the "S" in the device code. Seemed to have no activity on SCOA/B.
4) EPM7032VLC-44-12: a 3.3V device (denoted by the "V" in the device code). Bingo. A stable and repeatable bit stream from SCOA and SCOB.  ;D I tried my "read" code and I got stable results but the data looked suspiciously similar to the device ID from address block 0.
4) EPM7032VLC44-12 (**) : also a 3.3V device. Device ID data stream works. Same as the previous "V" chip. The "read" code reads back all address blocks as 80 '1's (all FF == blank).

(*) This device was bought from China. It has laser markings. I did try one using a JTAG programmer and it did program and work.
Just FYI I have bought a number of counterfeit devices (e.g. MC68000, i8088) which originate from a China. The giveaway is that the tops have been sanded down and they have been remarked using laser etching. All my other genuine EPM7032 devices have the text printed in ink. I wanted to see if the JTAG parts could be programmed (or ERASEd) in old-style parallel mode.

(**) This device is black topped. It is a 100% genuine Altera part (I know it's providence). This used to be a trick of the Chinese counterfeiters, until they moved to laser etching. I have a MC68HC000-16 device which came from China via Ebay (yes let the buyer beware). I was able to use IPA to remove the fake ink markings and beneath I found the original Motorola markings of MC68000-8, so not HC and not 16MHz  >:( .

Black topping can be found on genuine devices, but it is of high quality as you might expect. Back in the day (80's/90's?) in the UK RS Components (our Digikey/Mouser) used to sell common ICs such as 7400 LS TTL devices which were black topped and marked with their logo. These were genuine full spec devices.

So success with the 3.3V devices, but not the 5V devices.

I now tried to make sense of the bit stream on SCOA/B, and went back to the IDA Pro disassembly. I found code which manipulated the bit stream. It took some time to figure out what was happening, and I wrote some C code to replicate the machine code in order to play with the bit stream. In one of those "wow" moments a string "ALTURA93" appeared. Close enough  ;D , but after editing the code all that appeared was garbage. After many more hours I found the issue, in that I needed to extend and zero the input array.

For those interested. Each serial out generates 80 bits. in the data area of the code there is an array with 80 elements. It is filled with numbers from 0 to 79 in a logical order (0,5,10,15, ... 70,75, then 1,6,11,16, ... finally 4,9,14, ... 79). It is used to unscramble the 80 bits and create a new string of 80 bits with them simply re-ordered. The "set of 5" appears regularly and must have some relation to the hardware.

I have attached a screen grab showing the captured 16 bits values on SCOA/B and SDOUTA/B (5 * 16 = 80 bits each), and the output from my C code.

I have also attached a grab of the strings embedded in the ALL03 A70X.EXE code. There are 8 strings, which are compared against the descrambled bit stream. The ALTERA93 corresponds to the "V" 3.3V device.
 
The following users thanked this post: YetAnotherTechie

Offline migryTopic starter

  • Regular Contributor
  • *
  • Posts: 76
  • Country: gb
Re: Programming (non-JTAG) MAX7000 devices
« Reply #122 on: August 17, 2022, 05:46:52 pm »
So I have been doing some more digging into the disassembly from IDA Pro.

Strings are pretty easy to find and many appear automatically on the first pass of IDA Pro. I saw that there is text which makes up the main menu/screen, but includes text for commands which are not printed on the screen. I also found the code which processes the keypress from the main screen/menu and there is table of jumps for every key in alphabetical order, which jump either to a subroutine or a blank. Again I noted a number of characters which are not in the main menu, but have code associated with them. I bit more investigation revealed that a location/flag is checked and if 0 the code is not executed. So I looked for where this location is changed, and turns out only in one place, the code associated with the "U" menu command (does not appear in the screen/menu). When I ran the code in DOSBOX and pressed "U" nothing of note happened. It took some more looking around and a bit of guess and finally if I press "u" followed by "I" followed by "u" the extra commands appear on the main menu/screen (see attachment). There is now a command to read and display the device ID. In Windows when I run the programming software (AMAX70.EXE) since there is no ISA card hardware, nor programmer, the program displays some error messages. So I hacked the binary to fool these checks and the program now executes code that otherwise wouldn't be, allowing me to get a clearer picture of the code execution using DOSBOX trace. The new "Read ID" command displays garbage since it probably sees all ones when reading the the SCOA/SCOB I/O port.

So now over to my Linux VM. Here some time ago i downloaded the DOSBOX-X sources and was able to compile and build a binary. I then proceeded to add my own module, which emulated 1) the ISA card and PALs 2) the ALL03 programmer registers, and 3) the EPM7032. Now that I know the serial bit stream for reading the device ID for a EPM7032V device, I added this emulation into my module. Now when I run the binary, I can enable the "hidden" commands with "uIu" and I can execute the "I" command (Read ID). The 3rd attachment shows the result, and confirms that I managed to get the emulation of the serial bit stream correct. Note that this bit stream also contains two non-ASCII bytes which define: Vpg - the high programming voltage (AKA Vpp) ; Tpg - the width of the programming pulse for writing a block; and Tbe - the width of the pulse for doing a bulk erase.

Both my EPM7032V devices give slightly different values for the 2 bytes defining these values, however the "ALTERA93" ASCII part is the same.

BTW I have just noticed that in the Linux binary the YELLOW text shows different information, so I will need to investigate why using the IDA Pro disassembly.
 

Offline pityokas

  • Contributor
  • Posts: 11
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #123 on: August 18, 2022, 08:32:34 am »
Hi, I'm try to figure out ... (Attachment Link)
This pinout?
Unfortunately that picture is not 100% correct.If we considering the plcc44 wiring corect then for EPM7064-84:
A2 and A5 is at 49 and 41 and the picture says AD6 AD3
pins 10,29,56,75 are SDOA,B,C,D
plcc pin44(A6) -> PLCC84 picture says  GAD0
And pin 12 used at initialization so cannot be L
Or my adapter is totally wrong.
Also 7128 use more data lines at different pins so EPM7064=7096=7128=7160 it's not true
The programmer require a different adapter for 7128 and 7192 and same for 7064 and 7096

Quote from: migry
...mapping from the ZIF socket to the pins of the EDPM7064 device?
Yes!

The PLCC84 PLD-1 cost 180usd, ok its using high quality zif but...

I inspired my adapter from here https://blog.system11.org/?p=2999, unfortunately was different for beeprog but counted the totally used pins and was exactly 48, so I made my adapter started from pin 1 until all connected, first tested with scope, the important pins VDD,GND VPP was at right position, also the JTAG pins, so tested some EPM7000S and one 7064, at first the 7064 generated some error but after erase was fine so considered was just a temporary error and put everything int box and forget about, until recently when really needed and got error again with another EPM7064 so started to dig deeper.

And now some research what I found:
Today made one random project for EPM7064-84, generated a pof file programed my PLD and got no error after verify, now where is the problem?
Interestingly an empty EPM7064 return a lot of 0 from address 6E00 but the programmer still saying is perfectly empty, odd...
Also the pof file bites are not linearly arranged in PLD, maybe vertically?
Changed the very first 2 bites to 0, the first 0 bit are at first reading the second after 5th reading(one reading return 16 or 17 bit).
I think the algorithm depend on ID, I made a dumb read(without chip) and got different scheme, like an old EPROM, clearly
visible A0,A1...A6 (000  001  010  011 ..)

Quote from: migry
If you were to capture another trace, such as ERASE, which is quite short, I can do the same thing, and we can compare waveforms?
Ok I will make some but I have only one EPM7064-84 the other are with S, I will order some 7032 without S from ali, let see.
 

Offline Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 68
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #124 on: August 18, 2022, 08:58:42 am »
Hi, I'm try to figure out ... (Attachment Link)
This pinout?
Unfortunately that picture is not 100% correct.If we considering the plcc44 wiring corect then for EPM7064-84:
A2 and A5 is at 49 and 41 and the picture says AD6 AD3
pins 10,29,56,75 are SDOA,B,C,D
plcc pin44(A6) -> PLCC84 picture says  GAD0
And pin 12 used at initialization so cannot be L
Or my adapter is totally wrong.
Also 7128 use more data lines at different pins so EPM7064=7096=7128=7160 it's not true
The programmer require a different adapter for 7128 and 7192 and same for 7064 and 7096
http://matthieu.benoit.free.fr/all03/adp-7064S-PL84/
http://matthieu.benoit.free.fr/120.htm
https://forum.system-cfg.com/viewtopic.php?f=18&t=13192
My adapter is compatible with all MAX 7000 PLCC84 packages for ALL-03?
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf