Programming (non-JTAG) MAX7000 devices

[ukamak]

Hi jgustavoam,

Yes I have some EPM7032s still alive/new.
For JTAG I didn't start to check, and for ID for now we don't need to check, we can see in arduino or in lt48uxp log that manufacturer ID is not correct.

My situation now is following Your job with arduino,

Code: [Select]

-  IC04 - not new, not sure if something was erased changed, bud manuID works.
EPM7032S Parallel Programmer - ERASE V7
EPM7032S - Phase 1
SDOUTA: 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x10                           // I think must be 0x01 .... also need some bitswap  TODO
SDOUTB: 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x10                           // I think must be 0x01 .... also need some bitswap  TODO
SCOx: 0x41 0x4c 0x54 0x45 0x52 0x41 0x39 0x38 0xa7 0x00 0xc3 0xff 0xff 0x04 0x50 0x31 0xff 0xff 0xff 0xff         // manuID hex
SCOx: "ALTERA98",0xa7,0x00,0xc3,0xff,0xff,0x04,"P1",0xff,0xff,0xff,0xff                                           // manuID ASCII/hex 

If You still need the jtag log I will do.

[abyrvalg]

BTW, for JTAG analysis try generating a STAPL .jam file and look into it, it should be a human-readable text file containing a programming script in terms of JTAG operations like “shift XXX into IR, check DR to match YYY”. It is NOT specific to Altera programmers, Altera even provided a “jam player” source code to be run on customer’s platform, i.e. an MCU.

[jgustavoam]

Hi jgustavoam,

Yes I have some EPM7032s still alive/new.
For JTAG I didn't start to check, and for ID for now we don't need to check, we can see in arduino or in lt48uxp log that manufacturer ID is not correct.
...

If You still need the jtag log I will do.

Yes, Is it possible to capture the JTAG pins with your logic analyzer, during ISP Programming with USB Blaster + Quartus? Thanks.

My captures with program failed:

[jgustavoam]

BTW, for JTAG analysis try generating a STAPL .jam file and look into it, it should be a human-readable text file containing a programming script in terms of JTAG operations like “shift XXX into IR, check DR to match YYY”. It is NOT specific to Altera programmers, Altera even provided a “jam player” source code to be run on customer’s platform, i.e. an MCU.

Hi abyrvalg,

Excellent tip for analyzing a project in Quartus. I knew about these files, but I hadn't thought to check them. Thank you very much.

This is one of the projects I'm trying to program the EPM7032S for, but it doesn't work because the chip IDs have been erased.

PLA susbtituition for PLA Commodore C64.


/output_files/PLAepm7032.jam

Code: [Select]

NOTE "CREATOR" "QUARTUS II JAM COMPOSER 13.0";
NOTE "DATE" "2026/01/05";
NOTE "DEVICE" "EPM7032S";
NOTE "FILE" "PLAepm7032.pof";
NOTE "TARGET" "1";
NOTE "IDCODE" "070320DD";
NOTE "USERCODE" "0000FFFF";
NOTE "CHECKSUM" "00067E06";
NOTE "SAVE_DATA" "DEVICE_DATA";

PRINT "Device #", V0 - i ," Silicon ID is ",
CHR$(A16[0]), CHR$(A16[1]), CHR$(A16[2]), CHR$(A16[3]),
CHR$(A16[4]), CHR$(A16[5]), CHR$(A16[6]), CHR$(A16[7]),
"(", CHR$(((V36 >> 4) & 1) + 48),
CHR$((V36 & 15) + 48 + V27), ")"
;




[jgustavoam]

Using Quartus II 64-Bit Jam Tools:

Confirming that my EPM7032S chip is missing its ID code.

Unrecognized device
Exit code = 6... Unrecognized device


You can find the quartus_jli command-line executable in the <Quartus Prime system directory> \bin64 directory.

Add <Quartus Prime system directory> \bin64 path to Windows 10 or 11 PATH environment variable!

Usage:
------

quartus_jli [-h | --help[=<option|topic>] | -v]
quartus_jli -n --- list available hardware
quartus_jli -i <jam file> --- list available actions
quartus_jli [-c <cable>] <jam/jbc file> -a <action> [-d <proc>] [-e <proc>]

Code: [Select]

C:\altera\Quartus13.0\quartus\bin64>quartus_jli -a program -c1 PLAepm7032.jam
Info: *******************************************************************
Info: Running Quartus II 64-Bit Jam Tools
    Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
    Info: Copyright (C) 1991-2013 Altera Corporation. All rights reserved.
    Info: Your use of Altera Corporation's design tools, logic functions
    Info: and other software and tools, and its AMPP partner logic
    Info: functions, and any output files from any of the foregoing
    Info: (including device programming or simulation files), and any
    Info: associated documentation or information are expressly subject
    Info: to the terms and conditions of the Altera Program License
    Info: Subscription Agreement, Altera MegaCore Function License
    Info: Agreement, or other applicable license agreement, including,
    Info: without limitation, that your use is for the sole purpose of
    Info: programming logic devices manufactured by Altera and sold by
    Info: Altera or its authorized distributors.  Please refer to the
    Info: applicable agreement for further details.
    Info: Processing started: Tue Jan 06 08:37:48 2026
Info: Command: quartus_jli -a program -c 1 PLAepm7032.jam
Unrecognized device
Exit code = 6... Unrecognized device
Error: Quartus II 64-Bit Jam Tools was unsuccessful. 0 errors, 0 warnings
    Error: Peak virtual memory: 4238 megabytes
    Error: Processing ended: Tue Jan 06 08:37:48 2026
    Error: Elapsed time: 00:00:00
    Error: Total CPU time (on all processors): 00:00:00

C:\altera\Quartus13.0\quartus\bin64>

Code: [Select]

C:\altera\Quartus13.0\quartus\bin64>quartus_jli -n
Info: *******************************************************************
Info: Running Quartus II 64-Bit Jam Tools
    Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
    Info: Copyright (C) 1991-2013 Altera Corporation. All rights reserved.
    Info: Your use of Altera Corporation's design tools, logic functions
    Info: and other software and tools, and its AMPP partner logic
    Info: functions, and any output files from any of the foregoing
    Info: (including device programming or simulation files), and any
    Info: associated documentation or information are expressly subject
    Info: to the terms and conditions of the Altera Program License
    Info: Subscription Agreement, Altera MegaCore Function License
    Info: Agreement, or other applicable license agreement, including,
    Info: without limitation, that your use is for the sole purpose of
    Info: programming logic devices manufactured by Altera and sold by
    Info: Altera or its authorized distributors.  Please refer to the
    Info: applicable agreement for further details.
    Info: Processing started: Tue Jan 06 08:33:26 2026
Info: Command: quartus_jli -n
1) USB-Blaster [USB-0]
Info: Quartus II 64-Bit Jam Tools was successful. 0 errors, 0 warnings
    Info: Peak virtual memory: 4238 megabytes
    Info: Processing ended: Tue Jan 06 08:33:29 2026
    Info: Elapsed time: 00:00:03
    Info: Total CPU time (on all processors): 00:00:00

C:\altera\Quartus13.0\quartus\bin64>

[ukamak]

 On "20260106_00_epm7032s_jtag_logs.7z" some jtag logs using quartus "testing" and programing with JTAG

IC: 03  ManuID NG  we can't program by jtag quartus
IC: 04  ManuID OK  we can program by jtag quartus

On device 03 ManuID NG  we have  "DR TDO: ... (0x1ffffffffffffffff0fecc0ff070320dd), 129 bits"  like others devices
 I don't see  "ALTER98.." in that logs, maybe log is to short.
 

[jgustavoam]

Many Thanks Ukamak,

With my CPLDs (without ID code) I can't run anything with Quartus!

[ukamak]

One solution for Devices with bad siliconId and can't be programmed on quartus with usb-blaster.
- Generate a JAM file
- patch it
- Program using quartus_jli and usb-blaster.

Info for EPM7032S

Code: [Select]

- Device bad siliconID
    - Program:
       > quartus_jli.exe -c 1 -a program test02_p.jam
       ......
       SiliconID:        255 255 255 255 255 255 255 255 255 255 255 255 255 255 255
       !!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!                   
       SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255         
       Device #1 Silicon ID is ALTERA98(00)                                         
       programming 7K device(s)...                                                   
       verifying 7K device(s)...                                                   
       DONE                                                                         
       Exit code = 0... Success                                                     
       ..........

- Device ok

    - Program:
       Info: Command: quartus_jli -c 1 -a program test02_p.jam
       SiliconID:        65 76 84 69 82 65 57 56 167 0 195 255 255 4 80
       Device #1 Silicon ID is ALTERA98(00)
       programming 7K device(s)...
       verifying 7K device(s)...
       DONE
       Exit code = 0... Success



Check the info on 7z file and test if is ok.

we know that siliconID can be erased and readed , job TODO program it again.

[jgustavoam]

What great news! Congratulations!!

I'll test this as soon as possible.

[jgustavoam]

Sharing some information about ISP Programming

Altera In-System Programmability Guidelines ISP Muito importante.pdf
AN039 JTAG Testing Importante.pdf
AN085 ISP timiming for MAX Muito bom.pdf
AN088 Using JAM Language.pdf
AN094 Understanding MAX 7000 Timing.pdf
AN095 In-System Programmability.pdf
AN095 JTAG In-System Programmability in MAX Devices.pdf
AN100 2014  In-System Programmability Guidelines.pdf
AN100 In-System Programmability Guidelines.pdf
AN122 Using JAM STAPL to ISP Importante .pdf
Hermes_Programming.pdf
PIB26 Concurrent Programming JTAG.pdf
PIB27 Jam Programming.pdf


========================================================
AN425 Using the Command-Line Jam STAPL Solution for Device Programming.pdf

1.1.1. Differences Between the Jam STAPL Players and quartus_jli

A single .jam or .jbc can contain several functions such as programming, configuring, verifying, erasing, and blank-checking a device.
The Jam STAPL players are interpreter programs that read and execute the .jam or .jbc files. The Jam STAPL players can access the IEEE 1149.1 signals that are
used for all instructions based on the IEEE 1149.1 interface. The players can also process user-specified actions and procedures in the .jam or .jbc.

The quartus_jli command-line executable has the same functionality as the Jam STAPL players but with additional capabilities:
• It provides command-line control of the Quartus Prime software from the UNIX or DOS prompt.
• It supports all programming hardware available in the Quartus Prime software version 6.0 and later.

You can find the quartus_jli command-line executable in the <Quartus Prime system directory> \bin64 directory.


Altera supports two types of Jam STAPL files: .jam ASCII text files and .jbc bytecode files.

ASCII Text Files (.jam)

Altera supports the following formats of the ASCII text-based .jam:
• JEDEC JESD71 STAPL format. Altera recommends that you use this format for new projects. In most cases, you use .jam files in tester environments.
• Jam version 1.1 format (pre-JEDEC).

Table 4. Definitions of .jam Procedure Statements

Check this out!!


do_ignore_idcode_errors
When enabled, the procedure allows configuration of the device even if an IDCODE error exists.

[jgustavoam]

Hi Ukamak,

It is not necessary to recreate the JAM file using the quartus_cpf.exe program.
After compiling the EPM7032S project in Quartus, all files are saved to the output_files folder, including the JAM file.

==============================================
I apologize for my mistake!

Use the Quartus programmer to convert the POF file to JAM format.

• Open the Programmer window.
• Select the option - File → Create JAM, SVF, or ISC File.
• Select the file name (format JAM) and then OK.

==============================================

Code: [Select]

C:\altera\Quartus13.0\projetos\PLAepm7032\output_files>dir
 O volume na unidade C não tem nome.
 O Número de Série do Volume é DAAF-F4A4

 Pasta de C:\altera\Quartus13.0\projetos\PLAepm7032\output_files

06/01/2026  07:17    <DIR>          .
06/01/2026  07:28    <DIR>          ..
06/01/2026  07:17             8.997 PLAepm7032.asm.rpt
06/01/2026  07:26               368 PLAepm7032.cdf
06/01/2026  07:17                26 PLAepm7032.done
06/01/2026  07:17            31.011 PLAepm7032.fit.rpt
06/01/2026  07:17               332 PLAepm7032.fit.summary
06/01/2026  07:17             6.521 PLAepm7032.flow.rpt
06/01/2026  07:17            44.744 PLAepm7032.jam
06/01/2026  07:17            40.586 PLAepm7032.jbc
06/01/2026  07:17               232 PLAepm7032.jdi
06/01/2026  07:17            13.584 PLAepm7032.map.rpt
06/01/2026  07:17               269 PLAepm7032.map.summary
06/01/2026  07:17             8.842 PLAepm7032.pin
06/01/2026  07:17             2.064 PLAepm7032.pof
06/01/2026  07:17            19.938 PLAepm7032.sta.rpt
06/01/2026  07:17               223 PLAepm7032.sta.summary
              15 arquivo(s)        177.737 bytes
               2 pasta(s)   32.304.496.640 bytes disponíveis

[jgustavoam]

Unbelievable!

I successfully programmed my EPM7032S chip without an ID code using the Ukamak patch.
Many thanks to Ulamak!!!

To find the CRC of the JAM file, I ran the program once (with the patch installed).

Info: Command: quartus_jli -a program -c 1 PLAepm7032.jam
CRC mismatch: expected D9E3, actual D650

Using the Actual CRC (D650), I made the change in the last line of the Jam file.

Code: [Select]

1973 END OF FILE
1974 CRC D650;
Running the program with the corrected CRC:

SiliconID:        255 255 255 255 255 255 255 255 255 255 255 255 255 255 255
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
DONE
Exit code = 0... Success


I attached PulseView (logic analyzer) and Wireshark files (USB capture).

Code: [Select]

C:\altera\Quartus13.0\projetos\PLAepm7032test\output_files>quartus_jli -a program -c 1 PLAepm7032.jam
Info: *******************************************************************
Info: Running Quartus II 64-Bit Jam Tools
    Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
    Info: Copyright (C) 1991-2013 Altera Corporation. All rights reserved.
    Info: Your use of Altera Corporation's design tools, logic functions
    Info: and other software and tools, and its AMPP partner logic
    Info: functions, and any output files from any of the foregoing
    Info: (including device programming or simulation files), and any
    Info: associated documentation or information are expressly subject
    Info: to the terms and conditions of the Altera Program License
    Info: Subscription Agreement, Altera MegaCore Function License
    Info: Agreement, or other applicable license agreement, including,
    Info: without limitation, that your use is for the sole purpose of
    Info: programming logic devices manufactured by Altera and sold by
    Info: Altera or its authorized distributors.  Please refer to the
    Info: applicable agreement for further details.
    Info: Processing started: Thu Jan 08 22:34:30 2026
Info: Command: quartus_jli -a program -c 1 PLAepm7032.jam

SiliconID:        255 255 255 255 255 255 255 255 255 255 255 255 255 255 255
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
DONE
Exit code = 0... Success

Info: Quartus II 64-Bit Jam Tools was successful. 0 errors, 0 warnings
    Info: Peak virtual memory: 4238 megabytes
    Info: Processing ended: Thu Jan 08 22:35:04 2026
    Info: Elapsed time: 00:00:34
    Info: Total CPU time (on all processors): 00:00:01

C:\altera\Quartus13.0\projetos\PLAepm7032test\output_files>

[jgustavoam]

VITORY!!!

I used my Parallel Programmer - Arduino MEGA on the EPM7032S (IDCODE cleared) and managed to erase it!!
Thank you very much Ukamak and all the colleagues who helped me.

Then I was able to successfully program and verify the JAM program using Quartus_JLI with the Ukamak patch. Fantastic!



1) Yesterday I successfully programmed the EPM7032S (Chip1) using the file - PLAepm7032.jam.

Code: [Select]

Info: Processing started: Thu Jan 08 23:08:28 2026
Info: Command: quartus_jli -a program -c 1 PLAepm7032.jam
SiliconID:        255 255 255 255 255 255 255 255 255 255 255 255 255 255 255
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
DONE
Exit code = 0... Success

2) Today I tried to program the same EPM7032S (Chip1) with another program. But during the verify process, it showed an Verify error.

Code: [Select]

Info: Processing started: Fri Jan 09 18:54:02 2026
Info: Command: quartus_jli -a program -c 1 EPM7032SBlinkLedREM.jam
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 0 0 0 0 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
Device verify failure
Exit code = 11... Device verify failure

3) Using my Parallel Programmer - Arduino Mega - I was able to erase the chip!

Code: [Select]

EPM7032S Parallel Programmer - ERASE V8
Waiting 5 seconds
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000101
Pulses 108 x A6
Pulses Address 0x43
Pulses SDIN
Read IDCODE
Erase CPLD
Last Phase
End
4) Again I successfully programmed the EPM7032S (Chip1) using the file - PLAepm7032.jam.

Code: [Select]

Info: Processing started: Fri Jan 09 19:35:50 2026
Info: Command: quartus_jli -a program -c 1 PLAepm7032.jam
SiliconID:        255 255 255 255 255 255 255 255 255 255 255 255 255 255 255
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
DONE
Exit code = 0... Success

I might need to make some adjustments to the Arduino program, but it worked!


 EPM7032S_prog 2025.pdf (194.95 kB - downloaded 58 times.)

[jgustavoam]

Testing my EPM732S Chip1 (with IDCODE Cleared) with SUCCESS:

1) Erasing chip with my Parallel Programmer - Arduino MEGA:

Code: [Select]

EPM7032S Parallel Programmer - ERASE V7
Waiting 5 seconds
EPM7032S - Phase 1
Port PB PH00: 10000100
Port PB PH01: 10000101
Pulses 108 x A6
Pulses Address 0x43
Pulses SDIN
Read IDCODE
Erase CPLD
Last Phase
End

2) Programming Chip1 with Quartus_CLI program - quartus_jli -a program -c 1 EPM7032SBlinkLedREM.jam

Code: [Select]

C:\altera\Quartus13.0\projetos\EPM7032SBlinkLedTest>quartus_jli -a program -c 1 EPM7032SBlinkLedREM.jam
Info: *******************************************************************
Info: Running Quartus II 64-Bit Jam Tools
    Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
    Info: Copyright (C) 1991-2013 Altera Corporation. All rights reserved.
    Info: Your use of Altera Corporation's design tools, logic functions
    Info: and other software and tools, and its AMPP partner logic
    Info: functions, and any output files from any of the foregoing
    Info: (including device programming or simulation files), and any
    Info: associated documentation or information are expressly subject
    Info: to the terms and conditions of the Altera Program License
    Info: Subscription Agreement, Altera MegaCore Function License
    Info: Agreement, or other applicable license agreement, including,
    Info: without limitation, that your use is for the sole purpose of
    Info: programming logic devices manufactured by Altera and sold by
    Info: Altera or its authorized distributors.  Please refer to the
    Info: applicable agreement for further details.
    Info: Processing started: Fri Jan 09 22:08:01 2026
Info: Command: quartus_jli -a program -c 1 EPM7032SBlinkLedREM.jam
!!!!!!!!!!!!!!!!!!!! SiliconId forced !!!!!!!!!!!!!!!!!!!!
SiliconID_forced: 65 76 84 69 82 65 57 56 255 0 255 255 255 255 255
Device #1 Silicon ID is ALTERA98(00)
programming 7K device(s)...
verifying 7K device(s)...
DONE
Exit code = 0... Success
Info: Quartus II 64-Bit Jam Tools was successful. 0 errors, 0 warnings
    Info: Peak virtual memory: 4238 megabytes
    Info: Processing ended: Fri Jan 09 22:08:34 2026
    Info: Elapsed time: 00:00:33
    Info: Total CPU time (on all processors): 00:00:01
My project is a clock divider:
Input (pin12) = Clock Oscillator
Output (pin37) = Divided clock  (/ 2^24)

80 MHz / 16,777,216 = 4.76837 Hz

EPM7032SBlinkLed.vhd



Pin Planner



Test circuit with Clock oscillator and EPM7032S (In this photo = 20MHz) :




Input (EPM7032S pin12) = Oscillator 80 MHz



Output (EPM7032S pin37) = Divided Clock = 4.766 Hz

[ukamak]

Thanks jgustavoam and all people that provided the info

I think we can't erase the device with:
  quartus_pgm -c usb-blaster -m jtag -o r;test02.pof
  or
  quartus_jli.exe -c 1 -a erase test02.jam

- Becouse we generated that files with quartus and erase is disabled and maybe not addled to POF/JAM file.

  We add in TODO list.

[jgustavoam]

Reading EPM7032S IDCODE with Parallel Programmer - Arduino Mega:

My 6 "new" chips that I bought have already arrived. I already damaged one because I connected the Parallel Programmer connector incorrectly.

I managed to read the IDcode of my Chip4!



Using this Arduino Code - EPM7032S_programmer_READ_V4.ino (Attached file).

Code: [Select]

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10001011
Port PB PH01: 10001101
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A4(�)  0()      ByteSCOB = DB(�) FF(�)
 ByteSCOA = FF(�)  3()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
Last Phase
End

Testing my 8 chips (Chip1 and Chip2 - Cleared IDCODE):

Code: [Select]

EPM7032 Programmer - Arduino MEGA testes 2026_01_12.txt

CHIP1 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

CHIP2 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

CHIP3 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E7( ) FF( )
 ByteSCOA = FF( )  82( )      ByteSCOB = 56(V) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E7( ) FF( )
 ByteSCOA = FF( )  82( )      ByteSCOB = 56(V) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End


CHIP4 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10001000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A4( )  0()      ByteSCOB = DB( ) FF( )
 ByteSCOA = FF( )  3()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10001000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A4( )  0()      ByteSCOB = DB( ) FF( )
 ByteSCOA = FF( )  3()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

CHIP5 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000111
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000111
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )


CHIP6 EPM7032S =================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = BF( )  0()      ByteSCOB = 3() FF( )
 ByteSCOA = FF( )  83( )      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = BF( )  0()      ByteSCOB = 3() FF( )
 ByteSCOA = FF( )  83( )      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )


CHIP7 EPM7032S ======================================================


EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  3()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000000
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  3()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End


CHIP8 EPM7032S =============================================

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10001011
Port PB PH01: 10000111
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A4( )  0()      ByteSCOB = DF( ) FF( )
 ByteSCOA = FF( )  82( )      ByteSCOB = 56(V) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Port PB PH00: 10001011
Port PB PH01: 10000111
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A4( )  0()      ByteSCOB = DF( ) FF( )
 ByteSCOA = FF( )  82( )      ByteSCOB = 56(V) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End


=============================================================

 EPM7032S_programmer_READ_V4.zip (2.06 kB - downloaded 37 times.)

[jgustavoam]

EPM7032S - JTAG UNLOCK - first time without clear IDCODE!!

Using my Parallel Programmer - Arduino Mega, I was able for the first time to erase an EPM7032S (JTAG UNLOCK) without erasing the IDCODE.

1) Erasing the EPM7032S chip (my Chip5) using the Arduino program, without clearing the ID code.
    EPM7032S_programmer_ERASE_V9.ino (attached file)
    Immediately after executing the ERASE procedure, I read the IDCODE again.
    To my surprise, the programmer couldn't read the ID code. I guess it's a matter of timing.
    By running the Read V4 program after Erase chip, I was able to read the IDCODE again!!!

Code: [Select]

EPM7032S Parallel Programmer - ERASE V9
Waiting 5 seconds
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000111
Pulses 108 x A6
Pulses Address 0x43
Pulses SDIN
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Erase CPLD
Read IDCODE
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End


Code: [Select]

CHIP5 - after ERASE V9

EPM7032S Parallel Programmer - READ V4
Test count: 1
EPM7032S - Phase 1
Port PB PH00: 10000000
Port PB PH01: 10000101
Pulses 108 x A6
Pulses Address 0x43
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3( )  0()      ByteSCOB = E3( ) FF( )
 ByteSCOA = FF( )  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF( )  FF( )      ByteSCOB = FF( ) FF( )
Last Phase
End

2) While running the Quartus program with USB Blaster, I selected Auto Detect within the Programmer window and it worked!
    Then I selected the Program/Configure option and, for the first time, I managed to program an EPM7032S with Quartus!



Attached JTAG captures using PulseView and the LOGIC2 program.

[abyrvalg]

Great progress, congratulations!

My theory on what's happening is:
- the readID() function is "read current address" actually
- to read the SiliconID it is essential to set that "current address" to a specific value (that "magic" 0x43 address)
- the eraseCPLD() function erases a particular address (0x3B) and the "current address" remains 0x3B
- a subsequent call to readID() without setting address 0x43 reads the current address 0x3B instead and it returns all FFs (it has been erased just before this read)
- running the READ_V4 code performs a full setup, including setting the address 0x43, so it's readID() reads the correct block containing the SiliconID

Some ideas to try based on the above:
- use READ_V4-style code to read addresses other than 0x43 (i.e. try it on many addresses of a non-blank CLPD, this should read parts of a programmed design, or set the JTAG fuse and read block 0x3B - it should be non-FF)
- !!! DANGER. Don't try unless you are sure !!! Erase block 0x43 instead of 0x3B - this should kill the SiliconID 

Edit: and beware of erasing with BEM=1, for non-S EPM7xxx that appeared to be "erase all blocks" (found in ALL07 programming software some pages of this thread ago).

[abyrvalg]

Checked my old disassembly of the ALL07 sw, it looks pretty similar to what's jgustavoam's code is doing, except one thing: it doesn't pulse A6 hundreds times. When it needs to set an address it just sets A[6..0]=addr and keeps them (as in eraseCPLD() it is just PORTA = 0x3B). An arbitrary address read using existing jgustavoam's functions and ALL07's logic would look like this:

Code: [Select]

phase01EPM7032();
PORTA = addr_to_read;
pulses_SDIN(); // send a 16x 10000  pattern on all SDINx
readID(); // read 5x 16-bit words from all SCOx - this is the data at addr_to_read
I suspect those pulses on A6 we've seen in LA traces were just some noise.

A mass erase in ALL07 is just this:

Code: [Select]

TM = 1;
delay_cycles(5);
BE = BEM = 1;
delay_cycles(5);
NTPW = 0;
delay(Tbe); // Tbe is read from the block containing SiliconID
NTPW = 1;
delay_cycles(5);
BE = BEM = 0;
delay_cycles(5);
TM = 0;
- this would erase the SiliconID block too (they read it before erasing and program back after)

Edit: and here is the fun part: there is no “single block erase” (BE=1, BEM=0) operation in ALL07, only that bulk erase w/o setting the address. But what if we apply the single block erase to the “security fuse” block? 

[jgustavoam]

Hi Abyrvalg,

All Arduino programming (bit bang) was developed from the analysis of protocols captured using the user's logic analyzer Pityocas and Ukamak.
Thank you guys. Without these LA captures, program development would have been impossible.

Ukamak, I recommend against using digitalwrite, as bit programming is more efficient and faster. Some pulses last only 5us.

I still don't know the reason for sending 108 pulses of the A6 addressing bit.But I know that in the case of the EPM7032S there is serial access to the bits of the internal EEPROM.

I read somewhere that BE stands for bulk erase. But what does BEM mean? Bulk erase modified?

Your suggestions are very interesting, and I will test them as soon as possible.

Thank you.

[abyrvalg]

Sure, I’ve seen posts with LA dumps and your first experiments. The ALL07 I’m talking about is some ancient parallel programmer analyzed several years ago in this thread (page 7) and it is interesting and reassuring to see similarities between it and your working code. And since they match, more details from the ALL07 could be useful, i.e. the block programming part (would be great to restore erased SiliconIDs for example).

I guess BE means Block Erase: note that your code has erased the JTAG fuse but not the SiliconID block.
And BEM could be something like Block Erase Mass, erasing everything.

A6 pulsing: my bets are if you comment them out the code would work the same way.

Timings: from ALL07 code it looks like the only pulses potentially sensitive to max width are NTPWs. Perhaps this pin controls the high voltage to memory cells directly (like in old 27xx PROMs) and leaving it in the on state for too long could result in “overprogramming” and excessive cell wear. ALL07 sw gets several programming parameters from the device itself (from other bytes of the block containing the SiliconID):Tbe (NTPW pulse width for erase), Tpg (NTPW pulse width for program), Vpg (programming voltage: they read the ID block with Vpp=12V, then adjust it to a more exact Vpg value).

[ukamak]

The use of pulses on A6, I think, is because in the larger CPLDs, the A0-A6 address lines are insufficient. Instead of increasing the parallel lines, they came up with the idea of ​​sending pulses serially through A6 and using A0-A5. This needs further study. The EPM7032 doesn't use pulses on A6; it uses everything in parallel, but the larger ones already use the pulse technique.

Using digitalwrite for me is more clear to implement, bud after program is less clean. The idea is to have one h file fro 7032, 7032s etc and use same code.

Protocol for epm7032 is different than emp7032s. It uses BEM, parallel addressing A0.A6, need to decrypt siliconId ....

[jgustavoam]

EPM7032S - Reading Bytes from EEPROM Memory

Based on the capture from Pityocas - EPM7032S read TM, I am able to read bytes from a specific address in the EEPROM memory.

In this LA capture, the address selection must follow a sequence of 215 address pulses.
The sum of pulses should always be 215, I presume.


Reading the address 0x43 gives the ID code.
Reading address 0x5B should be a block of EEPROM memory (Second reading in this example).
After selecting address 0x5B, pulses of 0x40 should determine the block sequence.
I will have to do many studies and tests.

Code: [Select]

EPM7032S Parallel Programmer - READ V5
Test count: 1
EPM7032S - Phase 1
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3(�)  0()      ByteSCOB = E3(�) FF(�)
 ByteSCOA = FF(�)  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)

Read SCOA and SCOB  // Address 0x5B + one pulse 0x40
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = 7F()  FF(�)      ByteSCOB = DE(�) CF(�)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = 7F()  FF(�)      ByteSCOB = DC(�) C3(�)
Last Phase
End

Test count: 2
EPM7032S - Phase 1
Read IDCODE
 ByteSCOA = 41(A)  4C(L)      ByteSCOB = 54(T) 45(E)
 ByteSCOA = 52(R)  41(A)      ByteSCOB = 39(9) 38(8)
 ByteSCOA = A3(�)  0()      ByteSCOB = E3(�) FF(�)
 ByteSCOA = FF(�)  2()      ByteSCOB = 50(P) 31(1)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)

Read SCOA and SCOB  // Address 0x5B + one pulse 0x40
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = 7F()  FF(�)      ByteSCOB = DE(�) CF(�)
 ByteSCOA = FF(�)  FF(�)      ByteSCOB = FF(�) FF(�)
 ByteSCOA = 7F()  FF(�)      ByteSCOB = DC(�) C3(�)
Last Phase
End

Pityocas EPM7032S read tm Capture - Attached



Arduino Code - EPM7032S_programmer_READ_V5.ino - Attached

(The Arduino code doesn't fit in this post.)

Only the Loop :

Code: [Select]

void loop() {

  count = count + 1;
  Serial.print("Test count: ");
  Serial.println(count);

  phase01EPM7032();
  pulses_SDIN();          // Send SDINA and SDINB pulses to CPLD
  delayMicroseconds(20);  // delay 20 microseconds
  pulses_Address40(214);  // 214 pulses of Address 0x40
  delayMicroseconds(6);   // delay 5 microseconds
  pulses_Address43();     // Set Address 0x43
  delayMicroseconds(6);   // delay 5 microseconds
  Serial.println("Read IDCODE");
  readSCOX();
  delayMicroseconds(100);  // delay 100 microseconds

  pulses_SDIN();              // Send SDINA and SDINB pulses to CPLD
  delayMicroseconds(20);  // delay 20 microseconds
  pulses_Address40(213);  // 213 pulses of Address 0x40
  pulse_Address5B();      // set Address 0x5B
  pulses_Address40(1);    // 1 pulse of Address 0x40
  Serial.println();
  Serial.println("Read SCOA and SCOB");
  readSCOX();
  delayMicroseconds(100);  // delay 100 microseconds

  lastPhaseEPM7032();
  delay(700);  // delay 500 miliseconds
}


   
Reading IDCODE and Address 0x5B:



213 pulses 0x40 + one pulse 0x5B + one pulse 0x40

[ukamak]

It seems that we're mixing EPM7032 and EPM7032s. In 48uxp EMP7032 don't use pulses only addresses. Pityokas capture seesm to be for 7032

[ale500]

Hello together,

Gustavo, thanks for contacting me, muito obrigado . Excelente trabajo han realizado todos ustedes, muito bom.

Now that the 7032S can be erased and the jtag can be activated again means that we could probably get the other family members: 7064S and 7128S to work.

I have some 7128S I got from Ali several years ago, and a board with a socket.
- I have no arduino megas (I had one but I gave it away), I could port the code to something else, for the time being I use the rp2040/rp2350, these are 3.3V devices, they need voltage leveling, also a solved problem.

I could overtake developing the "thing" for the MAX7128S. I only have the ones I got from ali express.

Let's put a plan (for me), chime in if you think I am doing it wrong ;-)

- Find out the pinout mapping between the 32 and the 128, I think the datasheet and related documents are going to help here, do a review with you (reviews are great, we should do a check list and some jira issues too, just joking).
- Build a similar programmer to what Gustavo has but for the PLCC84 my MAX devices.
- Port the FW (there is an ardiuno framework for the rp2040).
- Try it

What do you think ?

Edit: I do not find the pinout of the signals needed for the 7128 I will keep looking. I just ask myself: do we really need so much for only "erase all", I saw that one could program something even if the id is zero...