Author Topic: Weller WMD-3 M27C256B dump needed  (Read 3722 times)

0 Members and 1 Guest are viewing this topic.

Offline HooliganTopic starter

  • Newbie
  • Posts: 5
  • Country: ee
Weller WMD-3 M27C256B dump needed
« on: December 28, 2020, 07:27:01 pm »
Hi, trying to repair the old Weller WMD-3 soldering station with MCU SAB80C535N and ROM M27C256B on board. Station has no indication at all. Finally found that ROM changes some bytes inside it every time it powers on, so the data is corrupted. Could someone help me with the M27C256B dump from a working unit?
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #1 on: December 28, 2020, 11:01:17 pm »
Try reading it multiple times with different VCC and IC temperature. There is a chance you can read it successfully.
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #2 on: December 29, 2020, 04:04:54 am »
Can you upload one of your bad dumps? Perhaps you could narrow down the problem to a weak data bit, in which case you could buffer it with a comparator.
 

Offline HooliganTopic starter

  • Newbie
  • Posts: 5
  • Country: ee
Re: Weller WMD-3 M27C256B dump needed
« Reply #3 on: December 29, 2020, 05:49:35 am »
Thanks for taking part guys, will try to play with VCC and temperature. Here are few dumps with some different bytes in it.
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #4 on: December 29, 2020, 06:43:04 am »
ISTM that bits are being dropped rather than being set. Therefore I'm wondering if the solution would be to simply perform a bitwise OR on the contents of all the dumps.

I have already written a command line tool to do this.

http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/filmerge.exe
http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/filmerge.bas

This would be my BATch file:

    filmerge M27C256B-v1.BIN M27C256B-v2.BIN temp1
    filmerge temp1 M27C256B-v3.BIN temp2
    filmerge temp2 M27C256B-v4.BIN temp1
    filmerge temp1 M27C256B-v5.BIN temp2
    filmerge temp2 M27C256B-v6.BIN ROM.bin


« Last Edit: December 29, 2020, 08:27:33 am by fzabkar »
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #5 on: December 29, 2020, 12:19:21 pm »
ISTM that bits are being dropped rather than being set. Therefore I'm wondering if the solution would be to simply perform a bitwise OR on the contents of all the dumps.
IMHO it should be bitwise AND, not OR. Since bits are in logic high state when unprogrammed (read as FF) and set logic low when programmed. And as cell discharges, it should return to high state with time. Switching from high to low state is only possible if IC physically fails or programmed IC was poorly erased previously.
« Last Edit: December 29, 2020, 07:31:16 pm by wraper »
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #6 on: December 29, 2020, 04:10:01 pm »
ISTM that bits are being dropped rather than being set. Therefore I'm wondering if the solution would be to simply perform a bitwise OR on the contents of all the dumps.
IMHO it should be bitwise AND, not OR. Since bits are in logic high state when unprogrammed (read as FF) and set logic low when programmed. And as cell discharges, it should return to high state with time. Switching from low to high state is only possible if IC physically fails or programmed IC was poorly erased previously.
If you compare the dumps, you will notice that the differences occur mostly near the start and end of the ROM. If you then examine the contents at the end of the ROM, you will see that bytes which should be 0xFF (?) are read as 0xE7 or 0xFE. At least that's how I see it. Therefore it could be a case of a weak data bus rather than fading cells. But then the bad cells should be randomly distributed throughout the entire address space, not confined to the start and end. ???
« Last Edit: December 29, 2020, 04:15:56 pm by fzabkar »
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #7 on: December 29, 2020, 04:28:28 pm »
If you compare the dumps, you will notice that the differences occur mostly near the start and end of the ROM. If you then examine the contents at the end of the ROM, you will see that bytes which should be 0xFF (?) are read as 0xE7 or 0xFE.
Differences occur mostly in start to middle, not end. I don't see any flipped data located in an empty pool of FFs. The furthest single standing thing is like 20 bytes away from other data.
Quote
Therefore it could be a case of a weak data bus rather than fading cells
Strange you even thought of this since different bits are flipped. And only single bit at a time.
« Last Edit: December 29, 2020, 04:34:43 pm by wraper »
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #8 on: December 29, 2020, 04:35:44 pm »
Quote
Therefore it could be a case of a weak data bus rather than fading cells
Strange you even thought of this since different bits are flipped.
AISI, bits which should normally be high are read as low. The opposite doesn't occur. This would be consistent with a weak data bus, if the addresses were randomly distributed.
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #9 on: December 29, 2020, 04:52:34 pm »
AISI, bits which should normally be high are read as low. The opposite doesn't occur. This would be consistent with a weak data bus, if the addresses were randomly distributed.
I haven't ever heard about this magical weak data bus, and why it "should read low and opposite does not occur". While retention (floating-gates losing charge) is a very real thing and bits flip to erased (high) state. Also if it's a supposed bus issue, then why bits flip at the same places and not purely randomly?
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #10 on: December 29, 2020, 04:58:45 pm »
AISI, bits which should normally be high are read as low. The opposite doesn't occur. This would be consistent with a weak data bus, if the addresses were randomly distributed.
I haven't ever heard about this magical weak data bus, and why it "should read low and opposite does not occur". While retention (floating-gates losing charge) is a very real thing and bits flip to erased (high) state.
Nothing magical about it. I have seen MANY cases where a TTL level doesn't switch nicely between 0V and 5V. In fact I have used comparators to buffer these low levels in IBM PS/2 Model 25s.

Here is a quirky thread:

https://www.eevblog.com/forum/repair/kontron-8201-not-booting/msg3374750/#msg3374750

The OP is observing weak TTL levels on the data bus.

"The 5V Rail of the PROM is clean. But as you can see, the Voltage levels are at about 3V and sometimes even lower.. Is this a known failure mode of an aged PROM?"


« Last Edit: December 29, 2020, 05:01:23 pm by fzabkar »
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #11 on: December 29, 2020, 05:23:29 pm »
Code: [Select]
Comparing files M27C256B-v1.BIN and ROM.BIN
0000000B: 00 02
0000000C: 01 03
0000000D: 1A 5A
0000006E: EE FE
00000B11: 40 44
0000121A: 03 83
00004048: 23 63
00004531: 20 A0
0000590B: 32 3A
00005950: E8 F8
0000597C: 13 1B
00007F30: F7 FF

Code: [Select]
Comparing files M27C256B-v2.BIN and ROM.BIN
00000008: 03 23
00000009: 5A 7A
0000000B: 00 02
0000000C: 01 03
0000000D: 1A 5A
0000004E: 63 E3
00000052: 73 F3
00000053: F2 F6
0000006E: EE FE
00000B11: 40 44
00000B33: BC FC
0000121A: 03 83
00004042: 62 E2
0000590B: 32 3A
00005934: 06 0E
00005935: 90 98
00005936: 13 1B
0000593E: 90 98
00005950: F0 F8
00007829: E7 F7
00007F30: F7 FF

Code: [Select]
Comparing files M27C256B-v3.BIN and ROM.BIN
00000002: 00 40
00000008: 03 23
00000009: 5A 7A
00000012: F2 F6
00000030: C2 E2
0000004E: 63 E3
0000005B: D0 F0
00000064: EE FE
0000006D: 66 E6
00000B11: 40 44
0000121A: 03 83
00004042: 62 E2
00004048: 23 63
00004069: 77 F7
0000590B: 32 3A
0000593F: 13 1B
00005950: F0 F8
00005963: 04 0C
00007829: E7 F7

Code: [Select]
Comparing files M27C256B-v4.BIN and ROM.BIN
00000008: 03 23
00000009: 5A 7A
00000030: C2 E2
0000004A: 02 42
0000004E: 63 E3
00000052: 73 F3
00000053: F2 F6
0000005B: 50 F0
00000060: C2 E2
0000006E: EE FE
00000B11: 40 44
00000B33: BC FC
00004007: F0 F2
00004042: 62 E2
00005934: 06 0E
00005935: 90 98
00005936: 13 1B
00005950: F0 F8
00005963: 04 0C

Code: [Select]
Comparing files M27C256B-v5.BIN and ROM.BIN
00000002: 00 40
00000008: 03 23
00000009: 5A 7A
0000000B: 00 02
0000000C: 01 03
0000000D: 1A 5A
0000001B: 62 E2
0000004E: 63 E3
0000005B: 50 F0
00000060: C2 E2
0000006D: 66 E6
0000006E: EE FE
00004004: A0 A2
00004007: F0 F2
00004042: 62 E2
0000590B: 32 3A
00005934: 06 0E
00005950: F0 F8
00005963: 04 0C
0000597C: 13 1B

Code: [Select]
Comparing files M27C256B-v6.BIN and ROM.BIN
00000002: 00 40
00000006: 00 40
00000008: 03 23
00000009: 5A 7A
0000000C: 01 03
0000000D: 1A 5A
00000012: F2 F6
0000001B: 62 E2
00000030: C2 E2
0000004E: 43 E3
00000051: 64 66
0000005B: 70 F0
0000006D: 66 E6
0000006E: EE FE
0000121A: 03 83
00004042: 62 E2
00004069: 77 F7
00005934: 06 0E
00005959: 90 98
00005963: 04 0C
00007829: E7 F7

Here is an 0xE7 which flips to 0xF7 in some dumps (M27C256B-v6.BIN). It looks like it wants to be 0xFF.

Code: [Select]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007800  01 FF 01 FF 01 FF 01 FF 01 FF 01 FF 0B FF 0B FF
00007810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007820  FF FF FF FF FF FF FF FF FF E7 FF FF FF FF FF FF  <--
00007830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007840  49 FF 01 FF FF FF FF FF FF FF 49 FF FF FF FF FF

This block looks like it needs fixing (ROM.BIN):

Code: [Select]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007E00  01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF
00007E10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007E20  E7 E7 F7 FF FF FF FF FF EF E7 EF EF FF FF FF FF
00007E30  F7 F7 F7 F7 FF FF FF FF FF E7 FF E7 FF FF FF E7
00007E40  01 FF 01 4B FF FF FF FF FF FF 01 01 FF FF FF FF
« Last Edit: December 29, 2020, 05:35:17 pm by fzabkar »
 

Offline HooliganTopic starter

  • Newbie
  • Posts: 5
  • Country: ee
Re: Weller WMD-3 M27C256B dump needed
« Reply #12 on: December 29, 2020, 06:55:14 pm »
Tried to play with Vcc, but no success, everytime get a different data. Made bitwise OR on dumps with same Vcc, the result is attached.
 

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #13 on: December 29, 2020, 07:06:25 pm »
I don't understand the failure mode, especially in that other thread. I would have thought that @wraper was right, and I had already confirmed that the erased state of the EPROM was 0xFF.

Anyway, I have rewritten my tool to perform a bitwise AND. This expects that bad bits are hot.

http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/bitwand.exe
http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/bitwand.bas
 
The following users thanked this post: wraper, Hooligan

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #14 on: December 29, 2020, 07:25:34 pm »
I would use as many dumps as possible (like 100+), preferably made in different conditions and run them through AND/OR tools and see if processed dump works afterwards. And continue processing additional dumps with the tool until resulting dump stops changing.
 
The following users thanked this post: Hooligan

Online fzabkar

  • Super Contributor
  • ***
  • Posts: 2806
  • Country: au
Re: Weller WMD-3 M27C256B dump needed
« Reply #15 on: December 29, 2020, 07:51:42 pm »
ISTM that, as Vcc increases, the bad bits switch from 0 to 1, not the other way around. I don't know if this is repeated over the entire address space.

ROM.bin

Code: [Select]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007E00  01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF
00007E10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007E20  E7 E7 F7 FF FF FF FF FF EF E7 EF EF FF FF FF FF
00007E30  F7 F7 F7 F7 FF FF FF FF FF E7 FF E7 FF FF FF E7
00007E40  01 FF 01 4B FF FF FF FF FF FF 01 01 FF FF FF FF

ROM-VCC5_5.bin

Code: [Select]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007E00  01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF
00007E10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007E20  E7 E7 FF FF FF FF FF FF FF E7 EF FF FF FF FF FF
00007E30  F7 F7 FF F7 FF FF FF FF FF E7 FF E7 FF FF FF E7
00007E40  01 FF 01 FB FF FF FF FF FF FF 01 03 FF FF FF FF


ROM-VCC6_5.bin

Code: [Select]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007E00  01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF
00007E10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00007E20  F7 E7 FF FF FF FF FF FF FF EF FF FF FF FF FF FF
00007E30  FF F7 FF F7 FF FF FF FF FF E7 FF E7 FF FF FF F7
00007E40  41 FF 01 FF FF FF FF FF FF FF 01 4B FF FF FF FF
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #16 on: December 29, 2020, 08:04:36 pm »
ISTM that, as Vcc increases, the bad bits switch from 0 to 1, not the other way around. I don't know if this is repeated over the entire address space.
Then chip should be read at decreased voltage. Say 4V, or even less.
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #17 on: December 29, 2020, 08:25:40 pm »
Tried to play with Vcc, but no success, everytime get a different data. Made bitwise OR on dumps with same Vcc, the result is attached.
But why you only tried increasing the voltage?
 

Offline HooliganTopic starter

  • Newbie
  • Posts: 5
  • Country: ee
Re: Weller WMD-3 M27C256B dump needed
« Reply #18 on: December 29, 2020, 08:30:58 pm »
Do you mean I should lower voltage or try to heat the IC?
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17952
  • Country: lv
Re: Weller WMD-3 M27C256B dump needed
« Reply #19 on: December 29, 2020, 08:33:30 pm »
Do you mean I should lower voltage or try to heat the IC?
Lower the voltage, put into freezer. Try both ways.
 

Offline cocosteel

  • Newbie
  • Posts: 3
  • Country: fr
Re: Weller WMD-3 M27C256B dump needed
« Reply #20 on: April 10, 2022, 05:14:26 pm »
Hello, do you still need this eprom dump ?
 

Offline HooliganTopic starter

  • Newbie
  • Posts: 5
  • Country: ee
Re: Weller WMD-3 M27C256B dump needed
« Reply #21 on: April 14, 2022, 08:05:06 am »
Hi, still need, could you upload it please?
 

Offline cocosteel

  • Newbie
  • Posts: 3
  • Country: fr
Re: Weller WMD-3 M27C256B dump needed
« Reply #22 on: April 14, 2022, 03:49:45 pm »
Here it is. I hope this will help you to repair your soldering station.
I have done a quick diff with my file and yours, it's interesting to see how your EPROM is corrupted.
« Last Edit: April 14, 2022, 04:09:05 pm by cocosteel »
 
The following users thanked this post: wraper, Hooligan

Offline mt777

  • Contributor
  • Posts: 12
  • Country: pl
Re: Weller WMD-3 M27C256B dump needed
« Reply #23 on: December 14, 2024, 04:00:35 am »
Do you have a photo of motherboard with EPROM (27C) ?
I wanted preserve my unit (where DSX-120 works and in another WMD3 is not recognized) but what I see that I have only single PIC chip (in both units)
 

Offline Harry_22

  • Frequent Contributor
  • **
  • Posts: 603
  • Country: 00
Re: Weller WMD-3 M27C256B dump needed
« Reply #24 on: December 14, 2024, 11:08:10 am »
Hi!

Still need dump from Weller WMD-3?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf