Hi,
I analyzed a bit more of the capture and could observe the following:
- first PA.5 is set to high (not sure which voltage is applied since logic analyzer does not provide this info, will find out later)
- 100µs later VDD is set to high (not sure which voltage is applied since logic analyzer does not provide this info, will find out later)
- 500µs later PA.3 (CLK) and PA.6 (DAT) are used to send 48 bit of data:
1010010110100101101001011001cccccccc10101010001 (A5A5A5A*CMD-BYTE*AA1) Note: AA1 might be from OTP-ID 2AA1 ?
- depending on command
* no response expected:
- 100µs later VDD is set to low
- 250µs later PA.5 is set to low
* response expected:
- maybe DAT/CLK changes direction (driven by IC now)? -->
any idea how to find out who is sending IC or WRITER? - response length depending of command
- 100µs later VDD is set to low
- 250µs later PA.5 is set to low
****
Following in this order been sent:
0x61 / no response (maybe writer stops after getting no response or does not even wait for response)
0x61 / response: 00111110111101111111111110000111111100000000000000011100011111110001000000000001111 (3F7BFFC3F8000E3F8800F)
0x31 / response: 0000 (very slow clocking)
0x66 / no response (execution time is very long before VDD/PA.5 going low)
0x70 / additional send data: 000000000010001111111111111111111111111111111111111111110011111110000 0 0 0 0 0 0 0 0 (last bits slow clocking) (4x 14bit data: 0x0008, 0x3FFF, 0x3FFF, 0x3FFF , 0x3F8 0 0..)
0x61 / no response (maybe writer stops after getting no response or does not even wait for response)
0x71 / additional send data: ( multiple times: (4 x 14 bit data, ADR, slow clocks to process) )
0x61 / no response (maybe writer stops after getting no response or does not even wait for response)
0x61 / no response (maybe writer stops after getting no response or does not even wait for response)
0x61 / response: ...
0x61 / no response (execution time is very very very long VDD/PA.5 going low, seems DAT pulses without CLK from IC extend waiting period)
0x70 / additional send data: ( multiple times: (4 x 14 bit data, ADR?, slow clocks to process) )
0x70 / additional send data: ( multiple times: (4 x 14 bit data, ADR?, slow clocks to process) )
0x61 / response: ...
0x60 / response: multiple times: (14 bit data)
0x61 / no response (maybe writer stops after getting no response or does not even wait for response)
0x60 / no response (maybe writer stops after getting no response or does not even wait for response)
0x70 / additional send data: ( multiple times: (4 x 14 bit data, ADR, slow clocks to process) )
****
- now IC is booted normally (PA.5 stays low, VDD is set to high)
- at this point it looks like the "calibration code" is executed
# PA.5 is set high
# PA.4 + PA.7 output high some clocks later
lot of PA.4/PA.3 communication is done ...
- after some time VDD is set to low (IC shutdown)
****
- calibration is run again
****
0x71 / additional send data: ( multiple times: (4 x 14 bit data, ARD?, slow clocks to process) )
0x61 / response: ...
0x60 / no response (maybe writer stops after getting no response or does not even wait for response)
0x71 / additional send data: ( multiple times: (4 x 14 bit data, ADR?, slow clocks to process) )
****
ALL DONE
Looks like:
0x60/0x61 might be GET_STATUS or READ
0x70/0x71 might be WRITE
0x31 might be ERASE
0x66 might be CHECKBLANK
Time to write a parser for this
Have fun,
JS