Thank you for making the waveform traces @pityokas
When I first started this project (a year or two ago) I was hoping that someone who had access to genuine programmer hardware would be able to make traces of the pins, in order to allow the programming protocol top be reverse engineered.
Here is a quick summary of my findings for the
EPM7032 with some guesses added.
The Vpp pin when taken to a high enough voltage (*) puts the device into test/programming mode, and the pins are configured into inputs and outputs for SK, SCL, SDIN, SDOUT, SCO, etc.
SDINA and SDINB are used to shift in 80 bits of data. For the read ID sequence to work, a pattern of 00001-00001-000001-00001-00001 (for 80 bits) is required. I have no idea of the significance of this pattern. Data on SDINA and SDINB is clocked in using the SCK clock.
The "set of 5" is also seen in the tables in the ALL03 programming software. This must tie in with the architecture in some way.
The ADDR pins (A6-A0) select a block of EEPROM memory. Since 160 bits are shifted in (80 on SDINA and 80 on SDINB) then we can guess that each block of EEPROM is 160 bits.
Address block 0x7C (hex) is a special block which contains the "read ID". I have no idea if this block is protected from erase or is simple implemented as ROM (rather than EEPROM).
Data is clocked out on SCOA and SCOB. I have a suspicions that these are the outputs of two 16 bit registers, as 16 bits are shifted out using SK, with a clock of SCK every 16 clocks of SK. For the first bit of SS is low and for the next 15 bits SS is high. An alternate interpretation is that SS must be low when SCK is clocked to load new data into the 16 bit SCO registers.
Each device type generates a different stream for read ID. For the EPM7032VLC-44 "V" 3.3V device the datastream of SCOA is 0146-8AAB-F533-6083-3643 (5 sets of 16 bits, with MSB clocked out first). This was observed on a genuine device and captured using a Rigol oscilloscope. The 80 bits for each SCO shifted out is unscrambled using an algorithm based around sets of 5 bits. When the 80 bits shifted out of SCOA are descrambled it becomes 10 bytes "0xFE 0x07 A L T E R A 9 3" (i.e. 10 * 8 bits = 80). The first two bytes define: Vpg - the programming voltage needed on Vpp (called Vpg in the ALL03 software); Tbe - time for bulk erase in ms (determined by a look up table) [note I am guessing the purpose based on the letters "BE"); and Tpg - time to program one EEPROM memory block (also determined using a look up table). The ALL03 software has hidden commands which can be enabled with the sequence "uIu" which gives the "I" command which prints the decoded read ID and Vpg, Tpg and tBe (see attachment).
NTPW is the pin used for the programming and erase pulse. While Vpp/Vpg is high (12V or so) this pin MUST be '1'. It is pulsed LOW for between 20 to 500ms (depending upon device) to either program a block of EEPROM as addressed using the ADDR pins, or to erase everything. Of course it should only be taken low when the appropriate sequence has been applied to other pins.
the ADDR pins (A6-A0) select the block of EEPROM to be programmed or read back. When programming a block of EEPROM the data to be programmed is shifted in on SDINA and SDINB. When reading back a block it is the same as the "read ID " waveforms except that the ADDR pins select the block of EEPROM to be read. For blank check all EEPROM address blocks are read back and all 160 bits (80 from SCOA and 80 from SCOB) must be '1' to confirm the erased state. In the ALL03 blank check command address blocks 0 to 0x57 (87 decimal) are read back in order, then the next few blocks are not read sequentially but goes to 0x68 with the final two reads of address blocks 0x70 and 0x71. This is 106 address blocks in total or 2.21k bytes of data.
The ALL03 software reads in the data to be programmed in POF format. Using Altera Quartus 13.0 (free download) it is possible to create a POF for the MAX7000. My only concern is that the POF format might be different for different versions of the chip A,B,s (JTAG). I compiled a very simple piece of verilog code which simply routine pin 4 to pin 5 (no clocks or flops were used). The data portion of the POF file (having removed the head) was approx 1900 bytes. I do not know the data format, however the size of the header can vary and contains textual information.
(*) for the EPM7032VLC-44 which is the "V" 3.3V Vcc device, I only needed to raise Vpp to 5.5V in order to enable test/programming mode and unload the read ID data stream (on a real device). Note: for programming or erase the required Vpp will be around 12V, the exact needed value is encoded into the read ID data stream.
In my DOSBOX-X
emulation of the ALL03 ISA card, ALL03 registers, and EPM7032 device, I added emulation for the SCOA and SCOB data streams for the "read ID" sequence. I was able to use the ALL03 software to confirm that the data steams were correct, since when unscrabled the magic string "ALTERA93" appears. The emulation of the "read ID" is important, otherwise the software will not generate any further waveform stimulus unless a device has been detected via the "read ID" data stream mechanism.
Home
Help
Search
Login
Register
