Author Topic: Programming (non-JTAG) MAX7000 devices  (Read 64111 times)

0 Members and 1 Guest are viewing this topic.

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #200 on: September 06, 2024, 07:54:45 pm »
In reality my summarization is based on Matthieu Benoit's and mqp.com on EPM7032/7064, with the hypothesis that multiple packages of a certain device have no difference apart from their packaging, i.e. the dies are all the same. Also, EPM7128E differs from EPM7064 entirely, it should have 8 serial input (guessed from the buffer chips on ADP-7128), each corresponding to one LAB.

I agreed, that different packages of the same chip type must be "similar". Different LAB/Cell pins may connected to different pins at each package type, but they should share the same functionality (+also for parallel programming).
Like you said - dies are the same. It is interesting, that package page for EPM7064 in a datasheet shows exact "geographic" pin-to-pin match between PLCC44 and TQFP/PQFP44. Pin numbering is different between packages, but die pinout in terms "east-west-south-north" are the same.

And I wonder, that 7128 may have 8 serial pipes instead of 4. Yesterday I re-read Matthieu Benoit's site and found a mention of  "ALTERA EPM7128LC84 with adapter ADP-EPM7128-PL", so adapter for 7128 may be a different one.
Unfortunately, I have no ADP-EPM7128-PL schematic. What confuses me, is that text in ADP-7064 PDF schematic says, that EPM7096S, EPM7128S and EPM7160S as compatible. So I assume that it may work for 7128S too.

I have no 7064 in PLCC84 to reuse my current "adapter", but have one chip in PLCC44. So I try to solder a minimal 44 pin adapter to continue investigations.

PS: Also I walk along the @migry path and disassembled a70x.exe. It's pretty simple at the hi-level (DOS, MZ executable, segments, etc), but more cumbersome when diving into interaction with hardware. Need to look to Matthieu Benoit's schematic of ALL07 and stuff.


 
The following users thanked this post: Beta_vulgaris

Offline pityokas

  • Contributor
  • Posts: 18
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #201 on: September 08, 2024, 05:32:38 am »
Quote
I agreed, that different packages of the same chip type must be "similar". Different LAB/Cell pins may connected to different pins at each package type, but they should share the same functionality (+also for parallel programming).

Maybe Dataman48 adapters information give more help for pins used for programming:
https://www.dataman.com/mwdownloads/download/link/id/111/

Example:
EPM7064/96-84 1,2,4,10,12,14,16,17,18,20,23,27,28,29,31,33,35,36,37,39,40,41,44,45,46,48,49,50,52,54,56,57,62,65,67,68,69,71,73,75,77,79,80,81,83,84 +VCC and GND
EPM7128-84    1,2,4,6,8,9,11,12,14,15,20,21,23,30,31,33,34,35,37,39,40,45,46,48,50,51,52,54,55,57,60,62,64,65,67,69,70,71,73,77,81,83,84 +VCC and GND

Quote
What confuses me, is that text in ADP-7064 PDF schematic says, that EPM7096S, EPM7128S and EPM7160S as compatible. So I assume that it may work for 7128S too.
Probably true for JTAG programming but not for parallel.

Attach one EPM7128E (not S) Beeprog-pulseview capture (I think was a read).
« Last Edit: September 08, 2024, 08:02:36 am by pityokas »
 
The following users thanked this post: marcopolo, Beta_vulgaris, megov

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #202 on: September 10, 2024, 11:23:34 am »
I take a couple steps back and solder adapter for EPM7064SLC44 and EPM7032SLC44 as their pinouts are more clear. Schematic attached here.
For 7032 family, the only chip in PLCC44 that I have is EPM3032ALC44. I know, that it should be powered 3.6V and may be incompatible with 7032S for programming. But and I try to read ID from it.  >:D
Well. Reading failed as pin4 (SCK) shunts SCK signal to ground just after 12V was applied to Vpp. SCK level was dropped to <0.5V so input shift registers was not clocked properly. I assume, that (at least for EPM3032ALC44) in programming mode pin4 become an output. Lucky enough, I didn't burn anything, both my test picture and chip work after the 12V torture. I've ordered 6 EPM7032SLC44 and 6 EPM7064SLC44 and will continue investigation.

For EPM7064SLC44 results are better, I've not read ID yet, but have some responses. Main problem: what values should have a bunch of other signals?
Firstly I set BE=0,, BEM=0, MTIN=0, SS_BI=0, TM=0, MT=0, CB=0, BP=0, BV=0, GAD0=0, GAD1=0, A0-A7 have 0x7C address, NTPW=1.
I set 0001 pattern 16 times on all SDINA/B/C/D inputs and clock each bit with 0-1-0 SCK pulse, than try to read five 16 bit packets from outputs: SS_BI=0 during the first SK pulse, then SS_BI=1 during other 15 SK pulses, then SS_BI=0 plus a single SCK pulse. All SCOx remains 0 while reading, but SDOA output shows an interesting waveform (see SDOA.PNG)

When I change initial values to CB=BP=BV=1 and run reading cycle, all SCOx remains 0 in writing phase, but turns to 1 when reading started (see SCOA-00.png).
It seems that "there is a life inside", but something wrong in procedure. Maybe 5x16=80 bits * 4 pipes of input is not enough? Or some combination of other signals needed?

BTW, does anyone know purposes of all these BP/BV/CB/TM/ME/etc signals?
I'm not sure, but is seems that /NTPW is a "write" strobe (=1 while reading) and BE is "bulk erase" signal (=0 while reading and =1 during erasing).

PS: SCOx behavior changes with CB=1, BP and BV do not affect it.
« Last Edit: September 10, 2024, 12:53:53 pm by megov »
 
The following users thanked this post: Beta_vulgaris

Online Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 72
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #203 on: September 10, 2024, 03:39:50 pm »
I take a couple steps back and solder adapter for EPM7064SLC44 and EPM7032SLC44 as their pinouts are more clear. Schematic attached here.
For 7032 family, the only chip in PLCC44 that I have is EPM3032ALC44. I know, that it should be powered 3.6V and may be incompatible with 7032S for programming. But and I try to read ID from it.  >:D
Well. Reading failed as pin4 (SCK) shunts SCK signal to ground just after 12V was applied to Vpp. SCK level was dropped to <0.5V so input shift registers was not clocked properly. I assume, that (at least for EPM3032ALC44) in programming mode pin4 become an output. Lucky enough, I didn't burn anything, both my test picture and chip work after the 12V torture. I've ordered 6 EPM7032SLC44 and 6 EPM7064SLC44 and will continue investigation.
MAX 7000AE/3000A (also ATF15xx excluding ATF1500) series differ far from the parallel programming, only JTAG available and the OE1 pin is used to reclaim JTAG functionality, according to ADP-7064AE and ADP-ATF1508 diagrams from Matthieu's, drawn by tinhead@eevblog.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 
The following users thanked this post: megov

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #204 on: September 11, 2024, 06:36:03 pm »
Another deep dive, today into A70X.EXE.
I gathered together all ALL-03/EXPRO-80 schematics that I can download from Matthieu Benoit's site (Many thanks to him!), cut down A70X executable inside IDA and write SAC-201 emulation stub inside DosBox.
Just like @migry already done before. While A70X were written in C, its internals are quite cumbersome, because it supports a bunch versions of a programmer, different versions of DOS, VGA and BW access to videoram and all that compatibility stuff. Hardware detection routines are located here-and-there and obstruct to find actual CPLD interaction protocol.
Currently I have a more or less clear traces of ReadID for EPM7064LC44 and EPM7064LC84.
As a next step I'll try to convert bitbang traces to actual pin handling routines (including ALL-03 registers to test socket pins mapping + known ADP-7064 topology) and reimplement them on my test fixture.

PS: It is interesting, that both ALL-03 schematic and software evolved over time. For example, there is ALL-03_Hardware_IO_Configuration.PDF document from Matthieu Benoit's site, contains, I think, the earliest version of registers map. There were no F6 (marked as unused) and F7 register, EF register has only two positions for GND pins, etc. But software accessed some undocumented entities:
  • reading from undocumented F8 register
  • accessing registers 01h-07h while outputting 80h to 0F6h register
  • and the most brilliant thing: organizing serial (CLK+DATA) interface on two LSBs of VOP DAC (reg E7h)

The latter used to detect some hardware through serial channel. Unfortunately, I don't know anything about it. And also I can't find any info on schematics, except two nets on HILOSYSTEMS ALL-03A/SUNSHINE EXPRO-80 PDF, that marked, but hanging float (or I can't find their destination).
« Last Edit: September 11, 2024, 08:09:38 pm by megov »
 
The following users thanked this post: YetAnotherTechie, Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #205 on: September 12, 2024, 08:42:07 pm »
 :-BROKE   :horse:

Spent another day in (retro) digital archeology. I've caught traces of Read ID action from A70X.EXE for EPM7064LC84 (I assume that ADP-7064(S) was designed for it) and EPM7064LC44 (I have two of these).
By "traces" I mean access logs to ALL-03 programmer, captured by my patched DosBox. It was very easy to do, emulation code attached here. You also need to add all03.cpp to ./src/hardware/Makefile.am and init sequence to ./src/dosbox.cpp:

diff -urN ./dosbox.cpp ./.new
--- ./dosbox.cpp   2024-09-12 23:08:46.835771316 +0300
+++ ./.new   2024-09-12 23:05:42.609356654 +0300
@@ -654,6 +654,10 @@
    Pbool = secprop->Add_bool("disney",Property::Changeable::WhenIdle,true);
    Pbool->Set_help("Enable Disney Sound Source emulation. (Covox Voice Master and Speech Thing compatible).");
 
+   secprop->AddInitFunction(&ALL03_Init,true);//done
+   Pbool = secprop->Add_bool("all03",Property::Changeable::WhenIdle,true);
+   Pbool->Set_help("Enable ALL03 parallel programmer emulation.");
+
    secprop=control->AddSection_prop("joystick",&BIOS_Init,false);//done
    secprop->AddInitFunction(&INT10_Init);
    secprop->AddInitFunction(&MOUSE_Init); //Must be after int10 as it uses CurMode


Traces were analyzed and matched with A70X.EXE code with TurboDebugger and IDA. As a result, mapping from software to PLCC84 pins was created...


                 /-------------Notes and comments---------------\
                 |  /----------ALL-03 ZIF socket pins--------\  |
                 |  |  /-------Initial TTL value-----------\ |  |
                 |  |  | /-------PLCC84 pins-----------\   | |  |
                 |  |  | |   /--ADP7064 connections--\ |   | |  |
vvvvvvvvvvvvvvvvvv  v  v v   v                       v v   v v  vvvvvvvvvvvvvvvvvvvvvvvvvv
                    01 0 p35:AD0                    NC     1 40
                    02 0 p36:AD1              244(B)/G     1 39
                    03 0 p37:AD2              244(A)/G     1 38
                    04 0 p41:AD3                    NC     0 37
                    05 0 p44:AD4                  UNK?:p16 0 36 BE?
                    06 0 p48:AD5                    NC     0 35
                    07 0 p49:AD6                  GAD1:p33 0 34
                    08 0 p50:AD7                  GAD0:p31 0 33 Buf by 2x LS14

DIN9  Thru 244(A)   09 1 p20:SDINA                         1 32 DIN32?
DIN10 Thru 244(A)   10 1 p39:SDINB                         0 31 VCCIO? not conn. to VCC by soft
DIN11 Thru 244(A)   11 1 p46:SDINC              VCCINT     1 30
DIN12 Thru 244(A)   12 1 p65:SDIND                 VPP:p84 0 29 0->1->VOP
                    13 1 p67:MT?                  SCOD:p81 1 28 DIN28 Thru 244(B)
            TDI     14 1 p14:BP?                  SCOC:p62 1 27 TCK/DIN27 Thru 244(B)
            TDO     15 1 p71:BV?                  SCOB:p23 1 26 TMS/DIN26 Thru 244(B)
                    16 1 p68:CB?                  SCOA:p04 1 25 DIN25 Thru 244(B)

                    17 1 p01:/NTPW                MTIN:p02 0 24 (or GCLK2)
GCLK1 Buf 2xLS14    18 0 p83:SK                    BEM:p17 0 23
                    19 0 p69:UNK?                  SCK:p79 0 22 Buf by 2x LS14
                    20 0 GND                     SS_BI:p77 0 21

... and Read ID procedure was documented:

;===================INITIAL PREPARATION
ALL03 [E5]<-6       Set VOP to 0 (+6*0.1V steps for drop compensation)

;------seg005:082A @@EPM7064Entry inside setVCC_VOP_ADx
ALL03 [E0]<-0       082A: mov regE0_init, 0 [Pins 8-1=0] -> Address AD[7-0]=00h
ALL03 [E1]<-FF      ????: only in trace [Pins 16-9=1]
ALL03 [E2]<-1       082F: and regE2, 1 [Pin 17=1 (/NTPW), pins 24-18=0]
ALL03 [E3]<-AF      0834: and regE3, 0A0h + or regE3, 0FH
                    [Pins 32, 30, 28-25=1 (SCOx), 29 and 31 =0]
ALL03 [E4]<-E0      083E: and regE4, 0E0h [Pins 40-38=1, 37-33=0]

ALL03 [E7]<-8C      0872: Set VCC to 7Dh=125*0.04V=5.0V
                          (+0FH*0.04V steps for drop compensation)

;------seg005:0922 applyVCC_P30_P32
ALL03 [ED]<-28      093A: or regED, 28h [0010 1000 - VCC to pins 30 and 32]

;------seg005:0A16 applyVOPRampUp_P29(byte desiredVOP =78h=120*0.1V=12.0V)
ALL03 [E3]<-BF      0A33: or regE3, 10h [xxx1 xxxx - Set pin 29(VPP) to 1]
ALL03 [EB]<-10      0A50: or regEB, 10h [xxx1 xxxx - Turn on VOP on pin 29 (VPP)]

ALL03 [E5]<-6       0A70: inc regE5 LOOP: Ramp VOP voltage from 10.2V
                                    (+6*0.1V steps for drop compensation)
                                    up to desiged level in arg_0
ALL03 [E5]<-7
ALL03 [E5]<-8
...
ALL03 [E5]<-7E

;------seg002:024E setADxAddress
ALL03 [E4]<-E4      02A5: or regE4, 4. Was E0, now E4
                    [xxxx x1xx - Set 1 to pin 35 - NC on adapter??]
ALL03 [E0]<-7A      02F7: [E0]<-arg_0. Was 0, now 7A
                    [0111 1010 - Set 1 to pins 2,4,5,6,7]
                    Set address AD[7-0]=7Ah

;------seg005:0898 continues @@EPM7064Entry
ALL03 [E4]<-F4      0898: or reg4, 10h. Was E4, now F4.
                    [xxx1 xxxx - Set 1 to pin 37 - NC on adapter??]
ALL03 [E6]<-46      08BC: Set VHH to 60*0.06V=3.6V (+10 steps for drop comp.)
                    BUT VHH IS UNCONNECTED YET!
;===================SET BLOCK ADDRESS
ALL03 [E4]<-F4      0BF4: setADxAddress 7Ch
ALL03 [E0]<-7C
;===================SEND READ ID BIT PATTERN
                    regE1 was FF before.
;-----5 times cycle #0
  ALL03 [E1]<-F0      0498: and regE1, 0F0h + or regE1, al
                      4 LSB pins (9,10,11,12) of regE1 -> 4 SDINx pipes

  ;------seg002:0C84 pulseSCK
  ALL03 [E2]<-21      0C84: or regE2, 20h   [xx1x xxxx - Set pin 22 to 1]
  ALL03 [E2]<-1       0CA0: and regE2, 0DFh [xx0x xxxx - Clear pin 22 to 0]

  [E1]<-F0 [E2]<-21 [E2]<-1
  [E1]<-F0 [E2]<-21 [E2]<-1
  [E1]<-F0 [E2]<-21 [E2]<-1
* [E1]<-FF [E2]<-21 [E2]<-1
;----- repeat cycle 16 times:
ALL03 [E1]<-F0 [E2]<-21 [E2]<-1 [E1]<-F0 [E2]<-21 [E2]<-1 [E1]<-F0 [E2]<-21 [E2]<-1 [E1]<-F0 [E2]<-21 [E2]<-1
      [E1]<-FF [E2]<-21 [E2]<-1

;===================READ RESPONSE
;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:05D3 inResponseReadID (sub_5553)
;#0                 regE2 was 01 before
ALL03 [E2]<-81      0784: or regE2, 80h  [1xxx xxxx - Set pin 24 (MTIN) high]
ALL03 [E2]<-83      07A4: or regE2, 02h  [xxxx xx1x - Set pin 18 (SK) high]
dly5
ALL03 [E2]<-93      07C0: or regE2, 10h  [xxx1 xxxx - Set pin 21 (SS_BI) high]
dly5
ALL03 [E2]<-91      07DC: and regE2,0FDh [xxxx xx0x - Set pin 18 (SK) low]
dly5
ALL03 [E2]<-11      07F8: and regE2,7Fh  [0xxx xxxx - Set pin24 (MTIN) low]

ALL03 [E3]->0       0810: read back from regE3 [need pins 28-25, low nibble]

;#1                 regE2 was 11h before
ALL03 [E2]<-13      07A4: or regE2, 02h  [xxxx xx1x - Set pin 18 (SK) high]
ALL03 [E2]<-13      07C0: or regE2, 10h  [xxx1 xxxx - Set pin 21 (SS_BI) high - already high]
ALL03 [E2]<-11      07DC: and regE2,0FDh [xxxx xx0x - Set pin 18 (SK) low]
ALL03 [E2]<-11      07F8: and regE2,7Fh  [0xxx xxxx - Set pin24 (MTIN) low - already low]
ALL03 [E3]->0

;-----do the same as #1 14 times
ALL03 [E2]<-13 [E2]<-13 [E2]<-11 [E2]<-11 [E3]->0 ;#2
...
ALL03 [E2]<-13 [E2]<-13 [E2]<-11 [E2]<-11 [E3]->0 ;#15
;-----finalize SS_BI to low
ALL03 [E2]<-1       0839: and regE2, 0EFh [xxx0 xxxx - Set pin 21 (SS_BI) low ]
;<<<<<<<<<<<<<<<<<<< 1/5 seg005:0C21

;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:0565 lowSDINx (sub_54E5)
                    regE1 was FF before
ALL03 [E1]<-F0      05B1: and regE1, 0F0h [xxxx 0000 - Set pins 12-09 (SDIND-SDINA) to low ]
dly05
ALL03 [E2]<-21      05AB: pulseSCK
ALL03 [E2]<-1
;<<<<<<<<<<<<<<<<<<< 1/5 seg005:0C29

;-----Loop calls to inResponseReadID and lowSDINx for 4 times
;-----Reading from E3 register at each step should bring SCOx data in 4 LSB bits

;===================FINALIZING
;>>>>>>>>>>>>>>>>>>> Call seg005:0D0C shutDownVoltages (sub_E7DC)
;>>>>>>>>>>>>>>>>>>> Call seg005:0AF0 rampDownAndRemoveVOP (sub_E5C0)
ALL03 [E5]<-7E      0B06-0B1C: Ramp down VOP to 2Bh
ALL03 [E5]<-7D
...
ALL03 [E5]<-32
ALL03 [E5]<-31

ALL03 [EA]<-0       0B30: remove VOP from pins 24-17
ALL03 [EB]<-0       0B4F: remove VOP from pins 32-25
;<<<<<<<<<<<<<<<<<<<
;>>>>>>>>>>>>>>>>>>> Call seg005:0A92 removeVHH_VCC (sub_E562)
ALL03 [F3]<-0       0AB0: remove VHH from pins 32-25
ALL03 [ED]<-0       0ACA: remove VCC from pinf 40-28
;<<<<<<<<<<<<<<<<<<<
ALL03 [E5]<-6       0D37: setVOP to 0
ALL03 [E6]<-A       0D41: setVHH to 0
ALL03 [E7]<-F       0D4B: setVCC to 0



 
The following users thanked this post: Rasz, Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #206 on: September 12, 2024, 09:00:42 pm »
And about results.
1. I exactly code the Read ID sequence from previous message into my test fixture. With exception of ramp up/down VOP and other voltages and connecting them to pins by software: VCC is tied to VCCIO+VCCINT, VPP to VPP.
The behavior is the same: SCOx rises high when response reading begins and falls to low after. No serial data is visible on SCOx. I have an assumption, that SK clock (or, maybe, other signals) needed for serial outputting are misrouted on ADP-7064 and on my test adapters.
2. ADP-7064S adapter schema has some questions:
 - two PLCC84 pins (pin16 and pin69) are routed tio ZIF socket, but their purpose is unknown to me.
 - software sequence toggles ZIF pins 35 and 37, but they are not connected at adapter's side.
 - on the other side LS244 /OE pins connected, according to scheme, to ZIF pins 38 and 39. But these ZIF pins are set to 1 and untouched during the whole ReadID process. So neither SDINx, nor SCOx should work.

Currently, I'm slightly stuck. Next goal is to trace EPM7128 Read ID procedure and compare it to 7064. According to code in A70X.EXE, procedures are different. I don't have and adapter schema for EPM7128, but have a couple of chips in PLCC84.
 
The following users thanked this post: Rasz, Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #207 on: September 13, 2024, 08:40:46 am »
Found another problem with ADP-7064S schematic.

3. Software trace shows that VCC is supplied to pins 30 and 32. On schematic pin 30 is VCCINT and pin 31 is VCCIO. That means there will be no VCCIO on CPLD!
Pin 32 marked as a signal DIN32 and has a capacitor to ground, so it is possibly designed to be a power pin. But there are no connections to it on the whole scheme (or I can't found them).

So, now we have no proven adapter schematic (or proven pinouts for parallel programming) neither for EPM7064 nor for EPM7128. Neither for PLCC packages, nor for QFP100.
Does anyone have this information? Or, maybe a working adapter to restore schematic from it (especially for 7128)?
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #208 on: September 13, 2024, 11:58:20 am »
Let's continue.
Here is a trace of Read ID procedure for EPM7128(S)LC84. (SAME) means that interaction is exactly the same as for EPM7064, (SIMILAR) means that interaction may use slightly different values, but do the same thing, (DIFF) means that interaction is different or not used on EPM7064.

;=================== Initial setup
ALL03 [E5]<-6       (SAME) Set VOP to 0 (+6*0.1V steps for drop compensation)

ALL03 [E0]<-0       (SAME)
ALL03 [E1]<-0       (DIFFERENT) Was FF on 7064
ALL03 [E2]<-1       (SAME)
ALL03 [E3]<-A0      (DIFFERENT) Was AF on 7064
ALL03 [E4]<-E0      (SAME)
ALL03 [E7]<-8D      (DIFFERENT) Was 8C on 7064 -> VCC=5.04V

;---------------applyVCC_P30_P32
ALL03 [ED]<-28      (SAME) [0010 1000 - VCC to pins 30 and 32]

;---------------PRACTICALLY THE SAME: TURN ON VPP
ALL03 [E3]<-B0      (SIMILAR) A0->B0 [xxx1 xxxx - Set pin 29(VPP) to 1 (TTL)]
ALL03 [EB]<-10      (SAME) [xxx1 xxxx - Turn on VOP on pin 29 (VPP)]

;---------------RAMP UP VOP
ALL03 [E5]<-6       (SAME) LOOP: Ramp VOP voltage from 10.2V
ALL03 [E5]<-7       (+6*0.1V steps for drop compensation
...                 up to desired level in arg_0
ALL03 [E5]<-7D
ALL03 [E5]<-7E

;---------------
ALL03 [E4]<-E0      (DIFFERENT) regE4 already set to E0 by init sequence
ALL03 [E0]<-7A      (SAME) Set address AD[7-0]=7Ah

;---------------
ALL03 [E4]<-F0      (SIMILAR) E0->F0 [xxx1 xxxx - Set 1 to pin 37 - NC on adapter??]
ALL03 [E4]<-F0      Why do it twice?
ALL03 [E0]<-7C      (SAME) setADxAddress: set address AD[7-0]=7Ch

;=================== Send Read ID pattern to CPLD
;>>>>>>>>>>>>>>>>>>> Call seg002:0311 outReadIDPattern (sub_5291)
;(DIFFERENT) IT SEEMS THAT 7128 HAS 8 SERIAL PIPES. IO is bidirectional
;through E1 register (pins 16 to 9)
;
;#0           /---SCK pulse--\
ALL03 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1
      [E1]<-FF [E2]<-21 [E2]<-1
... Run same pattern 14 times (total - 17!)
;#15
ALL03 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1 [E1]<-0 [E2]<-21 [E2]<-1
      [E1]<-FF [E2]<-21 [E2]<-1
;#16 (DIFFERENT) Strange 17th pattern, regE1 is not set before SCK pulse, but it should be the same (00)
ALL03 [E1]<-0 [E2]<-21 [E2]<-1         [E2]<-21 [E2]<-1         [E2]<-21 [E2]<-1         [E2]<-21 [E2]<-1
      [E1]<-FF [E2]<-21 [E2]<-1
;<<<<<<<<<<<<<<<<<<<

;=================== Read response back from CPLD
;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:05D3 inResponseReadID (sub_5553)
ALL03 [E1]<-FF      Seems it is needed to set regE1 tp 0FFh before reading from it
ALL03 [E4]<-B0      (DIFF) F0->B0 Clear pin 39 (???)

ALL03 [E2]<-81      (SAME) 01->81 Set pin 24 (MTIN?)
ALL03 [E3]<-F0      (DIFF) B0->F0 Set pin 31 (???)

ALL03 [E2]<-83      (SAME) 81->83 Set pin 18 (SK)
ALL03 [E2]<-93      (SAME) 83->93 Set pin 21 (SS_BI?)
ALL03 [E2]<-91      (SAME) 93->91 Clear pin 18 (SK)
                    (DIFF) On 7064 MTIN goes low here, on 7128 it goes low after 2 reads
ALL03 [E3]<-B0      (DIFF) F0->B0 Clear pin 31 (???)
ALL03 [E1]->0 ;#0   (SIMILAR) Read 8 pipes, bidirectional, shared with outputs to SDINx

      /----Pulse pin 18 (SK)---\ /--???-\ /-READ-\
      | while pin24=1 (MTIN?)  | |      | |      |
ALL03 [E2]<-93 [E2]<-93 [E2]<-91 [E3]<-B0 [E1]->0 ;#1

ALL03 [E2]<-11      (DIFF) 91->11 Set pin 24 (MTIN?) low, on 7064 is happens before 1st read

      /----Pulse pin 18 (SK)---\ /--???-\ /-READ-\
      | while pin24=0 (MTIN?)  | |      | |      |
ALL03 [E2]<-13 [E2]<-13 [E2]<-11 [E3]<-B0 [E1]->0 ;#2

... Run same pattern 12 times (total - 16)
ALL03 [E2]<-13 [E2]<-13 [E2]<-11 [E3]<-B0 [E1]->0 ;#15
; Finalizing
ALL03 [E3]<-B0      (DIFF) regE3 should already be 0B0h, clear pin 31 (???)
ALL03 [E2]<-11      (DIFF) regE2 should already be 11h, clear pin 18 (SK)
ALL03 [E4]<-F0      (DIFF) B0h->F0h Set pin 39 (???)
ALL03 [E2]<-1       (SAME) 11h->01h Clead pin 21 (SS_BI?)
;<<<<<<<<<<<<<<<<<<<

;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:0565 lowSDINx (sub_54E5)
ALL03 [E1]<-0       (SIMILAR) Set all SDINc to 0
ALL03 [E2]<-21      (SAME) SCK (pin 22) goes high 0->1
ALL03 [E2]<-1       (SAME) then back to low 1->0
;<<<<<<<<<<<<<<<<<<<

;Repeat procedure (inResponseReadID + lowSDINx) 4 times more.
;Total - 5 times


;=================== Shutdown
;>>>>>>>>>>>>>>>>>>> Call seg005:0D0C shutDownVoltages (sub_E7DC)

;>>>>>>>>>>>>>>>>>>> Call seg005:0AF0 rampDownAndRemoveVOP (sub_E5C0)
ALL03 [E5]<-7E      (SAME) Ramp down VOP to 2Bh
ALL03 [E5]<-7D
...
ALL03 [E5]<-32
ALL03 [E5]<-31

ALL03 [EA]<-0       (SAME) remove VOP from pins 24-17
ALL03 [EB]<-0       (SAME) remove VOP from pins 32-25
;<<<<<<<<<<<<<<<<<<<

;>>>>>>>>>>>>>>>>>>> Call seg005:0A92 removeVHH_VCC (sub_E562)
ALL03 [F3]<-0       (SAME) remove VHH from pins 32-25
ALL03 [ED]<-0       (SAME) remove VCC from pinf 40-28
;<<<<<<<<<<<<<<<<<<<

ALL03 [E5]<-6       (SAME) setVOP to 0
ALL03 [E6]<-A       (SAME) setVHH to 0
ALL03 [E7]<-F       (SAME) setVCC to 0
;<<<<<<<<<<<<<<<<<<<
; Execute standard init seqence
[E0]<-FF [E8]<-0 [F0]<-0
[E1]<-FF [E9]<-0 [F1]<-0
[E2]<-FF [EA]<-0 [F2]<-0
[E3]<-FF [EB]<-0 [F3]<-0
[E4]<-FF [EC]<-0 [F4]<-0

[ED]<-0 [F5]<-0 [EE]<-0 [F6]<-0
[E5]<-0 [E6]<-0 [E7]<-0
[EF]<-0 [F7]<-0
;<<<<<<<<<<<<<<<<<<<


Looking to trace I understood two things:
  • EPM7128 definitely has 8 serial pipes instead 4 for EPM7064
  • Adapter for EPM7128 must be different, ADP-7064(S) will not work.

Partial connection schema here:

==================================================================

                 /-------------Notes and comments---------------\
                 |  /----------ALL-03 ZIF socket pins--------\  |
                 |  |  /-------Initial TTL value-----------\ |  |
                 |  |  | /-------PLCC84 pins-----------\   | |  |
                 |  |  | |   /--ADP7064 connections--\ |   | |  |
vvvvvvvvvvvvvvvvvv  v  v v   v                       v v   v v  vvvvvvvvvvvvvvvvvvvvvvvvvv
                    01 0 p??:AD0                           1 40
                    02 0 p??:AD1                      ???  1 39
                    03 0 p??:AD2                           1 38
                    04 0 p??:AD3                      ???  0 37 0->1 before set address
                    05 0 p??:AD4                           0 36
                    06 0 p??:AD5                           0 35
                    07 0 p??:AD6                           0 34
                    08 0 p??:AD7                           0 33

out:SDINA in:SCOA   09 0                                   1 32 maybe VCCIO?
out:SDINB in:SCOB   10 0                             ???   0 31
out:SDINC in:SCOC   11 0                        VCCINT:pXX 1 30
out:SDIND in:SCOD   12 0                           VPP:p84 0 29
out:SDINE in:SCOE   13 0                                   0 28
out:SDINF in:SCOF   14 0                                   0 27
out:SDING in:SCOG   15 0                                   0 26
out:SDINH in:SCOH   16 0                                   0 25

Const.1 (reading)   17 1 p??:/NTPW                         0 24
Buf by 2x LS14      18 0 p??:SK                            0 23
                    19 0                           SCK:p?? 0 22 Buf by 2x LS14
                    20 0 GND                     SS_BI:p?? 0 21


Notes:
 1. As there are no proven parallel programming pinouts for EPM7128SLC84, PLCC84 pins are not shown. Maybe some of them use the same pins with EPM7064SLC84.
 2. Serial data handling was changed, EPM7128 have 8 serial pipes instead of 4. So port E1 is bidirectional, output goes to SDINx, input reads from SCOx. It is unknown, how directions are switched. Exact pins for SDINx/SCOx also
    unknown.
 3. VPP/VOP handling is the same as for 7064 (prog socket pin 29 -> pin 84 PLCC84)
 4. VCC handling is uncertain. I've found two different bit designations for register ED. ALL-03_Hardware_IO_Configuration.PDF says that VCC applied to pins 28(bit7), 29, 30, 31, 32, 34, 36, 40(bit0), while HILOSYSTEMS ALL03-1 says 29(bit7), 30, 31, 32, 33, 35, 37, 41(bit0). I assume the first layout and applying power to socket pins 30 and 32 ([ED]=28h).
 5. Pin 31 was unused for EPM7064, but pulsed around SK in the first cycle of reading response. I don't know the signal name.
 6. Pin 37 have a strange behavior: set to 1 before setting address and stays hi for whole ReadID procedure.
 7. Pin 39 set high from beginning and goes low only for inResponseReadID call. Maybe it is used as /RD signal for SCOx buffer. While high, buffer is disabled and output to register E1 goes to SDINx CPLD inputs. If pin 39 goes low, SCOx buffer outputs enabled and can be read out through port E1.

« Last Edit: September 13, 2024, 12:01:59 pm by megov »
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #209 on: September 14, 2024, 06:45:29 pm »
Got trace of Erase procedure for EPM7064(S)LC84.
As it was mentioned earlier in the thread by @migry, it is true, that software read 7Ch block with ID data, do bulk erase and write block back (+re-reading to check).
And with this knowledge, I'm wonder how EPM7032 JTAG Unlocker (https://forum.system-cfg.com/viewtopic.php?p=231550&sid=6de82b2b764883e14e21c6b7779cc86f#p231550) works.

So, in order to going further, the base problem that needs to be solved - being able to Read ID from CPLD. It is a cornerstone operation.
« Last Edit: September 14, 2024, 06:56:50 pm by megov »
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #210 on: September 15, 2024, 03:21:12 pm »
  The idea behind today's work is to summarize information about pinouts and adapters known to me, add knowledge from software traces and try to make some new assumptions. Results are gathered into large table below.
  At first I add to EPM7064SLC44 and EPM7064SLC84 "usual" pinouts information about what exact LAB and Cell is connected to pin. It will help to match different pins in different packages to same die signals. So, all IO pins below are named using <Lab><Cell> notation: A16, D55, etc. Results are shown in "PLCC44 pin & purpose" and "PLCC84 pin & purpose" columns.
  Second step is to write down possible PLCC84 pinout assuming that PLCC44 pinout in AD359 description is right. PLCC44 signal names gathered to "AD359 pin descriptions" and transferred to "PLCC84 pin assumptions" column to pins with the same LAB/Cell. Pins with LAB/Cell that do not present on smaller package firstly marked as NC (Not connected).
  Third step is matching these PLCC84 signal assumptions with ADP-7064 schematic. "ADP-7064S-PL84 conn." column shows ALL-03 DIP40 ZIF socket pins (on a programmer side).
After matching there are three cases:
  • AD359 pin description matches the schematics. That means we know signal designation and pin numbers for both packages. Good!
  • NC pins from PLCC84 that pulled down on PLCC84 adapter. These are unused pins. Also good.
  • Meaningful signals that pulled down on PLCC84 adapter or meaningful signals, that connected to ALL-03 ZIF socket and not exist in PLCC44.

Third case shows that parallel programming pin functions not assigned consistently to different packages and adapters schematic must be specific device type and package.
That's sad as too many combinations exist and to few information available.

Table legend:
  • Pin directions (at CPLD side): (I) - input, (O) - output, (P) - power, (*?) - uncertain direction
  • Pin connections on adapter side: (PD) - pulled low thr. 100R-560R, (PU) - pulled high thr. 10k, (TS) - buffered with 2x Schmidt triggers, (GA/GB) - gated through A/B half of 74LS244.

Adaptors:
  • AD359 - PLCC44 adaptor from https://mqp.com/ad359.htm.
  • ADP-7064S-PL84 - PLCC84 adapter with schematic found at Matthieu Benoit site.
  • SDP-7064-84 - EPM7064 PLCC84 adaptor from "Dataman 48 Adaptor Connection Table" PDF.
  PLCC44 pin  AD359 pins  PLCC84 pin  PLCC84 pin  ADP-7064S-  SDP-7064
   & purpose   descript.   & purpose   assumption  PL84 conn.  -84 conn. Comment
   p01 /GCLRn  /NTPW(I)    p01 /GCLRn  /NTPW(I)    p17         p05       Ok. Program/Erase strobe. High when reading.
   p02 OE2     MTIN(I)     p02 OE2     MTIN(I)     p24+PD 4k7  p06       Ok.
   p03 VCC     VCC(P)      p03 VCCINT  VCC(P)      p30:VCCINT  p44:VCC   Ok.
   p04 A16     SCOA(O)     p04 A16     SCOA(O)     p25 (GB)    p07       Ok.
                           p05 A15     NC          PD          PD        Ok.
   p05 A14     BE(I)       p06 A14     BE?(I)      PD          PD        ?1. BE by LAB/Cell pin? But PD on both adaptors.
                           p07 GND     GND(P)      p20:GND     p24:GND   P24:GND   Ok.
                           p08 A13     NC          PD          PD        Ok.
                           p09 A12     NC          PD          PD        Ok.
   p06 A11     SDOA(O?)    p10 A11     SDOA(O?)    PU          p08       ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.
                           p11 A10     NC          PD          PD        Ok.
   ...         ...         ...         ...         ...         ...       ...
                           p12 A9      NC          PD          p02       ??. Diff between ADP7064 and SDP-7064-84
                           p13 VCCIO   VCC(P)      p30:VCCINT  p44:VCC   Error? CPLD pin is VCCIO
   p07 A8/TDI  BP(I?)      p14 A8/TDI  BP(I?)      p14         p09       Ok.
                           p15 A7      NC          PD          PD        Ok.
                           p16 A6      BE?(I)      p36         p10       ?1. Maybe BE on both adaptors?
   p08 A5      BEM(I)      p17 A5      BEM(I)      p23         p11       Ok.
   p09 A4      -           p18 A4      NC          PD          p03       ??. Diff between ADP7064 and SDP-7064-84
   p10 GND     GND(P)      p19 GND     GND(P)      p20:GND     p24:GND   Ok.
   p11 A3      SDINA(I)    p20 A3      SDINA(I)    p09 (GA)    p12       Ok.
                           p21 A2      NC          PD          PD        Ok.
   p12 A1      -           p22 A1      NC          PD          PD        Ok.
   p13 B32/TMS SCOB(O)     p23 B32/TMS SCOB(O)     p26 (GB)    p13       Ok.
                           p24 B31     NC          PD          PD        Ok.
   p14 B30     AD0(I)      p25 B30     AD0?(I)     PD          PD        ?2. AD0 by LAB/Cell pin? But PD on both adaptors.
   p15 VCC     VCC(P)      p26 VCCIO   VCC(P)      p30:VCCINT  p44:VCC   Error? CPLD pin is VCCIO
                           p27 B29     NC          PD          p04       ??. Diff between ADP7064 and SDP-7064-84
                           p28 B28     NC          PD          p22       ??. Diff between ADP7064 and SDP-7064-84
                           p29 B27     NC          PU          p14       ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.
                           p30 B26     NC          PD          PD        Ok.
   p16 B25     GAD0(I)     p31 B25     GAD0(I)     p33 (TS)    p15       Ok. Why triggers? It's not a clock signal.
                           p32 GND     GND(P)      p20:GND     p24:GND   Ok.
                           ...                                           ...
   p17 B24     GAD1(I)     p33 B24     GAD1(I)     p34         p16       Ok.
                           p34 B23     NC          PD          PD        Ok.
                           p35 B22     AD0?(I)     p01         p17       ?2. Maybe AD0 on both adaptors (**1)
   ...                                                                  ...
   p18 B21     AD1(I)      p36 B21     AD1(I)      p02         p18       Ok.
   p19 B20     AD2(I)      p37 B20     AD2(I)      p03         p19       Ok.
                           p38 VCCIO   VCC(P)      p30:VCCINT  p44:VCC   Error? CPLD pin is VCCIO
   p20 B19     SDINB(I)    p39 B19     SDINB(I)    p10 (GA)    p20       Ok. ??? Is is AD3? (**1)
                           p40 B18     NC          PD          p45       ??. Diff between ADP7064 and SDP-7064-84
   p21 B17     AD3(I)      p41 B17     AD3(I)      p04         p21       Ok.
   p22 GND     GND(P)      p42 GND     GND(P)      p20:GND     p24:GND   Ok.
   p23 VCC     VCC         p43 VCCINT  VCC(P)      p31:VCCIO   p44:VCC   Error? CPLD pin is VCCINT! Pin31 is not used in A70X.EXE
   p24 C33     AD4(I)      p44 C33     AD4(I)      p05         p23       Ok.
                           p45 C34     NC          PD          p01       ??. Diff between ADP7064 and SDP-7064-84
   p25 C35     SDINC(I)    p46 C35     SDINC(I)    p11 (GA)    p25       Ok.
                           p47 GND     GND(P)      p20:GND     p24:GND   Ok.
   p26 C36     AD5(I)      p48 C36     AD5(I)      p06         p26       Ok.
   p27 C37     AD6(I)      p49 C37     AD6(I)      p07         p27       Ok.
                           p50 C38     AD7?(I)     p08         p28       ?3. Maybe AD7 on both adaptors (**1)
                           p51 C39     NC          PD          PD        Ok.
   p28 C40     LPT1        p52 C40     LPT1        PD          p29       ??. Diff. Purpose of LPT1 is unknown
                           p53 VCCIO   VCC(P)      p31:VCCIO   p44:VCC   Ok.
   ...                     ...         ...         ...         ...       ...
   p29 C41     LPT2        p54 C41     LPT2        PD          p30       ??. Diff. Purpose of LPT2 is unknown
                           p55 C42     NC          PD          PD        Ok.
                           p56 C43     NC          PU          p31       ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.
                           p57 C44     NC          PD          p46       ??. Diff between ADP7064 and SDP-7064-84
                           p58 C45     NC          PD          PD        Ok.
   p30 GND     GND(P)      p59 GND     GND(P)      p20:GND     p24:GND   Ok.
   p31 C46     AD7         p60 C46     AD7?(I)     PD          PD        ?3. AD7 by LAB/Cell pin? But PD on both adaptors.
                           p61 C47     NC          PD          PD        Ok.
   p32 TCK     SCOC(O)     p62 TCK     SCOC(O)     p27 (GB)    p32       Ok.
   p33 D49     TM          p63 D49     TM?(I)      PD          PD        ?4. TM by LAB/Cell pin? But PD on both adaptor.
                           p64 D50     NC          PD          PD        Ok.
   p34 D51     SDIND       p65 D51     SDIND       p12 (GA)    p33       Ok.
   p35 VCC     VCC         p66 VCCIO   VCC(P)      p31:VCCIO   p44:VCC   Ok.
   p36 D52     MT          p67 D52     MT          p13         p34       Ok.
   p37 D53     CB          p68 D53     CB          p16         p35       Ok.
                           p69 D54     UNKp69      p19         p36       ?4. CPLD input (TM?) on both adaptors
                           p70 D55     NC          PD          PD        Ok.
   p38 TDO     BV          p71 TDO     BV          p15         p37       Ok.
                           p72 GND     GND(P)      p20:GND     p24:GND   Ok.
   p39 D57     SS_BI       p73 D57     SS_BI?(I)   PD          p47       ?5. SS_BI by LAB/Cell? Different on adaptors.
                           p74 D58     NC          PD          PD        Ok.
   ...         ...         ...         ...         ...         ...       ...
                           p75 D59     NC          PU          p38       ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.
                           p76 D60     NC          PD          PD        Ok.
                           p77 D61     SS_BI?(I)   p21         p39       ?5 SS_BI on adaptors?
                           p78 VCCIO   VCC(P)      p31:VCCIO   p44:VCC   Ok.
   p40 D62     SCK(I)      p79 D62     SCK(I)      p22 (TS)    p40       Ok. Should be SCK
                           p80 D63     NC          PD          p48       ??. Diff between ADP7064 and SDP-7064-84
   p41 D64     SCOD(O)     p81 D64     SCOD(O)     p28 (GB)    p41       Ok.
   p42 GND     GND         p82 GND     GND(P)      p20:GND     p24:GND   Ok.
   p43 GCLK1   SK(I)       p83 GCLK1   SK(I)       p18 (TS)    p42       Ok. Should be SK
   p44 OE1     VPP(P)      p84 OE1     VPP(P)      p29:VPP     p43       Ok. VPP/VOP prog voltage.

Conclusion: initial assumption that same LAB/Cell pins should have the same parallel programming functions is wrong. Are wafer dies the same between different packages of the same device?
I'm not sure, or some remappings are done as @reverse mentioned earlier.
Looking to the difference between AD359 and ADP7064, I assume that these signals in PLCC84 package should be located at different pins (by LAB/Cell):
     PLCC44            PLCC84
     -------------     -----------
?1:  p05 A14/BE    ->  p16 A6/BE      Uncertain, but Erase sequence toggles it.
?2:  p14 B30/AD0   ->  p32 B22/AD0    Proven by both PLCC84 adaptors. B30 is PD, but B22 connected to ZIF.
?3:  p31 C46/AD7   ->  p50 C38/AD7    Proven by both PLCC84 adaptors. C46 is PD, but C38 connected to ZIF.
?4:  p33 D49/TM    ->  p69 D54/TM     Uncertain, D49 is PD on adaptors, but unknown pin69@PLCC84 connected to ZIF.
?5:  p39 D57/SS_BI ->  p77 D61/SS_BI  D57 is PD on ADP7064, but pin77@PLCC84 connected to ZIF.
                                      Software sequences for this pin are looks like it is SS_BI.


Errors about VCCIO/VCCINT in comments are for ADP-7064S-PL84: CPLD core VCC connecting to VCCIO net and vice-versa. It is not a great problem if both voltages are driven in sync (and they are, as we can see on traces). SDP-7064-84 is simpler as it contains only single common power rail.

There is also differencies between ADP-7064S-PL84 and SDP-7064-84:
1. All 4 CPLD pins (p10, p29, p56, p75 @PLCC84) that pulled up on ADP7064 are connected to pins of ZIF socket on SDP-7064-84.
2. 10 CPLD pins (p12, p18, p27, p28, p40, p45, p52:LPT1, p54:LPT2, p57, p73 @PLCC84) that are pulled down on ADP7064 are also connected to pins of ZIF socket on SDP-7064-84.

As for PLCC68,  "Dataman 48 Adaptor Connection Table" PDF contains adapters for both 84 and 68 pin packages. So, it is possible to convert 84 pin pinout into 68 pin.
Of course, when exact pinout for PLCC84 will be known.

As for experimental side - nothing new: Read ID sequence was coded into my test fixture. SCOx raises high with first MTIN/SS_BI pulses, but no serial data present on SCOx.
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #211 on: September 15, 2024, 06:53:44 pm »
Well, one simple question to forum's guru: am I right, that Altera MAX 7000S family devices (EPM7032SLC44, EPM7064SLC84, EPM7128SQI100, etc, etc, dozens of devices anyway) really support parallel programming mode? Yes, I know about their JTAG support and even use this kind of programming. Yes, I read somewhere, that JTAG can be disabled. Yes, I know that previous family (without S in suffix) does not support JTAG programming. So, am I right, that 7000S devices with disabled JTAG can be erased with parallel programmed and re-enable JTAG programming ability?

Or I'm insane and just trying to teach 7000S chip samples to accept parallel programming while they lack of it, like 3000S device series?

PS: I came to this theme by a simple reason - I own a whole tray (>60pcs) of new and unsoldered EPM7128SQI100-10 in rare and uncommon PQFP100/0.65 package (rectangle package, not square).
Even their actual pinout is a mystery: I only can find a single 6th pages PDF from Altera with EPM7128 pin correspondence between PLCC84, TQFP100 (square), PQFP100 (rectangle) and PQFP160 (again, square).
Two or three of them, being soldered to a interposer board do not answer to JTAG. So either I'm unable to trace JTAG pins, it is possible in this lack of information. Or they have JTAG disabled, that's why I'm here.
I love digital archaeology and reverse engineering, but fell that I'm exhausted here now...  :--
« Last Edit: September 15, 2024, 07:11:09 pm by megov »
 
The following users thanked this post: YetAnotherTechie, Beta_vulgaris

Offline PCB.Wiz

  • Super Contributor
  • ***
  • Posts: 1880
  • Country: au
Re: Programming (non-JTAG) MAX7000 devices
« Reply #212 on: September 15, 2024, 10:16:12 pm »
Well, one simple question to forum's guru: am I right, that Altera MAX 7000S family devices (EPM7032SLC44, EPM7064SLC84, EPM7128SQI100, etc, etc, dozens of devices anyway) really support parallel programming mode? Yes, I know about their JTAG support and even use this kind of programming. Yes, I read somewhere, that JTAG can be disabled. Yes, I know that previous family (without S in suffix) does not support JTAG programming. So, am I right, that 7000S devices with disabled JTAG can be erased with parallel programmed and re-enable JTAG programming ability?
A good point to ponder.

IIRC the Atmel ATF15xx JTAG parts use a HV VPP PIN to enable JTAG, and have no parallel mode. Apply Vpp, and you enable the disabled JTAG pins.

Once you have JTAG/Serial program, it must cost extra silicon to also include parallel program path, so I'd expect vendors to drop that (but keep a VPP enable)
 
The following users thanked this post: Beta_vulgaris, megov

Online Beta_vulgaris

  • Regular Contributor
  • *
  • Posts: 72
  • Country: 00
Re: Programming (non-JTAG) MAX7000 devices
« Reply #213 on: September 16, 2024, 06:16:42 am »
Even their actual pinout is a mystery: I only can find a single 6th pages PDF from Altera with EPM7128 pin correspondence between PLCC84, TQFP100 (square), PQFP100 (rectangle) and PQFP160 (again, square).
Pinouts can be found from MAX+plus II help file,
Code: [Select]
maxplus2.hlp.
Electronics, Geospatial, Aerospace
Programmable Logic Devices (PLD) Programming Algorithm Preservation
 
The following users thanked this post: megov

Offline pityokas

  • Contributor
  • Posts: 18
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #214 on: September 16, 2024, 10:30:25 am »
Quote
Well, one simple question to forum's guru: am I right, that Altera MAX 7000S family devices (EPM7032SLC44, EPM7064SLC84, EPM7128SQI100, etc, etc, dozens of devices anyway) really support parallel programming mode?

Yes, I confirm for 7128S-84.
I bought some 7128S from ali, for some got no response for jtag.
After erased in socket, the jtag become alive.
 
The following users thanked this post: Beta_vulgaris, megov

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #215 on: September 16, 2024, 03:28:10 pm »
I bought some 7128S from ali, for some got no response for jtag.
After erased in socket, the jtag become alive.

Glad to hear it! So 7064S should also response to Read ID in parallel programming mode, but I didn't reach it yet. Anyway, it is worth to continue investigations.

Today I return to my EPM7128SQI100. As @Beta_vulgaris advised, I look into MAX+plus II help file and JTAG pinout in it matches with I have in Altera's PDF (EPM7128E & EPM7128S Pin Tables ver. 1.0).
For PQFP they are 6 - TDI, 17 - TMS, 64 - TCK and 75 - TDO. I've checked connections, they're OK.

For experiments I have a simple test board with 10 pin JTAG connector, 44 pin LCC socket, 84 pin LCC socket and 2.54 pin sockets to accept PQFP100 interposer.
Schematic is trivial, routed power and ground, TDI, TMS and TDO have 1K pull-ups and TCK has 1K pull-down. Additionally a blinker on 555 used as a clock generator.
I use it successfully for EPM7064SLC44, EPM7032ALC44 and EPM7128SLC84, programming a simple counter/divider into CPLD and looking to blinking LEDs.

But when I insert my EPM7128SQI100, soldered to interposer, both TDI and TMS strongly pulled down, idle level drops from >4,5V to ~1.2-1.3V.
Current draw also rises from 20-50mA to 280mA or so. EPM7128SQI100 become slightly warm. TDI and TMS sinks 5 mA each when power is applied and JTAG
is not connected and ~75mA each, when JTAG cable + Blaster connected. TCK, whilke also being an input, behaves well - clock pulses are >4,5V.
On the other side, I'm not see that TDI and TMS are dead short. Of course, all connections, soldering etc was checked many times, PLCC CPLDs programmed
successfully, so JTAG part also works. I really can't explain this behavior, the only thought that left is that JTAG is disabled and TMS/TDI pins reused as outputs (and set low).

I took 3 chips from a batch and use 2 interposer boards and all 3 behaves identically. The funniest thing is that chips are supposed to be new: I've bought then inside a tray,
they are not soldered. Mysterious things  :-\
 
The following users thanked this post: Beta_vulgaris

Offline pityokas

  • Contributor
  • Posts: 18
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #216 on: September 16, 2024, 04:53:58 pm »
Unsoldered, disabled jtag = factory programmed jtag reused chips(probably).

My beeprog warning me about ID check, they say some Altera chips did not respond to ID but you can program anyway.
Some programmers like topmax not let to bypass the ID check, without ID just stop.
Mystery.
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #217 on: September 16, 2024, 06:05:17 pm »
Unsoldered, disabled jtag = factory programmed jtag reused chips(probably).

Sorry, but I'm unable to understand the phrase. Do you mean, that my batch of unsoldered chips was or may be factory programmed for some specific function,
and this programming includes disabling JTAG? May be. Programming using external programmer (with suitable adapter and ZIF-like socket) is hardly noticeable
on pins tin coating. May be they were programmed for some project that was cancelled as I bought them quite cheap at local marketplace. But seller wasn't notify
me that chip were pre-programmed.

My beeprog warning me about ID check, they say some Altera chips did not respond to ID but you can program anyway.
Some programmers like topmax not let to bypass the ID check, without ID just stop.
Mystery.

As for ID check, all that is easy for me. I do not own any of these vintage programmers, neither I want to buy one.
They're old, expensive, require an old system (DOS, Windows, ISA cards, etc), force to struggle with their software, etc.
Rather I want to implement a simple device that connects through a COM port and able to erase/restore JTAG for some CPLD types.
Maybe, if I have spare time and some passion - to add implementation of actual parallel programming.
Even for proper erasing CPLD you also must be able to do Read ID, Bulk Erase and Program block procedures,
that means that you already have most of interaction with a chip. Adding "Program POF" may not be too difficult.
 

Offline PCB.Wiz

  • Super Contributor
  • ***
  • Posts: 1880
  • Country: au
Re: Programming (non-JTAG) MAX7000 devices
« Reply #218 on: September 16, 2024, 09:15:45 pm »
I bought some 7128S from ali, for some got no response for jtag.
After erased in socket, the jtag become alive.

Glad to hear it! So 7064S should also response to Read ID in parallel programming mode, but I didn't reach it yet. Anyway, it is worth to continue investigations.

I'm not sure you can make that leap.
Erase in socket may simply apply Vpp and erase via JTAG, and once erased, the JTAG disable fuse is cleared, so then normal in circuit pgm (No Vpp) is ok.

If your PCB HW design allows Vpp to be applied to the pin (voltage tolerant) you can just apply 12V* to over-ride.
ISTR some comments about total time with 12V* applied in some vendor's spec, so permanent 12V* is probably not a good idea.

* 12V or whatever vendor Vpp is.
 

Offline pityokas

  • Contributor
  • Posts: 18
  • Country: ro
Re: Programming (non-JTAG) MAX7000 devices
« Reply #219 on: September 17, 2024, 04:48:34 am »
Quote
Sorry, but I'm unable to understand the phrase.
I wanted to say,You can order from factory(for extra money) a brand new preprogrammed with your pof,
Probably yours is something like that. Somebody ordered from some hardware a preprogrammed cpld-s, then the project was dropped and maybe somebody else sold without know about.And for your bad luck the jtag was disabled.

Quote
Rather I want to implement a simple device that connects through a COM port and able to erase/restore JTAG for some CPLD types.
You have to focus only on that.The pof file and cpld address mapping is another mystery, forget it.(my opinion)
Probably every type/package have different mapping table and different programming timings.

Returning to topic (parallel programming EPM7000 without S) I think the best option is to find documented/reversed programmer who have documented adapter(s),then clone/improve and use the original software. 
Or emulate in software then send to different hardware the result, but still use the original software.
Also reversing the software without knowing the original hardware is just a guessing and lead to dead end

For example the all07 is well documented but hard to find the required adapters schematic.I once implemented a lot of chips used by all07 inside cpld, and routed outside only the pins needed for experiment.

Just got an idea, can you find the erase function in that software (skipping the ID check) to see if just a static setup for pins or it's a complex procedure?
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #220 on: September 17, 2024, 07:16:22 am »
I'm not sure you can make that leap.
Erase in socket may simply apply Vpp and erase via JTAG, and once erased, the JTAG disable fuse is cleared, so then normal in circuit pgm (No Vpp) is ok.

If your PCB HW design allows Vpp to be applied to the pin (voltage tolerant) you can just apply 12V* to over-ride.
ISTR some comments about total time with 12V* applied in some vendor's spec, so permanent 12V* is probably not a good idea.

No, it works only for Atmel's ATF15xx and possibly for MAX 7000AE/3000A. I tried to use this method on my EPM7064SLC44 and EPM7128SLC84 - it doesn't work. Applying ~12V Vpp prevents these chips to answer through JTAG.
Of course +12V applied only for a couple of seconds. @Beta_vulgaris said about it earlier:

MAX 7000AE/3000A (also ATF15xx excluding ATF1500) series differ far from the parallel programming, only JTAG available and the OE1 pin is used to reclaim JTAG functionality, according to ADP-7064AE and ADP-ATF1508 diagrams from Matthieu's, drawn by tinhead@eevblog.

You have to focus only on that.The pof file and cpld address mapping is another mystery, forget it.(my opinion)
...
Also reversing the software without knowing the original hardware is just a guessing and lead to dead end
...
Just got an idea, can you find the erase function in that software (skipping the ID check) to see if just a static setup for pins or it's a complex procedure?

I've already done it. You can find 3 traces (first two in the messages, third in attachment) here in the thread above. I took ALL-03 docs and A10X.EXE from Matthieu's and dig all that.
An SC-201 emulation stub was written to DosBox and all interaction between software and programmer's ZIF socket pins (not including adapter for the exact chip type) was recorded
and later analyzed. Yes, traces look like "ancient scripts", but they contain exact sequences for ReadID on EPM7064(S)LC84 and EPM7128(S)LC84 and Erase procedure for EPM7064(S)LC84.
And "Erase" is not a static procedure: it reads ID block (7Ch) not only for checking ID (this check can be removed by JNE->JMP 2 bytes patch), but for reprogramming ID block back after bulk erase.

Also, Read ID trace for EPM7064(S)LC84 contains ZIF socket pinout with signal names, that were guessed by looking to trace itself and ALL-03 and ADP-7064S-PL84 schematics.
My another message above contains a big table with pin designation and correspondence for the 2 EPM7064 packages and 3 adapters. So many information were already dug up.
But things is not so good for EPM7128 as I don't have even a single adapter schematic and don't know where pins for additional 4 pipes are located.

Returning to topic (parallel programming EPM7000 without S) I think the best option is to find documented/reversed programmer
who have documented adapter(s),then clone/improve and use the original software. 
Or emulate in software then send to different hardware the result, but still use the original software.

I'm greatly against it, especially for reusing software. If reversing allows us to understand protocol and pinouts, it is far better to reimplement a solution with modern/simplified components and software approaches.

Probably every type/package have different mapping table and different programming timings.

It is a big problem. and I've asked here: if anyone have adapter schematics for MAX 7000(S) or own adapters and capable to do good photo or to trace PCB with multimeter, please do it. It can helps a lot.
Thanks.

PS: I've suddenly catch a thought! It can be possible, that my current troubles (SCOx became high to all readout phase of Read ID and no serial data can be seen on them) with reading ID on 7064SLC44 have a simple explanation.
What if my CPLD was bulk erased with something like https://forum.system-cfg.com/viewtopic.php?f=31&t=13192&p=252742#p252742? It seems that some people can interpret Bulk Erase as a static process. Even @pityokas said about it in previous message. If so, 7Ch block will contain only 1 bits (I assume, that internal CPLD EEPROM contains 1's when erased) and this is exactly behavior that I've got. And JTAG ID is a different entity, have a different value and implemented via another chip blocks. As a result, chip can be identified and programmed by JTAG but will return all 1's while reading ID in parallel programming mode.
« Last Edit: September 17, 2024, 07:35:47 am by megov »
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #221 on: September 21, 2024, 08:54:06 pm »
Short news.
Just got in a couple of days:
6 x EPM7032SLC44 from Ali. Very strange, but all of them have working JTAG
6 x EPM7064SLC44 from Ali. Only one of then have working JTAG. As expected.  >:D
8 x EPM7032LC44 + 12 x EPM7064LC44 from the heart of Siberia, thanks to Vladimir to help me in my investigation!
1 x beautiful EPM7256EGC192, 8) see in attachment.

Despite that now I have 2 different batches of EPM7064SLC44 and one of EPM7064LC44, behavior of samples from all batches are the same: SCOx goes high at readout phase of Read ID procedure.
That means something is wrong with my test setup. It may be an algorithm flaw or wrong hand-made adapter pinout.

Next step will be switching to EPM7032 as now I have a bunch of them and doing to do the same things: capturing CPLD interaction inside DosBox, matching it with known adapter schematic for ALL-03
and trying to re-implement it on my test fixture. 7032 is slightly simpler so maybe it will be more successful then 7064.

PS: I have lot of two EPM7096LC68 locally. They are interesting both for 68 pin package and for rare chip size. But there is no bargain yet.
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #222 on: September 28, 2024, 12:10:05 pm »
"There is a life inside it!"

Read ID procedure trace for EPM7032 was captured and analyzed. Results are attached to this message. I take EPM7032 PLCC44 adapter from  http://matthieu.benoit.free.fr/all03/adp/ADP-EPM7032.htm
found pin correspondence between CPLD PLCC44 package and ALL-03 ZIF pins and use information to decode and understand a trace.
After that I just code the exact procedure to my Arduino-based test fixture and got a beautiful serial signal on SCOA and SCOB outputs (see in attachments).
I'm not deserialize and decode serial stream yet, but is is not a very difficult thing. I also capture Erase trace but do not decode it.

But I was very surprised by EPM7032SLC44 behavior: SCOx goes high during whole read phase as it happened with EPM7064SLC44 earlier in my investigations!
In today's experiment all things were exactly the same: I only change EPM7032LC44 to EPM7032SLC44 and back in the socket. Anytime with LC I got serial data in ReadID,
anytime with SLC I've got SCOx stuck high.
 
The following users thanked this post: Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #223 on: October 05, 2024, 06:26:49 pm »
Another piece of information. A couple of pages above @migry briefly described serial stream decoding algorithm for EPM7032(V).
I dumbly implement it in plain C (Linux+GCC) and check with mine and his data. Code:
Code: [Select]
#include <stdio.h>
#include <stdint.h>

uint8_t my_scoa[10] = { 0x01, 0x46, 0x8A, 0xAB, 0xB5, 0x31, 0x60, 0x84, 0x36, 0x43 };
uint8_t my_scob[10] = { 0xFF, 0xF6, 0xFF, 0xFF, 0xFF, 0xF5, 0xFF, 0xFC, 0xFF, 0xFB };

uint8_t mirgy_scoa[10] = { 0x01, 0x46, 0x8A, 0xAB, 0xF5, 0x33, 0x60, 0x83, 0x36, 0x43 };
uint8_t mirgy_scob[10] = { 0xFF, 0xF6, 0xFF, 0xE3, 0xFF, 0xF7, 0xFF, 0xE3, 0xFF, 0xF3 };

uint8_t resa[10] = { };
uint8_t resb[10] = { };

uint8_t original_map[80] =
                   {  0,  5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75,
                      1,  6, 11, 16, 21, 26, 31, 36, 41, 46, 51, 56, 61, 66, 71, 76,
                      2,  7, 12, 17, 22, 27, 32, 37, 42, 47, 52, 57, 62, 67, 72, 77,
                      3,  8, 13, 18, 23, 28, 33, 38, 43, 48, 53, 58, 63, 68, 73, 78,
                      4,  9, 14, 19, 24, 29, 34, 39, 44, 49, 54, 59, 64, 69, 74, 79, };

uint8_t adjusted_map[80] =
                   { 40, 45, 50, 55, 60, 65, 70, 75, 0, 5, 10, 15, 20, 25, 30, 35,
                     41, 46, 51, 56, 61, 66, 71, 76, 1, 6, 11, 16, 21, 26, 31, 36,
                     42, 47, 52, 57, 62, 67, 72, 77, 2, 7, 12, 17, 22, 27, 32, 37,
                     43, 48, 53, 58, 63, 68, 73, 78, 3, 8, 13, 18, 23, 28, 33, 38,
                     44, 49, 54, 59, 64, 69, 74, 79, 4, 9, 14, 19, 24, 29, 34, 39, };

void hexdump(uint8_t *buf, uint16_t cnt) {
  uint8_t strbuf[16];
  uint8_t stridx = 0;
  for (uint16_t addr = 0; addr < cnt; addr++) {
    if ((addr & 0x0F)==0) printf("%04X: ", addr);
    printf("%02X ", buf[addr]);
    strbuf[stridx++] = ((buf[addr] < ' ') || (buf[addr]>=0x80)) ? '.' : buf[addr];
    if ( (addr==(cnt-1)) || ( ((addr & 0x0F)==0) && (addr!=0)) ) {
        strbuf[stridx] = 0;
        printf(" %s\n", strbuf);
        stridx = 0;
    }
  }
}

#define MAP adjusted_map

void decode(uint8_t *psrc, uint8_t *pdst, uint8_t sz) {
  //Zero result buffer
  for (uint8_t i=0; i<sz; i++) pdst[i]=0;

  //Pass through all 80 bits
  for (uint8_t srcbitno=0; srcbitno<sizeof(MAP); srcbitno++) {
    //Locate bit in source stream
    uint8_t srcbyteno = srcbitno >> 3;
    uint8_t srcmask = 0x80 >> (0x07 - (srcbitno & 0x07));
    //Locate bit in destination stream
    uint8_t dstbitno = MAP[srcbitno];
    uint8_t dstbyteno = dstbitno >> 3;
    uint8_t dstmask = 0x80 >> (0x07 - (dstbitno & 0x07));
    //Set bit in destination stream if it is set in source stream
    if (psrc[srcbyteno] & srcmask) {
      pdst[dstbyteno] |= dstmask;
    }
  }
}

void main(int argc, char * argv[]) {
  printf("     My SCOA:"); hexdump(&my_scoa[0], sizeof(my_scoa));
  printf("     My SCOB:"); hexdump(&my_scob[0], sizeof(my_scob));
  decode(&my_scoa[0], &resa[0], sizeof(my_scoa));
  decode(&my_scob[0], &resb[0], sizeof(my_scob));
  printf("     My RESA:"); hexdump(&resa[0], sizeof(resa));
  printf("     My RESB:"); hexdump(&resb[0], sizeof(resb));
  printf("\n");
  printf("Migry's SCOA:"); hexdump(&mirgy_scoa[0], sizeof(mirgy_scoa));
  printf("Migry's SCOB:"); hexdump(&mirgy_scob[0], sizeof(mirgy_scob));
  decode(&mirgy_scoa[0], &resa[0], sizeof(mirgy_scoa));
  decode(&mirgy_scob[0], &resb[0], sizeof(mirgy_scob));
  printf("Migry's RESA:"); hexdump(&resa[0], sizeof(resa));
  printf("Migry's RESB:"); hexdump(&resb[0], sizeof(resb));

It works, but with one interesting thing: substitution map for bitstream that I've created exactly using the Migry's description (original_map) provide "5 byte-swapped output":

     My SCOA:0000: 01 46 8A AB B5 31 60 84 36 43  .F...1`.6C
     My SCOB:0000: FF F6 FF FF FF F5 FF FC FF FB  ..........
     My RESA:0000: 45 52 41 39 32 76 26 41 4C 54  ERA92v&ALT
     My RESB:0000: FF FF FF FF FF 76 3E FD FF FF  .....v>...

Migry's SCOA:0000: 01 46 8A AB F5 33 60 83 36 43  .F...3`.6C
Migry's SCOB:0000: FF F6 FF E3 FF F7 FF E3 FF F3  ..........
Migry's RESA:0000: 45 52 41 39 33 FE 07 41 4C 54  ERA93..ALT
Migry's RESB:0000: FF FF FF FF FF FE 17 50 FF FF  .......P..


It can be easily fixed by swapping left and right halves of map, see adjusted_map in the code. With adjusted map I got the right results:

     My SCOA:0000: 01 46 8A AB B5 31 60 84 36 43  .F...1`.6C
     My SCOB:0000: FF F6 FF FF FF F5 FF FC FF FB  ..........
     My RESA:0000: 76 26 41 4C 54 45 52 41 39 32  v&ALTERA92
     My RESB:0000: 76 3E FD FF FF FF FF FF FF FF  v>........

Migry's SCOA:0000: 01 46 8A AB F5 33 60 83 36 43  .F...3`.6C
Migry's SCOB:0000: FF F6 FF E3 FF F7 FF E3 FF F3  ..........
Migry's RESA:0000: FE 07 41 4C 54 45 52 41 39 33  ..ALTERA93
Migry's RESB:0000: FE 17 50 FF FF FF FF FF FF FF  ..P.......


So in addition to description, we now have a working code.

ADDED:
Just a thought that came to me after thinking about ReadID in parallel mode for 7000S (All one's serial output) and re-reading this thread.
I don't know the whole Altera product line of that time, but got this summary to myself:
 1. 'Old/classic' 7000 family, that supports only high-voltage, clumsy and mysterious parallel programming mode.
 2. 'Intermediate' 7000S family, that introduce JTAG programming, but not get rid completely from HV mode. My assumption is that they (7000S) doesn't support parallel programming, only high-voltage erase.
 3. 'Modern' 7000AE/3000S and Atmel's ATF15xx that take a step further and support JTAG reenabling with HV appiled. No more needed for HV parallel programming, even for simple pin manipulations for BulkErase.

Why I made such conclusion?
 1. EPM7032LC44 (and other family members) provide serial output and I think that it is a vital data:
 - ID block is possibly erased during HV BulkErase and need to be reprogrammed to keep ID/VPP/Tbe/etc.
 - Reprogramming is really performed after HV BulkErase (see traces, that I provided earlier).
 2. EPM7032SLC44 does not provide any serial data for ReadID. Let's think what it means:
 - we don't need actual VPP value and timings - programming via JTAG does not require such parameters.
 - we don't need Chip ID as it can be read by JTAG.
 3. So the only reason for 7000S to use HV parallel programming is BulkErase procedure.
 4. Successors, like 7000AE/3000S/ATF15xx make this "revival" procedure even more simpler.

« Last Edit: October 06, 2024, 05:24:18 pm by megov »
 
The following users thanked this post: YetAnotherTechie, Beta_vulgaris

Offline megov

  • Contributor
  • Posts: 22
  • Country: kz
Re: Programming (non-JTAG) MAX7000 devices
« Reply #224 on: October 06, 2024, 05:19:53 pm »
Well, It is worth to re-read thread from time to time...  :-DD

Today I've started another run for EPM7064LC44. I look again to traces and possible ZIF socket pin definitions for 7064 that I've posted here and compare them with traces for 7032, which allows me to read ID.
Differences were in init sequence (7064 has more pins to drive or keep at certain level) and during reading phase: in addition to SK pulses and keeping SS (or SS_BI for 7064) low for 1st bit in 16bits pack,
another pin dives high ate the same 1st bit of 16bits pack. Currently I identify it as MTIN, but it may not be true, see below.

Struggling a little bit I've got the SCOA waveform you can see in attachments. It is really looks like a start of ID sequence. But I'm unable to force CPLD producing serial stream beyond these 16 bits.
More interesting, that test code works without modifications with EPM7064LC84 in adapter that I made looking to ADP-7064S-PL84 scematic, AD359 adapter pinout table and traces from A70X.EXE.
I think the following way:
 - (1) treat AD359 adapter pinout table as a sort of truth for 7064 in PLCC44
 - (2) suppose that ADP-7064S-PL84 also works
 - (3) traces that I've taken from A70X.EXE are real
 => projecting procedures from (3) to ALL03 ZIF socket pins makes me understanding algorithm
 => ADP-7064S-PL84 schematic (2) with (3) reveals actual PLCC84 pinout for parallel programming
 => looking into (1) will give some hints about actual PLCC84 pinout, as devices are same with exception of packaging.

Yes, I've found some incompatibilities between access patterns in A70X.EXE and ADP-7064S-PL84 schematic, but don't stuck at them.
But... @Reverse here https://www.eevblog.com/forum/fpga/programming-(non-jtag)-max7000-devices/msg5454905/#msg5454905 said:

> There is another A70X.EXE that supports non-S versions but with different adaptor - EPM7064-PLxx which schematic is unknown to me anyway.

So I take a trace from code and apply it to wrong adapter from wrong code and apply it to incompatible adapter. That's why my attempts with 7064 were not so successful.
Well, it's time to open A7064.EXE and I hope that internals of ALL07 programmer don't differ much from ALL03.

ADDED: Strange, but I'm unable to find A7064.EXE at Matthieu's site. Anyone, please, provide me a link to download it. Thanks!
Found it. Need to understand how ALL07 differs from ALL03.

ADDED2: Looked briefly to ALL07 schematic... More complex and less understandable than ALL03.  :palm:
« Last Edit: October 06, 2024, 07:26:53 pm by megov »
 
The following users thanked this post: Beta_vulgaris


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf