DavidGriffith / minipro-import-test

An open source program for controlling the MiniPRO TL866xx series of chip programmers
GNU General Public License v3.0
3 stars 0 forks source link

Viability of address extension using specialized hardware #244

Open DavidGriffith opened 2 years ago

DavidGriffith commented 2 years ago

In GitLab by @nitro2k01 on Nov 10, 2021, 12:23

Since I'm not familiar with the internals of minipro, this is more of a reality check as to what level of control the minipro application has over the hardware.

Some chips, like the 27C160, have more pins than the Minipro socket. Apparently what people do to is use specialized adapter boards with dip switches to program one region at a time. So my idea is that this could potentially be automated using a special adapter board with simple 74xx/40xx series latches to control the upper address bits. Basically, reserve one pin of the socket for latching data present on, say, the data bus of the chip pinout. Now, the full chip could be programmed automatically in one go.

For example, I could imagine minipro being dependent on programming profiles in the closed source firmware such that it's just not flexible enough to do something this. If it is indeed possible, it would open new possibilities for the hardware.

DavidGriffith commented 2 years ago

In GitLab by @radiomanV on Nov 30, 2021, 04:15

You are right. We cannot manipulate (well this is debatable) the socket pins during transfer.
The TL866XX firmware is structured more like data block transfer wise. So when an action is requested (read/write/erase/etc) the minipro software will read all the required parameters from the xml database (infoic.xml) like protocol and sub-protocol (called "variant" in the database) then read and write buffer size, power supply and programming voltages and for some chips the programming pulse width.

Then with all these parameters a structure is constructed and then we send it to the TL866. We call this begin_transaction because in this moment the firmware will initialize all pin drivers and power supply pins according to that above structure. Also in this moment the chip is powered.

This means that there's a table in firmware with all init values for all protocols or something like this. Then after this init we simply move data blocks back and forth using simple commands like read_block or write_block until required size (also specified in database).
The last step is to reset the programmer to an idle state by sending the end_transaction command. That's all. Well there are some additional commands in between like read the chip ID or read the over current status to detect an short-circuit or any failure during read/write process.

So we don't manipulate any pin during the programming, this is done by the firmware. I think that this design is implemented first, to be efficient (transfer-wise oriented) and second for some intellectual property protection (all programming algorithms are in firmware).

An adapter like one described can be easily made, also we have some pin manipulation primitives/commands used for pin contact or hardware integrity check. We can use one of those to manipulate some latches for example but we must trick the firmware by not sending the end_transaction command (otherwise the power supply is switched off) and somewhat to send one of the pin manipulation primitive to load the adapter latch with a new value (upper address bits, obviously) and then loop again to read/write another block.

This can work but should be tested. Also for the above mentioned chip (27C160) what is the base chip used? i think it should be something like a 32 pin chip or similar (must be under 40 pin, because we need at least one pin for the latch clock).

DavidGriffith commented 2 years ago

In GitLab by @nitro2k01 on Dec 7, 2021, 16:34

First off, I don't actually have a use for this or own any chips that would benefit form this. But it might come in handy, and it's a pretty simple PCB which should take no time to prepare. So this caught my interest and it wouldn't cost many dollars to get a few chips and a board.

This is the method people use currently. People use the AMD 27C4096 DIP40 profile apparently.

https://github.com/mafe72/27c160-tl866-adapter

You don't strictly need direct IO control through primitives if the latch could be controlled through what behaves like a standard bus interface. So if you could for example do the following steps within the same transaction, we have something that could work.

  1. Select chip as Am27C2048
  2. Write data 0 to address 131072
  3. Program 128 kwords. (Ie half of the apparent chip size.)
  4. Write data 1 to address 131072
  5. Program 128 kwords.

etc...

Even if that's not possible to do within the same transaction, it might be possible to use a diode+cap to keep the latch's state alive for a short while.

Edit: On second thought, there's obviously no "write" pin defined in the RAM sense for that chip. But you could just as well (ab)use a read for the same purpose. Read from address $2000x to latch value of x.

DavidGriffith commented 2 years ago

In GitLab by @radiomanV on Jan 7, 2022, 01:41

This should be tested. I don't know how the firmware will react for a single byte write only.