Weller WMD-3 M27C256B dump needed - Page 1
Forum section: electronics / repair

author: Hooligan
author_rank: Newbie
timestamp: December 28, 2020, 07:27:01 pm
content: Hi, trying to repair the old Weller WMD-3 soldering station with MCU SAB80C535N and ROM M27C256B on board. Station has no indication at all. Finally found that ROM changes some bytes inside it every time it powers on, so the data is corrupted. Could someone help me with the M27C256B dump from a working unit?

author: wraper
author_rank: Unknown
timestamp: December 28, 2020, 11:01:17 pm
content: Try reading it multiple times with different VCC and IC temperature. There is a chance you can read it successfully.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 04:04:54 am
content: Can you upload one of your bad dumps? Perhaps you could narrow down the problem to a weak data bit, in which case you could buffer it with a comparator.

author: Hooligan
author_rank: Newbie
timestamp: December 29, 2020, 05:49:35 am
content: Thanks for taking part guys, will try to play with VCC and temperature. Here are few dumps with some different bytes in it.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 06:43:04 am
content: ISTM that bits are being dropped rather than being set. Therefore I'm wondering if the solution would be to simply perform a bitwise OR on the contents of all the dumps.I have already written a command line tool to do this.http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/filmerge.exehttp://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/filmerge.basThis would be my BATch file:filmerge M27C256B-v1.BIN M27C256B-v2.BIN temp1filmerge temp1 M27C256B-v3.BIN temp2filmerge temp2 M27C256B-v4.BIN temp1filmerge temp1 M27C256B-v5.BIN temp2filmerge temp2 M27C256B-v6.BIN ROM.bin

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 12:19:21 pm
content: Quote from: fzabkar on December 29, 2020, 06:43:04 amIMHO it should be bitwise AND, not OR. Since bits are in logic high state when unprogrammed (read as FF) and set logic low when programmed. And as cell discharges, it should return to high state with time. Switching from high to low state is only possible if IC physically fails or programmed IC was poorly erased previously.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 04:10:01 pm
content: Quote from: wraper on December 29, 2020, 12:19:21 pmIf you compare the dumps, you will notice that the differences occur mostly near the start and end of the ROM. If you then examine the contents at the end of the ROM, you will see that bytes which should be 0xFF (?) are read as 0xE7 or 0xFE. At least that's how I see it. Therefore it could be a case of a weak data bus rather than fading cells. But then the bad cells should be randomly distributed throughout the entire address space, not confined to the start and end.

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 04:28:28 pm
content: Quote from: fzabkar on December 29, 2020, 04:10:01 pmDifferences occur mostly in start to middle, not end. I don't see any flipped data located in an empty pool of FFs. The furthest single standing thing is like 20 bytes away from other data.QuoteStrange you even thought of this since different bits are flipped. And only single bit at a time.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 04:35:44 pm
content: Quote from: wraper on December 29, 2020, 04:28:28 pmAISI, bits which should normally be high are read as low. The opposite doesn't occur. This would be consistent with a weak data bus, if the addresses were randomly distributed.

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 04:52:34 pm
content: Quote from: fzabkar on December 29, 2020, 04:35:44 pmI haven't ever heard about this magical weak data bus, and why it "should read low and opposite does not occur". While retention (floating-gates losing charge) is a very real thing and bits flip to erased (high) state. Also if it's a supposed bus issue, then why bits flip at the same places and not purely randomly?

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 04:58:45 pm
content: Quote from: wraper on December 29, 2020, 04:45:07 pmNothing magical about it. I have seen MANY cases where a TTL level doesn't switch nicely between 0V and 5V. In fact I have used comparators to buffer these low levels in IBM PS/2 Model 25s.Here is a quirky thread:https://www.eevblog.com/forum/repair/kontron-8201-not-booting/msg3374750/#msg3374750The OP is observing weak TTL levels on the data bus."The 5V Rail of the PROM is clean. But as you can see, the Voltage levels are at about 3V and sometimes even lower.. Is this a known failure mode of an aged PROM?"

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 05:23:29 pm
content: Code:Comparing files M27C256B-v1.BIN and ROM.BIN0000000B: 00 020000000C: 01 030000000D: 1A 5A0000006E: EE FE00000B11: 40 440000121A: 03 8300004048: 23 6300004531: 20 A00000590B: 32 3A00005950: E8 F80000597C: 13 1B00007F30: F7 FFCode:Comparing files M27C256B-v2.BIN and ROM.BIN00000008: 03 2300000009: 5A 7A0000000B: 00 020000000C: 01 030000000D: 1A 5A0000004E: 63 E300000052: 73 F300000053: F2 F60000006E: EE FE00000B11: 40 4400000B33: BC FC0000121A: 03 8300004042: 62 E20000590B: 32 3A00005934: 06 0E00005935: 90 9800005936: 13 1B0000593E: 90 9800005950: F0 F800007829: E7 F700007F30: F7 FFCode:Comparing files M27C256B-v3.BIN and ROM.BIN00000002: 00 4000000008: 03 2300000009: 5A 7A00000012: F2 F600000030: C2 E20000004E: 63 E30000005B: D0 F000000064: EE FE0000006D: 66 E600000B11: 40 440000121A: 03 8300004042: 62 E200004048: 23 6300004069: 77 F70000590B: 32 3A0000593F: 13 1B00005950: F0 F800005963: 04 0C00007829: E7 F7Code:Comparing files M27C256B-v4.BIN and ROM.BIN00000008: 03 2300000009: 5A 7A00000030: C2 E20000004A: 02 420000004E: 63 E300000052: 73 F300000053: F2 F60000005B: 50 F000000060: C2 E20000006E: EE FE00000B11: 40 4400000B33: BC FC00004007: F0 F200004042: 62 E200005934: 06 0E00005935: 90 9800005936: 13 1B00005950: F0 F800005963: 04 0CCode:Comparing files M27C256B-v5.BIN and ROM.BIN00000002: 00 4000000008: 03 2300000009: 5A 7A0000000B: 00 020000000C: 01 030000000D: 1A 5A0000001B: 62 E20000004E: 63 E30000005B: 50 F000000060: C2 E20000006D: 66 E60000006E: EE FE00004004: A0 A200004007: F0 F200004042: 62 E20000590B: 32 3A00005934: 06 0E00005950: F0 F800005963: 04 0C0000597C: 13 1BCode:Comparing files M27C256B-v6.BIN and ROM.BIN00000002: 00 4000000006: 00 4000000008: 03 2300000009: 5A 7A0000000C: 01 030000000D: 1A 5A00000012: F2 F60000001B: 62 E200000030: C2 E20000004E: 43 E300000051: 64 660000005B: 70 F00000006D: 66 E60000006E: EE FE0000121A: 03 8300004042: 62 E200004069: 77 F700005934: 06 0E00005959: 90 9800005963: 04 0C00007829: E7 F7Here is an 0xE7 which flips to 0xF7 in some dumps (M27C256B-v6.BIN). It looks like it wants to be 0xFF.Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00007800 01 FF 01 FF 01 FF 01 FF 01 FF 01 FF 0B FF 0B FF00007810 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007820 FF FF FF FF FF FF FF FF FF E7 FF FF FF FF FF FF <--00007830 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007840 49 FF 01 FF FF FF FF FF FF FF 49 FF FF FF FF FFThis block looks like it needs fixing (ROM.BIN):Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00007E00 01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF00007E10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007E20 E7 E7 F7 FF FF FF FF FF EF E7 EF EF FF FF FF FF00007E30 F7 F7 F7 F7 FF FF FF FF FF E7 FF E7 FF FF FF E700007E40 01 FF 01 4B FF FF FF FF FF FF 01 01 FF FF FF FF

author: Hooligan
author_rank: Newbie
timestamp: December 29, 2020, 06:55:14 pm
content: Tried to play with Vcc, but no success, everytime get a different data. Made bitwise OR on dumps with same Vcc, the result is attached.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 07:06:25 pm
content: I don't understand the failure mode, especially in that other thread. I would have thought that @wraper was right, and I had already confirmed that the erased state of the EPROM was 0xFF.Anyway, I have rewritten my tool to perform a bitwise AND. This expects that bad bits are hot.http://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/bitwand.exehttp://www.users.on.net/~fzabkar/FreeBasic_W32/Utils/bitwand.bas

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 07:25:34 pm
content: I would use as many dumps as possible (like 100+), preferably made in different conditions and run them through AND/OR tools and see if processed dump works afterwards. And continue processing additional dumps with the tool until resulting dump stops changing.

author: fzabkar
author_rank: Super Contributor
timestamp: December 29, 2020, 07:51:42 pm
content: ISTM that, as Vcc increases, the bad bits switch from 0 to 1, not the other way around. I don't know if this is repeated over the entire address space.ROM.binCode:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00007E00 01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF00007E10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007E20 E7 E7 F7 FF FF FF FF FF EF E7 EF EF FF FF FF FF00007E30 F7 F7 F7 F7 FF FF FF FF FF E7 FF E7 FF FF FF E700007E40 01 FF 01 4B FF FF FF FF FF FF 01 01 FF FF FF FFROM-VCC5_5.binCode:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00007E00 01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF00007E10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007E20 E7 E7 FF FF FF FF FF FF FF E7 EF FF FF FF FF FF00007E30 F7 F7 FF F7 FF FF FF FF FF E7 FF E7 FF FF FF E700007E40 01 FF 01 FB FF FF FF FF FF FF 01 03 FF FF FF FFROM-VCC6_5.binCode:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00007E00 01 FF 01 FF 03 FF 03 FF 09 FF 01 FF 0B FF 0B FF00007E10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF00007E20 F7 E7 FF FF FF FF FF FF FF EF FF FF FF FF FF FF00007E30 FF F7 FF F7 FF FF FF FF FF E7 FF E7 FF FF FF F700007E40 41 FF 01 FF FF FF FF FF FF FF 01 4B FF FF FF FF

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 08:04:36 pm
content: Quote from: fzabkar on December 29, 2020, 07:51:42 pmThen chip should be read at decreased voltage. Say 4V, or even less.

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 08:25:40 pm
content: Quote from: Hooligan on December 29, 2020, 06:55:14 pmBut why you only tried increasing the voltage?

author: Hooligan
author_rank: Newbie
timestamp: December 29, 2020, 08:30:58 pm
content: Do you mean I should lower voltage or try to heat the IC?

author: wraper
author_rank: Unknown
timestamp: December 29, 2020, 08:33:30 pm
content: Quote from: Hooligan on December 29, 2020, 08:30:58 pmLower the voltage, put into freezer. Try both ways.

author: cocosteel
author_rank: Newbie
timestamp: April 10, 2022, 05:14:26 pm
content: Hello, do you still need this eprom dump ?

author: Hooligan
author_rank: Newbie
timestamp: April 14, 2022, 08:05:06 am
content: Hi, still need, could you upload it please?

author: cocosteel
author_rank: Newbie
timestamp: April 14, 2022, 03:49:45 pm
content: Here it is. I hope this will help you to repair your soldering station.I have done a quick diff with my file and yours, it's interesting to see how your EPROM is corrupted.

author: mt777
author_rank: Contributor
timestamp: December 14, 2024, 04:00:35 am
content: Do you have a photo of motherboard with EPROM (27C) ?I wanted preserve my unit (where DSX-120 works and in another WMD3 is not recognized) but what I see that I have only single PIC chip (in both units)

author: Harry_22
author_rank: Frequent Contributor
timestamp: December 14, 2024, 11:08:10 am
content: Hi!Still need dump from Weller WMD-3?

author: Harry_22
author_rank: Frequent Contributor
timestamp: December 16, 2024, 03:54:31 pm
content: There are no 27C.. inside