Dumping a ROM - Page 1
Forum section: electronics / projects

author: Unknown
author_rank: Unknown
timestamp: June 21, 2013, 07:57:20 pm
content: So I posted in another thread that I was messing around with a Casio keyboard, which has a 4M mask rom on it. I'd like to dump this ROM to see what the contents are, but I'd like to not remove it from the circuit. The address and data leads appear to come directly from the CPU. Is there an easy way to probe this ROM without removing it from the circuit, or do I have to desolder it (thankfully this is a single sided board so it would be trivial) in order to hook it to an arduino?I don't really mind removing it because I can do so reasonably non-invasively, but I'd much more rather not have to do that at all.The ROM is a DIP package, btw.

author: Stonent
author_rank: Super Contributor
timestamp: June 21, 2013, 08:15:38 pm
content: Depends on the chip, board etc. But if it is a mask rom I doubt they made any provisions to access it like they would something that would be reprogrammable.Got any pictures?

author: Unknown
author_rank: Unknown
timestamp: June 21, 2013, 08:24:47 pm
content: Yes, but they didn't come out well and I'll have to retake. The DIP is a 40 pin ROM, though... an HN62414.

author: Paul Moir
author_rank: Frequent Contributor
timestamp: June 21, 2013, 08:52:11 pm
content: If you could get the CPU to tristate its data and address busses you could take over. You would just have to force the chip select somehow, but that's probably just one pin. Most CPUs will have this ability which can be requested by a pin on it so they can work with DMA (which takes over the bus) or multiprocessor situations.But I think the datasheet for the CPU is a bit of a problem?

author: Unknown
author_rank: Unknown
timestamp: June 22, 2013, 12:11:26 am
content: You're correct, I can't find the datasheet anywhere. The datasheet for the ROM is easily found, though.

author: Harvs
author_rank: Super Contributor
timestamp: June 22, 2013, 12:33:03 am
content: In these situations I normally find just desoldering the device is quicker than the background work to ensure that you're not going to driving current into some output pin. But that all depends on whether you've got the tools to do it. Also, most arduino's out of the box are 5V, and most circuits around are 3.3V. Assuming the device is 5V tolerant, desoldering and putting on a breakout board can get you around dealing with the voltage problem as well.So I know it doesn't answer your question, but it'll probably lead you to success quicker.

author: SeanB
author_rank: Super Contributor
timestamp: June 22, 2013, 08:19:45 am
content: Desolder it and put a 40 pin turned pin socket on it, and another in the board. That way it is easier to remove it next time, or swap it out for a modified one. The reason for the socket on the ROM is to enable you to place it in the socket without damage, the extra solder on the pins will damage the socket with repeat insertions, but just once will be fine.

author: Unknown
author_rank: Unknown
timestamp: June 22, 2013, 07:57:14 pm
content: Interestingly, I found a schematic:http://www.loscha.com/scans/casio_cps-130_%5BET%5D.pdfThat contains the same chip, and on the schematic itself it's got a different part number that's hard to read. But that's a start!EDIT: Looks like it might be a UPD938 family... though the only one I can find there is a power mgmt IC, or rambus ASIC. But it's nice at least to have a pinout. Not too sure this is worth spending too much more time on, but it's a good learning experience.

author: gxti
author_rank: Frequent Contributor
timestamp: June 22, 2013, 08:23:25 pm
content: Holding the CPU reset line low might tri-state all the pins. The reset controller is to the lower left of the CPU in that schematic.

author: Stonent
author_rank: Super Contributor
timestamp: June 23, 2013, 05:25:24 am
content: If you can get it unsoldered you can probably drop it in an eprom programmer and read it. I'd assume it would use some kind of standard pinout.

author: SeanB
author_rank: Super Contributor
timestamp: June 23, 2013, 05:40:43 am
content: Not likely to be a mask rom, more likely to be a standard OTP eprom, 16 bits though is not common, more likely you will have to replace it with a little breakout board with 2 standard 8 bit 4Mb eproms/eeroms to get it working.

author: Unknown
author_rank: Unknown
timestamp: June 23, 2013, 05:54:46 am
content: It's a mask rom according to the datasheet. But I could have misread...

author: SeanB
author_rank: Super Contributor
timestamp: June 23, 2013, 08:07:00 am
content: Depends how many they made with each revision. AFAIK the switch point for it being cheaper to go for a mask was at around the 10k unit mark, under that using OTP devices was cheaper, over that the cost of the mask was covered by the bulk purchase price for the uncommitted sea of diode cells. This was changed when EEPROM got to it's current reliability, as you could get a 100k of units and program them, with a cost actually lower than having the mask made. As well now you do have the ability to do a firmware update without tossing out all the old chips, either by in circuit or removing the device and reflashing it.

author: amyk
author_rank: Super Contributor
timestamp: June 23, 2013, 10:57:39 am
content: Quote from: Stonent on June 23, 2013, 05:25:24 amIt is a (sort of) standard pinout, a truncated JESD21 3.2.2-8. This is a ROM and not EPROM standard.