EPROM addressing question - Page 1
Forum section: electronics / projects

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 12:14:23 pm
content: I have a board that I just finished reverse-engineering its schematic, and which uses a pair of TMS-2516 EPROMs to store the firmware.I also know there is a newer version of the same board, and one of the three major changes between the two is the firmware is contained on a single 2764, instead of a 2732 as would otherwise be assumed.Looking at the addressing, am I correct in assuming that U3 and U4 are NOT, in fact, consecutive in memory?Continuing that line of thought, would the 2764 image then consist of the old U3 image, then padding, old U4 image, then padding again?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 02, 2025, 12:33:49 pm
content: correct - A11 is unused so they will repeat. A 2764 can include these repeats to appear the same, assuming its chip select is suitably decoded

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 12:49:26 pm
content: So they would just bring out A11 to the 2764 and then use the first of the two ROM select lines?

author: pcprogrammer
author_rank: Super Contributor
timestamp: January 02, 2025, 01:14:02 pm
content: A14 is also not used in the decoding. A15 is used to enable the decoder, so the lower 32KB of the address space is used.A14 can be either 0 or 1, so the selects work in both the lower 16KB block as well as the upper 16KB block of this 32KB block mentioned above.A12 and A13 are used to select the four regions within these 16KB blocks. So 4KB blocks of memory are available per region.With the EPROMS not using A11, it can be either 0 or 1, so the 2KB of each EPROM is visible in both the lower 2KB block as well as the upper 2KB block of the aforementioned 4KB block.To have it work with a 2764 the two ROM select signals need to be merged to allow the full 8KB to be addressed with this setup. An AND gate will do the trick.Within the 2764 the first EPROM has to be copied into the lower 4KB twice and the second one has to be copied twice into the upper 4KB, to make it behave exactly the same, or copied in just once and have A11 of the 2764 tied to ground. A12 needs to be connected to A12 of the 2764.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 01:25:55 pm
content: But what if only 4K of the addressing space is required?The old EPROM pair and the replacement single EPROM have the same checksum? That implies there was no change in the code, therefore, only 4K out of the 8K is required?If the two old EPROMs were consecutive in memory, it would definitely have been easier to just use a 2732, right?

author: m k
author_rank: Super Contributor
timestamp: January 02, 2025, 03:18:18 pm
content: Since A11 is missing old ROMs were not consecutive.Like pcprogrammer said, first is 2x ROM1 and then is 2x ROM2, same happens again when A14 is high.A11 doesn't do anything.If you can't find an extra gate chip combining ROM1 and ROM2 signals it can be maid using old double diode trick.Checksum can be counted quite many ways.But if code uses static addresses keeping original locations is easier.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 03:50:12 pm
content: The 290022 board is the one I posted a snippet of the schematic, and I was trying to work out the detail of the changes that turned it into the new 290078 version - EPROM, added Schottky diodes, and output stage.(trying to satisfy my curiosity without spending $$$ to get my hands on a 290078)

author: pcprogrammer
author_rank: Super Contributor
timestamp: January 02, 2025, 06:28:39 pm
content: Quote from: metertech58761 on January 02, 2025, 01:25:55 pmWith the two 2516 EPROMS it is just 4KB that is needed, but then they would have needed additional logic to incorporate A11 into the address space selection mix.To see if there is no change in the code a one to one comparison of the actual code blocks would be definitive. But if indeed the same they could have done it with a 2732, but maybe the 2764 was chosen based on either availability or future expansion of the code.Since the code blocks are not consecutive in the original design it would have needed a re compilation to make it work from a 2732 though.

author: m k
author_rank: Super Contributor
timestamp: January 02, 2025, 06:51:14 pm
content: (can't be a maid, I guess)D12 and D13 are good candidates for ROM selection address combo.One is traced under LS139, other is also possible.Lower right corner transistors are clearly beefed up, if that's an output stage.It's also possible that consecutive code of 2nd copy of ROM1 and 1st copy of ROM2 are used for checksum.But 1st ROM1 image must be there also, it contains a booting location.Must be an obfuscation or something.E,verb -> noun

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 11:27:13 pm
content: Full schematics of main board and display attached, along with EPROM dumps. 8031 MPU.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 05, 2025, 06:04:39 am
content: I need to correct myself.After searching a bit, it seems I was misled by some incorrectly marked units - correct marking should be 900490-001 A21SP8.I'ma try and see how badly I need to break the bank to get one of these after all.

author: m k
author_rank: Super Contributor
timestamp: January 05, 2025, 05:42:33 pm
content: Do you mean that all of above is wrong and useless?My guess is that the 900 number is the whole module.Main board, display board and the actual display/keyboard front.Some possibly useless stuff still follows.Seems that shadow addresses are not used.1146h to 1171h has BCD words.First is 0.39 and doubling to 50.0 of 1+1 byte fixed point and then 1 doubling to 8192.118e to 11ab has three sets of 10 bytes of multiply values starting from 0.First stepping ~2.5(guess) then ~27 and finally 10.One other data is 142d to 143c, seems to be some display stuff.Rest are program code.For 7-segment 7f can be '8' or empty, opposite of 00 without a dot.7b, 5f, 77, 7e and 04 have only one segment changed.0, 6, 9, 'A', 'a' and 'e' can be those.Code:DAT_CODE_142d XREF: FUN_CODE_1363:139e(R),FUN_CODE_1363:13a1(R),FUN_CODE_1363:13a4(R)CODE:142d 7b ?? 7Bh {DAT_CODE_142e XREF: FUN_CODE_1363:139b(R)CODE:142e 30 undefined1 30hCODE:142f 6d ?? 6Dh mCODE:1430 75 ?? 75h uCODE:1431 36 ?? 36h 6CODE:1432 57 ?? 57h WCODE:1433 5f ?? 5Fh _CODE:1434 70 ?? 70h pCODE:1435 7f ?? 7Fh CODE:1436 77 ?? 77h wCODE:1437 7e ?? 7Eh ~CODE:1438 1f ?? 1FhCODE:1439 0d ?? 0DhCODE:143a 3d ?? 3Dh =CODE:143b 04 ?? 04hCODE:143c 00 ?? 00hIts codeCODE:1397 90 14 2d MOV DPTR,#0x142dCODE:139a ec MOV A,R4 = unknown, 1, 0 or 5CODE:139b 93 MOVC A,@A+DPTRCODE:139c f8 MOV R0,ACODE:139d ed MOV A,R5CODE:139e 93 MOVC A,@A+DPTRCODE:139f f9 MOV R1,ACODE:13a0 ee MOV A,R6CODE:13a1 93 MOVC A,@A+DPTRCODE:13a2 fa MOV R2,ACODE:13a3 ef MOV A,R7CODE:13a4 93 MOVC A,@A+DPTRCODE:13a5 fb MOV R3,ACODE:13a6 90 80 00 MOV DPTR,#0x8000

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 06, 2025, 03:37:42 am
content: Useless? Not necessarily.When I was operating under the assumption that both firmware sets (2x 2516 and 1x 2764) shared the same checksum, based on pictures of units available online, what I was hoping to do was to nail down how the addressing worked so I could generate the 2764 image from the 2516 images. That way I didn't have to worry about making sure the EPROM hadn't been pillaged from the unit.It was surprising to realize that there were some units with incorrectly marked EPROMs - and nobody ever noticed!Now then, the display data will be weird, as the displays are mounted upside down to allow the decimal points to serve as indicators. Besides digits 0-9, there will be three error messages: Ab-0, Ab-1, Ab-5.

author: m k
author_rank: Super Contributor
timestamp: January 06, 2025, 05:28:08 pm
content: Don't think 7-segments upside down, it's just wiring.Practically only 04 can be a hyphen.7b is first and is most likely 0, missing hyphen fits.ICM7218 has lowest data for segment g.Number 4.It has b, c, f and g, so 3 for high nibble and two highs for low nibble.If 4 is g then 2 must be f for 36h.Number 3.It has a, b, c, d and g, so 7 for high nibble and two highs for low nibble.If 4 is g then 1 must be d for 75h.So g and d are swapped.7e is A, segment d is missing.Rest are bcd- and empty.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 16, 2025, 12:24:59 am
content: Update: Finally smashed open the piggy bank and bought the assembly.Dump of the EPROM attached - and while the layout matched my suspicion (image 0 / FF padding / image 1 / FF padding), it seems there were tweaks to the code as a quick compare to the old code fails, so I guess I did need the new version anyway!A11 and A12 were connected to the 8031 as I suspected they would be, and the output enable remains the same (driven by PSEN on the 8031).The two Schottky diodes were indeed used to couple the ROM1 / ROM2 lines into the 2764's chip select (a 10K resistor next to them was the pull-up needed to form a wire-AND gate).Just finished doing a difference compare between the -22 and -78 boards.

author: m k
author_rank: Super Contributor
timestamp: January 16, 2025, 06:32:32 pm
content: Basically the same code, possibly added a function or two.Difference can also be from the newer compiler.Code:CODE:005c 74 00 MOV A,#0x0CODE:005e 90 23 50 MOV DPTR,#0x2350CODE:0061 f0 MOVX @DPTR=>DAT_EXTMEM_2350,ACODE:0062 05 82 INC DPLCODE:0064 f0 MOVX @DPTR=>DAT_EXTMEM_2351,ACODE:0065 90 23 00 MOV DPTR,#0x2300CODE:0068 f0 MOVX @DPTR=>DAT_EXTMEM_2300,A <--- addedCODE:0069 90 20 d0 MOV DPTR,#0x20d0CODE:11ac c2 af CLR EA <--- addedCODE:11ae 85 1f 02 MOV BANK0_R2,BANK3_R7CODE:11b1 85 1e 03 MOV BANK0_R3,BANK3_R6CODE:11b4 85 1d 04 MOV BANK0_R4,BANK3_R5CODE:11b7 85 1c 05 MOV BANK0_R5,BANK3_R4CODE:11ba 12 11 72 LCALL FUN_CODE_1172

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 17, 2025, 12:24:00 am
content: That company redesigned another of their boards around the same time (combining their older 290009 / 290051 CPU board set into the new 290077 CPU board)... so it could well be refinements that were added at the same time.I still need to get my hands on at least a disassembler that can handle 8085 / 8031 code - it'd be nice if it ran on macOS, but I do have a Win7 box I can put it on.Anyway, I appreciate the help, and after I finish going through the schematics I have thus far, I'll have a couple other threads for the brain trust to peruse later.

author: pcprogrammer
author_rank: Super Contributor
timestamp: January 17, 2025, 07:27:13 am
content: Quote from: metertech58761 on January 17, 2025, 12:24:00 amGive Ghidra a try:https://ghidra-sre.org/It can handle code targeted for many processors amongst which the 8051 (8031).There are ways to run it on a Mac.