Programming (non-JTAG) MAX7000 devices - Page 1
Forum section: electronics / general

author: migry
author_rank: Regular Contributor
timestamp: September 23, 2020, 08:04:47 pm
content: Gutted, hit some key combo and lost all my text!!!!Now to start over again.Quite some time ago just as RoHS was coming into force, some bright spark had the idea to throw out all leaded components from the lab (where I worked at the time) into the skip, where it would go straight to landfill. Sort of ironic really. The whole point of RoHS was to prevent this kind of hazardous waste going to landfill!Luckily I got wind of this and managed to rescue some rails of ICs before they were thrown away. I also got my hands on a couple of EPROM/PAL programmers and an EPROM eraser.Recently I have got into retro compuiter projects. I have been playing with different FPGAs. I recently designed some 68000 CPU boards and used GALs for the first time. As mentioned in other threads I used WinCUPL without too much bother, and one of my (rescued) programmers supports GALs.At that time some of the devices rescued were MAX7000 devices. These are older devices that DO NOT support programming via JTAG. These are 5V devices and it would be really useful to use them in some future projects. I have 8 EPM7128s, and lots of EPM7064 and EPM7032's. See attached picture.Unfortunately my programmer only supports the JTAG version of these devices, and even then requires an adapter board, which I do not have and cannot find any information about.Now I am sure some of you will be telling me to sell these devices and buy some JTAG compliant versions and use the Altera Byte Blaster. Good advice, but since these devices were FOC I really would like to use them.I have searched the internet and cannot find any programming information for these (non-JTAG) devices. I realise it is quite common for manufacturers to keep this information confidential, perhaps they make money by selling the algoritms to programmer manufacturers? I did tweet Intel, but they didn't bite, and I got no reply.What to do?I could buy a new programmer, but these cost around $1000, so this is of no interest, not for a few devices....perhaps if I didn't already have a programmer.I did have a crazy idea, but perhaps someone can suggest a better way...There is an excellent sitehttp://matthieu.benoit.free.fr/which has loads of information about various EPROM/FLASH/PAL/GAL/MICRO programmers. There is even a few hints about the pins used for programming the MAX7000 devices.So if I could run some old Win95 or DOS software for one of these old programmers which supports the non-JTAG MAX7000 devices under Linux Wine (?), then perhaps I could trace the I/O writes to whatever parallel ports and use it to figure out which pins of the programmer are been driven. Forgot to mention that for at least for one programmer there are reverse engineered schematics. Does anyone think that this can be made to work? Can you trace I/O writes in some way using Wine?Anyway time to post before I accidently delete it again--migry

author: BrianHG
author_rank: Super Contributor
timestamp: September 24, 2020, 07:23:51 pm
content: Quote from: migry on September 23, 2020, 08:04:47 pmI thought the ByteBlaster, ByteBlaster II, and ByteBlaster MV did support all versions of the MAX7000, as well as the even older MAX3000 series.

author: bingo600
author_rank: Super Contributor
timestamp: September 24, 2020, 07:42:14 pm
content: Wasn't there something about , if jtag was disabled and protection set on a 7000.Then you'd need a special (expensive) programmer to reset it./Bingo

author: migry
author_rank: Regular Contributor
timestamp: September 24, 2020, 08:40:59 pm
content: I just googled and found an Intel(Altera) document.https://www.thailand.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ug/ug_bbii.pdfIn a table of supported devices:-MAX 7000S devices - 5V (this has a JTAG port)MAX 7000AE (this has a JTAG port) and MAX 3000A (not familiar with this device) devices - 3.3VThe Byte Blaster has only a few pins so cannot do the "parallel" programming, but it does have enough pins for JTAG connections.QuoteApparently if some kind a security fuse is programmed on the JTAG devices, then the devices cannot be erased by means of the JTAG connector.I am looking to build in some way a cheap version of the "expensive" programmer.--migry

author: joeqsmith
author_rank: Super Contributor
timestamp: September 24, 2020, 08:42:23 pm
content: They support JTAG and could be programmed with the bit blaster, byte blaster and master blaster.See the following data sheet:https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ds/archives/m7000.pdf

author: joeqsmith
author_rank: Super Contributor
timestamp: September 24, 2020, 08:48:05 pm
content: The security bit doesn't prevent reprogramming. Actually, that's how you clear it. I started out making my own programmer. I think they published the design for one of their early programmers.

author: joeqsmith
author_rank: Super Contributor
timestamp: September 24, 2020, 08:49:53 pm
content: A quick search.https://www.min.at/prinz/o/oe1rib/FPGA/

author: migry
author_rank: Regular Contributor
timestamp: September 24, 2020, 10:02:20 pm
content: My devices are NOT the "S" (5V) or "AE" (3.3V) types.My devices are older MAX7000 which do NOT have JTAG.In front of me I have an EPM7032LC44-10 and a EPM7032VLC44-12 (I think that this is a 3.3V device - but can't recall).QuoteWhile googling I found several postings saying that JTAG parts which had the security bit set could not be re-programmed using JTAG, because the security bit had to be reset using a "parallel" type programmer. I took this are read. In any case my parts are not JTAG so I need to make some kind of parallel programmer.I discovered that my devices did not have JTAG having built a board and hooked up a USB Blaster clone, and found that it did nothing. The datasheet revealed to my disappointment that my devices did not have JTAG.You design and references will be helpful for those who already have or who buy the JTAG compatiable MAX7000 devices.--migry

author: joeqsmith
author_rank: Super Contributor
timestamp: September 24, 2020, 10:22:00 pm
content: I'll check my stash of old parts and databooks and get back with you.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: September 24, 2020, 10:54:33 pm
content: Not long ago I was planning to use some of these devices and bought an UP2 board and ByteBlaster. Worked fine.https://mil.ufl.edu/4712/altera_UP_board_info.htmlIn the end I don't think I will use this part because all the ones I got from China seem to be fake.

author: migry
author_rank: Regular Contributor
timestamp: September 24, 2020, 11:30:17 pm
content: Quote from: NivagSwerdna on September 24, 2020, 10:54:33 pmI followed the link and found information about the JTAG programmers, which I am already familiar with. They unfortunately DO NOT program the parts which I have :-(Are you aware that the MAX7000 devices come in several different flavours?Some are 5V and some are 3.3VThe newer ones can be programmed over JTAG (a simple industry standard interface and protocol widely used to program and test ICs) using a Byte Blaster.BTW I use JTAG a lot in my work, so have a deep understanding of this interface and its use.The older ones CANNOT be programmed using JTAG as the internal circuity does not exist inside the older parts. They require a "parallel" programmer to control a number of pins and a high voltage must be applied to one pin, sort of like an EPROM programmer. From the information I have been able to find it appears that the parts have one or more shift registers and some other miscellaneous pins whose purpose I do not understand. Intel/Altera are keeping this information confidential.Perhaps you bought the NON JTAG devices, which CANNOT be programmed using the ByteBlaster which you have. Could it be that the devices are not actualy fake, but are simply not the JTAG type? Can you post the full device ID or post a picture of the top of one of your devices? This will allow us to confirm - or not!--migry

author: joeqsmith
author_rank: Super Contributor
timestamp: September 25, 2020, 01:29:52 am
content: This is going way back. It appears you need the Master Programming Unit PL-MPU with the LP6 ISA card. I have not seen one of these in many years.http://www.ece.ualberta.ca/~elliott/ee552/AlteraDoc/maxplus2_getting_started.pdfhttps://www.ebay.com/itm/ALTERA-MPU-MASTER-PROGRAMMING-UNIT-Full-PL-ASAP2-kit-LP6-programming-card/114416535210?hash=item1aa3c1c6aa:g:R5MAAOSwmcJd8Cvp

author: NivagSwerdna
author_rank: Super Contributor
timestamp: September 25, 2020, 09:55:34 am
content: I'm sure there are many variants... this is the combo that worked for me...

author: migry
author_rank: Regular Contributor
timestamp: September 25, 2020, 11:30:54 am
content: Quote from: NivagSwerdna on September 25, 2020, 09:55:34 amJust to highlight to any readers (and please read the SUBJECT text) that I know that MAX7000 "S" devices CAN be programmed with the USB blaster shown, however MY devices arenotthe "S" variant and DO NOT HAVE JTAG circuitry.The device in the picture is marked EPM7128SLC84-S, so it is clearly a "S" device and is therefore capable of being programmed using the USB Blaster clone shown in the picture, because the "S" devices DO have JTAG internal circuitry.My problem, for which I search a solution, is that I need to program devices which I have, which are NOT "S" devices and cannot be programmed in the way your picture shows.Neverthess for anyone who has the "S" type parts, you have confirmed that the common and cheap USB Blaster clone can program these (the "S") devices.--migry

author: joeqsmith
author_rank: Super Contributor
timestamp: September 25, 2020, 11:44:45 am
content: Another option may be a generic programmer. I have an old EETOOLS programmer that supports both devices. It requires two adaptors which would cost about $250, if you could find them. Have you checked to see if any of the new low cost programmers support it?Some of the older parts I used also did not use JTAG but rather the passive serial mode, which could still be programmed using their more common programmers. That doesn't help you except that the lack of JTAG isn't really a good indicator, so much at the part numbers.

author: migry
author_rank: Regular Contributor
timestamp: September 25, 2020, 11:47:09 am
content: Quote from: joeqsmith on September 25, 2020, 01:29:52 amOK @joeqsmith, thank you for the pointers.I do have the physical MAX7000 databooks (remember them?), but I do not have the MAX-PLUS II databook, now downloaded from your link to the PDF.I actually intend to use Quartus to generate the code for the MAX7000 devices (if I can solve the programming problem) using a POF compiled from Verilog.I was also aware of the old programmer type shown in the Ebay link, however I do not want to spend $2000 to buy an old ISA card. H-ll I don't even have any old ISA motherboards anymore, they were all thrown out long ago (and ironically and nowe worth lots of $$$).There are still (multi device) programmers which can be bought new and which do support these MAX7000 devices (JTAG and non-JTAG modes of programming), but they cost at least $1000. As I mentioned, if I didn't already have a flexible EPROM/FLASH/EEPROM/MICRO programmer (FYI - LV48 Speedmaster), then I would have considered buying such an expensive programmer. I have been using the LV48 quite often recently to program EPROMS and GALs. It connects to the parallel port of my old XP machine and the DOS based GUI runs under Win-XP without problems.--migry

author: NivagSwerdna
author_rank: Super Contributor
timestamp: September 25, 2020, 01:05:31 pm
content: Quote from: migry on September 23, 2020, 08:04:47 pmApologies I read s as S.

author: migry
author_rank: Regular Contributor
timestamp: September 25, 2020, 01:46:32 pm
content: Quote from: NivagSwerdna on September 25, 2020, 01:05:31 pmSorry! My bad! The "EPM7218s" was a plural. I didn't even think that this might be mis-read! I should have written "I have 8 EPM7128's".--migry

author: westfw
author_rank: Super Contributor
timestamp: September 27, 2020, 09:36:24 am
content: Did you find any modern development software for these? I also have a bunch, as a result of dumpster-diving.(mine were in a proper w-waste bin, at least.)You can find the old Quartus v9.1 Altera software that is supposedly the last official release that supports these, but ... it look painfully ancient :-(See alsohttps://hackaday.com/2016/02/04/a-better-way-to-plug-a-cpld-into-a-breadboard/

author: migry
author_rank: Regular Contributor
timestamp: September 27, 2020, 01:50:05 pm
content: Quote from: westfw on September 27, 2020, 09:36:24 amThank you for this information.I have Quartus 13.0sp1 loaded on my Win10 machine, so I tried to create a simple counter design project. I found that there were several MAX7000 EPM7032 devices which could be selected, but I noted that these were all the JTAG types. I was able to create a POF, but I am now guessing that this POF uses the JTAG serial mode of programming, so will be of no use to me.So I then tried to find the old Quartus v9.1 on the Intel site. Well guess what - you can select it, but cannot download it. Thanks Intel! Thanks for NOT supporting thje maker community or anyone using old parts!I tried googling, but I was unable to find an this old version anywhere else.So @westfw (and any others) do you still have the install .EXE for this old version of Quartus?--migry

author: migry
author_rank: Regular Contributor
timestamp: September 27, 2020, 02:16:46 pm
content: So I initially mentioned a possible method to find a way to program these old non-JTAG devices.So I was intrigued by the amazing information on thehttp://matthieu.benoit.free.frwebsite.There is a page dedicated to an old Hi-Lo programmer called the ALL03, which appears to be able to program the non-JTAG EPM7032 (and similar) devices. It even shows the schematic of the adapter which is needed, butamazinglyit gives pin names of what appear to be the programming pins for this device (SDINA, SDOUTA, BE, BEM, SCK, SK, ...etc...). I can find no reference to these names elsewhere. It also shows which ALL03 channels each pin of the EPM7032 connects to. There is also the specific .EXE which is needed to program these devices. It is a very straight forward design of programmer. It needs an ISA card which uses only 2 addresses. Inside the programmer lots of 74LS273 8-bit latches are used to latch the data from the PC ISA card which in turn allow pins to be driven and read back and voltages such as Vcc and Vpp to be connected to appropriate pins. There are 3 DACs which generate 3 sets of high voltages (Vcc, Vpp and other).So since I had DOSBOX on my PC I tried running the software. It ran! The GUI was the old DOS type character graphics, which to be honest allowed really nice (low res) GUIs to be constructed, thanks to the IBM PC character set.So I wondered if I could modify DOSBOX to allow me to trace writes to and reads from the two I/O addresses.To cut a long story short, I downloaded the sources for DOSBOX-X onto my Ubuntu Linux VM, and was able to compile and run DOSBOX-X under Linux with relatively few problems. For other software you download, configure and compile under Linux I have had lots of problems. So kudos to the DOSBOX-X team.I spent a good part of one day in the src/hardware folder looking at the various I/O devices (mainly sound cards) which arre supported. I started to get an idea of how to intercept I/O writes and reads. I then copied the MPU401.cpp module and hacked it around to give a skeleton to log writes and reads to the two ALL03 ISA card ports. I needed to modify the Makefile and create a .Po file (no idea what this is - I just copied the mpu401.Po file!). Several hours of debugging later... I run the modified DOSBOX-X, fire up the MAX7000 .EXE (A70X.EXE), do some commands and look at the log. First problem was that the software was not seeing the programmer, however it was still apparently writing to the various registers. The programmer implements a PAL to decode the addresses of the various registers, but also contains a 4 bit state machine, the output of which can be read by the software, and this is seen in the logs. So again thanks to the same website, I found the PAL equations and added emulation of the PAL into the software. Finally no more complaints by the programming software. I am now emulating the SAC-201 PC ISA interface card, the various programmer I/O control registers, and the programmer PAL. Apparently the PAL is used to identify the prrogrammer hardware type, but might also have been some crude form of protection.So now I can run the A70X.EXE software for the MAX7000 and generate a log. Unfortunately the pins used did not match those expected from the EPM7032 adapter pinout. I was aware that this version of software, while allowing different members of the family to be selected, did not have a choice for the EPM7032. More googling later and I found a website suggesting a different .EXE program name. More googling and I could not find it, until I looked in the folder of software downloaded from the above site and I found AMAX70.EXE . I now loaded the DOSBOX-X (with SAC-201 and ALL03 emulation) software and generated some new trace logs. This time the Vcc and Vpp pins mapped perfectly, and I was able to see toggling on the SCK pin and changes on the SDINA and SDINB pins (presumably serial data in). The software then tries to read back a serial value, which of course fails.I have attached the log file with annotated EPM7032 pins.More soon...--migry

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 27, 2020, 05:26:27 pm
content: What if you “just” route (in software) the pin accesses to some kind of GPIOs attached to a real MAX7k now?

author: migry
author_rank: Regular Contributor
timestamp: September 27, 2020, 10:14:55 pm
content: Quote from: abyrvalg on September 27, 2020, 05:26:27 pmAha! I also had a similar idea. Bear in mind that DOSBOX-X is already emulating not only software but hardware too. having said that it can read joysticks, so has a way to speak to the outside world. Otherwise I don't know how I would get DOSBOX-X to speak to real physical hardware (parallel port?).For the time being I intend to simply record the stimulus as text (as shown) and then replay on an Arduino. There's stilla long way to go!--migry

author: migry
author_rank: Regular Contributor
timestamp: September 28, 2020, 09:15:05 pm
content: Just to confirm that I am getting the expected values out of the DOSBOX-X emulator in the log file (as previously attached), I have written an emulator for a simple EPROM device. I chose the AMD Am2716. At (simulated) reset, the contents of the EPROM, defined as a byte array, are all set to 0xFF, i.e. the normal EPROM erased value.After a few iterations I managed to get it to work.This time in DOSBOX-X I run the main ALL03 programmer software, ACCESS.EXE (there might be other versions and names). I then select EPROM, then AMD, then Am2716 device, and the software loads and runs another module (called EPP512.EXE) which appears to be the EPROM specific software (just like AMAX70.EXE is the Altera EPM7032 specific module). I examine the buffer (start only) and see all zeroes. I then load the buffer from the emulated 2716. I then check the buffer and see that the values are now all 0xff. I then edit the first 16 bytes to 0x55. I then select program and ... success! What this means is that the value being programmed is used to update the array so when the EPROM is read back it has the new programmed value. I was able to examine the programmer pin log file to confirm what had happened. First good thing is that all the pins which toggle map correctly to the EPROM pins, i.e. pins 9 to 20 of the programmer (which correspond to pins 1 to 12 of the EPROM) are the ones which toggle, and I can see the address count. I note that when programming the whole EPROM is read and only the bytes which are not 0xff, are programmed (I don't know if this check is more intellegent - as long as an EPROM bit needed to be zero is one, it can be changed, but 0 cannot be changed to a 1). I thought that Vpp was pulsed for each address, but actually it remains high during programming and readback of all locations. From earlier work I know that after applying the programming conditions (CE and OE) the EPROM is read back, and if the wanted value is not found, another attempt is made. Now after only the first attempt, the emulated EPROM has the right value, but interestingly, the programming software gives it one more "write" at the same address (just to be certain that this EPROM address is "firmly" programmed and not just marginal).--migry

author: migry
author_rank: Regular Contributor
timestamp: September 28, 2020, 09:36:01 pm
content: So I have a log of the EPM7032 sequence which the ALL03 programmer applies to the device to confirm its ID, which of course it fails to do.So I have wired up a perf board with a PLCC44 socket, where each pins comes to a row of 44 turned pin header for connection. I then found a 5V Arduino, a Nano, which has more or less the required number of pins.Yesterday. I was able to code the data from the previously posted file into the Arduino sketch in order to generate the waveforms that would be applied by the ALL03 programmer. I then hooked all the programming pins (thanks once again to the sitehttp://matthieu.benoit.free.fr/) to pins of the Arduino. Turns out that "analogue" pins named A0 to A5 can be used as digital, but not A6 and A7 - guess which pin I used for a critical signal! I was able to confirm that when the Vpp pin was taken over about 11V the chip went into test mode and previously clamped shift in data now had no contention and was the right level. I scoped the 2 suspected shift out pins: SDOUTA and SDOUTB, and they had identical waveforms which were defintely the EPM7032 responding to the stimulus.Today. I wanted to properly capture the response. I didn't quite have enough pins, so I moved some stuff around. Mistake. When I raised Vpp from 5V to 12V (which was OK yesterday) I was getting current clamping on my PSU, and a burning smell. After some messing around the lights (of the Arduino went out). Oops! Turns out the min hub (to which the Nano was plugged on) no longer was lit. When tested elsewhere the min hub appeared to light up, and the Nano too. The hub connected to the back of my Dell monitor. The EPM7032 was very hot, and clearly I had blown it up. I eventually figured out that you must ONLY connect Vpp when a number of other inputs are grounded, and appear to put the device into a state where Vpp does not destroy the chip, however I am not 100% sure which pins are the critical ones.So I ripped out all the wires from the Nano to the EPM7032 board connector and started again. After the usual debugging and discovery of swapped wires, I got the same waveforms on SDOUTA and SDOUTB as yesterday. I used my Rigol scope logic analyser to capture the waveforms (attached).I also confrmed which pins become outputs and which inputs when Vpp puts the EPM7032 into "programming" mode.NTPW - inputMTIN - inputSCK - inputSDINA - inputBE - inputBEM - inputSS - inputSBI - inputTM - inputA0 to A6 - inputSDINB - inputSK - inputVpp - needs around 12V to put the device into test mode (but ONLY do this if the other pins have been set!)SDOUTA - outputSDOUTB - outputSCOA - outputSCOB - output--migry

author: migry
author_rank: Regular Contributor
timestamp: September 28, 2020, 09:45:21 pm
content: Question.Can the JTAG type "S"/"AE" devices (e.g. EPM7032S) be programmed in "parallel" mode, i.e. not using the JTAG? In other words did Altera make the newer "S" devices backwards compatible with the older devices?Actually it is sort of ironic. To implement JTAG you need quite a few flip-flops (for state machine, instruction register, data registers), however the main EPM7032 device only has 16 macrocells, therefore with only 16 flip-flops (as far as I understand).@bingo wroteQuote@joeqsmith wroteQuoteI wonder if someone who knows for sure can confirm that - if the security bit of a "S" type device has been set, can the device be erased by means of JTAG only, or as @bingo beleves, do you need a "parallel" mode type programmer to clear the security bit and erase the device?--migry

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 29, 2020, 04:42:38 pm
content: My idea was to make DOSBOX controlling the pins of a real MAX7k. I.e. you connect an Arduino between the PC’s serial port and the MAX, write a sketch that listens to commands like "set pin X to Y state", "get pin X state" and send these commands from DOSBOX’s IO port handler, bridging the programmer exe to your MAX and letting it doing it’s job directly.

author: migry
author_rank: Regular Contributor
timestamp: September 30, 2020, 01:20:25 am
content: Quote from: abyrvalg on September 29, 2020, 04:42:38 pmHi @abyrvalg, I did understand what you were suggesting, and I did briefly consider this. I was incorrect in my previous reply, in that of course it is possible from the DOSBOX-X (modified) source code to write to real hardware (I just got confused), if I can figure out the correct library calls. Since DOSBOX-X is compiled under Linux with gcc, then I guess it should be possible to write to the serial port. I have an old Maplin kit for a ISA I/O card (un-built) which uses a INS8255. This would have been perfect. No good for my modern PC with PCIe ! Certainly I could devise a protocol and send serial data to a hardware COM port, then use an Arduino to capture this data and re-assemble the parallel packets. The ALL03 programmer is built from 8 bit chunks, so that maps nicely. I would need a couple of DACs for Vcc and Vpp, however I possibly could get away with simply switching these supllies on and off. I do see in the programmer I/O logs that Vpp is ramped slowly up and (later) down again using the DAC. Vcc is simply enabled on or off, having been previously programmed to the right level. The ALL03 can route 3 different high voltage supplies to nearly all pins (they didn't connect to all pins to save some costs I assume). If I use the "serial" Arduino method or the "parallel" stand-alone method, Vcc and Vpp will be handled the same way. The benefit of the way you suggest is that the timing information is at least "maintained" from the original software. With my method of logging I have no idea (currently) how long between writes to the programmer registers, and I think that some "pulses" may have minimum or critial lengths.--migry

author: ale500
author_rank: Frequent Contributor
timestamp: October 26, 2020, 03:57:56 pm
content: Did you get further with your efforts ?I ask because I have a stack of EPM7128S that have the security fuse programmed.

author: MadTux
author_rank: Frequent Contributor
timestamp: October 26, 2020, 05:07:43 pm
content: Quote from: migry on September 28, 2020, 09:45:21 pmAs fas as I know, EPM7032 should have 32Flipflops, just like as with XC95xx, xx is the number of flipflops available. 32FFs are very few for anything with clock, the small CPLDs are IMO better suited to replace lots of 74xx AND/OR.... combinatorial logic.BTW anyone who has downloaded Quartus II 9.0 for linux, before it was taken offline?

author: migry
author_rank: Regular Contributor
timestamp: October 28, 2020, 04:32:32 pm
content: Yes I did make a little more progress, but then decided to move onto something else, as a form of break, but intending to re-visit later. I do have 10 EPM7032S JTAG devices on order from China, and assuming that they are not fakeI will be able to program them using my Altera USB Blaster clone, in order to try various actions on my hardware.My new hardware now has two DAC channels, one of which is required for Vpp. 12V on this pin puts the device into test mode and reconfigures all the special pins.My new hardware is based around an Arduino MEGA2560. I have a script, into which I hard code sequences which have been learnt by reverse engineering the DOSBOX + ALL03 programmer hardware and software. The EPM7032 programming software (for the ALL03) gives me traces of certain commands. I see common sequences on groups of pins. Certain commands do not work as the software does not see the expected response from the emulated ALL03 programmer and emulated EPM7032 device. Blank check for example is still reporting a failure even though I applied the waveforms using my hardware to a blank device. Probably my emulated "blank" EPM7032 needs some minor tweaks.Some commands such as erase seem to have simpler sequences, but need more pins to be toggled.I finally found the special test pin names for the 44 pins EPM7064. There are more pins used for programming on this device, some with new names as compared to the 44 pin EPM7032. I do not know the pinout of the test pins for the EPM7128. This would need someone with an adapter for the ALL03 programmer to reverse engineer the adapter to 40 pin socket. With this information I could use the MAX7000 version of the ALL03 programmer to work out which waveforms to apply to which pins.I have added a JPG of the list of test pin names for the EPM7032 and EPM7064.If I or someone can find the same list for the EPM7128 then Imightbe able to help (in the longer term).

author: migry
author_rank: Regular Contributor
timestamp: October 28, 2020, 04:38:54 pm
content: Quote from: MadTux on October 26, 2020, 05:07:43 pmMy point was that adding the extra circuitry to convert the non-JTAG device to the new JTAG equivalent would add many more extra flops, as compared to the 32 which form the basis of the device as "seen" by the end user.To implement JTAG you need at least 4 flops for the state machine, one for the re-timing of TDO, at least 4 for the instruction register, 32 flops if you implement the Device ID register, plus any addition flops to tie into the old programming circuitry.From my experiments on the non-JTAG EPM7032 there are at least two shift registers each 10 bits long (so this requires 20 flops). So even in the non-JTAG design there are more "hidden" flops needed for programming, than the 32 which are used by the end user.[Edit: I originally said 16 user flops and not 32!]

author: bingo600
author_rank: Super Contributor
timestamp: October 28, 2020, 05:18:42 pm
content: @migryThat is some serious effort, put into reviving some old devices.I hope you have quite a few.Interesting read.Thanx for sharing/Bingo

author: ale500
author_rank: Frequent Contributor
timestamp: October 29, 2020, 02:21:50 pm
content: QuoteMine also come from China, fuse locked, (because I cannot read/program them with a USB Blaster, nothing found on JTAG). Maybe one of the pins is a JTAG enable pin...Firstly I saw that they came packaged in a reel and I thought maybe they are NOS or so (very naive from my part). After closer inspection... all chips have different date codes !I also bought several XC9572XL-vq64, those work great though.

author: migry
author_rank: Regular Contributor
timestamp: October 29, 2020, 03:03:13 pm
content: Quote from: ale500 on October 29, 2020, 02:21:50 pmMy limited understanding, with assumptions, is that for the JTAG devices, if you utilise the I/O's shared with the JTAG pins as user I/O, then of course the JTAG has to be disabled using some fuse. These parts cannot therefore be re-programmed using JTAG. If you do not use the JTAG shared I/O as user pins, then the JTAG remains enabled, allowing re-programisation. Perhaps the 12V on the Vpp re-enables the JTAG I/O. This is something which I will investigate in the future.In IC design, particularly for low pin count chips, where JTAG is used internally for chip scan test, do you dedicate 4 (or 5) pins to JTAG, so making less pins available for user I/O, or do you share pins and add some mechanism (normally a single TEST pin) to enable JTAG and allow chip scan test? Altera have given maximum flexibility here, and we might assume that the fuse to enable/disable JTAG is "new", i.e. it is not on the non-JTAG devices. We can select to use fewer I/O and have JTAG always enabled, or use maximum I/O but lose JTAG programmability once the chip is programmed.Having ordered cheap parts from China in the past: Flash ROMs and MC68000 DIL and PLCC, I am now aware of the problem of chip recovery and re-marking.The MC68000 DILs were 8MHz devices, remarked as 16MHz devices. I found out simply by removing the fake marking with IPA, which clearly revealed the original markings.The MC68000 PLCC did not work at all. Suspiciously they all had the same date-code markings, but the packages all differed slightly with respect to markings on the bottom and dimples. They were obviously remarked, possibly not even MC68000s. I got a full refund from the seller, who I will avoid in future.Of the 4 Flash ROMs, 2 worked and 2 did not program. All had identical markings and date code, so obviously re-marked, but the markings did not come off with IPA. My programmer essentially rejected the devices saying that the manufacturer ID was not Intel. I wondered whether the 2 devices which did not program were from another manufacturer, but I could not get them to program when I tried to select different chip vendors. I got a refund for the 2 "broken" devices. Whether I can trust the speed rating of the 2 "good" (and remarked) devices is unclear.Clearly all the above devices were re-claimed and were not NOS.BTW I have absolutely no issue with chip recovery, but I simply want the sellers to be honest. Some sellers might buy chips from the recovery companies in good faith, and there will be good and bad recovery companies. What really p*****s me off is when the chips are re-marked. What a waste of time. Given the low selling cost of the chips, why bother?So I will be interested to find out if the EPM7032S devices are genuine parts and if so, are they locked.

author: westfw
author_rank: Super Contributor
timestamp: October 30, 2020, 12:50:54 am
content: Quoteflip-flops in general are not "expensive", and the flipflops to make up the shift registers for basic JTAG access can be especially trivial (and may in fact be very similar to what is already there for the non-JTAG versions.)It's the fully-connected, fully-configurable flip-flops and their associated control logic and routing that make up one of the "Macrocells" that make them costly.(an SRAM is essentially flipflops, and you can get a million of them on a very cheap chip. REAL old-timers will remember that shift registers were used for microprocessor storage back when SRAM was "too expensive.")

author: migry
author_rank: Regular Contributor
timestamp: October 30, 2020, 01:25:49 pm
content: My EPM7032S parts arrived. 10 off. All have identical markings on the top, i.e. same date code. However on the bottom almost all parts are different, which absolutely confirms that they are NOT from the same lot, and therefore must have been remarked.Note: manufacturers use lot numbers and date codes to track "sets" of devices throughout the manufacturing process. Parts marked with the same date code are very likely to have come from the same wafers. They would have gone through assembly as a group and would have been processed by the same machines. I am unfamiliar with the machines which put the die in the plastic packages, but you should expect all devices with the same lot code to have used the same machine and therefore any package markings (top and bottom) and dimples should be identical.I will now test them to see if they are even EPM7032S devices.

author: TomS_
author_rank: Frequent Contributor
timestamp: October 30, 2020, 09:06:48 pm
content: Altera EPM devices and Atmel ATF devices are very similar it seems, so much so that Atmel released a tool to convert Altera .pof files to .jed so you can program a design into one of their own parts.If you use the JTAG pins as IOs, they can be re-enabled for programming by applying 12V to the OE pin.Presumably it would be similar on the Altera parts.How to clear the security bit is still to be discovered.

author: Rasz
author_rank: Super Contributor
timestamp: November 02, 2020, 03:38:25 pm
content: Thishttps://hackaday.com/2020/10/16/isastm-runs-vintage-cards-over-usb/might give you ideas about linking emulator with real world. Manawyrm used PCem and USB CDC-ACM serial connection to STM32.https://www.vogons.org/viewtopic.php?p=902486#p902486

author: migry
author_rank: Regular Contributor
timestamp: November 03, 2020, 02:09:29 pm
content: Hi @Rasz thanks for the pointer to an interesting read.I might just re-visit the idea of sending register writes from DosboxX via serial to the Arduino. I think that it might speed things up.My only concern is that using serial comms under Linux appears to be unnecessarily complicated, what with all these IOCTLs and function calls. On the Arduino (and small development systems) serial comms is a piece of p--s, but under Windows and Linux all the additional wrapping seems to overcomplicate things (IMO). Over the years I've written lots of serial comms code for microcontroller and uPs in machine code, without much of a problem. As soon as I even try to find example code for Windows and Linux I can't find something nice and easy to understand.

author: migry
author_rank: Regular Contributor
timestamp: November 04, 2020, 03:21:47 pm
content: Update.Using my homebrew perf board set-up shown below, I can connect up a cheap Chinese USB Blaster clone to the EPM7032S devices in PLCC 44 pin.| was pleasantly surprised to find out that all devices respond to JTAG and are blank. I must admit this was somewhat of a surprise, as I am still in no doubt that all 10 parts have been remarked. Some parts have a lighter colour of plastic and you can see where very black paint has been painted on top.Next I tried to program a part with a simple 24 bit counter. I was using Quartus 13.1I had the usual issue that it selects pin assignments for you first time around, and moved them to known adjacent pin positions. The strange this is that I see square waves on some pins, but not the ones which I chose. I have re-compiled several times in case something was out of date. The part programs and verifies correctly. I tried a second part and it behaved in the same way. I see the xtal divided output from the counter, but 1) on the wrong pins 2) lower frequencies on pins which I have not assigned (perhaps this is side effect of using macrocells?).Now scratching my head.

author: migry
author_rank: Regular Contributor
timestamp: November 04, 2020, 03:42:06 pm
content: Update #2.Silly me. It's all OK!I changed the "Unused Pins" option in "Device->Device and Pin Settings" from "As output driving and unspecified signal" to "As input tri-stated", and quickly saw that I had wired up the wrong part of the counter, so that I was outputting very low frequency square waves on the pins of interest.I updated the Verilog code, re-programmed, and the EPM7032S is now working as expected, outputting the correct square waves from dividing the xtal on the expected pins. Brilliant!

author: Rasz
author_rank: Super Contributor
timestamp: November 04, 2020, 05:04:33 pm
content: under linux talking serial is just opening file descriptor and writing/reading to it> cheap Chinese USB Blaster clonefx2lphttps://www.newioit.com.au/archives/159https://github.com/Wei1234c/FX2LPThis sems to have already implemented firmware for random GPIO access + glue python code

author: ale500
author_rank: Frequent Contributor
timestamp: November 04, 2020, 05:58:42 pm
content: Oh, you had more luck than I had :+1:The ATF parts look similar at least they have the same pinout for the PLCC84 variants. I found a forum post on the forums.6502.org about applying 12 V to OE1 to enable JTAG, but no docu as of yet. I'll try anyways. Thanks for the tip !

author: TomS_
author_rank: Frequent Contributor
timestamp: November 05, 2020, 07:56:47 am
content: Pinout is also the same for the 44 pin PLCC package too.

author: ale500
author_rank: Frequent Contributor
timestamp: November 05, 2020, 01:15:52 pm
content: It seems that I have no luck with this device. (EPM7128SCL84)1. I apply 12 V at OE1 (Pin 84).2. Apply 5 V at VCCINT/VCCIOs.3. Send JTAG command (blank check, verify, program). I see that the clock does not go to 0V (Transitions between 5 V and 4.5 V), as if the chip were driving high on TCK.I see No output on TDO.See trace: CH1 TCK, CH2 : TDI2nd test:1. Apply 5 V at VCCINT/VCCIOs.2. I apply 12 V at OE1 (Pin 84).3. Send JTAG command (blank check, verify, program). I see that the clock does not go to 0V (Transitions between 5 V and 2.5 V), as if the chip were driving high on TCK.I see No output on TDO.I tested the GND pins and they seem to be at the right locations: i.e. both internal GNDs are connected as well as the IO GND, so I assume it is a EPM7128.Something is missing, some other pins may need to be grounded or so.

author: migry
author_rank: Regular Contributor
timestamp: November 05, 2020, 01:26:51 pm
content: @ale500 - where did you get your devices from?During my many searches I have seen numerous messages from people wanting to clear the security fuse of the EPM7128S.On the EPM7032 I apply 12V to the OE pin which is Vpp. I think it's a pretty fair guess that OE on the 7128 will also be Vpp, but... until we get someone who has an adapter for the ALL03 programmer, we can't be 100% sure.

author: ale500
author_rank: Frequent Contributor
timestamp: November 06, 2020, 05:34:10 am
content: I got them from aliexpress: shenzhenYida Store.... I'll try to buy another batch from some other store...To which OE pin do you apply the 12 V ? OE1 or OE2 the 44 PLCC has both too. And how do you apply it ? could you please describe the sequence of steps ?

author: ale500
author_rank: Frequent Contributor
timestamp: December 10, 2020, 02:58:42 pm
content: I got to test all my devices (EMP7128S according to the markings). They fall into two categories: they do not respond to any command, even in "jatg debug mode", and the ones that say something like EMP7128DD_UNKNOWN when the IDCODE iteration test is used. (but nothing else).They do seem to use the JTAG pins as IOs. That would also prevent JATG from working...

author: CJay
author_rank: Super Contributor
timestamp: December 10, 2020, 03:41:30 pm
content: FWIW, I have a programmer which seems to support these devices but I'd need to hack together an adapter, happy to do so if it's just a wiring job.If you want to check the supported device list here:https://www.dataman.com/mwdownloads/download/link/id/6/I'm happy to erase a few chips if that helps?

author: ale500
author_rank: Frequent Contributor
timestamp: December 13, 2020, 06:47:03 am
content: Thanks for the offer !I think, "just" knowing how the programming, erase works, or where and how the 12 V are applied may just be enough. Shipping the chips and getting them back would be more expensive than buying a bunch of XC9572xl and making adapters for them. The versions in VQ64 actually work. The info could help some other folks too. What do you think ?

author: vvervvurm
author_rank: Newbie
timestamp: December 16, 2020, 10:16:27 pm
content: QuoteI have salvaged some EPM7064AE devices from old Cisco hardware. Although the security bit was not set - the JTAG was disabled. I could not access them with my USB Blaster. After reading this thread I mustered up the courage to apply 12.25 volts via 2.2k resistor to the OE1n pin (after the normal 3.3 volt VCC). Current draw on that pin was minute ( < 1mA ). Suddenly the JTAG worked and I was able to read and erase the device.So I would give it a shot. It could also work on 7000S devices I would guess.I hope this helps.

author: ale500
author_rank: Frequent Contributor
timestamp: December 17, 2020, 03:44:45 pm
content: @vvervvurm:Did you keep the 12.5 V during the JTAG transaction or not ?

author: vvervvurm
author_rank: Newbie
timestamp: December 18, 2020, 11:33:41 am
content: yes, VPP stayed on for the whole time ..(of course after erasing it was not needed any longer as normal JTAG was enabled again)I have only 2 samples .. so I was not brave enough to set the security flag and try to pull off the same trick again .. and as mentioned my parts are of the AE variety ..

author: vvervvurm
author_rank: Newbie
timestamp: December 18, 2020, 12:30:15 pm
content: @ale500You might have already seen this topic (near the end of the thread)https://www.eevblog.com/forum/fpga/atmel-atf150x-cpld-and-wincupl/So I think I was just lucky that my devices had no security bit set. Sorry for getting your hopes up.edit: The whole "100ms pulse" sounds very much like parallel programming mode as I can't think of a way for a timed pulse in JTAG protocol. (?)

author: Cyberbiotics
author_rank: Newbie
timestamp: February 24, 2021, 01:00:40 pm
content: Hi All! New to the forums.I purchased 20 EPM7128S MAX7000S devices and most of them didn't respond to the JTAG commands, I tried the +12V in OE1 method (Pin 84 in PLCC-84) in all of them with no luck. I tried both 1k and 2k7 resistors without voltage drop. Has anyone been able to reset the JTAG fuse in MAX7000S devices this way??Here you have some pictures of my devices, all of them were sanded with sandpaper and remarked, all of them same datecodes on top but different on the bottom of the IC. Maybe some of them werent MAX7000S devices but MAX7000 devices, which as someone stated before do not have the JTAG circuitry.Keep an eye for those counterfeits!

author: marcopolo
author_rank: Regular Contributor
timestamp: February 24, 2021, 01:19:19 pm
content: Ebay or Aliexpress?

author: Cyberbiotics
author_rank: Newbie
timestamp: February 24, 2021, 01:28:54 pm
content: Ebay, Polida. Bought new working ICs from him in the past but now they are selling these "fully functional" remarked ICs. I don't understand the reason why someone would erase good chip markings with sandpaper.I found an interesting vids about detecting counterfeit ICshttps://youtu.be/12u_hBkHB88https://youtu.be/k72SFBOZ_lw

author: CJay
author_rank: Super Contributor
timestamp: February 24, 2021, 05:16:25 pm
content: Quote from: Cyberbiotics on February 24, 2021, 01:28:54 pmPolida are bloody awful for fakes, remarked etc. Not only that they get *really* pissy when you leave them a negative pointing it out, I've been banned from buying from them and all their other ebay accounts.

author: marcopolo
author_rank: Regular Contributor
timestamp: February 24, 2021, 05:30:56 pm
content: Quote from: CJay on February 24, 2021, 05:16:25 pmLike all Chinese sellers (UTSource included)The only thing to do is to never buy from them.

author: CJay
author_rank: Super Contributor
timestamp: February 25, 2021, 10:20:07 am
content: Quote from: marcopolo on February 24, 2021, 05:30:56 pmEasy to say, damned difficult to do because the fake crap turns up everywhere, there's another thread here where I've a suspicion the OP has got a fake RF power transistor that he bought from a local store.I've been bitten by genuinely UK based sellers who've sold fake parts too.On balance I've had a more positive than negative experience but it's getting more difficult to avoid.

author: ale500
author_rank: Frequent Contributor
timestamp: February 27, 2021, 05:43:16 pm
content: Are you sure your chips are sanded down ? try with nail polish remover (acetone or ethyl acetate). Mine do not seem to be repainted but the 12 V on OE1 didn't help.Anecdote: I bought 8 27C400, I got 9 repainted TC5742000 (same size 256k x16). Sadly my MiniPro do not want to read them, read ID or anything... Most probably they are burnt somehow.En otras palabras: nos cagaron

author: ceteras
author_rank: Newbie
timestamp: March 11, 2021, 12:55:53 pm
content: Regarding 7000S series with JTAG pins used as IO:https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/an/an100.pdfPage 7, Table 2: Disabling IEEE Std.1149.1 Circuitry in MAX Devices.Here, in the rightmost column "Enabled for ISP and BST, Disabled During User Mode", we see for MAX 7000S :QuoteAm I wrong if I interpret this as a way to re-enable the JTAG if it was disabled by turning off the Enable JTAG BST Supportoption in the Quartus II software?I have one 44pin EPM7064S with disabled JTAG but can't test right now.Anybody else can give this a try? The pull up should be 4.7K and the pull down 1K.I'll try it later and come back.

author: ale500
author_rank: Frequent Contributor
timestamp: March 11, 2021, 02:41:47 pm
content: Are you sure ? , it looks like that is the way to disable the port. Anyways, the devices I have seem to have the pins repurposed as IOs.

author: Cyberbiotics
author_rank: Newbie
timestamp: March 11, 2021, 03:08:14 pm
content: Yes, it seems that now Polida is selling fakes. They asked me to smash the ICs... I opened a case and was fully refunded.Trying acetone in them removed a black oily substance that was masking the sandpaper imperfections. The device marking was very well done with laser engraving technique, but as could be expected, all devices had the same datecode. On the backside of the ICs older datecodes could be foundQuote from: ale500 on February 27, 2021, 05:43:16 pmI also tried the 12V in OE method, but it didn't work in any case.

author: ceteras
author_rank: Newbie
timestamp: March 11, 2021, 06:54:14 pm
content: I tried pulling the pins, didn't work.

author: TomKeddie
author_rank: Newbie
timestamp: March 25, 2021, 04:07:47 am
content: @migry awesome efforts on the non-jtag devices, I have the same problem. Seems like I should just ewaste them and use a bunch of 22v10s instead but I wanted to check what you ended up doing. Thanks Tom.

author: migry
author_rank: Regular Contributor
timestamp: May 02, 2021, 09:58:27 pm
content: I have put further work on a back burner for the time being, however I would very much like to spend some more time.The more I think about it, the more I like the idea of modifying DosBox to output the programmer "commands" to a serial port (USB RS232) as long as I can figure out how to do this inside DosBox. The serial output would connect to the Arduino Mega, which would be able to parse the data stream in order to set the pins and power supplies as just like the programmer would. The timings wouldn't be perfectly accurate, but hopefully would be good enough to get a response from the device.I will look into "erase" as this appears to be the action people need/want. I did buy 10 EPM7032 devices, so I can sacrifice one and program the lock bit. These particular devices are the later JTAG ones, and I have confirmed that I am able to program them using the cheap Chinese Altera USB Blaster clone.

author: ale500
author_rank: Frequent Contributor
timestamp: May 03, 2021, 01:46:20 pm
content: Is your USBBlaster clone's VCC pin 5 V tolerant ? Mine is not: internally has a level converter (A LCX245) that only accepts up to 3.3V supply voltage, I powered with 3.3V.

author: Rasz
author_rank: Super Contributor
timestamp: May 04, 2021, 12:03:12 am
content: wouldnt that depend on the clone? those based on EZ-USB FX2LP CY7C68013A should be 5v tolerant

author: ale500
author_rank: Frequent Contributor
timestamp: May 04, 2021, 07:30:48 am
content: My clone doesn't have a cypress chip, it has a FTDI, an Altera CPLD and the LCX245.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: September 20, 2021, 05:57:02 am
content: Quote from: migry on September 28, 2020, 09:36:01 pmEPM7032/EPM7064 in PLCC44 package have different non-ISP programming pinout?References:http://matthieu.benoit.free.fr/120.htm

author: c64
author_rank: Frequent Contributor
timestamp: October 21, 2021, 04:08:44 am
content: So, you found a dos software which talks to a programmer via LPT port. You are running it in dosbox and managed to intercept all requests it sends to LPT port. Is it correct? Now you need to send all data to the real MAX700 via com port.You could run it in virtual box which supports dos and can have virtual com port. Not sure it your LPT port hacking will work under virtual box

author: edevaldo
author_rank: Newbie
timestamp: October 21, 2021, 03:22:51 pm
content: QuoteYes it can. The security bit does not prevent erasing. But there is a programming option to disable JTAG and make the pins available for IO. Used devices, particularly in lower pin count packages, are usually programmed to disable JTAG. When this happens you need parallel (not the port) programmer like the hilo to put the device back in a erased state and make t he JTAG pins available.You are getting really close to it. Just fantastic.

author: edevaldo
author_rank: Newbie
timestamp: October 21, 2021, 03:32:13 pm
content: Quote from: migry on October 28, 2020, 04:38:54 pmA macrocell is a really complex piece of circuit. And you need high voltage circuitry to program each eeprom bit in the device and there may be hundreds or even a few thousand of them. Once read they may ned need to be latched somehow... For the different product terms you can select 16 or more inputs, then there is the expansion terms, optional routing, IO configuration, polarities, select clock and reset sources for the flops...The additional circuit for JTAG is nothing by comparison. CPLDs may be even worse than FPGAs, and they need thousands of transistors to implement each logic element.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: October 22, 2021, 01:41:25 pm
content: migry, I've tried to disassemble the AMAX70.EXE a bit and have identified the erase function. I can see the 10 42 08 21 84 10 42 08 21 84 pattern matching your log, the ReadID function sends it and receives 5x16 bits back from the chip. Those bits should contain an "ALTERA92" (for EPM7032) or "ALTERA93" (for EPM7032V) in some form. I could dig further if you share LPT pins to programmer regs mapping (don't want to dig into programmer schematics and PAL contents since you did it already).I can see some sequences looking like prommer regs accesses, i.e. write reg addresses to LPT DATA port, pulse INIT pin, write reg value to DATA port, pulse AUTOLF, but it would be much faster to reuse your info (i.e. reg addresses, who are all those E0, E1,E3 etc I'm looking at).Or you just followhttps://stackoverflow.com/questions/6947413/how-to-open-read-and-write-from-serial-port-in-cto access serial port from DOSBox and implement that bridging. Beware, there are two IC-specific delays (called Tbe and Tpg in AMAX70.EXE, looks like it gets them straight from the ID data), both affect some pulse lengths sent via reg E2. Not sure how critical they are.

author: fisafisa
author_rank: Regular Contributor
timestamp: December 06, 2021, 09:55:11 am
content: I am sitting on quite some of these (for now unusable) devices...Just an idea:Run dosbox-x in a PI and use the PI IO/pins to interface to the device to be programmed.Some voltage level shifting and possibly some IO expansion might be necessary but modifying dosbox so that every attempt to write/read from the HILO board is trapped has already been done successfully right ?Would it be possible to share the modified dosbox-x code...Ciao

author: migry
author_rank: Regular Contributor
timestamp: December 14, 2021, 07:58:15 pm
content: It's been quite some time since I last looked at this project, but it has not been forgotten.I have about 50 new EPM7032s, but no way to program them.Just recently I completed the following break out PCB. This will allow me to tidy up my breadboarded circuit.I am happy to share the DOSBOX code, although I need to check that it is still working now I have transferred all files to a new PC. If this board allows messaging, please contact me via that method.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: January 20, 2022, 07:33:03 am
content: Altera Classic devices, PROGRAMMING Pin-outs for reference.

author: Zapotec
author_rank: Newbie
timestamp: April 24, 2022, 10:05:24 am
content: Good morning !I need to program EPM7032SLC44 with files made by a project writte in Quartus 13.0.1. I need to use all pins, JTAG pins tooThe nice thing is that I have an (old) Elnec LabProg48LV programmer, that support this device. BUT.... its fail to program leaving the chip blank, after no error during programming, but (obviously) fails the verify.OK I bought an USBBlaster and made a off circuit only programming board.The problem is that in Quartus, when I try to program device, it told me that JTAG is disabled in project, closing programming window.I start from Menu Tools->Programmer, scan JTAG, found device EPM7032S, load .JAM file, program. All fine, device works .. but ! jtags pins still enabled (so don't make my project funtions).If I try to load .POF.... message : JTAG is disabled in file, can't loadIf I put +12V (by resistor) on pin44, Quartus program fails also to find (jtag scan) the (blank) 7032S device in home made programmerHave some idea ?And wy my Elenec (but I try also with a newer one) falis to program the device (also fail Chip ID .. but is a known problem reported by Elnec).One Thousand dollars questionthanks

author: GTT95
author_rank: Contributor
timestamp: June 01, 2022, 04:29:51 pm
content: Hello,I'm facing quite same situation.In my EPM7128S based design I need all 84 IO pins for the expected function.However, I need the ISP feature to be available so that I can reflash CPLD's EEPROM while it is already mounted on the target circuit.So my question is: once flashed and JTAG pins assigned to functionnal IO, is there a way to take back control over those pins so that the chip can be reflashed? Or is a "special" (non JTAG) programmer required to "factory reset" the chip and make the JTAG specific pins usable again for reprogramming?Thanks a lot.

author: marcopolo
author_rank: Regular Contributor
timestamp: June 01, 2022, 04:53:14 pm
content: That's not possible, you need a LP6 ISA board + PL-MPU+ PLM7000-84 AdapterThis is the problem that many people who buy Altera CPLDs on Ebay encounter.Perhaps you can use a FLEX10K FPGA.Marc

author: GTT95
author_rank: Contributor
timestamp: June 02, 2022, 07:04:00 am
content: So only by keeping the 4 JTAG pins as dedicated to the ISP function I can continue in-circuit reflashing?My understanding is that devices from ebay may not be blank leading to the unability to in-circuit reflash through JTAGThe FLEX10K might be a good alternative. However the ratio between max user IO ant total pins is lower than MAX7000S series (only 66 IO for 100pins devices). Other drawback is a serial configuration Flash is required which adds an extra component to the design.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 02, 2022, 09:03:56 am
content: Quote from: GTT95 on June 02, 2022, 07:04:00 amYou can use a parallel PROM, although more pins, it can be multiplexed after configuration done as user I/Os (serial PROMs still the same, but not so ubiquitous as parallel ones).

author: GTT95
author_rank: Contributor
timestamp: June 02, 2022, 10:25:56 am
content: Are you refering to my last remark about configuring the FPGA? Was not aware it can be configured from parallel Flash. Anyway, there will still be limitation to 66 pins IO which will force selecting a higher FPGA with more total pins.

author: marcopolo
author_rank: Regular Contributor
timestamp: June 02, 2022, 11:31:07 am
content: Quote from: GTT95 on June 02, 2022, 10:25:56 amAnd what is the problem?Could you not use a 144-pin TQFP EPF10K10 with 102 I/O?http://marc.retronik.fr/tmp-mj/AN116_Configuring_Flex6000_et_Flex10K.pdf

author: GTT95
author_rank: Contributor
timestamp: June 02, 2022, 12:44:14 pm
content: A 144 TQFP means more than twice that much area and I am very restricted in PCB size.

author: marcopolo
author_rank: Regular Contributor
timestamp: June 02, 2022, 01:21:46 pm
content: To stay under 100x100 mm for a cheap PCB?

author: GTT95
author_rank: Contributor
timestamp: June 02, 2022, 04:17:43 pm
content: Could be but actually reason is it is constrained by credit card size PCB.

author: marcopolo
author_rank: Regular Contributor
timestamp: June 02, 2022, 04:28:56 pm
content: Why use old 5V circuits?

author: GTT95
author_rank: Contributor
timestamp: June 02, 2022, 04:58:00 pm
content: Because the design has to interface with a system delivering 5V TTL levels. Using a 3,3V device would require level translators through resistor based voltage dividers or other kind of ICs.

author: marcopolo
author_rank: Regular Contributor
timestamp: June 02, 2022, 06:32:43 pm
content: Quote from: GTT95 on June 02, 2022, 12:44:14 pmPLCC-84 30x30 mm (without socket)TQFP-144 23x23mmTQFP-144 area is 60% of the PLCC-84 area.it leaves room for a serial configuration memory.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: June 02, 2022, 10:59:13 pm
content: Can't you retarget to a ATF1508AS? as described in Atmel’s Application Note 0916, orhttp://avitech.com.au/?page_id=3195

author: GTT95
author_rank: Contributor
timestamp: June 03, 2022, 08:06:44 am
content: QuoteAgree, but the comparison was against the TQFP-100 version of EPM7128S. PLCC-84 version doesn't provide 84 user IO.QuoteWas not aware of this Atmel equivalent. What benefit is there from using the Atmel CPLD? There are still 84 max IO pins. My guess is that I will experience same limitation while using the JTAG pins for ISP, preventing their reuse for functionnal IO.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: June 03, 2022, 11:30:50 am
content: The biggest benefit is that it's still in production, so you don't have to depend on the used market. It's also less power, more erase cycles and its jtag can be re-enabled by putting 12 volts on OE pin.https://www.hackup.net/2020/01/erasing-and-programming-the-atf1504-cpld/.There might be details that don't fit your use case, they are listed on the original atmel apnote.

author: GTT95
author_rank: Contributor
timestamp: June 03, 2022, 03:19:23 pm
content: That sounds good. And also better documented about how to perform reprogramming. Let's know if it can be synthesized from Quartus II 9.0.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 05, 2022, 11:05:09 am
content: Quote from: GTT95 on June 03, 2022, 03:19:23 pmYes, MAX 7000S/AE/3000A, FLEX 10K/KA/KE are supported up to Quartus II 13.0.

author: GTT95
author_rank: Contributor
timestamp: June 06, 2022, 06:24:30 pm
content: OK, but what about ATF1508AS? Seems not to be available as target device.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 08, 2022, 03:11:15 am
content: Quote from: GTT95 on June 06, 2022, 06:24:30 pmATF1508AS can be converted from EPM7128S/AE by Microchip POF2JED.

author: GTT95
author_rank: Contributor
timestamp: June 08, 2022, 08:59:32 am
content: OK thanks, good to know synthesizing ATF1508AS from Quartus is only a matter of file format.

author: c64
author_rank: Frequent Contributor
timestamp: June 12, 2022, 03:38:01 am
content: Anyone know cheap programmer for ATF1508AS ? I'm not aware of any cheap clones on eBay. Programmer for Altera parts can be bought under $10

author: c64
author_rank: Frequent Contributor
timestamp: June 12, 2022, 03:39:17 am
content: Some people report that the same trick with 12v on OE pin (with series resistor) also works on MAX7000s. I haven't tried

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 13, 2022, 04:42:25 pm
content: Quote from: c64 on June 12, 2022, 03:38:01 amAny JTAG debugger with SVF support, such as J-Link, CMSIS, FT232, USB Blaster, ByteBlaster, Platform Cable, etc.

author: GTT95
author_rank: Contributor
timestamp: June 21, 2022, 01:26:08 pm
content: QuoteIs it specific to one version of ATF150? Schematic here:https://www.hackup.net/2020/01/erasing-and-programming-the-atf1504-cpld/has the alternate feature Vpp labelled for /OE1, however, the datasheet specifies only /OE1/I?

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 21, 2022, 04:27:45 pm
content: Quote from: GTT95 on June 21, 2022, 01:26:08 pmNo programming information is available from the datasheets. Only programmer manufacturers had the access to them, so just do some reverse engineering!

author: GTT95
author_rank: Contributor
timestamp: June 22, 2022, 01:43:25 pm
content: Maybe applying +12V to /OE1 through resistor and measuring the voltage on this pin. As regular Inputs shall have clamps, measuring +12 V would mean it is OK to accept Vpp, and not accept if mearuring +5V.

author: ale500
author_rank: Frequent Contributor
timestamp: June 23, 2022, 04:21:08 am
content: I'll try that with the MAX7128S I got from ali...

author: ale500
author_rank: Frequent Contributor
timestamp: June 23, 2022, 01:19:00 pm
content: When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE1 (PIN 84), I measure 11.97 V at PIN 84.When I apply ~12 V through a 2.2 kOhm resistor (12.10 V) to ~OE2 (PIN 2), I measure 12.10 V at PIN 2.Could it be that it needs 12 V on both pins ?... That I didn't try before.When I apply 12 V to both PINs TDO changes from HIGH (~5 V), to LOW ~ 0 V.Nothing, the chips are still not being detected

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 23, 2022, 01:47:34 pm
content: Quote from: ale500 on June 23, 2022, 01:19:00 pmYou entered the parallel programming mode of Altera.

author: GTT95
author_rank: Contributor
timestamp: June 23, 2022, 02:34:47 pm
content: QuoteDoes it mean to stay in serial JTAG based programming mode only /OE1 shall be put to 12V. Or is it specific to ATF150X devices?

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: June 23, 2022, 04:13:07 pm
content: Quote from: GTT95 on June 23, 2022, 02:34:47 pmMAX 7000AE/3000A/ATF1500 specific, these families are JTAG only.

author: migry
author_rank: Regular Contributor
timestamp: August 10, 2022, 01:53:31 pm
content: I am the original starter of this thread.To recap, I have a bunch of NON-JTAG EPM7032/EPM7064/EPM7128 devices, obtained when there was a lab clear out of non-ROHS devices.I have used GALs in a number of recent projects for which I have had PCBs made, and it would be nice to use these CPLDs in future projects. However I do not have a programmer for the MAX7000 devices.I mentioned that the ALL03 programmer has been reverse engineered and information is available on the "benoit" website. I am able to run the programming software for the ALL03 in DOSBOX. The programs are DOS EXE files and use character graphics, as was common in the late 80's and 90's. Each device type has it's own EXE. There are several EXEs to support the Altera CPLD parts.Last year I worked on an 8088 based IBM PC XT clone PCB/project. I needed a BIOS and found a disassembly of the Tandy1000 BIOS on GitHub. The author used a tool called "IDA Pro" to do the disassembly. It is an intelligent disassembler. there is a free version of this tool available for download. I downloaded and "had a play". As usual there's a learning curve.Just recently I had the idea to re-visit the MAX7000 project with the idea of looking at the EXE code, so see if the programming algorithm could be determined.I made a false start by using the wrong EXE ! I stated with the EXE which allowed the ALL03 programmer to program the EPM7064/96/128. Nevertheless it was a useful introduction to IDA Pro (Free). The biggest frustration is forgetting to click to select the current line of disassembly before assigning a label. Firstly the EXE is compressed using PKLITE, so I had to find a tool to remove this compression. Having done this the new EXE loads into IDA Pro and the tool does lots of work with no input needed. At the end of the file you can find lots of text strings. Some decompiled as strings, and others which are a list of bytes (not yet referenced by the code). It is also possible to search and find the I/O out and in instructions. I spent quite a few hours over the course of a week playing with the tool and adding labels and defining data types. I started to see code (C switch?) which used the selected device type and jumped to different code depending upon the device selected in the simple GUI. Then the penny dropped, I was looking at the wrong EXE.So I found the EXE which programmed the ALL03 for the EPM7032 only, and I started a new IDA Pro project. I was able to make quick work thanks to the knowledge already gained. I now started to see where the strings seen in the data section of the EXE were referenced, so the subroutine call could be assigned a readable name. I didn't understand what all the parameters do, but that is not necessary. This helped figure out where other stuff was. I then found the code for the main menu. When running the code (in DOSBOX) a single character selects an action. I found the jump table which mapped character pressed to subroutine. Interestingly some characters vector off, but they are not seen in the GUI on-screen. I don't know what they do, but at the moment this is not of interest.I also downloaded the "debug" version of DOSBOX. This version of the code allows writing a trace file, which shows disassembly of the instructions as they are executed and gives a register dump. I was able to use grep and vim to process this file to extract all the I/O instructions, where the code speaks to the two ports on the PC ISA card. This gives a pretty clear picture on how the hardware is sequenced. Again thanks to the "benoit" website, the mapping of ALL03 pins (there are 40) to the pins of the EPM7032, are known.When I run the EXE I get the message "Error Identification on hardware". Thanks to having schematics of the PC ISA card, and some example C source code (which allows users to write there own driver software), I realised this came from checking the magic counter in the PALs on the ISA card. IDK but perhaps it is a simple form of copy protection? I was able to find the code and hack it to return a "pass" result.When I run the EXE and now get into the GUI and select the ERASE operation, I get the error message "ID code ERROR !". This string appears several times, but I was able to find it in code related to the 'E' (ERASE) command. After quite some effort I found the function which returned a Boolean false and triggered the message. I hacked the code to fix this too. When the code was run again, the programming software did "more stuff", so having the fail result, due to no real device in a socket, gives an incomplete DOSBOX trace file. I figured out that the first thing that the programmer does is try to determine if there is an ALTERA device in the socket. It does this by applying a stimulus, grabbing the resulting 160 bits, "fiddling" with them in some way, then comparing the resulting 9 bytes to an array of 10 strings, the first of which is "ALTERA92". If no string match is found the "ID code ERROR !" string is the result. By now I think(!) that I know how to stimulate the EPM7032 part in order to get the identification string response. Now over to my hardware to see what happens in practice.

author: migry
author_rank: Regular Contributor
timestamp: August 10, 2022, 02:17:58 pm
content: If you have no familiarity with the ALL03 programmer, this will make no senseBTW there are currently a couple of ALL03 programmers for sale on Ebay US, both around $500. If I lived in the US I would probably just bid on one of these and save a lot of my time!Any for those interested in the EPM7032 and how the device identification string is "accessed", please read on.The device VCC is powered to 5V. The NTPW pin is set to '1'. I'm unsure if it needs to already by '1' during power up, but the programmer sets it first before enabling VCC.Vpp is ramped to 12V. I am pretty sure that this puts the device into test (or programming) mode where the user settings are switched off and various pins are put into input or output mode for programming purposes.The 7 "ADDR" pins are forced with the value "0x7C". I have no idea why, or what these pins do, but I guess that the address selects different blocks of EEPROM.Then 80 bits are shifted into SDINA and SDINB (the same data) using SCK (SCK is normally used for the name of a shift clock). The data shifted in is "00001" repeated 16 times.Next data is shifted out using SK in blocks of 16 bits. The data on SCOA and SCOB is captured. I believe that this data stream should contain the device identifier (ALTERA92) coded in some way.After each 16 bit clock SCK is clocked.There are 5 blocks of 16 so 80 x 2 = 160 bits are shifted out and captured.So over to my hardware.I recently made a EPM7032 PLCC to DIL breakout PCB. I now find that I got the pin out incorrect and the PCB is uselessSo back to the old hardware, which uses a hand wired perf board, a breadboard for two DACs (VCC and Vpp) and a MEGA 2560 for control.So I modified the code to apply the newly determined sequence.I power the device on, ramp Vpp, do the toggling of SCK and CK clocks and drive SDINA/B and then ramp down Vpp and power off. In the Arduino code I loop on this sequence in order to look at the signals using my Rigol scope. The good news is that there is genuine serial data, the bad news is that it is random for each read. I must be missing something which resets the sequence.

author: migry
author_rank: Regular Contributor
timestamp: August 10, 2022, 02:22:19 pm
content: Some waveforms captured using the Rigol scope.The good news is that I get a digital serial stream shifted out from SCOA and SCOB. SCOA is always zero, but SCOB waveform/data changed from run to run.

author: Rasz
author_rank: Super Contributor
timestamp: August 11, 2022, 02:51:15 am
content: Quote from: abyrvalg on October 22, 2021, 01:41:25 pmQuote from: migry on August 10, 2022, 02:17:58 pmwhich is it?also have you compared to ATF1502 A1500.exe?

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 11, 2022, 11:56:16 am
content: Quote from: Rasz on August 11, 2022, 02:51:15 amATF15xx (ISP) CPLDs only have JTAG programming, when JTAG is "disabled" it can be re-enabled by Vpp high voltage.

author: migry
author_rank: Regular Contributor
timestamp: August 11, 2022, 02:46:05 pm
content: QuoteThey are the same pattern.SDINA is the top trace in the third picture (above). You can see the 00001-00001-00001- ..etc.. sequence applied to SDINA (same is applied to SDINB). It is clocked in by "SCK" (bottom trace).In the software the data is shifted in, in 16 bit chunks, stored as 16 bit words in a table. The values shifted in are: 0842-1084-2108-4210-8421.It's the same bit pattern.The data read back on SCOA and SCOB is shifted out by the clock "SK", with a pulse of "SCK" every 16 clocks of "SK". The relationship of the two clocks are shown in the Rigol screen grab.

author: pityokas
author_rank: Contributor
timestamp: August 16, 2022, 10:42:48 am
content: Hi, I'm try to figure out the pin-out for MAX7000 PLD-1 PLCC84 Beeprog.Almost done, except last part of memory read incorrectly (wrong and repetition of data)Maybe with combined information we can figure out what pins used for last part of memory and not involved in fist part.Last part meaning from 0x6E00 (1bit) or 0xDC0(8bit) from total of 0x732F/0xE6F(8bit) for EPM7064 plcc84I guessed will be same as parallel eproms addressing but it's not.Attaching a read of epm7032S read in parallel mode.For 7064 almost identical except using more pins. Don't 100% trust on data because I have to make an experimental 48bit logic analyzer (FX2LA+CPLD) and I'm not sure if everything working but promising.Use pulseview to open files.

author: vvervvurm
author_rank: Newbie
timestamp: August 16, 2022, 10:42:05 pm
content: @migryQuotemaybe the real programmer has inverted logic? It could explain the random output of the chip. maybe have a look if the data changes on rising or falling edge of the clock signal?

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 17, 2022, 09:58:13 am
content: Quote from: pityokas on August 16, 2022, 10:42:48 amThis pinout?

author: migry
author_rank: Regular Contributor
timestamp: August 17, 2022, 12:57:01 pm
content: Quote from: pityokas on August 16, 2022, 10:42:48 amHi Pityokas, I was confused about what information you were asking for help with.My interpretation was that you have a Beeprog programmer (nice programmer unit supporting lots of ICs!) and you are trying to figure out the mapping from the ZIF socket to the pins of the EDPM7064 device?While following various links I diid find an adaptor for this programmer for the EPM7032 (I recall) which was around $70. I thought that this wasn't bad value, as I have seen adapters (for various ICs) sell for hundreds of dollars for other programmers.If I understand better what you are trying to do I may be able to help. I can run the EPM7064 software (A70X.EXE) in my DSBOX emulator, and I can collect some waveforms similar to the ones you collected.I did look at your waveforms for the EPM7032 and there was a lot of things which looked familiar. Since the trace was quite long I got a little lost. If you were to capture another trace, such as ERASE, which is quite short, I can do the same thing, and we can compare waveforms?

author: migry
author_rank: Regular Contributor
timestamp: August 17, 2022, 01:35:58 pm
content: Quote from: vvervvurm on August 16, 2022, 10:42:05 pmHi @vvervvurm,I have actually made some progress with the read out of the device ID "serial bit stream", since my last (big) posting. BTW my programmer is home made and is based around an Arduino Mega 2560 running custom C code.I have DAC control of VCC and Vpp (or Vpg - the high voltage ~12V programming voltage). The circuitry is based around cheap Arduino MCP4725 modules, an OP-amp and a couple of transistors.So in the past I have made the mistake of continuing to "flog a dead horse", i.e. I have tried to debug a chip which is dead, but which I assumed was workingSo I realised that I needed to try some other devices. I had a few at hand. Here is the summary1) EPM7032LC44-10 : original device, SCOA/B shows serial data but changes from run to run (involves a complete power down).2) EPM7032LC44-12 : also show random serial data, but is more biases to a string of ones.3) EPM7032SLC-44-10 (*) : a "newer" device which has JTAG pins - denotes by the "S" in the device code. Seemed to have no activity on SCOA/B.4) EPM7032VLC-44-12: a 3.3V device (denoted by the "V" in the device code). Bingo. A stable and repeatable bit stream from SCOA and SCOB.I tried my "read" code and I got stable results but the data looked suspiciously similar to the device ID from address block 0.4) EPM7032VLC44-12 (**) : also a 3.3V device. Device ID data stream works. Same as the previous "V" chip. The "read" code reads back all address blocks as 80 '1's (all FF == blank).(*) This device was bought from China. It has laser markings. I did try one using a JTAG programmer and it did program and work.Just FYI I have bought a number of counterfeit devices (e.g. MC68000, i8088) which originate from a China. The giveaway is that the tops have been sanded down and they have been remarked using laser etching. All my other genuine EPM7032 devices have the text printed in ink. I wanted to see if the JTAG parts could be programmed (or ERASEd) in old-style parallel mode.(**) This device is black topped. It is a 100% genuine Altera part (I know it's providence). This used to be a trick of the Chinese counterfeiters, until they moved to laser etching. I have a MC68HC000-16 device which came from China via Ebay (yes let the buyer beware). I was able to use IPA to remove the fake ink markings and beneath I found the original Motorola markings of MC68000-8, so not HC and not 16MHz.Black topping can be found on genuine devices, but it is of high quality as you might expect. Back in the day (80's/90's?) in the UK RS Components (our Digikey/Mouser) used to sell common ICs such as 7400 LS TTL devices which were black topped and marked with their logo. These were genuine full spec devices.So success with the 3.3V devices, but not the 5V devices.I now tried to make sense of the bit stream on SCOA/B, and went back to the IDA Pro disassembly. I found code which manipulated the bit stream. It took some time to figure out what was happening, and I wrote some C code to replicate the machine code in order to play with the bit stream. In one of those "wow" moments a string "ALTURA93" appeared. Close enough, but after editing the code all that appeared was garbage. After many more hours I found the issue, in that I needed to extend and zero the input array.For those interested. Each serial out generates 80 bits. in the data area of the code there is an array with 80 elements. It is filled with numbers from 0 to 79 in a logical order (0,5,10,15, ... 70,75, then 1,6,11,16, ... finally 4,9,14, ... 79). It is used to unscramble the 80 bits and create a new string of 80 bits with them simply re-ordered. The "set of 5" appears regularly and must have some relation to the hardware.I have attached a screen grab showing the captured 16 bits values on SCOA/B and SDOUTA/B (5 * 16 = 80 bits each), and the output from my C code.I have also attached a grab of the strings embedded in the ALL03 A70X.EXE code. There are 8 strings, which are compared against the descrambled bit stream. The ALTERA93 corresponds to the "V" 3.3V device.

author: migry
author_rank: Regular Contributor
timestamp: August 17, 2022, 05:46:52 pm
content: So I have been doing some more digging into the disassembly from IDA Pro.Strings are pretty easy to find and many appear automatically on the first pass of IDA Pro. I saw that there is text which makes up the main menu/screen, but includes text for commands which are not printed on the screen. I also found the code which processes the keypress from the main screen/menu and there is table of jumps for every key in alphabetical order, which jump either to a subroutine or a blank. Again I noted a number of characters which are not in the main menu, but have code associated with them. I bit more investigation revealed that a location/flag is checked and if 0 the code is not executed. So I looked for where this location is changed, and turns out only in one place, the code associated with the "U" menu command (does not appear in the screen/menu). When I ran the code in DOSBOX and pressed "U" nothing of note happened. It took some more looking around and a bit of guess and finally if I press "u" followed by "I" followed by "u" the extra commands appear on the main menu/screen (see attachment). There is now a command to read and display the device ID. In Windows when I run the programming software (AMAX70.EXE) since there is no ISA card hardware, nor programmer, the program displays some error messages. So I hacked the binary to fool these checks and the program now executes code that otherwise wouldn't be, allowing me to get a clearer picture of the code execution using DOSBOX trace. The new "Read ID" command displays garbage since it probably sees all ones when reading the the SCOA/SCOB I/O port.So now over to my Linux VM. Here some time ago i downloaded the DOSBOX-X sources and was able to compile and build a binary. I then proceeded to add my own module, which emulated 1) the ISA card and PALs 2) the ALL03 programmer registers, and 3) the EPM7032. Now that I know the serial bit stream for reading the device ID for a EPM7032V device, I added this emulation into my module. Now when I run the binary, I can enable the "hidden" commands with "uIu" and I can execute the "I" command (Read ID). The 3rd attachment shows the result, and confirms that I managed to get the emulation of the serial bit stream correct. Note that this bit stream also contains two non-ASCII bytes which define: Vpg - the high programming voltage (AKA Vpp) ; Tpg - the width of the programming pulse for writing a block; and Tbe - the width of the pulse for doing a bulk erase.Both my EPM7032V devices give slightly different values for the 2 bytes defining these values, however the "ALTERA93" ASCII part is the same.BTW I have just noticed that in the Linux binary the YELLOW text shows different information, so I will need to investigate why using the IDA Pro disassembly.

author: pityokas
author_rank: Contributor
timestamp: August 18, 2022, 08:32:34 am
content: Quote from: Beta_vulgaris on August 17, 2022, 09:58:13 amUnfortunately that picture is not 100% correct.If we considering the plcc44 wiring corect then for EPM7064-84:A2 and A5 is at 49 and 41 and the picture says AD6 AD3pins 10,29,56,75 are SDOA,B,C,Dplcc pin44(A6) -> PLCC84 picture says GAD0And pin 12 used at initialization so cannot be LOr my adapter is totally wrong.Also 7128 use more data lines at different pins so EPM7064=7096=7128=7160 it's not trueThe programmer require a different adapter for 7128 and 7192 and same for 7064 and 7096Quote from: migryYes!The PLCC84 PLD-1 cost 180usd, ok its using high quality zif but...I inspired my adapter from herehttps://blog.system11.org/?p=2999, unfortunately was different for beeprog but counted the totally used pins and was exactly 48, so I made my adapter started from pin 1 until all connected, first tested with scope, the important pins VDD,GND VPP was at right position, also the JTAG pins, so tested some EPM7000S and one 7064, at first the 7064 generated some error but after erase was fine so considered was just a temporary error and put everything int box and forget about, until recently when really needed and got error again with another EPM7064 so started to dig deeper.And now some research what I found:Today made one random project for EPM7064-84, generated a pof file programed my PLD and got no error after verify, now where is the problem?Interestingly an empty EPM7064 return a lot of 0 from address 6E00 but the programmer still saying is perfectly empty, odd...Also the pof file bites are not linearly arranged in PLD, maybe vertically?Changed the very first 2 bites to 0, the first 0 bit are at first reading the second after 5th reading(one reading return 16 or 17 bit).I think the algorithm depend on ID, I made a dumb read(without chip) and got different scheme, like an old EPROM, clearlyvisible A0,A1...A6 (000 001 010 011 ..)Quote from: migryOk I will make some but I have only one EPM7064-84 the other are with S, I will order some 7032 without S from ali, let see.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 18, 2022, 08:58:42 am
content: Quote from: pityokas on August 18, 2022, 08:32:34 amhttp://matthieu.benoit.free.fr/all03/adp-7064S-PL84/http://matthieu.benoit.free.fr/120.htmhttps://forum.system-cfg.com/viewtopic.php?f=18&t=13192My adapter is compatible with all MAX 7000 PLCC84 packages for ALL-03?

author: pityokas
author_rank: Contributor
timestamp: August 18, 2022, 09:41:57 am
content: Quote from: Beta_vulgaris on August 18, 2022, 08:58:42 amNo really help because no names on pins just connection so I can't identify after waveform.But found interesting, only the SDOABCD pins are connected to pullup, maybe not needed in programming.Quote from: Beta_vulgaris on August 18, 2022, 08:58:42 amThey talking about enable MAX7000S JTAG, I don't have problem to program any S type PLD.All MAX7000S compatible because using JTAG pins, but the MAX7000 are not!

author: pityokas
author_rank: Contributor
timestamp: August 18, 2022, 11:29:40 am
content: Quote from: Beta_vulgaris on August 18, 2022, 09:51:44 amOk let explain what I know and what no from this schematic compared with my adapter and my waveform:Clocks: Pin 31,79,83 buffers, probably clock,ok, match my waveform.SCO-s: Pin 4,23,62,81 trough 244 output, match my waveformSDI-s: Pin 20,39,46,65 trough 244 input-> matchSDO-s: Pin 10,29,56,75 pullup, my waveform at initialization are all 4 set to high -> matchMissing: Pin 36,37,41,44,48,49,71 and some others,there are directly connected to zif, how to determine the position?Maybe if migry generate a valid waveform for my epm ID, I can compare else this schematic not help more.BTW my EPM7064-84 ID: 41 4C 54 45 52 41 39 37 A3 01 00 00 00 (ALTERA97) A301 probably revision and programming info

author: migry
author_rank: Regular Contributor
timestamp: August 18, 2022, 12:36:30 pm
content: I have been looking at this schematic and using it to try to emulate the epm7064 in my DOSBOX-X code base.I think that pin 1 of the ZIF is incorrect. PLEASE SEE BELOW, this was written before thinking more fully (sorry!).It is labelledpin35(not apparently used for programming), but I think that it should bepin25, which isAD0. SEE BELOW (the adapter diagram could be incorrect ?).ZIF pins 1 to 7 were AD0 to AD6 for the EPM7032, but once I had mapped the pins, I saw that AD0 of the EPM7064 was not connected.Pins 1 to 8 map to ALL03 register "E0" and was used for the ADDR bus on the EPM7064 and I would assume that this was not changed for the EPM7064.ADDED LATER: Apologies. It could be the picture of the pin out of the EPM7064 which is incorrectly labelled. In other words perhaps pin 35 is AD0, rather than pin25 ?I now also note that pin 21 of the ZIF connects to SS_BI (waveform is the same as SS on the 7032).The diagram of the adapter shows SS_BI on pin 73, but the schematic shows this pin going to pin 77 of the 84 pin PLCC device.I note that BE is on pin 6 according to the adapter diagram, but I see no control of this from the schematic (just a pull-up).In the schematic I see pin 19 of the ZIF socket connects to pin 69, but in the adapter diagram this does not show a test purpose.In the schematic I see pin 36 of the ZIF socket connects to pin 16, but in the adapter diagram this does not show a test purpose.In the adapter diagram the boxes coloured GREEN seem to indicate something special, but pin 16 shows no test purpose, ditto for 35 and 69.It just makes me wonder if 16 is BE, 35 is AD0, and 69 is SS_BI or TM ?I wonder if it possible to determine which diagram is incorrect ?

author: pityokas
author_rank: Contributor
timestamp: August 18, 2022, 01:02:53 pm
content: Pins 25 and 35 not seems to be used.Use this for input simulation.Do not skip the ID check, let the program decide what to do with information!The vpp is still not connected. I did not make an input circuit for high voltage

author: migry
author_rank: Regular Contributor
timestamp: August 18, 2022, 01:20:39 pm
content: Quote from: pityokas on August 18, 2022, 01:02:53 pmI'm pretty sure one of these two pins is AD0.You would need to do a blank checks, which increments the address by one, to confirm.BTW I am still unclear as to your setup. Can you take a picture for clarification?Am I correct in understanding that you have a BeeProg programmer which you are using to capture the waveforms from?Have you made a home-brew adapter fro the 40 pin ZIF to the 84 pin PLCC ?Is this what you are trying to debug ?

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 18, 2022, 01:32:16 pm
content: Quote from: migry on August 18, 2022, 12:36:30 pmI recalled that the inner ring was EPM7032,NOT 7064? I forgot where I saw it.

author: pityokas
author_rank: Contributor
timestamp: August 18, 2022, 01:35:51 pm
content: QuoteYesQuotePLCC84 to ZIF48And yes I'm try to debug my adapter.

author: migry
author_rank: Regular Contributor
timestamp: August 18, 2022, 02:26:28 pm
content: Quote from: Beta_vulgaris on August 18, 2022, 09:51:44 amIs this your work at reverse engineering the adapter socket?Or do you know who created the schematic?At this point in time I am leaning towards believing this schematic, and thinking that the pin out (rectangle) diagram has some bugs.Nevertheless I wonder where the person who created the diagram got the test pin names from?Note: the 7032 only has SCOA/SCOB, where as the 7064 has SCOA/B/C and D.This ties up with the fact that the ALL03 has an executable for the 7032 (only) and a different executable which supports the 7064/7096 and 7128.The former "knows" about 2 serial read channels and the latter 4 (I will check my disassembly of the latter code to confirm).

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 18, 2022, 03:24:33 pm
content: Quote from: migry on August 18, 2022, 02:26:28 pmhttp://matthieu.benoit.free.fr/120.htmhttp://matthieu.benoit.free.fr/all03/adp-7064S-PL84/

author: migry
author_rank: Regular Contributor
timestamp: August 18, 2022, 07:26:33 pm
content: Quote from: pityokas on August 18, 2022, 01:02:53 pmI have had a look at your traces, and I have found it difficult to understand them. The software used by the BeeProg might well stimulate the device in a different order.Interestingly I see 3 pins which are unlabelled on the adapter diagram, but could be SDOUTB, C and D. Not that these pins show anything of interest anyway!I have created a version of DOSBOX-X with an emulation of the EPM7064 device, and traces based around the pin mapping from the schematic (and some from the diagram). It isn't working in that the EPM7064 is not recognised, so the ALL03 software does not proceed further. The first thing that it always does is look for the device ID. For some reason it is not being seen, even though I am generating the same serial bit stream on SCOA as was done on the EPM7032.Here are the traces. One difference between these and yours is that I see activity on "SS_BI" and yours is always zero.NOTE: I may have some pins labelled incorrectly due to not knowing if the adapter diagram labels are correct.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 19, 2022, 12:31:59 am
content: Quote from: migry on August 18, 2022, 07:26:33 pmSome of the inner labels are for EPM7032, I remembered, if I were correct.

author: pityokas
author_rank: Contributor
timestamp: August 19, 2022, 04:39:01 am
content: Quote from: migry on August 18, 2022, 07:26:33 pmInteresting why SCOA=SCOB=SCOC=SCOD?SCO is output, from where you get the data?Also I don't understand why bee using 17 clock pulses for SK and ALL only 16?Can you put a break-point on ID check just feed my ID ad let run?SS_BI(pin 73) on ALL adapter connected to pulldown. I think you mislabeled, that pin is BV(pin71) and will be similar to my waveform.Another interesting difference: ALL use SCK pulses after each data read, bee not, but bee using extra SK pulses and ALL notBee send 80 SCK pulses ALL send 90? counted right? can you expand and count?Hint: if you can export your data as binary then you can import into pulseview and there is more tools like counter spi demodulator.

author: migry
author_rank: Regular Contributor
timestamp: August 19, 2022, 12:50:02 pm
content: Quote from: pityokas on August 19, 2022, 04:39:01 amAll SCO outputs are the same because this is a trace from anemulatedEPM7064.Going back to the EPM7032 and the ALL03 software...I compiled DOSBOX-X from sources. I can then run dosbox-x and load the ALL03 binary (AMAX70.EXE for the EPM7032). I then added my own module. This moduleemulates1) the ISA card and the PAL protection(?) circuitry 2) the registers of the ALL03 programmer (e.g. there are 5 8 bit registers for driving the 40 pins of the ZIF socket, but there are others too) 3) the EPM7032.As I mentioned the ALL03 software will not generate the proper waveforms unless the check for the ISA card is OK and also the check for the device in the socket (i.e. device ID read) is OK too. So once I had genuine traces from real silicon (the 7032V) for SCOA and SCOB, I added emulation of this to the code. After this was debugged the ALL03 programmer code is happy that it is seeing a genuine device and generates the full set of waveforms for all programming actions. It does however barf during programming because I do not emulate the EEPROM memory.I trace the waveforms by writing "special" data to the LOG file. I then extract this data and create the stimulus in Verilog format. Weird yes!I have a Verilog testbench which I compile and simulate to generate the waveforms. There is no option to save waveforms AFAIK., but you could write Verilog code to write a binary file. How to make this compatible with Pulseview - I have no idea.I copied the DOSBOX-X EPM7032 area and created a EPM7064 area and modified the emulation of the MAX device to reflect the change of pins, and I added SDINC, SDIND, SCOC and SCOD. I emulate the SCO pins, so what you see is myguessat their behaviour and is NOT from a real device. For some reason the device ID was not working for the EPM7064 (it DOES work for the '32). The device ID for the EPM7032 comes out of the SCOA pin. I simply copied the SCOA waveform into the B,C and D eumulation in case the software was looking for the device ID on a different pin.I am very happy with these waveform traces for the EPM7032. This is way I am CERTAIN than your SS waveform is incorrect.I then re-generate the waveforms on my desktop setup. There are photos earlier in this thread if you are interested. I use an Arduino to generate the stimulus.Quote from: pityokas on August 19, 2022, 04:39:01 amThe sequence comes from the ALL03 software, however the TIMING is NOT accurate. I only log I/O writes and reads. My waveform is sort of like a condensed version of the stimulus. I t would look more like your capture on real ALL03 hardware (which I do not have - and is unavailable in the UK at a sensible price if at all).Thanks to the IDA Pro work, I am confident that the waveforms are 100% correct, and they do have a sensible pattern. Perhaps without the software delay adding gaps it is less easy to spot each sub-sequence.I was unable to determine the serial data for the ID from your waveforms, since they look so different to the ones from the ALL03 which I am used to.I will use DOXBOX-X instruction trace to figure out why the device ID datastream is not working, but from initial look at the IDA Pro disassembly the code is more or less the same.I hope this clarifies.BTW I can go into more detail, but most readers are probably not interested. If you have specific questions about my setup, please send a direct message. I can also go into much deeper interest in a DM.

author: migry
author_rank: Regular Contributor
timestamp: August 19, 2022, 01:00:12 pm
content: Quote from: pityokas on August 19, 2022, 04:39:01 amTL;DR I think that the pin indicated in the rectangular diagram is incorrect.According to the diagram "SS" is pin 73, but according to the more recent schematic of the adapter (and work with my EPM7064 emulation) it is pin 77.I am now very familiar with the waveforms needed by the EPM7032.SS is needed in order to get good data on SCOA/B. So I am pretty certain that if your device is wired to the programmer correctly you will see a waveform on "SS_BI".SCOA/B is unloaded 16 bits at a time using the SK clock. For the first bit (of 16) SS is LOW, then it is HIGH for the next 15. At the end of every 16 SK clocks SCK is pulses (I sort of guess that this loads the next 16 bits into the output shift register).I am making the assumption (and I could be wrong) that the behaviour of SS_BI for the 7064 will be the same as the behaviour of SS for the 7032. I think that I have now confirmed this from the EPM7064 emulation, however there is still confusion as to which is the SS pin on the device, since the source documents differ and/or are incomplete.

author: pityokas
author_rank: Contributor
timestamp: August 19, 2022, 02:08:29 pm
content: Quote from: migry on August 19, 2022, 12:50:02 pmMaybe wrong emulated?On my waveform SCOA!=SCOB!=The first 2 byte come from SCOA, the second from SCOB ....QuoteBinary file. byte after byte, that's all.QuoteOn EPM7032?QuoteSS is input or output for EPM?

author: pityokas
author_rank: Contributor
timestamp: August 21, 2022, 08:20:56 am
content: Another read of EPM7032S-44 but this time with Topmax.This is very close to your waveform, I think bee sending the reading address pointer every time, and ALL and maybe others just clock SCK once.There are some spikes including on GND there are very short, just ignore, probably connected the GND to wrong place.

author: pityokas
author_rank: Contributor
timestamp: August 21, 2022, 10:24:37 am
content: Attaching EPM7032S-44 erase/blank check waveform, nothing interesting, no commands, just static setup on pins.

author: migry
author_rank: Regular Contributor
timestamp: August 21, 2022, 03:55:01 pm
content: Thank you for making the waveform traces @pityokasWhen I first started this project (a year or two ago) I was hoping that someone who had access to genuine programmer hardware would be able to make traces of the pins, in order to allow the programming protocol top be reverse engineered.Here is a quick summary of my findings for theEPM7032with some guesses added.The Vpp pin when taken to a high enough voltage (*) puts the device into test/programming mode, and the pins are configured into inputs and outputs for SK, SCL, SDIN, SDOUT, SCO, etc.SDINA and SDINB are used to shift in 80 bits of data. For the read ID sequence to work, a pattern of 00001-00001-000001-00001-00001 (for 80 bits) is required. I have no idea of the significance of this pattern. Data on SDINA and SDINB is clocked in using the SCK clock.The "set of 5" is also seen in the tables in the ALL03 programming software. This must tie in with the architecture in some way.The ADDR pins (A6-A0) select a block of EEPROM memory. Since 160 bits are shifted in (80 on SDINA and 80 on SDINB) then we can guess that each block of EEPROM is 160 bits.Address block 0x7C (hex) is a special block which contains the "read ID". I have no idea if this block is protected from erase or is simple implemented as ROM (rather than EEPROM).Data is clocked out on SCOA and SCOB. I have a suspicions that these are the outputs of two 16 bit registers, as 16 bits are shifted out using SK, with a clock of SCK every 16 clocks of SK. For the first bit of SS is low and for the next 15 bits SS is high. An alternate interpretation is that SS must be low when SCK is clocked to load new data into the 16 bit SCO registers.Each device type generates a different stream for read ID. For the EPM7032VLC-44 "V" 3.3V device the datastream of SCOA is 0146-8AAB-F533-6083-3643 (5 sets of 16 bits, with MSB clocked out first). This was observed on a genuine device and captured using a Rigol oscilloscope. The 80 bits for each SCO shifted out is unscrambled using an algorithm based around sets of 5 bits. When the 80 bits shifted out of SCOA are descrambled it becomes 10 bytes "0xFE 0x07 A L T E R A 9 3" (i.e. 10 * 8 bits = 80). The first two bytes define: Vpg - the programming voltage needed on Vpp (called Vpg in the ALL03 software); Tbe - time for bulk erase in ms (determined by a look up table) [note I am guessing the purpose based on the letters "BE"); and Tpg - time to program one EEPROM memory block (also determined using a look up table). The ALL03 software has hidden commands which can be enabled with the sequence "uIu" which gives the "I" command which prints the decoded read ID and Vpg, Tpg and tBe (see attachment).NTPW is the pin used for the programming and erase pulse. While Vpp/Vpg is high (12V or so) this pin MUST be '1'. It is pulsed LOW for between 20 to 500ms (depending upon device) to either program a block of EEPROM as addressed using the ADDR pins, or to erase everything. Of course it should only be taken low when the appropriate sequence has been applied to other pins.the ADDR pins (A6-A0) select the block of EEPROM to be programmed or read back. When programming a block of EEPROM the data to be programmed is shifted in on SDINA and SDINB. When reading back a block it is the same as the "read ID " waveforms except that the ADDR pins select the block of EEPROM to be read. For blank check all EEPROM address blocks are read back and all 160 bits (80 from SCOA and 80 from SCOB) must be '1' to confirm the erased state. In the ALL03 blank check command address blocks 0 to 0x57 (87 decimal) are read back in order, then the next few blocks are not read sequentially but goes to 0x68 with the final two reads of address blocks 0x70 and 0x71. This is 106 address blocks in total or 2.21k bytes of data.The ALL03 software reads in the data to be programmed in POF format. Using Altera Quartus 13.0 (free download) it is possible to create a POF for the MAX7000. My only concern is that the POF format might be different for different versions of the chip A,B,s (JTAG). I compiled a very simple piece of verilog code which simply routine pin 4 to pin 5 (no clocks or flops were used). The data portion of the POF file (having removed the head) was approx 1900 bytes. I do not know the data format, however the size of the header can vary and contains textual information.(*) for the EPM7032VLC-44 which is the "V" 3.3V Vcc device, I only needed to raise Vpp to 5.5V in order to enable test/programming mode and unload the read ID data stream (on a real device). Note: for programming or erase the required Vpp will be around 12V, the exact needed value is encoded into the read ID data stream.In my DOSBOX-Xemulationof the ALL03 ISA card, ALL03 registers, and EPM7032 device, I added emulation for the SCOA and SCOB data streams for the "read ID" sequence. I was able to use the ALL03 software to confirm that the data steams were correct, since when unscrabled the magic string "ALTERA93" appears. The emulation of the "read ID" is important, otherwise the software will not generate any further waveform stimulus unless a device has been detected via the "read ID" data stream mechanism.

author: migry
author_rank: Regular Contributor
timestamp: August 21, 2022, 05:46:33 pm
content: Request.Does anyone have the Altera MAX+Plus II software? I believe that this software requires a license and possible uses a dongle for protection too.Would it be possible to create some POF files for each of the EPM7032 devices which it supports?I would like to look at the files to determine the size of the data section of this file, to see if it is the same or different length to the POF file created by the Quartus II 13.0 software which I am using.The POF generated for the supported device EPM7032AE has a data section of 1901 bytes.

author: marcopolo
author_rank: Regular Contributor
timestamp: August 21, 2022, 06:01:23 pm
content: https://archive.org/details/1999-altera-max-plus-ii-93

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 21, 2022, 06:29:40 pm
content: Quote from: migry on August 21, 2022, 05:46:33 pmI am working on cross-annotating this software, based on the Solaris version (with symbol table, Ghidra decompiler) and Windows (for debugging, Hex-Rays decompiler) MAX+plus 7.2 (available on the Internet Archive). I can upload the application and annotations if we need.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 21, 2022, 06:41:11 pm
content: Quote from: migry on August 21, 2022, 03:55:01 pmMicrochip(Atmel) POF2JED can output some debugging information to dump.txt, see whitequark's Twitter. I can upload the modified executable, too.

author: migry
author_rank: Regular Contributor
timestamp: August 21, 2022, 07:07:19 pm
content: Quote from: Beta_vulgaris on August 21, 2022, 06:29:40 pmIf you have the chance to create a POF from a simple project for the EPM7032, it would be useful to know if the format as the same as generated by the Quartus software (which I would prefer to use).I will take a look at the v7.2. I will be interested to see what level of capability it has (without licence?). I'm not sure which version of Windows it will work under?I did a quick experiment using Quartus II 13.0, generating some POFs from a trivial Verilog source.EPM7032AELC44 - data length = 1901EPM7032BTC44 - data length = 1945EPM7032SLC44 - data length = 1892 (the S device has a modified architecture as compared to the non-S, so the smaller POF data section was a surprise).

author: migry
author_rank: Regular Contributor
timestamp: August 21, 2022, 07:18:01 pm
content: Quote from: Beta_vulgaris on August 21, 2022, 06:41:11 pmI wrote something quick and dirty using the Perl language. If you have a POF please try it and let me know. It is incomplete.NOTE: I cannot upload files ending dot PL, so I renamed it to dot BAS. I am sure you can figure out what to do if you need to run it. Requires Perl.

author: migry
author_rank: Regular Contributor
timestamp: August 21, 2022, 08:30:23 pm
content: Quote from: marcopolo on August 21, 2022, 06:01:23 pmOK thank you for the pointer. I was surprised to find the software here!I installed on an old Vista machine without any hassle. After some playing I found that the Verilog compiler was not licensed, so I tried an example from the AHDL examples. This compiled and I was able to generate a sample POF.EPM7032AELC44 - data length = 1901 (compiled using Quartus II 13.0)EPM7032BTC44 - data length = 1945 (compiled using Quartus II 13.0)EPM7032SLC44 - data length = 1892 (compiled using Quartus II 13.0)RPM7032LC44 - data length 1846 (compiled using Max+Plus 9.3)

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 21, 2022, 11:56:48 pm
content: Quote from: migry on August 21, 2022, 08:30:23 pmPlease apply the cpt.dll patch (made by myself) for licensing and Windows 10 compatibility.

author: pityokas
author_rank: Contributor
timestamp: August 22, 2022, 05:48:29 pm
content: Quote from: migry on August 21, 2022, 03:55:01 pmFor that somebody must have:1.A programmer2.adaptor3.PLD4.Logic analyser5.Will to do6.Read EEVBlogLong list, and AND condition not ORQuoteMore detail how is unscrambled?

author: jdgabbard
author_rank: Contributor
timestamp: August 23, 2022, 09:01:27 pm
content: I do not frequent the forum super often, but I thought I could contribute to this thread. I have laid out the EPM7064-PL84 adapter as the schematic shows on the Benoit website. There are actually two pages that deal with this adapter, one with better pictures of a prototype version. However, I do not have a EPM71064 to try this adapter with my ALL-07 programmer. I can say however, that at least as far as the ICs I have, the EPM7128 does not seem to work with the adapter. Which would reinforce the idea from previous comments that the pinouts are not the same. That page is here:http://matthieu.benoit.free.fr/hilosystem_all-11P2_universal_programmer.htmThat said, I'd be interested in helping with any testing I could do with the ALL-07. Not exactly an ALL-03, but it is close.I will say that the ATF1508 schematic works with the ALL-07 and I'm able to program ATF1508s just fine once the POFs have been converted to JEDECs with Atmel's tool. It would be nice to get these EPM7128 CPLDs working though... But being from Aliexpress, it's hard to say if they're actually 7128s, or something else that's been rebadged...

author: migry
author_rank: Regular Contributor
timestamp: August 23, 2022, 10:11:55 pm
content: Quote from: pityokas on August 22, 2022, 05:48:29 pmHa haReminds me of the Drake equation. It's supposed to predict the chance of other lifeforms in the Universe, but physicists can't agree on the numbers that get put into the formula. Of course the arrogant physicists completely ignore the personal testimonies of those people who claim to have had encounters with aliens, which of course would make the chance '1' and the formula would then be a waste of time :-).I suspect this thread is most likely found through googling of MAX7000 or EPM7032, even though that is likely a rather low probability event.QuoteSo the (machine) code algorithm to do the descrambling is not clear to me, since the code looks like spaghetti However as previously described, it uses a table and essentially takes the 5 (16 bit) words read out on SCO and simply re-arranges all 80 bits into 10 bytes. In other words 80 bits in (5 x 16) to 80 bits out (10 x 8 ). The table is 80 bytes long. The table contains the number 0 to 79 once each.The table starts 0,5,10,15,20,etc... So bit 0 of the 80 bit input is extracted and then put into the output 80 bit array. The bit 5 of the 80 bit input is extracted and then put into the output 80 bit array, then bit 15, etc.. Once it has done bit 75, the sequence changes to 1,6,11,16 and these bits are extracted from the 80 bit input array and put into the output array. TO help clarify, if you count the number of bits set to '1' in the 80 bit input array, there will be the same number of bits set to '1' in the output array. The order that the bits are deposited in the output array is confusing.In order to try to understand this algorithm more clearly, I have installedGhidra. This tool, written and released by the NSA (of all organisations!) onto GitHub, reads in an executable and generates C source code. Of course the C needs some help to become more readable and the end user has to give the functions and variables meaningful names. I am still struggling to get it to work properly. Some things are intuitive and some things are less than obvious. Documentation is not greatly helpful. YouTube videos have been helpful, but none of them deal with old style DOS executables, such as the ALL03 programs. Nevertheless it did a great job untangling the spaghetti of the loops inside loops of the bit re-arranger code, but I still don't understand the shifting and masking.

author: migry
author_rank: Regular Contributor
timestamp: August 23, 2022, 10:23:44 pm
content: Quote from: jdgabbard on August 23, 2022, 09:01:27 pmWell hello @jdgabbard, welcome to the thread!The information on the "benoit" website has been invaluable, particularly for me, the complete reverse engineering of the ALL03 schematics, both programmer and ISA card.I am focusing on the EPM7032, which is the simpler device, as it has less pins to control. It has two SCO output pins. From my limited work looking at the ALL03 7064/096/128 programming software, these 3 devices are all slightly different, and have more SCO output pins, as well as other (unknown) differences.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 23, 2022, 11:10:56 pm
content: Quote from: migry on August 23, 2022, 10:23:44 pmMy rectangular diagram is also based on Benoit's website. The inner ring isCROSS ANNOTATED FROM EPM7064S, so I was wrong.

author: migry
author_rank: Regular Contributor
timestamp: August 24, 2022, 12:27:14 pm
content: OK I did some work to better understand the unscramble algorithm.Each bit in the 80 bit input string is translated to a different bit position in the output string. The attached log shows the mapping.Input words and output bytes have to be ordered correctly to get the correct result.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: August 28, 2022, 01:46:44 pm
content: Quote from: Beta_vulgaris on August 23, 2022, 11:10:56 pmhttps://www.mqp.com/ad359.htm

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: September 05, 2022, 09:32:45 am
content: Quote from: Beta_vulgaris on January 20, 2022, 07:33:03 amUpdated: EP1800, fromhttp://www.emulation.com/pdf/m1965.pdf.

author: migry
author_rank: Regular Contributor
timestamp: September 05, 2022, 01:16:22 pm
content: I have returned to experimenting with the EPM7032V (3.3V) device from which I could read the device ID (using my Arduino MEGA 2560 + DACs setup).FYI on this device, VCC is 3.3V . If the Vpp (Vpg) pin is raised above 5.5V, then the pins are put in test mode and the device ID can be read. This voltage is likely much too small to work for programming, but gives an insight into how the device works.From the pin names in test/programming mode, we can see 7 address bits. Each address selects a small block of 160 bits (20 bytes) of EEPROM. Not all 128 blocks physically exist.I have a sequence which steps through blocks 0 to 87 and reads back the contents. Another check confirms if all bits are '1' (i.e. erased). These are the 20 byte blocks, there are another 25 or so blocks which are smaller (purpose is unknown). The erase state is all ones.I have tried to write data to a selected block. I quickly found that it is scrambled, possibly using the same algorithm as the device ID. I am now writing all zeroes. It sort of works. Some blocks become all zeroes, but some still have some bits set. I need to experiment with different levels of Vpp and NTPW pulse lengths.I also tried to re-create the erase waveforms. For normal block access, the pattern of "00001" repeated has to be shifted in on SDINA and SDINB (as previously described). My guess is that this pattern is decoded to enable reading or writing. For erase a different bit pattern is needed, one which is derived from the device ID. So I tried running the erase sequence and looked at the blocks which I had set to zeroes. Nothing changed. I then tried repeating the command, eventually coding a loop. After about 30 or so iterations, all bits were reset back to all ones! I think that this should only take one pulse of NTPW and not 30, however it is a start.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 11, 2022, 12:49:10 am
content: A bit more from disasm:Code:<<< Program row >>>set address pins to addressshift the data out on SDINA+SDINBTM=SBI=1NTPW=0delay(Tpg)NTPW=1TM=SBI=0Code:<<< Erase >>>check IDread row 7C to temp bufTM=1BE=BEM=1NTPW=0delay(Tbe)NTPW=1BE=BEM=0TM=0program row 7C from temp bufread and verify row 7Crow 74 is security fuse (zeroes activate it)Reprogramming the 7C row after erase looks interesting - erase destroys device ID ??

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 13, 2022, 02:04:46 pm
content: Studied a bit more: the bit shuffling from POF to raw data and back looks more complicated than hw access. Perhaps it would be easier to just build a DOSBox to run on some board like Raspberry and map programmer pin accesses to GPIO pins?

author: migry
author_rank: Regular Contributor
timestamp: September 13, 2022, 05:11:37 pm
content: QuoteYes I agree. After further experimentation, I discovered that I had erased not only the data blocks of the EPM7032V, but also block 0x7C - which contains the device ID. So my previous assumption that this block was protected, was incorrect. I was not able to restore itI have attached waveforms taken fromemulationof the sequence generated by the ALL03 programmer EPM7032 A70X.EXE file. ALL03 register writes were captured and turned into Verilog code, then simulated as a testbench. The capture comes from the waveform display of the Verilog simulation, courtesy of "ModelSim". NOTE: that timings are not accurate. in that every register write simulates as one cycle. I did extend the two cycles where the NTPW programming pulse is taken low. As @abyrvalg has pointed out the values for Tpg (programming pulse width) and Tbe (bulk erase) are extracted from the block 0x7C and then a table look up is used to convert to milliseconds. TBH I assume that most other timings are not critical, except the width of NTPW.You will notice that there are three "block read" sequences. They all read the same block address 0x7C, which would appear to be reserved for an ASCII "device ID" code.1) The first "block read" reads the current "device ID". The data has to be unscrambled in order to retrieve the device ID (ALTERA92). I posted the algorithm in an earlier post. If a valid "device ID" is not found the software bails out with an error.2) The second "block read" of the same address simply reads the current "device ID", unscrambles it and saves it.3) The first red oval shows the ERASE signalling. The width of NTPW is important. All EEPROM data is erased, including block 0x7C, and we canassumesecurity fuse settings too.4) The next sequence is where the old device ID is loaded into the device ready to be re-programmed into block 0x7C. NOTE: the ALL03 will refuse to program any device which does not have a valid "device ID", so this step is very important. Note that the data on SDINA is loaded "in the clear" that is the sequence is ASCII (ALTERA92), for those of you who enjoy decoding serial data bitstreams5) The second oval shows the PROGRAM signalling. Again the width of NTPW is important and is not the same as for bulk erase. The data previously shifted in on SDINA and SDINB is programmed into the block selected by address "A".6) The final "block read" sequence is likely to be for confirmation that block 0x7C was successfully programmed.

author: migry
author_rank: Regular Contributor
timestamp: September 13, 2022, 05:22:35 pm
content: Quote from: abyrvalg on September 13, 2022, 02:04:46 pmYes I have looked at this too, and confirm your findings. There are multiple tables in the initialised data segment which maps from POF bit position to bit position in the SDIN 80 bit programming data stream.I had hoped that it might be simpler, but it's quite complicated. Also the 7032 (5V) and 7032V (3.3V) have different tables.In an earlier post I did mention that I had considered adding code to the DOSBOX-X emulation, to drive external hardware, but on a modern PC I don't see a simple way to do this. Possibly converting ALL03 register writes to serial data and using a USB to serial hardware device is one way to get "physical" data, but then I need to capture the data, process it, before applying to the hardware. I haven't ruled this out. In the past I've found that accessing hardware is never simple, apart from back in the days of the 8088 when it was all simple I/O writes or BIOS calls. It depends on the libraries, and I haven't investigated how this could be done in DOSBOX-X. All I can say is that when I have looked at Unix type libraries and seen IOCTL code, it sent a shiver down my back.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 13, 2022, 08:07:35 pm
content: You don't need an x86 machine to run DOSBox. What I'm suggesting is to build a Raspberry Pi version, where you would be able to manipulate GPIOs relatively easily (i.e. using thishttps://abyz.me.uk/rpi/pigpio/cif.html)

author: migry
author_rank: Regular Contributor
timestamp: September 14, 2022, 04:54:59 pm
content: A quick update.I spent a few hours playing with my Arduino based "programmer".I worked with the EPM7032V, the 3.3V device from which I had been able to unload the device ID. I have had some success writing zeroes to blocks 0,1 and 2, but other blocks remained stubbornly all ones (blank). I was able to erase the device only after multiple attempts to do the erase sequence. During this session I was unable to erase. I started to look at the signals using my Rigol scope. Many signals did not look clean, and Vcc was particularly "nasty". This could be explained by the use of a breadboard and longish connection wires, coupled with a less than perfect ground for the Vss pins. I am driving inputs using the output from the 5V Arduino Mega 2560. Since this is a CMOS device the outputs swing more or less rail to rail (0 -> 5V). Although I was driving the 7032V inputs via 1k resistors, I did not see the inputs clamping to a little over Vcc. This might also have contributed to the flaky behaviour. So I am giving up on this until I get a new breakout PCB made (my first was a bust). BTW when I erased this device, block 0x7C was also erased to all ones, and I was unable to re-program it. I will re-visit when I have the new PCB and I will use proper level translator ICs (74LVC8T245).Note: many devices have clamping diodes on the input and output pins, possibly there for ESD reasons to catch spikes. With care you can drive 3.3V inputs (which have clamps) from a 5V driver, as long as you limit the current using a resistor. The RC network of resistor and input capacitance will impact slew rate, but for many inputs this is not an issue.So I swapped over to one of the 5V devices. Vcc in the Arduino sketch was changed to 5V. I ran the code not really expecting it to work, but blow me down, I saw the device ID of ALTERA92appear. I have no idea why it is now working. The operation of programming was more robust in that it took only one try to program a block andanyblock I chose appeared to program to zeroes. I tried erase. It didn't work, so I re-tried. This time it worked and what's more the block 0x7C was programmed correctly, but with the wrong device ID, since the sketch still contained the ALTERA93device ID for the 3.3V device. TBH I'm a little surprised that not only is it working, but it seems much much less flaky.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 14, 2022, 06:51:58 pm
content: Great! So the last missing piece is POF to raw shift data conversion. One idea: you can turn your DOSBox-based emulator into converter: track the SDINx shifting, output the last shifted data together with an address when you see an NTPW pulse with SBI=1, capture entire POF this way, then send it block by block to Arduino by some other way (not from DOSBox C code, i.e. via terminal or Python script or whatever), implementing shifting and NTPW pulsing in the Arduino.Upd: found a general (nothing device-specific there) POF format description:http://ftp.dataio.com/main/manuals/unifam/translation%20formats.pdf(page 10)

author: migry
author_rank: Regular Contributor
timestamp: September 15, 2022, 12:29:00 pm
content: Quote from: abyrvalg on September 14, 2022, 06:51:58 pmYep. I found this a few weeks ago. I made a post on 21st Aug with an attachment of Perl code (I had to give it the .BAS extension in order to upload) to decode Altera POF. This document was a very helpful reference.The format is actually very simple, it's just repeated blocks of: tag (16 bits); length (32 bits); block of "length" bytes. Some of the blocks of bytes are in simple ASCII format. The largest block with tag 17 (0x11) is the one which contains the data to be programmed. I am pretty sure that the first 'n' bytes (n=12?) of this data block are a (sub)header and do not form part of the data to be programmed. The tags for the ASCII part of the POF can vary in length. In a different posting I looked at the length of the program data tag block and noted that the length differed depending on which version of the EPM7032 you were compiling for. This unfortunately confirmed that I could not used Quartus V13 on my PC to compile Verilog for the MAX7000 devices which triggered the whole project.When the ALL03 EXE loads any POF, it relocates the data block into a fixed location in memory, and modifies the ASCII data on these type of tags, such that the binary program block is always found at a fixed address in the buffer. This is helpful when looking at CPU trace files, as the reads from this data section can be more easily filtered. Using trace files of CPU operations gives one possible way to determine the mapping, however the trace files get pretty big quickly (Gb++). It may be possible to hack the code to only write out reads/writes in a particular range, or this might even be already supported, IDK. Data reads from the buffer to form the 2 x 80 bit serial stream for SDINA and SDINB are not consecutive.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 15, 2022, 11:51:20 pm
content: A script simulating raw to POF conversion as done by AMAX70.exe during read (all those bit tables are ripped from exe).The output is not a full POF, just the data block as seen by exe. The programming function appears to be doing a reverse mapping using same tables.A "row" in script's terminology is a full content of a single address (all SDINx-SDOUTx chains together, 2x80 bits), while a "plane" is an array connected to a single SDIN-SDOUT.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 16, 2022, 02:05:06 pm
content: Updated version, working both ways

author: migry
author_rank: Regular Contributor
timestamp: September 16, 2022, 08:00:04 pm
content: Quote from: abyrvalg on September 15, 2022, 11:51:20 pmYep, great workI recognise the various tables, but had never got to the point of trying to convert them back as C structs (which Ghidra can do).From a pervious posting (of mine)Code:EPM7032LC44 - data length 1846 (compiled using Max+Plus 9.3)From your extracted tablesCode:EPM7032 = Device("EPM7032", "ALTERA92", 14672, 2, 8, BlockTable7032)14672 / 8 => 18341834 + 12 => 1846 , where 12 are the header bytes of the POF data section. These differ very slightly for different devices. Ties in nicely.My best guess (based on disasembly)Code:Block(88, 1, 7040, 0, 80, BitTable0),Each table entry controls the POF to SDINA/B mapping for a block of EEPROM addresses. There are 8 sections (as I call them) or table entries if you prefer. If you examine the blank check waveforms closely you can see "changes". The first 88 blocks are 80 bits on both SDINA and SDINB, but the later sections only program 16 or 8 bits, so appear shortened in the waveform trace.first column = number of EEPROM blocks (different addresses) in this sectionsecond column = not sure, but I see you call itplanethird colum =some kind of bit offset into the POF, I see you call itplane_start_bitfourth column = address of first EEPROM block in this sectionfifth column = number of serial bits on SDINA (and B) for each block (80, 16 or 8 )sixth column = pointer to bit translation/mapping table.BlockTablePlaneA =bit translation/mapping for data to be shifted in on SDINABlockTablePlaneB = ditto ... SDINBCode:Block(88, 0, 0, 0, 80, BitTable0),The first section (as I called it) starts with address 0x00 and goes to address 87 (0x57). There are 80 bits shifted in on SDINA. Mapping table is BitTable0.Since the 7032 has 32 macrocells, we might guess that two EEPROM blocks (160 bits) are allocated per macrocell (but this is just a guess).From the 1993 databook "MAX7000 EPLDs contain from 32 to 256 macrocells that are combined into groups called Logic Array Blocks (LABs).".Code:Block(12, 0, 0, 0x62, 16, BitTable62),The second block is special in that the start address is 0x62, but the sequence of addresses is not sequential but a secondary table is used (Block62AddrTable). There are 12 blocks in this section and only 16 bits are shifted in on SDINA.Thank you, there are some very interesting insights from your Python code which I hadn't yet figured out from the disassembly.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 16, 2022, 10:32:24 pm
content: Check the __init__ method definition of class Block (and other classes), I gave names to all those numbers already

author: migry
author_rank: Regular Contributor
timestamp: September 16, 2022, 10:39:17 pm
content: Quote from: abyrvalg on September 16, 2022, 10:32:24 pmYes, thank you, I did note your variable names.I am now converting the Python to C, to allow me to print some debugging information, which I can then compare with the instruction trace.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 16, 2022, 11:30:57 pm
content: BTW, the programming function in exe builds a used bits mask together with pof to raw bit transfer - another buffer of the same full row size is filled with 0s initially, then bits are set to 1 in same positions where pof bits are being transferred into row write buffer. They use it during verification after each row write: read back a row without converting it back to pof and compare with write buffer, using a mask. So it looks like unused bits could have some unpredictable values (i.e. those remaining 64 bits in rows declared with only 16 used bits).Just a thought: depending on your relationship with Python, perhaps you don’t need to convert that code to C at all. It is extremely easy to talk to serial ports from Python (search for “pyserial” examples, or I could provide some), you could just transfer the “cooked” row data to/from your Arduino right from read_row/write_row Python functions, staying in a comfort of desktop environment.

author: reverse
author_rank: Contributor
timestamp: February 26, 2024, 12:22:07 pm
content: Hi. Unfortunately the progress on this seems stalled. I am still looking for the adapter schematics/wiring for the non-JTAG EPM7064 plcc68/44//84 for Hi-LO ALL03 (probably it should work on my ALL07C), or for the Slovakian Dataman/Elnec/Beeprog...Thanks.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: February 26, 2024, 04:09:02 pm
content: Quote from: reverse on February 26, 2024, 12:22:07 pmEPM7032/7064 have pin mappings and signal definations.https://mqp.com/ad359.htmandhttp://matthieu.benoit.free.fr/all03/adp-7064S-PL84.

author: reverse
author_rank: Contributor
timestamp: February 26, 2024, 07:39:23 pm
content: Nothing for the PLCC68 and other sockets, except for PLCC44. The PLCC84 example you are referring to is for JTAG version of the EPM7000S family, not for the "parallel programmed" family.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: February 27, 2024, 09:31:41 am
content: Quote from: reverse on February 26, 2024, 07:39:23 pmThe wafer dies inside all packagings are all the same, so simply connect to the same macrocells.

author: reverse
author_rank: Contributor
timestamp: February 27, 2024, 10:53:01 am
content: While dies are identical in every family regardless of the pin quantity, their general I/O pins can be remapped at software level in almost arbitrary way therefore the correspondence to programming pins is not determined.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 28, 2024, 07:50:28 am
content: Quote from: reverse on February 26, 2024, 12:22:07 pmI'm unclear on what a 'non-JTAG' means ?With the Atmel ATF15xx parts, the JTAG fuse can release the JTAG pins to become IO, but then you just apply ~12V (IIRC) to the Vpp pin, to override and enable the JTAG pins again.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: February 28, 2024, 09:43:02 pm
content: Quote from: PCB.Wiz on February 28, 2024, 07:50:28 amATF15xx series are based on MAX 7000AE, even the 5V parts. EPM7000AE also release JTAG pins on Vpp voltage assertion.http://matthieu.benoit.free.fr/all03/adp/HiLo_ADP-7064AE.PDF

author: reverse
author_rank: Contributor
timestamp: February 29, 2024, 07:08:53 am
content: "Non-JTAG" means ICs in question do not have JTAG interface at all and can only be programmed via other pins that are manufacturer's secret.

author: c64
author_rank: Frequent Contributor
timestamp: February 29, 2024, 08:56:59 am
content: Quote from: PCB.Wiz on February 28, 2024, 07:50:28 am7000S has JTAG7000 has no JTAG

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: March 01, 2024, 11:02:03 pm
content: Quote from: reverse on February 29, 2024, 07:08:53 amTI PAL chips (military) have official programming specifications.

author: reverse
author_rank: Contributor
timestamp: March 02, 2024, 10:35:51 am
content: This topic is exaclty about ALTERA reprogrammable devices, not about TI OTP PALs! You replies in this topic are like spam and by AI generated.

author: reverse
author_rank: Contributor
timestamp: March 08, 2024, 08:19:58 am
content: I found the following official documents/tables describing the pin relation across different sockets of each family:https://cdrdv2-public.intel.com/676788/epm7160e.pdfhttps://cdrdv2-public.intel.com/676664/epm7096.pdfhttps://pdf.dzsc.com/88888/2006916165239174.pdfhttps://cdrdv2-public.intel.com/676785/epm7032.pdfhttps://cdrdv2-public.intel.com/676926/epm7064.pdfBut my attempts to build adapter for HILO programmer based on them fail so far. Moreover for example I am puzzled by controversy in description of power rails VCCIO and VCCINT distribution in 7064 table and in commercial adapter ADP-7064S-84 which is well documented and reversed here:http://matthieu.benoit.free.fr/all03/adp-7064S-PL84/

author: migry
author_rank: Regular Contributor
timestamp: April 07, 2024, 01:10:06 am
content: These pinouts are very likely to only work for the "S" type devices, which can be programmed via JTAG.The ALL03 software for the various MAX7000 devices, use lots of pins in a parallel mode in order to read/program/erase the devices.

author: migry
author_rank: Regular Contributor
timestamp: April 07, 2024, 01:27:16 am
content: FWIW, I have been doing little in the way of electronic projects for the past year or so, and I stopped working on the reverse engineering of these devices about 2 years ago.I now have a new breakout PCB for the 44 pin EPM7032 device. I am currently trying to re-collect all the various places on my PC where I did work on this project and I hope to spend some time trying again, with the hope that the new PCB will be much more reliable than my old "mess of wires". I now have the breakout PCB wired to the original MEGA 2560 Arduino, with pins in the sketch re-mapped accordingly. After some wierd behaviour of the two DACs, I discovered that my original "play" devices were both broken/shorted causing the DACs to mis-behave(!). Using a new device, I can once again read the "device ID" and get the magic "ALTERA92" string which confirms that the device is correctly in the test/programming mode (Vpp > 14V).Incidently this data is stored in one of the many (60+) blocks of EEPROM. I am pretty sure that when the device is erased this block also gets erased as well. From recollection during the erase the old "device ID" is read, before the device is erased, and then the "device ID" is written back to the same specific EEPROM block. This is necessary (at least for the ALL03) because for any operation, the ALL03 software always tries to read the "device ID" and if it fails, it refuses to do anything else. Two bytes read from the special "device ID" block contain information about Vpp and the pulse width needed to erase/program the device. The software has a useful table, used to decode and print the information, held in ASCII format (C null terminated strings).I am trying to re-visit the work I did on the AMAX70.EXE software using Ghidra and IDA-Pro. Both were very helpful tools, however both were far from perfect, and have a steep learning curve to get the most from them. Out of curiosity I installed the latest version of Ghidra, hoping to see improvements, but the code re-generated was worse in the newist version as compared to the old. This might be fixable, but the menu options in Ghidra seem less numerous and flexible than in IDA-Pro.

author: reverse
author_rank: Contributor
timestamp: April 15, 2024, 02:49:05 pm
content: Quote from: migry on April 07, 2024, 01:10:06 amNo, I made an adapter for ALL-07 based on 7064 84 PLCC version for 68 pin version based on tables above and it works well with 7064E. What puzzles me I failed extending my adapter for the 44 PLCC version based on the same tables!Another thing - I managed to damage the ID of a 7128E chip while programming it in elnec jetprog with PLD4 adapter. Now that chip can only be programmed if ID verification is disabled. What I did was to press the "Yes" button involuntarily while removing the chip from the PLCC socket which lead to repetition of the last programmer's action (supposedly erase).

author: migry
author_rank: Regular Contributor
timestamp: April 15, 2024, 08:14:17 pm
content: Quote from: Beta_vulgaris on August 21, 2022, 11:56:48 pmI have spent more time mainly pulling out my hair when trying to install Windows98(SE) into a virtual machine.I gave up on that when it didn't work, locking up with strange error messages. An internet search did reveal this problem had been seen before, but the solution didn't work for me. Apparently modern PCs are too fast and some old instructions are no longer supported.So I then tried a different emulator - PCem. This time the emulator worked well, but something got confused during installation and various VXDs and DLLs couldn't be found on the (virtual) CDROM.Nevertheless after two days, and having viewed a helpful YouTube video, I got it installed, although I cannot get networking to work.I installed the Altera Max-Plus-II software, version 9.3.It does run, and the AVHDL examples will compile and create a POF. Some features such as Verilog compile and simulation do not work without a licence.I do not know where to find your DLL. Will it work under Windows98(SE)?regards...--migry

author: migry
author_rank: Regular Contributor
timestamp: April 15, 2024, 10:12:12 pm
content: I found the DLL file cpt.dll after searching a little more with the correct spelling!I have now being able to compile a verilog source file. I am very comfortable using this RTL. It will allow me to create a meaningful test case and resulting POF file, to run inside my DOSBOX emulator to understand how the POF file is loaded and processed.Many thanks!

author: reverse
author_rank: Contributor
timestamp: April 16, 2024, 07:42:29 am
content: Quote from: migry on April 15, 2024, 10:12:12 pmI have LPT driven all-07 programmer and if you debug the executable files for that programmer which is close to all-03 I may be able to test modified executables on real programmer and altera chips.

author: migry
author_rank: Regular Contributor
timestamp: April 17, 2024, 12:15:37 am
content: I assume that the same PLCC package adapters are used for the ALL03 and ALL07 programmers?I can do repeat some of my work for the EPM7064 devices, now I have knowledge of the EPM7032 devices, although it does take a lot of time.If anything I can try to determine which pins of the programmer are used, as I got the impression you were unsure of your adapter?I have attached a screen shot from the ALL03 software for the EPM7064/96/128 devices. Which one is of particular interest?BTW I did look in the folder where I have downloaded the ALL07 files. The schematics are virtually identical. I couldn't find an EXE for the MAX7000 series, perhaps simply it does not have an obvious name? Do you have the EXE for the EPM7032/7064 etc?UPDATE: I found the executable for this series of devices on the ALL07, it is called A7064.EXEI also checked a VM where I emulated the ALL03 and EPM7032 in DOSBIX-X, and I also have a EPM7064 version of this code, but I will need to take a look to see where I left off.I also found the ALL03 main EXE which has a nice DOS menu style front end. When selecting the EPM7032 it is looking for the file AMAX70.EXE which is the same name as the EXE I have been reverse engineering from the ALL03. At a guess the two programmers likely use the same EXE.

author: reverse
author_rank: Contributor
timestamp: April 17, 2024, 07:54:01 pm
content: Actually I am using A7064.EXE that supports adaptor -7064S-PL68. As I already mentioned this adaptor I made on the basis of this one:http://matthieu.benoit.free.fr/all03/adp-7064S-PL84/but I could not extend it further to support PLCC44 variant for unknown reason.A7064.EXE supports S and non-S altera chip versions.There is another A70X.EXE that supports non-S versions but with different adaptor - EPM7064-PLxx which schematic is unknown to me anyway. I have PLCC84 pin 7128 altera chips but their ALL07 adaptor is also mystery to me though pictures on the internet showed very similar design using one L244 and one LS14 again.ALL07 has launcher application too that starts individual executables named ACCESS.EXE.

author: jgustavoam
author_rank: Regular Contributor
timestamp: June 04, 2024, 01:45:15 am
content: I have two EPM7064 and one EPM7032. I intend to learn how to program them. I'm still reading this extensive topic.I found some old Altera manuals. And this one is interesting - 1993_Altera_Max_7000_Data_Book.pdfhttp://bitsavers.trailing-edge.com/components/altera/_dataBooks/MAX+PLUS® II Getting Started Manual:https://www.intel.com/content/www/us/en/content-details/653698/max-plus-ii-getting-started.html

author: megov
author_rank: Contributor
timestamp: June 20, 2024, 09:18:28 pm
content: Hi!I'm just registered at the forum to participate this discussion.Great thanks to @migry, @Beta_vulgaris, @abyrvalg, @pityokas and to someone, who I may miss, for all work, that you've done.Currently, I've read the whole thread and try to gather information inside my head to implement "Bulk Eraser" for EPM 7000S.My interest in narrower than to fully reverse the parallel programming protocol. But from what I've read here,parallel erasing is an act of programming anyway.In short, I have a whole tray (>50 pcs) of new and unsoldered EPM7128SQI100-10, that do not answer to JTAG.They're in PQFP100/0.65 and it seems they were ZIF-programmed with JTAG disabled.Simple methods, like +12V to OE1 and JTAG erase (for Atmel ATF150X) didn't work.So I try to discover chip interaction with all information that I've taken here and post my findings back here.Thanks, Igor.

author: djsb
author_rank: Super Contributor
timestamp: August 04, 2024, 05:02:37 am
content: I'm interested in this because I have a load of old development boards that use the MAX7000 CPLD's and parallel port programming tool (but of course no PC's with parallel ports) at work. I'd like to be able to make use of them for educational purposes, if possible. I'll post more details of the actual chip used in the boards later. Thanks.

author: megov
author_rank: Contributor
timestamp: September 05, 2024, 08:52:41 am
content: Hi!I've spent a couple of weeks working on this project, though without much success. At first I've designed and soldered test fixture. Schematic is provided as attachment to this message.The idea behind fixture is simple: Arduino Nano is used to drive:3 CPLD pins directly - SCK, SK and /NTPWa chain of 3x 74HC595 (24 bit total) for bitbanging all other CPLD pins - A0-A6, GAD0-GAD1, SDINA-SDIND, MT, CB, BV, SS_BI, BEM, BP, MTIN, pin16, pin694 p-ch MOSFET power switches for VCCINT, VCCIO and VPP (4th switch is not used)4 inputs (SCOA-SCOD) to capture output from CPLDLow power Chinese 5-to-12V DC-DC also soldered to provide Vpp voltage.Main area of uncertainty now is actual CPLD connections for parallel programming. In fixture I try to summarize information fromhttps://www.eevblog.com/forum/fpga/programming-(non-jtag)-max7000-devices/msg3699106/#msg3699106by @Beta_vulgaris and ADP-7064 schematic.EPM7064 symbol in PDF have dual pin names: name before slash is LAB/Cell according to datasheet, name after slash is a possible pin purpose for parallelprogramming mode. 560R pull-downs and 10k pull-ups are borrowed from ADP-7064 schematicsFirst task is to try to read CPLD ID, so on the software side I try to emulate waveforms, provided by @migry athttps://www.eevblog.com/forum/fpga/programming-(non-jtag)-max7000-devices/msg4366219/#msg4366219.What I've got now:power sequence applied successfully, nothing is burned yet: VCCINT+VCCIO, then VPP, then try to read ID0x7C address applied to A0-A7 inputsother inputs are set according by @migry's waveform16x5 bit 0001 pattern applied together with SCK to all 4 of SDINA-SDINB in order to fill input shift registersMTIN+8xSK pulses applied and SCOA-SCOD are sampled (yet manually by oscilloscope)power sequence removed successfully: remove VPP, remove VCCIO+VCCINTThere was a response: some of SCOx outputs changes from 0 to 1 during MTIN+8xSK phase, but SCOx is solid "1"and I'm not able to see any transitions on them, so no serial output.The problems I can see and try to solve:CPLD pinout may be wrong. There are no official parallel pinout, only picture by @Beta_vulgaris and ADP-7064 and even there were some discussion in this threadI actually investigate EPM7128SLC84, not EPM7064. So some sequence actions may be different.Exapmle waveform by @migry is a simulation result and "in vivo" sequence also may be different.In general, there is a much things to do.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: September 06, 2024, 06:43:33 pm
content: Quote from: megov on September 05, 2024, 08:52:41 amIn reality my summarization is based on Matthieu Benoit's and mqp.com on EPM7032/7064, with the hypothesis that multiple packages of a certain device have no difference apart from their packaging,i.e. the dies are all the same. Also, EPM7128E differs from EPM7064 entirely, it should have 8 serial input (guessed from the buffer chips on ADP-7128), each corresponding to one LAB.

author: megov
author_rank: Contributor
timestamp: September 06, 2024, 07:54:45 pm
content: Quote from: Beta_vulgaris on September 06, 2024, 06:43:33 pmI agreed, that different packages of the same chip type must be "similar". Different LAB/Cell pins may connected to different pins at each package type, but they should share the same functionality (+also for parallel programming).Like you said - dies are the same. It is interesting, that package page for EPM7064 in a datasheet shows exact "geographic" pin-to-pin match between PLCC44 and TQFP/PQFP44. Pin numbering is different between packages, but die pinout in terms "east-west-south-north" are the same.And I wonder, that 7128 may have 8 serial pipes instead of 4. Yesterday I re-read Matthieu Benoit's site and found a mention of "ALTERA EPM7128LC84 with adapter ADP-EPM7128-PL", so adapter for 7128 may be a different one.Unfortunately, I have no ADP-EPM7128-PL schematic. What confuses me, is that text in ADP-7064 PDF schematic says, that EPM7096S, EPM7128S and EPM7160S as compatible. So I assume that it may work for 7128S too.I have no 7064 in PLCC84 to reuse my current "adapter", but have one chip in PLCC44. So I try to solder a minimal 44 pin adapter to continue investigations.PS: Also I walk along the @migry path and disassembled a70x.exe. It's pretty simple at the hi-level (DOS, MZ executable, segments, etc), but more cumbersome when diving into interaction with hardware. Need to look to Matthieu Benoit's schematic of ALL07 and stuff.

author: pityokas
author_rank: Contributor
timestamp: September 08, 2024, 05:32:38 am
content: QuoteMaybe Dataman48 adapters information give more help for pins used for programming:https://www.dataman.com/mwdownloads/download/link/id/111/Example:EPM7064/96-84 1,2,4,10,12,14,16,17,18,20,23,27,28,29,31,33,35,36,37,39,40,41,44,45,46,48,49,50,52,54,56,57,62,65,67,68,69,71,73,75,77,79,80,81,83,84 +VCC and GNDEPM7128-84 1,2,4,6,8,9,11,12,14,15,20,21,23,30,31,33,34,35,37,39,40,45,46,48,50,51,52,54,55,57,60,62,64,65,67,69,70,71,73,77,81,83,84 +VCC and GNDQuoteProbably true for JTAG programming but not for parallel.Attach one EPM7128E (not S) Beeprog-pulseview capture (I think was a read).

author: megov
author_rank: Contributor
timestamp: September 10, 2024, 11:23:34 am
content: I take a couple steps back and solder adapter for EPM7064SLC44 and EPM7032SLC44 as their pinouts are more clear. Schematic attached here.For 7032 family, the only chip in PLCC44 that I have is EPM3032ALC44. I know, that it should be powered 3.6V and may be incompatible with 7032S for programming. But and I try to read ID from it.Well. Reading failed as pin4 (SCK) shunts SCK signal to ground just after 12V was applied to Vpp. SCK level was dropped to <0.5V so input shift registers was not clocked properly. I assume, that (at least for EPM3032ALC44) in programming mode pin4 become an output. Lucky enough, I didn't burn anything, both my test picture and chip work after the 12V torture. I've ordered 6 EPM7032SLC44 and 6 EPM7064SLC44 and will continue investigation.For EPM7064SLC44 results are better, I've not read ID yet, but have some responses. Main problem: what values should have a bunch of other signals?Firstly I set BE=0,, BEM=0, MTIN=0, SS_BI=0, TM=0, MT=0, CB=0, BP=0, BV=0, GAD0=0, GAD1=0, A0-A7 have 0x7C address, NTPW=1.I set 0001 pattern 16 times on all SDINA/B/C/D inputs and clock each bit with 0-1-0 SCK pulse, than try to read five 16 bit packets from outputs: SS_BI=0 during the first SK pulse, then SS_BI=1 during other 15 SK pulses, then SS_BI=0 plus a single SCK pulse. All SCOx remains 0 while reading, but SDOA output shows an interesting waveform (see SDOA.PNG)When I change initial values to CB=BP=BV=1 and run reading cycle, all SCOx remains 0 in writing phase, but turns to 1 when reading started (see SCOA-00.png).It seems that "there is a life inside", but something wrong in procedure. Maybe 5x16=80 bits * 4 pipes of input is not enough? Or some combination of other signals needed?BTW, does anyone know purposes of all these BP/BV/CB/TM/ME/etc signals?I'm not sure, but is seems that /NTPW is a "write" strobe (=1 while reading) and BE is "bulk erase" signal (=0 while reading and =1 during erasing).PS: SCOx behavior changes with CB=1, BP and BV do not affect it.

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: September 10, 2024, 03:39:50 pm
content: Quote from: megov on September 10, 2024, 11:23:34 amMAX 7000AE/3000A (also ATF15xx excluding ATF1500) series differ far from the parallel programming, only JTAG available and the OE1 pin is used to reclaim JTAG functionality, according to ADP-7064AE and ADP-ATF1508 diagrams from Matthieu's, drawn by tinhead@eevblog.

author: megov
author_rank: Contributor
timestamp: September 11, 2024, 06:36:03 pm
content: Another deep dive, today into A70X.EXE.I gathered together all ALL-03/EXPRO-80 schematics that I can download from Matthieu Benoit's site (Many thanks to him!), cut down A70X executable inside IDA and write SAC-201 emulation stub inside DosBox.Just like @migry already done before. While A70X were written in C, its internals are quite cumbersome, because it supports a bunch versions of a programmer, different versions of DOS, VGA and BW access to videoram and all that compatibility stuff. Hardware detection routines are located here-and-there and obstruct to find actual CPLD interaction protocol.Currently I have a more or less clear traces of ReadID for EPM7064LC44 and EPM7064LC84.As a next step I'll try to convert bitbang traces to actual pin handling routines (including ALL-03 registers to test socket pins mapping + known ADP-7064 topology) and reimplement them on my test fixture.PS: It is interesting, that both ALL-03 schematic and software evolved over time. For example, there is ALL-03_Hardware_IO_Configuration.PDF document from Matthieu Benoit's site, contains, I think, the earliest version of registers map. There were no F6 (marked as unused) and F7 register, EF register has only two positions for GND pins, etc. But software accessed some undocumented entities:reading from undocumented F8 registeraccessing registers 01h-07h while outputting 80h to 0F6h registerand the most brilliant thing: organizing serial (CLK+DATA) interface on two LSBs of VOP DAC (reg E7h)The latter used to detect some hardware through serial channel. Unfortunately, I don't know anything about it. And also I can't find any info on schematics, except two nets on HILOSYSTEMS ALL-03A/SUNSHINE EXPRO-80 PDF, that marked, but hanging float (or I can't find their destination).

author: megov
author_rank: Contributor
timestamp: September 12, 2024, 08:42:07 pm
content: Spent another day in (retro) digital archeology. I've caught traces of Read ID action from A70X.EXE for EPM7064LC84 (I assume that ADP-7064(S) was designed for it) and EPM7064LC44 (I have two of these).By "traces" I mean access logs to ALL-03 programmer, captured by my patched DosBox. It was very easy to do, emulation code attached here. You also need to add all03.cpp to ./src/hardware/Makefile.am and init sequence to ./src/dosbox.cpp:diff -urN ./dosbox.cpp ./.new--- ./dosbox.cpp 2024-09-12 23:08:46.835771316 +0300+++ ./.new 2024-09-12 23:05:42.609356654 +0300@@ -654,6 +654,10 @@Pbool = secprop->Add_bool("disney",Property::Changeable::WhenIdle,true);Pbool->Set_help("Enable Disney Sound Source emulation. (Covox Voice Master and Speech Thing compatible).");+ secprop->AddInitFunction(&ALL03_Init,true);//done+ Pbool = secprop->Add_bool("all03",Property::Changeable::WhenIdle,true);+ Pbool->Set_help("Enable ALL03 parallel programmer emulation.");+secprop=control->AddSection_prop("joystick",&BIOS_Init,false);//donesecprop->AddInitFunction(&INT10_Init);secprop->AddInitFunction(&MOUSE_Init); //Must be after int10 as it uses CurModeTraces were analyzed and matched with A70X.EXE code with TurboDebugger and IDA. As a result, mapping from software to PLCC84 pins was created.../-------------Notes and comments---------------\| /----------ALL-03 ZIF socket pins--------\ || | /-------Initial TTL value-----------\ | || | | /-------PLCC84 pins-----------\ | | || | | | /--ADP7064 connections--\ | | | |vvvvvvvvvvvvvvvvvv v v v v v v v v vvvvvvvvvvvvvvvvvvvvvvvvvv01 0 p35:AD0 NC 1 4002 0 p36:AD1 244(B)/G 1 3903 0 p37:AD2 244(A)/G 1 3804 0 p41:AD3 NC 0 3705 0 p44:AD4 UNK?:p16 0 36 BE?06 0 p48:AD5 NC 0 3507 0 p49:AD6 GAD1:p33 0 3408 0 p50:AD7 GAD0:p31 0 33 Buf by 2x LS14DIN9 Thru 244(A) 09 1 p20:SDINA 1 32 DIN32?DIN10 Thru 244(A) 10 1 p39:SDINB 0 31 VCCIO? not conn. to VCC by softDIN11 Thru 244(A) 11 1 p46:SDINC VCCINT 1 30DIN12 Thru 244(A) 12 1 p65:SDIND VPP:p84 0 29 0->1->VOP13 1 p67:MT? SCOD:p81 1 28 DIN28 Thru 244(B)TDI 14 1 p14:BP? SCOC:p62 1 27 TCK/DIN27 Thru 244(B)TDO 15 1 p71:BV? SCOB:p23 1 26 TMS/DIN26 Thru 244(B)16 1 p68:CB? SCOA:p04 1 25 DIN25 Thru 244(B)17 1 p01:/NTPW MTIN:p02 0 24 (or GCLK2)GCLK1 Buf 2xLS14 18 0 p83:SK BEM:p17 0 2319 0 p69:UNK? SCK:p79 0 22 Buf by 2x LS1420 0 GND SS_BI:p77 0 21... and Read ID procedure was documented:;===================INITIAL PREPARATIONALL03 <-6 Set VOP to 0 (+6*0.1V steps for drop compensation);------seg005:082A @@EPM7064Entry inside setVCC_VOP_ADxALL03 <-0 082A: mov regE0_init, 0 [Pins 8-1=0] -> Address AD[7-0]=00hALL03 <-FF?: only in trace [Pins 16-9=1]ALL03 <-1 082F: and regE2, 1 [Pin 17=1 (/NTPW), pins 24-18=0]ALL03 <-AF 0834: and regE3, 0A0h + or regE3, 0FH[Pins 32, 30, 28-25=1 (SCOx), 29 and 31 =0]ALL03 <-E0 083E: and regE4, 0E0h [Pins 40-38=1, 37-33=0]ALL03 <-8C 0872: Set VCC to 7Dh=125*0.04V=5.0V(+0FH*0.04V steps for drop compensation);------seg005:0922 applyVCC_P30_P32ALL03 <-28 093A: or regED, 28h [0010 1000 - VCC to pins 30 and 32];------seg005:0A16 applyVOPRampUp_P29(byte desiredVOP =78h=120*0.1V=12.0V)ALL03 <-BF 0A33: or regE3, 10h [xxx1 xxxx - Set pin 29(VPP) to 1]ALL03 <-10 0A50: or regEB, 10h [xxx1 xxxx - Turn on VOP on pin 29 (VPP)]ALL03 <-6 0A70: inc regE5 LOOP: Ramp VOP voltage from 10.2V(+6*0.1V steps for drop compensation)up to desiged level in arg_0ALL03 <-7ALL03 <-8...ALL03 <-7E;------seg002:024E setADxAddressALL03 <-E4 02A5: or regE4, 4. Was E0, now E4[xxxx x1xx - Set 1 to pin 35 - NC on adapter??]ALL03 <-7A 02F7: <-arg_0. Was 0, now 7A[0111 1010 - Set 1 to pins 2,4,5,6,7]Set address AD[7-0]=7Ah;------seg005:0898 continues @@EPM7064EntryALL03 <-F4 0898: or reg4, 10h. Was E4, now F4.[xxx1 xxxx - Set 1 to pin 37 - NC on adapter??]ALL03 <-46 08BC: Set VHH to 60*0.06V=3.6V (+10 steps for drop comp.)BUT VHH IS UNCONNECTED YET!;===================SET BLOCK ADDRESSALL03 <-F4 0BF4: setADxAddress 7ChALL03 <-7C;===================SEND READ ID BIT PATTERNregE1 was FF before.;-----5 times cycle #0ALL03 <-F0 0498: and regE1, 0F0h + or regE1, al4 LSB pins (9,10,11,12) of regE1 -> 4 SDINx pipes;------seg002:0C84 pulseSCKALL03 <-21 0C84: or regE2, 20h [xx1x xxxx - Set pin 22 to 1]ALL03 <-1 0CA0: and regE2, 0DFh [xx0x xxxx - Clear pin 22 to 0]<-F0 <-21 <-1<-F0 <-21 <-1<-F0 <-21 <-1* <-FF <-21 <-1;----- repeat cycle 16 times:ALL03 <-F0 <-21 <-1 <-F0 <-21 <-1 <-F0 <-21 <-1 <-F0 <-21 <-1<-FF <-21 <-1;===================READ RESPONSE;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:05D3 inResponseReadID (sub_5553);#0 regE2 was 01 beforeALL03 <-81 0784: or regE2, 80h [1xxx xxxx - Set pin 24 (MTIN) high]ALL03 <-83 07A4: or regE2, 02h [xxxx xx1x - Set pin 18 (SK) high]dly5ALL03 <-93 07C0: or regE2, 10h [xxx1 xxxx - Set pin 21 (SS_BI) high]dly5ALL03 <-91 07DC: and regE2,0FDh [xxxx xx0x - Set pin 18 (SK) low]dly5ALL03 <-11 07F8: and regE2,7Fh [0xxx xxxx - Set pin24 (MTIN) low]ALL03 ->0 0810: read back from regE3 [need pins 28-25, low nibble];#1 regE2 was 11h beforeALL03 <-13 07A4: or regE2, 02h [xxxx xx1x - Set pin 18 (SK) high]ALL03 <-13 07C0: or regE2, 10h [xxx1 xxxx - Set pin 21 (SS_BI) high - already high]ALL03 <-11 07DC: and regE2,0FDh [xxxx xx0x - Set pin 18 (SK) low]ALL03 <-11 07F8: and regE2,7Fh [0xxx xxxx - Set pin24 (MTIN) low - already low]ALL03 ->0;-----do the same as #1 14 timesALL03 <-13 <-13 <-11 <-11 ->0 ;#2...ALL03 <-13 <-13 <-11 <-11 ->0 ;#15;-----finalize SS_BI to lowALL03 <-1 0839: and regE2, 0EFh [xxx0 xxxx - Set pin 21 (SS_BI) low ];<<<<<<<<<<<<<<<<<<< 1/5 seg005:0C21;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:0565 lowSDINx (sub_54E5)regE1 was FF beforeALL03 <-F0 05B1: and regE1, 0F0h [xxxx 0000 - Set pins 12-09 (SDIND-SDINA) to low ]dly05ALL03 <-21 05AB: pulseSCKALL03 <-1;<<<<<<<<<<<<<<<<<<< 1/5 seg005:0C29;-----Loop calls to inResponseReadID and lowSDINx for 4 times;-----Reading from E3 register at each step should bring SCOx data in 4 LSB bits;===================FINALIZING;>>>>>>>>>>>>>>>>>>> Call seg005:0D0C shutDownVoltages (sub_E7DC);>>>>>>>>>>>>>>>>>>> Call seg005:0AF0 rampDownAndRemoveVOP (sub_E5C0)ALL03 <-7E 0B06-0B1C: Ramp down VOP to 2BhALL03 <-7D...ALL03 <-32ALL03 <-31ALL03 <-0 0B30: remove VOP from pins 24-17ALL03 <-0 0B4F: remove VOP from pins 32-25;<<<<<<<<<<<<<<<<<<<;>>>>>>>>>>>>>>>>>>> Call seg005:0A92 removeVHH_VCC (sub_E562)ALL03 <-0 0AB0: remove VHH from pins 32-25ALL03 <-0 0ACA: remove VCC from pinf 40-28;<<<<<<<<<<<<<<<<<<<ALL03 <-6 0D37: setVOP to 0ALL03 <-A 0D41: setVHH to 0ALL03 <-F 0D4B: setVCC to 0

author: megov
author_rank: Contributor
timestamp: September 12, 2024, 09:00:42 pm
content: And about results.1. I exactly code the Read ID sequence from previous message into my test fixture. With exception of ramp up/down VOP and other voltages and connecting them to pins by software: VCC is tied to VCCIO+VCCINT, VPP to VPP.The behavior is the same: SCOx rises high when response reading begins and falls to low after. No serial data is visible on SCOx. I have an assumption, that SK clock (or, maybe, other signals) needed for serial outputting are misrouted on ADP-7064 and on my test adapters.2. ADP-7064S adapter schema has some questions:- two PLCC84 pins (pin16 and pin69) are routed tio ZIF socket, but their purpose is unknown to me.- software sequence toggles ZIF pins 35 and 37, but they are not connected at adapter's side.- on the other side LS244 /OE pins connected, according to scheme, to ZIF pins 38 and 39. But these ZIF pins are set to 1 and untouched during the whole ReadID process. So neither SDINx, nor SCOx should work.Currently, I'm slightly stuck. Next goal is to trace EPM7128 Read ID procedure and compare it to 7064. According to code in A70X.EXE, procedures are different. I don't have and adapter schema for EPM7128, but have a couple of chips in PLCC84.

author: megov
author_rank: Contributor
timestamp: September 13, 2024, 08:40:46 am
content: Found another problem with ADP-7064S schematic.3. Software trace shows that VCC is supplied to pins 30 and 32. On schematic pin 30 is VCCINT and pin 31 is VCCIO. That means there will be no VCCIO on CPLD!Pin 32 marked as a signal DIN32 and has a capacitor to ground, so it is possibly designed to be a power pin. But there are no connections to it on the whole scheme (or I can't found them).So, now we have no proven adapter schematic (or proven pinouts for parallel programming) neither for EPM7064 nor for EPM7128. Neither for PLCC packages, nor for QFP100.Does anyone have this information? Or, maybe a working adapter to restore schematic from it (especially for 7128)?

author: megov
author_rank: Contributor
timestamp: September 13, 2024, 11:58:20 am
content: Let's continue.Here is a trace of Read ID procedure for EPM7128(S)LC84. (SAME) means that interaction is exactly the same as for EPM7064, (SIMILAR) means that interaction may use slightly different values, but do the same thing, (DIFF) means that interaction is different or not used on EPM7064.;=================== Initial setupALL03 <-6 (SAME) Set VOP to 0 (+6*0.1V steps for drop compensation)ALL03 <-0 (SAME)ALL03 <-0 (DIFFERENT) Was FF on 7064ALL03 <-1 (SAME)ALL03 <-A0 (DIFFERENT) Was AF on 7064ALL03 <-E0 (SAME)ALL03 <-8D (DIFFERENT) Was 8C on 7064 -> VCC=5.04V;---------------applyVCC_P30_P32ALL03 <-28 (SAME) [0010 1000 - VCC to pins 30 and 32];---------------PRACTICALLY THE SAME: TURN ON VPPALL03 <-B0 (SIMILAR) A0->B0 [xxx1 xxxx - Set pin 29(VPP) to 1 (TTL)]ALL03 <-10 (SAME) [xxx1 xxxx - Turn on VOP on pin 29 (VPP)];---------------RAMP UP VOPALL03 <-6 (SAME) LOOP: Ramp VOP voltage from 10.2VALL03 <-7 (+6*0.1V steps for drop compensation... up to desired level in arg_0ALL03 <-7DALL03 <-7E;---------------ALL03 <-E0 (DIFFERENT) regE4 already set to E0 by init sequenceALL03 <-7A (SAME) Set address AD[7-0]=7Ah;---------------ALL03 <-F0 (SIMILAR) E0->F0 [xxx1 xxxx - Set 1 to pin 37 - NC on adapter??]ALL03 <-F0 Why do it twice?ALL03 <-7C (SAME) setADxAddress: set address AD[7-0]=7Ch;=================== Send Read ID pattern to CPLD;>>>>>>>>>>>>>>>>>>> Call seg002:0311 outReadIDPattern (sub_5291);(DIFFERENT) IT SEEMS THAT 7128 HAS 8 SERIAL PIPES. IO is bidirectional;through E1 register (pins 16 to 9);;#0 /---SCK pulse--\ALL03 <-0 <-21 <-1 <-0 <-21 <-1 <-0 <-21 <-1 <-0 <-21 <-1<-FF <-21 <-1... Run same pattern 14 times (total - 17!);#15ALL03 <-0 <-21 <-1 <-0 <-21 <-1 <-0 <-21 <-1 <-0 <-21 <-1<-FF <-21 <-1;#16 (DIFFERENT) Strange 17th pattern, regE1 is not set before SCK pulse, but it should be the same (00)ALL03 <-0 <-21 <-1 <-21 <-1 <-21 <-1 <-21 <-1<-FF <-21 <-1;<<<<<<<<<<<<<<<<<<<;=================== Read response back from CPLD;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:05D3 inResponseReadID (sub_5553)ALL03 <-FF Seems it is needed to set regE1 tp 0FFh before reading from itALL03 <-B0 (DIFF) F0->B0 Clear pin 39 (???)ALL03 <-81 (SAME) 01->81 Set pin 24 (MTIN?)ALL03 <-F0 (DIFF) B0->F0 Set pin 31 (???)ALL03 <-83 (SAME) 81->83 Set pin 18 (SK)ALL03 <-93 (SAME) 83->93 Set pin 21 (SS_BI?)ALL03 <-91 (SAME) 93->91 Clear pin 18 (SK)(DIFF) On 7064 MTIN goes low here, on 7128 it goes low after 2 readsALL03 <-B0 (DIFF) F0->B0 Clear pin 31 (???)ALL03 ->0 ;#0 (SIMILAR) Read 8 pipes, bidirectional, shared with outputs to SDINx/----Pulse pin 18 (SK)---\ /--???-\ /-READ-\| while pin24=1 (MTIN?) | | | | |ALL03 <-93 <-93 <-91 <-B0 ->0 ;#1ALL03 <-11 (DIFF) 91->11 Set pin 24 (MTIN?) low, on 7064 is happens before 1st read/----Pulse pin 18 (SK)---\ /--???-\ /-READ-\| while pin24=0 (MTIN?) | | | | |ALL03 <-13 <-13 <-11 <-B0 ->0 ;#2... Run same pattern 12 times (total - 16)ALL03 <-13 <-13 <-11 <-B0 ->0 ;#15; FinalizingALL03 <-B0 (DIFF) regE3 should already be 0B0h, clear pin 31 (???)ALL03 <-11 (DIFF) regE2 should already be 11h, clear pin 18 (SK)ALL03 <-F0 (DIFF) B0h->F0h Set pin 39 (???)ALL03 <-1 (SAME) 11h->01h Clead pin 21 (SS_BI?);<<<<<<<<<<<<<<<<<<<;>>>>>>>>>>>>>>>>>>> 1/5 Call seg002:0565 lowSDINx (sub_54E5)ALL03 <-0 (SIMILAR) Set all SDINc to 0ALL03 <-21 (SAME) SCK (pin 22) goes high 0->1ALL03 <-1 (SAME) then back to low 1->0;<<<<<<<<<<<<<<<<<<<;Repeat procedure (inResponseReadID + lowSDINx) 4 times more.;Total - 5 times;=================== Shutdown;>>>>>>>>>>>>>>>>>>> Call seg005:0D0C shutDownVoltages (sub_E7DC);>>>>>>>>>>>>>>>>>>> Call seg005:0AF0 rampDownAndRemoveVOP (sub_E5C0)ALL03 <-7E (SAME) Ramp down VOP to 2BhALL03 <-7D...ALL03 <-32ALL03 <-31ALL03 <-0 (SAME) remove VOP from pins 24-17ALL03 <-0 (SAME) remove VOP from pins 32-25;<<<<<<<<<<<<<<<<<<<;>>>>>>>>>>>>>>>>>>> Call seg005:0A92 removeVHH_VCC (sub_E562)ALL03 <-0 (SAME) remove VHH from pins 32-25ALL03 <-0 (SAME) remove VCC from pinf 40-28;<<<<<<<<<<<<<<<<<<<ALL03 <-6 (SAME) setVOP to 0ALL03 <-A (SAME) setVHH to 0ALL03 <-F (SAME) setVCC to 0;<<<<<<<<<<<<<<<<<<<; Execute standard init seqence<-FF <-0 <-0<-FF <-0 <-0<-FF <-0 <-0<-FF <-0 <-0<-FF <-0 <-0<-0 <-0 <-0 <-0<-0 <-0 <-0<-0 <-0;<<<<<<<<<<<<<<<<<<<Looking to trace I understood two things:EPM7128 definitely has 8 serial pipes instead 4 for EPM7064Adapter for EPM7128 must be different, ADP-7064(S) will not work.Partial connection schema here:==================================================================/-------------Notes and comments---------------\| /----------ALL-03 ZIF socket pins--------\ || | /-------Initial TTL value-----------\ | || | | /-------PLCC84 pins-----------\ | | || | | | /--ADP7064 connections--\ | | | |vvvvvvvvvvvvvvvvvv v v v v v v v v vvvvvvvvvvvvvvvvvvvvvvvvvv01 0 p??:AD0 1 4002 0 p??:AD1 ??? 1 3903 0 p??:AD2 1 3804 0 p??:AD3 ??? 0 37 0->1 before set address05 0 p??:AD4 0 3606 0 p??:AD5 0 3507 0 p??:AD6 0 3408 0 p??:AD7 0 33out:SDINA in:SCOA 09 0 1 32 maybe VCCIO?out:SDINB in:SCOB 10 0 ??? 0 31out:SDINC in:SCOC 11 0 VCCINT:pXX 1 30out:SDIND in:SCOD 12 0 VPP:p84 0 29out:SDINE in:SCOE 13 0 0 28out:SDINF in:SCOF 14 0 0 27out:SDING in:SCOG 15 0 0 26out:SDINH in:SCOH 16 0 0 25Const.1 (reading) 17 1 p??:/NTPW 0 24Buf by 2x LS14 18 0 p??:SK 0 2319 0 SCK:p?? 0 22 Buf by 2x LS1420 0 GND SS_BI:p?? 0 21Notes:1. As there are no proven parallel programming pinouts for EPM7128SLC84, PLCC84 pins are not shown. Maybe some of them use the same pins with EPM7064SLC84.2. Serial data handling was changed, EPM7128 have 8 serial pipes instead of 4. So port E1 is bidirectional, output goes to SDINx, input reads from SCOx. It is unknown, how directions are switched. Exact pins for SDINx/SCOx alsounknown.3. VPP/VOP handling is the same as for 7064 (prog socket pin 29 -> pin 84 PLCC84)4. VCC handling is uncertain. I've found two different bit designations for register ED. ALL-03_Hardware_IO_Configuration.PDF says that VCC applied to pins 28(bit7), 29, 30, 31, 32, 34, 36, 40(bit0), while HILOSYSTEMS ALL03-1 says 29(bit7), 30, 31, 32, 33, 35, 37, 41(bit0). I assume the first layout and applying power to socket pins 30 and 32 (=28h).5. Pin 31 was unused for EPM7064, but pulsed around SK in the first cycle of reading response. I don't know the signal name.6. Pin 37 have a strange behavior: set to 1 before setting address and stays hi for whole ReadID procedure.7. Pin 39 set high from beginning and goes low only for inResponseReadID call. Maybe it is used as /RD signal for SCOx buffer. While high, buffer is disabled and output to register E1 goes to SDINx CPLD inputs. If pin 39 goes low, SCOx buffer outputs enabled and can be read out through port E1.

author: megov
author_rank: Contributor
timestamp: September 14, 2024, 06:45:29 pm
content: Got trace of Erase procedure for EPM7064(S)LC84.As it was mentioned earlier in the thread by @migry, it is true, that software read 7Ch block with ID data, do bulk erase and write block back (+re-reading to check).And with this knowledge, I'm wonder how EPM7032 JTAG Unlocker (https://forum.system-cfg.com/viewtopic.php?p=231550&sid=6de82b2b764883e14e21c6b7779cc86f#p231550) works.So, in order to going further, the base problem that needs to be solved - being able to Read ID from CPLD. It is a cornerstone operation.

author: megov
author_rank: Contributor
timestamp: September 15, 2024, 03:21:12 pm
content: The idea behind today's work is to summarize information about pinouts and adapters known to me, add knowledge from software traces and try to make some new assumptions. Results are gathered into large table below.At first I add to EPM7064SLC44 and EPM7064SLC84 "usual" pinouts information about what exact LAB and Cell is connected to pin. It will help to match different pins in different packages to same die signals. So, all IO pins below are named using <Lab><Cell> notation: A16, D55, etc. Results are shown in "PLCC44 pin & purpose" and "PLCC84 pin & purpose" columns.Second step is to write down possible PLCC84 pinout assuming that PLCC44 pinout in AD359 description is right. PLCC44 signal names gathered to "AD359 pin descriptions" and transferred to "PLCC84 pin assumptions" column to pins with the same LAB/Cell. Pins with LAB/Cell that do not present on smaller package firstly marked as NC (Not connected).Third step is matching these PLCC84 signal assumptions with ADP-7064 schematic. "ADP-7064S-PL84 conn." column shows ALL-03 DIP40 ZIF socket pins (on a programmer side).After matching there are three cases:AD359 pin description matches the schematics. That means we know signal designation and pin numbers for both packages. Good!NC pins from PLCC84 that pulled down on PLCC84 adapter. These are unused pins. Also good.Meaningful signals that pulled down on PLCC84 adapter or meaningful signals, that connected to ALL-03 ZIF socket and not exist in PLCC44.Third case shows that parallel programming pin functions not assigned consistently to different packages and adapters schematic must be specific device type and package.That's sad as too many combinations exist and to few information available.Table legend:Pin directions (at CPLD side): (I) - input, (O) - output, (P) - power, (*?) - uncertain directionPin connections on adapter side: (PD) - pulled low thr. 100R-560R, (PU) - pulled high thr. 10k, (TS) - buffered with 2x Schmidt triggers, (GA/GB) - gated through A/B half of 74LS244.Adaptors:AD359 - PLCC44 adaptor fromhttps://mqp.com/ad359.htm.ADP-7064S-PL84 - PLCC84 adapter with schematic found at Matthieu Benoit site.SDP-7064-84 - EPM7064 PLCC84 adaptor from "Dataman 48 Adaptor Connection Table" PDF.PLCC44 pin AD359 pins PLCC84 pin PLCC84 pin ADP-7064S- SDP-7064& purpose descript. & purpose assumption PL84 conn. -84 conn. Commentp01 /GCLRn /NTPW(I) p01 /GCLRn /NTPW(I) p17 p05 Ok. Program/Erase strobe. High when reading.p02 OE2 MTIN(I) p02 OE2 MTIN(I) p24+PD 4k7 p06 Ok.p03 VCC VCC(P) p03 VCCINT VCC(P) p30:VCCINT p44:VCC Ok.p04 A16 SCOA(O) p04 A16 SCOA(O) p25 (GB) p07 Ok.p05 A15 NC PD PD Ok.p05 A14 BE(I) p06 A14 BE?(I) PD PD ?1. BE by LAB/Cell pin? But PD on both adaptors.p07 GND GND(P) p20:GND p24:GND P24:GND Ok.p08 A13 NC PD PD Ok.p09 A12 NC PD PD Ok.p06 A11 SDOA(O?) p10 A11 SDOA(O?) PU p08 ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.p11 A10 NC PD PD Ok.... ... ... ... ... ... ...p12 A9 NC PD p02 ??. Diff between ADP7064 and SDP-7064-84p13 VCCIO VCC(P) p30:VCCINT p44:VCC Error? CPLD pin is VCCIOp07 A8/TDI BP(I?) p14 A8/TDI BP(I?) p14 p09 Ok.p15 A7 NC PD PD Ok.p16 A6 BE?(I) p36 p10 ?1. Maybe BE on both adaptors?p08 A5 BEM(I) p17 A5 BEM(I) p23 p11 Ok.p09 A4 - p18 A4 NC PD p03 ??. Diff between ADP7064 and SDP-7064-84p10 GND GND(P) p19 GND GND(P) p20:GND p24:GND Ok.p11 A3 SDINA(I) p20 A3 SDINA(I) p09 (GA) p12 Ok.p21 A2 NC PD PD Ok.p12 A1 - p22 A1 NC PD PD Ok.p13 B32/TMS SCOB(O) p23 B32/TMS SCOB(O) p26 (GB) p13 Ok.p24 B31 NC PD PD Ok.p14 B30 AD0(I) p25 B30 AD0?(I) PD PD ?2. AD0 by LAB/Cell pin? But PD on both adaptors.p15 VCC VCC(P) p26 VCCIO VCC(P) p30:VCCINT p44:VCC Error? CPLD pin is VCCIOp27 B29 NC PD p04 ??. Diff between ADP7064 and SDP-7064-84p28 B28 NC PD p22 ??. Diff between ADP7064 and SDP-7064-84p29 B27 NC PU p14 ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.p30 B26 NC PD PD Ok.p16 B25 GAD0(I) p31 B25 GAD0(I) p33 (TS) p15 Ok. Why triggers? It's not a clock signal.p32 GND GND(P) p20:GND p24:GND Ok.... ...p17 B24 GAD1(I) p33 B24 GAD1(I) p34 p16 Ok.p34 B23 NC PD PD Ok.p35 B22 AD0?(I) p01 p17 ?2. Maybe AD0 on both adaptors (**1)... ...p18 B21 AD1(I) p36 B21 AD1(I) p02 p18 Ok.p19 B20 AD2(I) p37 B20 AD2(I) p03 p19 Ok.p38 VCCIO VCC(P) p30:VCCINT p44:VCC Error? CPLD pin is VCCIOp20 B19 SDINB(I) p39 B19 SDINB(I) p10 (GA) p20 Ok. ??? Is is AD3? (**1)p40 B18 NC PD p45 ??. Diff between ADP7064 and SDP-7064-84p21 B17 AD3(I) p41 B17 AD3(I) p04 p21 Ok.p22 GND GND(P) p42 GND GND(P) p20:GND p24:GND Ok.p23 VCC VCC p43 VCCINT VCC(P) p31:VCCIO p44:VCC Error? CPLD pin is VCCINT! Pin31 is not used in A70X.EXEp24 C33 AD4(I) p44 C33 AD4(I) p05 p23 Ok.p45 C34 NC PD p01 ??. Diff between ADP7064 and SDP-7064-84p25 C35 SDINC(I) p46 C35 SDINC(I) p11 (GA) p25 Ok.p47 GND GND(P) p20:GND p24:GND Ok.p26 C36 AD5(I) p48 C36 AD5(I) p06 p26 Ok.p27 C37 AD6(I) p49 C37 AD6(I) p07 p27 Ok.p50 C38 AD7?(I) p08 p28 ?3. Maybe AD7 on both adaptors (**1)p51 C39 NC PD PD Ok.p28 C40 LPT1 p52 C40 LPT1 PD p29 ??. Diff. Purpose of LPT1 is unknownp53 VCCIO VCC(P) p31:VCCIO p44:VCC Ok.... ... ... ... ... ...p29 C41 LPT2 p54 C41 LPT2 PD p30 ??. Diff. Purpose of LPT2 is unknownp55 C42 NC PD PD Ok.p56 C43 NC PU p31 ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.p57 C44 NC PD p46 ??. Diff between ADP7064 and SDP-7064-84p58 C45 NC PD PD Ok.p30 GND GND(P) p59 GND GND(P) p20:GND p24:GND Ok.p31 C46 AD7 p60 C46 AD7?(I) PD PD ?3. AD7 by LAB/Cell pin? But PD on both adaptors.p61 C47 NC PD PD Ok.p32 TCK SCOC(O) p62 TCK SCOC(O) p27 (GB) p32 Ok.p33 D49 TM p63 D49 TM?(I) PD PD ?4. TM by LAB/Cell pin? But PD on both adaptor.p64 D50 NC PD PD Ok.p34 D51 SDIND p65 D51 SDIND p12 (GA) p33 Ok.p35 VCC VCC p66 VCCIO VCC(P) p31:VCCIO p44:VCC Ok.p36 D52 MT p67 D52 MT p13 p34 Ok.p37 D53 CB p68 D53 CB p16 p35 Ok.p69 D54 UNKp69 p19 p36 ?4. CPLD input (TM?) on both adaptorsp70 D55 NC PD PD Ok.p38 TDO BV p71 TDO BV p15 p37 Ok.p72 GND GND(P) p20:GND p24:GND Ok.p39 D57 SS_BI p73 D57 SS_BI?(I) PD p47 ?5. SS_BI by LAB/Cell? Different on adaptors.p74 D58 NC PD PD Ok.... ... ... ... ... ... ...p75 D59 NC PU p38 ??. Diff. ADP7064: weak 10k PU, ZIF pin on SDP7064.p76 D60 NC PD PD Ok.p77 D61 SS_BI?(I) p21 p39 ?5 SS_BI on adaptors?p78 VCCIO VCC(P) p31:VCCIO p44:VCC Ok.p40 D62 SCK(I) p79 D62 SCK(I) p22 (TS) p40 Ok. Should be SCKp80 D63 NC PD p48 ??. Diff between ADP7064 and SDP-7064-84p41 D64 SCOD(O) p81 D64 SCOD(O) p28 (GB) p41 Ok.p42 GND GND p82 GND GND(P) p20:GND p24:GND Ok.p43 GCLK1 SK(I) p83 GCLK1 SK(I) p18 (TS) p42 Ok. Should be SKp44 OE1 VPP(P) p84 OE1 VPP(P) p29:VPP p43 Ok. VPP/VOP prog voltage.Conclusion: initial assumption that same LAB/Cell pins should have the same parallel programming functions is wrong. Are wafer dies the same between different packages of the same device?I'm not sure, or some remappings are done as @reverse mentioned earlier.Looking to the difference between AD359 and ADP7064, I assume that these signals in PLCC84 package should be located at different pins (by LAB/Cell):PLCC44 PLCC84------------- -----------?1: p05 A14/BE -> p16 A6/BE Uncertain, but Erase sequence toggles it.?2: p14 B30/AD0 -> p32 B22/AD0 Proven by both PLCC84 adaptors. B30 is PD, but B22 connected to ZIF.?3: p31 C46/AD7 -> p50 C38/AD7 Proven by both PLCC84 adaptors. C46 is PD, but C38 connected to ZIF.?4: p33 D49/TM -> p69 D54/TM Uncertain, D49 is PD on adaptors, but unknown pin69@PLCC84 connected to ZIF.?5: p39 D57/SS_BI -> p77 D61/SS_BI D57 is PD on ADP7064, but pin77@PLCC84 connected to ZIF.Software sequences for this pin are looks like it is SS_BI.Errors about VCCIO/VCCINT in comments are for ADP-7064S-PL84: CPLD core VCC connecting to VCCIO net and vice-versa. It is not a great problem if both voltages are driven in sync (and they are, as we can see on traces). SDP-7064-84 is simpler as it contains only single common power rail.There is also differencies between ADP-7064S-PL84 and SDP-7064-84:1. All 4 CPLD pins (p10, p29, p56, p75 @PLCC84) that pulled up on ADP7064 are connected to pins of ZIF socket on SDP-7064-84.2. 10 CPLD pins (p12, p18, p27, p28, p40, p45, p52:LPT1, p54:LPT2, p57, p73 @PLCC84) that are pulled down on ADP7064 are also connected to pins of ZIF socket on SDP-7064-84.As for PLCC68, "Dataman 48 Adaptor Connection Table" PDF contains adapters for both 84 and 68 pin packages. So, it is possible to convert 84 pin pinout into 68 pin.Of course, when exact pinout for PLCC84 will be known.As for experimental side - nothing new: Read ID sequence was coded into my test fixture. SCOx raises high with first MTIN/SS_BI pulses, but no serial data present on SCOx.

author: megov
author_rank: Contributor
timestamp: September 15, 2024, 06:53:44 pm
content: Well, one simple question to forum's guru: am I right, that Altera MAX 7000S family devices (EPM7032SLC44, EPM7064SLC84, EPM7128SQI100, etc, etc, dozens of devices anyway) really support parallel programming mode? Yes, I know about their JTAG support and even use this kind of programming. Yes, I read somewhere, that JTAG can be disabled. Yes, I know that previous family (without S in suffix) does not support JTAG programming. So, am I right, that 7000S devices with disabled JTAG can be erased with parallel programmed and re-enable JTAG programming ability?Or I'm insane and just trying to teach 7000S chip samples to accept parallel programming while they lack of it, like 3000S device series?PS: I came to this theme by a simple reason - I own a whole tray (>60pcs) of new and unsoldered EPM7128SQI100-10 in rare and uncommon PQFP100/0.65 package (rectangle package, not square).Even their actual pinout is a mystery: I only can find a single 6th pages PDF from Altera with EPM7128 pin correspondence between PLCC84, TQFP100 (square), PQFP100 (rectangle) and PQFP160 (again, square).Two or three of them, being soldered to a interposer board do not answer to JTAG. So either I'm unable to trace JTAG pins, it is possible in this lack of information. Or they have JTAG disabled, that's why I'm here.I love digital archaeology and reverse engineering, but fell that I'm exhausted here now...

author: PCB.Wiz
author_rank: Super Contributor
timestamp: September 15, 2024, 10:16:12 pm
content: Quote from: megov on September 15, 2024, 06:53:44 pmA good point to ponder.IIRC the Atmel ATF15xx JTAG parts use a HV VPP PIN to enable JTAG, and have no parallel mode. Apply Vpp, and you enable the disabled JTAG pins.Once you have JTAG/Serial program, it must cost extra silicon to also include parallel program path, so I'd expect vendors to drop that (but keep a VPP enable)

author: Beta_vulgaris
author_rank: Regular Contributor
timestamp: September 16, 2024, 06:16:42 am
content: Quote from: megov on September 15, 2024, 06:53:44 pmPinouts can be found from MAX+plus II help file,Code:maxplus2.hlp.

author: pityokas
author_rank: Contributor
timestamp: September 16, 2024, 10:30:25 am
content: QuoteYes, I confirm for 7128S-84.I bought some 7128S from ali, for some got no response for jtag.After erased in socket, the jtag become alive.

author: megov
author_rank: Contributor
timestamp: September 16, 2024, 03:28:10 pm
content: Quote from: pityokas on September 16, 2024, 10:30:25 amGlad to hear it! So 7064S should also response to Read ID in parallel programming mode, but I didn't reach it yet. Anyway, it is worth to continue investigations.Today I return to my EPM7128SQI100. As @Beta_vulgaris advised, I look into MAX+plus II help file and JTAG pinout in it matches with I have in Altera's PDF (EPM7128E & EPM7128S Pin Tables ver. 1.0).For PQFP they are 6 - TDI, 17 - TMS, 64 - TCK and 75 - TDO. I've checked connections, they're OK.For experiments I have a simple test board with 10 pin JTAG connector, 44 pin LCC socket, 84 pin LCC socket and 2.54 pin sockets to accept PQFP100 interposer.Schematic is trivial, routed power and ground, TDI, TMS and TDO have 1K pull-ups and TCK has 1K pull-down. Additionally a blinker on 555 used as a clock generator.I use it successfully for EPM7064SLC44, EPM7032ALC44 and EPM7128SLC84, programming a simple counter/divider into CPLD and looking to blinking LEDs.But when I insert my EPM7128SQI100, soldered to interposer, both TDI and TMS strongly pulled down, idle level drops from >4,5V to ~1.2-1.3V.Current draw also rises from 20-50mA to 280mA or so. EPM7128SQI100 become slightly warm. TDI and TMS sinks 5 mA each when power is applied and JTAGis not connected and ~75mA each, when JTAG cable + Blaster connected. TCK, whilke also being an input, behaves well - clock pulses are >4,5V.On the other side, I'm not see that TDI and TMS are dead short. Of course, all connections, soldering etc was checked many times, PLCC CPLDs programmedsuccessfully, so JTAG part also works. I really can't explain this behavior, the only thought that left is that JTAG is disabled and TMS/TDI pins reused as outputs (and set low).I took 3 chips from a batch and use 2 interposer boards and all 3 behaves identically. The funniest thing is that chips are supposed to be new: I've bought then inside a tray,they are not soldered. Mysterious things

author: pityokas
author_rank: Contributor
timestamp: September 16, 2024, 04:53:58 pm
content: Unsoldered, disabled jtag = factory programmed jtag reused chips(probably).My beeprog warning me about ID check, they say some Altera chips did not respond to ID but you can program anyway.Some programmers like topmax not let to bypass the ID check, without ID just stop.Mystery.

author: megov
author_rank: Contributor
timestamp: September 16, 2024, 06:05:17 pm
content: Quote from: pityokas on September 16, 2024, 04:53:58 pmSorry, but I'm unable to understand the phrase. Do you mean, that my batch of unsoldered chips was or may be factory programmed for some specific function,and this programming includes disabling JTAG? May be. Programming using external programmer (with suitable adapter and ZIF-like socket) is hardly noticeableon pins tin coating. May be they were programmed for some project that was cancelled as I bought them quite cheap at local marketplace. But seller wasn't notifyme that chip were pre-programmed.Quote from: pityokas on September 16, 2024, 04:53:58 pmAs for ID check, all that is easy for me. I do not own any of these vintage programmers, neither I want to buy one.They're old, expensive, require an old system (DOS, Windows, ISA cards, etc), force to struggle with their software, etc.Rather I want to implement a simple device that connects through a COM port and able to erase/restore JTAG for some CPLD types.Maybe, if I have spare time and some passion - to add implementation of actual parallel programming.Even for proper erasing CPLD you also must be able to do Read ID, Bulk Erase and Program block procedures,that means that you already have most of interaction with a chip. Adding "Program POF" may not be too difficult.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: September 16, 2024, 09:15:45 pm
content: Quote from: megov on September 16, 2024, 03:28:10 pmI'm not sure you can make that leap.Erase in socket may simply apply Vpp and erase via JTAG, and once erased, the JTAG disable fuse is cleared, so then normal in circuit pgm (No Vpp) is ok.If your PCB HW design allows Vpp to be applied to the pin (voltage tolerant) you can just apply 12V* to over-ride.ISTR some comments about total time with 12V* applied in some vendor's spec, so permanent 12V* is probably not a good idea.* 12V or whatever vendor Vpp is.

author: pityokas
author_rank: Contributor
timestamp: September 17, 2024, 04:48:34 am
content: QuoteI wanted to say,You can order from factory(for extra money) a brand new preprogrammed with your pof,Probably yours is something like that. Somebody ordered from some hardware a preprogrammed cpld-s, then the project was dropped and maybe somebody else sold without know about.And for your bad luck the jtag was disabled.QuoteYou have to focus only on that.The pof file and cpld address mapping is another mystery, forget it.(my opinion)Probably every type/package have different mapping table and different programming timings.Returning to topic (parallel programming EPM7000 without S) I think the best option is to find documented/reversed programmer who have documented adapter(s),then clone/improve and use the original software.Or emulate in software then send to different hardware the result, but still use the original software.Also reversing the software without knowing the original hardware is just a guessing and lead to dead endFor example the all07 is well documented but hard to find the required adapters schematic.I once implemented a lot of chips used by all07 inside cpld, and routed outside only the pins needed for experiment.Just got an idea, can you find the erase function in that software (skipping the ID check) to see if just a static setup for pins or it's a complex procedure?

author: megov
author_rank: Contributor
timestamp: September 17, 2024, 07:16:22 am
content: Quote from: PCB.Wiz on September 16, 2024, 09:15:45 pmNo, it works only for Atmel's ATF15xx and possibly for MAX 7000AE/3000A. I tried to use this method on my EPM7064SLC44 and EPM7128SLC84 - it doesn't work. Applying ~12V Vpp prevents these chips to answer through JTAG.Of course +12V applied only for a couple of seconds. @Beta_vulgaris said about it earlier:Quote from: Beta_vulgaris on September 10, 2024, 03:39:50 pmQuote from: pityokas on September 17, 2024, 04:48:34 amI've already done it. You can find 3 traces (first two in the messages, third in attachment) here in the thread above. I took ALL-03 docs and A10X.EXE from Matthieu's and dig all that.An SC-201 emulation stub was written to DosBox and all interaction between software and programmer's ZIF socket pins (not including adapter for the exact chip type) was recordedand later analyzed. Yes, traces look like "ancient scripts", but they contain exact sequences for ReadID on EPM7064(S)LC84 and EPM7128(S)LC84 and Erase procedure for EPM7064(S)LC84.And "Erase" is not a static procedure: it reads ID block (7Ch) not only for checking ID (this check can be removed by JNE->JMP 2 bytes patch), but for reprogramming ID block back after bulk erase.Also, Read ID trace for EPM7064(S)LC84 contains ZIF socket pinout with signal names, that were guessed by looking to trace itself and ALL-03 and ADP-7064S-PL84 schematics.My another message above contains a big table with pin designation and correspondence for the 2 EPM7064 packages and 3 adapters. So many information were already dug up.But things is not so good for EPM7128 as I don't have even a single adapter schematic and don't know where pins for additional 4 pipes are located.Quote from: pityokas on September 17, 2024, 04:48:34 amI'm greatly against it, especially for reusing software. If reversing allows us to understand protocol and pinouts, it is far better to reimplement a solution with modern/simplified components and software approaches.Quote from: pityokas on September 17, 2024, 04:48:34 amIt is a big problem. and I've asked here: if anyone have adapter schematics for MAX 7000(S) or own adapters and capable to do good photo or to trace PCB with multimeter, please do it. It can helps a lot.Thanks.PS: I've suddenly catch a thought! It can be possible, that my current troubles (SCOx became high to all readout phase of Read ID and no serial data can be seen on them) with reading ID on 7064SLC44 have a simple explanation.What if my CPLD was bulk erased with something likehttps://forum.system-cfg.com/viewtopic.php?f=31&t=13192&p=252742#p252742? It seems that some people can interpret Bulk Erase as a static process. Even @pityokas said about it in previous message. If so, 7Ch block will contain only 1 bits (I assume, that internal CPLD EEPROM contains 1's when erased) and this is exactly behavior that I've got. And JTAG ID is a different entity, have a different value and implemented via another chip blocks. As a result, chip can be identified and programmed by JTAG but will return all 1's while reading ID in parallel programming mode.

author: megov
author_rank: Contributor
timestamp: September 21, 2024, 08:54:06 pm
content: Short news.Just got in a couple of days:6 x EPM7032SLC44 from Ali. Very strange, but all of them have working JTAG6 x EPM7064SLC44 from Ali. Only one of then have working JTAG. As expected.8 x EPM7032LC44 + 12 x EPM7064LC44 from the heart of Siberia, thanks to Vladimir to help me in my investigation!1 x beautiful EPM7256EGC192,see in attachment.Despite that now I have 2 different batches of EPM7064SLC44 and one of EPM7064LC44, behavior of samples from all batches are the same: SCOx goes high at readout phase of Read ID procedure.That means something is wrong with my test setup. It may be an algorithm flaw or wrong hand-made adapter pinout.Next step will be switching to EPM7032 as now I have a bunch of them and doing to do the same things: capturing CPLD interaction inside DosBox, matching it with known adapter schematic for ALL-03and trying to re-implement it on my test fixture. 7032 is slightly simpler so maybe it will be more successful then 7064.PS: I have lot of two EPM7096LC68 locally. They are interesting both for 68 pin package and for rare chip size. But there is no bargain yet.

author: megov
author_rank: Contributor
timestamp: September 28, 2024, 12:10:05 pm
content: "There is a life inside it!"Read ID procedure trace for EPM7032 was captured and analyzed. Results are attached to this message. I take EPM7032 PLCC44 adapter fromhttp://matthieu.benoit.free.fr/all03/adp/ADP-EPM7032.htmfound pin correspondence between CPLD PLCC44 package and ALL-03 ZIF pins and use information to decode and understand a trace.After that I just code the exact procedure to my Arduino-based test fixture and got a beautiful serial signal on SCOA and SCOB outputs (see in attachments).I'm not deserialize and decode serial stream yet, but is is not a very difficult thing. I also capture Erase trace but do not decode it.But I was very surprised by EPM7032SLC44 behavior: SCOx goes high during whole read phase as it happened with EPM7064SLC44 earlier in my investigations!In today's experiment all things were exactly the same: I only change EPM7032LC44 to EPM7032SLC44 and back in the socket. Anytime with LC I got serial data in ReadID,anytime with SLC I've got SCOx stuck high.

author: megov
author_rank: Contributor
timestamp: October 05, 2024, 06:26:49 pm
content: Another piece of information. A couple of pages above @migry briefly described serial stream decoding algorithm for EPM7032(V).I dumbly implement it in plain C (Linux+GCC) and check with mine and his data. Code:Code:#include <stdio.h>#include <stdint.h>uint8_t my_scoa = { 0x01, 0x46, 0x8A, 0xAB, 0xB5, 0x31, 0x60, 0x84, 0x36, 0x43 };uint8_t my_scob = { 0xFF, 0xF6, 0xFF, 0xFF, 0xFF, 0xF5, 0xFF, 0xFC, 0xFF, 0xFB };uint8_t mirgy_scoa = { 0x01, 0x46, 0x8A, 0xAB, 0xF5, 0x33, 0x60, 0x83, 0x36, 0x43 };uint8_t mirgy_scob = { 0xFF, 0xF6, 0xFF, 0xE3, 0xFF, 0xF7, 0xFF, 0xE3, 0xFF, 0xF3 };uint8_t resa = { };uint8_t resb = { };uint8_t original_map ={ 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75,1, 6, 11, 16, 21, 26, 31, 36, 41, 46, 51, 56, 61, 66, 71, 76,2, 7, 12, 17, 22, 27, 32, 37, 42, 47, 52, 57, 62, 67, 72, 77,3, 8, 13, 18, 23, 28, 33, 38, 43, 48, 53, 58, 63, 68, 73, 78,4, 9, 14, 19, 24, 29, 34, 39, 44, 49, 54, 59, 64, 69, 74, 79, };uint8_t adjusted_map ={ 40, 45, 50, 55, 60, 65, 70, 75, 0, 5, 10, 15, 20, 25, 30, 35,41, 46, 51, 56, 61, 66, 71, 76, 1, 6, 11, 16, 21, 26, 31, 36,42, 47, 52, 57, 62, 67, 72, 77, 2, 7, 12, 17, 22, 27, 32, 37,43, 48, 53, 58, 63, 68, 73, 78, 3, 8, 13, 18, 23, 28, 33, 38,44, 49, 54, 59, 64, 69, 74, 79, 4, 9, 14, 19, 24, 29, 34, 39, };void hexdump(uint8_t *buf, uint16_t cnt) {uint8_t strbuf;uint8_t stridx = 0;for (uint16_t addr = 0; addr < cnt; addr++) {if ((addr & 0x0F)==0) printf("%04X: ", addr);printf("%02X ", buf);strbuf[stridx++] = ((buf < ' ') || (buf>=0x80)) ? '.' : buf;if ( (addr==(cnt-1)) || ( ((addr & 0x0F)==0) && (addr!=0)) ) {strbuf = 0;printf(" %s\n", strbuf);stridx = 0;}}}#define MAP adjusted_mapvoid decode(uint8_t *psrc, uint8_t *pdst, uint8_t sz) {//Zero result bufferfor (uint8_t i=0; i<sz; i++) pdst=0;//Pass through all 80 bitsfor (uint8_t srcbitno=0; srcbitno<sizeof(MAP); srcbitno++) {//Locate bit in source streamuint8_t srcbyteno = srcbitno >> 3;uint8_t srcmask = 0x80 >> (0x07 - (srcbitno & 0x07));//Locate bit in destination streamuint8_t dstbitno = MAP;uint8_t dstbyteno = dstbitno >> 3;uint8_t dstmask = 0x80 >> (0x07 - (dstbitno & 0x07));//Set bit in destination stream if it is set in source streamif (psrc & srcmask) {pdst |= dstmask;}}}void main(int argc, char * argv[]) {printf(" My SCOA:"); hexdump(&my_scoa, sizeof(my_scoa));printf(" My SCOB:"); hexdump(&my_scob, sizeof(my_scob));decode(&my_scoa, &resa, sizeof(my_scoa));decode(&my_scob, &resb, sizeof(my_scob));printf(" My RESA:"); hexdump(&resa, sizeof(resa));printf(" My RESB:"); hexdump(&resb, sizeof(resb));printf("\n");printf("Migry's SCOA:"); hexdump(&mirgy_scoa, sizeof(mirgy_scoa));printf("Migry's SCOB:"); hexdump(&mirgy_scob, sizeof(mirgy_scob));decode(&mirgy_scoa, &resa, sizeof(mirgy_scoa));decode(&mirgy_scob, &resb, sizeof(mirgy_scob));printf("Migry's RESA:"); hexdump(&resa, sizeof(resa));printf("Migry's RESB:"); hexdump(&resb, sizeof(resb));It works, but with one interesting thing: substitution map for bitstream that I've createdexactlyusing the Migry's description (original_map) provide "5 byte-swapped output":My SCOA:0000: 01 46 8A AB B5 31 60 84 36 43 .F...1`.6CMy SCOB:0000: FF F6 FF FF FF F5 FF FC FF FB ..........My RESA:0000: 45 52 41 39 32 76 26 41 4C 54 ERA92v&ALTMy RESB:0000: FF FF FF FF FF 76 3E FD FF FF .....v>...Migry's SCOA:0000: 01 46 8A AB F5 33 60 83 36 43 .F...3`.6CMigry's SCOB:0000: FF F6 FF E3 FF F7 FF E3 FF F3 ..........Migry's RESA:0000: 45 52 41 39 33 FE 07 41 4C 54 ERA93..ALTMigry's RESB:0000: FF FF FF FF FF FE 17 50 FF FF .......P..It can be easily fixed by swapping left and right halves of map, see adjusted_map in the code. With adjusted map I got the right results:My SCOA:0000: 01 46 8A AB B5 31 60 84 36 43 .F...1`.6CMy SCOB:0000: FF F6 FF FF FF F5 FF FC FF FB ..........My RESA:0000: 76 26 41 4C 54 45 52 41 39 32 v&ALTERA92My RESB:0000: 76 3E FD FF FF FF FF FF FF FF v>........Migry's SCOA:0000: 01 46 8A AB F5 33 60 83 36 43 .F...3`.6CMigry's SCOB:0000: FF F6 FF E3 FF F7 FF E3 FF F3 ..........Migry's RESA:0000: FE 07 41 4C 54 45 52 41 39 33 ..ALTERA93Migry's RESB:0000: FE 17 50 FF FF FF FF FF FF FF ..P.......So in addition to description, we now have a working code.ADDED:Just a thought that came to me after thinking about ReadID in parallel mode for 7000S (All one's serial output) and re-reading this thread.I don't know the whole Altera product line of that time, but got this summary to myself:1. 'Old/classic' 7000 family, that supports only high-voltage, clumsy and mysterious parallel programming mode.2. 'Intermediate' 7000S family, that introduce JTAG programming, but not get rid completely from HV mode. My assumption is thatthey (7000S) doesn't support parallel programming, only high-voltage erase.3. 'Modern' 7000AE/3000S and Atmel's ATF15xx that take a step further and support JTAG reenabling with HV appiled. No more needed for HV parallel programming, even for simple pin manipulations for BulkErase.Why I made such conclusion?1. EPM7032LC44 (and other family members) provide serial output and I think that it is a vital data:- ID block is possibly erased during HV BulkErase and need to be reprogrammed to keep ID/VPP/Tbe/etc.- Reprogramming is really performed after HV BulkErase (see traces, that I provided earlier).2. EPM7032SLC44 does not provide any serial data for ReadID. Let's think what it means:- we don't need actual VPP value and timings - programming via JTAG does not require such parameters.- we don't need Chip ID as it can be read by JTAG.3. So the only reason for 7000S to use HV parallel programming is BulkErase procedure.4. Successors, like 7000AE/3000S/ATF15xx make this "revival" procedure even more simpler.

author: megov
author_rank: Contributor
timestamp: October 06, 2024, 05:19:53 pm
content: Well, It is worth to re-read thread from time to time...Today I've started another run for EPM7064LC44. I look again to traces and possible ZIF socket pin definitions for 7064 that I've posted here and compare them with traces for 7032, which allows me to read ID.Differences were in init sequence (7064 has more pins to drive or keep at certain level) and during reading phase: in addition to SK pulses and keeping SS (or SS_BI for 7064) low for 1st bit in 16bits pack,another pin dives high ate the same 1st bit of 16bits pack. Currently I identify it as MTIN, but it may not be true, see below.Struggling a little bit I've got the SCOA waveform you can see in attachments. It is really looks like a start of ID sequence. But I'm unable to force CPLD producing serial stream beyond these 16 bits.More interesting, that test code works without modifications with EPM7064LC84 in adapter that I made looking to ADP-7064S-PL84 scematic, AD359 adapter pinout table and traces from A70X.EXE.I think the following way:- (1) treat AD359 adapter pinout table as a sort of truth for 7064 in PLCC44- (2) suppose that ADP-7064S-PL84 also works- (3) traces that I've taken from A70X.EXE are real=> projecting procedures from (3) to ALL03 ZIF socket pins makes me understanding algorithm=> ADP-7064S-PL84 schematic (2) with (3) reveals actual PLCC84 pinout for parallel programming=> looking into (1) will give some hints about actual PLCC84 pinout, as devices are same with exception of packaging.Yes, I've found some incompatibilities between access patterns in A70X.EXE and ADP-7064S-PL84 schematic, but don't stuck at them.But... @Reverse herehttps://www.eevblog.com/forum/fpga/programming-(non-jtag)-max7000-devices/msg5454905/#msg5454905said:> There is another A70X.EXE that supports non-S versions but with different adaptor - EPM7064-PLxx which schematic is unknown to me anyway.So I take a tracefrom code and apply it to wrong adapterfrom wrong code and apply it to incompatible adapter. That's why my attempts with 7064 were not so successful.Well, it's time to open A7064.EXE and I hope that internals of ALL07 programmer don't differ much from ALL03.ADDED:Strange, but I'm unable to find A7064.EXE at Matthieu's site. Anyone, please, provide me a link to download it.Thanks!Found it. Need to understand how ALL07 differs from ALL03.ADDED2: Looked briefly to ALL07 schematic... More complex and less understandable than ALL03.

author: reverse
author_rank: Contributor
timestamp: October 08, 2024, 09:30:06 am
content: Quote from: megov on October 06, 2024, 05:19:53 pmI own an ALL07C (a compact version of ALL07 with SMD components and built-in PAC_DIP40) for the past over 15 years, and unlike you, I like vintage programmers and I am almost daily using my ALL07C workhorse, of course it was a gift from a close friend of mine (damaged back then by automotive apps of his employers, obsolete, but to me very useful with vintage computers). Thanks to the French schematic on Matthieu's web site (it has some minor errors, but these don't affect the overall understanding) and PLD equations I managed to succeed in almost fully controlling ALL07 via mine TASM DOS code. I haven't digged into ALL07 OSC generation control, but that is not interesting to me so far. That helped me with successfully dumping of vintage ROM PIC, and I have more plans for similar projects. I think I may be able to help you with understanding of ALL07 programmer. Alas, I have no HILO EPM adapters, I just handmade one, mentioned by me earlier in this topic, and it worked. I will be able to help with testing/debugging of your code on a real ALL07 programmer and Altera devices, should you need that.

author: megov
author_rank: Contributor
timestamp: October 09, 2024, 09:16:20 pm
content: I think, that you don't understand me correctly. Maybe I write my thoughts not so clearly. English is not my native language.I don't even try to blame vintage programmers, definitely. They're a good engineering devices of their own time. I just looked to schematic, that I've found at the same well-known and wonderful Matthieu's web site (it is not a joke, Matthieu's site is a very valuable source of information). And schematic, at least at the my first sight, seems to be much less understandable, than ALL03.I'm not an owner of ALL07 and its lower/middle/higher boards structure was cumbersome.Yes, later I found the functional dividing between sub-boards, more-or-less common (by function, not by exact schematic) blocks with ALL03 and pretty standard 4-bit scheme of "reading out" through various status bits of parallel port.For my further intentions: I plan to analyze ALL07 schematic to understand its register map and where it differs from ALL03. I saw accesses to non-existent ALL03 registers in A70X.EXE.Then I'll reverse A7064.EXE to trace actual interaction between software and ZIF socket pins. For this part of analysis it will be helpful to have @reverse adapter(s) pinouts. Thanks for support.I have no plans to write 'software' to run with ALL03/ALL07. The idea is to understand the whole chain of technology (algorithms, interaction inside a programmer and how it connects to actual pins in various packages)and describe it in simple terms and actions. This approach help to recreate parallel programmers functionality on modern basis.And yes, it may help to erase/unlock hundreds of CPLDs that people have in their boxes.

author: reverse
author_rank: Contributor
timestamp: October 15, 2024, 07:12:28 am
content: @Megov, I am quite skeptical about guys who announce what they plan to do prior to doing the job itself. I was just trying to widen your horizons of actions/tools and offer you more options. Neither the three PCBs of the ALL07 (ALL07C has only two PCBs, but the schematics is the same), nor the schematics are complicated at all. The reversing from PCBs was complicated, which the French guys already did without too much noise on forums. If you experience difficulties expressing yourself in English, I am also fluent in Russian.

author: jgustavoam
author_rank: Regular Contributor
timestamp: October 16, 2024, 03:10:22 am
content: My first steps in researching how it is possible to program an Altera EPM7032LC44-5, without using official tools.Using a K6-2 500MHz PC with Windows 98, I managed to install MAX+PLus II version 9.3 from 1999.I downloaded the files from a link on this forum.I was able to activate the license. But I don't have any hardware to program EPLDs.

author: jgustavoam
author_rank: Regular Contributor
timestamp: October 30, 2024, 03:09:53 am
content: I have been studying about GAL, PAL and PLDs. I found these two CDs to download with various programs. Maybe there is something interesting.For example:"Welcome to Altera's FirstStep design kit, a free and simpletool for easy PAL/GAL integration. FirstStep is a Windowsbased utility program used to enter and compile designs forAltera's EPM7032 high performance EPLD. "https://archive.org/details/pld-start(ISO.image)Contents:Altera: 1StepAltera: PLDshell PlusAMD: MachProAMD: MachXLData I/O: EasyABELData I/O: Synario (Evaluation)Isdata: LOG/IC (Evaluation)Logical Devices: PALexpertMicroSim: Design Center (Evaluation)MicroSim + AMD: Design Center AMD (Evaluation)National Semi: OPAL JrQuicklogic: pASICSH-Elektronik: GDS (Evaluation)Texas Instruments: ProLOGICXilinx: DS550HiLo Systems: ALL07 programmer device listhttps://archive.org/details/elrad-pld(ISO.image)Contents:Synario: ABEL-Edu 5.03HiLo Systems: ALL-07 programmer device listMinc-IST: Asyl+VHDL Starter KitPilkington Micro: August Design System 2.2Xilinx: DS550 6.0Translogic: Ease-VHDL 2.3Altera: First Step 1.0Schuster/Belte: FPGA-Pilot (Evaluation)SH-Elektronik: GDS 3.5 (Evaulation)Mettner: GLSIM 1.10Lattice: ISP Starter Kit 2.71Isdata: LOG/IC2 4.22 (Evalation)AMD: MachXL 2.1AMD: MachXL/210 3.0AMD: PALasm 1.5Altera: PLDshell 5.0MicroSim: PLSyn 6.2 (Evaluation)iNT: PSI 2.1 (Evaluation)iNT: SCAT 2.1a (Evaluation)Visual Software Solutions: StateCAD 2.10F (Evaluation)iNT: STC 2.1 (Evaluation)iNT: SVU 1.0 (Evaluation)iNT: VGEN 2.1 (Evaluation)Cypress: Warp2/371 3.3Xilinx: XABEL-CPLD 6.0 (Evaluation)

author: deanclaxton
author_rank: Regular Contributor
timestamp: November 04, 2024, 10:19:53 am
content: Very interesting thread. Somewhat related, I'm working with Microchip ATF150x parts and would like to be able to set the security fuse to protect the design, however I'd also like to be able to erase and reprogram without removing the chip from the board.Previously I've just been locking out the JTAG port, and using the +12V OE1 trick to re-enable it for reprogramming.That trick is fairly well known now, so I think I need to start setting security however I'm yet to find a method to erase the device once the security is enabled other than desoldering the device and dropping it into my XELTEK 6100N. I'm using a ATDH1150USB-K programmer to re-program chips in system, however I'm using the XELTEK 6100N to initially program the devices pre-assembly.Today I experimented a little with the securlty fuse. My Xeltek 6100N can set security, and then erase the device (removing security) no problem, however thats using a TQFP socket adapter in the programmer.To date I've been unable to do this using the ATDH1150USB-K programmer.I tried making an adapter today to go from the XELTEK 6100N to a TagConnect cable connecting the JTAG programming pins in an attempt to use the XELTEK to program a chip in-system - it didnt work. I got a message that it found an unrecognised 42 pin device. I also tried connecting OE1 through to the target board but it didnt help.I wonder if the ATF150x do actually use parallel programming when in the XELTEK just like the EPM7000 series that (I believe) they are based on?I guess I'll have to hook up a logic analyser to the XELTEK - maybe with some form of overvoltage protection on the OE1 pin. Are any other pins likely exposed to high voltage? I guess I may have to work around the socket with a CRO to check.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: November 04, 2024, 09:29:54 pm
content: Quote from: deanclaxton on November 04, 2024, 10:19:53 amDid you try the 1150 to an ZIF adaptor ?It seems strange the 1150 cannot bulk erase, my recollection is HV is neededonlyon VPP to enable JTAG and then all commands are available.Maybe the in-circuit loadings affect Vcc ramp ?When we did JTAG, I think we found short leads helped and 100R series termination helped reduce bounce effectsMinor point : IIRC some ATF150x parts need 11V Vpp, you could check what your Xeltek delivers ?

author: deanclaxton
author_rank: Regular Contributor
timestamp: November 04, 2024, 11:15:15 pm
content: No - I havent tried a ZIF adapter driven by the ATDH1150. Hmmm. I can tweak the experimental adapter I built and add stacking headers - that way I could either drop it into the Xeltek OR I could plug a TQFP44 programming adapter into the top of it. Then rather than plug the TagConnect cable into the box header I put on it, I could plug in the ATDH1150. Doesn't help me though, but an interesting experiment.Ultimately I need to find a way to re-program secure devices (ATF1502 and ATF1504) that are soldered down. EDIT - I really need to know whether this is even possible.If you lock out the JTAG (in a lot of my designs I use the pins for other purposes) then you can reprogram via the ATDH1150 if you apply voltage to OE1 - that works fine with +12V applied. It doesn't work though if you set the security fuse. I am wondering if there is some way it can be done over JTAG in conjunction with maybe the OE1 pin if it was pulsed or something but I think I need to get a scope onto it to see what is going on there voltage wise as you suggest.

author: deanclaxton
author_rank: Regular Contributor
timestamp: November 05, 2024, 02:02:17 am
content: I don't mean to hijack the original thread - happy to start a separate topic for the ATF150x series if that is more appropriate.

author: deanclaxton
author_rank: Regular Contributor
timestamp: November 05, 2024, 04:54:28 am
content: Quote from: megov on September 15, 2024, 06:53:44 pmI'm wondering if ATF150x actually do support parallel programming also, and that is how the security fuse is removed and the device erased. I'll need to hook up my Xeltek programmer to the logic analyser though to test this.Also the ramp of voltage from 10.2 to 12V - how fast is that ramp?

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 05, 2024, 09:27:24 pm
content: EPM7032S - controlling JTAG support bit.I'm first studying how to program theEPM7032S, and then trying to find out something about theEPM7032.I learned how to program the EPM7032S with this guy. I am very grateful to him for his didactic guidance. I will test it as soon as my JTAG chips arrive.https://youtu.be/1-oK0y2VH0Y?si=RiLJZ_ABhpBM2Yfmhttps://github.com/marekl123/ezPLA-VHDLI installed theQuartus II 64 bit - Version 13.0.1program on my Windows 10 PC.https://www.intel.com/content/www/us/en/software-kit/711791/intel-quartus-ii-web-edition-design-software-version-13-0sp1-for-windows.htmlTo enable theJTAG support bit, go to theAssignments / Devicewindow and then click onDevice and Pin Options. I think that's it.

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 06, 2024, 12:39:33 am
content: EPM7032S - Do I really need 12V to program?I don't think so.http://www.pldworld.com/_altera/html/toolman/cic.org.tw-alteratutorial.htmMAX 7000S ISP• MAX 7000S devices can be programmed through 4-pin JTAG interface– By downloading the information via automatic test equipment, embeddedprocessors, or Altera BitBlaster/ByteBlaster download cable•MAX 7000S internally generates 12.0-V programming voltage• Refer to Altera’s Application Brief & Application Note for details– AB145 : Designing for In-System Programmability in MAX 7000S Devices– AN039: JTAG Boundary-Scan Testing in Altera Devices- AN100 In-System Programmability Guidelines- AN095 In-System Programmability

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 06, 2024, 02:14:34 am
content: Trying to understand the structure of an EPM7032 and EPM7064."Note: the 7032 only has SCOA/SCOB, where as the 7064 has SCOA/B/C and D."EPM7032 has 2 LABs.EPM7064 has 4 LABsLogic Array Blocks:The MAX 7000 device architecture is based on the linking of high performance,flexible, logic array modules called logic array blocks (LABs).LABs consist of 16-macrocell arrays.Multiple LABs are linked together via the programmable interconnect array (PIA), a global bus that is fed by all dedicated inputs, I/O pins, andmacrocells.Each LAB is fed by the following signals:■ 36 signals from the PIA that are used for general logic inputs■ Global controls that are used for secondary register functions■ Direct input paths from I/O pins to the registers that are usedfor fast setup times for MAX 7000E and MAX 7000S devices

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 22, 2024, 01:23:32 am
content: EPM7032S programmingAs I already mentioned, I am learning to use theEPM7032Sfirst and then moving on to studying theEPM7032. The internal structures are similar.I bought two usedEPM7032SL44-10chips. And an AlteraUSB Blaster clonemodule to program the chips.USB Blaster Clone with CH552 chip:https://www.eevblog.com/forum/fpga/usb-blaster-(ftdi245-vs-ch552x)-quartus-no-hardware/UsingQuartus 13.0 sp1 (32-bit)on an Intel Celeron PC / MB PCWare / Windows 7 (32-bit).https://www.intel.com/content/www/us/en/software-kit/711791/intel-quartus-ii-web-edition-design-software-version-13-0sp1-for-windows.htmlI used a 32-bit PC so that the environment would be as close to the reality of the 90s as possible.My PC has a parallel printer port (LPT).Using the example to program the EPM7032S:(Commodore 64 PLA replacement)https://github.com/marekl123/ezPLA-VHDLSeveral attempts to program both EPM7032s and neither of them were recognized. Searching in several forums and with some information from this forum, I discovered that my chips hadJTAG locked.Some pins on the JTAG interface were being blocked (digital signal less than 1V) because they were configured as output and not as signal input as they should be. For example, the TDI, TMS and TCK pins.It may be a normal situation when the user intends to use the chip's JTAG interface pins in his circuit.I believe that this same behavior can appear on chips without JTAG (EPM7032), if the programming mode is not activated.Following the tips from this forum and others, I connected theOE1 pin (PLCC pin 44)to a12V sourceusing an1K ohm resistorin series (a brief pulse of 12V).I was able tounlock the JTAG interfaceof both chips with this procedure! But I am not supplying the chip with 12V during the programming procedure.MAX7000S JTAG Lock:https://www.vogons.org/viewtopic.php?t=100864https://www.edaboard.com/threads/quartus-jtag-id-error-using-an-epm7128slc84-7-on-pldt-2-db.116711/https://www.elektroda.com/rtvforum/topic3844129.htmlhttps://forum.system-cfg.com/viewtopic.php?t=13192https://community.intel.com/t5/Programmable-Devices/problem-programming-old-cpld-epm7032/td-p/156760In theQuartusprogram, using thetool - JTAG Chain debugger, I can identify the chips asEPM7032S. (JTAG interface is working).But, when I try to program I have received the following message:"JTAG ID CODE SPECIFIED IN JEDEC STAPL FORMAT FILE DOESN'T MATCH ANY VALID JTAG ID CODES FOR DEVICE."I did the same tests using the "Byte Blaster MV" interface (connected with parallel port LPT1) that I built on a protoboard. And the results were the same.I assume I managed to unlock the JTAG interface of the chips, but I haven't been able to erase the original programming yet.Reading numerous Altera documents, I saw that there is a procedure to erase the chip's memory. I know that using one of Altera's parallel programmers, it is possible to erase the memory.But I don't have any of those rare and very expensive devices.The research continues...If you are interested in the ISP programming of the MAX7000S, I recommend reading the attached documents.

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 22, 2024, 08:25:06 pm
content: EPM7032S - IDENTIFYING THE PINSTo find out and confirm that myEPM7032Schips had ablocked JTAG interface, I used a procedure based on the characteristics of the CPLD chip.This procedure can also be used on other EPM7032 chips (without JTAG).Measuring the JTAG interface signals (with scope) when I tried to program the EPM7032S, I noticed that some pins had avery low voltage level (below 1V).Therefore, communication was blocked and the Quartus program could not recognize the chip.Knowing that the maximum current on each pin can vary between +25 mA or -25 mA, I built this simple circuit, whichhelps identify whether the pin is an input or output.Two 220 ohm resistors in series connected to GND and +5V.The test lead to be connected to each pin of the chip must be connected between the two resistors.To measure the test voltage with a voltmeter, connect its leads to the resistor connected to ground.I filled a table with numerous voltage measurements on the pins of my chips in the state with the JTAG interface locked and then unlocked (see attached file).To identify the pins, measure the voltage:INPUT = 2.5VOUTPUT LOW = 0.25 VVCC = 5 VGND = 0 VProgramming circuit to be attached to USB Blaster or Master Blaster MV (parallel Port LPT):

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 12, 2024, 03:33:58 pm
content: Deciphering EPM7032S erasure (trying):The topic is quite large and I hadn't realized until yesterday that Pityokas had sent the records in the logic analyzer of theBEEPROG programmer, with some procedures performed withMAX7000 devices.Thank you very much Pityokas, your records will be very useful for my analysis!Programming Sequence for JTAG MAX7000S devices:(Datasheet)1. Enter ISP. The enter ISP stage ensures that the I/O pins transition smoothly from user mode to ISP mode. The enter ISP stage requires 1 ms.2. Check ID. Before any program or verify process, the silicon ID is checked. The time required to read this silicon ID is relatively small compared to the overall programming time.3. Bulk Erase. Erasing the device in-system involves shifting in the instructions to erase the device and applying one erase pulse of 100 ms.4. Program. Programming the device in-system involves shifting in the address and data and then applying the programming pulse to program the EEPROM cells. This process is repeated for eachEEPROM address.5. Verify. Verifying an Altera device in-system involves shifting in addresses, applying the read pulse to verify the EEPROM cells, and shifting out the data for comparison. This process is repeated foreach EEPROM address.6. Exit ISP. An exit ISP stage ensures that the I/O pins transition smoothly from ISP mode to user mode. The exit ISP stage requires 1 ms.In parallel with studying EPLDs, I am also studying GAL devices, as for me they have similar characteristics.I assembled this GAL programmer (with Arduino UNO) and managed to erase a Lattice GAL22V10B.GAL chip programmer for Arduino:https://github.com/ole00/afterburnerI usedAfterBurner version 0.6.0with this circuit that I edited (attached).I was able to read the GAL26CV12B and the GAL22V10B. Including erasing it. But I still haven't been able to read the GAL16V8B.AfterBurner GAL Programmer Gustavo.pdf(219.14 kB - downloaded 125 times.)See the 100ms pulse from the STRB pin that allows the GAL to be erased!In the dark image attached.For reference only:GAL programming algorithms: (may be an inspiration for PLDs)http://www.armory.com/%7Erstevew/Public/Pgmrs/GAL/algo.htmWrite, Erase, Security fuse (GAL16V8/GAL20V8) at VPP volt on EDIT:Set P/V- to H, set up the desired pattern on RA0..RA5, apply first bit to SDIN, bring SCLK for a short time to H and back to L,and transfer the next bit until all bits of this line have been transferred. Bring STB- to L and wait for the programming pulse timebefore you take it back to H again. Restore P/V- to L at the end of the operation.GAL22V10:1 2 4 8 16 32/RA0 /RA1 /RA2 /RA3 /RA4 /RA51 0 1 1 1 1 => 61 (0X3D) - CLEAR ?1 0 0 1 1 1 => 57 (0X39) - CLEAR ALL ?

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 12, 2024, 09:47:49 pm
content: Analyzing EPM7032S erasurePityokas had sent the records in the logic analyzer of theBEEPROG programmer(aug/2022), with some procedures performed withMAX7000 devices.Thank you very much Pityokas, your records are being very useful for my analysis!https://www.eevblog.com/forum/fpga/programming-(non-jtag)-max7000-devices/msg4371268/#msg4371268Analyzing file waveforms -epm7032s_erase.sr.I changed the order of the lines for better understanding (attached file).The 100ms pulse for erasure is evident!VCC - active (5V)VPP - active (5V or 12V ??)NTPW - LOW pulse 100 msBE - HIGH pulse 100 msTM - HIGH pulse 100 msMT, MTIN - LOWSS, SCK, SK - LOWSDINA and SDINB - LOWA0 A1 A2 A3 A4 A5 A61 1 0 1 1 1 0 = 0x3B (59) CLEAR ALL ???

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 26, 2024, 02:00:46 am
content: First attempt to erase EPM032S - failedBased on Pityokas' logs, I assembled this circuit and program it with the Arduino Mega, to try to erase the EPM7032S.Why did I use the Arduino Mega? Because it makes the circuit assembly easier. I like to simplify whenever possible.Thinking that only the 100 millisecond interval would allow the EPM7032 to be erased, I did these tests. But I still couldn't erase it.EPM7032_prog.pdf(180.94 kB - downloaded 66 times.)This is the INO code:Code:/* EPM7032S ERASE Programmer V0 - Arduino MEGAPLD Altera EPM7032SLC44 in PROG MODEArduino IDE 2.3.4Gustavo Murta - 2024/12/18EDIT/VPP - PE4 (PIN02) = 12V controlNTPW - PL0 (PIN49) - bit value 0x01BE - PL1 (PIN48) - bit value 0x02TM - PL2 (PIN47) - bit value 0x04MT - PL3 (PIN46) - bit value 0x08MTIN - PL4 (PIN45) - bit value 0x10BEM - PL6 (PIN43) - bit value 0x40SBI - PL7 (PIN42) - bit value 0x80SS - PC0 (PIN37) - bit value 0x01SCK - PC1 (PIN36) - bit value 0x02SK - PC2 (PIN35) - bit value 0x04SDINA - PC4 (PIN33) - bit value 0x10SDOUTA - PB0 (PIN53) - bit value 0x01SCOA - PB1 (PIN52) - bit value 0x02SDINB - PC5 (PIN32) - bit value 0x20SDOUTB - PB2 (PIN51) - bit value 0x04SCOB - PB3 (PIN50) - bit value 0x08A6 - PA6 (PIN28) - bit value 0x40A5 - PA5 (PIN27) - bit value 0x20A4 - PA4 (PIN26) - bit value 0x10A3 - PA3 (PIN25) - bit value 0x08A2 - PA2 (PIN24) - bit value 0x04A1 - PA1 (PIN23) - bit value 0x02A0 - PA0 (PIN22) - bit value 0x01*/int count = 0;void setup() {DDRA = 0xFF; // configure PORTA pins as outputDDRB = 0x00; // configure PORTB pins as inputDDRC = 0xFF; // configure PORTC pins as outputDDRL = 0xFF; // configure PORTL pins as outputpinMode(2, OUTPUT); // configure PE4 as output (EDIT/VPP)PORTA = 0x00; // SET all pins to LOWPORTC = 0x00; // SET all pins to LOWPORTL = 0x00; // SET all pins to LOWdigitalWrite(2, LOW); // set the digital pin PE4 LOW (EDIT/VPP)Serial.begin(115200); // Monitor serial 115200 bpsSerial.println("EPM7032S ERASE Programmer - press 'e' to chip erase ");}// ERASE EPM7032 sequencevoid eraseEPM7032() {Serial.println("EPM7032S ERASE PULSE");PORTL = 0x06; // set NTPW LOW , BE HIGH and TM HIGHdelay(100); // delay 100 milisecondsPORTL = 0x01; // set NTPW HIGH - others LOWPORTA = 0x00; // set Address 0x00 (A0 to A6 pins)}void loop() {while (Serial.available() > 0) { // Verificar se há caracteres disponíveischar caractere = Serial.read(); // Armazena caractere lidoif (caractere == 'e') { // Verificar se o caractere é 'e'Serial.println("EPM7032S - Initialization process");PORTL = 0x01; // set NTPW HIGH - others LOWdelay(50); // delay 50 milisecondsdigitalWrite(2, HIGH); // set EDIT/VPP HIGHif (digitalRead(53) == 1 && digitalRead(51) == 1) { // read SDOUTA and SDOUTBSerial.println("EPM7032S Initialization OK");} else {Serial.println("EPM7032S - no response");Serial.println("Verify connections to PLD chip");Serial.println("End");return;}delay(200); // delay 200 milisecondsPORTC = 0x00; // set SS,SCK,SK,SDINA,SDINB LOWPORTA = 0x3B; // set Address 0x3B (A0 to A6 pins)delay(50); // delay 50 milisecondseraseEPM7032();count = count + 1;Serial.print("Erase count: ");Serial.println(count);Serial.println("End");}delay(50); // delay 50 milisecondsPORTA = 0x00; // SET all pins to LOWPORTC = 0x00; // SET all pins to LOWPORTL = 0x00; // SET all pins to LOWdigitalWrite(2, LOW); // set EDIT/VPP LOWdelay(500);}}EPM7032S eraser - first sequence :EPM7032S eraser - erase sequence :Arduino MEGA ports:

author: nipanchal72
author_rank: Newbie
timestamp: March 21, 2025, 02:31:38 pm
content: Hi jgustavoam,Thanks for providing a resource to legacy compilers. I got excited looking through it, to hopefully find a ATMEL device definition file but unfortunately did not find it. Do you happen to have an ATMEL PLD device definition file (P2500C.dev). It generally reside within ABEL4 software in a sub directory <LIB4> ABEL4PLD.dev / ABEL4LIB.dev file. The device I am trying to compile is ATF2500C-20KM CPLD and the .dev is missing P2500C.dev definitation. Is there a way to generate P2500C.dev maually and make the ABEL4.0 compiler point to this device (P2500C.dev). Any suggestion would be highly appreciated.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 21, 2025, 07:05:59 pm
content: Hi nipanchal,This PLD Programmers repository was not found and suggested by me.But it has a lot of interesting content.See if you can find what you need.ABEL20D.ZIP (ZIP Archive - 733Kb)http://matthieu.benoit.free.fr/131.htmhttp://matthieu.benoit.free.fr/index.html

author: nipanchal72
author_rank: Newbie
timestamp: March 24, 2025, 05:06:25 pm
content: Hi jgustavoam,Thank you very much for your help. I will have a look at the attached file. The manufacturer were not able to help and their response was to move to newer device.

author: nipanchal72
author_rank: Newbie
timestamp: March 27, 2025, 01:36:18 pm
content: Hi,Your friend Matthieu was able to help me seek the file, and now I am able to recompile the original abel code. Thank you very much.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 27, 2025, 01:52:35 pm
content: Good news!