Little help to read this EEPROM

Topic: Little help to read this EEPROM (Read 11309 times) previous topic - next topic

Little help to read this EEPROM

June 20, 2010, 07:51:33 pm

Hi everybody,

I spend my day trying to read a 93c46 chip [8 lead TSSOP] (datasheet: www.atmel.com/atmel/acrobat/doc0172.pdf). I plugged the OLA in parallel to check the signal the BP was outputting.
Here is one configuration I tried:
-> SPI -> 30KHz -> Idle low -> Active to Idle -> Middle -> Normal

Also, I connected VPU to 3.3V and the whole system is 3.3V powered. When activating the pullup resistor, I noticed different things I was unable to correct:

-> CS in inverted. I'd like CS instead of /CS. The solution is to send ] to "enable" it...
-> Looks like DI / DO are always up (due to the pullup ?)
-> DO seems to be a tristate as describe in the datasheet, so how can I deal with that ?

I would really appreciate a little bit of help.

Thanks a lot,

C0

Re: Little help to read this EEPROM

Reply #1 – June 20, 2010, 08:01:21 pm

[quote author="cam0"]
Hi everybody,

I spend my day trying to read a 93c46 chip [8 lead TSSOP] (datasheet: www.atmel.com/atmel/acrobat/doc0172.pdf). I plugged the OLA in parallel to check the signal the BP was outputting.
Here is one configuration I tried:
-> SPI -> 30KHz -> Idle low -> Active to Idle -> Middle -> Normal

Also, I connected VPU to 3.3V and the whole system is 3.3V powered. When activating the pullup resistor, I noticed different things I was unable to correct:

-> CS in inverted. I'd like CS instead of /CS. The solution is to send ] to "enable" it...
-> Looks like DI / DO are always up (due to the pullup ?)
-> DO seems to be a tristate as describe in the datasheet, so how can I deal with that ?

I would really appreciate a little bit of help.

Thanks a lot,

C0
[/quote]

Hi welcome to the BP side of DP

With SPI most chips use /cs (inverted chip select 0=active), so you are right that ] enables the chip.

DI/DO are up (high voltage) if nothing is happening is correct. The lines should be in tristate because of SPI being a bus. This implies when a device is idle it should be not interfering the bus. If you select the device and send data you should see something happening. (could it be that cs is inverted?)

Here is btw an other topic about almost the same chip (93c86): http://dangerousprototypes.com/forum/in ... opic=510.0

Re: Little help to read this EEPROM

Reply #2 – June 20, 2010, 08:33:57 pm

Quote

-> SPI -> 30KHz -> Idle low -> Active to Idle -> Middle -> Normal

Also, I connected VPU to 3.3V and the whole system is 3.3V powered.

The pull-up resistors are usually only used with the hi-Z (open drain/collector ouput) pin type. It shouldn't hurt or change anything to use the pull-ups too though.

I have not worked with this chip, I perused the datasheet quickly (a timing chart is attached).

It looks like CS is not inverted, it's high-active in the diagram.

Can you share a paste of your terminal output and the commands you've tried so far? You might need to use the raw3wire library to send bitwise commands, it doesn't look like it's byte based (hardware SPI on the PIC is byte only). The read instruction looks something like this:

] raise CS
-^^_^ two 1 bits, one 0 bit

? clock in the address as bits, bytes, or a combo
rrrrr read data from the chip
[ drop CS

Re: Little help to read this EEPROM

Reply #3 – June 20, 2010, 08:53:06 pm

Since Cam0 posted a topic in the OLS section where he was using the HiZ mode I assumed (..) he was using HiZ mode again.

The other topic has working examples how to read/write from it. The 9386 is a bigger chip, but the interface is the same.

Re: Little help to read this EEPROM

Reply #4 – June 20, 2010, 10:55:27 pm

Thanks to both of you for your reply. I'll let you updated with what I'll do !

C0

Re: Little help to read this EEPROM

Reply #5 – June 21, 2010, 07:07:59 pm

Hi,

so here is an update of what I am doing.
I am desperately trying to debug the interface with the OLA, but I am not able to trigger on the clk, cs or data

Code: [Select]

M
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. JTAG
7. RAW2WIRE
8. RAW3WIRE
9. PC KEYBOARD
10. LCD
(1) >8
Mode selected
Set speed:
 1. ~50KHz
 2. ~100KHz
 3. ~400KHz
(1) >1
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)
(1) >1
READY
RAW3WIRE>W
POWER SUPPLIES ON
RAW3WIRE>v
Voltage monitors: 5V: 4.64 | 3.3V: 3.31 | VPULLUP: 3.31 |

According to the datasheet, to read a piece of memory, I need to set CS, send 0b110 + '7 bits of address'. While sending the last bit, it looks like a 0 is already coming from DO (synced on rising edge).

Code: [Select]

M
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. JTAG
7. RAW2WIRE
8. RAW3WIRE
9. PC KEYBOARD
10. LCD
(1) >8
Mode selected
Set speed:
 1. ~50KHz
 2. ~100KHz
 3. ~400KHz
(1) >1
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)
(1) >1
READY
RAW3WIRE>]0b110 -^:7 r:8[
CS DISABLED
WRITE: 0x06
DATA OUTPUT, 1
0x07 CLOCK TICKS
READ 0x08 BYTES:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
CS ENABLED

RAW3WIRE>W
POWER SUPPLIES ON

RAW3WIRE>]0b110 -^:7 r:8[
CS DISABLED
WRITE: 0x06
DATA OUTPUT, 1
0x07 CLOCK TICKS
READ 0x08 BYTES:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
CS ENABLED

RAW3WIRE>P
 1. Pull-ups off
 2. Pull-ups on
(1) >2
Pull-up resistors ON

RAW3WIRE>]0b110 -^:7 r:8[
CS DISABLED
WRITE: 0x06
DATA OUTPUT, 1
0x07 CLOCK TICKS
READ 0x08 BYTES:
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
CS ENABLED

RAW3WIRE>

With or without my chip, I get the same result. Where I am getting really puzzled is when I use the OLA and nothing happens. Basically, this is what I am doing:

Quote

BP ----> chip
   ]
   ]
   OLA

ie the OLA is in // to snoop the signal, but it is definitely not working that way :/.
Note that I prefer not to write anything on the chip, because it contains some valid data.

Thanks for your help

C0

Re: Little help to read this EEPROM

Reply #6 – June 21, 2010, 07:18:56 pm

Quote

send 0b110

That command sends a full 8 bit byte (00000110), I think you want to send a partial byte like -^^_^ that takes data high (-), two clock ticks (^^), data low (_), another clock tick. That only sends the 3 bit you want.

Is the address 1111111?

With the OLS, make sure you have the right channel numbering system active when you set the triggers. There is sometimes confusion between the inside and outside numbering schemes. We're working on an updated bitstream and will release better use instructions with it.

Re: Little help to read this EEPROM

Reply #7 – June 21, 2010, 07:31:59 pm

[quote author="ian"]

Quote

send 0b110

That command sends a full 8 bit byte (00000110), I think you want to send a partial byte like -^^_^ that takes data high (-), two clock ticks (^^), data low (_), another clock tick. That only sends the 3 bit you want.

Is the address 1111111?
[/quote]
Thanks for pointing this out. But well, I guess sending 0b110 must be almost the same (since CS just rises up). But anyway, I corrected that and I get the same stuff:

Quote

M
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. JTAG
7. RAW2WIRE
8. RAW3WIRE
9. PC KEYBOARD
10. LCD
(1) >8
Mode selected
Set speed:
1. ~50KHz
2. ~100KHz
3. ~400KHz
(1) >1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1) >1
READY
RAW3WIRE>W
POWER SUPPLIES ON
RAW3WIRE>]-^^_^ _^:7 r:8[
CS DISABLED
DATA OUTPUT, 1
0x01 CLOCK TICKS
0x01 CLOCK TICKS
DATA OUTPUT, 0
0x01 CLOCK TICKS
DATA OUTPUT, 0
0x07 CLOCK TICKS
READ 0x08 BYTES:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
CS ENABLED
RAW3WIRE>p
1. Pull-ups off
2. Pull-ups on
(1) >2
Pull-up resistors ON
RAW3WIRE>]-^^_^ _^:7 r:8[
CS DISABLED
DATA OUTPUT, 1
0x01 CLOCK TICKS
0x01 CLOCK TICKS
DATA OUTPUT, 0
0x01 CLOCK TICKS
DATA OUTPUT, 0
0x07 CLOCK TICKS
READ 0x08 BYTES:
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
CS ENABLED
RAW3WIRE>

[quote author="ian"]
With the OLS, make sure you have the right channel numbering system active when you set the triggers. There is sometimes confusion between the inside and outside numbering schemes. We're working on an updated bitstream and will release better use instructions with it.
[/quote]

Well, for the numbering, I am pretty sure it is configured correctly, because when I fire the "W" in the bus pirate, the OLA instantly triggers.

Thanks !

Re: Little help to read this EEPROM

Reply #8 – June 21, 2010, 07:43:01 pm

Is it a brand new flash chip? They come fully erased. An empty chip means every byte is 0xFF.

Could you also try the selftest of the buspirate (~ command) to see if there any errors on your buspirate (just to be sure)

BTW A very informative post about inside/outside numbering scheme is here: http://dangerousprototypes.com/forum/in ... 72#msg6072

@ian: If I remember correctly from the other topic it didn't matter if you send 8 bits or 3 as long as the last three bits where ok. The chip is triggered by looking for a specific bitpattern (and CS off course)

Re: Little help to read this EEPROM

Reply #9 – June 21, 2010, 08:22:19 pm

Sounds like everything is working properly. The chip is *not* new, since I unsoldered it from a PCB, that's why I don't want to write data in it. Also, it makes no sense to read 0x00 when pullup is inactive and 0xFF when it is active :/.

Code: [Select]

HiZ>~
Disconnect any devices
Connect (Vpu to +5V) and (ADC to +3.3V)
Press a key to start
Ctrl
AUX OK
MODE LED OK
PULLUP H OK
PULLUP L OK
VREG OK
ADC and supply
5V(4.64) OK
VPU(4.65) OK
3.3V(3.31) OK
ADC(3.30) OK
Bus high
MOSI OK
CLK OK
MISO OK
CS OK
Bus Hi-Z 0
MOSI OK
CLK OK
MISO OK
CS OK
Bus Hi-Z 1
MOSI OK
CLK OK
MISO OK
CS OK
MODE and VREG LEDs should be on! Any key exits.

Thanks for the link, I already saw it and I confess it is good. In the future, I'll ask a new question about these buffered and unbuffered inputs

(which are not really clearly defined, except for the 5V tolerant voltage), but in the OLA forum.

Thanks

Re: Little help to read this EEPROM

Reply #10 – June 21, 2010, 08:26:50 pm

I'm not sure beyond this point, I read through the datasheet, but I don't have one of these chips to play with. As Sjaak said - maybe the part of the chip you're reading is blank (0xff)?

Quote

]-^^_^ _^:7 r:8[

Quote

Also, it makes no sense to read 0x00 when pullup is inactive and 0xFF when it is active :/.

Re: Little help to read this EEPROM

Reply #11 – June 21, 2010, 08:36:03 pm

Sorry, I meant to attach this chart:

Re: Little help to read this EEPROM

Reply #12 – June 21, 2010, 09:23:16 pm

[quote author="ian"]
I'm not sure beyond this point, I read through the datasheet, but I don't have one of these chips to play with. As Sjaak said - maybe the part of the chip you're reading is blank (0xff)?

Quote

]-^^_^ _^:7 r:8[

Did you intend to change the address to 0000000 this attempt? It looks like you used _^7 t his time instead of -^7. Looking at the datasheet, _^:7 is probably the correct option to read from the start of the chip.

Do you have the 8/16bit mode configured? I think there's a pin (ORG) that selects it. The address is only 5bits for the 16bit mode.
[/quote]

This time I managed to get address 0x0 correctly. ORG is grounded, so we are using 8b accesses. Maybe, indeed, there is nothing at this address.

[quote author="ian"]

Another thing: this is an SPI chip, there's no reason (AFAIK) that you can't choose normal pin type and skip the pull-up resistors.
[/quote]

Hum ok, but both methods give the same result.

[quote author="ian"]

Quote

Also, it makes no sense to read 0x00 when pullup is inactive and 0xFF when it is active :/.

Can you explain this one? This makes sense to me. If the chip doesn't respond then the pull-up resistors hold the bus high for 0xff (11111111), if they are off then it is high-z and random or 0, in this case 00000000.
[/quote]

Ok, thanks for the explanation, I still do not master all this pullup stuff.

One thing that would be interesting to do now is to read every 8 bit to see if the content differs from 0 (since I don't know where the data is...).

Quote

]-^^_^ _^:7 r:8[
]-^^_^ _^:6-^:1 r:8[
]-^^_^ _^:5-^:1_^:1 r:8[
etc...

Well, this is not very interesting to do it this way :/, and I guess increasing r:8 to r:256 wouldn't help, since we have to resend 0b110 + addr each time we want to read a piece of memory (EDIT: actually, even r:8 is incorrect, a single 'r' is enough). I am very tempted to write something in this first byte, though

. Anyway, what could be the best way to scan the full memory, is there a way to write it directly in the interpretor ? I can see a way using an expect script, but if it is possible to do without, I'll buy it.

Thanks !

Re: Little help to read this EEPROM

Reply #13 – June 21, 2010, 10:20:23 pm

This won't let me go

I studied the datasheet a bit more, and I saw there is a reverse package (it has a different pinassignment) I dunno how to tell but I think it it has a R in the printing. This could explain reading all zero/ones (depending on the pullup setting). Could you tell the exact printing (or make a picture?)

Which version of Buspirate are you running?

I found this in the svn: http://code.google.com/p/the-bus-pirate ... irateLite/

THere is a script to dump a 93c66 but the first bytes should be valid data. It use python though so you need to install that to (if on windows)

Re: Little help to read this EEPROM

Reply #14 – June 22, 2010, 08:27:31 am

Quote

READ (READ): The Read (READ) instruction contains the address code for the memory
location to be read. After the instruction and address are decoded, data from the
selected memory location is available at the serial output pin DO. Output data changes
are synchronized with the rising edges of serial clock SK. It should be noted that a
dummy bit (logic â€œ0â€) precedes the 8- or 16-bit data output string.

Can you consistently see this dummy bit? You might need an extra clock tick after the address to get this bit:
]-^^_^ _^:7 ^ r:8[

That's also handy because it makes the address into a 8bit value and you can use bytes instead of bit:
]-^^_^ 0b00000000 r:8[ second location would be: ]-^^_^ 0b00000010 r:8[

I couldn't find anything in datasheet that says the read length. Usually you can read the whole EEPROM from the start to finish, and only writes are limited to 1,8,16bytes, etc.

I also noticed this:

Quote

A valid instruction starts with a rising edge of CS and consists of a Start Bit
(logic â€œ1â€) followed by the appropriate Op Code and the desired memory address
location.

It was bolded in the datasheet. Maybe the opcode needs to setup prior to raising CS, so something like this:
-]^^_^ _^:7 ^ r:8[

It's all a guess though. The best thing would be to write a known value to a chip location and try to read it back. We don't really know what's on the chip, the first few sectors could be blank. It doesn't seem to have a status byte we can read to see if the chip is working at all.