Universal parallel reader and programmer

Author: Alexey Galakhov

This device is able to read firmware out of any chip that works with 5V or 3.3V supply and has its supply pins at the opposite edges of the package. The chip can be programmed as well if it does not require voltages higher than 5V for programming. This includes reading firmware out of 27C series EPROM and programming 5V 28F series EEPROM. Older ROM chips like 82S23 or K155PE3 also can be read.

The programmer can also test logic series chips like 7400 and reconstruct their truth tables. This might be useful for working some programmable logic.

Hardware features

There is 40-pin ZIF socket in the middle of the board. Near the upper row of the socket there are 10 jumper pin pairs with one jumper bridge placed over one of them. This jumper is used to set the desired chip length.

There are three LEDs in the upper right corner.

• D1 (yellow) indicates that the ZIF socket circuit is powered.
• D2 (green) indicates that the chip in the socket is powered.
• D3 (red) indicates a short-circuit or overload (protection is triggered). Also, D3 always is turned on just after the programmer is connected to USB-C and then is turned off after a successful USB handshake. If D3 remain lit, check operating system settings and drivers.

On the bottom row there are 8 RGB LEDs. These LEDs are freely programmable. They are also used as progress indicator while reading some chips.

A three-pin jumper in the lower right corner is used to switch chip voltage between 3.3V and 5V.

On the opposite side of circuit board there is a small 1.27mm pin header for firmware debuggingand a button to enter the bootloader for firmware update.

The USB-C connector uses USB 2.0 Full-Speed only and is 5V only.

Hardware connections

Place chip in the ZIF socket so that the chip is RIGHT-aligned. The ZIF lever should be to the LEFT. Pin 1 of the chip should point to the lever.

The last pin in the bottom row of the ZIF socket (pin 20 of 40-pin chip) is hardwired to GND. Make sure that this is the GND pin of the chip as well.

Place the jumper over one of the connectors JP1 to JP11 near the last pin of the inserted chip. This jumper connects power to the chip and is to be placed on the VCC or VDD pin of the chip.

Set the voltage, 3.3V or 5V with JP10.

Now, connect the USB-C cable to a PC. A serial device such as /dev/ttyACM0 should appear.

Software protocol

The programmer emulates an USB serial port (CDC-ACM device class). A simple text terminal is used to communicate with the device.

Both commands and their results use simple ASCII text. Complex data are dumped using hexadecimal notation. Commands are case-insensitive.

Commands are not echoed back and there is no command prompt. If using picocom, press Ctrl-A Ctrl-C to see what you're typing.

Each command ends with space or newline and is executed immediately. Multiple commands on a single line separated with spaces are equivalent to multiple commands on individual lines, one per line.

Following commands are supported:

• Ln=rrggbb - Set LED color where n is the LED number (1 to 8 for D4 to D11 respectively), rrggbb is the light color in hex format.

Example: L3=000f0f

• V? - Get voltate jumper position. Returns V3.3 or V5 depending on the jumper position, or V0 if the jumper is not present at all.

• P1 - Turn chip power on. Returns power status (P1), pin count jumper position (if present) and voltage. Example return value: P1 N28 V3.3 for 28-pin 3.3V setting.

Upon issuing this command the yellow LED turns on and power is supplied to the circuitry. If jumpers are properly placed, the green LED turns on as well. In case of short-circuit a digital fuse will turn power off again and the red LED turns on. Issue P0 command to reset this error condition.

All data pins default to input with weak pull-up after issuing this command.

• P0 - Turn chip power on. Returns power status (P0).

• P? - Check if power is on. Returns power status (P0 or P1), pin count jumper position (if power is on and the jumper is present) and voltage (even if the power is off).

• p? - Set the pin p as input and get its logical level. This command is only to be used if power is on and jumper settings are valid. The pin number is relative to the chip, not to the socket. Returns the pin number and its logical value in the format pin=1 or 0`.

Example command: 3?

Example return value: 3=1

Note that all input pins have weak pull-ups. Unconnected pins are always read as 1.

• p=0 or 1 - Set the pin p as output with given logical level. This command is only to be used if power is on and jumper settings are valid. The pin number is relative to the chip, not to the socket. Returns the pin number and its real logical value in the format pin=1 or 0`. The logical value is read back from the pin and not from the output buffer. In case of short-circuit the indicated value may be different from the value being set.

Example command: 3=0

Example return value: 3=0

• N=n
• A=a0,a1,...an
• D=d0,d1,...dn
• H=h0,h1,...hn
• Z=l0,l1,...ln
• R

Bulk read command family.

The R command reads the whole chip at once by sequentially going through all addresses. The output is written to the console in hexadecimal format. Each output line starts with a 24-bit address. Then, separated by spaces, data words follow. Data word size is chosen automatically from 8, 16 or 32-bit depending on the bus width. The line length never exceeds 64 bytes of text. After everything has been read, a line containing the total byte count and a single $ is printed.

Example of the output:

000000 80 E4 80 E9 53 84 00 00
... (snip) ...
007fc8 80 E4 80 E9 53 84 00 00
007fd0 00 00 00 00 00 00 00 00
007fd8 00 00 00 00 00 00 00 00
007fe0 00 00 00 00 00 00 00 00
007fe8 00 00 00 00 00 00 00 00
007ff0 4C 65 61 64 00 00 00 00
007ff8 00 00 00 00 00 00 00 0D
008000 $

The progress is indicated by programmable LEDs that slowly start lighting blue. They all turn green after successful read.

In order to use the R command, chip pinout has to be set first.

The R command itself is only to be issued with power on. Its settings companions are independent of the power status and just have to be issued prior to the R command. Settings keep their effect across multiple R commands and are kept over P0 and P1 cycles. If the same settings command is issued multiple times, the last one takes effect.

N=n sets the pin count of the chip to be programmed. This is used for verification purposes and must be always set prior to issuing R. If its value does not match the actual jumper position, the R command will abort with WRONG SIZE error message.

A=a0,a1,...an sets address pins. Pin numbers are relative to the chip and not to the socket. They are comma-separated without extra whitespace. The total amount of address pins determines the address range to be scanned. The programmer supports up to 24 address pins.

D=d0,d1,...dn sets data pins. The format is the same as for A=. The total amount of data pins determines the width of output words. For 8 pins or less the output will be 8 bit, for 9 to 16 pins it will be 16-bit (left zero padded), for 17 to 24 bit it will be 32-bit (left zero padded). The output format is endianess-agnostic. More than 24 data lines are not supported.

H=h0,h1,...hn and Z=l0,l1,...ln configure pins that have to be 1 and 0 for the entire read cycle, respectively. Chip select and mode select pins can be set this way. This is equivalent to setting them individually using pin=value. The pins are set in the order they are listed, all ones (H=) first, all zeroes (Z=) next. After reading they are returned to their default state (input with weak pull-up) in reverse order.

Full example of using R (reading a 27C256 UV-EPROM):

N=28
D=11,12,13,15,16,17,18,19
A=10,9,8,7,6,5,4,3,25,24,21,23,2,26,27
Z=20,22,1
P1
R
P0

Testing non-memory chips

The R command can be used for testing logic chips. Suppose we want to test a 74LS00. This chip has DIP-14 package and contains 4 NAND gates.

The following script tests the first gate:

N=14
A=1,2
D=3
P1 R P0

We treat the NAND gate like 2x1 memory and, by scanning its 4 "addresses", get its truth table. It is also possible to check all four gates at once:

N=14
A=1,2,4,5,13,12,10,9
D=3,6,11,8
P1 R P0

Being less efficient than checking each gate separately, this still works since there are only 256 possible input combinations. It also checks for any kind of cross-talking between logic gates.

To test stateful chips like flip-flops, talk to their pins separately using p=v command.

Firmware building and update

The firmware is written in Rust. Due to ROM size restrictions and corresponding agressive optimization the nightly Rust channel has to be used for now. It works with Rust 1.90-nightly or later.

In order to build the firmware, the lld linker must be available as well. Other prerequisites are to be installed with cargo:

$ cargo install flip-link
$ cargo install cargo-dfu    # for programming over USB
$ cargo install cargo-embed  # optional, for programming over SWD

To build the firmware:

$ cd firmware && cargo build --release

To update firmware using DFU:

• Disconnect USB-C cable.
• Set the voltage jumper to 3.3V.
• Press and hold the button (SW1).
• Connect USB-C cable with button pressed.
• Release the button.

The device is now in DFU mode and can be programmed. To build and flash the firmware:

$ cd firmware && cargo dfu --release

If the device is not accessible, check device access rights (udev). If the device does not appear in lsusb at all, make sure the jumper is at 3.3 volts. The device will NOT enter bootloader mode with any other jumper settings.

To update firmware using SWD (not recommended):

• Connect SWD dongle. SWD pinout is as follows: 1 - GND, 2 - RST, 3 - SWCLK, 4 - SWDIO.
• Issue cargo embed --release command. Unlike cargo build and cargo dfu this only works from the firmware root directory and not from its subdirectories. Correct usage is, for example:

$ cd firmware && cargo embed --release