135
edits
Changes
Jump to navigation
Jump to search
m
→T48 Programmer-
==Device Overview==
This is a complex device with a 16 bit CPU, Xilinx 95xx CPLD, Custom Alesis chip (Gate array, PAL, GAL, OTP CPLD?) SRAM, NOR flash 512kb, logic and switching for bus arbitration. BREQ Bus request is a very involved circuit. Also CE# Chip Enable NOR Flash is connected through a complicated muxing circuit. The Alesis custom IC handles the WE# Write Enable to the NOR Flash, and also seems BREQ master.
No info could be found on the Alesis chip, searching for the numerous IC markings revealed nothing.
In the image below the python code on the right, are the settings needed for a good read. The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low). SHARP LH28F400BVE Parallel NOR Flash 512kb. The chip is from the late 1990s as the device is also, turn of the century 2000s.
Although the strings are legible in the T48 preview, this is because the T48 is re-arranging the byte order automatically. The byte order must be swapped (little endian) in order to correctly view and disassemble the firmware. I found this out after nonsensical strings were seen, without swapping byte order. I tried some 8 bit reads, but this garbled the strings in the T48. It was clear 16 bit wide was correct, but then byte order needed changing. I used a python script to swap the byte order of the entire dumped firmware file. <syntaxhighlight lang="python3">
# swap_bytes.py
</syntaxhighlight>The strings are very interesting indeed. Not just a standard 'version' or 'release date' string - they are command strings!
As this device has no screen, a low level diagnostic routine is inferred from their discovery. (though actually, there are also a couple of strings that are sent out via a User Operation, to a device with a screen) Looking closely at the last string or two, I was worried that it might be corrupted as there are some missing letters in the string - (ADAT Sync port di onnected and Dectected rather than Detected).
==Examine Firmware -==
==Repairs -==
After confirming the firmware of the CPLD and the Flash seem intact. , I flashed the firmware onto a new NOR flash chip. I also replaced the SRAM (these are almost a consumable, and I have had one of this range fail before, in a different package) This device has seen some use, if the NOR got warm enough to dry out half the pins completely.
I replaced the other chips I had removed. I fixed the traces on the board with new pcb traces. I had to repair a leg of a custom Alesis IC (there are three, two small one large). The chip was bridged with a factory bodge of a capacitor. Removing that, broke the leg off the IC. I was able to grind away the epoxy and solder a new leg in place. Almost 20 traces have been repaired.
The LEDs had metal fatigued off with all the repairs. I ground away the solder resist and was able to solder them directly to the board again. (they are a custom design package. Also, I like to use the original. Only , only the legs were broken after all)<gallery>
File:Dif-at-tracerepair.png|alt=Traces replaced and connected.|Traces replaced and connected.
File:Dif-at-tracerepair2.png|traces tinned (way too much, I took some off with wick)
