QDRE (Quick & Dirty Rom Emulator) is a device which emulates a ROM by replacing it with a static RAM - this is useful when: - You need to load code many times during development, and would rather not wait the 1/2 hour cycle time for EPROM erase/program. - You need to put diagnostic or bootstrap code into a system temporarily by replacing it's ROM and you do not have access to a traditional device programmer. QDRE is NOT a full-featured in-circuit debug tool. It was designed as a "get the job done" tool for people who have an occational need to place ROM code into a system, and do not have ready access to an EPROM programmer or in- circuit ROM emulator. It is not as easy to use as an in-circuit ROM emulator (you have to move the ROM module between a programmer and the target system), however it was designed be very inexpensive, easy and quick to build - It contains only 7 IC's (5 if you use 8-bit counters) and can be constructed in an hour or two. QDRE assumes you have a DOS-PC available on your workbench (every workbench should have a DOS-PC ... an amazing number of useful lab tools can be created using the PC parallel and serial ports and a "bit of software"). Parts list: - DS1230 or DS1235 non-volatile RAM or equivalent (cordless version) -or- 62256 static RAM or equivalent (umbilical cord version). - 74LS14 schmitt trigger hex buffer - 74LS245 bi-directional bus tranceiver - 16-bits worth of TTL counter. I used 4x74LS163 (4-bit) counters which I had in my junkbox, but you could use 2x74LS590 (8-bit) for fewer parts. - 3x28 pin sockets (programming socket + two for module) "ZIF" (Zero Insertion Force) socket recommended for the programmer "machine" type socket recommended for the module "plug" - Recommend sockets for the LS14, LS245 and counters - DB-25 connector for connection to PC parallel port - A few 10k resistors & 10uf bypass capacitors I've included a couple of photos which will let you see how the prototype QDRE system was constructed: QDRE_SYS.JPG - Full system, with programmer (left), cordless (top right) and unbilical-cord (lower right) versions of the MODULES. QDRE_SCK.JPG - Closeup of a ROM module socket (umbilical version) - here you can see it was constructed from 2 28-pin sockets (the top one has had the center cut out so that only the rows of pins remain, and a "sip" resistor pak is used to provide the various pull-ups in a very small space. --- How it works --- A ROM emulator works by multiplexing a RAM chip between the target system and a control cicuit which loads it - a RAM is a parallel device so this means switching a lot of signals and a control circuit capable of parallel loading the data. For an up to 32k device, this involves switching and manipulating: 8 Data lines 15 Address lines 1 "Chip Select" signal 1 "Write enable" signal 1 "Output enable" signal QDRE loads the chip from the PC parallel port, using a 16-bit counter to achieve the address bus. - The 8 data lines are the LPT data lines (you must have a bidirectional LPT) - The 15 address lines come from the counter (we read/write sequentially) - "Chip Select" is driven by LPT "SlctIN" (pin 17) - "Output enable" is driven by LPT "AutoFD" (pin 14) - The counter is clocked by "STROBE" (pin 1) - The counter is reset by "INIT" (pin 16) This uses up all our LPT output signals - and we still have "Write Enable" (WE) to contend with - Fortunately we only need 15 address lines (we emulate up to a 32K ROM) - WE is connected to output 0 from the counter, while address lines A0-A14 of the ROM are connected to outputs 1-15. To keep WE high (inactive) when the counter is reset, we put it through an invertor. This means that EVEN addresses READ the chip (A0 is LOW/WE is HIGH) and ODD addresses WRITE the chip (A0 is HIGH/WE is LOW). Since the read or write only occurs if CE is LOW, we can step along either reading or writing by clocking the counter twice between each access. We just have to set the right "state" by either clocking it once, or not clocking it at all after resetting it before we begin the read or write sequence. The easiest way to multiplex the RAM between the contraption attached to the PC LPT port and the target system is to physically remove it from one, and plug it into the other - the trick is to not lose the data from the device, since an SRAM normally "forgets" the moment you remove power. This can be accomplished in two ways: --- Cordless Version --- This version makes use of a 32k non-volatile battery-backed-up SRAM chip such as the DS1230 or DS1235 available from Dallas Semiconductor. These devices not only keep their data when power is removed, but they have an internal power monitor to prevent unintentional writes when the signals become unstable during a power-down. --- Umbilical-Cord version --- This version uses a standard 62256 SRAM device which must remain powered while it is being moved from the programmer to the target system. To accomplish this the chip is powered by an unbilical cord from the programmer which must be long enough to reach the target (3 feet seems pretty good on most benches). Pin 28 on the ROM emulation "plug" is NOT connected - otherwise the programmer would end up trying to power the entire target system. To avoid corruption when moving the chip, the PC software holds all the lines (selects, enables etc.) HIGH when it is idle (everything off) - there is a 10k resistor between WE and the +5V power to the module (from the cable), so when removing it, WE will stay high (deselected). A small switch (or jumper) is used to disconnect WE from the socket pin (ROMs don't use a WE signal), which guarantees that no matter what we do to the other pins, the device will not be written. As long as it stays powered, and the jumper remains OFF, WE will be pulled high and the device will hold it's content. Most classic systems use smaller ROMs than 32K - The corresponding address lines are unused, sometimes "float" or may be connected to HICH or LOW. The QDRE software handles this by "mirroring" the content of smaller ROM images throughout the 32k SRAM map so that the data presented will be correct no matter what state the higher address bits are in. The ROM MODULE schematic is provided in the files: QDRE_CDL.DWG - Cordless version - Microcad format QDRE_CDL.JPG - Cordless version - Image format QDRE_UMB.DWG - Umbilical-cord version - Microcad format QDRE_UMB.JPG - Umbilical-cord version - Image format When jumper J1 is CLOSED, the device can be programmed via the PC LPT port. When J1 is OPEN, the device is write protected and can be used in a ROM socket. J1 should be changed when the module is in the programmer and the programmer is idle. It should ALWAYS be OPEN when the module is plugged into the target system, and CLOSED when in the programmer. Jumper J2 (cordless version only) should be OPEN when programming or when emulating a 28 pin device - CLOSE J2 to provide power from pin 24 when emulating a 24-pin device. Note: This module should work for all EPROM types from 2716 to 27256 and ROMs with compatible pinouts. The 24-pin devices (2716 and 2732) can usually be made to "fit" by stacking a couple of 24-pin "machine" sockets on the lower-portion of the 28-pin emulator socket. An alternative to using J2 on the cordless module is to have a more complex 28<>24 pin adapter which makes the pin 24-28 connection when it is installed. If you need to emulate an older/other devices (like 2708 or 1702), then you will need to make a custom pin adapters. For a 2708, all you need to do is move CE from pin 20 on the 24-pin socket to pin 20 on the emulator socket (which is in a different place because it's 28<>24 pin), leave pins 18, 19 and 21 of the 24-pin socket unconnected, and tie OE LOW and the corresponding address lines HIGH (if not already pulled up) on the emulator side. For a 1702 or other devices you will need to make a more complex adapter as the pinout is completely different. A12 & A14 should be pulled to +5 via 10k resistors, otherwise they will "float" when emulating smaller devices. It wouldn't hurt to pull all of A10-A14 as they may "float" in some configurations (you're "supposed" to tie these off on the target ROM socket - but you never know). --- The PC based "programmer" --- The programmer unit connects to the PC parallel port and has a 28 pin socket for programming the module - a ZIF socket is recommended. The schematic for the programmer is provided in the files: QDRE_PGM.DWG - Microcad format QDRE_PGM.JPG - Image format This schematic shows the use of 4x 74LS163 counters which just happens to be what was readily available when the prototype was built. You can use any counter scheme you like, as long as it: - Resets when CLEAR is strobed ** - Increments when CLOCK is strobed ** - Presents 16 parallel outputs in a linear binary count from 0000-FFFF. A pair of cascaded 74LS590s should work just as well as the LS163s and with a lower parts count. ** Most other counters can be accomodated with the setup options of QDRE - You can reverse the sense of the strobes. - You can have a CLOCK strobe issued or not while CLEAR is low (for counters with synchronous/asynchronous clear) The DPDT switch on the schematic labled PGM/SBY serves two purposes. - It provides power to the cordless module when in the PGM position, and removes it in SBY while the other signals remain high - this insures the Dallas device will see power drop before WE. NOTE: You must still power-OFF the programmer before removing the cordless module, otherwise it may become corrupted as it leaves the socket. - It disables the 74LS256 outputs when in SBY - this prevents conflicts with the PC parallel port output drivers. YOU SHOULD ONLY MOVE THE SWITCH TO "PGM" WHILE THE QDRE PC SOFTWARE IS RUNNING!!! Note that this switch should NOT control the power to an umbilical cord version of the module - it is important that that module receive power at ALL times. Use of the programmer module should follow this sequence: - Make sure PGM/SBY switch is set to "SBY'. - Run the QDRE application on the PC - Connect the programmer to the LPT port. - Insure cordless module J2 is open. - Insert the module into the programmer - Set the module J1 for "programming" mode - Move the PGM/SBY switch to PGM - PROGRAM the module via software (F5) - Set module J1 for "emulation" mode - Perform VERIFY (F4) and confirm device is programmed correctly. - For CORDLESS version ONLY: - Turn the PGM/SBY switch to SBY - Power-OFF the programmer before removing the module. - Remove the module from the programmer - Set cordless module J2 closed for a 24-pin target. - Insert module in (powered off) target device - Power up the target and go. NOTE: that the power monitor on the Dallas chips prevents them from being read until the power is stable - the power-on-reset of some systems is faster than the Dallas power monitor, meaning the device does not read when the system is trying to execute the first few of bytes from it. The solution here is to power on the system, and then manually reset it (buy this time the Dallas device will be operating). --- SOFTWARE --- The QDRE program is fairly self-explainatory: Use: QDRE [@file] [options] opts: P=1-3|address - select Parallel port [1] F=xx - blank rom Fill value [FF] M=8-15 - Mirror address bits [15] O=xxxx - address Offset [0000] R=8-15 - Rom address bits [15] S=AORSWC - parallel port Setup: [none] A = invert (LHL) Address/counter clock O = invert (LHL) Oe strobe R = invert (LHL) address/counter Reset S = invert (LHL) Select (ce) strobe W = invert We (LOW means READ) C = inhibit address Clock strobe during reset W=n - parallel port Wait cycles [4] Options can be supplied from a file with '@' (one per line - blank lines and lines beginning with ';' are ignored). If no command options are given, QDRE will look for default options file 'QDRE.OPT', first in the current directory and then in the directory where the program resides. Dave Dunfield - Jul 19 2005 When run, you are presented with a screen containing a hex/ascii editor, you can move around and edit the ROM image, with the following keys: Up/Down/Left/Right - Move one byte in direction Home - Move to beginning of line End - Move to end of line ^Home - Move to beginning of page ^End - Move to end of page PgUp - Scroll up by one page PgDn - Scroll down by one page ^PgUp - Move to beginning of image ^PgDn - Move to end of image F7 - Toggle Hex/Ascii edit mode F8 - Set edit address (data) - Hex/Ascii data is entered into the image You can also use the following keys to perform other functions: F1 = Load ROM image from a PC file (binary or Intel/Motorola) F2 = Save the ROM image to a PC file (binary or Intel/Motorola) F3 = Read ROM image from device (attached to LPT) F4 = Verify ROM image with device (attached to LPT) **full mirror F5 = Write ROM image to device (attached to LPT) **full mirror F6 = Fill ROM image with a value F7 = Toggle Hex/Ascii editing mode F8 = Set edit address F9 = Setup screen F10 = exit program ** The Write and Verify operations write and verify all mirrored copies of smaller ROM chips. Setup menu: F1: Offset Sets an offset for loading/saving images in file. For BINARY files, the offset is just the position within the ROM buffer when the file will be loaded/saved to/from. For Intel and Motorola format files, the offset is subtracted from the record addresses during LOAD, and added to them during SAVE. This allows you to emulate ROMs which are not at address 0000 in the target memory map. F2: ROM address bits Selects the number of address bits to be emulated. This controls the size of the emulated ROM. F3: MIRROR address bits Selects the number of address bits in the physical RAM device on the emulation module - QDRE will mirror the ROM image as many times as it will fit in the physical device. Unless you are using less than a 32k device in the module, you should leave this set at 15. F4: CS strobe (Chip select) F5: OE strobe (Output Enable) F6: ADDR strobe (Counter clock) F7: ADDR reset (Counter reset) Allows you to select an active-low (HLH) or active-high (LHL) strobe sense for each of the above signals on the parallel port. Unless you have changed the hardware design, you should leave these at the default values. F8: CLOCK to reset Allows you to select whether or not a clock strobe should be issued while the reset line is held active when clearing the address counter. Some counters require this clock (syncronous reset) while others do not (asyncronous reset). If you find the counter is stepping during reset (WE will appear high afterward) you may need to disable this. F9: WE LOW means Allows you to select whether a LOW value of the WE signal means WRITE or READ - unless you have changed the hardware design you should leave this at it's default value. NOTE: The setup menu describes signals respect to the devices on the programming board - due to the inversion of the 74LS14, the signals on the LPT cable are the opposite polarity. --- DIAGNOSTICS FUNCTIONS --- To assist in debugging your hardware, the setup menu has a few built in diagnostic functions which perform operations via the PC LPT port as you execute them: S - toggles the Select (CE) line O - toggles the Output (OE) line A - steps the Address counter by one clock C - performs a Clear (reset) of the address counter G - Go to specified address, clears and then steps this many NOTE: entered address is "raw counts" - so: 00FF means ROM address 7F with A0 HIGH/WE LOW (write) 00FE means ROM address 7F with A0 LOW/WE HIGH (read) W - Write data byte to LPT data Forces OE OFF to avoid conflict Data remains asserted until next keystroke, then LPT is reverted to input. R - Read data byte from LPT data Asserts OE during read. NOTE: Signal state 'ON' or 'OFF' means 'Asserted' or 'Deasserted' actual logic polarity for either state will depend on the setup menu settings. I have also included PPDEBUG.COM, a tool I created for more detailed general debugging of parallel port logic - type 'PPDEBUG ?' for the command line options, and press '?' when running the program for the available function keys. --- THINGS TO WATCH OUT FOR --- NEVER connect the programmer to the LPT port when the QDRE software is not running! Be sure to set the correct Offset address for your ROM image. This controls where in the target system memory map the ROM "starts", and is required to properly locate the image within the ROM. Be sure to set the correct ROM size. If you fail to do this, the content of smaller ROMs will not be mirrored correctly within the 32k RAM - this may prevent the ROM from being read correctly in the target system. Always power-OFF the programmer before inserting or removing the cordless module - otherwise the Dallas chip will be corrupted. The cordless module is a hack! - moving a powered RAM chip from one system to another is not really a "clean" thing to do. Keep in mind: - Be carefull of static, use a static strap etc. - Avoid differing grounds at the target system and the programmer. It is best to connect the two through a solid common ground. - When inserting the module in the target system, I always try to angle it slightly so that ground (pin 14) will connect first. The 74LS14 is important! Do not substitute a 74LS04. Without the schmitt trigger inputs, ringing and transients on the LPT cable will cause spurious signals. To test your setup, use the 'G' command under the Setup menu to position to a number of high count values and confirm that the counter always ends up at the expected address. Although not shown on the schematic, bypass capacitors should be placed on all ICs. Dunfield Development Services (DDS) offers software and firmware development services specializing in systems and embedded applications. For more information, visit: http://www.dunfield.com