READ-ONLY MEMORIES or "ROMs" have been used for many years to store data and "firmware" programs in a huge range of digital equipment. So if you do servicing work on such equipment, it's very handy to have a device which can read and check the contents of a ROM.

And if you do development work on equipment with ROMs, it's essential to be able to program them as well. You need to be able to program EPROMs (erasable programmable ROMs) and ideally, OTP (one-time programmable) ROMs and EEPROMs (electrically erased programmable ROMs) as well.

Although freestanding programmer/readers are available, they're quite expensive. Even those that are controlled by a PC aren't cheap, with prices ranging from about $300 up to over $2000. Our new comprehensive design is much cheaper than that. We estimate that the kit cost should be around $160.

A good PC-driven programmer/reader was described in the September and October 1993 issues of "Electronics Australia". Designed by Dr Glenn Pure, it was very popular, with many hundreds of kits sold. It was given a further boost in January 2000, when Glenn Pure described how to adapt the original design for programming 1Mb (one megabit) EPROMs.

This new programmer/reader has been designed to build on the work of Glenn Pure and it gets around most of the shortcomings of the earlier version. It has all the circuitry on a single double-sided PC board and because all of the setting-up and device configuration are under software control, there's no off-board wiring. The board has one DB25 connector to accept the cable from the PC's printer port and a socket for a 12V AC plugpack.

The controlling software is Windows-based (Win95/98), rather than DOS-based as in the earlier design.

The programmer has one ZIF (zero insertion force) socket for the EPROM to be programmed or read. This is a 32-pin socket which can be configured by the software to suit devices in 28-pin or 32-pin DIL packages, with capacities from 64Kb (kilobits) to 2Mb (megabits).

It can also be used to work with older 32Kb devices in 24-pin DIL packages and devices in 32-pin PLCC (plastic leadless chip carrier) packages with capacities from 64Kb to 2Mb. This is done with small matching socket adaptors which fit into the ZIF socket.

How it works

Although there's lots more circuitry in the new programmer than in Glenn Pure's original, the basic operation is pretty straightforward. Let's refer to the block diagram shown in Fig.1.

As already noted, the programmer is designed to connect to the PC via a standard parallel (Centronics) printer port. It does not need the newer bidirectional ECP (extended capabilities port) or EPP (enhanced parallel port). This makes it fully compatible with older PCs.

As a result of using the Centronics port, we have a total of 12 8-bit lines for 'outgoing' data from the PC to the programmer and five 8-bit lines for 'incoming' data.

Fortunately, the majority of PROMs have their data organised in 8-bit bytes and we're also able to handle the outgoing address, configuration and pulse timing data in (8-bit) bytes as well, so the eight data output lines provided in a standard printer port's main 'base I/O address' are all we need, for downloading all of this data.

As shown in Fig.1, data comes from the PC via pins 2-9 of the DB25 connector and is fed to buffer IC1. The outputs of this buffer are then fed to a byte-wide data bus, which goes to the EPROM programming socket and to various storage registers.

For example, when the software wants to change the current EPROM address, it can send down a byte representing the lowest eight address bits for storage in the 'low address byte register' IC6; and/or it can send a byte representing the next most significant eight address bits, for storage in the 'mid address byte register' IC7.

Alternatively or in addition, it can send down a byte with the two top address bits, for storage in the 'hi address bits register' IC10; or a byte providing the configuration data for the EPROM to be programmed, for storage in the 'EPROM config register' IC9, or a byte specifying the duration of the programming pulses to be used, for storage in the 'PGM* pulse duration register' IC8.

How does the software control which register receives this downloaded data or whether it goes to the EPROM? That's controlled by three more of the printer port's outgoing data lines. These are provided by bits D1-D3 of the control register at the PC's I/O port address 'base + 2' (ie, two up from the port's main base address). These bit lines arrive on pins 14, 16 & 17 of the DB25 connector and are fed to the inputs of decoder IC3, where they're decoded to provide one of eight different 'mode control' logic signals.

These signals are used to control the current operating mode of the programmer and where the data bytes from IC1 are sent.

The 12th outgoing bit from the printer port (the least significant bit D0 of the port's control register) arrives on pin 1 of the DB25 connector and is used to trigger the programmer's PGM* hardware pulse timing circuit. This involves ICs 4, 13 & 14. When they're triggered, they produce a programming pulse with a length determined by the data byte currently stored in IC8.

All of the voltage setting and chip configuration data stored in config register IC9 is used to control switching circuits associated with ICs 16-19. This is how the software is able to set the correct voltage levels and pin functions for each type of EPROM and for each programming mode.

Nibble this, nibble that

So much for programming, then. But what about reading data already stored in an EPROM? Since a standard parallel printer port provides only five incoming data bit lines, we simply split the data byte from the EPROM into two four-bit 'nibbles' and send them back to the PC separately. The software then 'glues them back together' to produce the full data byte.

During a read operation, the data byte from the EPROM's current address appears on the data bus (the outputs of IC1 are turned off in this mode). It's then effectively split into two nibbles by multiplexer IC2, which presents one nibble or the other to pins 10-13 of the DB25 connector, as controlled by a 'read low data nibble' or a 'read high data nibble' signal from IC3.

In the PC, these pins connect to data bits D4-D7 of the port's read-only status register at I/O address 'base +1', so this enables the software to read each nibble separately before reassembling them into the read data byte.

The fifth and last incoming bit line on the printer port connects to pin 15 of the DB25 connector and this is used in the programmer to provide a copy of the PGM* pulse, so that the software can tell when the hardware-timed pulse has ended. This bit line also goes back to the printer port's status register at I/O address 'base +1', specifically to that register's bit D3.

The basic arrangement of the various registers and I/O addresses associated with a PC's printer port is shown in Fig.2.

Circuit description

Now let's look at the main circuit, shown in Fig.3 (see over).

The data input buffer IC1 is a 74HC245 octal bus transceiver. This is a bidirectional device, although it's used here only for buffering in the 'write' direction. The data bit lines from the DB25 connector are fed to its inputs via 100Ω stopper resistors, which minimise line reflections and ringing. (This is also done for all other port signal lines.)

The outputs of IC1 are enabled by a logic low signal applied to pin 19 in all of the programmer's modes, except the two for reading back EPROM data. In these two modes, the outputs are disabled by applying a logic high signal to pin 19, from gate IC4c.

In all other modes, IC1 receives the downloaded data from the PC printer port's base address and passes it straight through to the programmer's internal data bus. From here, it can be fed to any of the storage registers or to the ZIF socket and EPROM.

The data is loaded into each storage register as desired by applying a logic signal to its parallel load input. As mentioned earlier these 'load data' signals come from the outputs of mode decoder IC3, a 74HC138. So when the software wants the data byte to be loaded into low address byte register IC6 for example, it manipulates the three control bit lines feeding IC3 to force its Y0-bar output to go low.

This LAL* (Load Low Address, active low) signal is then inverted by IC5f and fed as an active high signal to pin 11 of IC6 so that it loads the data byte into its internal latches (ICs 6, 7, 8 & 9 are all 74HC373 octal latches).

can be set up on the DIP switches.

Similarly, the software can have the data byte loaded into mid address byte register IC7 by manipulating the three bit lines feeding IC3, so that the Y1-bar output goes low. The resulting LAM* signal is then inverted by IC5a and fed as a LAM signal to pin 11 of IC7.

The data can be loaded into high address register IC10, config register IC9 or PGM* pulse duration register IC8 in the same way. The LAH* signal from the Y2-bar output of IC3 is used to load IC10, while the LCF* and LPD* signals from the Y3-bar and Y6-bar outputs of IC3 are used to load IC9 and IC8 respectively.

The only difference with the last of these signals is that there's a small low-pass RC filter between the Y6-bar output of IC3 and the input of inverter IC5c (the 100Ω resistor and 1nF capacitor). This is to prevent timing misloads due to narrow spurious glitches which can appear at the output of IC3.

IC5 also drives five inverters in IC15, which in turn drive LEDs 1-5. These LEDs light to indicate when data is being loaded into each of the registers. We'll come to LED6 in a moment.

Timing circuit

ICs4, 13 & 14 form the timing circuit for the programmer's PGM* puls-es. As you can see, IC13 and IC14 are both 74HC161 4-bit synchronous counters, which together form an 8-bit counter. The counter's operation is controlled by IC4a and IC4b, which form the timing control flipflop.

Inverter IC12b and crystal X1 form a 4MHz oscillator which then drives flipflops IC11a and IC11b to give 2MHz and 1MHz clock signals. The 1MHz pulses from pin 9 of IC11b are fed to IC13 and IC14, so they count in accurate 1μs increments.

The 4MHz, 2MHz and 1MHz clock signals are also fed through to three inverters in IC12 and made available at on-board test points.

The timing counter works as follows. Normally the flipflop formed by IC4a and IC4b is reset, with pin 3 low and pin 6 high (and the latter is also the PGM* output line, so there is no pulse). In this state, the counters are in "parallel load" mode, with the data byte in timing register IC8 being loaded into them.

When the software sends down a programming trigger pulse via pin 1 of the DB25 connector, it is passed through the differentiating circuit formed by the 100pF capacitor, 4.7kΩ resistor and diode D1. The resulting very narrow negative-going pulse is then applied to pin 1 of IC4, which makes the control flipflop switch into its set or 'counting' state, with pin 3 now high and pin 6 low.

The low level on pin 6 thus forms the PGM* pulse, while the high level on pin 3 switches counters IC13 and IC14 from parallel load mode into counting mode. They therefore begin counting the 1MHz clock pulses, starting from whatever binary value has been loaded into them from IC8.

This counting operation continues until IC13 and IC14 both reach their maximum or 'terminal' count of 255 decimal (11111111 binary or FF hex). Then the TC output of IC14 (pin 15) goes high and this signal is fed back through inverter stage IC4c to pin 5 of IC4b, which triggers the control flipflop back into its reset mode.

Pin 6 of the flipflop then flicks back high, ending the PGM* pulse, while pin 3 goes low and switches the counters back to parallel load mode.

The bottom line is that the timing circuit can produce a PGM* pulse anywhere between 1μs and 255μs, depending on the 'pulse duration' data byte loaded by the software into register IC8. But note that because the counter counts UP to 255 from the value parallel loaded from IC8, the actual pulse length generated by the circuit is given not directly by the value of the data byte but by the difference between it and 255; ie:

Pd = (255 - Dv) microseconds

where Pd is the pulse length and Dv is the value of the duration data byte. So to generate a 1ms pulse, the software must send down a value of 254. Similarly, a value of 0 will produce a pulse length of 255μs. For a 50μs pulse, it must send down a duration byte value of 205 and so on.

By the way, if you're wondering about that 10Ω resistor and 100pF capacitor in the timing circuit's terminal count feedback line, they form another glitch-swallowing low-pass filter. 74HC161 chips can produce a very narrow 'false TC output' glitch pulse when they're changing state at a lower count but the filter stops this glitch from upsetting the timing.

As well as setting the mode of counters IC13 & IC14, the signal at pin 3 of IC4a is fed through inverter IC5d to pin 15 of the printer port connector, so the PC software can monitor the PGM* pulse and sense when it ends. In addition, this signal is taken to inverter IC15c, which drives indicator LED6. This LED lights whenever a PGM* pulse is being generated.

ZIF switching

Most of the remaining circuitry is used for switching voltages and signal lines to various pins of the ZIF socket, to suit it to different EPROMs and for the various programmer operating modes. This is done under software control, mainly using the eight output lines from config register IC9. These are labelled CF0 - CF7 and their functions are shown in Table 1.

Other signals used by the switching circuitry are the PROG* output from mode decoder IC3 (pin 7, Y7-bar), the PGM* programming pulse from IC4 pin 6 and the READ signal from pin 11 of IC4c.

If you have a look at IC9, the CF0 signal drives transistor Q6, which operates relay RLY1. This controls the voltage/signal fed to pin 3 of the ZIF socket, allowing the software to select either address line A15 or programming voltage Vpp as required for different EPROMs.

Note that the same ZIF socket pin becomes pin 1 for 28-pin EPROMs. That's why Table 1 shows a second pin number in brackets. This convention is used with the other pins as well.

Similarly, the CF4 signal drives Q7 and relay RLY2, which controls the voltage/signal fed to pin 30(28) of the ZIF socket. In this case the software can select either address line A17 or Vcc, as required.

Signals CF1, CF2 and CF3 are also used to control ZIF socket pin voltages/signals, except that transistors and gates are used for the switching rather than relays. This is because this switching needs to be done relatively quickly, in conjunction with the PGM* pulses. These switching functions involve IC17-IC19, transistors Q4-5 and Q8-Q15 and diodes D8-D11.

Power supply

Referring back to Table 1, you can see that the remaining control signals from config register IC9 (CF5˜F7) are used to switch the values of chip supply voltages Vcc and Vpp, to suit the needs of different EPROMs in either read or write mode. To see how this switching is done, refer to the power supply circuit in Fig.4.

The programmer derives all its operating voltages from a standard 12VAC 1A plugpack, which connects via CON2. The 12VAC feeds three rectifier circuits, to provide a total of four different supply lines.

Diode D5 and a 2200μF filter capacitor provide the unregulated +16V line used to operate the two relays.

Diode D2 is also used as a halfwave rectifier, with another 2200μF reservoir capacitor. This feeds regulators REG1 and REG2. REG1 is a fixed type (7805) which provides the +5V supply line for all of the programmer's own logic chips and indicator LEDs (including power indicator LED7). REG2 is an adjustable type (LM317) and is used to provide the EPROM's programmable Vcc supply line.

Control signals CF5 and CF6 are used here, in conjunction with the programming mode control signal PROG* (from mode decoder IC3, pin 7). These are fed to logic gates from IC16 and inverters from IC17, to control transistors Q1 and Q2. The two transistors switch in resistor combinations across the lower resistors in REG2's voltage setting divider, to control its output voltage Vcc.

As a result, the software can select the Vcc voltage fed to the EPROM socket pins - either 3.0V, 5.0V or 6.25V, - as needed for different EPROMs in either read or write mode.

The actual voltages produced by REG2 are about 0.7V higher than these nominal voltage figures, to allow for the voltage drop in the associated switching transistors and diodes. This means that the correct voltages are delivered at the ZIF socket pins, when an EPROM is present.

The final rectifier circuit is the voltage doubler using diodes D3 & D4 and 2200μF and 470μF electrolytic capacitors. This produces an unregulated output of about +33V which is used to feed regulator REG3, another LM317 adjustable type.

Regulator REG3 is used to produce the EPROM's Vpp supply line and as before it has resistors switched across the lower resistors of its voltage setting divider, to control its output voltage as needed for different EPROMs. In this case, control signal CF7 is used to switch transistor Q3, which allows the Vpp line voltage to be switched between +21.2V and +12.95V. These values allow for 0.2V drop in the following switching transistors, to give the correct Vpp voltage levels of 21.0V and 12.75V at the ZIF socket pins.

So that's a fairly complete rundown on the circuitry in our new EPROM programmer/reader. Next month, we'll cover construction and software details.

Acknowledgements

Our thanks to Glenn Pure for his suggestions and advice. Thanks also to Bill de Rose at Dick Smith Electronics and Bob Barnes of RCS Design.

Programming & Erasing EPROMs Not too sure about EPROMs and how they work? Basically they're non-volatile memory devices, which means they can store digital data for long periods when no power is applied - until it's intentionally 'erased'. This makes them ideal for storing 'firmware' programs for microcomputers and microcontrollers and also for storing other data like lookup tables, graphics characters and computer BIOS routines. The most common type of EPROM uses a single MOS transistor for each storage cell, with one such cell needed to store every bit (binary digit) of data in the EPROM. So a 256K-bit EPROM will have 262,144 MOS transistor cells - one for each bit. Each transistor cell is very much like a normal depletion-mode MOSFET transistor, except that it contains a second inner gate electrode, separated from the source-drain channel in the silicon chip itself by a very thin (about 10nm) layer of silicon oxide. There's no electrical connection to this gate, which is therefore called a 'floating' gate. Fig.5 shows a single EPROM cell. When an EPROM is manufactured, the floating gate of each cell transistor has no electrical charge and as a result each channel can easily conduct electrons between source and drain. That's why a blank or erased EPROM effectively has a '1' stored in every memory cell. For programming, a higher than normal voltage Vpp is applied to the drains of the transistors for a brief period and a positive '1' voltage is applied to the upper gate of each transistor to be programmed with a '0'. This produces a high field strength in those transistors and a fairly high current pulse flows through the channel. Some of the conduction electrons are sufficiently 'excited' that some of them tunnel up through the thin layer of insulating oxide and reach the floating gate. Once there they cannot easily escape and as a result this gate becomes negatively-charged. When the transistor cell is 'read' with a normal voltage Vcc applied to the drain, the negative charge on the floating gate prevents conduction in the channel - so that cell is now said to be programmed with '0' rather than the original '1'. And since the charge on each floating Fig.5: the basic structure of a single EPROM storage cell. A single MOS transistor is used for each cell, with each cell used to store one bit (ie, one binary digit). Note that there is no connection to Gate1. gate remains there indefinitely, the programming is non-volatile, ie, loss of supply voltage does not lose the data. What about erasing? Well, the most common type of EPROM is housed in a package with a transparent quartz window directly above the chip. This allows the data to be erased by subjecting the EPROM to fairly intense (about 12mW/sq cm) ultraviolet (UV) radiation for about 45-60 minutes. The high energy UV photons then excite the electrons in the floating gates, so they tunnel back through the thin oxide layer and return to the silicon chip. At the end of this erasing operation all floating gates on the chip are left uncharged and every memory cell contains a '1' again. Of course, there are other methods of erasure such as in the EEPROM (electrically erased PROM). Here the erasing is performed on each cell or group of cells separately, by applying a relatively high negative voltage to the upper gates at the same time as the higher positive Vpp voltage is applied to the drains. This creates a high electric field through the floating gate, pushing the captive charge electrons back through the thin oxide layer and into the silicon. This electrical erasure process is much faster than the UV radiation method and can be used to erase just some of the EEPROM's cells, without disturbing the data stored in the remaining cells. 'Flash' EPROMs are similar to EEPROMs but the transistor gate structure is modified to allow easier electrical erasure. This allows the charge to be removed from the floating gates without UV radiation or the application of a relatively high programming/erasing voltage.