Turning a Top2005 EPROM Programmer into a Desktop Test Bench

Phase I – Circuit Analysis

We apologize in advance that we DO NOT intend to release schematics of the programmer.   Ours are messy hand-drawn partial notebook pages and really not interesting enough to redraw.   Email us directly if you blew up your unit and need some partial schematic in order to figure out how to fix it.   Frankly, the Top2005 is already a clone of a clone, so if you really want to pirate the device you can probably just buy the PCB artwork from one of many grey market clone manufacturers.

But alas!   The world doesn’t need another low-cost programmer, it need a low-cost test bench so let’s get to it!   We’ll first take a peek under the hood, and then discuss how the internal subsystems work together to do funky things to IC’s.

Annotated photograph of Top2005 internals

Fig 2 – Annotated pic of the Top2005′s guts

Starting from the right side, you see the obvious USB connector which supplies power and data to the board.   Those nice big electrolytic capacitors are why you may get a momentary USB current overload warning when plugging into a PC – nice work, whoever the joker was that thought that was OK to ship with!

PDIUSB12.   The USB input/output is controlled by a Philips PDIUSB12 highlighted in the above picture with light green.   This very simple USB device acts as a memory-mapped peripheral to the 8051, accessed when the nCE line is low. The 8051 reads and writes the device using the standard 8-bit bus.
Data sent from the PC triggers an interrupt on the 8051, and receiving data from the Top to the PCB is basically just a blind read of the little data buffer on the PDIUSB.   It’s up to the 8051 (and some associated commands) to fill that buffer with important data.   You may note that the buffer is static, so even if you only want a few bytes you’re going to get the whole 64-byte buffer with most of it filled with old data from previous operations.   Keep it in mind when writing client tools.

The PDIUSB12 also outputs a 24MHz clock that is frequency multiplied from it’s own 6MHz crystal.   This 24MHz clock is used as the system clock for the 8051 and FPGA.

8051.   The brains of the operation is a somewhat unremarkable SyncMos SM8952A 8051 clone highlighted in orange.   The 8051 controls an 8-bit address/data bus that is shared between the PDIUSB, 8051, CPLD, and FPGA.   We will call this bus TOPBUS.   The 8051 also has a side-task of controlling which ZIF pins are driven to the adjustable VCC supply, VCCx.   There is no way to update it’s firmware without pulling it from the board, so we are stuck with it’s rather silly role as a “command interpreter”.

What that means is that the 8051 will receive a USB command such as “set VPP to 12v”, and will turn around and make the proper bus accesses to stuff the data corresponding to the desired function into the proper register in the CPLD or FPGA.   So a lot of the internal architecture (register map) is hidden from the user, which is kind of lame.   We’d much rather send address/data pairs and have them interpreted literally, but this scheme seems to be used in order to allow the same client software to control several varieties of EPROM programmers.   Shoulda made the software nicer then, fellas!

CPLD – A Xilinx XC9536 (highlighted in dark blue) is used for housekeeping functions as well as to control which ZIF pins are used as GND pins.   Again, it’s programming can’t be changed (no JTAG connection) so it’s relegated to the task for which it was designed.   In addition to the GND control, the CPLD is used to adjust the programming voltage VPP and the variable supply voltage VCCx.   It only uses a 4-bit (low nibble) connection to TOPBUS, so you may see the 8051 fire two consecutive writes when attempting to modify byte-wide stuff like the GND control registers.   It responds to internal addresses less than $10.

FPGA – An old Xilinx SpartanXL (XCS05XL) FPGA is mainly used to write/read data to all 40 pins of the ZIF socket.   It’s side task is to control some high-voltage drivers to apply VPP to various pins of the ZIF socket.   The bistream for the FPGA is loaded over USB by the client software when you select the device to be programmed, and can be reloaded to something new at any time.   Of course, it’s also possible to write and load our own bitstreams so we can do all sorts of neat things to the chip using programmable logic.   We’ll give you some sample Verilog templates to get you started on that stuff later in the article..

The logic read/write to the ZIF is implemented as open-drain logic with external pullups to VCCx on each pin of the ZIF socket.   Write a 0 to the FPGA to pull the pin low (which will then read a 0), or write a 1 to let the pin float high externally.   The IC under test can now pull that pin low in order for the FPGA to read a logic 0, else the FPGA reads the 1 that remains on that pin.   Standard open-drain stuff you’ve probably seen in PIC and other MCU’s.   When reading the pins, you always read the state of all pins but you must realize that the VCC and GND pins will always read back 1 and 0 so there is no use in trying to drive them to the other state.   The pins are protected and we do it all the time, but we have to take a moment to say that it’s a bad practice in general.
As we mentioned on another site, this FPGA runs on 3.5v but it’s pins may touch ZIF pins that are either driven to 5v, or even 25v in the case of VPP!   Those pins have series 510 Ohm resistors to keep the FPGA from blowing up, but this is not a good design technique at all.   Please don’t ever do something like this, as it will probably damage the FPGA in the long run and cause customer returns.   You can avoid those returns and complaints by continually changing the manufacturer name to some obscure Chinese combination of happy, powerful, and perhaps the name of a fruit or something.

Boost Converter.   At the top highlighted in light blue is a step-up (boost) DC-DC converter (MC34063) used to generate an adjustable HV programming voltage that we’ll call VPP.   There’s a test point for VPP on the board so it’s easy to send different commands and watch VPP change.   The black shrink-wrapped “barrel” looking guy next to the chip is the inductor for the boost converter.

The output voltage for the boost is controlled by the CPLD using 5 resistors and open-drain logic to implement a cheesy DAC-type control of the feedback resistor divider.   By turning on various pulldowns on the bottom resistors, you can change the resistor divider ratio from the output to the boost’s comparator input to adjust the regulation point from 9v to about 25v.   However, the selection of output voltages is not continuous – you have your choice of: 5v (off), 9.4v, 10v, 10.4v, 11v, 12v, 12.6v, 13v, 13.7v, 14.8v, 16.4v, 21.1v, and 25.6v.

VCCx, VPP, and GND control (to Major Tom).   All controlled with bjt transistors.   CPLD drives a bunch of NPN’s to pull various ZIF pins to GND.   The 8051 uses some spare ports to drive some PNP’s to apply the adjustable VCCx to other ZIF pins.   And the FPGA drives some HV open-collector drivers to even more PNP’s to apply the adjustable VPP to various ZIF pins.

The bjt’s are simple, cheap 3904/3906′s in SOT23 package which are easy to replace if you happen to blow one up.   In the pic above, the devices nearest the CPLD are the VCCx control, followed by the VPP control just to the left of that.   And north of the ZIF socket are the GND devices and a few other VPP controllers all the way on the top left.   As a side note, ZIF pin 40′s VPP uses a 6v series zener to drop the voltage down to the 6.5v level.

It may sound like a tangled web, but once you organize the signals with respect to the ZIF socket it becomes much easier to understand.   After the next section, we’ll supply you an easy-to-use cheat sheet that tells you what to do in order to modify which pin.

Continue to Next Page

This entry was posted in Hacks, Projects. Bookmark the permalink.

33 Responses to "Turning a Top2005 EPROM Programmer into a Desktop Test Bench"

Leave a reply