It all started when I bought a late-1990s synthesizer that needed a firmware upgrade. One could simply pull the ROM chip, ship it off to Yamaha for a free replacement, and swap in the new one — in 2003. Lacking a time machine, a sensible option is to buy a pre-programmed aftermarket EPROM on eBay for $10, and if you just want a single pre-flashed EPROM that’s probably the right way to go. But I wanted an adventure.
Spoiler alert: I did manage to flash a few EPROMs and the RM1X is happily running OS 1.13 and pumping out the jams. That’s not the adventure. The adventure is trying to erase UV-erasable EPROMS.
And that’s how I ended up with a small cardboard fire and a scorched tanning lamp, and why I bought a $5 LED, and why I left EPROMs out in the sun for four days. And why, in the end, I gave up and ordered a $15 EPROM eraser from China. Along the way, I learned a ton about old-school UV-erasable EPROMs, and now I have a stack of obsolete silicon that’s looking for a new project like a hammer looks for a nail — just as soon as that UV eraser arrives in the mail.
Flash from the Past: UV EPROMs
Old-school EPROMs are made by laying out a bunch of field-effect transistors (FETs) in an IC. In read mode, a gate voltage is applied to each transistor, and whether it conducts or not determines if the bit of data stored there is a one or a zero. The gimmick is that an additional metal layer — the floating gate — is interposed between the FET’s channel and the gate. Putting a negative charge on this floating middle layer will raise the voltage required to turn the transistor on from the outside. A bit of info can thus be stored in the physical form of excess electrons on the floating gate.
In a UV EPROM, the floating gate is insulated all around by an oxide layer, so it retains this negative charge essentially indefinitely. You get extra electrons onto the floating gate through “hot-electron injection”: applying enough voltage across the floating gate that electrons jump through the insulating layer. When reading the data, transistors that have a negatively charged gate won’t conduct at their normal gate voltage, while those that haven’t been programmed will. Easy peasy.
But then how do you get rid of the excess floating-gate electrons in order to blank an EPROM? The original method proposed to erase ceramic-encased EPROMs was to use X-rays in a 600° C oven, but cooler heads prevailed and chipmakers instead installed a relatively expensive crystal window that’s UV permeable, allowing longer wavelengths of carcinogenic light to coax the electrons back into the substrate. Apparently, in the 1970’s hard-UV lamps were commonly used for their germicidal effects in barbershops and the like, so having a UV-erasable EPROM was convenient. My own attempts to clear UV EPROMs have been anything but.
How Not To Clear an EPROM
I ordered a ten-pack of used (!) 27C160 UV EPROMs online and was a bit surprised when only three of the ten arrived with the memory cleared. Unless I could figure out how to blank a UV EPROM, I would only have three chances to flash my synth’s EPROM. And since I had a ROM dump with 16-bit words of unknown endianness, there was a 50% chance that I’d need to try twice. This left me with only one EPROM to use in developing an EPROM programmer. So I decided to see if I could erase them to provide myself with a safety net.
I have read, in these very pages, tales of success erasing UV EPROMs with a UV LED and by harnessing the power of the sun. My EPROM’s datasheet specifies “wavelengths shorter than 400 nm” and recommends “30 to 40 minutes using an UV lamp with 12 mW / cm2 power rating.” It also suggests that approximately one week of exposure to direct sunlight would suffice. So these Hackaday stories sound plausible on the surface.
Maybe November sunlight in southern Germany doesn’t pack the same UV punch of full summer in southern California or wherever the datasheet was written, but the two chips that I left out on our balcony displayed exactly the same data after a week of exposure as they did beforehand. Not a single bit flipped, and there were four fully sunny days. Maybe it was the cold? I asked around Hackaday HQ, and Jenny said she’d tried once and it took three weeks or more over an English summer. This was clearly not the quick way to go.
So I tried a random UV LED from my junkbox, and got nothing. True UV LEDs are difficult and expensive to make, and this one was very visibly blue. So while it was failing to erase an EPROM on my desk, I mail-ordered something that stood a better chance of doing the trick: a $5 375 nm Nichia UV diode. It’s a 6 mW device at 375 nm, instead of the instead of 12 mW at 254 nm mercury line that germicidal bulbs use, but it was the shortest wavelength I could get for a reasonable amount of money, and the datasheet says “under 400 nm”, right?
Well, kinda right. The good news is that bits were flipped. After 24 hours, some 10,000 bits read out as ones that had previously read as zero. The bad news is that there’s a big difference between an EPROM that has flipped a few thousand bits, resulting in corrupted data, and one that’s lost all 2,097,152 bits and is a clean slate.
From datasheets, the exposure curve is supposed to be S-shaped: a first very few bits flip, then most do, and then after a while the last reluctant bits give in. With the promise of this avalanche of ones, I left the LED running at 15 mA, the rated current, for four days. Each time I checked up on the chip, it made progress, but it was slow progress. Compared with a promised 40 minutes in a proper UV eraser, this was taking far too long. It’s also possible that these used chips are somewhat worn out and will require a little more persuasion anyway.
And Then I Set Things On Fire
And then it struck me! My mother-in-law stashed her old tanning lamp in our basement about seven years ago, where it’s been taking up space and collecting sawdust ever since. Tanning lamps run on the same mercury UV bulbs used in the germicidal lamps, but they spread the UV out over a much wider area — a human body. If I could get an EPROM up close enough to the bulb, though, it just might work. So I grabbed some cardboard to use as backing, taped an EPROM directly to the lamp, and fired it up.
I have since learned that tanning lamps also have a large IR heating element to simulate the warming effect of the sun. Taping cardboard to the sun is not recommended. After five minutes, my wife asked me what smelled like smoke, and I started running downstairs. When I arrived, there was a hot broken EPROM on the floor, and she was stomping out the cardboard fire. Dramatic! We aired out the house, and I placed an order for one of the $15 import EPROM erasers that evening.
Not to be beaten, I also fabricated a frame from aluminum that could hold an EPROM against the tanning lamp’s shield, but after three 30-minute sessions not a single bit was flipped. The UV in a tanning lamp is probably either filtered or defocused enough that it’s safer for human skin and not suitable for clearing EPROMs. Anyway, it’s not putting out the 12 mW / cm2 that I need. So the cancer machine in my basement continues to be an albatross around my neck.
Programming EPROMs is Refreshingly Easy
I embarked on this EPROM-clearing journey because I only had three blanks out of ten ordered from eBay. Luckily for me, programming them turns out to be as easy as reading the datasheet and following the instructions. Basically, you’ll need a source of oddball voltages for programming the EPROM: 12 V for the hot-electron injection, and 6.5 V to provide a little margin during verification — if the FET won’t open at 6.5 V, it surely won’t open with the nominal 5 V operating voltage on the gate. Finally, you need a way to set up the chip’s address and data pins, but this is no big deal if you’re handy with a microcontroller.
My old synthesizer used 27C160 EPROMs, one of the last types of chips to be made before EEPROM, with an extra “E” for “electrically erasable” memories took over. As such, the 27C160 can store a still-impressive 2 MB, addressed as 1,048,576 16-bit words. This means that it has 16 output pins and 20 address pins, plus two more that need to be strobed to flash and verify the data respectively. That’s a lot of GPIO!
I have a few budget black STM32F407 breakout boards that I use for high-GPIO-count projects because it has three ports of 16-pins each that are essentially free for use and that means that I didn’t have to think hard about where the bits go or hook up shift registers. EPROMs are designed for old-school TTL logic levels, so you can even use a 3.3 V microcontroller without level shifters!
The firmware I used was equally simple, just reading in a value over the serial line while counting up the addresses and setting it up on the GPIO pins. Toggling the verify pin makes sure that the intended value “took”. I love writing up simple projects like this in Forth, because I can write and debug the code interactively and then automate things by sending the same text commands over the serial line from my laptop, where I can script up the hard stuff in Python. So the laptop-side code sends something like 12345 000000 program over serial, and the Forth system automatically returns an “ok.” when it has programmed and verified that word. Each word took just about 15 milliseconds, which doesn’t sound bad until you multiply it by a million and get something like 4.5 hours. Oh well, I was just going to program one. Or two, if I messed up.
It’s ugly, but if you want to take a gander it’s up on GitHub. It’s easy.
In the end, I managed to code and verify my programmer firmware using only a single chip, which left two more blank EPROMs to burn one ROM image. Of course, Muphry’s Law struck, and the OS ROM data I found on the Internet was stored big-endian, and I had initially guessed at little-endian, so I got to burn the last blank EPROM that I had left.
Hammer Seeks Nail
EPROMs are appealing in their simplicity. Unlike a modern, two-E, EEPROM there’s no protocol of any sort here. Simply impose voltages for an address on the pins and a decoder sets sixteen FET gates, and some of these tiny FETs open while others don’t. All of it happens within a few tens of nanoseconds. Any pattern of 20 bits can be mapped to any pattern of 16. That’s memory!
Now what am I going to do with the remaining EPROMs once the UV eraser arrives? Their longevity and moderate obscurity might make one a good place to store secret key material. Maybe I’ll stash an EPROM with my GPG key in the safe deposit box along with the paper printout? Or use them as secret decoder rings for über-retro-nerds? Or maybe fetch some old, and historically accurate, drum machine samples and burn them in to recreate a LinnDrum? Hook up a ladder-DAC and build a 16-bit resolution arbitrary waveform generator? Sixteen outputs suggests a sixteen-segment display lookup table to me, but with a 20-bit address space I’d have room for every possible glyph 16 times over. That seems ridiculous.
What would you do with a small pile of EPROMs? And how would you erase them?
[Epilogue: The $15 UV eraser arrived, and did exactly what it should, in 15 minutes, and nothing caught on fire.]
No comments:
Post a Comment