Can I read a flash memory IC in-situ - on a working board

[Western]

Wondering if anyone can help me please.


I need to copy a flash memory IC … an AM29F800BT-55SF ... 8 Megabit Top Boot Sector Flash Memory IC … SOIC44 package.


Can I copy one that’s still on its circuit board?


Of course if I power up the board that it’s on … the micro is going to take over … but if I hold the micro in reset … could I then access the flash memory chip maybe?

Or do I allow my programmer to supply the 5 volts for the flash memory ... and still hold the micro in reset.


Do I need to make sure Chip Enable and Output Enable are set perhaps … then read it with my usual programmer?


All the pins on the flash chip also run to an edge connector on the board … so I can access them reasonably easily … though there seems to be no real order to them!


I don’t need to program them in-situ … once I have the data I’ll program them in a proper programmer and solder new ones in … I just need to have legit data to start with.

I can't remove them easily ... they have a conformal coating and my usual way of removing them is to cut the legs off and them hit them with a hammer and screwdriver to break them free of the board. I know, I know ... butchery!!!

 

[Pommie]

It's unlikely that you could read it like that. The micro will probably hold the address, CS and OE lines in a known state during reset to prevent any bus collisions. I can't think of any reason that the manufacturer would add the circuitry to make these tristateable. If you can get a board with a fault elsewhere and remove the processor then you should be able to read it.

Mike.

 

[kubeek]

You can try to keep the processor in reset and carefully check if you can wiggle the data lines. If that fails, you can also remove the processor, or cut the traces to it and then solder them back.

 

[Pommie]

The data lines should be tristate and so "wiggleable". The address lines less likely so.

Mike.

 

[kubeek]

All microcontrollers I have so far encountered have all pins tristated when in reset, so it may not be an issue.

 

[Pommie]

If it's a modern micro then it may not have dedicated data and address lines. If it's designed to always work with external memory then the I/O is likely to be dedicated and address lines not tristate able. Data lines are always tristate able which is why I suggested wiggling the address lines.

Mike.

 

[Western]

It's unlikely that you could read it like that. The micro will probably hold the address, CS and OE lines in a known state during reset to prevent any bus collisions. I can't think of any reason that the manufacturer would add the circuitry to make these tristateable. If you can get a board with a fault elsewhere and remove the processor then you should be able to read it.

Thanks Mike ... you may well be correct ...

... though I understand that in 'Reset' the micro lines are all tri-stated ...

Maybe the CS and OE are kept safe simply with pull-ups or pull-down resistors ... I'll check ...

NOPE ... neither!!!


Mmmm ... the micro is a H8S/2350 ... page 60 of 988 says ..

2.8.2 Reset State: When the RES input goes low all current processing stops and the CPU enters the reset state. The CPU enters the power-on reset state when the NMI pin is high, or the manual reset state when the NMI pin is low. All interrupts are masked in the reset state. Reset exception handling starts when the RES signal changes from low to high.​

That doesn't look so promising.


My comment about micro lines being tri-stated during Reset came from an article I read about hacking flash memories ... but it was an entirely different sort of micro ... so may not apply to others.

 

[Western]

You can try to keep the processor in reset and carefully check if you can wiggle the data lines. If that fails, you can also remove the processor, or cut the traces to it and then solder them back.

I could try that I guess ... at worst I can only blow it up **broken link removed**

I probably should attempt to remove the flash chip ... but then if I stuff it up ... I'll have ruined a good board as well as have a dud ... and still not have the firmware for the next one.

The board is conformal coated and while I did once remove one of them intact (from a 1st generation bd) and got it to read in my eprom programmer ... I still get heart palpitations any time I think of doing it again.


This request is for a 2nd generation board ...


... but I already have a 3rd generation board I need to do as well ... and that uses a S29AL008J70TF101 flash chip … with a 48 pin TSOP package. Smaller legs and finer pitch. I'm not feeling so well.

 

[large_ghostman]

Anyway you can apply some Toluene to the costing where you dont want it? use a cotton bud? Mind where you get it or you wont read any chip numbers again . But get rig of the coating from where you need to desolder etc and you might stand a chance.

Personally i would be brutal and cut power traces to the micro....

Only other suggestion is, can you power it up and try and piggy back it?

 

[Western]

Anyway you can apply some Toluene to the costing where you dont want it? use a cotton bud? Mind where you get it or you wont read any chip numbers again . But get rig of the coating from where you need to desolder etc and you might stand a chance.

I've never used any ... I'll have to see if I can source some.

The biggest issue is that the coating material gets under the chip and sticks like super glue. I can get the coating off the pins and re-tin them ... but to lift them all up off their pads without wrecking some is nigh on impossible.

Then, as I mentioned in another thread ... I have to use a hammer and screwdriver to tap the body off the board.

Maybe the Toluene will soften that bond if I leave it long enough.


I ordered a hot air desoldering system a few weeks ago ... it's on a slow boat from China ... maybe I should wait for that. Then after practising on some sacrificial boards I might be more confident.

Personally i would be brutal and cut power traces to the micro....

Trouble is it's got 120 pins inside 2 square cm ... and half a dozen Vcc pins ... I'd never get them attached again.

I'd probably have better luck just cutting it out altogether ... then when I'm finished ... stitch a new one in.

I have changed a few of them before and they aren't that daunting. Once you decide to change one ... you know there's no going back.

 

[Pommie]

If you can remove the processor then you should have no problem reading the ROM. If you can then manage to fit a new processor then you have a working board and an image file.

Mike.

 

[large_ghostman]

Dichloromethane (DCM) is used in paint stripper, thats another option but dosnt flow like toluene, not cheap but will seep under anything, when its done its thing use the hot ir to evap it off and lift while sticky. DCM sometimes also called methylene chloride is often distilled from paint strippers by home chemists, so i assume that would do it. Be careful with either solvent they are both chlorinated and not things you want to breathe in or get on the skin.

 

[tomizett]

Depends on the coating, but I've had good results with some heat and isopropanol. Some of the coatings that appear hard go jelly-like at 150 degreesC or so (use your hot air station for this once it arrives) and will flake off quite cleanly. Then some isopropanol will soften and clean the residue.
Of course, there's no saying this will work on the coating on your boards.

 

[Western]

Thanks for all the help so far guys ... I may have to concede defeat on my initial plans.

I hadn't fully completed the diagram of the edge connectors to the flash chip ... but now that I have ... I'm more confused than before.

All except for A8 and A17 of the address lines are connected ... but only half of the data lines DQ8 thru to DQ15 are connected.

There is a connection through to the micro RESET pin ... and to pin 70, P6-2/DREQ1

Then there are a couple to the SRAM chip ... see cct

And none to OE or CE ... in fact I couldn't find any direct link with them to the micro either!


DREQ1 is tied up with the on chip DMA Controller (DMAC) and Data Transfer Controller (DTC) ... which enable high speed data transfer without CPU intervention.

I spent an hour or so reading (and half an hour sleeping) in front of the datasheet ... 988 pages!!! ... DMAC came up 599 times in the search CTR/F ... several hundred pages ...

It's obviously a big part of the micro's capabilities ... but I'm none the wiser.


I just got an Aust Post tracking alert email on a parcel due tomorrow ... and I'm hopeful that's my new desoldering station ... so on to Plan B after a decent sleep!

Depends on the coating, but I've had good results with some heat and isopropanol. Some of the coatings that appear hard go jelly-like at 150 degreesC or so (use your hot air station for this once it arrives) and will flake off quite cleanly. Then some isopropanol will soften and clean the residue.

The iron certainly softens this stuff ... so I'm hopeful that you are correct.


Thanks again for all the support.

Edited to provide better images (I hope)

 

[kubeek]

Then I would guess the connector is used for some sort of address space expansion, and you can´t really use it to read the flash.

 

[tomizett]

That shiny colourless coating looks like stuff I've encountered before... try heating it with the hot air and flaking it away with a jewler's screwdriver or similar. After some practice (on some scrap boards!) with the hot air, I reckon you stand a pretty good chance of getting that flash IC off intact. The ones with pins on all 4 sides are harder, as you've no-where to grip and you really do need to get all pins unsoldered simultaneously. With those you can do a bit of heat one side, ease it up, heat the other side, ease it up, etc. You're far more likely to lift a pad off the board then to damage the IC... you can only afford to lift a minuscule amount.
Remember you can buy adapter boards for a lot of surface mount ICs (don't know about that type specifically though) which would make a nice breakout - far easier to deal with than trying to solder fine wires to those pins.
Good luck!

 

[Western]

Thanks for all the encouragement.

I've had a good 10 years experience with conformal coatings in general ... the stuff is a pain in the butt for most repair work ... and 95% of the boards I work on use it!!!

I've developed a whole heap of techniques to deal with it ... particularly a number of home made scrapers and abrasive tools ... but combining them with hot air is new for me.

The desoldering machine arrived this morning .. a Quick 8610W. Couldn't resist playing with it for a couple hours and lifted ICs and all sorts of smds off some wrecked boards.

Of course these were uncoated boards and I was amazed how well it works. Dunno why I waited so long to buy one.

Anyway, I had to try it on the memory chip in question ... but I did spend quite a while cleaning the coating off the pins before I did anything else. In this case it was doubly important because I need the pins to be clean and straight enough to go into an adaptor and connect properly without having to scratch and clean pins once it was off the board. That's when I break pins or spend ages trying to get them all to contact.

Was a bit of an anti climax really ... I had to get it pretty warm ... and keep a bit of pressure under it to break it free. It certainly still was the paint under the chip body that kept it from coming loose easily ... but it came off well.

Went straight into the adaptor and read off the code with no trouble. Now I just need the new chips to see how it goes.


I didn't want to stretch my luck yet by tackling the TSOP48 chip ... I'll try that later. Those pins still look too fragile for me.

 

[Western]

Then I would guess the connector is used for some sort of address space expansion, and you can´t really use it to read the flash.

Yeah, I'm at a loss for what it might be used for. I was sure it was for initial loading of latest firmware for the boards before they were coated.

The crazy part is that I could upgrade the firmware using a stand alone processor that's used as a controller in the dairy ... but it requires the flash chip to have a boot program loaded on it already.

... and if I fit a new blank chip the boot section is not there ... so my processor can't 'see' it.

 

[tomizett]

Really glad you've met with success here!
Hot air was a revelation for me, too, when we got our first hot air station at work. It was only a cheap one, but even that was a world away from not having one at all! it really does open up a whole host of new things you can work on.

Also glad to hear that the IC was simple to read. I don't have much call to do that sort of thing, but so many embedded systems use micros with on-board flash, and you can bet they'll have programmed the lock bits so you can't read them out.

 

[Western]

Really glad you've met with success here!
Hot air was a revelation for me, too, when we got our first hot air station at work. It was only a cheap one, but even that was a world away from not having one at all! it really does open up a whole host of new things you can work on.

Yes, thanks ... me too. I should have bought one years ago ... often looked at them but kept putting it off.


After I read this one I put it on another board I believed had a crook flash chip ... and it didn't fix it ... whaaaaaaatt !!

Anyway, after I spent a while looking for the actual fault ... I gave up and simply swapped the good chip back onto the donor board. I couldn't have done that before.

I'll wait till I get some replacements ... program them ... and then do some more fault finding on this dud.

Also glad to hear that the IC was simple to read. I don't have much call to do that sort of thing, but so many embedded systems use micros with on-board flash, and you can bet they'll have programmed the lock bits so you can't read them out.

I was really surprised when I started this field of equipment, that a lot of them aren't code protected ... even some of the micros.

Most can have the firmware upgraded ... so the code can be seen anyway if you have access to the upgrades.

I got to a stage where any time I saw something new ... and the micro or eprom was socketed ... I'd stick them in a programmer and check if they were protected or not.

I'm not trying to do anything shonky ... it's just so much easier if I have a strange fault and I'm doubtful about the micro or eprom ... I can pull one off the shelf or program one specially ... and try that in my faultfinding.

I've been amazed how many I've checked that weren't protected.


There have been a few where the micro is a common fault and you can't buy them as a spare part ... I've .. ahem .. sent a good one off to china for an 'operation'. Couple weeks later an email comes through with an attachment ... and there's one more type of board that can be fixed. I've changed hundreds of one particular type ... certainly better than throwing away a $700 board for want of a PIC16C57 or now I use PIC16F57. Less than a buck each.

As you can probably tell, most of the gear I fix is pretty old technology ... though a lot of the later equipment is pretty current tech. They are control boards for equipment on dairy farms and because they have so many of a particular board it costs megabucks to replace them all with a later system ... so they prefer to fix them if they can.