BIOS Flasher

(ISA board for reading and writing flash memories)

Zap, bang! Just while updating the flash BIOS you're struck by a power outage. The BIOS file hasn't been completely written, and thus the mainboard is rendered useless – unless you're equipped with the BIOS Flasher, that comes to rescue your board or the firmware in your PABX or other microprocessor-controlled equipment.

Lucky are those who have access to another PC that's equipped with an (E)PROM burner which also manages flash chips. If not, the PC owner is left with few choices: Firstly s/he could order a new BIOS chip via their PC shop or the mainboard manufacturer's support, which might work with current mainboards, but that's a hapless approach with older ones. Secondly s/he could take the expensive option and buy a new mainboard. However, costly updates of RAM and processor might be the consequence of this.

And just few readers will experience the favorable third case: To know a dealer or friend who owns the above mentioned PROM writer. The BIOS Flasher is intended to bea cheap relief of such misery. Although this small ISA board still requires access to another working PC with a free ISA slot, the latter might still be easier to find among your friends or at a complaisant dealer than the aforementioned special lab hardware. By the way: If the above scenario happens only rarely at your site, you might be better off by making use of a commercial chip-programming service...

Current flash chips do help the flash tool programmer tremendously compared to EPROMs: A so called State Machine handles internal operations which require a specific timing autonomously. In order to tell that state machine what to do, the programming software issues a series of write-accesses to specific memory locations. At first the flash chip doesn't view those accesses as data to be stored, but keeps watching what's happening on it's data and address busses. Only after recognizing special commando sequences it acts accordingly. Atmel chips for instance may be switched into identification mode by issuing this write sequence:

[$5555]:=$AA;
[$2AAA]:=$55;
[$5555]:=$90;

After this sequence successive read accesses to location zero retrieve the manufacturer ID ($1F with Atmel), and reads from address one give the chip type (e. g. $D5 for the AT29C010A). Similar sequences initialize the erase of single memory blocks or of the whole chip, enable a write protection or switch between programming and data mode. These sequences may differ between manufacturers and even between different chip series from the same manufacturer. Some flash types also require specific pauses between commandos or commando segments. A write tool programmer will have to dig into the manufacturer's data sheets and application notes for every flash type that shall be programmed.

Placement: When inserting the PCB into an ISA slot observe the correct orientation! The arrow labeled Rückwand must point to the back of the PC.

Since the traditional memory and I/O space of the PC architecture is quite limited, the BIOS Flasher uses only 11 address bits of the memory bus directly. With these it accesses the flash chip via a 2 Kbyte sized memory window. Three jumpers (J1...3) allow to select one of six possible locations in the PC memory space.

+ means: jumper set, - stands for: open.

These adresses are some suggestions. Choose whatever is free in your programmer PC, but please pay attention: Observe the imprint A8...A2 on the component side of the PCB since not all DIP switches are made alike.

But the primary function of this I/O port is to deliver the upper eight address bits via a register  to the flash chip. This allows to program flash memories with a maximum of 19 address bits – hence 512 KBytes with 8-bit-chips. A LED indicates ongoing activity. Since some flash types require an auxiliary voltage of +12V for identification or writing, two jumpers switch two pins between the address lines A18 (pin 1 of IC1, J5) and A17 (pin 30 of IC1, J4) versus +12V. The default position for these jumpers is to be set on the address bits (not +12V side).

Because the BIOS Flasher's PCB is a simple 8 bit ISA board without a slot bracket, there's danger of inserting it the wrong way! Arrows marked Rückwand on the component and solder side indicate how to plug it in correctly, those arrows must point to the back of the PC in order to avoid 'bus stops'.

Imprinting

Reading and writing data is the job of the DOS tool ctflash. Three mandatory command line parameters tell it what to do:

ctflash IO R/W filename [/m] [/n|e]

The first parameter is the chosen I/O address in hexadecimal format. The following character tells if data shall be 'r'ead from or 'w'ritten into the flash chip. Lastly comes the complete filename for the binary data file, which will be written into the chip or will receive the read data. Since ctflash.exe only works on binary data, files of different format, e. g. Intel Hex or Motorola S-Rec, first have to be converted with an appropriate tool. Such could be found on Amrel's site at the time of the BIOS Flashers conception, but since then that useful fconv.exe has been pulled. Fortunately one satisfied user of the BIOS Flasher saved it for now, but should this link vanish in the future, just try digging the Web with any good (ftp) search engine.

After invocation ctflash tries to identify the flash type automatically. If this doesn't work, it offers to select the manufacturer and chip type manually – the optional parameter /m forces manual selection. Further the program checks if the capacity of the chip and the binary file size match. If the chip is too small, ctflash aborts. If it's larger than the file, the program offers to fill the remainder with $FF. Should ctflash not be able to read a plausible address for the 2-K-memory-window from the given I/O address, it declares so.

The next step will be the complete erasure of the chip: Many flash ICs offer command sequences to do this in whole (Chip Erase, e. g. with AMD, Atmel, SST, Winbond), while others prefer it sector-wise (e. g. Intel). Sometimes ctflash isn't able to erase the chip and tells so. In that case don't throw away the chip instantly, but try again with the same parameters two or three times. Probably the flash IC gets 'reanimated' that way.

After successful erasure the tool starts to write data into the flash chip. Some types accept data byte-wise (like AMD or Intel), whereas others want to be fed so called pages of 128 or 256 bytes at a time (Atmel, SST, Winbond). After writing of each byte or page ctflash has to wait some hundred microseconds up to a few milliseconds, while the chip transfers the data from it's internal buffer into the memory matrix. Possible time-outs due to aging of the chip or approaching the maximum number of write cycles get announced properly.

Finally ctflash verifies that all data have been written correctly. If it doesn't find discrepancies the flash chip is ready to run again.

Post scriptum

Some notes regarding the PC to use for flashing chips with the BIOS Flasher: An old 286 will do, but the board and software also work on more up-to-date equipment. I regularly test new versions of ctflash.exe on a P-III-800. Start the machine into plain and pure DOS without memory managers like HIMEM.SYS or EMM386.EXE, since ctflash needs direct access to memory and I/O. It will definitely not work reliably in a Windows or OS/2 DOS box, under a DOS emulator/shell of Linux (DOSEMU, Wine, VMware) or the like, since some flash types require a strict timing while writing data page-wise.

Although ctflash can't program EPROMs or OTPROMs, at least you may read their contents – as long as those chips come in a 32 pin DIL/DIP package and conform to the JEDEC pinout. In that case ctflash will always offer manual selection of which capacity shall be read, since it can't identify such chips automatically.

It is possible to use a Textool or ZIF socket for easy insertion of the chip to be programmed, I even advise to spend the extra dollars for such a socket if you happen to use the BIOS Flasher frequently. But please refrain from using a flat ribbon cable to locate this socket outside the PC. Many signals on the flash chip are connected directly to the ISA bus, and this works at 8 MHz clock, which is 'high frequency region' already. Due to the extra cable capacitance, increased crosscoupling between bus signals may occur and your system may get unstable. Such an extension also is an overlength stub that will produce signal reflections which in turn may disturb the data on the bus.

Further common questions get answered in the Flasher-FAQ.

The first version of ctflash.exe came out at the end of 1997. The program displays a short help screen as well as a list of currently supported devices when invoked without command line parameters. please download the software here.

http://www.rebios.net
http://rebios.51.net
E-mail:BIOS@sina.com