With A Cherry On The Side – Episode Two (How to run code from non-existent ROM)

[A Project to interface a PS/2 keyboard to a 68hc11 microcontroller]

The Case of the Unmissing PROM

Last time, I mentioned that there was something a bit unusual about my 68HC11E1 MCU, running the BUFFALO monitor program from on-chip PROM.

Well, the issue is that the E1 model 68HC11 isn’t supposed to have any on-chip PROM!

Motorola/Freescale/NXP, Toshiba and Tekmos produced a wide range of 68hc11 MCUs, with differing amounts/configurations of on-chip RAM, on-chip EEPROM, on-chip (U/V-erasable) EPROM, on-chip (one-time-programmable) OTPROM, and so on.

The 68HC11 E0, E1, E8, E9 MPUs used the same mask-set – ie: the same die. All have 512 bytes of on-chip RAM. The 68HC11E0 has no EPROM or OTPROM, and no EEPROM; the 68HC11E1 has 512 bytes of EEPROM @ address B600, but no EPROM or OTPROM; the 68HC11E8 has no EEPROM or EPROM but does include 12Kb of OTPROM @ address D000, the 68HC811E8 has no EEPROM or OTPROM but does include 12Kb of EPROM, the 68HC11E9 has OTPROM and EEPROM but no EPROM, and the 68HC711E9 has EPROM and EEPROM, but no OTPROM.

Confused yet?

And all these MCUs use the exact same die, how can this be?

The Subterfuge

Well, the die really includes:

  • 512 bytes of RAM
  • 12Kb of EPROM
  • 512 bytes of bulk EEPROM
  • an 8-bit EEPROM “config register”

The first part of the subterfuge is the on-chip 8-bit non-volatile EEPROM-based “config register” that can selectively disable the (bulk) EEPROM array and/or the EPROM array. Completely disable, as in electrically isolate and remove from the memory-map.

This explains the difference between the presence or lack of EEPROM, and also
between the presence or absence of EPROM. Bear in mind that this “config register” is programmable in software, in-circuit, without the need for any additional external voltage…

The second part of the subterfuge is in the packaging: the parts marketed as “EPROM” MCUs actually have a transparent window to enable the EPROM array to be bulk-erased by U/V light ie: to behave as conventional EPROM. The parts marketed as “OTPROM” MCUs do not have that window, the package is opaque, thus making the internal EPROM array behave as one-time-programmable PROM that cannot be erased!

And the final wrinkle: back in the day, you could order 68HC11E parts from Motorola pre-equipped with what Motorola called “customer-specified Mask ROM”: you provided them with a custom ROM image in hex-record format, and they would deliver (windowless) 68HC11E parts with your custom code in on-chip “Mask ROM” – even though it was not a custom die mask at all – it was really just the standard MCU in an opaque package with the EPROM array factory-pre-programmed with the customer code.

In the earlier 68HC11 “A” series (1985), which also all used the same die as each other, Motorola “best-binned” the dies, and those that failed high-temp EEPROM testing had the config register factory-pre-programmed in software to disable the EEPROM; and similarly for those that failed high-temp EPROM tests; thus giving rise to the range of different options.

By the time the second-generation “E” series were in production, the yields on full-working tested dies were much better. So much better that many notionally EPROM-less parts were 100% fine but were programmed in software to disable the EPROM so they could be sold as the desired model. This was Motorola beating Intel to the Celeron Manuoever (“disabling” parts of fully-working dies) by 10 years, although many chip manufacturers even at this earlier time were also doing something at least vaguely similar.

The same SKU subterfuge was also inherited by many later 68HC11 model-families.
To be fair, Motorola never really hid this manouever, it’s spelled out in the reference manuals and app-notes if you look hard enough, but neither did they shout it from the rooftops.

Ding Dong!

Given that the non-volatile config register can be re-programmed by software in-circuit, you might have guessed by now that a 68HC11E1 (no OTPROM) can be easily reconfigured to reenable the OTPROM (turning it into a 68HC11E9) – just by running a tiny assembly-code program downloaded through the on-chip serial-port. In fact, Motorola published guides showing how to do so, although not titled in quite such a blunt manner!

And this is exactly what has been done to my 68HC11E1 MCU – it is now functionally a 68HC11E9 with the BUFFALO Monitor programmed into the high 8K of the on-chip 12K OTPROM.


Whilst we are on the subject of the large variety of 68HC11 models, and all their sub-variants, I guess it is time to confess: for the last year, on and off, I have been working on a Canonical 68HC11 Comparison Table (including even the rare and oddball models), which is now in a publishable state, at http://shelldozer.im/68hc11/6811taxonomy.pdf

Next time, we’ll cover the beginning of work on the actual project I’m supposed to be describing!


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s