Allpro 88 Programming --------------------- V1.00 K.Horton 100912 TODO: investigate how the slew control stuff works. Adjust the voltages read at the pins because of Vdrop of the diodes on the hybrids. --- The Allpro 88 is a fairly nice, if somewhat antiquated DAC per pin programmer designed and sold by Logical Devices. "DAC per pin" means there is literally an 8 bit DAC for every single pin that the programmer can drive. That means each pin can be set to any arbitrary voltage between 0V and 25V or thereabouts. This flexiblity allows it to program almost any device. This programmer came in various models, each supporting a different number of pins. All of these programmers are identical, except each has a different number of pin driver boards installed. There are 5 sizes of programmer, apparently, as indicated by a sticker with a hole punched in it on the back of the unit: 24 pins 32 pins 48 pins 68 pins 88 pins It seems to have been introduced in 1990 or thereabouts, with a $2995 price tag. I am unsure if this is the "fully loaded" 88 pin model or a smaller one. You can upgrade the programmer by simply plugging in the extra boards, and I suspect Logical Devices offered kits to do this. There seems to be a variety of socket boards that were sold, but I have only seen two different but similar versions. These socket boards connect to the programmer via two 96 pin DIN connectors. They plug in and unplug fairly easily. The first version I have has no less than 8 sockets on the front: 48 pin ZIF (will socket .3" to .6" chips of any number of pins, up to 48) 20 pin PLCC 28 pin PLCC 32 pin PLCC 44 pin PLCC 52 pin PLCC 68 pin PLCC 84 pin PLCC The second version is identical, except the 84 pin socket is missing. The PCB inside is identical, just with a missing socket. There appears to be a 48 pin ZIF only socket board, and there are some special adapters for programming 1702 EPROMs and another special EPROM, because both of them need 40V to program, which is higher than the programmer can supply. Fortunately it looks easy to construct your own custom socket boards for it by making a PCB with the required two 96 pin DIN connectors. I will be making a few socket boards most likely for dumping SOICs and TSOPs and other more modern devices. That's all the on-programmer fun stuff. The final bit is how it connects to your computer. There's a very long (7 foot, 2.1 meter) cable that connects between the programmer and an ISA card that goes into your computer. This cable is simply a dsub 37 pin male to dsub 37 pin male connector joined by some ribbon cable. Unfortunately, the PC expansion card is *ALWAYS* missing if you try to buy one of these programmers from Ebay or similar. Fortunately for us, and the whole point of this document, is making my OWN damn interface for this programmer to allow it to be used for dumping or programming chips. The hardware seems to be more than capable of dumping or programming nearly any chips I would have the desire to work with. ------------------------------------------------- Pin IO So that's the background of this programmer. What can it DO to the poor device we happen to place into the socket? Well there's 10 basic things it can do: * nothing (pin is connected to ground through a 15K resistor) * ground (pin is pulled hard to ground through a heavy duty FET) * pin DAC voltage (pin is connected to a DAC , which can supply 0-25V at 1A) * test voltage (pin is connected to a voltage and current regulated supply) * pullup (pin is connected to a voltage regulated supply via a 2.7K resistor) * pulldown (pin is connected to ground via a 5.4K resistor) * logic low * logic high * positive clock (see clock section) * negative clock (see clock section) Ground: ------- This simply connects the pin to ground via a IRFD020 N channel FET. It provides a nice low impedance path to ground. DAC voltage: ------------ The DAC voltage is settable per pin, so that means there are 88 pin DACs present on the programmer for this, one per pin. It can supply up to 1A to the device, which should be adequate for nearly anything. The voltage is variable between 0V and 25V or thereabouts. The DACs are 8 bits each, and have the following voltage characteristics: Vout = (((5.1*input)/256) * 5.1) - 1.1 There's basically a pass transistor (-0.7V) and then a shottky diode (-0.3V) in series to generate the output voltage. This gives a range of approximately 0-25V, for the input codes 00-ffh. The DACs are double buffered, and each can be loaded separately, but then the outputs all updated simultaniously. There is no way to individually update the DACs- they must all be updated at once. test voltage: ------------- The test voltage works similar to the DAC voltage, but its range is between 0.4 and 27V. The current setting interacts somewhat with the voltage setting. Maximum current is 0-255ma in 1ma steps. I suspect this supply is not to power the device, but rather to test it to see if it is installed in the socket correctly. To test if say, an EPROM is installed in the socket correctly, just set current to some nominal value that the EPROM would draw in its quescent state (say, 50ma) then measure the voltage at the VCC pin using the pin threshold setting to see if VCC dipped below say, 4V. If it did, the EPROM is probably in the socket backwards (or it may not be an EPROM at all). Pullup: ------- As the name implies, the pin will be pulled up via a 2.7K resistor to a set voltage. This pullup voltage is the same for all pins, and is settable via another DAC. It can range from -0.5V-25V. The PNP transistor will never pass the negative voltage, so its effective range is 0-25V. Pulldown: --------- Simply a 5.4K resistor that can be connected to ground when enabled. Logic high: ----------- Connects to 5V through a shottky diode and a 10 ohm resistor. Logic Low: ---------- Connects to ground through a 50 ohm resistor. Clocking: --------- It's possible to connect the pin to either a true or inverted version of a clock signal. This clock is one of the following: 4MHz 2MHz 1MHz 500KHz 250KHz low (logic low, no clocking) high (logic high, no clocking) nothing (neither high nor low- the pin is effectively not driven at all) This must be for programming microcontrollers such as the 68705's that need a clock to operate during programming. The clock signals use the logic high/low circuitry to drive the pins. Either a true or complement version can be selected, in case a chip needs both phases of a 250KHz clock, for example. If multiple pins need to be toggled at the exact same time, this can be used for that also, since all pins update simultaniously when the clock settings are changed. If a bunch of pins need to toggle between open and high, or low this can be used for that as well. Pin reading: ------------ Each pin is connected to a voltage comparator. This allows the programmer to set a voltage threshold nearly anywhere, to accomodate 3.3V logic, or 12V logic, or anything in between. It allows for testing margin by sweeping the pin voltage threshold DAC and seeing where the level changes. Normally, the pin threshold is set and then used simply to produce the usual high/low logic level determination. The threshold voltage is the same for all 88 pins and is DAC settable. It can vary in voltage from 0V to 25V. ------------------------------------------------- Power Supplies The power supply flow inside the programmer is arranged like so: +------------------------> VADJ 88 pin DAC pass transistors | | +-------------+ *---->| op-amp | ---> VPIN adjustable pin threshold voltage | +-------------+ | ^ | V dac | +-------------+ *---->|pullup supply| ----> VPUL adjustable pullup supply | +-------------+ | ^ | V dac | | +-------------+ *---->| test supply | ----> VTST voltage/current adjustable supply | +-------------+ | ^ ^ | V dac I dac +---------------------------------------------------------------------+ | +-------------+ (22.6VAC) +----------+ (+34.5V) +--------+ | 120VAC -> | transformer | ------> | UNREG PS | ------> | ADJ PS | -+ +-------------+ | | (+30V) +--------+ | | --+ ^ +----------+ | V dac | | +--------------------------------------------------+ | | +---------+ (+5V) *--->| 5V PS | ----> logic | | | (-8.5V) +--------+ (-5V) | | | --------*-----> | 7905 | ----> DAC VSS | +---------+ | +--------+ | | | | +-------+ (-5.1V) | +-------| LM337 | ----> DAC Vref | +-------+ | | +---------+ (+12V) +--->| 7812 | --*----> VCC of DACs +---------+ | | | +-------+ (+5V) *-----| 78L05 | ----> logic high level (1 per pin board) | +-------+ | | +-------+ (+5.1V) +-----| LM317 | ----> PM7226 DAC Vref (2x) +-------+ As can be seen from the above diagram, the power flow in the programmer is somewhat complicated. The power first is run through a transformer and bridge rectifier and filter capacitors to produce approximately 30VDC. This 30VDC is then boosted up to 34.5V with a flyback converter, and both exit the "UNREG PS" board. The 30VDC unregulated power is used by the 5V power supply and -8.5V supply. The "5V PS" board contains both regulators, which are switch mode converters. That 30VDC unregulated voltage is used by a 7812 on the "ANALOG 1" board that powers the DACs' VCC pins and is used to generate the Vrefs for the two PM7226 quad DAC chips. The 34.5VDC coming off the UNREG PS board is only fed into the ADJ PS board which is a buck regulator that generates the power used to run most of the analog system. The output voltage is adjustable via a DAC, and this output is then fed to all 88 pin drivers to be used by the DACs on same, and is used to derive the pullup, VCC, and pin threshold voltages. There's some other minor voltages used to run the guts of the programmer. The buck regulator on the ADJ PS supply is interesting to me. It makes a lot of sense to buck down the 34.5V to something lower before feeding it into the pin drivers, because this will greatly reduce the losses in the pin driver pass transistors, which are basically a computer controlled linear power supply. To read back an EPROM that runs on 5V, the following is probably a decent way to do it. First, set the VADJ voltage to around 9V or so. Next, ground the EPROM's GND. Now, set the EPROM's VCC to 5V using the DAC on the VCC pin. Finally, enable the programmer's analog section to turn the power supplies on which will start feeding 5V to the EPROM. Now that that's done, the EPROM can be read. Optionally, the current limited supply could be used to "test" the EPROM first to make sure it is properly installed in the socket. This can be done by setting the current limit low, say, 20-30ma., and then feeding 5V into it. Measure the VCC pin using the pin comparator and sweeping the threshold voltage. This will allow a fairly accurate measurement to be made. If the voltage is below a certain threshold, the EPROM is deemed to be installed backwards due to the low forward voltage of the protection diode on the device. If it's above the threshold, it's most likely installed correctly. Also, if there's NO drop in voltage, it's possible there's no device installed at all. The pin DAC should be used to power the chip during readback. Related to power, there's a set of 48 bypass capacitors on my socket board. There's 48 .1uf capacitors, 48 N channel FETs, and associated circuitry to enable/disable these FETs. When a FET is enabled, it grounds its corresponding bypass capacitor. To bypass a chip properly, both the ground AND VCC bypass capacitors should be turned on. Turning the ground bypass capacitor on might seem redundant, but it's a good idea, because the impedance is what counts here. By turning two capacitors on, it reduces the impedance between VCC/ground. This occurs due to both capacitors being physically close together on the same ground plane right under the socket. If the ground bypass cap was not turned on, the AC ground currents would have to travel from the socket, through the socket board connector, on the programmer board, to the pin driver board (and its connectors), to the FET that grounds the pin, and finally out the pin driver board connector again, to the ground plane on the programmer's board. Turning on the ground bypass cap shortcuts this relatively longer path to AC signals. Interestingly, only the 48 pins of the ZIF socket have these bypass capacitors. The other 40 pins don't. ------------------------------------------------- Programming the bastard Fortunately, this is quite easy and straight forward. The programmer simply memory-maps everything into a 2K address space. Control signals are as follows: A0-A10 - 11 address lines D0-D7 - 8 data lines /CE - chip enable /WR - write data /RD - read data /RESET - reset the programmer A0-A10, D0-D7 are the address/data bus, respectively /CE must be low to write or read data to/from the programmer. /WR when low will write data on the data lines to the specified address /RD when low will read data from the specified address /RESET will reset all latches on the device, but not the DACs. The programmer is basically addressed like a very large 6116 RAM chip. The address space for the programmer is included at the end of this document. There are four adjustable power supplies that feed the 88 pin drivers. Each power supply is independent of the other, however VADJ powers the other three (VPUL, VTST, VPIN) which means the output from those three supplies cannot exceed VADJ's voltage minus 1-2V or so, depending on the supply in question. VADJ: ----- This voltage drives all the DACs on the pin drivers. It is adjustable, and designed to reduce power losses in the linear regulators of the DACs. Normally, this is set 2V or so above the highest voltage you will be applying to target device via the DAC outputs. If your highest voltage to the chip is 5V, simply set this to 7V. formula: VADJ = 0.8598 + (dac * 0.119036) + (dac ^ 2 * -0.0000115199973) dac = DAC input code (0-255) VADJ = output voltage from the VADJ power supply A 256 entry table of all possible DAC codes can be stored and searched to match the desired output code vs. voltage. VPUL: ----- This voltage drives the pullups. It is distributed to all 88 pin drivers. It is sent to a pin via a 2.7K resistor if the pullup is turned on. VPUL = -0.54392 + (dac * 0.100723) + (dac ^ 2 * 0.000000000497) A 256 entry table of all possible DAC codes can be stored and searched to match the desired output code vs. voltage. VPIN: ----- This voltage is used to set the pin detection threshold. If the pin voltage is higher than this voltage, it will register as a "1". If it's lower than this voltage, it registers as a "0" when the pin is read back. It has the simplest formula. VPIN = 0.1 * dac VTST: ----- This voltage source is the adjustable voltage/current source (test voltage). Its current is adjustable from 0-255ma, and around 0.5-27V. The two settings interact somewhat, which is taken into account. This restricts the usable range to around 1.5-25V or so, with the entire 0-255ma current range used. Iout = Idac (milliamps) Eout = 0.408 + (0.003855 * Idac) + (0.10151 * Edac) To calculate the desired two DAC values to plug in, the following formula will reverse the operation. Idac = Iout Edac = (Eout - 0.408 - (0.003855 * Idac)) / 0.10151 Programmer control register: ---------------------------- The PCR is used to enable or disable all the power supplies on the programmer. It is located at address 30Ch. There's only two bits: 7 0 --------- xxxx xxAN A: aux. enable bit. Connects to the socket board but is not used by it. No idea what this is used for, it just seems to be an extra doo-dad added in case it was needed by some expanded socket. When the A bit is set, it pulls a pin on the DIN connector low via an NPN transistor. When the A bit is clear the line floats. N: power enable bit. 0 = disable, 1 = enable. When this bit is set, it enables all the programming power supplies. These are: VADJ, VTST, VPIN, and VPUL. When the bit is clear, all those supplies are effectively turned off. Setting this bit also lights up the red "BUSY" LED on the socket board. Timer control register: ----------------------- The TCR is used to control the action of the clock generator. It's another 8 bit register. It is located at 38Bh in the address space. 7 0 --------- Pxxx xMMM M: timer mode 000b - neither high nor low driver is enabled 001b - pin state follows P bit (1 = high, 0 = low) 010b - 4MHz clock 011b - 2MHz clock 100b - 1MHz clock 101b - 500KHz clock 110b - 250KHz clock 111b - turns both drivers on. DO NOT USE P: polarity bit. Determines polarity of the clock signal when it is not toggling. setting 7 should not be used- it turns both pin drivers on at once which will short them out. I am not sure why this is allowed, but it's there. Tempting you to turn it on. resist this urge. Unused DACs: ------------ Two of the DAC channels on one of the PM7226 quad DACs are not used and could probably be pressed into service if someone wanted to use 'em, but you'd have to connect to them via a wire. They are mapped in at 384h and 285h. Both turn on and off with the power supplies via the power enable bit on the programmer control register. XFER: ----- All 88 DACs on the pin drivers, and the DAC for VPUL have their XFER pins tied together. Each of these 89 DACs has the following layout: +-------+ +-------+ +-----+ | | | | | | --------\| |----\| |-----\| | | | | | | | databus | latch | | latch | | DAC |---o output | | | | | | --------/| |----/| |-----/| | | | | | | | +-------+ +-------+ +-----+ | | WRITE XFER So, to make the DAC update its value after it is written to, it must have its XFER pin yanked low. This is done simply by writing to the address 308h. This will cause ALL 89 of the DACs to transfer the contents of the first latch into the second and thus the DAC output value. There is no way to update just one DAC at a time. However, you do not have to update DACs that do not change: they will just copy the latch value over when XFER occurs, and if it was not changed, the output value won't either. When resetting the programmer, all 88 of the pindriver DACs should have 00h written to them first. Ill-fated VADJ testing hardware: -------------------------------- There's a bit of hardware on the programmer which appears to have been designed to test the VADJ supply, but it's broken by design. The DAC that checks the voltage is at address 303h. The comparator for the voltage is read back on the A1STAT register. (see below) Slew rate control: ------------------ I am not sure how this works yet. I need to test it. It does the obvious: speeds up or slows down the edges coming out of the DACs. Other than this, dunno. Pin bypassing: -------------- The socket boards I have allow for pin bypassing as previously discussed. To turn the pin's bypass capacitor on, set D0. To turn it off, clear D0. The address range of these registers is 280h-2ffh. See the register list for where each pin maps. The current socket board's ID is read back via addresses 280h-2ffh. Reading anywhere in this range will return 081h. A1STAT register: ---------------- Reading this register will read back the analog1 board's 8 bit status register. It's not terribly useful except to see if a programmer is actually hooked up. It returns: 7 0 --------- Cxxx 0011 C: output of the voltage comparator for testing the VADJ supply, but it's broken. x: these bits are NC's on the input of the 74LS244, so they will read as 1's. The other 4 bits will read as shown. Pin drivers: ------------ There are 88 pin drivers. each is unique, and operates independent of the others. VDAC: ----- There are 88 DACs on the pin drivers, one per. Each is separately writeable but all 88 (and the built-in VPUL DAC making 89) of them update at the same time when XFER is written to. VDAC = -0.5 + (0.1 * dac) With a maximum code of 255d, the VDAC voltage is thus 25.0V. Codes below 5 do not result in a negative voltage, but 0V. The DAC register is at address xx3h (i.e. 003h, 013h, 023h, etc) of the selected pin driver register area. PINCON: ------- There's a pin control register for every pin. It selects one of the various sources to drive the pin. 7 0 --------- DMMU HTCG D: Pulldown. When set, the pin will be pulled down to ground via a 5.4K resistor. M: Mode: 00b: Disable logic level drivers 01b: output logic low (ground through a 50 ohm resistor) 10b: positive clock 11b: negative clock U: Pullup. When set, the pin will be pulled up to the VPUL voltage via a 2.7K resistor. NOTE: There are two 2.7K resistors in series like so: pulldown -vvvvv--*--vvvvv---- pin | pullup --------+ So when the pullup and pulldown are both enabled, the pullup "wins" (note that you should not turn both on at the same time, but if you do this is what happens.) H: Output logic high level (5V through a 10 ohm resistor) NOTE: The mode pins' outputs are driven via the logic high/low drivers. There is one set of drivers, and they can be either driven high, low, neither, or driven off a positive or negative clock signal. T: Output the test voltage on this pin. Sends VTST to the pin. C: Output the DAC voltage on this pin. Sends VDAC to the pin. This is the "DAC per pin" voltage. G: grounds the pin with a FET. I don't think it needs to be said, but improper programming of this register can and will cause damage, if two "competing" sources are turned on, say the VDAC and ground. The multiple voltage sources are run through diodes and they will not be harmed if more than one is enabled, but you still shouldn't do it. Valid codes would be thusly (all hex): 00 - disable everything 01 - ground 02 - DAC voltage 04 - VTST test voltage 08 - high logic level 10 - pullup 20 - low logic level 40 - positive clock 60 - negative clock 80 - pulldown This will output one of the signals to the pin. In addition to this, it might be useful to turn more than one source on at a time. Say, you're dumping a TI serial ROM that needs 9V to operate. To do this, it'd be useful to toggle between logic low and the VTST voltage to generate a 9V swing. To do this, you could turn the pulldown on and leave it on, then toggle bit 3 to turn the VTST voltage on and off to the pin. This would result in a glitchless change between modes. This would be 80h for a low and 84h for a high. The other way would be to toggle between say, 80h and 04h, but this will cause some glitching when one source turns on and the other turns off. So, I call these "sticky" bits that can stay on if the following conditions are met: 80h - pulldown. --------------- Keep this bit on to keep the pulldown on. Turning one of these sources on will turn off the pulldown: 10h - pullup 01h - ground 10h - pullup. ------------- Keep this on for continuous pullup. Turning one of these sources on will turn off the pullup: 01h - ground 80h - pulldown All other combinations should NOT be used. --- Address maps: ----------------------------- Write address memory mapping: All 88 pin drivers are the same. They share the format: (pin 00 example) W000-001: PIN00 control W002: - W003: PIN00 DAC W004-00F: mirrors of the above 2 registers (group 0) W000-00F: PIN00 W010-01F: PIN01 W020-02F: PIN02 W030-03F: PIN03 W040-04F: PIN04 W050-05F: PIN05 W060-06F: PIN06 W070-07F: PIN07 (group 1) W080-08F: PIN08 W090-09F: PIN09 W0A0-0AF: PIN0A W0B0-0BF: PIN0B W0C0-0CF: PIN0C W0D0-0DF: PIN0D W0E0-0EF: PIN0E W0F0-0FF: PIN0F (group 2) W100-10F: PIN10 W110-11F: PIN11 W120-12F: PIN12 W130-13F: PIN13 W140-14F: PIN14 W150-15F: PIN15 W160-16F: PIN16 W170-17F: PIN17 (group 3) W180-18F: PIN18 W190-19F: PIN19 W1A0-1AF: PIN1A W1B0-1BF: PIN1B W1C0-1CF: PIN1C W1D0-1DF: PIN1D W1E0-1EF: PIN1E W1F0-1FF: PIN1F (group 4) W200-20F: PIN20 W210-21F: PIN21 W220-22F: PIN22 W230-23F: PIN23 W240-24F: PIN24 W250-25F: PIN25 W260-26F: PIN26 W270-27F: PIN27 (socket board) W280: PIN00 bypass enable W281: PIN01 bypass enable W282: PIN02 bypass enable W283: PIN03 bypass enable W284: PIN04 bypass enable W285: PIN05 bypass enable W286: PIN06 bypass enable W287: PIN07 bypass enable W288: PIN08 bypass enable W289: PIN09 bypass enable W28A: PIN0A bypass enable W28B: PIN0B bypass enable W28C: PIN0C bypass enable W28D: PIN0D bypass enable W28E: PIN0E bypass enable W28F: PIN0F bypass enable W290: PIN10 bypass enable W291: PIN11 bypass enable W292: PIN12 bypass enable W293: PIN13 bypass enable W294: PIN14 bypass enable W295: PIN15 bypass enable W296: PIN16 bypass enable W297: PIN17 bypass enable W298: PIN18 bypass enable W299: PIN19 bypass enable W29A: PIN1A bypass enable W29B: PIN1B bypass enable W29C: PIN1C bypass enable W29D: PIN1D bypass enable W29E: PIN1E bypass enable W29F: PIN1F bypass enable W2A0: PIN20 bypass enable W2A1: PIN21 bypass enable W2A2: PIN22 bypass enable W2A3: PIN23 bypass enable W2A4: PIN24 bypass enable W2A5: PIN25 bypass enable W2A6: PIN26 bypass enable W2A7: PIN27 bypass enable W2A8-2BF: - W2C0: PIN28 bypass enable W2C1: PIN29 bypass enable W2C2: PIN2A bypass enable W2C3: PIN2B bypass enable W2C4: PIN2C bypass enable W2C5: PIN2D bypass enable W2C6: PIN2E bypass enable W2C7: PIN2F bypass enable W2C8-2FF: - (analog 1) W300: slew rate control W301: VPIN pin voltage comparator voltage set W302: VADJ voltage set W303: VADJ test input voltage set (design is broken, doesn't work) W304: - W305: VPUL pullup voltage set W306: - W307: VPUL pullup voltage set (mirror) W308-30B: XFER on all 89 DACs (xfers when written) W30C-30F: PCR program control register W310-37F: mirrors of 300-30F (analog 2) W380-383: - W384: not used (DAC channel A) W385: not used (DAC channel B) W386: VTST voltage setting W387: VTST current setting W388: - W389: - W38A: - W38B: TCR timer control register W38C-38F: - W390-3FF: mirrors of the above 16 registers (group 5) W400-40F: PIN28 W410-41F: PIN29 W420-42F: PIN2A W430-43F: PIN2B W440-44F: PIN2C W450-45F: PIN2D W460-46F: PIN2E W470-47F: PIN2F (group 6) W480-41F: PIN30 W490-49F: PIN31 W4A0-4AF: PIN32 W4B0-4BF: PIN33 W4C0-4CF: PIN34 W4D0-4DF: PIN35 W4E0-4EF: PIN36 W4F0-4FF: PIN37 (group 7) W500-50F: PIN38 W510-54F: PIN39 W520-54F: PIN3A W530-53F: PIN3B W540-54F: PIN3C W550-54F: PIN3D W560-56F: PIN3E W570-57F: PIN3F (group 8) W580-51F: PIN40 W590-59F: PIN41 W5A0-5AF: PIN42 W5B0-5BF: PIN43 W5C0-5CF: PIN44 W5D0-5DF: PIN45 W5E0-5EF: PIN46 W5F0-5FF: PIN47 (group 9) W600-64F: PIN48 W610-61F: PIN49 W620-62F: PIN4A W630-63F: PIN4B W640-64F: PIN4C W650-65F: PIN4D W660-66F: PIN4E W670-67F: PIN4F (group 10) W680-64F: PIN50 W690-64F: PIN51 W6A0-6AF: PIN52 W6B0-6BF: PIN53 W6C0-6CF: PIN54 W6D0-6DF: PIN55 W6E0-6EF: PIN56 W6F0-6FF: PIN57 (not used) W700-7FF: - Readbacks: ---------- (group 0) R000-00F: PIN00 level in D0 R010-01F: PIN01 level in D0 R020-02F: PIN02 level in D0 R030-03F: PIN03 level in D0 R040-04F: PIN04 level in D0 R050-05F: PIN05 level in D0 R060-06F: PIN06 level in D0 R070-07F: PIN07 level in D0 (group 1) R080-08F: PIN08 level in D0 R090-09F: PIN09 level in D0 R0A0-0AF: PIN0A level in D0 R0B0-0BF: PIN0B level in D0 R0C0-0CF: PIN0C level in D0 R0D0-0DF: PIN0D level in D0 R0E0-0EF: PIN0E level in D0 R0F0-0FF: PIN0F level in D0 (group 2) R100-10F: PIN10 level in D0 R110-11F: PIN11 level in D0 R120-12F: PIN12 level in D0 R130-13F: PIN13 level in D0 R140-14F: PIN14 level in D0 R150-15F: PIN15 level in D0 R160-16F: PIN16 level in D0 R170-17F: PIN17 level in D0 (group 3) R180-18F: PIN18 level in D0 R190-19F: PIN19 level in D0 R1A0-1AF: PIN1A level in D0 R1B0-1BF: PIN1B level in D0 R1C0-1CF: PIN1C level in D0 R1D0-1DF: PIN1D level in D0 R1E0-1EF: PIN1E level in D0 R1F0-1FF: PIN1F level in D0 (group 4) R200-20F: PIN20 level in D0 R210-21F: PIN21 level in D0 R220-22F: PIN22 level in D0 R230-23F: PIN23 level in D0 R240-24F: PIN24 level in D0 R250-25F: PIN25 level in D0 R260-26F: PIN26 level in D0 R270-27F: PIN27 level in D0 (socket board) R280-2FF: socket ID (my board is 81h) (analog 1) R300-37F: A1STAT (group 5) R400-40F: PIN28 level in D0 R410-41F: PIN29 level in D0 R420-42F: PIN2A level in D0 R430-43F: PIN2B level in D0 R440-44F: PIN2C level in D0 R450-45F: PIN2D level in D0 R460-46F: PIN2E level in D0 R470-47F: PIN2F level in D0 (group 6) R480-48F: PIN30 level in D0 R490-49F: PIN31 level in D0 R4A0-4AF: PIN32 level in D0 R4B0-4BF: PIN33 level in D0 R4C0-4CF: PIN34 level in D0 R4D0-4DF: PIN35 level in D0 R4E0-4EF: PIN36 level in D0 R4F0-4FF: PIN37 level in D0 (group 7) R500-50F: PIN38 level in D0 R510-51F: PIN39 level in D0 R520-52F: PIN3A level in D0 R530-53F: PIN3B level in D0 R540-54F: PIN3C level in D0 R550-55F: PIN3D level in D0 R560-56F: PIN3E level in D0 R570-57F: PIN3F level in D0 (group 8) R580-54F: PIN40 level in D0 R590-54F: PIN41 level in D0 R5A0-5AF: PIN42 level in D0 R5B0-5BF: PIN43 level in D0 R5C0-5CF: PIN44 level in D0 R5D0-5DF: PIN45 level in D0 R5E0-5EF: PIN46 level in D0 R5F0-5FF: PIN47 level in D0 (group 9) R600-64F: PIN48 level in D0 R610-61F: PIN49 level in D0 R620-62F: PIN4A level in D0 R630-63F: PIN4B level in D0 R640-64F: PIN4C level in D0 R650-65F: PIN4D level in D0 R660-66F: PIN4E level in D0 R670-67F: PIN4F level in D0 (group 10) R680-68F: PIN50 level in D0 R690-69F: PIN51 level in D0 R6A0-6AF: PIN52 level in D0 R6B0-6BF: PIN53 level in D0 R6C0-6CF: PIN54 level in D0 R6D0-6DF: PIN55 level in D0 R6E0-6EF: PIN56 level in D0 R6F0-6FF: PIN57 level in D0 All other addresses read back as 0ffh. Unimplemented bits on the pin drivers read back as 1's. 01234567890123456789012345678901234567890123456789012345678901234567890123456789