Dumping 6309 PROMs

Apple IIe Disk II

As part of diagnosing the issues with my Disk II interface card, I thought I would see whether there were any issues with the PROM, as this would definitely cause issues with reading or writing disks.

The card itself is made up of a number of ICs:

  • SN74LS14N - Hex/6 Way Inverter
  • SN74LS132N - Quad/4 Way NAND
  • PROM P6 - In my case a Harris Semiconductor part
  • SN74LS05N - Hex/6 Way Line Driver
  • SN74LS323N - Shift/Storage Register
  • 9334 - 8-Bit Addressable Latch
  • PROM P5 - In my case a Harris Semiconductor part
  • NE556N - Dual 555 Timer

The ICs we are interested in today are the P5 and P6 PROMS.

The ICs are marked 341-0127-A for the P5 ROM, and 341-0128-A for the P6. On this card, these are actually marked P5A and P6A, which denotes a later version of the ROM that supports 16 sector disks. The earlier P5 and P6 roms only support 13 sectors. The applelogic site here listed a couple of different varieties of ICs that Apple used - TBP28L22N (256x8) or 6309 (256x8).

There is a comprehensive list of apple ROM labels here.

I have a TL866II EEPROM programmer, which I wanted to dump the ROMS with. Unfortunately, the 6309/28L22 ROMS are so old, that there is no matching IC in the programmers list.

Searching around, I managed to find this post which detailed the steps to be taken. In essence, make a small adapter board, and choose a chip that the Xgpro software does support. I chose to follow Dexter's lead, and use the AM2716B.

Using the datasheet, I examined the pinout of the 6309:

Here is the pinout of the 2716:

Aside from the address and data lines being in different physical locations on the chips, the 2716 has some additional address lines, to allow additional data to be stored on the ROM. The 2716 is a 16kb device, compared to the 2kb of the 6309. Note this is kilobits not kilobytes. These additional address lines A8, A9 and A10 need to be tied to ground so they are inactive when the reading takes place.

The 2716 is also an EPROM device, and the pins marked NOTE 1 and NOTE 2 correspond with Output enable high, and VPP. Output enable was wired to E2 on the 6309 - the second "enable" pin. VPP was tied to ground.

Full pinouts:

6309 Pin 1  > A0  > 2716 Pin 8  > A0
6309 Pin 2  > A1  > 2716 Pin 7  > A1
6309 Pin 3  > A2  > 2716 Pin 6  > A2
6309 Pin 4  > A3  > 2716 Pin 5  > A3
6309 Pin 5  > A4  > 2716 Pin 4  > A4
6309 Pin 6  > O1  > 2716 Pin 9  > Q0
6309 Pin 7  > O2  > 2716 Pin 10 > Q1
6309 Pin 8  > O3  > 2716 Pin 11 > Q2
6309 Pin 9  > O4  > 2716 Pin 13 > Q3
6309 Pin 10 > GND > 2716 Pin 12 > GND
6309 Pin 11 > O5  > 2716 Pin 14 > Q4
6309 Pin 12 > O6  > 2716 Pin 15 > Q5
6309 Pin 13 > O7  > 2716 Pin 16 > Q6
6309 Pin 14 > O8  > 2716 Pin 17 > Q7
6309 Pin 15 > E1  > 2716 Pin 18 > CE
6309 Pin 16 > E2  > 2716 Pin 20 > OE 
6309 Pin 17 > A5  > 2716 Pin 3  > A5
6309 Pin 18 > A6  > 2716 Pin 2  > A6
6309 Pin 19 > A7  > 2716 Pin 1  > A7
6309 Pin 20 > VCC > 2716 Pin 24 > VCC

Additional pins on 2716 that aren't on the 6309:

2716 Pin 19 > A10 > VCC
2716 Pin 21 > VPP > GND
2716 Pin 22 > A9  > GND
2716 Pin 23 > A8  > GND

Unfortunately, I don't have a 20 pin DIL socket to hand, so instead I used DuPont cables and a breadboard to map the pinouts of the 6309 to the TL866II.

I was then able in Xgpro select the AM2716B, and complete a "read" of the ROM.

This resulted in a BIN file that contained essentially 8 reads of the 6309, as essentially it's reading A8/A9/A10 and the lower 256 bytes over and over. I used HxD to delete the bytes after F0, giving me a 256 byte BIN file.

P5A Firmware ROM 341-0127-A - 341-0127-A P5A.bin

I compared the trimmed 341-0127-A and an internet dump of 341-0128-A, and these were identical.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 40 50 00 52 03 16 CC 1A 0A 44 CC F0 80 05 CC  R@P.R..Ì..DÌð€.Ì
00000010  29 FF 49 EE D0 08 2A B0 FB 98 9D A6 03 38 78 80  )ÿIîÐ.*°û˜.¦.8x€
00000020  45 B0 B9 50 03 15 20 DD 1C 30 80 FB 4A 15 CC DD  E°¹P.. Ý.0€ûJ.ÌÝ
00000030  1C 30 80 FB 45 CC 18 B0 7C 48 35 CD B0 DE 55 20  .0€ûEÌ.°|H5Í°ÞU 
00000040  98 49 03 0A 05 4B 5A DD 11 30 59 A6 40 58 FC 18  ˜I...KZÝ.0Y¦@Xü.
00000050  80 7B 15 46 15 CD 15 21 59 08 15 47 88 08 DD 1C  €{.F.Í.!Y..Gˆ.Ý.
00000060  FB A9 B6 02 54 CC 91 46 38 B0 7F DC 1C 30 80 FB  û©¶.TÌ‘F8°.Ü.0€û
00000070  A9 B6 02 B0 17 50 00 52 A6 3A C0 FB D1 46 AE 00  ©¶.°.P.R¦:ÀûÑF®.
00000080  75 40 A8 FF DA DD 00 01 0A 0A 0A 0A 15 4B 5A DD  u@¨ÿÚÝ.......KZÝ
00000090  1E 30 DD 1C 30 DD 1A 30 DD 19 30 50 A0 DD 10 30  .0Ý.0Ý.0Ý.0P Ý.0
000000A0  35 21 B0 D8 D0 D7 50 A6 14 CC DC 1C 30 80 FB A9  5!°ØÐ×P¦.ÌÜ.0€û©
000000B0  B6 02 54 CC 18 99 00 03 B0 7E 14 CC DC 1C 30 80  ¶.TÌ.™..°~.ÌÜ.0€
000000C0  30 80 FB 29 B5 B0 F7 DD 1C 30 80 FB 39 5A B0 F3  0€û)µ°÷Ý.0€û9Z°ó
000000D0  7A DD 1C 30 80 FB 39 96 F0 09 48 90 BF 29 5D F0  zÝ.0€û9–ð.H.¿)]ð
000000E0  03 4A AE 00 03 4A 91 46 38 B0 7E 76 47 76 CD 55  .J®..J‘F8°~vGvÍU
000000F0  CD 3D 00 08 56 4B 90 BB 2C 01 08 00 00 00 00 00  Í=..VK.»,.......

P6A State Machine ROM 341-0128-A - 341-0128-A P6A.bin

I compared the trimmed 341-0128-A and an internet found dump of 342-0028-A, these were also identical.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  18 D8 18 08 0A 0A 0A 0A 18 39 18 39 18 3B 18 3B  .Ø.......9.9.;.;
00000010  18 38 18 28 0A 0A 0A 0A 18 39 18 39 18 3B 18 3B  .8.(.....9.9.;.;
00000020  2D D8 38 48 0A 0A 0A 0A 28 48 28 48 28 48 28 48  -Ø8H....(H(H(H(H
00000030  2D 48 38 48 0A 0A 0A 0A 28 48 28 48 28 48 28 48  -H8H....(H(H(H(H
00000040  D8 D8 D8 D8 0A 0A 0A 0A 58 78 58 78 58 78 58 78  ØØØØ....XxXxXxXx
00000050  58 78 58 78 0A 0A 0A 0A 58 78 58 78 58 78 58 78  XxXx....XxXxXxXx
00000060  D8 D8 D8 D8 0A 0A 0A 0A 68 08 68 88 68 08 68 88  ØØØØ....h.hˆh.hˆ
00000070  68 88 68 88 0A 0A 0A 0A 68 08 68 88 68 08 68 88  hˆhˆ....h.hˆh.hˆ
00000080  D8 CD D8 D8 0A 0A 0A 0A 98 B9 98 B9 98 BB 98 BB  ØÍØØ....˜¹˜¹˜»˜»
00000090  98 BD 98 B8 0A 0A 0A 0A 98 B9 98 B9 98 BB 98 BB  ˜½˜¸....˜¹˜¹˜»˜»
000000A0  D8 D9 D8 D8 0A 0A 0A 0A A8 C8 A8 C8 A8 C8 A8 C8  ØÙØØ....¨È¨È¨È¨È
000000B0  29 59 A8 C8 0A 0A 0A 0A A8 C8 A8 C8 A8 C8 A8 C8  )Y¨È....¨È¨È¨È¨È
000000C0  D9 FD D8 F8 0A 0A 0A 0A D8 F8 D8 F8 D8 F8 D8 F8  ÙýØø....ØøØøØøØø
000000D0  D9 FD A0 F8 0A 0A 0A 0A D8 F8 D8 F8 D8 F8 D8 F8  Ùý ø....ØøØøØøØø
000000E0  D8 DD E8 E0 0A 0A 0A 0A E8 88 E8 08 E8 88 E8 08  ØÝèà....èˆè.èˆè.
000000F0  08 4D E8 E0 0A 0A 0A 0A E8 88 E8 08 E8 88 E8 08  .Mèà....èˆè.èˆè.

As a result, I suspect the problem with the card lies elsewhere.

Thankfully the TL866 supports testing of some 74 series IC, so I will test these next.

Previous Post Next Post