Allpro 88 Programming
---------------------

V1.00
K.Horton
100912


TODO:  investigate how the slew control stuff works.  Adjust the voltages
read at the pins because of Vdrop of the diodes on the hybrids.


---


The Allpro 88 is a fairly nice, if somewhat antiquated DAC per pin programmer
designed and sold by Logical Devices.  "DAC per pin" means there is literally
an 8 bit DAC for every single pin that the programmer can drive.  That means
each pin can be set to any arbitrary voltage between 0V and 25V or thereabouts.

This flexiblity allows it to program almost any device.

This programmer came in various models, each supporting a different number of
pins.  All of these programmers are identical, except each has a different
number of pin driver boards installed.

There are 5 sizes of programmer, apparently, as indicated by a sticker
with a hole punched in it on the back of the unit:

24 pins
32 pins
48 pins
68 pins
88 pins

It seems to have been introduced in 1990 or thereabouts, with a $2995 price
tag.  I am unsure if this is the "fully loaded" 88 pin model or a smaller
one.

You can upgrade the programmer by simply plugging in the extra boards, and I
suspect Logical Devices offered kits to do this.

There seems to be a variety of socket boards that were sold, but I have only
seen two different but similar versions.  These socket boards connect to
the programmer via two 96 pin DIN connectors.  They plug in and unplug fairly
easily.

The first version I have has no less than 8 sockets on the front:

48 pin ZIF (will socket .3" to .6" chips of any number of pins, up to 48)
20 pin PLCC
28 pin PLCC
32 pin PLCC
44 pin PLCC
52 pin PLCC
68 pin PLCC
84 pin PLCC

The second version is identical, except the 84 pin socket is missing.  The 
PCB inside is identical, just with a missing socket.

There appears to be a 48 pin ZIF only socket board, and there are some special
adapters for programming 1702 EPROMs and another special EPROM, because both
of them need 40V to program, which is higher than the programmer can supply.

Fortunately it looks easy to construct your own custom socket boards for it
by making a PCB with the required two 96 pin DIN connectors.  I will be making
a few socket boards most likely for dumping SOICs and TSOPs and other more
modern devices.  

That's all the on-programmer fun stuff.  The final bit is how it connects to
your computer.  There's a very long (7 foot, 2.1 meter) cable that connects
between the programmer and an ISA card that goes into your computer.

This cable is simply a dsub 37 pin male to dsub 37 pin male connector joined
by some ribbon cable.

Unfortunately, the PC expansion card is *ALWAYS* missing if you try to buy 
one of these programmers from Ebay or similar.  

Fortunately for us, and the whole point of this document, is making my OWN
damn interface for this programmer to allow it to be used for dumping or
programming chips.

The hardware seems to be more than capable of dumping or programming nearly
any chips I would have the desire to work with.


-------------------------------------------------
Pin IO


So that's the background of this programmer.  What can it DO to the poor
device we happen to place into the socket?

Well there's 10 basic things it can do:

* nothing (pin is connected to ground through a 15K resistor)
* ground (pin is pulled hard to ground through a heavy duty FET)
* pin DAC voltage (pin is connected to a DAC , which can supply 0-25V at 1A)
* test voltage (pin is connected to a voltage and current regulated supply)
* pullup (pin is connected to a voltage regulated supply via a 2.7K resistor)
* pulldown (pin is connected to ground via a 5.4K resistor)
* logic low
* logic high
* positive clock (see clock section)
* negative clock (see clock section)

Ground:
-------

This simply connects the pin to ground via a IRFD020 N channel FET.  It provides
a nice low impedance path to ground.

DAC voltage:
------------

The DAC voltage is settable per pin, so that means there are 88 pin DACs present
on the programmer for this,  one per pin.  It can supply up to 1A to the
device, which should be adequate for nearly anything.  The voltage is variable
between 0V and 25V or thereabouts.

The DACs are 8 bits each, and have the following voltage characteristics:
       
Vout = (((5.1*input)/256) * 5.1) - 1.1

There's basically a pass transistor (-0.7V) and then a shottky diode (-0.3V)
in series to generate the output voltage.

This gives a range of approximately 0-25V, for the input codes 00-ffh.

The DACs are double buffered, and each can be loaded separately, but then
the outputs all updated simultaniously.  There is no way to individually
update the DACs- they must all be updated at once.

test voltage:
-------------


The test voltage works similar to the DAC voltage, but its range is between
0.4 and 27V.  The current setting interacts somewhat with the voltage setting.

Maximum current is 0-255ma in 1ma steps.

I suspect this supply is not to power the device, but rather to test it
to see if it is installed in the socket correctly.  To test if say, an
EPROM is installed in the socket correctly, just set current to some nominal
value that the EPROM would draw in its quescent state (say, 50ma) then 
measure the voltage at the VCC pin using the pin threshold setting to see
if VCC dipped below say, 4V.  If it did, the EPROM is probably in the socket
backwards (or it may not be an EPROM at all).


Pullup:
-------

As the name implies, the pin will be pulled up via a 2.7K resistor to a set
voltage.

This pullup voltage is the same for all pins, and is settable via another DAC.
It can range from -0.5V-25V.  The PNP transistor will never pass the negative
voltage, so its effective range is 0-25V.  

Pulldown:
---------

Simply a 5.4K resistor that can be connected to ground when enabled.

Logic high:
-----------

Connects to 5V through a shottky diode and a 10 ohm resistor.

Logic Low:
----------

Connects to ground through a 50 ohm resistor.

Clocking:
---------

It's possible to connect the pin to either a true or inverted version of a
clock signal.  

This clock is one of the following:

4MHz
2MHz
1MHz
500KHz
250KHz
low     (logic low, no clocking)
high    (logic high, no clocking)
nothing (neither high nor low- the pin is effectively not driven at all)


This must be for programming microcontrollers such as the 68705's that need a
clock to operate during programming.

The clock signals use the logic high/low circuitry to drive the pins.
Either a true or complement version can be selected, in case a chip needs 
both phases of a 250KHz clock, for example.

If multiple pins need to be toggled at the exact same time, this can be used
for that also, since all pins update simultaniously when the clock settings
are changed.  If a bunch of pins need to toggle between open and high, or low
this can be used for that as well.


Pin reading:
------------

Each pin is connected to a voltage comparator.  This allows the programmer
to set a voltage threshold nearly anywhere, to accomodate 3.3V logic, or
12V logic, or anything in between.  It allows for testing margin by
sweeping the pin voltage threshold DAC and seeing where the level changes.

Normally, the pin threshold is set and then used simply to produce the
usual high/low logic level determination.  The threshold voltage is
the same for all 88 pins and is DAC settable.

It can vary in voltage from 0V to 25V.

-------------------------------------------------
Power Supplies


The power supply flow inside the programmer is arranged like so:
 

  +------------------------> VADJ 88 pin DAC pass transistors
  |
  |     +-------------+
  *---->|   op-amp    | ---> VPIN adjustable pin threshold voltage
  |     +-------------+
  |           ^
  |         V dac
  |     +-------------+
  *---->|pullup supply| ----> VPUL adjustable pullup supply
  |     +-------------+
  |           ^
  |         V dac
  |
  |     +-------------+
  *---->| test supply | ----> VTST voltage/current adjustable supply 
  |     +-------------+
  |        ^       ^
  |      V dac   I dac
  +---------------------------------------------------------------------+
                                                                        |
           +-------------+ (22.6VAC) +----------+  (+34.5V) +--------+  |
120VAC ->  | transformer |  ------>  | UNREG PS |  ------>  | ADJ PS | -+
           +-------------+           |          |  (+30V)   +--------+
                                     |          |  --+          ^
                                     +----------+    |        V dac 
                                                     |
                                                     |
  +--------------------------------------------------+
  |
  |    +---------+  (+5V)
  *--->|  5V PS  |  ---->  logic
  |    |         |  (-8.5V)         +--------+ (-5V)
  |    |         |  --------*-----> |  7905  | ---->  DAC VSS
  |    +---------+          |       +--------+
  |                         |       
  |                         |       +-------+  (-5.1V)
  |                         +-------| LM337 | ---->  DAC Vref
  |                                 +-------+
  |
  |    +---------+  (+12V) 
  +--->|  7812   |  --*---->  VCC of DACs
       +---------+    |
                      |
                      |     +-------+ (+5V)
                      *-----| 78L05 | ---->  logic high level (1 per pin board)
                      |     +-------+
                      |
                      |     +-------+ (+5.1V)
                      +-----| LM317 | ---->  PM7226 DAC Vref (2x)
                            +-------+




As can be seen from the above diagram, the power flow in the programmer is
somewhat complicated.  The power first is run through a transformer and
bridge rectifier and filter capacitors to produce approximately 30VDC.  
This 30VDC is then boosted up to 34.5V with a flyback converter, and both
exit the "UNREG PS" board.

The 30VDC unregulated power is used by the 5V power supply and -8.5V supply.
The "5V PS" board contains both regulators, which are switch mode converters.
That 30VDC unregulated voltage is used by a 7812 on the "ANALOG 1" board that
powers the DACs' VCC pins and is used to generate the Vrefs for the two PM7226
quad DAC chips.

The 34.5VDC coming off the UNREG PS board is only fed into the ADJ PS board
which is a buck regulator that generates the power used to run most of the
analog system.  The output voltage is adjustable via a DAC, and this output
is then fed to all 88 pin drivers to be used by the DACs on same, and is used
to derive the pullup, VCC, and pin threshold voltages.

There's some other minor voltages used to run the guts of the programmer.

The buck regulator on the ADJ PS supply is interesting to me.  It makes a lot
of sense to buck down the 34.5V to something lower before feeding it into the
pin drivers, because this will greatly reduce the losses in the pin driver
pass transistors, which are basically a computer controlled linear power 
supply.

To read back an EPROM that runs on 5V, the following is probably a decent way to
do it.


First, set the VADJ voltage to around 9V or so.  
Next, ground the EPROM's GND.
Now, set the EPROM's VCC to 5V using the DAC on the VCC pin.
Finally, enable the programmer's analog section to turn the power supplies on
which will start feeding 5V to the EPROM.

Now that that's done, the EPROM can be read.

Optionally, the current limited supply could be used to "test" the EPROM first
to make sure it is properly installed in the socket.  This can be done by
setting the current limit low, say, 20-30ma., and then feeding 5V into it.  
Measure the VCC pin using the pin comparator and sweeping the threshold voltage.
This will allow a fairly accurate measurement to be made.  

If the voltage is below a certain threshold, the EPROM is deemed to be
installed backwards due to the low forward voltage of the protection diode
on the device.  If it's above the threshold, it's most likely installed
correctly.  Also, if there's NO drop in voltage, it's possible there's no
device installed at all.

The pin DAC should be used to power the chip during readback.  

Related to power, there's a set of 48 bypass capacitors on my socket board.
There's 48 .1uf capacitors, 48 N channel FETs, and associated circuitry to
enable/disable these FETs.  When a FET is enabled, it grounds its corresponding
bypass capacitor.

To bypass a chip properly, both the ground AND VCC bypass capacitors should be
turned on.  Turning the ground bypass capacitor on might seem redundant, but
it's a good idea, because the impedance is what counts here.  By turning two
capacitors on, it reduces the impedance between VCC/ground.  This occurs
due to both capacitors being physically close together on the same ground plane
right under the socket.

If the ground bypass cap was not turned on, the AC ground currents would have
to travel from the socket, through the socket board connector, on the programmer
board, to the pin driver board (and its connectors), to the FET that grounds
the pin, and finally out the pin driver board connector again, to the ground
plane on the programmer's board.  Turning on the ground bypass cap shortcuts
this relatively longer path to AC signals. 

Interestingly, only the 48 pins of the ZIF socket have these bypass capacitors.
The other 40 pins don't. 


-------------------------------------------------
Programming the bastard


Fortunately, this is quite easy and straight forward.  The programmer simply
memory-maps everything into a 2K address space.  

Control signals are as follows:

A0-A10   - 11 address lines
D0-D7    - 8 data lines
/CE      - chip enable
/WR      - write data
/RD      - read data
/RESET   - reset the programmer

A0-A10, D0-D7 are the address/data bus, respectively
/CE must be low to write or read data to/from the programmer.
/WR when low will write data on the data lines to the specified address
/RD when low will read data from the specified address
/RESET will reset all latches on the device, but not the DACs.

The programmer is basically addressed like a very large 6116 RAM chip.

The address space for the programmer is included at the end of this
document.  


There are four adjustable power supplies that feed the 88 pin drivers.
Each power supply is independent of the other, however VADJ powers the
other three (VPUL, VTST, VPIN) which means the output from those three
supplies cannot exceed VADJ's voltage minus 1-2V or so, depending on the
supply in question.


VADJ:
-----

This voltage drives all the DACs on the pin drivers.  It is adjustable, and
designed to reduce power losses in the linear regulators of the DACs.  Normally,
this is set 2V or so above the highest voltage you will be applying to target
device via the DAC outputs.

If your highest voltage to the chip is 5V, simply set this to 7V.

formula:

VADJ =  0.8598 + (dac * 0.119036) + (dac ^ 2 * -0.0000115199973)

dac = DAC input code (0-255)
VADJ = output voltage from the VADJ power supply

A 256 entry table of all possible DAC codes can be stored and searched to
match the desired output code vs. voltage.


VPUL:
-----

This voltage drives the pullups.  It is distributed to all 88 pin drivers. It
is sent to a pin via a 2.7K resistor if the pullup is turned on.

VPUL = -0.54392 + (dac * 0.100723) + (dac ^ 2 * 0.000000000497)

A 256 entry table of all possible DAC codes can be stored and searched to
match the desired output code vs. voltage.


VPIN:
-----

This voltage is used to set the pin detection threshold.  If the pin voltage is
higher than this voltage, it will register as a "1".  If it's lower than this
voltage, it registers as a "0" when the pin is read back.  It has the simplest
formula.

VPIN = 0.1 * dac


VTST:
-----

This voltage source is the adjustable voltage/current source (test voltage).
Its current is adjustable from 0-255ma, and around 0.5-27V.  The two settings
interact somewhat, which is taken into account.  This restricts the usable
range to around 1.5-25V or so, with the entire 0-255ma current range used.

Iout = Idac (milliamps)
Eout = 0.408 + (0.003855 * Idac) + (0.10151 * Edac)

To calculate the desired two DAC values to plug in, the following formula
will reverse the operation.

Idac = Iout 
Edac = (Eout - 0.408 - (0.003855 * Idac)) / 0.10151


Programmer control register:
----------------------------

The PCR is used to enable or disable all the power supplies on the programmer.
It is located at address 30Ch.  There's only two bits:

7       0
---------
xxxx xxAN

A: aux. enable bit.  Connects to the socket board but is not used by it.

No idea what this is used for, it just seems to be an extra doo-dad added in
case it was needed by some expanded socket.  When the A bit is set, it pulls
a pin on the DIN connector low via an NPN transistor.  When the A bit is clear
the line floats.

N: power enable bit. 0 = disable, 1 = enable.

When this bit is set, it enables all the programming power supplies.  These
are: VADJ, VTST, VPIN, and VPUL.  When the bit is clear, all those supplies
are effectively turned off.

Setting this bit also lights up the red "BUSY" LED on the socket board.


Timer control register:
-----------------------

The TCR is used to control the action of the clock generator.  It's another 8
bit register.  It is located at 38Bh in the address space.

7       0
---------
Pxxx xMMM

M: timer mode

  000b - neither high nor low driver is enabled
  001b - pin state follows P bit (1 = high, 0 = low)
  010b - 4MHz clock
  011b - 2MHz clock
  100b - 1MHz clock
  101b - 500KHz clock
  110b - 250KHz clock
  111b - turns both drivers on. DO NOT USE

P: polarity bit.  Determines polarity of the clock signal when it is not
toggling.

setting 7 should not be used- it turns both pin drivers on at once which will
short them out.  I am not sure why this is allowed, but it's there. Tempting
you to turn it on.  resist this urge.

Unused DACs:
------------

Two of the DAC channels on one of the PM7226 quad DACs are not used and could
probably be pressed into service if someone wanted to use 'em, but you'd have
to connect to them via a wire.  

They are mapped in at 384h and 285h.  Both turn on and off with the power
supplies via the power enable bit on the programmer control register.


XFER:
-----

All 88 DACs on the pin drivers, and the DAC for VPUL have their XFER pins tied
together.  Each of these 89 DACs has the following layout:

         +-------+     +-------+      +-----+
         |       |     |       |      |     |
--------\|       |----\|       |-----\|     |
         |       |     |       |      |     |
databus  | latch |     | latch |      | DAC |---o  output
         |       |     |       |      |     |
--------/|       |----/|       |-----/|     |
         |       |     |       |      |     |
         +-------+     +-------+      +-----+
             |             |
           WRITE          XFER


So, to make the DAC update its value after it is written to, it must have its
XFER pin yanked low.  This is done simply by writing to the address 308h.
This will cause ALL 89 of the DACs to transfer the contents of the first latch
into the second and thus the DAC output value.

There is no way to update just one DAC at a time.  However, you do not have
to update DACs that do not change: they will just copy the latch value over
when XFER occurs, and if it was not changed, the output value won't either.

When resetting the programmer, all 88 of the pindriver DACs should have 00h
written to them first.


Ill-fated VADJ testing hardware:
--------------------------------

There's a bit of hardware on the programmer which appears to have been
designed to test the VADJ supply, but it's broken by design.

The DAC that checks the voltage is at address 303h.  The comparator for the
voltage is read back on the A1STAT register. (see below)


Slew rate control:
------------------


I am not sure how this works yet.  I need to test it.  It does the obvious:
speeds up or slows down the edges coming out of the DACs.  Other than this,
dunno.


Pin bypassing:
--------------

The socket boards I have allow for pin bypassing as previously discussed.
To turn the pin's bypass capacitor on, set D0.  To turn it off, clear D0.
The address range of these registers is 280h-2ffh.  See the register
list for where each pin maps.

The current socket board's ID is read back via addresses 280h-2ffh. Reading
anywhere in this range will return 081h.  

A1STAT register:
----------------

Reading this register will read back the analog1 board's 8 bit status register.
It's not terribly useful except to see if a programmer is actually hooked up.
It returns:

7       0
---------
Cxxx 0011

C: output of the voltage comparator for testing the VADJ supply, but it's 
broken.

x: these bits are NC's on the input of the 74LS244, so they will read as 1's.

The other 4 bits will read as shown.


Pin drivers:
------------

There are 88 pin drivers.  each is unique, and operates independent of the 
others.


VDAC:
-----

There are 88 DACs on the pin drivers, one per.  Each is separately writeable
but all 88 (and the built-in VPUL DAC making 89) of them update at the same
time when XFER is written to.

VDAC = -0.5 + (0.1 * dac)

With a maximum code of 255d, the VDAC voltage is thus 25.0V.

Codes below 5 do not result in a negative voltage, but 0V.  

The DAC register is at address xx3h  (i.e. 003h, 013h, 023h, etc) of the
selected pin driver register area.



PINCON:
-------

There's a pin control register for every pin.  It selects one of the
various sources to drive the pin.

7       0
---------
DMMU HTCG


D:  Pulldown.  When set, the pin will be pulled down to ground via a 5.4K
    resistor.

M:  Mode:

    00b: Disable logic level drivers
    01b: output logic low (ground through a 50 ohm resistor)
    10b: positive clock
    11b: negative clock

U:  Pullup.  When set, the pin will be pulled up to the VPUL voltage via a
    2.7K resistor.  

NOTE: There are two 2.7K resistors in series like so:

pulldown -vvvvv--*--vvvvv---- pin
                 |
pullup   --------+

So when the pullup and pulldown are both enabled, the pullup "wins" (note that
you should not turn both on at the same time, but if you do this is what
happens.)

H:  Output logic high level (5V through a 10 ohm resistor)

NOTE: The mode pins' outputs are driven via the logic high/low drivers.  There
is one set of drivers, and they can be either driven high, low, neither, or
driven off a positive or negative clock signal.

T:  Output the test voltage on this pin.  Sends VTST to the pin.

C:  Output the DAC voltage on this pin.  Sends VDAC to the pin.  This is the
    "DAC per pin" voltage.

G:  grounds the pin with a FET.


I don't think it needs to be said, but improper programming of this register
can and will cause damage, if two "competing" sources are turned on, say the
VDAC and ground.  The multiple voltage sources are run through diodes
and they will not be harmed if more than one is enabled, but you still
shouldn't do it.

Valid codes would be thusly (all hex):

00 - disable everything
01 - ground
02 - DAC voltage
04 - VTST test voltage
08 - high logic level
10 - pullup
20 - low logic level
40 - positive clock
60 - negative clock
80 - pulldown


This will output one of the signals to the pin.  In addition to this, it might
be useful to turn more than one source on at a time.  Say, you're dumping a
TI serial ROM that needs 9V to operate.  To do this, it'd be useful to toggle
between logic low and the VTST voltage to generate a 9V swing.

To do this, you could turn the pulldown on and leave it on, then toggle 
bit 3 to turn the VTST voltage on and off to the pin.  This would result in a
glitchless change between modes.  This would be 80h for a low and 84h for a
high.  The other way would be to toggle between say, 80h and 04h, but this
will cause some glitching when one source turns on and the other turns off.

So, I call these "sticky" bits that can stay on if the following conditions
are met:

80h - pulldown.
---------------
Keep this bit on to keep the pulldown on.  

Turning one of these sources on will turn off the pulldown:

10h - pullup
01h - ground


10h - pullup.
-------------

Keep this on for continuous pullup. 

Turning one of these sources on will turn off the pullup:

01h - ground
80h - pulldown


All other combinations should NOT be used.  


---

Address maps:


-----------------------------
Write address memory mapping:


All 88 pin drivers are the same.  They share the format:
(pin 00 example)
W000-001:  PIN00 control
W002:      -
W003:      PIN00 DAC
W004-00F:  mirrors of the above 2 registers

(group 0)
W000-00F:  PIN00
W010-01F:  PIN01
W020-02F:  PIN02
W030-03F:  PIN03
W040-04F:  PIN04
W050-05F:  PIN05
W060-06F:  PIN06
W070-07F:  PIN07
(group 1)
W080-08F:  PIN08
W090-09F:  PIN09
W0A0-0AF:  PIN0A
W0B0-0BF:  PIN0B
W0C0-0CF:  PIN0C
W0D0-0DF:  PIN0D
W0E0-0EF:  PIN0E
W0F0-0FF:  PIN0F
(group 2)
W100-10F:  PIN10
W110-11F:  PIN11
W120-12F:  PIN12
W130-13F:  PIN13
W140-14F:  PIN14
W150-15F:  PIN15
W160-16F:  PIN16
W170-17F:  PIN17
(group 3)
W180-18F:  PIN18
W190-19F:  PIN19
W1A0-1AF:  PIN1A
W1B0-1BF:  PIN1B
W1C0-1CF:  PIN1C
W1D0-1DF:  PIN1D
W1E0-1EF:  PIN1E
W1F0-1FF:  PIN1F
(group 4)
W200-20F:  PIN20
W210-21F:  PIN21
W220-22F:  PIN22
W230-23F:  PIN23
W240-24F:  PIN24
W250-25F:  PIN25
W260-26F:  PIN26
W270-27F:  PIN27
(socket board)
W280:      PIN00 bypass enable
W281:      PIN01 bypass enable
W282:      PIN02 bypass enable
W283:      PIN03 bypass enable
W284:      PIN04 bypass enable
W285:      PIN05 bypass enable
W286:      PIN06 bypass enable
W287:      PIN07 bypass enable
W288:      PIN08 bypass enable
W289:      PIN09 bypass enable
W28A:      PIN0A bypass enable
W28B:      PIN0B bypass enable
W28C:      PIN0C bypass enable
W28D:      PIN0D bypass enable
W28E:      PIN0E bypass enable
W28F:      PIN0F bypass enable
W290:      PIN10 bypass enable
W291:      PIN11 bypass enable
W292:      PIN12 bypass enable
W293:      PIN13 bypass enable
W294:      PIN14 bypass enable
W295:      PIN15 bypass enable
W296:      PIN16 bypass enable
W297:      PIN17 bypass enable
W298:      PIN18 bypass enable
W299:      PIN19 bypass enable
W29A:      PIN1A bypass enable
W29B:      PIN1B bypass enable
W29C:      PIN1C bypass enable
W29D:      PIN1D bypass enable
W29E:      PIN1E bypass enable
W29F:      PIN1F bypass enable
W2A0:      PIN20 bypass enable
W2A1:      PIN21 bypass enable
W2A2:      PIN22 bypass enable
W2A3:      PIN23 bypass enable
W2A4:      PIN24 bypass enable
W2A5:      PIN25 bypass enable
W2A6:      PIN26 bypass enable
W2A7:      PIN27 bypass enable
W2A8-2BF:  -
W2C0:      PIN28 bypass enable
W2C1:      PIN29 bypass enable
W2C2:      PIN2A bypass enable
W2C3:      PIN2B bypass enable
W2C4:      PIN2C bypass enable
W2C5:      PIN2D bypass enable
W2C6:      PIN2E bypass enable
W2C7:      PIN2F bypass enable
W2C8-2FF:  -
(analog 1)
W300:      slew rate control
W301:      VPIN pin voltage comparator voltage set
W302:      VADJ voltage set
W303:      VADJ test input voltage set (design is broken, doesn't work)
W304:      -
W305:      VPUL pullup voltage set
W306:      -
W307:      VPUL pullup voltage set (mirror)
W308-30B:  XFER on all 89 DACs (xfers when written)
W30C-30F:  PCR program control register
W310-37F:  mirrors of 300-30F
(analog 2)
W380-383:  -
W384:      not used (DAC channel A)
W385:      not used (DAC channel B)
W386:      VTST voltage setting
W387:      VTST current setting
W388:      -
W389:      -
W38A:      -
W38B:      TCR timer control register
W38C-38F:  -
W390-3FF:  mirrors of the above 16 registers
(group 5)
W400-40F:  PIN28
W410-41F:  PIN29
W420-42F:  PIN2A
W430-43F:  PIN2B
W440-44F:  PIN2C
W450-45F:  PIN2D
W460-46F:  PIN2E
W470-47F:  PIN2F
(group 6)
W480-41F:  PIN30
W490-49F:  PIN31
W4A0-4AF:  PIN32
W4B0-4BF:  PIN33
W4C0-4CF:  PIN34
W4D0-4DF:  PIN35
W4E0-4EF:  PIN36
W4F0-4FF:  PIN37
(group 7)
W500-50F:  PIN38
W510-54F:  PIN39
W520-54F:  PIN3A
W530-53F:  PIN3B
W540-54F:  PIN3C
W550-54F:  PIN3D
W560-56F:  PIN3E
W570-57F:  PIN3F
(group 8)
W580-51F:  PIN40
W590-59F:  PIN41
W5A0-5AF:  PIN42
W5B0-5BF:  PIN43
W5C0-5CF:  PIN44
W5D0-5DF:  PIN45
W5E0-5EF:  PIN46
W5F0-5FF:  PIN47
(group 9)
W600-64F:  PIN48
W610-61F:  PIN49
W620-62F:  PIN4A
W630-63F:  PIN4B
W640-64F:  PIN4C
W650-65F:  PIN4D
W660-66F:  PIN4E
W670-67F:  PIN4F
(group 10)
W680-64F:  PIN50
W690-64F:  PIN51
W6A0-6AF:  PIN52
W6B0-6BF:  PIN53
W6C0-6CF:  PIN54
W6D0-6DF:  PIN55
W6E0-6EF:  PIN56
W6F0-6FF:  PIN57
(not used)
W700-7FF:  -

Readbacks:
----------
(group 0)
R000-00F:  PIN00 level in D0
R010-01F:  PIN01 level in D0
R020-02F:  PIN02 level in D0
R030-03F:  PIN03 level in D0
R040-04F:  PIN04 level in D0
R050-05F:  PIN05 level in D0
R060-06F:  PIN06 level in D0
R070-07F:  PIN07 level in D0
(group 1)
R080-08F:  PIN08 level in D0
R090-09F:  PIN09 level in D0
R0A0-0AF:  PIN0A level in D0
R0B0-0BF:  PIN0B level in D0
R0C0-0CF:  PIN0C level in D0
R0D0-0DF:  PIN0D level in D0
R0E0-0EF:  PIN0E level in D0
R0F0-0FF:  PIN0F level in D0
(group 2)
R100-10F:  PIN10 level in D0
R110-11F:  PIN11 level in D0
R120-12F:  PIN12 level in D0
R130-13F:  PIN13 level in D0
R140-14F:  PIN14 level in D0
R150-15F:  PIN15 level in D0
R160-16F:  PIN16 level in D0
R170-17F:  PIN17 level in D0
(group 3)
R180-18F:  PIN18 level in D0
R190-19F:  PIN19 level in D0
R1A0-1AF:  PIN1A level in D0
R1B0-1BF:  PIN1B level in D0
R1C0-1CF:  PIN1C level in D0
R1D0-1DF:  PIN1D level in D0
R1E0-1EF:  PIN1E level in D0
R1F0-1FF:  PIN1F level in D0
(group 4)
R200-20F:  PIN20 level in D0
R210-21F:  PIN21 level in D0
R220-22F:  PIN22 level in D0
R230-23F:  PIN23 level in D0
R240-24F:  PIN24 level in D0
R250-25F:  PIN25 level in D0
R260-26F:  PIN26 level in D0
R270-27F:  PIN27 level in D0
(socket board)
R280-2FF:  socket ID (my board is 81h)
(analog 1)
R300-37F:  A1STAT
(group 5)
R400-40F:  PIN28 level in D0
R410-41F:  PIN29 level in D0
R420-42F:  PIN2A level in D0
R430-43F:  PIN2B level in D0
R440-44F:  PIN2C level in D0
R450-45F:  PIN2D level in D0
R460-46F:  PIN2E level in D0
R470-47F:  PIN2F level in D0
(group 6)
R480-48F:  PIN30 level in D0
R490-49F:  PIN31 level in D0
R4A0-4AF:  PIN32 level in D0
R4B0-4BF:  PIN33 level in D0
R4C0-4CF:  PIN34 level in D0
R4D0-4DF:  PIN35 level in D0
R4E0-4EF:  PIN36 level in D0
R4F0-4FF:  PIN37 level in D0
(group 7)
R500-50F:  PIN38 level in D0
R510-51F:  PIN39 level in D0
R520-52F:  PIN3A level in D0
R530-53F:  PIN3B level in D0
R540-54F:  PIN3C level in D0
R550-55F:  PIN3D level in D0
R560-56F:  PIN3E level in D0
R570-57F:  PIN3F level in D0
(group 8)
R580-54F:  PIN40 level in D0
R590-54F:  PIN41 level in D0
R5A0-5AF:  PIN42 level in D0
R5B0-5BF:  PIN43 level in D0
R5C0-5CF:  PIN44 level in D0
R5D0-5DF:  PIN45 level in D0
R5E0-5EF:  PIN46 level in D0
R5F0-5FF:  PIN47 level in D0
(group 9)
R600-64F:  PIN48 level in D0
R610-61F:  PIN49 level in D0
R620-62F:  PIN4A level in D0
R630-63F:  PIN4B level in D0
R640-64F:  PIN4C level in D0
R650-65F:  PIN4D level in D0
R660-66F:  PIN4E level in D0
R670-67F:  PIN4F level in D0
(group 10)
R680-68F:  PIN50 level in D0
R690-69F:  PIN51 level in D0
R6A0-6AF:  PIN52 level in D0
R6B0-6BF:  PIN53 level in D0
R6C0-6CF:  PIN54 level in D0
R6D0-6DF:  PIN55 level in D0
R6E0-6EF:  PIN56 level in D0
R6F0-6FF:  PIN57 level in D0

All other addresses read back as 0ffh.  Unimplemented bits on the pin
drivers read back as 1's.



01234567890123456789012345678901234567890123456789012345678901234567890123456789
