The new Motorola HCS08 Flash processor (JP1.2)

Post by **The Robman** » Fri Dec 10, 2004 5:03 pm

UEI is switching over to using a new flash chip from Motorola for their new line of OFA and RS remotes. These remotes do have a 6-pin connector but the current JP1 cables and software won't work with them.

I have a copy of what I believe is the right data sheet for this chip here.

I'm setting up this thread for discussing what we need to do to make these new remotes JP1 compatible.

Herbie · Post by **Herbie** » Fri Dec 10, 2004 5:24 pm

So can I assume that the 6-pin connector in the "JP1.2" remotes is the "Background Debug Controller" interface?

Interesting.

All of the following is based on a 5-minute browsing of the datasheet:

Looks like the 1-wire interface (really 4-wires) can do what we need it to do: read/write flash, etc. Its a bidirectional interface, so a controller on the other end would need to be able to toggle that pin.

I've only briefly looked at the spec-sheet for the Delcom chip. I know the cypress base chip has reconfigurable ports, but does the Delcom ROM make that available via its command interface? (I'm guessing it does, but I actually don't know the pinout of JP1!) If so, it could probably built right on as a second 6-pin interface to Tommy's "Improved USB" design (9 GPIOs free, IIRC), so one chip could talk to both JP1 and the new standard.

One way or the other, I think the actual interface portion isn't too difficult. If the Delcom chip supports a bidirectional GPIO, then great. If not, I think similar offerings from Microchip or Cypress can be had that offer a windows-level interface via USB.

Obviously most of the "work" happens in IR, which means so does most of the programming effort. New routines are probably needed for issuing the read commands via that interface, and dealing with the response. Same for sending.

Deciphering the storage structure, etc. comes after the interface is working, but the smart people here probably know what to look for.

Thanks Rob, I'll dig more deeply into that datasheet after the weekend.

Cheers.

Post by **The Robman** » Fri Dec 10, 2004 6:50 pm

Even without changes to IR, if someone were to write a stand-alone program that would just read and write the data in the standard IR format, people could still use IR to manipulate the data, until such time as IR is modified to handle the new chip.

Mark Pierson · Post by **Mark Pierson** » Fri Dec 10, 2004 7:21 pm

The Robman wrote:people could still use IR to manipulate the data

Rob,

Do you know if the data storage on the new chip is the same as the current EEPROM, or did UEI change the format?

Post by **The Robman** » Fri Dec 10, 2004 8:19 pm

Until we get the first dump, I have no idea, but I'm ginna guess that once we see it, we'll be able to figure it out pretty quickly.

However, one thing occurs to me. Most of us have put all our energy into developing S3C8 stuff (ie, special protocols, extenders, etc). We've left all the Motorola stuff up to Mike E, but once these new remotes become standard, we're all gonna have to brush up on our 6805 assembly skills.

mr_d_p_gumby · Post by **mr_d_p_gumby** » Sat Dec 11, 2004 12:07 am

The Robman wrote:We've left all the Motorola stuff up to Mike E, but once these new remotes become standard, we're all gonna have to brush up on our 6805 assembly skills.

Good thing I put a 6805 assembler in PB.

I've looked at the HCS08 data sheet as well. The flash memory is divided into segments, and parts of it can be read-protected. My guess is that the "JP1" area will be unprotected, and probably resembles the current EEPROM in structure (but that's only conjecture at this point). One complication in reading the flash is that the 1-wire debugger interface can be operated at different bit rates. There is a command to interrogate it for speed, but that requires the inteface to measure a time period fairly accurately. I doubt the final JP1.2 interface would need this, but we might need it for initial investigations.

On the bright side, once you all have brushed up on your 6805 assembly skills, we can create an extender that simply replaces the entire flash contents. That opens up quite a few possibilities, huh?

Post by **The Robman** » Sat Dec 11, 2004 9:40 am

mr_d_p_gumby wrote:On the bright side, once you all have brushed up on your 6805 assembly skills, we can create an extender that simply replaces the entire flash contents. That opens up quite a few possibilities, huh?

Do you think that's likely to be possible? I've got to imagine that UEI would have made sure the ROM portions were protected before they elected to use it, especially as they know that we're out here ready to hack away at it.

mr_d_p_gumby · Post by **mr_d_p_gumby** » Sat Dec 11, 2004 3:42 pm

The Robman wrote:Do you think that's likely to be possible? I've got to imagine that UEI would have made sure the ROM portions were protected before they elected to use it, especially as they know that we're out here ready to hack away at it.

Well, you can always overwrite the flash even if it is protected. (That would assume that we could write all the code from scratch.) However, if someone's got the time & energy, the read-protection is provided by an 8-byte password.

Post by **The Robman** » Sat Dec 11, 2004 5:47 pm

It appears that the chip they'll be using is an MC9S08RC16.

Here is the specific data sheet for this chip.

Here is an index to lots more info on it.

And here is some software that might be useful. And a more recent link (as of 2020).

Post by **The Robman** » Sat Dec 11, 2004 11:14 pm

I have a hybrid remote that has the new HCS08 chip and an EEPROM on board. It also has the regular EEPROm based 6-pin along with a soldered on 6-pin that I presume is the same as the 6-pin on the new remotes.

Here's how the pins are connected.

1: pin 24 which is PTD0/BKGD/MS
2: ground (and pin 7, which is Vss)
3: not conencted
4: pin 25 which is PTD1/RESET
5: not connected
6: pin 6, which is Vdd

I was also curious where the SDA and SCL pins from the EEPROM went:

SDA: pin 26, which is PTD2/IRQ
SCL: pin 30, which is PTD4/ACMP1-

Herbie · Post by **Herbie** » Mon Dec 13, 2004 12:46 pm

That lines up with the "Standard BDM Tool Connector" pinout in that chip spec.

Maybe I'll ask around about what one of the standard development tools would cost... hmm...

Post by **The Robman** » Mon Dec 13, 2004 3:04 pm

Check the Metro Werks link above as you can download a free evaluation copy of their software.

andyross · Post by **andyross** » Sat Dec 18, 2004 10:50 am

Is this new chip the one being used in the Comcast silver remotes?

Post by **The Robman** » Sat Dec 18, 2004 11:43 am

The Comcast "JP1.1" remotes use an SST 65P542R flash chip:
http://www.hifi-remote.com/files/chip-m ... 5P542R.pdf

jherrick · Post by **jherrick** » Thu Feb 17, 2005 7:27 am

This looks interesting...
http://www.newark.com/eflyer/softec/