View Single Post
  #9   Report Post  
Tim H.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909


"Bruce Esquibel" wrote in message
...
Jack ) wrote:
: You probably corrupted the EEPROM when you read it. I just learned about
: this when I was reading an article about security chips. If you try to

read
: them with normal reader/writers, they get corrupted due to the fact that
: during the read process, the reader tries to write something on the

chip, to
: test it out and this corrupts the chip.

I really don't think this is true of that family for the 93C46.

We used to used those things for something (think it was for alarm panels)
and although some in the family had the "protect bit", this "blowing of

it"
to enable security only disabled reading the rom. Pretty sure you could

sit
there all day and try reading it, nothing would happen.


I tend to agree. If I did just a normal read on a protected chip, it would
most likely be all 0s/1s. I don't think Kenwood spent THAT much $$ on R&D to
protect this stereo.


It's a rather old device.

More likely the OP put it in wrong back into the socket, the socket itself
is bad or the socket into the circuit board. Maybe static discharge. I
really think it's a safe guess (although the datasheets have to be online
somewhere to prove it) that it has no "self destruct mode".


No, it wasn't put in backwards. The PCB has markings for pin 1, so I got
that right. I managed to get a datasheet for the EEPROM from a different
manufacturer; and I made sure it matched the pinout (pins 1 and 8 are N.C.).

ESD is possibility. I did take the bare board to my friend to show him which
chip was burnt up.

This head unit has an NEC microcontroller (uPD178018) which interfaces to
the EEPROM. If I reset the micro and scope the EEPROM pins, I just see the
data/clock lines go high and that's it. And yes, I have the trigger set up
right to capture it.

I would like to get ahold of a service manual for this unit in case it
mentions anything I've yet to find out.


Pretty sure blowing the protect bit just internally disconnected the rom
address space from being accessed and sent out to the serial i/o.


I made no attempt to blow the protect bit. As you say, if that security
feature had been implemented, I would've seen it when I initially dumped the
EEPROM.

Thanks,

Tim


-bruce