Question about a circuit puzzle

Electronics
1

I’m trying to understand a circuit board that I have.

The main components are an Atmel Atmega16 chip and an Atmel AT45DB04 4Mbit data flash chip.

I’m going to assume that the MCU is doing something fancy with the data in the flash chip, but aside from that, the SO pin of the flash is connected to the Emitter of this NPN transistor. Then the Collector of that is connected to the ATMega chip’s pin 23 (TDO) on fairly thick traces. I’m believing that this is some kind of timing control mechanism to match the timing requirements of the AT45, but that’s just an uneducated guess.

20150224_195015.jpg1003×652 188 KB

I’m looking for some educated guesses :slight_smile:
Cheers,
Mark

2

Boundary SCAN, maybe? The AT35DB04 doesn’t have a JTAG interface. Maybe they’re using the serial interface of the AT35DB04 to include this chip as part of the boundary scan they perform prior to shipping the EVM?

EDIT: No really sure why TDO and SO are playing together like this. Is the TDO net or the SO net connected anywhere else on the EVM?

3

Could the transistor be protecting one or the other during programming?

For example, could the transistor be protecting the AT45DB04’s output while the ATmega16 is being programmed? Then, during normal use, TDO is “serial in” from the AT45DB04’s Serial Output.

4

That is certainly a plausible reason! Thanks…

But wouldnt a diode suffice…

5

It might be because i have not desoldered anything to peak under the chips

6

I think a diode would work for that.

Oh, it could be level translation (if the transistor is a MOSFET). That’s how things like this work…

7

The SMD Code that is printed on the device is clearly marked as “1F”. “1F” is a BC847B NPN Transistor.

According to the data sheet of the BC847B, Mark is correct about the connections to the collector and emitter of the transistor.

8

I too thought of level translation but the sticker (redacted un the pic) says 2.7v.

Even more peculiar is the mere presence of the micro. This is a “rom chip” of sorts… A cartridge that plugs into a machine. I know whats on the flash but its burning a hole in my head why they built it this way lol.

9

“Rom chip” of sorts?

So the SO and TDO lines connected by the NPN could be going to a shared net on the cartridge edge connector?

Is this a cartridge where the mirco is sniffing the requests from the host machine? Maybe then re-programming the Flash on the fly?

Sounds like big brother is keeping a close eye on you. :grin:

10

Lol

…looks out the window…

11

I removed the two ICs from the board to get a better idea of where the traces go.

20170531_081444.jpg1286×1420 501 KB

12

J2 looks suspiciously like an ISP programming port…

13

Yep…kinda stands out doesnt it :wink:

1 Like
14

Think you can learn anything useful by extracting its code?

15

One possible motivation for having a controller in the cartridge is that the contents of the flash chip is encrypted so that directly reading that chip does not give up anything useful. The Atmega may be decrypting as the main device requests the contents.

2 Likes
16

The unpopulated R8 is rather interesting, as well. Likely the board is used for multiple applications - this particular one not requiring pin 19 on the edge connector.

1 Like
17

You can’t extract code from an production AVR. Almost always they set the protection bits.

1 Like
18

This is kind of what I’m leaning to. Either encryption, or compression. Or both.

1 Like