Firmware ROM

1. Purpose and Scope

The firmware subsystem provides 128 KiB of nonvolatile storage using four Atmel AT28C256-15PU EEPROMs connected to the 16-bit MC68EC000 data bus.

This page documents the electrical interface between the firmware EEPROMs and the CPU bus. It defines the EEPROM address and data wiring, device control signals, firmware read/write policy, bus-cycle completion, timing requirements, electrical loading, and local PCB implementation.

Global address ownership is defined by Bus and Decode. That logic provides the following byte-specific active-low firmware selection signals:

ROM0_UDS_n
ROM0_LDS_n
ROM1_UDS_n
ROM1_LDS_n

These signals identify the firmware half and CPU byte lane participating in a bus cycle. This page determines how those selections control the physical AT28C256 /CE, /OE, and /WE inputs.

A chip select identifies the device; output enable controls whether it drives the bus. During a write, the CPU supplies the data and all EEPROM outputs must be disabled.

Timing below uses the AT28C256-15 read limits and the MC68EC000 10 MHz bus specifications. The read-delay circuit feeds ROM_DTACK_n into the shared completion tree in Bus and Decode and takes its clock from a spare U_DRAM_CLK_BUF channel. Board timing verification remains before construction.

A signal ending in _n, or written with a leading slash, is active low: 0 means asserted and 1 means inactive. HI and LO name byte lanes; ROM0 and ROM1 name the two 64 KiB halves.

2. Physical EEPROM Organization

The firmware store uses four Atmel AT28C256-15PU EEPROMs. Each device is organized as 32K x 8 bits. The four devices are arranged as two 32K x 16-bit firmware halves.

Within each half, the high-byte and low-byte EEPROMs share the same address and are selected independently according to the MC68EC000 byte strobes. Together, one high/low pair behaves as a 32K x 16-bit memory.

Each high/low pair stores 32,768 words, or 64 KiB. Two pairs provide 128 KiB. A word read selects both devices in one pair.

All four EEPROMs receive the same fifteen word-address bits:

CPU A1  -> EEPROM A0
CPU A2  -> EEPROM A1
...
CPU A15 -> EEPROM A14

CPU A16 is not connected to an EEPROM address input. It selects firmware half 0 or firmware half 1 through the previously defined firmware-half selection logic.

The physical EEPROM organization is identical for the permanent firmware mapping and the temporary boot alias. Both address ranges access the same four devices; only the upstream address-selection logic differs.

3. CPU Address Wiring

Each AT28C256 has fifteen address inputs, A0..A14, selecting one of 32,768 byte locations. The firmware interface maps them directly from CPU A1..A15.

CPU A1  -> AT28C256 A0
CPU A2  -> AT28C256 A1
CPU A3  -> AT28C256 A2
...
CPU A15 -> AT28C256 A14

This wiring is identical on ROM0_HI, ROM0_LO, ROM1_HI, and ROM1_LO.

Each range maps in ascending order. CPU A1 connects to EEPROM A0 on pin 10, and CPU A15 connects to EEPROM A14 on pin 1.

CPU A0 is exposed by the processor but is not wired to an EEPROM address input or to firmware-half selection. On the 16-bit bus, the active-low /UDS and /LDS strobes select the upper and lower EEPROM byte lanes.

CPU word address
   |
   +-- A1..A15 -> EEPROM A0..A14
   |
   +-- /UDS    -> high-byte device selection
   |
   +-- /LDS    -> low-byte device selection

One EEPROM address therefore corresponds to one 16-bit CPU word. The high-byte and low-byte EEPROMs in a firmware half receive the same address; the byte strobes determine which device participates in the transfer.

CPU A16 connects only to the firmware-half decode in Bus and Decode. It does not connect to an AT28C256 address pin.

A16 = 0 -> firmware half 0
A16 = 1 -> firmware half 1

No address translation occurs inside the firmware subsystem. The same physical EEPROM address wiring is used through the permanent firmware mapping and through the temporary boot alias.

4. CPU Data-Bus Wiring

The two upper EEPROMs connect to D15..D8, and the two lower EEPROMs connect to D7..D0. Every range below maps in ascending signal order.

An upper EEPROM's I/O0 connects to D8 and I/O7 to D15. A lower EEPROM's I/O0 connects to D0 and I/O7 to D7. The decoder outputs ROM0_UDS_n, ROM0_LDS_n, ROM1_UDS_n, and ROM1_LDS_n connect to the matching EEPROM /CE pins.

The control connections below determine when these data pins drive the bus. Both EEPROMs on a given byte lane share its eight CPU wires.

Microchip, AT28C256 datasheet, sections 1 and 2; and Bus and Decode, firmware bank and byte-lane selection.

5. Permanent and Boot-Alias Address Mapping

The 128 KiB physical firmware image has two CPU mappings. The permanent mapping is always available. The low-address boot alias is available only while the motherboard boot overlay is enabled.

These ranges do not represent separate firmware stores. The permanent mapping and boot alias access the same four EEPROMs, so a corresponding address reads the same stored byte through either mapping.

$000000-$00FFFF  --+
                   +--> ROM0_HI + ROM0_LO
$FE0000-$FEFFFF  --+

$010000-$01FFFF  --+
                   +--> ROM1_HI + ROM1_LO
$FF0000-$FFFFFF  --+

Bus and Decode owns address qualification and boot-overlay state. The EEPROM interface receives the same firmware-cycle and byte-lane signals for either mapping; it does not distinguish a permanent access from a boot-alias access.

6. Firmware-Half Selection

CPU address bit A16 selects the 64 KiB half of the physical firmware store during an active firmware cycle.

A16 = 0 -> firmware half 0
A16 = 1 -> firmware half 1

The address decoder supplies the active-low half-selection signals ROM_BANK0_n and ROM_BANK1_n. Their definitions are:

ROM_BANK0_n = ROM_CYCLE_n OR A16
ROM_BANK1_n = ROM_CYCLE_n OR A16_n

Only one half is eligible during a valid firmware access. The byte-lane signals in the next section decide whether its upper EEPROM, lower EEPROM, or both EEPROMs are selected.

7. Byte-Lane Selection

Each firmware half contains an upper EEPROM on CPU D15..D8 and a lower EEPROM on D7..D0. The MC68EC000's active-low /UDS and /LDS strobes select the participating byte lane.

HI device -> CPU D15..D8 -> /UDS
LO device -> CPU D7..D0  -> /LDS

The decoder combines each active-low bank select with its matching byte strobe:

ROM0_UDS_n = ROM_BANK0_n OR UDS_n
ROM0_LDS_n = ROM_BANK0_n OR LDS_n
ROM1_UDS_n = ROM_BANK1_n OR UDS_n
ROM1_LDS_n = ROM_BANK1_n OR LDS_n

The chip-enable signals identify the EEPROMs participating in the cycle. The control-signal section defines the separate /CE, /OE, and /WE behavior that permits a selected EEPROM to drive the CPU data bus.

Bus and Decode, firmware ROM cycle, bank, and byte-lane selection; and AT28C256 datasheet, section 2.

8. EEPROM Control-Signal Architecture

Each AT28C256 has three active-low control inputs: /CE, /OE, and /WE. They have separate jobs. The device reads only when /CE and /OE are low and /WE is high. Its outputs are high-impedance when either /CE or /OE is high.

Chip Enable

The byte-specific decoder outputs already include firmware-cycle, firmware-half, and CPU byte-lane qualification. They connect directly to the matching AT28C256 /CE pin:

ROM0_UDS_n -> ROM0_HI /CE
ROM0_LDS_n -> ROM0_LO /CE
ROM1_UDS_n -> ROM1_HI /CE
ROM1_LDS_n -> ROM1_LO /CE

Output Enable

ROM_OE_n is a local name for the existing READ_n net. It adds no inverter or buffer:

ROM_OE_n = READ_n = NOT R/W

R/W = 1: READ_n = 0, EEPROM /OE inputs low
R/W = 0: READ_n = 1, EEPROM /OE inputs high

During a CPU read, a selected EEPROM can drive its byte lane. During a CPU write, READ_n holds every EEPROM /OE high, so the CPU is the only defined data-bus driver. An EEPROM whose /CE is inactive remains high-impedance even while the shared READ_n signal is low.

Write Enable

Every EEPROM /WE pin connects directly to +5 V:

ROM0_HI /WE -> +5 V
ROM0_LO /WE -> +5 V
ROM1_HI /WE -> +5 V
ROM1_LO /WE -> +5 V

No CPU control signal, address-decode output, or motherboard logic signal connects to an EEPROM /WE input. Since a byte or page write needs a low pulse on /WE or /CE with the other write condition satisfied and /OE high, the permanent high /WE connection prevents the CPU from initiating a programming cycle.

Microchip, AT28C256 datasheet, sections 2 and 6; and Bus and Decode, firmware bank, byte-lane, and read qualification.

all AT28C256 /WE inputs = +5 V

9. Read-Cycle Behavior

Firmware reads use the AT28C256 asynchronous interface. Each EEPROM receives its own byte-specific /CE; all four share ROM_OE_n. Every /WE stays high.

ROM_OE_n = READ_n = NOT R/W

CPU read:  R/W = 1, /OE = 0, /WE = 1
CPU write: R/W = 0, /OE = 1, /WE = 1

A device drives data only with /CE = 0, /OE = 0, and /WE = 1. An unselected EEPROM stays high-impedance even when the common output enable is low. This follows the AT28C256 operating-mode table, section 6.1.

A 16-bit read asserts both byte strobes: the selected HI device drives D15..D8 and the LO device drives D7..D0. An even-address byte read uses HI; an odd-address byte read uses LO. The firmware subsystem leaves the other lane undriven on a byte read.

Read Access Timing

These are parallel requirements with different starting events. Evaluate each selected EEPROM at its pins:

t_data_valid = max(t_address_valid + 150 ns,
                   t_CE_low        + 150 ns,
                   t_OE_low        +  70 ns)

The read-waveform note allows /CE to follow the address by tACC - tCE without extending address access time. That allowance is zero for the -15 part. Decode delay adds to the path through chip enable; it cannot be absorbed into the 150 ns address specification.

CPU address and control
  -> address / overlay decode -> half select -> byte select
  -> EEPROM /CE -> valid EEPROM data -> valid CPU data

Selected read request -> clocked delay -> ROM_DTACK_n
  -> shared completion tree -> CPU /DTACK -> CPU data sampling

The delay runs alongside the EEPROM access. It does not detect data validity. Section 11 checks that it waits long enough. Source: AT28C256, sections 6.2-6.5.

10. ROM /DTACK Generation

ROM_DTACK_n acknowledges a selected firmware read after its data has had time to settle. It is one completion input to the U_DTACK_A SN74F21N stage of the shared acknowledgement tree in Bus and Decode. Firmware writes receive no ROM acknowledgement and reach the motherboard timeout, which asserts /BERR. The timeout and all other responders must preserve the firmware address ownership defined in Bus and Decode.

Read-Request Qualification

The names below are aliases for the existing byte-select wires. They do not add another decode stage.

ROM0_HI_CE_n = ROM0_UDS_n
ROM0_LO_CE_n = ROM0_LDS_n
ROM1_HI_CE_n = ROM1_UDS_n
ROM1_LO_CE_n = ROM1_LDS_n

ROM_BYTE_CYCLE_n = ROM0_HI_CE_n AND ROM0_LO_CE_n
                   AND ROM1_HI_CE_n AND ROM1_LO_CE_n
ROM_READ_REQ_n = ROM_BYTE_CYCLE_n OR ROM_OE_n
ROM_READ_ACTIVE = NOT ROM_READ_REQ_n

Selected Delay Architecture

Use two SN74AHCT74N dual flip-flops as a four-stage shift register on a buffered 10 MHz clock. Stage 1 samples ROM_READ_ACTIVE; each later stage samples the preceding stage. Clear all stages between bus cycles and during board reset. Tie every asynchronous preset high.

ROM_CLK = CPU_CLK_10 via U_DRAM_CLK_BUF spare channel
ROM_AS_ACTIVE = NOT AS_n
ROM_SHIFT_CLR_n = RESET_n AND ROM_AS_ACTIVE

On each rising ROM_CLK edge, when ROM_SHIFT_CLR_n = 1:
  Q1 <- ROM_READ_ACTIVE
  Q2 <- Q1
  Q3 <- Q2
  Q4 <- Q3

When ROM_SHIFT_CLR_n = 0:
  Q1 = Q2 = Q3 = Q4 = 0

ROM_ACK_BLOCK_n = ROM_READ_REQ_n OR Q4_n
ROM_DTACK_n = AS_n OR ROM_ACK_BLOCK_n

All four assignments use the old stage values. In normal operation, the first sampled 1 reaches Q4 after three further clock periods. The request must stay active throughout the read. A write or a cycle with no selected byte keeps ROM_ACK_BLOCK_n high. The final OR gate releases the acknowledgement directly from AS_n, without waiting for the shift register to clear.

This is not a fixed CPU wait count. The decoded request is not phase-aligned with the clock. Stage 1 can violate setup time; stages 2-4 provide settling time. Recovery at clear release, clock skew, and metastability are on the verification list before the calculated latency is treated as a hardware guarantee. No RC delay or chain of nominal gate delays sets the read duration.

Through-Hole Gate and Pin Map

These are new local reference designators. All parts use +5 V and ground. The existing READ_n inverter and byte-select gates remain upstream.

Tie unused HCT21 inputs 9, 10, 12, 13 low; leave pin 8 open and its NC pins 3 and 11 unconnected. Tie unused inverter inputs 5, 9, 11, 13 and unused HCT08 inputs 4, 5, 9, 10, 12, 13 low; leave their outputs open. U_ROM_OR gate 4 is unused: tie inputs 12 and 13 low and leave output pin 11 open.

Motherboard Integration

ROM_DTACK_n connects to U_DTACK_A pin 2 in Bus and Decode, the input its completion tree already reserves for the firmware ROM. That tree uses two SN74F21N AND stages and a dedicated SN74F32N timeout mask (U_OR_DTACK), so the shared acknowledgement-release path is 17.2 ns and no HCT final gate is moved. Do not connect two push-pull outputs together.

ROM_CLK uses a spare channel of U_DRAM_CLK_BUF, with pin 15 fed from DRAM_CLK_10 and pin 5 driving the four flip-flop clocks, so CPU_CLK_10 loading in Clock and Reset is unchanged. The 20 MHz divider node is unused by the ROM circuit. See dram.html for the buffer pin assignment.

Sources: SN74AHCT74, sections 5 and 6, SN74AHCT32, sections 5 and 6, CD74HCT21, SN74HCT04, SN74HCT08, and CD74ACT244.

11. Read Timing Verification

Use the 10 MHz column of M68000 User's Manual, section 10.14, pages 10-24 through 10-26, which explicitly covers the MC68EC000. The generic processor table in section 10.9 is not the source for these bus limits. The separate clock-waveform questions in Clock and Reset still apply.

Worst-Case Paths

Logic calculations use 4.5 V, loads at or below 50 pF, and the -40 to +85 C limits. The board clock chain limits the complete system to 0-70 C. EEPROM read access is specified with the section 6.5 100 pF test load; output disable has a separate 5 pF condition. Trace delay, threshold differences, clock skew, and excess loading are not included in the sums below.

The 99.990 ns period is the tolerance-only fast corner of the project's 40 MHz +/-100 ppm source divided by four. This is slightly above the CPU's nominal 10 MHz rating. It does not establish a new processor speed rating or include clock aging and jitter.

For an ordinary stable read, each selected CE is low and the address is valid before the request reaches stage 1. Three further periods provide about 300 ns against a 150 ns EEPROM access requirement. Check both CEs on a word read: the AND merge detects the first selected lane, so the later lane's assertion must also fall within that budget. Address, lane selects, and direction must stay stable until completion.

For every selected byte lane:
  max(t_address + 150, t_CE + 150, t_OE + 70)
      + board_data_delay + 5 ns <= CPU_data_sampling_time

For acknowledgement recognition:
  CPU_DTACK_low_time + 5 ns <= chosen_CPU_falling_edge

For release:
  26.2 ns + board_control_delay <= 110 ns

A conservative normal-operation estimate from stable CPU decode inputs to CPU DTACK is 252 + 68 + 5 + 400.040 + 10 + 18 + 17.2 = 770.240 ns, before board delay. It allows one clock period to capture the request, then three more to reach stage 4. It is far below the documented 51.1 us timeout boundary. It is not a metastability bound or a measured CPU bus-cycle duration.

Four flip-flops do not mean four CPU wait states. Decode delay, request phase, clock-buffer delay, and the 17.2 ns completion tree determine which falling edge recognizes DTACK. Count wait states against the S4 sampling point in the CPU bus waveform after these phases have been resolved. No zero-wait or fixed-wait claim is made.

Metastability and Clear Recovery

ROM_READ_ACTIVE is asynchronous to ROM_CLK, so a stage-1 sample can fall in the setup or hold window and drive U_ROM_DELAY_A stage 1 metastable. The SN74AHCT74N datasheet does not publish the metastability time constants, so a numeric MTBF stays a bench measurement. The consequence is bounded on paper.

• The request is level-held for the whole bus cycle: ROM_READ_REQ_n stays low until AS_n negates. A missed or metastable stage-1 sample is re-presented on the next ROM_CLK edge.
• ROM_ACK_BLOCK_n = ROM_READ_REQ_n OR Q4_n and ROM_DTACK_n = AS_n OR ROM_ACK_BLOCK_n. ROM_DTACK_n cannot assert while ROM_READ_REQ_n or AS_n is high, so a stage-1 error can only postpone the acknowledgement, never assert it early or falsely.
• Three ROM_CLK periods separate stage 1 from stage 4, and each stage has the 84.990 ns stage-to-stage window from the budget table to settle. Each added stage multiplies the resolution time before Q4 is first used.
• Worst case, an unresolved stage-1 sample adds one ROM_CLK period of latency. That is far inside the 51.1 us bus-timeout boundary, so the cycle still ends with /DTACK, not /BERR.

ROM_SHIFT_CLR_n releases when AS_n asserts at the start of the cycle. If that release violates the 3.5 ns clear-recovery time before a ROM_CLK edge, stage 1 may hold an indeterminate value for that one edge. The level-held request and the qualified acknowledgement make this the same one-period case as above. The open item is the numeric failure rate.

Acknowledgement Assertion and Release

ROM_DTACK_n reaches the CPU through the Bus and Decode tree: two SN74F21N stages then the SN74F32N timeout mask.

• Assertion: the fourth clock edge to ROM_DTACK_n low is 10 + 9 + 9 = 28 ns (SN74AHCT74N CLK-to-Q and U_ROM_OR gates 2 and 3). The FAST tree adds 5.5 + 5.5 + 6.3 = 17.3 ns tPHL, for 45.3 ns from that edge before board delay. The CPU recognizes it on the next falling edge that meets the 5 ns #47 setup; a late arrival costs one wait state, which is allowed.
• Release: AS_n high to ROM_DTACK_n high is 9 ns through U_ROM_OR gate 3, then 5.3 + 5.3 + 6.6 = 17.2 ns tPLH through the tree. 26.2 ns total against the 110 ns #28 limit leaves 83.8 ns for board delay.
• ROM_DTACK_n is the single push-pull output of U_ROM_OR gate 3 driving one U_DTACK_A input. It is not wire-ORed.

The open item is measuring these two edges at the CPU pins with the other completion inputs present.

Reset and Abort Clearing

• ROM_SHIFT_CLR_n = RESET_n AND ROM_AS_ACTIVE. Either RESET_n low or AS_n high forces all four stages to 0 asynchronously, so Q4 falls, ROM_ACK_BLOCK_n rises, and ROM_DTACK_n rises before the next cycle.
• A timeout or aborted cycle negates AS_n, which releases ROM_DTACK_n through its AS_n term and clears the shift register at the same time. No stale Q4 survives into the next cycle.
• Reset during a read holds the stages cleared while RESET_n is low. The first ROM_CLK edge after release starts a fresh capture; the chain retains no state of its own.
• AS negation to cleared stages is 25 + 30 + 13 = 68 ns, inside the 105 ns minimum AS / DS-inactive interval of #15, so the chain is always clear before the next request can be sampled.

The open item is capturing consecutive reads, reset during a read, and aborted cycles on the board to confirm the analysis.

Checks Needed Before Timing Sign-Off

These items need the assembled board. The analysis above bounds the behavior each one measures.

Sources: Bus and Decode, timing and timeout tables, Clock and Reset, clock tolerance and loading, and the device datasheets linked in sections 9 and 10.

12. Boot-Vector Verification

Reset enables the low-address ROM overlay. The CPU reads the initial supervisor stack pointer from bytes 0-3 and the initial program counter from bytes 4-7. On the 16-bit bus these are four word reads, all from ROM0_HI and ROM0_LO with both strobes active. The 68000 stores the most significant byte first.

For a 128 KiB image F, split the programmer files as follows. Indices and lengths are bytes; each output is exactly 32 KiB.

ROM0_HI[i] = F[0x00000 + 2*i]
ROM0_LO[i] = F[0x00001 + 2*i]
ROM1_HI[i] = F[0x10000 + 2*i]
ROM1_LO[i] = F[0x10001 + 2*i]
0 <= i < 0x8000

The initial SSP must be even and allow downward stack writes into initialized writable RAM. With the documented contiguous 4 MiB RAM, $00400000 is a possible top-of-RAM value: the first push writes below it. This is an example, not an assigned firmware value. RAM initialization and refresh must work before stack use.

Prefer an even reset PC in the permanent range $00FE0000-$00FFFFFF, pointing past the vector data to executable code. Execute from that permanent mapping before writing the overlay-disable register at $E80001. Low memory then becomes RAM; initialize its exception vectors before enabling interrupts or operations that may take an exception.

The wiring and image-split equations establish vector placement. No firmware binary or programmed-chip readback is present here, so actual SSP, reset PC, instruction bytes, and checksums remain unchecked. Read back each programmed device and reassemble the four files; the result must match the original image byte for byte. On hardware, capture the four vector fetches and the first instruction fetch.

Sources: M68000 User's Manual, sections 2, 5 and 6 (data organization, bus operation and reset), Memory Map, and System Control.

13. Electrical Compatibility and Fanout

Use the motherboard's regulated 5 V +/-5% rail. This lies within the EEPROM and HCT/AHCT 4.5-5.5 V operating ranges. All interfaces here use TTL-compatible input thresholds: high at 2.0 V or above, low at 0.8 V or below.

The EEPROM-to-CPU high margin is only 0.40 V at its rated source current. Include every disabled output, receiver, pull resistor, and expansion-bus connection when calculating load. Do not use the output current rating as a capacitance limit.

EEPROM capacitances are characterized at 1 MHz and 25 C; they are not production-tested limits over every condition. The CPU's 20 pF input figure is periodically sampled. These are design budgets, not measurements of the assembled board.

One byte lane has two EEPROM outputs connected, but only one may drive. At least the inactive device's capacitance loads the active output. Avoid passive pull-downs that consume the EEPROM's small high-state current budget. Buffer expansion connections as specified in Bus and Decode.

Budget up to 50 mA active supply current per EEPROM under the datasheet test condition, or 200 mA for four devices as a conservative allocation, plus output and logic current. Do not assume the 200 uA CMOS standby value from a TTL-high CE alone; it requires CE near VCC. The TTL standby limit is 3 mA per device.

Sources: AT28C256, sections 4.2-4.4, M68000 User's Manual, section 10.13, and the HCT/AHCT electrical tables linked in section 10.

14. Decoupling / PCB Notes

The capacitor values are starting layout choices. Verify the 5 V rail at the EEPROM pins during word reads and bus turnaround. Do not attach an LED or long header stub directly to a data, clock, or completion net. Use a buffered diagnostic output if a permanent indicator is needed.

15. Internal Signal Reference

Aliases below identify the same wire. Q1-Q4 are active-high stored states; their names do not indicate CPU wait-state numbers.