Flash NAND Lite memory programmer! TSOP48

  The assumption of the project was to create from the basics a programmer for popular Flash NAND type memory, to fill the gap in the market in the segment of low-budget programmers. Sometimes it is necessary to read the Flash NAND system located eg in a pendrive, but also various types of navigations, modems, routers, TV sets, etc. It is not necessarily right to purchase a professional tool at a price of at least 5x higher to read / program one system. I have been dealing with Flash NANDs for a relatively long time, I can say for just over 3 years. When I first used such a memory for the designed device, I saw the same advantages: low price, large capacity, ease of use. After years of use, I also see defects, but about that in a moment.

The programmer designed by me, due to the cost cutting, contains only one slot for inserting Flash NAND memory in the TSOP48 housing, soldered permanently.

 

The whole is powered from the USB port with 5.0V voltage, while the FlashNAND memory system and the processor is supplied with 3.3V voltage supplied from the LDO stabilizer TPS781330220. The advantage of this stabilizer is built-in 150mA overcurrent protection, which works great in the case of reverse inserting the system into the stand, which does not damage the memory chip, as well as the fact that I had them in large quantities in the warehouse.

I added two LEDs, indicating the voltage of 5.0V (D5), and 3.3V (D1), after which you can quickly check if everything is in order.

I used a full FlashNAND memory connection system, in which there are four CE lines, and four RB lines, thanks to which it is possible to handle all types of memory available in the TSOP48 enclosure, and the 3.3V power supply is fed only to the VSS pins (13 , 36), VCC (12.37).

The entire programmer is managed by the XMEGA-A4U processor, which perfectly fits in terms of the number of pins with which the software communicates on a PC, through the USB & lt; & gt; FT245.
I used here a very interesting solution based on a parallel bus, connecting the data lines DATA0-7 of the FT245 system directly to the XMEGA processor port, additionally connecting them to the FlashNAND memory system.

I gained a high speed of data transmission and great freedom of communication.
The results I received surprised me:

FT245 & lt; & gt; XMEGA = 980kB / s
NAND & lt; & gt; XMEGA = 2.7MB / s

Thus, the sample communication then looks like:
1. PC - & gt; XMEGA - read command from NAND memory
2. PC & lt; - XMEGA - start reading package
2. XMEGA - & gt; NAND - preparation for reading, sequence execution
3. PC & lt; - NAND - transfer data directly from NAND to PC
4. XMEGA & lt; - NAND - data listening counting CRC32
5. XMEGA - & gt; NAND - end of reading
6. PC & lt; - XMEGA - end of the read packet

In this general procedure, taking into account the protocol overhead and interchangeable communication with the PC, I achieve a real transfer rate of 750kB / s considering the reading time of FlashNAND at 60us.

The programmer also has the ability to measure the time of reading / writing / deleting pages. It performs completely hardware in XMEGA using the Timer with an accuracy of 1us. Due to the fact that the RB outputs of the FlashNAND memory chip are only pulled up by the pull-up resistors in XMEGA, these values differ slightly from those in the documentation. How much, I have to measure it with an oscilloscope. However, it gives us the opportunity to assess the diagnostic of a given FlashNAND memory chip. For example, you can see that some pages are read slightly faster than others. The difference is sometimes significant.

Example: K9GAG08U0E-SCB0
Block 0, page 0: read: 197us
Block 0, page 1: read: 198us
Block 0, page 2: reading: 235us
Block 0, page 3: read: 198us
Block 0, page 4: reading: 236us

Example: MT29F64G08CBAAAWP
Block 0, page 0: reading: 42us
Block 0, page 1: reading: 43us
Block 0, page 2: reading: 42us
Block 0, page 3: reading: 42us
Block 0, page 4: reading: 58us
Block 0, page 5: reading: 58us
Block 0, page 6: reading: 42us

Example: K9F5608U0C-YIB0
Block 0, page 0: read: 9us
Block 0, page 1: read: 9us
Block 0, page 2: reading: 8us
Block 0, page 3: reading: 8us
Block 0, page 4: reading: 8us
Block 0, page 5: reading: 8us
Block 0, page 6: reading: 8us

The programmer also has detection of the system, for this purpose after inserting the system and inserting the programmer into USB the first step is setting the line low / WP to protect the FlashNAND memory system from accidental deletion, waiting 1000ms and after this time the RESET command is sent to the memory then the memory ID is read.

If the loaded identifier has non-different values, eg: 0x00, 0x00, 0x00, then the system is marked as undiscovered and the red LED lights up, and if these values differ from each other, then the green LED lights up. This function has been added to allow you to check whether everything is okay and you can take a PC program right after you insert the system into the stand, or you should improve something in the layout.


Estimated costs about 105 PLN. Assuming that we perform immediately 5 pieces.
The worst is with the TSOP48 socket, which unfortunately has to be imported from China.

The HEX file of the current version (NANDLite_r1.0_1003a.zip) of the programmer is in the appendix, and the off-line PC application (NANDLite_v1.0.1003.43.zip)

The latest version of the software can be found under the link Link which contains the latest signatures of supported chips.

I warmly welcome .

I have these questions:

1. Do you have to sell PCB / TSOP48?
2. For what purpose has FT245 been used, would it be simpler to use avra with hardware USB or v-usb support?
3. Do you plan to provide source codes or write software for Linux?

Greetings.

And I have these answers:

1. I collect orders on a popular auction site.
2. FT245 was used to speed up the transfer from NAND to PC, this is the solution towards FT232H, so that in the next programmer's revision, you can get 8MB / s without changing the software on the PC. The second issue is the use of VID / PID. When I buy a FT245, I have a case.
3. I do not plan to share source code, although it may change sometime. Under Linux, unfortunately, I am not able to write software.

I have already found the programmer on the well-known auction site
As for the software, I am able to support the project and port it for linux.

I am very happy, I will have to wait a bit, because the version 2.0 will be planned, in which, unfortunately, we will have to re-order the commands for reading the pages and their addresses due to the fact that not all memories are addressed in a similar way.

For example, TOSHIBA came up with the addressing of pages in a block using an additional command, for example:
TC58NVG7T2JTA00
https://www.elektroda.pl/rtvforum/viewtopic.php?p=15967618&highlight=#15967618

The blocks are addressed 0..8311 and here it is fine, while the pages in the block are addressed as follows:
Page: 0..85, and you know that there are 258 pages in the block. And the choice of these three groups of pages within the block is by means of an additional command sent to the FlashNAND memory.

Thanks to this, the entire memory area and its addressing is a discontinuous space.


At the moment I plan to work out corrective codes. For this purpose, I need sample batch from devices, so that you can practice a bit on them and check exactly how the correction data is located.

My intention is to load the memory, press the Analyze button and wait for the program to calculate all codes, it will detect the type itself, ECC, BCH, ReedSolomon, corrects the wrong bits and will write a completely healthy file, which will later be used to save in the new memory .

The programmer is great conceived and made. I have a factory programmer myself, but its price was deadly. There is only a problem because the 32M memory and more can be read, only because of the bad blocks it can not be easily copied. It would be useful to have software that could mount the file system used in memory. For example, the ubifs system could be handled in Linux using the software emulator of nand memory. additionally, reading files from a damaged pendrive from the bin itself is not easy because file systems mix data to save cells. Another problem is the different ways of implementing the determination of bad sectors in the separation areas and / or the bad sectors table.

Thank you for positive words.

As for filesystems, I read about UBIFS, but I have no batch to confront the acquired knowledge with the actual FlashNAND memory content. According to the documentation, there is not a high level of complexity with UBIFS, it is relatively well described, so there are opportunities and the future in this to work out.

As for the recovery of data from the pendrive, for the moment I have made one experience consisting in saving a CompactFlash 8GB card with a specially prepared content in which each sector of 512 bytes was numbered. Then I desoldered the memory from the card and inserting it into the programmer I read its contents. And in fact, the sectors are very confused, but there seems to be some order and order in it. But to start analyzing such content, you need to start controlling the redundant bits to make sure that the data we read is correct.

If anyone can send me any batch for diagnostic and research purposes, I am serving my specially prepared forum, or an appropriate FTP account. I have unlimited capacity and high speed connection.

In principle, data recovery comes down to mathematical calculations, if everything agrees, we have 100% certainty that everything is recovered.


The price of the factory programmer is also dictated by the possibilities. Such a programmer, is much faster and is known - universal, so we will put both the TSOP48 system for 3.3V, but also 1.8V, and 1.2V as needed. You pay for it, so it has to cost.

The project is interesting, but in my opinion it will be suitable only for copying flashs from one bone to another (after developing the error correction algorithm), with relatively small bones, because the speed is not too big.

In the case of the desire to recover data, it is the balancing of the open door, because the solutions are ready (of course they cost, but unfortunately this is the result of a huge amount of work).
I would like to draw attention to the problems that you will face if you want to recover something after reading:
1. The current TSOP48 bones have power supply for many more legs. Reading the standard VCC (12.37) is largely insufficient
2. TOSP48 is a system less and less mounted on mass storage. The industry is switching to BGA and monoliths.
3. Sometimes you need to work on one bone from 2-7 days to correct errors
4. Currently, each controller uses XORs, of which there are hundreds (controllers and XORs).
5. Data is mixed in a very different way depending on the controller model.
6. The block translation algorithm is different for different controllers.
7. There are a lot of refurbished bones and controllers on the market - they have different pathological solutions.
8. In a large part of the dumps there are inserts in various places (redundant bytes of data) that are managed by the controller program or hardware. For data recovery, you must delete them.
9. Many many other nuances.

I agree that data recovery is mathematics. The cryptology (also mathematics) and algorithmics (also) must be added to this.

If the project developed, I am ready to perform the second and third generation of the programmer. The second one with speed up to 8MB / s, third up to 50MB / s.

I received access to the latest documentation from Micron under certain conditions. However, when browsing PDFs, you can draw interesting conclusions. First of all, the amazing NAND capacity, up to 6Tbit. The second thing is actually multi-bank, and more lines to control, and power up to 1.2V.

As for the memory in the TSOP48 itself, the ONFI documentation clearly states that if the memory is powered from 3.3V, and the I / O voltage is also 3.3V, it is internally connected, so there is no need for additional power supply. In all other cases, two supply voltages should be used.

I agree that by reading this programmer the memory of 8GB, it is about 3 hours, however, it was supposed to be a cheap programmer, so the parameters were slightly weaker.

In addition, the group of recipients of this programmer are amateurs who want to do something occasionally. And if the only compromise is time, in terms of price, then I consider this a good solution. Otherwise, they would invest a lot of money.

Yes, the amount of memory and controllers is gruesome to grasp. That's why most laboratories just let go of Flash memory ...
Standard ONFI standard but life life

Since it releases flash memory, it's a good idea to get on with it

funak wrote:

Since it is forgiving flash memory, it's a good idea to get on with it

Of course. Except you are not aware of what you are writing now
He deals with it on a daily basis. I have quite a lot of experience in this matter because I wrote you about potential problems.
The cheapest professional nand flash reader can be purchased for about 800 PLN. That's why I wrote about balancing open doors

funak wrote:

The worst is with the TSOP48 socket, which unfortunately has to be imported from China.

Nice project - admittedly, I've only seen here the announcement of the sale and the offer on the allegro - nice to know something more

However, as for the TSOP48 stand, they are available in PL, for example, Semicon has them - with the price of PLN 180 is known as far as I remember (but company) ... on the other hand, these cheap Chinese TSOP48 (several dollars each) from my experience are g ... worth, i.e. in my transcriber from DIP48 to TSOP48 already bad (and not much memory was made) - although now the original TNM5000 transceiver is ordered on the YAMAICHI stand (we will see how it will perform) - also cheaper than us alone stand.

However, for USB and speed it may be worth the interest in Cypress layouts

michal_aniol wrote:

funak wrote:

Since it is forgiving flash memory, it is it's a good idea to get on with it

Of course. Except you are not aware of what you are writing now
He deals with it on a daily basis. I have quite a lot of experience in this matter because I wrote you about potential problems.
The cheapest professional nand flash reader can be purchased for around 800 PLN. That's why I wrote about balancing open doors

Flash Extractor?
Quite nice with intuitive dump programming software.


But the PC-3000 Flash is better, although the price with all the snap-ups is able to jump to about 15k PLN. This is what we'll do almost all flashs as long as we can set up all the options and times of the flash bones when it automatically can not detect the type of bone.

mariomario wrote:

But the PC-3000 Flash is better, although the price with all the snap-ups is able to jump to about 15k PLN.

and probably the price because it has the name "Data Recovery"

However, let's face it, the programmer described here is the equipment for amateurs with a small budget for hobbies or "businessmen" who profess theories "buys a sham" because better equipment will not return " Let's face it, this programmer is in the price (or even lower) of a good TSOP48 stand for any programmer with DIL48 ...

So there is nothing to ask ... both a hobbyist and a professional who has money will find something suitable for himself ... For me a nice project, because the hobbists with less money have the chance to play with such memories ...

Can the author comment on the quality of the Chinese stand he uses?

Of course, before I started to assemble the stands, I ordered three Chinese testers (I waited 21-27 days) and among them I chose one which, in my opinion, provides a good quality TSOP48 stand. They were mainly different from inaccurate plastic casting. I do not have any pictures, so I can not present it.

As for durability, I have my only copy from the beginning of the project and it still works. The effects of wear are manifested by the fact that the base slightly springing, however all the contacts still work. I can see that the bottom contacts are slightly dirty, which are not connected to anything. This is the effect of packing the systems straight from the outlet without cleaning the leads.

There is a way:
 

I ordered 2 pieces for tests and I highly appreciate the quality of the socket for the TSOP48 socket. Turned, round contacts perfectly fit into the plate, they are very evenly made, in an ideal raster.

Now I am collecting capital to order a larger number of such sockets to equip them in a new revision. In addition, there are adapters from TSOP48 to BGA / LGA at a dizzying price, so it would be possible to operate in a different enclosure than TSOP48.

I added today in programming NANDLite! generating statistics on transfers (Version 1.0.1014.50).

The results have surprised again how fast FlashNAND memory can be erased.

Two examples:
Deleting K9GAG08U0E-SIB0


Deleting MT29F64G08CBAAAWP

Flash NAND test: NAND512W3A2CN6 in the TSOP48 enclosure.

This memory has sectors of 512 + 16 bytes.
The total capacity of 69 206 016 bytes.

Erasing memory


Write to memory


Verification of memory contents


Reading from memory

Как приобрести в Украине ??
Тема на форуме: http://www.tele-servis.ru/forum/viewtopic.php?t=7617

Hello dear author! Resolve ł & ć & ć programmer. In the face of this problem. I can not ę programmed ć ATXMega hex file. AtmelStudio 7 Flip Flops ć niew ł and ś & # 261 been properly; capacity ś ć hex file. Please ę mi pom ó c explain ś ni ć this problem. Dzi ę ki Constantine.

Hello.

Work continued on the programmer.
At the moment I have already developed a BCH correction code algorithm that allows for correction up to 4 bits in a space of 512 bytes. Soon I will officially join the NANDLite application. However, at the moment I found these codes only in one batch of Flash NAND memory in which there is a UBI file system.

Therefore, I am still looking for any feeds to analyze the structure. Soon, it will also be possible to directly upload batches from the NANDLite application.

The current version of the software 1.0.1014.63 - in the attachment.

funak wrote:

Hello.
However, at the moment I found these codes only in one batch of Flash NAND memory in which there is a UBI file system.

I do not know if such a groping has any sense. Take a look at the NAND support in U-Boat, for example:
http://git.denx.de/?p=u-boot.git;a=tree;f=dri...b;hb=2a48b3a2c4ec0f1775deeac5cfe7e61072b6b894

specifically in nand_base.c you can take a look for the correction selection:

http://git.denx.de/?p=u-boot.git;a=blob;f=dri...b;hb=2a48b3a2c4ec0f1775deeac5cfe7e61072b6b894

If we have a Linux device (and in that case, the U-Boot is the most often), you can infer the above mentioned code about the corrections used, including BCH. If other systems are used, this may look quite different, and most of the commercial systems are unfortunately closed (VxWorks, etc.) and here it may be different ...

The programmer is still developing, as evidenced by the next version of the software.

The new version is already prepared for choosing the interface language, the only thing to do is translate.

In addition, drivers have been added to the application that supports the programmer, it is no longer necessary to search on the Internet suitable for the FTDI system.

The upload function for the NAND Lite server is currently being tested. This will greatly improve the further work on the programmer, especially the operation of badblocks, bit correction etc., where it is just practical to test the developed algorithms for handling the above mentioned issues.

I realize that sending 8GB and more via the Internet is problematic. Hence the idea to deploy programmer users and perform the function of an automatic upladu functioning according to the rule: select files, click send and follow the case.

Below is the current list of supported systems verified by users:

Hi collected programmer has come so XMEGA hex firmware file. checksum calculated for you, but still a mistake. if you can help me send the hex firmware operating mail. djsprut(malpa)mail.ru

Hey, I do not quite understand the purpose of inserting XMEGA and FT245. Would not it be simpler to do everything on FT2232 or USB straight from XMEGA? There are some fancy drivers for FT2232 and most programmers, for example for FPGA, use this one chip.

Yes, I was considering the possibility to control it with FDTI and bit-bang, but the freedom of configuring the pins connected to XMEGA prevailed.

The second thing is, in XMEGA I can use the hardware measurement of read / write / delete time of pages.

Third thing, from the PC application level I send XMEGA a command to perform a specific task and wait for the result. It is convenient for me.

The fourth thing is that the programmer will be extended with additional functionalities, so such an extensive FTDI design - XMEGA - NAND was also thought out from this angle.

Added after 7 [minutes]:

 

Sprut wrote:

some collected programmer has come so XMEGA hex firmware file. checksum calculated for you, but still a mistake. if you can help me send the hex firmware operating mail. djsprut(malpa)mail.ru

In the attachment I put fimware to XMEGA version 1024a.

If you add a task to a wrong block it is the best budget solution.

Hello

I invite you to download the latest version of the application for the NANDLite programmer.
Link

Version 1.0b1014.78
+ Added test functionality of sending batches to the server for structure analysis.


 

The Wsady tab has appeared, where you can add files with the batch, which will be easily sent to the server for analysis.

Currently, the server capacity is 200GB, with time will expand its capacity.

Sent batches will help me to work out data structures for bypassing bad memory blocks, as well as testing ECC data correction algorithms.

Sent files, of course, are anonymous and available only to me.

I attach the version of the NANDLite application without installation, in the attachment.

Thanks for fast reaction. To this day I have received from you 5 batches for the K9GAG08U0E system with a capacity of 2GB. Two things are connected with this:
- the upload system is working properly
- I will start analyzing BAD BLOKS from these systems.

Some of the information I already have worked out, including that he found the BCH ECC error correction algorithm.
Each page with the size of 8kB is divided into 1036 byte fragments, which is secured by an additional 42 bytes of data, allowing to fix 24 erroneous bits. So in total there can be 192 incorrect bits on the page and you will be able to read the information correctly. So, in my opinion: Not bad
Samsung system used: FSR: Flex Sector Remapper.
The right thing to look for was a map with the relocation of damaged blocks, which I hope will help me send me the uploads.

At the same time, I am asking you to submit any feeds for further analysis.
Soon you will be able to download sent batches, direct programming from the Internet and many, many other cool features.

Thank you for supporting NAND Lite!