TFBGA Chip Pinout Help

[ddrecovery]

I have this chip from a very old Motorola V3 phone. Its only 512MB but has some critical photos we need to recovery. This chip is a multi-chip package and I am having difficulty working out the correct pinout for the flash memory side. I have attached an image of the pinout as well as the datasheet. If any of you flash gurus can help it would be much appreciated.

Attachments

M36L0R7050_STMicroelectronics.pdf

(406.68 KiB) Downloaded 531 times

[fzabkar]

Your multi-chip appears to be ball compatible with the M30L0R7000B0 flash-only chip. That is, the RAM balls are not connected (!). However, the "multi" datasheet stipulates that the RAM's output must be disabled to avoid contention on the data bus. I don't know if this still applies if the RAM's power supply is not present (I suspect not).

Simply put, if you have an adapter for the M30L0R7000B0, or similar, then it should work.

M30L0R7000(B/T)0, STMicroelectronics, 128 Mbit (8Mb x16), Multiple Bank, Multi-Level, Burst, 1.8V, Flash Memory :
http://pdf.datasheetcatalog.com/datasheet2/0/01rzqfgx971prpsrg57cw4tzaqwy.pdf

JEDEC STANDARD Common Flash Interface (CFI), JESD68.01, (Minor Revision to JESD68, September 1999):
https://web.archive.org/web/20090306191719/http://www.jedec.org/download/search/jesd68-01.pdf

Attachments

[ddrecovery]

Unfortunately there are no adapters for this particular chip (probably not popular enough), so I trying to do it the hard way. There are pins that I do not recognize such as DU and G and E.

[fzabkar]

The following adapter (US$270) appears to be suitable, but there is no photo of the underside. Hopefully it breaks out to a standard header ???

TFGBA88 Adapter, 8 x 10 mm, for AH-400A:
http://microcontrollershop.com/product_info.php?products_id=5172

This adapter supports the following TF88 devices:

* Micron / ST: M36L0T7050T3ZAQ

The M36L0T7050T3ZAQ appears to have the same ball definitions as your multi-chip.

M36L0T7050T0, ST Microelectronics, 128Mbit (Multiple Bank, Multi-Level, Burst) Flash Memory 32Mbit (2M x16) PSRAM, Multi-Chip Package:
http://pdf.datasheetcatalog.com/datasheet2/8/0i63lyhgf3khkz6gsshcufrozr7y.pdf

[fzabkar]

There are pins that I do not recognize such as DU and G and E.

DU = do not use
E* = Chip Enable (must be low to enable chip)
G*= Output Enable (must be low to enable output when reading)

All the pins are defined in the datasheet.

[fzabkar]

I haven't used this company, but there were two occasions when I required a similar service. You might like to look around.

https://pdi2000.com/component-programming-services/

(If they can program it, they can read it ... obviously)

[ddrecovery]

Many thanks for all the help @fzabkar. Much appreciated.

[HaQue]

Do you know this is not a chip that can be read with VNR, SC or PC3K, even with an adapter? The critical info as Franc said is It is a CFI chip, notice address lines A0 - A22. I have been working on an old phone as well, and had quite a bit of problems so far.

Ive bought different hardware but so far unsuccessful. There seems to be no info in just dumping a CFI chip unless you buy a purpose programmer for lots of $. Actually not much info on homebrewy type CFI at all.

I've bought both the regular and pro versions of Flashcat. [url]http://www.embeddedcomputers.net/products/FlashcatUSB/[/url I believe this programmer should do it. If you have any success I would LOVE to hear about it!

pretty sure this chip is very similar to the one I am working on.

[ddrecovery]

@ HaQue -Thanks for the info. Looks like you saved me some time and money

I have recently purchased a donor phone from eBay as a stand by, so this may be the only way to access the data. Not sure if any unique information is stored on this chip (EMEI, SN etc) which may prevent it working, but I will let you know how I get on.

[fzabkar]

The OP's chip is a 1.8V device. The Flashcat programmer does not appear to support this voltage:

http://www.embeddedcomputers.net/products/FlashcatUSB/

Dual voltage 3.3v or 5v output via selectable switch

Not sure if any unique information is stored on this chip ...

From the datasheet ...

SECURITY

- 64 bit unique device number
– 2112 bit user programmable OTP Cells

[HaQue]

My chip is as well - I have a variable DC benchtop power supply
but I also have the pro ver of the programmer: http://www.embeddedcomputers.net/products/FlashcatUSB_Pro/ which does support 1.8v

[HaQue]

I asked the vendor of the flashcat if devices could be added. I recieved a respose and also sent back a few follow up questions. I dont think an easy task, this is.

"Interface wise, the device is compatible with the NOR software. However, it seems the package to socket adapter would be the hardest part. For me to even find and make a compatible socket would probably be a thousand dollars, give or take. Also, its 1.8V nature, means it would have to be implemented for Mach1 CPLD logic code."

My question:

Thank you for the reply and for the added info.

I haven’t worked with CFI before, so I am just a little uncertain if you are saying that, not counting the no socket problem, software and hardware will read it? Or the CPLD part means you would have to write additional code...

For me a socket is no issue, as I regularly wire monolith USB/SD/MicroSD cards and read with NAND reader. I would be happy to make a breakout PCB, reball the chip and wire it even.

Purpose is data recovery from 2 separate (old) mobile phones.

In your opinion is it a project worth my while pursuing?

reply:

Logically, the XPORT programmer should be able to read/write to the NOR portion of the memory fine. However, unless I am mistaken, the IO logic is 1.8V, so 3.3v may possible damage it. If that is the case, you would have to wire in multiple level shifters. Mach1 CPLD is capable of 1.8v or 3.3v, but it does not have the NOR engine yet (just NAND, since that is what we are focusing on development wise). NOR will be added in the future.

[fzabkar]

deleted

[fzabkar]

FYI, here are the circuit diagrams and repair guides for a Motorola RAZR V3:

https://elektrotanya.com/showresult?what=razr%20v3&kategoria=&kat2=all
https://elektrotanya.com/motorola_razr_v3.rar/download.html
https://elektrotanya.com/motorola_razr_v3_sm.pdf/download.html

BTW, the chip's capacity is 16MB flash + 4MB SRAM, not 512MB.

The chip in the circuit diagram is a PF38F4050L0YBQ0.

Attachments

[HaQue]

so I'm wondering how well the circuit needs to be well designed (trace length, width, close to the chip etc).

If a purpose built pcb would do what the embedded systems engineer was saying.

These are pretty cheap:
http://au.element14.com/adafruit/757/logic-level-converter-4ch-arm/dp/2301651
or
https://www.digikey.com.au/product-detail/en/sparkfun-electronics/BOB-12009/1568-1209-ND/5673795

Side note.. the Mach1 that the engineer ( http://www.embeddedcomputers.net/products/FlashcatUSB_Mach1/ ) mentioned looks to be an offering for data recovery from NAND. IMHO it is a huge undertaking to get near VNR, SC and PC3K. I wonder if it is more aimed at firmware chips than DR from the regular NAND we see on this forum. Very interesting and I will definitely be getting one.

Tangential question.. why aren't chip dumpers using USB3 or 3.1? 128GB over 2.0 is slow a f.

[ddrecovery]

@ fzabkar, the unique info in this chip I was referring to is phone specific information. Sometimes with phones the EMEI or SN are paired to the CPU, if this is not correct the chip will not work in the donor phone.

[HaQue]

@ddrecovery do you still have this case open, I know it is quite old? I think I should be able to say in a week or so if everything I have for a different topic can read these chips. I also have some similar chips (intel) from LG phones to read. I will post results in both threads.

This one is the same chip as yours: http://forum.hddguru.com/viewtopic.php?f=10&t=38520

[ddrecovery]

@ddrecovery do you still have this case open, I know it is quite old? I think I should be able to say in a week or so if everything I have for a different topic can read these chips. I also have some similar chips (intel) from LG phones to read. I will post results in both threads.

This one is the same chip as yours: http://forum.hddguru.com/viewtopic.php?f=10&t=38520

Unfortunately I no longer have this case, however I am sure I can get it back from the client again. I don't think he would have gone anywhere else. Let me know the outcome of your tests and I will see if I can get it returned to me.

[HaQue]

No Problem, just watch the above topic for updates. I have almost all the hardware required now.

[ddrecovery]

No Problem, just watch the above topic for updates. I have almost all the hardware required now.

Will do.