IN THE BEGINNING...
The year was 1991, amazingly coincident with the same year Sonic was born.
I was given a black plastic box- a security module removed from a car. The box had a sticker (and printing on it) that said it was manufactured by CONLOG.
I was given a black plastic box- a security module removed from a car. The box had a sticker (and printing on it) that said it was manufactured by CONLOG.
During the late 80s and well into the 90s, car security was a big deal. Today car security is integrated into the engine management system and it's taken for granted. In 1991, however, vehicle security was something you would have fitted to your vehicle like any other accessory, and it was an optional extra.
At the time, being very naive and stupid, I stripped the PC board within the box for the parts it contained. However I did consider the 40 pin chip that was on the board. Initially I thought (silly naive 16 year old me) it was a dedicated car alarm chip. How wrong I was...
At the time, being very naive and stupid, I stripped the PC board within the box for the parts it contained. However I did consider the 40 pin chip that was on the board. Initially I thought (silly naive 16 year old me) it was a dedicated car alarm chip. How wrong I was...
The above photo shows the chip I had in my hand, except one difference. The middle set of digits on mine were OC16W, not 9C11C. This code number of course, is the mask revision of this chip.
I had no clue what this device was or could do, because firstly, the internet was years away, and secondly, there was no electronic engineer I could ask to teach me about these things or explain them to me. However as 1993 approached I gained access to some books (the MAPLIN 1992 catalogue and several Elektor magazines I had borrowed from a classmate). I had then understood the device to be an 8-bit microcontroller. Later in 1993, with much more knowledge and experience and being sure this device was a microcontroller, I was already looking for ways to "gain access" because by then I had learnt about the PIC16C54 (in 1993 most electronic engineers and hobbyists were going nuts about PICs) and the programming concepts of microcontrollers, particularly OTP (one-time programmable) variants was something I had just learnt about. Also bear in mind that I did not have a computer at the time and also no way of knowing about Motorola's FAX BACK service in any case. So until 1995 when I had a job and could afford a new 80386 PC with Windows, I was basically stuck!
The Maplin catalogue provided the datasheet for one of the companion chips that I removed from the PC board, which is a relatively common 93C46 EEPROM. The device featured in the Maplin catalogue was an equivalent part- not exactly the same but the base part number and pin out matched exactly (as far as I could figure out from the circuit anyway). This helped clarify that it was nothing more than non-volatile memory, although that serial protocol to talk to it looked pretty hefty and confused my 17 year old mind.
I had no clue what this device was or could do, because firstly, the internet was years away, and secondly, there was no electronic engineer I could ask to teach me about these things or explain them to me. However as 1993 approached I gained access to some books (the MAPLIN 1992 catalogue and several Elektor magazines I had borrowed from a classmate). I had then understood the device to be an 8-bit microcontroller. Later in 1993, with much more knowledge and experience and being sure this device was a microcontroller, I was already looking for ways to "gain access" because by then I had learnt about the PIC16C54 (in 1993 most electronic engineers and hobbyists were going nuts about PICs) and the programming concepts of microcontrollers, particularly OTP (one-time programmable) variants was something I had just learnt about. Also bear in mind that I did not have a computer at the time and also no way of knowing about Motorola's FAX BACK service in any case. So until 1995 when I had a job and could afford a new 80386 PC with Windows, I was basically stuck!
The Maplin catalogue provided the datasheet for one of the companion chips that I removed from the PC board, which is a relatively common 93C46 EEPROM. The device featured in the Maplin catalogue was an equivalent part- not exactly the same but the base part number and pin out matched exactly (as far as I could figure out from the circuit anyway). This helped clarify that it was nothing more than non-volatile memory, although that serial protocol to talk to it looked pretty hefty and confused my 17 year old mind.
The actual EEPROM chip removed from that PC board, kept safely in storage since 1991 and it still works!
As at April 2023, the EEPROM pictured above still reads and writes data without error. 32 years old and it still works. Amazing! Of course the fact that there's been no wear and tear i.e. write cycles, has contributed to its longevity.
Given the date code on the EEPROM (9037) we can more or less work out when the alarm control unit was manufactured.
Week 37 of 1990 was September 10 - 16 1990. I was given the unit somewhere in the 2nd quarter of 1991. I will never know why it was removed from the vehicle but it was pretty new when I got it. Additionally, mask set 0C16W on the micro also correlates with the year 1990.
By late 1993 I had been given more of these security control units along with their remote controls- some of these systems were still functional, and I already figured out that the EEPROM was used to hold the "paired" remote control transmitter's code/serial number/key. I recall swapping the EEPROM between two units and the paired remote controls would "move" from one unit to another.
The vehicle security system that used this microcontroller was called "S-VSS" (the label on the bottom of the box, and the label on the micro referred to S-VSS). CONLOG had implemented a type of code-hopping security on the remote control system, I guess CONLOG rolled their own code hopping scheme to avoid having to license the KEELOQ patent from Nanoteq. By 1996, however, CONLOG had changed their business to prepaid metering and they sold their automotive electronics division to another company that replaced the technology with KEELOQ and PIC microcontrollers anyway.
I always wanted to tinker with this micro. Especially for nostalgic reasons because it was the first real CPU I ever had. When I eventually began working as a design engineer in 2001, at the first opportunity, I asked the Motorola Field Application Engineer if I could please requisition a few samples (OTP and EPROM) and the development tools. The response:
"Why bother with old junk young man, the HC908 is what you should use, here's a free Evaluation Board and complimentary copy of Metrowerks CodeWarrior! And you can program your application in C!"
How do you refuse that sales pitch?
The last attempt I made to get info and tools for this chip was in 2008, on behalf of a fellow engineer, Matthieu Benoit in France. By then I was dealing with a different FAE because the previous FAE had moved to Australia and also, Motorola spun off their SPS sector into a separate company known as Freescale Semiconductor Inc. All my requests fell on deaf ears and I gave up.
When I got internet access in early 1998, information pertaining to this chip was one of the first things I searched for. All I could find was an abridged version of the HC05 Technical Data Book that provided the programmer schematic, and very little info else. The information made little sense because (a) no context of the architecture and (b) no context of Motorola's bootloader legacy, which I would later find out extends to nearly every microprocessor or controller they ever made. Even the venerable Fairlight CMI relied on such a loader at startup!
Now I did gain some experience and understanding of Motorola/Freescale's methods when I was mucking around with the HC908 back in 2004, but I had no idea that the HC05 had a loader, nor did I know the loader in the HC908 was basically evolved from it.
All of this changed in 2023! The proper, unabridged technical manual (a scanned copy), and a technical update document that included the source code of the factory programmed bootloader residing inside this micro, was uploaded to bitsavers.org.
HC05 Technical Data (1990)
Motorola Technical Update
For the first time, I fully understand how this device works. It is a really simple device compared to the devices I have developed for, but without documentation even simple things can be impervious. Time to really take that trip back to 1991
Collecting the bits and pieces
The easy part was getting the actual chip. One of my suppliers has stock of this CPU, albeit only the OTPROM version. Bear in mind it's not a serious problem because, we can still run and debug small programs from the RAM.
Mantech Electrioncs - MC68HC705C8P OTP
The more difficult aspect would prove to be getting the original development tools. One would think the assembler (CASM05) would be floating around the internet. Nope!
Back in the day, Motorola's preferred partner, P&E Microsystems, charged a chunk of money for the assembler. This was long before the open source movement that has changed the world and forced semiconductor vendors to stop trying to make profits from tool sales. Everything had to be bought, paid for, licensed and yes, in some cases the tools were secured with those HASP dongles. Back then you needed to have an even deeper pocket if you wanted C or Pascal compilers for your target MCU. It was during this period that embedded C compilers earned their unjustified reputation for producing bloated/slow/lacklustre code. Some of that may have been true but the real problem likely lay with the fact that in those times, electronic engineers were not programmers by any stretch. I sort of know this from my own experiences, having written bits of C code for an HC908 micro in 2003 and it was a horribly bloated piece of crap because I had very little experience with C.
In my search for the tools, somewhere in March 2023 I found a forum post on P&E Micro's website where someone else asked for these tools and P&E responded with links to download the tools. So I registered an account and made a similar request. Within 48 hours my request was granted- P&E gave me links to download those tools which I downloaded without delay. FINALLY!
Given the age of the tools I decided to create a virtual machine for them, and so I created a Windows XP based VM for this purpose. It worked out very well. I am truly pleased. The in-circuit debugger (ICS05CW) is a bit of a mess as it was written for Windows 3.x and the cascading windows are all over the place. I am hoping to roll my own programmer for this so I am not concerned!
As at April 2023, the EEPROM pictured above still reads and writes data without error. 32 years old and it still works. Amazing! Of course the fact that there's been no wear and tear i.e. write cycles, has contributed to its longevity.
Given the date code on the EEPROM (9037) we can more or less work out when the alarm control unit was manufactured.
Week 37 of 1990 was September 10 - 16 1990. I was given the unit somewhere in the 2nd quarter of 1991. I will never know why it was removed from the vehicle but it was pretty new when I got it. Additionally, mask set 0C16W on the micro also correlates with the year 1990.
By late 1993 I had been given more of these security control units along with their remote controls- some of these systems were still functional, and I already figured out that the EEPROM was used to hold the "paired" remote control transmitter's code/serial number/key. I recall swapping the EEPROM between two units and the paired remote controls would "move" from one unit to another.
The vehicle security system that used this microcontroller was called "S-VSS" (the label on the bottom of the box, and the label on the micro referred to S-VSS). CONLOG had implemented a type of code-hopping security on the remote control system, I guess CONLOG rolled their own code hopping scheme to avoid having to license the KEELOQ patent from Nanoteq. By 1996, however, CONLOG had changed their business to prepaid metering and they sold their automotive electronics division to another company that replaced the technology with KEELOQ and PIC microcontrollers anyway.
I always wanted to tinker with this micro. Especially for nostalgic reasons because it was the first real CPU I ever had. When I eventually began working as a design engineer in 2001, at the first opportunity, I asked the Motorola Field Application Engineer if I could please requisition a few samples (OTP and EPROM) and the development tools. The response:
"Why bother with old junk young man, the HC908 is what you should use, here's a free Evaluation Board and complimentary copy of Metrowerks CodeWarrior! And you can program your application in C!"
How do you refuse that sales pitch?
The last attempt I made to get info and tools for this chip was in 2008, on behalf of a fellow engineer, Matthieu Benoit in France. By then I was dealing with a different FAE because the previous FAE had moved to Australia and also, Motorola spun off their SPS sector into a separate company known as Freescale Semiconductor Inc. All my requests fell on deaf ears and I gave up.
When I got internet access in early 1998, information pertaining to this chip was one of the first things I searched for. All I could find was an abridged version of the HC05 Technical Data Book that provided the programmer schematic, and very little info else. The information made little sense because (a) no context of the architecture and (b) no context of Motorola's bootloader legacy, which I would later find out extends to nearly every microprocessor or controller they ever made. Even the venerable Fairlight CMI relied on such a loader at startup!
Now I did gain some experience and understanding of Motorola/Freescale's methods when I was mucking around with the HC908 back in 2004, but I had no idea that the HC05 had a loader, nor did I know the loader in the HC908 was basically evolved from it.
All of this changed in 2023! The proper, unabridged technical manual (a scanned copy), and a technical update document that included the source code of the factory programmed bootloader residing inside this micro, was uploaded to bitsavers.org.
HC05 Technical Data (1990)
Motorola Technical Update
For the first time, I fully understand how this device works. It is a really simple device compared to the devices I have developed for, but without documentation even simple things can be impervious. Time to really take that trip back to 1991
Collecting the bits and pieces
The easy part was getting the actual chip. One of my suppliers has stock of this CPU, albeit only the OTPROM version. Bear in mind it's not a serious problem because, we can still run and debug small programs from the RAM.
Mantech Electrioncs - MC68HC705C8P OTP
The more difficult aspect would prove to be getting the original development tools. One would think the assembler (CASM05) would be floating around the internet. Nope!
Back in the day, Motorola's preferred partner, P&E Microsystems, charged a chunk of money for the assembler. This was long before the open source movement that has changed the world and forced semiconductor vendors to stop trying to make profits from tool sales. Everything had to be bought, paid for, licensed and yes, in some cases the tools were secured with those HASP dongles. Back then you needed to have an even deeper pocket if you wanted C or Pascal compilers for your target MCU. It was during this period that embedded C compilers earned their unjustified reputation for producing bloated/slow/lacklustre code. Some of that may have been true but the real problem likely lay with the fact that in those times, electronic engineers were not programmers by any stretch. I sort of know this from my own experiences, having written bits of C code for an HC908 micro in 2003 and it was a horribly bloated piece of crap because I had very little experience with C.
In my search for the tools, somewhere in March 2023 I found a forum post on P&E Micro's website where someone else asked for these tools and P&E responded with links to download the tools. So I registered an account and made a similar request. Within 48 hours my request was granted- P&E gave me links to download those tools which I downloaded without delay. FINALLY!
Given the age of the tools I decided to create a virtual machine for them, and so I created a Windows XP based VM for this purpose. It worked out very well. I am truly pleased. The in-circuit debugger (ICS05CW) is a bit of a mess as it was written for Windows 3.x and the cascading windows are all over the place. I am hoping to roll my own programmer for this so I am not concerned!