Ooh, very interesting! Thanks for sharing! I find this fascinating because AM29F040B doesn't require VPP, and also isn't supported by Apple's Flasher app I disassembled. These chips will identify itself as manufacturer ID 0x01 and device ID 0xA4. That combination is nowhere to be found in Flasher. Several 2
8F0
20 variants are supported, but nothing for 29F040. But clearly your picture shows AM29F040B. I'm intrigued.
Each chip is 512 KB so this is a 4 MB SIMM, which I'm guessing you already knew based on the "4MB PLCC FLASH SIMM" silkscreen and of course the chip datasheet.
Since this is an Apple SIMM I expect you will find that /WE is on pin 3 of the SIMM connector rather than the pin I chose for the SIMM programmer (13), so it's likely that it won't ever be flashable in my programmer, unless they happened to hook /WE up to pin 13 like I did. I feel like you should be able to read the entire content through the programmer by just saying you have a 4 MB SIMM inserted though -- for example the
4MB (4x 8Mb PLCC) option like you said. I actually do expect that to read all of the content because I would expect it to be hooked up to the Mac address bus the exact same way my programmer would read it out.
Do you happen to be really bored? It would be awesome if you could trace out exactly how things are connected. I suspect the data bus D0-D31 is going directly to each set of 4 chips. Like 2 chips are hooked to D0-D7, 2 chips are hooked to D8-15, and so on. I also expect most of the address bus (A2-A20) to go directly to all eight chips. U9 (in conjunction with any other special additional chips) is probably responsible for generating /OE and /WE signals based on the original /OE and /WE signals along with another address line, like A21. I guess it's also possible they did the logic using A2, but that would interleave the data weirdly.
Would you be willing to take some closer pics of both sides of the board with all the chip markings readable? I'm especially interested in what's going on with U9, and what part number is on it. Is there another chip on the other side of the board too? I suspect it's going to be some logic gates to decide which half of the SIMM to activate. My guess is the logic will be something along these lines:
- U1-U4 /OE = /OE OR A21
- U1-U4 /WE = /WE OR A21
- U5-U8 /OE = /OE OR ~A21
- U5-U8 /WE = /WE OR ~A21
...but that's just a somewhat educated guess. I could also be way wrong. I feel like there would probably have to be one more chip to implement the logic I just described, unless it's a PAL instead of a 74 series chip.
It's probably possible to hack Flasher to support this SIMM for in-system programming. I'm kind of surprised to see an Apple SIMM with this type of flash chip on it, but based on the date on the board it came later so I guess it makes sense. There must be a newer version of Flasher out there somewhere that supports it. I don't see support for it in the TNT Flasher either, which is the newest I've seen so far.