Markings on a customized HC11?

[Meterman]

I've had this board kicking around for a while that has a Motorola processor on it (in a PLCC-52 form factor).

I recently realized that it is actually a mask-programmed version of the 68HC11E9.

There are some additional markings on the chip, and I just want to verify that they would include the firmware that would have been masked into the chip at the time of manufacture.

The markings are:

SC407598FN (I know this to be the part number of the customized 68HC11)

283C0005 (this would be the firmware number, correct?)

C96N (is this the mask set?)

QQAF9933 (9933 is obviously 33rd week of '99, but the rest?)

(I did ask on the NXP forum, but the drone merely said "Contact your authorized NXP representative"...)

[CPUShack]

SC407598FN (I know this to be the part number of the customized 68HC11) - COrrect

283C0005 (this would be the firmware number, correct?) - Correct (or whatever the customer asked for)

C96N (is this the mask set?) - Correct

QQAF9933 (9933 is obviously 33rd week of '99, but the rest?) QQAF is the die run code (aka lot number)

[Meterman]

Thank you! Makes for an interesting comparison to the other processor I'd asked about ages ago (especially the firmware number formatting - the other batch all follow the format S00000A).

[Meterman]

One other thing: If I had the chip removed, would I be able to put it into an adapter and read out the on-chip ROM?

[CPUShack]

[Meterman]

I gave it a try, but it seems to be a matter of getting the pins to make contact with the programmer socket. i'll try and clean off the rest of the solder from the pins and give it another go.

I also have a 68HC705C9A I wanted to dump as well, but that family of MPUs unfortunately has a security bit that gets set by default.

[Meterman]

To follow up; I seem to have finally got the chip to make proper contact with the (worn) socket in the programmer module at work...

Reading the chip proceeds at blazing speed through the empty address range and the (blank) EEPROM range, then it simply bogs down trying to read the mask ROM at $D000-FFFF. Ran out of time and tried to see what it managed to pick up in the memory space; there was no usable data in the portion it supposedly read. Three possibilities - still not making clean contact with the programmer pins, a security bit is in play after all, or the chip got zapped at some point.

A shame, really, especially after I'd gone and laboriously drawn out the schematic of this FM/SCA radio board. I realigned or repaired hundreds of these boards back in the day; it woulda been nice to get a peek at the code. Oh well