First of all, let me say, Oleg spotted it right - BINGO.

Now on my error with A15-/CS: first, I planned to describe the puzzle with 6264-type memory, which has two chip selects - one is active low /CS1 and the second active high CS2. Then, A15 can be tied to CS2 directly and /CS1 tied to GND, to address the memory from 8000h. The timing error is also more pronounced with 6264s, as there were really slow pieces around (I have seen 150ns, but maybe even slower); while the more modern 62256 I have never seen slower than 85ns (please correct me).

-----------

Originally, I had an idea and tried to hide it in the puzzle. However I later realized that there are two other possible explanations, so I will give them here all three, the original last.

All the solutions are based on '51 in a situation with unpredictable behaviour, so it might as well end up with other combination of LEDs lit or no one lit at all.

1. There is no explicit specification how /EA is connected. So if Little Joe tied it to GND, the AT89C52 attempted to start executing code from external code memory at 0000h - and as there is no memory mapped there, it may do anything.

2. Little Joe might have programmed all three security fuse, which results in disabled external code execution (although external data memory access is still enabled). The datasheet does not specify what happens if in such case it tries execute external code, so it is assumed it may do anything.

3. My original solution:
There is a difference in timing, when accessing external data memory or external code memory. Code fetches are performed at double rate than data reads/writes (there are 2 code fetches per 12-oscillator-cycle, but only 1 external data read/write).
So there can easily be a combination of timing parameters, when an external memory can be perfectly accesses as data memory, but fails or - worse - is marginal when used as code memory. Then, the test program could write the RAM and read it back without errors, but when attempting to run the code from RAM, it may do anything.
An example combination of such timing is AT89C52 at 24MHz, where tPLIV (/PSEN Low to Valid Instruction In) is max. 3*tCLCL-45ns=80ns, the propagation delay on two 74LS00 gates is max.2*15 ns, so there is a 80-30=50ns window for the RAM from /OE to data output. Hence, some of the older 85ns 62256s (which have 50ns /OE-to-data time) will be marginal; even older 6264 parts with 120ns and 150ns access time (60ns and 70ns /OE-to-data time) might fail completely.
On the other hand, for external data timing, the equivalent value is tRLDV (/RD Low to Valid Data In) which is max. 5*tCLCL-90ns=118ns, minus the AND delay gives a 88ns window, so even the 150ns RAM would work.
Please note, that if /PSEN would be fed into an address decoder which would go to /CS, the timing is even tighter, as /CS-to-data on RAMs are rated the same delay as address-to-data, i.e. the number given by the suffix (here, 85-120-150ns).

Of course, the modern 62256s are rated 70ns or 55ns; and there are also substantially faster and bigger memories available - but there are also faster '51 derivatives with tighter external memory timing requirements. I just wanted to sketch the possible failure scenario using more common parts (otherwise it would be much easier to guess).


Jan Waclawek