If you’re planning to do some hacking with CPLD or FPGA chips you’ll need a way to program them. JTAG is one of the options and here’s a cheap method that uses the serial port (translated).

This method requires only four signals (TDI, TMS, TCK and TDO) plus ground. But the problem is that an RS232 serial port operates with 12V logic levels and the JTAG side of the programmer needs to operate with the logic levels native to the device you’re programming. Commercial programmers use a level convert IC to take care of this for you, but that doesn’t mesh with the cheap goal of this project. Instead, [Nicholas] uses Zener diodes and voltage dividers to make the conversion. There is also an LED for each data signal to give some feedback if you’re having trouble.

You can use this along with a programming application that [Nicholas] whipped up using Visual Studio. It works well via the serial port, but he did try programming with a USB-to-Serial dongle. He found that this method slows the process down to an unbearable 5-minutes. Take a look, maybe you can help to get that sloth-like programming up to a manageable speed.

[Thanks Alex]

[Bingo] did some work porting Versaloon for STM8 and STM32 discovery boards. Versaloon is a multiple-architecture programmer that we saw a few weeks back. At its center is an STM32 microprocessor, which greatly simplifies the work necessary to use the two discovery boards instead. Flashing the firmware to the boards will zap the ST-link firmware and [Bingo] doesn’t know of a way to restore that so be warned. This hack is still pretty fresh off the bench, but so far it looks like vsprog and OpenOCD both work just fine with the new hardware.

Versaloon is an open source, USB connected project, that centers around an STM32 processor and provides a standard JTAG pinout. Above you see the Nano version which has a 10-pin JTAG connector, but there is also a 20-pin option on the Handy model. Great, another JTAG programmer. Well this can do a bit more than that. With a bit of help from the software it has been turned into a programmer for ten different types of hardware. Obviously this should be able to program anything that works with the JTAG protocol, but the script adapts it to work as an In System (or In Circuit) Programmer too. So far the list of programming targets includes STM32, LPC1000, LPC900, STM8, AR8, MSP430, and a few others.

We had some trouble finding an actual picture of this hardware. If you’ve got one, snap a picture and leave a link to it in the comments along with your thoughts on the device.

[Thanks Geekabit]

[Firestorm_v1] has done a fabulous writeup on not only resurrecting his dead DockStar with JTAG, but also includes some handy techniques and useful information that could be used with other hardware and JTAG equipped devices.

The tutorial itself goes into the details of finding the JTAG, correctly identifying the ports and making an adapter cable. Then wiring a TIAO Parallel JTAG kit and finally the flash and upload of firmware to the deceased Dockstar to give it new life.

While the fun stops a little short, we’ll be sure to keep an eye out for [Firestorm_v1's] future plans involving these surprisingly useful (read: hackable) storage devices, “roving USB camera with WiFi” we hear?

[Matt Evans] was running up against the common programming gotcha caused by disappearing parallel ports. For years he had used a JTAG parallel cable when working with FPGAs but recently realized he no longer owned any machines with that interface available. Instead of shelling out $50 for a USB programmer he a programming interface from an old router.What he’s doing is bit-banging using Linux. In this case it’s a router running a version of Linux which makes his setup Internet friendly but this could be done in the same basic manner on any Linux device with enough available I/O to connect to the device you are programming.

There has been another development in the never-ending battle that is Microsoft trying to keep its gaming system closed to unauthorized use. Xbox-scene reports that a new hack called freeBOOT v0.01 allows the Xbox 360 to upgrade to the newer kernels, but allows the option of rebooting to an older kernel in order use the JTAG exploit and gain access to the hardware.

In case you missed it, the JTAG hack is a way to run homebrew code on an Xbox 360. Exploiting this hack makes it possible to boot a Linux kernel in about five seconds. We’ve long been fans of the homebrew work done with XBMC on the original Xbox and hope that advances like this will lead to that end. We want this because the older hardware cannot handle high definition content at full resolution but the Xbox 360 certainly can.

This exploit is still far from perfect. It currently requires that the Cygnos360 mod chip be installed on the system. A resistor also needs to be removed from the board to prevent accidental kernel updating. That being said, this is still progress. If you’re interested in step-by-step details, take a look at the text file instructions provided.

[Thanks wdfowty]

For months we’ve used our Bus Pirate universal serial interface tool to demonstrate electronics parts, so it’s only appropriate that the Bus Pirate get it’s own parts post. We recently had a Bus Pirate preorder, and today we received the pre-production Bus Pirate prototype from Seeed Studio. This prototype was mailed just a few days before preorder 1 started to ship, so those packages should start arriving any day.

Follow along as we unbox the prototype Bus Pirate, and connect it to a debugger to determine the PIC24FJ64GA002-I/SO revision that shipped with this board. Use this post to share your own Bus Pirate unboxing experience. Pictures and discussion after the break.

Most Bus Pirates will ship in a padded envelope (JPG), but ours came in a box with some PCBs for future projects and an AVR programmer.

Inside the box, the Bus Pirate is protected by a static dissipative bag. The Bus Pirate pin headers are stuck in foam to protect the packaging.

We ran a battery of functionality tests that covered USB, the user terminal, protocol libraries, power supplies, and pullup resistors. Everything passed our tests.

Next, we used a Microchip ICD2 debugger/programmer to make a backup of the firmware prior to doing a test upgrade/downgrade with the bootloader.

Connecting to MPLAB ICD 2
…Connected
Setting Vdd source to target
Target Device PIC24FJ64GA002 found, revision = Rev 0×3042
…Reading ICD Product ID
Running ICD Self Test
…Passed
MPLAB ICD 2 ready for next operation

All of our previous Bus Pirate version were built using Rev 0×3003 (A3) of the PIC 24FJ64GA002. Version A3 has a few issues, known as errata (PDF), one of which is a flaky hardware I2C module. These chips aren’t ‘defective’, they just have a few quirks like any complicated integrated circuit. The Bus Pirate firmware works around these issues using software techniques. Most desktop computer processors go through a similar stepping process.

Our Bus Pirate appears to have a B4 revision PIC (0×3042) that corrects some, but not all, of the errata from A3. This is no guarantee that every Bus Pirate will have a B4 PIC, preorder 1 and 2 are both sourced from multiple international vendors. Additionally, there’s no immediate benefit from having a B4 chip, someone will have to write software that takes advantage of the hardware. The next firmware update will print the PIC revision in the user terminal, check the nightly compiles if you’re anxious.

There is a revision B5 mentioned in the PIC errata. Some of these might find their way into preorder 2 boards.

Now that you’ve got your Bus Pirate, what do you do with it? We’ve got a bunch of part demonstrations to get you started.

Please leave a comment about your unboxing experience, and the devices you plan to interface.

Update, Saturday July 4th, 2009: All preorders are closed.

The Bus Pirate is a universal serial interface tool, we use it to test new chips without writing any code. It currently supports most serial protocols, including 1-Wire, I2C, SPI, JTAG, asynchronous serial, MIDI, and more. We added some other features we frequently need, like pulse-width modulation, frequency measurement, voltage measurement, bus sniffers, pull-up resistors, and switchable 3.3volt and 5volt power supplies.

The new v2 family adds USB power and connectivity to the best Bus Pirate design yet. We also reduced the part count and cost wherever possible. If you want to get your hands on some Bus Pirate USB goodness, Seeed Studio has assembled hardware for $30 (including worldwide shipping).

Read about the new design after the break.

Concept overview

The Bus Pirate connects to a PC USB port. The user send commands to the Bus Pirate from a serial terminal on the PC. Commands are translated to the bus protocols that control microchips. See our Bus Pirate page for full documentation.

The latest firmware supports 1-Wire, I2C, SPI, JTAG, asynchronous serial, MIDI, and PC keyboards. Bit-wise 2- and 3-wire libraries can interface most proprietary serial protocols.  More protocols are being added all the time, check out the source code on our Google Code SVN page.

Hardware

Click for a large image of the schematic (PNG). The schematic and board layout were made with the freeware version of Cadsoft Eagle. Download the latest files from our Google Code page.

PIC24F

A Microchip PIC24F series microcontroller generates the user interface and translates input into bus communications. V2 uses the same 24FJ64GA002 as the previous Bus Pirate versions. It’s cheap, has a ton of memory, a couple 5volt tolerant input pins, and the peripheral pin select feature lets us assign hardware modules anywhere we want.

The PIC (IC1) is powered by a 3.3volt regulator (VR2, C23). Each PIC power pin gets a 0.1uF bypass capacitor (C1,2). The internal 2.5volt regulator requires a 10uF tantalum capacitor (C20). The programming pins are brought to a five pin header (ICSP) on the edge of the PCB.

USB interface

The Bus Pirate is powered from the USB 5volt supply, which is first filtered with a ferrite bead (L1) and 10uF tantalum capacitor (C21). We used the small, still-not-quite-common, USB mini-b connector (J2).

Choosing a ferrite bead is a common hangup. Its purpose is to filter small power fluctuations, all the current for the circuit will go through it. We can guestimate that the Bus Pirate’s worst case current consumption is 525ma (3 power supplies @ 150ma, the FTDI chip @ 25ma, 2 LEDs @ 50ma max). Use a ferrite bead rated for at least 1000ma to be safe. We used this one, which is rated for 1500ma and costs 10 cents.

An FTDI FT232BL USB->serial chip (IC2) handles the USB connection. You might be familiar with this chip from various Arduino boards. FTDI has extensive driver support for most platforms, we used the virtual com port drivers.  This is the latest generation chip, and it’s only available in small SSOP and QFN packages. We had no problem hand-soldering it to a professional PCB, but it’s not for everyone.

The FT232BL is powered directly from the filtered, unregulated USB supply. C4 is a  decoupling capacitor for the FTDI232BL supply pin. A single LED (LED4/USB) indicates USB status and activity. The FT232BL RXLED pin sinks current, so we powered the LED from the 5volt USB supply through a 1.1K resistor (R3).

While the FT232BL runs at 5volts from the USB supply, its serial IO pins have an independent supply input – they can operate at another voltage. Since the microcontroller is 3.3volts, we just feed the FT232BL IO pins a 3.3volt supply and eliminate any funky translation circuitry. We used the chip’s internal 3.3volt regulator to supply the IO pins because it was the easiest trace to route. The IO pins get their own 0.1uF bypass capacitor (C5).

Switchable power supplies

The Bus Pirate has on-board 3.3volt and 5volt supplies (VR3, VR4) that can power a test circuit. The supplies are switchable, so we can reset the circuit from software when something goes wrong. To be extra safe, the supplies are held off until activated in the terminal.

[Nathan Seidle] at SparkFun recommended that we replace the  TPS796xx ($2.50) we used in The Bus Pirate v1a with a MIC5205-xxYM5 ($0.90). They supply just 150ma maximum current, compared to 800ma from the TPS796xx, but the cost savings and reduced part-count are worth it.

The regulators are fed from the 5volt USB supply. The 5volt regulator drops a few millivolts below optimal because there’s no headroom, but it’s within the minimum level specified by most 5volt parts.

The MIC5205 requires a large output filter capacitor (C22-24, 10uF), but no input capacitor. An optional small-value capacitor on the BP pin can decrease power supply noise, but we left this off because it didn’t make much difference in practice.

A small voltage on the EN pin enables the supply, we used a 10K pull-down resistor (R18, not shown) to ensure that the supplies stay off while the PIC initializes. LED3/VREG, with current limiting resistor R32, lights when the power supplies are active.

On-board pull-up resistors

Bus Pirate V2 has multi-voltage, software controlled pull-up resistors via the 4066 (PDF) quad bilateral switch (IC3). When enabled, the 4066 connects the four on-board bus pull-up resistors (R20-23, 10K) to any external signal on the Vpullup pin (0 to 5volts). When disabled, the outputs are high-impedance and have no effect on the bus lines.

The 4066 can’t switch an input voltage greater than the supply voltage. To give it the widest possible range, we powered it from the USB supply (5volts).

When operated at 5volts, it takes 4volts+ to enable the 4066. The PIC pins have a maximum output of 3.3volts, so we have a problem. We solve it with a 5volt tolerant PIC pin and a pull-up resistor.  We turn on the 4066 with a pull-up resistor to 5volts (R19, 10K), and then disable it by switching the connected PIC pin to ground.

For a brief instant at power-on, the PIC pin is high-impedance and the 4066 outputs are active because the pull-up resistor holds the control pins at 5volts. This is a concern if the Vpullup input is connected to an external 5volt supply while the bus is connected to a 3.3volt device – the brief exposure to 5volts might harm the device. If you’re worried about this, make sure there’s no active power supply connected to the Vpullup input before powering the Bus Pirate. This isn’t a concern if you use one of the on-board power supplies for the pull-up voltage because they’re disabled at startup.

Voltage monitoring

Four voltage dividers (R10-17, 10K), attached to analog to digital converters, allow the 3.3volt PIC to safely measure up to 6volts DC.

Two voltage monitors measure the switchable power supply output. One measures the Vpullup input voltage, and another connects to the external voltage measurement probe.

Indicator LEDs

Three LEDs indicate power, mode, and voltage regulator status (LED1-3). LED4/USB displays USB activity.

There are pads for resistors R30-32 and LEDs 1-3 on the front and back of the PCB. Only one set should be populated. We put pads on both sides so the board could be mounted with the indicator LEDs abutting the top of an enclosure.

V2a vs V2go

Click for large schematic (PNG) and layout (PNG) images of the version 2a hardware. The Eagle layout files are available in our Google Code SVN.

Bus Pirate V2a is a developer’s board. In addition to all the features of V2go, it includes a jack (J1) for an external power supply and an additional 5volt regulator (VR1).  A switch (S1) selects between USB power and the external supply.

The FT232BL chip on V2a is powered directly from the USB supply, and is not connected to the external supply. This is useful if you want to disable USB and use the Bus Pirate with a serial port on a PC or PDA.

The V2a 4066 enable pull-up resistor is powered by the switchable 5volt regulator. The 5volt regulator must be enabled for the 4066 to be active. Don’t forget to install the 4066 pull-up resistor (R19), located on the back of the v2a PCB.

PCB

The PCB is a compact, 2-layer design. We prepared gerbers and had PCBs made by our usual service, BatchPCB ($21, shipped to EU), and tried a new service offered by Seeed Studio ($32, shipped worldwide).

Seeed has a PCB service specifically for open source hardware projects. For $32 (including worldwide shipping) we got 5 small PCBs, and Seeed made a few extra to sell in their shop. We liked the idea that there would be extra PCBs available.

You might know Seeed Studio from their cheap, improved Seeeduino Arduino clone. They’re located in Shenzhen, a Chinese electronics manufacturing hot-spot. A bunch of notable bloggers recently visited the region and wrote about the huge electronic component markets.

The Seed order arrived in 14 days (left), the BatchPCB order arrived in 30 days (right).  Seeed and BatchPCB both make beautiful PCBs. Seeed has a much faster turn-around, and has better minimum trace widths and separation (8mil vs 6mil). BatchPCB has standard green PCBs, Seeed gives you the choice of green, black, or white; red, blue and yellow are $7.50 extra.

We really like the Seeed PCB service, extra Bus Pirate v2go and v2a PCBs from our order are available in the Seeed shop. BatchPCB remains the cheapest prototyping option if you want a single board, closed source work, or don’t mind the extra wait.

Parts list

Firmware

The latest Bus Pirate firmware for all hardware version is always available on our Google Code page. The code is written in C, and is compiled with the Microchip C30 demonstration compiler.

Bootloader

The biggest change in the latest firmware is the addition of a bootloader. Now the firmware can be updated through the USB or serial connection.

A bootloader is small program that sits at the beginning of the PIC program memory. It accepts updated firmware through the USB or serial port and saves it to the chip.

The bootloader comes from Microchip application note AN1157. We modified the bootloader to check for a jumper between the programming clock (PGC) and data (PGD) pins at power-up (update, above left). If there’s a connection, the bootloader takes over and waits for new code. Without a connection, the bootloader exits and runs the main program.

There’s a very minor chance of accidentally entering the bootloader with no jumper installed. This won’t damage the Bus Pirate, but you will need to connect it again.  You can prevent it by moving the jumper over one position,  between the ground pin and the inner programming pin (normal, above right).

Upgrading the firmware with the bootloader

If you’re using a fresh chip, first program it with the bootloader firmware (vxx-PIC Bootloader.hex) through the ICSP header using a ‘real’ programmer like an ICD2 or PicKit.

If you’re upgrading, follow this procedure or refer to the instructions in the firmware download.

• Disconnect the Bus Pirate from any power supply such as the USB cable.
• Place a jumper between the programming data and clock pins of the ICSP header. This will trigger the bootloader mode.
• Connect the Bus Pirate to a USB port (or, if applicable, power and serial cable).
• Start the MS Windows P24QP.exe programmer utility. You may need to modify the COM port (portindex=) in P24qp.ini to match your system.  Programmer source is available, and the simple bootloader protocol is documented in AN1157 if you want to write an app for a non-Windows system.
• Click the connect to device icon (#1). The program will connect to the PIC.
• Click the folder icon (#2) and open the firmware update file (vxx-Firmware for BL.hex).
• Click the erase device icon (#3) to erase the chip. DO NOT SKIP THIS STEP. Programming may not be successful if you forget to erase the chip.
• Click the write device icon (#4) to program the new firmware. Ignore any verify errors between 0×400 and 0xBFF, the bootloader lives in this region and doesn’t get updated.
• Click the green arrow icon (#5) to exit the bootloader and start the program. Click OK at the warning, we use the jumper to re-enter the bootloader.
• Remove the jumper from the programming pins, or move it over one position to connect the inner PGx pin to ground (GND).
• ***IMPORTANT*** Now restart the Bus Pirate by disconnecting and reconnecting the USB cable (or power cable). Some features won’t work until after a complete hardware reset.

Using it

USB device driver

You may need to install an FTDI virtual serial port driver for your platform.

On Windows, go to the Device Manager to configure the FTDI driver or check the COM port number.

Menus and Syntax

Use a serial terminal to communicate with the Bus Pirate. We like Tera Term.

The Bus Pirate works best with the terminal set to 115200bps, 8 databits, no parity, 1stopbit. Disable local echo in the terminal, and use CR for line breaks. Some modes also require Xon/Xoff software flow control.

In the serial terminal, press ? for the help menu. Read more about the Bus Pirate’s menu and syntax on the Bus Pirate page. There’s lots of demonstrations in our recent parts posts.

LED indicators

• PWR indicates power to the Bus Pirate.
• MODE is off when the I/O pins are in a safe, high-impedance state. MODE is lit when a bus mode is engaged, the pins may be active.
• VREG indicates that the on-board switchable power supplies are active.
• UR is a single USB activity indicator LED. It displays data coming from the PC to the Bus Pirate. You can probably change what this LED displays with the FTDI configuration utility.

Connections

Pin location diagrams: v2a, v2g0.

Notes: * TX moved from CS to MOSI in firmware v0g.

The 10 pin I/O block contains the data signals and power supplies that connect to a test circuit. Each pin is labeled on the back of the PCB, refer to the table above for a detailed description.

The pinout on V2 is similar to V1, but we moved the power supply output and Vpullup input to the cable bundle. We also eliminated the second, unused auxiliary pin.

Conclusion

If you want a complete Bus Pirate or a kit, here’s a couple options:

• Seeed Studio is accepting pre-orders for assembled Bus Pirate v2go hardware until the end of Friday, July 3.  An assembled Bus Pirate v2go is $30, including worldwide shipping.
• Seeed Studio also has the extra v2g0 ($5.90) and v2a ($6.50) PCBs from our order.
• Fundamental Logic sells a through-hole kit version of the Bus Pirate V1a ($29.50). ***v1a is serial port only***

Thanks to everyone who contributed to this project. The Bus Pirate wouldn’t be possible without a ton of great feedback from the comments. If you’d like to get involved, join the Bus Pirate project at Google Code.

Hack a Day review disclosure: We asked Seeed Studio to make our first order of PCBs for free. Since then, we’ve made several paid orders.

We use the Bus Pirate to interface a new chip without writing code or designing a PCB. Based on your feedback, and our experience using the original Bus Pirate to demonstrate various parts, we updated the design with new features and cheaper components.

There’s also a firmware update for both Bus Pirate hardware versions, with bug fixes, and a PC AT keyboard decoder. Check out the new Hack a Day Bus Pirate page, and browse the Bus Pirate source code in our Google code SVN repository.

We cover the design updates and interface a digital to analog converter below.

Concept overview

The Bus Pirate started as a collection of code fragments we used to test new chips without endless compile-program-run development cycles. We released it in a how-to and used it to demonstrate a bunch of serial interface ICs in our parts posts. This article introduces an updated design with new features and a bunch of improvements.

• Surface mount design
• Pull-up resistors on all bus lines with external voltage source
• Software resettable 3.3volt and 5volt power supplies
• Voltage monitoring of all power supplies
• An external voltage measurement probe
• Cheaper parts

Hardware

Click for a full size schematic image (PNG). The circuit and PCB are designed using the freeware version of Cadsoft Eagle. All the files for this project are included in the project archive linked at the end of the article.

Microcontroller

We used a Microchip PIC24FJ64GA002 28pin SOIC microcontroller (IC1) in this project. The power pins have 0.1uF bypass capacitors to ground (C1,2). The 2.5volt internal regulator requires a 10uF tantalum capacitor (C20). The chip is programmed through a five pin header (ICSP). A 2K pull-up resistor (R1) is required for the MCLR function on pin 1. Read more about this chip in our PIC24F introduction.

RS-232 transceiver

An inexpensive MAX3232CSE RS232 transceiver (IC2) interfaces the PIC to a PC serial port. This chip replaces the expensive through-hole MAX3223EEPP+ used in the previous version of the Bus Pirate. The serial interface will work with a USB->serial adapter.

Bus pull-up resistors

The original Bus Pirate has 3.3volt pull-up resistors on 2 pins, but most of our tests required additional external resistors. The updated design has pull-up resistors (R20-23) on the three main bus signals (data in, data out, clock) and the chip select (CS) pin.

A row of jumpers (SV5) connects each resistor to an external voltage supplied through the Vext terminal (X4). Through-hole resistors are used like jumper-wires to make the PCB easier to etch at home.

We couldn’t find an elegant way to control an arbitrary voltage pull-up resistor array from a 3.3volt microcontroller. If you have any ideas, please share them in the comments.

Power supply

VR1 is a 3.3volt supply for the microcontroller and RS232 transceiver. VR2 is a 5volt supply. Both require two 0.1uF bypass capacitors (C3-C6). J1 is a power supply jack for a common 2.1mm DC barrel plug. 7-10volts DC is probably the ideal power supply range.

The original Bus Pirate had dual power supplies, 3.3volts and 5volts, so most ICs could be interfaced without an additional power supply. A major annoyance was the lack of a power reset for connected chips. If a misconfigured IC needed to be power-cycled, we had to disconnect a wire. We got so tired of this routine that we added a software controlled reset to the updated design.

VR3 (3.3volts) and VR4 (5volts) are TI TPS796XX voltage regulators with an enable switch. A high level on pin 1 enables the regulator. A pull-down resistor (R13,R12) ensures that the regulators are off when the PIC isn’t actively driving the line, such as during power-up initialization. The datasheet specifies a hefty capacitor on the input (C23, C21) and output (C24, C22) pins, we used the same 10uF tantalum we use everywhere. An additional, optional, 0.1uF capacitor (C12,C11) can improve regulation.

The switchable regulators are powered by VR2, a 5volt supply.  We did this because the maximum input for VR3 and VR4 is 6volts, leaving the device with a narrow 5.2-6volt power supply range. VR2 will work well above 10volts, and provides an adequate supply for the other regulators.

VR3 (3.3volts) has plenty of headroom to operate from a 5volt supply. VR4 (5volts) will lose about 0.2volts, but 4.8volts remains well within the acceptable range for most 5volt chips. In practice, and under light loads, we see less than 0.1volts drop-out from VR4.

Voltage monitoring

Voltage monitoring is a new feature we’re really excited about. Has your project ever mysteriously stopped responding because of an accidental short circuit? The Bus Pirate’s power supplies are equipped with voltage monitoring that can detect a change in power levels.

Each monitored signal is connected to an analog to digital converter (ADC) through a resistor voltage divider. Two 10K resistors (R10,R11 above) divide the input voltage in half, making it possible to measure up to 6.6volts with the 3.3volt PIC microcontroller.

The Bus Pirate has four voltage monitors. The 3.3volt and 5volt power supplies are monitored, as is the external voltage fed to the pull-up resistors. A fourth monitor is connected to pin 9 of the output header to make a voltage probe.

PCB

Click for a full size placement diagram (PNG). The board is a quasi single-sided design, we etched ours in the lab on a single-sided photo-resist PCB. At the top, near C13, two jumper wires meet at a single via; we soldered one jumper wire to the other on the back of the board.

Part list

Firmware

The firmware is written in C using the free demonstration version of the PIC C30 compiler. Learn all about working with this PIC in our introduction to the PIC 24F series.

The latest firmware is posted on the Hack a Day Bus Pirate page. The latest source is in our Google Code SVN repository.

Using it

The diagram above shows the Bus Pirate pinout.

We made a cable with alligator clips on the end, and added labels to each wire so we don’t have to refer to this table every time we interface a new chip.

If you know of any cool connectors or cables, please link to them in the comments.

LTC2640 SPI digital to analog voltage converter

The Linear Technology LTC2640-LZ8 is an 8bit digital to analog converter (DAC) programmed over SPI. A DAC is essentially a programmable voltage divider. They’re useful for recreating waveforms, such as audio signals. An 8bit DAC has 255 even intervals between 0 and the reference voltage, the L part we used has an internal 2.5volt reference.

The LTC2640 only comes in a small SOT223-8 package, so we made a breadboard adapter in the profile of a DIP-8 chip.  Our LTC2640 footprint is included in the project archive attached at the end of this article.

The schematic above shows our test circuit for the LTC2640. It requires a 2.7-5volt power supply, we used the Bus Pirate’s 3.3volt supply. C1 is a bypass capacitor between the power pin and ground. Pin 8 is an active-low reset pin, tie it high for normal operation. Pin 7 is the DAC output, connect the Bus Pirate voltage measurement probe (ADC) here.

We connected the Bus Pirate to the LTC2640 as shown in the table. The LTC2640 doesn’t have a data output pin, this SPI connection remains unused.

The Bus Pirate’s hardware SPI library and software RAW3WIRE library are compatible with the LTC2640′s SPI interface. We used the SPI library; if you use the RAW3WIRE library be sure to choose normal pin output.

HiZ>m<–select mode
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. JTAG
7. RAW2WIRE
8. RAW3WIRE
9. PC AT KEYBOARD
MODE>5<–SPI or RAW3WIRE
900 MODE SET
Set speed:
1. 30KHz
2. 125KHz
3. 250KHz
4. 1MHz
SPEED>1 <–test at low speed
…
102 SPI READY
SPI>

Press M for the Bus Pirate mode menu, choose 5 for SPI mode. There are a bunch of configuration options for the SPI module, use the default options for all of them. After SPI mode is ready we need to configure the power supply.

SPI>p<–power supply setup
W/w toggles 3.3volt supply?
1. NO
2. YES
MODE>2<–use 3.3volt supply
W/w toggles 5volt supply?
1. NO
2. YES
MODE>1<–don’t use 5volt supply
9xx SUPPLY CONFIGURED, USE W/w TO TOGGLE
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 0.0 | VPULLUP: 0.0 |
SPI>

p opens the Bus Pirate power supply menu. We use the 3.3volt supply but not the 5volt supply. The voltage monitor verifies that the power supplies are off.

SPI>W<–capital W (silly CSS) enables power supply
9xx 3.3VOLT SUPPLY ON
SPI>v<–voltage monitor
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 3.3 | VPULLUP: 0.0 |
SPI>

Capital ‘W’ enables any power supplies selected in the previous menu, a small ‘w’ disables them. V displays the supply voltage monitor, which now shows 3.3volts output from the 3.3volt supply.

Now that configuration is finished, we can send commands to the LTC2640 over the SPI bus. The LTC2640 has a 24bit (3byte) interface protocol. The first byte is a command, followed by two data bytes. The LTC2640 is available in 8,10, and 12bit versions; the 8bit version uses the first byte to set the DAC value, and ignores the second byte.

SPI>[0b00110000 255 0]<–set DAC to full
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0xFF<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
SPI>

Every SPI command begins by enabling the chip select pin ([). The first byte is the command to update the DAC (0b00110000), followed by the value to output (255), and a third byte that's ignored (0). The command ends by disabling chip select (]).

We used an 8bit DAC with 255 even voltage steps, output set to 255 is 100%. We can use the Bus Pirate voltage probe to measure the output.

SPI>d<–measure voltage
9xx VOLTAGE PROBE: 2.5VOLTS<–DAC output
SPI>

D triggers a voltage measurement. The DAC output voltage is 100% (255/255) of the internal reference, 2.5volts.

SPI>[0b00110000 0 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0×00<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 0.0VOLTS<–DAC output
SPI>

The same command with a DAC value of 0 outputs 0% (0/255) of 2.5volts; 0volts.

SPI>[0b00110000 128 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0×80<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 1.2VOLTS<–DAC output
SPI>

A DAC value of 128 is about 50% (128/255) of the reference voltage, 1.2volts.

SPI>[0b01000000 0 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×40<–power down command
120 SPI WRITE: 0×00<–don’t care
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 0.0VOLTS<–DAC off
SPI>

The LTC2640 has a low power mode, triggered by the command 0b01000000 and two bytes that are ignored. After the power down command we can verify that there’s output from the DAC. Write any DAC value to exit low power mode.

Taking it further

What’s the next step for the Bus Pirate? We’ll eventually make a final update to the design that includes USB on a professionally made, double-sided PCB. Power supply indicator LEDs were slated for this version, but didn’t get included. It would also be handy to have an AT  keyboard connector for debugging without a PC. Check out the roadmap and wishlists on the Hack a Day Bus Pirate page.

Download: buspirate.v1a.zip

Download: buspirate.v0c.zip

A few weeks ago we wrote about our Bus Pirate universal serial interface tool. We used the recent holiday to add some new features, like a JTAG programmer, macros, frequency measurement, and more. A major code reorganization makes everything easier to read and update.

Check out the a demonstration of the new features below. We’re compiling a roadmap and wish list, so share your ideas in the comments. You can also see how we used the Bus Pirate to read a smart card and test-drive an I2C crystal oscillator.

New protocols

I2C>m <–setup mode
1. HiZ <– high impedance pins (safe mode)
2. 1-WIRE <– not ready for this release
3. UART
4. I2C
5. SPI
6. JTAG <– interface and programmer
7. RAW2WIRE
8. RAW3WIRE
MODE>1
900 MODE SET
HiZ>

This firmware release lists three new protocols.

Hi-Z makes all pins high impedance/input, a safe state that won’t damage an attached circuit. To be safe, the Bus Pirate now starts in this mode.

1-Wire is listed, but we couldn’t include it in this release because we still don’t have any parts to test with our library. This is just a placeholder for now, but it will be added as soon as we get a 1-Wire part to test.

We wrote a simplified JTAG interface that includes a XSVF player for programming JTAG device chains.

**We included a hardware I2C library, but according to the device errata there’s a bug in the 24FJ64GA002 rev3 I2C module. This will work with a different chip (e.g. a 28pin dsPIC33).

Connection table

*also raw 2 wire. **also raw 3 wire.

The new modes connect to the Bus Pirate as outlined in the table.

New features and settings

Frequency measurement

HiZ>F <– do a frequency count
9xx FREQ COUNT ON AUX: 22199552Hz (22MHz)
HiZ>

As seen in the DS1077 demonstration, we added a frequency counter to the Bus Pirate’s AUX pin.  ‘F’ measures frequency, maximum of about 50MHz.

Assign axillary control

HiZ>c <– menu c
AUX PIN
1. AUX (DEFAULT)
2. CS/TMS
MODE>1 <– set AUX control mode
9xx AUX: DEFAULT SETTING (AUX PIN)
HiZ>

Sometimes we need to control the chip select (CS) /JTAG state machine (TMS) pins manually. ‘c’ toggles the pin control between the axillary pin and the chip select pin.

Set terminal speed

HiZ>b <– menu b
Set serial port speed: (bps)
1. 300
…
9. 115200
SPEED>9 <– set speed
Adjust your terminal and press space to continue
HiZ>

‘b’ adjusts the PC-side serial port speed.

Macros

A new syntax addition, ‘(#)’, triggers protocol dependent macros.

JTAG>(0) <–macro 0
0.Macro menu
1.Reset chain
2.Probe chain
3.XSVF player
JTAG>

In any mode, use the macro (0) to display a menu of available macros.

I2C address search

I2C>(1) <–scan I2C addresses macro
xxx Searching 7bit I2C address space.
Found devices at:
0xB0 0xB1 <–DS1077 responds to write and read address
I2C>

The I2C library includes a macro to automatically search the I2C address range for devices. Helpful when you work with an unknown chip.

Raw2wire smart card ISO 7813-3 ATR

RAW2WIRE>(1)<–ATR and decode macro
ISO 7813-3 ATR
950 AUX LOW
951 AUX HIGH
4xx RAW2WIRE 0×01 CLOCK TICKS
950 AUX LOW
ISO 7813-3 reply: 0xA2 0×13 0×10 0×91<–ATR bytes
Protocol: 2 wire <–decoded ATR data
Read type: to end<–
Data units: 256 <–
Data unit length: 8 bits <–
RAW2WIRE>

Macro 1 resets and identifies a smart card. For more about the ISO7813-3 ATR, see how we used the Bus Pirate to read a smart card.

JTAG

JTAG is a debugging and programming interface for all kinds of electronics. The raw hardware interface can be accessed with the Bus Pirate’s raw 3 wire library, but we added a few features to make it much easier.

JTAG has different modes where data entry does different things. Modes are navigated with the JTAG TMS signal; there are a bunch of JTAG modes, called states.The Bus Pirate’s JTAG library is just the raw 3 wire library, enhanced to help with JTAG state changes.

We only implemented the JTAG states we need to get data in and out of a JTAG device chain: reset, idle, data register, and instruction register. Macro (1) issues a JTAG chain reset, and initializes the chain to the idle state. { puts the JTAG chain in data register mode. [ puts the chain in instruction register mode. ] or } return the chain to the idle state. The Bus Pirate has an internal state machine tracker that is smart enough to manage the chain without explicitly returning the chain to idle; in other words, you don’t have to close your tags. The state machine tracker reports every state change to help debug problems.

JTAG>[0xfe {rrrr} <-- same as [0xfe]{rrrr}
xxx JTAGSM: ALREADY IDLE
xxx JTAGSM: IDLE->Instruction Register (DELAYED ONE BIT FOR TMS)
610 JTAG READY TO WRITE IR <– JTAG chain instruction register
620 JTAG WRITE: 0xFE <– request ID
xxx JTAGSM: (WROTE DELAYED BIT) IR->IDLE <–back to IDLE
xxx JTAGSM: IDLE->Data Register <–IDLE to data register
611 JTAG READY TO READ/WRITE DR
630 JTAG READ: 0×93 <–device ID
630 JTAG READ: 0×40
630 JTAG READ: 0×60
630 JTAG READ: 0×59
xxx JTAGSM: DR->IDLE <–back to idle
640 JTAG IDLE
JTAG>

Here is a short interaction with a Xilinx XC9572 CPLD. We go to the instruction register ( [ ), and send the device ID request command (0xfe). Then, we go the the data register( { ), read four bytes (rrrr, or r:4 shorthand), and return to idle ( } ).

What are delayed bit writes?

JTAG requires that the last data bit written to the instruction register be entered at the same time as the state change. Since the Bus Pirate has no way of predicting when we'll actually change states, it delays the last bit of each byte write until one of three things happens:

• Exit the instruction register with a }, ], or { command
• Write another byte value
• A read command

Pending bits are not cleared by bitwise operations (like ! or ^). Do these before writing your last byte, or change the code. We haven’t implemented pending writes to the data register, but it’s probably needed. You might need to implement this if you’re writing the data register, rather just reading, like we did.

JTAG Macros

JTAG>(1) <–macro 1
xxx JTAGSM: RESET
xxx JTAGSM: RESET->IDLE
JTAG>

JTAG macro (1) resets the JTAG chain and then advances it to the idle state.

JTAG>(2) <–macro 2
xxx JTAG INIT CHAIN
xxx JTAGSM: RESET
xxx JTAGSM: RESET->IDLE
xxx JTAGSM: IDLE->Instruction Register (DELAYED ONE BIT FOR TMS)
xxx JTAGSM: IR->IDLE
xxx JTAGSM: IDLE->Data Register
xxx JTAGSM: DR->IDLE
xxx JTAGSM: RESET
xxx JTAGSM: RESET->IDLE
xxx JTAGSM: IDLE->Data Register
xxx JTAG CHAIN REPORT: <–start of report
0×01 DEVICE(S)
#0×01 : 0×93 0×40 0×60 0×59 <–device IDs
xxx JTAGSM: DR->IDLE
JTAG>

Macro (2) resets the chain, counts the devices, and reports all the device IDs.

JTAG>(3) <–macro 3
6xx JTAG XSVF PLAYER
xxx XON/XOFF FLOW CONTROL REQUIRED <–required!
xxx PRESS z TO CONTINUE <– press z
xxx BEGIN XSVF UPLOAD <– upload the file
6×0 XSVF OK <– result or error
YOUR PC DRIBBLED MAX 0×05 BYTES AFTER XOFF (THAT’S OK)
6xx PRESS z 5 TIMES TO CONTINUE <– continue
JTAG>

Macro 3 is an XSVF player/programmer using code from Xilinx. XSVF is byte format SVF, as described by Xilinx (pdf). XSVF files can be compiled for any chain with the correct generic JTAG definition files, even non-Xilinx devices. We successfully used the binary transfer features in Hercules and Tera Term to send XSVF files to the programmer.

JTAG sometimes pauses longer than it takes the PC to transfer a byte of data, so we implemented XON/XOFF software flow control for the XSVF player. Your terminal must be in XON/XOFF flow control mode before you upload the XSVF file, or the programmer will fail. Even with software flow control, a modern PC has already send several bytes through the layers of operating system before it receives the flow control signals. We deal with this by catching these bytes before moving on, this is reported as the maximum number of bytes “dribbled”.

If there’s an error in the upload, the PC will probably continue to spit bytes at the Bus Pirate. To keep error messages visible, and prevent garbage in the terminal, the XSVF player waits for five lower case z’s before it returns to the prompt. We chose this sequence because it will never occur in an XSVF file.

*Note that the XSVF player does not respect the JTAG Hi-Z pin setting. Went it does, it fails. Be careful mixing voltages without a buffer.

Better code structure

The biggest difference between the version 0b and 0c firmware is a massive improvement in code structure. The Bus Pirate existed in many incarnations before we packaged it for the initial article. v.0c harmonizes the code libraries and makes it easier to add new protocols.

How to add a custom protocol

The Bus Pirate code handles the user interface, and passes two variables to the active protocol library. The first variable is a command, such as CMD_READ, CMD_READBULK, or CMD_WRITE. The entire command set is defined in base.h. The second variable is an optional value. A simple CMD_READ command passes no value, a bulk read command passes the number of bytes to read, a write command passes the value to write to the bus, etc. At minimum, a custom protocol needs a function to receive these variables and translate them to bus actions.

We used three different techniques to link commands to bus actions. Simple code can go directly in a giant switch statement, like SPI.c. External libraries use an single linking function, like I2C.c, and m_i2c_1.c. More complicated protocols use the switch statement to call functions included in the library (raw2wire.c, raw3wire.c, jtag.c UART.c). Helpful functions for terminal IO are included in base.h/c.

Due to massive code improvements, it’s now only mildly confusing to register a new protocol with the Bus Pirate:

base.h – Create a definition for the protocol. The last entry is currently “#define RAW3WIRE 7″, so the next entry could be “#define MYCUSTOMWIRE 8″.

busPirate.c – Include a header file with that gives access to the processing function.  Add a menu entry in the char* mode[]  = variable list. The menu entry must be in the same position on the list as the number assigned in the base.h define. If MYCUSTOMWIRE is number 8, it must be the eight entry in the mode variable. Finally, add an additional switch to the bpProcess() function that calls the custom library processing routine when the mode is set to “MYCUSTOMWIRE”.

Taking it further: a Hack a Day wish list

We compiled the feedback we’ve gotten into three wish lists: protocols, features, and macros.

Protocols

• 1-Wire, with enumeration (*ready as soon as we have parts to test it)
• OBD-II (thanks [Shadyman])
• CAN
• MIDI (Wikipedia)
• DMX512-A
• IRDA, RC5x, etc.

Some protocols will require an external transceiver.

Features

• Pulse-width modulator, frequency generator
• “Wait until interrupt” command
• Convert frequency measurement to input capture peripheral
• Allow frequency measurement on any pin
• Show a report of the current configuration settings and pin states.
• Integer repeat values for bulk read, clock ticks, delays, etc.
• A CRC generator

Macros

• Transparent UART bridge
• SD card initialization, meta data extract, and dump
• EEPROM program/dump (I2C/SPI)
• Nokia 6100 LCD initialization, control
• NMEA GPS data decoder

Do you have anything to add to the list?

Firmware download: buspirate.v0c.zip

Figuring out the JTAG pinout on a device turns out to be the most time consuming hardware portion of many hacks. [hunz] started a project called JTAG Finder to automatically detect the JTAG pinouts on arbitrary devices using an 8bit AVR ATmega16/32L microcontroller. Check out the slides (PDF) from the talk as they break down how one finds JTAG ports on an arbitrary device, with or without a pinout detection tool. [hunz] is looking for people to pick up the project where he left off.

Once you determine the correct pinout, you will need a JTAG cable: there are two main types, buffered and unbuffered, both of which I have soldered up and tested from these circuit diagrams (image of completed buffered cable here). The software most hardware people use today are the openwince JTAG Tools. To get the JTAG Tools to compile, grab the latest source directly from their CVS repository.

The last time we featured JTAG was with regards to Linksys devices, but the tools listed above can be applied to any device with JTAG.