Maxim’s iButtons, which are small ICs in button-sized disks, are starting to show up in more and more places. They have a range of uses, from temperature loggers to identification, and all use the 1-wire protocol to communicate. Over a furrtek, they hacked an iButton used for buying things from vending machines and created an infinite money cheat. They built a small rig based on the ATmega8 to read and write data to the chip. The data was encrypted, so it wasn’t feasible to put an arbitrary amount on the card. Instead, they used a similar technique to the Boston subway hack and restored a previous state to the iButton after something was bought. They also created a hand-held device to backup and restore the contents of a button for portable hacking.

[Thanks furrtek]

Download: buspirate.v0d.zip

Dallas/Maxim’s 1-Wire protocol is the most requested addition to the Bus Pirate.  We finally got some 1-Wire parts, and today we’ll demonstrate the DS1822 1-Wire digital thermometer. Grab the datasheet (PDF) and follow along.

This post is accompanied by release v.0d of the Bus Pirate firmware for hardware version 0. This includes the new 1-Wire protocol library, more configuration options, and other improvements.

DS1822 Economy Digital Thermometer (Digikey #DS1822+-ND, $3.87) We found a footprint in the 1-wire library for Eagle on the Cadsoft download page.

The 1-Wire protocol uses a single wire for data transfer, and sometimes power. Data is transferred in time-sensitive ‘slots’ because there isn’t a separate clock to delineate bit periods.

The DS1822 connections are shown in the table. We used the Bus Pirate’s 5volt supply to power the DS1822, but it also works at 3.3volts. A resistor (R1, ~5K) holds the bus high.

All 1-Wire commands start with a reset procedure, followed by one of five ROM commands.

ROM commands are described on page 10 of the datasheet. All ROM commands are available as macros in the Bus Pirate 1-Wire library, see (0) for a menu. ROM command macros include the 1-Wire bus reset procedure.

Single device

All 1-Wire devices have a unique 64bit (8 byte) address, and some 1-Wire devices are used exclusively to give electronics a unique tracking number. When a single device is connected to a 1-Wire bus, the READ ROM command will extract its address.

1-WIRE>{ 0×33 r:8 <–command
xxx 1WIRE BUS RESET OK
xxx 1WIRE WRITE: 0×33 <–READ ROM
xxx 1WIRE BULK READ, 0×08 BYTES:
0×22 0×47 0×45 0×22 0×00 0×00 0×00 0×29 <–ID#
1-WIRE>

The command sends a bus reset ({), the READ ROM command (0×33), and reads the 64bit address (r:8, 8 bytes *8bits/byte=64bits).

The first byte (0×22) identifies this as a DS1822 thermometer. The next 6 bytes are unique to this device, and the final byte is a CRC of the previous 7 bytes.

Now we can address the device with the MATCH ROM command and send it further instructions.

1-WIRE>{ 0×55 0×22 0×47 0×45 0×22 0×00 0×00 0×00 0×29 0×44
xxx 1WIRE BUS RESET OK
xxx 1WIRE WRITE: 0×55<–MATCH ROM command
xxx 1WIRE WRITE: 0×22<–start address
xxx 1WIRE WRITE: 0×47
xxx 1WIRE WRITE: 0×45
xxx 1WIRE WRITE: 0×22
xxx 1WIRE WRITE: 0×00
xxx 1WIRE WRITE: 0×00
xxx 1WIRE WRITE: 0×00
xxx 1WIRE WRITE: 0×29
xxx 1WIRE WRITE: 0×44 <–start conversion
1-WIRE>

First, we send the MATCH ROM command (0×55) and the device address (8 bytes).  Next is the CONVERT T command (0×44, datasheet page 11) that starts the temperature conversion.

A second command sequence retrieves the temperature reading from the DS1822.

1-WIRE>{ 0×55 0×22 0×47 0×45 0×22 0×00 0×00 0×00 0×29 0xbe r:9
xxx 1WIRE BUS RESET OK
xxx 1WIRE WRITE: 0×55
xxx 1WIRE WRITE: 0×22
…long 1-Wire address…
xxx 1WIRE WRITE: 0×29
xxx 1WIRE WRITE: 0xBE <–read scratchpad command
xxx 1WIRE BULK READ, 0×09 BYTES:
0×71 0×01 0xFF 0×00 0x7F 0xFF 0x0F 0×10 0xF8
1-WIRE>

The READ SCRATCHPAD command (0xBE, datasheet page 11) returns 9 bytes. We only care about the first two bytes, the rest can be decoded according the the table on page 7 of the datasheet. Temperature is calculated according to page 4 of the datasheet: 0×0171 HEX=369 DEC, 369*0.0625=23C  (74F).

Multiple devices

When multiple 1-Wire devices share a bus it’s more difficult to determine all the addresses. The fastest way to find attached devices is with the SEARCH ROM command (0xF0) and a binary branching procedure. The Bus Pirate automates this with macro (240).

1-WIRE>(240) <–macro 240
xxx 1WIRE ROM COMMAND: SEARCH (0xF0)
Found devices at:
Macro     1-WIRE address
1.0×22 0×50 0×28 0×22 0×00 0×00 0×00 0x0A <–address
*DS1822 Econ Dig Therm <–type according to family code
2.0×22 0xD0 0xC7 0x1A 0×00 0×00 0×00 0×01
*DS1822 Econ Dig Therm
3.0×22 0×47 0×45 0×22 0×00 0×00 0×00 0×29
*DS1822 Econ Dig Therm
Found 0×03 devices.
The first 10 device IDs are available by MACRO, see (0).
1-WIRE>

The SEARCH ROM command shows the devices it found, and the type according to the family code.

We think typing 8 byte 1-Wire addresses is really tedious, so the first 10 device addresses are stored in memory and can be accessed with the macros (1)…(10). A buffer for up to 50 device addresses can be defined in the 1-Wire library at compile time. Ideally, this data will be stored in a global scratch buffer shared by all modules in a future firmware update.

1-WIRE>(0) <–show macro list
0.Macro menu
Macro     1-WIRE address <–enumerated device addresses
1.0×22 0×50 0×28 0×22 0×00 0×00 0×00 0x0A
*DS1822 Econ Dig Therm
2.0×22 0xD0 0xC7 0x1A 0×00 0×00 0×00 0×01
*DS1822 Econ Dig Therm
3.0×22 0×47 0×45 0×22 0×00 0×00 0×00 0×29
*DS1822 Econ Dig Therm
1-WIRE ROM COMMAND MACROs:<–normal commands
51.READ ROM (0×33) *for single device bus
85.MATCH ROM (0×55) *followed by 64bit address
204.SKIP ROM (0xCC) *followed by command
236.ALARM SEARCH (0xEC)
240.SEARCH ROM (0xF0)
1-WIRE>

The macro menu (0) will also include the device addresses stored in the roster. Now we can just address devices by macro, rather than typing the whole 64bit address every time.

1-WIRE>(85) (1) 0×44 <–start conversion
xxx 1WIRE BUS RESET OK
xxx 1WIRE WRITE ROM COMMAND: MATCH (0×55) *follow with 64bit address
xxx 1WIRE ADDRESS MACRO 1: 0×22 0×50 0×28 0×22 0×00 0×00 0×00 0x0A
xxx 1WIRE WRITE: 0×44
1-WIRE>(85) (1) 0xbe r:9 <–fetch reading
xxx 1WIRE BUS RESET OK
xxx 1WIRE WRITE ROM COMMAND: MATCH (0×55) *follow with 64bit address
xxx 1WIRE ADDRESS MACRO 1: 0×22 0×50 0×28 0×22 0×00 0×00 0×00 0x0A
xxx 1WIRE WRITE: 0xBE
xxx 1WIRE BULK READ, 0×09 BYTES:
0×81 0×01 0x4B 0×46 0x7F 0xFF 0x0F 0×10 0×71
1-WIRE>

(85) is a shortcut for a bus reset and MATCH ROM command. (1) is the device address macro, and 0×44 is the command to begin a temperature conversion. Retrieving the reading involves the same macros, but substitutes the command to read the device (0xBE) and grabs 9 bytes (r:9). The temperature is 0×0181, or 24C next to the PC fan.

Taking it further

We used the Bus Pirate to give a visual demonstration of the 1-Wire protocol, but the real challenge is integrating it into your own design. Maxim provides example code, Microchip has an app note (PDF), and you can check out the example code we used.

Firmware download: buspirate.vod.zip

The DS1077 is a 5volt, 133MHz to 16kHz programmable clock source. The internal frequency divider is configured over a simple I2C interface, and the chip requires no external parts. Not bad for under $2. We used the Bus Pirate to test this chip before using it in a project. Grab the datasheet (PDF) and follow along.

DS1077, $1.69 direct from Maxim + $10 shipping.

This chip isn’t available at any major distributors yet, but Maxim has them for under $2/each with a flat $10 shipping charge. This is an 8pin SOIC surface mount chip, so we made a small breakout board for testing.

Test circuit

Pin connections

We powered the DS1077 from the Bus Pirate’s 5volt power supply. Two resistors, R1 and R2, pull-up the I2C bus to 5volts when it’s not in use. Capacitor C1 is 0.01uF and C2 is 0.1uF, as recommended by the datasheet. Control pins provide some additional functions, but we bypassed them to ground during our test. Output1 is the primary clock signal pin.

Interfacing

We put the Bus Pirate into I2C mode (M, options: I2C, 100kHz). The external pull-up resistors hold the bus at 5volts, so it’s important to leave the on-board 3.3volt pull-up resistors off (default).

I2C>{0b10110000} <– DS1077 write address
210 I2C START CONDITION
220 I2C WRITE: 0xB0 GOT ACK: YES <– got ACK
240 I2C STOP CONDITION
I2C>

First, we broadcast the DS1077′s address and see if it acknowledges. The address of the DS1077 is 1011, plus three programmable bits (000 by default), and the read (1) or write (0) bit. We got an ACK, so we know that the circuit is working and our connections are good.

The DS1077 is controlled by writing values to the locations shown in the table.

I2C>{0xb0 0x0d 0b00001000} , <–write to BUS register
210 I2C START CONDITION
220 I2C WRITE: 0xB0 GOT ACK: YES <–DS1077 write address
220 I2C WRITE: 0x0D GOT ACK: YES <– BUS register
220 I2C WRITE: 0×08 GOT ACK: YES <– BUS register setting
240 I2C STOP CONDITION
I2C>

By default, the DS1077 saves all changes to the EEPROM. We don’t need this during testing, so we disable it by setting bit 3 (0b1000) of the BUS register (0x0d). The first four bits must be left as 0, the last three bits select the address to accommodate multiple DS1077s on the same I2C bus. See datasheet page 7.

I2C>{0xb0 0×02 0b00011000 0b00000000} <–set the 16bit MUX value
210 I2C START CONDITION
220 I2C WRITE: 0xB0 GOT ACK: YES <–DS1077 write address
220 I2C WRITE: 0×02 GOT ACK: YES <–MUX register
220 I2C WRITE: 0×18 GOT ACK: YES <–data byte 1
220 I2C WRITE: 0×00 GOT ACK: YES <–data byte 2
240 I2C STOP CONDITION
I2C>

The MUX register controls the prescalers, CTRL pin functions, and frequency divider.  We disable the prescaler and CTRL pins, and enable the 10bit frequency divider.  The MUX register is explained on page 5 of the datasheet.

Specific frequencies are generated by dividing the 133MHz reference frequency through the prescalers and a 10bit (1025 level) programmable divider.  The clock is divided by the amount specified in the DIV register, plus two. When DIV=0, the output is 133MHz/2=66MHz.

This scheme gives the best frequency resolution in low ranges, and no steps between 133MHz and 66MHz.

I2C>{0xb0 1 0b11111111 0b11000000} <–DIV=1025
210 I2C START CONDITION
220 I2C WRITE: 0xB0 GOT ACK: YES <–DS1077 write address
220 I2C WRITE: 0×01 GOT ACK: YES <– DIV register
220 I2C WRITE: 0xFF GOT ACK: YES <– bits 9:2
220 I2C WRITE: 0xC0 GOT ACK: YES <– bits 1:0
240 I2C STOP CONDITION
I2C>f  <–do a frequency count
9xx FREQ COUNT ON AUX: 16128Hz (16kHz) <– DS1077 frequency
I2C>

We set all the bits in the DIV register to 1 for maximum frequency division. ‘F’ measures the frequency on the AUX pin, which is connected to the DS1077 clock output. With DIV=1025, the frequency is about 16kHz.

I2C>{0xb0 1 0 0} <– DIV=0, 133MHz divide by 2
…
9xx FREQ COUNT ON AUX: 0Hz <–66MHz, too fast to count

————-

I2C>{0xb0 1 0 0b10000000} <– DIV=2
…
9xx FREQ COUNT ON AUX: 3339696Hz (33MHz) <–133MHz/4

————-

I2C>{0xb0 1 0b00000001 0b00000000} <–DIV=4
…
9xx FREQ COUNT ON AUX: 22192384Hz (22MHz) <–133MHz/6

We can play with the divider and generate a range of frequencies. The output is always equal to the reference frequency (133MHz) divided by DIV+2. The Bus Pirate’s input pin is only capable of measuring about 50MHz, so the highest speeds don’t register. A future version of the Bus Pirate should include a gigahertz prescaler for high frequency measurement.

I2C>{0xb0 0x3f} <–write E2 register

Finally, we can write the E2 register (0x3f) to save these setting in the EEPROM. The DS1077 will now return to these settings at power-on.

Conclusion

The DS1077 simplifies complex clock sources by moving a programmable oscillator and frequency divider into a single chip. It isn’t available from distributors, but you can buy it directly from Maxim. If you need better control of high frequencies, check out the DS1085 with 10kHz steps from 133MHz to 8kHz. The DS1085L is a 3.3volt, 66MHz version available at Digikey.