The usual way send data from a microcontroller is either over RS-232 with MAX232 serial ICs, crystals, and a relatively ancient computer, or by bit-banging the USB protocol and worrying about driver issues. Not content with these solutions, [Scott] came up with sound card μC/PC communication that doesn’t require any extra components.

[Scott] bought a cheap USB sound card dongle on eBay (although a built-in sound card will do) and wired up the tip and ring of the plug to the microcontroller. The data is sent from the microcontroller a lot like Morse code – a short gap between pulses is a zero, a long gap is a one. This is parsed by a Python script using PyAudio. Synchronization, timing, and calibration is automatic because of a 10-bit ‘packet header’ explained in this video.

After he had a really great way of sending data from a microcontroller to a PC, [Scott] asked himself if it would be possible to have bidirectional communication. Using the same sound card setup, he managed to get bidirectional communication off an ATtiny44a. You can see his demo video of this here.

The cleverness of hack is overwhelming, and we’re kind of amazed that this technique isn’t in the standard repertoire of solder monkeys. After looking at this, we’re tempted to throw out the half-dozen USB/RS-232 adapters we have lying around. They never worked anyway. Check out [Scott]‘s highly informative video of his build below.

If you’re planning to do some hacking with CPLD or FPGA chips you’ll need a way to program them. JTAG is one of the options and here’s a cheap method that uses the serial port (translated).

This method requires only four signals (TDI, TMS, TCK and TDO) plus ground. But the problem is that an RS232 serial port operates with 12V logic levels and the JTAG side of the programmer needs to operate with the logic levels native to the device you’re programming. Commercial programmers use a level convert IC to take care of this for you, but that doesn’t mesh with the cheap goal of this project. Instead, [Nicholas] uses Zener diodes and voltage dividers to make the conversion. There is also an LED for each data signal to give some feedback if you’re having trouble.

You can use this along with a programming application that [Nicholas] whipped up using Visual Studio. It works well via the serial port, but he did try programming with a USB-to-Serial dongle. He found that this method slows the process down to an unbearable 5-minutes. Take a look, maybe you can help to get that sloth-like programming up to a manageable speed.

[Thanks Alex]

[Mike Lu] likes to add serial ports to his routers to use for debugging but he didn’t want to drill holes in his new RT-N12. After a bit of head-scratching he thought about repurposing the four unused wires on one of the RJ45 Ethernet connectors. This would allow him to interface with the necessary signals and still have the option of using that port for a network connection. The first step was to build the circuit to output the correct serial levels and connect it to the unused pins on the jack. Next, to separate serial and Ethernet on the outside of the router he build a short adapter cable.

This is an elegant solution if you’re looking for zero case modifications. But if you don’t mind a few inconspicuous holes we love the serial port used on this Dockstar.

[Geordy] added a serial port to his Zipit. It uses a 3.5mm jack as the connector. He managed to include an RS232 level converter inside the case. Both components were hard to fit into the cramped quarters but he did it and he kept the hacker-friendly device looking nice too.

We use the Bus Pirate to interface a new chip without writing code or designing a PCB. Based on your feedback, and our experience using the original Bus Pirate to demonstrate various parts, we updated the design with new features and cheaper components.

There’s also a firmware update for both Bus Pirate hardware versions, with bug fixes, and a PC AT keyboard decoder. Check out the new Hack a Day Bus Pirate page, and browse the Bus Pirate source code in our Google code SVN repository.

We cover the design updates and interface a digital to analog converter below.

Concept overview

The Bus Pirate started as a collection of code fragments we used to test new chips without endless compile-program-run development cycles. We released it in a how-to and used it to demonstrate a bunch of serial interface ICs in our parts posts. This article introduces an updated design with new features and a bunch of improvements.

• Surface mount design
• Pull-up resistors on all bus lines with external voltage source
• Software resettable 3.3volt and 5volt power supplies
• Voltage monitoring of all power supplies
• An external voltage measurement probe
• Cheaper parts

Hardware

Click for a full size schematic image (PNG). The circuit and PCB are designed using the freeware version of Cadsoft Eagle. All the files for this project are included in the project archive linked at the end of the article.

Microcontroller

We used a Microchip PIC24FJ64GA002 28pin SOIC microcontroller (IC1) in this project. The power pins have 0.1uF bypass capacitors to ground (C1,2). The 2.5volt internal regulator requires a 10uF tantalum capacitor (C20). The chip is programmed through a five pin header (ICSP). A 2K pull-up resistor (R1) is required for the MCLR function on pin 1. Read more about this chip in our PIC24F introduction.

RS-232 transceiver

An inexpensive MAX3232CSE RS232 transceiver (IC2) interfaces the PIC to a PC serial port. This chip replaces the expensive through-hole MAX3223EEPP+ used in the previous version of the Bus Pirate. The serial interface will work with a USB->serial adapter.

Bus pull-up resistors

The original Bus Pirate has 3.3volt pull-up resistors on 2 pins, but most of our tests required additional external resistors. The updated design has pull-up resistors (R20-23) on the three main bus signals (data in, data out, clock) and the chip select (CS) pin.

A row of jumpers (SV5) connects each resistor to an external voltage supplied through the Vext terminal (X4). Through-hole resistors are used like jumper-wires to make the PCB easier to etch at home.

We couldn’t find an elegant way to control an arbitrary voltage pull-up resistor array from a 3.3volt microcontroller. If you have any ideas, please share them in the comments.

Power supply

VR1 is a 3.3volt supply for the microcontroller and RS232 transceiver. VR2 is a 5volt supply. Both require two 0.1uF bypass capacitors (C3-C6). J1 is a power supply jack for a common 2.1mm DC barrel plug. 7-10volts DC is probably the ideal power supply range.

The original Bus Pirate had dual power supplies, 3.3volts and 5volts, so most ICs could be interfaced without an additional power supply. A major annoyance was the lack of a power reset for connected chips. If a misconfigured IC needed to be power-cycled, we had to disconnect a wire. We got so tired of this routine that we added a software controlled reset to the updated design.

VR3 (3.3volts) and VR4 (5volts) are TI TPS796XX voltage regulators with an enable switch. A high level on pin 1 enables the regulator. A pull-down resistor (R13,R12) ensures that the regulators are off when the PIC isn’t actively driving the line, such as during power-up initialization. The datasheet specifies a hefty capacitor on the input (C23, C21) and output (C24, C22) pins, we used the same 10uF tantalum we use everywhere. An additional, optional, 0.1uF capacitor (C12,C11) can improve regulation.

The switchable regulators are powered by VR2, a 5volt supply.  We did this because the maximum input for VR3 and VR4 is 6volts, leaving the device with a narrow 5.2-6volt power supply range. VR2 will work well above 10volts, and provides an adequate supply for the other regulators.

VR3 (3.3volts) has plenty of headroom to operate from a 5volt supply. VR4 (5volts) will lose about 0.2volts, but 4.8volts remains well within the acceptable range for most 5volt chips. In practice, and under light loads, we see less than 0.1volts drop-out from VR4.

Voltage monitoring

Voltage monitoring is a new feature we’re really excited about. Has your project ever mysteriously stopped responding because of an accidental short circuit? The Bus Pirate’s power supplies are equipped with voltage monitoring that can detect a change in power levels.

Each monitored signal is connected to an analog to digital converter (ADC) through a resistor voltage divider. Two 10K resistors (R10,R11 above) divide the input voltage in half, making it possible to measure up to 6.6volts with the 3.3volt PIC microcontroller.

The Bus Pirate has four voltage monitors. The 3.3volt and 5volt power supplies are monitored, as is the external voltage fed to the pull-up resistors. A fourth monitor is connected to pin 9 of the output header to make a voltage probe.

PCB

Click for a full size placement diagram (PNG). The board is a quasi single-sided design, we etched ours in the lab on a single-sided photo-resist PCB. At the top, near C13, two jumper wires meet at a single via; we soldered one jumper wire to the other on the back of the board.

Part list

Firmware

The firmware is written in C using the free demonstration version of the PIC C30 compiler. Learn all about working with this PIC in our introduction to the PIC 24F series.

The latest firmware is posted on the Hack a Day Bus Pirate page. The latest source is in our Google Code SVN repository.

Using it

The diagram above shows the Bus Pirate pinout.

We made a cable with alligator clips on the end, and added labels to each wire so we don’t have to refer to this table every time we interface a new chip.

If you know of any cool connectors or cables, please link to them in the comments.

LTC2640 SPI digital to analog voltage converter

The Linear Technology LTC2640-LZ8 is an 8bit digital to analog converter (DAC) programmed over SPI. A DAC is essentially a programmable voltage divider. They’re useful for recreating waveforms, such as audio signals. An 8bit DAC has 255 even intervals between 0 and the reference voltage, the L part we used has an internal 2.5volt reference.

The LTC2640 only comes in a small SOT223-8 package, so we made a breadboard adapter in the profile of a DIP-8 chip.  Our LTC2640 footprint is included in the project archive attached at the end of this article.

The schematic above shows our test circuit for the LTC2640. It requires a 2.7-5volt power supply, we used the Bus Pirate’s 3.3volt supply. C1 is a bypass capacitor between the power pin and ground. Pin 8 is an active-low reset pin, tie it high for normal operation. Pin 7 is the DAC output, connect the Bus Pirate voltage measurement probe (ADC) here.

We connected the Bus Pirate to the LTC2640 as shown in the table. The LTC2640 doesn’t have a data output pin, this SPI connection remains unused.

The Bus Pirate’s hardware SPI library and software RAW3WIRE library are compatible with the LTC2640′s SPI interface. We used the SPI library; if you use the RAW3WIRE library be sure to choose normal pin output.

HiZ>m<–select mode
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. JTAG
7. RAW2WIRE
8. RAW3WIRE
9. PC AT KEYBOARD
MODE>5<–SPI or RAW3WIRE
900 MODE SET
Set speed:
1. 30KHz
2. 125KHz
3. 250KHz
4. 1MHz
SPEED>1 <–test at low speed
…
102 SPI READY
SPI>

Press M for the Bus Pirate mode menu, choose 5 for SPI mode. There are a bunch of configuration options for the SPI module, use the default options for all of them. After SPI mode is ready we need to configure the power supply.

SPI>p<–power supply setup
W/w toggles 3.3volt supply?
1. NO
2. YES
MODE>2<–use 3.3volt supply
W/w toggles 5volt supply?
1. NO
2. YES
MODE>1<–don’t use 5volt supply
9xx SUPPLY CONFIGURED, USE W/w TO TOGGLE
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 0.0 | VPULLUP: 0.0 |
SPI>

p opens the Bus Pirate power supply menu. We use the 3.3volt supply but not the 5volt supply. The voltage monitor verifies that the power supplies are off.

SPI>W<–capital W (silly CSS) enables power supply
9xx 3.3VOLT SUPPLY ON
SPI>v<–voltage monitor
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 3.3 | VPULLUP: 0.0 |
SPI>

Capital ‘W’ enables any power supplies selected in the previous menu, a small ‘w’ disables them. V displays the supply voltage monitor, which now shows 3.3volts output from the 3.3volt supply.

Now that configuration is finished, we can send commands to the LTC2640 over the SPI bus. The LTC2640 has a 24bit (3byte) interface protocol. The first byte is a command, followed by two data bytes. The LTC2640 is available in 8,10, and 12bit versions; the 8bit version uses the first byte to set the DAC value, and ignores the second byte.

SPI>[0b00110000 255 0]<–set DAC to full
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0xFF<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
SPI>

Every SPI command begins by enabling the chip select pin ([). The first byte is the command to update the DAC (0b00110000), followed by the value to output (255), and a third byte that's ignored (0). The command ends by disabling chip select (]).

We used an 8bit DAC with 255 even voltage steps, output set to 255 is 100%. We can use the Bus Pirate voltage probe to measure the output.

SPI>d<–measure voltage
9xx VOLTAGE PROBE: 2.5VOLTS<–DAC output
SPI>

D triggers a voltage measurement. The DAC output voltage is 100% (255/255) of the internal reference, 2.5volts.

SPI>[0b00110000 0 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0×00<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 0.0VOLTS<–DAC output
SPI>

The same command with a DAC value of 0 outputs 0% (0/255) of 2.5volts; 0volts.

SPI>[0b00110000 128 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×30<–write DAC command
120 SPI WRITE: 0×80<–DAC value
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 1.2VOLTS<–DAC output
SPI>

A DAC value of 128 is about 50% (128/255) of the reference voltage, 1.2volts.

SPI>[0b01000000 0 0] d
110 SPI CS ENABLED
120 SPI WRITE: 0×40<–power down command
120 SPI WRITE: 0×00<–don’t care
120 SPI WRITE: 0×00<–don’t care
140 CS DISABLED
9xx VOLTAGE PROBE: 0.0VOLTS<–DAC off
SPI>

The LTC2640 has a low power mode, triggered by the command 0b01000000 and two bytes that are ignored. After the power down command we can verify that there’s output from the DAC. Write any DAC value to exit low power mode.

Taking it further

What’s the next step for the Bus Pirate? We’ll eventually make a final update to the design that includes USB on a professionally made, double-sided PCB. Power supply indicator LEDs were slated for this version, but didn’t get included. It would also be handy to have an AT  keyboard connector for debugging without a PC. Check out the roadmap and wishlists on the Hack a Day Bus Pirate page.

Download: buspirate.v1a.zip

UPDATE: New firmware with JTAG and more

We’re always excited to get a new chip or SIM card to interface, but our enthusiasm is often dampened by the prototyping process. Interfacing any chip usually means breadboarding a circuit, writing code, and hauling out the programmer; maybe even a prototyping PCB.

A few years ago we built the first ‘Bus Pirate’, a universal bus interface that talks to most chips from a PC serial terminal. Several standard serial protocols are supported at 3.3-5volts, including I2C, SPI, and asynchronous serial. Additional ‘raw’ 2- and 3- wire libraries can interface almost any proprietary serial protocols. Since this has been such a useful tool for us, we cleaned up the code, documented the design, and released it here with specs, schematic, and source code.

Concept Overview

The Bus Pirate is a serial terminal bridge to multiple IC interface protocols. We type commands into a serial terminal on the computer. The commands go to the Bus Pirate through the PC serial port. The Bus Pirate talks to a microchip in the proper protocol, and returns the results to the PC.

All pins output 3.3volts, but are 5volt tolerant. On-board 3.3volt and 5volt power supplies are available to power the connected chip. Software configurable I2C pull-up resistors complete the package.

The serial terminal interface works with any system: PC, Mac, Linux, Palm Pilots, WinCE devices, etc; no crapware required. We considered a USB device, but USB isn’t compatible with the huge number of hand-held devices that have a serial port. We also wanted a 3.3volt device with 5volt tolerant inputs, but most popular through-hole USB microcontollers were 5volt parts (e.g. the PIC18Fx550).

The Bus Pirate currently ‘speaks’ three hardware protocols for high-speed interfacing, and has two software protocol libraries for easy bus manipulation. The theory and specification of each protocol is beyond what we can cover here, but check out some of these tutorials:

I2C

A slow 2 wire bus. Wikipedia is a great place to start for I2C background. I2C-Bus.org, Robot Electronics, Embedded Systems Academy, and Embedded.com have decent I2C tutorials.

SPI

A simple 3 wire bus. Wikipedia has background; Embedded.com has a great tutorial and comparison to I2C.

Universal Asynchronous Receiver Transmitter (UART or serial)

A clock and timing dependent serial protocol best known for its appearance as the PC serial port protocol. Wikipedia has background on asynchronous serial protocols.

Raw 2 wire

This is a generic 2 wire protocol library, similar to I2C but without an ACK bit. I2C and many proprietary 2 wire protocols can be formed using the bus manipulations available in this mode. Use this library to work with non-I2C 2 wire devices, like smartcards or Sensirion SHT11 temperature/humidity sensors.

Raw 3 wire

This is a generic 3 wire protocol library, similar to SPI but without the constraints of a hardware module. Use this library to work with devices that use non-8bit compatible 3-wire protocols, like the Sparkfun Nokia 6100 LCD knock-off. Many 3 wire protocols can be formed using the bus manipulations available in this mode.

Hardware

Click for a full size PCB placement image (PNG). Screw terminals connect to the power supplies. A row of seven pin headers connect to the IO pins. Despite the label, only 7volts DC is required.

This table shows the pin connections for each bus mode. Raw 2 wire mode uses the same pin configuration as I2C. Raw 3 wire mode uses the same pin configuration as SPI.

Click for a full size circuit image (PNG). The circuit and PCB are designed using the freeware version of Cadsoft Eagle. Download the project archive (ZIP).

PIC 24FJ64GA002

We used a PIC24FJ64GA002 microcontroller in the Bus Pirate; this is the same chip we used in our mini-server project. It’s fast enough to do everything we want (16MIPS), and the peripheral pin select feature allows the hardware SPI, UART, and I2C modules to share output pins. Each power pin needs a decoupling capacitor(C12,13), and the MCLR function requires a resistor (R7) between pin 1 and 3.3volts. The PIC has an internal voltage regulator that requires a 10uF tantalum capacitor (C3), though we used a plain electrolytic capacitor without issue. Read about programming and working with this chip in our PIC24F tutorial. If you don’t have a PIC debugger, several readers recommend the under-$40 ICD2 clones on eBay.

The PIC runs at 3.3volts, but the digital-only pins are 5volt tolerant for interfacing 5volt logic. Pins 14,15,16,17,18,21, and 22, are digital only, which we determined by looking through the datasheet and eliminating any pins with an analog connection type (table 1-2, pages 11-16). According to the datasheet, I2C pins are also 5volt tolerant. There’s a bunch of conflicting information on the web, but datasheet page 230, parameter DI28, clearly states that the max input for a 24FJ64GA002 I2C pin without analog circuitry is 5.5volts.

Pins 21 and 22 (RB10/11) can pull-up SDA/SCL through resistors R4 and R5.

MAX3223CPP

This chip converts 3.3volt serial output to +/-10volt RS232 signals compatible with a PC serial port. The MAX3223CPP is a 3-5volt version of the MAX202, with extra power saving features. MAX RS232 transceivers require four 0.1uF capacitors for a charge pump (C4,5,7,8), and one decoupling capacitor (C17). We used the same capacitors for everything.

We used a MAX3223CPP, which doesn’t seem to be available anymore. MAX3223EEPP+ is a pin-compatible newer version, available at Digikey for $7. Ouch! None of the 3223′s power saving features are used, so a cheaper, simpler 3.3volt RS232 transceiver should be substituted if at all possible.

Power supplies

Most chips can be powered from the Bus Pirate’s on-board 3.3volt and 5volt supplies. 5volts is supplied by a common 7805 regulator (VR2) and two decoupling capacitors (C9,10). An LM317 adjustable regulator (VR1) is set to 3.3volts using two resistors (R2,3), and requires two decoupling capacitors (C6,7). The circuit requires a 7-10volt DC supply (J1).

Part list

Firmware

The firmware is written in C using the free demonstration version of the PIC C30 compiler. Learn all about working with this PIC in our introduction to the PIC 24F series. Download the project archive (ZIP).

main.c – Handles the user terminal interface.

busPirate.c – Abstraction routines that convert syntax to actions on the proper bus.

uartIO.c – IO routines for both hardware UARTs.

m_i2c_1.c – Software I2C routines by [Michael Pearce]. We couldn’t get the PIC hardware I2C to work, so we used this helpful library. The software doesn’t take into account the I2C speed setting, and seems to work at about 5KHz.

SPI.c – Routines that drive the hardware SPI module.

raw2wire.c – Software 2-wire interface library.

raw3wire.c – Software 3-wire (SPI) interface library.

User input is held in a 4000 byte buffer until a newline character (enter) is detected. If the first character of the input is a menu option (see below), the menu dialog is shown, otherwise the string is parsed for data to send over the bus (see syntax). The code consists of an embarrassing number of switch statements and spaghetti code.

Terminal interface

Rather than write a junk piece of software to control the device, we gave it a serial command line interface that will work with any ASCII terminal.  The bus pirate responds to commands with three digit result codes and a short message. The codes are designed with PC automation in mind. We’ve included a table of result codes in the project archive (zip).

Menu options

Menu options are single character commands that don’t involve data transfers. Enter the character, followed by <enter>, to access the menu.

? – Show a help menu with commands and syntax.

M – Set the bus mode (SPI, I2C, UART, raw 2 wire, raw 3 wire). Followed immediately by a prompt for speed, polarity, and output state (mode dependent).

• Bus speeds: SPI:30, 125, 250, 1000KHz. I2C:100, 400, 1000KHz. UART: 300, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200bps. Raw modes: 1, 10, 50KHz.
• Inverse clock setting sets the idle state opposite of normal (normal SPI:idle low; normal UART:idle high): SPI:idle high; UART:idle low.
• Some modes have optional high-z output modes for use with pull-up resistors (Low=ground, High=input).

L – Toggle bit transmit/receive order: most/least significant bit first.

P – SDA/SCL pin pull-up resistor toggle (3.3volts). Only valid in I2C and raw 2 wire modes.

O – Set number output display format. The terminal can display numbers as decimal, hexadecimal, and binary ASCII values. A fourth format sends the raw, unprocessed byte for reading ASCII formatted text.

Syntax

A simple syntax is used to communicate with chips over a bus.  Syntax commands have generic functions that generally apply to all bus types.

A/a/@ – Toggle auxiliary pin. Capital “A” sets AUX high, small “a” sets to ground. @ sets aux to input (high impedance mode) and reads the pin value.

[ - Start data write. SPI/raw 3 wire: chip select enabled. I2C/raw 2 wire: start condition. RS232: open UART, discard received bytes.

{ - Start data write with reads. Same as [, except: SPI/raw 3 wire: show the read byte for each write. RS232: display data as it arrives asynchronously.

] or } – End data write. SPI/raw 3 wire: chip select disabled. I2C/raw 2 wire: stop condition. RS232: close UART.

R/r – Read byte. SPI/raw 3 wire: send dummy byte, return read. I2C: read byte with ACK. Raw 2 wire: read 8 bits. RS232: check UART for byte and return, or fail if empty. Use 0r1…255 for bulk reads up to 255 bytes.

0b – Write this binary value. Format is 0b00000000 for a byte, but partial bytes are also fine: 0b1001.

0h or 0x – Write this HEX value. Format is 0h01 or 0×01. Partial bytes are fine: 0xA. A-F can be lower-case or capital letters.

0-255 – Write this decimal value. Any number not preceded by 0x, 0h, or 0b is interpreted as a decimal value.

, or space - Value delimiter. Use a coma or space to separate numbers. Any combination is fine, no delimiter is required between non-number values: {0xa6,0, 0 16 5 0b111 0haF}.

Direct bus manipulation commands for raw 2 wire mode and raw 3 wire mode.
^ – Send one clock tick. Use 0^1…255 for multiple clock ticks.

/ and \ – Toggle clock level high (/) and low (\). Includes clock delay (100uS).

-/_ – Toggle data state high (-) and low (_). Includes data setup delay (20uS).

! - Read one bit with clock.

. - Read data pin state (no clock).

& – Delay 1uS. Use 0&1…255 for multiple delays.

Using it

Here are two examples that show the Bus Pirate in action. Terminals should be set to ASCII mode with local echo, we used the Windows serial terminal. The PC-side serial connection is 115200bps, 8N1. The Bus Pirate should respond to any single line feed type (0x0a, 0x0d), or both (Windows style).

.I2C/SPI – Flash 24LC1025 EEPROM

Microchip’s EEPROMS are popular permanent-storage memory chips, the 24LC1025 has 128Kbytes of storage with an I2C interface.  We can test this chip without bread-boarding a big circuit or writing code.

The picture shows an 24LC1025 connected to the Bus Pirate. The EEPROM works from 2.7 to 5volts, so we used the 3.3volt supply from the Bus Pirate to power the circuit. The on-board SDA/SCL pull-up resistors hold the I2C bus high, and eliminate the need for external resistors. A single 0.1uF capacitor decouples the EEPROM from the power supply.

Setup I2C mode

First, we setup the Bus Pirate for I2C mode and enable the pull-up resistors. Since the Bus Pirate currently uses a software I2C library, the speed setting doesn’t really have an effect.

SPI>m  <–enter m for mode select
1. SPI
2. I2C
3. UART
4. RAW 2 WIRE
5. RAW 3 WIRE
MODE>2  <–enter 2 for I2C
900 MODE SET
Set speed:
1. 100KHz (Standard)
2. 400KHz (Fast Mode)
3. 1MHz (High Speed)
SPEED>1 <–speed doesn’t really do anything…
901 SPEED SET
202 I2C READY, P/p FOR PULLUPS
I2C>P   <–enable the I2C pull-up resistors
205 I2C PULLUP ON
I2C>

Write to EEPROM (I2C)

All I2C operations begin with a start condition { or [, and end with a stop condition } or ]. A write begins by addressing the device (1 byte) and looking for an acknowledgment bit (ACK). If the EEPROM responds, we can send the data location to write (2 bytes) and data payload (n bytes). The Bus Pirate automatically checks for an ACK at the end of each write, and ACKs each read.

The 24LC1025 base address is 1010xxy, where xx is determined by the state of pins 2 and 3, and y is read (1) or write (0) mode. We tied pins 2 and 3 high, making the full write address 1010110.  We’ll start writing to the device at the first data location (0 0), and write one to thirteen using a mix of data input formats (1…13).

I2C>{0b10100110 0 0 1 2 3 4 5 6 7 8 9 10 0xb 0xc 13} <–I2C command
210 I2C START CONDITION <–bus start
220 I2C WRITE: 0xA6 GOT ACK: YES <–address sent and ACK received
220 I2C WRITE: 0×00 GOT ACK: YES <–write address
220 I2C WRITE: 0×00 GOT ACK: YES <–write address
220 I2C WRITE: 0×01 GOT ACK: YES <–data
…
220 I2C WRITE: 0x0D GOT ACK: YES
240 I2C STOP CONDITION
I2C>

Read from EEPROM (I2C)

Reading the 24LC1025 takes two steps. First, a write command with no data sets the address pointer. Second, a read command outputs data starting at the location set in step 1.

The first command is a write command, we use the hexadecimal equivalent of the write address (0b10100110 = 0xa6) to save a bit of typing. The address pointer is set to the location where we wrote our data (0 0).

I2C>{0xa6 0 0} <–set write pointer command
210 I2C START CONDITION
220 I2C WRITE: 0xA6 GOT ACK: YES
220 I2C WRITE: 0×00 GOT ACK: YES
220 I2C WRITE: 0×00 GOT ACK: YES
240 I2C STOP CONDITION

With the pointer set, we can start reading data. The read address is the device address, with the last bit set to 1 ( 0b10100111 or 0xa7). We used thirteen r commands to read the data, but we could have used the shorthand version: 0r13.

I2C>{0b10100111 rrrrrrrrrrrrr} <–read command
210 I2C START CONDITION
220 I2C WRITE: 0xA7 GOT ACK: YES <–chip ACKed the read address
230 I2C READ: 0×01 <–data byte 1
230 I2C READ: 0×02 <–data byte 2
…
230 I2C READ: 0x0D <–data byte 13
240 I2C STOP CONDITION
I2C>

We know the operation was a success because the output matches the data we wrote earlier.

UART – EM406 SurfIII GPS

The EM406 is a tiny 5volt GPS module that tracks up to 20 satellites. By default, it outputs NMEA formatted data from a serial port at 4800bps, 8N1. The output format is standard serial, but at 2.8volts it’s incompatible with PC serial ports. The Bus Pirate can interface this GPS without the need for a separate RS232 transceiver or 5volt power supply.

Setup the UART

First, we setup the Bus Pirate UART to receive serial data at 4800bps.

I2C>m <–setup mode
1. SPI
2. I2C
3. UART
4. RAW 2 WIRE
5. RAW 3 WIRE
MODE>3 <–UART
900 MODE SET
Set speed:
(bps)
1. 300
2. 1200
3. 2400
4. 4800
…
9. 115200
SPEED>4 <–4800bps
901 SPEED SET
302 UART READY
UART>

Enable UART and data reads

An important thing to remember about UARTs is that the data arrives asynchronously. Unlike SPI and I2C, where data transfer is controlled by the master, serial data can arrive at the UART at any time. The GPS is a great example of this because it spits out location data continuously, without user intervention.

We developed two read modes to cope with asynchronous data .  { echos all incoming data as it arrives.  New data will displace and garble data entry, but all input is still accepted normally.  [ opens the UART in a send only mode that discards incoming bytes. } or ] closes the UART, regardless of the mode.

UART>{ <–open UART with async reads
310 UART OPEN, } TO CLOSE
330 UART READ: 0×80 <–GPS data
330 UART READ: 0×78

Write to the UART

Type in values to send out the UART. Even if the input is broken up by incoming data, it will be processed on <enter>.  We sent 0×40 as an example, but this has no particular meaning to the GPS module.

330 UART READ: 0×80 0×40<–random byte to write
320 UART WRITE: 0×40 <–byte written

Close the UART

“}” followed by <enter> closes the UART.

330 UART READ: 0×78
303 UART READ: 0×60 } <–close UART command
330 UART READ: 0xE6
340 UART CLOSED
UART>

Don’t think you can use this GPS data to track us, we don’t actually get satellite reception down here in mom’s basement.

Taking it further

The Bus Pirate is an important development tool in our lab. We keep updating it as we use it, and we’ll release new firmware as we add protocols and features. Expect to see the Bus Pirate in future articles.

These improvements are at the top of our list. Do you have any suggestions?

• New protocols: One Wire, CAN, ???
• Controls for polarity and other settings
• Adjustable instruction delay
• Get hardware I2C module working.
• Enable protocol speed settings.
• Cheaper, easier to get RS232 transceiver

The project archive (ZIP) has everything you need to build your own Bus Pirate.