How-to: Bus Pirate V1, Improved Universal Serial Interface


We use the Bus Pirate to interface a new chip without writing code or designing a PCB. Based on your feedback, and our experience using the original Bus Pirate to demonstrate various parts, we updated the design with new features and cheaper components.

There’s also a firmware update for both Bus Pirate hardware versions, with bug fixes, and a PC AT keyboard decoder. Check out the new Hack a Day Bus Pirate page, and browse the Bus Pirate source code in our Google code SVN repository.

We cover the design updates and interface a digital to analog converter below.

Concept overview


The Bus Pirate started as a collection of code fragments we used to test new chips without endless compile-program-run development cycles. We released it in a how-to and used it to demonstrate a bunch of serial interface ICs in our parts posts. This article introduces an updated design with new features and a bunch of improvements.

  • Surface mount design
  • Pull-up resistors on all bus lines with external voltage source
  • Software resettable 3.3volt and 5volt power supplies
  • Voltage monitoring of all power supplies
  • An external voltage measurement probe
  • Cheaper parts




Click for a full size schematic image (PNG). The circuit and PCB are designed using the freeware version of Cadsoft Eagle. All the files for this project are included in the project archive linked at the end of the article.


We used a Microchip PIC24FJ64GA002 28pin SOIC microcontroller (IC1) in this project. The power pins have 0.1uF bypass capacitors to ground (C1,2). The 2.5volt internal regulator requires a 10uF tantalum capacitor (C20). The chip is programmed through a five pin header (ICSP). A 2K pull-up resistor (R1) is required for the MCLR function on pin 1. Read more about this chip in our PIC24F introduction.

RS-232 transceiver

An inexpensive MAX3232CSE RS232 transceiver (IC2) interfaces the PIC to a PC serial port. This chip replaces the expensive through-hole MAX3223EEPP+ used in the previous version of the Bus Pirate. The serial interface will work with a USB->serial adapter.

Bus pull-up resistors


The original Bus Pirate has 3.3volt pull-up resistors on 2 pins, but most of our tests required additional external resistors. The updated design has pull-up resistors (R20-23) on the three main bus signals (data in, data out, clock) and the chip select (CS) pin.

A row of jumpers (SV5) connects each resistor to an external voltage supplied through the Vext terminal (X4). Through-hole resistors are used like jumper-wires to make the PCB easier to etch at home.

We couldn’t find an elegant way to control an arbitrary voltage pull-up resistor array from a 3.3volt microcontroller. If you have any ideas, please share them in the comments.

Power supply

VR1 is a 3.3volt supply for the microcontroller and RS232 transceiver. VR2 is a 5volt supply. Both require two 0.1uF bypass capacitors (C3-C6). J1 is a power supply jack for a common 2.1mm DC barrel plug. 7-10volts DC is probably the ideal power supply range.


The original Bus Pirate had dual power supplies, 3.3volts and 5volts, so most ICs could be interfaced without an additional power supply. A major annoyance was the lack of a power reset for connected chips. If a misconfigured IC needed to be power-cycled, we had to disconnect a wire. We got so tired of this routine that we added a software controlled reset to the updated design.

VR3 (3.3volts) and VR4 (5volts) are TI TPS796XX voltage regulators with an enable switch. A high level on pin 1 enables the regulator. A pull-down resistor (R13,R12) ensures that the regulators are off when the PIC isn’t actively driving the line, such as during power-up initialization. The datasheet specifies a hefty capacitor on the input (C23, C21) and output (C24, C22) pins, we used the same 10uF tantalum we use everywhere. An additional, optional, 0.1uF capacitor (C12,C11) can improve regulation.

The switchable regulators are powered by VR2, a 5volt supply.  We did this because the maximum input for VR3 and VR4 is 6volts, leaving the device with a narrow 5.2-6volt power supply range. VR2 will work well above 10volts, and provides an adequate supply for the other regulators.

VR3 (3.3volts) has plenty of headroom to operate from a 5volt supply. VR4 (5volts) will lose about 0.2volts, but 4.8volts remains well within the acceptable range for most 5volt chips. In practice, and under light loads, we see less than 0.1volts drop-out from VR4.

Voltage monitoring


Voltage monitoring is a new feature we’re really excited about. Has your project ever mysteriously stopped responding because of an accidental short circuit? The Bus Pirate’s power supplies are equipped with voltage monitoring that can detect a change in power levels.

Each monitored signal is connected to an analog to digital converter (ADC) through a resistor voltage divider. Two 10K resistors (R10,R11 above) divide the input voltage in half, making it possible to measure up to 6.6volts with the 3.3volt PIC microcontroller.

The Bus Pirate has four voltage monitors. The 3.3volt and 5volt power supplies are monitored, as is the external voltage fed to the pull-up resistors. A fourth monitor is connected to pin 9 of the output header to make a voltage probe.



Click for a full size placement diagram (PNG). The board is a quasi single-sided design, we etched ours in the lab on a single-sided photo-resist PCB. At the top, near C13, two jumper wires meet at a single via; we soldered one jumper wire to the other on the back of the board.

Part list

Part Value
VR1 LD1117S33 3.3volt regulator (SOT223)
VR2 LD1117s50 5volt regulator (SOT223)
VR3 TPS79633 3.3volt regulator (SOT223-6)
VR4 TPS79650 5volt regulator (SOT223-6)
C1-13 0.1uF capacitor (0805)
C20-24 10uF tantalum capacitor (SMC A)
R1 2000 ohm resistor (0805)
R2,3 390 ohm resistor (0805)
R4-13 10000 ohm resistor (0805)
R20-23 2.2K10K ohm resistor (through-hole)
LED1,2 LED (0805)
J1 2.1mm power jack
X2,X4 screw clamp (2 terminals) *untested
X3 db9 female serial port connector *untested
ICSP 0.1″ pin header, straight
SV4 0.1″ pin header or shrouded header
SV5 0.1″ pin header, straight


The firmware is written in C using the free demonstration version of the PIC C30 compiler. Learn all about working with this PIC in our introduction to the PIC 24F series.

The latest firmware is posted on the Hack a Day Bus Pirate page. The latest source is in our Google Code SVN repository.

Using it


The diagram above shows the Bus Pirate pinout.

We made a cable with alligator clips on the end, and added labels to each wire so we don’t have to refer to this table every time we interface a new chip.

If you know of any cool connectors or cables, please link to them in the comments.


LTC2640 SPI digital to analog voltage converter

The Linear Technology LTC2640-LZ8 is an 8bit digital to analog converter (DAC) programmed over SPI. A DAC is essentially a programmable voltage divider. They’re useful for recreating waveforms, such as audio signals. An 8bit DAC has 255 even intervals between 0 and the reference voltage, the L part we used has an internal 2.5volt reference.

The LTC2640 only comes in a small SOT223-8 package, so we made a breadboard adapter in the profile of a DIP-8 chip.  Our LTC2640 footprint is included in the project archive attached at the end of this article.


The schematic above shows our test circuit for the LTC2640. It requires a 2.7-5volt power supply, we used the Bus Pirate’s 3.3volt supply. C1 is a bypass capacitor between the power pin and ground. Pin 8 is an active-low reset pin, tie it high for normal operation. Pin 7 is the DAC output, connect the Bus Pirate voltage measurement probe (ADC) here.

Bus Pirate LTC2640 (pin #)
CS CS/LD (1)
+3.3volts CLR (8 )
+3.3volts VDD (5)

We connected the Bus Pirate to the LTC2640 as shown in the table. The LTC2640 doesn’t have a data output pin, this SPI connection remains unused.

The Bus Pirate’s hardware SPI library and software RAW3WIRE library are compatible with the LTC2640’s SPI interface. We used the SPI library; if you use the RAW3WIRE library be sure to choose normal pin output.

HiZ>m<–select mode
1. HiZ
2. 1-WIRE
4. I2C
5. SPI
Set speed:
1. 30KHz
2. 125KHz
3. 250KHz
4. 1MHz
SPEED>1 <–test at low speed


Press M for the Bus Pirate mode menu, choose 5 for SPI mode. There are a bunch of configuration options for the SPI module, use the default options for all of them. After SPI mode is ready we need to configure the power supply.

SPI>p<–power supply setup
W/w toggles 3.3volt supply?
1. NO
2. YES
MODE>2<–use 3.3volt supply
W/w toggles 5volt supply?
1. NO
2. YES
MODE>1<–don’t use 5volt supply
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 0.0 | VPULLUP: 0.0 |

p opens the Bus Pirate power supply menu. We use the 3.3volt supply but not the 5volt supply. The voltage monitor verifies that the power supplies are off.

SPI>W<–capital W (silly CSS) enables power supply
SPI>v<–voltage monitor
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 3.3 | VPULLUP: 0.0 |

Capital ‘W’ enables any power supplies selected in the previous menu, a small ‘w’ disables them. V displays the supply voltage monitor, which now shows 3.3volts output from the 3.3volt supply.

Now that configuration is finished, we can send commands to the LTC2640 over the SPI bus. The LTC2640 has a 24bit (3byte) interface protocol. The first byte is a command, followed by two data bytes. The LTC2640 is available in 8,10, and 12bit versions; the 8bit version uses the first byte to set the DAC value, and ignores the second byte.

SPI>[0b00110000 255 0]<–set DAC to full
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0xFF<–DAC value
120 SPI WRITE: 0x00<–don’t care

Every SPI command begins by enabling the chip select pin ([). The first byte is the command to update the DAC (0b00110000), followed by the value to output (255), and a third byte that’s ignored (0). The command ends by disabling chip select (]).

We used an 8bit DAC with 255 even voltage steps, output set to 255 is 100%. We can use the Bus Pirate voltage probe to measure the output.

SPI>d<–measure voltage

D triggers a voltage measurement. The DAC output voltage is 100% (255/255) of the internal reference, 2.5volts.

SPI>[0b00110000 0 0] d
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0x00<–DAC value
120 SPI WRITE: 0x00<–don’t care

The same command with a DAC value of 0 outputs 0% (0/255) of 2.5volts; 0volts.

SPI>[0b00110000 128 0] d
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0x80<–DAC value
120 SPI WRITE: 0x00<–don’t care

A DAC value of 128 is about 50% (128/255) of the reference voltage, 1.2volts.

SPI>[0b01000000 0 0] d
120 SPI WRITE: 0x40<–power down command
120 SPI WRITE: 0x00<–don’t care
120 SPI WRITE: 0x00<–don’t care

The LTC2640 has a low power mode, triggered by the command 0b01000000 and two bytes that are ignored. After the power down command we can verify that there’s output from the DAC. Write any DAC value to exit low power mode.

Taking it further

What’s the next step for the Bus Pirate? We’ll eventually make a final update to the design that includes USB on a professionally made, double-sided PCB. Power supply indicator LEDs were slated for this version, but didn’t get included. It would also be handy to have an AT  keyboard connector for debugging without a PC. Check out the roadmap and wishlists on the Hack a Day Bus Pirate page.


65 thoughts on “How-to: Bus Pirate V1, Improved Universal Serial Interface

  1. To think earlier today I ordered all the parts for the first one times six. Oh well any way thanks for all the hard work on this project I had been meaning to build something like this for some time.

  2. @cirictech – We hate it when that happens. On the bright side, both versions use the same source code base so you still get the new protocols and bug fixes.

    @error404 – Our first design has two 3.3volt pull-ups on the SDA and SCL signal lines. We often had to add external pull-up resistors to pull lines all the way to 5volts, or to use other signal lines (e.g. SPI).

    The new design has an array of resistors connected to an external voltage source through jumpers. Now we can use the on-board resistors to pull-up/down every signal line to any voltage that won’t fry the PIC.

    Could you elaborate a bit more on using a single-transistor switch in this design?

    @aa – We added LIN to the wishlist, CAN was already included. Can you suggest some fun chips we can use to prototype these libraries?

  3. Will supporting CAN and ODBII require a new board revision, or is it just firmware? I’d love to start playing with one of these, but I’d rather wait for the next board rev if that’s what’s needed for CAN.

    Also, +1 to hope-somebody-does-a-kit :-)

  4. This looks great! Ian – what’s the license on the intellectual property here?

    i.e. If I modify the board or code, can I distribute the modification? And if I wanted to make kits, can I do so? Can I charge for them? At cost or at a profit?

    Note that I’m *not* proposing to do any of this, but just wondering so that those who do know where they stand. And maybe the rest of us can get a kit quicker :)

  5. Ian: Thanks I didn’t notice it was all about the software this time.

    cazh: Oh please. Just because I don’t like to muck around with SMD components because I don’t have steady hands doesn’t mean I am any less capable. I’ve designed with SMD for stuff that goes to the factory but for my hobby projects (including my home security made by me) it’s always DIP for me.

  6. @ian:

    I got the impression you wanted to be able to switch the pull-ups on or off from software so the design is more flexible with protocols that require tri-stating the interface. Using a GPIO (or 4) and a transistor to switch the (external) supply to the pull-up array would give you that option.

  7. @Si1entDave – New protocols shouldn’t need new hardware, but might require an external transceiver depending on the physical layer implementation. RS232, RS485, and IDX are examples.

    We’d like to tackle ODBII but don’t have any hardware to work with. ODBII is several protocols and different physical layers that need a transceiver.

    CAN became a mandated auto diagnostic protocol in the US in 2008, and it was already widespread in Europe. Its also has a lot of other uses. CAN is used on a bunch of different physical layers. The MCP2515 is a CAN 2.0B controller with an SPI interface. It would work with the Bus Pirate’s SPI or RAW3WIRE library. You may even need one additional transceiver between the MSP2515 and the final CAN bus, depending on what you want to interface.

    These are just our general impression after investigating each protocol. By no means was our search exhaustive, and we welcome additional accounts and clarification.

  8. @ CazH

    Soldering SMD is not that hard, but etching a PCB at home with such small tracks and pads using toner transfer is quite hard!

    Also, my local electronics store doesn’t have SMD on stock, only takes orders (with the added cost).

    Also, isn’t the trough-hole version an older version of the hardware?

  9. Soldering SMD parts is brain dead easy. I gave up on crappy DIP parts a long time ago.

    YOu need to get a clue and the tools and start SMD soldering. I can solder any SMD part without effort. Too many “hackers” say that it’s impossible because they really dont know anything about electronics and go at things with a giant trigger iron and think that is soldering. Noobs.

  10. I’m considering making my own version of this board. I think I can make it small enough to where it will be able to plug into the top of a breadboard and make connections with both pwr and gnd rails and give you some automatic connections on the breadboard. I might even include some adjustable switching voltage regulators to generate the power rails from a 5-9v wall-wart or something similar.

    Would you guys be interested in one of those?
    Because of the nature of getting a pcb made through my fab house I’d end up with several boards and I don’t mind populating extra’s if someone wants to buy them off me.

  11. I agree with the convenience of SMDs. The only thing you need to solder most SMD (other than a BGA) is a fine tip iron and some solder wick. You don’t need steady hands, good vision, hot air, etc. Paste helps but isn’t necessary. I’ve even done QFNs this way. Once you get used to SMD you never go back. No more drilling holes, bending leads, straightening dips, etc.

  12. @trolls: We are all impressed with the imense penises you obviously have because you work with SMDs. I’ll be over there working on actual projects and not soldering.

    Will the software resettable power supplies work on the dip version too?

  13. @hackius – No, the TPS796xx resettable voltage regulators only come in SMD. Unfortunately, many of the coolest new parts are only available in surface mount packages now. Someone might be able to suggest a replacement. The original through-hole version of the Bus Pirate doesn’t have all the same features, but it makes compromises to be a fully through-hole design.

    @jim, error404 – Thank you both for elaborating. We considered a high side switch (PNP transistor), but adding four sot-23 transistors and 4-8 more resistors to the design made the PCB a beast to prototype in the lab. A professional 2-sided board would solve that problem.

    @lwr – The hardware designs are public domain, but its always nice if you release improvements and new ideas back to the community.

    Our code is public domain, but is listed as BSD on Google Code because there wasn’t a PD option.

    There are two code libraries written by other authors that may have different licenses (JTAG programmer, I2C), though these were chosen because they were supposedly public domain. We checked the license for these libraries, but offer this obligatory disclaimer: if it really matters, clear it with a lawyer.

  14. @ian, error404

    How about using a quad analogue switch instead of the PNPs? It’s a bit of an over kill for this app but they are available in soic packages which might help layout.

    Something like the common 4066 would do, but pull ups would still be needed on the control inputs.

    A more expensive device like the MAX4614 should be directly compatible with the PIC24 outputs.

  15. Hi,

    Anyone having trouble checking out the source from Google ?

    I’m getting ‘’ doesn’t exist errors. Tried a number of combo’s but alas…

    Love to give it a try to port to AVR… (mega2561)

  16. I am currently working on a pcb for using the FT232 chip and USB for the bus-pirate rather than the old-school RS232 interface. As genesis pointed out, it should be able to be powered by the USB port.

    I am by no means an expert at PCB design and microcontrollers, so would anyone (ian?) be willing to review my design if I post it somewhere?

  17. @clint

    Sure, just post a link to the files.

    The FT solution is good, but expensive. We’ve been looking at using a second 18F2550 for the USB interface because it’s cheaper and comes in a larger SMD package.

  18. Heh, I went with 10k. We’ll see how it works. Just finished my BusPirate v1.0 this afternoon, got the PIC programmed – it’s talking – and am ready to hook up my first part! Score-one for pre-powerup inspections too. I forgot the little short jumper tying the ground-fills together. That and a USB microscope showing a couple micro-solder-bridges.

    No smoke! W00t!

    Used the toner transfer method to make the board. That and FeCl sponge method to etch.

    I’ll post my draft-pcb idea for the USBusPirate soon.

    Thanks Ian!

  19. Hey, got my board up and running today. Have a problem using a USB-Serial adaptor though.
    The keys aren’t being mapped properly
    e.g. pressing ‘m’ results in ‘l’ being printed on screen. ‘1’ goes to ‘0’, ‘3’ goes to ‘2’ etc.

    I’m using hyperterminal, the board works fine with a standard serial port and this USB-Serial adaptor definitely works (using it on another project)

    Any thoughts?

  20. It sounds like a baud rate mis-match. The Bus Pirate’s default speed is 115200bps, which is what most USB->serial converters also use.

    Check the terminal program and the adapter driver settings to be sure everything is set to 115200/8/N/1. Another terminal program might also be helpful, we’ve been using the free Ayera version of Tera Term.

  21. @ian – thanks for the info, unfortunately didn’t solve the problem. My theory is that the problem lies with a damaged MAX3232CSE. I’m using a MAX3232CSE+, do you think that could make a difference?

  22. …you might try adjusting your terminal or driver flow control settings (to none). Also, perhaps you can adjust the Bus Pirate speed (menu option B) and then plug in the USB adapter to see if that works.

    Did you try something other than hyperterminal? It’s notoriously buggy.

  23. @ian – flow control has been set to none for the whole testing process. I did try tera term but this didn’t fix the problem. I have also tried the device with an alternate USB->Serial adaptor and noted the same problem.
    I have access to a computer with a serial port in my lab (at work) so will try changing the baud rate tomorrow.

  24. Hi everybody
    I have a problem on programming the pic.
    I’m using a icd2 clone (
    The icd2 is working correctly (if I connect a 16f876a it connect correctly)

    I built the icsp cable correctly:

    1 MCRL
    2 VDD (3,3V)
    3 GND
    4 DATA
    5 CLOCK
    6 NOT USED

    I also powered the circuit; but if I go to programmer -> setting on mplab, only MCLR gnd test pass. The other are low.

    Also target vdd and target vpp are 0 V

    What is wrong on my circuit? I also chek the power and on pin 13 and 28 of pic I have 3,3 V and also on pin 1 when the ICSP cable is disconnected I have 3,3

    Please help me!

    Thank you

  25. @Alessandro –

    So you plug in the power supply to the Bus Pirate and you get 3.3volts on the VDD and MCLR pins. That sounds correct.

    Can you test the ICSP header pins with a multimeter to make sure you have 3.3volts on VDD and MCLR without the programmer attached? What happens when you plug in the programmer (again, a manual test and not the MPLAB report)? Does the power drop to 0 when you then plug in the ICSP cable? That would be strange.

    If you made the board yourself, do you have the two power jumpers installed? One is from above C1 to above C13, and the other from above C21 to the same via above C13?

  26. @ ian lesnet

    First of all thank you for the fast answer.

    I cheked everything you suggest me.
    The only thing that isn’t ok is the mcrl.
    When I connect the icsp cable to the icd the mcrl goes to 0 Volt. So it seams that the pic isn’t realeased from reset.

    I tried to measure the mcrl range from logic low and High with a pic16f877A and the value range from 0 Volt to 4 Volt. Any more suggestion? can be that my icd is broken? Maybe I can ask to a friend that have a microchip icd2.

  27. @Alessandro – My MCLR pin also goes to 0 when I plug in the programmer. 0volts holds the PIC in reset, but if you can’t program it there must be some other problem.

    Did you disable the ICD2 power supply before connecting to the board (under programmer setting->power tab->uncheck/disable ‘power target circuit from ICD2’)? My ‘real’ ICD2 has only a 5volt supply which would break a PIC24F.

    Other than that, I can’t think of anything. Try another programmer if you can, please let us know if that works. If it doesn’t, maybe you can post a high resolution picture of your board on Flickr and we can make a visual inspection.

  28. @ian lesnet

    I can’t enable ‘power target circuit from ICD2′ because the chek box is grayed.

    Ok, I will try whit a real icd2 and then I will post the result as soon as possible.

    Thank you again

  29. @Alessandro – The grayed out box is good. Sometimes, though, if MPLAB was last configured for a PIC18F or other 5volt part it will still provide 5volts until you change the processor type to 24F. I’ve broken a few chips this way…

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.