How-to: Bus Pirate v1, improved universal serial interface


We use the Bus Pirate to interface a new chip without writing code or designing a PCB. Based on your feedback, and our experience using the original Bus Pirate to demonstrate various parts, we updated the design with new features and cheaper components.

There’s also a firmware update for both Bus Pirate hardware versions, with bug fixes, and a PC AT keyboard decoder. Check out the new Hack a Day Bus Pirate page, and browse the Bus Pirate source code in our Google code SVN repository.

We cover the design updates and interface a digital to analog converter below.

Concept overview


The Bus Pirate started as a collection of code fragments we used to test new chips without endless compile-program-run development cycles. We released it in a how-to and used it to demonstrate a bunch of serial interface ICs in our parts posts. This article introduces an updated design with new features and a bunch of improvements.

  • Surface mount design
  • Pull-up resistors on all bus lines with external voltage source
  • Software resettable 3.3volt and 5volt power supplies
  • Voltage monitoring of all power supplies
  • An external voltage measurement probe
  • Cheaper parts




Click for a full size schematic image (PNG). The circuit and PCB are designed using the freeware version of Cadsoft Eagle. All the files for this project are included in the project archive linked at the end of the article.


We used a Microchip PIC24FJ64GA002 28pin SOIC microcontroller (IC1) in this project. The power pins have 0.1uF bypass capacitors to ground (C1,2). The 2.5volt internal regulator requires a 10uF tantalum capacitor (C20). The chip is programmed through a five pin header (ICSP). A 2K pull-up resistor (R1) is required for the MCLR function on pin 1. Read more about this chip in our PIC24F introduction.

RS-232 transceiver

An inexpensive MAX3232CSE RS232 transceiver (IC2) interfaces the PIC to a PC serial port. This chip replaces the expensive through-hole MAX3223EEPP+ used in the previous version of the Bus Pirate. The serial interface will work with a USB->serial adapter.

Bus pull-up resistors


The original Bus Pirate has 3.3volt pull-up resistors on 2 pins, but most of our tests required additional external resistors. The updated design has pull-up resistors (R20-23) on the three main bus signals (data in, data out, clock) and the chip select (CS) pin.

A row of jumpers (SV5) connects each resistor to an external voltage supplied through the Vext terminal (X4). Through-hole resistors are used like jumper-wires to make the PCB easier to etch at home.

We couldn’t find an elegant way to control an arbitrary voltage pull-up resistor array from a 3.3volt microcontroller. If you have any ideas, please share them in the comments.

Power supply

VR1 is a 3.3volt supply for the microcontroller and RS232 transceiver. VR2 is a 5volt supply. Both require two 0.1uF bypass capacitors (C3-C6). J1 is a power supply jack for a common 2.1mm DC barrel plug. 7-10volts DC is probably the ideal power supply range.


The original Bus Pirate had dual power supplies, 3.3volts and 5volts, so most ICs could be interfaced without an additional power supply. A major annoyance was the lack of a power reset for connected chips. If a misconfigured IC needed to be power-cycled, we had to disconnect a wire. We got so tired of this routine that we added a software controlled reset to the updated design.

VR3 (3.3volts) and VR4 (5volts) are TI TPS796XX voltage regulators with an enable switch. A high level on pin 1 enables the regulator. A pull-down resistor (R13,R12) ensures that the regulators are off when the PIC isn’t actively driving the line, such as during power-up initialization. The datasheet specifies a hefty capacitor on the input (C23, C21) and output (C24, C22) pins, we used the same 10uF tantalum we use everywhere. An additional, optional, 0.1uF capacitor (C12,C11) can improve regulation.

The switchable regulators are powered by VR2, a 5volt supply.  We did this because the maximum input for VR3 and VR4 is 6volts, leaving the device with a narrow 5.2-6volt power supply range. VR2 will work well above 10volts, and provides an adequate supply for the other regulators.

VR3 (3.3volts) has plenty of headroom to operate from a 5volt supply. VR4 (5volts) will lose about 0.2volts, but 4.8volts remains well within the acceptable range for most 5volt chips. In practice, and under light loads, we see less than 0.1volts drop-out from VR4.

Voltage monitoring


Voltage monitoring is a new feature we’re really excited about. Has your project ever mysteriously stopped responding because of an accidental short circuit? The Bus Pirate’s power supplies are equipped with voltage monitoring that can detect a change in power levels.

Each monitored signal is connected to an analog to digital converter (ADC) through a resistor voltage divider. Two 10K resistors (R10,R11 above) divide the input voltage in half, making it possible to measure up to 6.6volts with the 3.3volt PIC microcontroller.

The Bus Pirate has four voltage monitors. The 3.3volt and 5volt power supplies are monitored, as is the external voltage fed to the pull-up resistors. A fourth monitor is connected to pin 9 of the output header to make a voltage probe.



Click for a full size placement diagram (PNG). The board is a quasi single-sided design, we etched ours in the lab on a single-sided photo-resist PCB. At the top, near C13, two jumper wires meet at a single via; we soldered one jumper wire to the other on the back of the board.

Part list

Part Value
VR1 LD1117S33 3.3volt regulator (SOT223)
VR2 LD1117s50 5volt regulator (SOT223)
VR3 TPS79633 3.3volt regulator (SOT223-6)
VR4 TPS79650 5volt regulator (SOT223-6)
C1-13 0.1uF capacitor (0805)
C20-24 10uF tantalum capacitor (SMC A)
R1 2000 ohm resistor (0805)
R2,3 390 ohm resistor (0805)
R4-13 10000 ohm resistor (0805)
R20-23 2.2K10K ohm resistor (through-hole)
LED1,2 LED (0805)
J1 2.1mm power jack
X2,X4 screw clamp (2 terminals) *untested
X3 db9 female serial port connector *untested
ICSP 0.1″ pin header, straight
SV4 0.1″ pin header or shrouded header
SV5 0.1″ pin header, straight


The firmware is written in C using the free demonstration version of the PIC C30 compiler. Learn all about working with this PIC in our introduction to the PIC 24F series.

The latest firmware is posted on the Hack a Day Bus Pirate page. The latest source is in our Google Code SVN repository.

Using it


The diagram above shows the Bus Pirate pinout.

We made a cable with alligator clips on the end, and added labels to each wire so we don’t have to refer to this table every time we interface a new chip.

If you know of any cool connectors or cables, please link to them in the comments.


LTC2640 SPI digital to analog voltage converter

The Linear Technology LTC2640-LZ8 is an 8bit digital to analog converter (DAC) programmed over SPI. A DAC is essentially a programmable voltage divider. They’re useful for recreating waveforms, such as audio signals. An 8bit DAC has 255 even intervals between 0 and the reference voltage, the L part we used has an internal 2.5volt reference.

The LTC2640 only comes in a small SOT223-8 package, so we made a breadboard adapter in the profile of a DIP-8 chip.  Our LTC2640 footprint is included in the project archive attached at the end of this article.


The schematic above shows our test circuit for the LTC2640. It requires a 2.7-5volt power supply, we used the Bus Pirate’s 3.3volt supply. C1 is a bypass capacitor between the power pin and ground. Pin 8 is an active-low reset pin, tie it high for normal operation. Pin 7 is the DAC output, connect the Bus Pirate voltage measurement probe (ADC) here.

Bus Pirate LTC2640 (pin #)
CS CS/LD (1)
+3.3volts CLR (8 )
+3.3volts VDD (5)

We connected the Bus Pirate to the LTC2640 as shown in the table. The LTC2640 doesn’t have a data output pin, this SPI connection remains unused.

The Bus Pirate’s hardware SPI library and software RAW3WIRE library are compatible with the LTC2640’s SPI interface. We used the SPI library; if you use the RAW3WIRE library be sure to choose normal pin output.

HiZ>m<–select mode
1. HiZ
2. 1-WIRE
4. I2C
5. SPI
Set speed:
1. 30KHz
2. 125KHz
3. 250KHz
4. 1MHz
SPEED>1 <–test at low speed


Press M for the Bus Pirate mode menu, choose 5 for SPI mode. There are a bunch of configuration options for the SPI module, use the default options for all of them. After SPI mode is ready we need to configure the power supply.

SPI>p<–power supply setup
W/w toggles 3.3volt supply?
1. NO
2. YES
MODE>2<–use 3.3volt supply
W/w toggles 5volt supply?
1. NO
2. YES
MODE>1<–don’t use 5volt supply
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 0.0 | VPULLUP: 0.0 |

p opens the Bus Pirate power supply menu. We use the 3.3volt supply but not the 5volt supply. The voltage monitor verifies that the power supplies are off.

SPI>W<–capital W (silly CSS) enables power supply
SPI>v<–voltage monitor
9xx VOLTAGE MONITOR: 5V: 0.0 | 3.3V: 3.3 | VPULLUP: 0.0 |

Capital ‘W’ enables any power supplies selected in the previous menu, a small ‘w’ disables them. V displays the supply voltage monitor, which now shows 3.3volts output from the 3.3volt supply.

Now that configuration is finished, we can send commands to the LTC2640 over the SPI bus. The LTC2640 has a 24bit (3byte) interface protocol. The first byte is a command, followed by two data bytes. The LTC2640 is available in 8,10, and 12bit versions; the 8bit version uses the first byte to set the DAC value, and ignores the second byte.

SPI>[0b00110000 255 0]<–set DAC to full
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0xFF<–DAC value
120 SPI WRITE: 0x00<–don’t care

Every SPI command begins by enabling the chip select pin ([). The first byte is the command to update the DAC (0b00110000), followed by the value to output (255), and a third byte that’s ignored (0). The command ends by disabling chip select (]).

We used an 8bit DAC with 255 even voltage steps, output set to 255 is 100%. We can use the Bus Pirate voltage probe to measure the output.

SPI>d<–measure voltage

D triggers a voltage measurement. The DAC output voltage is 100% (255/255) of the internal reference, 2.5volts.

SPI>[0b00110000 0 0] d
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0x00<–DAC value
120 SPI WRITE: 0x00<–don’t care

The same command with a DAC value of 0 outputs 0% (0/255) of 2.5volts; 0volts.

SPI>[0b00110000 128 0] d
120 SPI WRITE: 0x30<–write DAC command
120 SPI WRITE: 0x80<–DAC value
120 SPI WRITE: 0x00<–don’t care

A DAC value of 128 is about 50% (128/255) of the reference voltage, 1.2volts.

SPI>[0b01000000 0 0] d
120 SPI WRITE: 0x40<–power down command
120 SPI WRITE: 0x00<–don’t care
120 SPI WRITE: 0x00<–don’t care

The LTC2640 has a low power mode, triggered by the command 0b01000000 and two bytes that are ignored. After the power down command we can verify that there’s output from the DAC. Write any DAC value to exit low power mode.

Taking it further

What’s the next step for the Bus Pirate? We’ll eventually make a final update to the design that includes USB on a professionally made, double-sided PCB. Power supply indicator LEDs were slated for this version, but didn’t get included. It would also be handy to have an AT  keyboard connector for debugging without a PC. Check out the roadmap and wishlists on the Hack a Day Bus Pirate page.


65 thoughts on “How-to: Bus Pirate v1, improved universal serial interface

  1. i am mulling over the concept of a FX2 based USB interface that gets straight jacketed to a 16 bit Micros. The data transfer speed being the one obvious reason, the other is I dont have to mess with generating 5V supplies. Does any one have a recommendation for a 16bit Micro?

  2. @ ian lesnet
    Finally I get my pic work whit the icd2 whit icsp. The problem was the icsp adaptor cable. The data about the rj11 of my icd2 clone pinout was incorrect!!!
    Now the problem is to understand how use mplab to program the pic whit an already assembled program…

  3. WOW IT WORK!!!! :-) Finally!!!
    Can somebody explain me wich are the behaviuor of the two led?
    Because I have one bus pirate whit the led1 turned on on power on, and the other with the same led off. Wich is correct? When they light up and what they mean?

    Many thanks again!!!!

  4. @ian – re: problems with usb to serial adaptor

    Sorry for the delay in responding. As you suggested I tried changing the bus rate to 9600 and the device now works via the usb serial adaptor. How do I make this change permanent?
    When I unplug the power the bit rate reverts back to the non-working 115200 rate

  5. @sideblazs – The only way to do that right now is to make 9600 the default speed in the firmware and do a custom compile.

    I don’t know if this helps, but today I tested V1a hardware (this how-to) with an FTDI-based USB->serial converter at 115200. I didn’t have any problems. I did have to go to advanced settings in the control panel and change the FTDI driver to 115200bps, the default was 9600.

  6. My bus pirate v1 default boud rate is 115200/4=28800 bps. Maybe i don’t program something, like fuses in avr?
    And why bus pirate use software I2C, not hardware? I dont now why, but in my bus pirate I2C don’t work.

  7. @vaidas – Did you disable the 4x PLL fuse? That might do it, as 28800bps isn’t a programmed speed option. It is set in the firmware, so check that your programing software isn’t making any changes.

    We used software I2C because the I2C hardware module in the 24FJ64GA002 revision 3 is broken.

  8. Thanks, ian lesnet. I only download original hex to my pic flash. 4x fuse is enabled in this hex, or i need enable it manually?

    Now i use modified firmware and have 115200 speed (modify UART settings), but I2C mode don’t work. SCL, SDA pins allways are low. In terminal i write M, then 4 to select I2C mode, then { symbol and then trying to send 69 value (E symbol). Maybe i forgot something in mode selecting, or, like in UART enable with { symbol.

  9. Oh, my in programmer soft (beeprog) need to select “program config bits” – i forgot about it.

    Yes, i use pullups.
    Maybe problem is in source file “m_i2c_1.c”, function “i2csendbyte” is line “SDA_TRIS=I2CHIGH;”? This command set SDA pin direction to input. but here need set SDA pin to high value – send “1”. When sending “0”, all ok – SDA direction is input, SDA value “0”.

  10. With pull-ups, TRIS=1,PORT=0 is HIGH; TRIS=0, PORT=0 is LOW. With a high-impedance bus like I2C we manipulate the TRIS (direction) register rather than the port pins. We’ve done a ton of testing of the I2C library, I’m pretty sure there’s no functional problems. What are you trying to interface? Did you connect the pull-up jumpers and connect a power source to the pull-up supply terminal? What happens when you try menu option ‘V’? ‘V’ will give you a voltage report. It should look like this if there is power to the pull-up supply terminal:
    VOLTAGE MONITOR: 5V: 4.9 | 3.3V: 3.3 | VPULLUP: 4.9 |

  11. Sure, you can use a jumper wire to connect to either the 3.3 or 5.0 volt supply.

    We did this in case we want to work with external supplies or low voltage parts, such as 1.8 or 2.5 volt parts.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s