Author Topic: EEVblog #1144 - Padauk Programmer Reverse Engineering  (Read 187874 times)

0 Members and 1 Guest are viewing this topic.

Offline serisman

  • Regular Contributor
  • *
  • Posts: 94
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1150 on: August 07, 2020, 01:49:29 am »
Do you have a more complete example of what you are trying to accomplish?
I am trying to implement an Arduino-like tone function that outputs a specific frequently on a pin.

For something like that, I would just use PWM.
 

Offline bovineck

  • Contributor
  • Posts: 12
  • Country: au
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1151 on: August 08, 2020, 12:21:00 pm »
Quote
What's up with your 15V supply? It should be going to pin 8 of the opamp, and yours is apparently 1.69V. Is your dc-dc converter disabled, or faulty?

It's a mess for sure - I'm going to start again and hopefully have better success with MKIII.  :-//

Take care,

OneCircuit


Hi all,

Happy to report that although MKIII was a bust, MKIV is functional and I now have a blinking PFS154. It seems the STM32s I sourced are a bit on the dodgy side.  :(

Thanks everyone for all the advice, support, encouragement and all of the hard work making this crazy project in the first place!

Take care,

OneCircuit
www.onecircuit.blogspot.com
You're unique, like everyone else
 

Offline LovelyA72

  • Contributor
  • Posts: 43
  • Country: us
  • Kashikoma from Massachusetts!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1152 on: August 09, 2020, 08:17:26 pm »
I put together an extremely basic but useful(at least to me) GUI frontend for easypdkprog.exe.
https://github.com/Kashouryo/FreePDK-WRITER
[attach=1]
Also, I made this logo for EasyPDK Programmer. It somewhat resembles the Padauk logo.
Kashikoma!
 

Offline bovineck

  • Contributor
  • Posts: 12
  • Country: au
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1153 on: August 14, 2020, 12:23:31 pm »
Hi all,

Trying my MKIV programmer with "easypdkprog probe" and get the following...

PFS154 probe
Probing IC... found.
TYPE:FLASH RSP:0x1AA1 VPP=4.50 VDD=2.00
IC is supported: PFS154 ICID:0xAA1

...blinky works...

PFS173 probe
Probing IC... found.
TYPE:FLASH RSP:0x1EA2 VPP=4.50 VDD=2.00
IC is supported: PFS173 ICID:0xEA2

...blinky works...

PMS150C probe
Probing IC... found.
TYPE:FLASH RSP:0xF VPP=4.50 VDD=2.00
Unsupported IC

...no blinky... :-\

But "easypdkprog list" gives...

PMS150C  (0xA16): OTP  : 1024 (13 bit), RAM:  64 bytes

...so I've tried multiple chips from two different batches of PMS150C but no luck! Any suggestions?

Take care,

OneCircuit
You're unique, like everyone else
 

Offline LovelyA72

  • Contributor
  • Posts: 43
  • Country: us
  • Kashikoma from Massachusetts!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1154 on: August 15, 2020, 06:16:22 am »
Hi all,

Trying my MKIV programmer with "easypdkprog probe" and get the following...

PFS154 probe
Probing IC... found.
TYPE:FLASH RSP:0x1AA1 VPP=4.50 VDD=2.00
IC is supported: PFS154 ICID:0xAA1

...blinky works...

PFS173 probe
Probing IC... found.
TYPE:FLASH RSP:0x1EA2 VPP=4.50 VDD=2.00
IC is supported: PFS173 ICID:0xEA2

...blinky works...

PMS150C probe
Probing IC... found.
TYPE:FLASH RSP:0xF VPP=4.50 VDD=2.00
Unsupported IC

...no blinky... :-\

But "easypdkprog list" gives...

PMS150C  (0xA16): OTP  : 1024 (13 bit), RAM:  64 bytes

...so I've tried multiple chips from two different batches of PMS150C but no luck! Any suggestions?

Take care,

OneCircuit

Seems like the software is recognising your PMS150C as a flash micro. Make sure your cli software and your programmer firmware are up to date.
Kashikoma!
 
The following users thanked this post: bovineck

Offline rameshd

  • Newbie
  • Posts: 4
  • Country: in
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1155 on: August 15, 2020, 08:04:34 am »
HI All,

Been following this thread since the beginning. Had bought a few hundred Padauk MCUs even before the programmer/compiler was available.

Thanks to all the folks here who did a fantastic work of creating the Compiler and the Programmer, and made programming the MCUs a reality.

Ordered and built the programmer and successfully programmed the MCU. Had ordered the PCB assembly with just the basic components. Screenshot of my order attached here for anyone to reorder(If any permission issue, will be happy to inform).

Meanwhile here is something interesting. MCUs from Shenzhen Zhien:

hxxp://www.zhienchina.com/product/MCU.html
They seem to be making Padauk MCUs as well. But they have other MCUs with embedded Padauks.
Here is an example:
XDM2102x series, a PMS150C + TP4056 Charger + 1 Amp Motor charger, all in one.

[attach=1]

Thanks again,
Ramesh

[attach=2]

EDIT: Added photo of Assembled PCB





« Last Edit: August 15, 2020, 08:09:17 am by rameshd »
 

Offline cmfcmf

  • Contributor
  • Posts: 9
  • Country: de
    • github.com/cmfcmf
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1156 on: August 15, 2020, 08:56:58 am »
Meanwhile here is something interesting. MCUs from Shenzhen Zhien:

hxxp://www.zhienchina.com/product/MCU.html
They seem to be making Padauk MCUs as well. But they have other MCUs with embedded Padauks.
Here is an example:
XDM2102x series, a PMS150C + TP4056 Charger + 1 Amp Motor charger, all in one.

Great find! I added a section for these chips at https://free-pdk.github.io/chips/#xdmfsss-chips.
 

Offline bovineck

  • Contributor
  • Posts: 12
  • Country: au
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1157 on: August 15, 2020, 01:36:16 pm »
Quote
Seems like the software is recognising your PMS150C as a flash micro. Make sure your cli software and your programmer firmware are up to date.

I have tried three linux flavours and also Windows 10, using both pre-built binaries for easypdfprog and compiled versions - but always the same message for the PMS150C chips. The firmware is the latest from the repository (14th July). Is there other cli software I should be updating?

Is it possible to be a hardware issue? It seems unlikely given the other chips can be recognised and programmed. I'm currently trying to build the firmware from the src (EASYPDKPROG.bin) rather than use the github file (EASYPDKPROG.dfu)

Take care,

OneCircuit
You're unique, like everyone else
 

Offline js_12345678_55AA

  • Frequent Contributor
  • **
  • Posts: 297
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1158 on: August 17, 2020, 10:27:20 pm »
Hi all,

Trying my MKIV programmer with "easypdkprog probe" and get the following...

PFS154 probe
Probing IC... found.
TYPE:FLASH RSP:0x1AA1 VPP=4.50 VDD=2.00
IC is supported: PFS154 ICID:0xAA1

...blinky works...

PFS173 probe
Probing IC... found.
TYPE:FLASH RSP:0x1EA2 VPP=4.50 VDD=2.00
IC is supported: PFS173 ICID:0xEA2

...blinky works...

PMS150C probe
Probing IC... found.
TYPE:FLASH RSP:0xF VPP=4.50 VDD=2.00
Unsupported IC

...no blinky... :-\

But "easypdkprog list" gives...

PMS150C  (0xA16): OTP  : 1024 (13 bit), RAM:  64 bytes

...so I've tried multiple chips from two different batches of PMS150C but no luck! Any suggestions?

Take care,

OneCircuit

I just tested it with some PMS150C and it works well for me.

./easypdkprog probe -v
Searching programmer... found: /dev/tty.usbmodem1234567855AA1
FREE-PDK EASY PROG - HW:1.2 SW:1.3 PROTO:1.3
Probing IC... found.
TYPE:OTP RSP:0x285A0 VPP=4.50 VDD=2.00
IC is supported: PMS150C / PMS15A ICID:0xA16


Maybe the PROBE command is having trouble with your setup (we might find out later).

How about just specifying the IC name and try a READ:

$ ./easypdkprog -n PMS150C read emptypms150c.hex -v
Searching programmer... found: /dev/tty.usbmodem1234567855AA1
FREE-PDK EASY PROG - HW:1.2 SW:1.3 PROTO:1.3
Reading IC (1024 words)...done.


=> Please always use the "-v" option to give verbose output. This will show more details in case something is wrong.


JS


BTW... I just saw that you wrote some time ago that you already had success with PMS150C:
On the plus side - my second SMD version had some small success - it recognised the PMS150C, but not the PFS154 or PFS173. It was unable to program any of them...

PMS150C:
easypdkprog probe
Probing IC... found.
TYPE:OTP RSP:0x285A0 VPP=4.50 VDD=2.00
IC is supported: PMS150C / PMS15A ICID:0xA16

Confused.....
« Last Edit: August 17, 2020, 10:31:45 pm by js_12345678_55AA »
Easy PDK programmer and more: https://free-pdk.github.io
 
The following users thanked this post: bovineck

Offline bovineck

  • Contributor
  • Posts: 12
  • Country: au
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1159 on: August 18, 2020, 08:39:33 am »
Quote
Please always use the "-v" option to give verbose output. This will show more details in case something is wrong.

PMS150C
easypdkprog probe -v

Searching programmer... found: /dev/ttyACM0
FREE-PDK EASY PROG - Hardware:1.2 Firmware:1.3 Protocol:1.3
Probing IC... found.
TYPE:FLASH RSP:0xF VPP=4.50 VDD=2.00
Unsupported IC

PMS150C
easypdkprog -n PMS150C read emptypms150c.hex -v

Searching programmer... found: /dev/ttyACM0
FREE-PDK EASY PROG - Hardware:1.2 Firmware:1.3 Protocol:1.3
Reading IC (1024 words)...FPDK_ERROR: command ack failed / wrong icid

Compare with PFS154:
easypdkprog probe -v

Searching programmer... found: /dev/ttyACM0
FREE-PDK EASY PROG - Hardware:1.2 Firmware:1.3 Protocol:1.3
Probing IC... found.
TYPE:FLASH RSP:0x1AA1 VPP=4.50 VDD=2.00
IC is supported: PFS154 ICID:0xAA1

Quote
BTW... I just saw that you wrote some time ago that you already had success with PMS150C:
Confused.....

That "success" was with an earlier version where I could talk to PMS150C (but not program) and not recognise PFS154/PFS173. In version IV just to be interesting I can recognise and program PFS154/PFS173 but not PMS150C - very strange! I'm going to start on MKV soon and hopefully there will be success across the board. Thank you for your help and suggestions!

Take care,
OneCircuit
You're unique, like everyone else
 

Offline LovelyA72

  • Contributor
  • Posts: 43
  • Country: us
  • Kashikoma from Massachusetts!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1160 on: September 02, 2020, 05:24:54 am »
I am working on an 8 bit PWM tone project. The current status is WIP but in a useable state.

Tested on PFS154, but should work on PMS150C.

The size of the demo program is around 300 words, so it should be able to fit plenty of notes.

half notes are currently not supported. Manual frequency input is not supported due to the way padauk controls the PWM frequency.

https://github.com/Kashouryo/Padauk-tone
Kashikoma!
 

Offline Talrey

  • Contributor
  • Posts: 9
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1161 on: September 04, 2020, 05:08:37 am »
Finally got my parts in and soldered up a board, woohoo!

It was tricky, I haven't done SMD soldering in a long time so I ended up needing to borrow the services of the friendly neighborhood reflow oven. A couple close calls with old, bubbly tack flux later and I have an assembled pdk programmer.

The trouble now is, I can't seem to flash the firmware with `dfu-util`. Power seems to be going to the board, as checked at the 1x4 male header, but nothing shows up in `lsusb`. Even with `-vv`, all it tells me is:
DFU suffix version 100
dfu-util: No DFU capable USB device available


Is there something obvious I'm missing or is my best option to start poking SMD bits with my multimeter?
 

Offline serisman

  • Regular Contributor
  • *
  • Posts: 94
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1162 on: September 04, 2020, 03:39:54 pm »
...
The trouble now is, I can't seem to flash the firmware with `dfu-util`. Power seems to be going to the board, as checked at the 1x4 male header, but nothing shows up in `lsusb`.
...
Is there something obvious I'm missing or is my best option to start poking SMD bits with my multimeter?

Did you remember to press and hold the button while plugging it in to enable bootloader mode?
 

Offline itelite

  • Contributor
  • Posts: 23
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1163 on: September 04, 2020, 05:18:42 pm »
Does anyone have any experience with the official Programming tool?  I finally got one, when i insert the PMS150 8 pin IC (using a small break out board) it says "IC Ready",  but when i hit the program button it says "Find a diff IC.".  I have tried 5 different ICs just to make sure, but the results are all the same. 

I sent an email to their support and hopefully hear back, but just wondering if someone else has had this experience.

 

Offline Talrey

  • Contributor
  • Posts: 9
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1164 on: September 05, 2020, 12:38:41 am »
...
The trouble now is, I can't seem to flash the firmware with `dfu-util`. Power seems to be going to the board, as checked at the 1x4 male header, but nothing shows up in `lsusb`.
...
Is there something obvious I'm missing or is my best option to start poking SMD bits with my multimeter?

Did you remember to press and hold the button while plugging it in to enable bootloader mode?

Yup. Tried every boolean combination of Button First | Plugging In | Button While Doing lsusb. No change in the output.
 

Offline wolf22

  • Newbie
  • Posts: 4
  • Country: ch
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1165 on: September 05, 2020, 10:57:39 am »
Yup. Tried every boolean combination of Button First | Plugging In | Button While Doing lsusb. No change in the output.

Long time ago I had serious doubts when looking on the schematic of the programmer. The chip would allow programming via SWD and also via bootloader, but instead placing a suitable connector on the board, a pushbutton was placed.

I myself refuse to smudge my HDD by installing such a dfu-util. Programming via bootloader would be the cleanest and easiest way, but the schematic does not provide it. So the best way for you is to use a eval-board from ST and use the onboard ST-Link from this board to program the programmer. A better way would be using a JLink from Segger and manually connect the /reset to it.

And do not forget: fresh chips from ST often need to be bulk erased and unlocked before they are ready to be programmed.
 

Offline Talrey

  • Contributor
  • Posts: 9
  • Country: us
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1166 on: September 05, 2020, 09:37:41 pm »
Yup. Tried every boolean combination of Button First | Plugging In | Button While Doing lsusb. No change in the output.

Long time ago I had serious doubts when looking on the schematic of the programmer. The chip would allow programming via SWD and also via bootloader, but instead placing a suitable connector on the board, a pushbutton was placed.

I myself refuse to smudge my HDD by installing such a dfu-util. Programming via bootloader would be the cleanest and easiest way, but the schematic does not provide it. So the best way for you is to use a eval-board from ST and use the onboard ST-Link from this board to program the programmer. A better way would be using a JLink from Segger and manually connect the /reset to it.

And do not forget: fresh chips from ST often need to be bulk erased and unlocked before they are ready to be programmed.

As luck would have it, I have an STM eval board! It's an STM32F4-Discovery that's currently running MicroPython. I see a port labeled "SWD", and there are some jumpers that seem to allow choosing between "ST-LINK" and "Discovery". Are the right pins exposed on the PDKProg board? I would guess the 4-pin header, but the SWD on my Discovery has 6 pins and I don't know anything about the ST-Link protocol.
 

Offline tim_

  • Regular Contributor
  • *
  • Posts: 189
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1167 on: September 06, 2020, 05:39:13 am »

Yup. Tried every boolean combination of Button First | Plugging In | Button While Doing lsusb. No change in the output.

Does your device enumerate when you plug it in while the button is pressed? It should show up as "STM32 BOOTLOADER". If it does not, then there is certainly a hardware issue, like a solder bridge or incomplete connection. Trying to program the device with SWD will not make that issue go away. Choose wisely where you spend your effort :)

Did you check the 3.3V supply? Did you check the USB connection on the PCB?

« Last Edit: September 06, 2020, 07:26:00 am by tim_ »
 

Offline tim_

  • Regular Contributor
  • *
  • Posts: 189
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1168 on: September 06, 2020, 05:41:03 am »
...  Programming via bootloader would be the cleanest and easiest way, but the schematic does not provide it. So the best way for you is to use a eval-board from ST and use the onboard ST-Link from this board to program the programmer. A better way would be using a JLink from Segger and manually connect the /reset to it.

And do not forget: fresh chips from ST often need to be bulk erased and unlocked before they are ready to be programmed.

Sorry, that statement does not even make sense. The STM32F072 comes with integrated USB bootloader that is invoked by the pushbutton. This works very well. No bulk erase or SWD access is needed if it is a fresh device.

There are some people that have trouble soldering the board, but that is unrelated to the bootloader.
« Last Edit: September 06, 2020, 07:22:39 am by tim_ »
 

Offline bingo600

  • Super Contributor
  • ***
  • Posts: 1572
  • Country: dk
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1169 on: September 06, 2020, 05:52:40 am »
I myself refuse to smudge my HDD by installing such a dfu-util.

Why would dfu-util be a smudge ??
That makes no sense

/Bingo

Who uses Tim's Rev 0 programmer wo. any problems  :-+
« Last Edit: September 06, 2020, 05:56:23 am by bingo600 »
 

Offline bingo600

  • Super Contributor
  • ***
  • Posts: 1572
  • Country: dk
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1170 on: September 06, 2020, 06:00:38 am »
I am working on an 8 bit PWM tone project. The current status is WIP but in a useable state.
https://github.com/Kashouryo/Padauk-tone

May i ask why you have included "code" your tone.h file ?
That is a bit unconventional.

/Bingo
 

Offline LovelyA72

  • Contributor
  • Posts: 43
  • Country: us
  • Kashikoma from Massachusetts!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1171 on: September 06, 2020, 07:06:53 am »
I am working on an 8 bit PWM tone project. The current status is WIP but in a useable state.
https://github.com/Kashouryo/Padauk-tone

May i ask why you have included "code" your tone.h file ?
That is a bit unconventional.

/Bingo

That's actually quite common in padauk projects that I read before.
Kashikoma!
 

Offline tim_

  • Regular Contributor
  • *
  • Posts: 189
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #1172 on: September 06, 2020, 07:28:55 am »
I am working on an 8 bit PWM tone project. The current status is WIP but in a useable state.
https://github.com/Kashouryo/Padauk-tone

May i ask why you have included "code" your tone.h file ?
That is a bit unconventional.

/Bingo

That's actually quite common in padauk projects that I read before.

Yeah, but that is not done because this is acceptable style, but because SDCC is not able to remove unused functions from the binary... I know I am also guilty of this, but generally no code should be in the include files.
 

Offline tim_

  • Regular Contributor
  • *
  • Posts: 189
  • Country: de
PFS173 bugs/features
« Reply #1173 on: September 06, 2020, 01:35:05 pm »
I have been working with the PFS173 again, only to bump into some additional oddities. Not sure where else to document this:

Power on reset

It seems that the PFS173 power on reset does not work if the slew rate is too low. My power supply takes around 50 ms to ramp to final voltage. This will lead to the PFS173 not starting at all. See waveform here:

[attach=1]

When I detach and attach the connection manually, everything is fine:

[attach=2]

11 Bit PWM

It took me quite a while to figure out why the PWM frequency was never the one I tried to set: The 11 Bit PWM is actually a 10 bit counter. The eleventh bit is generated by a ANDing the LSB with the clock. Therefore only 1024 maximum counts should be assumed when calculating the PWM frequency.

There are also several "code options" mentioned in the datasheet. Has anybody already figured out how these can be activated? f.E. seetting the PWM clock source to IHRC*2.
« Last Edit: September 06, 2020, 02:08:22 pm by tim_ »
 

Offline cmfcmf

  • Contributor
  • Posts: 9
  • Country: de
    • github.com/cmfcmf
Re: PFS173 bugs/features
« Reply #1174 on: September 06, 2020, 01:50:02 pm »
It seems that the PFS173 power on reset does not work if the slew rate is too low. My power supply takes around 50 ms to ramp to final voltage. This will lead to the PFS173 not starting at all. See waveform here:

I experienced the same behavior. For me, setting the startup speed code option to 'slow' fixed that behavior.

There are also several "code options" mentioned in the datasheet. Has anybody already figured out how these can be activated? f.E. seetting the PWM clock source to IHRC*2.

I haved documented the code options and how to use them here: https://free-pdk.github.io/tutorial#code-options
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf