EEVblog #1144 - Padauk Programmer Reverse Engineering

[spth]

Evaluation boards (design on https://github.com/free-pdk/f-eval-boards), hand-soldered prototypes (well the PFS232 is not yet available from Padauk, so for that one Ihave the pcb only).

Left: PFS173
Middle: PFS154
Right: PFS232

One can't see it very well in the image, but the bottom header (for programming) has pin names below.

[js_12345678_55AA]

Evaluation boards (design on https://github.com/free-pdk/f-eval-boards), hand-soldered prototypes).

Nice timing. I just got PCB1.2 revision of Easy PDK Programmer and soldered a small batch. No problems found so far. Everything working as expected.

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

I will upload all schematics + firmware + software right after I'm sure everything is working as expected.

[ali_asadzadeh]

Nice timing. I just got PCB1.2 revision of Easy PDK Programmer and soldered a small batch. No problems found so far. Everything working as expected.

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

I will upload all schematics + firmware + software right after I'm sure everything is working as expected.

That's great, because Also I have ordered some PFS173-S14, I hope they become useful in my projects! Also I found it weird, I can not find these puppies from my other Chinese suppliers! I have at list tried 10 different suppliers, I only got them from lcsc

[spth]

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

Which Padauk devices are currently supported?

Philipp

[js_12345678_55AA]

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

Which Padauk devices are currently supported?

Philipp

The firmware for STM32 is generic and should support any IC.
All parameters are defined and sent from the host software.

I focused on testing everything with PFS154 but support for other ICs can be added easily.

Here an example of one entry of the IC definition table in host software:

static const FPDKICDATA fpdk_ic_table[] =
{
  { .name               = "PFS154",
    .otpid              = 0x2AA1,
    .type               = FPDK_IC_FLASH,
    .addressbits        = 13,
    .codebits           = 14,
    .codewords          = 0x800,
    .ramsize            = 64,
    .exclude_code_start = 0x7ED, //use 0xFFFF to disable
    .exclude_code_end   = 0x7F0, //use 0xFFFF to disable
    .vdd_cmd            = 3.0,
    .vpp_cmd            = 5.6,
    .vdd_write          = 5.8,
    .vpp_write          = 8.5,
    .vdd_erase          = 5.8,
    .vpp_erase          = 8.5,
    .default_ihrcr      = 0x80,
    .default_bgtr       = 0x5A,
  },

[js_12345678_55AA]

Hi,

today I was very excited when I finally got the following output:

bash-3.2$ sdcc -mpdk14 hellopfs154noprintf.c


bash-3.2$ ./easypdkprog write hellopfs154noprintf.ihx --icname PFS154 --fuse 31FD
Erasing IC... done.
Writing IC... done.
Writing IC Fuse... done.


bash-3.2$ ./easypdkprog start
Running IC (5.00V)... IC started, press [Esc] to stop.
Hello World!
Hello World!
Hello World!
Hello World!

Explanation:
1. SDCC compiler development branch which supports PADAUK (MANY MANY thanks to SPTH and Nicolas Lesser) is used to compile a small test program

2. easypdkprog is used to send the compiled program to PFS154 sitting in a socket on top of the Easy PDK programmer

3. the PFS154 IC is started while still in the socket on top of the programmer. All serial output on PA.7 is captured and shown on the screen


So real development can start now 



I will cleanup the sources and release all of them on https://free-pdk.github.io during the next few days:
- Easy PDK programmer schematic and PCB design files
- STL files for 3D printable housing (housing not required)
- Easy PDK programmer firmware + source code
- easypdkprog source code

Right now only PFS154 is supported but other types will get added quickly now.

 


In case you are curious here the output of:

bash-3.2$ ./easypdkprog --help
Usage: easypdkprog [OPTION...] probe|read|write|erase|start [FILE]
easypdkprog -- read, write and execute programs on PADAUK microcontroller
https://free-pdk.github.io

  -b, --bin                  Binary file output. Default: ihex8
  -c, --calibrate            Calibrate IC after writing
  -f, --fuse=FUSE            FUSE value, e.g. 0x31FD
  -n, --icname=NAME          IC name, e.g. PFS154
      --noblankchk           Skip blank check before write
      --noerase              Skip erase before write
      --noverify             Skip verify after write
  -o, --otpid=ID             OTP ID, e.g. 0x2AA1
  -p, --port=PORT            COM port of programmer. Default: Auto search
  -r, --runvdd=VDD           VDD voltage for running IC (e.g. 3.3). Default: 5.0
  -v, --verbose              Verbose output
  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options.

[spth]

1. SDCC compiler development branch which supports PADAUK (MANY MANY thanks to SPTH and Nicolas Lesser) is used to compile a small test program

We've made quite some progress recently. It seems, there now is only one remaining bug to be fixed (related to arrays that are not const) to get the first of the SDCC regression tests (it tests abs() and labs() from the standard library) to pass.

I assume we can fix enough bugs to make four fifths or so of the tests pass sometime next week, which should be good enough to merge to trunk, so the pdk14 backend would make it into the next SDCC release (3.9.0).

Philipp

[js_12345678_55AA]

Where can we download latest SDCC?

Right now you have to go to the "pdk" branch of sdcc in their svn, check it out and compile it.

https://sourceforge.net/p/sdcc/code/HEAD/tree/branches/pdk/

But remember, it is an experimental branch which might or might not work from day to day (lot of activity right now).

JS

[piotr_go]

...check it out and compile it.

Thank You. It's working.

[js_12345678_55AA]

...check it out and compile it.

Thank You. It's working.

Do you plan to share your project / source / ... ?

[piotr_go]

https://github.com/piotr-go/PADAUK

PFS154-S08 POV display:

[spth]

Yes really need the +1 for PCADD. Otherwise my program was jumping into nowhere, crashing (I think it adds 256 in the case of A=0, will need to investigate)

Any news on zero a?

Philipp

[js_12345678_55AA]

Yes really need the +1 for PCADD. Otherwise my program was jumping into nowhere, crashing (I think it adds 256 in the case of A=0, will need to investigate)

Any news on zero a?

Philipp

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

PCADD A   with A=0:

Possibility 1:
The IC will do the equation mentioned in reference manual: "PC <- PC + A" which results in an endless loop.

Possibility 2:
PC is incremented by 1 automatically after each instruction. So maybe IC is subtracting 1 from operand and then adds this to the already advanced PC.
In case A=0 this subtraction would result in 0xFF which is added to the advanced PC which would be same as "PCADD 0x100"
This would match the behavior I observed when I tried it with ICE (I found program execution somewhere in code memory after "pcadd 0")... but this also could be an ICE bug.

In order to try this we would need to create and run a small test assembly program like this:


TEST_PCADD:
MOV A,0
PCADD A
RET 0x01
RET 0x02
...
RET 0xFE
RET 0xFF
RET 0x00

MAIN:
CALL TEST_PCADD
==> A holds result
if 0 then is variant 2
if not coming back then variant 1
if anything else then ??


JS

[ali_asadzadeh]

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

Thanks, I have orders some of these

[piotr_go]

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

I have similar results with my programmer.
Different write command?

[spth]

The pdk branch of SDCC has been merged to trunk today. Further development will happen there.

From tomorrow, the nightly snapshots (http://sdcc.sourceforge.net/snap.php) should include support for pdk14 and pdk15.

The pdk14 port is working quite well now; while many regression tests had to be disabled ofr pdk14 due to lack of memory, the large number of tests passing still indicate that pdk14 is quite stable now:

Summary for 'pdk14': 10 failures, 2997 tests, 2101 test cases, 1463033 bytes, 17333727 ticks

Philipp

[electronic_eel]

Hi,

I will cleanup the sources and release all of them on https://free-pdk.github.io during the next few days:
- Easy PDK programmer schematic and PCB design files

Thanks for posting the hardware files of the programmer.

I was about to order the pcb and had a look at the Gerber_EASYPDKPROG_PCB12_Panel4x_NoSilk.zip file in a gerber viewer (gerbv from the gEDA project). I have attached a screenshot.

It looks like only one of the programmers is in the gerbers and not a panel of 4, 3 are empty. Also the plated slot for the usb connector looks just like a hole. So I'm a bit in doubt if these gerbers are correct. But there also might be some advanced gerber functions at play that gerbv doesn't understand.

Did you use these gerber files to order at JLCPCB or did you use a direct order link from easyeda into JLCPCB?

[js_12345678_55AA]

Did you use these gerber files to order at JLCPCB or did you use a direct order link from easyeda into JLCPCB?

The exact same Gerber ZIP file was uploaded to JLCPCB using the upload Gerber function. The production went smoothly and the received PCB panels did not have any error (also the USB port fits nicely).

The multiple copy of the outline without having the same PCB inside is an industry standard for PCB factories used to indicate to panelize the PCB.


In case you plan to build the programmer please consider clicking on the AFFILIATE link when you start to order parts of the BOM on lcsc web site: LCSC.com

JS

[electronic_eel]

The exact same Gerber ZIP file was uploaded to JLCPCB using the upload Gerber function. The production went smoothly and the received PCB panels did not have any error (also the USB port fits nicely).

Good to know, thanks.

The multiple copy of the outline without having the same PCB inside is an industry standard for PCB factories used to indicate to panelize the PCB.

I never heard of that one. All the tutorials regarding panelization I've seen copy the actual content. Do you happen to have a link or document explaining the details of this process?

[anxzhu]

https://docs.easyeda.com/en/PCB/Panelize/index.html

[spth]

Do we have any idea which devices support ldsptl or ldspth, and which ones don't?

[oPossum]

Only supported by the 14 bit parts.

https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering/msg2010509/#msg2010509

[js_12345678_55AA]

Only supported by the 14 bit parts.

https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering/msg2010509/#msg2010509

More correct: PADAUK IDE generates opcodes only for 14 bit parts.

However they might be in all processor variants.

Another example for this assumption: 15 bit devices reference 4 opcodes in manual which IDE also does not compile:

NMOV A, M
NMOV M, A
SWAP M
XOR A, IO

But there is space inside of the instruction set to support exact this opcodes.

[piotr_go]

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

Any progress?

I think i found a new command.
0xA5A5A5AB, with B like BRICKED at the end
When executed µC looks like locked, but FW does not work and cannot be erased.
Tested on pfs154 and pfs173, vpp 10V, vcc 5V/6V.

[js_12345678_55AA]

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

Any progress?

I think i found a new command.
0xA5A5A5AB, with B like BRICKED at the end
When executed µC looks like locked, but FW does not work and cannot be erased.
Tested on pfs154 and pfs173, vpp 10V, vcc 5V/6V.

I got PFS154 and PFS173 working, now focusing on OTP like PMS154 / B / C.

./easypdkprog list
Supported ICs:
 PMS154   (0xA06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PFS154   (0xAA1): FLASH: 2048 (14 bit), RAM: 128 bytes
 PMS154B  (0xC06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS154C  (0xE06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PFS173   (0xEA2): FLASH: 3072 (15 bit), RAM: 256 bytes


After this only internal high/low speed osc (IHRCR / ILRCR) and bandgap (BGTR) tuning is left to do.

So release of firmware / host software is coming soon :-)

JS