EEVblog #1144 - Padauk Programmer Reverse Engineering

[itelite]

I can read successfully and it has been written.  not sure how to compare it to input, since input is a IHX file, readout seems to do a HEX file or a BIN file.

.ihx and .hex are both file endings for Intel Hex. objcopy can be used to convert between Intel Hex and raw binary.

I have attached my readout as well as the orginal example PM150 hello world (had to add txt per forum upload rules)

In hex editor they appear very different. 

[socram]

(In development branch of programmer software, examples folder: https://github.com/free-pdk/easy-pdk-programmer-software/tree/development/Examples/src)

JS

I might be wrong, but isn't 2.5 LVR register value 0x80 instead of 0x70? I think I got 0x80, and that would make sense given the rest of the values are using only the three MSB of the MISCLVR register.

[socram]

For quicker reference, here's a sorted table of all the VDD the comparator on the PFS154 can measure:

VDD (BG=1.2V)	GPCS.5	GPCS.4	GPCS.N
1.60	0	0	15
1.67	0	0	14
1.75	0	0	13
1.80	0	1	15
1.83	0	0	12
1.92	0	1	14
1.92	0	0	11
2.00	1	0	15
2.02	0	0	10
2.06	0	1	13
2.09	1	0	14
2.13	0	0	9
2.18	1	0	13
2.22	0	1	12
2.26	0	0	8
2.29	1	0	12
2.40	0	0	7
2.40	0	1	11
2.40	1	0	11
2.40	1	1	15
2.53	1	0	10
2.56	0	0	6
2.56	1	1	14
2.62	0	1	10
2.67	1	0	9
2.74	0	0	5
2.74	1	1	13
2.82	1	0	8
2.88	0	1	9
2.95	0	0	4
2.95	1	1	12
3.00	1	0	7
3.20	0	0	3
3.20	0	1	8
3.20	1	1	11
3.20	1	0	6
3.43	1	0	5
3.49	0	0	2
3.49	1	1	10
3.60	0	1	7
3.69	1	0	4
3.84	0	0	1
3.84	1	1	9
4.00	1	0	3
4.11	0	1	6
4.27	0	0	0
4.27	1	1	8
4.36	1	0	2
4.80	0	1	5
4.80	1	0	1
4.80	1	1	7
5.33	1	0	0
5.49	1	1	6
5.76	0	1	4
6.40	1	1	5
7.20	0	1	3
7.68	1	1	4
9.60	0	1	2
9.60	1	1	3
12.80	1	1	2
14.40	0	1	1
19.20	1	1	1
28.80	0	1	0
38.40	1	1	0

[js_12345678_55AA]

I can read successfully and it has been written.  not sure how to compare it to input, since input is a IHX file, readout seems to do a HEX file or a BIN file.

.ihx and .hex are both file endings for Intel Hex. objcopy can be used to convert between Intel Hex and raw binary.

I have attached my readout as well as the orginal example PM150 hello world (had to add txt per forum upload rules)

In hex editor they appear very different.

Your "readout" file shows that only a few bits of the very first 2 words got changed. Most likely VDD / VPP was instable or inaccurate during programing.

In order to investigate further you should:
- check with "easypdkprogtest" the output values of VDD and VPP (nothing connected)
- check length / resistance of your wires / socket (it is not only the programing speed, also voltage is affected by poor / long / ... wires/sockets).
- show us a picture of your complete setup


JS

PS: The HelloWorld program will output "Hello World!" on the serial port. README in same directory as the .ihx files has full information:
https://github.com/free-pdk/easy-pdk-programmer-software/tree/master/Examples

[js_12345678_55AA]

(In development branch of programmer software, examples folder: https://github.com/free-pdk/easy-pdk-programmer-software/tree/development/Examples/src)

JS

I might be wrong, but isn't 2.5 LVR register value 0x80 instead of 0x70? I think I got 0x80, and that would make sense given the rest of the values are using only the three MSB of the MISCLVR register.

Hi,

according to the include file from IDE ("PFS173.INC") "misc_lvr" is defined like this:

MISC_LVR      IO_WO:OP   0x28 (-)
      $ 7 ~ 4 :   1V8, 1V9, 2V, 2V1, 2V2, 2V3, 2V4, 2V5, 2V75, 3V, 3V15, 3V3, 3V5, 3V75, 4V, 4V5
      $ 1 ~ 0   :   BG_On, BG/4, BG/32, BG_Auto


which translates to (bit 7-4 = upper most 4 bits = upper nibble):
1V8  = 0000rrxx = 0x00
1V9  = 0001rrxx = 0x10
2V    = 0010rrxx = 0x20
2V1  = 0011rrxx = 0x30
2V2  = 0100rrxx = 0x40
2V3  = 0101rrxx = 0x50
2V4  = 0110rrxx = 0x60
2V5  = 0111rrxx = 0x70  <== correct
2V75= 1000rrxx = 0x80
...


JS

[socram]

Sorry, I forgot to mention I was talking about the PFS154.

[js_12345678_55AA]

Sorry, I forgot to mention I was talking about the PFS154.

Ok, now I see. It is fixed in development branch. Thanks for reporting.

JS

[js_12345678_55AA]

For a very low-power, which does not need perfect frequency accuracy, I'm trying to use ILRC and keep IHRC disabled. However I seem to be getting a frequency four times lower than expected on ILRC:

Code: [Select]

#include <pfs154.h>

// From cpldcpu's SimPad repository
#define PDK_USE_FACTORY_TRIMMING() {__asm__ (".word (0x3fed)\nmov __ihrcr,a\n.word (0x3fee)\nmov __bgtr,a\n");}

unsigned char _sdcc_external_startup(void) {
PDK_USE_FACTORY_TRIMMING();

// Set clock to ILRC and disable IHRC
CLKMD = CLKMD_ENABLE_ILRC | CLKMD_ENABLE_IHRC | CLKMD_ILRC;
CLKMD &= ~CLKMD_ENABLE_IHRC;

return 0;
}

int main(void) {
// Set PA0 pin to output
PAC = 0b00000001;

while (1) {
__set1(PA, 0);
__set0(PA, 0);
}
}
I get a square wave with a duty cycle of 25%, but at 11.1KHz rather than the expected 54KHz than the datasheet suggests. Any idea why?

I have tried with two different PFS154 to rule out a defect in a single device, and they both behave the same.

Hi,

this is exact what it should look like (according to your program).

After compilation have a look inside of the .asm file created from sdcc:

...
; ilrctest.c: 20: while (1) {
00102$:
; ilrctest.c: 21: __set1(PA, 0);
  set1  __pa, #0
; ilrctest.c: 22: __set0(PA, 0);
  set0  __pa, #0
  goto  00102$
...

set1 (1 cycle)
set0 (1 cycle)
goto (2 cycles)

==> 4 cycles per loop, set1 stays on for 1 cycle (25%) and set0 stays on for 1 + 2(goto) cycles (75%)

According to PFS154 data sheet chapter 4.4: ILRC is apx. 55kHz at 5.0V

==> 55000 Hz / 4 cycles = 13750 Hz (already very close to your measured output frequency, maybe ILRC also needs tuning which I have not finished in easypdkprog completely yet).

JS

BTW: ILRC is on by default (IC starts up with ILRC). There is no need to turn on IHRC and turn it off in _sdcc_external_startup. Also the factory trimming is for IHRC only, so there is no need to load it in this case.

[socram]

No no, I meant 11.1KHz CPU clock frequency, so about 2.77KHz frequency on PA0.

It turns out it was the scope's fault. Or maybe mine, depending on how you see it: last time I used it I was working with high speed signals instead of the slow signals I use to work with, so I used the "X5" magnification which I never use and forgot to turn it off 

Mix that with me getting the calculations incorrectly for the timer 2 by a factor of four in the program I had written before to blink an LED at about 0.5Hz, and you get me going crazy for the last three hours without knowing why every signal coming from the PFS154 is suddenly way slower than last week.

Thanks for your post still, though!

[KaeTo]

Hello ,

I hope that you can help me. I got to know the padauk uC from youtube quite a while ago. Recently I build the Free pdk Programmer from Github, but I have some starting issues. I got the firmware sucessfully flashed and have also probed successfully a PMS150C. My question is now what mikrocontrollers are supported by the time, bcause I think I read somewhere that I can only flash the PFS154 and PFS174. What format do I need for flashing? Do I need a .hex file or can I use the .pdk file of the padauk ide. If I could not use the .pdk file directly is there way to convert it to a .hex. If there is no way I have to use the SDCC for programming, don't I? And my last question is, if there is a tutorial or a list of the operations you can use when programming in c or mini-C?

I hope that you can help me.

[spth]

Hello ,

I hope that you can help me. I got to know the padauk uC from youtube quite a while ago. Recently I build the Free pdk Programmer from Github, but I have some starting issues. I got the firmware sucessfully flashed and have also probed successfully a PMS150C. My question is now what mikrocontrollers are supported by the time, bcause I think I read somewhere that I can only flash the PFS154 and PFS174.

Try

Code: [Select]

easypdkprog list to list the supported devices.

[spth]

And my last question is, if there is a tutorial or a list of the operations you can use when programming in c or mini-C?

When programming in C (that is using SDCC), nearly all of standard C will just work. Just learn C. Unless you run into code size / RAM size problems, if it compiles with GCC, it most likely will compile with SDCC.
You still need to think of the limitations of the hardware, and make sure you write efficient code, as otherwise you'll hit the hardware limits soon. Examples to get started can be found at: https://github.com/free-pdk/sdcc-pdk-code-examples

Mini-C, on the other hand is differerent. It ist just a thin layer above assembler with C-like syntax and very restricted. AFAIR, the documentation is somewhat outdated, and some of it is available in Traditional Chinese only. But there also are some examples that could help getting started.

[KaeTo]

Thank you for yours answers. I think I should have been a bit more specific. I am fairly expirience in programming with C (till now only Atmel controllers). I mean where do I find the specific comandos for setting up the uC. Thing like timer , interupts on coperator edge detections. Do I use the same aus discribed in the data sheet or do they vary a bit.

And the question for the programming of the PMS150C is more if I can generate the file for flashing or not? Therefor I want to know if I an use the .pdk Files from the padauk IDE. I think I read somewhere in this post, that by now only the PFS154 and PFS174 are supported in the SDCC and I can only flash .hex files because the .pdk contain futher informations than only the code (something like calibration of the clock).

I hope my questions are more understandable now.

[js_12345678_55AA]

Hi,

I mean where do I find the specific comandos for setting up the uC. Thing like timer , interupts on coperator edge detections. Do I use the same aus discribed in the data sheet or do they vary a bit.

The manufacturer data sheets are the best source. They explain in detail how to setup interrupts, timers, comparator, edge detections,...
As @spth mentioned before, there are several examples here: https://github.com/free-pdk/sdcc-pdk-code-examples
Also the easypdkprog repository contains a simple "hello world" example (compiled for PMS150C / PFS154 / PFS173 and as source code): https://github.com/free-pdk/easy-pdk-programmer-software/tree/master/Examples

And the question for the programming of the PMS150C is more if I can generate the file for flashing or not?

You can use SDCC and it will produce the complete (hex) file for flashing. (see above)

I think I read somewhere in this post, that by now only the PFS154 and PFS174 are supported in the SDCC...

This is wrong. Right now SDCC can be used to generate code for all 13, 14 and 15 bit PADAUK ICs which includes apx. 95% of all PADAUK ICs available.
It does not matter if they are OTP or flashed based.
PMS150 is 13 bit OTP
PMS154 is 14 bit OTP
PFS154 is 14 bit FLASH
PFS173 is 15 bit FLASH
...

So SDCC supports *all* ICs, easypdkprog needs to be extended for every specific IC. Right now the following IC types are supported:
./easypdkprog list
Supported ICs:
PMC251   (0x058): OTP  : 1024 (16 bit), RAM:  96 bytes
 PMS132   (0x109): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS132B  (0x109): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS150C  (0xA16): OTP  : 1024 (13 bit), RAM:  64 bytes
 PMS15A   (0xA16): OTP  : 1024 (13 bit), RAM:  64 bytes
 PMS152   (0xA27): OTP  : 1280 (14 bit), RAM:  80 bytes
 PMS271   (0xA58): OTP  : 1024 (16 bit), RAM:  64 bytes
 PFS154   (0xAA1): FLASH: 2048 (14 bit), RAM: 128 bytes
 PMS133   (0xC19): OTP  : 4096 (15 bit), RAM: 256 bytes
 PMS134   (0xC19): OTP  : 4096 (15 bit), RAM: 256 bytes
 MCU390   (0xC31): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS131   (0xC83): OTP  : 1536 (14 bit), RAM:  88 bytes
 PMS171B  (0xD36): OTP  : 1536 (14 bit), RAM:  96 bytes
 PMS154B  (0xE06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS154C  (0xE06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PFS173   (0xEA2): FLASH: 3072 (15 bit), RAM: 256 bytes


In case you need support for a specific IC not in the list just give a note.

Therefor I want to know if I an use the .pdk Files from the padauk IDE. I think I read ... that ... I can only flash .hex files because the .pdk contain futher informations than only the code (something like calibration of the clock).

This is correct. PDK files can NOT be flashed to the IC directly. The original IDE inserts a lot of stub code which the WRITER (flasher) needs to know about and manipulate the contents flashed to the IC.
For example The IDE inserts a a calibration loop in every PDK file which will prevent your program from starting unless you do a specific calibration and write some values to some special locations.
Since we focus on creating a free and open source tool chain here not much effort is going into adding support for the legacy closed and undocumented PDK file solution.


Have fun,

JS

[KaeTo]

Hi

js_12345678_55AA you said tat the 13 bit padauks are supported, but on Github (https://github.com/free-pdk/sdcc-pdk-code-examples/blob/master/README) stands that it is still experimental. Futhermore I installed sdcc yesterday and only the pdk14 and pdk15 where showes for lib installation. Is there a way that I get the pdk13 lib, altthough it is still experimental. I want to use the PMS150C for a few small and very simple task, because of its little footprint (sot23-6).

[js_12345678_55AA]

js_12345678_55AA you said tat the 13 bit padauks are supported, but on Github (https://github.com/free-pdk/sdcc-pdk-code-examples/blob/master/README) stands that it is still experimental.

Everything here is "experimental" . The text you reference is from June "For pdk13, the SDCC-based toolchain is still experimental as of 2019-06-09"). A lot has been done and SDCC produces good code for 13 bit. I used it for 2 full projects already.

Futhermore I installed sdcc yesterday and only the pdk14 and pdk15 where showes for lib installation.
Is there a way that I get the pdk13 lib, altthough it is still experimental.

If you follow the link / instructions from the example directory I mentioned earlier... https://github.com/free-pdk/easy-pdk-programmer-software/tree/master/Examples/src
you will find a download link for current SDCC snapshots (nightly builds) for several platforms: http://sdcc.sourceforge.net/snap.php
I just checked again and 13 bit support is included.

Have fun,

JS

[daveatol]

The work you've done reverse-engineering and designing the programmer is very impressive  . Is there a document describing the steps the programmer goes through to program the devices (e.g. set MCLR/Vpp=13V, VDD=6.5V, delay 100ms, etc.)?
Also, I was wondering if you've thought about using the PICKIT2 for programming the devices, as has a programmable Vpp/Vdd/etc. for programming PIC microcontrollers, and I get the feeling that the padauk chips are somewhat related. I've used the PICKIT2 for programming ATMEGA88 (set Vpp=Vdd=5V, use SPI data transfer) before the USBASP was readily available, and it may be easier to get hold of a PICKIT2 from online shops than the free-pdf/easy-pdk-programmer, for some people.

Best Regards,
db

[js_12345678_55AA]

The work you've done reverse-engineering and designing the programmer is very impressive  . Is there a document describing the steps the programmer goes through to program the devices (e.g. set MCLR/Vpp=13V, VDD=6.5V, delay 100ms, etc.)?
Also, I was wondering if you've thought about using the PICKIT2 for programming the devices, as has a programmable Vpp/Vdd/etc. for programming PIC microcontrollers, and I get the feeling that the padauk chips are somewhat related. I've used the PICKIT2 for programming ATMEGA88 (set Vpp=Vdd=5V, use SPI data transfer) before the USBASP was readily available, and it may be easier to get hold of a PICKIT2 from online shops than the free-pdf/easy-pdk-programmer, for some people.

Best Regards,
db

Hi,

Have a look here: https://github.com/free-pdk/fppa-pdk-documentation . You will find many notes and documents regarding programing of the IC.

I also had a look at PICKIT2 and considered using it. Unfortunately it was not fulfilling all requirements like capturing high speed signal from IC (this is required to calibrate the internal oscillator).
Also the price of PICKIT2 is a bit high compared to the $2 solution of easypdk programmer  .

Have fun,

JS

[daveatol]

Have a look here: https://github.com/free-pdk/fppa-pdk-documentation . You will find many notes and documents regarding programing of the IC.

Thanks! The "Architectural considerations" document is quite thorough.

I also had a look at PICKIT2 and considered using it. Unfortunately it was not fulfilling all requirements like capturing high speed signal from IC (this is required to calibrate the internal oscillator).

The PICKIT2 can capture at up to 1MHz (or 500kHz, 250kHz, etc.), for 1000 samples, so the calibration should be possible. It can only output Vdd<5V though, which will be an issue if 6.5V is required for programming. This would require a hardware workaround, if 5V Vdd is insufficient.

Also the price of PICKIT2 is a bit high compared to the $2 solution of easypdk programmer  .

So, where/how would someone in a developing nation, in particular Australia, get one of these $2 programmers?

Cheers

[socram]

There is a "limited voltage programming mode", at least for the PFS154, which does limit VDD to 5V. This mode is not yet documented however.

I would be interested too in using a PICkit too, since that would be an easier entry point for more people to get interested in the Padauk platform.

[js_12345678_55AA]

Also the price of PICKIT2 is a bit high compared to the $2 solution of easypdk programmer  .

So, where/how would someone in a developing nation, in particular Australia, get one of these $2 programmers?

I outlined the process to order from JLCPCB.com and LCSC.com. If you use the signup discounts you might pay less than USD20 (including shipping) for several pcbs and parts to make at least 10 pcs... and it is a fun project to solder them :-)

Have fun,

JS

[js_12345678_55AA]

There is a "limited voltage programming mode", at least for the PFS154, which does limit VDD to 5V. This mode is not yet documented however.

I would be interested too in using a PICkit too, since that would be an easier entry point for more people to get interested in the Padauk platform.

Hi,

according to PFS154 user manual we almost use "limited voltage programing mode...":

http://www.padauk.com.tw/upload/doc/PFS154%20datasheet_v104_EN_20190618.pdf

Page 89:

The voltage conditions in Limited-Voltage programming mode:
  (1)VDD is 5.0V, and the maximum supply current is up to about 20mA.
  (2)PA5 is 8.0V.
  (3)The voltage of other program pins (except GND) is the same as VDD.


I used VDD 5.0V / VPP 8.0V before and it was working OK... But if you add a capacitor on VDD it causes problems. That's why it was increased VDD to 5.5V and VPP to 8.5V in current easypdkprog which worked out really well.
Maybe if you write slowly / multiple times the same word then you could make it work with 5.0V VDD. But anything lower than this (e.g. 4.9V) will not work for sure...
But this obviously would work for the PFS (flash based ICs) only.

JS


BTW: Have you seen this: https://github.com/free-pdk/easy-pdk-programmer-hardware/issues/10
Looks like somebody might create a ready made version and sell it soon...

[spth]

Hi

js_12345678_55AA you said tat the 13 bit padauks are supported, but on Github (https://github.com/free-pdk/sdcc-pdk-code-examples/blob/master/README) stands that it is still experimental. Futhermore I installed sdcc yesterday and only the pdk14 and pdk15 where showes for lib installation. Is there a way that I get the pdk13 lib, altthough it is still experimental. I want to use the PMS150C for a few small and very simple task, because of its little footprint (sot23-6).

Did you install a release version? If yes, the latest is 3.9.0 and does not yet support pdk13.
If you want pdk13 support, you need to install a current snapshot (http://sdcc.sourceforge.net/snap.php) or just compile from svn.

[daveatol]

I would be interested too in using a PICkit too, since that would be an easier entry point for more people to get interested in the Padauk platform.

Same. I might have a go, although the way I'm thinking will require an external power supply, and an opamp to multiply the VDD x1.5.

I outlined the process to order from JLCPCB.com and LCSC.com. If you use the signup discounts you might pay less than USD20 (including shipping) for several pcbs and parts to make at least 10 pcs... and it is a fun project to solder them :-)

Yes, I did see that; it's a bit more than just a $2 device then. Maybe if the taobao guy doesn't get up and running, I'll consider making a batch. Soldering new clean PCBs is always fun

But anything lower than this (e.g. 4.9V) will not work for sure...  But this obviously would work for the PFS (flash based ICs) only.

That's good to know about the LVPM; the PICKIT2 has a schottky diode in line with VDD, so it will be ~4.9V max (unless VUSB is boosted to 6V).

BTW: Have you seen this: https://github.com/free-pdk/easy-pdk-programmer-hardware/issues/10
Looks like somebody might create a ready made version and sell it soon...

Sounds good

Thanks for all the great replies!

[KaeTo]

If you follow the link / instructions from the example directory I mentioned earlier... https://github.com/free-pdk/easy-pdk-programmer-software/tree/master/Examples/src
you will find a download link for current SDCC snapshots (nightly builds) for several platforms: http://sdcc.sourceforge.net/snap.php
I just checked again and 13 bit support is included.

Okay, I did what you said, but I still did not get it completly (sorry for that). I downloaded and installed the sdcc exe. During the installation prozess the applied libs are viewed. So I downloaded additionally the .zip file and unzipped it. In this unziped directory I found in the lib folder the pdk13 folder and copied it into the lib folder of the installed exe.
Now I tried compieling the code examples. At first helloword example from the software branch and later the examples from the sdcc example branch. Non of them worked. In the helloworld from the software branch I later defined additionally the the used uC. At first I tried compiling withe the "make" command in diffent variations like explained in the software/examples/src branch but I did not get a response at all. Next I tried compiling with "sdcc helloworld.c" . With this it started compiling but I got warning 182 for the "pfs154.h" "absolute address for sfr '...' probably out of range". Futhermore I got errors for helloworld.asm. Ten times I got ".org in REL area or directive / mnemonic error" and at last "missing or improper operator, terminators, or delimiters". After that helloworld.rel was removed. (I added a screenshot of the cmd window)

It would be great if you can tell me what I am doing wrong all the time and thank you very much for your comments in the past.