EEVblog #1144 - Padauk Programmer Reverse Engineering

[bovineck]

I was happily programming PFS154 chips one day and then the next day...

Code: [Select]

Searching programmer... found: /dev/ttyACM0
FREE-PDK EASY PROG - Hardware:1.2 Firmware:1.3 Protocol:1.3
Erasing IC... done.
Blank check IC... FPDK_ERROR: chip is not blank

If I use --noblank --noverify then calibration fails:

Code: [Select]

Erasing IC... done.
Writing IC (81 words)... done.
Calibrating IC
* IHRC SYSCLK=1000000Hz @ 4.00V ... calibration result: 0Hz (0x00)  out of range.
ERROR: Calibration failed

Different chips and changing the programmer doesn't seem to work.

easyprogtest reports:

Code: [Select]

vdd: 4.93   vpp: 4.98    (vref= 3.30) 

It's a bit of a head scratcher! 

Late addition: my PFS173 chips are fine with the same setup and code - just the PFS154s that are suddenly not cooperative 

[bovineck]

Late addition: my PFS173 chips are fine with the same setup and code - just the PFS154s that are suddenly not cooperative 

UPDATE: Just those few PFS154 chips. Have thrown them out and performed cleansing ceremony. Sorry for interruption, normal service resumed...

[js_12345678_55AA]

Late addition: my PFS173 chips are fine with the same setup and code - just the PFS154s that are suddenly not cooperative 

UPDATE: Just those few PFS154 chips. Have thrown them out and performed cleansing ceremony. Sorry for interruption, normal service resumed...

Could you ERASE and then READ one of those "faulty" PFS154?

Maybe you wrote something to the "reserved area" (0x7E0-0x7F0) previously. If so, it might be that you turned sections of the flash to READ-ONLY mode. (I found some bits there which disable parts of the flash to be erased/written to. This would explain why you can't erase / write to this ICs properly).

In case this happened to you, I will consider adding a safety feature preventing to write to reserved area (something like an extra command line option like "--write-reserved-area", if not given then write is prohibited).

JS

[bovineck]

Could you ERASE and then READ one of those "faulty" PFS154?

They would definitely read, but I'm not sure about erase. I threw them out! Next time I have the same problem I will check.

On a COMPLETELY unrelated matter, how would I compile an assembly file for the PFS154 and write the hex file to the chip?

[retiredfeline]

SDCC has an assembler. Just run SDCC with the appropriate options (IIRC it does the right thing if the file extension is that of assembler) and it will skip the C compile step. But you still need the startup code so you might want to retain the main() in C and call your assembly code. Or insert inline assembly code in the C code.

[bovineck]

SDCC has an assembler. Just run SDCC with the appropriate options (IIRC it does the right thing if the file extension is that of assembler) and it will skip the C compile step. But you still need the startup code so you might want to retain the main() in C and call your assembly code. Or insert inline assembly code in the C code.

I compiled the start-up code with an empty main() and checked out the resulting assembly file that SDCC generated, but then I couldn’t see any way to use it as a template for an assembly version of the start-up code. I’m not sure that method is completely dead for me but I need to spend a lot more time on it.

In the meantime I like the idea of calling assembly code from the C code. It’s more complicated than what I’d like but it’s a nice work around, thank you! I’m not much of a fan of in-line assembly, and I’m not sure why that is!

[serisman]

Hello again, everyone.  It's been a while since I posted anything, but I have been following along, and still reach for the Padauk MCUs occasionally for projects.  Part of what has kept me from staying more excited has been the global component shortages and the fact LCSC currently has zero stock of Padauk MCUs.    Hopefully this is resolved soon.

Anyway, I thought I would post a new 'dev board' that I recently came up with to make breadboard prototyping a bit easier.  One of the challenges has been having to physically move the MCU back and forth between the programmer and the breadboard.  I did come up with the idea of using 1.27mm headers to turn the SOIC MCU into a pluggable module (see my post a few pages back).  This helped, and I do use this with custom PCBs to make easier to test different code versions, but it still seemed a bit too annoying for breadboard prototyping.

This new 'dev board' solves the issue by using two DPDT switches that physically isolate the VDD (ICVDD), PA3 (ICPCK), PA5 (ICVPP), and PC6 (ICPDA) pins during programming from whatever is on the breadboard and vice-versa (see schematic).  This means, all I have to do is flip the switches over towards the 2x4 programming header and run my programming command, and then flip the switches back to the other side to run the code.  I had thought of using CD4053 analog switch ICs at first, but the design was getting too complicated, partly because of the different voltages in play, and I still needed a switch to change modes, so I backed away from that idea for now.

Anyway, here are the gerber files and schematic if anyone wants them.  OSHPARK purchase link: https://oshpark.com/shared_projects/BhdQLc4h. It is designed to work with either the PFS154 or PFS173 16-pin ICs.  Technically it should also work with the PFC154 IC, although I don't have any of those to test with.  I can post these files to a github repo if there is enough interest.

I use a 8-wire IDC cable with 2x4 female connectors on either end.  One end plugs into an adapter that plugs into my easy-pdk-programmer, the other end plugs directly into this dev board.  The DPDT switches are LCSC part number: C108742.  Funny how they cost more than the Padauk MCUs.   

Oh, yeah, there are also LEDs on PA3/PA4, and a Push Button on PA5/RST that make this ready to go for the examples found in the http://github.com/free-pdk/free-pdk-examples repo.

[LovelyA72]

https://www.kuaishou.com/f/XTxuFXDaAWv1Wz

错误就是我应该选win版本就好了,需要.exe文件,软件根本就不会用,有使用指导么?太难了

苏sir你还是发英语吧，用百度翻译一下都好啊。大家都会方便很多。
Please use English while posting on this forum. As most of the members on the forum does not understand Chinese.

[tim_]

https://www.kuaishou.com/f/X6Eb6Az5izrRf6m
https://www.kuaishou.com/f/X6Eb6Az5izrRf6m
软件是如何运行的?

How does the software work?

Have you already installed the firmware on the controller? It's described here:

https://github.com/free-pdk/easy-pdk-programmer-software/tree/master/Firmware

[LovelyA72]

A few days ago I walked him through with an online meeting. He's now switched to ubuntu for better software support

[makersLabs]

Hi,

This look very good projet and I wanna have programmer for some cheap board later so
I have done assembly for 5 Programmer using provided GERBER files
I successfully program the ST32 chip
I am under windows 10 and also alrdy install the STM32 driver
Using easypdkprog list or --version I get an answer (confirmed version 1.3)
But when I wanna try the probe command the answer is "probing IC... Nothing found" with a PFS154 or PFS173 fresh new chip

This append on all of the programmers, so I guess something wrong :-5
What checking on PCBA can I run to fix this?
What command can I pass to check all?

Rgds

[tim_]

Have you tried "easypdkprogtest"  and measured all voltages?

[spth]

Recently, about a dozen new Padauk devices becam available at LCSC. Part numbers start with XDT, and I cannot find any datasheets anywhere. They are not mentioned on the Padauk website. The Padauk MINI-C software does not mention them either (there is one XDT device mentioned in there - the XDT0164, but that one isn't among the ones available at LCSC).

Does anyone have any idea about those devices?

[tim_]

Recently, about a dozen new Padauk devices becam available at LCSC. Part numbers start with XDT, and I cannot find any datasheets anywhere. They are not mentioned on the Padauk website. The Padauk MINI-C software does not mention them either (there is one XDT device mentioned in there - the XDT0164, but that one isn't among the ones available at LCSC).

Does anyone have any idea about those devices?

It could be a mistake. All of these seem to be touch controllers without MCU:

http://www.zhienchina.com/product/Touch.html

[makersLabs]

Have you tried "easypdkprogtest"  and measured all voltages?

Hi Tim,
No I just try to use "normal" program
I found easypdkprgtest.c is it that one you speak about ?

on DOS session sending make easypdgprogtest give me this for result :
D:\Users\FidL\Documents\eagle\easyPDKprog\easy-pdk-programmer-software-master>make easypdkprogtest
cc -std=c99 -pedantic -Wall -O2 -Ilib/argp-standalone-1.3   -c -o serialcom.o serialcom.c
process_begin: CreateProcess(NULL, cc -std=c99 -pedantic -Wall -O2 -Ilib/argp-standalone-1.3 -c -o serialcom.o serialcom.c, ...) failed.
make (e=2): file sp¨|cifi¨| cannot find.
make: *** [serialcom.o] Error 2

[spth]

https://item.taobao.com/item.htm?spm=a230r.1.14.1.f1fc51c4BL5XXZ&id=649017329840&ns=1&abbucket=8#detail

XDM4102 and XDM4104. Very interesting. 1.9 KW of program memory. According to the data from Mini-C, these are pdk14 devices. I guess they use the program memory space to map the 2KB EEPROM. That could allow these devices to update their own firmware in the field. It would be great to have datasheets.

P.S.: According to http://www.qy6.com/syjh/showbus8356932.html, the XDM4105 is basically a PFS173 with EEPROM, the XDM4104 a PFS154 with extra EEPROM , the XDM4103 a PMS152 with extra EEPROM. But according to that page, the program memory has hte full size (so it looks more like two dies in one package). I guess we need to get and decap some to know.

[js_12345678_55AA]

https://item.taobao.com/item.htm?spm=a230r.1.14.1.f1fc51c4BL5XXZ&id=649017329840&ns=1&abbucket=8#detail

XDM4102 and XDM4104. Very interesting. 1.9 KW of program memory. According to the data from Mini-C, these are pdk14 devices. I guess they use the program memory space to map the 2KB EEPROM. That could allow these devices to update their own firmware in the field. It would be great to have datasheets.

P.S.: According to http://www.qy6.com/syjh/showbus8356932.html, the XDM4105 is basically a PFS173 with EEPROM, the XDM4104 a PFS154 with extra EEPROM , the XDM4103 a PMS152 with extra EEPROM. But according to that page, the program memory has hte full size (so it looks more like two dies in one package). I guess we need to get and decap some to know.

I have some XDM4103. They are multi chip packages containing a standard PADAUK PMS152 and an attached 24C02 eeprom.
The 24C02 eeprom is attached to IO ports of PADAUK IC. The eeprom can not be used as program memory.
Nothing fancy.

XDM4105 is same thing, a PFS173+24C02 in one package.

Here a list with XDM to PADAUK mapping: http://www.zhienchina.com/product/MCU.html

JS

[js_12345678_55AA]

Hello,

some days ago I had an idea how to add support for writing PDK files (from padauk IDE).

The padauk IDE inserts code that makes a call to almost the end of the IC code memory (e.g. call 0x7FE on PFS154).
If the returned value is 0xFF (ret 0xFF), the calibration code for IHRC is executed.
After WRITER completes the IHRC calibration, it overwrites the return value 0xFF with the calibration value.
The next time IC is started, the same call returns the calibration value, which is then written to IHRCR.

The idea that simplifies PDK support for easypdkprog is that instead of running the complex padauk calibration code, the default easypdk calibration code is embedded and instead of the instruction returning the calibration value, a GOTO to the easypdk calibration code is inserted. This only requires space for 13 additional instructions, which most projects can afford. 

The development branch contains an initial implementation that already works very well for all ICs I have tested. The "write" command supports IHX and PDK files now. Even serial numbers (32 bit only) can be set.

For the other direction SDCC .IHX file => usable with padauk IDE I will try a different approach. Instead of converting the .IHX to .PDK, I plan to convert the .IHX to padauk IDE .ASM code (with embedded comments containing original SDCC .C source lines). This converted .ASM code can then be used in padauk IDE to generate PDK files and is also usable with the padauk ICE (padauk emulator).


JS

[spth]

@spth



mr.spth
I'm very interested in your open source the programmable hard devices .the operation instructions provided are not clear enough and

I'd like to request some additional documentation regarding the programmer's operation instructions. I'd also like to request the

latest Windows binary development release of the programmer software. annex: Test Chip compatible software
thank you
Su

I can't give it to you because I don't have an import and export certificate.You can buy it on Taobao.
https://item.taobao.com/item.htm?spm=a230r.1.14.1.359b404c0Msywi&id=650818241626&ns=1&abbucket=15#detail


时间先生


我对你们的开源可编程硬件设备非常感兴趣。提供的操作说明不够清楚，我想要求提供一些关于程序员操作说明的附加文档。我还想申请最新的

Windows二进制开发版本的程序员软件。附件：测试芯片兼容软件

非常感谢。


su
由于我没有进出口凭证,无法给你.你可以在淘宝上购买.
https://item.taobao.com/item.htm?spm=a230r.1.14.1.359b404c0Msywi&id=650818241626&ns=1&

I didn't create the programmer, and didn't contrinute much to the easypdkprog software either. That work was mostly done by @js_12345678_55AA. But I think you can get help in the forum here or by opening an issue on GitHub.

AFAIK; Windows binaries of releases can be found at https://github.com/free-pdk/easy-pdk-programmer-software/releases

I did create the SDCC pdk13, pdk14 and pdk15 backends(s), though: http://sdcc.sourceforge.net which you can use to compile C code for Padauk µC.

Philipp

[tim_]

mew chip FT32F072C8AT7 LQFP48
https://www.fremontmicro.com/product/32%20bit%20mcu/arm%20core_1/20210316/1769.aspx
https://item.taobao.com/item.htm?spm=a1z09.2.0.0.df072e8dE6k6EJ&id=656098151997&_u=923hlh4e710

So now FMD switched to cloning STM microcontrollers. It would be better if they came up with their own designs instead.

[tim_]

Article about Padauk in the Digitimes

https://digitimes.com/news/a20211008PD205.html

"Padauk Technology saw its third-quarter revenue hit a record high of NT$264 million (US$9.43 million), with revenue for the first three quarters of 2021 already exceeding the level in all of 2020."

I wish they would send some reels to LCSC again, but I guess they are busy trying to get enough product for their key customers...

[js_12345678_55AA]

Hi

thanks @damingge for the taobao link. I will order some of the FT32F072 to check compatibility and also will try to get some PFC886. For sure it will take some time to export them from China but I have some friends which handle it for me.

Regarding latest "binary versions" of the programmer software / firmware: You always can build it yourself from source. Everything is included. However the next release version will come out soon.
I just wanted to test a bit more all the new features like .PDK writing, support for PFC151/PFC161/PFC232, support for MacSilicon (ARM-Mac) / support for armhf /aarch64 (raspberry pi) ...

JS

Update: I checked FT32F072 data sheet and it looks like it is not at all like a real STM32F072. The SRAM is much smaller, data sheet does not mention dual 12 bit DAC, bootloader does not mention DFU, ... So most likely this is not a valid STM32F072 replacement. I ordered some anyway to have a look myself. Maybe the clone is better than the data sheet.

[tim_]

It looks like FMD is planning to have RISC-V products as well:

https://www.fremontmicro.com/product/32%20bit%20mcu/risc-v%20core/index.aspx

This could be very interesting. There are still not many small RISC-V devices available.

[daming]

FT32F0 The file is too la.rge. What's your QQ number or email number.

[js_12345678_55AA]

FT32F0 The file is too la.rge. What's your QQ number or email number.

You can send to : js55aa@88.com