EEVblog #411 - MiniPro TL866 Universal Programmer Review

[BravoV]

Radioman, just a suggestion, you should create a new thread maybe under "Projects, Designs, and Technical Stuff" section for that excellent mod you've done there  , rather than buried deep under in this gigantic thread unnoticed, you deserved better and big an applause from greater audience. 

Thanks for your effort & sharing it.

[radioman]

@computar, yes the voltage generators are controlled by 3bits each, this is correct. For 3bits we have 2^3=8 values of voltage for each voltage generated and I think that is enough.  The big range of chips are not so big, they artificially inflated the supported list, you will find the same chip under many manufacturers and several package types, but in fact is just the same chip.

@BravoV, thanks for suggestion, perhaps this is what i do in the future, right now i will stay here a while. As i seen, many youtubers who watched Dave review landed here and this is good, not to say that a search on Google by tl866 firmware or tl866 schematic will give us first result this thread. But if the project will advance i will create a new thread as you suggested me, thanks again.
For statistical purposes i monitored the links posted and well, people are interested, over 30 countries so far  and this is not real statistics btw. My goal is if possible, to document the protocol used by this device and to help the open source/Linux community because they have always been less privileged. But this is hard work, the manufacturer should do this, but they are not interested, they only provide Windows support and if you have a major problem, like for ex. a firmware corruption then you must buy another device, they will not give you a new firmware, its a shame. But for $50 we want too much. Ok. i was bad, is Easter in my country and i should be good these days.
Cheers!

[BravoV]

My goal is if possible, to document the protocol used by this device and to help the open source/Linux community because they have always been less privileged. But this is hard work, the manufacturer should do this, but they are not interested, they only provide Windows support and if you have a major problem, like for ex. a firmware corruption then you must buy another device, they will not give you a new firmware, its a shame.

I don't think the manufacturer will ever release the protocol or open up to public, its like dog eat dog business in China, once opened wide, tons of this TL866 clone copies will flood the market like there is no tomorrow. 

[radioman]

I don't think the manufacturer will ever release the protocol or open up to public, its like dog eat dog business in China, once opened wide, tons of this TL866 clone copies will flood the market like there is no tomorrow. 

Well, you right, Chinese are known as copycats. Probably they work hard these days  to release first clone of the TL866, he he!. I've seen in the downloaded links referrers a lot of countries marked as unknown, I expected to be from China. We will see what will happen. The protocol itself is not very complicated, i discovered myself a couple of commands, you only need an USB sniffer and a little bit of imagination. The chips database is separated from the main program and I think it is easy to dump the content in the another well known  database file, like sqlite or something. Once we have the protocol and chip database an open source cross platform project can be started. But this means time and possible the manufacturer will abandon this programmer, we will see. Btw in my country when you write something complicated with few words we call this "wood language"; sorry if my English is wood. 

[diogoc]

Thanks for your hard work 

I just afraid that with that manufacturers leave this device and we do not have more updates and so no new devices supported by the programmer

[radioman]

Well I don't think so, I think they will release a a patch to stop clones, but in the same time they must support existing devices, its a trap, we will see. I talked with some guys from technical support and they are very reticent, the only help  that they will give you is "reinstall driver" or "try to another computer" and shit like this. Man I know what a driver is, I wrote a few, and I know how things works i say.  After that they will ignore you. So I make my own support like in Linux, he he! If they have balls it will continue to provide software releases.

[diogoc]

  we will see if they have balls

As a suggestion you can make a clone of tsop adapter too

[BravoV]

I talked with some guys from technical support ...........

Huh ? How ? Thru phone ? 

I've tried email few times their support asking for adding a new chip which should be very easy to implement and still no reply, also asked Franky (iloveelectronics) for help since he is Chinese to post a request in their language, and still no luck. 

What I want is pretty simple, its just adding a support for a F-RAM chip FM1608 which is drop in replacement for the notorious Maxim DS1225 battery backed up SRAM which already supported at TL866. The only difference is just a really-really minor signaling sequence. I ended with 3 wasted F-RAM chips -> HERE.  Yeah, partly also my own fault as a noob.

[radioman]

Huh ? How ? Thru phone ? 

Email, my bad. Well, they responded me every time no problem, but responses were stupid. Nice 2465B teardown btw, sorry about your wasted F-Rams, perhaps the FM1608 will be supported ,who knows.

@diogoc, i'm not a cloner, sorry about that, i only want to help people repairing their devices.

[BravoV]

radioman, share their support email please ? The one that replies. 

And I assumed you were using English right ?

[radioman]

radioman, share their support email please ? The one that replies. 

And I assumed you were using English right ?

English right.

My request:
Hello! I purchased an TL866A from eBay and after changing from minipro software version 5.80 to 5.91 and after request from software to reflash internal firmware, the programmer is now dead. I think the internal firmware is corupted, device is not seen anymore by the software, and by the computer. The little yellow LED its not blinking anymore when I put the USB cable into the device. My request is if possible to reflash internal firmware (I had another tl866 programmer), because the USB method its not working anymore. I can't imagine how easy was to brick this $100 device. Just click reflash firmware, and after that the software hang's about 10 seconds and that was, not seen anymore as device by the computer.
Thank you for support!

Response:
The most likely cause is that the USB driver error, and so can not find the device.
Normal , even if the upgrade fails, you can refresh also.
put your device into another computer  USB interface and give it a try, see the USB port does not respond?

Me again:
Well, first thank you for response, second, I tried this on three different computers and same result. Device is not seen by the computers, its not appears in device manager in any form. I tried even a Usbview utility and he's tell my that USB port is not used by any device. Its appears blank port. I tried another TL866 from a friend of mine an that is working properly, just this is has a problem. I notice at the working one when I put the cable in USB socket, the yellow led blinks. My TL866 do not blink the yellow led.
To resume: I have two TL866A.
device no 1 its working when is plugged in the USB port.
device no2 do not work, is appears like is not connected to the computer, only red led is light, the yellow led do not blink. This issue appeared after an failed firmware upgrade. What should I do next?

Their response:
Hi
You may remove USB driver, and restart windows.then reinstall USB driver.
When failed firmware upgrade it is allowed  to reflash the firmware.

Me:
But the programmer is not present as USB device man, minipro software do not see the programmer. I can't reflash from minipro software. It is possible to reflash internal microcontroller by other method? I need the internal firmware of microcontroller to reflash manually via another programmer. Can you give me the firmware hex file? if you don't give me the firmware file then I drop the programmer to bin, and I will buy another TL866A, but what should I do if corruption of firmware will happen again? i'm not so glad to buy a programmer every 30 days. Why internal firmware is not well protected from corruption? in case of computer crash during flash upgrade, the programmer firmware will be overwritten and customers cannot do anything for device restoration. Who guarantee me if I buy another programmer it will not happen again? well questions and questions. I will be very glad if you will answer me to this questions, and tell me how to restore device in its working state.
Thanks for support again.

he:
As pic shown, the connection of a 100 ohm resistor, you can reflash
after the Upgrade is completed , and remove it.

Me:
OK, i soldered a 100ohm resistor between  3.3V and pin36 of microcontroller, it has no effect, same result, device is not seen by the computer. The red LED stay light, the yellow LED its not blinking. Minipro software not see the programmer, is not appearing in the device manager / UsbView. I think the internal firmware of microcontroller has been compomissed. What is the unsoldered  J1 connector? its appear like a standard LVP ICSP programming interface. Bellow is the soldered resistor like you teel me:
So what to do?

And after that total silence, i tried another email but no response. So here i started reverse engineering, now you know. The data corruption was caused by a faulty usb hub, so beware.

[BravoV]

Damn, thats frustrating. 

Is this "autoelector@yahoo.com" email you're using for that communication ? Got this from their web site.

If its not, then share it please, at least you got replies rather than me that got no reply at all.

[radioman]

@BravoV, yes the address is "autoelector@yahoo.com", I will send them an email to give me the usb command protocol, just for fun

[PA0PBZ]

Thanks radioman, my TL866CS is now a TL866A 

[radioman]

Hi PA0PBZ,  glad to see you happy, thanks for your feedback. The schematic diagram swapped VCC and GND drawing issue on J1 is corrected now, please download again on posted links or here:
TL866 firmware updater
Related to PicKit3 hex issue i will investigate, but from what you say me in PM most likely is a software issue. The hex file was tested on another TL866A and PicKit2, and worked. Do you solder any connector on unpopulated ICSP?

[PA0PBZ]

Related to PicKit3 hex issue i will investigate, but from what you say me in PM most likely is a software issue. The hex file was tested on another TL866A and PicKit2, and worked.

It loaded fine in MPLAB, but not in the standalone PICkit 3 programmer. I think it's more or less abandoned by microchip, I had a hard time finding it. So don't worry, it is probably some weird stuff in that program, although it could load a hex file that it produced itself.

Do you solder any connector on unpopulated ICSP?

Yes, fortunately I had some strips in stock so I just cut off 6 pins and soldered it in place. Tomorrow I will check if it will read/program some chips and report back.

[PA0PBZ]

I did some testing with a few PIC chips and found something strange.
First test was with a 12F629, which worked ok in the ZIF socket and with the PICkit 3. Connected to the ICSP connector it said "wrong device id", it was reading 3E while it should read 7C. Hmm, that is 00111110 when it should be 01111100. So I hooked up a scope (x10 probe) to the PGD pin to see what was going on and then it was reading ok... What? I then placed a 47P cap from PGD to ground and it worked ok. I tried the same with a 16F630 and it also needed the cap or the scope. Then I tried a 18F252 but could not get it to work at all, device id stayed at 0000. Same for another 18F.

It looks like a timing error somehow, but it is hard to tell when it works ok trying to measure it...
Anyone else seeing the same or care to try?

[radioman]

Sounds like a pullups/pulldowns resistors for me, maybe the CS variant does not have these resistors soldered? if you look on the schematic diagram at cpu section you will see ten 51K resistors wich are controlled by the RB1 line, check if those resistors are soldered:

Here are only nine resistors, one is soldered on the reverse side of the pcb.

Also at the suggestion of PA0PBZ i have to fix a bug in the hex file generator wich cause pickit3 software to not load generated hex. Thank you!
Download here or on any posted links: TL866 firmware updater

[PA0PBZ]

No, all the resistors are there. I can't find any unpopulated parts at first sight, but I did not take it apart, hate to put the leds back.

I did some more testing and found that it works ok with the scope probe on either clock or data. Measured the probe and it is 12M/13pF. And indeed, when I put a 15pF cap on the clock or data line everything is fine. Using a pull up or down resistor makes no difference. Also, it seems that it only has trouble reading the id, the first thing it does. When I uncheck "Check device ID" it reads the program memory fine.

I wonder what those 10 resistors are supposed to do, they are also on some pins that are not connected to the ICSP.

[radioman]

hmm... seems like a timming problem, AFAIK they implemented serial communication as bitbanging in software, probably they set the clock frequency too high. Also check if the cable you use is not to long. The ten resistors are needed probably by the i2c and spi communication on ZIF socket.

[PA0PBZ]

I looked at the timing to see if it was on the edge of failing, but it looks fine to me. I even decoded what it does getting the ID and it all makes sense, set address, inc address a few times and then a read command. Looks like it reads the data on the falling clock, and from programmer -> PIC it changes the data in the middle of the high clock, and from PIC-> programmer the data is changed at the rising clock. There is a bit of crosstalk between the clock and data but nothing serious I think. Unfortunately I have not yet found a way to measure without fixing the problem.

[radioman]

The two diagrams looks good, the read from pic is a little bit strange but the PGD line is set by the pic in this case, probably the read routine in the main software is reading the PGD too early, I think. The CPU frequency is set to 48MHz now, maybe slowing down a little bit can resolve this issue, but you have to deal with the config bytes (cpdiv0 and cpdiv1 if I remember correctly), I have programmed a couple of atmel avr's and  pic18f but don't have any problems yet.

[PA0PBZ]

Well, I managed to get a scope shot from both the good and the bad read by connecting the scope to the ZIF socket, which is in parallel with the ICSP connector. Looks like it shifts the data one bit indeed, which I already suspected.
Reading the ID of a 12F629 which should be 7C (01111100) I see 3E (00111110) when things go wrong, see attachment.
Doing the same with a 16F630 (ID 86, 10000110) it reads 23 (00100011) in error. I'd almost think that the PIC sees an extra clock cycle, that would explain the shift. The only thing is, I don't see it on the scope screen. And still, a 15pF cap over the clock line at the PIC fixes it.

[radioman]

Well done, this definitively is a firmware bug, try to slow down the cpu core speed by tweaking cpdiv0,cpdiv1 config bits; i wonder if the error is constant at different cpu core clock frequencies.

[PA0PBZ]

Well done, this definitively is a firmware bug...

I don't believe in a software bug, there is no extra clock pulse to be seen and the data is coming out of the PIC, not the programmer. It looks like the PIC sees an extra clock pulse but I can't see it with the scope. Also I still don't see how a 15pF cap can cure it if it is a software bug. It must be something in the hardware, I only wish that I could see it on the scope. Oh well, maybe just a little bit more fiddling...