Repairing, hacking and upgrading an Ellisys USB Explorer 200

[MindBender]

Hi,

Like many people here, I too scavenge eBay for test equipment I always wanted to have, but is way to expensive to buy (new). So I've got a number of saved searches that trigger once in a while.

I'm a freelance embedded software engineer, usually closely involved with hardware design, and during my professional career I have enjoyed using the Ellisys USB Explorer 200 at various customers. They are incredibly useful. Their software is intuitive, versatile and can everything you could possibly need, without needing a masters degree in USB. So I have always wanted to have one. Customers who really need one, buy one, but sometimes I just want to check something, which just doesn't justify the €899 for the cheapest model.

So end of August two appeared on eBay. Simultaneously from different traders. I bought one, for $150,00 + $24,27 shipping + $42,82 import tax (I really hate eBay Global Shitment Service). I was untested, but more ofter than not sellers don't know how, or can't be bothered to test. And since it's professional equipment it usually doesn't break easily.

Not this one, though. I was broken. Plugging it in my old Mac Pro made the power LED flash, but that turned out to be a Mac artifact; Booting it into Windows showed a continuously lit power LED. After downloading and installing the excellent Ellisys Visual USB software, the analyser even got recognised, serial number and all. However, after clicking the 'Record'-button to start a capture, an error popped up with the following message:
"This software was not properly activated for this operation. Please contact your local distributor or the Ellisys support team for more information."
So I contacted support and they were very friendly and very helpful. Unfortunately their diagnosis was that the analyser was broken.

Since all three versions, Basic Edition (€899), Standard Edition (€1799) and Professional Edition (€3599) all share the same hardware and appearance, and sellers unwilling or unable to test, it's always a bit of a mystery what version you have bought on eBay. These analysers can even be upgraded in the field to a more advance model by purchasing an upgrade license. With the serial number of my analyser support was able to tell me it was the cheapest Basic Edition which was a bit of a bummer, but not too much since it was broken anyway. I had already checked all power supplies, but given that it was recognised, I figured it was probably a corrupted configuration or firmware of some kind, but no updater was available. So it ended up on my desk for almost a year now.

Then destiny called; Not only by terminating my freelance assignment by the end of this month, but also by my customer finally heeding my advice to replace their proprietary bitrate non-handshaking serial port with USB. With this decision, they also ordered the USB analyser I recommended: an Ellisys USB Explorer 200 Standard Edition. And with the current work from home situation, I was able to take this new USB Explorer home.

Using this new analyser, I was able to repair my 'broken' analyser, and even to upgrade it to the more advanced Standard Edition (€1799). I'm pretty sure I can even upgrade it to the Professional Edition, but for that I need more information.

If you own a Ellisys USB Explorer 200, and you're interested in upgrading it, please drop me a PM.
If you have access to a Ellisys USB Explorer 200 Professional Edition and you would like to help me out (in a non-invasive way), please drop me a PM.
If you have ever purchased an update license, of have used the official Ellisys tools to install an updated licence, please drop me a PM.

Cheers!

[MindBender]

First of all I need to express that I like the Ellisys company and their product too much to do them harm. So I will not provide a step-by-step solution here. I will describe my process to help others, who could have done this on their own, save some time.

In order to repair my 'broken' analyser, I first needed to understand houd it works. Alle the magic happens inside a Xilinx Spartan XC3S1500, attached to a Cypress CY7C68013A handling communication to the host PC running the Visual USB application. The only memory I could find were a DDR2 SO-DIMM, which of course is volatile, and an 24LC128I I²C EEPROM.

The SO-DIMM is connected to the Spartan FPGA, most likely used a a buffer. My 'broken' analyser has a 1GiB 2Rx8 PC2-5300S 555 12 E3 version, the new analyser has a 2GiB 2Rx8 PC2-6400 666 13 F1 version. I did not check whether or not SPD is read and hence I do not know if the analyser benefits from a larger, faster SO-DIMM, or that the lower density SO-DIMMs became unavailable so they are using a larger one for only half.

The I²C EEPROM I expected only to contain configuration data, such as the USB device descriptor information, serial number, versioning  and hopefully licenses enabled. I figured perhaps something got corrupted here and the simples thing to do was to desolder them from both analysers, put them in the EPROM programmer and check for differences. But because the new analyser wasn't mine, I decided to find another way. I own a Weller SMD rework station, and (for a software guy) I have pretty good soldering skills, I can remove it and putting it back without anybody even seeing this work was done, but I felt it was immoral. So I figured I could also listen along with the bus. That would require some post-processing of the captured data, and it could leave me with an incomplete image, but the data on address not read could probably be missed. So I clipped on my Saleae, and much to my surprise, after power-up, the whole device was being read!

So I captured this read traffic from both analysers. I noticed the 'broken' one had a couple of out-of-place NAcks in it, but didn't pay too much attention to trying to explain those. To validate my capture and post-processing, I desoldered the EEPROM from the broken one, read it in the EPROM programmer and compared the image with the post-processed captured image; It turned out to be an exact match.

It was only at that time that I looked up the CY7C68013 manual, and discovered that it has no internal non-volatile memory at all. It loads it's program from I²C EEPROM into RAM upon power-up and starts executing right after that. Even the signature at the beginning of the image matched.

Conclusion: The host communication CPU, the CY7C68013, gets all of its program code and data from the 24LC128 I²C EEPROM.

[tv84]

RTFM. 

Page 6 of the manual: "During the power-up sequence, internal logic checks the I2C port for the connection of an EEPROM whose first byte is either 0xC0or 0xC2. If found, it uses the VID/PID/DID values in the EEPROM in place of the internally stored values (0xC0), or it boot-loads the EEPROM contents into internal RAM (0xC2)."

I will drop you a PM.