Bus Pirate review

Sparkfun Bus Pirate, top viewThe Bus Pirate: It sounds kind of shady, and maybe it is, but it is also a handy little tool. A few weeks ago, I received a Sparkfun Bus Pirate as a birthday present. This little board is a USB-to-nearly-anything serial adapter that can speak SPI, I2C, async serial (UART), JTAG, and several other protocols. It’s designed as a quick tool for easy exploration of new hardware and, yes, as a hacking tool useful for reverse engineering undocumented boards and communications protocols. It has a few limitations that hold it back from being everything it could be, but the low price makes it a worthy addition to a professional’s or hobbyist’s engineering toolbox.

The Bus Pirate was designed by Ian Lesnet at Dangerous Prototypes, and he sells his original version via his partnership with Seeed Studio. Since it is an open source hardware design, others are free to make their own versions, which is what Sparkfun opted to do. It appears that Sparkfun did their own layout, but the major components are in roughly the same locations. Both versions are electrically equivalent and run the same firmware, and both versions cost about $30 (at this writing).

Bus Pirate Hardware and Accessories

On unpacking the box, my first surprise was the Bus Pirate’s small size. That’s not a drawback in practice, but it looks more delicate than I expected. The board has a row of LEDs along the top edge for status information, a USB mini-B connector on the left side, and a header for the serial interfaces on the right side. The header is shrouded, which is a nice touch, because it makes sure polarized cables only go in one way.

Polarization is great for cables, except that different versions of the Bus Pirate orient the header in opposite directions! The Sparkfun version has the polarization notch on the outside, while the Bus Pirate documentation says that some Seeed Studio versions have the polarization notch on the inside. Although this inversion means that pin “1” moves from one end to the other, the layout of the PC board has not changed, so the pin in the lower left corner remains chip select (CS), regardless of which way the header is installed.

Bottom view of Sparkfun Bus PirateI am a little concerned about the durability of the board. One aspect is having small surface-mount components exposed, where they could get knocked off, taking their PCB pads with them. Another aspect is the choice of a USB mini-B connector. The mini-B has durability issues that has caused the USB Forum to deprecate it in favor of their other connector styles. A standard B connector would have been a better choice.
Another disappointment was the lack of PCB mounting holes, which are handy for screwing in standoffs to use as feet. holes would also make it easier to protect the board in an enclosure, such as a mint tin.  It appears that the latest Seeed Studio Bus Pirate boards (v3.5) have mounting holes.

Sparkfun and Seeed both sell breakout cables for the board. These cables aren’t strictly necessary, and in fact you might find a fistful of single-pin jumpers more useful for many purposes. The header has a few pins that can be jumpered for special purposes, such as configuring a pullup voltage in open-drain/open-collector mode. The the breakout cable may make that more awkward in some circumstances. I found the breakout cable handy, though, and I would recommend it as an accessory. The Sparkfun cable has single-pin sockets on its loose leads.  Seeed sells a version with single-pin sockets and one with mini-grabbers.

SPI Sniffing

Although I wanted a Bus Pirate for my basement hacking, the day after I received it, I took it to work. I was debugging a tough problem for which it would be useful to be able to eavesdrop on SPI traffic between a microcontroller and a peripheral. The Bus Pirate’s SPI sniffer mode seemed perfect. (I did have the option of using an Agilent mixed-signal oscilloscope, but who wants to read hundreds of bytes, in binary, from a ‘scope screen when an easier option exists?)

In principle, SPI sniffing can be done from a terminal, but in practice, an SPIsniffer utility that uses the Bus Pirate in binary mode is recommended. I downloaded the SPIsniffer and had a tough time interpreting the output. It appears that the latest version was released with debugging code that causes duplicated bytes in the output. I removed the debugging code, recompiled, and had somewhat better success.
The SPI sniffer formats its output as “[0xba(0x00) 0x5e(0x00) 0x00(0x1e)]”. The square brackets show when chip select is active, and the bytes are shown as the MOSI value followed by the MISO value in parentheses. This format is basic, but easy to read. Getting the chip select brackets in the right place is critical to interpreting SPI traffic. Many chips use the first byte after chip select as a command or an address, and the following bytes as data. Without having chip select in the right place, it can be impossible to decipher the data stream.

Unfortunately, in my application, the chip select indications were all over. When watching an initialization sequence, which should have shown chip select low for each of a series of two-byte packets, and high in-between, the Bus Pirate showed many one-byte packets and a few with up to 10 bytes. I looked for ground loop problems and other issues that might throw it off, without success. An oscilloscope showed the two-byte packets, as expected. As best I can figure, the Bus Pirate was simply unable to keep up with the data stream and got its chip select reads out of sync with its serial data reads. The Bus Pirate did not drop any data bytes, but without accurate chip select information, it was as useless as if it had.

Would The Correct Logic Level Please Stand Up?

My SPI sniffing also brought to my attention the Bus Pirate’s less than ideal logic level selection. The Bus Pirate is billed as working with logic levels “at any voltage“, and “above and below the Bus Pirate’s 3.3V supply“. I thought this meant it incorporated a level shifter that could input and output all of the major logic levels used today, from 1.5V on up. Unfortunately, the truth is that the Bus Pirate runs at 3.3V with 5V-tolerant inputs. It does have the ability to use open-drain outputs with a strappable pull-up voltage, which could be anything from 0 V to 5V, but that does not change the input thresholds, which remain at standard 3.3V CMOS levels. Unfortunately, that means that logic running at 2.5V and below is not guaranteed to be read correctly by the Bus Pirate. Logic with a 1.5V supply simply won’t work.  (In fairness, there are other pages on the Dangerous Prototypes web site that correctly describe the Bus Pirate as supporting 3.3V and 5V I/O.)

This problem could be solved by incorporating a proper level shifter into the board or, with some constraints, by replacing the 3.3V regulator with a lower voltage version. The hobbyist market for which the device was designed rarely uses I/O voltages below 3.3V, so many typical users will not notice this limitation, at least for the next few years. However, the problem makes it harder to use the Bus Pirate as a reverse-engineering tool and for developing low-voltage designs.

A USB UART

The Bus Pirate includes a UART mode that lets it communicate with asynchronous serial, just like RS-232, but at logic levels. Conveniently, I’m currently working on a project that uses asynchronous serial at logic levels, but at an unusual baud rate. This was a great chance to try out the Bus Pirate.

In addition to all of the standard baud rates, UART mode accepts direct programming of the PIC’s baud rate generator. It was a simple matter to compute the right value for my project.

Unfortunately, though I was able to generate serial at the right baud rate and verify it on a ‘scope, I wasn’t able to get the Bus Pirate to work on receive. I had some noise problems with the system, and that coupled with the I/O voltage mismatch meant the receiver picked up garbage characters. I was in the midst of bringing up a custom USB-to-async converter to fill the same role, so I didn’t have much incentive to spend more time getting the Bus Pirate to work. I have since taken the time to eliminate the noise, so maybe the Bus Pirate would work now despite the logic-level mismatch. In any event, the problems on receive were my fault, not the Pirate’s.

Documentation

The Bus Pirate “manual” is a wiki. The strong point of using a wiki is that it is easy for the developers to update. It has some drawbacks, too. Like much hypertext documentation, there is no obvious way to read it linearly like a textbook, and it can be hard to be sure you have found all of the material relevant to a particular topic. Maybe I’m showing my age, but I would have liked to be able to download and archive a PDF, or perhaps even print and bind a manual with complete instructions for the Bus Pirate.

The documentation is concise to the point of terseness at times, but I was able to find all of the information I needed. The diagrams, in particular, are well done and clearly show exactly what needs to be conveyed.

Terminal Software

For some reason, the Bus Pirate did not work well with Windows’ Hyperterminal. From the wiki and forums, it seems this is not unusual. Following the manual’s recommendation, I switched to Tera Term and did not have any further problems.

More Cool Features

So far, I have only sampled the Bus Pirate’s capabilities. Among its cool features are a bitbang I/O mode that let the PC command each pin individually. Even in the SPI and other modes, it has an auxilary output pin that might be useful for a reset, address, or secondary chip select.

The Bus Pirate has two power supply outputs, one each at 5 V and 3.3 V, on its connector. Commands from the PC switch the supplies on and off, and there is enough current available to power small circuits. Some applications require little more than a Bus Pirate, a breadboard, and the target chip.

Analog signals can be read with the Bus Pirate’s ADC input pin. Together with the power supplies, this means that the Bus Pirate can directly connect to some analog sensors as well as the more obvious one-wire, I2C, and SPI devices.

It can even speak JTAG for debugging or programming, albeit slowly. It was not designed for JTAG and has to emulate the protocol in software.

The Bus Pirate also has a logic analyzer mode. SUMP and other software compatible with the Open Bench Logic Sniffer can interface to the Bus Pirate to read a few logic channels, slowly. It’s really just a toy in this mode, but I would have loved something like it when I was a kid experimenting with 4000-series CMOS.

Conclusions

I’m happy with my Bus Pirate. It is described as being a hacker’s multitool, and I have to agree. I love my Leatherman, too! I’m going to need longer to fully understand the Bus Pirate than to grok a Leatherman, but I’m looking forward to finding new ways to use it. Especially considering the low price, the Bus Pirate is a worthy addition to any basement tinkerer’s toolkit.

Is the Bus Pirate ready for professional use? The answer is “maybe”. If you work on 3.3V or 5V systems, buy one. It’s worth having in your toolbox, and the $30 price is practically free compared to engineering hours. I’m not quite ready to order some for my bench at work, though, because everything I do is at lower voltages. The low cost may yet pull me in, though. Particularly when evaluating new parts, the Bus Pirate would be a faster and easier solution than either a microcontroller or a National Instruments DAQ.

Links:

A Trip to Electronic Surplus in Cleveland

Yesterday my son and I took a trip to Electronic Surplus, Cleveland Ohio’s candy store for electronics hobbyists and professionals. From a warehouse building in Mentor, ESI operates both a brick-and-mortar store and the website electronicsurplus.com. This is my home-town surplus dealer, which has been a good source for parts for me. Read on to have a look around.

The welcoming sign tells me I’m in the right place. Their location is near a busy intersection, but out of sight of the main roads. An earlier incarnation of the business was known as “Electronic Surplus Inc.”, hence “ESI”. Today the “I” is vestigial — the company is an LLC — but the abbreviation stuck.

The retail store fills about a quarter of the warehouse-style space, with the rest used for storage and web order fulfillment. The store has an odd C-shaped floorplan. This is the view from just inside the front door. The grey drawers contain a variety of parts. The shelves behind them have some of the test equipment that is for sale.

Not far from the counter is a selection of odd circuit boards and modules. This one is a sound and light board from a toy, and next to it is a high voltage supply board. Out of sight to the right was an LM317 power supply board. I was tempted by that, but decided it would be a better idea to use up the ones I already have in my parts collection. Continue reading A Trip to Electronic Surplus in Cleveland

Crazy PCB Layout from the Big Hair Decade

Check out the bizarre PCB layout on this power supply.  A Pulse Instruments PI-702, I bought it for a few dollars at a hamfest. It was made in the mid-80’s and plugs into Tektronix TM500-series mainframes. When I powered it up, BANG!, after which it had no output.  Here is what I found when I opened it up for a look:

The curvy, hand-taped traces are typical for the period, but look at how few components are in the two-thirds closest to the front panel compared to the number of pads! Plenty of those pads look like they have an 0.3″ DIP pattern, but have either discretes or nothing soldered to them.  The layout is also full of dead-ends and traces that don’t go anywhere, and there is no silkscreen.  The back third is neat and tidy — it is all a bit Dr. Jekyl and Mr. Hyde.

All of this leaves me wondering what the crazy layout is for! If it is meant to dissuade reverse-engineering, it might work (it worked for me, so far…), but who would want to protect something as simple as a linear power supply? It is even stranger that the digital-to-analog conversion circuitry near the edge connector gets so little of the board, and is laid out quite cleanly compared to the power supply.  I suppose that this might be a case of multiple models using a single PCB, but what a devious mind it would take to merge multiple schematics into something that looks like this!

The problem itself was easy enough to find. One electrolytic capacitor dried out and blew up. You can see it at the lower-left of the second photo. It will be easy to fix, assuming it didn’t take any other components with it.

The device itself is interesting.  It has three outputs, two of which are bipolar, each covering -25 V to +25 V continuously. They can be independently set with front panel controls, track an external input, or be controlled digitally. The bipolar outputs are limited to a wimpy 25 mA each, which is undoubtedly why it is called a bias supply. It also has a fixed +5 V output at up to 0.5 A.

Now I know that the 80’s were not only the decade of MTV and big hair, but at least one rather strange PCB layout.

Smoke testing the A3PN250 FPGA board

There comes a point in any project when one has to find out if it works, but first, there is the “smoke test”: Turn on the power and see if anything goes up in smoke. I smoke tested the A3PN250 FPGA breakout board this weekend, and it passed, or at least it failed to emit smoke. In any event, no smoke was emitted and the board survived. In fact, the board works. I talked to the board with a FlashPro4 programming pod and my rewired JTAG cable. The FPGA passed the pod’s signal-integrity check and identified itself correctly, so it is certainly alive.

The A3PN250 board on the bench

 

I follow a few rules of thumb when smoke testing. These aren’t things one learns in books, but instead from other engineers, so they are worth writing down and passing on. Continue reading Smoke testing the A3PN250 FPGA board

Cleaning the Basement: When Junque is just Junk

I don’t know who coined the term “junque”, but it used to be used on the QRP-L mailing list to describe questionable treasures brought home from a hamfest. “But honey, it’s not junk, it’s high-class junque!”  Like many engineers, I’m a bit of a packrat for old parts and gear, and there was a time in my bachelor life when I saw it as my duty to rescue as many old HP and Tektronix instruments as I could, especially the tube variety. Call it a misplaced attempt to emulate the Endangered Species Act.

My wife has quietly tolerated my electronics junk in the basement, but my life has moved on. I have two children, and my sense of what I’m doing in my hobby has crystalized. Now I look at a basement full of stuff and think, “Boy, it would be nice to have a rec room here.”

This week, I went on the warpath and started cleaning. I started with the shelves under the basement stairs, which were packed full of “treasures”. Among them I found these endangered species:

Three HP antiques
Left to Right: HP 400D vacuum-tube voltmeter, HP X-Y plotter, HP 211A square wave generator

Continue reading Cleaning the Basement: When Junque is just Junk