Do you ever find yourself wanting an IC tester? Some way to power up an IC and apply various voltages and signals to different pins, in order to either check functionality or to explore the inner workings of some mystery chip..? Exporting test vectors from your logic simulator and checking the final, rubber-meets-the road performance on actual silicon? Then this project is for you. You’re not going to get the equivalent of a Teradyne or anything, but you won’t be spending $300k either.
What we’ve done is traced out and bus-snooped a cheap EPROM programmer to decipher it’s inner workings in order to create an open, super-low-cost platform for digital IC testing and development. This device can drive logic-level signals onto all 40 pins of a Zero Insertion Force (ZIF) socket, as well as providing ground, adjustable power and high-voltage programming signals onto common IC footprints. It can clock at 24MHz, so it’s probably possible to even do microcontroller development where the MCU runs code and the device applies fake signals at the pins to verify functionality.
The device is the Top2005, a reasonably capable Chinese EPROM programmer that we discussed previously in an article talking about how awful the vendor-supplied software is. As you may have read, we liked the minimalistic hardware design, but didn’t use the tool much because the software was rather bad. Our EPROM programming is mostly done by a nice Xeltek programmer, so the poor Top2005 was just collecting dust on a shelf in the lab. Until we decided that we needed a low-cost test bench for testing CPLD designs and debugging some proprietary SD cards, that is!
Fig 1 – Top2005 programmer pre-hack
Above is a snapshot of the Top2005. The fact that it’s USB powered and very small and portable is great. And from all our analysis, the hardware inside is fairly reasonable, save for the occasional fright from low-end design techniques. This hack consisted of three main parts that we will take a moment to describe:
- Circuit Tracing – The most tedious part was tracing the 40 signal pins from FPGA to the ZIF socket. Otherwise, this simple 2-layer PCB was fairly straightforward to trace in order to determine which pins of which IC controlled which function. Very important to know later, when we want to begin extending the capabilities.
- Bus and USB Snooping – Internally, the device uses a homegrown address/data bus that we’ll call TOPBUS. By watching the internal signals while we snoop the USB commands, it was possible to understand and recreate command sequences in order to toggle pins high/low as well as apply power and GND to the socket.
- Extending the Capabilities – With the vendor-supplied bitstreams, you can already do a ton of stuff (uhh, like EPROM/MCU programming and 74xx logic test). Just using what comes out of the box, we’ll show you how to write a little piece of testbench software so you can do on-the-fly logic verification with just a few clicks. For more off-the wall functions, we’ll show you how to write your own custom logic for the FPGA in order to do fancy sequencing or other cool stuff while you still churn data into and out of the device. We’ll provide some verilog templates and Xilinx constraint files to give you a head start on implementing custom logic for the device.
Continue to Next Page Jump to Page 2
By Carl September 11, 2010 - 8:45 am
Have you seen the open source toprammer 2049 s/w ? There are lots of info in the docuementation including reverse engineering for the protocol.
Seems like the protocols and the architecture is very similar between the different top programmers. I have a top2048 which seems to work with
the toprammer s/w
http://linux.softpedia.com/get/System/Hardware/Toprammer-57047.shtml
By openschemes September 14, 2010 - 4:23 am
Thanks for the link, that is great stuff. You are right, his work is very similar to own work here. Looks like the programmers are quite similar! Thanks again, we will try to get in touch with the author for some collaboration.
By Carl September 24, 2010 - 8:40 pm
I was hoping for an open source development that lead to support of all TOPxxx devices not only test bench but also universal device programming support.
I have an TOP2048 that I am trying to reverse engineer the usb protocol. It seems very similar to the TOP2049 except the ZIF(47) doesnt have a VPP driver. Funilly enough there is one extra transistor connected to the VPP shift registers that isn’t connected to anything, Thinking about connecting that one to ZIF(47).
The toprammer 0.5 s/w does work to some extent for my TOP2048 after removing some of the status register checks. It bombs when setting VPP voltage shift registers using command 0x0e1400. An error code -0×02 is sent back by the device. all the VDD VSS stuff works though. I am still trying to figure out whats wrong.
Funnily enough the same command does work if I havn’t changed the VPP value from the default one.
Don’t really have the skills or the tools of you and Michael Buesch has
ffff88013b142f00 1434636915 S Bo:10:016:2 -115 18 = 0a50000a 51000a52 000a5300 0a54000a 5500
ffff88013b142f00 1434638896 C Bo:10:016:2 0 18 >
ffff8800b3d0a0c0 1434638941 S Bo:10:016:2 -115 4 = 0e120000
ffff8800b3d0a0c0 1434639895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434639921 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434640895 C Bo:10:016:2 0 1 >
ffff88013b1429c0 1434640924 S Bo:10:016:2 -115 4 = 0e123300
ffff88013b1429c0 1434641895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434641917 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434650896 C Bo:10:016:2 0 1 >
ffff88011f3ef240 1434650987 S Bo:10:016:2 -115 4 = 0e140000
ffff88011f3ef240 1434751902 C Bo:10:016:2 -2 0
By openschemes September 29, 2010 - 6:01 pm
One suggestion would be to sniff the USB communication of the vendor software to see how the commands are properly used. It’s quite likely that at least some of the framework is different from device to device. Perhaps it’s just that 00 00 is not the way to turn off VPP on the 2048…?
By Toprammer – Open Source Python Software for TOP2049 « Openschemes January 11, 2011 - 6:47 pm
[...] Logic Cube – The Modification! – 7,384 viewsTurning a Top2005 EPROM Programmer into a Desktop … – 7,035 viewsMore FT232 Bit Banging with the Arduino Board – 4,085 viewsExternal WDTV Remote [...]
By Papat44 March 6, 2011 - 2:50 am
Hi,
At first, thanks for this hack. Great stuff!
I’m not a good coder in VB (some macro in Excel that’s all)so, when it tell me ”can’t find libusbvb0.dll”, I lose my mind.
I have try to put this famous dll in windows/system then in windows/system32 without any result.
It’s certainly a rooky question but: ”Where do it be ?”
Thank for ”your ligths”.
Regards.
By openschemes March 14, 2011 - 4:15 pm
When the compiled tool runs, it will begin looking for the dll in the same directory in which it exists. If not found there, it will look in system32.
However, if you’re running code from inside VB6 (the debugger) then it must be in windowssystem32. If it still isn’t found (which it sounds like it is not) you may want to try registering it?
regsvr32 c:windowssystem32libusbvb0.dll
By Elgen April 4, 2011 - 9:20 am
Hi, this is really great stuff.
Do you think that it will possible by what you’ve found here, to program PROMS/EPROMS that have 16bit wide databuses ie. 27C1024 (maby with the use of an custom adapter)? Or is there some hardware limitations that makes it impossible?
By openschemes October 29, 2011 - 9:53 am
If the pinout fits, then sure – it can be programmed
By Jozsef October 4, 2011 - 5:59 am
Hi,
I have the same error: ”can’t find libusbvb0.dll”
It looks like an inevitable error on – regsvr32 c:windowssystem32libusbvb0.dll .
The error in the dialog: Error in library LoadLibrary(“c:windowssystem32libusbvb0.dll”) finction – cannot find the requested module
The libusbvb0.dll file was copied as well into c:windowssystem32.
What can be the problem? Can you help?
Thanks forwarding.
Best regards,
Jozsef
By openschemes October 4, 2011 - 7:07 pm
Jozsef,
It either goes in the same directory as the exe, or system32 if you’re running in the VB6 code debugger. What windows version are you using?
By Jozsef October 5, 2011 - 1:02 pm
Hi,
I am using WXP Professional (2002) SP3 on HP8730w laptop, NT Partition on C drive.
Th file “libusbvb0.dll” is in same directory where the exe file – “C:Program FilesTopwin6Opentop2OpenTOP2.exe”
Then .dll file also was copied into directory “C:WINDOWSsystem32″
There is no VB6 installed. Should I install it to run the exe?
Thanks forwarding.
Best regards,
Jozsef
By openschemes October 7, 2011 - 7:45 pm
Do you have libusb installed on your machine? It could be that the regsvr is not finding the dependency.
By Jozsef October 8, 2011 - 8:11 am
Hi,
It must be the problem. Where from could I download the libusb installer?
Thanks
By openschemes October 10, 2011 - 8:18 pm
Sourceforge libusb-win32
http://sourceforge.net/apps/trac/libusb-win32/wiki
By Jozsef October 23, 2011 - 8:25 am
Thanks, I have installed the libusb .
I see the properly registrated device on the list by USBView, but there is a next problem.
The result of this command : regsvr32 c:windowssystem32libusbvb0.dll
as follows, the popup window has contains this message:
The c:windowssystem32libusbvb.dll has successfully loaded but unable to find the proper access point: DllRegisterServer.
The requested command is unable to register the file.
I am awaiting your kind reply.
Best regards
Jozsef
By openschemes October 25, 2011 - 7:53 pm
Glad to see some progress. This error is very puzzling, and without more investigation it is difficult to determine the problem.
Searching on google shows several other DLL’s that cause a similar error. Have you tried the fixes described for those other users?
By Jozsef October 28, 2011 - 10:36 am
Pass me a link how to solve if you known a good one.
Looks like the both version of drivers are cannot live together on the same machine, doensn’t works even an assigned USB socket to LibUSB driver.
I have tried out it right now on a clean machine (TOP2005 never seen of this) but accidentally it is not XP -> Win7 32bit.
Driver LibUSB is installed as well.
But the problem is even worse now because – at the starting of OpenTOP2.exe put an error window -> Component “RICHTX32.OCX” or one of its dependencies not correctly registered: a file is missing or invalid
Phh…life is not so easy..
Jozsef
By openschemes October 28, 2011 - 6:45 pm
The original TOP software does not seem to work on Win7 regardless. We will check on Opentop as it has never really been tried.
By Jozsef October 29, 2011 - 8:09 am
That would be very good. Packed all in one installer version together with driver components also would be very good.
BTW, what is your opinion, doesthis device could be able to functioning as an in-circuit IC tester? Maybe with some external driver circuits, does it possible?
Thanks
By Simon May 8, 2012 - 3:48 pm
Have you any plans of writing software to map a PAL fuse map? This would be so useful.
By Elgen June 25, 2012 - 6:59 pm
};-P http://elgensrepairs.blogspot.dk/2012/05/extending-usage-of-top2005-universal.html
By openschemes July 3, 2012 - 6:26 pm
Hey, great stuff! We intended to put a link in the comments section a few weeks ago, but it seems like it never happened. Looks like you’re doing all sorts of cool things with the device, and it seems you’ve got an outstanding piece of software brewing – kudos! Congrats on getting the Neo Geo bin file burned and running as well – this seems to be a more recent development than the last time we checked in.
By Jan April 1, 2013 - 4:03 pm
Why are there NO pictures available in a such good article_
By openschemes April 2, 2013 - 3:10 am
Good catch – it looks like some of the auto-translation did not come through. This article has had it’s images corrected, and will get other touchups soon. Thanks for pointing it out!
By Jan April 6, 2013 - 7:29 pm
Thanks, now pictures are here.Great project.Thanks for sharing
One more question: Can you please explain how you were able to identify the list of commands? You used logic analyzer but you can see only graphical values coming from LA. Do you have any samples how you linked LA’s output values with the list of commands you published here?
Thank you
By openschemes April 7, 2013 - 11:29 pm
I will check if there are any examples in the original files, but probably the LA traces are not in the backup.
The LA was watching the buses, and we were also snooping USB. So by doing simple tasks like changing chip (which uploads a new bitstream) we could see what was sent on USB and what was further sent out on tbe bus. On the LA you can group a set of inputs into a bus, and then the LA shows you the hexadecimal value of the bus instead of just a bunch of 1′s and 0′s.
From there, you can match what section of the USB packet is a command to the microcontroller, and what is being sent out the bus.
By siten April 20, 2013 - 10:33 am
Hey, You’ve done a tremendous task. I will certainly digg it and in person suggest to my local freinds.