Do you ever find yourself wanting an IC tester? Some way to power up an IC and apply various voltages and signals to different pins, in order to either check functionality or to explore the inner workings of some mystery chip..? Exporting test vectors from your logic simulator and checking the final, rubber-meets-the road performance on actual silicon? Then this project is for you. You’re not going to get the equivalent of a Teradyne or anything, but you won’t be spending $300k either.
What we’ve done is traced out and bus-snooped a cheap EPROM programmer to decipher it’s inner workings in order to create an open, super-low-cost platform for digital IC testing and development. This device can drive logic-level signals onto all 40 pins of a Zero Insertion Force (ZIF) socket, as well as providing ground, adjustable power and high-voltage programming signals onto common IC footprints. It can clock at 24MHz, so it’s probably possible to even do microcontroller development where the MCU runs code and the device applies fake signals at the pins to verify functionality.
The device is the Top2005, a reasonably capable Chinese EPROM programmer that we discussed previously in an article talking about how awful the vendor-supplied software is. As you may have read, we liked the minimalistic hardware design, but didn’t use the tool much because the software was rather bad. Our EPROM programming is mostly done by a nice Xeltek programmer, so the poor Top2005 was just collecting dust on a shelf in the lab. Until we decided that we needed a low-cost test bench for testing CPLD designs and debugging some proprietary SD cards, that is!
Fig 1 – Top2005 programmer pre-hack
Above is a snapshot of the Top2005. The fact that it’s USB powered and very small and portable is great. And from all our analysis, the hardware inside is fairly reasonable, save for the occasional fright from low-end design techniques. This hack consisted of three main parts that we will take a moment to describe:
- Circuit Tracing – The most tedious part was tracing the 40 signal pins from FPGA to the ZIF socket. Otherwise, this simple 2-layer PCB was fairly straightforward to trace in order to determine which pins of which IC controlled which function. Very important to know later, when we want to begin extending the capabilities.
- Bus and USB Snooping – Internally, the device uses a homegrown address/data bus that we’ll call TOPBUS. By watching the internal signals while we snoop the USB commands, it was possible to understand and recreate command sequences in order to toggle pins high/low as well as apply power and GND to the socket.
- Extending the Capabilities – With the vendor-supplied bitstreams, you can already do a ton of stuff (uhh, like EPROM/MCU programming and 74xx logic test). Just using what comes out of the box, we’ll show you how to write a little piece of testbench software so you can do on-the-fly logic verification with just a few clicks. For more off-the wall functions, we’ll show you how to write your own custom logic for the FPGA in order to do fancy sequencing or other cool stuff while you still churn data into and out of the device. We’ll provide some verilog templates and Xilinx constraint files to give you a head start on implementing custom logic for the device.
Continue to Next Page Jump to Page 2
Have you seen the open source toprammer 2049 s/w ? There are lots of info in the docuementation including reverse engineering for the protocol.
Seems like the protocols and the architecture is very similar between the different top programmers. I have a top2048 which seems to work with
the toprammer s/w
http://linux.softpedia.com/get/System/Hardware/Toprammer-57047.shtml
Thanks for the link, that is great stuff. You are right, his work is very similar to own work here. Looks like the programmers are quite similar! Thanks again, we will try to get in touch with the author for some collaboration.
I was hoping for an open source development that lead to support of all TOPxxx devices not only test bench but also universal device programming support.
I have an TOP2048 that I am trying to reverse engineer the usb protocol. It seems very similar to the TOP2049 except the ZIF(47) doesnt have a VPP driver. Funilly enough there is one extra transistor connected to the VPP shift registers that isn’t connected to anything, Thinking about connecting that one to ZIF(47).
The toprammer 0.5 s/w does work to some extent for my TOP2048 after removing some of the status register checks. It bombs when setting VPP voltage shift registers using command 0x0e1400. An error code -0×02 is sent back by the device. all the VDD VSS stuff works though. I am still trying to figure out whats wrong.
Funnily enough the same command does work if I havn’t changed the VPP value from the default one.
Don’t really have the skills or the tools of you and Michael Buesch has
ffff88013b142f00 1434636915 S Bo:10:016:2 -115 18 = 0a50000a 51000a52 000a5300 0a54000a 5500
ffff88013b142f00 1434638896 C Bo:10:016:2 0 18 >
ffff8800b3d0a0c0 1434638941 S Bo:10:016:2 -115 4 = 0e120000
ffff8800b3d0a0c0 1434639895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434639921 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434640895 C Bo:10:016:2 0 1 >
ffff88013b1429c0 1434640924 S Bo:10:016:2 -115 4 = 0e123300
ffff88013b1429c0 1434641895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434641917 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434650896 C Bo:10:016:2 0 1 >
ffff88011f3ef240 1434650987 S Bo:10:016:2 -115 4 = 0e140000
ffff88011f3ef240 1434751902 C Bo:10:016:2 -2 0
One suggestion would be to sniff the USB communication of the vendor software to see how the commands are properly used. It’s quite likely that at least some of the framework is different from device to device. Perhaps it’s just that 00 00 is not the way to turn off VPP on the 2048…?
[...] Logic Cube – The Modification! – 7,384 viewsTurning a Top2005 EPROM Programmer into a Desktop … – 7,035 viewsMore FT232 Bit Banging with the Arduino Board – 4,085 viewsExternal WDTV Remote [...]
Hi,
At first, thanks for this hack. Great stuff!
I’m not a good coder in VB (some macro in Excel that’s all)so, when it tell me ”can’t find libusbvb0.dll”, I lose my mind.
I have try to put this famous dll in windows/system then in windows/system32 without any result.
It’s certainly a rooky question but: ”Where do it be ?”
Thank for ”your ligths”.
Regards.
When the compiled tool runs, it will begin looking for the dll in the same directory in which it exists. If not found there, it will look in system32.
However, if you’re running code from inside VB6 (the debugger) then it must be in windows\system32. If it still isn’t found (which it sounds like it is not) you may want to try registering it?
regsvr32 c:\windows\system32\libusbvb0.dll
Hi, this is really great stuff.
Do you think that it will possible by what you’ve found here, to program PROMS/EPROMS that have 16bit wide databuses ie. 27C1024 (maby with the use of an custom adapter)? Or is there some hardware limitations that makes it impossible?
If the pinout fits, then sure – it can be programmed
Hi,
I have the same error: ”can’t find libusbvb0.dll”
It looks like an inevitable error on – regsvr32 c:\windows\system32\libusbvb0.dll .
The error in the dialog: Error in library LoadLibrary(“c:\windows\system32\libusbvb0.dll”) finction – cannot find the requested module
The libusbvb0.dll file was copied as well into c:\windows\system32.
What can be the problem? Can you help?
Thanks forwarding.
Best regards,
Jozsef
Jozsef,
It either goes in the same directory as the exe, or system32 if you’re running in the VB6 code debugger. What windows version are you using?
Hi,
I am using WXP Professional (2002) SP3 on HP8730w laptop, NT Partition on C drive.
Th file “libusbvb0.dll” is in same directory where the exe file – “C:\Program Files\Topwin6\Opentop2\OpenTOP2.exe”
Then .dll file also was copied into directory “C:\WINDOWS\system32″
There is no VB6 installed. Should I install it to run the exe?
Thanks forwarding.
Best regards,
Jozsef
Do you have libusb installed on your machine? It could be that the regsvr is not finding the dependency.
Hi,
It must be the problem. Where from could I download the libusb installer?
Thanks
Sourceforge libusb-win32
http://sourceforge.net/apps/trac/libusb-win32/wiki
Thanks, I have installed the libusb .
I see the properly registrated device on the list by USBView, but there is a next problem.
The result of this command : regsvr32 c:\windows\system32\libusbvb0.dll
as follows, the popup window has contains this message:
The c:\windows\system32\libusbvb.dll has successfully loaded but unable to find the proper access point: DllRegisterServer.
The requested command is unable to register the file.
I am awaiting your kind reply.
Best regards
Jozsef
Glad to see some progress. This error is very puzzling, and without more investigation it is difficult to determine the problem.
Searching on google shows several other DLL’s that cause a similar error. Have you tried the fixes described for those other users?
Pass me a link how to solve if you known a good one.
Looks like the both version of drivers are cannot live together on the same machine, doensn’t works even an assigned USB socket to LibUSB driver.
I have tried out it right now on a clean machine (TOP2005 never seen of this) but accidentally it is not XP -> Win7 32bit.
Driver LibUSB is installed as well.
But the problem is even worse now because – at the starting of OpenTOP2.exe put an error window -> Component “RICHTX32.OCX” or one of its dependencies not correctly registered: a file is missing or invalid
Phh…life is not so easy..
Jozsef
The original TOP software does not seem to work on Win7 regardless. We will check on Opentop as it has never really been tried.
That would be very good. Packed all in one installer version together with driver components also would be very good.
BTW, what is your opinion, doesthis device could be able to functioning as an in-circuit IC tester? Maybe with some external driver circuits, does it possible?
Thanks
Have you any plans of writing software to map a PAL fuse map? This would be so useful.