Phase I – Circuit Analysis
We apologize in advance that we DO NOT intend to release schematics of the programmer. Ours are messy hand-drawn partial notebook pages and really not interesting enough to redraw. Email us directly if you blew up your unit and need some partial schematic in order to figure out how to fix it. Frankly, the Top2005 is already a clone of a clone, so if you really want to pirate the device you can probably just buy the PCB artwork from one of many grey market clone manufacturers.
But alas! The world doesn’t need another low-cost programmer, it need a low-cost test bench so let’s get to it! We’ll first take a peek under the hood, and then discuss how the internal subsystems work together to do funky things to IC’s.
Fig 2 – Annotated pic of the Top2005′s guts
Starting from the right side, you see the obvious USB connector which supplies power and data to the board. Those nice big electrolytic capacitors are why you may get a momentary USB current overload warning when plugging into a PC – nice work, whoever the joker was that thought that was OK to ship with!
PDIUSB12. The USB input/output is controlled by a Philips PDIUSB12 highlighted in the above picture with light green. This very simple USB device acts as a memory-mapped peripheral to the 8051, accessed when the nCE line is low. The 8051 reads and writes the device using the standard 8-bit bus.
Data sent from the PC triggers an interrupt on the 8051, and receiving data from the Top to the PCB is basically just a blind read of the little data buffer on the PDIUSB. It’s up to the 8051 (and some associated commands) to fill that buffer with important data. You may note that the buffer is static, so even if you only want a few bytes you’re going to get the whole 64-byte buffer with most of it filled with old data from previous operations. Keep it in mind when writing client tools.
The PDIUSB12 also outputs a 24MHz clock that is frequency multiplied from it’s own 6MHz crystal. This 24MHz clock is used as the system clock for the 8051 and FPGA.
8051. The brains of the operation is a somewhat unremarkable SyncMos SM8952A 8051 clone highlighted in orange. The 8051 controls an 8-bit address/data bus that is shared between the PDIUSB, 8051, CPLD, and FPGA. We will call this bus TOPBUS. The 8051 also has a side-task of controlling which ZIF pins are driven to the adjustable VCC supply, VCCx. There is no way to update it’s firmware without pulling it from the board, so we are stuck with it’s rather silly role as a “command interpreter”.
What that means is that the 8051 will receive a USB command such as “set VPP to 12v”, and will turn around and make the proper bus accesses to stuff the data corresponding to the desired function into the proper register in the CPLD or FPGA. So a lot of the internal architecture (register map) is hidden from the user, which is kind of lame. We’d much rather send address/data pairs and have them interpreted literally, but this scheme seems to be used in order to allow the same client software to control several varieties of EPROM programmers. Shoulda made the software nicer then, fellas!
CPLD – A Xilinx XC9536 (highlighted in dark blue) is used for housekeeping functions as well as to control which ZIF pins are used as GND pins. Again, it’s programming can’t be changed (no JTAG connection) so it’s relegated to the task for which it was designed. In addition to the GND control, the CPLD is used to adjust the programming voltage VPP and the variable supply voltage VCCx. It only uses a 4-bit (low nibble) connection to TOPBUS, so you may see the 8051 fire two consecutive writes when attempting to modify byte-wide stuff like the GND control registers. It responds to internal addresses less than $10.
FPGA – An old Xilinx SpartanXL (XCS05XL) FPGA is mainly used to write/read data to all 40 pins of the ZIF socket. It’s side task is to control some high-voltage drivers to apply VPP to various pins of the ZIF socket. The bistream for the FPGA is loaded over USB by the client software when you select the device to be programmed, and can be reloaded to something new at any time. Of course, it’s also possible to write and load our own bitstreams so we can do all sorts of neat things to the chip using programmable logic. We’ll give you some sample Verilog templates to get you started on that stuff later in the article..
The logic read/write to the ZIF is implemented as open-drain logic with external pullups to VCCx on each pin of the ZIF socket. Write a 0 to the FPGA to pull the pin low (which will then read a 0), or write a 1 to let the pin float high externally. The IC under test can now pull that pin low in order for the FPGA to read a logic 0, else the FPGA reads the 1 that remains on that pin. Standard open-drain stuff you’ve probably seen in PIC and other MCU’s. When reading the pins, you always read the state of all pins but you must realize that the VCC and GND pins will always read back 1 and 0 so there is no use in trying to drive them to the other state. The pins are protected and we do it all the time, but we have to take a moment to say that it’s a bad practice in general.
As we mentioned on another site, this FPGA runs on 3.5v but it’s pins may touch ZIF pins that are either driven to 5v, or even 25v in the case of VPP! Those pins have series 510 Ohm resistors to keep the FPGA from blowing up, but this is not a good design technique at all. Please don’t ever do something like this, as it will probably damage the FPGA in the long run and cause customer returns. You can avoid those returns and complaints by continually changing the manufacturer name to some obscure Chinese combination of happy, powerful, and perhaps the name of a fruit or something.
Boost Converter. At the top highlighted in light blue is a step-up (boost) DC-DC converter (MC34063) used to generate an adjustable HV programming voltage that we’ll call VPP. There’s a test point for VPP on the board so it’s easy to send different commands and watch VPP change. The black shrink-wrapped “barrel” looking guy next to the chip is the inductor for the boost converter.
The output voltage for the boost is controlled by the CPLD using 5 resistors and open-drain logic to implement a cheesy DAC-type control of the feedback resistor divider. By turning on various pulldowns on the bottom resistors, you can change the resistor divider ratio from the output to the boost’s comparator input to adjust the regulation point from 9v to about 25v. However, the selection of output voltages is not continuous – you have your choice of: 5v (off), 9.4v, 10v, 10.4v, 11v, 12v, 12.6v, 13v, 13.7v, 14.8v, 16.4v, 21.1v, and 25.6v.
VCCx, VPP, and GND control (to Major Tom). All controlled with bjt transistors. CPLD drives a bunch of NPN’s to pull various ZIF pins to GND. The 8051 uses some spare ports to drive some PNP’s to apply the adjustable VCCx to other ZIF pins. And the FPGA drives some HV open-collector drivers to even more PNP’s to apply the adjustable VPP to various ZIF pins.
The bjt’s are simple, cheap 3904/3906′s in SOT23 package which are easy to replace if you happen to blow one up. In the pic above, the devices nearest the CPLD are the VCCx control, followed by the VPP control just to the left of that. And north of the ZIF socket are the GND devices and a few other VPP controllers all the way on the top left. As a side note, ZIF pin 40′s VPP uses a 6v series zener to drop the voltage down to the 6.5v level.
It may sound like a tangled web, but once you organize the signals with respect to the ZIF socket it becomes much easier to understand. After the next section, we’ll supply you an easy-to-use cheat sheet that tells you what to do in order to modify which pin.
Continue to Next Page
Have you seen the open source toprammer 2049 s/w ? There are lots of info in the docuementation including reverse engineering for the protocol.
Seems like the protocols and the architecture is very similar between the different top programmers. I have a top2048 which seems to work with
the toprammer s/w
http://linux.softpedia.com/get/System/Hardware/Toprammer-57047.shtml
Thanks for the link, that is great stuff. You are right, his work is very similar to own work here. Looks like the programmers are quite similar! Thanks again, we will try to get in touch with the author for some collaboration.
I was hoping for an open source development that lead to support of all TOPxxx devices not only test bench but also universal device programming support.
I have an TOP2048 that I am trying to reverse engineer the usb protocol. It seems very similar to the TOP2049 except the ZIF(47) doesnt have a VPP driver. Funilly enough there is one extra transistor connected to the VPP shift registers that isn’t connected to anything, Thinking about connecting that one to ZIF(47).
The toprammer 0.5 s/w does work to some extent for my TOP2048 after removing some of the status register checks. It bombs when setting VPP voltage shift registers using command 0x0e1400. An error code -0×02 is sent back by the device. all the VDD VSS stuff works though. I am still trying to figure out whats wrong.
Funnily enough the same command does work if I havn’t changed the VPP value from the default one.
Don’t really have the skills or the tools of you and Michael Buesch has
ffff88013b142f00 1434636915 S Bo:10:016:2 -115 18 = 0a50000a 51000a52 000a5300 0a54000a 5500
ffff88013b142f00 1434638896 C Bo:10:016:2 0 18 >
ffff8800b3d0a0c0 1434638941 S Bo:10:016:2 -115 4 = 0e120000
ffff8800b3d0a0c0 1434639895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434639921 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434640895 C Bo:10:016:2 0 1 >
ffff88013b1429c0 1434640924 S Bo:10:016:2 -115 4 = 0e123300
ffff88013b1429c0 1434641895 C Bo:10:016:2 0 4 >
ffff88013b1429c0 1434641917 S Bo:10:016:2 -115 1 = 1b
ffff88013b1429c0 1434650896 C Bo:10:016:2 0 1 >
ffff88011f3ef240 1434650987 S Bo:10:016:2 -115 4 = 0e140000
ffff88011f3ef240 1434751902 C Bo:10:016:2 -2 0
One suggestion would be to sniff the USB communication of the vendor software to see how the commands are properly used. It’s quite likely that at least some of the framework is different from device to device. Perhaps it’s just that 00 00 is not the way to turn off VPP on the 2048…?
[...] Logic Cube – The Modification! – 7,384 viewsTurning a Top2005 EPROM Programmer into a Desktop … – 7,035 viewsMore FT232 Bit Banging with the Arduino Board – 4,085 viewsExternal WDTV Remote [...]
Hi,
At first, thanks for this hack. Great stuff!
I’m not a good coder in VB (some macro in Excel that’s all)so, when it tell me ”can’t find libusbvb0.dll”, I lose my mind.
I have try to put this famous dll in windows/system then in windows/system32 without any result.
It’s certainly a rooky question but: ”Where do it be ?”
Thank for ”your ligths”.
Regards.
When the compiled tool runs, it will begin looking for the dll in the same directory in which it exists. If not found there, it will look in system32.
However, if you’re running code from inside VB6 (the debugger) then it must be in windows\system32. If it still isn’t found (which it sounds like it is not) you may want to try registering it?
regsvr32 c:\windows\system32\libusbvb0.dll
Hi, this is really great stuff.
Do you think that it will possible by what you’ve found here, to program PROMS/EPROMS that have 16bit wide databuses ie. 27C1024 (maby with the use of an custom adapter)? Or is there some hardware limitations that makes it impossible?
If the pinout fits, then sure – it can be programmed
Hi,
I have the same error: ”can’t find libusbvb0.dll”
It looks like an inevitable error on – regsvr32 c:\windows\system32\libusbvb0.dll .
The error in the dialog: Error in library LoadLibrary(“c:\windows\system32\libusbvb0.dll”) finction – cannot find the requested module
The libusbvb0.dll file was copied as well into c:\windows\system32.
What can be the problem? Can you help?
Thanks forwarding.
Best regards,
Jozsef
Jozsef,
It either goes in the same directory as the exe, or system32 if you’re running in the VB6 code debugger. What windows version are you using?
Hi,
I am using WXP Professional (2002) SP3 on HP8730w laptop, NT Partition on C drive.
Th file “libusbvb0.dll” is in same directory where the exe file – “C:\Program Files\Topwin6\Opentop2\OpenTOP2.exe”
Then .dll file also was copied into directory “C:\WINDOWS\system32″
There is no VB6 installed. Should I install it to run the exe?
Thanks forwarding.
Best regards,
Jozsef
Do you have libusb installed on your machine? It could be that the regsvr is not finding the dependency.
Hi,
It must be the problem. Where from could I download the libusb installer?
Thanks
Sourceforge libusb-win32
http://sourceforge.net/apps/trac/libusb-win32/wiki
Thanks, I have installed the libusb .
I see the properly registrated device on the list by USBView, but there is a next problem.
The result of this command : regsvr32 c:\windows\system32\libusbvb0.dll
as follows, the popup window has contains this message:
The c:\windows\system32\libusbvb.dll has successfully loaded but unable to find the proper access point: DllRegisterServer.
The requested command is unable to register the file.
I am awaiting your kind reply.
Best regards
Jozsef
Glad to see some progress. This error is very puzzling, and without more investigation it is difficult to determine the problem.
Searching on google shows several other DLL’s that cause a similar error. Have you tried the fixes described for those other users?
Pass me a link how to solve if you known a good one.
Looks like the both version of drivers are cannot live together on the same machine, doensn’t works even an assigned USB socket to LibUSB driver.
I have tried out it right now on a clean machine (TOP2005 never seen of this) but accidentally it is not XP -> Win7 32bit.
Driver LibUSB is installed as well.
But the problem is even worse now because – at the starting of OpenTOP2.exe put an error window -> Component “RICHTX32.OCX” or one of its dependencies not correctly registered: a file is missing or invalid
Phh…life is not so easy..
Jozsef
The original TOP software does not seem to work on Win7 regardless. We will check on Opentop as it has never really been tried.
That would be very good. Packed all in one installer version together with driver components also would be very good.
BTW, what is your opinion, doesthis device could be able to functioning as an in-circuit IC tester? Maybe with some external driver circuits, does it possible?
Thanks
Have you any plans of writing software to map a PAL fuse map? This would be so useful.