Upgrading the tl866cs, or: misadventures with PICs

So, as the story usually goes: I bought the crippled cheaper version and dropped way too much time upgrading it. This time it’s the tl866cs EEPROM programmer. but this thing is much more than that, it does reading and writing of EEPROMs, sure, but it also does avr, pic, 8051, PLDs, all sorts of stuff. The part that sold it for me was that… well, what do you think this programmer is? it’s a micro with IO expanders (or at least buffers), and digitally configurable voltage regulators. so, crap-tons of IO, definable power and ground pins… this thing can test piles of logic chips! all you have to do is apply input signals, take output signals, check against a known good and report faults. So it also tests 7400, 4000, and even ram chips. So this thing is an absolute godsend, it has tons of chips in the database, hex editor built in, configurable pretty much anything.

Now, on to the differences in the versions. I bought the tl866cs variant which has the 40pin zif socket, but no ICSP connector. Don’t get me wrong, it has the cutout, has all needed passives, just needs the header. The full version is the tl866a, what I wanted to upgrade to. Now, as far as I can tell this is an original Chinese design: I don’t know of another programmer in a similar form factor, they have their own GUI (unlike the Saleae I modded the other day). They are understandably hesitant to release any schematics, firmware, or even what chip is driving the entire thing.

Let’s start with the chip. They have scraped the part number off of the package (rotary tool of some kind) and apparently thought this was enough. I won’t even go into the brute force method which starts with the USB Vid is licensed to microchip if I’m not mistaken and they have this wonderful thing these days where you can sort by package to get all possible PICs in that package, then trace power, ground, ICSP, and crystal and you have the family, if not the exact chip (oops, I guess I got into it). The really hard way involves acid and building a complete picture of all it’s specs based on the silicon die, but we’ll save that for military ASICs (You can’t hide from us!). The easy way is to ask around other people who bought it (they are probably electrical engineers/hobbyists, who else buys no-name Chinese stuff like this) and find someone who can read the slightly less worn away chip they got in theirs. Now we have the one unknown part we can proceed to reverse engineer a schematic pretty easily. I know it’s time consuming, but luckily we can outsource that job to people on the internet with more free time than us.

bottom featuring shaved IC and it’s ICSP header… facepalm

Just a side note on the construction: this board is designed fairly well, I only have a few gripes. It seems fairly obvious that these PCBs are machine assembled and the final product is hand assembled. They use standard 0.1″ pin headers to connect the boards and solder wires to hold them in place. My main gripe is not the wires, they’re redundant grounds, my gripe is those darn LEDs, they are on long leads that go all the way through the boards and solder in the bottom. You’re already putting in all those pin headers, you can’t put in 4 more pins!?

modular pin headers… thank god

Ok, now that we have the hardware, let’s move on to the software. This is where I got hung up, bored, and let someone else do it. We’ll start with my attempt. First thoughts: different USB Pid for each model (so very wrong). we’ll skip my pawing at the minipro files looking for plaintext and move right on to the fact that someone actually discovered that there is a bootloader that takes firmware updates, the firmwares are encrypted, and the bootloader checks them on boot to see if they match. They also decrypted them, reverse engineered the bootloader, created an application to generate bootloader and whole firmware unencrypted hex files with user settable IDs…. duuuuuude, so much work, such nice documentation.

my original serial and dev codes

Now, looking into the future, there is also talk about creating custom chip libraries and chip testing/programming algorithms…. I envision a utopia future where there is a crowdsourced effort adding chips to the library, maybe even designing better hardware (using digital pots to get finer power control than 8 distinct voltages). but I digress…

boost converters on the left

OK, now I have a firmware image to write to the PIC, all I need to do is whip out the pickit3. Oh, I don’t have one. pickit2? Nope, hmm, I have something for PICs around here… AH! here, a microchip mplab ICD 2. Ok, no problem install mplab, and visual studio? I don’t care, whatever, just install it. OK, now how do I set it up? uh, ok, select programmer, blah, blah, error… huh? Well the programmer failed the self test, but nothing’s plugged in to it and it says it passed the test in the settings menu. Uh, we’ll just ignore that. now connect it, import the hex, set the config bits from the hex, aaaaand crap. it can’t recognize the PIC. I don’t know why, the voltages are all fine, it says it’s supported, please work? No, ok, well screw you too mplab. how about some 3rd party pic programming tools. None support this hockey puck of doom. Ok, fine, just use the easy serial programmer. It’s only like five components and I’m in a well stocked lab and…..you want WHAT now?! an 8.2v zener? no I don’t stock those. hmmm, how does this even work… OH GOD, uh, we’ll just forget how they’re doing that voltage regulation… and floating grounds… ok, here’s a more sane one, still needs a 12v zener, that’s ok, I actually have those. Get it all breadboarded up and find out that my 3rd party client supports the PIC18f87j50… with only one of the many compatible programmers he listed. Fine, what else? ok, here, a parallel port programmer, it doesn’t get any more simple. so I need a 74<cough><cough>05, yeah, I’ve got one somewhere, I’m sure it’ll work just fine. Oh, hmmm, it says I need a Vpp of no more than 3.6v, and I think I need logic levels to match. fine, I’ll just lower the voltage on this buffer chip…. crap. it doesn’t go low enough. This is the point where I considered breaking out the textbooks to build level shifters out of BJTs to get the right voltages (I would have already built a pickit2 clone as they can be programmed with the serial thing, if I had the right model PIC for the brain). I just know these chips will work out of spec, what is it Scotty said? “A good engineer is always a wee bit conservative… at least on paper”. Ok, let’s do it. Doesn’t detect programmer… crap. well, it’s breadboarded up, I’ll just… oh… that’s how it checks for this simple programmer, it uses a free input pin to sense the inverse of one of it’s own signals and twiddles it to be sure that, yes, it really is seeing it’s own tail wag. and the pin fell out. Ok, back in, click button, YAY! the programmer is recognized. ok, connect the PIC… one of the pins isn’t used… the one with the bjt… nope, I don’t care anymore, leave it off, keep on trucking. Dump the chip. well, it’s not throwing an error, and it seems to have autodetected the PIC. (yes, hooking up a programmer is exactly all it takes to bypass the ‘scratching off the number’ routine since they LEFT AN ICSP HEADER FOR THE MAIN PROCESSOR OPEN AND PINNED OUT RIGHT). Ok, well, it read something, mostly blank, must be the DRM flag set. Now write the-WARNING CONFIG BITS NOT SET IN THE HEX-. Yeah, they are. No seriously, I open up mplab and import the hex and they’re right there. <sigh> check flag… set flag… check flag… set flag… ok, all are finally set, let’s program. Programming, cool. Errors with verifying, not cool. Well, dump it again, see if it still hasn’t been programmed. No, there’s something different there, quick see if it matches the code I tried to write! huh, slightly different formatting, whatever, where’s the USB cable, plug it in, aaaaaaaand……… SUCCESS!!!!! it is now a TL866A! ok, box it up, now where did I put that AVR ICSP header adapter I made like a month ago…. and it works, no support for the atmega1280 or 2560, but it’ll come, maybe, eventually. this took…. 6 hours, maybe 7? whatever, now I have a decent PIC progammer, never need to do that again.

the setup that finally worked

no, it’s not cracked in half, but it does have 5 or 6 pins repaired with solid core wires.


EEVblog thread with all the wonderful info (starts on page 5 or 6)

programmer I used

software I used

rest of the pictures

Tags: , , , , ,

15 Responses to “Upgrading the tl866cs, or: misadventures with PICs”

  1. Solitone (@Solitone) Says:

    Hi there and thanks for sharing this very interesting mod with us. I would like to do the same to my TL866CS, but I have to say that I don’t understand precisely what you have been doing with the software part (writing style maybe? who knows? ;-). I looked at your links too, but couldn’t start to understand what it’s all about… I understand that you have reprogrammed the PIC chip of the TL866CS to make it act as a TL866A and thus be able to use the ICSP interface, but what specific mods did you bring to the firmware. Did you get a TL866A firmware that you tweaked? Ultimately (and I know it sucks…) could you make a more detailed post about it? I believe that MANY people out there would crave for this kind of information considering the shear amount of TL866CS on sale on ebay since Dave’s review on Eevblog, and also because it’s a neat little programmer!! Thanks!!

    • abzman2000 Says:

      So, basically I just did a writeup of my attempt to replicate what other people figured out how to do on the EEVblog forum post I linked here. The only unique thing I contributed to the programmer hacking was commenting about how to do it with no proper PIC programmer and very few parts. The code all comes from Radioman and all I did was program the chip. The process can be outlined as follows: 1) Download firmware hex from Radioman’s post(s). 2) download and install picpgm. 3) open the hex in mplab to read out the config bits. 4) open the hex in picpgm and get the error about no config bits set. 5) set the config bits manually according to what mplab says. 6) assemble the LVP programmer. 7) power the programmer with 3.6V instead of 5 (may not be needed, but that’s what I did). 8)wire the programmer up to the pic leaving off picpgm and being sure to supply 3.6v power and ground. 9) program the PIC. 10) disconnect the programmer, plug in the USB cable and hope for the best. If you really want it I can write a followup where I’m a bit less sleep deprived and a bit more methodical in my explanations, but I originally intended this to be an entertaining read and to point out that this way is possible.

  2. Solitone (@Solitone) Says:

    Thanks a million for your cool reply my friend!! Now I get it way better!! I know I should spend more time on the EEVBlog Forum… I’ll go and have a look now. If I still can’t get it, I’ll come back to you for more assistance. “Catch you next time” as they say!! 😉

    • abzman2000 Says:

      no problem, I’m new to actually giving back to electronics communities (documenting things) so I’m glad someone is actually getting use out of my rantings

  3. radioman Says:

    you can power from USB as well, there’s no need to have separate power source. As for programmer the most simple one can be a DB-25 connector and three resistors(of course an computer with LPT parallel port is needed). Config bytes are embedded in generated hex file, I don’t know why picpgm software is not able to read them, I will investigate this. Thank you for article abzman!

    • abzman2000 Says:

      I think me using the external power source is a holdover from me using the mplab ICD 2 and trying anything I could think of to make it work. As for the programmer and config bytes: do toy know if mplab supports any really simple programmers like the one you described? I’ve never used PICs up until this project and I’m sure it shows.

      • radioman Says:

        afaik the Mplab is working only with picKit and icd. My primary development is focused on Atmel Avr’s but i have done a couple of projects with Pic’s(don’t like pics very much). I have done a little experiment here, with picpgm and a very simple lvp programmer (a female DB25 connector and three resistors), well i can confirm, there is an error with no config bits set, but this is for picpgm Version (beta); with version the load of config bytes from hex fileis working ok, so picpgm is buggy. Please download the stable version of picpgm (version from here:

        Schematic diagram of this very simple programmer is here:

        Settings for picpgm hardware here:

  4. Jan Says:


    Ive made the same programmer as you did, but the problem is that it wont detect the pic in PICPgm… ver though…

    Ill try to describe my config:
    1. everything connected (I did connect ICSP 1-5 to a J1 connector on TL866CS)
    2. supplied 3,6V to output connector of LPT programmer (PIN1=3,6V and PIN2=GND)

    but Im little confused here:

    Do I have to connect USB cable to TL866CS when trying to programm?
    (I tried but it just drains around 500mA and it wont detect either)

    I double checked the programmer and its well slodered and no problem here (I suppose PICPgm wouldnt detect it…)

    Please help…

    • Jan Says:

      My bad!!!

      I looked at the schematics of the programmer TL866CS and found out that the pin assigment was different..

      Remade the connection and voila.. Software detects the PIC and I could flash the TL866A firmware…

      Took me 2 days to make it happen.

      Anyway thanx!!

      • abzman2000 Says:

        Good, I’m glad. As a note I always pinout the connection myself, assuming a sane or standard pinout has fried more of my stuff that I usually like to admit.

  5. PV981A-16 mod for autodetection in linux | Evan's Techie-Blog Says:

    […] My trusty tl866 wrote these easily and now I have a card that autodetects incorrectly (it did before too) but with the right input settings.  I may have been able to just remove the chips and have it autodetect as generic/unknown and had it work, but this seems more resistant to driver autodetection changes in the future. […]

  6. Don’t throw that away: how to stay sharp and be productive | Evan's Techie-Blog Says:

    […] that I can use to erase some of the older chips (thank you electronics goldmine surprise box) and a programmer that can do almost anything.  That, coupled with the fact that atari 2600 cartridges were […]

  7. TTL POV globe redesign (part 1) | Evan's Techie-Blog Says:

    […] and decoders for the 28C64 EEPROM made from 74LS161 chips.  The EEPROM was programmed using the TL866 programmer to a sequential pattern as an example.  You can see that this chunk of the circuit iterates […]

  8. Xbox360 Chat Pad to USB | Evan's Techie-Blog Says:

    […] There were other things I could have done, including reprogramming the PIC (but seriously, fuck PICs) or just using another library, but this is the solution I ended […]

  9. Synthesizing a neo-geo game from scratch (ish) | Evan's Techie-Blog Says:

    […] be that hard. Programming them, however, is a bit of a challenge. I can program the 27C101 with my TL866A, but none of the others. The 27C301 is no big deal, I just made a passive adapter swapping /OE and […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: