Posts Tagged ‘upgrade’

Pocket TV upgrade

June 13, 2013

the victim

So, adding to my growing list of projects where I add features to things that should have had them from the start, I bring you: composite input on a pocket TV.  This particular TV (Casio TV-890) was made useless by the Digital broadcast television switchover, it has no jack to put in an auxiliary signal, and thus can’t be used at all.  So, since we all know the world runs on some sort of composite video signal (or can be made to) let’s crack this thing open and find us some signal paths.  Maybe we’ll check the pads coming off of the RF can first, maybe look up part numbers for a video chip, maybe…..oh, well that was anticlimactic

unpopulated jack

So, a similar model has a three conductor 3.5mm jack with spdt switch built in.  Presumably this is for video/audio and, yup, it is.  The next question is where am I going to find one of those jacks? how do you even source a part like this? Well, I just so happen to have one, no idea where it’s from but I have one close enough.

salvage part

Now, some of you may notice mine is a dpdt switch, yup, and I only have to re-locate one capacitor to make it fit.

moved a cap (always with the cat5…)

But, there’s another thing.  On the underside of the board there are two zero ohm resistors jumping the contacts that would normally be connected on the jack that isn’t present (for reliable operation they should be removed, otherwise you’re back feeding the RF stuff, or getting signal mixing).  What I mean by that is: these types of jacks sometimes have, say, 5 pins when you might think they only need 3.  Obviously you need audio, video, and ground (or left, right, and ground in the case of an audio application) but what are the other 2 pins for? They’re pass through audio lines.  Think back to a set of speakers that stops playing when you plug headphones in, that’s what’s going on.  When you don’t have headphones in, the audio gets routed through the pass through pins into the speakers, but the physical act of plugging in headphones breaks the connection and the audio is routed to your headphones.  This is used in the opposite way, in the sense that you are routing a signal into the TV, rather than out.  The use of a separate switch may be to cut power to the RF components so power isn’t wasted while they are not in use.

two tiny zero ohm resistors that are clearly jumpering pads meant for a jack

Well, what can I say? It’s not much of a hack. It works, or, it did.  I think I was slimming it down for use as a portable screen for something or other and I broke it, so there isn’t a picture of it working, but I swear it did.  Oh well, at least I got to tell people how to upgrade theirs.

entire album

Modded slug

June 12, 2013

This is in no way an original project, but I’m publishing it because I think some of the things I did were pretty neat.  A long long time ago Linksys released the nslu2, a network atatched storage device.  That’s cool, let’s open it up to see what it has inside.  TTL level serial port, cool, I put a header on it, and broke it out to the ftdi friend standard with a pigtail though a hole in the case.  Overclocking? yes please! just remove resistor R83, it’s that simple to double the clock speed.  now you’re cooking with gas at… 266Mhz. Ok, this is a bit of an old device.  What else do we have…. more USB ports? ok, I can break those out, but first what’s with this one port that doesn’t allow flash drives? it has no power line soldered to it… what? Ok, there’s a set of pads for a fuse like the other port has, but it’s not connected.  Maybe it’s to make sure their cheap power brick won’t crap out on them? No matter, solder a jumper and it’s done, add another 3 ports and they’re all broken out.  The thing is, I didn’t have 3 nice USB ports at the time, but I did have an old USB PCI bracket that’s normally used to break out motherboard USB ports.  No problem, just grab some pin header and a scrap of PCB (these pin headers tend to fall apart if not soldered to something sturdy.  Now I have a total of five powered USB ports.  Now, about that power adapter… This thing runs on 5v, and after tracing the power rails I find that it’s unregulated all the way out the USB ports, so I dig out a monster 5a 5v supply, graft on the right barrel jack and we’re in business.

new ports soldered in, pretty cleanly

Ok, now that we’re done with the hardware (all that I did anyway) let’s move on to the software.  I’ll admit that I had modded this thing, put it on a shelf and forgot about it for a while, the only thing I remember was insisting that I had to have the most capable linux install on it (a debian derivative) and it had to be a fully featured linux box (a configuration nightmare compared to what I finally used it for).  So I have a modded slug that I want to re-mod to have Unslung on it, a derivative of the stock firmware that allows those extra usb ports.  All the tutorials say to “use this utility and it’s easy”, bah, I have a serial terminal, no need to mess around with blind boots, and all this crap.  With my experience modding FONs and other embedded linux devices I’m actually more comfortable with redboot, a tftp server and raw commands.  Following the tutorial listed here I got it installed and booting in no time.  I can’t use it as a general purpose webcam server or network connected speaker system, or whatnot but it’ll make a good NAS.

big boy

There’s another interesting feature of the nslu2 has, a strange one, a USB device port.  Now, I can’t really say what I’d use it for, but it’s there and I haven’t done it yet (I may never).  There is a mod to auto power on the slug using a capacitor (The same hack can be done with a desktop, I think) but I haven’t done that mod, mostly because I have real servers… also does this thing not respond to WOL packets?  Now, looking at what people have done, using it as a network attatched power switch and stuff, they all seem to use usb connected devices to trip FETs or relays… what about the activity LEDs? can you not manually control them like on the WRT54g or the FON?  Some pretty fantastic things have been done with these devices, as a EE I tend towards the really cool hardware, like using the I2C bus to talk to low level devices directly, adding more RAM and flash, and the fact that there is a second RX and CTS only serial port in there somewhere.  Check out the wiki, it has so much covered on this neat little gadget.



pretty comprehensive wiki

fantastic pictures

Upgrading the tl866cs, or: misadventures with PICs

June 12, 2013

So, as the story usually goes: I bought the crippled cheaper version and dropped way too much time upgrading it.  This time it’s the tl866cs EEPROM programmer.  but this thing is much more than that, it does reading and writing of EEPROMs, sure, but it also does avr, pic, 8051, PLDs, all sorts of stuff.  The part that sold it for me was that… well, what do you think this programmer is? it’s a micro with IO expanders (or at least buffers), and digitally configurable voltage regulators.  so, crap-tons of IO, definable power and ground pins… this thing can test piles of logic chips! all you have to do is apply input signals, take output signals, check against a known good and report faults.  So it also tests 7400, 4000, and even ram chips.  So this thing is an absolute godsend, it has tons of chips in the database, hex editor built in, configurable pretty much anything.

Now, on to the differences in the versions.  I bought the tl866cs variant which has the 40pin zif socket, but no ICSP connector.  Don’t get me wrong, it has the cutout, has all needed passives, just needs the header.  The full version is the tl866a, what I wanted to upgrade to.  Now, as far as I can tell this is an original Chinese design: I don’t know of another programmer in a similar form factor, they have their own GUI (unlike the Saleae I modded the other day).  They are understandably hesitant to release any schematics, firmware, or even what chip is driving the entire thing.

Let’s start with the chip.  They have scraped the part number off of the package (rotary tool of some kind) and apparently thought this was enough.  I won’t even go into the brute force method which starts with the USB Vid is licensed to microchip if I’m not mistaken and they have this wonderful thing these days where you can sort by package to get all possible PICs in that package, then trace power, ground, ICSP, and crystal and you have the family, if not the exact chip (oops, I guess I got into it).  The really hard way involves acid and building a complete picture of all it’s specs based on the silicon die, but we’ll save that for military ASICs (You can’t hide from us!).  The easy way is to ask around other people who bought it (they are probably electrical engineers/hobbyists, who else buys no-name Chinese stuff like this) and find someone who can read the slightly less worn away chip they got in theirs.  Now we have the one unknown part we can proceed to reverse engineer a schematic pretty easily.  I know it’s time consuming, but luckily we can outsource that job to people on the internet with more free time than us.

bottom featuring shaved IC and it’s ICSP header… facepalm

Just a side note on the construction: this board is designed fairly well, I only have a few gripes.  It seems fairly obvious that these PCBs are machine assembled and the final product is hand assembled.  They use standard 0.1″ pin headers to connect the boards and solder wires to hold them in place.  My main gripe is not the wires, they’re redundant grounds, my gripe is those darn LEDs, they are on long leads that go all the way through the boards and solder in the bottom.  You’re already putting in all those pin headers, you can’t put in 4 more pins!?

modular pin headers… thank god

Ok, now that we have the hardware, let’s move on to the software.  This is where I got hung up, bored, and let someone else do it.  We’ll start with my attempt.  First thoughts: different USB Pid for each model (so very wrong).  we’ll skip my pawing at the minipro files looking for plaintext and move right on to the fact that someone actually discovered that there is a bootloader that takes firmware updates, the firmwares are encrypted, and the bootloader checks them on boot to see if they match.  They also decrypted them, reverse engineered the bootloader, created an application to generate bootloader and whole firmware unencrypted hex files with user settable IDs…. duuuuuude, so much work, such nice documentation.

my original serial and dev codes

Now, looking into the future, there is also talk about creating custom chip libraries and chip testing/programming algorithms…. I envision a utopia future where there is a crowdsourced effort adding chips to the library, maybe even designing better hardware (using digital pots to get finer power control than 8 distinct voltages). but I digress…

boost converters on the left

OK, now I have a firmware image to write to the PIC, all I need to do is whip out the pickit3.  Oh, I don’t have one.  pickit2? Nope, hmm, I have something for PICs around here… AH! here, a microchip mplab ICD 2.  Ok, no problem install mplab, and visual studio? I don’t care, whatever, just install it.  OK, now how do I set it up? uh, ok, select programmer, blah, blah, error… huh? Well the programmer failed the self test, but nothing’s plugged in to it and it says it passed the test in the settings menu.  Uh, we’ll just ignore that.  now connect it, import the hex, set the config bits from the hex, aaaaand crap.  it can’t recognize the PIC.  I don’t know why, the voltages are all fine, it says it’s supported, please work? No, ok, well screw you too mplab.  how about some 3rd party pic programming tools.  None support this hockey puck of doom.  Ok, fine, just use the easy serial programmer.  It’s only like five components and I’m in a well stocked lab and… want WHAT now?! an 8.2v zener? no I don’t stock those.  hmmm, how does this even work… OH GOD, uh, we’ll just forget how they’re doing that voltage regulation… and floating grounds… ok, here’s a more sane one, still needs a 12v zener, that’s ok, I actually have those.  Get it all breadboarded up and find out that my 3rd party client supports the PIC18f87j50… with only one of the many compatible programmers he listed.  Fine, what else? ok, here, a parallel poet programmer, it doesn’t get any more simple.  so I need a 74<cough><cough>05, yeah, I’ve got one somewhere, I’m sure it’ll work just fine.  Oh, hmmm, it says I need a Vpp of no more than 3.6v, and I think I need logic levels to match.  fine, I’ll just lower the voltage on this buffer chip…. crap.  it doesn’t go low enough.  This is the point where I considered breaking out the textbooks to build level shifters out of BJTs to get the right voltages (I would have already built a pickit2 clone as they can be programmed with the serial thing, if I had the right model PIC for the brain).  I just know these chips will work out of spec, what is it Scotty said? “A good engineer is always a wee bit conservative… at least on paper”.  Ok, let’s do it.   Doesn’t detect programmer… crap.  well, it’s breadboarded up, I’ll just… oh… that’s how it checks for this simple programmer, it uses a free input pin to sense the inverse of one of it’s own signals and twiddles it to be sure that, yes, it really is seeing it’s own tail wag.  and the pin fell out.  Ok, back in, click button, YAY! the programmer is recognized.  ok, connect the PIC… one of the pins isn’t used… the one with the bjt… nope, I don’t care anymore, leave it off, keep on trucking.  Dump the chip.  well, it’s not throwing an error, and it seems to have autodetected the PIC.  (yes, hooking up a programmer is exactly all it takes to bypass the ‘scratching off the number’ routine since they LEFT AN ICSP HEADER FOR THE MAIN PROCESSOR OPEN AND PINNED OUT RIGHT).  Ok, well, it read something, mostly blank, must be the DRM flag set.  Now write the-WARNING CONFIG BITS NOT SET IN THE HEX-.  Yeah, they are.  No seriously, I open up mplab and import the hex and they’re right there.  <sigh> check flag… set flag… check flag… set flag… ok, all are finally set, let’s program.  Programming, cool. Errors with verifying, not cool.  Well, dump it again, see if it still hasn’t been programmed. No, there’s something different there, quick see if it matches the code I tried to write! huh, slightly different formatting, whatever, where’s the USB cable, plug it in, aaaaaaaand……… SUCCESS!!!!! it is now a TL866A! ok, box it up, now where did I put that AVR ICSP header adapter I made like a month ago…. and it works, no support for the atmega1280 or 2560, but it’ll come, maybe, eventually.  this took…. 6 hours, maybe 7? whatever, now I have a decent PIC progammer, never need to do that again.

the setup that finally worked

no, it’s not cracked in half, but it does have 5 or 6 pins repaired with solid core wires.


EEVblog thread with all the wonderful info (starts on page 5 or 6)

programmer I used

software I used

rest of the pictures

Saleae Logic clone build

June 11, 2013

So, I wanted a logic analyzer, and I wanted it cheap.  After hearing about the Saleae Logic I was excited, after all what is a logic analyzer but a pile of IO and some nice software.  The thing is, the rate at which you may want to take samples can be much greater than the transfer speed of, say, USB 2.0.  The cool thing about the Saleae Logic, USBEE, Braintechnology USB-LPS, and presumably others is that they use the Cypress FX2 chip.  The main benefit of this chip is that it has an enormous 4 Kilobyte FIFO buffer attached to ports B and D.  That means it can take a huge number of samples really fast.  That chip is really weird, well, it’s the first I’ve heard of having to push firmware to a chip upon plugging it into a computer.  This means that any software that wants to use a peripheral based on this chip can simply push fresh code on boot to the processor, allowing firmware upgrades to be as easy as software upgrades for the client software.  This also means that any software is free to push it’s code to any peripheral and try to use it.  This could be problematic if you end up trying to output into a one-way buffer chip or anything else since the associated hardware could differ wildly from devices utilizing this chip.  The way around this is to have an I2C EEPROM that has the usb Vid:Pid on it, allowing authentication of peripherals to the software.  This method can pragmatically be used for protection, or used for DRM (I think you see where this is going).

overview with crappy cable

There is an open source logic analyzer project known as sigrok that has a client for many different logic analyzers, and a sub-project fx2lafw which is a firmware for FX2 based logic analyzers.  They have a wealth of information about various logic analyzers, especially the FX2 variants.  Some of the stuff I found most interesting was the details on which eeprom and buffer each device uses. Since I am planning on using this chip as a logic analyzer, and as such will be connecting it to foreign/unknown hardware I think an input buffer is pretty important.  I went with the ST DVIULC6-4SC6 because that’s what the Saleae used, it’s fantastically simple, it’s just a diode array used to tie any over voltages to the power rails, so you just tap it right on to your data lines, not through.  The benefit of these is that they’re designed for ESD and can respond even with signals switching at up to 1.65Gb/s.  Now the other thing the sigrok site has for input protection is series resistor values.  Clamping diodes protect from voltage, but series resistors protect from current.  While they don’t actually list the resistor values, they have detailed pictures with which you can actually read the smd markings… except the Saleae uses packages without markings <sigh> whatever, I used 4.7k 603 package ones between 2 pads on a standard perf board.

close up of my hackery

My original plan was to break out all 16 pins of the FIFO (prots B and D) so that I could have a 16 channel logic analyzer, but ST only samples one of each part and only had 2 variants of the ESD chip, so… I’ll do that later if I really want it.  Now I just needed to figure out the EEPROM problem.  I bought the Lcsoft CY7C68013A Mini Board off of ebay for ~$15 it comes with an EEPROM on it and a jumper to set the address of the chip, the problem is the chinese company used an EEPROM with 16bit memory addressing and put it at the address where the Saleae looks for an EEPROM, except the FX2 needs an EEPROM with 8bit addressing at that address, and the Saleae won’t look at the address where the FX2 will allow a 16bit addressed EEPROM.  Basically, while they tried to create a knock off, they failed.  I know they tried to create a knock off because I dumped the 24c128 they had on the board, it had the right USB Vid:Pid on it for the Saleae.  Well, it’s fantastically easy to find EEPROMs of the required interface as they are used all the time as the DDC chip in any VESA compatible display (VGA, DVI, or HDMI ports each have one) to communicate to the computer what resolutions a monitor is capable of.  There is a way to use the Cypress tools to reprogram the EEPROM if you don’t have any other tools to do it, but I just used my tl866cs, fantastic programmer (trying to upgrade it to a tl866a).  I salvaged a few from the logic board of a long dead and smashed LCD, wrote them with the required bytes and voila! we have a Saleae Logic.  but that’s not enough, oh no, I need to make this better than retail.  How about making it also a USBEE ZX? well, kinda.  I have yet to figure out what pins on the FX2 map to the Trigger and Clock on the USBEE ZX.  Also, I have some sources that say the USBEE ZX is not as picky about the EEPROM type as the Saleae is.  And I needed to solder a jumper from the board to the protoboard since 5v isn’t broken out on the headers (for the GND, 3.3v, 5v header).  So, I grabbed another EEPROM, burned in some new Vid:Pid bytes and hey! it works too!

yeah, I soldered a wire, boo hoo

Fabrication took place in my signature style: using whatever I had lying around and not bothering to etch a board.  Don’t get me wrong, I can etch a board in a few hours with the tools at hand, I just didn’t feel like it.  “But they’re surface mount chips” I hear you cry.  “But I don’t care” I respond.  Some people invest in rework stations and reflow ovens, all I need is a really, really fine tip on my iron.  Not for this project though, a regular fat tip will do just fine.  “How can you solder those chips down? the pin pitch isn’t right”.  Ok, fine, scrape off 2 circles of copper and straddle it with the EEPROMs tack the corners and the 2 center pins on each side aren’t soldered to the board.  “But you have 2 EEPROMs…”.  Do I even have to say this one? Stack them, wire all pins in parallel except the SDA line, switch that one with the jumper.  “Ok, fine, but the SOT23-6 don’t stradle like that, ha!” Ok, fine, shave off half a pad, straddle the middle pin over that space.  “Hey, you should get some 30 gauge kynar wire for that, works great”.  I’d love some… oh, you’re not offering? well then, scrap 40pin IDE cable it is.  Some fantastically cheap 0.1″ female headers from ebay (not breakaway, but at these prices I can sacrifice a pin every time I want to shorten them), scrap male headers from an old motherboard, and a jumper from a dead IDE CD drive, and a bit of nearly new protoboard, now I’ve got a logic analyzer.


8 channel logic analyzer + ground pin

jumper to select which EEPROM

in line resistor protection

diode clamp protection

GND, 3.3v, 5v header (on the USBEE)

power button

Things I missed/messed up:

USBEE trigger and clock pins

ground pin should be on other side (to match Saleae)?

PORT D (remaining 8 pins for use with sigrok)


’C0-A9-08-05-00-84-23-00′. this is the VID:08A9 and PID:0005 for the USBee ZX device. ‘C0-25-09-81-38-1B-00-00’. This is the VID:0925 and PID:3881 for the Saleae device.

PORT B[0:7] => Saleae[purple:black] (I think that’s the correct order)


list of FX2 devices in sigrok

my board

what I’m trying to emulate

the other one I’m trying to emulate

original inspiration (gave me the EEPROM info in the comments)

gave me the Vid:Pid

lots of useful info, just not essential to my project

how to write the EEPROM if you don’t have any other way