[SOLVED] Project to replace CY7C64613 in the ICD2

[Andy_123]

Potyo: MAX4066 has 4 NO switches, but logic microchip has uses NC contacts.
Are you adding control line invertors as well?
I got DG411s, so I will try this weekend.

 

[potyo]

Hi
I will use 4066 to isolate MCLR, PGD and PGC lines of the icd2 from target, not to replace DG411. This is usual, if you want to use icd2 for programming only, and will use these pins of the target device regularly. This function will be selectable by jumper, so if you want to use icd2 as debugger, the cmos switches will be always on(approx 40Ω), if you want to use it as programmer, the swiches will be on only if 13V is present on the MCLR.

 

[Hal]

I got DG411s, so I will try this weekend.

I think, that very good idea is separating PC(USB) and ICD connector.
Ideal parts:
TLP176G (TOSHIBA) MOSFET optocoupler switch
and DCP010505B, DCP010512B (TI) miniature isolated DC/DC converters.


Rgds
Hal

 

[Lothar Stolz]

Hi everybody!

I've become aware of your great project a few days ago by your link placed in the guestbook of my page. Congratulations to your efforts getting Microchip's ICD2_4550_BOOT work!!!

Of course I have to try and build this USB-Clone now that silly Cypress isn't needed anymore hope I will soon find time...

I think the extra DC-DC-converter-IC could be easily abdicable. In industry, MCUs now often are taking over the switching-regulator part, too, and of course the 18f4550 present in the design contains everything needed, just coil, transistor and schottky to it! So I thought of patching the 18f4550 firmware with a simple (this are just a few lines) switcher algorithm (interrupt-driven, using ADC, one plain IO-pin (not necessarily PWM-pin)). Are there already any details known (unfortunately time is money :-/ ) about uC-resources allocated (you wrote about some interrupts, and TMR0) by the 18f4550-firmware? The software control would also give a flexible, software controlled Vpp like in real ICD2, no need for any digital poti!

In the schematics I saw a transistor design like the one of my first serial clone design is used, but you are using lower resistors and don't specify which type of the BC5x7-series-transistors (A to C: widely different gain!!) should be used. The initial idea of this MCLR-signal-generation with defined Rs was an inherit current limiting to prevent latch up of the target-PIC (this can occur when large currents flow (due to inner Cs) into MCLR when switching voltage levels). When driving the transistors with higher base currents(switch mode)/undefined gain then **there should be a small but few ohms resistor prior to the MCLR pin!!!!** to protect your target! It's just one cheap resistor!

Another possiblity for the MCLR-stage is the more easy-to-rebuild one-op-amp-concept as azn_oohwee already mentioned. In this design the op-amp itself limits current internally, simple, but (just to recall it): the op-amp design can't do float mode to MCLR pin! Well, normally it works without - but if not, possibly check about this!
And check the op-amp still drives enough current (named ICL7621 delivers only about 1mA max, am I wrong?)

ps, @andy: the reason I "abandoned" the DG411 two years ago: they *really* were not available for normal people (germany), that's all ;-) And well, transistors were switches too, always available, cheap, design should be easy-to-rebuild, so they had to do the job ;-). ok, now they ship almost everything as free samples when I order, but, sadly, for people not beeing in industry or student it's often impossible to this obtain special parts... :-/

But of course if you manage to get DG411, use it!!!

Best regards to all and keep it up!
Lothar

(Now, I have to go to bed fast, it was a long, long evening here in germany - you know if you're observing the soccer world championship... ;-) )

 

[Andy_123]

Wow,

Lothar is here! He found us!

I guess it will be an update at his site as soon as World Cup ends..

Anyway, DG411 sucsessfully tested, and I will make modifications to get this version out as well.
It may be even better to use 4:1 or 8:1 MUX but be careful replacing DG411 with other chips - DG411 has only 35 Ohm resistance while some other chips have up to 1.5K. And it can handle up to 20V signals.

Few notes: DG411 made by many vendors now, so you can get one cheap from your IC vendor.
Maxim gives it as a sample as well, but I can speak for US only - PLEASE DO NOT abuse sample system, or they will close the door...

Now about Lothar's idea to patch 4550 firmware - I would try to avoid this - Microchip may reload code once you are going from one MPLAB version to another and this will kill Vpp generator. They did it while going from 7.31 to 7.40

 

[szlovak]

Hi everybody!

I think the extra DC-DC-converter-IC could be easily abdicable. In industry, MCUs now often are taking over the switching-regulator part, too, and of course the 18f4550 present in the design contains everything needed, just coil, transistor and schottky to it! So I thought of patching the 18f4550 firmware with a simple (this are just a few lines) switcher algorithm (interrupt-driven, using ADC, one plain IO-pin (not necessarily PWM-pin)). Are there already any details known (unfortunately time is money :-/ ) about uC-resources allocated (you wrote about some interrupts, and TMR0) by the 18f4550-firmware? The software control would also give a flexible, software controlled Vpp like in real ICD2, no need for any digital poti!

In the schematics I saw a transistor design like the one of my first serial clone design is used, but you are using lower resistors and don't specify which type of the BC5x7-series-transistors (A to C: widely different gain!!) should be used. The initial idea of this MCLR-signal-generation with defined Rs was an inherit current limiting to prevent latch up of the target-PIC (this can occur when large currents flow (due to inner Cs) into MCLR when switching voltage levels). When driving the transistors with higher base currents(switch mode)/undefined gain then **there should be a small but few ohms resistor prior to the MCLR pin!!!!** to protect your target! It's just one cheap resistor!

I think that DC/DC is so simple circuit that there is no need to simplify it more.

And with MCLR resistor you are right, current should be limited. But for what value?

You are saying that chip could latch-up? I mean it is then locked or something? I'm just trying to reanimate pic16f877a . Could it be the reason? I didn't do any special thing to it, I don't know why ICD2 doesn't recognise it.

There is a simple solution for current limiting in this PCB. Simply adding resistor instead of junction near the USB socket and correcting the values for R25 and R27.

 

[Mike K8LH]

Now about Lothar's idea to patch 4550 firmware - I would try to avoid this - Microchip may reload code once you are going from one MPLAB version to another and this will kill Vpp generator. They did it while going from 7.31 to 7.40

I was also curious about ICD2 controlled variable VPP generation. I saw in original ICD2 schematic that MC used an MCP41010 digital pot and I was wondering if we could design a 12F683 VPP generator with SPI interface to emulate the 256 step digital pot? Would the ICD2 '877/A firmware adjust VPP? Does this seem feasable guys?

Regards, Mike

 

[Lothar Stolz]

@slovak:
PIC18f2550 datasheet, page363 (Absolute Maximum Ratings), note 2 says: "Voltage spikes below VSS at the MCLR/VPP/RE3 pin, inducing currents greater than 80 mA, may cause
latch-up. Thus, a series resistor of 50-100Ω should be used when applying a “low” level to the MCLR/VPP/
RE3 pin, rather than pulling this pin directly to VSS."

@mike: yes, that was exactly the topology i thought of!!!
But I think the Vpp must be feed back to an anolog input of the pic (eg. via the already existing voltage divider conected to pic16f877-analog-input) to get a loop because we don't know the load current, and it may vary.

@andy: when updating pic18f4550-firmware it won't change all the memory?!? is there any information about which areas get updated?

The topic got me, so I wrote some pseudo-code earlier that day ;-) :

it will hook only the interrupt vector (everything else unchanged) and could be placed anywhere in flash. the first time an interrupt occurs (the timer0 interrupt), it will setup itself (ADC). Then, everytime ADC conversion is complete, the algorithm is called by interrupt. Swithcer working in discontinuous mode.

without guarantee: ;-)

NewISR
btfss ADCON0, ADON ; is adc-module off?
bra ISRNoInit

movwf PREINC1 ; then initialize! on first (tmr0-)irq
movlw 0x01
movwf ADCON0
movlw 0x0E
movwf ADCON1
movlw 0x88
movwf ADCON2
clrf PREV_ADRESL
clrf PREV_ADRESH
bcf PWM_LAT, PWM_PIN
bcf PWM_TRIS, PWM_PIN
movf POSTDEC1, W

ISRNoInit btfss PIR1, ADIF
goto OldIntService

movff STATUS, PREINC1
movff BSR, PREINC1
movwf PREINC1

btfss PWM_LAT, PWM_PIN
bra ISRCont0
bcf PWM_LAT, PWM_PIN
bra ISREnd
ISRCont0

;if( ADRES < THRES1 )
; goto ISREnd;
movlw ( THRES1L )
subwf ADRESL, W
movlw ( THRES1H )
subwfb ADRESH, W
bnc ISREnd

;if( ADRES < THRES2 )
movlw ( THRES2L )
subwf ADRESL, W
movlw ( THRES2H )
subwfb ADRESH, W
bc ISRCont1
; if( ADRES > prevADRES )
; goto ISREnd
; movlb 0 banking?
movf ADRESL, W
subwf prevADRESL, W
movf ADRESH, W
subwfb prevADRESH, W
bnc ISREnd
ISRCont1

;if ADRES < THRES3 )
movlw ( THRES3L )
subwf ADRESL, W
movlw ( THRES3H )
subwfb ADRESH, W
bc ISRCont2
; then set pin!
bsf PWM_LAT, PWM_PIN
ISRCont2
ISREnd movff ADRESH, PREV_ADRESH
movff ADRESL, PREV_ADRESL

bcf PIR1, ADIF
bsf ADCON0, GO


movf POSTDEC1, W
movff POSTDEC1, BSR
movff POSTDEC1, STATUS
retfie 0


might be something like that?!? (just a thought...) ;-)

 

[Andy_123]

Lothar:

If you flash 4550 with 7.31 boot/FW and upgrade to 7.40, then 7.40 updates both Bootloader and Ffirmware.
How I know?
Because the original 4500 hex file had boot sector protection on and with 7.40 it will tell you that unable update boot.

See posts on the page 13 about 50% down and post by stroma about boot protect enabled (75% down)

New version of BOOT/FW may erase whole thing completely, so I would avoid modifying anything in 877.

I like Mike's approach with separate PIC instead of pot!
And RA3 is a Vpp feedback!

Did anyone try to read data coming to the POT?

 

[szlovak]

@slovak:
PIC18f2550 datasheet, page363 (Absolute Maximum Ratings), note 2 says: "Voltage spikes below VSS at the MCLR/VPP/RE3 pin, inducing currents greater than 80 mA, may cause
latch-up. Thus, a series resistor of 50-100Ω should be used when applying a “low” level to the MCLR/VPP/
RE3 pin, rather than pulling this pin directly to VSS."

I understand now. But the source of low state is derived from RC2 that can supply not too much and not directly from Vss

 

[sane3]

PIC16F84 or PIC16F877A

 

[Brem]

Did anyone try to read data coming to the POT?

No didn't do that, but I did read a disassemled version of the 877 OS. It first sends a 0x11, then the set value. It's shifted out over RB1 (slave select), RB6 (clock) & RB7 (data), MSB first. To adjust for a certain Vpp level it increases the setvalue from 0 until the correct Vpp level is reached. Vpp feedback is read from RA0 which should return 0.08V per step.

Here is some pseudo code from ICD06010202.hex where the setvalue is send, hope it's readable

    024D     SET STATUS.RP1, 0              ; * C3  &H01C9
    024E     SET STATUS.RP0, 0
    024F     SET PORTB.BIT1, 0                ; slave select
    0251     SET REG51, 0x11                  ; send 0x11 (command?)
    0252     CALL 0x0259
    0254     SET REG51, REG53                 ; send setvalue
    0255     CALL 0x0259
    0256     SET PORTB.BIT1, 1                ; unselect
    0257     CALL TMR0_Delay_216              ; delay 1 msec
    0258     RETURN
        
    0259; * C2  &H0252
    025A     SET BITCNT, 0x8
    025B     RLF REG51, F                   ; * G1 
    025C     IFEQ STATUS.CARRY, 0
    025D        GOTO 0x0260
    025E     SET PORTB.BIT7, 1
    025F     GOTO 0x0261
    0260     SET PORTB.BIT7, 0              ; * G1 
    0261     NOP                            ; * G1 
    0262     NOP
    0263     NOP
    0264     NOP
    0265     SET PORTB.BIT6, 1
    0266     NOP
    0267     NOP
    0268     NOP
    0269     NOP
    026A     SET PORTB.BIT6, 0
    026B     DECFSZ BITCNT, F
    026C        GOTO 0x025B
    026D     RETURN

 

[Andy_123]

Brem,

This code makes sence for me:
Command 0x11 is "write to pot #0"
See page 18 of this data sheet:
https://ww1.microchip.com/downloads/en/DeviceDoc/11195c.pdf

I just dont see how whey set and adjust value in REG53

Also I am not sure if they compare with RA0 or with RA3?
I would say it should be RA3, because RA0 measured at the PIC Target already and you don't want voltage to be very high to apply to the PIC.
RA3 is right after power supply and will be a good reliable feedback.

 

[R2D1]

Yo, I post the question just to earn enough points to get Andy's file, didn't expect so many quality posts in a few days.

The original ICD1 already use the simple switcher approach plus a 78L12 to give a fixed VPP. The PICKit 2 uses exactly the same approach to get a variable VPP. May be there's reason why the PICKit 2 support limited number of device and the ICD2 abandon this approach?

The D-POT + DC/DC converter is simple enough, if replacing with another controller, would it be possible to implement electrical isolation (controller on target side).

@Andy:

DG411 sucsessfully tested

Could you post your schematics?

Thanks!

 

[Andy_123]

See DG411 version on page 21

 

[Lothar Stolz]

@andy:

New version of BOOT/FW may erase whole thing completely

But in 4550, when it's updating itself, it is running some code (USB+reprogramming), so some kind of code area must be left untouched?

so I would avoid modifying anything in 877.

You mean 4550 (there I wanted to patch)? 877 firmware untouched, that's for sure!

Are there any 4550-flash-images available, before and after 7.31 to 7.40 update? Would be a great help!

 

[Andy_123]

Lothar

Yes, I mean 4550, not 877, sorry.
I don't really think that patching FW is better idea than using $2 small PIC

I don't have FW images before and after, because I have TQFP chips soldered and I can't read them once on PCB.
Maybe someone with DIP chips can do it.


This is just my guess, I can't confirm, but here is my scenario for upgrade from 7.31 to 7.40:

- MPLAB downloaded temporary USB bootloader into empty memory area.
- reset - you can hear USB disconnected and re-connected again using temp BL

- using temp bootloader MPLAB erased and downloaded new bootloader
- reset - you can hear USB disconnected and re-connected again using new BL

- Loaded 4550 FW using new bootloader.

 

[polymath]

Andy_123

I just dont see how whey set and adjust value in REG53

Line Addr Opcode Disassembly
590 024D 1303 BCF 0x3, 0x6
591 024E 1283 BCF 0x3, 0x5
592 024F 1086 BCF 0x6, 0x1
593 0250 3011 MOVLW 0x11
594 0251 00D1 MOVWF 0x51
595 0252 2259 CALL 0x259
596 0253 0853 MOVF 0x53, W
597 0254 00D1 MOVWF 0x51
598 0255 2259 CALL 0x259
599 0256 1486 BSF 0x6, 0x1
600 0257 22EC CALL 0x2ec
601 0258 0008 RETURN
602 0259 3008 MOVLW 0x8
603 025A 00CA MOVWF 0x4a
604 025B 0DD1 RLF 0x51, F
605 025C 1C03 BTFSS 0x3, 0
606 025D 2A60 GOTO 0x260
607 025E 1786 BSF 0x6, 0x7
608 025F 2A61 GOTO 0x261
609 0260 1386 BCF 0x6, 0x7
610 0261 0000 NOP
611 0262 0000 NOP
612 0263 0000 NOP
613 0264 0000 NOP
614 0265 1706 BSF 0x6, 0x6
615 0266 0000 NOP
616 0267 0000 NOP
617 0268 0000 NOP
618 0269 0000 NOP
619 026A 1306 BCF 0x6, 0x6
620 026B 0BCA DECFSZ 0x4a, F
621 026C 2A5B GOTO 0x25b
622 026D 0008 RETURN
623 026E 1486 BSF 0x6, 0x1
624 026F 1706 BSF 0x6, 0x6
625 0270 1786 BSF 0x6, 0x7
626 0271 0008 RETURN
627 0272 1486 BSF 0x6, 0x1
628 0273 1706 BSF 0x6, 0x6
629 0274 1386 BCF 0x6, 0x7
630 0275 0008 RETURN
631 0276 1486 BSF 0x6, 0x1
632 0277 1706 BSF 0x6, 0x6
633 0278 1386 BCF 0x6, 0x7
634 0279 0008 RETURN

This is the dissassembly using MChip instr.
The file 0x51 is loaded from W and not 'SET'

The 0x24D routine for writing to DPot is only called from 3 places:
0x01C9 .... 0x80 => #53 => DPot
0x02F4 ... 0xFF => #55 => #53 => DPot
0x0304 ... 0x00 => #53 => DPot

As only fixed values appear to go to DPot then there is NO feedback mechanism in this code. I have not looked in any other HEX.

Lothar

But in 4550, when it's updating itself, it is running some code (USB+reprogramming), so some kind of code area must be left untouched?

There is no reason why the whole 4550 could not be ALL reprogrammed whilst running.
It would need to be done in two sections by uploading a new section with another loader code in it - then running that loader code to overwrite the original loader with the second section of code. A little involved but quite feasible. - I will have to try it!

Andy - if you note the 4550 Enumerates twice in the process then you are probably right and the 4550 initiates two soft resets. By doing this MChip are not restriced to using the 4550 chip in future - any chip with USB and a soft reset will work without changing MPLAB code.

hope this helps - regards ... Polymath

 

[Brem]

Here is some more pseudo code from ICD06010202.hex (18C601 etc), including the variable pot setvalue, and the feedback.

    1182:ICD_Cmd_2A_SetChipType:            ; 
    1183     SET VPPMIN, 0xa0           ; 0xa0 * 0.08V =   12.8V    
    1185     SET VPPOPT, 0xa2           ; 12.96V
    1187     SET VPPMAX1, 0xa6          ; 13.28V
    118A     CALL 0x02F0
    118D     RETURN
...
    02F0; * C1  &H118A
    02F1     SET REG55, 0xff
    02F2; * G1 
    02F3     SET REG53, REG55
    02F4     CALL 0x024D
    02F5     CALL PROG_MCLR_Vpp
    02F6     CALL AD_Get_RA0
    02F7     CALL PROG_MCLR_GND
    02F9     SET REG56, 0x5
    02FA; * G1 
    02FC     IFLSS ADRESH, VPPOPT
    02FD        GOTO 0x0305
    02FE     DECFSZ REG56, F
    02FF        GOTO 0x02FA
    0300     DECFSZ REG55, F
    0301        GOTO 0x02F2
    0303     SET REG53, 0
    0304     CALL 0x024D
    0305     RETURN

In this firmware the pot setvalue is adjusted down from 0xff to 0. I dont know why, but in the firmware for other PICs its adjusted up (0->0xff). I dont think the POT can supply a Vpp high enough to destroy a PIC, because it seems to be measured/adjusted with Vpp suplied to the target.

 

[polymath]

Hi Brem

Yes you are right - the +Vpp is loop controlled - I had not looked for a jump into the SPI output routine.

I have checked several HEX files and some are INCFSZ and some are DECFSZ on DPOT control.

It will not matter IF the target +Vpp is not enabled (through DG411) until the correct value has been reached. I have not checked program flow.

Output of DG411 will be Hi-Z until bit0 of buffer file is reset and file is moved to PORTC. Buffer file is used to ensure Break-Before-Make on DG411.

Info: for those in UK, DG411 ICs are available from:
**broken link removed**

regards ... Polymath