BUS PIRATE: Ultra v1c board update

Bus Pirate prototype “Ultra” version 1c is technically done, but we came up with some hot last minute additions this weekend. We’ll skip this board and send out the updated version 1d with the additional features at the end of the week.

Version 1c changes:

  • 4 layer PCB
  • 1MHz 12 bit SPI ADC connected directly to the FPGA
  • Vout/Vref is also measured through the analog multiplexer, which is changed to to the bigger 16bit version (74HCT4067). This will probably change to two 74HCT4051s instead because supplies of the 4067 are skimpy! We can have one “divide by two” 4051 for 5volt measurements on the IO pins, and one 3.3volt 4051 tied directly to the ADC for measuring lower voltage analog stuff
  • Beefier 3.3volt supply
  • The 1.2volt supply is now monitored by the MCU for self testing
  • 0.5mm flex cable connector for the display board opens up a bit of board space
  • Additional ADC measurement point before the back-current shut down protection on the power supply. This gives us a way to include it in the self test and detect when it activates

Boards and schematics are in our git repo, and you can follow the latest developments in the forum.

BUS PIRATE: pin order and cable colors

The Bus Pirate pinout was supposed to be intuitive, except for one Arduino-like mistake.

Each protocol uses the same pin for similar functions, and the pins used are supposed to “walk” up the row. 1-Wire uses Master Out Slave In (MOSI, pin number 1). I2C uses MOSI (1) and CLOCK (2). UART uses MOSI (1) and Master In Slave Out (MISO, 3). SPI uses MOSI (1), CLOCK (2), MISO(3), and Chip Select (CS,4).

It should have been a nice intuitive progression, except for the unfortunate use of a hideous 2x5pin IDC connector. It’s hard to recall why we used this connector. Probably to keep the board small, provide a keyed connector, and likely because it was in our parts box.

The IDC connector was a poor choice. Not only is it ugly, probes end up using crappy ribbon cable that makes it look even worse. The connector was added without regard for the proper pin order, and used something hard to remember – MISO, CS, MOSI, CLK. Once it was loose in the wild we were stuck with that convention, and that’s how Bus Pirates have been produced for over 10 years!

Bus Pirate Ultra uses a 1x10pin connector called TJC8 2.54mm or 2543 by Chinese suppliers. It’s keyed, but also fits common 2.54mm “DuPont” connectors laying around most workshops. The pinout is DIO1 to DIO8, Vout, and Ground. Each protocol mode is in charge of naming the DIO pins, and the labels are displayed on the LCD above the connector.

We also want to give some thought to the color codes used on the pinout display and probe cables. Typically cable manufacturers stock wire in ten colors: red, orange, yellow, green, blue, purple, gray, white, black, and brown.

Goal one is to make the power and ground pins an intuitive color pair. Black and red, white and black, maybe even red and green. A color pair that a beginner in electronics has probably seen somewhere before.

Goal two is to follow the rainbow. Most people are probably familiar with ROY G BIV, the acronym for the order of colors in a rainbow. We want to start with red and progress downwards in a logical order so that pin one is instantly obvious, and the pins can be identified in a tangled messy probe cable without tracing them back to the source. Indigo and violet colored cable isn’t standard and the colors are hard to tell apart, so they’re usually substituted with purple and brown.

Pin 1 (DIO1) is assigned red. DIO2 to DIO7 are assigned orange, yellow, green, blue, purple and brown. With three colors remaining (gray, black, white), white and black are the obvious choice for the power/ground pin pair. Grey is assigned to DIO8.

Eventually we’ll need to choose good quality wire and some decent probe hooks for the cable. Sigrok, the open source logic analyzer software project, has a good overview of probe hook options. The rest of this week we’ll work on getting the firmware cleaned up and Ultra v1c board routed. As always, you can follow our latest progress in the forum.

BUS PIRATE: 2bit anti aliased font for small color LCDs

Bus Pirate prototype “Ultra” v1b has an IPS LCD to show pinout labels, voltage levels, and other useful info. The background image was done in Photoshop and is stored in the 32Mbit flash chip on the board. Pin labels and voltage readings are drawn on top of the background image with a fixed-width font.

1bit font generator by maxpromer

Most LCD fonts represent each pixel with a single bit (on or off). This is an efficient way to store a font, but the results look jagged and unprofessional. To get a better look, we anti aliased an open source font and then extracted two bits per pixel of color data. The results, shown above, use a four color lookup table to represent the background, text color, and two intermediate colors for anti aliased pixels.

Anti aliasing smooths the edges of each letter with a few pixels in intermediate colors. The bottom line of text is not processed at all, angular and circular edges look jagged and stepped. The top four lines of text use various styles of anti aliasing and the edges appear smoother on a small display.

Real-time anti aliasing on the MCU will take too many resources, so we made a pre-anti aliased font. Instead of storing each pixel as a single bit, we use 2bits of data per pixel and a four color lookup table to draw the characters. The resulting font takes twice as much space as a one bit font, but the extra bit (two extra colors) are used for those nice fuzzy edges.

The background image is designed for characters 14 pixels tall. It’s important to choose a fixed-width monospaced font so that each character has even spacing. We used DejaVu Mono, an open source fixed-width font that is used in Linux. At 14 pixels tall the characters are 10 pixels wide. Our characters will be 10×14 at 2 bits per pixel, that’s 35 bytes each.

In Photoshop we used View->New Guide Layout to create a 10×14 pixel grid, then added the typical range of ASCII characters. We skipped a box between each character so that any stray anti aliased pixels that fall outside the box don’t get included in a neighboring character. We tried several types of anti aliasing, and decided “Windows LCD” looks best on our small display.

At this point we have a grid of nicely anti aliased characters, but Photoshop is using dozens of different colored pixels to make those smooth edges. Before we process the character set we need to reduce that to something manageable. The simplest enhancement to a 1 bit font is to add an extra bit. 2 bits per pixel provides a four color pallet: text, background, and two shades of grey for the anti aliased pixels. We converted the characters to a four color pallet in Photoshop with Image->Mode->Indexed color, then assigned a four color custom pallet and saved the result as a 8bit color bitmap.

Bus Terminal has become a dumping ground for our utility scripts. A small addition loads the font image, crops each character, and outputs the font variables as HEX numbers. The font output goes into a font.h file to include in the Bus Pirate firmware.

lcd.c demonstrates how to use the 2 bit font. Our display uses 16 bits per pixel in 565RGB mode. font_lut16RGB contains our pallet of 4 16 bit color codes. We prefer to start with 24 bit color codes because they’re ubiquitous, so we enter our colors into font_lut24 and pre-calculate the 16 bit color values during initialization. Our color pallet includes the background image color, a white shade for the character, and two grey tones for the anti aliased pixels.

To write a character we loop through the 35 bytes of data, pulling out 2 bits at a time. Each two bit set is used to lookup a color code in the lookup table. The color code is sent to the display via SPI. A lot of data has to be moved to write a single character, 280 bytes each for this font.

This is an example of different anti aliasing methods (sharp/crisp/strong/smooth) using 2 bits/pixel. The line on the bottom has no anti aliasing. Without anti aliasing the bottom line is jagged and rough. The other lines add one bit (two indexed colors) for anti aliasing and look remarkably better, even without tweaking.

Taking it further

The 2 bit font looks much better than a 1 bit font. This same technique could be used to extract 3 or more bits of color data per pixel, but that eventually feels like reinventing the PNG.

This is very much a hack in progress. A few tweaks the pallet during conversion to indexed color that will probably make it look much nicer. Some of the characters in the set hang below the outline, so g, q and p are cut off. While Photoshop is good for extensive tweaking, it’s going to take a lot of effort to make font in different sizes.

It seems possible to render each character, anti alias it, and reduce it to indexed color using Qt libraries like QPaint and QPixelmap. The Photoshop side could be automated in Qt to export any system font in any size with minimal hassle.

Chinese cable and connector vocabulary

Bus Pirate prototype “Ultra” v1c will use a 0.5mm flex cable (FFC/FPC) to connect the display board. Of course we could just order the standard parts from Mouser or SZLCSC, but rooting around on Taobao is fun and gives a better idea of the range of stuff out there. Here’s some Chinese vocabulary that helped us order parts.

Cables that are connected 1:1, pin one of one connector is wired to pin 1 of the other connector, are called 反向. Cables that are connected 1:N, pin one of one connector is wired to the highest number pin of the other connector, are called 同向. We ordered the wrong version of the 1.25mm display cable for v1b, but fortunately the crimps can be carefully removed and replaced in reverse order. This won’t be an option with the flex connector.

Most FPC/FFC connectors are available in two types. Metal contacts on the bottom of the connector slot are called 下接. Metal contacts along the top of the connector slot are called 上接.

Orientation is really important because FPC/FFC cables generally only have contacts exposed on one side of each end. FPC/FFC cables are also available in 反向 / 同向 (1:1/1:N), meaning the exposed contacts are on the same side or opposite side of the ends. We’ll post some photos of these cables when they arrive.

BUS PIRATE: LCD with pinout labels and live info

The Bus Pirate prototype “Ultra” v1b has a 10 pin 1.25mm connector for a display daughterboard. We wanted a more dynamic way to keep track of the pinout and other handy information like pin states and voltage levels.

There are various reference stickers and labeled probe cables for the Bus Pirate v3 and v4, but a display frees us from strict pinout conventions and makes setup a lot easier for new hackers. More on the display below.

We wanted to use ePaper!

At first we really wanted to use ePaper. A static, easily readable display is reminiscent of the stickers it replaces, and makes reference to its primary purpose as a label. The slow update speeds also dampen expectations of flashy graphics and interaction.

The three color ePaper shown above was a top candidate, but it requires 180 seconds of rest between updates to stay in spec. Slow updates are acceptable, but we need to be able to change the display more frequently than once every three minutes.

While the two color version of this display doesn’t have this limitation, we ultimately decided that the Dots Per Inch is just too low to look really good. ePaper is also quite expensive compared to IPS LCDs with much higher pixel density.


Our attention turned to inexpensive LCDs. These are not the dodgy panels with limited color and ever-changing driver chips you may have used in the past. About $3 buys a 240×320 pixel 2 inch IPS (view from every angle) display supporting 250K colors, with a simple SPI interface and well known driver chip. We bought samples from two manufacturers, a QT020HLCG00 and a HT020SQV003NS.

With a bunch of colors and the ability to constantly update, we can show a lot of useful info. Each pin has a proper name corresponding to the active mode, along with input/output direction indication. Color caps on each pin match the probe cable wires, the terminal interface and the logic analyzer client.

Starting with v1b we can measure voltage on all 8 IO pins, so we’ll show that on the display. We’re particularly excited about this feature because we always end up jugging multimeter probes to verify levels during a rough hack. Now we can just look at the display!

Both LCDs are approximately the same dimensions, but the solderable flex connector is a slightly different length. The LCD daughterboard has extra long pads that fit both displays. The files for the display board are in the git repo.

The image on this LCD is just a static mock-up exported from Photoshop. Next we’ll need to create a font and write actual values to the display. This is will be tricky because LCD fonts typically look jagged and ugly, and we don’t really have enough power to do anti aliasing on the fly. Follow our latest progress in the forum.

BUS PIRATE: Love the USB C connector!

Bus Pirate prototype Ultra v1b uses a common, cheap USB C connector and we are in love!

Micro B connectors are a nightmare. Very inconsistent footprints, poor materials and build quality, and very weak mounting supports. Often the leads are hidden under the housing and conceal pesky shorts. Almost every Micro B connector we hand soldered eventually broke off the board and usually took some traces with it.

USB C solved all these issues! Soldering it is an absolute breeze. Leads are easily accessible and friendly to solder. It’s made of decent materials, and the footprint seems to be pretty standardized across the market. The mounting posts are solid and strong, this connector isn’t going anywhere.

Here’s how we connected it on the v1b hardware. The footprint was made by Sjaak at SMDprutser and is in our git repo.

PROTOTYPE: Bus Pirate “Ultra” v1b

Today we finished stuffing the first Bus Pirate “Ultra” v1b board. This includes the updates we posted this week, and a few other improvements from v1a:

The new power supply and voltage measurement concept are both tested and working on the new hardware. The new USB C connector is extremely solid and is a dream to solder, we’ll never look back.

Next we’ll work on getting the display going. So far it powers up and no smoke escapes.

Eagle files for v1b are in the git repo. Follow development of v1c in the forum.

Bus Pirate: Reclaiming the Vpullup pin

The Bus Pirate Vpullup pin supplies a voltage to the on-board pull-up resistors. In the “Ultra” hardware it also powers the external half of the bi-directional IO buffer.

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. AUX4 (formerly 3.3Volts)
  9. 0.8-5.0Vout (formerly 5.0Volts)
  10. GND

So far we’ve added voltage measurement to every IO pin and removed the dedicated ADC pin. We also replaced the fixed 3.3volt and 5volt power supplies with a single programmable output power supply (Vout) capable of 0.8-5.0volts output at 300mA. Today we’re going to reclaim the Vpullup pin and dig into the on-board pull-up resistor system.

On-board pull-up resistors

Many common buses like I2C and 1-Wire won’t work at all without pull-up resistors. Pull-up resistors are also commonly used in voltage level translation. The Bus Pirate can only directly interface at 3.3volts, but using open drain outputs with pull-up resistors it can interface with devices running at 2-5.5volts.

The Bus Pirate has on-board pull-up resistors on the four main bus pins (MOSI, CLOCK, MISO, CS) of the IO header. The pull-ups are toggled in the terminal with the P/p commands.

MOSI is used in the 1-Wire protocol. Several 1-Wire devices are parasitically powered from the pull-up resistor and require no additional power supply. These devices typically require a lower value pull-up resistor than other buses. The Bus Pirate has a 2K pull-up resistor on MOSI to properly power 1-Wire devices, while the other pins have 10K pull-up resistors.

74HCT4066 analog switch applies Vpullup voltage to a resistor attached to MISO pin.

The Vpullup voltage is switched onto the pull-up resistors through a 74HCT4066 analog switch. This is an effective solution, but there’s an annoying waste of pins when the 4066 is used this way.

Merge the Vpullup functions into the Vout pin

Pull-up source select on v5 prototype.

In the past it made sense to have a dedicated Vpullup pin so the user can connect it to one of the two on-board power supplies (3.3volts, 5volts), or the supply of an external circuit. We tried to automate this from the terminal in various prototypes using FETs, analog switches and other methods.

Since we’ve combined the on-board supplies into a single Vout pin, let’s also power the pull-up resistors and bi-directional IO buffer the Vout pin. The Vout/Vref pin now has two uses:

  1. Programmable power supply output from 0.8-5.0volts that powers the IO buffers and pull-up resistors (when enabled)
  2. Voltage reference input that powers the IO buffers and pull-up resistors (when enabled) from an external supply (e.g. self-powered breakout board)

We lose the ability to run the pull-up resistors and the programmable output power supply at different voltages. This could matter when Vout is used as the external supply for a board with its own voltage regulator.

Adjustable pull-up/down resistors?

MCP44X2 I2C digital quad rheostat. Source: MCP44X2 datasheet page 1.

This is definitely overkill, but let’s go “Ultra” for a moment. MCP4442-10K is an I2C controlled digital rheostat with 4 10K resistors. Each resistor can be disabled or connected to 127 taps between 10K and 0R.

Unfortunately we run into pesky bandwidth issues again, the same reason we couldn’t use this chip in the programmable output power supply. The 10K version of the MCP4442 only has 1MHz of bandwidth, which means the maximum speed the internal circuit can adjust to changes in signals. A lot of common buses support speeds above 1MHz. Linear Devices has several precision digital pots with much higher bandwidth, but they’re far too expensive to justify replacing the current cheap and dirty setup.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. AUX3 (formerly Vpullup)
  8. AUX4 (formerly 3.3Volts)
  9. 0.8-5.0Vout/Vref (formerly 5.0Volts)
  10. GND

With the Vpullup pin features safely tucked into the Vout pin, we can add an eighth general purpose IO pin to the header (AUX3). Vout is renamed Vout/Vref to identify its dual power output and reference input functions.

The final thing to do is add a second 4066 so all 8 IO pins have a pull-up resistor.

Next time we’ll try to find a better way to label the IO header pinout. If you want to skip the wait, our latest work is in the forum.

BUS PIRATE: 0.8-5.0volt programmable output power supply

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpu
  8. 3.3V
  9. 5.0V
  10. GND

After adding buffered voltage measurements to every IO pin, we eliminated the dedicated ADC pin and turned it into a general purpose IO (AUX2). Now we’re going to take a hatchet to the on-board voltage regulators (3.3V, 5.0V) and replace them with a robust programmable output power supply.

Power supplies background

On-board power supplies are toggled with w and W.

The Bus Pirate has two on-board voltage regulators that can power a board or chip. The supplies are enabled with the W and w commands. The Bus Pirate supplies the two most common voltages through two dedicated pins because it was the simplest approach and it “just works”.

3.3volt and 5.0volt on-board power supplies.

The Bus Pirate has always had a 5volt regulator because so much hobby electronics stuff like the Arduino runs at 5volts. 3.3volts is very popular in more modern systems, such as the Bus Pirate itself. However, there’s no reason you couldn’t swap those regulators with a compatible part with output in the 0-5volt range.

Common SOT-23-5 LDO regulator with shutdown pin. Source: MCP1801 datasheet page 1.

There are tons of manufacturers of SOT-23-5 low drop out voltage regulators with a shutdown pin that use the same footprint and have somewhat similar specs. We specify the Microchip MCP1801 in new designs.

Programmable output power supply

5volts and 3.3volts are useful voltage nodes for everyday hacking. A more useful power supply would be programmable from the terminal, and cover as wide a range as possible ( 0.8, 1.2, 1.8, 2.5, 3.0, 3.3, 5.0volts).

There are a few ways to concoct a programmable supply. A simple buck converter driven by a PWM pin with feedback through an ADC is a very cheap solution, but it has no safety features whatsoever. A dedicated buck converter chip is a better option, but still has the potential to be a big source of noise on the board.

MCP1824 adjustable output LDO. Output set by R1 and R2. Source: MCP1824 datasheet page 3

Ideally, we’d like to abuse an adjustable low drop out regulator because they have very clean output with built-in current protection, short circuit protection and thermal protection. MCP1824 is adjustable from 5volts all the way down to 0.8volts, the output voltage is set by feedback resistors R1 and R2. One way to make the output programmable is an array of different resistor values selected (grounded) by an IO expander or MCU pin. This would give steps, but not the full range.

Another option is a digital potentiometer or rheostat. In our experience it’s difficult to satisfy the feedback/adjust requirements of most LDOs while also getting a usable range of output voltages using a digital pot. Additionally, digital pots have very low bandwidth and inexpensive chips like the MCP444x are unsuitable for this purpose.

Output from U14 margins the adjustment voltage of IC12 through R30, R31, R32.

Texas Instruments has a video and tutorial explaining how to offset (or margin) the feedback voltage of an LDO using an op-amp driven by a Digital to Analog Converter or Pulse Width Modulator. It just so happens our STM32F103 has two DACs. The DACs have an optional internal buffer, but the internet suggests it’s not really rail to rail.

The output of the DAC is applied to the non-inverting input of an op-amp. The op-amp output margins the feedback voltage on the MCP1824 ADJ pin through R30, R31, R32. The values for the resistors were calculated to give 0.8-5.0volt output range with 0-3.3volt DAC output.

Always use protection

PFET Q2 acts as a diode to protect the power supply.

The output of the adjustable regulator goes into a nifty little circuit (Q1, Q1B, Q2, R34, R35) that acts like a diode but has negligible voltage drop. A PFET (Q2) is used as an ideal diode to stop current backflow if an external power supply is present.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. AUX4 (formerly 3.0Volts)
  9. 0.8-5.0Vout (formerly 5.0Volts)
  10. GND

Both on-board regulators (3.3, 5volts) could be swapped with programmable output power supplies, but that seems like overkill. Pin 9 becomes a 0.8-5.0volt power supply named Vout, while pin 8 is now available for general purpose IO and is renamed AUX4.

We have very nearly reached our goal of 8 IO pins! Next we’ll rethink the Vpullup pin and the on-board pull-up resistors. If you want to skip the wait, our latest work is in the forum.

BUS PIRATE: Voltage measurement on every pin

Bus Pirate Ultra v1a follows the same pinout as previous versions. 5 I/O pins (MOSI, CLOCK, MISO, CS, AUX), a voltage probe (ADC), a voltage source for the on-board pull-up resistors (Vpu), two power supplies (3.3, 5.0volts) and ground. While we were building the prototype it became obvious that a few tweaks could make a much more useful tool.

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. ADC
  7. Vpu
  8. 3.3V
  9. 5.0V
  10. GND

This is the starting pinout. In this post we’ll update the voltage/ADC probe to measure voltage on every IO pin, and free up a pin for general purpose use.

Measuring voltage with the Bus Pirate ADC pin.

The voltage probe (ADC pin) is useful for checking the output of a digital to analog converter (DAC), verifying a supply voltage, or almost anything you’d do with a multimeter. The d command takes a single voltage measurement, while the D command takes continuous measurements.

Problems with the resistor voltage divider approach

The Bus Pirate runs at 3.3volts, but we still want to measure within the most common 0-5.0volt range used in hobby electronics. To bring the voltage into range, the Bus Pirate uses two 10K resistors to divide the measured voltage in half. Now we can safely measure a voltage in the range of 0-6.6volts using an analog digital converter with a maximum input of 3.3volts.

This is a super effective and simple approach, but it adds a 20K resistive load to the pin at all times. This load makes the pin less useful for digital IO, so the ADC has always been a dedicated pin without any other functions.

Adding a unity gain op-amp buffer

Input from IO_PIN is buffered by the op-amp and then divided in half for ADC1.

One obvious way to eliminate the load on the ADC pin is to buffer the voltage divider with an op-amp. The op-amp input is extremely low impedance and has negligible impact on the signal we’re measuring.

An MCP6001 is a cheap general purpose op-amp (U15) with common mode voltage that extends 0.25volts beyond the power and ground rails. Using it in a unity gain configuration buffers the input voltage (IO_PIN), which then goes through the voltage divider (RN3D, RN3C) to be measured by the ADC (ADC1). A few current limiting resistors and protection diodes suggested in the datasheet help ruggadize the op-amp for abuse during hacking.

Voltage measurement on every IO pin

A 74HCT4051 analog multiplexer selects which IO pin connects to the op-amp.

Without that nasty 20K load the ADC pin can be a general purpose digital IO. While we could dedicate an op-amp and ADC to measure each IO pin, that’s a lot of routing and resources. Instead, each IO pin connects to a 74HCT4051 8:1 analog multiplexer that selects which IO pin to measure with a single op-amp and ADC.

Three FPGA pins select one of the 8 analog inputs to measure. The FPGA is in control, rather than the MCU, so that we are ready to add an external high-speed ADC in the future.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. 3.3volts
  9. 5.0volts
  10. GND

Using a single analog mux and op-amp we can measure the voltage on every Bus Pirate IO pin. The dedicated ADC pin is cast into the dustbin of history, and we gain a new digital pin that we’ll call AUX2 for now.

Taking it further

1 x 10P connector on v1a (1)

6 IO pins is definitely better than 5. Wouldn’t it be great to have even more? Our goal is to get to 8 digital IO pins. That’s enough to interface nearly any serial bus, and it’s the logical number of channels for a proper logic analyzer.

At the same time, we’d like to stick with the 2.54mm 10 pin IO header (1) we’ve been using in recent prototypes. It fits common jumper cables we have in the parts box, but could also accept a nice keyed custom cable.

Next we’ll rethink the function of the on-board power supplies and pull-up resistors. To skip the wait, see our most recent progress in the forum.