BUS PIRATE: LCD with pinout labels and live info

The Bus Pirate prototype “Ultra” v1b has a 10 pin 1.25mm connector for a display daughterboard. We wanted a more dynamic way to keep track of the pinout and other handy information like pin states and voltage levels.

There are various reference stickers and labeled probe cables for the Bus Pirate v3 and v4, but a display frees us from strict pinout conventions and makes setup a lot easier for new hackers. More on the display below.

We wanted to use ePaper!

At first we really wanted to use ePaper. A static, easily readable display is reminiscent of the stickers it replaces, and makes reference to its primary purpose as a label. The slow update speeds also dampen expectations of flashy graphics and interaction.

The three color ePaper shown above was a top candidate, but it requires 180 seconds of rest between updates to stay in spec. Slow updates are acceptable, but we need to be able to change the display more frequently than once every three minutes.

While the two color version of this display doesn’t have this limitation, we ultimately decided that the Dots Per Inch is just too low to look really good. ePaper is also quite expensive compared to IPS LCDs with much higher pixel density.


Our attention turned to inexpensive LCDs. These are not the dodgy panels with limited color and ever-changing driver chips you may have used in the past. About $3 buys a 240×320 pixel 2 inch IPS (view from every angle) display supporting 250K colors, with a simple SPI interface and well known driver chip. We bought samples from two manufacturers, a QT020HLCG00 and a HT020SQV003NS.

With a bunch of colors and the ability to constantly update, we can show a lot of useful info. Each pin has a proper name corresponding to the active mode, along with input/output direction indication. Color caps on each pin match the probe cable wires, the terminal interface and the logic analyzer client.

Starting with v1b we can measure voltage on all 8 IO pins, so we’ll show that on the display. We’re particularly excited about this feature because we always end up jugging multimeter probes to verify levels during a rough hack. Now we can just look at the display!

Both LCDs are approximately the same dimensions, but the solderable flex connector is a slightly different length. The LCD daughterboard has extra long pads that fit both displays. The files for the display board are in the git repo.

The image on this LCD is just a static mock-up exported from Photoshop. Next we’ll need to create a font and write actual values to the display. This is will be tricky because LCD fonts typically look jagged and ugly, and we don’t really have enough power to do anti aliasing on the fly. Follow our latest progress in the forum.

BUS PIRATE: Love the USB C connector!

Bus Pirate prototype Ultra v1b uses a common, cheap USB C connector and we are in love!

Micro B connectors are a nightmare. Very inconsistent footprints, poor materials and build quality, and very weak mounting supports. Often the leads are hidden under the housing and conceal pesky shorts. Almost every Micro B connector we hand soldered eventually broke off the board and usually took some traces with it.

USB C solved all these issues! Soldering it is an absolute breeze. Leads are easily accessible and friendly to solder. It’s made of decent materials, and the footprint seems to be pretty standardized across the market. The mounting posts are solid and strong, this connector isn’t going anywhere.

Here’s how we connected it on the v1b hardware. The footprint was made by Sjaak at SMDprutser and is in our git repo.

PROTOTYPE: Bus Pirate “Ultra” v1b

Today we finished stuffing the first Bus Pirate “Ultra” v1b board. This includes the updates we posted this week, and a few other improvements from v1a:

The new power supply and voltage measurement concept are both tested and working on the new hardware. The new USB C connector is extremely solid and is a dream to solder, we’ll never look back.

Next we’ll work on getting the display going. So far it powers up and no smoke escapes.

Eagle files for v1b are in the git repo. Follow development of v1c in the forum.

Bus Pirate: Reclaiming the Vpullup pin

The Bus Pirate Vpullup pin supplies a voltage to the on-board pull-up resistors. In the “Ultra” hardware it also powers the external half of the bi-directional IO buffer.

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. AUX4 (formerly 3.3Volts)
  9. 0.8-5.0Vout (formerly 5.0Volts)
  10. GND

So far we’ve added voltage measurement to every IO pin and removed the dedicated ADC pin. We also replaced the fixed 3.3volt and 5volt power supplies with a single programmable output power supply (Vout) capable of 0.8-5.0volts output at 300mA. Today we’re going to reclaim the Vpullup pin and dig into the on-board pull-up resistor system.

On-board pull-up resistors

Many common buses like I2C and 1-Wire won’t work at all without pull-up resistors. Pull-up resistors are also commonly used in voltage level translation. The Bus Pirate can only directly interface at 3.3volts, but using open drain outputs with pull-up resistors it can interface with devices running at 2-5.5volts.

The Bus Pirate has on-board pull-up resistors on the four main bus pins (MOSI, CLOCK, MISO, CS) of the IO header. The pull-ups are toggled in the terminal with the P/p commands.

MOSI is used in the 1-Wire protocol. Several 1-Wire devices are parasitically powered from the pull-up resistor and require no additional power supply. These devices typically require a lower value pull-up resistor than other buses. The Bus Pirate has a 2K pull-up resistor on MOSI to properly power 1-Wire devices, while the other pins have 10K pull-up resistors.

74HCT4066 analog switch applies Vpullup voltage to a resistor attached to MISO pin.

The Vpullup voltage is switched onto the pull-up resistors through a 74HCT4066 analog switch. This is an effective solution, but there’s an annoying waste of pins when the 4066 is used this way.

Merge the Vpullup functions into the Vout pin

Pull-up source select on v5 prototype.

In the past it made sense to have a dedicated Vpullup pin so the user can connect it to one of the two on-board power supplies (3.3volts, 5volts), or the supply of an external circuit. We tried to automate this from the terminal in various prototypes using FETs, analog switches and other methods.

Since we’ve combined the on-board supplies into a single Vout pin, let’s also power the pull-up resistors and bi-directional IO buffer the Vout pin. The Vout/Vref pin now has two uses:

  1. Programmable power supply output from 0.8-5.0volts that powers the IO buffers and pull-up resistors (when enabled)
  2. Voltage reference input that powers the IO buffers and pull-up resistors (when enabled) from an external supply (e.g. self-powered breakout board)

We lose the ability to run the pull-up resistors and the programmable output power supply at different voltages. This could matter when Vout is used as the external supply for a board with its own voltage regulator.

Adjustable pull-up/down resistors?

MCP44X2 I2C digital quad rheostat. Source: MCP44X2 datasheet page 1.

This is definitely overkill, but let’s go “Ultra” for a moment. MCP4442-10K is an I2C controlled digital rheostat with 4 10K resistors. Each resistor can be disabled or connected to 127 taps between 10K and 0R.

Unfortunately we run into pesky bandwidth issues again, the same reason we couldn’t use this chip in the programmable output power supply. The 10K version of the MCP4442 only has 1MHz of bandwidth, which means the maximum speed the internal circuit can adjust to changes in signals. A lot of common buses support speeds above 1MHz. Linear Devices has several precision digital pots with much higher bandwidth, but they’re far too expensive to justify replacing the current cheap and dirty setup.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. AUX3 (formerly Vpullup)
  8. AUX4 (formerly 3.3Volts)
  9. 0.8-5.0Vout/Vref (formerly 5.0Volts)
  10. GND

With the Vpullup pin features safely tucked into the Vout pin, we can add an eighth general purpose IO pin to the header (AUX3). Vout is renamed Vout/Vref to identify its dual power output and reference input functions.

The final thing to do is add a second 4066 so all 8 IO pins have a pull-up resistor.

Next time we’ll try to find a better way to label the IO header pinout. If you want to skip the wait, our latest work is in the forum.

BUS PIRATE: 0.8-5.0volt programmable output power supply

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpu
  8. 3.3V
  9. 5.0V
  10. GND

After adding buffered voltage measurements to every IO pin, we eliminated the dedicated ADC pin and turned it into a general purpose IO (AUX2). Now we’re going to take a hatchet to the on-board voltage regulators (3.3V, 5.0V) and replace them with a robust programmable output power supply.

Power supplies background

On-board power supplies are toggled with w and W.

The Bus Pirate has two on-board voltage regulators that can power a board or chip. The supplies are enabled with the W and w commands. The Bus Pirate supplies the two most common voltages through two dedicated pins because it was the simplest approach and it “just works”.

3.3volt and 5.0volt on-board power supplies.

The Bus Pirate has always had a 5volt regulator because so much hobby electronics stuff like the Arduino runs at 5volts. 3.3volts is very popular in more modern systems, such as the Bus Pirate itself. However, there’s no reason you couldn’t swap those regulators with a compatible part with output in the 0-5volt range.

Common SOT-23-5 LDO regulator with shutdown pin. Source: MCP1801 datasheet page 1.

There are tons of manufacturers of SOT-23-5 low drop out voltage regulators with a shutdown pin that use the same footprint and have somewhat similar specs. We specify the Microchip MCP1801 in new designs.

Programmable output power supply

5volts and 3.3volts are useful voltage nodes for everyday hacking. A more useful power supply would be programmable from the terminal, and cover as wide a range as possible ( 0.8, 1.2, 1.8, 2.5, 3.0, 3.3, 5.0volts).

There are a few ways to concoct a programmable supply. A simple buck converter driven by a PWM pin with feedback through an ADC is a very cheap solution, but it has no safety features whatsoever. A dedicated buck converter chip is a better option, but still has the potential to be a big source of noise on the board.

MCP1824 adjustable output LDO. Output set by R1 and R2. Source: MCP1824 datasheet page 3

Ideally, we’d like to abuse an adjustable low drop out regulator because they have very clean output with built-in current protection, short circuit protection and thermal protection. MCP1824 is adjustable from 5volts all the way down to 0.8volts, the output voltage is set by feedback resistors R1 and R2. One way to make the output programmable is an array of different resistor values selected (grounded) by an IO expander or MCU pin. This would give steps, but not the full range.

Another option is a digital potentiometer or rheostat. In our experience it’s difficult to satisfy the feedback/adjust requirements of most LDOs while also getting a usable range of output voltages using a digital pot. Additionally, digital pots have very low bandwidth and inexpensive chips like the MCP444x are unsuitable for this purpose.

Output from U14 margins the adjustment voltage of IC12 through R30, R31, R32.

Texas Instruments has a video and tutorial explaining how to offset (or margin) the feedback voltage of an LDO using an op-amp driven by a Digital to Analog Converter or Pulse Width Modulator. It just so happens our STM32F103 has two DACs. The DACs have an optional internal buffer, but the internet suggests it’s not really rail to rail.

The output of the DAC is applied to the non-inverting input of an op-amp. The op-amp output margins the feedback voltage on the MCP1824 ADJ pin through R30, R31, R32. The values for the resistors were calculated to give 0.8-5.0volt output range with 0-3.3volt DAC output.

Always use protection

PFET Q2 acts as a diode to protect the power supply.

The output of the adjustable regulator goes into a nifty little circuit (Q1, Q1B, Q2, R34, R35) that acts like a diode but has negligible voltage drop. A PFET (Q2) is used as an ideal diode to stop current backflow if an external power supply is present.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. AUX4 (formerly 3.0Volts)
  9. 0.8-5.0Vout (formerly 5.0Volts)
  10. GND

Both on-board regulators (3.3, 5volts) could be swapped with programmable output power supplies, but that seems like overkill. Pin 9 becomes a 0.8-5.0volt power supply named Vout, while pin 8 is now available for general purpose IO and is renamed AUX4.

We have very nearly reached our goal of 8 IO pins! Next we’ll rethink the Vpullup pin and the on-board pull-up resistors. If you want to skip the wait, our latest work is in the forum.

BUS PIRATE: Voltage measurement on every pin

Bus Pirate Ultra v1a follows the same pinout as previous versions. 5 I/O pins (MOSI, CLOCK, MISO, CS, AUX), a voltage probe (ADC), a voltage source for the on-board pull-up resistors (Vpu), two power supplies (3.3, 5.0volts) and ground. While we were building the prototype it became obvious that a few tweaks could make a much more useful tool.

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. ADC
  7. Vpu
  8. 3.3V
  9. 5.0V
  10. GND

This is the starting pinout. In this post we’ll update the voltage/ADC probe to measure voltage on every IO pin, and free up a pin for general purpose use.

Measuring voltage with the Bus Pirate ADC pin.

The voltage probe (ADC pin) is useful for checking the output of a digital to analog converter (DAC), verifying a supply voltage, or almost anything you’d do with a multimeter. The d command takes a single voltage measurement, while the D command takes continuous measurements.

Problems with the resistor voltage divider approach

The Bus Pirate runs at 3.3volts, but we still want to measure within the most common 0-5.0volt range used in hobby electronics. To bring the voltage into range, the Bus Pirate uses two 10K resistors to divide the measured voltage in half. Now we can safely measure a voltage in the range of 0-6.6volts using an analog digital converter with a maximum input of 3.3volts.

This is a super effective and simple approach, but it adds a 20K resistive load to the pin at all times. This load makes the pin less useful for digital IO, so the ADC has always been a dedicated pin without any other functions.

Adding a unity gain op-amp buffer

Input from IO_PIN is buffered by the op-amp and then divided in half for ADC1.

One obvious way to eliminate the load on the ADC pin is to buffer the voltage divider with an op-amp. The op-amp input is extremely low impedance and has negligible impact on the signal we’re measuring.

An MCP6001 is a cheap general purpose op-amp (U15) with common mode voltage that extends 0.25volts beyond the power and ground rails. Using it in a unity gain configuration buffers the input voltage (IO_PIN), which then goes through the voltage divider (RN3D, RN3C) to be measured by the ADC (ADC1). A few current limiting resistors and protection diodes suggested in the datasheet help ruggadize the op-amp for abuse during hacking.

Voltage measurement on every IO pin

A 74HCT4051 analog multiplexer selects which IO pin connects to the op-amp.

Without that nasty 20K load the ADC pin can be a general purpose digital IO. While we could dedicate an op-amp and ADC to measure each IO pin, that’s a lot of routing and resources. Instead, each IO pin connects to a 74HCT4051 8:1 analog multiplexer that selects which IO pin to measure with a single op-amp and ADC.

Three FPGA pins select one of the 8 analog inputs to measure. The FPGA is in control, rather than the MCU, so that we are ready to add an external high-speed ADC in the future.

Updated pinout

  1. MOSI
  2. CLOCK
  3. MISO
  4. CS
  5. AUX
  6. AUX2 (formerly ADC)
  7. Vpullup
  8. 3.3volts
  9. 5.0volts
  10. GND

Using a single analog mux and op-amp we can measure the voltage on every Bus Pirate IO pin. The dedicated ADC pin is cast into the dustbin of history, and we gain a new digital pin that we’ll call AUX2 for now.

Taking it further

1 x 10P connector on v1a (1)

6 IO pins is definitely better than 5. Wouldn’t it be great to have even more? Our goal is to get to 8 digital IO pins. That’s enough to interface nearly any serial bus, and it’s the logical number of channels for a proper logic analyzer.

At the same time, we’d like to stick with the 2.54mm 10 pin IO header (1) we’ve been using in recent prototypes. It fits common jumper cables we have in the parts box, but could also accept a nice keyed custom cable.

Next we’ll rethink the function of the on-board power supplies and pull-up resistors. To skip the wait, see our most recent progress in the forum.

PROTOTYPE: Bus Pirate/Logic Analyzer with Ice40 FPGA

Bus Pirate “Ultra” taps an iCE40 FPGA to power a combined Bus Pirate interface and logic analyzer that is infinity hackable. Previous Bus Pirates relied on the hardware peripherals available in a microcontroller, which vary in features and have the occasional bug. With an FPGA we can implement practically any peripheral with all the fixes and hacks we want! SPI, I2C, UART, CAN? Yes! Master or slave? Both! Complex frequency generator? Yup! Full featured JTAG debugger? Don’t see why not!

A big STM32F103ZE (1) microcontroller connects to an iCE40HX4K FPGA (2) through a 16bit bus that can move a ton of data. The fully buffered interface (3) is capable of high-speed signaling from 1.2volt to 5volts. 128Mbit of RAM (4) powers a logic analyzer with a potential maximum speed over 200MSPS. A 32Mbit flash chip (5) stores up to 30 bitstreams with different features that can be loaded into the FPGA by the microcontroller.

This post covers our most recent hacks to the Bus Pirate, created with these goals in mind:

  • Peripherals that work and can be hacked
  • Direct interfacing at all common voltage levels
  • Real-speed bus activity
  • Built-in logic analyzer
  • Plenty of space for updates

Continue below to read about the design, or jump to the forum to see the bleeding edge.

The Bus Pirate is a tool that talks to microchips in various protocols such as I2C and SPI. Get to know a chip first, then dive into the code. It’s been ten years since Seeed Studio did the original Bus Pirate production, and now we’re hacking new hardware for the next decade.

The Bus Pirate v3.x PCB is extremely simple due to a feature in PIC24FJ microcontrollers called Peripheral Pin Select. PPS allows most major peripherals (UART, SPI, PWM, counters, etc) to be assigned to almost any IO pin. Five PIC pins provide all the functionality for all the supported protocols.

Last year Sjaak did a deep dive on an STM32 ARM-based Bus Pirate. Unlike the PIC24FJ, all the hardware peripherals are fixed to certain pins that have to be tied together. All the interconnections make a rat nest of traces.

Once we got familiar with the STM32 it was obvious that the optimizations for low-power and DMA were going to be a real pain to work around. Take for example the I2C peripheral: you need to tell it when the transfer is ending at least one byte in advance. This is great if you’re setting up repetitive transfers using DMA in low-power modes, but the Bus Pirate is for hacking and “human scale” interactions. We faced two bad options: send a ghost byte when we can’t infer the end of a transfer, or use software I2C libraries. There’s really no point in having this much chip and then resorting to bit-banging!

Bus Pirate Ultra

We shelved the project to lick our wounds and come up with some new design goals:

  1. Peripherals that work and can be hacked
  2. Direct interfacing at all common voltage levels
  3. Real-speed bus activity
  4. Built-in logic analyzer
  5. Plenty of space for updates

Peripherals that work and can be hacked

The bottom line is we need hackable peripherals. From the I2C hardware bug in the B2 revision of the 24FJ64GA002, to the tricky implementation of peripherals in modern ARM chips, fixed silicon peripherals are a huge limitation. An FPGA is one answer.

In this design we use a Lattice ICE40 FPGA to implement bus protocol peripherals. Bugs can be squashed and features can be added with a simple bitstream update.

Source: ST app note AN2784 page 6.

The FPGA is connected to the STM32 static memory controller (FSMC) using a 16bit SRAM-like bus with 6 address bits. That’s a lot of bandwidth to push and pull data, and will eventually drastically speed up binary operations like dumping the contents of flash chips with FLASHROM.

An FPGA has always been the next logical step for the Bus Pirate, but bloated “Webpacks” and vendor tools under restrictive licenses are not hacker friendly. Fortunately, IceStorm gives us a free, open, and fast tool chain for the ICE40 FPGA.

Direct interfacing from 1.2 to 5volts

Previous Bus Pirates could interface with chips directly at 3.3volts, and from ~2volts to 5volts using pull-up resistors and open drain pin outputs. This works well for slow experimentation, but an open drain bus has real speed limitations. We want to interface directly at any common voltage.

Source: Nexperia 74LVC1T45 datasheet page 1.

74LVC1T45 is a bi-directional buffer used in cheap ARM programmer clones sold on Taobao. This buffer is a bulldozer, capable of 420Mbps at 5volts to 60Mbps at 1.5volts. It has a partial power-down feature that disables the outputs when no power supply is present to prevent backflow current into the FPGA or the device under test. TI, Nexperia and Diodes INC all manufacture a version of the 74LVC1T45. The Nexperia version works from 1.2volts to 5.0volts, while the others have a 1.65volt minimum.

74LVC1T45 has two control pins: direction and input/output. In a fixed direction bus like SPI or asynchronous serial this buffer can be put in front of any common microcontroller peripheral. However, it’s a dead end for a bidirectional bus like I2C or 1Wire because the peripheral would need to somehow manage the direction pin on a bit by bit basis. Direction handling is not a feature we’ve ever encountered on a microcontroller peripheral. The key here is to implement our own peripherals in the FPGA, and use the FPGA to manage the direction pin.

Source: Nexperia 74LVC1G07 datasheet page 1.

A 74LVC1G07 open drain output buffer is paired with each 74LVC1T45. It is also 5volt tolerant and has partial power down protection. Open drain output could be done by switching the direction pin of the 74LVC1T45, however it requires attention to timing to avoid bus contention. It’s so much easier to add a dedicated open drain driver chip.

Real-speed bus activity

At our very first New York Maker Fair (RIP) we had the chance to meet one of our maker heroes at an after party. We introduced ourselves and Maker Hero replied “The Bus Pirate is too slow” and walked away. It was crushing, but it is accurate. The Bus Pirate is slow in several ways:

  1. It is slow in terms of maximum bus speeds from the PIC running at 16MIPS
  2. It is slow in terms of time between each bus action. For each read/write/whatever the Bus Pirate sits and spits out text to the serial terminal. On a logic analyzer, as shown above, there is a very obvious delay between each command
  3. USB CDC (virtual serial port) is super easy to use, but it is slow and antiquated

Bus speeds can be increased substantially with a fast-clocked FPGA. We used the FPGA block RAM to create a bidirectional FIFO command queue. The STM32 MCU fills the command queue, then the FPGA drives the bus signaling without any delays to handle the terminal text. The MCU reads from the FPGA output queue and spits out text from a low priority background process. The fast, continuous bus activity from the FPGA is more in line with what really happens in implemented circuits.

libopencm3, the open source peripheral library we’re using with the STM32, supports multiple USB endpoints. We’ll add a USB bulk transfer endpoint that should drastically speed up binary operations like chip programming, flash read and writes, and display interfacing.

Built-in logic analyzer

A built-in logic analyzer is a top wish list item and has appeared in various prototypes in the past. While the Bus Pirate and a datasheet are enough to get a lot of chips going, there’s a decent chance we haul out the logic analyzer to get a good look at whats happening on the wires. A built-in logic analyzer that captures each command in real time makes debugging a dream.

A simple serial SRAM logic analyzer like the Logic Shrimp and Logic Pirate are quite cheap and easy to implement with PIC18/24/30 timers. Our attempt to do the same with the STM32 was less successful, but now we can drive it from the FPGA.

To ensure that the logic analyzer is reading the actual pin states, it gets a dedicated 74LVC573 input buffer that attaches to the IO header after the signal buffers.

Bus Terminal is a little Qt hack for debugging the logic analyzer and uploading FPGA bitstreams. Eventually we’ll target sigrok with a USB bulk transfer interface and driver.

Plenty of space for updates

The biggest issue we faced with Bus Pirate v3 was the lack of space. Endlessly optimizing of strings to eek out a few more bytes is annoying. Eventually we had to split the firmware into multiple parts with different features, a nightmare for users.

We want to hack and hack and hack for years in the future without running into space limitations. The huge STM32 chip has a generous amount of flash that should be sufficient for years of development.

The FPGA is another possible space crunch. Instead of the FPGA loading it’s own bitstream like the Logic Sniffer design, we used a big 32Mbit (or 64Mbit) flash chip to store multiple bitstreams in a simple file system. The STM32 loads the correct bitstream into the FPGA for each bus protocol. Bitstreams for the ICE40 4HK chip are about 135K max, so 32Mbit of flash should hold around 30 bitstreams with different features.

Hardware, firmware, software, HDL

Taking it further

The v1a board shown here was a good proof of concept, and it made it obvious where major improvements could be made in the design. Next week we’ll post about our updates to the on-board power supplies, voltage/ADC probe, and the pull-up resistors. We’re also working on a pinout label a high-resolution IPS LCD.

Check out the forum if you’d like to skip ahead and see our latest revisions.

BUS PIRATE: USB Micro B connector test


USB Micro B is the connector of the moment, but we haven’t had a very good time working with it. The bog-standard Chinese generic Micro B connectors on Bus Pirate v5 and Bus Pirate NG1 break constantly. We tested a Micro B connector with through-hole support tabs on the latest Bus Pirate PCBs. It turned out really well.

Standard Chinese USB Micro B connector


A ton of mom and pop factories around Shenzhen churn these out by the bucket load. It seems like a great part: ubiquitous and cheap, doesn’t require a special board slot, versions with extended leads and centering pegs are easier to hand solder. Unfortunately, every connector soldered by every member of our team has eventually decided to exit the PCB.

This connector is optimized for paste stencil and reflow soldering. Most support should come from two solder pads under the connector that are impossible to reach with a soldering iron. Maybe it could be done with hot air, or the QFN “solder from the bottom of the board through a via” hack.

Connectors with supporting through-hole tabs


The generic Chinese connector (left) has six solder pads holding it to the PCB. Four can’t be reached with a soldering iron – the two under the front, and the two recessed pads at the back near the pins.

A Molex 47589-001 (right) with through-hole support tabs went into the next revision of the Bus Pirate boards. The tabs aren’t long enough to go completely through a 1.6mm PCB, but they can still be soldered in place from the top of the board. It’s much more expensive – essentially free vs $0.50 each – but we’re optimizing for hand assembly, not production.


Now we’re living the dream. The four tabs are really secure, and we don’t have to treat the prototype like glass. The next step is to find the most widely available Chinese equivalent.




Trying a quick turn hand-assembly prototype service


These Bus Pirate v5 prototypes were hand-assembled by a random PCBA shop on Taobao. Assembly took two days and cost 80RMB (~$12) for each board, we provided the PCBs and components. Normally we relish a prototype build because it’s a source of so many design improvements, but this was an emergency.

The USB Micro B connector on the Bus Pirate v5 and the Bus Pirate NG1 keeps breaking. In fact, the connector on v5 broke while we took pictures for a post. We soldered it on well enough to finish the photos, but we need to replace the trashed board ASAP to continue working on BusPirate.com.

How it worked

We contacted a random PCBA shop on Taobao using QQ messenger. The assembler reviewed the gerber files and quoted 80RMB (~$12) to assemble each piece. That’s just the assembly cost.

PCBs and all the components came from our own suppliers. PCBs came from the Dirty PCB factory, parts came from JLC and a few Toabao suppliers. Sourcing the components for the “kit” took quite a bit of time, maybe the same as soldering a Bus Pirate. After two days we had the PCBs and parts in our Shenzhen office, then it all went to the assembler by same-day courier.

Communication with the assembler

The assembler relied on the BOM and the PCB silkscreen to stuff the board. They didn’t need an image of the schematic nor do they accept Eagle files. All interaction happened over QQ, which is pretty typical for everything in China.


They had a single question about the orientation of a component. The dots marking pin 1 of the BL1551s was on the wrong layer and didn’t get printed on the PCB. We’ll make sure all the orientation markings are clear for a speedier build next time.


The assembler found a problem with the parts we sent too. The 74HCT4066 is in the wrong package, it should be TSSOP instead of SOIC. We ordered a replacement part from JLC and chose SF shipping for 12RMB (~$1.90). The replacement arrived at the factory the next day.

The result

Finished boards arrived in our office two days after the assembler received all the parts, about 5 days after we ordered parts. Soldering is very good, but you wouldn’t mistake it for a board done in a reflow oven. All the components are stuffed in the right place and in the correct orientation. There’s a tiny bit of flux around the LEDs, but otherwise the board is super clean.


Bus Pirates have a row of unpopulated indicator LED footprints on the back of the board named LED1A-LED4A. These are the same as the LEDs on the front (LED1-LED4), and just open up more case options at no additional cost. The BOM we sent to the assembler specified LEDs for LED1-LED4, and made no mention of LED1A-LED4A. The assembler soldered LEDs to both sides of the board.

Our instructions were too ambiguous. The LED silk labels are PWR, USB, MODE, and VREG, not LED1-LED4. There was no way for the assembler to tell which LEDs were supposed to be populated, so they stuffed them all. In the future we’ll make sure the BOM names match the PCB silk, and explicitly state which parts are “do not populate”.

Does it work?


Powered up, programmed a bootloader, flashed the latest v5 firmware freshie build. Every board works and passes the self-test.

Quick turn hand-assembly

It’s super nifty to send away parts and get back assembled boards a few days later. If the orientation of every part is really obvious on the PCB silkscreen then the assembler can probably handle the build without any questions. The boards all work perfectly, and outsourcing the build really did keep the project moving at a critical moment.

Sourcing the parts and kitting the components took a lot of time. It would be a lot easier if the assembler provided common resistors and capacitor values so we don’t have to find them. There’s also a lot of caveats: this was all handled in Chinese, requires Chinese payment methods, and our Shenzhen office was able to coordinated everything.