MSP430 Bootloader over I2C on RaspberryPi and BeagleBone Black

MSP430 has a built-in bootloader (BSL), that communicates with a host through UART or I²C to update memory.  TI released the code described in "MSP430^TM Firmware Updates Over I²C Using Linux®".  This code compiles without modification on Raspberry Pi.

First we try the hardware entry sequence on the TEST and RST pins to invoke the BSL.  "The BSL program execution starts when the TEST pin has received a minimum of two rising edges (low-to-high transitions) and if TEST is high while RST/NMI rises from low to high."  From the RaspberryPi 40-pin header, we connect RPi Pin-3 (SDA) and Pin-5 (SCL) to MSP430 P1.2 (SDA) and P1.3 (SCL) for I²C and Pin-13 and Pin-15 GPIO to RST/SBWTDIO and TEST/SBWTCK.   After applying the sequence using Python RPi.GPIO, we can probe the I²C bus with "i2cdetect -y 1" and see a response at the expected address 0x48.   Now we can try "msp430-i2cbsl-tool" to update the firmware.  The firmware file is generated using MSP430 Hex Utility hex430 with --ti_txt option.  Note that the BSL times out in 10 seconds.   When we run the command, we get an error message, "Attempting to unlocking device with password... Fail!".   It looks like ioctl I2C_RDWR failed, "Connection timed out".   The next troubleshooting step is to take a look the I²C traces on the scope.  

Before we do that, we'll do a test on BeagleBone Black that TI has tested on.  We connect Pin-19 (SCL2) and Pin-20 (SDA2) to P1.3 and P1.2, Pin-12 (GPIO_60) and Pin-15 (GPIO_48) to TEST and RST.  We control the GPIO pins using SysFs.  This works,

./msp430-i2cbsl-tool -f ~/BlinkLED_MSP-EXP430FR2355.txt -i /dev/i2c-1 -n
---------------------------------------------------------------
   TI MSP430 I2C Linux BootLoader 01.00.00.00                  
---------------------------------------------------------------
INFO: Firmware file /home/debian/BlinkLED_MSP-EXP430FR2355.txt specified
INFO: I2C BUS /dev/i2c-1 specified
INFO: Opening TI-TXT firmware file firmware.txt...  done!
INFO: Password file not found, defaulting to 0xFFs.
INFO: Skipped software invoke.
INFO: Attempting to unlocking device with password... Fail!
INFO: Device could not be unlocked. Resetting password and trying again.
INFO: Skipped software invoke.
INFO: Attempting to unlocking device with password... done!
INFO: Programming attempt number 0
INFO: Programming @0x8000 with 220 bytes of data... done!
INFO: Programming @0xff80 with 12 bytes of data... done!
INFO: Programming @0xffa0 with 2 bytes of data... done!
INFO: Programming @0xffce with 50 bytes of data... done!
INFO: Programmed all memory locations successfully.
INFO: New firmware successfully downloaded to device.
INFO: Reading the reset vector contents and setting the PC to this value.
INFO: This should cause the device to reset.
INFO: Reset vector read as 0x80c0
INFO: New program downloaded and reset successfuly!

Note that the default password is used, which is not the correct password the first time and triggers a mass erase that clears the password so the it succeeds in unlocking the second time.  If the proper password (32 bytes from address 0xffe0 - 0xffff) is used, it is unlocked the first time.

Notebook PC Power Adapter - Dell 90W

Many years ago, I wrote about my experience with the "smart" power adapter.  As I changed my work notebook computer from Dell to HP, despite of same power rating and same 3-pin barrel plug, the HP computer would not detect the Dell power adapter.  It seems such a waste not to have a common standard of power adapters.  (The move towards USB C PD for all mobile devices should make thing better.)  So I decide to crack one open to see what exactly the center pin does.  This is a 90-watt dell power adapter (19.5V 4.62A); it is not too hard to crack the case open.   The power adapter is made in China by Delta Electronics, a Taiwanese power product company.  The date code is "0731". The three wires go connections labelled VO, GND and DATA on the single layer PCB.  The DATA trace is connected to a 3-pin TO-92 device, with marking "75M518E BYE TI".  No information is found on this device, so it is likely a proprietary device.  The DATA signal has an 130-Ohm resistor in series and is clamped by a Zener.   The device is powered directly off the 19.5V.

The primary is switched by Infineon SPA15N65C3 650V 0.28-Ohm N-channel MOSFET.  The secondary side is Vishay Siliconix SUP60N10 100V 0.02-Ohm N-channel MOSFET.  The controller has the marking "DAP6A",  which seems to be a custom specific device from ON Semi with the part no. DAP006, PWM Current−Mode Controller for Free Running Quasi−Resonant Operation and is equivalent to NCP1200.  On the secondary side, there is an 8-pin IC with marking, "DAS001 ST", which appears to be equivalent to TSM103W, a dual opamp with 2.5V voltage reference.

When the power connector is plugged into the computer, the center pin is pulled up to about 3.3V.  Then there is data activities on the line.  If the center pin is not connected to the power adapter, the center pin from the computer toggles every 3 seconds with 2 seconds high.

When the center pin is not connected, the power draw drops to 20W and the computer runs at a slow clock rate (about 800MHz).

Aukey DR01 Dash Cam

It features SonyIMX323 with 1936 (H) × 1097 (V) active pixels, with pixel size of 2.8um, Novatek NT96655 with 128MB DDR3 SRAM and 2x 2.7V 3.3F super cap.  It produces reasonable good quality video for most lighting conditions.

Recently, it kept resetting the time.  And the dash cam does not record until the date/time is set.  It is suspected that the time keeping battery is faulty.  The coin battery appears to be FDR rechargeable lithium battery, ML621, 5.8mAh, 3.3V, 6.8x2.1 mm.  The number of charge/discharge cycles are rated for 300 at 23C.   The voltage at the end of capacity is about 2V and 2.5V at the half capacity.  The standard charging method is constant voltage of 3V with 1KOhm.

The battery voltage is measured at 2.8V.  Interestingly, the dash cam started working fine after it was opened and continued to work after it was put back.  Perhaps something was shorting the battery?

Tek Scope Screen Capture

I've been taking scope pictures with my phone, but sometimes the pictures do not have good focus and the picture size is large.    The Tek scope has a serial port which commands and data can be sent and received.  But I have had a lot trouble to get the Tek's own software to work.   For screen capture, it is actually a lot simpler: just set up the hardcopy to output to RS232 and choose a format such as PNG, then just hit the hardcopy button, the data come out on the serial port.  Now it is just a matter of capturing it on the PC, which can be a simple Python script using pyserial.   A null modem cable is necessary; the maximum baud rate is 38400.  It takes about 3-4 seconds to get the screen shot, which is much better than you can capture with your phone.

USB Hub

This is a 7-port USB hub with 4 USB3 ports and 3 USB2 ports by Zoweetek, ZW-H355.  It essentially is consisted of two ICs, GL3523 by Genesys Logic is a 4-port USB3.1 compliant hub controller and HS8836 which appears to be a 4-port USB hub controller but very little information is available online.   It appears that one of the USB2 signals goes from  GL3523 to HS8836 and HS8836 has 4 pairs of USB2.0 signals going to 3 USB2 ports and one of the USB3 ports.  The PC board is not well cleaned especially around through-hole connections, perhaps the switches and connectors are hand soldered.  It is not clear if the high-speed traces are matched.  There is a footprint for input USB3 connector, but here the wires are directly soldered to the board.

RaspberryPi Zero W

I came across a RaspberryPi Zero W, the older generation RPi Zero with WiFi.  For $10, it is a great little board.  Although it can run the desktop environment, it cannot really be expected to run the memory intensive applications such as internet browser because of limited memory.  But 512MB is a huge amount of memory for embedded systems.  To run the camera, it needs to allocate 128MB to the GPU (perhaps 64MB if only still picture).

It is straightforward to wiring up a display module (2.7" 128x64 OLED).  And with the python module luma.oled, the display is up and running quickly.

Starter Motor

I recently had to replace a starter motor, so I got a chance to look the interior of the starter motor assembly.    The starter motor assembly is consisted of a DC brushed motor, a solenoid and gears.   

The DC motor has series field winding: the input positive battery coming through the solenoid switch first goes into the field winding, then to a pair of copper brushes.  The negative terminal is the chassis connecting to the other brushes.  

The solenoid serves two functions: switching the battery power to the motor and pushing the gear to engage the engine flywheel.  Because of the large starting current (hundreds of amperes),  heavy gauge wires and large copper contact are used.   The solenoid has two coils: push-in coil that is connected to the motor positive terminal (the output of the switch) and the holding coil connected to the chassis.   This is a clever design: before the motor power switch is closed, the push-in coil is energized through the motor windings.  Once the motor power switch is closed; the push-in coil becomes inactive and a lower power holding coil keeps the solenoid in place.

The motor shaft is geared to the output the starter.  The solenoid has a spring loaded pin that pushes the gear to engage the flywheel.  There is also a clutch that prevents the flywheel to backdrive the motor once the engine has started.