Problem with ISP in existing hardware

Go To Last Post
21 posts / 0 new
Author
Message
#1
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

As some of you know, Daqq pointed out the Mattel Hot Wheels Radar Gun which I have proceeded to spend way too much time on. I have it reverse engineered and am ready to give all my theories a try, but am failing in using its ISP connection with my (working) STK500.

The problem is that they use the MOSI, MISO, and SCK lines for generating the LCD backplane voltages (0, V/2, and V). Therefore there are two 56K resistors on each, one to ground and one to V. When they output a 0 or 1 they get 0 and V; when they switch to input/no pullups they get V/2. My guess is these resistors are causing my grief.

I've tried using the gun's power without Vtarget, Vtarget without the gun being powered on, have traced the ISP header to the ATmega88 pins, checked cables, tried the STK500 on other chips, etc. - everything I can think of, and all checks out. I've dropped the ISP clock to the lowest it will go (a little over 1KHz) and jacked it up to where it should be. Nada. Reading fuses, locks, or signature, I always get a message that there's an ISP error. A scope shows reset handled correctly and an attempt to talk (SCK and MOSI).

I really don't want to remove the resistors, since to do so would sort of defeat ISP plus be a lot of trouble. I could put jumpers to break the connections but that too is more than I hope to have to do. Yes, I've read AVR910, and they do show isolation from other active stuff using a series resistor on each line. But it seems that Mattel's manufacturer probably successfully programmed this doggie, although possibly not via ISP. It seems odd they would have the ISP solder pads there if it shouldn't work, but who knows.

Any comments or ideas would be greatly appreciated. Thanks in advance.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I could offer to check the following:

I take an ATmega88, connect to my STK500
and than add the 56k resistors and check.

I have an operating ATtiny2313 with an R-2R DAC
(10k and 20k Resistors) connected to PortB without
disturbing ISP.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Perhaps they have disabled the reset, just a guess.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Chuck wrote:

Quote:
My guess is these resistors are causing my grief.
I think not. I have used simular setups without any problem afa the resistors are concerned.
What may be an issue, is the capacitive load of the LCD on these lines (see note). And THAT is a problem I came across on several occasions. Is it possible to disconnect the LCD by unplugging a connector ?
Are you using a tailor-made ISP-cable for this doggie ?

It's also possible that they used debugWire to program this one. And when dW is still enabled, ISP is no longer possible. To check this, hookup the dragon, start a debugsession in Studio, and switch dW off from within that session.

Nard

Edit: the note ;)
Apparently the LCD is direct-driven by the AVR, hence the Vcc / 0.5*Vcc / 0V on these lines. And the LCD may represent quite some capacitance. When SCK is clocked by the STK500, the capacitive coupling may super-impose glitches on MOSI and MISO, or, and that's a second possible cause: the rise- and fall-times of SCK do not meet the specifications.

A GIF is worth a thousend words   They are called Rosa, Sylvia, Tricia, and Ulyana. You can find them https://www.linuxmint.com/

Dragon broken ? http://aplomb.nl/TechStuff/Dragon/Dragon.html for how-to-fix tips

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I have meet same problem with a HW som have a 2K2 to GND on MOSI & MISO-->2k2 work not stable but I have change to 1K8 ( empty with 2K2) and not work.
Now I use 4k7 not problem. I can not think it is a problem with the resistor but try to reduce ISP frenquency (work for me with 2K2).
Thierry

Thierry Pottier

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

TPE wrote:
I have meet same problem with a HW som have a 2K2 to GND on MOSI & MISO-->2k2 work not stable but I have change to 1K8 ( empty with 2K2) and not work.
Now I use 4k7 not problem. I can not think it is a problem with the resistor but try to reduce ISP frenquency (work for me with 2K2).
Thierry

ISP programmers can't drive any load. E.g. the dragon can't driver pull up resistors smaller than 1k and pull down resistors smaller than 10k. Capacitors as noted above are note valid when using the ISP interface. I guess your 2k2 resistors are a too high load for your programmer.

Regards
Sebastian

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Quote:

Reading fuses, locks, or signature, I always get a message that there's an ISP error.

Just a thought: Does reading a locked chip result in an ISP error? I'd assume that the ISP pads have a purpose, but maybe they just locked the chip after programming?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Chuck, if the issue Sebastian is pointing out is causing the trouble, 1k pull-ups on the programming cable may do the trick.
And it could be locked .... what a pitty that would be :(

Nard

A GIF is worth a thousend words   They are called Rosa, Sylvia, Tricia, and Ulyana. You can find them https://www.linuxmint.com/

Dragon broken ? http://aplomb.nl/TechStuff/Dragon/Dragon.html for how-to-fix tips

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Thanks, guys - good stuff. I should have mentioned that I have removed the LCD itself, so it (the glass) is not the problem.

It never occurred to me that I wouldn't be able to read the signature if the chip were locked. Then I found this in the datasheet: "All Atmel microcontrollers have a three-byte signature code which identifies the device. This code can be read in both serial and parallel mode, also when the device is locked." So unfortunately being locked is probably not the problem. I was waiting to try a chip erase until I had verified the signature.

In answer to other points: the ISP cable is one that came with the STK500; I don't have another '88 but I'll try ossi's suggestion of duplicating the resistors with a different chip. And for Cliff's DW point, I guess I'll wake up the old dragon and try not to kill him by touching his private parts. It's probably the excitement that gets them, or the disappointment that the one doing the touching is not a damsel in distress.

Thanks again for your thoughtful replies.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Quote:
And for Cliff's DW point, I guess I'll wake up the old dragon and try not to kill him by touching his private parts.
That CD-rom housing wasn't such a bad idea after all, in spite of the possibility of built-up static charge: the amount of charge will is so low, that it's not very likely that it will be fatal to the dragon. OTOH, the carton box needs just a little bit of Kindergarten-work to make it suitable as "I will not touch your private parts, Dragon" :) And power it from a self-powered HUB ...

Cheers

A GIF is worth a thousend words   They are called Rosa, Sylvia, Tricia, and Ulyana. You can find them https://www.linuxmint.com/

Dragon broken ? http://aplomb.nl/TechStuff/Dragon/Dragon.html for how-to-fix tips

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I could do a test with an ATmega88.
On which lines should I put a 56k+56k combo ?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Thanks, ossi. I'm just getting ready to try it on a '16 myself. It's the following:

15 - PB3/MOSI
16 - PB4/MISO
17 - PB5/SCK

There's a 4th (13 - PB1), but it's not important. I appreciate your help.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Well, no problem on a '16 with the resistors on the ISP lines. Hmmm...

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I use an ATmega88 with external Quartz-oscillator
20MHz. Attached three times 47k+47k combo to
SCK,MISO,MOSI and STK500 to ISP.
(all 47k 5% resistors from same batch.)

I can verify, program and everything at full speed.

I can lock the device. Then verify fails but
I can still see the signature.

Perhaps you could check the signals on all
three lines using a scope. Perhaps
one line is intentionally "killed".

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Well, my apologies to all. When all else fails, get Occam's razor out and shave.

I have handled and traced and poked this thing enough that I thought maybe I caused it brain damage even though it appears to work. I just opened up another (always have a spare, especially when it's something you shouldn't be working on in the first place), and sure enough, ISP works fine on it. The first one needs to drop back a grade or two in school.

Anyway, I appreciate all the good ideas and help. Thanks.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Very wise decision do buy two. I would be
lucky to have one !

And are the lock-bits set ?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

There are three, pretty much as expected:

Mode 3: Further programming and verification disabled
The two "no locks" on SPM/LPM in application or boot sections.

Funny thing is, I just looked at every MCU pin on the old one while it was running, and they all look fine. Whatever is killing ISP is more subtle than I am (which is not that hard to do).

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

The V/2 idea for LCDs is new to me. Have you seen
it elsewhere ? Has anyone already built an LCD
driver using a standerd ATmega to drive an old
LCD-Watch display ?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I found it described exactly as this unit implements it here starting on page 4.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Are the lock bits set in the one you can do ISP on?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

There are three, pretty much as expected:

Mode 3: Further programming and verification disabled
The two "no locks" on SPM/LPM in application or boot sections.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org