研仪Labtool-48UXP的拆机分析，外国的哦

liyf · 发表于 2011-4-17 15:29:13

48UXP (hw)

February 3rd, 2009 by bushing

Back at 25C3, pytey handed me a rather intimidating piece of hardware. “It’s a flash programmer, but it doesn’t work; I think I broke it with a custom adapter I was working on for it. I don’t have any tools to try to fix it, you want to have a go?”

Here’s the device:

The “Labtool-48UXP” is an “Intelligent Universal Programmer”, with an impressive list of features. Some of the ones that caught my eye were “Four DACs for Vcc, Vpp1, Vpp2 and Vpp3 with 8-bit resolution. Software controllable rises time and current limit protection”, “Logic driver supports pull-up/ pull-down or high impedance on all 48 pins with 2.0V-5V level,” and “The LabTool-48UXP performs device insertion and contact checks before it programs each device. It can detect poor pin contact and devices inserted upside down or in the wrong position.”

I had high hopes for this device — maybe I could write a Mac client for it, or add support for the Wii’s NAND flash chips to it. In any case, I could find virtually no info about this thing online; surely someone had hacked on one of these things before? In any case, before any more fun could be had, I had to get it working, and that required understanding what’s inside. Shall we take a look?

When you open the thing up, you’re faced with 2 stacked boards and a dual-voltage power supply (12v/5v).

The lower board is marked “LabTool-48UXP Control Unit”.

[/url]

In some order, here are the major parts on the board:

DB25 connector for parallel port
USB connector
[url=http://www.cypress.com/products/?rpn=CY7C68013A]Cypress “EZ-USB” FX2 microcontroller, a common USB2.0 interface that is an 8051-derivative
Serial EEPROM to store USB VID/PID
Main processor – an Intel 80C32, another ROMless 8051 derivative. This chip is as old as I am!
Firmware for the 80C32 — 64KB, only the first half is used
32KB SRAM for the 80C32 — overlays the top 32KB of the address space. Also, I think some of the address space is used for memory-mapped IO with the XC3030 (see below) and the parallel port / FX2
Lattice CPLD — possibly used for the MMIO mentioned above
TLC7226C — 4-output 8-bit DAC. Presumably used to drive the 4 power supplies (Vcc, Vpp1, Vpp2, Vpp3) mentioned in the marketing copy
Power supply section — what we have here is an LM317T (used as a general voltage regulator?), LT1170CT (used to boost the +12v to +30v), and then 4 power op-amps which are configured as non-inverting amplifiers with a gain of about 10. Meaning, the DAC feeds each a voltage from 0-3.0v, and the opamp outputs 0-30v.
A6833 (x2) — these are 32-bit, high drive-capacity shift registers.
NEC B772 PNP power transistors. There are 48 of them, but I don’t think that they necessarily map 1:1 with the output pins. These seem to be driven by the output of the shift registers?
Reed relays — 10 of them. Why 10? Dunno. They seem to connect to the voltage sources, although 3 of them seem to pull stuff down to ground.

The chips marked with ? have the tops sanded off them. The chips marked with * are standard 74HCT logic-series chips — from top to bottom, left to right (like reading a book) we have ’373, ’245, ’373, ’14A, ’245, ’244, ’373, ’374, ’244, ’244.

The upper board is marked “LabTool-48 Driver Unit”.

TPIC6B259 “Power Logic 8-bit Addressable Latch”. This thing has 8 150ma open-drain outputs (wewt!) and only needs 4 control lines — 3 to specify 1 of 8 bits, 1 to actually set the bit. 6 of these, total, so one bit per pin.
UDN2987 “8-Channel Source Driver with Overcurrent Protections”. This part has 8 buffers which are presumably used in combination with the open-drain latches (above) to form a push-pull circuit for each pin. Each driver can source 100mA, and it has an overcurrent detection output, which is fed back into the controller circuitry and causes the device to give you an error message when you put your chips in backwards. Again, 6 of these.
74HC259 — 8-bit addressable latch. There’s one of these for every UDN2987, so you can latch the state of the pull-up driver and latch the state of the pull-down driver for each pin.
74HC138 and 74HC273, presumably acting as glue logic for the …
XC3030A — Xilinx 3000-gate FPGA. Digikey lists this as a $17 part, but that must just be because they are old and hard to find! This was state-of-the-art, 10 years ago. If nothing else, it provides the “software controllable rise time”. I think it’s safe to say this drives the push-pull latches that cover the rest of this board.

Still unclear is exactly how the transistors and relays on the first board interact with the latches on the second board. My next post will talk about the software provided by the manufacturer to drive this thing.