PROTOTYPE: Bus Pirate Next Gen v1


Sjaak, fresh off his ARM adventures at SMDprutser, hacked together an STM32-based Bus Pirate prototype we’ve been calling NG1 (Next Gen version 1). NG1 uses a modern ARM chip with completely open tools and libraries, and sports an integrated logic analyzer . The firmware is very usable, but largely untested. Let’s have a look at the biggest changes.

STM32 ARM-based design


NG1 is built around an STM32F103CBT6, a modern ARM chip with 128K flash and 20K RAM running at 72MIPS.

All the extra resources let us use a proper printf function for terminal display, instead of the crappy obscure way of storing strings we invented for the v3.x hardware. The current firmware uses about half of the flash (78 of 128K). If we fill the chip, like we did with the Bus Pirate v3.x, STM32 has a full line of compatible chips with up to 512K of flash.

ARM has completely open toolchains, while the Microchip PIC used in previous Bus Pirates is still straggling with free-but-not-open-not-distributableand-crippled compilers and libraries. The ARM GCC compiler is open source and freely available for multiple operating systems. Several active open source libraries support the chip’s features, such as multiple USB endpoints. NG1 uses an open source peripheral library, libopencm3, so the complete source and libraries can be redistributed under the GPL.


Like most chips, STM32 doesn’t have a Peripheral Pin Select feature. PPS on the PIC24FJ64GA002 is what makes the original Bus Pirate v3.x design so elegant (left layout). Most major hardware modules like UART, SPI, timers, PWM, etc can be assigned to almost any pin using PPS – just one PIC pin is needed for each of the 5 Bus Pirate IO connections.

STM32 hardware modules are fixed to specific pins. Each Bus Pirate IO pin is connected to up to five STM32 pins to provide the necessary features. This kind of design uses a lot more pins (28 vs 64), and the PCB is a lot more complicated (right layout).

On-board Logic Analyzer


Frequently we use the Bus Pirate along side a logic analyzer like the Logic Pirate. NG1 has an SRAM-based logic analyzer directly on-board. The logic analyzer records bus activity every time the Bus Pirate writes or reads commands.

This adds an additional layer of debugging when things go wrong, without any extra cables or connections. Talk to a chip through the terminal, then check the logic analyzer to verify what actually happened on the bus. Terminal mode and the logic analyzer work at the same time because they each have a dedicated USB endpoint in the STM32. Microchip 23LC1024 SRAMs provide 256K samples per channel at 20MSPS on the current prototype, but we’ve found an alternate SRAM chip with over 10M samples per channel.

Currently NG1 uses a 74LVC573 single direction latch between the logic analyzer and bus. The next revision uses a 74LVC245 bidirectional latch[link] so the logic analyzer can also work as a signal generator without any additional hardware. Maybe we could toss on a resistor ladder to make an analog signal generator too.

So far we’ve focused on capturing bus activity while the Bus Pirate is writing and reading commands, but the hardware should work as a stand-alone logic analyzer as well. The high latency of STM32 pin interrupts could contribute to really sloppy capture triggers, especially at high capture speeds, but there’s still a lot to learn about this chip.

Selectable 3.3volt, 5volt, external pull-up voltage


The Bus Pirate has on-board pull-up resistors (10K) to use with 1Wire, I2C, and any other situation where an open drain bus is used. The on-board pull-up resistors can be connected to one of three voltage sources straight from the Bus Pirate terminal. Select from the on-board 3.3volt or 5volt power supplies, or use an external supply through the Vpull-up pin. Selecting the pull-up voltage from the terminal is really convenient new feature.


Two BL1551 analog switches are chained together so that three input sources (3.3volt, 5volt, Vpu pin) are controlled by two pins. If this seems familiar, it’s the same switch hardware we tested on the v3.x update.

Integrated USB and USB Micro B connector

STM32F103CBT6 has integrated USB hardware with actively developed open source driver libraries. Not only is the USB interface faster than a USB-to-serial converter chip, it supports multiple USB endpoints at the same time. Currently we’ve implemented one “low speed” USB endpoint for the terminal and DFU bootloader updates, and a second “high speed” USB endpoint for the on-board logic analyzer.

USB Micro B is by far the most common USB connector at the moment. NG1 uses a Micro B connector so it works with the phone cable that’s probably already on your desk.

However, we don’t like the Micro B connector as much as the Mini B. Every hand-soldered USB Micro B connector eventually broke off of the PCB. After re-soldering it numerous times the pads and tracks get to the point of no repair.

On the most recent hardware revision we removed the cheap “standard” Chinese Micro B connector and used a much more expensive Molex 47589-001 USB connector with through-hole tabs for reinforcement.

1x10pin keyed locking connector


Previous Bus Pirates use a 2x5pin IDC connector. These are easy to use with 0.1” jumper wires from your parts box, but there’s not many options for probe cables using an ICD connector.

NG1 uses a 1x10pin 2543/TJC8S-10AW (equivalent to Molex 70553-0044)connector, a common 0.1” header inside a keyed/locking shroud. The pins are 0.1” pitch, so jumper wires still work great, but now we can make high quality keyed/locking probe cables with tangle-free silicone wire.


The NG1 has a hardware reset button and a user configurable button. The user configurable button is currently only used for activating the bootloader during power-up. We haven’t decided yet on a good secondary purpose for it, but we are open for suggestions.

Second UART

A hardware UART is exposed for debugging without using USB. The code supports debugging via the UART, though we started debugging through the second USB CDC port after USB was up and running.

Taking it further

A logic analyzer, selectable pull-up resistor voltage supply, more memory and a totally open toolchain are probably the four biggest improvements to Bus Pirate NG1. The next revision will also support a hardware signal generator.

Hardware files are available here. The hardware is not final, but the current version addresses all known bugs. Quick order the latest PCB version at DirtyPCBs, or wait a week and we’ll have some to give away for free.

Firmware repository is here, it builds with the ARM GCC compiler. Use the command ‘git clone –recursive‘ to clone our git repository. That command should also take care of getting the right libopencm3 version. Be sure to run make in the ‘/libopencm3/‘ folder first, then switch to the ‘/source/‘ folder and run make again to built the firmware. We’ll walk through the toolchain setup next week.

from Dangerous Prototypes

Related Post

Deja un comentario

Tu dirección de correo electrónico no será publicada. Los campos obligatorios están marcados con *