Program wraz z opisem służy żeby np. zejść w dół firmware lub w górę, lub przerobić wersję TL866CS na TL866A.
TL866 Programmer
TL866 programmer consists of the following functional blocks:
CPU block based on the Microchip microcontroller Pic18F87J50.
I/O Expander using eight 74HC373 latches and one 74HC164 shift register.
Pin drivers realized with discrete components. Thus we have 16 VPP voltage switches, 24 VDD
voltage switches and 25 GND switches.
DC to DC converters wich generate the VPP programming voltage and VDD supply voltage.It is made
with two MC34063 circuits.
CPU
USB
PIC18F87J50
I/O expander
DC to DC
Converters
VPP & VDD
Pin drivers
ZIF
Socket
CPU block
It is based on the PIC18F87J50 microcontroller and is the core of entire device.
The internal firmware is composed of two main modules:
Bootloader: for later firmware upgrade.
Main software: implements all programming algoritms.
The internal controller flash memory has 128Kbytes and is divided as follows:
1-0x00000-0x017FF bootloader
2-0x01800-0x1FBFF main firmware
3-0x1FC00-0x1FFFF decryption tables
00000h-017FFh
Bootloader
01800h-1FBFFh
Main firmware
1FC00h-1FFFFh
Decryption tables
Of the three memory areas ,only the two can be updated. The entire 128Kbytes of flash memory is divided in
blocks of 1kbyte each, so we have 128 blocks numbered from 0 to 127 as follows:
0 To 5 = bootloader (6Kbytes)
6 To 126 = main software (121Kbytes)
127 = decryption tables (1kbyte)
Updating software is mainly done as follows:
Erasing blocks 6-126
Writing this memory area with the new content.
This operation is provided by the bootloader, which controlled by the pc software will perform erase memory,
decrypt received data blocks and writing flash memory.
Bootloader
This module is the first that run at startup and is responsible for verifying the integrity of the main firmware
and transfer execution to it.
At every startup it does the following operations:
1 initialize the controller ports and peripherals
2 check the state of pin RC1 ; if is logic one then jumps to step 5
3 check if bootloader mode was demanded by the main software; if yes then jumps to step 5.
4 verify the last 4 bytes of main software, if they are 55, AA, A5, 5A is considered that the main software
is valid and transfers execution at adress 0x1800; bootloader cease functioning here.
5 USB module initialization
6 Waiting commands from PC
7 loop to step 6
As you can see, we can force the bootloader mode by holding the RC1 pin at logic one at startup, this can be
done by soldering an resistor of approx. 100-200ohm between +3.3 V and pin 36 (R26) of the controller:
Although bootloader will check the software integrity , in some cases it may be a valid software signature but
either main firmware is missing or corrupted, leading to invalid code execution and the cpu will stall. Out of
this situation can only be done by forcing the bootloader mode.
Reviewing: entering bootloader mode can be done only in three cases:
-Forced by pin RC1, which has the highest priority.
-When was demanded by the main software.
-In case the main program is corrupted or missing.
After entering the bootloader mode and USB module initialization, it enters a loop of waiting for orders from
the PC, which are only four in number, as follows:
1 RESET
resets the controller.
2 REPORT report status of the device, firmware version, serial number and device code.
3 ERASE
erase the main program by initializing blocks 6-126 with FF.
4 WRITE
decrypts and writes a block of data in the flash memory at specified address.
As a remark, although in step 4 is mandatory that the address specified in the command to be within the
0x01800-0x1FBFF range, actually the bootloader implemented in TL866 will write to any address ordered and
has no kind of protection, if such a situation is reached by writing to addresses in blocks 0-5 or 127 then the
bootloader will overwrite itself (ridiculous!) or table decryption block 127 will become corrupt and bootloader
will not be able to do the right decryption. In both cases the device will become unusable, its restoration can
only be done with an external programmer connected to J1 connector.
This is a nasty bug of the bootloader, so beware.
Although reprogramming device in the above case can be made very simple, we need the full firmware. For
safety reasons the full firmware is not provided by the manufacturer (shame on you autolelectric).
For such cases i made a small utility software that provides the following functions:
-generates complete firmware using custom serial number and device specific code.
-updates main software by decrypting the update.dat file provided by the manufacturer.
-formatting the main area (blocks 6-126).
-switching between normal mode and bootloader.
-Displays the status of the programmer and identification info.
For safety reasons the program will not perform the formatting and rewriting without presence of the update.dat
file, which will be checked for integrity.
The program will not execute any operation if is detected the presence of two or more programmers at the same
time.
TL866 firmware generator/updater main interface
The main interface of utility consists of the folowing elements:
1. Switching betwen firmware updater and firmware generator
2. Path to the update.dat file (you will found this file in the same folder with minipro software)
3. Version of the firmware wich will be uploaded; If yo want to make a backup of your firmware
please select firmware dumper
4. Reflash button; this will perform the main firmware update, you will need the update.dat file wich
will be checked for integrity.
5. Reset button; will reset the programmer and toggling between normal mode and bootloader .
If the programmer cannot enter to normal mode then it will stay in bootloader mode.
6. Dump button; this button will become active only if the firmware dumper has been uploaded.
7.Advanced button; this button will become active only if the firmware dumper has been uploaded.
You can change device type, serial number and code protection bit on the fly, without having to use
an external programmer.
8. Info area; for displaying device informations.
9. Device status; for displaying device status.
10. Write progress; for displaying firmware upgrade progress.
For regular upgrade of the main firmware you will need to:
1- Browse for update.dat file
2- Click reflash button
This will update the main firmware and automaticaly will perform the folowing operations:
-switching to bootloader mode
-erase the main firmware area
-decrypt the file update.dat and write the main firmware area with the new content
-switching to normal mode (only if the right firmware was written).
No matter what version of programmer you have, the updater will upload the chosen firmware encrypted with
the proper key, so you can have a TL866CS device programmed with TL866A firmware or vice versa.
Advanced window
In this window you can reflash your TL866 without an external programmer but be very carefully!
If something is going wrong you can brick your device (of course an external programmer will restore it).
So we have:
1. Device bootloader version,code protection bit status and device serial number info.
2. Bootloader section. Here you can rewrite your bootloader version at your choice, click write button to
proceed; the new bootloader will be written very fast (1-2 sec).
3. Code protection bit section. Here you can change the PIC18F87J50 CP0 bit; click write button to proceed.
4. Device serial number section. Well you can change your device code/serial number here if you want!
When you finish with this advanced window please reflash the normal firmware by selecting the desired
firmware version from main window or from minipro software.
The full firmware generator
The firmware generator interface of this utility consists of the folowing elements:
1- Device code box; content of this box will be displayed in the about box of the Minipro software
as DEV Code:xxxxxxxx (max. 8 characters)
2- Serial number box; content of this box will be displayed in the about box of the Minipro software
as Serial:xxxxxxxxxxxxxxxxxxxxxxxx (max. 24 characters)
3- Edit buton; for editing device code and serial number as follows:
By clicking the two Random butons the device code or serial number will be updated with random numbers. Of
course you can manualy enter what you want, the content of these two boxes is not restricted.
4- Clone button; this will copy the device code and serial number from active programmer plugged into the
USB. If you intend to transform an CS version to A then clone device code and serial number of the
working programmer first, for preserving original serial code and device code.
5- Default button; will update the device code and serial number with default ones.
6- Firmware version selector; The full firmware option will generate the hex file with main firmware writen
in the 0x01800-0x1BFFF address range; for bootloader only option, this range will be filled with blank
value (FF).
7- Firmware version to generate; you can choose between A and CS version.
8- Save button; by clicking this button you will be prompted to save the generated hex firmware file.
The encrypted device code and serial numbers is writen in the last area of flash memory (0x1FC00-0x1FFFF).
The generated firmware hex file contains the necesary config bytes for programming the PIC18F87J50;
the CP0 copy protect bit is not set, if you need to copy protect the programmer set this bit in the PIC
programmer you use for this.
For reflashing the TL866 you will need an PIC programmer (Pickit2,Pickit3,Picpgm,another TL866A). The J1
socket is an standard ICSP connector, just plug your pic programmer cable here, load the hex file generated
above and reflash.
In this image the J1 connector is located down left to the PCB, the first square pad is the pin number 1
The programming cable has a mark to the pin 1, please be sure they match.
In this image the TL866 programmer is reflashed by another TL866, be sure to activate
ICSP_VCC enable in the minipro software.
If you don’t have a dedicated PIC programmer then you can build a very simple one, but you will need the
presence of an LPT port in your PC like this:
The programming software used is picpgm wich can be downloaded here:
http://picpgm.picprojects.net/download/winpicpgm_v1650.zip
Settings to make picpgm to work with this “programmer”
1
2
3
4
3.3V
RC5
RC4
RC3
RC2
RJ7
RJ6
RC6
RC7
RJ4
RJ5
RG3
RG2
RD0
RD1
RD2
RG1
RE0
RE7
RE2
RE3
RE4
RE5
RE6
RE1
RD3
RD4
RD5
RD6
RD7
RG0
RJ0
RJ1
RJ2
RJ3
RB2
RB3
RB4
RB5
RB6
RB7
J1
R2
10K
9
3.3V
A
24
3.3V
23
3.3V
C3
100nF
C57 47nF
3.3V
C6
220uF/16V
C7
12
25
32
48
71
47nF
26
11
31
51
70
3.3V
C55 47nF
R44
C56 47nF
Q8
C23
100nF
C1
15pF
2
15pF
C10
100nF
Y1
16MHz
RA7
C2
D2
C5
100nF
L3
R3
1K1
F1
1mH
C9
220uF/16v
Top
C4
220uF/16v
D1
VUSB
VDDCORE/VCAP
AVDD
VDD
VDD
VDD
RB0/FLT0/INT0
RB1/INT1/PMA4
RB2/INT2/PMA3
RB3/INT3/ECCP2/P2A/PMA2
RB4/KBI0/PMA1
RB5/KBI1/PMA0
RB6/KBI2/PGC
RB7/KBI3/PGD
AVSS
VSS
VSS
VSS
VSS
RC0/T1OSO/T13CKI
RC1/T1OSI/ECCP2/P2A
RC2/ECCP1/P1A
RC3/SCK1/SCL1
RC4/SDI1/SDA1
RC5/SDO1/C2OUT
RC6/TX1/CK1
RC7/RX1/DT1
RH5
RA6
AMS1117-3.3
C
ENVREG
R43
240
Vin
Vout
GND
5V
RA0/AN0
RA1/AN1
RA2/AN2/VREFRA3/AN3/VREF+
RA4/PMD5/T0CKI
RA5/PMD4/AN4/C2INA
OSC2/CLKO/RA6
OSC1/CLKI/RA7
4K7
R25
4K7
1
B
MCLR
VBUS
DD+
GND
1
2
3
4
RF3
RF4
R1
5
6
7
8
10
79
80
1
2
22
21
20
19
62
61
60
59
39
40
41
42
RD0/AD0/PMD0
RD1/AD1/PMD1
RD2/AD2/PMD2
RD3/AD3/PMD3
RD4/AD4/PMD4/SDO2
RD5/AD5/PMD5/SDI2/SDA2
RD6/AD6/PMD6/SCK2/SCL2
RD7/AD7/PMD7/SS2
RG0/PMA8/ECCP3/P3A
RG1/PMA7/TX2/CK2
RG2/PMA6/RX2/DT2
RG3/PMCS1/CCP4/P3D
RG4/PMCS2/CCP5/P1D
RH0/A16
RH1/A17
RH2/A18/PMD7
RH3/A19/PMD6
RH4/PMD3/AN12/P3C/C2INC
RH5/PMBE/AN13/P3B/C2IND
RH6/PMRD/AN14/P1C/C1INC
RH7/PMWR/AN15/P1B
RJ0/ALE
RJ1/OE
RJ2/WRL
RJ3/WRH
RJ4/BA0
RJ5/CE
RJ6/LB
RJ7/UB
RE0/AD8/PMRD/P2D
RE1/AD9/PMWR/P2C
RE2/AD10/PMBE/P2B
RE3/AD11/PMA13/P3C/REFO
RE4/AD12/PMA12/P3B
RE5/AD13/PMA11/P1C
RE6/AD14/PMA10/P1B
RE7/AD15/PMA9/ECCP2/P2A
RF2/PMA5/AN7/C2INB
RF3/DRF4/D+
RF5/PMD2/AN10/C1INB/CVREF
RF6/PMD1/AN11/C1INA
RF7/PMD0/SS1/C1OUT
MCLR
VCC
GND
RB7 PGD
RB6 PGC
GND
30
29
28
27
34
33
50
49
1
2
3
4
5
6
10x51K
58
57
56
55
54
53
52
47
RB1
36
35
43
44
45
46
37
38
P1
P2
P3
P4
P7
P8
P11
P12
P16
P30
72
69
68
67
66
65
64
63
4
3
78
77
76
75
74
73
P1
P2
P3
P4
P5
P6
P7
P8
P9
P10
P11
P12
P13
P14
P15
P16
P17
P18
P19
P20
P21
P22
P23
P24
P25
P26
P27
P28
P29
P30
P31
P32
P33
P34
P35
P36
P37
P38
P39
P40
RH3
RH2
RG4
RA4
RH0
RH1
RA2
RA0
RA5
RA3
RH4
RA1
RF5
RF6
RF7
RH6
RH7
RF2
RC1
RB0
18
17
16
15
14
13
RC0
PIC18F87J50
470
SR_CLK
SR_DAT
/OE_VPP
/OE_VDD
LE0
LE1
LE2
LE3
LE4
LE5
LE6
LE7
VID_00
VID_01
VID_02
VID_10
VID_11
VID_12
GND20
OVC
D
A
B
C
D
5V
3.3V
TL866-CPU
1
2
3
5V
3.3V
4
1
2
3
L0
74HC373D
GND
VPP_32
VPP_38
VPP_39
VPP_40
VPP_2
VPP_1
VPP_36
VPP_30
A
5V
19
16
15
12
9
6
5
2
20
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
D8
D7
D6
D5
D4
D3
D2
D1
VCC
LE
OE
L1
3.3V
VPP_31
VPP_34
VPP_3
VPP_4
VPP_10
VPP_9
VPP_33
VPP_37
B
9
8
SR_CLK
RST VDD
CLK
QA
D1
QB
D2
QC
QD
QE
QF
QG
GND
QH
1
2
SR_DAT
7
14
3
4
5
6
10
11
12
13
D0
D1
D2
D3
D4
D5
D6
D7
5V
C
LE0
LE1
LE2
LE3
LE4
LE5
LE6
LE7
OE_VPP
OE_VDD
20
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
D8
D7
D6
D5
D4
D3
D2
D1
VCC
LE
OE
L2
VDD_21
VDD_13
VDD_12
VDD_11
VDD_8
VDD_7
VDD_10
VDD_9
R29 2K2
OE_VPP
OE_VDD
19
16
15
12
9
6
5
2
20
3.3V
3.3V
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
D8
D7
D6
D5
D4
D3
D2
D1
VCC
LE
OE
L3
3.3V
3.3V
5V
5V
VDD
GND
+VDD
19
16
15
12
9
6
5
2
20
VDD
5V
5V
5V
18
17
14
13
8
7
4
3
D7
D6
D5
D4
D3
D2
D1
D0
11
1
LE0
OE_VPP
D2
D3
D6
D1
D0
D7
D4
D5
18
17
14
13
8
7
4
3
LE7
OE_VDD
11
1
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
D8
D7
D6
D5
D4
D3
D2
D1
VCC
LE
OE
74HC373D
GND
D8
D7
D6
D5
D4
D3
D2
D1
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
LE
OE
VCC
L6
10
10
18
17
14
13
8
7
4
3
D0
D1
D2
D3
D4
D5
D6
D7
11
1
LE1
OE_VPP
D5
D4
D7
D0
D1
D6
D3
D2
18
17
14
13
8
7
4
3
LE6
OE_VDD
11
1
10
18
17
14
13
8
7
4
3
D5
D4
D7
D0
D1
D6
D3
D2
11
1
LE2
OE_VDD
D2
D3
D6
D1
D0
D7
D4
D5
18
17
14
13
8
7
4
3
LE5
OE_VDD
11
1
10
18
17
14
13
8
7
4
3
D5
D4
D7
D0
D1
D6
D3
D2
11
1
LE3
OE_VDD
D2
D3
D6
D1
D0
D7
D4
D5
18
17
14
13
8
7
4
3
LE4
OE_VDD
11
1
20
GND_5
GND_6
GND_7
GND_8
GND_9
GND_10
GND_11
GND_12
A
5V
74HC373D
D8
D7
D6
D5
D4
D3
D2
D1
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
LE
OE
VCC
19
16
15
12
9
6
5
2
20
GND_35
GND_34
GND_32
GND_31
GND_4
GND_3
GND_2
GND_1
B
5V
74HC373D
GND
D8
D7
D6
D5
D4
D3
D2
D1
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
LE
OE
VCC
L4
10
19
16
15
12
9
6
5
2
GND
L5
10
74HC373D
R30 2K2
VDD_3
VDD_2
VDD_1
VDD_39
VDD_40
VDD_38
VDD_37
VDD_5
10
74HC373D
GND
74HC164D
LE0
LE1
LE2
LE3
LE4
LE5
LE6
LE7
/OE_VPP
/OE_VDD
19
16
15
12
9
6
5
2
L7
10
74HC373D
GND
C59 47nF
4
19
16
15
12
9
6
5
2
20
GND_30
GND_14
GND_16
GND_38
GND_40
GND_39
GND_37
GND_36
C
5V
74HC373D
GND
D8
D7
D6
D5
D4
D3
D2
D1
Q8
Q7
Q6
Q5
Q4
Q3
Q2
Q1
LE
OE
VCC
19
16
15
12
9
6
5
2
VDD_6
VDD_34
VDD_30
VDD_32
VDD_4
VDD_36
VDD_35
VDD_33
D7
20
5V
D6
D
C50
47nF
C53
47nF
C54
47nF
D
VDD
C55
47nF
C51 47nF
C52 47nF
TL866-LATCH
1
2
3
4
1
2
GND switch details
3
VDD switch details
VPP switch details
ZIF_X
GND_X
3K9
VDD
NPN
A
4
NPN
PNP
VDD_X
1K2
1K2
VPP_X
VPP
PNP
A
10K
3K9
ZIF_X
16XVPP switch
ZIF1
ZIF2
ZIF3
ZIF4
ZIF9
ZIF10
ZIF30
ZIF31
ZIF32
ZIF33
ZIF34
ZIF36
ZIF37
ZIF38
ZIF39
ZIF40
40XVoltage limiters
P1
P2
P3
P4
P5
P6
P7
P8
P9
P10
P11
P12
P13
P14
P15
P16
P17
P18
P19
P20
P21
P22
P23
P24
P25
P26
P27
P28
P29
P30
P31
P32
P33
P34
P35
P36
P37
P38
P39
P40
B
C
R
*1K2
5V
ZIF1
ZIF2
ZIF3
ZIF4
ZIF5
ZIF6
ZIF7
ZIF8
ZIF9
ZIF10
ZIF11
ZIF12
ZIF13
ZIF14
ZIF15
ZIF16
ZIF17
ZIF18
ZIF19
ZIF20
ZIF21
ZIF22
ZIF23
ZIF24
ZIF25
ZIF26
ZIF27
ZIF28
ZIF29
ZIF30
ZIF31
ZIF32
ZIF33
ZIF34
ZIF35
ZIF36
ZIF37
ZIF38
ZIF39
ZIF40
ICSP Connector
ZIF1
ZIF2
1
2
3
4
5
6
ZIF3
ZIF7
ZIF8
ZIF_X
VPP_1
VPP_2
VPP_3
VPP_4
VPP_9
VPP_10
VPP_30
VPP_31
VPP_32
VPP_33
VPP_34
VPP_36
VPP_37
VPP_38
VPP_39
VPP_40
VPP
ZIF-40
ZIF1
ZIF2
ZIF3
ZIF4
ZIF5
ZIF6
ZIF7
ZIF8
ZIF9
ZIF10
ZIF11
ZIF12
ZIF13
ZIF14
ZIF15
ZIF16
ZIF17
ZIF18
ZIF19
ZIF20
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
40
39
38
37
36
35
34
33
32
32
30
29
28
27
26
25
24
23
22
21
ZIF40
ZIF39
ZIF38
ZIF37
ZIF36
ZIF35
ZIF34
ZIF33
ZIF32
ZIF31
ZIF30
ZIF29
ZIF28
ZIF27
ZIF26
ZIF25
ZIF24
ZIF23
ZIF22
ZIF21
ZIF1
ZIF2
ZIF3
ZIF4
ZIF5
ZIF6
ZIF7
ZIF8
ZIF9
ZIF10
ZIF11
ZIF12
ZIF13
ZIF21
ZIF30
ZIF32
ZIF33
ZIF34
ZIF35
ZIF36
ZIF37
ZIF38
ZIF39
ZIF40
VDD_1
VDD_2
VDD_3
VDD_4
VDD_5
VDD_6
VDD_7
VDD_8
VDD_9
VDD10
VDD_11
VDD_12
VDD_13
VDD_21
VDD_30
VDD_32
VDD_33
VDD_34
VDD_35
VDD_36
VDD_37
VDD_38
VDD_39
VDD_40
B
25XGND switch
ZIF1
ZIF2
ZIF3
ZIF4
ZIF5
ZIF6
ZIF7
ZIF8
ZIF9
ZIF10
ZIF11
ZIF12
ZIF14
ZIF16
ZIF20
ZIF30
ZIF31
ZIF32
ZIF34
ZIF35
ZIF36
ZIF37
ZIF38
ZIF39
ZIF40
GND_1
GND_2
GND_3
GND_4
GND_5
GND_6
GND_7
GND_8
GND_9
GND_10
GND_11
GND_12
GND_14
GND_16
GND_20
GND_30
GND_31
GND_32
GND_34
GND_35
GND_36
GND_37
GND_38
GND_39
GND_40
C
VDD
24XVDD switch
* For pin 28 R=50; pin 38 & 40 R=240
D
D
TL866-PIN DRIVERS
1
2
3
4
1
2
3
4
A
A
R16
22K
R22
Q4
VID_00
4K7
Q14
R17
C16
100nF
R14
9K1
Q5
VID_01
R4
4K7
B
U4
8
7
5
R18
8K2
R24
Q6
VID_02
4K7
R15
4K3
C21
C60
100nF 1uF
D13
R13 1
6K8
R23
C18
100nF
4
L2
1
R42
2K2
R36 2
Q11
B
6
DRV COLL
VCC
IPK
INSW COLL
SW EM
GND
TIM CAP
R37
1K2
C19
220uF/16V
D4
1
2
3
VDD
C17
220uF/16V
220uH
MC34063
D11
SS14
L5
100uH
R39 1K2 C22
R38
OVC
1K2
R40
1K2
C11 100nF
SS14
Q12
C15
470pF
D10
D14
5V
Q13
R10
C14
100nF
15K
R19
Q1
VID_10
R5
1
4K7
5V
R6
R7
240
R11
C
10K
R20
R8
33K
Q2
VID_11
4K7
R9
4K7
1
R33 3
U3
8
7
5
4
R41
2K2
D8
SS14
Q9
VPP
MC34063
DRV COLL
VCC
IPK
INSW COLL
SW EM
GND
TIM CAP
D2
6
1
2
3
SS14
L6
100uH
47uF/50V
R34
1K2
L1
9K1
R35
C20
100nF
C
4K7
47uF/50V
C8
470pF
R12
R21
47nF
Q10
100uH
Q3
VID_12
4K7
D
D
TL866-DC to DC converters
1
2
3
4