Keil ULink

Some time ago I've investigated the Keil ULink JTAG adapter. Note that this is version 1, not the ULink2, ULinkPro or ULink-ME. The following image shows the schematic (the link opens a PDF file), previously posted at Mikrocontroller.net.

The device is built around the well-known Cypress AN2131 EZ-USB microcontroller and has additional 32 kByte external memory. Level shifters are used for the JTAG signals, which are available at 3 connectors for Infineon OCDS, ST and ARM.

Since the device is quite generic, any other things can be done with it. A few students used it to program their custom firmware and PC software (running on Linux) to use the device to download ATmega and ARM software as well as an OpenOCD driver. Links and details will follow.

Unfortunately the work is only tested with the ULink version 1. Does anybody have a ULink2 and is interested to borrow it to us for investigations and firmware adoption?

Logic Analyzer and Protocol Analyzer

The Logic Analyzer and Protocol Analyzer is a project done during Easter holidays. It uses an FPGA for acquisition, then transfers the samples to the PC, where a protocol analyzer identifies the ones and zeros and reconstructs e.g. I2C bus traffic or a program download and debug session via JTAG.

Several years ago I got a Cesys X2S_USB FPGA board with a Xilinx Spartan-2 XC2S200-PQ208 FPGA and an AN2131 EZ-USB microcontroller (MCU). The MCU has rich connectivity to the FPGA and is used for programming and control, both via the PC.

The first image shows the X2S_USB and an add-on board with multiple pin-head connectors. Each size is available twice to connect this board as sniffer to a ribbon cable. One cable comes e.g. from a JTAG programmer and the second goes to the target device. No intermediate connector at ribbon cables are required this way.

Logic Analyzer

The Logic Analyzer part is mainly implemented in the FPGA. Commercial logic analyzers sample the input signals periodically. Either an internal clock is used (like a digital scope) or a dedicated input signal is used as clock. This projects realizes a different approach: The logic signals are only stored, if any of them has changed. This looses time information, but instead spares the small amount of acquisition memory.

For each input signal one of the 4kBit Block RAMs is used. The FPGA contains 14 such Block RAMs, therefore up to 14 signals can be monitored with up to 4096 values.

Before the operation can start, the MCU is used to download the config bitstream (167 kBytes) from the PC via the USB bus into the FPGA. For the operation, the FPGA is connected to the EZ-USB via the 8 bit external memory interface. The MCU can access a control register and a sample counter as well as a FIFO to read out the acquisition memory.

Everything is controlled with a small PC program, which communicates with the MCU via USB.

Protocol Analyzer

The protocol analyzer functionality uses the samples acquired by the logic analyzer and applies analysis algorithms. Successive algorithms hierarchically extract the meaning from the data. The first step is to convert the samples to protocol-specific symbols, e.g. I2C-Start, -Stop or -Data. The next levels extract the meaning of these symbols with a notion of underlying grammar, e.g. I2C Byte or a whole I2C Transfer.

Currently only I2C analysis is done. The output is printed as text, so no fancy GUI or waveforms. Next steps will be a more user-friendly interface with Readline and perhaps a scripting language. This will be supplemented with a GUI and finally with waveforms.

Eagle, VHDL, Firmware and PC software sources are available under the terms of the GPL on request.