HACK: Open source USB stack on MCP2200

Microchip has a new USB->serial converter chip called the MCP2200. We suspected they made this chip from a 20-pin PIC. The MCP2200 pinout is like other PIC uCs, and it has similar reset pin and internal voltage regulator circuits.

We hooked up our trusty PICKIT3 and read the device ID. The MCP2200 was recognized as a PIC 18F14K50! Save a few pennies if you need a 18F14K50 and buy the MCP2200 instead, the MCP2200 is currently cheaper than the blank PIC!

The firmware is probably based on the Microchip USB stack, but we’ll never know because the code is protected. Forget that! We decided to give it an open source firmware instead. Follow our hack below.

We released an MCP2200 breakout board earlier today, available now for $15.

Programming connection

Our initial suspicions of PICness were confirmed by a post in the Microchip forum. We still had a couple of SOIC protoboards and MCP2200 ICs laying around, so we started to experiment.

According to the datasheet, the USB D+ and D- pins are shared with the programming pins (PGC and PGD).

The /MCLR reset signal needs to be soldered to R6 (chipside). It’s better to add a series diode (D5) to protect the chip.

Be aware the PGC/PGD pins aren’t 5V tolerant (3.6volt max) and the /MCLR can’t stand more then 8V5!! It seems that the PICKIT3 manages this ok when supply is set to 3V3, or the PIC is very robust.

If unsure use this circuit to protect your PIC. It adds some voltage protection for the programming and reset pins using zener diodes.

Dump the code

Hackers as we are, we decided to read the chip and see what makes it tick. Unfortunately the chip returns all 0′s and the configwords told us why, it was code protected. That was a huge bummer: since we can’t read the code, we cannot return it to the original firmware after we start messing with it.

Liberate the MCP2200 with open source!

Let’s write our own firmware for the chip. We could use the USB stack Microchip provides, and write “open” firmware that mimics the current behavior of the MCP2200. Unfortunately Microchip has a fuzzy license agreement which doesn’t allow anybody to release sourcecode with their USB stack included. Recently Honken released an open source USB stack we can use instead.

Porting the stack was harder then we anticipated, as the PIC18F14K50 (also the PIC18F13K50) appears to be a bit crippled compared to the other PIC18s with USB support. It has very little (USB)RAM (256 bytes), and just 8 endpoints instead of the normal 16.

We compiled a test firmware with MPLAB and C18,  and loaded it into the MCP2200. The current code just echoes the bytes back, but it won’t be long before we come up with a complete open source replacement firmware. We had a couple of issues with MPLAB and our PICKIT3 so we had to flash  the chip from the commandline. The code is as usual in our SVN.

USB VID/PID

One word about compiling the firmware yourself: every USB device needs to have an unique VendorID and ProductID pair for the OS to know which driver to load. The USB.org tracks the VIDs and ensure they are globally unique, however there aren’t any ranges for testing or amateur electronics. Getting a VID is a challenging task for a group like us. Microchip offers a ‘free’ PID under their VID for little projects that use Microchip ICs, but that comes with a restrictive license.

You need to supply your own USB ID in USB_CONFIG.H. We don’t provide a VID/PID pair in the MCP2200 replacement firmware source, but the factory default is easy enough to find in the .inf if you need one for your experiments.

What are you gonna do with your MCP2200?

Links

PIC 18F14K50 specs

Program Memory Type Flash
Program Memory (KB) 16
CPU Speed (MIPS) 12
RAM Bytes 768
Data EEPROM (bytes) 256
Digital Communication Peripherals 1-A/E/USART, 1-MSSP(SPI/I2C)
Capture/Compare/PWM Peripherals 1 ECCP
Timers 1 x 8-bit, 3 x 16-bit
ADC 9 ch, 10-bit
Comparators 2
USB (ch, speed, compliance) 1, Full Speed, USB 2.0
Temperature Range (C) -40 to 125
Operating Voltage Range (V) 1.8 to 5.5
Pin Count 20
XLP Yes
Cap Touch Channels 9
This entry was posted in demonstrations, dev boards, Development, hacks, USB and tagged , , , , .

Comments

  1. Ian says:

    I am totally impressed!

    • Sjaak says:

      Thanks!

      Too bad the prototype did died from reverse current. As the ICSP share the same connections (and MCLR) I made a small ICSP header for easy attaching the PICKIT3. The USB connector is connected through some 1 wire female header, which I did connect the other way around.

      BTW one myth is busted: the MCP doesn’t contain any so called magic smoke… It just plain died, no smoke whatsoever.. Hopefully my shipment from mouser will arrive shortly :)

  2. Tiersten says:

    What I’d be worried about is whether the MCP2200 is actually a full production quality 18F14K50 or whether its a partially defective part that is still good enough to work with the MCP2200 code…

    • Ian says:

      Interesting theory. That would be a good reuse if they had a system in place to recycle defects like that.

    • Sjaak says:

      It is hard to tell.. It appears a full blown pic18f14k50 but I blew the prototype (dangerous prototype) as you can read above. I couldn’t test it before my new chips arrive (they are in backorder).

      Prolly it isn’t a crippled one and is the price so low because of marketing. It is a proven design and a simpel chip (the only thing you could do with is is prolly an USB serial converter). The intelligence is in the firmware (they use thier own stack with proven code) and in the (standard) windows/linux CDC driver. The is easy and prolly a code example in the Microchip stack (didn’t check it though)

      We don’t endorse buying MCP2200s and use them as PIC18F14K50s. It was pure a hack and a demonstration of the newly developped USBstack by Honken. Please see it in the same context as overclocking of PCs. If it works you’re lucky.

  3. Tiersten says:

    Yeah. Its just a possibility. Doubt Microchip will even admit that its a regular PIC there so its really unlikely whether they’d tell us if its a production quality one or its a partially defective one. The tiny discount from buying MCP2200s to reprogram isn’t really worth the risk anyway :)

    Will the replacement firmware just have CDC or will it be a composite CDC+HID like the stock MCP2200?

    Interesting how the ICSP pins are the same one as the USB pins though. Shame it also requires MCLR to be connected as you could have a very tidy way of reflashing your PIC just via the USB connector otherwise.

    • Sjaak says:

      The firmware currently just echoes the bytes send to it. It shouldn’t be to hard to init the serial port and outputs the bytes (a real replacement). I’ll try that when I got a replacement chip.

      The current stack only implements CDC (serial) class only and nothing else. Honken is trying to make DFU (kinda of universal bootloader) to work. We have plans to make other functions work, but serial is the most used thing by us.

      Having a HID class at the same time makes it incompatible with XP SP2 and below (I think)

      The device needs to be in reset and then a special voltage (+- 8V) needs ot be applied to the MCLR (reset) in order to reprogram it, chances of reflashing (accidently) is almost zero.

  4. Alfonso says:

    that is just awsome, I think that is kind of laziness of Microchip using a PIC instead of making a new IC but I can understand that it is cheaper to just write a firmeware

    • Tiersten says:

      Huh? Why is it lazy? Sounds efficient to me and making a dedicated chip doesn’t give you anything extra over what it can do with the PIC. I’d expect all the other USB -> serial chips to actually be microcontrollers of some kind as well. They might not be a generic one like the PIC but they’ll be running some kind of firmware inside.

  5. JTR says:

    Oh dear, why didn’t you guys break out the reprogramming pins as well? This board could have then been a general purpose MCP2200 / PIC18F14K50 board. If anyone was worried about the MCP2200 being a full spec’ed 14K50 then they could just fit a 14K50 and be done with it.

    Personally, I have little doubt that the chip is a full spec’ed 14K50. Microchip engineers have said as much at seminars according to various people contributing on various forums.

    • Sjaak says:

      We designed the breakout long ago, before we start hacking. It went more then a month ago to manufacturing. We prolly break them out in a later revision of the board.

      Remember that the ICSP pins aren’t mentionned in the MCP2200 data sheet and are used as USB pins.

      • Victor says:

        I modified your design this way – made a jumper connecting MCLR to mini USB unused pin. I forgot the diode to power supply, but managed to place one anyway. Also I used 12MHz CSTCE12M0G55-R0 ceramic resonator with embedded capacitors, actually this resonator is mentioned in Microchip’s datasheet. It works, but the programmability is to be checked yet – I don’t have PIC programmer, and due to high voltage protocol it’s not as easy to build as AVR SPI-based one. I also use 0603 instead of 0805.

        BTW, why so large cap on power and why ferrite bead? Do they actually add anything?

  6. Jon Chandler says:

    One nice thing about this would be using the firmware in a PIC18F14K50….then you can use a part in a DIP package. None of the USB chips are available in other than surface mount.

  7. JTR says:

    @Sjaak Thanks for the reply. Yes I think it would be a very good idea to breakout the programming pins. There are already some good MCP2200 boards out there and at a cheaper price too. However there are none that bring out the programming pins so this would make your board unique and value added.

  8. uf6667 says:

    dude, one question… (not sure if someone mentioned it yet)
    but you should be able to do a partial flash, right?
    flash something into the first bank to dump the rest of the code
    once you’ve done that, you can find out where to hook to dump the overwritten code

  9. Hardcore says:

    You can actually extract the code out of the Pic’s, but you need 2.
    Partial flash the Boot loader, then extract the main code.
    Then on the second attempt , partial flash the ‘main’ code to extract the boot loader.

    What you are left with, should be the full code of the device.

  10. I developed an application using Android using the MCP2200. And I want to change the firmware to include some simple functionality such as event counters (on / off) pins.
    The idea is to count pulses, and reset the counter when read.
    So I have a command to enable the counter to certain pins. And a command to read the value of the counters.
    thank you

  11. Harley Clark says:

    Could you extend the new open firmware so this becomes a USB->UART + USB->SPI + USB->I2C bridge?

  12. Kim Hailey says:

    I am new to this. Anyone know how to write a pattern out to the GPIO pins. I ran the configuration utility and I the USB is configured at port4. I tried to talk to the MCP2200 with PuTTY, but I got nothing. I can see that the Configuration Utility can somehow write to the GPIO. Any help would be appreciated

Leave a Comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Notify me of followup comments via e-mail. You can also subscribe without commenting.