Bus Pirate PIC24F programmer

This post is an overview of a test app that uses the Bus Pirate’s binary rawwire mode to program another Bus Pirate. This could be a handy way to unbrick one Bus Pirate with another. Eventually, we’d like it to program all PICs that don’t require a 13volt programming voltage (18FJ/FK, 24F, 30F, and 33F).

We’re having some problems getting it working though, and we put up one of Ril3y’s laser-cut Bus Pirate cases as a bounty for help solving the problem.

Download the current executable and source archive here, the latest source is in the SVN. Keep reading for an overview of the programmer application.

The application is currently limited to Windows with the .NET framework, but that might expand after we get beyond the test phase. After opening the application, select the serial port for your Bus Pirate and click connect. Next, press the ‘initialize Bus Pirate’ button to setup rawwire mode with active power supplies.

The programmer has a GUI on the Manual Control tab that can put the PIC in programming mode and read/write commands, read more about PIC24F programming in our previous post. It’s far easier to debug the programmer with scripts, so we’ll only cover the script mode here.

The script file is simply created in any text editor without formatting (e.g. Notepad). It has the file extension .scrp24. There are example scripts in the download archive and SVN. Click ‘open and load script’ on the script mode tab and select a script to run. Scripts are executed immediately.

As of this writing, the script mode accepts the 5 essential commands used for PIC24F programming. The script file is written in the following format (separated by comma):

Command, Data Byte(in hex) , Delay (in msec), Comment

It consists of the follow mandatory fields:

Command	Data Byte(in hex)	Delay in milliseconds after the command was executed	Comment
ENTERICSPNORMALMODE	0x000000	Integer value	The data is not used in this command.
FORCEDSIX	0x000000	Integer value	The data is not used in this command. This command always sends 0x000000 data.
SIX	<Hex Value>	Integer value	This sends <Hex value> on the data bus.
REGOUT	0x000000	Integer value	The data is not used. It reads the data from the PIC24.
EXIT_ICSP	0x000000	Integer value	The data is not used.

Here is an actual example script:

//test.scrp24
//Sample Script
//Command, Data Byte(in hex),Delay (in msec), comment

ENTERICSPNORMALMODE,0x000000,10, This is for entering ICSP Mode. Delay of 10msec.
FORCEDSIX,0x000000,10, This is forced SIX Command usually sent after entering to ICSP Mode.
SIX,0x000000,10, It sends 0x000000 Data. It has a delay of 10msec.
SIX,0x0000FF,20, It sends 0x0000FF Data. It has a delay of 20msec.
REGOUT,0x000000,20, This is for reading. The Data is not used. It has a delay of 20msec.
EXIT_ICSP,0x000000,10, This is for exiting ICSP Mode. The Data is not used. It has a delay of 10msec

The scripts care used to send the command sequences shown in the PIC24F programming specification.

This is the sequence to erase the PIC from page 17 of the programming spec [PDF!]. We enter this as a script and run it, but we haven’t successfully erased a chip yet.  A test read script appears to read the NVCON register correctly once, but then fails after additional attempts. The output looks great on a logic analyzer, but we’ve had little success.

Hopefully a review of the Open Programmer source will give us some clues. If you figure it out, we’ll send you one of Ril3y’s laser-cut Bus Pirate cases (see details).