PROTOTYPE: Bus Pirate Next Gen v1

Posted on Thursday, September 13th, 2018 in Bus Pirate, Prototypes by Ian


Sjaak, fresh off his ARM adventures at SMDprutser, hacked together an STM32-based Bus Pirate prototype we’ve been calling NG1 (Next Gen version 1). NG1 uses a modern ARM chip with completely open tools and libraries, and sports an integrated logic analyzer . The firmware is very usable, but largely untested. Let’s have a look at the biggest changes.

STM32 ARM-based design


NG1 is built around an STM32F103CBT6, a modern ARM chip with 128K flash and 20K RAM running at 72MIPS.

All the extra resources let us use a proper printf function for terminal display, instead of the crappy obscure way of storing strings we invented for the v3.x hardware. The current firmware uses about half of the flash (78 of 128K). If we fill the chip, like we did with the Bus Pirate v3.x, STM32 has a full line of compatible chips with up to 512K of flash.

ARM has completely open toolchains, while the Microchip PIC used in previous Bus Pirates is still straggling with free-but-not-open-not-distributableand-crippled compilers and libraries. The ARM GCC compiler is open source and freely available for multiple operating systems. Several active open source libraries support the chip’s features, such as multiple USB endpoints. NG1 uses an open source peripheral library, libopencm3, so the complete source and libraries can be redistributed under the GPL.


Like most chips, STM32 doesn’t have a Peripheral Pin Select feature. PPS on the PIC24FJ64GA002 is what makes the original Bus Pirate v3.x design so elegant (left layout). Most major hardware modules like UART, SPI, timers, PWM, etc can be assigned to almost any pin using PPS – just one PIC pin is needed for each of the 5 Bus Pirate IO connections.

STM32 hardware modules are fixed to specific pins. Each Bus Pirate IO pin is connected to up to five STM32 pins to provide the necessary features. This kind of design uses a lot more pins (28 vs 64), and the PCB is a lot more complicated (right layout).

On-board Logic Analyzer


Frequently we use the Bus Pirate along side a logic analyzer like the Logic Pirate. NG1 has an SRAM-based logic analyzer directly on-board. The logic analyzer records bus activity every time the Bus Pirate writes or reads commands.

This adds an additional layer of debugging when things go wrong, without any extra cables or connections. Talk to a chip through the terminal, then check the logic analyzer to verify what actually happened on the bus. Terminal mode and the logic analyzer work at the same time because they each have a dedicated USB endpoint in the STM32. Microchip 23LC1024 SRAMs provide 256K samples per channel at 20MSPS on the current prototype, but we’ve found an alternate SRAM chip with over 10M samples per channel.

Currently NG1 uses a 74LVC573 single direction latch between the logic analyzer and bus. The next revision uses a 74LVC245 bidirectional latch[link] so the logic analyzer can also work as a signal generator without any additional hardware. Maybe we could toss on a resistor ladder to make an analog signal generator too.

So far we’ve focused on capturing bus activity while the Bus Pirate is writing and reading commands, but the hardware should work as a stand-alone logic analyzer as well. The high latency of STM32 pin interrupts could contribute to really sloppy capture triggers, especially at high capture speeds, but there’s still a lot to learn about this chip.

Selectable 3.3volt, 5volt, external pull-up voltage


The Bus Pirate has on-board pull-up resistors (10K) to use with 1Wire, I2C, and any other situation where an open drain bus is used. The on-board pull-up resistors can be connected to one of three voltage sources straight from the Bus Pirate terminal. Select from the on-board 3.3volt or 5volt power supplies, or use an external supply through the Vpull-up pin. Selecting the pull-up voltage from the terminal is really convenient new feature.


Two BL1551 analog switches are chained together so that three input sources (3.3volt, 5volt, Vpu pin) are controlled by two pins. If this seems familiar, it’s the same switch hardware we tested on the v3.x update.

Integrated USB and USB Micro B connector

STM32F103CBT6 has integrated USB hardware with actively developed open source driver libraries. Not only is the USB interface faster than a USB-to-serial converter chip, it supports multiple USB endpoints at the same time. Currently we’ve implemented one “low speed” USB endpoint for the terminal and DFU bootloader updates, and a second “high speed” USB endpoint for the on-board logic analyzer.

USB Micro B is by far the most common USB connector at the moment. NG1 uses a Micro B connector so it works with the phone cable that’s probably already on your desk.

However, we don’t like the Micro B connector as much as the Mini B. Every hand-soldered USB Micro B connector eventually broke off of the PCB. After re-soldering it numerous times the pads and tracks get to the point of no repair.

On the most recent hardware revision we removed the cheap “standard” Chinese Micro B connector and used a much more expensive Molex 47589-001 USB connector with through-hole tabs for reinforcement.

1x10pin keyed locking connector


Previous Bus Pirates use a 2x5pin IDC connector. These are easy to use with 0.1” jumper wires from your parts box, but there’s not many options for probe cables using an ICD connector.

NG1 uses a 1x10pin 2543/TJC8S-10AW (equivalent to Molex 70553-0044)connector, a common 0.1” header inside a keyed/locking shroud. The pins are 0.1” pitch, so jumper wires still work great, but now we can make high quality keyed/locking probe cables with tangle-free silicone wire.


The NG1 has a hardware reset button and a user configurable button. The user configurable button is currently only used for activating the bootloader during power-up. We haven’t decided yet on a good secondary purpose for it, but we are open for suggestions.

Second UART

A hardware UART is exposed for debugging without using USB. The code supports debugging via the UART, though we started debugging through the second USB CDC port after USB was up and running.

Taking it further

A logic analyzer, selectable pull-up resistor voltage supply, more memory and a totally open toolchain are probably the four biggest improvements to Bus Pirate NG1. The next revision will also support a hardware signal generator.

Hardware files are available here. The hardware is not final, but the current version addresses all known bugs. Quick order the latest PCB version at DirtyPCBs, or wait a week and we’ll have some to give away for free.

Firmware repository is here, it builds with the ARM GCC compiler. Use the command ‘git clone –recursive‘ to clone our git repository. That command should also take care of getting the right libopencm3 version. Be sure to run make in the ‘/libopencm3/‘ folder first, then switch to the ‘/source/‘ folder and run make again to built the firmware. We’ll walk through the toolchain setup next week.

This entry was posted on Thursday, September 13th, 2018 at 12:25 pm and is filed under Bus Pirate, Prototypes. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

16 Responses to “PROTOTYPE: Bus Pirate Next Gen v1”

  1. Michael Grant says:

    Fantastic MCU choice, the smaller STM32F103C8T6 is my go to part.

  2. John Peck says:

    I’ve been using the Bus Pirate v4’s bitbang mode to run scripted hardware tests. I really like not needing to download an API to run my tests on a new machine. Will this mode still be there on this new version?

  3. Have you guys evaluated the PSoC series from Cypress?
    Or alternatively a bunch of ARM vendors (NXP, Atmel/Microchip, Nordic) now support pin multi plexing

  4. darkspr1te says:

    I would suggest you break out the CAN bus too although it conflicts with the USB side there are ways around that with the secondary UART and FTDI, it would make a awesome OBD debugger

  5. Squonk42 says:

    For the micro USB connector, I suggest using this one that we used for our BluePill F4:

    It features “harpoon-like” through-hole legs, and is thus very difficult to tear off the board. It is cheap and very easy to get in China.

    The original manufacturer is “Dongguan BSC (Bestcreate) Electronics Co.,Ltd”, website here (not very useful though):

  6. Squonk42 says:

    – The STM32F103CBT6 features built-in CAN and 1MSPS 12-bit ADCs, maybe add them to the BP capabilities?
    – OLED or LCD screen connection?

  7. Electronic Eel says:

    Frequently plugging the usb connector in and out really stresses the solder joints of smd connectors. Even the more expensive ones wear out after some time and break.

    So why not use a traditional big USB-B connector as a THT part? Yeah, it is expensive for you to solder on a THT part. But please prepare the layout so that the user could do that himself.

    I have created a combination footprint for a SMD-Micro-B and THT-B connector for cases like this. See here for an example:….c-breakout/master/pictures/board%2Bsample.jpg

    • Electronic Eel says:

      Sorry, the blog software ate the correct link. Use this one instead:

    • Squonk42 says:

      From USB 2.0 “Cables and Connectors Class Document”, Table 3.1:
      1500 cycles [for standard USB-B connector]
      5000 cycles for Mini “B”
      10,000 cycles for Micro series

      These are mating cycles, and in this regard, the micro USB-B is 6x more durable than standard B. OTOH, the smaller the connector, the more sensitive it is from tear off by unaligned unpluging the cable. Most of micro-USB connectors are designed to be included into an enclosure that would keep them in place. But if you use these kind of connectors with no/few through holes on a bare PCB like here, they don’t last long.

      The best solution I have found for dev boards is to use a mid-mount micro-USB B connector with strong “harpoon-style” legs as described above.

  8. octal says:

    What SRAM chip are you going to use for the logic analyze? I can’t find any 10M spi sram on the market

  9. MartinZ says:

    The first screenshot seems to be showing STM32F103RBT6 – which is LQFP64 (and not CBT6, which is LQFP48).
    The schema also has LQFP64 placeholder.. so is it planned to use the smaller one in the next revisions?

  10. Michael says:

    A feature I’ve wanted forever is a dual RX UART mode, so I can watch both sides of a UART communication between devices (right now I the logic analysis functions on my oscilloscope, or a logic analyzer for that). This chip has enough UARTs to pull it off. Maybe it could insert color codes into the output so you can tell which device is speaking (but, that complicates things somewhat)


  11. mike ward says:

    wiil the NG1 be able to also become the logic pirate logic analyser ?

    if so, it will be extremely useful

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Recent Comments

  • Crawford: Biscuits!
  • hli: Sunday++
  • Jack: Hello! Any board relating to LC filter circuits?
  • Fabien: PCB is life, life is PCB.
  • Kurt: We sleep safely at night because rough men stand ready to visit violence on those who would harm us. (Rough women, too.)