A first usable version of the sampling software for my ADC4 board is done with the 1 GB RAM. As always needed a bit longer than expected, not as easy as it should be to access DDR3 RAM from a FPGA. I included a test mode which saves a counter in the RAM to check it, and also a CRC8 checksum because I'm transferring it over an external serial port connection. Sometimes there are transfer errors, but the CRC8 checksum detects it and I transfer the block then again. So the data should be very accurate.
I recorded the programming cycle of a PMS150C with SOT-23-6 package. There is no extra information with 25 MHz, so I used 12.5 MHz samplerate.
I stored the data in Sigrok format to view with
PulseView, which is the best open source program for viewing analog data that I could find. It works for Windows, Linux and Mac. I couldn't find a way for GTKWave to show voltage divs. PulseView forgets the settings always when you load a new file, but at least it can be configured with 1 V per div and horizontal lines for each div, and navigating even in big datasets is fast and smooth. This is an example how you configure it when you click on the channel arrow:
You can also see the cursor, which is enabled by clicking on the blue cursor symbol in the toolbar, and which is useful for measuring time deltas.
All files are here:
http://www.frank-buss.de/tmp/dumps.zipA *.sr file is just a zip file, and the analog-1-1-1 files are binary files of the voltages, with 4 byte float values for each sample, which could be converted back to float in Python with struct.unpack. But for easier reading I stored it in CSV format as well. The files in detail:
blinker.zip: the Padauk project and PDK file, compiled with IDE version 0.84
dump1.sr/csv: programming an already programmed PMS150C OTP chip with the blinker OTP. The following signals are connected to the channels:
CH1: PA4
CH2: PA6
CH3: VDD
CH4: PA5
The full sequence looks like this:
PA5 (CH4) doesn't look very interesting. So for the next files dump2.sr/csv, I sampled the following signals, now using CH4 for PA3:
CH1: PA4
CH2: PA6
CH3: VDD
CH4: PA3
It looks like this:
You can use the signals which are identical in the two dumps to correlate the PA5 signal in relation to PA3, if needed.
Then I used an empty chip and programmed it and saved it as dump3. The channel configuration is the same as used first:
CH1: PA4
CH2: PA6
CH3: VDD
CH4: PA5
It needs longer, so I sampled 2 seconds, with the same resolution of 12.5 MHz samplerate as the other dumps. Looks like this:
Finally I used another empty chip and programmed it, and saved the dump as dump4, now recording PA3 again instead of PA5 with CH4:
CH1: PA4
CH2: PA6
CH3: VDD
CH4: PA3
Looks like this:
I don't have much time to analyze it myself, but I guess now it shouldn't be too difficult to reverse engineer the full protocol.
PS: I disabled the open/short test with the ".writer" directive in the blinker.PRE file, because there were some problems with it with the SOT23-6 to DIP14 adapter, so some details of the dump might be different compared to the other dumps.