The Blair Witch story of my first FPGA devboard made from a printer front panel

[RoGeorge]

This is true story, happened long ago, on another forum.
The tail, the reverse engineer, the schematic, FPGA 101.

Would be too long to post all at once.  Trying a new format, with reserved slots.
Please feel free to post a subscribe reply if you want to read the next episodes.

It was my very first FPGA, and the following content is Google translated from Ro to En, so any observations, corrections or comments are welcome.

[RoGeorge]

Part 1 - Looking through the guts of the beast, I saw an FPGA, a Xilinx Spartan IIE with 50000 gates.


About 5 years ago [in fact, cca. 2007 colorized ], a very large company I worked for bought several dozen HP Color Laserjet 4730 MFP multifunction printers.



All well and good, except that after a few months, the printers started dropping like flies, due to a design mistake.  Their control panel stopped working.

These panels were a real "Made in Japan" gem.  They had them like this:
- 6 LEDs (3 green + 1 red + a red/green combination)
- numeric keypad with 20 physical buttons
- a black and white LCD, 20 cm wide, with touch screen and backlight
- piezo speaker (buzzer)
The printers being under warranty, when a panel broke, HP sent a new one, and the defective one was thrown in the trash.

When I found out, I asked a former colleague and friend, whom I want to thank, and him and his boss, to give me a defective panel, not to throw it away, because I was going to recover the LCD and the touch screen.  He gave me two panels that were going to the trash.  Now, I'm sorry I didn't get them all.

Looking through the guts of the beast, I saw an FPGA, a Xilinx Spartan IIE, with 50,000 gates.  I really wanted to see what his skin could do, but at the time I thought the plate was defective.  Otherwise, the LCD seemed hard to use, the touch screen as well, I didn't even know if they were good or burnt, so I put everything back together and almost forgot about them.

Later, it was found out that the fault was the mechanical assembly, the electronics of the panel worked perfectly, but that's another story.

A few weeks ago [so, cca. 2012 colorized, we are now in 2024 ], ratza said that the company he works for is hiring.  One of the jobs required FPGA knowledge.

This reminded me of something I've been wanting to do for a long time, which is playing around with FPGAs. I started looking for development boards, but they were a bit expensive, between 50 euros for a chior chip on a test board, up to 500-1000 euros for a development board with LCD and touch screen.  That's how much the cheap boards cost, for amateurs, the professional ones cost about as much as a car...

These prices instantly refreshed my memory, and made me remember the FPGA seen on the printer panel board, only good development board panel.

I've always liked to do reverse engineering (that is, to take things apart to see how they were made), and for this money, it's definitely worth a try.  Let's see what comes out.

[RoGeorge]

Part 2 - front panel board peripherals, DIY a power supply and a Xilinx JTAG programmer


Back to the printer board, I first looked up the datasheet for each integrated on the board. That's how I got an idea about the block diagram. Upon further inventory, the board was found to have the following: 

• - FPGA Xilinx Spartan IIE, XC2S50E-6, 50,000 gates, i.e. 768 slices
• - 50 MHz oscillator
• - numeric keypad + several other buttons (20 push buttons in total)
• - Black/white LCD 256*64 (not sure about the resolution)
• - white backlight for LCD
• - LCD controller with EPSON S1D13503
• - 64K x 16 SRAM linked to the LCD controller
• - resistive touch screen
• - controller (ADC) for touch screen, made with ADS7846N
• - sensor for temperature and for supply voltage (included in ADS7846N)
• - an ADC channel with SAR at 125 KHz, left free from ADS7846N
• - piezo buzzer with volume control (2 bits, PWM + ON/OFF)
• - 4 LEDs + 1 bicolor LED (red + green)
• - several connections with buffers linked to a connector, 3 in + 1 out, suitable for serial, synchronous or asynchronous communication
• - Configuration PROM
• - standard JTAG connector, with 9 pins at 0.1 inch (it was not mounted, but it was very good that there were holes for it)

In terms of equipment, it is only good as a didactic board with FPGA, it has more than enough on it to develop applications in VHDL, Verilog or other HDL.

I already knew the power supplies, because I had put the oscilloscope on the connector of the board, to a functional printer. Otherwise I wouldn't have known how much to feed the board (yes, a few days after I got the boards, I took the oscilloscope from home, put it in a travel bag, and did the measurements at work, on a printer which was just having another defective panel replaced).

I got what is written in blue on the sheet in the picture. What is written in black, was added these days [in 2012].



The board needs 24V, later I would find out that they are for the LCD backlight and buzzer, and 3.3V for the logic part. I hastily whipped up a power supply, from a 24V switching power supply (salvaged from another broken printer), followed by a 12V LM7812 and an LF33 LDO which produces 3.3V. 12V was not needed, but the LF33 did not support more than 16V on the input, I could not connect it directly to 24V. So I put an LM7812 first, which supports a maximum of 36V, followed by an LF33. I don't put the diagram of the power supply anymore, I didn't even draw it. It's the one in the catalog, with a few tens of microfarads in parallel with 100 nF, both on inputs and outputs, at each stabilizer. The assembly is done in the air, it doesn't look very nice, but I was eager to start the toy.



Starting from the FPGA datasheet, I saw that the JTAG pins are dedicated, they cannot be mapped elsewhere. Following the wiring traces, I discovered that the JTAG pins go to the holes corresponding to the CN4 connector. Luckily for me, although the entire board was SMD technology and contained all sorts of hard-to-find connectors, standard 1x9 0.1 inch pin holes had been provided for CN4. Now I also had a way to talk to the FPGA, to reprogram it.

Once the JTAG connector was figured out, I needed a JTAG programmer for Xilinx Spartan IIE FPGAs, plus the rigor software.

Searching about JTAG, I found a link that explains very clearly what it is, how it came about and what can be done with JTAG.
http://www.fpga4fun.com/JTAG.html
I recommend the entire fpga4fun website, it is very clear and concise.

After understanding better than ever what JTAG is, I looked for a programmer. Too bad and these. They are usually included with the development board you buy. There are also separate programmers, but at prices of 50-100 euros. Too much. I decided to make my own. Again, fortunately, the chip manufacturer itself, Xilinx, provided a very simple programmer schematic for the parallel port:



My computer has a parallel port, and I already had the rest of the parts around the house. Compared to the original scheme, I added an LED connected to a free gate, to see when the programmer is working. Later I would find that I did very well, the LED is particularly useful.

After some tinkering I got this:



Buuun, we have a board powered and connected to the computer.

We just need to talk to her.

Xilinx offers a free software variant for configuring and programming their FPGAs, called ISE WebPack. It's a very large package, you need a few free GBs for download and a few more for installation. Cleaned by computer, downloaded the newest version, installed and...surprise! Spartan IIE, the FPGA on my board, was not supported.

Searched the net for the problem, the last variant that supported Spartan IIE was ISE 10.1. Made more space on the hard drive, downloaded another GB, installed another GB. All this lasted one day.

Finally, I was able to talk to the FPGA and read its ID.
Total victory!

[RoGeorge]

Part 3 - raising the schematic of the HP Color Laserjet 4730 MFP front panel board, prepare a Xilinx UCF file corresponding to that schematic


The next step was to remove the schematic, piece by piece and not very detailed, just enough to find out how, and to which pins, each peripheral is connected. It took quite a while, I'm not done yet. So that others don't waste time, the schemes:

Schematic 1 - HP Color LaserJet 4730 MFP - keyboard, piezo speaker, connectors


Schematic 2 - HP Color LaserJet 4730 MFP - LCD controller


Schematic 3 - HP Color LaserJet 4730 MFP - touch screen controller


Schematic 4 - HP Color LaserJet 4730 MFP - connectors for power, LCD and high voltage backlight


From the schemes above, I wrote the UCF file (User Constraint File). The UCF is a file that specifies, among other things, the connections between the FPGA pins and our scheme. For example, in the UCF it is written how we want to name each pin of the FPGA and where it is connected, if the pins have pull-up or pull-down resistors, etc. This file is used by the programs that configure the FPGA (ISE).

Below, the UCF file for PWB51652J-V0 (that's the name of the board in the pictures).

Code: [Select]

#========================================================
# Pin assignement for XILINX Spartan 2E - XC2S50E
# Printer display board PWB51652J-V0 (Mihai)
#
# Author: RoGeorge
# Version: 2012.07.13 V0.4
#========================================================



#========================================================
# Touch Screen Controller - ADS7846
#========================================================
NET "TSC_DCLK" LOC = "P77";
NET "NTSC_CS" LOC = "P78";
NET "TSC_DIN" LOC = "P79";
NET "TSC_BUSY" LOC = "P82";
NET "TSC_DOUT" LOC = "P44";
NET "NTSC_PENIRQ" LOC = "P80";

#========================================================
# CN1 Connector - 10 pins connector to outside world
#========================================================
NET "CN1_DI" LOC = "P85"; # CN1 pin 4
NET "CN1_CK" LOC = "P83"; # CN1 pin 6
NET "NCN1_CS" LOC = "P86"; # CN1 pin 8
NET "CN1_DO" LOC = "P84"; # CN1 pin 2

#========================================================
# Not shure - Buzzer BZ1
#========================================================
NET "BZ_VOL_PWM" LOC = "P48"; # PWM '0' -> (BZ+ = 24V)
#   '1' -> (BZ+ =  0V)
NET "BZ_PULSE" LOC = "P47"; #     '0' -> (BZ- = BZ+)
#     '1' -> (BZ- =  0V)

#========================================================
# Keyboard buttons, 8 input columns x 3 output rows
#========================================================
# 1 2 3 4 5 6 7 8 - A0_
# 9 * 0 # C y p bl - A1_
# NC NC NC NC gr gl gu br - A2_
# | | | | | | | |
#   D0_ D1_ D2_ D3_ D4_ D5_ D6_ D7_
#
# y = Yellow button
# p = Pink button
# bl = Blue Left button
# gr = Grey Right button
# gl = Grey Left button
# gu = Grey Up button
# br = Blue Right button
#========================================================
# 8 input columns with pullup resistors
NET "NKBD_D<7>" LOC = "P27"; # Data input D7 keyboard
NET "NKBD_D<6>" LOC = "P28"; # Data input D6 keyboard
NET "NKBD_D<5>" LOC = "P29"; # Data input D5 keyboard
NET "NKBD_D<4>" LOC = "P30"; # Data input D4 keyboard
NET "NKBD_D<3>" LOC = "P31"; # Data input D3 keyboard
NET "NKBD_D<2>" LOC = "P32"; # Data input D2 keyboard
NET "NKBD_D<1>" LOC = "P38"; # Data input D1 keyboard
NET "NKBD_D<0>" LOC = "P39"; # Data input D0 keyboard

NET "NKBD_D<?>" PULLUP; # Pullup resistors

# 3 output rows with pullup resistors
NET "NKBD_A<2>" LOC = "P23"; # Address A2 keyboard
NET "NKBD_A<1>" LOC = "P26"; # Address A1 keyboard
NET "NKBD_A<0>" LOC = "P24"; # Address A0 keyboard

NET "NKBD_A<?>" PULLUP; # Pullup resistors

#========================================================
# LEDs - 6 discrete LEDs, common anod
#========================================================
NET "NLED<6>" LOC = "P18";
NET "NLED<5>" LOC = "P21";
NET "NLED<4>" LOC = "P22";
NET "NLED<3>" LOC = "P15";
NET "NLED<2>" LOC = "P20";
NET "NLED<1>" LOC = "P14";

#========================================================
# LCD controller - EPSON S1D13503F01
#========================================================
# controll bus
NET "LCD_BKL" LOC = "P13"; #LCD backlight

NET "LCD_READY" LOC = "P12";
NET "LCD_OSC1" LOC = "P67";

NET "LCD_RESET" LOC = "P11";
NET "NLCD_MEMR" LOC = "P10";
NET "NLCD_MEMW" LOC = "P8";
NET "NLCD_MEMCS" LOC = "P7";

NET "NLCD_IOR" LOC = "P6";
NET "NLCD_IOW" LOC = "P5";
NET "NLCD_IOCS" LOC = "P4";
NET "NLCD_BHE" LOC = "P3";

# data bus - 16 bits
NET "LCD_DB7" LOC = "P132";
NET "LCD_DB6" LOC = "P131";
NET "LCD_DB5" LOC = "P125";
NET "LCD_DB4" LOC = "P124";
NET "LCD_DB3" LOC = "P123";
NET "LCD_DB2" LOC = "P122";
NET "LCD_DB1" LOC = "P121";
NET "LCD_DB0" LOC = "P118";

NET "LCD_DB8" LOC = "P133";
NET "LCD_DB9" LOC = "P134";
NET "LCD_DB10" LOC = "P137";
NET "LCD_DB11" LOC = "P138";
NET "LCD_DB12" LOC = "P139";
NET "LCD_DB13" LOC = "P140";
NET "LCD_DB14" LOC = "P141";
NET "LCD_DB15" LOC = "P142";

# address bus - 20 bits
NET "LCD_AB0" LOC = "P87";
NET "LCD_AB1" LOC = "P89";
NET "LCD_AB2" LOC = "P92";
NET "LCD_AB3" LOC = "P93";
NET "LCD_AB4" LOC = "P94";
NET "LCD_AB5" LOC = "P95";
NET "LCD_AB6" LOC = "P96";
NET "LCD_AB7" LOC = "P97";
NET "LCD_AB8" LOC = "P98";
NET "LCD_AB9" LOC = "P100";
NET "LCD_AB10" LOC = "P101";
NET "LCD_AB11" LOC = "P102";
NET "LCD_AB12" LOC = "P103";
NET "LCD_AB13" LOC = "P104";
NET "LCD_AB14" LOC = "P69";
NET "LCD_AB15" LOC = "P106";
NET "LCD_AB16" LOC = "P114";
NET "LCD_AB17" LOC = "P115";
NET "LCD_AB18" LOC = "P116";
NET "LCD_AB19" LOC = "P117";

#========================================================
# Clock and Reset
#========================================================
NET "CLK" LOC = "P129";
# NET "RESET" LOC = "Pyy";

#========================================================
# Timing constraint of 50 MHz onboard oscillator
# name of the clock signal is CLK
#========================================================
NET "CLK" TNM_NET = "CLK";
TIMESPEC "TS_CLK" = PERIOD "CLK" 20 ns HIGH 50 %;

Now, we have everything we need to start programming. In the following examples, I will use the VHDL language.

For those who don't know, if we look from the plane, an FPGA is an integrated circuit in which you can put whatever scheme you want. The diagram can be drawn or written in a programming language to describe the diagram. An example of such a language is VHDL. We are talking here about circuits with digital (numerical) circuits, that is, circuits with logic gates, counters and the like, not analog circuits, such as those with operational amplifiers. On the board in the pictures, the FPGA is that big, fat, 144-foot integrated that says Xilinx Spartan. Xilinx is the company that produces it. Spartan is the trade name that Xilinx has given to a range of FPGAs produced by them.

Acronyms:
FPGA - Field Programmable Gate Array
UCF - User Constraint File
ISE - Integrated Synthesis Environment
HDL - Hardware Description Language
VHSIC - Very High Speed ​​Integrated Circuit
VHDL - VHSIC HDL

[RoGeorge]

Reserved 4

[RoGeorge]

Reserved 5

[RoGeorge]

Reserved 6

[RoGeorge]

Reserved 7

[RoGeorge]

OK, found the pics, too, part 1 ready:
Part 1 - Looking through the guts of the beast, I saw an FPGA, a Xilinx Spartan IIE with 50000 gates. 

[pcprogrammer]

Interesting journey. 

At that time what was the status of the Xilinx software? Still only paid for licensing or already free for the simpler devices?

This because you mentioned the high prices of development boards, and what I know from how expensive the software was in the beginning. (Around 1990)

[RoGeorge]

Back then, the current tool chain was Xilinx ISE 12.x or so, with both a paid and a free (reduced) version.

However, the chip found in that printer front panel was a Spartan 2.  The Xilinx Spartan 2 family was no longer supported in any IDE greater than Xilinx ISE 10.x (? not very sure about the minor version number back then).  Xilinx Vivado was not yet invented.  There was an unreleased project (i think the internal Xilinx name was of a sculptor name, IIRC "Rodin"), later to become Vivado - no idea how the sculptor name was changed into Vivado.

AFAIK, starting from at least Xilinx ISE 10.x to today Xilinx tools, there always was a free version of their IDE.  At first the name for the free Xilinx ISE was ISE WebPack (the name might seem like a cloud product, but Xilinx cloud compiling was not yet a thing until Vivado, around cca 2015 or so).

The ISE WebPack was a standalone/offline toolchain perfectly usable for learning/small projects, just that it was stripped away from the most IP blocks and from other productivity tools that one might want/need for a more elaborated/professional design.

[iMo]

..
This reminded me of something I've been wanting to do for a long time, which is playing around with FPGAs. I started looking for development boards, but they were a bit expensive, between 50 euros for a chior chip on a test board, up to 500-1000 euros for a development board with LCD and touch screen.  That's how much the cheap boards cost, for amateurs, the professional ones cost about as much as a car...

I bought (my own money) my first Xilinx FPGA in around year 2000 - XC5202 (3000 gates) - for aprox 50E (in 2000 value), still have the board with 9k6 YAM TNC Packet Radio modem.. None Xilinx programming environment available at that time to me, I just flashed the binary into it via the parallel port and some simple bitbanging sw somebody wrote..

[pcprogrammer]

My first FPGA experience was with a Xilinx XC3042 (144 CLB's 480 FF) and I was amazed with what I could cram into it. 

The software was made available to the foundation I worked for at a reduced rate, but still expensive. A full version would cost about 4500 euro or so (10000 Dutch guilders) and definitely not affordable for a hobbyist. I still have the floppies, documentation and a bunch of these old FPGA's, because when I left there, no one was interested in it all.

[daisizhou]

Looking forward to your masterpiece

[RoGeorge]

Thank you , part 2:
Part 2 - front panel board peripherals, DIY a power supply and a Xilinx JTAG programmer

[RoGeorge]

Ready part 3, the must have prerequisites needed to use that printer front panel board as an FPGA devboard for Xilinx ISE:
Part 3 - raising the schematic of the HP Color Laserjet 4730 MFP front panel board, prepare a Xilinx UCF file corresponding to that schematic