Minimum logic analyzer requirment for decoding a 20Mhz SPI bus - Page 1
Forum section: electronics / beginners

author: poot36
author_rank: Frequent Contributor
timestamp: November 16, 2022, 04:17:48 am
content: I am looking into getting a USB based logic analyzer to try and figure out why a motherboard I have reads the SPI BIOS chip for a short time and then gives up. The chip is is a 8Mb unit. I am wondering if one of the cheap clone 8 channel 24Mhz USB LA's would work (example:https://sigrok.org/wiki/MCU123_Saleae_Logic_clone) or would I need to get one of the 16 channel 100Mhz USB units (example: Kingst LA1010) ? I am not sure if the USB 2.0 bus on these units would be fast enough to stream the data coming from the LA or not. I know there is a higher up model of the 100Mhz unit that does have onboard ram so that would get around the USB bus speed but I am not really wanting to get that one if I don't have to as it is more expensive.

author: ataradov
author_rank: Super Contributor
timestamp: November 16, 2022, 04:54:09 am
content: 24 MHz is not enough 100%. 100 MHz is probably the minimum to get something reasonable. Many logic analyzers can compress the data and pack multiple samples into the same byte, saving some bandwidth.But I'm not sure how exactly you will know why it gives up. There would be either few transfers to read basic chip ID and stuff like this and giving up because something basic is not right. Or there will be an attempt to read a lot of data and you won't know what the host does not like about it. It might read the image that is not properly checksummed or signed. How would you know?

author: Zenith
author_rank: Frequent Contributor
timestamp: November 16, 2022, 06:11:13 am
content: Those little 8ch 24MHz logic analysers cost next to nothing and are great if you are messing with Arduino, RPi etc, and don't want spend much. I doubt one would have what takes to do what you want here.I'm inclined to agree with ataradov and say that this approach is barking up the wrong tree anyway. I suspect it's corrupt BIOS or the wrong BIOS - try another version if possible - or a faulty BIOS chip. I can't see how a logic analyser would shed much light on it.What's the story behind this? Is this something you've had in regular use for years and it's stopped working? Has it been unused for years? Is the M/B new to you?

author: poot36
author_rank: Frequent Contributor
timestamp: November 17, 2022, 02:50:02 am
content: @Zenith I have tried the only bios image from the manufacture. I got the M/B from work as they were going to toss it because it would not power on. I don't know any more information about it but that. I have checked all the power rails and clock signals that I can find and they look OK to me. I don't have a POST card for this motherboard as it only has mini PCI-E slots on it. I checked the LPC header for any activity with my scope and saw none when I powered the board up. The motherboard is from a Bematech LC810 mini computer and there is really no information on this board online. The model of the M/B is DMS-BT12 REV A1 and it is running a Intel Atom J1900 processor. What ever is wrong with this board is pretty bad as I don't even get any activity on the RAM SPD lines either.@ataradov I just want to see if the board is looping trying to read the BIOS chip or not. The chip programs fine and verifies correctly so I am at a bit of a loss right now.

author: ataradov
author_rank: Super Contributor
timestamp: November 17, 2022, 03:10:24 am
content: If you just want to see that host does something with the IC, all you need to check if any of the lines toggle. Specifically CS is a good pin to check. For this the simplest logic analyzer would do the trick, you don't actually need the data.

author: DavidAlfa
author_rank: Super Contributor
timestamp: November 17, 2022, 03:16:22 am
content: Probably the famous Atom CPU bug:https://www.eevblog.com/forum/microcontrollers/intel-atom-c2000-failures/

author: amyk
author_rank: Super Contributor
timestamp: November 17, 2022, 03:24:07 am
content: That crossed my mind too, but I wonder how many designs put BIOS on the LPC instead of the dedicated SPI bus that the SoC has.Edit: according tohttps://www.eevblog.com/forum/microcontrollers/intel-atom-c2000-failures/msg3568464/#msg3568464it might not only be the pullups which are dying as initially thought, but also the pulldowns. J1900 is also affected, not just C2000, and probably a few others too.

author: Zenith
author_rank: Frequent Contributor
timestamp: November 17, 2022, 02:04:15 pm
content: Did you get the whole thing including case, RAM, storage and PSU, or just the bare M/B?From the WWW this "minicomputer" (it had me thinking of PDP11, HP1000 etc) looks for all the world like a thin client or USFF PC, available used on ebay for not much.So unless you are rising to the challenge of fixing it, I'm inclined to ask why you are messing with it.

author: poot36
author_rank: Frequent Contributor
timestamp: November 18, 2022, 03:03:19 am
content: @ataradov I can see data on all the SPI lines but if it is sending garbage commands to the chip it wont boot.@DavidAlfa, amyk I will take a look at that.@Zenith I did get the whole unit minus the HDD as it has sensitive data on it. Also made a typo on the model number it should be LC8810 not LC810. Sorry about that. Here is the manual for the unit:https://www.manua.ls/bematech/lc8810/manual

author: ataradov
author_rank: Super Contributor
timestamp: November 18, 2022, 03:17:46 am
content: Quote from: poot36 on November 18, 2022, 03:03:19 amThis is highly unrealistic scenario. Plus it would be hard to tell if all the commands are good. And if it does, what are you going to do?

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 01:06:09 am
content: @ataradov If it is sending garbage I would double check the clocks as that is most likely why the garbage is being sent. I have attached a picture of the LPC clock but I am not sure if it is normal or not.

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2022, 01:12:56 am
content: What clocks would you check? Why do you think it is likely? If the clock is so bad, then what are you going to look at with the analyzer?This clock looks fine. Some overshoots/undershoots are normal and partially would be due to the probing setup. This is clean enough that I would not worry about it.

author: JustMeHere
author_rank: Frequent Contributor
timestamp: November 21, 2022, 01:31:14 am
content: Honestly, get a DZ1054 from Rigol

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 01:48:59 am
content: @ataradov I would think the clocks are possibility likely due to previous comments about the Intel Atom bug.@JustMeHere Do you know if the Rigol supports decoding 20Mhz + SPI buses?

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2022, 01:58:26 am
content: Quote from: poot36 on November 21, 2022, 01:48:59 amYes, but LPC clock is not related to the SPI or its clocks.Quote from: poot36 on November 21, 2022, 01:48:59 amIt does, but the capture time is limited by the available memory and sampling rate. It may also be easier to just export traces into CSV file and do the decoding on a PC. I can't imagine going though long captures on the scope UI.At best you have 24 Mpts of memory. Let's say you only want to capture 2 channels (SCK and MOSI), then you will have 12 Mpts. At 100 MSPS you get 120 ms of capture time.

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 02:06:55 am
content: Ok so it looks like the Rigol may not be the best thing to get. Would one of the USB based LA's be fast enough to do what I want it to do? I am looking for one that is compatible with the Sigrok software. Looking to spend around $150 max.

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2022, 02:25:59 am
content: Most of the fast LAs would be storing samples in the internal memory, so it depends on the memory of the LA.And again, you will waste money on this. There is nothing actionable you can discover here.Capturing a ton of data is not the right approach anyway. You can do with just the first few bytes. If they are fine, then it is likely the resto of the transfer is also fine. Or capture a few random chunks in the middle and look at individual transfers. Those spot checks are good enough to verify clocks and data integrity. There is nothing else you could possible do here.

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 02:39:12 am
content: I did try using my very old HP 1661C LA (only 8K of memory) to capture the first section of data that the BIOS chip works with but when I exported it to a format that the Sigrok software could understand and then decoded it and none of the decoded data made any sense. I had the LA set to run off the SPI clock and to trigger on the rising and falling edge of the clock. Perhaps I did something wrong here? This LA is really only setup for parallel data capture and decode not a serial data stream. I have attached the .csv file and the raw data from that run as a rar file (had to change the file name to .zip to attache it and the first row of data has been removed from the .csv file as it was not valid data). The data is as follows CLK CS DO /WP DI /HOLD.

author: JustMeHere
author_rank: Frequent Contributor
timestamp: November 21, 2022, 02:54:53 am
content: You can always hook up your scope to a computer and make long captures. You need a scope anyways.

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 03:21:27 am
content: @JustMeHere The only digital scope I have is a Tektronix TDS210 with 1K points of sample memory and no way to connect it to a computer.

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2022, 03:54:02 am
content: Quote from: poot36 on November 21, 2022, 02:39:12 amWhy falling edge? I'm not familiar with this LA, but I don't see how that would work.Use your Tek scope and capture a first byte, it if makes sense and signals look ok, it is highly likely that the reset of the bytes are also fine.

author: poot36
author_rank: Frequent Contributor
timestamp: November 21, 2022, 04:35:32 am
content: @ataradov My scope only has 2 channels, I think I need 4 to do that. The LA was triggering on the rising and falling edge, should I have only set it to rising?

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2022, 04:51:27 am
content: You can observe SCK+MOSI to know the request and then SCK+MISO to know the response. Realistically all you need is to see that signals look clean and alignment of the clock and data makes sense. There is no more useful information you can extract from there.I don't know what 'triggering' means in that case. Usually triggering is a single time thing that starts the capture. In this case triggering on the clock makes little sense, you want to trigger on the CS going low. But there may be something specific to this LA, no idea.

author: DavidAlfa
author_rank: Super Contributor
timestamp: November 21, 2022, 07:18:33 am
content: You're convinced the problem is the SPI memory, but probably isn't, the reality is it's a pretty complex boot chain and It takes only one wrong to break it.Check the LPC clock with the probe in 10x mode, high frequencies can't be properly measured with 1x probes.Try a pci diagnostic card, will show some codes to start looking at.

author: poot36
author_rank: Frequent Contributor
timestamp: November 22, 2022, 03:00:47 am
content: @ataradov I can try checking those lines with my scope. I may have misused the word triggering in relation to my LA, the unit supports both state and timing mode. I have selected state mode as this allows the clock of the SPI chip to run the LA. It is set up to take a sample when the clock pulse goes from high to low and another sample when the clock pulse goes from low to high (IE triggers the LA to sample). Not sure if that makes sense.@DavidAlfa I have previously in this thread posted a LPC clock with a 10x probe the problem is my scope is only 60Mhz so I think I am running close to its limits. As this is a Intel Atom based system it does not have a PCI bus just a PCI-E bus and that is a nonstandard mini PCI-E slot. I don't have a POST card for that type of slot. I have probed the mini PCI-E slot with my scope and don't see any activity on any of the lines except for the clock line.

author: ataradov
author_rank: Super Contributor
timestamp: November 22, 2022, 03:03:36 am
content: Quote from: poot36 on November 22, 2022, 03:00:47 amThis does not make sense for SPI. Depending on the mode SPI will change the data on one edge and sample on the other. So you need to use one one edge. Most likely rising, but it depends.

author: amyk
author_rank: Super Contributor
timestamp: November 22, 2022, 03:04:30 am
content: Note that this SoC can have a BIOS in "descriptor format" so you are unlikely to see the first byte read from the EEPROM being the first byte of the reset vector at FFFF:FFF0, but instead will be getting several descriptor-area reads from the hardware before it fetches the reset vector. I recommend finding the datasheet and reading through the relevant sections first.

author: poot36
author_rank: Frequent Contributor
timestamp: November 22, 2022, 03:45:44 am
content: Well I attempted to look at the signals with my scope but either my scope is not good enough or things are really messed up. I noticed that on power up the clock line pulses once and then stops and then pulses a few more times and then stops and then a lot of pulses that I am guessing is it actually reading from the BIOS chip. However it appears that the data on the MOSI line is going way faster then the clock. The first picture I have is a capture of the start of that third block of activity from the clock line and the second picture is a zoomed in version. The clock is channel one on the top. Notice how the clock is not a 50 percent duty cycle and sort of ramps up as well.

author: poot36
author_rank: Frequent Contributor
timestamp: November 22, 2022, 03:47:34 am
content: And here are pictures from the clock and chip select line also on that 3rd clock burst. The first one is whole capture and the second one is zoomed in.

author: ataradov
author_rank: Super Contributor
timestamp: November 22, 2022, 03:49:50 am
content: What probes do you use ? And do you have ground properly connected?This may be a probing issue. If it is not, then something is broken.

author: ataradov
author_rank: Super Contributor
timestamp: November 22, 2022, 03:52:15 am
content: Wait, you have 5 us per division. This is not enough to see 25 MHz clock. You are observing aliased signals.Get time base back to ns ranges you had on the initial capture.

author: JustMeHere
author_rank: Frequent Contributor
timestamp: November 22, 2022, 03:58:07 am
content: You can do SPI with two channels. CS can be hooked up to your trigger. I only use two on my 4 channel scope. I set the trigger to SCL's first transition.You can even probe both MOSI and MISO with the same probe. While it's a full duplex protocol, usually only one side is transmitting

author: poot36
author_rank: Frequent Contributor
timestamp: November 22, 2022, 04:20:01 am
content: Ok, good to know. I have set my scopes trigger on external to monitor the chip select line when it goes low and have taken a picture of what the clock and MOSI lines look like. It does look better then my previous attempts. A bit odd that the MOSI line goes low before the clock starts though. The bios chip is a Winbond W25Q64FW.

author: poot36
author_rank: Frequent Contributor
timestamp: November 22, 2022, 04:23:02 am
content: By the way here are the 3 clock chunks I was talking about. The first picture is with the MOSI line and the 2nd with the chip select line. I know this is at the wrong timebase but my scope does not have much memory.

author: ataradov
author_rank: Super Contributor
timestamp: November 22, 2022, 04:34:27 am
content: It is normal for MOSI to be set before the clock. Usually it happens half a bit time before the edge, but it really depends on the controller.Those signals look fine. And bursts are also normal It is likely probing the flash and its parameters.I'm not sure you will be able to extract more information from this.

author: poot36
author_rank: Frequent Contributor
timestamp: November 25, 2022, 04:10:44 am
content: Well I have managed to correct my capture from my old LA that only has 8K of memory and feed it into the Sigrok program and partially decode it. The only issue I am currently having is that the Sigrok program does not know how to decode the fast read dual output mode of my chip (hex value 3B). Do you have any idea what free program could decode that from the csv file I got from my LA?

author: ataradov
author_rank: Super Contributor
timestamp: November 25, 2022, 04:14:53 am
content: It might be easier to write a Python script that takes the CSV file and decodes the data. I doubt there is a program specifically for this.Or if the capture size is small anyway, you can decode a first few bytes by hand and if they match, assume that thew rest match as well.And this experiment still does not tell much. Even if your LA received the data correctly, it does not mean that the host would.

author: DavidAlfa
author_rank: Super Contributor
timestamp: November 25, 2022, 04:48:48 am
content: The decoders are already using python, so the 25xx decoder can be modified adding more commands.

author: poot36
author_rank: Frequent Contributor
timestamp: November 26, 2022, 04:40:29 am
content: @ataradov I am not a programmer so sadly that is not going to happen. I did manually decode the first fast read byte and it was correct. Let's assume that the issue is not BIOS chip related where would you look next for the problem as I have run out of ideas?@DavidAlfa I did try to modify the code but all I managed to do was make the decoder not be recognized by the program.

author: ataradov
author_rank: Super Contributor
timestamp: November 26, 2022, 04:47:05 am
content: I have no idea, I know nothing about PC systems like this.This is a project project to learn some coding, it comes in handy in cases like this and there are a ton of tutorials for Python.

author: DavidAlfa
author_rank: Super Contributor
timestamp: November 26, 2022, 05:08:18 am
content: Anything wrong with... anything.I hope you already tested with different RAM parts!Could it be a corrupted Bios? Sure!Take it out, make a backup and flash a dump from internet.The thing is it doesn't seem to be anything about these boards.If you have more of these still working, try dumping the Bios from one.But don't expect to find the problem like you're doing, it's just too complex, try finding a pci adapter to debug the boot codes, otherwise analyzing the SPI activity will be like finding a needle in a cornfield.To me, the expansion slots in that mobo look as normal minipcie, like this one:https://a.aliexpress.com/_Ex0kAJT

author: amyk
author_rank: Super Contributor
timestamp: November 26, 2022, 11:28:51 pm
content: Agree with getting a port 80 card to see where the boot process is hanging.

author: poot36
author_rank: Frequent Contributor
timestamp: November 27, 2022, 04:00:41 am
content: @DavidAlfa I have tried with different ram as well as no ram and no change. I have tried flashing a clean bios I got from the manufacture and still no change. I did backup the suspected corrupt bios before I did that and both bios images open with uefitool just fine with no errors so I am going to rule out the bios for now.I will get one of the POST diagnostic cards. I did not realize they had gotten so cheap, the one I got for standard ISA and PCI cost close to $20 or so. It will take a month or more to get here though so I will update you when I do get it.

author: JacobPilsen
author_rank: Regular Contributor
timestamp: November 29, 2022, 03:50:27 pm
content: Quote from: poot36 on November 21, 2022, 03:21:27 amBTW: You should get TDS2CM (or its USB clone).It's worth it.

author: St66666
author_rank: Contributor
timestamp: December 17, 2022, 07:07:34 am
content: W25Q64FWThe last few years have seen a lot of corrupted flash memory ICs on television main boards.A flipped bit can mess up the firmware and the boards were usually not booting up at all or were getting stuck.Never really figured out why they fail. Maybe a power surge or the memory location got tired like in the NANDs?Overwriting them with good data made the chip work again, but always preferred to replace the chip with a new one.

author: poot36
author_rank: Frequent Contributor
timestamp: December 18, 2022, 04:05:00 am
content: @St66666 That is interesting, I did have that happen a long time ago on my Sony PlayStation 3D monitor and was able to send it back for warranty and the replacement monitor I got is still going strong. I have programed and verified the chip 3+ times in a row and it did not change its content. I wonder if perhaps when it is read at a higher speed and read mode in the motherboard if that is when it has issues?

author: St66666
author_rank: Contributor
timestamp: December 19, 2022, 06:17:14 am
content: The flash you have in there and it's closely related family is where I see the occasional bit flip.I have analyzed and compared a lot of files in a hex editor and usually see a few errors in these.Not as many as in some Samsung NANDs, but one location is enough to make the whole thing not to work.Recently I had an EMMC chip where the whole user area got filled with zeros, but the chip was still reporting 90% of its life left.I don't understand how this happens. I suspect some kind of power surge perhaps.

author: py-bb
author_rank: Regular Contributor
timestamp: December 27, 2022, 02:53:23 am
content: Quote from: poot36 on November 16, 2022, 04:17:48 amThe Nyquist limit is important but in practice you want to go higher. The information to tell frequency is still there but it's not "sharp and clear" at the Nyquist limit, it's just not aliased. I was just now looking at a 16.6mhz signal at a 50mhz sampling rate and it was only a few points per symbol.This may have been discussed - I've not read the thread sorry but here are your options as I see it (which you may or may not know):0) Get/flash a new chip - this is cheap probably and worth a try.1) Ebay - generally speaking like "DIY-style" scopes from ebay are awful but tend to be OK (apparently) over "the 5v range" (so signals like these) - you can also buy protocol analysers that cover this, how good they are I don't know. Sure it's not a great instrument but it's one option. It might be enough to work.2) Second hand DSO - lots of them have serial ports, you can quickly knock something up in python or shell even you hit it with a wavedump command and it gives you nice raw data. Process with little more than an awk one-liner, you have decoded it. Even if you get an "oscilloscope" in option (1) if it can export the waveform you can still do this.These are all generic options which are quiet easy.You can get old logic analysers quite cheaply, I've seen a HP 1650A and a 1650G recently, they're on the order of £100 - but whether they're fast enough or can decode it I don't know.3) You can probably buy a cheap SPI monitor, these are not scope like, they actually follow the protocol, this means they spew less data and are still very helpful. For example ethernet switches that provide monitoring will not show you malformed packets (they'll just drop them) but this is good enough for most uses. You don't need something "lower". I've heard good stories about SCSI protocol analysers saving the day, rather than using a more general purpose instrument to monitor the bus.Finally: RAM isn't quite what you thinkDSOs are basically two separate things in the same box. The computer bit that you interact with sets up the actual scope bit and is signalled (interrupts) when the oscilloscope bit wants something. DRAM speeds in terms of number of page/rows opens/closes a second have not improved since the 90s - easily (but the rows are much longer, once the transfer starts the rate is much higher and as the row is bigger more data can be read before needing to get another row open) - 100Mhz is a good value (and not far from the best and worst around)You'd have to gang them together in parallel, so say you have 8 bits of DRAM, now you can do 8 page accesses concurrently - but something has to "demux" the samples to write them, especially as 800Msamples/sec isn't that high these days.Older ones certainly use a special memory type for this reason where they store the acquisition, they interrupt the computer bit when they're done and it DMAs the data out.So don't look at RAM size.Look at the "sample buffer size".Good luck.

author: radiolistener
author_rank: Super Contributor
timestamp: December 29, 2022, 03:30:15 am
content: I would suggest 500-1000 MHz logic analyzer for good 24 MHz bus analysis.Of course, just for decoding you can use some 100 MHz logic analyzer, but if you want to discover and analyze transition glitches, you're needs much higher sample rate for logic analyzer.

author: poot36
author_rank: Frequent Contributor
timestamp: December 31, 2022, 03:08:43 am
content: Well I finally got my Mini PCI-E POST card in and if it is working correctly I get no clock or reset lights on it and only a single 0 on the display. The manual states that if I don't get the clock or reset lights that it may be incompatible with my motherboard. The interesting thing is that the card gets power even before I press the power switch on the motherboard. I suspect this is a standby voltage for a wireless or other card to power up the system but I could be wrong. I would also like to test the LPC bus but the pins for that are smaller then the standard 2.54mm standard DuPont style header. Got any idea what size these would be as they seem like a smaller standardized version of the bigger pins? Also is there a standard pinout for the 9 pin LPC header as mine is not labeled on the PCB?