KrzysioTesterEPM240 - the EPM240 CPLD chip tester, the fear of sellers from alieexpress

You can talk about almost anything that you want to on this board.

Moderator: Moderators

Post Reply
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

KrzysioTesterEPM240 - the EPM240 CPLD chip tester, the fear of sellers from alieexpress

Post by krzysiobal »

Image

I've recently made myself a tester for testing EPM240/EPM570 CPLD chips. Those chips are not very large in terms of capacity, but quite cheap and popular, good choice for making your own cartridge (or smiple flash cartridge).
In this article, I will describe the design and construction of my own FPGA tester, which I was forced to build by the Chinese sellers, because in the recently ordered package from them, every third chip was faulty. After pressing one button, the tester will thoroughly check the inserted unit. There will be some analog electronics, a lot of digital, a bit about JTAG and USB. Fasten your seat belts as it promises to be interesting.

1. As an introduction - a bit about our patient, the EPM240T100C5N chip
1.1. Why this particular one?
1.2. Motivation to build
1.3. Smart test
2.0 Construction - assumptions
2.1. Supported layouts
2.1. ZIF socket
2.2. Layout programming
2.3. Short-circuit protection + supply current measurement
2.2. Pin test
2.3. Software on the PC side
3. Surprises during construction
4. Future plans
5. Summary


1. As an introduction - a bit about our patient, the EPM240T100C5N chip
Each of the electronics constructors probably has their favorite processors, FPGAs or other chips that they use to build some projects. Mine is the EPM240T100 chip, the simplest representative of the MAX II programmable circuit from Altera.
Image

1.1. Why this particular one?
+ Cheap (before the inflation jump you could get them for 0.90 $ -1.5 $ / item on aliexpress)
+ The capacity of 240 logic blocks (LE) (simplifying 1 block allows you to store one bit in the flip-flop)
+ Quite friendly TQFP100 housing (0.5mm spacing between legs) - easy to solder at home (after getting some practice)
+ A large number of pins (the version in the TQFP100 housing is 80 I / O pins)
+ Support for various voltage standards on the I / O pins, including the ability to turn on a Schmitt trigger on the input for slowly rising signals,
+ In the simplest variant, it only requires a single 3.3V supply voltage
+ Contains two independent memories - the first (configuration) stores the currently programmed batch and the second (the so-called UFM block)
* the configuration memory stores "how the chip is supposed to work", so it does not require additional memory to store this information (as is the case with many FPGA devices), there is also the possibility of protection against reading our code
+ UFM serves as a Flash memory for the user; from the outside, it can be visible as a serial memory (e.g. after the SPI, I2C protocol) or as a parallel memory
+ The clock signal (about 3..5MHz) from the UFM block can be used for your own needs, so it does not require an additional generator

However, there are also a lot of disadvantages:
-The above-mentioned 240 LE capacity is relatively small (we will not fit, for example, the implementation of a simple Z80 processor or even a 6502 processor)
-Limited number of reprogramming cycles (up to 100 times)
-UFM block simulating Flash memory also has only up to 100 write cycles (so it is more for storing some data that we rarely modify;)
-No 5V-tolerant inputs

The mentioned EPM240 chip is only the simplest representative of the family, the table below includes all members of this family:
Image

And the way of marking:
Image

1.2. Motivation to build
The price of these chips (aliexpress) at the beginning of my adventure with them (2017) fluctuated around $ 1 and was basically at a similar level for 3 years. In the last few months, however, there has been some drama - the price from week to week has started to soar and is now around $ 2-3.
I ordered them from various sellers and it was sometimes better, sometimes worse. There were orders that only 1 in 50 chips turned out to be out of order, sometimes 100% worked, but recently, when ordering from one retailer, I noticed a serious problem several times. On average, every 3-4, the chip did not work. And there were cases that I desoldered a faulty chip, soldered a new one and this also did not work, only after 3 or 4 times it was OK. Waste of time and shattered nerves said STOP.

What does it mean that the chip was out of order? There have been many different faults:
* after soldering, caused a short circuit between the power supply and ground
* was not detected by the programmer
* was detected by the programmer as a completely different chip (e.g. 5M240ZT100), although the housing was marked with the correct (!) This arrangement will be mentioned later. This only confirms that the Chinese paint new markings on the housings often blindly. I have several layouts "collected" over time - you can see a different font on each of them, the texture of the housing is also different (sometimes smooth, sometimes rough)

* halfway programming was suddenly interrupted with an error message
* some of the output pins did not work (either attached to ground / power or hung in the air at all)
* some of the input pins did not work - this fault was the most severe in the diagnosis, because it manifested itself in the operation of the entire chip inconsistent with the assumptions
* and of course a physical defect (e.g. bent legs, missing one of the extreme legs - broken during transport). A few times there was even a hole in the middle of the housing, clearly proving that the magic smoke and parts of the structure fields visible through the housing (housing too polished?)
Image Image

If, during my adventure, I found a faulty chip, I put it back in a special box. Over the years, I have accumulated about 100 chips that somehow were not suitable for normal operation.

1.3. Smart test
Being in need of finding out what chip I am dealing with, I accidentally found an interesting way to test quickly before soldering. In the described chip, several groups of pins can be distinguished:

Applying the meter probe to the pins 11 GND (+) and 13 VCCINT (-) on the diode test, I usually got 3 indications:
~ 1070 mV - EPM240 (as it should be)
~ 1300 mV - chip detected as 5M240
~ 700 mV - the circuit which caused a short circuit after soldering
The test, however, required placing the chip on the desk, meticulous pin counting, applying sharp gauge probes, so it was a pain in the ass and it did not allow to determine if all the pins in the chip were working properly.
And what are we actually measuring here? It seems that the average forward voltage of all protection diodes in the chip.
Image

2.0 Construction - assumptions
In fact, at this stage, I didn't really know what I wanted to build. It would definitely be a device equipped with a ZIF stand, into which the patient would be inserted.
Initially, I wanted to connect only the programmer socket (and power) to the socket.
Later I came to the conclusion that it would be worth testing all the pins as well.
Further - that it would be worth adding the measurement of the currents consumed by the chip.
Further - that it is necessary to protect against short circuit

The very way the result is displayed has also evolved in my head:
* two LEDs: red - the chip has a defect, green - the chip is OK
* small OLED display - in case of a defect - displaying the details of the defect
* sending detailed information about the result via USB to the computer - it would speed up the creation of a list containing chips with defects (which can, for example, be sent to the seller to apply for a refund)

Finally, the idea that was implemented was:
* motherboard (based on Atmega 64 microcontroller), USB socket, signaling diodes, buffers, USB socket
* a second plate with a stand is attached to the record
Image Image Image Image

2.1. Supported layouts
The key chip that I wanted to handle is of course the main character - EPM240T100.
Sometimes there was also a need to buy some more capacious chips (EPM570T100), which I also have a few in my collection. In terms of housing and outputs, they are almost identical to the predecessor.

As a result of the sellers' carelessness, my collection also includes several EPM240GT100 chips - they differ in that they require VCCINT 1.8V (instead of 3.3V) to be powered.
Finally, also as a result of sellers' mistakes, there are also several 5M240ZT100 chips - they also require VCCINT = 1.8V and additionally have a slight difference in the pinout
I also have one 5M570ZT100 chip
The difference in pinout is really minimal and it comes down to the fact that the chips have additional ground / power pins where the EPM240T100 had IO pins:
Image

In effect:
* the board must enable both 1.8V and 3.3V voltage to be supplied to the VCCINT pins
The 1.8V and 3.3V voltages have the interesting property that they lie symmetrically between the 2.5V center voltage.
If now the VCCINT_SET pin:
* will be in Hi-Z state, the voltage of 2.5V will be set at the output of the divider
* will be shorted to ground, the voltage at the output of the divider will be ~ 1.8V
* will be shorted to + 5V, the voltage will be ~ 3.3V at the output of the divider.
Atmega64, controlling the pin appropriately, can regulate the voltage supplied to the chip - all you need to do is add a repeater (implemented on the operational amplifier):
Image

* removing pins 1, 37, 90 to ground
* download pins 39, 88 to VCCINT
This was realized by transistor (saturated) keys:
* the appearance of a low state on the pin VCCINT_39_80_nEN causes the download of pins 39 and 88 to the power supply (VCCINT)
* the appearance of a high state on the GND_1_EN pin causes the removal of the 1 pin to the power supply
* high status on pin GND_37_90_EN pulls pins 37 and 90 to ground
As in the case of the EPM240 chip, all these pins (39, 88, 1, 37, 90) are IO pins, they are still connected to the microcontroller, only through the protection resistors
Image

2.1. ZIF socket
The most important (and most expensive) part of the device is the stand. There are two kinds
The "shell" -type underneath which you put the chip in, and then close the flap that presses the pins (on the left) and the compact-type stand into which you insert the chip, press the whole thing down, the chip drops under the weight and is already pressed
Image Image

I did not deal with any of them, but I bet on the other - it seemed to be more precise, and the possibility of one-handed operation was an additional advantage (by the way - I wonder why the prices of these stands for ali start at $ 20, and in Poland it is already e.g. from PLN 700?)

Further consideration was the choice between a bare stand and one already soldered into the PCB with goldpins on the sides (as shown in the photos). I chose the second solution, because making a tile with such a number of holes at home is a chore.

Now, in retrospect, I can say that the stand works exceptionally well. The only drawback is that the insertion (and removal) of the chip takes place from the top, so a vacuum gripper is required.

Here again I had to do a little riser. According to many opinions, manual grippers, regardless of the manufacturer, are the same rubbish:
Image

I accidentally found a suction cup, powered by a battery, which has a mini pump activated by a button. And I must say - a revelation. Even heavy things can be lifted without any problems. The only thing I can't understand is why the manufacturer decided to power it with one AAA (tiny) finger instead of the normal (AA)? Even if it would involve a slightly thicker grip, such a battery has 3 times greater capacity.
Image Image

2.2. Layout programming
On the board I added a 6 pin connector (JTAG) that allows you to connect a USB Blaster programmer to it and program the chip from the Quartus software. The board is also adapted for programming directly via the Atmega 64 chip to eliminate the need to use an external programmer.
Image

2.3. Short-circuit protection + supply current measurement
As it was mentioned earlier, sometimes after soldering the circuit to the PCB, there was a short circuit which indicated some internal damage to the chip. After inserting such a chip into the socket, it would most likely result in the appearance of the message "there was a voltage surge on the USB port", or the protection in the 3.3V stabilizer or the burning of delicate contacts in the socket. So it was necessary to make some short-circuit protection. The simplest protection consists of a series resistor on which voltage is deposited. When the current is too high, this voltage drop controls the transistor, which "sticks" to the pass-through transistor, lowering its value, thus reducing the current drawn:
Image

The idea is simple, but in the above form it has a disadvantage - the voltage drop across the series resistor must be at least 0.7V to "close" the transistor. When the chip is powered with 3.3V, such a drop is too large. A workaround would be to use the above chip on the input side of the 3.3V stabilizer (the LD1117 stabilizer has a dropout of about 1V, so when powered from + 5V it would be pinned), but I didn't like this idea. Another idea would be to reduce the dropout across the series resistor, then amplify this dropout and control the transistor. For now, I decided to think about something else, namely the measurement of the current consumed by the chip.

The EPM240 chip has three types of supply voltage:
* VCCINT - core power supply (+ 1.8V or + 3.3V)
* VCCIO1 - power supply of IO pins: 2, 3, ..., 51 and JTAG pins (max + 3.3V)
* VCCIO2 - power supply of IO pins: 52, 53, ..., 100, 1 (max + 3.3V)
Image

In the simplest configuration, it is enough to close all three voltages VCCINT = VCCIO1 = VCCIO2 = + 3.3V. However, in the case of a test, it would be worth measuring the current consumed on each of the three types of power supply. I used a 1R series resistor here and an operational amplifier in a non-inverting configuration, which amplifies the difference on the string resistor ~ 20 times and feeds it to the ADC input of the microcontroller (three same blocks for each of the VCCINT, VCCIO1, VCCIO2 voltages).
It is only worth mentioning that the LM324 operational amplifier used is NOT rail to rail, but because it is powered from + 5V, and both ends of the series resistor at a maximum of + 3.3V, it fulfills this role perfectly
Image

The general scheme of the described solution is presented below:
Image

Returning, however, to the topic of overcurrent protection, now something dawned on me. An amplified voltage drop (eg ADC_VCCIO1) could be used to control an input voltage limiting transistor.

Unfortunately, there is a problem. To control the T1 transistor (PNP) we require the interval [4.3V ... 5V] (on .. off). The range of voltage changes on ADC_VCCIO1 with increasing current is [0 ... 5V]. The direction of changes is correct, unfortunately the range of values ​​is not.
Image

So we need to add an NPN transistor (T2) which will reverse the direction of the voltages [5V .. 0V]. You will also need another NPN transistor (T3) which will reverse the directions of the voltages again)
Image

However, it would be nice if the excessive current consumption in each of the branches (VCCIO1 / VCCIO2 / VCCINT) would activate the countercurrent protection. Here it is enough to add 3 LEDs, which will perform a function similar to the OR gate. Additionally, by adding the fourth diode and controlling this pin (POWER_nON) from the microcontroller, we can programmatically turn off the power to the chip - useful to cut off the power after the test and be able to calmly remove the tested chip.
Image

The value of the current, from which the circuit starts to lower the voltage, can be increased by increasing the amplifiers gain or decreased by adding a resistor divider based on transistor T2. I did not know what current to expect in normal operation, so I decided to consider something between 50 and 100mA as the limit.

I simulated the whole chip first in the LTSpice program and according to the simulation, the protection worked around 80mA
Image

Later, on the physically made device, I gradually increased the current consumption, reading at the same time the return value from the ADC converter and on this basis I could conclude that the protection allows a maximum of 65 mA of current to pass (the graph shows small non-linearities at the beginning and end of the interval, caused by either non-linearity the converter itself in Atmanga or the nonlinearity of the voltage amplifier from the series resistor)
Image

2.2. Pin test
The key issue (apart from determining whether the chip is short-circuited, whether it is detected and programmable) is whether each pin is functional. I do not know the mechanism that causes some of the pins in my chips to be damaged (the chips sold are probably used and refurbished), so I have some suspicions:
* or they have already been damaged in the device from which they were stolen,
* or they were damaged at the time of unprofessional discharge - e.g. by ESD charges,
* or the whole structure was removed from the original IC and then packed in a new case with new feet and something went wrong while soldering the bond wires.
Testing the operation of the pins consists in checking whether each of them can set logical 0/1 and whether each can read 0/1 from the outside. This requires uploading a special diagnostic batch to the chip and communication with the pins. Since there are as many as 80 pins in the chip, and access to all of them at once is not required, I decided to multiplex with buffers (reading all of them at once is not necessary). At 80 pins, I used 10 74LVC245 buffers. The number of legs used is: 8 + 10 (BUF / OE) + 10 (BUF DIR) = 28. As it turned out later, all the pins controlling the directions of the buffers could be connected together anyway, because never more than one buffer is active.
Buffers, apart from multiplexing, have an additional function - they convert voltages from 5V (Atmega64) to + 3.3V (EPM240 chip)

A simple program, uploaded to the EPM240 chip that tests it, works as follows:
* one of the pins is dedicated to the clock that controls the operation
* during the T0 cycle - 0xAA is displayed on the first 8 pins
* during the T1 cycle - 0x55 is displayed on the first 8 pins
* during the T2 cycle - the value (V1) is read from the first 8 pins
* during the T3 cycle - the negated previously read value is displayed on the first 8 pins (~ V1)
* during the T4 cycle - the value (V2) is read from the first 8 pins
* during the T5 cycle - the negated previously read value is displayed on the first 8 pins (~ V2)
The EPM240 chip outputs values ​​only when CLK = 0, when CLK = 1 - pins are in high impedance state

then the T6..T11 cycles test the next 8 pins, the T12..T17 the next 8, etc.

By setting the value of AA and then 55, you can check whether the chip can set a logical zero and one on each of the pins, and whether two adjacent pins are not short-circuited with each other.
Image

A certain drawback was the clock pin. Such a pin should be directly connected to the atmega, because the value displayed on it should be available for the EPM240 chip constantly, and access through buffers prevents it. Initially, I tried to work around it, using, for example, pin No. 1 (which also has a transistor key connected), shorting it to ground (logical 0), opening it and using the pull resistors (logical 1) built into the EPM240. Unfortunately, such too little steep slopes, even despite the inclusion of the built-in Schmitt trigger, often caused the chip to think that it had got two or more slopes. So I had to make a modification in the PCB, cutting off one of the paths from the buffer and connecting it permanently to the atmega (of course, I added a resistor in series and a + 3.3V zener diode)

Another disadvantage is that if the pin for the clock in the tested circuit does not work, it will not be possible to perform the test.

2.3. Software on the PC side
The next step was to create a program that will communicate with the device. I decided on a modest interface that
* allows you to enable / disable the chip
* set the correct supply voltage
* To make a test
* display the current power consumption of the chip
Image Image

3. Surprises during construction
Not everything went smoothly and as planned during the work on the device.
* The first problem was Atmega64, which after soldering was not detected at all - here, as ordered by August, was the chip itself, which I once bought from someone on allegrolokalne.pl and it had fusebits so programmed that it could not be reprogrammed, I described it in more detail here:
https://www.elektroda.pl/rtvforum/viewt ... highlight=

* Shortly after soldering, it turned out that switching off the voltage supply to the chip does not work if the voltage is + 2.5V or + 3.3V. The cause of the problem turned out to be simple - when the transistor (Q4) cutting off the supply voltage is active, the operational amplifier (repeater) is still trying to drive the T4 transistor so that it supplies the VCCINT voltage in accordance with the set voltage. However, since the T4 cannot do it, because its collector no longer receives any current, the operating voltage produces such a high voltage on its base that the base-collector junction is pierced and the chip is still supplied with current, but this time - from the amplifier:
Image

The solution was to overvoltage one of the legs of the R23 resistor from + 5V to the collector:
Image

This solution works for + 1.8V and + 2.5V, but still does not work for + 3.3V (because then the atmega introduces its + 5V). However, the EPM240 chip to supply VCCINT requires a voltage in the range of + 2.5V .. + 3.3V, so a + 2.5V supply is enough

* Occasionally, the test shows that one or two pins are broken, even though the circuit is then good. The reason is the deposit (dirt) on the tested chips, sometimes it is enough to press the stand again or remove the chip and run the knife over all the pins.

* Short-circuit oscillations - during a short-circuit (whether as a result of a damaged chip or, for example, on purpose, when we connect one of the supply voltages to ground with a wire), the signal from the amplifier that goes to the converter in Atmanga is no longer a direct voltage, but is visible on it clear oscillations with a frequency of about 100 kHz. I do not know exactly what the reason is, if any of the transistors is trying to generate, or maybe the feedback loop in the current limiter is too long. I went around it programmatically, averaging the ADC reading.
Image

4. Future plans
* adding the possibility of programming the chip directly from my program (each time connecting the USB Blaster programmer and starting the Quartus software is extremely annoying). The ability to automatically detect the type of chip and select the appropriate load (for each of the EPM240T100 / EPM240ZT100 / 5M240ZT100 / EPM570T100 chips to be tested, a separate, complex VHDL file is required)
* finding some way to change the pin to the clock edge (those on the list where allegedly all 79 pins are damaged has a really damaged clock pin and therefore the test result is unreliable)
* I have had several dozen of more capacious Xilinx XC3S100E chips (TQF144 chassis), about which I also have doubts if they are all functional. I also have a ZIF socket for these chips, so it only remains to create a dedicated version of the tester.
Image

5. Summary
The described tester made it possible to check all my chips. Thanks to it, I was able to create a defective list and send it to the seller requesting a refund:
Image

* Several of the circuits had a defect in the form of non-working 1/2/3 pins - these were used for my project by simply omitting the faulty pins (although there were some where they did not work, for example 17).
* A lot of the circuits had an internal short circuit (mainly on the VCCINT2 line).
* Also, a lot of circuits were not detected by the programmer (measurement with a multimeter on the diode test indicated the lack of connection of one or more pins responsible for the JTAG - burnout inside the chip)

As a curiosity, I have to say that I damaged the EPM240 chip twice on my own. The described scalers are used by me, among others to build KrzysioCarta - programmable cartridge for the NES console (https://www.elektroda.pl/rtvforum/topic3326538.html). The photo below shows a special version for the NES console. There are two 6-pin connectors on the board - one JTAG for programming the EPM chip, and the other ISP for programming the attiny13 microcontroller. Coincidentally, twice in my life, I plugged the USB blaster programmer to the JTAG socket, once for about 5 seconds, the second time I didn't even put the plug in, I barely put it on and threw it right away. Unfortunately, in both cases the EPM chip caused a short to ground after this operation (probably + 5V on the line from the programmer, the USB connected to one of the JTAG pins effectively killed it)
Image

Image Image Image Image Image Image

[youtube] https://youtu.be/YU5filbrHFE[/youtube]
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: KrzysioTesterEPM240 - the EPM240 CPLD chip tester, the fear of sellers from alieexpress

Post by Ben Boldt »

Thank you or sharing, it is a very interesting read.
User avatar
TmEE
Posts: 960
Joined: Wed Feb 13, 2008 9:10 am
Location: Norway (50 and 60Hz compatible :P)
Contact:

Re: KrzysioTesterEPM240 - the EPM240 CPLD chip tester, the fear of sellers from alieexpress

Post by TmEE »

This was a great read, very awesome ~

I'm having joys of bad CPLDs every once in a while too, though with older stuff. I have found bad IOs but also some damage where programming/verify always fails at same place in addition to chips that just don't detect or get hot (internal shorts).
zombie343
Posts: 8
Joined: Wed Feb 04, 2015 12:16 am

Re: KrzysioTesterEPM240 - the EPM240 CPLD chip tester, the fear of sellers from alieexpress

Post by zombie343 »

Excellent read. Thank you for your hard work and thank you for sharing with us!
Post Reply