User Tools

Site Tools


projects:repair:dell_pa10

Clone a Dell PA-10 AC adapter

This page describes how to make a clone of a Dell PA-10 AC adapter. More specifically, an HP adapter is taken which has the same jack. From this the voltage is modified to 19.5 volt. For the laptop, to recognize the correct power it can source, a PIC 10f220 controller is taken to generate a data signal to the laptop.

Data signal

Although I have lying around a ST7-Lite pic controller with ST7-STICK interface, I don't have a windows machine with a parallel port. So I decided to use a pic controller instead which can be programmed under linux with PICPgm.

The ST7-STICK interface can be used with PICPgm, using the following pgmifcfg.xml configuration file which needs to be in the users home directory:

ToDo

Source

The intel pic hex format is described here, here and here.

  • A word is 12 bits in size. the remaining 4 bits are not used for data. I don't understand how 2805 is encoded into memory. This is an indication the code is for another processor.
  • The 'Extended Linear Address Record' in the first line does not make much sense for the PIC 10f220. See here for more information.
  • The device ID is stored from 0x2000 to 0x2003 As is explained here.
  • The processor configuration is stored at 0x2007. For a 10f220 this would be: IOSCFS=8MHz, _MCPU=Pull-up enabled, WDTE=disabled, _CP=disabled, MCLRE=MCLR function
:020000040000FA                             ; Byte count=2, Address=0000, RECTYP=04, DATA=0000 ; 1 word of 2-byte data with RECTYP='Extended Linear Address Record', starting at 0000, checksum=FA. Bits 16-31 of the LBA are set to 0, bits 0-15 of the LBA are taken from the subsequent records. Since there is no further extended linea address, this remains effective throughout the code.
 
:0800080005281F28A300A40035                 ; Byte count=8, Address=0008, RECTYP=00, DATA=05281F28A300A400 ; 4 words, starting at word (8/2)=4, data in low-high format:2805,281f,00a3,00a4
:100010000830A2002508A306A30C2508A300031C92 ; Byte count=16, Address=0010, RECTYP=00, DATA=0830A2002508A306A30C2508A300031C; 8 words, starting at word (0x10/2)=8, data in low-high format:3008,00a2,0825,06a3,0ca3,0825,00a3,3100
:1000200013281830A306A30C2308A5002408A30056 ; etc
:100030000310A30C2308A400A20B0A280800A501A2
:10004000F0300620103006200000003006200000AE
 
:084000000100020003000400AE                 ; Byte count=8, Address=4000, RECTYP=00, DATA=0100020003000400, 4 words, starting at word (0x4000/2)=0x2000, data in low-high format:0001,0002,0003,0004
:02400E00F93F78 ; Byte count=2, Address=400E, RECTYP=00, DATA=F93F, 1 word, starting at word (0x400E/2)=0x2007, data in low-high format:3ff9
:00000001FF                                 ; EOF

With gputils (v1.2.0) this is converted with the following command:

./gpdasm -p p10f220 -i dell.hex

A memory dump could be created with this command:

./gpdasm -p p10f220 -m dell.hex

But the output does not reflect the hex values in the second column from the code above. Therefore the list below is generated with another method.

00000000  0000 0000 0000 0000 2805 281f 00a3 00a4 ......(.(.(.....
00000008  3008 00a2 0825 06a3 0ca3 0825 00a3 1c03 ...%.......%....
00000010  2813 3018 06a3 0ca3 0823 00a5 0824 00a3 0......#.#...$..
00000018  1003 0ca3 0823 00a4 0ba2 280a 0008 01a5 ...#......(.....
00000020  30f0 2006 3010 2006 0000 3000 2006 0000 .0. .....0. ...
00002000  0001 0002 0003 0004                     ........
00002007  3ff9                                    ?.
gpdasm with 10f220 picdisasm with 12C672
with opcodes
picdisasm with 12C672














000000: 0000 nop
000001: 0fff
000002: 0fff
000003: 0fff
000004: 2805 retlw 0x5
000005: 281f retlw 0x1f
000006: 00a3 subwf 0x3, f
000007: 00a4 subwf 0x4, f
000008: 3008 dw 0x3008
000009: 00a2 subwf 0x2, f
00000a: 0825 retlw 0x25
00000b: 06a3 btfsc 0x3, 0x5
00000c: 0ca3 movlw 0xa3
00000d: 0825 retlw 0x25
00000e: 00a3 subwf 0x3, f
00000f: 1c03 movlw 0x3
000010: 2813 retlw 0x13
000011: 3018 dw 0x3018
000012: 06a3 btfsc 0x3, 0x5
000013: 0ca3 movlw 0xa3
000014: 0823 retlw 0x23
000015: 00a5 subwf 0x5, f
000016: 0824 retlw 0x24
000017: 00a3 subwf 0x3, f
000018: 1003 sleep
000019: 0ca3 movlw 0xa3
00001a: 0823 retlw 0x23
00001b: 00a4 subwf 0x4, f
00001c: 0ba2 goto 0x1a2
00001d: 280a retlw 0xa
00001e: 0008 dw 0x8
00001f: 01a5 xorwf 0x5, f
000020: 30f0 decf 0x10, f
000021: 2006 tris 0x6
000022: 3010 dw 0x3010
000023: 2006 tris 0x6
000024: 0000 nop
000025: 3000 nop
000026: 2006 tris 0x6
000027: 0000 nop
002000: 0001 tris 0x1
002001: 0002 option
002002: 0003 sleep
002003: 0004 clrwdt
002007: 3ff9 xorlw 0xf9







ConfigurationBits: 0x3FF9
IDLocation: 01020304
ProgramMemory
Adr Data Command
--------------------
0000 0000 | NOP
0004 2805 | GOTO LADR_0x0005
0005 281F | GOTO LADR_0x001F
0006 00A3 | MOVWF LRAM_0x23
0007 00A4 | MOVWF LRAM_0x24
0008 3008 | MOVLW 0x08 ; b'00001000' d'008'
0009 00A2 | MOVWF LRAM_0x22
000A 0825 | MOVF LRAM_0x25, W
000B 06A3 | XORWF LRAM_0x23, F
000C 0CA3 | RRF LRAM_0x23, F
000D 0825 | MOVF LRAM_0x25, W
000E 00A3 | MOVWF LRAM_0x23
000F 1C03 | BTFSS STATUS, C
0010 2813 | GOTO LADR_0x0013
0011 3018 | MOVLW 0x18 ; b'00011000' d'024'
0012 06A3 | XORWF LRAM_0x23, F
0013 0CA3 | RRF LRAM_0x23, F
0014 0823 | MOVF LRAM_0x23, W
0015 00A5 | MOVWF LRAM_0x25
0016 0824 | MOVF LRAM_0x24, W
0017 00A3 | MOVWF LRAM_0x23
0018 1003 | BCF STATUS, C
0019 0CA3 | RRF LRAM_0x23, F
001A 0823 | MOVF LRAM_0x23, W
001B 00A4 | MOVWF LRAM_0x24
001C 0BA2 | DECFSZ LRAM_0x22, F
001D 280A | GOTO LADR_0x000A
001E 0008 | RETURN
001F 01A5 | CLRF LRAM_0x25
0020 30F0 | MOVLW 0xF0 ; b'11110000' d'240'
0021 2006 | CALL LADR_0x0006
0022 3010 | MOVLW 0x10 ; b'00010000' d'016'
0023 2006 | CALL LADR_0x0006
0024 0000 | NOP
0025 3000 | MOVLW 0x00 ; b'00000000' d'000'
0026 2006 | CALL LADR_0x0006
0027 0000 | NOP
; original File = dell.hex

processor 12C672
#include <P12C672.INC>
__config _MCLRE_ON & _CP_OFF & _PWRTE_OFF & _WDT_ON & _XT_OSC ; 0x3FF9
__idlocs 0x1234

; RAM-Variable
LRAM_0x22 equ 0x22
LRAM_0x23 equ 0x23
LRAM_0x24 equ 0x24
LRAM_0x25 equ 0x25

; Program

Org 0x0000

; Reset-Vector
NOP

Org 0x0004

; Interrupt-Vector
GOTO LADR_0x0005
LADR_0x0005
GOTO LADR_0x001F
LADR_0x0006
MOVWF LRAM_0x23
MOVWF LRAM_0x24
MOVLW 0x08 ; b'00001000' d'008'
MOVWF LRAM_0x22
LADR_0x000A
MOVF LRAM_0x25, W
XORWF LRAM_0x23, F
RRF LRAM_0x23, F
MOVF LRAM_0x25, W
MOVWF LRAM_0x23
BTFSS STATUS, C
GOTO LADR_0x0013
MOVLW 0x18 ; b'00011000' d'024'
XORWF LRAM_0x23, F
LADR_0x0013
RRF LRAM_0x23, F
MOVF LRAM_0x23, W
MOVWF LRAM_0x25
MOVF LRAM_0x24, W
MOVWF LRAM_0x23
BCF STATUS, C
RRF LRAM_0x23, F
MOVF LRAM_0x23, W
MOVWF LRAM_0x24
DECFSZ LRAM_0x22, F
GOTO LADR_0x000A
RETURN
LADR_0x001F
CLRF LRAM_0x25
MOVLW 0xF0 ; b'11110000' d'240'
CALL LADR_0x0006
MOVLW 0x10 ; b'00010000' d'016'
CALL LADR_0x0006
NOP
MOVLW 0x00 ; b'00000000' d'000'
CALL LADR_0x0006
NOP

End

picdisasm

As this disassembly code in the first column does not make much sense, I assumed another microcontroller had been used but had been mistaken with the 10f220. With this very practical alternative freeware disassembler, which gives a slightly better output than gpdasm, while changing the PIC-Type, it will immediately show the updated disassembly. This makes it much easier to find the target for which the code was written. So far following controllers show up with useful code:

  • 12C: 12C671, 12C672
  • 12F: 12F629
  • 16C: 16C61, 16C62, 16C62A, 16C62B, 16C63, 16C63A, 16C64, 16C64A, 16C65, 16C65A, 16C65B, 16C66, 16C67, 16C71, 16C72, 16C72A, 16C73, 16C73A, 16C73B, 16C74, 16C74A, 16C74B, 16C76, 16C77, 16CR83, 16C84, 16CR84, 16C432, 16C433, 16C554, 16C558, 16C620, 16C620A, 16C621, 16C621A, 16C622, 16C622A, 16CE623, 16CE624, 16CE625, 16C641, 16C642, 16C661, 16C662, 16C710, 16C711, 16C712, 16C715, 16C716, 16C717, 16C745, 16C765, 16C770, 16C771, 16C773, 16C774, 16C781, 16C782, 16C923, 16C924, 16C925, 16C926
  • 16F: 16F72, 16F73, 16F74, 16F76, 16F77, 16F83, 16F84, 16F84A, 16F616, 16F627, 16F627A, 16F628, 16F628A, 16F630, 16F636, 16F639, 16F648A, 16F676, 16F677, 16F684, 16F685, 16F687, 16F689, 16F690, 16F716, 16F785, 16F818, 16F819, 16F870, 16F871, 16F872, 16F873, 16F873A, 16F874, 16F874A, 16F876, 16F876A, 16F877, 16F877A, 16F913, 16F914, 16F916, 16F917, 16F946
  • Other: 14000, 16HV616, 16HV785

No meaningful disassembly from the following types:

  • 10F: 10F200, 10F202, 10F204, 10F206, 10F220, 10F222
  • 12F: 12F508, 12F509, 12F510, 12F519, 12F609, 12F615, 12F635, 12F675, 12F683
  • 12C: 12C508, 12C508A, 12C509, 12C509A, 12CE518, 12CE519, 12CE673, 12CE674
  • 16C: 16C52, 16C54, 16C54A, 16C54B, 16C54C, 16C55, 16C55A, 16C56, 16C56A, 16C57, 16C57A, 16C58A, 16C58B, 16C505
  • 16F: 16F54, 16F57, 16F59, 16F87, 16F88, 16F505, 16F506, 16F526, 16F610, 16F631, 16F688, 16F722, 16F723, 16F724, 16F726, 16F727, 16F737, 16F747, 16F767, 16F777, 16F882, 16F883, 16F884, 16F886, 16F887
  • Other: 12HV609, 12HV615, 16HV540, 16HV610

attinty13 solution

Test the communications with the controller with:

avrdude -P usb -c dragon_isp -p attiny13 -v

With the attiny13 solution, program the microcontroller with:

avrdude -P usb -c dragon_isp -p attiny13 -Uflash:w:/Users/iudex/Downloads/tiny13-90w/Dell_1wire.hex:i
avrdude -P usb -c dragon_isp -p attiny13 -Ueeprom:w:/Users/iudex/Downloads/tiny13-90w/Dell_1wire.eep:i

The terminal mode can be entered with:

avrdude -P usb -c dragon_isp -p attiny13 -t

fuse settings

Debugging with Bus Pirate

Connect Bus Pirate with 1-wire device as follows:

  • (Bus Pirate) MOSI → (ATtiny13A) 1-wire data pin (to 47 ohm resistor)
  • (Bus Pirate) GND → (ATtiny13A) GND

Because the ATtiny13A is not a genuine 1-wire ic, connect additionally:

  • (Bus Pirate) +5v → (ATtiny13A) +5v

With Bus Pirate v4 an external pull-up resistor is not required. The board con be configured by software to have one. Use a terminal, configure speed to 9600 N81, 'new line' shall be only CR. Connect the Bus Pirate and enter the following commands:

HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. KEYB
9. LCD
10. PIC
11. DIO
x. exit(without change)

(1)>2
Ready
1-WIRE>v
Pinstates:
#12    .#11    .#10    .#09   .#08   .#07   .#06   .#05   .#04   .#03   .#02   .#01   
GND.5.0V.3.3V.VPU.ADC.AUX2.AUX1.AUX.-.-.-.OWD
P.P.P.I.I.I.I.I.I.I.I.I.
GND.0.00V.0.00V.0.00V.0.00V.L.L.L.L.L.L.L.
1-WIRE>W
POWER SUPPLIES ON
1-WIRE>P
Pull-up resistors ON
Warning: no voltage on Vpullup pin
1-WIRE>e
Select Vpu (Pullup) Source:
 1) External (or None)
 2) Onboard 3.3v
 3) Onboard 5.0v

(1)>3
5V on-board pullup voltage enabled
1-WIRE>v
Pinstates:
#12    .#11    .#10    .#09   .#08   .#07   .#06   .#05   .#04   .#03   .#02   .#01   
GND.5.0V.3.3V.VPU.ADC.AUX2.AUX1.AUX.-.-.-.OWD
P.P.P.I.I.I.I.I.I.I.I.I.
GND.4.96V.3.34V.4.86V.0.00V.L.L.L.H.H.H.H.
1-WIRE>(0)
 0.Macro menu
Macro     1WIRE address
No device, try (ALARM) SEARCH macro first
1WIRE ROM COMMAND MACROs:
 51.READ ROM (0x33) *for single device bus
 85.MATCH ROM (0x55) *followed by 64bit address
 204.SKIP ROM (0xCC) *followed by command
 236.ALARM SEARCH (0xEC)
 240.SEARCH ROM (0xF0)

1-WIRE>(240)
SEARCH (0xF0)
Macro     1WIRE address
Device IDs are available by MACRO, see (0).

...
...
...

If you are ready, either type:

1-WIRE>e
Select Vpu (Pullup) Source:
 1) External (or None)
 2) Onboard 3.3v
 3) Onboard 5.0v

1-WIRE>p
Pull-up resistors OFF

(1)>1
 on-board pullup voltage disabled

1-WIRE>w
POWER SUPPLIES OFF

or type 'm', which will turn off all outputs, power supplies and pull-up resistors. It's ready to accept a new mode. Press 1 to return to HiZ mode:

1-WIRE>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. KEYB
9. LCD
10. PIC
11. DIO
x. exit(without change)

(1)>1
Ready
HiZ>

Programming a DS2502 with bus pirate:

1-WIRE>(51)
BUS RESET  OK
READ ROM (0x33): 0x89 0xA0 0x56 0x2E 0x12 0x70 0x5E 0x1C 
Unknown device

1-WIRE>r
READ: 0xFF 
1-WIRE>r:255
READ: 0xFF 0xFF ... 0xFF

255 bytes will be read </code>

Alternative implementations

Searching with google for 1 wire emulator revealed following pages:

Some information and a small video on defective parts on eevblog can be found here.

Relevant articles

projects/repair/dell_pa10.txt · Last modified: 2013/10/29 02:05 by admin