High-Voltage Serial Programmer – Rescue AVR Chips

Goal: Let’s build a high-voltage serial programmer (HVSP) to reset the fuses of extremely-bricked AVR ATtiny devices using another ATtiny85 Digispark and an on-board charge pump. This design can rescue many chips in rapid succession.

Imagine you accidentally disable the reset line, or disable the internal clock of your AVR chip – you’ve bricked your microcontroller. The HVSP1 can reset the device back to factory settings, automatically.

Motivation

Some of my ATtiny85 BlinkSticks no longer accept serial programming because of issues with undervoltage from a slow-decay power supply. Those issues have been resolved, and brown-out detect (BOD) fuses are now enabled. However, a handful went haywire and need the NAND fuses reset so they accept SPI and JTAG programming again. Let’s fix that.

High-voltage serial programmer breadboard prototype
High-voltage serial programmer breadboard prototype

High-Voltage Serial Programmer

The voltage we’re talking about is only 12V. AVR chips have a backdoor to recover them, and precise timing and 12V are all that is needed to backdoor into bricked chips.

There are many neat articles on building HV programmers for and with Atmel AVR microcontrollers. One uses a 12V A23 battery (with only 55 mAh) and a common transistor to achieve the 12V. Another design uses a barrel jack and an external 12V power supply with a voltage regulator to supply both 5V and 12V. Others even use a diode-capacitor charge pump using two clock sources from an Arduino. Let’s expand on the charge-pump idea with a dedicated IC chip.

Wanting to keep the part count low, my plan is to use an inexpensive MAX662A charge-pump IC to increase the voltage from 5V to 12V complemented by only two capacitors.

How Charge Pumps Work

Charge pumps – also called switching voltage regulators – are fascinating. Without inductors or transformers, and just by switching solid-state components at the right frequency in relation to capacitance, it is possible to double, triple, or n-multiply the source voltage. Of course, the current is very low, but we only need a handful of milliamps for a brief duration to reset the fuses. The simplest DC-DC charge pump is the Dickson Charge Pump.

How a charge pump works
How a charge pump works (source)

A multi-stage Dickson charge pump with just diodes and capacitors needs two clock signals 180 degrees out of phase to make the charge cascade propagate. An alternative is to use one clock source with some NOT logic to invert the original signal into two signals. The design below is a 4x voltage multiplier.

Classic Dickson charge pump timing
Classic Dickson charge pump timing (soure)

The MAX662A and LTC1263 are excellent charge pump ICs. I’ll be using the Maxim MAX662A with two external capacitors in my design. Here is the schematic:

MAX662A charge pump IC
MAX662A charge pump IC (source)
MAX662A charge pump IC works well
MAX662A charge pump IC: 12V output from 5V input
Note: The MAX662A is a “12V, 30mA Flash Memory Programming Supply“. It has a logic-level input (SHDN) to control the output, but it switches between 5V and 12V, not between 0V and 12V.

To switch between 0V and 12V, we’ll use a simple transistor to enter and exit HVSP mode.

MAX66A 12V output waveform
MAX66A 12V output waveform (source)

Digispark ATtiny85 as an HV Serial Programmer

Having dozens of 8-bit ATtiny85 Digisparks at hand, I’ll use one as an HV programmer to program other ATtiny85s. It’s perfect for the job: it’s powered by the USB bus, has most of the passive components already, and lends itself to customization. First, let’s explore the schematic of the Digispark by Digistump.

Digispark ATtiny85 schematic
Digispark ATtiny85 schematic

Here is an ATtiny85 Digistump pinout reference.

ATtiny85 Digistump pinout reference
ATtiny85 Digistump pinout reference (Source: Digispark)

Here is a pin reference for the 8-pin ATtiny85 DIP.

ATtiny85 DIP pin reference
ATtiny85 DIP pin reference (Source: Learning About Electronics)

It should be fairly easy to incorporate the MAX662A, a couple of 0.22uF 5%-tolerance capacitors (224J), and a transistor into the above schematic. It looks like VIN and PB5 (reset) will be left floating. More on that later.

Atmel AVR High-Voltage Protocol

Simply put, you can apply 0V and then 12V to the target reset pin (PB5) at any time to enter HVSP mode.

Using this simple trick, and by keeping the power on continuously, I can flash many ATtiny85 chips just by attaching and removing a SOIC8 test clip. No need to toggle power. This is the advantage of this design over others. Also, I use colored LEDs for some flare.

Drawing inspiration from this article, we can learn a lot about the protocol. See below.

HVSP protocol waveforms
HVSP protocol waveforms (source)

The protocol follows a similar pattern to the following:

Atmel AVR HVSP protocol diagram
Atmel AVR HVSP protocol diagram (source)

One exciting discovery from this blog is that in addition to resetting the fuses, a chip may need to be erased if it is super bricked with the Lock Bit Protection on. Let’s get to some code.


Hardware and Schematics

Not much is needed to make an HV serial programmer: just a few capacitors, a neat charge-pump IC, a run-of-the-mill transistor, a resistor, a Digistump, and the SOIC8 connector. Added for fun is an APA106 NeoPixel LED to show the flashing status more pleasingly.

ATtiny85 high-voltage programmer schematic
ATtiny85 high-voltage programmer schematic

Parts

  • 1x ATtiny85 Digispark
  • 1x MAX662A charge-pump IC
  • 1x 2N3904 NPN transistor
  • 1x 1KΩ resistor
  • 2x 0.22μF 5% capacitors – 224J marking
  • 1x 4.7μF polarized capacitor2 – 475 marking
  • 1x DIP 2×4 pin connector
  • 1x SOIC8 clip, ribbon cable, and 2×4 ribbon female connector
  • 1x APA106 NeoPixel LED (optional)

Capacitor Information

But, what kind of capacitors should be used? I use ceramic 224J (0.22uF at 5% tolerance). Here is a quick reference3 of the types of capacitors:

Types of capacitors with ceramic capacitors highlighted
Types of capacitors with ceramic capacitors highlighted

Not being one to chance the values and ratings of the passive components, I took this time to verify the values of the capacitors. Here I see that at room temperature this capacitor, which is rated at 0.22μF, is reading 226nF, so it is viable.

Checking true capacitor values at room temperature
Checking true capacitor values at room temperature

Software

Let’s get into the driver logic that resets the fuses, erases the flash, and rescues your bricked AVR chips.

Enter HVSP Mode

How do we enter HVSP mode? With a little bit of timing, the procedure is as follows (Source: Atmel):

  1. Set Prog_enable pins listed in Table 20-14 to “000”, RESET pin and VCC to 0V.
  2. Apply ~5V between VCC and GND. Ensure that VCC reaches at least 1.8V within the next 20 μs.
    — No minimum time required between step 2 and 3 —
  3. Wait 20 – 60 μs, and apply 11.5 – 12.5V to RESET.
  4. Keep the Prog_enable pins unchanged for at least 10 μs after the High-voltage has been applied to ensure the Prog_enable Signature has been latched.
  5. Release the Prog_enable[2] pin to avoid drive contention on the Prog_enable[2]/SDO pin.
  6. Wait at least 300 μs before giving any serial instructions on SDI/SII.
  7. Exit Programming mode by power the device down or by bringing RESET pin to 0V.

Again, in code,

Chip Erase

From the Atmel AVR spec sheet for the ATtiny series,

The Chip Erase will erase the Flash and EEPROM memories plus Lock bits. The Lock bits are not reset until theProgram memory has been completely erased. The Fuse bits are not changed. A Chip Erase must be performedbefore the Flash and/or EEPROM are re-programmed. – Microchip

Here is the Chip Erase procedure.

Main Loop

When powered on, the AVR timings and delays are initialized, then the pins are set to output mode. When completed, a yellow color illuminates.

The main loop starts by initiating the HVSP mode. If the ATtiny85 is connected via the SOIC8 clip, then the chip is erased and the fuses are reset. If successful, then a green light will blink rapidly. If unsuccessful, then a red light will blink rapidly. The blinking will continue until the SOIC8 clip is disconnected, and happily there will not be an infinite loop of chip flashing. The ATtiny85 SOIC8 clip must be disconnected and reconnected for the flashing to reinitiate. This way many chips can be flashed without power-cycling the circuit.


Demo

Full Code

Below is the complete C++ code. It’s verbose on purpose so it is easy to follow and maintain.

Careful: The ATtiny85 spec sheet and fuse calculators state the default low fuse is 0x62 (Int. RC Osc. 8 MHz; Start-up time PWRDWN/RESET: 6 CK/14 CK + 64 ms; [CKSEL=0010 SUT=10]).

I’ve found this value keeps the chips bricked. Interrogating several factory ATtiny85 Digisparks, they all seem to have 0xF1 as the low fuse which works brilliantly (PLL Clock; Start-up time PWRDWN/RESET: 16K CK/14 CK + 64 ms; [CKSEL=0001 SUT=11]).

Let’s use the low fuse of 0xF1 going forward.

Makefile

Run make hex to compile the hex file which can then be flashed to the ATtiny85 via a serial programmer, or uploaded via micronucleus or AVRDUDE.


Results

Tip: Better done than perfect. I was planning to create a nice PCB and solder down all the parts in a visually-pleasing layout, but the most important thing is the circuit works very well, and I can rapidly erase dozens of chips in minutes. Check and check.
JTAG connector placement on the ATtiny85 chip
JTAG connector placement on the ATtiny85 chip
Successful high-voltage erasure of dozens of ATtiny85s
Successful high-voltage erasure of dozens of ATtiny85s
Success: We constructed a high-voltage serial programmer to reset the fuses of seriously-bricked AVR ATtiny-series chips using an ATtiny85 Digispark and a charge-pump IC.

Notes:

  1. https://microchipdeveloper.com/8avr:programminginterfaces
  2. This is optional but is manufacturer-recommended.
  3. Original source before edited heavily: Freetronics Pty Ltd. Released under the Creative Commons Attribution Share-Alike license.