Repurposing the TI EZ430U, Part 1

by Travis Goodspeed <travis at utk.edu>
at the Extreme Measurement Communications Center
of the Oak Ridge National Laboratory



Lately I've been playing with the EZ430U, which is the adapter that ships with the TI EZ430 kits. The kits are an amazing deal, $20 gets you a spy-bi-wire MSP430 FET, while $50 gets you a similar FET with two wireless sensor nodes. Page 13 of SLAU227 contains the schematic diagram for Rev 2.0 of the MSP430U board, which ships packages as both the classic EZ430f2013 and the new EZ430rf2500; the only hardware difference is the color of the board, being green or red respectively.

The software differences, however, aren't so forgiving. While the classic kit readily creates a USB->serial device under Linux, the RF kit is as yet unusable in Linux as the interface was altered to support a second serial line, one to target board.

Each kit is composed of two types of boards, a programmer (EZ430U) and a target (RF2500T or T2012). While the target boards are a lot of fun, an email I received after my initial release of msp430static introduced me to something just as fun. Namely, the JTAG fuse of the EZ430U board is left unblown. The following diagram shows pin connections from the row of 5 testpoints on the side of the board.

The lack of a common ground is no problem, as ground and power both come from the same computer through USB. You'll need a proper JTAG FET; another EZ430 won't do. (The EZ430 programmer only supports spy-bi-wire; it cannot program traditional JTAG boards.)

Having ripped the firmware from both the RF kit and the 2013 kit, I thought it might be interesting to compare the two. For a brief visual comparison, consider the following memory maps. The first is of an EZ430U from a classic 2013 kit, the second is of the EZ430U from an RF kit.

Taking the difference of the two images yields

The lowest bands of the image, being ram and I/O, ought to be ignored. Still, higher memory makes it visually clear that the firmware images are different. Comparing library checksums confirms this: few functions are identical between the two revisions.

The RF firmware reports itself to the USB controller as "0451:f432" while the classic board reports itself as "0451:f430". The identification appears must reside in the ROM of the 3410 chip, as the RF variant identifies itself as f432 even when loaded with the classic variant's firmware.

The second installment of this series continues with details of the TUSB3410 firmware, which resides on an EEPROM.