5
\$\begingroup\$

I'm trying to reverse engineer the SPI communications between two chips. But, it's not clear who's master and who's slave.

I've found the chip select. Without lifting any pins or cutting traces is there a way to detect which end is asserting it?

The chips are: CC1110 (SoC radio) and CY7C63803 (USB MCU). The chip select comes off of the SSEL (slave select) line on the CY7C63803 and into a GPIO pin on the CC1110.

The CY7C63803 is an SOIC, so I could lift a leg, but I don't want to break it.

\$\endgroup\$
0

5 Answers 5

Reset to default
9
\$\begingroup\$

It's difficult to use a GPIO pin on a slave device as a chip select. If the chip select signal is not detected soon enough at the slave device after it is asserted you can miss the data that the master is clocking out. Since the CY7C63803 has its SSEL pin connected to the chip select line my guess is that it is the slave. The CC1110 is probably the master. You will probably need to lift a pin on one of the devices to know for sure.

\$\endgroup\$
2
  • 3
    \$\begingroup\$ According to this ( focus.ti.com/lit/ds/symlink/cc1110f32.pdf ) CC1110 datasheet, "In SPI master mode, only the MOSI, MISO, and SCK should be configured as peripherals. If the external slave requires a slave select signal (SSN) this can be implemented by using a general-purpose I/O pin and control from SW." Since you indicated the chip select comes off of a GPIO pin on the CC1110, this supports mjh2007's answer. \$\endgroup\$
    – tcrosley
    Commented Oct 13, 2010 at 15:47
  • \$\begingroup\$ Accepted - this helped me understand what I was seeing. It turns out that the bus was not SPI, nor had I found the chip select. It was one of two attention lines used to signal the start of a data transfer. One of these terminates at CY7C63803:SSEL, the other on an (interrupt capable) pin of the CC1110. The attention line is briefly pulsed before each transfer, then data is clocked out over one of the two data lines. Though, I still don't know who's driving the shared clock ;-) \$\endgroup\$
    – Toby Jaffey
    Commented Oct 14, 2010 at 0:00
7
\$\begingroup\$

How about holding each of the chips in reset (in turn) and observing the CS line?

The theory being that the line will tristate while the chip's in reset.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ Should work unless the master deasserts SS if tries and fails to contact the slave, but that just means you might have to use a scope instead of a multimeter. \$\endgroup\$
    – Nick T
    Commented Oct 13, 2010 at 15:08
  • 1
    \$\begingroup\$ Good idea. If you reset the slave you should still see the CS line toggling on a scope. If you have reset the master the line will float. \$\endgroup\$
    – mjh2007
    Commented Oct 13, 2010 at 15:15
2
\$\begingroup\$

How fast is it toggling the line? If it is slow enough, you could you measure the voltage between the pins with a good multimeter to determine which side is trying to sink the current. From pullup values/drive strength/trace resistance that I'd guess it might be possible with my 187 for instance.

Short of absolute proof though, mjh2007 is probably right; if one side is using the SS pin shared by the SPI hardware peripheral while the other uses some random GPIO, that's all but conclusive.

\$\endgroup\$
2
\$\begingroup\$

Try zooming waaaaaaaaaaaaay in with a really high resolution o-scope. Maybe you can see the reflection on the trace? The ringing at the load should be worse than the ringing at the source.

\$\endgroup\$
1
\$\begingroup\$

You'd need to figure out which way the current is flowing-- the upstream chip on the chip select line is the driver. That's hard without cutting traces. My best idea would be to place a coil of magnet wire connected to a large resistor next to the trace. Measure the voltage induced in the resistor through the mutual inductance when the chip select line changes state. The polarity of the voltage should correspond to the direction of current flow.

But honestly, that's just a theoretical answer. Given that you're probably trying to detect uA, which would induce nV potentials in the coil, I think the chances of it actually working are very close to zero. Maybe try it with a wire and a signal generator first, to see how small a change you can detect?

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.