Tuesday, April 30, 2013

Using the FPGA of an eeColor Color3


The eeColor Color3 device is designed to enhance the colors in televisions that use HDMI input. The device is supposed to work well in all types of viewing environments, with various lighting situations. But what really got me interested in this device is the chip in the center, which is an Altera Cyclone 4, 30K logic element FPGA (EP4CE30F23C6N). I initially found the device in a post on reddit asking if the header on the board was a JTAG or USB header. The author posted high resolution images and a video of the case being opened. Most of the comments seemed to agree that it was a JTAG header.

The author also noted that these devices were being given out for free (with rebate) by Newegg. So I looked around to see if I could get my hands on one for a reasonable price and found the devices being sold on Amazon (search "eecolor") for about $5 to $15! A development board with one of these FPGAs typically retails for over $100. While 30K logic elements is not huge, it is definitely a good starting place for people want to begin developing on FPGAs.


Insides
Having only worked with Xilinx products in the past, I did not have a JTAG cable for Altera products, but I found they are readily available on eBay for about $10. I plugged in the USB Blaster to the eeColor device and Quartus instantly recognized it. I was also able to upload bitstreams without trouble.

There are a few other chips of interest on the board, one of which is a 128P33BF60, which is a 16 MByte parallel flash, which is used to configure the FPGA. According to the Cyclone 4 Handbook the P33 chip is recommended in the AP configuration scheme. Also, the handbook tells us that the FPGA on board uses about 9 MBytes of this memory, so 7 MBytes should be available for other uses. I have not programmed this chip, but it should be relatively easy using the Quartus software. Another chip of note is the 48LC8M16A2, which is a 128 Mbit SDRAM. I have not confirmed that it is connected to the FPGA, but believe that it is.

The other two chips on the left and the right of the FPGA are labeled SiI9136CTU and SiI9233ACTU. These chips are HDMI transmitters and receivers, respectively. While a NDA is required to get the full data sheets of these chips, a product brief and a data brief are available for each of the chips.


The images above come from the product briefs, although there was no circuit diagram available for the SiI9233, my guess is that it does the opposite of the SiI9136. This includes HDCP Decryption. From the "AV Receiver" portion it looks like data comes in the receiver, is then decrypted and sent through the MCU (in this case the FPGA?) and then re-encrypted before transmission. I am not knowlegable about HDCP encryption, this seems like a vulnerable point for copying Hi-Def content, or modifying it. 

Finally, there is an unpopulated pad above the FPGA labeled U15. I imagine that this pad probably was put there for a FTDI USB-to-Serial connection. Several of the pins connect to the FPGA. My guess is that this was used for debugging purposes, but it is odd because there is a hole in the case for a USB connection that is covered by a black sticker. I don't know why this hole would be there if USB was only designed for debugging.

Also miscellaneous components present on the board are a reg/green/orange led near the power supply. A blue led and an IR receiver in front. Also there is a push button on top. All of these elements I believe make for a good cheap starter FPGA development board.

Pinout
While it is easy to get access to the FPGA through the JTAG, the more difficult task is determining what the remaining pins on the FPGA are connected to. I noticed that as soon as I programmed the FPGA, the led near the power supply turned orange. Normally during it's intended operation it is green. I also took a multimeter to all of the unpopulated pads where the FTDI chip goes and found a voltage of around 2.7v. So I assume that the majority of the pins on the FPGA are being pulled high. 



To determine which pins on the FPGA were connected to the orange led, I wrote some quick Verilog code to ground 10 pins and selected the 10 pins in the corner nearest to the led. This worked perfectly, the orange led turned off. By grounding fewer pins, I was able to determine that the red led was on pin AB19 and the green was on pin AB18. When they are both are on, it makes orange.

Using the same process and a multimeter, I was able to determine some of the pins that would go the the FTDI chip (AB14, AB15, AB16). I believe that there are 8 pins that go to open pads, I just have not checked them all yet. However to repeat my process, just watch when the pads go from 2.7v to 0v. 

To find out which pins are connected to the P33 chip is a simple process, look at the pinout information provided by Altera! All of the necessary pins should be labeled under the column "Configuration Function". 

Finding the clock
Finally, most FPGA designs will need a clock, so it was important to find the clock and the frequency. Between the FPGA and the JTAG is a chip labeled Y1, which is a dead giveaway that it is the clock. It is an IDT8102. By looking at the datasheet on Digikey, it looks like it could be any frequency from 4 MHz to 50 MHz, but I could not determine the frequency by it's markings.

So again, I needed to figure out which pin this was connected to on the FPGA. I narrowed the search by opening the Pin Planner in Quartus and only looking at the specific pins which are designed for a clock. I looked at row A first because it was physically closest to the chip. Then I designed a counter that would count to 50 million and change the color of the led once it reached this number, then reset. I did this because routing the clock directly to the led would make it flash to fast, but this way it would only change once a second at most. If I guessed the wrong pin, then the led (probably) wouldn't flash at all. It only took two tries and the clock was found to be at pin A12. 

I found the frequency of the clock to be 25 MHz by very low tech methods. I watched the led blink with a stopwatch out and timed how long it took to blink 100 times. Using simple math, it was easy to find the frequency. While this probably is not the best method, it certainly is cheap and does not require any fancy (and expensive) equipment or a lot of coding/configuration. But looking at the data briefs of the SiI chips, this frequency makes sense. The max frequencies used in those chips is 225 MHz, or 9 times the speed of the clock. 

Testing and Conclusions
Overall, I this this would make a great introductory board for anybody interested in working with FPGAs. It has a simple plug and play JTAG header, it has leds and buttons, it has an unpopulated spot where GPIO pins can be soldered. It also has access to volatile and non-volatile memory. For the more advanced programmer, maybe something interesting can be done with the HDMI connections.

I would really like to encourage people to buy these devices and share their findings. Right now they can be purchased on Amazon for less than $15, and a programming cable on eBay can be purchased for less than $10. FPGAs are an amazing technology and I would like to see a lot more people using them to create cool and innovative projects. 

While my eeColor device is not being developed on I have it running as a bitcoin miner using an Open Source Bitcoin Miner. Right out the door it is capable of 15 megahashs/sec. While this is nothing compared to the ASICs that are on the market or fast GPUs, it is still comparable to CPU mining. Using the killowatt I measured it's power consumption at 2.5 watts while mining. My i7 processor also can mine bitcoins at max of around 15 megahashs/sec. I for one am impressed that this $15 piece of specialized hardware is so capable and again, I would love to see people doing some cool things with it. I will continue to work with the board and post more of my findings here.

Update 5-8-13: Many of the cheap devices on Amazon have sold out after the HAD post, try instead searching eBay for "color3 hdmi"

45 comments:

  1. Will the $15
    USB Blaster cable from Amazon work with this?

    ReplyDelete
    Replies
    1. Yes, this looks like it is exactly what I bought.

      Delete
  2. Can you explain how you got Bitcoin miner running? The precompiled .sof file works on a different hardware, and I'm not sure how to compile it for this hardware. I'm sure this is trivially obvious, but not for us newbies :)

    ReplyDelete
  3. Or, could you just upload your compiled .sof file :)

    ReplyDelete
  4. I got it working. Out of box, I got only 10-MHash/sec instead of the 15 you got.

    Since you need to leave the JTAG programmer cable connected, the total price is about $30 from Amazon.com: $15 for the Color3 device, and $15 for the USB Blaster JTAG cable. I can't use one JTAG cable for multiple Color3 devices.

    This webpage (https://en.bitcoin.it/wiki/Open_Source_FGPA_Bitcoin_Miner) has some useful information.

    I downloaded the "Quartus II Web Edition v12.1sp1" in order to recompile the source code for this new device.

    I used the project "Open-Source-FPGA-Bitcoin-Miner-master\projects\DE2_115_makomk_mod/fpgaminer.qsf".

    In Assignments/Devices, I changed the chip from EP4CE115F23C7 to EP4CE30F23C7.

    In Assignments/PinPlanner change "osc_clk" to "PIN_A12" as you describe.

    I couldn't figure out where to change CONFIG_LOOP_LOG2 in project settings, so I manually edited line 38 of 'fpgaminer_top.v' and hard coded that as the value of 2. Lower values gave an error message "Error (170048): Selected device has 66 RAM location(s) of type M9K. However, the current design needs more than 66 to successfully fit".

    This successfully compiles and loads on to the device. I use the "Signal Tap II" to program the device with the fpgaminer.sof file, but it looks like there are lots of different ways to do this.

    I then run "mine.bat" file uploading the slush's pool. This gives me a rate of only 6-MHash/sec. I change altpll_component.clk0_multiply_by to 8 instead of 5. This increases the rate to 10-MHash/sec. If I get more aggressive, then the I get warnings about timing, and _reject_ messages while mining. I'll eventually get _reject_ messages even at the 8/5 ratio.

    So, what do I need to do in order to get to 15-MHashes/second?

    BTW, I have absolutely no clue what I'm doing, I can barely spell "FPGA" :)

    ReplyDelete
    Replies
    1. Yes, you were on the right path Robert. The differences are as follows: I used the BeMicro branch, loop_log2 = 3. In main_pll, I set the divide to 1, the multiply to 4 and the input frequency to 40000 (40ns period). That's what I remember changing. So maybe it is not ready to go out the door, but I uploaded the compiled project as requested. You can find it here: https://code.google.com/p/taylor-killian/downloads/list

      Delete
    2. While the JTAG cable can only connect to a single board, it is possible to daisy chain FPGAs together. I haven't looked into it too much, but I believe that it would only require soldering a few wires between boards.

      Also note that the frequency will play a role in the accept/reject rate. As you increase the frequency, more heat will be produced. For the 15 MHash miner, I have it running at 100 MHz without a heatsink. The chip itself is very hot to the touch, which could be dangerous, but it seems to be working okay for me. According to mine.bat, my reject rate is about 2.22%. Also, note that I use the stratum proxy with slush's pool, which should cause fewer rejections.

      Delete
  5. Thanks! I downloaded your .sof files and uploaded them to the Color3 and it's working great. I ran it overnight and have a 2.79% reject rate on Slush's pool. I also ran a GPU miner and got some rejects, so I assume those rejects are due to reasons other than corruption on the chip.

    Could you also upload your entire BeMicro-derived project? or do a GIT pull request to get it in the main code base? I'm not really interested in bitcoin mining so much as general FPGA knowledge. I'd rather start from a real-world project like bitcoin mining and then work backwards, instead of a "hello world" project then working forwards. There are lots of questions I have that'd be answered just by looking at your source. Did you set the clock pin to A12? did you change "intended_device_family" to Cyclone 4? and so on.

    Running your faster .sof, my chip still isn't too hot to touch. If I press down hard, it gets a little uncomfortable after a few seconds, but it doesn't seem all that "hot". If I attached a heatsink and a fan (there are pads conveniently labeled 5v 4.7v and 3.3v on the board to solder to), how much faster do you think we can clock this? Comparing this C30 to the C75 that fpgaminer was first written for, it seems like we should be able to go twice as fast with a heatsink and fan.

    It seems like there are several problems involved. One is getting rid of the heat. Second, there is the problem of making sure enough power can be supplied. Thirdly, there is the problem of timing. I haven't a clue about what timing parameters need to change to make it go faster.

    So, looking at the JTAG chain, it seems that everything is in parallel except for TDO/TDI which are connected in series. Seems like a I could hack up a ribbon cable that does this in order to hook three eeColor's together off of one USB Blaster. The Quartus programmer should then work, but I wonder what the fpgaminer software will do with that.

    ReplyDelete
    Replies
    1. Originally when I created the project, the files were in a bunch of different directories, but to make a compressed file, I made a new project with all of the files in the same directory. I'm not sure if I all of the same modifications or not, but I checked the produced file and it mines. The file is uploaded to my Google Code site. I don't really intend to make any more changes to the miner. I am now more interested in interacting with the other chips on board.

      Basically all of the changes were already mentioned in the above posts. The only thing I think I did not mention is using the "TimeQuest Timing Analyzer Wizard". This is found under the Assignments menu. Here I added osc_clk with a period of 40ns. By doing this, Altera should be able to verify if the design will meet the timing constraints. Without it, Altera has no information about the clock. As I said, I am new to Altera, so there might be a better/faster way than the wizard, but I believe it will work. From the report you can see that the max speed at 85 Celsius is 96.49 MHz, so it will not meet the timing constraints when it gets too hot.

      I have no idea what the effect of changing the value of "intended_device_family" would do. It may or may not have an effect. I actually didn't even notice this field while generating the bitstream. The bitcoin miner is not my end goal, I just wanted produce a bitstream that did something practical without having to code too much. If I spent more time on the design, I probably would have one of Altera's wizards create the template for the pll, rather than just modifying specific values.

      If you want to start with a real world project, I would recommend using prebuilt IP from opencores.com to build something useful. Or figuring out how to interact with the HDMI chip would be very useful, but maybe difficult. Actually if you are interested in continuing with the bitcoin source, it might be interesting to take a look at some of the duel core source code. You could more effectively use space on the FPGA that way. For instance the FPGA could have a LOG_LOOP2=3 core and a LOG_LOOP2=5 core on the same chip to use all the space.

      Delete
  6. Wow, 3 weeks and these devices have gone up to 60$-80$ range. . .

    ReplyDelete
  7. did some digging about teh hdmi chips. data briefs are public, with partial pinouts. (they are obfuscated below functional groupings)

    Sil9233 data brief: http://www.semiconductorstore.com/pages/asp/DownloadDirect.asp?sid=1368254622946
    sil9136CTU data brief: http://www.semiconductorstore.com/pages/asp/DownloadDirect.asp?sid=1368254718420

    complete pinouts can be found in service manuals for other devices using the same chips, such as the pioneer BDP-LX55 and yamaha rx-v565.

    ReplyDelete
    Replies
    1. didn't notice the data briefs were already mentioned in the post.
      i downloaded the linux kernel for the bdp-LX55 hoping it would have a driver for the sil9136, but it doesn't even seem to have code for the mt85xx, the cpu that blueray player uses, looks like pioneer uploaded the wrong kernel. doing some more digging.

      Delete
    2. Have you a link for the Kernel image?

      Delete
  8. I'm curious as to how you both got it to actually "run". I was able to compile and upload the program using Quartus, but cgminer doesn't seem to auto-detect the board and trying to run mine.bat that comes with open-source-fpga-bitcoin-miner looks for a config.tcl that isn't there. I assume that I have to use mine.bat and create a config.tcl, but just wanted to make sure.

    ReplyDelete
  9. Sorry, stupid question. I created a config.tcl using the example file and ran mine.bat. Looks like it's running fine.

    ReplyDelete
  10. It seems like the FTDI chip was originally intended for firmware updates since the instruction manual lists a "Fireware Revision Mode". Below is the pinout to the SDRAM, IR Receiver, red blue and green LEDs, and 25Mhz clock in .csv form. The NC36 pin refers to pin 36 on the SDRAM, which does not require a connection but has one.

    I'm having some trouble using the SDRAM so if someone with more experience could post a sample project using it that would be awesome.

    To,Location
    CLOCK_25,PIN_A12
    LEDR,PIN_AB19
    LEDG,PIN_AB18
    LEDB,PIN_D6
    IR,PIN_E9
    DQ[0],PIN_D20
    DQ[1],PIN_B20
    DQ[2],PIN_D19
    DQ[3],PIN_C19
    DQ[4],PIN_B19
    DQ[5],PIN_A19
    DQ[6],PIN_A18
    DQ[7],PIN_D17
    DQ[8],PIN_G15
    DQ[9],PIN_H15
    DQ[10],PIN_F16
    DQ[11],PIN_G16
    DQ[12],PIN_H16
    DQ[13],PIN_F17
    DQ[14],PIN_G17
    DQ[15],PIN_H17
    BA[0],PIN_D15
    BA[1],PIN_C15
    A[0],PIN_E12
    A[1],PIN_D10
    A[2],PIN_C10
    A[3],PIN_A10
    A[4],PIN_E10
    A[5],PIN_G10
    A[6],PIN_H10
    A[7],PIN_G11
    A[8],PIN_H11
    A[9],PIN_G13
    A[10],PIN_E13
    A[11],PIN_F14
    DQM[0],PIN_C17
    DQM[1],PIN_F15
    WE_N,PIN_E16
    CAS_N,PIN_B16
    RAS_N,PIN_A16
    CS_N,PIN_E15
    CLK,PIN_A20
    CKE,PIN_G18
    NC36,PIN_G14

    ReplyDelete
    Replies
    1. There's a typo in the list, make CKE=PIN_H14. Sorry about that.

      Delete
    2. Thanks for posting these. I am a little curious what method you used to find these pins, or if you used a method similar to mine. Anyway, I will search for some prebuilt stuff that interacts with the SDRAM and post back here if I find something. I am sure Altera has some IP, the only question would be if they are charging for it or not.

      Delete
    3. I used a similar method to yours to find the pins. I actually managed to get the SDRAM functioning since my last post using SOPC Builder to create a NIOS processor on the FPGA.

      I'm using the "SDRAM Controller" module set to custom with a data width of 16, chip select 1, banks 4, row 12, and column 8. Then I'm using ALTPLL to generate the 133MHz clock needed using a multiplication factor of 16 and division of 3. Also, Quartus doesn't like that I named one of the pins CLK so I had to rename it.

      Delete
  11. Hello do you guys know of any other hackable consumer electronics with FPGAs?

    ReplyDelete
    Replies
    1. The only other device I can think of off hand is the Pano Logic Zero Client that was featured on Hack A Day ( http://hackaday.com/2013/01/11/ask-hackaday-we-might-have-some-fpgas-to-hack/ ). I'm sure there are a lot more out there and I'd love to know about more in the wild.

      Delete
    2. And usage of FPGAs in thin clients is of course nothing new (though always has been niche). This page lists 2 devices for example: http://www.parkytowers.me.uk/thin/hware/hardware.shtml (grep for Altera).

      Delete
  12. just got my own board, feel free to see what I found out: http://blog.udif.com/?p=6
    (Better pictures, more ICs identified, including a temperature sensor).
    - udifink

    ReplyDelete
  13. This may be a silly question, but how are you connecting the eeColor to the internet?

    ReplyDelete
    Replies
    1. The eeColor itself does not connect to the internet. If you are wondering about the bitcoin example, it is the host computer that communicates with the internet and the miner. Communication with the miner is through the JTAG cable.

      Delete
    2. Well, that answers my question! Thanks!

      Delete
  14. I realized that I have an early version of this product, it even came with an extra unpopulated FPGA in the box! (What am I going to do with that?)

    It looks like everything is populated, most notably the FTDI chip and the micro USB connector. That probably actually makes it less useful to me....

    ReplyDelete
    Replies
    1. Interesting. Do you mean that there is an FPGA on board and empty spots for another FPGA? That would definitely have to be different PCB and really old!

      The micro USB might be really interesting. Can you interface with it on a PC using HyperTerminal or puTTY or something? It might be really useful if there are a bunch of debug commands on it that might help us understand the FPGA interaction with the SiI chips.

      Delete
    2. No, I mean to say that there was just an extra FPGA in an antistatic bag in the box -- no place for it on the board. It appears to be the same board as the pictures here and elsewhere.

      I plugged it in to my PC, but it doesn't appear to be a terminal interface. Nothing at any of the common bit rates, and no junk characters either.

      Delete
  15. Can you read off what's written on U12 near the USB socket?

    ReplyDelete
    Replies
    1. It's tiny -- horizontally next the pin 1 indicator dot it says "11". Vertically down the middle it says "EUs" or "E11s" or "E{}s", very hard to tell.

      Delete
    2. The chip is not populated on the third revision, but my guess is that it is Electro Static Discharge protection. So when you plug in the USB, the internal circuitry is not damaged.

      Delete
  16. Great article. Any updates on communication to the other chips?

    In the mean time I was playing with bitcoin miner - it's an excellent example project (well, and the board could potentially even pay for itself :)).
    I modified miner to run 2 cores (unrolling constants 3 and 5) and made some minor tweaks (LEDs, actual hashrate output, etc).
    After these modifications I am using 99% of the chip. And at 110MHz it's producing 17.19MH/s (110/32 + 110/8), not bad for a $10 toy.

    ReplyDelete
  17. Hi, as i can see the PIN A_12 is a 3.3V. are you using the default power cable? Mine, at least is a 5V, 1000 mA. Is your power cable different or it doesn't matter?

    ReplyDelete
  18. A datasheet for the Sil9233 HDMI receiver can be found hereif anyone is interested:

    http://ehs.ampak.com.tw/upload_folder/Material/S-000069_1408_tempSiI9233ACTU.pdf

    ReplyDelete
    Replies
    1. This comment has been removed by the author.

      Delete
  19. Hi Taylor, Dan

    Are you able to advise what voltages the various banks of the FPGA are configured for?

    Thank you

    ReplyDelete
    Replies
    1. I am not sure on the voltages. When I get a chance I'll look into it.

      Delete
  20. SiI9134 driver code as per below links. It will take a lot of work to figure out the connections to the FPGA bt it would be great to be able to use this board with the Altera VIP (Video IP) megacores.

    http://read.pudn.com/downloads167/sourcecode/multimedia/streaming/768879/SiI9134.c__.htm

    http://read.pudn.com/downloads167/sourcecode/multimedia/streaming/768879/SiI9134.h__.htm

    ReplyDelete
  21. I don't know about the silicon image devices but I know that the analog devices transmitters and receivers have a ton of undocumented registers. They basically supply a script to setup the device with the development boards - hitting a myriad of register locations in sequence. It needs to be precise otherwise the device wont work as expected.

    ReplyDelete
  22. hmmm does it have to have the jtag header attached either way? why not use some of the gpio for a slip connection to a *nix box like the old matchbox web server?

    (mind you i don't get online that often anymore (like the old days) but i'm just throwing this out there to stir the pot)

    ReplyDelete
  23. The button is on E7, if anyone else wanted to know.

    ReplyDelete
  24. I've populated the FTDI chip and supporting components, along with the temperature sensor. It seems like the FPGA is holding the FTDI in reset with the firmware my board shipped with. The FTDI chip is powered by the USB bus so it shows up when the board is plugged into USB and the power supply is disconnected, but since nothing else on the board gets powered up it isn't very useful. When the board is powered, the FTDI gets put into reset or something and the USB device disconnects. My next project will be to write a simple loopback test for the FTDI chip.

    To trace all the connections for the TMP75 and the FT232RL I used a slightly different technique than yours: I set up a project with just the clock input and 32 input wires (I could have done more at a time). Then I traced all the inputs in SignalTap so that I could see which pads mapped where by poking around with a wire. I ran two wires to a breadboard and connected them through a 1k resistor. Then I would use one of the leads to touch a pin I wanted to find, and with the other lead I tapped on GND or 3.3V while watching SignalTap.

    Here are the connections I discovered for the FT232RL and TMP75:

    [PAD = DEVICE FUNCTION (PIN)]
    AA15 = FT232RL CBUS0 (23)
    AA14 = FT232RL CBUS1 (22)
    AA8 = FT232RL CBUS2 (13)
    AA7 = FT232RL CBUS3 (14)
    AA9 = FT232RL CBUS4 (12)
    AB7 = FT232RL CTS# (11)
    AB8 = FT232RL DCD# (10)
    AB9 = FT232RL DSR# (9)
    AB16 = FT232RL DTR# (2)
    AA13 = FT232RL RESET# (19)
    AB10 = FT232RL RI# (6)
    AB14 = FT232RL RTS# (3)
    AB13 = FT232RL RXD (5)
    AB15 = FT232RL TXD (1)

    Y10 = TMP75 ALERT# (3)
    Y8 = TMP75 SCL (2)
    Y7 = TMP75 SDA (1)

    ReplyDelete
    Replies
    1. I made a mistake and have TXD and DTR# swapped. The correct connections for those are as follows:

      AB16 = FT232RL TXD (1)
      AB15 = FT232RL DTR# (2)

      Delete
  25. I just got my hands on one of these boards($25 on ebay) and intend to use it to learn to mine the new X11 algo, as well as learning to use FPGA's in general. Thanks for all this great info. I'll be using it and referring to it once my JTAG cable arrives tomorrow and I'll be happy to share any of my discoveries.

    (BONUS: my captcha was "1337")

    ReplyDelete