dragonzap/README.md

# Dragonzap

## Introduction

Dragonzap is a PCB for voltage glitching. It provides both a SPDT switch for
quickly switching between a high and a low voltage (controlled by a DAC), and a
MOSFET circuit for crowbar glitching. GPIOs to interact with the DUT can go
through a level shifter. An optional header can be used to connect to the
analog part of a PicoEMP, using this board as controller.

The PCB is about 9.2 cm by 5.4 cm in size.

## Images

### Front

![Front image](image/front.png)

### Back

![Back image](image/back.png)

### 3D view, with components

![3D image](image/3dview.png)

## Notes

External module and footprint sources:
* https://github.com/ncarandini/KiCad-RP-Pico (Pico)
* https://github.com/lethalbit/aki-eda (Samtec FTSH SWD debug connector)
* https://git.lain.faith/sys64738/pcbs/src/branch/main/chip-bo (4x2 jumper,
  Xenia silkscreen image)

## Usage

Firmware of the Pico controller is still TODO. Most of the documentation can
be found on the PCB silkscreen.

### Pico pinout

| Name       | Pico pin | Usage |
|:---------- |:-------- |:----- |
| DUT GPIO   | GP0..GP7 | Generic GPIO to the target DUT, goes through level shifter U200 and out to J200. GP0 and GP1 are also connected to JP100 for UART. |
| RV50x      | ADC0, ADC1 | Potentiometers that can be used for manual parameter tweaking. |
| DACVCC/2   | ADC2     | Can be used to calculate the maximum voltage the DAC can reach, for calibration. |
| TRIG IN    | GP10     | DUT trigger input |
| GLITCH SIG/HVP | GP11 | DUT glitch (voltage supply) control, can also be used as PicoEMP `HVP` signal. |
| CB1 (Q300) | GP12     | Crowbar gate 1 |
| CB2 (Q301) | GP13     | Crowbar gate 2 |
| PWM        | GP14     | PicoEMP `PWM` signal |
| CHG        | GP15     | PicoEMP `CHG` signal |
| DAC nLATCH | GP17     | `nLATCH` signal of the DAC (U401). |
| DAC CLK    | GP18     | SPI clock signal of U401.
| DAC TX     | GP19     | SPI controller-to-device data signal of U401. |

## BOM

### Base components

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| U100 | 1        | Raspberry Pico | Pico module | Raspberry Pico module/board | This one serves as the glitch controller. Very important. |
| C100 | 1        | 47 uF          | THT Radial P2.00mm | Electrolytic capacitor | Extra decoupling capacitor for the Pico. |
| J200 | 1        | Pin header 01x08 | THT 2.54mm 01x08 | Generic pin header | Main GPIO to DUT connector, goes through level shifter U200. |
| J201, J202, J205 | 3 | Pin header 01x01 | THT 2.54mm 01x01 | Generic pin header | Main glitching to DUT connectors (pin headers). |
| J203, J204, J206 | 3 | Amphenol 132289 | SMA edge-mount connector | SMA connector | Main glitching to DUT connectors (SMA connectors). Has many other compatible connectors. |

### Optional connectors

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| J207 | 1        | Pin header 02x05 | THT 2.54mm 02x05 | Generic pin header | Power out (and extra external voltage in) connector. |
| D100 | 1        | 1N4001         | SOD-123     | Generic or Schottky diode. | Reset diode for external reset signal (SWD). |
| J100 | 1        | Pin header 01x04 | THT 2.54mm 01x04 | Generic pin header | UART connector (nonstandard, 2.54mm jumper) |
| J101 | 1        | Pin header 01x05 | THT 2.54mm 01x05 | Generic pin header | SWD connector (nonstandard, 2.54mm jumper) |
| J102 | 1        | FTSH-105-01-L-DV-007-K | THT 1.27mm 02x05 -OR- FTSH-105 SMD | Cortex debug connector | SWD connector (standard FTSH connector, 1.27mm pitch, either through-hole or surface-mount) |
| J208 | 1        | Pin header 02x03 | THT 2.54mm 02x03 | Generic pin header | Connector to PicoEMP high-voltage front-end. |

### Manual control potentiometers

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| RV500, RV501 | 2 | Bourns 3386F/P/U and clones, eg. Suntan TSR-3386 | THT 2.54mm 1x3 | Potentiometer. | Used for optional manual control of parameters. |

### If you need the "emergency reset button"

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| SW1  | 1        | Push button | THT 4-lead 6x6mm | Two-by-two push button switch, generic | Make sure the bends in the pushbutton leads are parallell with the lines on the silkscreen. |
| R1   | 1 | 220k | 0805 | Resistor | Pullup/pulldown resistors. |
| D101 | 1        | 1N4001         | SOD-123     | Generic or Schottky diode. | Reset diode to pull down the Pico's `3V3_EN` line (which can be at an indeterminate voltage). |

The emergency reset button will stop U100, and disable most other ICs (eg. U400, U200).

### If you need the DAC

The DAC can be used for the level shifter, crowbar glitcher and SPDT glitcher
(selected using JP200, JP300 and JP500).

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| U401 | 1 | MCP48x2/MCP49x2 | SOIC-8 3.9x4.9 (U401a) *OR* MSOP-8 3x3mm P0.65mm (U401b) *OR* TSSOP-14 P0.65mm (U401c) | 2-channel 8-bit DAC, SPI interface. | DAC, optional. If not placed, you probably want to short JP500, and short the two leads as indicated on the silkscreen. SOIC and MSOP both work, MCP4812 or MCP4822 can be used, too. The MCP49x2 series can also be used, but only for the U401c footprint, in TSSOP package only. |
| C401 | 1 | 10 nF | 0805 | Unpolarized (MLCC) capacitor | Decoupling capacitor for U401. Optional. |

### If you need the level shifter

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| U200 | 1 | TXS0108EPW *OR* NXS0108PW *OR* NTS0308EPWJ *OR* MAX3001EAUP+ | TSSOP-20 4.4x6.5mm P0.65mm | Bidirectional level-shifting voltage translator | The level shifter. Source from TI, Nexperia, NXP or Maxim. LSF-style level shifters cannot be used. |
| R200 | 1 | 47k | 0805 | Pulldown resistor | Used for the enable line of U200. |
| JP200 | 1 | Pin header 02x04 | THT 2.54mm 02x04 | Level shifter external voltage selector. | Place a generic pin header here, use a pin shunt to select the voltage. |

If not using the level shifter, short the leads of the footprint of U200 as
shown on the PCB silkscreen.

### If you need the crowbar glitching circuit

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| Q300 | 1 | IRF7807/Si4850BDY/Si3463BDY | SOIC-8 3.9x4.9mm | N-channel Power MOSFET, SO-8 | Slower but higher-duty (current-wise) crowbar MOSFET. Need not be placed if Q301 is present. |
| Q301 | 1 | IRLML2502/IRLML6204 | SOT-23 | N-channel MOSFET, SOT-23 | Faster but more fragile crowbar MOSFET. Need not be placed if Q300 is present. |
| R300 | 1 | 50 Ohm | 0805/1206/2010/2512 | Current limiting resistor | Current limit resistor through which power is optionally supplied to the target. Several footprints work. Use eg. ESR10EZPF49R9. |
| JP300 | 1 | Pin header 02x04 | THT 2.43mm 02x04 | Generic pin header | Crowbar power supply, place generic pin header and use a pin shunt. Can be left open if target is self-powered. |

Note, Q300 and Q301 are selected by separate GPIO lines on the Pico.

### If you need the SPDT switch glitching circuit

| Ref  | Quantity | Product        | Footprint   | Description | Notes |
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
| U400 | 1 | MAX4619CSE+ | SOIC-8 3.9x4.9mm | Triple analog SPDT switch | Fast SPDT switch IC, used for glitching (selecting between high and low voltage levels). |
| R400 | 1 |  22k | 0805 | Generic resistor | Pullup/pulldown resistors for the enable line of U400. Can be used instead of D400, but this one has preference. |
| D400 | 1 | 1N4001 | SOD-123 | Generic or Schottky diode | Pulldown diode for the INHIBIT line of U400. Can be used instead of R400, but prefer using R400. |
| R401 | 1 | 220k | 0805 | Generic resistor | Pullup/pulldown resistors for the enable/inhibit line of U400. |
| C400 | 1 | 10 nF | 0805 | Unpolarized (MLCC) capacitor | Decoupling capacitor for U400. Optional. |