Dragonzap

Introduction

Dragonzap is a PCB for voltage glitching. It provides both a SPDT switch for quickly switching between a high and a low voltage (controlled by a DAC), and a MOSFET circuit for crowbar glitching. GPIOs to interact with the DUT can go through a level shifter. An optional header can be used to connect to the analog part of a PicoEMP, using this board as controller.

The PCB is about 9.2 cm by 5.4 cm in size.

Images

Front

Back

3D view, with components

Notes

External module and footprint sources:

• https://github.com/ncarandini/KiCad-RP-Pico (Pico)
• https://github.com/lethalbit/aki-eda (Samtec FTSH SWD debug connector)
• https://git.lain.faith/sys64738/pcbs/src/branch/main/chip-bo (4x2 jumper, Xenia silkscreen image)

Usage

Firmware of the Pico controller is still TODO. Most of the documentation can be found on the PCB silkscreen.

Pico pinout

Name	Pico pin	Usage
DUT GPIO	GP0..GP7	Generic GPIO to the target DUT, goes through level shifter U200 and out to J200. GP0 and GP1 are also connected to JP100 for UART.
RV50x	ADC0, ADC1	Potentiometers that can be used for manual parameter tweaking.
DACVCC/2	ADC2	Can be used to calculate the maximum voltage the DAC can reach, for calibration.
TRIG IN	GP10	DUT trigger input
GLITCH SIG/HVP	GP11	DUT glitch (voltage supply) control, can also be used as PicoEMP HVP signal.
CB1 (Q300)	GP12	Crowbar gate 1
CB2 (Q301)	GP13	Crowbar gate 2
PWM	GP14	PicoEMP PWM signal
CHG	GP15	PicoEMP CHG signal
DAC nLATCH	GP17	nLATCH signal of the DAC (U401).
DAC CLK	GP18	SPI clock signal of U401.
DAC TX	GP19	SPI controller-to-device data signal of U401.

BOM

Base components

Ref	Quantity	Product	Footprint	Description	Notes
U100	1	Raspberry Pico	Pico module	Raspberry Pico module/board	This one serves as the glitch controller. Very important.
C100	1	47 uF	THT Radial P2.00mm	Electrolytic capacitor	Extra decoupling capacitor for the Pico.
J200	1	Pin header 01x08	THT 2.54mm 01x08	Generic pin header	Main GPIO to DUT connector, goes through level shifter U200.
J201, J202, J205	3	Pin header 01x01	THT 2.54mm 01x01	Generic pin header	Main glitching to DUT connectors (pin headers).
J203, J204, J206	3	Amphenol 132289	SMA edge-mount connector	SMA connector	Main glitching to DUT connectors (SMA connectors). Has many other compatible connectors.

Optional connectors

Ref	Quantity	Product	Footprint	Description	Notes
J207	1	Pin header 02x05	THT 2.54mm 02x05	Generic pin header	Power out (and extra external voltage in) connector.
D100	1	1N4001	SOD-123	Generic or Schottky diode.	Reset diode for external reset signal (SWD).
J100	1	Pin header 01x04	THT 2.54mm 01x04	Generic pin header	UART connector (nonstandard, 2.54mm jumper)
J101	1	Pin header 01x05	THT 2.54mm 01x05	Generic pin header	SWD connector (nonstandard, 2.54mm jumper)
J102	1	FTSH-105-01-L-DV-007-K	THT 1.27mm 02x05 -OR- FTSH-105 SMD	Cortex debug connector	SWD connector (standard FTSH connector, 1.27mm pitch, either through-hole or surface-mount)
J208	1	Pin header 02x03	THT 2.54mm 02x03	Generic pin header	Connector to PicoEMP high-voltage front-end.

Manual control potentiometers

Ref	Quantity	Product	Footprint	Description	Notes
RV500, RV501	2	Bourns 3386F/P/U and clones, eg. Suntan TSR-3386	THT 2.54mm 1x3	Potentiometer.	Used for optional manual control of parameters.

If you need the "emergency reset button"

Ref	Quantity	Product	Footprint	Description	Notes
SW1	1	Push button	THT 4-lead 6x6mm	Two-by-two push button switch, generic	Make sure the bends in the pushbutton leads are parallell with the lines on the silkscreen.
R1	1	220k	0805	Resistor	Pullup/pulldown resistors.
D101	1	1N4001	SOD-123	Generic or Schottky diode.	Reset diode to pull down the Pico's 3V3_EN line (which can be at an indeterminate voltage).

The emergency reset button will stop U100, and disable most other ICs (eg. U400, U200).

If you need the DAC

The DAC can be used for the level shifter, crowbar glitcher and SPDT glitcher (selected using JP200, JP300 and JP500).

Ref	Quantity	Product	Footprint	Description	Notes
U401	1	MCP48x2/MCP49x2	SOIC-8 3.9x4.9 (U401a) OR MSOP-8 3x3mm P0.65mm (U401b) OR TSSOP-14 P0.65mm (U401c)	2-channel 8-bit DAC, SPI interface.	DAC, optional. If not placed, you probably want to short JP500, and short the two leads as indicated on the silkscreen. SOIC and MSOP both work, MCP4812 or MCP4822 can be used, too. The MCP49x2 series can also be used, but only for the U401c footprint, in TSSOP package only.
C401	1	10 nF	0805	Unpolarized (MLCC) capacitor	Decoupling capacitor for U401. Optional.

If you need the level shifter

Ref	Quantity	Product	Footprint	Description	Notes
U200	1	TXS0108EPW OR NXS0108PW OR NTS0308EPWJ OR MAX3001EAUP+	TSSOP-20 4.4x6.5mm P0.65mm	Bidirectional level-shifting voltage translator	The level shifter. Source from TI, Nexperia, NXP or Maxim. LSF-style level shifters cannot be used.
R200	1	47k	0805	Pulldown resistor	Used for the enable line of U200.
JP200	1	Pin header 02x04	THT 2.54mm 02x04	Level shifter external voltage selector.	Place a generic pin header here, use a pin shunt to select the voltage.

If not using the level shifter, short the leads of the footprint of U200 as shown on the PCB silkscreen.

If you need the crowbar glitching circuit

Ref	Quantity	Product	Footprint	Description	Notes
Q300	1	IRF7807/Si4850BDY/Si3463BDY	SOIC-8 3.9x4.9mm	N-channel Power MOSFET, SO-8	Slower but higher-duty (current-wise) crowbar MOSFET. Need not be placed if Q301 is present.
Q301	1	IRLML2502/IRLML6204	SOT-23	N-channel MOSFET, SOT-23	Faster but more fragile crowbar MOSFET. Need not be placed if Q300 is present.
R300	1	50 Ohm	0805/1206/2010/2512	Current limiting resistor	Current limit resistor through which power is optionally supplied to the target. Several footprints work. Use eg. ESR10EZPF49R9.
JP300	1	Pin header 02x04	THT 2.43mm 02x04	Generic pin header	Crowbar power supply, place generic pin header and use a pin shunt. Can be left open if target is self-powered.

Note, Q300 and Q301 are selected by separate GPIO lines on the Pico.

If you need the SPDT switch glitching circuit

Ref	Quantity	Product	Footprint	Description	Notes
U400	1	MAX4619CSE+	SOIC-8 3.9x4.9mm	Triple analog SPDT switch	Fast SPDT switch IC, used for glitching (selecting between high and low voltage levels).
R400	1	22k	0805	Generic resistor	Pullup/pulldown resistors for the enable line of U400. Can be used instead of D400, but this one has preference.
D400	1	1N4001	SOD-123	Generic or Schottky diode	Pulldown diode for the INHIBIT line of U400. Can be used instead of R400, but prefer using R400.
R401	1	220k	0805	Generic resistor	Pullup/pulldown resistors for the enable/inhibit line of U400.
C400	1	10 nF	0805	Unpolarized (MLCC) capacitor	Decoupling capacitor for U400. Optional.