Those annoying nonportable USB devices...

I own a Mac Powerbook G3 Lombard, which forsakes the decades-old async serial port for a couple of shiny new USB ports. Mostly I think this is a good thing (which is why I bought a Lombard instead of a Wallstreet), but there are plenty of peripherals out there that still want a serial port (like PalmPilots). So I bought a Keyspan USB-to-DB9-serial adaptor dongle.

Much to my annoyance, this dongle doesn't implement any sort of standard USB serial profile; it requires a driver to initialize it and presumably to speak some special protocol to it. Keyspan didn't include a Linux driver, the bastards, and since my Powerbook runs Linux with only brief adventures into MacOS, the dongle has been sitting in a box getting dusty.

Hey, wait! This thing is programmable!

A little while ago, however, I became curious about the contents of the dongle. Not for any particular reason; I simply succumbed to the hacker's desire to take things apart and see how they work. Well, when I popped the plastic case, what to my startled eyes should appear but an Anchor Chips AN2131SC and a TI 75LV4737A! A few minutes with an ohmmeter and I'd traced out all the interesting connections (see below).

Basically, the Keyspan USB adaptor is a general-purpose reprogrammable USB-enabled 8051-compatible microcontroller, plus a level shifter for RS232 use. The other ICs on the board are a transient suppressor for the USB port, and a 16-byte EEPROM to store Keyspan's USB vendor/product/serial numbers. The 8051 has 8K of RAM and runs at 24 MHz.

It's called "repurposing"

Of course, if I'd actually been paying attention to the linux-usb mailing list (instead of procmailing it all into a file I never read), I'd have known this earlier, and also that Brian Warner has already written custom firmware for the dongle to talk to the Linux kernel. But what I'm interested in is not using this as a serial adaptor, but as using it as a relatively cheap ($40) USB experimentation platform.

The design of the adaptor is very straightforward. The USB lines come in, go past a SN75240 transient suppressor, and connect to the EZ-USB chip. The RS232 lines go through the RS232 driver/receiver and connect to UART and general-purpose IO pins on the EZ-USB chip. The boot EEPROM is attached to SCL and SDA, as you would expect. For extra hackability, the spare I/O pins (most of port B) are brought out to extra solder pads on the board. Attaching extra circuitry to these should be trivial, but remember they use 3.3v logic levels.

EZUSB signalAN2131 pin75LV4737 pinsDB-9 pinRS232 signal
PC0/RxD014Rcvr 12RXD
PC1/TxD015Driver 13TXD
PC216Driver 27RTS
PC317Rcvr 28CTS
PC418Rcvr 36DSR
PC519Rcvr 59RI
PC620Rcvr 41CD
PC721Driver 34DTR
PB125!EN or STBY-
Vss-5GND

IMHO, the fact that this dongle can probably be made into a simple and effective USB prototyping platform is really cool, and I want to get this information out here where it might do someone some good.

Windows™

I don't know anything about MS-Windows, but Aaron Jones sent me this information about loading EZ-USB firmware under Windows.

Enough talk, let's see some blinking lights!

It took me a few days to get all the build tools set up on my machine, but I finally put together a tiny demo. Download blinkeyspan-r2.tar.gz for SDCC-2.3.x, or blinkeyspan-r1.tar.gz for SDCC-2.2.x. (Thanks to Gregg Levine for sending me copies of these after I lost my own!)

To try this you'll need an EZ-USB downloader such as ezdownload (part of the ezload utility). This works on BSD and Linux; you might have to hack on it a little since the userland USB interface is still changing. If you want to make changes, you'll also need the sdcc compiler.

All the demo does is cause some of the pins on the DB9 connector to toggle at 1.9 Hz. You can hook up an LED and a 2.2 kΩ resistor (conveniently, RS232 swings both ways, so you don't need to worry about which way you connect the LED). It should be perfectly safe to run this demo on your dongle, but don't sue me if it breaks something or voids your warranty.

Other models

After loooking at my serial adapter, I became curious about the insides of other models. It turns out that some of Keyspan's serial adapters are substantially different from others. Here's a list of what I've found. Let me know if you have any other information.
ModelDescription
USA-19 This is the "PDA adaptor" I pulled apart and described, above. It has one DB9 port and is in a translucent case. It's probably the most hackable model (because it has a few unused pins) and also the cheapest.
USA-28 This is the two-port adaptor in the opaque case. It's basically similar to what I've described, except:
  • it has what appears to be a 1.8432 MHz oscillator connected to pin 24
  • it has two SN75LBC776s instead of the SN75LV4737A
  • it doesn't have any spare I/O pins conveniently brought out to solder pads.
However, it should be just as easy to download custom firmware to the two-port adaptor as to the one-port version. The '776 is designed for Apple's "GeoPort" serial ports (RS-422 / RS-433) instead of RS-232, but it's basically similar to the '4737.
USA-19Q Appears to be a 1-port version of the USA-28, except that it uses an ADM213E for the level shifter.
USA-28X This is the two-port adaptor in the translucent case. It's substantially different from the USA-28! It contains an AN2136SC instead of a '2131, and instead of using the on-chip UART it has two OX16C950s, one per port. It also has only a single oscillator (12MHz again), the two expected 75'776s, etc.

The 16'950 seems like a nice chip for serial comms — 15 Mbps, IrDA, 128-byte fifo, blah, blah — but this means you can't easily use this model as a general parallel I/O device just by bypassing the on-chip UART.

USA-19W Keyspan is also advertising a one-port serial adaptor in a black case which has different capabilities from the USA-19. Like the -28X, this also contains a separate Oxford UART chip. This gives it a higher speed (230kbps instead of 57.6kbps) but again makes it less useful for generic I/O. (Thanks to Stephen Malinowski for this info.)
USA-19QW Keyspan's web site mentions this as a follow-on to the -19W. According to Stuart Northfield this contains an AN2136SC, a 16C950, and an ADM213E — it's a combination of the -19Q and the -19W, reasonably enough.
USA-19HS Brian Onn reports that the -19HS contains, not an Anchor/Cypress chip, but a TI TUSB3410. This is like the AN21xx family in that it's an 8052 core with a USB interface, but it's not compatible with the others. The USA-19HS contains:
  • TUSB3410 USB-to-Serial Port Controller
  • a single 12 MHz crystal
  • an I2C serial EEPROM from Microchip
  • a MAX3243C RS232 receiver/driver level shifter
The TUSB3410 can load its USB descriptors and device firmware from the attached EEPROM, but it can also have firmware downloaded from the host, like the AN21xx. However, the protocol is different so different downloaders (and firmware) need to be used for the USA-19HS.

The -19Q and -19QW both contain an LED connected to a spare pin on the microcontroller. It should be easy to modify the blinkeyspan demo to blink this light instead (just change the port and bitmask in timer0_isr()).

Here are the connections to the '2131 and the level shifter in the USA-19Q. (Thanks to Ray Gannon for all of the information on the -19Q.)
EZUSB signalAN2131 pinADM213E pinsDB-9 pin / RS232 signal
or other function
PC0/RxD014Rcvr 52RXD
PC1/TxD015Driver 13TXD
PC216Driver 27RTS
PC317Rcvr 18CTS
PC418Rcvr 36DSR
PC519Rcvr 49RI
PC620Rcvr 21CD
PC721Driver 34DTR
Vss-5GND
PA540Driver 4LED cathode
PB024 1.8432 MHz osc. input
PB125!SHDN-
PB226 1.8432 MHz osc. enable
PB731EN-



Page created: 21 November, 2000. Page last updated: 12 April, 2011.
Wim Lewis <wiml@hhhh.org> (My home page)