ChipCon SmartRF04 EB firmware reflashing

A while ago I picked up a CC1110 from eBay for cheap as we were looking at doing an IM-ME clone, Eventually got around back to the C11xx work.

ChipCon were bought by TI in about 2006, for the CC family, see the clue? the devboard I have is actually from the pre TI days, so I was amazed when in 2016 I downloaded the TI Smart RF software it connected and saw the board. The two dev boards also actually worked so lucked out on eBay again…

On plugging in it asked to update the firmware, which I did. . After that I could use Smart RF to control the board, but not from the board itself, no LCD display. So I went off and looked for old versions of Smart RF and older HEX files, no luck , OEMs always want to get rid of that stuff, they should make it all available but it is a support headache from the help vampyres, and TI’s forums had a few similar questions that mostly dead ended.

So I looked into the host chip, it’s a SI 8051F32, so needs a yet another debugger interface, I looked it up and see its USB Debug Adapter for about $30, not bad. It has an unusual shape and I recall having one, so I went and dug around and found it in a box, I actually had took it out of a box, looking through various devboards, looked at my hand and there it was, great…

So downloaded SI’s production programmer, still works, doesn’t read back only verify and program.. (is the verify download and compare, checksum or compare on chip) saw eclipse mentioned/java and went back to look for a different programming tool, SI have a utility dll from programming, read docs same deal only a memory downloader, check the memory map 0x0 – 0x3FFF with after 0x3DFF reserved.  Once I connect the USB Debug Adapter to the new software it want’s to update the firmware, here we go again, flashes and its OK after a USB reset.

Connected to the board, downloaded it to a “log file” which is literally a dump of the memory in either dec(with leading zeros)  or hex, and a cr\lf… quick sed script add commas to the dec, load it into an array, oh yeah, leading 0’s so it thinks its base 8 octal. redo it in hex output, add 0x, and end with , read it into an array write it out.

convert the newer TI supplied hex that didn’t work files to bin from the new 40 version, compare the two against the one I just read. they’re similar at the start, but it is shifted..  I realise the bootloader is there as as a separate hex, it’s loaded from 0x0 – 0x0800, so I chop that off and wrote out the file. they are now only slight differences, 0xFF where 0x00 is in the hex, this is likely a skip in the hex (unlikely since the hex file showed a single section) or the default erase byte .

Had I been watching the hex2bin output I’d have seen the start address of the firmware as 0x800, so at least independently verified, had too many windows open..

Lowest address  = 00000800
Highest address = 00003BDB
Pad Byte        = 0
8-bit Checksum = BE

So now all have to do is reflash the board with the code from the second board that I did not upgrade, so convert the .bin to .hex, either without the bootloader and reflash it with the TI tools, or clone one to the other and reflash with SI adapter.

Reflashed the whole thing in the end, which reverted it to 28 build.. Still no display when the EM is connected….so either flash on the EM module (which still works in Smart RF) mode or  theres something wrong with the EM module…


and yes reflashed the cc1110 and its back to life!  Probably should have tried that first Smile


SI USB chip docs

SI flash util


SmartRF flash programmer to redo the CC1110