Hardware kit with neat software to sniff QC/PD [negotiation] protocols?

[ia]

TL;DR:

What is the lowest budget & easy-to-use solution to capture dumps of low-level packets with QC/PD protocol frames over USB-C?

Is my understanding correct that [even on crowdsupply] there is no ready-to-use off-the-shelf device which I can order online, get it, connect three USB-C cables in it (source, sink, PC) without worry for 25+ V / 3+ A sparkles & magic smoke around, run [some neat] software and start to capture frames & their decoding right away?

---

Hello. To be honest, I think it's even a bit strange that there is no such information widely available in the documentation nor in the discussions. But even my online search skills are failing me on that a bit as well.

So, let's say I'm getting more & more curious to dig deeper into those power protocols for:

• helping IronOS with improving its power management for some power supplies (at least just by providing samples of dumps);
• gaining & using the similar techniques to debug & research other devices;
• just educating myself with basic info on power protocols on practice.

Where should I start?

• twinkie is not an option since it looks like some Google's internal hardware tool;
• twonkie demands a lot of additional effort: you have to get PCB & BOM separately, and then [micro]solder it yourself;
• in the context of USB-PD I see a lot of mentions of FUSB302 but as far as I understand it's just an IC supporting power protocols on hardware level but there is no any widely available hardware research tools based on that IC.

From software point of view, there is a USB-PD protocol decoder for sigrok. But what hardware would you recommend? Off-the-shelf preferably.

Then I came up with the similar idea like here:

• get some logic analyzer;
• get a pair of USB-C breakout boards;
• hook up the analyzer's probes for data/CC lines & multimeter for VCC/GND (not to fry the analyzer since there may be high voltage & a lot of amps).

But is this approach "work-able"? If so, what analyzer you would recommend? What minimal sample rate must be supported by analyzer? Does it have to be one of those original 100+ MHz sample rate devices or a cheap 24 MHz fx2lafw-based piece will do its job?

Also, thanks to this comment I discovered for myself a whole set of devices made by PowerZ, such as KM002 & KM003[C]. At first they look useful and just what I look for, but according to some reviews (since it's fully proprietary completely closed hardware, firmware & software) even getting GUI software may be a problem - I saw some comments where people have to write to corporate email to get zip with software because they just couldn't find/download it in any other way freely available online. Such level of support raises a lot of questions for future maintenance of devices by the manufacturer and make the cost too pricey for such level of support in my opinion.

However, what I would like to have is something like KM00C probably, BUT without a screen so just a box with cables (which in its turn should have less price) and reliable support by FOSS software community like sigrok or some similar project. Is such hardware solution / device out there?

So, bottom line is:

• what is your setup to debug power over QC/PD?
• hardware/software tools & projects?
• really good getting started guides into all of that?

Oh, and about the latter... just before posting this, I decided to check online search again just in case, so it seems I trained it by now, because I got in the results this super interesting set of articles including how to use the mentioned above FUSB302 IC with MicroPython supported board. But once again, it demands getting some additional pieces of hardware (i.e., more than just one unit). Also, just to save the effort & time for responders - I understand that additional good source of knowledge on the topic is Pinecil-related source code - the article above also has a reference to very interesting piece of information, and sources of Ralim's usb-pd obviously.

However, if you're aware of really good materials / write-ups / videos (especially interesting presentations from DefCon / ChaosCommunicationCongress / etc. about USB-C / USB-PD), please, share them in the comments.

I guess that just like with any other hardware tools for such things, we need some more time. I mean, at first, it was almost a luxury to debug JTAG at home. But then BusPirate/HydraBus & others came to the scene. The same did happen with SDR - what would cost kilotons of money a couple of decades ago, now is relatively affordable thanks to HackRF/BladeRF/LimeSDR projects. It seems that it's just a matter of time when we start to have really awesome hardware tools to tinker with power over USB-C in plug&play manner. In fact, for those hardware hackers who has a bit of business spirit, it could be a good opportunity to start & run such kind of open hardware project. NOT A BUSINESS ADVICE though :)

As always, thank the community for any advice in advance.

[Ralim]

I don't know of any good & cheap solution here.

I use:

• Cypress PD capture unit
• KM002C (software is just download on their site, nfi what reviews are on about. But its windows only. Support has been great for me).
• Saleae Logic with the decoder (Dont use this anymore as the low voltage signal is really on the edge for it, need to make an amplifier board some day)

All three have different bugs and quirks.

I did look into designing one and making it, (even made draft PCB's) but just didnt have time to get any firmware rolling really for it and so it was shelved for some rainy day in the future.

At this point its mostly the KM002C with windows in a VM for debugging smaller issues.
I plan to make up a Twonkie in the future, with a tweak to get rid of that micro-usb connector

The FUSB302 can be used as a decoder so long as the messages for EPR are chunked (which they will be for Pinecil at least).

In terms of understanding, I've mostly relied upon reading the specifications and whatever google turns up that day.
I also have an array of chargers here to help figure out if its a charger quirk or not.

USB-PD is only around 300kHz iirc, so you can probably make one of the cheaper capture units work with sigrok. You will need to amplify it up to 3.3V. This would probably be the path I'd look into first. If I had any spare time I'd make an interceptor board with amp + fx2 on it. Just dont have time at the moment.

QC is purely analog on the USB data pins in the 0-3.3V range, and its masssssively slower, basically anything > 10Hz is good here.

I hope I hit the main points, lmk if questions.

[ia]

First of all, sorry that I didn't respond anything right away after your reply. But I really have to tell you a BIG THANK YOU for sharing your experience & all of these very interesting pieces of information which wasn't so easy to find by myself. 🤝

Second, the fact that you have plans to make your own device means that it should be done since it tells a lot about existed solutions :)
Speaking of which - could you recommend KM002C/KM003C after all? Do you find it useful to have it in your toolbox based on your experience?

Third, while I was waiting a reply, I made a little setup of cheap logic analyzer connected to CC pin between two connected USB-C connector breakout boards working like a cable: the concept seems to be working but I have a couple of questions about captured samples.

These are two samples from one "recorded" "power on" session (during this session there were other samples but they were either junk or looked more like the second one):

• this one looks like device ID negotiation (right?):
  
• and this one looks like power capabilities negotiation but due to 0x0bad0bad CRC control check sum and unrealistic power numbers obviously something is wrong here:
  

The session has been recorded while powering on TS80P from Xiaomi Mi 65W Fast Charger with GaN Tech AD65GEU (I also tried Noname Travel Charger QC09 but got signals with noise only).

So, my questions are:

• Is the first sample some ID negotiation? Does it look valid to you?
• Why the second one may have bad checksum? Is it because of charger? Or do I have tune logic analyzer / get better one (as far as I understand more expensive ones are not just give more sample rate but implement filters reducing noise on the line which may be the issue capturing signals even on slow sample rate)?
• Any recommendations to improve the quality of signals while capturing (to reduce noise factor & avoid junk / corrupted frames)?

Sorry to bother you with that but I will be much appreciated for any information as always.

[Ralim]

Speaking of which - could you recommend KM002C/KM003C after all? Do you find it useful to have it in your toolbox based on your experience?

Its generally my go-to solution at the moment, due to running the thin windows VM being easier than figuring out why sigrok <-> Saleae broke yet again 😓

Is the first sample some ID negotiation? Does it look valid to you?

I haven't read the spec for ages, but that could be the cable identification request. If sigrok isn't marking the CRC as bad; its probably valid :D

Why the second one may have bad checksum?

This is what I get if I dont amplify the signal up to be a higher voltage so that it correctly gets decoded by the logic analyser. Most likely just need an op-amp/comparitor to convert the ~1.2 (or is it 1.8, cant recall) signal up to 3.3V levels

Any recommendations to improve the quality of signals while capturing

See above

[Ralim]

I've been thinking of making a board that is just one of the Cypress FX ic's + pre-amp to make said amplification easier. Maybe I should just make it 😓