Hardware fixes for common issues found in MSP-FET430UIF clone programmers.
MSP-FET430UIF Clone Board:
MSP-FET430UIF TI Official Board:
If you work with classic MSP430 devices over 4-wire JTAG especially F1xx, F2xx, and F4xx families you might be tempted to buy a cheap MSP-FET430UIF clone instead of the official MSP-FET. Before you click “Buy Now,” here is a reality check: Many clone units cut serious corners. My unit came from an international Amazon seller and lacks several critical features.
Below are the major problems and how to fix them:
1. Fuse blowing (JTAG security lockout) does not work:
TI’s fuse-blow procedure applies ~6.5 V to the TDI pin using a dedicated boost converter plus an analog switch/photorelay to physically isolate the MSP-FET’s MCU and inject high voltage into the target MSP430. This burns a real polyfuse inside the silicon, permanently disabling JTAG for code protection. The full procedure is documented in TI’s guide slau320.
Clones partially implement this:
- The boost converter is present but they used BCP56(Transistor) instead of BSP123(Mosset) to drive boost coil.
- But its output is connected to nothing. It senses voltage with a voltage divider via ADC2.
- The relay/photodiode switch and resistors are completely missing. We cannot connect 6.5V to target MCU directly (TDI PIN) without isolating MSP-FET’s MCU. Doing so will most likely fry it.
As a result the clone cannot blow fuses at all. For solution i added the missing circuitry and reconnect the boost line properly.
2. Target VCC output cannot be switched or measured:
On the genuine MSP-FET, VCCO to the target can be toggled and monitored via firmware. Clones tie everything directly to the LDO output, so the programmer cannot control or sense target voltage properly. For solution i rerouted VCCO, VCCI and reinstate the missing switch circuitry.
3. Target voltage cannot be adjusted
The original MSP-FET430UIF uses a TPS76601 LDO whose output voltage is dynamically set (1.8 V–5 V) via software feedback, allowing the programmer to power various MSP430 targets safely.
In my clone they replaced this with a generic fixed 3.3 V LDO. No feedback pin, no adjustability. However PCB have passive components so you can buy a TPS76601 to restore this functionality. I did not modify this section, since it’s functional but inconvenient and my MSP430F448 target works on 3.3V but for a workaround you can power your target externally using a variable PSU.
TI provides the full schematic of the official MSP-FET430UIF in slau647. Using this you can reverse-engineer the clone board identify missing components and wire them back in.
Here is %90 reverse engineered clone board:
And here is schematic to fix clone board:
Be warned: Soldering bodge wires to an MSP430F1612 (LQFP, ~1.5 mm pitch) is not for faint of heart. Check your connections for shorts and such. Before doing anything i strongly suggest backing up the firmware if you can.
I dumped mine using Travis Goodspeed’s legendary GOODFET42. You can find the backed up firmware in here. Use it only as a last resort i have not re-flashed or verified it.
After soldering bodge wires to the MCU, it is a good idea to verify each connection before sealing the pins with hot silicone. If you do not have an oscilloscope, you can quickly test the lines using a few LEDs in series with 270-ohm resistors. Connect a target device to the JTAG port, issue the fuse-blow command, and watch the LEDs. There is no risk in doing this because VF is not yet connected to the target MCU. However you cannot reprogram target MCU because "IR_PREPARE_BLOW" command is sent to it. If the wiring is correct, the LEDs will toggle briefly at the moment the high-voltage sequence begins, which confirms that the control signals are behaving as expected and you can proceed with the rest of the modifications.
If you are curious about what actually happens when you press the “blow fuse” button, here is the process as far as I understand it. The TDIOFF# line, which is normally high, is driven low to disconnect the JTAG TDI pin from the MSP-FET430UIF’s internal MCU so it will not be exposed to the upcoming 6.5-volt pulse. The programmer’s MCU then drives the MOSFET with a PWM-like signal to energize the inductor and generate the boosted voltage. Once the VF high-voltage node reaches the required threshold (around 6.5 volts), the MCU checks this level through ADC2 and activates the VF2TDI control line. This connects the boosted voltage to the target MCU’s TDI pin through the optoswitch, blowing the internal security fuse. After roughly 10 milliseconds, VF2TDI returns low, and about 2.6 microseconds later TDIOFF# goes high again, restoring normal JTAG operation. The scope capture and schematic below illustrate this sequence in detail:
Here is the modded programmer:
And here is a screenshot of blown fuse:
If you’re reading this, you probably already bought the clone. But as a public service, if the listing looks like below it’s probably missing half the critical analog circuitry:
The picture looks fine but they ship you clone one so be warned.
Funnily enough mine shipped with a CD full of AVR tools instead of MSP430 tools. This tells me that the manufacturer copy-pasted the TI schematic, removed whatever looked “unnecessary” and pushed it to market without understanding how JTAG fuse-blowing or target-power management even works.
Surprisingly both the MSP430F1612 and TUSB3410 on my clone appear genuine and work perfectly.
– My clone originally came with firmware 2.04.08.002. I successfully updated it to 3.02.01.009 using FET-Pro430.
– After above modifications, the programmer works correctly with (Fuse-blowing functionality and Target-voltage toggling):
-
TI offical programs.
TODO:
- This is a quick and dirty way to fix a cheap clone, maybe in future i will design an FPC interposer for easy soldering.