I2C Protocol Commands

Overview

• Bus: I2C (eye-squared-see or eye-two-see)
• Connections: two pins (SDA/SCL) and ground
• Output type: open drain/open collector
• Pull-up resistors: always required (2K - 10K ohms)
• Maximum voltage: 5volts

I2C is a common 2-wire bus for low speed interfaces, generally 100KHz, 400KHz and sometimes 1MHz.

Configuration options

Bus Pirate [/dev/ttyS0]

I2C speed
1KHz to 1000KHz
x. Exit
KHz (400KHz*) >
Data bits
1. 8*
2. 10
x. Exit
Bits (1) >
Mode: I2C
I2C>

Pull-up resistors

I2C is an open-collector bus, it requires pull-up resistors to hold the clock and data lines high and create the data '1'. I2C parts don't output high, they only pull low, without pull-up resistors there can never be a '1'. This will cause common errors such as the I2C address scanner reporting a response at every address.

Enable the Bus Pirate onboard pull-up resistors with the P command.

tip

• I2C requires pull-up resistors to hold the clock and data lines high.
• I2C parts don't output high, they only pull low.
• Without pull-up resistors there can never be a '1'.
• Enable the Bus Pirate onboard pull-up resistors with the P command.

Syntax

Command	Description
{ or [	Issue I2C start condition.
] or }	Issue I2C stop condition.
r	Read one byte, send ACK. (r:1…255 for bulk reads)
0b	Write this binary value, check ACK. Format is 0b00000000 for a byte, but partial bytes are also fine: 0b1001.
0x	Write this HEX value, check ACK. Format is 0x01. Partial bytes are fine: 0xA. A-F can be lower-case or capital letters.
0-255	Write this decimal value, check ACK. Any number not preceded by 0x or 0b is interpreted as a decimal value.
space	Value delimiter. Use a space to separate numbers. No delimiter is required between non-number values: {0xa6 0 0 16 5 0b111 0xaF rrrr}.
(#)	Run macro, (0) for macro list.

Macro

Number	Description
0	Macro menu
1	7bit address search. Find all connected devices by brute force.

I2C address search scanner macro

Bus Pirate [/dev/ttyS0]

I2C> (1)
I2C Bus Scan
0 1 2 3 4 5 6 7 8 9 A B C D E F
00 . . . . . . . . . . . . . . . .
10 . . . . . . . . . . . . . . . .
20 . . . . . . . . . . . . . . . .
30 . . . . . . . . . . . . . . . .
40 . . . . . . . . . . . . . . . .
50 . . . . . . . . . . . . . . . .
60 . . . . . . . . . . . . . . . .
70 . . . . . . . . . . . . . . . .
Done.

I2C>

You can find the I2C address for most I2C-compatible chips in the datasheet. But what if you're working with an unknown chip, a dated chip with no datasheet or you're just too lazy to look it up?

The Bus Pirate has a built-in address scanner that checks every possible I2C address for a response. This brute force method is a fast and easy way to see if any chips are responding, and to uncover undocumented access addresses.

I2C chips respond to a 7bit address, so up to 128 devices can share the same two communication wires. An additional bit of the address determines if the operation is a write to the chip (0), or a read from the chip (1).

Scanner details

Macro 1 in I2C mode runs the address scanner.

• For I2C write addresses: the BP sends a start, the write address, looks for an ACK, then sends a stop.
• For I2C read addresses: the BP sends a start, the read address, looks for an ACK. If there is an ACK, it reads a byte and NACKs it. Finally it sends a stop.

When the I2C chip responds to the read address, it outputs data and will miss a stop condition sent immediately after the read address (bus contention). If the I2C chip misses the stop condition, the address scanner will see ghost addresses until the read ends randomly. By reading a byte after any read address that ACKs, we have a chance to NACK the read and properly end the I2C transaction.

Connections

Bus Pirate	Direction	Circuit	Description
SDA	↔	SDA	Serial Data
SCL	→	SCL	Serial Clock
GND	⏚	GND	Signal Ground