Sysclk LWLA1016/Protocol

The basic structure of the SysClk LWLA1016 protocol is similar to the Sysclk LWLA1034/Protocol. As one would expect, it looks very much like an earlier iteration of the LWLA1034 protocol. It appears to lack the specialized commands the LWLA1034 has for reading memory and capture setup/status. Most of the functionality seems to be implemented on top of basic register reads and writes, using the same commands as the LWLA1034 for those.

FPGA Configuration

As with the LWLA1034, the FPGA bitstream is loaded via bulk transfer to USB end point 4. The format seems to be exactly the same, too.

The Windows software ships four separate executables: One for running with 16 channels at up to 100 MSps, one for 8 channels at up to 200 MSps, and one for 8 channels at 250 MSps. A fourth executable runs the LWLA1016 in frequency counter mode. Each of the executables downloads its own bitstream to the FPGA.

Application Behavior

The vendor software transfers a new bitstream to the FPGA

1. on application start,
2. ... (TODO).

Selecting specific device configurations may require downloading other bitstream variants to the device. TODO: Make sure all modes are covered.

Firmware Extraction

The FPGA bitstreams are stored in RBF (Raw Binary File) format, as with the LWLA1034. The bitstreams can be extracted from various DLLs installed with the Windows software (an extraction tool will be provided until we get permission to distribute the firmware). Unfortunately, unlike with the LWLA1034, the LWLA1016 firmware cannot be easily extracted from the installer executable without installing the software first.

There are six different FPGA bitstreams for the various LA modes: 3 frequency modes times 2 compression modes. In the vendor's terminology, "Timing-State" is the mode with compression enabled and "Normal" is the mode without compression.

Control Commands

As with the LWLA1034, control commands are sent via bulk transfer to USB end point 2, with the response (if any) coming in from end point 6.

For the most part, the LWLA1016 protocol seems to consist of basic register read and write commands. Unlike with the LWLA1034, it looks like capture setup, capture status polling and reading from memory are implemented on top of simple register reads and writes.

Command 0001: Read Register

This command reads a 32-bit wide control register. It appears to be identical to command 1 in the LWLA1034 protocol.

Command

Fixed length of 2 words (4 bytes).

ID	Address
0001	aaaa

Response

The response has a fixed length of 2 words (4 bytes). It is the content of a 32-bit register in mixed endian (2-1-4-3) byte order.

Command 0002: Write Register

This command writes a 32-bit value to a control register. It appears to be identical to command 2 in the LWLA1034 protocol.

Command

Fixed length of 4 words (8 bytes).

ID	Address	Data
0002	aaaa	dddd-dddd

The value is encoded in mixed endian (2-1-4-3) byte order.

Command 0003: Read Memory at Address

This command reads the captured samples from the device. It works very much like command 6 in the LWLA1034 protocol.

Command

Fixed length of 5 words (10 bytes).

ID	Address	Length
0003	aaaa-aaaa	nnnn-nnnn

Both the address and the length are encoded in mixed endian (2-1-4-3) byte order.

Response

The memory is 32 bit wide, and thus the size of the response in bits is 32 times the value in the length field. The original vendor software reads chunks of 250 words @ 32 bit at a time, i.e. 1000 bytes. Note that the software always starts reading at address 2 rather than 0.

Compression Scheme

In timing-state mode a very simple form of run-length encoding is used. Each 32-bit unit of memory holds 2 Little Endian values. The 16-bit word at the lower address is the repeat count for the channel state encoded in the subsequent 16-bit word.

Command 0005: Write ???

This command appears to have the same format and function as command 5 sent by the original LWLA1034 firmware. That means we can probably ignore it, just as with the LWLA1034.

Command

Fixed length of 33 words (66 bytes).

Control Registers

The device exposes a number of 32-bit wide registers accessed via commands 1 and 2. Some of the register addresses appearing in the protocol also occur in the LWLA1034 protocol, although it seems that their purpose may not be the same. Other registers appear to be specific to the LWLA1016.

Address	Name	Description
1000	SAMPLE_MASK	Bit mask of enabled channels.
1010	MS	Elapsed time in milliseconds.
1070	ASRAM_WR_PTR
1074	ASRAM_RD_PTR
1078	ASRAM_DATA
107C	ASRAM_CTR
10B0	ST_CNTR
10B4	ST_TOTAL_CNTR1 ST_TRG_SEL
10B8	ST_CTL
10BC	ST_TOTAL_CNTR0 ST_DIV_CNTR ST_PORT_VAL

Task Recipes

This section lists the commands issued by the software to perform a particular task.

Initialization

1. Acquire control of USB device and select configuration 1
2. Send FPGA bitstream to EP 4 via bulk transfer
3. Initial register activity:
   1. Read register 0x10B4, expected reply is 0x12345678
   2. Read register 0x10B4 (again), expected reply is 0x12345678
   3. Send command 5, which seems to have the same format and payload as with the LWLA1034

Device State Polling

1. Read register 0x10B8, reply is 0x10 in timing-state mode, or 0 in normal mode
2. Read register 0x10B0, reply is 0
3. Read register 0x1070, reply is 0
4. Read register 0x10BC, reply is 0x1234xxxx, where "xxxx" is the channel state
5. Read register 0x1010, reply is 0