Saleae Logic16

Saleae Logic16

Status	in progress
Channels	2/4/8/16
Samplerate	100/50/25/12.5MHz
Samplerate (state)	—
Triggers	none (SW-only)
Min/max voltage	-0.9V — 6V
Threshold voltage	configurable: for 1.8V to 3.6V systems: VIH=1.4V, VIL=0.7V for 5V systems: VIH=3.6V, VIL=1.4V
Memory	none
Compression	yes
Website	saleae.com

The Saleae Logic16 is a USB-based, 16-channel logic analyzer with 100/50/25/12.5MHz sampling rate (at 2/4/8/16 enabled channels).

The case requires a Torx T5 screwdriver to open.

See Saleae Logic16/Info for more details (such as lsusb -vvv output) about the device.

See Saleae Logic for the predecessor product of the Saleae Logic16.

Hardware

• FPGA: Xilinx Spartan-3A XC3S200A, 200K gates (datasheeet)
• USB interface chip: Cypress CY7C68013A-56PVXC (FX2LP) (datasheet)
• Ultralow capacitance ESD protection: 4x ST DVIULC6-4SC6 (datasheet)
• I2C EEPROM: Marking: "B2TH". Microchip 24AA02 has markings "B2??" in SOT-23 case (datasheet)
• Voltage regulators: 2x Semtech SC189 Step Down Switching Regulator. "189Z" for 3.3V and "189C" for 1.2V. (datasheet)
• ?: 2x Unknown 3-pin IC. Markings: "72Y7".

Pinouts and connections:

JTAG header (FPGA):

The J3 pin header is a JTAG connector wired to the FPGA. The pins are (from left to right, the right-most pin, pin number 1, is square):

5	4	3	2	1
GND	TMS	TCK	TDO	TDI

Testpoints:

T1	T2	T3
1.2V	3.3V	GND (FX2)

Cypress FX2:

(FPGA 15, IO_L05P_3) PD5	1-	O	-56	PD4 (FPGA 12, IO_L04P_3)
(FPGA 13, IO_L04N_3) PD6	2-		-55	PD3 (FPGA 44, IO_L09N_2)
(FPGA 10, IO_L03N_3) PD7	3-		-54	PD2 (FPGA 5, IO_L02P_3)
GND	4-		-53	PD1 (FPGA 4, IO_L01N_3)
(FPGA 90, IO_0) CLKOUT	5-		-52	PD0 (FPGA 6, IO_L02N_3)
VCC	6-		-51	*WAKEUP (3.3V)
GND	7-		-50	VCC
(FPGA 3, IO_L01P_3) RDY0/*SLRD	8-		-49	RESET# (3.3V via D2 (diode?))
(FPGA 3, IO_L01P_3) RDY1/*SLWR	9-		-48	GND
AVCC	10-		-47	PA7 (FPGA 9, IO_L03P_3)
(24MHz crystal) XTALOUT	11-		-46	PA6 (FPGA 30, IO_L04P_2)
(24MHz crystal) XTALIN	12-		-45	PA5 (FPGA 85, IO_L03P_0)
AGND	13-		-44	PA4 (FPGA 98, IO_L06P_0)
AVCC	14-		-43	PA3 (FPGA 51, MISO)
(USB D+) DPLUS	15-		-42	PA2 (FPGA 53, CCLK)
(USB D-) DMINUS	16-		-41	PA1 (FPGA 48, INIT_B)
AGND	17-		-40	PA0 (FPGA 54, DONE)
VCC	18-		-39	VCC
GND	19-		-38	CTL2 (FPGA 100, PROG_B)
(FPGA 84, IO_L02N_0) *IFCLK	20-		-37	CTL1 (FPGA 97, IP_0)
RESERVED	21-		-36	CTL0 (FPGA 94, IO_L05N_0)
(EEPROM SCL) SCL	22-		-35	GND
(EEPROM SDA) SDA	23-		-34	VCC
VCC	24-		-33	GND
(FPGA 40, IO_L08P_2) PB0	25-		-32	PB7 (FPGA 93, IO_L05P_0)
(FPGA 78, IO_L01N_0) PB1	26-		-31	PB6 (FPGA 37, IO_L07N_2)
(FPGA 77, IO_L01P_0) PB2	27-		-30	PB5 (FPGA 41, IO_L08N_2)
(FPGA 50, IO_L11P_2) PB3	28-		-29	PB4 (FPGA 46, MOSI)

Photos

• 

  Device, front

• 

  Device, bottom

• 

  PCB, top

• 

  PCB, bottom

• 

  Xilinx XC3S200A

• 

  Cypress FX2LP

• 

  I2C EEPROM

• 

  ST DVIULC6-4SC6

• 

  Voltage regulators

• 

  72Y7

Firmware

The firmware for the FX2LP is embedded in the vendor application as a set of Intel HEX lines. Each line is uploaded individually with a separate control transfer. The firmware currently occupies the address range [0x0000-0x145d], but is uploaded out of order. TODO: Make a tool to extract the firmware from the application binary.

See Saleae Logic16/Firmware for more details on the vendor firmware.

Protocol

Sample format:

The samples (as received via USB) for the enabled probes (3, 6, 9, or 16) are organized as follows:

0xLL 0xLL  0xMM 0xMM  0xNN 0xNN   0xPP 0xPP  0xQQ 0xQQ  0xRR 0xRR ...

In the above example, 3 probes are enabled. For each probe there are 2 bytes / 16 bits (e.g. 0xLL 0xLL for probe 0), then the next probe's data is received (0xMM 0xMM for probe 1), then 0xNN 0xNN for probe 2. When 2 bytes have been received for all enabled probes, the process restarts with probe 0 again.

The 16 bits of data per probe seem to contain the pin state of the respective probe (1: high, 0: low) at 16 different sampling points/times (which ones depends on the samplerate).

Configuration:

Endpoint 1 is used for configuration of the analyzer. The transfers are "encrypted" using a simple series of additions and XORs. Two kinds of transfers are used; a 3 byte out transfer starting with 0x81 followed by a 1 byte in transfer, and a 4 byte out transfer starting with 0x80. It's quite plausible that these provide raw read/write access to memory locations.

Channel number configuration
3 channels	0x80 0x01 0x02 0x07 0x80 0x01 0x03 0x00
6 channels	0x80 0x01 0x02 0x3f 0x80 0x01 0x03 0x00
9 channels	0x80 0x01 0x02 0xff 0x80 0x01 0x03 0x01
16 channels	0x80 0x01 0x02 0xff 0x80 0x01 0x03 0xff

Sampling frequency
500 kHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0xc7
1 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x63
2 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x31
4 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x18
5 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x13
8 MHz	0x80 0x01 0x0a 0x01 0x80 0x01 0x04 0x13
10 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x09
12.5 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x07
16 MHz	0x80 0x01 0x0a 0x01 0x80 0x01 0x04 0x09
25 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x03
32 MHz	0x80 0x01 0x0a 0x01 0x80 0x01 0x04 0x04
40 MHz	0x80 0x01 0x0a 0x01 0x80 0x01 0x04 0x03
50 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x01
80 MHz	0x80 0x01 0x0a 0x01 0x80 0x01 0x04 0x01
100 MHz	0x80 0x01 0x0a 0x00 0x80 0x01 0x04 0x00

Resources

• Manual
• Vendor software
• SDKs