Openbench Logic Sniffer

File:Open workbench logic sniffer.jpg

OpenBench Logic Sniffer

The OpenBench Logic Sniffer (OLS) is an FPGA-based logic analyzer, supporting 32 probes for probing up to 100MHz signals and advanced trigger functionality. It is a fully open source device — the circuit design, VHDL code for the FPGA, firmware for the PIC microcontroller and Java-based client software are all freely available. The project is a collaboration between Gadget Factory and Dangerous Prototypes.

The device started life as the Sump Logic Analyzer, which was meant to be run on a Digilent FPGA development board. The OpenBench Logic Analyzer unit is a custom-designed board, with the software parts of the Sump project mostly unchanged. The board was designed with low cost in mind: it can be bought for $45 from Seeed Studio.

Communication between the board and the PC is done via a serial port, running at 115200 bps. The communications protocol between the board and the PC is below, taken from the original Sump documentation.

Driver status

The sigrok driver does not currently support the trigger "serial" mode. This allows a single trigger to be set (on one or more probes), but with up to 32 stages. The parallel mode is supported, which supports up to 4 distinct trigger stages on any probe.

Using an external clock is not yet supported. Also the 200MHz mode will not work right now, since the driver always expects 32-bit sample values.

The RLE flag is in there, but is never set. So there is no compression for now. This needs to depend on which version of the FPGA software is detected; the original Sump didn't have RLE.

Also the whole code is untested so far.

Communications Protocol

All communication is done using a standard RS232 connection with 8 data bits, 1 stop bit and no parity. The transfer rate can be set to 115200, 57600, 38400 or 19200 bps. XON/XOFF software flow control is available.

When sending captured data the analyzer will send blocks of four bytes, the first containing the lowest channels. No start or end sequence exists. The host can assume an end of transmission if no data has been received for the duration of one byte.

The protocol used by hardware version 0.5 and older is not covered here. Hardware 0.6 uses protocol version 0, and hardware 0.7 uses protocol version 1. Unless otherwise stated, commands exist in both versions.

The following list provides a short overview of commands understood by the analyzer.

Short Commands

These commands are exactly one byte long.

Reset (00h)

Resets the device. Should be sent 5 times when the receiver status is unknown. (It could be waiting for up to four bytes of pending long command data.)

Run (01h)

Arms the trigger.

ID (02h)

Asks for device identification. The device will respond with four bytes. The first three ("SLA") identify the device. The last one identifies the protocol version which is currently either "0" or "1"

XON (11h)

Put transmitter out of pause mode. It will continue to transmit captured data if any is pending. This command is being used for xon/xoff flow control.

XOFF (13h)

Put transmitter in pause mode. It will stop transmitting captured data. This command is being used for xon/xoff flow control.

Long Commands

Are five bytes long. The first byte contains the opcode. The bytes are displayed in the order in which they are sent to the serial port starting left. The bits within one byte are displayed most significant first.

Set Trigger Mask (C0h, C4h, C8h, CCh)

Defines which trigger values must match. In parallel mode each bit represents one channel, in serial mode each bit represents one of the last 32 samples of the selected channel. The opcodes refer to stage 0-3 in the order given above. (Protocol version 0 only supports stage 0.)

Set Trigger Values (C1h, C5h, C9h, CDh)

Defines which values individual bits must have. In parallel mode each bit represents one channel, in serial mode each bit represents one of the last 32 samples of the selected channel. The opcodes refer to stage 0-3 in the order given above. (Protocol version 0 only supports stage 0.)

Set Trigger Configuration (C2h, C6h, CAh, CEh)

Configures the selected trigger stage. The opcodes refer to stage 0-3 in the order given above. The following parameters will be set:

• delay
  • If a match occures, the action of the stage is delayed by the given number of samples.
• level
  • Trigger level at which the stage becomes active.
• channel
  • Channel to be used in serial mode. (0-31 in normal operation; 0-15 when demux flag is set)
• serial
  • When set to 1 the stage operates as serial trigger, otherwise it used as parallel trigger.
• start
  • When set to 1 a match will start the capturing process. The trigger level will rise on match regardless of this flag. (Command available as of protocol version 1.)

Set Divider (80h)

When x is written, the sampling frequency is set to f = clock / (x + 1)

Set Read & Delay Count (81h)

Read Count is the number of samples (divided by four) to read back from memory and sent to the host computer. Delay Count is the number of samples (divided by four) to capture after the trigger fired. A Read Count bigger than the Delay Count means that data from before the trigger match will be read back. This data will only be valid if the device was running long enough before the trigger matched.

Set Flags (82h)

Sets the following flags:

• demux

Enables the demux input module. (Filter must be off.)

• filter

Enables the filter input module. (Demux must be off.)

• channel groups

Disable channel group. Disabled groups are excluded from data transmissions. This can be used to speed up transfers. There are four groups, each represented by one bit. Starting with the least significant bit of the channel group field channels are assigned as follows: 0-7, 8-15, 16-23, 24-31

• external

Selects the clock to be used for sampling. If set to 0, the internal clock divided by the configured divider is used, and if set to 1, the external clock will be used. Filter and demux are only available with internal clock.

• inverted

When set to 1, the external clock will be inverted before being used. The inversion causes a delay that may cause problems at very high clock rates. This option only has an effect with external set to 1.