Difference between revisions of "Saleae Logic16"
(Some notes on configuration transfers on EP1) |
|||
Line 26: | Line 26: | ||
The firmware for the FX2LP is embedded in the vendor application as a set of Intel HEX lines. Each line is uploaded individually with a separate control transfer. The firmware currently occupies the address range [0x0000-0x145d], but is uploaded out of order. <span style="color: red">TODO</span>: Make a tool to extract the firmware from the application binary. | The firmware for the FX2LP is embedded in the vendor application as a set of Intel HEX lines. Each line is uploaded individually with a separate control transfer. The firmware currently occupies the address range [0x0000-0x145d], but is uploaded out of order. <span style="color: red">TODO</span>: Make a tool to extract the firmware from the application binary. | ||
See [[Saleae Logic16/Firmware]] for more details on the vendor firmware. | |||
== Protocol == | == Protocol == |
Revision as of 10:54, 23 July 2013
The Saleae Logic16 is a USB-based, 16-channel logic analyzer with 100/50/25/12.5MHz sampling rate (at 2/4/8/16 enabled channels).
The case requires a Torx T5 screwdriver to open.
See Saleae Logic16/Info for more details (such as lsusb -vvv output) about the device.
See Saleae Logic for the predecessor product of the Saleae Logic16.
Hardware
- Xilinx XC3S200A 200K gate FPGA
- Cypress CY7C68013A-56PVXC (FX2LP) USB interface chip
Photos
Firmware
The firmware for the FX2LP is embedded in the vendor application as a set of Intel HEX lines. Each line is uploaded individually with a separate control transfer. The firmware currently occupies the address range [0x0000-0x145d], but is uploaded out of order. TODO: Make a tool to extract the firmware from the application binary.
See Saleae Logic16/Firmware for more details on the vendor firmware.
Protocol
Sample format:
The samples (as received via USB) for the enabled probes (3, 6, 9, or 16) are organized as follows:
0xLL 0xLL 0xMM 0xMM 0xNN 0xNN 0xPP 0xPP 0xQQ 0xQQ 0xRR 0xRR ...
In the above example, 3 probes are enabled. For each probe there are 2 bytes / 16 bits (e.g. 0xLL 0xLL for probe 0), then the next probe's data is received (0xMM 0xMM for probe 1), then 0xNN 0xNN for probe 2. When 2 bytes have been received for all enabled probes, the process restarts with probe 0 again.
The 16 bits of data per probe seem to contain the pin state of the respective probe (1: high, 0: low) at 16 different sampling points/times (which ones depends on the samplerate).
Configuration:
Endpoint 1 is used for configuration of the analyzer. Two kinds of transfers are used; a 3 byte out transfer starting with 0x55 followed by a 1 byte in transfer, and a 4 byte out transfer starting with 0x5a. It's quite plausible that these provide raw read/write access to memory locations.
Channel number configuration | |
---|---|
3 channels | 0x5a 0x32 0xf4 0x38 0x5a 0x32 0xef 0x1b |
6 channels | 0x5a 0x32 0xf4 0xc0 0x5a 0x32 0xef 0x1b |
9 channels | 0x5a 0x32 0xf4 0x80 0x5a 0x32 0xef 0xc8 |
Sampling frequency | |
---|---|
500 kHz | 0x5a 0x32 0x4c 0x61 0x5a 0x32 0x82 0xb0 |
8 MHz | 0x5a 0x32 0x4c 0x5e 0x5a 0x32 0x82 0x0c |