Sysclk LWLA1016/Protocol

The basic structure of the SysClk LWLA1016 protocol is similar to the Sysclk LWLA1034/Protocol. As one would expect, it looks very much like an earlier iteration of the LWLA1034 protocol. It appears to lack the specialized commands the LWLA1034 has for reading memory and capture setup/status. Most of the functionality seems to be implemented on top of basic register reads and writes, using the same commands as the LWLA1034 for those.

FPGA Configuration

As with the LWLA1034, the FPGA bitstream is loaded via bulk transfer to USB end point 4. The format seems to be exactly the same, too.

The Windows software ships four separate executables: One for running with 16 channels at up to 100 MSps, one for 8 channels at up to 200 MSps, and one for 8 channels at 250 MSps. A fourth executable runs the LWLA1016 in frequency counter mode. Each of the executables downloads its own bitstream to the FPGA.

Application Behavior

The vendor software transfers a new bitstream to the FPGA

1. on application start,
2. ... (TODO).

Selecting specific device configurations may require downloading other bitstream variants to the device. TODO: Make sure all modes are covered.

Firmware Extraction

The FPGA bitstreams are stored in RBF (Raw Binary File) format, as with the LWLA1034. The bitstreams can be extracted from various DLLs installed with the Windows software (an extraction tool will be provided until we get permission to distribute the firmware). Unfortunately, unlike with the LWLA1034, the LWLA1016 firmware cannot be easily extracted from the installer executable without installing the software first.

Control Commands

As with the LWLA1034, control commands are sent via bulk transfer to USB end point 2, with the response (if any) coming in from end point 6.

For the most part, the LWLA1016 protocol seems to consist of basic register read and write commands. Unlike with the LWLA1034, it looks like capture setup, capture status polling and reading from memory are implemented on top of simple register reads and writes.

Command 0001: Read Register

Apparently identical to command 1 in the LWLA1034 protocol.

Registers

Some of the register addresses appearing in the protocol also occur in the LWLA1034 protocol, although it seems that their purpose may not be the same. Other registers appear to be specific to the LWLA1016.

Address	Value	Description
1010	???
1070	???
107C	???
10B0	???
10B4	???
10B8	???
10BC	0x1234xxxx	The lower 16 bit appear to be the live channel state

Command 0002: Write Register

Apparently identical to command 2 in the LWLA1034 protocol.

Registers

Some of the register addresses appearing in the protocol also occur in the LWLA1034 protocol, although it seems that their purpose may not be the same. Other registers appear to be specific to the LWLA1016.

Address	Value
1000	???
1010	???
107C	???
10B0	???
10B4	???
10B8	???
10BC	???

Command 0003: Read ???

This command reads something from the device. It does not occur in the LWLA1034 protocol.

Command

Fixed (?) length of 4 words (8 bytes).

Response

The response to the command as sent by the vendor software consists of 8 words (16 bytes).

Command 0005: Write ???

This command appears to have the same format and function as command 5 sent by the original LWLA1034 firmware. That means we can probably ignore it, just as with the LWLA1034.

Command

Fixed length of 33 words (66 bytes).

Task Recipes

This section lists the commands issued by the software to perform a particular task.

Initialization

1. Acquire control of USB device and select configuration 1
2. Send FPGA bitstream to EP 4 via bulk transfer
3. Initial register activity:
   1. Read register 0x10B4, expected reply is 0x12345678
   2. Read register 0x10B4 (again), expected reply is 0x12345678
   3. Send command 5, which seems to have the same format and payload as with the LWLA1034
   4. Read register 0x10B8, reply is 0x10
   5. Read register 0x10B0, reply is 0
   6. Read register 0x1070, reply is 0
   7. Read register 0x10BC, reply is 0x12340000
   8. Read register 0x1010, reply is 0
   9. Read register 0x10B8, reply is 0x10
   10. ...