Difference between revisions of "Hantek 4032L"

From sigrok
Jump to navigation Jump to search
(Finished protocol description)
(Added HW features support status)
(7 intermediate revisions by 2 users not shown)
Line 1: Line 1:
{{Infobox logic analyzer
{{Infobox logic analyzer
| image            = [[File:Hantek4032L BoxSideView.png|180px]]
| image            = [[File:Hantek 4032l mugshot.png|180px]]
| name            = Hantek 4032L
| name            = Hantek 4032L
| status          = planned
| status          = supported
| source_code_dir  =  
| source_code_dir  = hantek-4032l
| channels        = 32
| channels        = 32
| samplerate      = 400MHz
| samplerate      = 400MHz
Line 10: Line 10:
| voltages        = -6V — +60V input, -6V — +6V threshold
| voltages        = -6V — +60V input, -6V — +6V threshold
| memory          = 2Gbit (64M samples x 32)
| memory          = 2Gbit (64M samples x 32)
| compression      = -
| compression      = —
| website          = [http://www.hantek.com/english/produce_list.asp?unid=67 hantek.com]
| website          = [http://www.hantek.com/en/ProductDetail_16_14.html hantek.com]
}}
}}


The [http://www.hantek.com/english/produce_list.asp?unid=67 Hantek 4032L] is an USB-based, 32-channel logic analyzer with up to 400MHz sampling rate and 2Gbit DDR2 memory.
The [http://www.hantek.com/en/ProductDetail_16_14.html Hantek 4032L] is a USB-based, 32-channel logic analyzer with up to 400MHz sampling rate and 2Gbit DDR2 memory.


See [[Hantek_4032L/Info]] for more details about the device.
See [[Hantek 4032L/Info]] for more details (such as '''lsusb -v''' output) on the device.  


== Hardware ==
== Hardware ==
Line 26: Line 26:
* Unknown I2C EEPROM (marking removed, contains FX2 firmware)
* Unknown I2C EEPROM (marking removed, contains FX2 firmware)
* MXIC MX25L4005 (4Mbit SPI flash, marking removed, contains FPGA bitstream)
* MXIC MX25L4005 (4Mbit SPI flash, marking removed, contains FPGA bitstream)
* Unknown PWM components (marking removed, input Vref generators)
* DAC122S085CIMM (marking removed, input Vref generators)


== Photos ==
== Photos ==
'''Teardown 1''':
<gallery>
File:Hantek 4032l package.jpg|<small>Package</small>
File:Hantek 4032l package contents.jpg|<small>Package contents</small>
File:Hantek 4032l device top.jpg|<small>Device, top</small>
File:Hantek 4032l device bottom.jpg|<small>Device, bottom</small>
File:Hantek 4032l usb connector.jpg|<small>USB connector</small>
File:Hantek 4032l probe connector.jpg|<small>Probe connector</small>
File:Hantek 4032l pcb top.jpg|<small>PCB, top</small>
File:Hantek 4032l pcb bottom.jpg|<small>PCB, bottom</small>
File:Hantek 4032l xilinx xc6slx16.jpg|<small>Xilinx XC6SLX16</small>
File:Hantek 4032l cypress fx2.jpg|<small>Cypress FX2</small>
File:Hantek 4032l micron ddr2 sdram2.jpg|<small>DDR2 SDRAM</small>
File:Hantek 4032l micron ddr2 sdram1.jpg|<small>DDR2 SDRAM</small>
File:Hantek 4032l tps51116.jpg|<small>TI TPS51116</small>
File:Hantek 4032l ti tps54286.jpg|<small>TI TPS54286</small>
File:Hantek 4032l spi flash chip.jpg|<small>SPI flash</small>
File:Hantek 4032l mornsun a0512s-1wr2.jpg|<small>Mornsun A0512S-1WR2</small>
File:Hantek 4032l 50mhz crystal.jpg|<small>50MHz crystal</small>
File:Hantek 4032l unknown chips1.jpg|<small>Unknown chips</small>
File:Hantek 4032l unknown chips2.jpg|<small>Unknown chips</small>
File:Hantek 4032l unknown chips3.jpg|<small>Unknown chips</small>
</gallery>
'''Teardown 2''':


<gallery>
<gallery>
File:Hantek4032L BoxIso.png|<small>Hantek 4032L with probes</small>
File:Hantek4032L BoxSideView.png|<small>Device, top</small>
File:Hantek4032L BoxIso.png|<small>Device, with probes</small>
File:Hantek4032L BoxPortSide.png|<small>Probe port side</small>
File:Hantek4032L BoxPortSide.png|<small>Probe port side</small>
File:Hantek4032L BoxUsbSide.png|<small>PC USB port side</small>
File:Hantek4032L BoxUsbSide.png|<small>PC USB port side</small>
Line 50: Line 79:
* bRequest=0xB3, wValue=X, wIndex=X, wLength=0x0A, data={ 0x0F, 0x03, 0x03, 0x03, X, X, X, X, X, X } - restart the engine (reset FPGA, reset FIFOs)
* bRequest=0xB3, wValue=X, wIndex=X, wLength=0x0A, data={ 0x0F, 0x03, 0x03, 0x03, X, X, X, X, X, X } - restart the engine (reset FPGA, reset FIFOs)
* bRequest=0xD0, wValue=X, wIndex=X, wLength=0x00 - disable communication (set FIFO reset), not used
* bRequest=0xD0, wValue=X, wIndex=X, wLength=0x00 - disable communication (set FIFO reset), not used
* bRequest=0xD0, wValue=X, wIndex=X, wLength=0x00 - enable communication (clear FIFO reset), not used
* bRequest=0xD1, wValue=X, wIndex=X, wLength=0x00 - enable communication (clear FIFO reset), not used


=== Command/Parameters packet ===
=== Command/Parameters packet ===
Line 92: Line 121:
       0x1B - 2KS/s
       0x1B - 2KS/s
       0x1C - 1KS/s
       0x1C - 1KS/s
      0x24 - posedge CLKA
      0x25 - posedge CLKB
      0x28 - negedge CLKA
      0x29 - negedge CLKB
      0x26 - DDR CLKA
      0x27 - DDR CLKB
    
    
     byte TrigFlags
     byte TrigFlags
Line 97: Line 132:
       bit 1 - enable trigger 2 (advanced)
       bit 1 - enable trigger 2 (advanced)
       bit 2 - trigger logic, 0 - T1 or T2, 1 - T1 and T2
       bit 2 - trigger logic, 0 - T1 or T2, 1 - T1 and T2
      bit 3 - unknown USBXI sync trigger config, default: 1
      bit 4 - unknown USBXI sync trigger config, default: 0
      bit 7 - unknown USBXI "check mode", default: 0
    
    
     word PwmA - channel A Vref PWM value, pseudocode:
     word PwmA - channel A Vref PWM value, pseudocode:
Line 111: Line 149:
     word PwmB - channel B Vref PWM value
     word PwmB - channel B Vref PWM value
    
    
     byte unused[2]
    byte UsbxiData - unknown USBXI parameter, default: 00
 
     byte unused: 00
    
    
     dword SampleDepth - sample depth in bits per channel, 2k-64M, must be multiple of 512
     dword SampleDepth - sample depth in bits per channel, 2k-64M, must be multiple of 512
Line 182: Line 222:
     dword CurrentDataValue - A0-B15 current state snapshot
     dword CurrentDataValue - A0-B15 current state snapshot
     dword CaptureStatus - 0-not finished, 1-?, 2-done, data is ready
     dword CaptureStatus - 0-not finished, 1-?, 2-done, data is ready
     dword DummyData[244] - pad to 1024 bytes
    dword UsbxiData - unknown USBXI data
    dword DevVersion - FPGA firmware version
     dword DummyData[251] - pad to 1024 bytes


   { 0x5A, 0x6B } - get captured data, parameters are defaults
   { 0x5A, 0x6B } - get captured data, parameters are defaults
Line 189: Line 231:
     dword CaptureData[SampleDepth] - capture data
     dword CaptureData[SampleDepth] - capture data
     dword EndMarker=0x4D3C037F - drop rx data after this till end of 512 byte packet
     dword EndMarker=0x4D3C037F - drop rx data after this till end of 512 byte packet
  { 0x9A, 0xAB } - unknown USBXI "eraser data" cmd, parameters are defaults
  Response: none
  { 0xBA, 0xCB } - unknown USBXI "set sync trig output" cmd, parameters are defaults
  Response: none


=== Acquisition session flow ===
=== Acquisition session flow ===
Line 197: Line 245:
* Get capture data with { 0x5A, 0x6B }
* Get capture data with { 0x5A, 0x6B }


== Resources ==
== Hardware features support status ==


[http://www.hantek.com/Product/HT4032/SDK.zip Hantek 4032L SDK (Windows only)]
  + Buffered mode acquisition
  + Sample depth selection
  + Pretrigger depth selection
  + Internal clocking (timing mode)
  + External clocking (state mode) with edge (rising/falling/both) and clock channel (ACLK/BCLK) selection
  + Logic voltage threshold selection (independent for Axx and Bxx channel groups, possible to analyze dual standrard circuits)
  + Unconditional trigger
  + Trigger on signal edge (rising/falling/any)
  + Trigger on bus pattern match
  - Trigger on bus value within/out of range
  - Trigger on bus pattern condition (match/within/out of range) repeating for N consecutive samples
    where N is equal/within range/out of range
  - Trigger on bus pattern condition at specific signal edge
  - Trigger on any of the above conditions combined with pattern match on the previous/current/next sample
  - Use two trigger units in AND/OR combination
  - External trigger input/output signals


[[Category:Device]]
[[Category:Device]]
[[Category:Logic analyzer]]
[[Category:Logic analyzer]]
[[Category:Planned]]
[[Category:Supported]]

Revision as of 16:25, 30 July 2018

Hantek 4032L
Hantek 4032l mugshot.png
Status supported
Source code hantek-4032l
Channels 32
Samplerate 400MHz
Samplerate (state) ?
Triggers edge, bus value range, pattern, pattern duration, combined
Min/max voltage -6V — +60V input, -6V — +6V threshold
Memory 2Gbit (64M samples x 32)
Compression
Website hantek.com

The Hantek 4032L is a USB-based, 32-channel logic analyzer with up to 400MHz sampling rate and 2Gbit DDR2 memory.

See Hantek 4032L/Info for more details (such as lsusb -v output) on the device.

Hardware

  • Xilinx Spartan-6 XC6SLX16 CSG324 DIV1225 (FPGA, 14579 logic cells, 2 DDR1/2/3 memory controllers, BGA324)
  • Cypress FX2LP CY7C68013A-100AXC (USB 2.0 HS controller, TQFP100)
  • 2x Micron MT47H64M16HR-25E:H (1Gbit DDR2 SDRAM, BGA)
  • TI TPS51116 (DDR memory power controller)
  • Unknown I2C EEPROM (marking removed, contains FX2 firmware)
  • MXIC MX25L4005 (4Mbit SPI flash, marking removed, contains FPGA bitstream)
  • DAC122S085CIMM (marking removed, input Vref generators)

Photos

Teardown 1:

Teardown 2:

Protocol

  • Vendor request is used to reset the engine and flush the buffers
  • Endpoint 2 is used for host-to-device command/parameters transfers
  • Endpoint 6 is used for device-to-host status/data transfers

X denotes "any value" in the following description

Vendor requests

  • bRequest=0xB3, wValue=X, wIndex=X, wLength=0x0A, data={ 0x0F, 0x03, 0x03, 0x03, X, X, X, X, X, X } - restart the engine (reset FPGA, reset FIFOs)
  • bRequest=0xD0, wValue=X, wIndex=X, wLength=0x00 - disable communication (set FIFO reset), not used
  • bRequest=0xD1, wValue=X, wIndex=X, wLength=0x00 - enable communication (clear FIFO reset), not used

Command/Parameters packet

 struct CmdParamsPacket
 
   byte Magic[2]={ 0x7F, 0x01 }
 
   byte SampleRate
     0x22 - 400MS/s
     0x23 - 320MS/s
     0x20 - 200MS/s
     0x21 - 160MS/s
     0x00 - 100MS/s
     0x08 - 80MS/s
     0x01 - 50MS/s
     0x09 - 40MS/s
     0x02 - 25MS/s
     0x0A - 20MS/s
     0x03 - 12.5MS/s
     0x0B - 10MS/s
     0x04 - 6.25MS/s
     0x0C - 5MS/s
     0x10 - 4MS/s
     0x05 - 3.125MS/s
     0x0D - 2.5MS/s
     0x11 - 2MS/s
     0x06 - 1.5625MS/s
     0x0E - 1.25MS/s
     0x12 - 1MS/s
     0x07 - 781.25KS/s
     0x0F - 625KS/s
     0x13 - 500KS/s
     0x14 - 250KS/s
     0x15 - 125KS/s
     0x16 - 62.5KS/s
     0x17 - 31.25KS/s
     0x18 - 16KS/s
     0x19 - 8KS/s
     0x1A - 4KS/s
     0x1B - 2KS/s
     0x1C - 1KS/s
     0x24 - posedge CLKA
     0x25 - posedge CLKB
     0x28 - negedge CLKA
     0x29 - negedge CLKB
     0x26 - DDR CLKA
     0x27 - DDR CLKB
 
   byte TrigFlags
     bit 0 - enable trigger 1 (main)
     bit 1 - enable trigger 2 (advanced)
     bit 2 - trigger logic, 0 - T1 or T2, 1 - T1 and T2
     bit 3 - unknown USBXI sync trigger config, default: 1
     bit 4 - unknown USBXI sync trigger config, default: 0
     bit 7 - unknown USBXI "check mode", default: 0
 
   word PwmA - channel A Vref PWM value, pseudocode:
     -6V < ThresholdVoltage < +6V
     Vref = 1.8-ThresholdVoltage
     if Vref>10.0
       Vref = 10.0
     if Vref<-5.0
       Vref = -5.0
     pwm = ToInt((Vref + 5.0) / 15.0 * 4096.0)
       if pwm>4095
       pwm = 4095
 
   word PwmB - channel B Vref PWM value
 
   byte UsbxiData - unknown USBXI parameter, default: 00
  
   byte unused: 00
 
   dword SampleDepth - sample depth in bits per channel, 2k-64M, must be multiple of 512
 
   dword PretriggerDepth - pretrigger buffer depth in bits, must be < SampleDepth
 
   struct Trig Trig1 - trigger 1 config, see below
 
   struct Trig Trig2 - trigger 2 config, see below
 
   byte Command[2] - command, see Commands and responses below
 struct Trig
   
   dword Flags - trigger types selection:
     bit 4:0 - edge trigger signal, 0-31 -> A0-B15
     bit 6:5 - edge to trigger on:
       00 - rise
       01 - fall
       10 - rise or fall
       11 - edge trigger disabled
     bit 7 - unused
     bit 9:8 - data range trigger type:
       00 - data=RangeMax trigger
       01 - data=RangeMin or data=RangeMax trigger
       10 - data<RangeMin or data>RangeMax trigger
       11 - RangeMin<data<RangeMax trigger
     bit 11:10 - time range trigger type:
       00 - time=TimeMax trigger
       01 - time=TimeMin or time=TimeMax trigger
       10 - time<TimeMin or time>TimeMax trigger
       11 - TimeMin<time<TimeMax trigger
     bit 12 - enable data range trigger (see bit 9:8)
     bit 13 - enable time trigger (see bit 11:10)
     bit 15:14 - unused
     bit 17:16 - combined trigger data selection (data=EquData and data_sel matches other criteria like time, range, edge):
       00 - data_sel is next data (next to matched with EquData)
       01 - data_sel is current data
       10 - data_sel is previous data
       11 - undefined
     bit 18 - enable combined trigger (see bit 17:16)
     bit 31:19 - unused
   
   dword RangeMin - min value for data range trigger (see Flags[9:8]), must be masked with RangeMask (see Masking below)
 
   dword RangeMax - max value for data range trigger (see Flags[9:8]), must be masked with RangeMask
 
   dword TimeMin - min value for time trigger (see Flags[11:10])
 
   dword TimeMax - max value for time trigger (see Flags[11:10])        
 
   dword RangeMask - mask value for data range trigger
 
   dword EquMask - mask value for combined trigger
 
   dword EquData - data value for combined trigger (see Flags[17:16]), must be masked with EquMask
 Masking:
   Some trigger types (data range, combined "pattern and condition") operate on a "bus" value of several signals selected with a mask. Active bits are combined to a single value WITHOUT GAPS:
     mask=01000011, value=11010001 -> masked_value=00000101 (bits 6,1,0 are combined and zero-extended)

Commands and responses

 { 0x1A, 0x2B } - configure and start capture, all parameters are used
 Response: none
 { 0x3A, 0x4B } - get status, parameters are defaults
 Response: 
   dword Magic=0x2B1A037F - drop rx data until this)
   dword CurrentDataValue - A0-B15 current state snapshot
   dword CaptureStatus - 0-not finished, 1-?, 2-done, data is ready
   dword UsbxiData - unknown USBXI data
   dword DevVersion - FPGA firmware version
   dword DummyData[251] - pad to 1024 bytes
 { 0x5A, 0x6B } - get captured data, parameters are defaults
 Response:
   dword Magic=0x2B1A027F - drop rx data until this
   dword CaptureData[SampleDepth] - capture data
   dword EndMarker=0x4D3C037F - drop rx data after this till end of 512 byte packet
 { 0x9A, 0xAB } - unknown USBXI "eraser data" cmd, parameters are defaults
 Response: none
 { 0xBA, 0xCB } - unknown USBXI "set sync trig output" cmd, parameters are defaults
 Response: none

Acquisition session flow

  • Send restart vendor request (0xB3)
  • Send { 0x1A, 0x2B } type packet to configure and start capture
  • Poll with { 0x3A, 0x4B } until CaptureStatus=2 (optionally blink bus indicators according to CurrentDataValue during poll)
  • Get capture data with { 0x5A, 0x6B }

Hardware features support status

 + Buffered mode acquisition
 + Sample depth selection
 + Pretrigger depth selection
 + Internal clocking (timing mode)
 + External clocking (state mode) with edge (rising/falling/both) and clock channel (ACLK/BCLK) selection
 + Logic voltage threshold selection (independent for Axx and Bxx channel groups, possible to analyze dual standrard circuits)
 + Unconditional trigger
 + Trigger on signal edge (rising/falling/any)
 + Trigger on bus pattern match
 - Trigger on bus value within/out of range
 - Trigger on bus pattern condition (match/within/out of range) repeating for N consecutive samples
   where N is equal/within range/out of range
 - Trigger on bus pattern condition at specific signal edge
 - Trigger on any of the above conditions combined with pattern match on the previous/current/next sample
 - Use two trigger units in AND/OR combination
 - External trigger input/output signals