Universal ≠ Simple

A Logical View
Control information and data are sent in packets that, in turn, comprise several fields: synchronization (SYNC), packet identifier (PID), address (ADDR), endpoint (ENDP), frame number, data, and cyclic redundancy check (CRC). Not all types of packets require all fields. For example, a data packet consists of a SYNC field, a start-of-packet (SOP) field, a PID field, a data field with zero or more bits of data, a 16-b CRC, and an end-of-packet (EOP) field (Figure 2).

Figure 2. Typical USB Data Packet Fields

A start-of-frame (SOF) packet is transmitted every millisecond on a full-speed bus and includes an 11-b frame number after the SYNC and PID fields and before the 5-b CRC and EOP fields. All types of packets start with a SYNC field consisting of 8 b for low- and full-speed devices and 32 b for high-speed devices.

USB encodes data in a non-return-to-zero-inverted (NRZI) format. This means that a one is represented by no change of level and a zero by a change in level. To have the highest number of edges in the SYNC field, low- and full-speed devices use six zeros followed by two ones that act an SOP indicator signaling the start of the PID field. In the USB standard, K and J are used instead of zero and one to indicate the resulting voltage levels measured differentially between the D- and D+ bus wires. However, the data values are inverted for high-speed devices.

Similar to other serial buses, bit stuffing is used to help maintain synchronization. In the case of USB with its NRZI format, only six successive ones are allowed before a zero is inserted. A receiver recognizing six consecutive ones must ignore the following zero. Having more than six successive ones generally is an error condition but also indicates an EOP signal.

There are four types of PID fields: token, data, handshake, and special. The PID field consists of eight bit locations, the last four being the one's complement of the first four to aid error detection. Combinations of the four bits signify various actions within the four PID types. For example, not acknowledge (NAK) indicates that the receiving device cannot accept data or the transmitting device cannot send data. The host does not issue NAK, so the use of the word device specifically means the devices attached to the bus.

All data sent on the bus is bit-ordered according to the Little Endian convention. That is, bytes are written and read starting with the least significant bit (LSB), progressing to the most significant bit (MSB). In the NAK example, the 1010B data word is written in MSB order with the MSB on the left. The B immediately precedes the LSB. The B can be thought of as being in the binary point position. NAK data is transmitted in a 0, 1, 0, 1 order.

A token packet includes a device address and informs the corresponding device that the host wants to read or write information, that this is an SOF, or that setup control information is going to follow this packet. A device may have more than one programmable function, so an additional 4-b endpoint (ENDP) field effectively extends the 7-b address field.

Handshake packets are used to indicate status. Has the transmitted data been correctly received (ACK)? Is there some reason that the data cannot be received (NACK)?

A large number of conditions apply only to high-speed devices, and a special split mode is provided for host communications with a hub having both high-speed and low/full-speed devices connected to it.

At a higher level, four types of transfers are supported: control, interrupt, bulk, and isochronous. Control transfers include command and status operations. Interrupt transfers are initiated by the device at the time the host polls the device. The device cannot request attention until it is polled.

Bulk transfers provide 16-b CRC error correction and are intended for large amounts of data. In contrast, isochronous transfers occur continuously and periodically. Errors can be detected via CRC checking, but no correction mechanism exists. These transfers are intended for time-sensitive data such as an audio or video stream. In that sense, they are related to other types of USB transfers in the same way that Ethernet user datagram protocol (UDP) transfers are related to transmission control protocol (TCP).

At an even higher level, several classes define how certain types of devices interact with the host. For example, class code 3 for human interface devices (HID) includes keyboards and mice. Class code 8 covers mass storage devices, and code 6 is for scanning/imaging devices.

In addition to classes, the recent on-the-go (OTG) specification has introduced a host negotiation protocol (HNP), which supports a negotiation process between two devices to establish one as the host. There may only be two wires carrying the data, but as evidenced by the 650 pages of the USB 2.0 specification, bus operation is anything but simple.

A Physical View
Two of the four wires in the cable are used for +5 V (red) and ground (black), the others for differential and single-ended signaling. Generally, logic levels are received by sensing the difference between the D+ (green) and D- (white) lines. However, in some cases, both lines are held at the same voltage to generate a single-ended signal. For example, if both D+ and D- are held low, a so-called single-ended zero results that can indicate a device reset if held for more than 10 ms.

Pull-up and pull-down resistors are used on low- and full-speed devices. These resistors are controlled by the device and when connected enable the host to sense the presence of a device on the bus. For example, a 1.5-kΩ pull-up resistor connected to D+ indicates a full-speed device. But if connected to D-, it signifies a low-speed device. High-speed devices initialize as full-speed devices then remove the pull-up resistor to balance the transmission line.

Bus frame timing requires that an SOF packet be sent every 1.0 ms  0.5 's for low- and full-speed devices and every 125 's  62.5 ns for high-speed devices. The voltage vs. time behavior of the signals is defined by a series of eye masks that account for the allowed range of rise/fall times and high/low amplitudes.

USB Analyzers
Conceptually, bits, fields, and packets aren t really all that difficult to work with. Practically, the number and complexity of the state diagrams in the USB specification argue otherwise. To understand in detail what's going wrong on a bus requires both a high-level and a low-level view. You need to see the messages exchanged at the various protocol levels as well as the signal voltages and edge transitions. Several instruments exist expressly for this purpose.

The Model SBAE-30B from Catalyst features dual-port analysis applicable to all device speeds and with support for OTG analysis. This instrument is connected to a PC and controlled via high-speed USB or Ethernet, which means that remote troubleshooting via the Internet is possible. The GUI provides both an easy and an advanced mode as well as the capability to combine elements of each in a custom user interface.

Either a USB host or a device can be emulated concurrently as analysis is taking place. Also operating concurrently, an asynchronous timing mode supports detailed physical-layer investigations. Together with the two ports that are provided, you have the required functionality to compare data sent to a hub and the data transmitted by the hub, for example. Having two ports allows direct, and in this case, real-time comparisons.

You can directly trigger on any of 15 different protocol errors. After data is acquired, 22 additional protocol errors are automatically searched for by a post-capture utility. Triggering and data capture accommodate nonstandard bus speeds approaching DC.

The basic product is analyzer only on both ports. Timing mode, host emulator, device emulator, OTG exerciser, and DC compliance test suite are separate options. The Conquest Series Protocol Analyzer is a single-port instrument that provides a subset of the SBAE-30B features and operates on the same PC-based software application. Two options, the host exerciser and the advanced capture/trigger mode, are available.

Ellisys, headquartered in Switzerland, provides several protocol analyzers with capabilities ranging from basic to professional. U.S. distribution is via Saelig, Driver Tools, and Corelis. The lowest-cost model, the USB Tracker 110, is less than $1,000 and appropriate for USB 1.1 development. Like many competing small analyzers, this product is powered from the USB bus.

An example of a common problem is incorrect USB enumeration.  Enumeration is a process in which the host requests information from the device to identify it and prepare it for its operation,• explained Laurent Guinnard, the company's co-founder and chief technology officer.  If the enumeration fails, the device cannot be used and will be disabled by the operating system. An invalid reply to a request, no reply to a mandatory request, an invalid value in a descriptor, late reply to a standard request, or anything that would prevent the operating system from identifying the device can cause a failure. 

Moving up to the $3,000 range, the USB Explorer 200 Standard Edition deals with the three device speeds and decodes all standard requests and descriptors. The USB Explorer 200 Professional Edition adds features such as class decoding to the Standard Edition capabilities.

Do you need class decoders? This type of feature certainly can save time. Without class decoding, you are presented with the basic bus data. With decoding, you have a list of English-language commands with corresponding values for each class of device.

According to Mr. Guinnard, flash disk memory can use at least three levels of protocols, and when an error occurs on a lower level, it can impact higher levels. The Explorer 200 Professional Edition decodes all mass storage requests, displays any protocol error, and forwards a low-level error to higher levels to ensure that it will be noticed.

Most recently, Ellisys launched the Wireless USB Explorer 300 that handles both WiMedia's ultra wideband as well as Certified Wireless USB protocols. The device records traffic exchanged over the air and displays the resulting decoded information.

The Bus Doctor RX Analyzer from Finisar now supports 13 protocols such as ATA, SCSI, USB, SATA, Firewire, Cardbus, and PCI/X. Multiprotocol analysis is accomplished by combining up to four RX Analyzers, each configured to handle a specific protocol. Having a multiple-protocol capability means that you can investigate in detail how data representing an image from a Firewire camera finally was transmitted to a USB-connected mass storage device, for example.

A separate pod is needed for each type of protocol. A logic analysis pod also is available. By adding one or more logic analysis pods to a Bus Doctor RX equipped to handle a specific protocol, you can perform analysis from the physical layer all the way up the protocol stack. With the appropriate pod, a Bus Doctor RX can analyze any of the 13 supported protocols but only one at a time.

Other features include a 12-level trigger sequencer with two counters and two timers to allow very complex trigger conditions to be specified. The analyzer's memory can be segmented so that successive acquisitions corresponding to the same trigger condition are separately and automatically stored. The combination of these capabilities supports capturing rare events that may require the analyzer to be run unattended overnight or weekends.

A bus event is defined in the timing mode to be any level different than the level of the last sample. In the state mode, an event is a pattern across the analyzer's input channels that matches a preprogrammed pattern. For example, you can define filter conditions to limit the amount of data captured. Hardware in the analyzer ensures that filters run at the full wire rate.

Alternatively, you can take advantage of the very large data capture buffers available with the Bus Doctor RX. Two analyzer models are available: the RX-36 with 36 channels and the RX-108 with 108. The higher capacity RX-108 targets a range of complex storage and computing buses as well as smaller interfaces such as those required for USB and logic analysis. The smaller-capacity instrument is limited to ATA and SCSI storage buses and USB and logic-analysis computing buses.

Both instruments are available in three versions: Slim with storage for 16 M events, Fit with 64 M, and Buff with 256 M. The physical memory corresponding to 256 M events in the RX-108 Buff version is 4.6 GB in size. Hardware search supports use of post-capture command and state filters so that even searching the entire 4.6 GB memory space takes place in 1 s or less.

An advantage of the modular pod approach taken in the Bus Doctor RX product is the need for only one analysis and control program on your PC regardless of the exact protocol being investigated. There's only one program to learn to use, and pods can be swapped among Bus Doctors RX as the need arises throughout a development lab.

At $400, the Total Phase Beagle USB Protocol Analyzer is the lowest cost instrument discussed in this article. Derek Fung, applications engineer at the company, explained,  By providing this tool at a low price point, more engineers can use them to develop USB-based products. When protocol analyzers are too expensive, there is resistance to purchasing them, making them less available to engineers. Low-cost analyzers are essential to increasing productivity for USB product development teams. 

By connecting to your PC via USB 2.0, the Beagle can stream captured real-time low- or full-speed USB data to memory. Also, the device is powered from the bus. Timing resolution to 21 ns is possible while the galvanically isolated Beagle nonintrusively monitors bus communications.

The Beagle operates on either Windows or Linux systems and includes cables and a CD with Windows drivers, Linux USB hot-plug configuration files, Beagle data center software, datasheets, and documentation. The application programming interface (API) also is royalty free.

LINEEYE is a Japanese company that offers two levels of product capability. For low-and full-speed USB analysis, the bus-powered LE-610 FS-E includes timestamping to 16.7-ns accuracy, real-time filtering to reduce the size of the log file, and up to 16 stages of sequential triggering to pinpoint very specific trigger conditions. The line-powered LE-620HS-E provides similar capabilities but also handles high-speed USB transmission.

Emphasis is placed on post-capture search and analysis capabilities, and these are aided by the customizable color-coded display. Packet types and jump/mark events are easily highlighted. Search functions identify SOF, IN-token, OUT-token, SETUP-token, DATA-packet, PING, ACK, NAK, Unknown, CRC-error states, multiple specific addresses/endpoints in combination, and long idle states.

The Model LE-610FS-E contains 16 MB of capture memory and can sequentially stream two to five files up to 2-GB long. The Model LE-620HS-E has 256 MB of capture memory and sequentially streams up to 10 2-GB files to the PC hard disk.

LeCroy offers several different capabilities in a number of USB analysis products, but all feature the CATC Trace• Software that hierarchically displays packets, transactions, and transfers. As shown in Figure 3, colorful fields present decoded bus activity unambiguously. For example, the OTG HNP field shows that control was transferred from A to B and the time of the event.

Figure 3. CATC USB Tracer Display
Courtesy of LeCroy

With the CATC Trace display, you can eliminate idle bus traffic, simplify the trace, and organize the information unique to each USB device by using the built-in class-decoding capability. The analyzer records all the bus data. With the Trace software, you can extract the relevant information from the data.

The USB Tracer/Trainer System accepts two plug-in modules. If only the two-channel Tracer module is fitted, you have an analyzer. The Classic Tracer/Trainer system supports USB 1.1 and OTG and is most appropriate for slower speed devices associated with human interface development (HID). The USB All Speed Tracer/Trainer handles USB 2.0 and OTG.

If only the Trainer module is fitted, you have a bus exerciser with host emulation capabilities and optional device emulation. The intelliframe mode actively searches for a response from the device under test and responds to it in a suitable manner. Including both types of modules in a system allows you to record live traffic and play back the same data stream for test purposes.

The PC card-size USBMobile HS Portable Analyzer is the smallest of the LeCroy instruments. The USB Chief for analysis and the USB Chief Plus with analysis and emulation capabilities are the company's lowest cost instruments for USB low-and full-speed traffic. The USB Advisor may be the best choice if only analysis features are required for all USB 1.1 and 2.0 speeds. Completing the wired USB product line, the UPT2• Systems USB 2.0 Port Testers simultaneously provide basic test capabilities on up to eight USB root and port hubs in a production environment.

The UWBTracer• MPI Protocol Analyzer captures and displays all traffic between multiple wireless USB endpoints in a WiMedia cluster. It supports both WiMedia and Certified Wireless USB specifications and has all the proven CATC display capabilities. Precapture filtering, Beacon frame and transaction event triggering, and traffic summaries are included.

Summary
Given the complexity of the USB specification and the extensions to date, a good protocol analyzer is necessary if you need to design or troubleshoot any but the simplest USB systems. Two approaches to data capture are supported by available instruments: All data is captured, or you can specify a real-time filter to accept only relevant data. In either case, recording starts after a user-specified trigger condition.

All instruments offer post-storage data analysis, and some products also support real-time analysis. Post-storage proponents claim that you have securely acquired the relevant data, so you are free to dissect it in a variety of ways to expose underlying problems. Those that offer real-time analysis emphasize immediate error notification. Depending on your application, one or the other approach may be more appropriate.

When deciding to purchase a USB protocol analyzer, keep in mind that analyzers have very different sets of capabilities. Some instruments include timing-analysis and voltage-level measurements. Some models don't handle high-speed devices. If USB 1.1 speeds are sufficient, there are considerable cost savings in these lower-speed products. On the other hand, there's no economy in buying less instrument than you may need, especially when a number of comprehensive analyzers are available.