# Mesa 7I92T Ethernet Anything I/O Manual

**Version 1.4**

---

## Table of Contents
1. [General Description](#general-description)
2. [Hardware Configuration](#hardware-configuration)
    - [Connector 5V Power](#connector-5v-power)
    - [5V I/O Tolerance](#5v-io-tolerance)
    - [Pullup or Pulldown Selection](#pullup-or-pulldown-selection)
    - [IP Address Selection](#ip-address-selection)
3. [Connectors](#connectors)
    - [Connector Locations and Default Jumper Positions](#connector-locations-and-default-jumper-positions)
    - [I/O Connectors Pinout](#io-connectors-pinout)
    - [Power Connector Pinout](#power-connector-pinout)
    - [JTAG Connector Pinout](#jtag-connector-pinout)
    - [Frame Ground Connection](#frame-ground-connection)
4. [Operation](#operation)
    - [FPGA](#fpga)
    - [IP Address Selection Details](#ip-address-selection-details)
    - [Host Communication](#host-communication)
    - [UDP](#udp)
    - [LBP16 Protocol](#lbp16-protocol)
    - [Windows ARP Issues](#windows-arp-issues)
    - [FPGA Configuration](#fpga-configuration)
    - [Fallback Configuration](#fallback-configuration)
    - [EEPROM Layout (M25P16)](#eeprom-layout-m25p16)
    - [Bitfile Format](#bitfile-format)
    - [Mesaflash Utility](#mesaflash-utility)
    - [Free Flash Memory Space](#free-flash-memory-space)
    - [Fallback Indication](#fallback-indication)
    - [Failure to Configure](#failure-to-configure)
    - [Clock Signals](#clock-signals)
    - [LEDs](#leds)
    - [Pullup/Pulldown Resistors](#pulluppulldown-resistors)
    - [I/O Levels](#io-levels)
    - [Startup I/O Voltage](#startup-io-voltage)
    - [Interface Cables](#interface-cables)
    - [Breakout Power Option](#breakout-power-option)
    - [Plug and Go Kits](#plug-and-go-kits)
5. [Supplied Configurations](#supplied-configurations)
    - [HostMot2 Firmware](#hostmot2-firmware)
    - [Standard Configurations](#standard-configurations)
    - [Pin Files](#pin-files)
6. [Reference Information](#reference-information)
    - [LBP16 Protocol Detail](#lbp16-protocol-detail)
    - [Info Area](#info-area)
    - [Info Area Access](#info-area-access)
    - [Supported Memory Spaces](#supported-memory-spaces)
    - [ELBPCOM Python Script](#elbpcom-python-script)
7. [Specifications](#specifications)
8. [Card Drawing](#card-drawing)

---

## General Description

The **MESA 7I92T** series cards are low-cost, general-purpose, FPGA-based programmable I/O cards with a 100BaseT Ethernet host connection. The 7I92T series cards are available with three connector options:
* **7I92TF**: Female DB25 plus 26-pin header
* **7I92TM**: Male DB25 plus 26-pin header
* **7I92TH**: Two 26-pin headers

*In the remainder of this document, all 7I92T models will be referred to as "7I92T".*

The 7I92T cards use standard parallel port pinouts and connectors for compatibility with most parallel port-interfaced motion control / CNC breakout cards, multi-axis step motor drives, allowing a motion control performance boost while retaining a reliable real-time Ethernet interface. Unlike the parallel port that the 7I92T replaces, each I/O bit has individually programmable direction and function.

The 7I92T cards have a simplified UDP host data transfer system that allows operation in real time and compatibility with standard networks. 7I92T cards provide 34 I/O bits (17 per connector). All I/O bits are 5V tolerant and have pullup or pulldown resistors. A power source option allows the 7I92T to supply 5V power to breakout boards if desired.

Firmware modules are provided for:
* Hardware step generation
* Quadrature encoder counting
* PWM generation
* Digital I/O
* Smart Serial remote I/O
* BISS, SSI, SPI, UART interfaces, and more

Configurations are available that are compatible with common breakout cards and multi-axis step motor drives like the Gecko G540 and Leadshine MX3660/4660. All motion control firmware is open source and easily modified to support new functions or different mixes of functions.

In addition to standard parallel port breakouts, there are currently six 7I92T-compatible breakout cards available from Mesa: the 7I74 through 7I78, and 7I85.
* **7I76**: A step/dir oriented breakout with 5 axes of buffered step/dir outputs, 1 spindle encoder input, 1 isolated 0-10V analog spindle speed plus isolated direction/enable outputs, 1 RS-422 expansion port, 32 isolated 5-32V inputs, and 16 isolated 5-32V 300 mA outputs.
* **7I77**: An analog servo interface with 6 encoder inputs, 6 analog &plusmn;10V outputs, 1 RS-422 expansion port, 32 isolated 5-32V inputs, and 16 isolated 5-32V 300 mA outputs.

The 7I92T supports two breakout cards, meaning for example a 10-axis step/dir configuration or a 12-axis analog servo configuration is possible with a single 7I92T and two Mesa breakout cards.

---

## Hardware Configuration

### General

Hardware setup jumper positions assume that the 7I92T card is oriented in an upright position, that is, with the Ethernet connector towards the left and the I/O connectors towards the right.

### Connector 5V Power

The 7I92T has the option to supply 5V power to the breakout board. This option is used by all Mesa breakout boards to simplify wiring. The option uses 4 parallel cable signals that are normally used as grounds for supplying 5V to the remote breakout board (DB25 pins 22, 23, 24, and 25). These pins are AC-bypassed on both the 7I92T and Mesa breakout cards, so they do not compromise AC signal integrity.

The 5V power option is individually selectable for each of the two I/O connectors. This option should only be enabled for Mesa breakout boards or boards specifically wired to accept 5V power on DB25 pins 22 through 25. When the option is disabled, DB25 pins 22 through 25 are grounded.
* **Jumper W3** sets the power option on header P1.
* **Jumper W4** sets the power option on DB25 connector P2.

| Jumper | Position | Function |
| :--- | :--- | :--- |
| **W3, W4** | **UP** | Breakout power enabled |
| **W3, W4** | **DOWN** | Breakout power disabled (Default) |

> [!WARNING]
> Only enable the breakout power option when using compatible daughtercards. Enabling this on standard parallel port devices not designed for 5V power on ground pins can cause damage.

### 5V I/O Tolerance

The FPGA used on the 7I92T has a 4.65V absolute maximum input voltage specification. To allow interfacing with 5V inputs, the 7I92T has bus switches on all I/O pins. The bus switches work by turning off when the input voltage exceeds a preset threshold. The bus switches also allow the I/O pins to be pulled up to 5V when used as inputs or outputs in the open drain mode.

### Pullup or Pulldown Selection

Jumpers W1 and W2 select whether the I/O pins on P1 and P2 have pullup or pulldown resistors.
* **W1** selects the option for P1.
* **W2** selects the option for P2.

When W1 or W2 are in the **UP** position, the I/O pins on the associated connector have pullup resistors. When W1 or W2 are in the **DOWN** position, the I/O pins have pulldown resistors.

| Jumper | Position | Function |
| :--- | :--- | :--- |
| **W1, W2** | **UP** | Pullup to 5V |
| **W1, W2** | **DOWN** | Pulldown to 0V |

### IP Address Selection

The 7I92T has three options for selecting its IP address. These options are selected by Jumpers W5 and W6.

| W5 | W6 | IP Address |
| :--- | :--- | :--- |
| **DOWN** | **DOWN** | Fixed **192.168.1.121** (Default) |
| **DOWN** | **UP** | Fixed from EEPROM |
| **UP** | **DOWN** | BOOTP |
| **UP** | **UP** | **192.168.1.121** + Use Fallback Configuration |

*Note: The initial EEPROM IP address is set to `10.10.10.10` at Mesa, but can be changed to any address with the `mesaflash` utility.*

---

## Connectors

### Connector Locations and Default Jumper Positions

Below is the layout diagram showing connector locations and default jumper configurations (7I92T version shown):

![Connector Locations and Default Jumper Positions](images/connector_locations-09.png)

---

### I/O Connectors Pinout

The 7I92T has two I/O connectors, P1 and P2. Depending on the 7I92T model, P2 may be a DB25 female, DB25 male, or 26-pin header.

#### P2 First I/O Connector Pinout

| DB25 Pin | HDR Pin | Function | DB25 Pin | HDR Pin | Function |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **1** | 1 | IO0 | **14** | 2 | IO1 |
| **2** | 3 | IO2 | **15** | 4 | IO3 |
| **3** | 5 | IO4 | **16** | 6 | IO5 |
| **4** | 7 | IO6 | **17** | 8 | IO7 |
| **5** | 9 | IO8 | **18** | 10 | GND |
| **6** | 11 | IO9 | **19** | 12 | GND |
| **7** | 13 | IO10 | **20** | 14 | GND |
| **8** | 15 | IO11 | **21** | 16 | GND |
| **9** | 17 | IO12 | **22** | 18 | GND or 5V |
| **10** | 19 | IO13 | **23** | 20 | GND or 5V |
| **11** | 21 | IO14 | **24** | 22 | GND or 5V |
| **12** | 23 | IO15 | **25** | 24 | GND or 5V |
| **13** | 25 | IO16 | **XX** | 26 | GND or 5V |

#### P1 HDR26 Connector Pinout

| HDR Pin | Function | HDR Pin | Function |
| :--- | :--- | :--- | :--- |
| **1** | IO17 | **2** | IO18 |
| **3** | IO19 | **4** | IO20 |
| **5** | IO21 | **6** | IO22 |
| **7** | IO23 | **8** | IO24 |
| **9** | IO25 | **10** | GND |
| **11** | IO26 | **12** | GND |
| **13** | IO27 | **14** | GND |
| **15** | IO28 | **16** | GND |
| **17** | IO29 | **18** | GND or 5V |
| **19** | IO30 | **20** | GND or 5V |
| **21** | IO31 | **22** | GND or 5V |
| **23** | IO32 | **24** | GND or 5V |
| **25** | IO33 | **26** | GND or 5V |

*Note: The 26-pin header P1 will match standard parallel port pin-out if terminated with flat cable 26-pin receptacle/DB25F cable with pin 1s connected (and header pin 26 left open).*

A cable kit is available from MESA to interface the 26-pin header to Mesa and general parallel port type breakout boards.

---

### Power Connector Pinout

**P4** is the 7I92T power connector. P4 is a 3.5mm plug-in screw terminal block.

| Pin | Function | Notes |
| :--- | :--- | :--- |
| **1** | +5V | TOP, SQUARE PAD |
| **2** | GND | BOTTOM, ROUND PAD |

---

### JTAG Connector Pinout

**P3** is a JTAG programming connector. This is normally used only for debugging or if both EEPROM configurations have been corrupted. In case of corrupted EEPROM contents, the EEPROM can be re-programmed using Efinix's stand-alone programming tool.

| Pin | Function | Pin | Function |
| :--- | :--- | :--- | :--- |
| **1** | TMS | **2** | TDI |
| **3** | TDO | **4** | GND |
| **5** | TCK | **6** | GND |
| **7** | /RESET | **8** | GND |
| **9** | /SS | **10** | +3.3V |

---

### Frame Ground Connection

The top left mounting hole (near the Ethernet jack) is the frame ground connection. This should be grounded to earth/frame ground for best ESD/EMI resistance.

---

## Operation

### FPGA

The 7I92T uses an **Efinix T20F256C4** FPGA.

### IP Address Selection Details

Initial communication with the 7I92T requires knowing its IP address. The 7I92T has 3 IP address options (Default, EEPROM, and BootP) selected by jumpers W5 and W6.

* **Default IP address**: Always `192.168.1.121`.
* **EEPROM IP address**: Set by writing Ethernet EEPROM locations `0x20` and `0x22`.
* **BootP**: Allows the 7I92T address to be set by a DHCP/BootP server. If BootP is chosen, the 7I92T will retry BootP requests at a ~1 Hz rate if the BootP server does not respond.

### Host Communication

The 7I92T standard firmware is designed for low-overhead real-time communication with a host controller, so it implements a very simple set of IPv4 operations. These operations include ARP reply, ICMP echo reply, and UDP packet receive/send for host data communications. UDP is used so that the 7I92T can be used on a standard network with standard tools for non-real-time applications. No fragmentation is allowed, so the maximum packet size is 1500 bytes.

### UDP

All 7I92T data communication is done via UDP packets. The 7I92T socket number for UDP data communication is **27181**. Read data is routed to the requester's port number. Under UDP, a simple register access protocol is used called **LBP16**.

### LBP16 Protocol

LBP16 allows read and write access to up to eight separate address spaces with different sizes and characteristics. Current firmware uses seven of these spaces. For efficiency, LBP16 allows access to blocks of registers at sequential increasing addresses (Block transfers).

### Windows ARP Issues

The Windows TCP stack has a characteristic that causes it to drop outgoing UDP packets when refreshing its ARP cache. Because of this, you must either verify packet transmission via echoing data from the 7I92T for every transaction (reading `RXUDPCount` is suggested) and retrying failed transactions, or alternatively, setting up a static entry for the 7I92T in the ARP table. This is done using the Windows `arp` command.

---

### FPGA Configuration

The 7I92T is configured at power-up by an SPI FLASH memory. This flash memory is a 16M-bit chip that has space for two configuration files. Since all Ethernet logic on the 7I92T is in the FPGA, a problem with configuration means that Ethernet access will not be possible. For this reason, there is a backup method to recover from FPGA boot failures: fallback.

### Fallback Configuration

The 7I92T flash memory normally contains two configuration file images: a **user image** and a **fallback image**. If the primary user configuration is corrupted, the FPGA will load the fallback configuration so the flash memory image can be repaired remotely without having to resort to switching memories or JTAG programming.

---

### EEPROM Layout (M25P16)

The EEPROM used on the 7I92T for configuration storage is the **M25P16**, which is a 16M-bit (2MB) EEPROM with thirty-two 64KB sectors. Configuration files are stored on sector boundaries to allow individual configuration file erasing and updating.

| Sector Offset | Content Description |
| :--- | :--- |
| **First Half (Fallback Space)** | |
| `0x00000` | Fallback Configuration Block 0 |
| `0x10000` | Fallback Configuration Block 1 |
| `0x20000` | Fallback Configuration Block 2 |
| `0x30000` | Fallback Configuration Block 3 |
| `0x40000` | Fallback Configuration Block 4 |
| `0x50000` | Fallback Configuration Block 5 |
| `0x60000` | Fallback Configuration Block 6 |
| `0x70000` | Fallback Configuration Block 7 |
| `0x80000` | Fallback Configuration Block 8 |
| `0x90000` | Fallback Configuration Block 9 |
| `0xA0000` | Fallback Configuration Block 10 |
| `0xB0000` | Fallback Configuration Block 11 |
| `0xC0000` | Unused / Free |
| `0xD0000` | Unused / Free |
| `0xE0000` | Unused / Free |
| `0xF0000` | Unused / Free |
| **Second Half (User Space)** | |
| `0x100000` | User Configuration Block 0 |
| `0x110000` | User Configuration Block 1 |
| `0x120000` | User Configuration Block 2 |
| `0x130000` | User Configuration Block 3 |
| `0x140000` | User Configuration Block 4 |
| `0x150000` | User Configuration Block 5 |
| `0x160000` | User Configuration Block 6 |
| `0x170000` | User Configuration Block 7 |
| `0x180000` | User Configuration Block 8 |
| `0x190000` | User Configuration Block 9 |
| `0x1A0000` | User Configuration Block 10 |
| `0x1B0000` | User Configuration Block 11 |
| `0x1C0000` | Unused / Free |
| `0x1D0000` | Unused / Free |
| `0x1E0000` | Unused / Free |
| `0x1F0000` | Unused / Free |

---

### Bitfile Format

The 7I92TF, 7I92TM, and 7I92TH use bitfiles for an Efinix T20F256 FPGA and must not be programmed with bitfiles designed for the 7I92, 7I92M, or 7I92H.

> [!CAUTION]
> Never write a bitfile that is not designed for a 7I92T into the 7I92T's EEPROM. Doing so can "brick" the card and require it to be returned to Mesa for repair. Additionally, never write a user configuration to the fallback location, and never write a fallback configuration to the user area.

---

### Mesaflash Utility

The Linux utility program `mesaflash` is provided to write configuration files to the 7I92T EEPROM. These files depend on a simple SPI interface built into both the standard user FPGA bitfiles and the fallback bitfile. **Mesaflash version 3.4.5 or later must be used to program the 7I92T.**

If `mesaflash` is run with a `--help` command-line argument, it will print usage information. The following examples assume the target 7I92T is using the default IP address of `192.168.1.121`.

* **Write User Area**: Writes a standard binfile `FPGAFILE.BIN` to the user area of the EEPROM:
  ```bash
  mesaflash --device 7I92T --addr 192.168.1.121 --write FPGAFILE.BIN
  ```
* **Reload FPGA**: Reloads the FPGA from the user area of the EEPROM:
  ```bash
  mesaflash --device 7I92T --addr 192.168.1.121 --reload
  ```
* **Verify Configuration**: Verifies the file `FPGAFILE.BIN` against the user area of the EEPROM:
  ```bash
  mesaflash --device 7I92T --addr 192.168.1.121 --verify FPGAFILE.BIN
  ```
* **Read Pinout/Modules**: Prints the modules and pinout of the currently loaded 7I92T firmware:
  ```bash
  mesaflash --device 7I92T --addr 192.168.1.121 --readhmid
  ```

#### Setting EEPROM IP Address
Mesaflash can write a custom IP address to the EEPROM:
```bash
mesaflash --device 7I92T --addr 192.168.1.121 --set ip=10.10.10.100
```

---

### Free Flash Memory Space

Eight 64KB blocks of flash memory space are free when both user and fallback configurations are installed. These free blocks can be used for storing user data.

### Fallback Indication

Mesa's supplied fallback configurations blink the red **INIT LED** on the top right-hand side of the card if the primary configuration fails and the fallback configuration loads successfully. If this happens, it means the user configuration is corrupted or not a proper configuration for the 7I92T's FPGA. This can be fixed by running the configuration utility and re-writing the user configuration.

### Failure to Configure

The 7I92T should configure its FPGA within a fraction of a second of power application. If the FPGA card fails to configure, the red **/DONE LED CR2** will remain illuminated. If this happens:
1. Try setting the IP address select option jumpers (W5, W6) to the **UP, UP** positions. This forces a boot from the fallback memory location (using the fixed IP `192.168.1.121`), allowing reprogramming of the user configuration.
2. If this fails, the 7I92T's EEPROM must be re-programmed via the JTAG connector or by a JTAG FPGA load followed by an Ethernet EEPROM update.

### Clock Signals

The 7I92T has a single 50 MHz clock signal from an on-card crystal oscillator. The clock can be multiplied and divided by the FPGA's clock generator block to generate a wide range of internal clock signals. The 50 MHz clock is also used to generate the 25 MHz clock for the Ethernet interface chip.

### LEDs

The 7I92T has:
* **4 Green FPGA-driven user LEDs** (User 0 through User 3): Used for any custom purpose or debugging.
* **2 Red FPGA-driven status LEDs**: Reflect the state of the FPGA's `DONE` and `/INIT` pins.
    - The `/DONE` LED lights until the FPGA is configured at power-up.
    - The `/INIT` LED lights when power-on reset is asserted or when a CRC error occurs during configuration. Under Mesa configurations, the `/INIT` LED blinks when the fallback configuration is loaded.
* **1 Power LED**.

### Pullup/Pulldown Resistors

All I/O pins are provided with pull-up or pull-down resistors to allow connection to open drain, open collector, or OPTO devices. These resistors have a value of **4.7K &Omega;** and have a maximum pull-up/pull-down current of ~1.07 mA at 5V.

### I/O Levels

The FPGA used on the 7I92T has programmable I/O levels for interfacing with different logic families. The 7I92T does not support I/O standards that require input reference voltages. All standard Mesa configurations use **LVTTL** levels.

Even though the 7I92T can tolerate 5V signal inputs, its outputs will not swing to 5V. The outputs are push-pull CMOS that drive to the output supply rail of 3.3V. This is sufficient for TTL compatibility but may cause problems with some types of loads:
* *Example*: When driving an LED that has its anode connected to 5V (as in some OPTO isolators or SSR module racks), the 3.3V high level might not completely turn the LED off.
* *Solution*: To avoid this problem, either drive loads that are ground-referred, use 3.3V as the VCC for VCC-referred loads, or use the open-drain mode.

### Startup I/O Voltage

After power-up or system reset and before the FPGA is configured, the pull-up/pull-down resistors pull all I/O signals to a high or low level. If the FPGA is used for motion control or controlling devices that could present a hazard when enabled, external circuitry should be designed so that this initial state results in a safe condition.

### Interface Cables

Mesa daughtercards use a female DB25 connector for interface.
* **7I92TM (Male DB25)**: Allows direct connection with no cable required for the primary port.
* **7I92TF (Female DB25)**: Requires a male-male DB25 cable to connect to a Mesa daughtercard.
* **7I92TH / Secondary Ports**: Require a HDR26 to DB25M cable to connect to a Mesa daughtercard.

For noise immunity and signal fidelity, it is highly suggested that only **IEEE-1284 rated cables** be used. IEEE-1284 rated cables have a twisted-pair shield wire for each signal wire and an overall shield terminated in the metal connector shell. This results in much better performance than flat or non-IEEE-1284 parallel port cables. For short connections of less than 3 feet, flat cables can be used. No other type of cable should be used.

### Breakout Power Option

When used with Mesa breakout/daughter cards, the 7I92T can supply up to **1A of 5V power** to each daughtercard. This option is disabled by default to avoid possible damage to standard breakout boards.

If you use this option, you must verify that the interface cable does not tie the eight parallel port ground wires together as some cheap printer cables do. Mesa-supplied IEEE-1284 cables are guaranteed to work with this power option.

### Plug and Go Kits

Motion control kits with a pre-programmed 7I92TM and daughtercard(s) are available to simplify system integration.

---

## Supplied Configurations

### HostMot2 Firmware

All supplied configurations are part of the **HostMot2** motion control firmware set. HostMot2 firmware is open-source and easily extendible to support new interfaces. For detailed register-level information on HostMot2 firmware modules, see the `regmap` file in the HostMot2 source code directory.

### Standard Configurations

* **7I76X1D**: Intended to work with a single 7I76 five-axis step/dir daughtercard.
* **7I76_7I74D**: Configured for a 7I76 five-axis step/dir daughtercard on P2 and a 7I74 eight-channel RS-422 interface on P1 (configured with eight Smart Serial channels).
* **G540X2D**: Intended to work with two Gecko G540 four-axis step motor drives. Includes 8 hardware step generators, 2 PWM generators, 4 GPIO outputs, 8 GPIO inputs, 2 charge pump drivers, and a watchdog timer.
* **7I77X2D**: Intended to work with two 7I77 six-axis analog servo daughtercards. Includes 12 encoder inputs, 6 Smart Serial interfaces (4 local, 2 fed through), a watchdog timer, and GPIO.
* **7I77_7I76D**: Intended to work with a 7I77 six-axis analog servo daughtercard on P2 and a 7I76 daughtercard on P1.
* **7I77_7I74D**: Intended to work with a 7I77 six-axis analog servo daughtercard on P2 and a 7I74 eight-channel RS-422 daughtercard on P1. Includes 6 encoder inputs, 14 Smart Serial interfaces, watchdog timer, and GPIO.
* **7I74X2D**: Intended to work with two 7I74 RS-422 daughtercards. Includes 16 Smart Serial interfaces (allowing real-time control of up to 784 digital I/O points), a watchdog timer, and GPIO.
* **7I78X2D**: Intended to work with two 7I78 four-axis step/dir daughtercards (one on each connector). Includes 8 hardware step generators, 2 PWM generators, 2 encoder inputs, 2 Smart Serial interfaces, watchdog, and GPIO.
* **PROB_RFX2D**: A step/dir configuration intended to work with most common parallel port breakouts (one on each connector). Includes 8 hardware step generators, 2 encoders with index, 4 PWM generators, watchdog, and GPIO.

### Pin Files

Each configuration has an associated file with a `.pin` extension that describes the FPGA functions included in the configuration and the I/O pinout. These are plain text files that can be viewed with any text editor.

---

## Reference Information

### LBP16 Protocol Detail

LBP16 is a simple remote register access protocol to allow efficient register access over the Ethernet link. All LBP16 commands are 16 bits in length and have the following structure:

| Bit | Symbol | Description |
| :--- | :--- | :--- |
| **15** | **W** | Write bit (1 = Write, 0 = Read) |
| **14** | **A** | Includes Address bit (1 = Command is followed by 16-bit address; 0 = Use current address pointer) |
| **13** | **C** | Info Area Access (0 = Access memory space itself, 1 = Access associated info area) |
| **12..10** | **M** | 3-bit Memory Space Specifier (`000b` through `111b`) |
| **9..8** | **S** | Transfer Element Size Specifier (`00b` = 8 bits, `01b` = 16 bits, `10b` = 32 bits, `11b` = 64 bits) |
| **7** | **I** | Increment Address Pointer bit (1 = Increment pointer by transfer size in bytes after every transfer; 0 = No increment, useful for FIFOs) |
| **6..0** | **N** | Transfer Count in units of selected size (1 through 127; 0 is an error) |

LBP16 read commands are followed by the 16-bit address (if the A bit is set). LBP16 write commands are followed by the address (if bit A is set) and the data to be written. LBP16 addresses are always byte addresses. LBP data and addresses are little-endian, so they must be sent LSB first.

---

### Info Area

Each of the eight possible memory spaces in LBP16 has an associated read-only info area. Only 16-bit read access is allowed to the info area.

#### Info Area Layout
| Offset (Hex) | Field Name | Description |
| :--- | :--- | :--- |
| `0000` | COOKIE | `0x5A0N` where `N` is address space 0..7 |
| `0002` | MEMSIZES | Memory Space Sizes Word (see format below) |
| `0004` | MEMRANGES | Memory Space Ranges Word (see format below) |
| `0006` | ADDRESS POINTER | Current address pointer |
| `0008` | SPACENAME 0,1 | First 2 characters of space name |
| `000A` | SPACENAME 2,3 | Next 2 characters of space name |
| `000C` | SPACENAME 4,5 | Next 2 characters of space name |
| `000E` | SPACENAME 6,7 | Last 2 characters of space name |

#### Info Area MEMSIZES Format
| Bit(s) | Symbol | Description |
| :--- | :--- | :--- |
| **15** | **W** | Memory space is Writeable |
| **14..8** | **T** | Type: `01h` = Register, `02h` = Memory, `0Eh` = EEPROM, `0Fh` = Flash |
| **7..4** | **X** | Reserved / Unused |
| **3..0** | **A** | Supported access widths (bitmask: bit 0 = 8-bit, bit 1 = 16-bit, bit 2 = 32-bit, bit 3 = 64-bit). E.g., `0x06` = 16-bit and 32-bit operations allowed. |

#### Info Area MEMRANGES Format
| Bit(s) | Symbol | Description |
| :--- | :--- | :--- |
| **15..11** | **E** | Erase block size ($2^E$ bytes). 0 for non-flash. |
| **10..6** | **P** | Page size ($2^P$ bytes). 0 for non-flash. |
| **5..0** | **S** | Address range ($2^S$ bytes). |

---

### Info Area Access

Hex command examples below are written in LSB-first order. `NN` is the count/increment field, and `LLHH` is the low and high bytes of the address.

* **Ispace 0 (HostMot2 space)**:
    - Read with address: `NN61LLHH`
    - Read (no address): `NN21`
* **Ispace 1 (Ethernet chip space)**:
    - Read with address: `NN65LLHH`
    - Read (no address): `NN25`
* **Ispace 2 (Ethernet EEPROM space)**:
    - Read with address: `NN69LLHH`
    - Read (no address): `NN29`
* **Ispace 3 (FPGA flash space)**:
    - Read with address: `NN6DLLHH`
    - Read (no address): `NN2D`
* **Ispace 6 (LBP16 R/W space)**:
    - Read with address: `NN79LLHH`
    - Read (no address): `NN39`
* **Ispace 7 (LBP16 R/O space)**:
    - Read with address: `NN7DLLHH`
    - Read (no address): `NN3D`

---

### Supported Memory Spaces

#### Space 0: HostMot2 Registers
This address space gives access to the FPGA I/O. It is a 64KB address range with 32-bit R/W access.
* Read with address: `NN42LLHH`
* Write with address: `NNC2LLHH`
* Read (no address): `NN02`
* Write (no address): `NN82`

##### Examples:
1. **Read first 5 entries in HostMot2 IDROM** (IDROM starts at `0x0400`):
   ```hex
   85420004
   ```
   * `85`: `NN` = 5 | Inc bit (`0x80`) set so address increments after each access.
   * `42`: Read from space 0 with address included.
   * `00`: LSB of address.
   * `04`: MSB of address.
2. **Write 4 GPIO ports starting at `0x1000`**:
   ```hex
   84C20010AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD
   ```
   * `84`: `NN` = 4 | Inc bit set.
   * `C2`: Write to space 0 with address included.
   * `00`, `10`: Address `0x1000`.
   * `AAAAAAAA` through `DDDDDDDD`: 32-bit little-endian write data.

#### Space 1: Ethernet Chip Access
Allows access to the KSZ8851-16 registers for debugging. All accesses are 16-bit.
* Read with address: `NN45LLHH`
* Write with address: `NNC5LLHH`
* Read (no address): `NN05`
* Write (no address): `NN85`

##### Example: Read CIDER register:
```hex
0145C000
```
* `01`: `NN` = 1 (16-bit).
* `45`: Read space 1 with address included.
* `C0`, `00`: CIDER register address.

#### Space 2: Ethernet EEPROM Chip Access
Stores the Ethernet MAC address, card name, and EEPROM-settable IP address. Accessed as 16-bit data. The first `0x20` bytes are read-only; the remaining `0x60` bytes are read/write.
* Read with address: `NN49LLHH`
* Write with address: `NNC9LLHH`
* Read (no address): `NN09`
* Write (no address): `NN89`

##### Writing to EEPROM:
Writes and erases require that the `EEPROMWEna` register (Space 6, offset `0x1A`) be set to `5A02`. `EEPROMWEna` is cleared at the end of every LBP packet, so the write enable command must be prepended to the EEPROM write/erase commands in the same packet.

##### Example: Write EEPROM IP address `192.168.0.32` (`C0:A8:0:20`):
```hex
01D91A00025A82C920002000A8C0
```
* `01D91A00025A`: Enable EEPROM area writes (Write `5A02` to Space 6, address `0x001A`).
* `82C920002000A8C0`: Write 2 words to `0x0020` with address increment.

##### Ethernet EEPROM Layout (Space 2)
| Address (Hex) | Field Name / Description | Access |
| :--- | :--- | :--- |
| `0000` | Reserved | RO |
| `0002` | MAC Address LS Word | RO |
| `0004` | MAC Address Mid Word | RO |
| `0006` | MAC Address MS Word | RO |
| `0008` | Reserved | RO |
| `000A` | Reserved | RO |
| `000C` | Reserved | RO |
| `000E` | Unused | RO |
| `0010` | CardNameChar-0,1 | RO |
| `0012` | CardNameChar-2,3 | RO |
| `0014` | CardNameChar-4,5 | RO |
| `0016` | CardNameChar-6,7 | RO |
| `0018` | CardNameChar-8,9 | RO |
| `001A` | CardNameChar-10,11 | RO |
| `001C` | CardNameChar-12,13 | RO |
| `001E` | CardNameChar-14,15 | RO |
| `0020` | EEPROM IP Address LS Word | RW |
| `0022` | EEPROM IP Address MS Word | RW |
| `0024` | EEPROM Netmask LS Word (V16 &gt; firmware) | RW |
| `0026` | EEPROM Netmask MS Word (V16 &gt; firmware) | RW |
| `0028` | DEBUG LED Mode (LSB determines HostMot2 (0) or debug(1)) | RW |
| `002A` | Reserved | RW |
| `002C` | Reserved | RW |
| `002E` | Reserved | RW |
| `0030..007E` | Unused | RW |

#### Space 3: FPGA Flash EEPROM Chip Access
Allows access to the FPGA's configuration flash memory. All flash memory access is 32-bit. It is done indirectly via a 32-bit address pointer and a 32-bit data port.
* Read with address: `NN4ELLHH`
* Write with address: `NNCELLHHDDDDDDDD`
* Read (no address): `NN0E`
* Write (no address): `NN8E`

##### Flash Memory Registers
Flash memory space has only 4 accessible registers:

| Address (Hex) | Register Name | Description |
| :--- | :--- | :--- |
| `0000` | **FL_ADDR** | 32-bit flash address register |
| `0004` | **FL_DATA** | 32-bit flash data register |
| `0008` | **FL_ID** | 32-bit read-only flash ID register |
| `000C` | **SEC_ERASE** | 32-bit write-only sector erase register |

The flash byte address is automatically incremented by 4 after each data access. Reads can access all of flash memory consecutively, but write operations can only write a flash page worth of data (256 bytes) before the page write must be started.

##### Examples:
1. **Read 1024 bytes (256 doublewords) of flash starting at address `0x00123456`**:
   ```hex
   01CE000056341200
   404E0400
   400E
   400E
   400E
   ```
   * First command writes `0x00123456` to `FL_ADDR` (`0x0000`).
   * Subsequent commands read `FL_DATA` (`0x0004`) without the increment bit (the flash controller increments address automatically).

2. **Write a 256-byte page of flash memory starting at `0xC000`**:
   Writes/erases require setting `EEPROMWEna` (Space 6, offset `0x1A`) to `5A03` in the same packet.
   ```hex
   01D91A00035A          ; Write EEPROMWEna with 0x5A03
   01CE000000C00000      ; Write flash address 0x0000C000 to FL_ADDR
   40CE0400              ; Write 64 doublewords to FL_DATA
   [64 doublewords of data]
   014E0000              ; Read FL_ADDR for host synchronization/wait
   ```

3. **Erase flash sector `0x00010000`**:
   ```hex
   01D91A00035A          ; Write EEPROMWEna with 0x5A03
   01CE000000000100      ; Write sector address to FL_ADDR
   01CE0C0000000000      ; Write sector erase command to SEC_ERASE (with 32-bit dummy data)
   014E0000              ; Read FL_ADDR for host synchronization (echos address after erase)
   ```

#### Space 4: LBP Timer/Utility Area
Read/write access to LBP-specific timing registers. All accesses are 16-bit.
* Read with address: `NN51LLHH`
* Write with address: `NND1LLHHDDDD`
* Read (no address): `NN11`
* Write (no address): `NN91DDDD`

##### Memory Space 4 Layout
| Address (Hex) | Register Name | Description |
| :--- | :--- | :--- |
| `0000` | **uSTimeStampReg** | Reads the free-running hardware microsecond timer. Writes are no-op. |
| `0002` | **WaituSReg** | Delays processing for specified number of microseconds when written (0 to 65535 &mu;s). Reads return last wait time written. |
| `0004` | **HM2Timeout** | Sets timeout value for all `WaitForHM2` operations (0 to 65536 &mu;s). |
| `0006` | **WaitForHM2RefTime** | Waits for rising edge of reference timer. Reads return wait time in &mu;s. |
| `0008` | **WaitForHM2Timer1** | Waits for rising edge of HM2 Timer 1. |
| `000A` | **WaitForHM2Timer2** | Waits for rising edge of HM2 Timer 2. |
| `000C` | **WaitForHM2Timer3** | Waits for rising edge of HM2 Timer 3. |
| `000E` | **WaitForHM2Timer4** | Waits for rising edge of HM2 Timer 4. |
| `0010..001E` | **Scratch** | Scratch registers for custom use. |

The `HM2Timeout` register places an upper bound on how long `WaitForHM2` operations will wait. Timeout events set the `HM2TimeOutError` bit in the error register.

#### Space 6: LBP Status/Control Area
Read/write access to LBP-specific control, status, and error registers. All accesses are 16-bit.
* Read with address: `NN59LLHH`
* Write with address: `NND9LLHHDDDD`
* Read (no address): `NN19`
* Write (no address): `NN99DDDD`

##### Memory Space 6 Layout
| Address (Hex) | Register Name | Description |
| :--- | :--- | :--- |
| `0000` | **ErrorReg** | Error status register (see format below). |
| `0002` | **LBPParseErrors** | Count of LBP parse errors. |
| `0004` | **LBPMemErrors** | Count of LBP memory range/access errors. |
| `0006` | **LBPWriteErrors** | Count of LBP write block errors. |
| `0008` | **RXPktCount** | Received packet count. |
| `000A` | **RXUDPCount** | Received UDP packet count (useful as a sequence indicator). |
| `000C` | **RXBadCount** | Received bad packet count. |
| `000E` | **TXPktCount** | Transmitted packet count. |
| `0010` | **TXUDPCount** | Transmitted UDP packet count. |
| `0012` | **TXBadCount** | Transmitted bad packet count. |
| `0014` | **LEDMode** | LSb = 0: LEDs owned by HostMot2; LSb = 1: LEDs are local debug LEDs. |
| `0016` | **DebugLEDPtr** | Variable address in Space 6 to show on local debug LEDs (default: `RXPktCount`). |
| `0018` | **Scratch** | Scratch pad (useful for custom sequence numbers). |
| `001A` | **EEPROMWEna** | Must be set to `5A0N` to enable EEPROM/flash writes or erases (N is memory space). Cleared at packet end. |
| `001C` | **LBPReset** | Set to non-zero to reset the LBP16 firmware. The card reads jumpers and re-assigns IP. Card is unresponsive for ~0.5s. |
| `001E` | **FPGAICAP** | FPGA ICAP-16 register for remote FPGA reload and low-level FPGA access. |

##### Error Register Format (ErrorReg)
| Bit | Error | Description |
| :--- | :--- | :--- |
| **0** | **LBPParseError** | Command parsing error |
| **1** | **LBPMemError** | Access to unsupported memory space or address out of range |
| **2** | **LBPWriteError** | Attempted write to read-only space or write size error |
| **3** | **RXPacketErr** | UDP packet receive error |
| **4** | **TXPacketErr** | UDP packet transmission error |
| **5** | **HM2TimeOutError** | HostMot2 wait operation timed out |
| **6..15** | **Reserved** | Reserved |

#### Space 7: LBP Read-Only Area
Used for read-only card identification and diagnostic information. All accesses are 16-bit.
* Read with address: `NN5DLLHH`
* Read (no address): `NN1D`

##### Memory Space 7 Layout
| Address (Hex) | Register Name | Description |
| :--- | :--- | :--- |
| `0000` | **CardNameChar-0,1** | Characters 0 & 1 of Card Name |
| `0002` | **CardNameChar-2,3** | Characters 2 & 3 of Card Name |
| `0004` | **CardNameChar-4,5** | Characters 4 & 5 of Card Name |
| `0006` | **CardNameChar-6,7** | Characters 6 & 7 of Card Name |
| `0008` | **CardNameChar-8,9** | Characters 8 & 9 of Card Name |
| `000A` | **CardNameChar-10,11** | Characters 10 & 11 of Card Name |
| `000C` | **CardNameChar-12,13** | Characters 12 & 13 of Card Name |
| `000E` | **CardNameChar-14,15** | Characters 14 & 15 of Card Name |
| `0010` | **LBPVersion** | Version of LBP firmware protocol |
| `0012` | **FirmwareVersion** | Version of card configuration firmware |
| `0014` | **Option Jumpers** | Status of option jumpers |
| `0016` | **Reserved** | Reserved |
| `0018` | **RecvStartTS** | Receive start timestamp (1 &mu;s resolution) |
| `001A` | **RecvDoneTS** | Receive done timestamp (1 &mu;s resolution) |
| `001C` | **SendStartTS** | Send start timestamp from previous packet |
| `001E` | **SendDoneTS** | Send done timestamp from previous packet |

---

### ELBPCOM Python Script

`ELBPCOM` is a simple demo script in Python (2.x) to verify LBP16 host communication. It accepts hexadecimal LBP16 commands and prints results.

```python
import socket

# Setup UDP Socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0)
sip = "192.168.1.121"
sport = 27181
s.settimeout(0.2)

while True:
    try:
        sdata = raw_input('>')
        if not sdata:
            continue
        sdata = sdata.decode('hex')
        s.sendto(sdata, (sip, sport))
        
        data, addr = s.recvfrom(1280)
        print('>') + data.encode('hex')
    except socket.timeout:
        print('No answer')
    except KeyboardInterrupt:
        break
```

#### Sample Communication Run:
1. **Read HostMot2 Cookie** at `0x100`:
   ```text
   >01420001
   >fecaaa55
   ```
   *(Returns `0x55AACAFE` in little-endian format)*

2. **Read EEPROM IP address** at `0x0020`:
   ```text
   >82492000
   >450a5863
   ```
   *(Returns `63:58:0A:45` which represents IP `99.88.10.69`)*

3. **Write custom EEPROM IP address** (to `192.168.0.1` / `C0:A8:0:1`):
   ```text
   >01D91A00025A82C920000100a8C0
   ```

---

## Specifications

| Parameter | Min | Max | Notes |
| :--- | :--- | :--- | :--- |
| **Power Supply** | | | |
| 5V Power Supply | 4.5V | 5.5V | Supplied via P4 connector |
| 5V Power Consumption | — | 2A | P4 Connector limit, depends on external load |
| 5V Power Consumption (No Load) | — | 250 mA | Typical current with no external IO load |
| Max 5V Current to I/O Connectors | — | 1000 mA | Limit per connector (P1 and P2) |
| **Environmental** | | | |
| Temperature Range (-C version) | 0 &deg;C | +70 &deg;C | Commercial grade |
| Temperature Range (-I version) | -40 &deg;C | +85 &deg;C | Industrial grade |
| **I/O Ratings** | | | |
| Input Voltage | -0.3V | 7.0V | 5V Tolerant through bus switches |
| Output Voltage (24 mA Sink) | — | 0.6V | FPGA outputs set for highest drive |
| Output Voltage (24 mA Source) | 2.4V | — | FPGA outputs set for highest drive |

---

## Card Drawing

Below is the mechanical layout and dimensions drawing of the 7I92T card:

![7I92T Card Drawing](images/card_drawing-41.png)
