Technica Engineering 100base-t1_SPY User manual

User Manual
Version 1.2
September 2017
BroadR-Reach –Standard Ethernet
100BaseT1_SPY

Page 1of 43
The user can download the latest firmware and documentation for the 100BASET1_SPY here:
http://www.technica-engineering.de/SPY
Note: This User Manual version is related to 100BASET1_SPY Firmware version 1.12.

Page 2of 43
Index
1 Feature List ..................................................................................................................................... 3
2 Warranty and Safety Information................................................................................................... 4
3 Pinning ............................................................................................................................................ 5
3.1 Power connector (top left)...................................................................................................... 6
3.2 BroadR-Reach connectors ....................................................................................................... 7
3.3 RJ45 Ethernet connectors ....................................................................................................... 8
3.4 SMA Connector........................................................................................................................ 8
4 Status LEDs and Pushbutton........................................................................................................... 9
5 Configuration Website.................................................................................................................. 10
5.1 Website Home....................................................................................................................... 11
5.2 System Information Tab ........................................................................................................ 11
5.3 Control Panel Tab .................................................................................................................. 12
5.4 Switch Status Tab .................................................................................................................. 13
5.4.1 Global Configuration: .................................................................................................... 13
5.4.2 Spy Multiplexer.............................................................................................................. 14
5.4.3 Gigabit Ethernet Ports................................................................................................... 15
5.4.4 BroadR-Reach Port ........................................................................................................ 16
5.4.5 CAN Port ........................................................................................................................ 18
5.4.6 LIN Port.......................................................................................................................... 22
5.4.7 FlexRay Port................................................................................................................... 25
6 Structure of an Ethernet 100BASET1_SPY RAW frame ................................................................ 26
6.1 Structure of the BroadR-Reach payload................................................................................ 28
6.2 Structure of the CAN payload................................................................................................ 29
6.3 Structure of the LIN payload ................................................................................................. 30
6.4 Structure of the FlexRay payload .......................................................................................... 32
6.5 100BASET1_SPY LUA Installation Guide................................................................................ 33
7 UseCases....................................................................................................................................... 35
7.1 100BaseT1_SPY UseCase....................................................................................................... 35
8 Hardware Variants........................................................................................................................ 36
8.1 BroadR-Reach Analog Filter................................................................................................... 36
8.2 Debug connector................................................................................................................... 36
8.3 Startup Time.......................................................................................................................... 37
9 Application Firmware Update....................................................................................................... 38
10 Frequently Asked Questions –FAQ .............................................................................................. 41
11 Contact.......................................................................................................................................... 42

Page 3of 43
1Feature List
The Technica Engineering 100BaseT1_SPY samples data Frames directly on the bus without influence
of the original network. The data Frames are enhanced with additional information as an exact
timestamp and the bus port the data was originally sent on. All data can be recorded on a PC or
datalogger for detailed offline analysis.
Timestamps are in 0.04 μs resolution and synchronous to all connected lines.
Optionally other UseCases (Frame Generator, Fault Injection, Data Manipulation, Trigger Generator,
… ) can be upgraded.
Features:
12x BroadR-Reach Ports Fullduplex 100 Mbit/s
1x FlexRay Channel A (option for transmission of StartUp & Sync Frames)
5x CAN / CAN-FD Ports
1x LIN, 1x SMA Trigger
4x Gigabit Ethernet Ports for Logging data output
1x Fast Ethernet Port for status output, configuration and webserver access
1x SD Card for configuration and storage of trigger events
Stainless steel case
Power requirement: 12 Volt DC Nominal (7-16 Volt)
Power consumption: 10 Watt
Size: 147 x 124 x 26mm
Weight: 0,9 kg
International Protection: IP 2 0
Operating Temperature: -40 to +80 °Celsius

Page 4of 43
2Warranty and Safety Information
Before operating the device, read this manual thoroughly and retain it for your
reference.
The latest firmware and documentation can be downloaded for the
100BASET1_SPY through the following link:
http://www.technica-engineering.de/SPY
Use the device only as described in this manual.
Use only in dry conditions.
Do not apply power to a damaged device.
Do not open the device. Otherwise warranty will be lost.
This device is designed for engineering purpose only.
Special care has to be taken for operation.
Do not use this device in a series production car.
As this device is likely to be used under rough conditions, warranty is limited to 1
year.
Manufacturer liability for damage caused by using the device is excluded.

Page 5of 43
3Pinning
The pinning of the ECU connectors is listed on the label on top of the device.
The Tyco Electronics (TE) Nano Micro Quad Lock System (NanoMQS) is used.
Name
Part Number
20POS
NANOMQS
REC HSG
CODE A
2141404-1
NANOMQS
RECEPTACLE TERMINAL
2-1703930-1
http://www.te.com/usa-en/product-2141404-1.html
http://www.te.com/usa-en/product-2-1703930-1.html
http://www.te.com/usa-en/product-4-1579014-0.html
http://de.farnell.com/te-connectivity/2-1703930-1/contact-socket-crimp/dp/2528666
Official Crimp Tool:
TE CONNECTIVITY CS11K NANO-MQS, 0.13-0.35 SQ.M
TE Internal Number: 4-1579014-0
Distributor:
Börsig GmbH
Siegmund-Loewe-Str. 5
74172 Neckarsulm
www.boersig.com

Page 6of 43
3.1 Power connector (top left)
Power supply for the device is supplied by Pin 18 (12Volt) and Pin 20 (Ground).
Requirements for the 100BASET1_SPY itself: 12 Volt DC up to 1 Ampere (typical 600mA)
Warning:If a voltage higher than 16 Volt is applied, the device will be damaged!
A wakeup-line may be connected on pin 5. The wakeup-line should have the same voltage level as
the power supply (12 Volt). A high level on one of these pins wakes up the ECU from sleep mode and
keeps it active.
Alternatively, the “Prevent sleep” checkbox in the control panel of the website can be enabled.
The CAN interfaces can be used to communicate with the Microcontroller by CAN and CAN-FD bus.
The LIN interface can be used to communicate with the Microcontroller by LIN bus.
The FlexRay interface can be used to communicate with the Microcontroller by FlexRay bus. In the
default software there is no data transmission specified.

Page 7of 43
Pin
Function
Pin
Function
1
GND Reference for Trigger
2
Host Trigger Line
3
LIN Bus
4
FlexRay Channel A BP
5
Wake Line
6
FlexRay Channel A BM
7
CAN D / 5 Minus (Low)
8
CAN E / 1 Plus (High)
9
CAN D / 5 Plus (High)
10
CAN E / 1 Minus (Low)
11
n.c.
12
CAN C / 2 Plus (High)
13
CAN B / 4 Minus (Low)
14
CAN C / 2 Minus (Low)
15
CAN B / 4 Plus (High)
16
n.c.
17
CAN A / 3 Minus (Low)
18
Battery +12 Volt Input
19
CAN A / 3 Plus (High)
20
Battery Ground Input
3.2 BroadR-Reach connectors
The pins marked with (P) or (M) are used for the BroadR-Reach ports.
The user has to connect the (P) pin to the (P) pin of the periphery device.
The user has to connect the (M) pin to the (M) pin of the periphery device.
Note: If these two pins are swapped, the link LED may be lit on the BroadR-Reach slave side, but no
data transmission will be possible.
Middle Connector
Pin
Function
Pin
Function
1
GND Reference for Trigger
2
FPGA Trigger Line OUT1
3
n.c.
4
n.c.
5
BroadR-Reach Port 3A / 5, P (Positive)
6
BroadR-Reach Port 3B / 6, P (Positive)
7
BroadR-Reach Port 3A / 5, M (Negative)
8
BroadR-Reach Port 3B / 6, M (Negative)
9
n.c.
10
n.c.
11
BroadR-Reach Port 2A / 4, P (Positive)
12
BroadR-Reach Port 2B / 3, P (Positive)
13
BroadR-Reach Port 2A / 4, M (Negative)
14
BroadR-Reach Port 2B / 3, M (Negative)
15
n.c.
16
n.c.
17
BroadR-Reach Port 1A / 1, P (Positive)
18
BroadR-Reach Port 1B / 2, P (Positive)
19
BroadR-Reach Port 1A / 1, M (Negative)
20
BroadR-Reach Port 1B / 2, M (Negative)
Outer Connector
Pin
Function
Pin
Function
1
GND Reference for Trigger
2
FPGA Trigger Line IN1
3
n.c.
4
n.c.
5
BroadR-Reach Port 6A / 9, P (Positive)
6
BroadR-Reach Port 6B / 12, P (Positive)
7
BroadR-Reach Port 6A / 9, M (Negative)
8
BroadR-Reach Port 6B / 12, M (Negative)
9
n.c.
10
n.c.
11
BroadR-Reach Port 5A / 8, P (Positive)
12
BroadR-Reach Port 5B / 11, P (Positive)
13
BroadR-Reach Port 5A / 8, M (Negative)
14
BroadR-Reach Port 5B / 11, M (Negative)
15
n.c.
16
n.c.
17
BroadR-Reach Port 4A / 7, P (Positive)
18
BroadR-Reach Port 4B / 10, P (Positive)
19
BroadR-Reach Port 4A / 7, M (Negative)
20
BroadR-Reach Port 4B / 10, M (Negative)

Page 8of 43
3.3 RJ45 Ethernet connectors
There are four RJ45 Standard Ethernet connectors of the front side for Gigabit Ethernet.
There is one RJ45 Standard Ethernet connector of the front side for Fast Ethernet (100 Bit/s)
3.4 SMA Connector
There is one shielded SMA Connector for one Trigger Input/Output Line.

Page 9of 43
4Status LEDs and Pushbutton
The 100BASET1_SPY has several status LEDs at the front side of the case.
The “Host” LED1 can toggle at three different speeds:
Slow toggle (approx. 0.5 sec) during normal operation to show that the microcontroller is running in
normal mode.
Fast toggle (approx. 0.1 sec) when the microcontroller is in bootloader mode. The bootloader mode
is used for firmware update only (see below in this manual). The user cannot access the website
when the device is in bootloader mode.
When the device is in Bootloader-Update Mode the LED toggles with moderate frequency (approx.
0.25 sec).
The “Host” LED2 should be normally off. If it toggled at high speed (approx. 0.1 sec) an error has
been detected by the Host.
The “FPGA” LED2 can toggle at two different speeds:
Slow toggle (approx. 0.5 sec) during normal operation to show that the FPGA is running in normal
mode.
Fast toggle (approx. 0.1 sec) : TBD
The “FPGA” LED1 should be normally off. If it toggled at high speed (approx. 0.1 sec) an error has
been detected by the FPGA.
The 12 port status LEDs 1A to B6 monitor the link status of the corresponding port. The LEDs are lit
when there is BroadR-Reach link detected.
Note: There is an issue when P/N of the bus are swapped. The LED may be on in this case on BroadR-
Reach slave side, but there will be no data transmission possible.
The built-in LEDs in RJ45 connector shows the status of the gigabit ports. The left (orange LED) is lit
by a link-up. The right (yellow) will blink on data traffic.
The Rotary DIP Switch has four modes:
1: TBD
2: TBD
3: TBD
4: TBD

Page 10 of 43
5Configuration Website
The user can access the configuration website with a standard web browser.
Note: Firefox is recommended; Chrome is not recommended.
Connect your PC to the “Host” RJ45 connector.
The default IP address of the device is 192.168.0.49 and subnet mask 255.255.255.0
If IP address has been changed, The user can reset it to default as described in chapter 9 of this man-
ual.
For example set the configuration PC to IP address 192.168.0.100 and subnet mask to 255.255.255.0
Note: Please, make sure that the Internet Protocol Version 6 (TCP/IPv6) option is disabled.

Page 11 of 43
5.1 Website Home
With the first access to the website The home screen will be shown. Please select one of the tabs for
further configuration.
5.2 System Information Tab

Page 12 of 43
On the tab „System Information“ some status information about the device is displayed. The user can
check the version number of the application firmware and the bootloader or the unique MAC adress
of the device. The version number registers of the switch and phy chips are displayed for information
only.
The MAC adress should be the same as on the label on the bottom of the device.
The IP adress of the host microcontroller (Webserver) can be changed here. If the user wants to use
multiple devices in one network, an unique IP adress for each device must be set here.
Note: Before installing a new firmware, please restore the IP Address to the default one:
192.168.0.49. In order to restore the IP, please see Section 9.
5.3 Control Panel Tab
On the „Control Panel“ tab The user can soft-reset (restart) the system.
Also the configuration settings of the device can be imported and exported to a file (*.bin) on a
computer connected to the RJ45 Port. The user have to restart the device for usage of the new
configuration.
The user can reset the configuration settings to default. All the configuration stored will be revert to
its defaults values.
If you do not want to use a WakeUp line, The user can enable the “Prevent sleep” checkbox (default).
This will keep the device running without entering the sleep mode.

Page 13 of 43
5.4 Switch Status Tab
The main configuration of the switch is done in the „Switch Status“ tab.
Here the user can configure details about each port and get some status information about the ports
and switch states.
On the left side of the page the user can see an overview of all available ports. A blue bar at the side
of a port label indicates an active link.
5.4.1 Global Configuration:
When the user click on „Switch Status“ tab and no port or switch is still selected, Global
configuration will appear.

Page 14 of 43
5.4.2 Spy Multiplexer
Click on the central „Spy“label to configure general Spy Multiplexer settings.
Enable header for logging ports: This option enables the Header Mode of the 100BASET1_SPY.
For BroadR-Reach Ports the original Ethernet frames will be wrapped in a new Ethernet Frame. This
new frame will contain additional data (timestamp, ingress port, …) and the original RAW frame. The
new Frame will be transmitted through the selected Gigabit Port. See frame format information in
Chapter 6.
For CAN, LIN and FlexRay frames the wrapper is necessary for the data to be recognized as Ethernet
frame.
Note: When the user makes any change in the configuration of any port, the Save Configuration
option will appear. Select the Restart after saving option before saving configuration.

Page 15 of 43
5.4.3 Gigabit Ethernet Ports
There are four Gigabit Ethernet Ports for data logging output at the front of the device. On the web-
site the user can see the status by clicking on the GB-A to GB-D labels on the left side.
Detected speed: Shows the result of link negotiation. Speed and half/full duplex information.
BroadR-Reach Inputs: This is a configuration status information. It shows which BroadR-Reach ports
are connected to the selected Gigabit port.
Auxiliary Inputs: This shows which CAN, LIN and FlexRay ports are connected to the selected Gigabit
port.

Page 16 of 43
5.4.4 BroadR-Reach Port
The BR-1A to BR-6B labels on right side allow the user to configure BroadR-Reach Port settings:
BroadR-Reach mode:Here the user can select Master/Slave Mode of the selected Port. On each
BroadR-Reach link there has to be one master and one slave device.
Please set the “BroadR-Reach mode” to the opposite of what the device which is connected to this
port.
Output level: The “Output Level” is the amplitude level of the BroadR-Reach signal. The user can set
Full level (Fullout = default) or half amplitude.
Note: Both devices of one BroadR-Reach link have to use the same level. Otherwise the user will get
an instable link. FullOut Level is always recommended.

Page 17 of 43
Test Mode: For BroadR-Reach Ports it is possible to set a BroadR-Reach Physical Layer Test Mode.
There are five test modes defined in the BroadR_Reach Specification to check the compliance of a
port.
Warning: When a test mode has been selected there is no communication possible for this port.
Note: For compliance testing an oscilloscope with special test software is necessary.
Output to: The BroadR_Reach Ports are always connected A-B for each channel pair. This setting
allows a copy of the A-B communication to be sent to a Gigabit port. Choose here which Gigabit port
will be connected with the selected BroadR-Reach port.
BR PAIR ID: Specifies the multiplexing between two BroadR-Reach ports. For example, if the user
wants to connect BR1A with BR5A, BR PAIR ID in both ports must have the same value.
Note: If more than two BroadR-Reach ports have the same BR PAIR ID, only the two first ports will be
connected. For example, if BR1A, BR1B and BR2A have the same BR PAIR ID, only BR1A and BR1B will
be connected between them.
Note: The BR PAIR ID value must be greater than 0. If two BroadR-Reach ports have this field set to 0,
those ports will be not connected.
TX/RX Packets: These two counters show the number of transmitted and received packets through
the selected BroadR-Reach port.

Page 18 of 43
5.4.5 CAN Port
The CAN-A to CAN-E labels on the left allow the user to configure:
Output to: Allows to select which Gigabit port will be used to output logging data of selected CAN
port. To activate the port logging, the Header must be enabled in the Spy Multiplexer page (see
Chapter 5.4.2.)
CAN Type:Allows to select between CAN or CAN-FD operation mode.
CAN mode: Allows to select if the CAN port is working as Spy or Slave. In both modes, the
100BASET1_SPY will logg the information. In the Spy mode the device will be passive and send no
ACK signals.
Bit Rate:Allows to select the CAN 2.0. Bit Rate. Available options: 62500bps, 100kbps, 125kbps,
250kbps, 500kbps, 1Mbps.
In CAN-FD transmission mode, FD Rate will be selectable. In CAN-FD, the Bit Rate determines the
Arbitration-Phase Bit Rate in CAN-FD protocol, while the FD Rate determines the Data-Phase Bit Rate
in CAN-FD protocol. The available options in FD Rate are 2Mbps and 5Mbps.

Page 19 of 43
Note: The CAN ports are able to work like receivers and transmitter at the same time.
Note: In the case of CAN-FD, the selected Bit Rate must be always 500kbps or 1Mbps. The device
does not work with Bit Rate lower than those values.
Note: Please set the Bit Rate and FD Rate to the same value of what the device is connected to this
port.
Note: If the 5Mbps FD Rate needs to be used, , please be sure that the transceiver of the opposite
device can work with rates higher than 2Mbps.