[sane-devel] HP5400 USB transfer protocol analysis

[Bertrik Sikken]

Hi all,

I got an inquiry about support for the HP5400 type of scanners.
(because I'm writing a backend for 'niash' chip scanners; the
HP5400 contains a niash00033 chip).

I have a USB snoopy log of the activity after plugging in the
scanner under Windows. The USB transfer protocol seems completely
different from the one used by other 'niash' type scanners.
( see http://home.kabelfoon.nl/~bertrik/plugin_hp5470c.log )
Analysing it was fun, but perhaps one of you people have
already seen the same transfer protocol so that would save
a lot of time.

Anyway, here's my analysis.
Every command basically consist of four control transfers
a) PC sends a command (+ data), the 'value' field contains the
command ID. Request field = 04 means 'read'. Request field = 0c
means 'write' (RequestTypeReservedBits also change depending on
read/write)
b) Scanner sends data back in case of a read.
c) PC sends a transfer with request field = 04, value field = c500
This means probably: read register c500
d) Scanner sends two bytes to indicate the command used in a),
but with one of the bytes equal to 0. I assume this is a check
to see if the command was received OK.

Apparently command 0x1200 retrieves version info from the scanner
("SilitekIBlizd C3 ScannerV0.84"). I strongly suspect Silitek is
the manufacturer of the niash type of scanner control chips.
Command 0xc500 retrieves the previous command ID.
Commands 0xf10b and 0xf10c write user interface texts to use on
the LCD display.
("Verarbeitung\x14\x0 Bereit\x0 Scanner verrieg.\x0 Fehler\x0
Vorgang wird abgebrochen\x14\x0 Energiesparmodus\x0 Scannen\x14\x0
ADF-Papierstau")
Commands 0xf00b and 0xf00c read the texts back for verification.
For some reason command 0xf200 is alternatingly written with 0x00
and 0x40 when reading and writing the user interface texts.
The last thing in the log is a bit odd I think; a 1-byte bulk
transfer is done, but nothing is coming back yet.

Does this transfer protocol look familiar to anyone?
Is "Silitek" perhaps reported by any other scanner?

Kind regards,
Bertrik Sikken