This page is about the "production" version of the setup described in ICE40_based_passive_tap.

It is a bi-directional, high-impedance passive tap for E1 (PRI/S2M) tracing. It traces both directions of a link simultaneously via two LIU (Line Interface Units) attached to an iCE40 FPGA with E1 framer + USB softcores.

The traces are sent as isochronous USB transfers to the host PC, where they can (for example) be stored on disk.


Hardware files can be found at: and are available as Open Source Hardware.

3U component carrier assembly

e1_tracer-bgt-1.jpg e1_tracer-bgt-2.jpg e1_tracer-bgt-3.jpg e1_tracer-bgt-4.jpg

design files

We originally started with a prototype from an iCE40 evaluation board plus two osmo-e1-xcvr and one e1-tap as described in ICE40_based_passive_tap.

Meanwhile, we have designed a fully integrated board. Design files are part of the osmo-e1-hardware.git repository.

gateware + firmware

The FPGA gateware and RISC-V softcore firmware are found in the osmo-e1-hardware.git repository, under the gateware and firmware/ice40-riscv/e1-tracer directories respectively.


to bring up the board after manufacturing there are 2 steps:

  • flash the padded bootloader into spi flash
  • flashing the runtime gateware and application via dfu

flashing the bootloader

this involves pulling the _CRESET line on the spi programming header next to ground (the pin next to gnd) to keep the fpga in reset while we access the flashchip.
the board can be powered via usb for this, but the spi programming cable should not have a vcc line connected then.
the 1M0xff.bin file consists of 0xFF and is used as padding for the unused flash areas.
the tool used for flashing here is flashrom via a stm32(bluepill) based adapter ("STM32 virtual serprog for flashrom") but virtually any spi programmer can be used.

cat e1tracer-bootloader-20200822.bin 1M0xff.bin > tmp
dd if=tmp of=flashme1M.bin bs=1024 count=1024
rm tmp
flashrom -p serprog:dev=/dev/ttyACM3:4000000 -w flashme1M.bin

flashing the runtime

to access the bootloader the first time, before any runtime is flashed you need to reset the board (power) while SW1 (button) is pressed to force bootloader(dfu) mode. the board should now enumerate on usb

flashing should be easy - it only needs the regular userspace tool dfu-util and
dfu-util -d 1d50:6150 -c 1 -a 0 -D e1-tracer-gw-c7566442.bin
dfu-util -d 1d50:6150 -c 1 -a 1 -D e1_tracer-fw-0.1-141-g6cb6e6e.bin -R


Fully assembled products based on this hardware are going to be made available by sysmocom


The very basic/hackish host software is found in the e1-recorder branch of ice40playground.git, see

There are two related programs:

  • main - the program used to perform recordings and store them
  • dump - the program to analyze recordings
Files (5)
e1_tracer.jpg View e1_tracer.jpg 293 KB laforge, 09/02/2020 09:56 PM
e1_tracer-bgt-1.jpg View e1_tracer-bgt-1.jpg 657 KB laforge, 12/23/2021 04:59 PM
e1_tracer-bgt-2.jpg View e1_tracer-bgt-2.jpg 942 KB laforge, 12/23/2021 04:59 PM
e1_tracer-bgt-3.jpg View e1_tracer-bgt-3.jpg 1.09 MB laforge, 12/23/2021 04:59 PM
e1_tracer-bgt-4.jpg View e1_tracer-bgt-4.jpg 733 KB laforge, 12/23/2021 04:59 PM

Updated by laforge over 1 year ago · 13 revisions

Add picture from clipboard (Maximum size: 48.8 MB)