SFPTotal Plus

From SFPTotal Wiki
Jump to: navigation, search
Programmer SFPTotal Plus

SFPTotal Plus - new version of universal programming board, which allows to reprogram GBIC, SFP, SFP+, XFP and QSFP transceivers and DAC or AOC cables.

For working with GBIC, XFP, and QSFP transceivers were added additional power supply plans, as well as control elements. The programmer connects to PC via USB interface through which performed control and power supply of transceiver. An external supply adapter is provided for work with high-powered transceivers with an overestimated power consumption (for example, transceivers for 40/80/120 km links).


Programmers SFPTotal are used to solve next tasks:

  • Programming SFP/SFP+, XFP, QSFP, GBIC optical transceivers and twinaxial cables
  • Providing of compatibility between network equipment of different manufacturers
  • Reflashing memory of write-protected transceivers
  • Changing settings of PHY controllers
  • Branding for OEM transceivers
  • Diagnosis transceiver by reading the DDM
  • Accounting for optical transceivers

Quick start guide

  1. Connect SFPTotal Plus board to your PC using micro USB Type B cable
  2. Install drivers for SFPTotal Device
  3. Download application SFPTotal Wizard
  4. Start SFPTotal Wizard
  5. Insert transceiver to the programmer port
  6. Reading transceiver's memory

Listing of elements

Listing of elements placed on circuit board of SFPTotal Plus programmer.

1. Transceiver ports

P2 - SFP, SFP+ port

P11 - QSFP, QSFP+, QSFP28 port

P9 - XFP port

P7 - GBIC port

2. Power supply plans

P1 - power supply of SFP port, a pair of 3.3 V for VccT and VccR pins.

P17, P16, P15 - power supply of QSFP port, 3.3 V for Vcc1, VccTx and VccRx pins.

P12, P14, P13, P10 - power supply of XFP port: 3.3V, -5V, 5V and 1.8 power supply plans.

P8 - power supply of GBIC port, switch between 3.3V or 5V. For default, closed in 3V3 position.

3. Jumpers

P3 - low power mode, keep closed to disable low power mode (TX enable).

P4 - RS1 (position 1-2) and RS0 (position 3-4) pins.

P18 - QSFP ModSelL

The ModSelL is an input pin. When held low by the host, the module responds to 2-wire serial communication commands. The ModSelL allows the use of multiple QSFP modules on a single 2-wire interface bus. When the ModSelL is “High”, the module shall not respond to or acknowledge any 2-wire interface communication from the host. ModSelL signal input node must be biased to the “High” state in the module.


Notice: The programmer automatically switches the contact to "Low" level when performing read and write operations on the data bus.

P19 - QSFP ResetL

P20 - XFP ModDeSel

The Mod_DeSel is an input pin. When held Low by the host, the module responds to 2-wire serial communication commands. The Mod_DeSel allows the use of multiple XFP modules on a single 2-wire interface bus.
When the Mod_DeSel pin is “High”, the module shall not respond to or acknowledge any 2-wire interface communication from the host. Mod_DeSel pin must be pulled to VCC3 in the module.


Notice: The programmer automatically switches the contact to "Low" level when performing read and write operations on the data bus.


This is a multifunction pin for module Power Down and Reset. The P_Down/RST pin must be pulled up to VCC3 in the XFP module.


4. Interfaces

P5 - USB interface for connection to PC

P22 - I2C databus, logic level 5V

5. LED indicators

POWER - should statically light when board connected to USB or to external supply adapter.

MCU - indication of power supply for microcontroller.

ERROR - should glow when unhandled errors occur on the data bus, for example: connection more than 1 transceiver.

STATUS - should blinking when transceiver is not connected and statically light when transceiver is connected.

Management interface

The device provides access to management interface (CLI) by connecting through a virtual serial port. You can use the programming board without SFPTotal Wizard software to get more features or to realize the opportunities that are not available in the standard software. Use this document to get information about commands which supported by SFPTotal Plus.

Serial port settings

Serial port settings

You can access the command line interface of the programmer not only with the SFPTotal Wizard, but also with the help of utilities for working with the serial port. For example, Putty.

The boards are support a flexible baud rate, but we recommend use value 115200.

Default settings
Baud rate: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None

Configuration commands


After reset the programmer does not display in the interface characters entered from the keyboard. The command switches the echo output of command line. Default, CLI=0.



Set CLI=1 to turn on echo.


Commend returns current state GPIO for each port.



Command allows to disable power supply of transmitter for switching to low power mode (LPMODE). To activate the LPMODE, it is necessary to transfer command TX_DIS setting the flag value of 1.

To disable the mode, you must set the flag equal to 0. The current state can be requested with STATUS command.




Low power mode is activated for default. On the PCB of SFPTotal boards are placed contacts LP_MODE, which allows to switch low power mode in manual mode.


Command returns information about device: hardware revision, software version and unique serial number of the device.

SFPTotal Plus (c) 2015-2016
HW: 1.1
SW: 1.0.5
SN: SFPT-P1116021001


Note: Supported only on the SW versions 1.1.0 or above

This command sets the speed of I2C data bus.

I2CRATE=12 # Set up speed rate 100 kHz
I2CRATE=40 # Set up speed 30 kHz
I2CRATE=C6 # Set up speed 10 kHz

To request a current speed use command: ? I2CRATE



Note: Supported only on the SW versions 1.2.2 or above

This command sets the interval between operation of I2C data bus. Value equal to milliseconds in Hex format.

I2CPAUSE=20 # Set interval 32ms
I2CPAUSE=32 # Set interval 50ms (for default)
I2CPAUSE=64 # Set interval 100ms

To request a current interval use command: ? I2CPAUSE



The command set number bytes in block of write. Default, BPS=08


BPS=01 # Set block size in 1 byte
BPS=08 # Set block size in 8 bytes (default)
BPS=FF # Set block size in 255 bytes

By default, the recording is performed by blocks of 8 bytes. For the programming of some transceivers with protection, it may be necessary to change the block size, for example, writing by each byte (BPS=01) or writing the entire block as a whole (BPS=FF).


Note: Supported only on the SW versions 1.1.0 or above

If the flag is set, the programmer will automatically change the address of the additional tables before performing reading and writing operations.


To request a current value use command: ? AUTO_WR_ADDTBL


Read and write


Command for reading memory of transceiver.

Read 128 byte(s) Table 0xA0 from 0x00

##    00  01  02  03  04  05  06  07  08  09  0A  0B  0C  0D  0E  0F

00 :  03  04  07  20  00  00  00  00  00  00  00  06  67  00  0A  64
01 :  00  00  00  00  4F  45  4D  20  20  20  20  20  20  20  20  20
02 :  00  20  20  20  00  00  00  00  31  30  47  42  2D  53  46  50
03 :  2D  4C  52  2D  45  20  20  20  31  2E  30  20  05  1E  00  F9
04 :  00  1A  00  00  45  58  50  39  36  4C  30  31  31  20  20  20
05 :  20  20  20  20  31  31  30  38  30  39  20  20  68  F0  03  02
06 :  45  58  54  52  45  4D  45  20  4C  52  00  00  00  00  00  00
07 :  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00


Command for writing to the memory of transceiver.

w — (1 byte) — Write command. Symbol register is responsible for the subsequent read after write. If you use uppercase (W) after the recording is complete programmer will make reading the memory area which has been overwritten. To write without return a write result of lower case (w) must be used.

X — (1 byte) — Transceiver type (1 - SFP, 2 - SFP+).

YY — (2 bytes) — The device address on the I2C bus.

AA — (2 bytes) — Address of additional table.

BB — (2 bytes) — Address table. Value in HEX. For example: A0 or A2.

СС — (2 bytes) — Write byte count. Hexadecimal value reduced by one. For example, for writing 128 bytes you should set this parameter in 7F (0x7F in HEX, 127 in decimal).

{DATA} — Write data in HEX, 2 characters for each byte of the parcel.


Write code 128 bytes in Table A0 Upper address 00 for SFP transceiver:


Write password 0123 (HEX: 30h 31h 32h 33h) in Table A2 address 7B for SFP+ transceiver:


Note: Write command should type without newline characters and spaces. Shifts are given for the convenience display of the material in the examples.

Brute-force mode

Starting from SW 1.2.3 firmware version has been added the function that allows searching for a password in brute mode without using the SFPTotal Wizard software. It mean that programming board can check passwords by itself in wide range of values.

How does it works?

To check the password programmer should make few operations:

  1. Enter password in password area
  2. Write a check word to Vendor name area
  3. Read vendor name area
  4. Compare a check word with vendor name.

The programmer goes through the password values sequentially within the specified range. By default, the programmer write a check word "SFPTOTAL" (8 bytes) in Table A0h with offset 14h. Then it compares the data that was read after the control word was written.

If the read data is the same as the control word, then it mean the record is successful. The programmer will stop the brute-force process and return the current password as a result of a successful search.

We are developed this function for searching passwords to MSA compliant transceivers. Anyway, you should check the documentation and standards for your module before using brute-force mode.


The command sets the password search parameters and starts the brute-force process.


A2 - address of Table, where must be entered a password. For XFP and QSFP address should be set in A0.

7B - offset for entering a password

AAAAAAAA - start of range

FFFFFFFF - end of range

CCCCCCCC - value from where should be started brute-force process

Recommended ranges for search:

BFSET A2 7B 41414141 5A5A5A5A 41414141 # A-Z

BFSET A2 7B 61616161 7A7A7A7A 61616161 # a-z

BFSET A2 FC 30303030 39393939 30303030 # 0-9

BFSET A2 7B 20202020 7A7A7A7A 24367621 # Symbols + Numeric + Literal


Use command BFSTOP to stop brute-force process. You could continue from this point using command BFSTART.


Use command BFSTART to continue brute-force progress from last point.


Use command ? BFPASS to get know current password in brute-force progress.


Set device address of entering check word. Fo example, BFCWADR=A0


Set offset parameter for entering check word. For default, BFCWOFT=14.

Note: for XFP and QSFP transceivers use BFCWOFT=94.

How to start brute-force for SFP+ transceiver?

BFSET A2 7B 20202020 7A7A7A7A 20202020

How to start brute-force for XFP transceiver?

Set jumper on P20 contact on programming board.

BFSET A0 7B 20202020 7A7A7A7A 20202020