(Last updated Saturday, January 11, 2003: added pointer to log file)

The HP5400/HP5470 types of scanner are color USB scanners with a resolution of 2400 dpi. They are not supported under Linux yet. The info on this page is aimed at making them work under Linux and similar operating systems. Scanners can be supported under Linux using the Sane package.

Transfer protocol

The transfer protocol allows reading/writing of command data by means of USB control transfers and reading/writing of bulk data (reading image data and writing gamma/calibration data) by means of USB bulk transfers.

Scanner commands

Command and response data is exchanged using USB control transfers. Each read or write takes several of them. The fields inside the USB control transfer are used as follows:

• RequestTypeReservedBits: 0xC0 when writing, 0x40 when reading data
• Request: 0x0C for 1 byte transfered, 0x04 when more bytes are transfered
• Value: the scanner command / register code. High byte = high-level command. Low-byte = low-level register.
• Index: probably not relevant
• TransferBufferLength: length of command data
• Data: the data

Reading command

Reading command date is done by sending a USB control transfer as shown above. The response to the control transfer contains the requested command response. Next 2 bytes are read with command 0xc500, which usually results in a response that contains the command of the actual read (although the low byte is 0x00).

Writing command

Writing command date is done by sending a USB control transfer containing the command data. Then, just like with reading a command, 2 bytes are read with command 0xc500.

Reading/writing bulk data

Reading and writing of bulk data is somewhat similar to how it is done on the HP3300c. Three pseudo-parallel port registers are written to prepare the bulk transfer:

• A command write with value=0x0087 and data=0x14 (on the HP3300 this sets the data direction)
• A command write with value=0x0083 and data=0x24 (on the HP3300 this prepares the bulk data transfer)
• A command write with value=0x0082 and data=0x00 0x00 0x00 0x00 0x00 0xf0 0x00 0x00 (On the HP3300 this sets the bulk transfer length too, in this case 0xF000)

Scanner commands overview

Low-level commands

command	length	meaning
0082	8	Data transfer length
0083	1	Data transfer register
0087	1	Data direction register

High-level commands

command	R/W	length	meaning
0000	W	?	Written with 0x01
01xx	R	1	Returns 0x00
12xx	R	50	Scanner version string and info
15xx	W	2	DPI or LPI?
1bxx	W	1	Written with either 0x00 or 0x40
20xx	R	2	During replug: returned 00 00
23xx	W	10	During replug: written with 03 00 00 00 00 3f 04 00 00 c3
25xx	W	32	Scan settings: DPI, scan position, lighting?
2axx	W	3	Written with 02 00 00
34xx	R	16	???
c0xx	W	4	During replug: written with 02 03 03 3c
c5xx	R	2	Previous command issued
d6xx	W	1	Written with 0x04
f0xx	R	x	Read UI texts
f1xx	W	x	Write UI texts
f2xx	W	1	UI text pointer

12xx: scanner info

Example of data read using this command:

00 53 69 6c 69 74 65 6b 49 42 6c 69 7a 64 20 43	\SilitekIBlizd C
33 20 53 63 61 6e 6e 65 72 56 30 2e 38 34 09 60	3 ScannerV0.84
09 60 4f b0 6d b0 00 00 00 00 00 00 00 00 00 0a 	
00 64 	

0x0960=2400 in bytes 0x1e/0x1f and 0x20/0x21 show max resolution in x and y?
0x4fb0=20400 and 0x6db0=28080 is height and width in units of 1/2400 inch?

25xx: scan settings

An example of the data written with this command from an USB log

08 00 96 00 96 00 00 00 00 09 f6 0d b6 00 80 00 	
40 08 e8 00 00 64 00 64 00 64 00 00 00 00 00 00 	

0x0096=150 in bytes 0x01/0x02 and bytes 0x03/0x04 is probably the resolution (vertical and horizontal)
0x09f6=2550 and 0x0db6=3510 look like width and height respectively, in units of 1/300 inch. This corresponds to 21.59cm and 29.72cm.
0x0064=100 in bytes 0x14/0x15 and further could be something related to each color component (R,G,B), lighting or contrast perhaps?