EEVblog Electronics Community Forum
Electronics => Projects, Designs, and Technical Stuff => Topic started by: tmbinc on April 26, 2017, 06:09:29 pm
-
As outlined in https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/ (https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/), I started to look into re-writing the RigolDS10xxZ firmware. The goal is to provide new software for the iMX as well as for the FPGA so we have an open-source (software) scope that's easily hackable. To be very plain: this hasn't happened yet. But I still want to open this thread in case other people want to work with me.
Motivation
The motivation for this effort is that the Rigol DS10xxZ is a dirt-cheap scope with okay-ish hardware that's hackable. Other scopes either have inferior hardware, are more expensive, have weird application processor architectures for which no open toolchains (compiler, debugger, infrastructure in general) exist, or use ASICs. The DS10xxZ is in sweet spot where it's affordable, uses off-the-shelf chips, ARM architecture, Xilinx Spartan-6 FPGA (for which a free toolchain exists), and is decently-spec'ed. I understand there are other scopes which are similar, but it seems the Rigol one is most popular.
(It is a valid question whether a Zynq-based scope would be a better target, and I would immediately say "yes" if availability for these wouldn't be so poor at a sub-400EUR price point.)
What I have today
(https://pbs.twimg.com/media/C3q_XQlWMAECEmq.jpg)
I can boot Linux, which means we have:
- USB
- LCD/Framebuffer
- Ethernet
- Frontpanel LEDs
- Frontpanel buttons
u-boot is here: https://github.com/tmbinc/rigol-uboot (https://github.com/tmbinc/rigol-uboot)
I load u-boot via JTAG/OpenOCD and then boot from USB-storage, I haven't yet looked into writing u-boot to flash. I'm not saying that Linux is the ideal choice, but it's a good test vehicle to validate that the hardware works.
There's a lot of things to figure out - including the whole "scope" part, the FPGA pinout, the FPGA<>iMX communication.
I can add more information if other people are interested in this.
-
NICE! :-+ :clap:
-
Thanks for starting a dedicated thread for this project. It certainly deserves it. Definitely continue adding info and progress updates to pique interest.
-
Nice Project :-+ as far you know, there are some possibility to add support for logic analyzer?
Many thanks
-
Link in OP doesn't work as it's got a comma embedded at the end of the URL.
Fixed:
https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/ (https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/)
-
Sorry, fixed it.
Here's a random dump of things that need to be done (and with an estimation of difficulty), non-exhaustive of course.
S: Figure out JTAG port to Xilinx FPGA pinout (Thank you, JJalling! https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1195497/#msg1195497 (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1195497/#msg1195497))- S: document findings in more details (frontpanel, IO, ...) in a public wiki
- S: find a better serial port for debug spew than the frontpanel IO
- M: Figure out connections between FPGA and iMX
- M: figure out existing iMX<>FPGA protocotol
M: reverse input stage (analog stage etc., similar to what has been done for other scopes) Done, thanks Dave and Ink (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1202261/#msg1202261 (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1202261/#msg1202261))- M: figure out, and reverse, role of the Actel FPGA
- M: figure out FPGA pinout to ADC
- M: figure out FPGA to memory pinout
- M: figure out how to easily (i.e. without risk to brick the thing) run custom code without opening the case
- L: reverse full scope PCB to schematics
- L: write host demo code to interface with existing FPGA and drive basic scope functionality
- L: re-implement FPGA firmware
- XL: architect and implement a "scope application"
Feel free to grab one of these items and work on it :).
-
Great to see this effort! :-+
I will be following this for sure.
-
Sound promissing :-+ :-+
I have bookmarked to following this.
-
- S: Figure out JTAG port to Xilinx FPGA pinout
I have attached a picture of the JTAG pinout of the FPGA
BR Jonas
-
:-+
Out of curiosity, what in particular would you be looking to improve in an eventual open-source firmware versus the standard firmware? Obviously there's a lot of work to do just to get to parity with the factory firmware, but just curious about your ultimate motivation.
-
Same as any open source initiative - the ability for anyone to then modify or implement a feature for his needs.
Off the shelf products always do 99% of the things you want, but there's no way to get that last 1% unless the manufacturer happens to add it. If there's a decent open base you can code it yourself.
-
Off the shelf products always do 99% of the things you want, but there's no way to get that last 1% unless the manufacturer happens to add it. If there's a decent open base you can code it yourself.
There's also changing the way the manufacturer did things to better suit your requirements, workflow, etc. Granted, an open source project don't always result in something that's on par or better than the original, but it opens the possibility to do more, do it differently, or keep it going longer than the manufacturer wants to support it.
-
If it was pretty much anyone except Felix Domke behind this project I'd dismiss this as a wildly overambitious pipe-dream... but now I'm excited! :-)
-
If it could come anywhere close to the success of the open source firmware available for popular broadband routers then that would really be something. A scope seems a lot more complex, at least on the surface, but perhaps it's actually not. I don't know how much of the "magic" is done in hardware and how much relies on the software.
-
- M: Figure out connections between FPGA and iMX
- M: figure out existing iMX<>FPGA protocotol
What i.MX is that? I'm currently repurposing a kindle 4 as a datalogger (I love that eink display), it's an i.MX508. Amazon has published most of the gpled code and there's a lot of info @ mobileread.com. Have you managed to get any sources? from Rigol perhaps? That would help a lot.
-
It's an i.MX28 (http://www.nxp.com/assets/documents/data/en/data-sheets/IMX28CEC.pdf (http://www.nxp.com/assets/documents/data/en/data-sheets/IMX28CEC.pdf)), so it's really not awesome (and still an ARM926, i.e. ARMv5T).
As far as I know, Rigol didn't use any GPL'ed code. Other than that, most of the i.MX28 functionality works - it's rather everything scope-specific that we need to figure out.
-
Just so there's a reference to it in this thread: There's a wiki that has some schematics and other assorted hardware info for the DS1052, here: http://rigol.codenaschen.de/index.php/Main_Page (http://rigol.codenaschen.de/index.php/Main_Page)
-
I don't know how much of the "magic" is done in hardware and how much relies on the software.
I suspect there will be a fair bit of disassembly and reverse engineering of existing firmware in this project.
-
Oh, what a pity, that -to me- sounds like bad news. I can read the sources of the eink driver and not have to figure it all out. Or see exactly how/what does it do to read the battery's mAh from the gas gauge chip, etc.
But my project is essentially different because as I'm not trying to use the kindle as a kindle anymore I don't need to use nor understand any of its apps (whose sources aren't available), but you will have to. I have even deleted them already! With the sources headers and configs I can compile my own drivers and apps and be happy.
But no sources at all? No, I for one would be totally lost if I were you!
-
But I have a Guinea pig ^w^w 1074Z-S. If it can be of any help just let me know :-)
-
Hi,
saw this featured on Hackaday, so i decided to join the party. I call a Rigol MSO1104Z (one with logic analyzer) my own. I like the scope, but i think it could perform better. Its mostly aliasing(REALLY ANNOYING), slow interface responding and an XY-Mode (that is actually a joke) which could be well improved. Try to put oscillofun on it and you see what i mean. Maybe we can add more features like XYZ-Mode, SDR stuff, eye diagrams and others.
Since I'm into SDR and Spartan 6 Ill try to help where i can.
To the RE:
I think theres a chance of getting the firmware and bitstreams of the FPGA, but because of the nature of FPGA's it will be next to impossible to RE the bitstreams. Thats bad because the HDL is directly coupled with the software. I would start with getting the full schematic together and then find out how it is driven and how it performs tasks like calibrating, selftest and so on.
Since this is my only scope im not going to tear it apart, maybe ill find another one on ebay.
-
With that i.MX sadly I don't think there's much room for improvement in the cpu/performance side of things.
-
Ah, but once the software is open, then upgrading some of the hardware might be an option. At least one can hope for it.
-
Cool! This is awesome!
I just bought my ds1054z yesterday and now such a thing happens!
One might take a look at the DSO quad community firmware (wildcat) which is an OSS app to drive the tiny oscilloscope. It is quite feature-packed compared to the
original software and might be easy to port over and be a starting point. The hardware is different (Lattice ICE65) but the verilog code is out there, quite simple and might be also possible to re-target.
I am unsure if its a good idea to port it rather than start from scratch, but at least it´s something worth to take a look at.
Oscilloscope app overview and download, source included:
http://www.seeed.cc/DSO-Quad-community-edition-Wildcat-updates-t-6071.html (http://www.seeed.cc/DSO-Quad-community-edition-Wildcat-updates-t-6071.html)
git for thhe older community app:
https://github.com/pmos69/dso203_gcc (https://github.com/pmos69/dso203_gcc)
git for the original source including FPGA source:
https://github.com/Seeed-Studio/DSOQuad_SourceCode (https://github.com/Seeed-Studio/DSOQuad_SourceCode)
As I already said it is no request to port it over, it´s just a working and open soure embedded oscilloscope app and fpga source that´s worth to be looked at.
-
Sounds like fun tmbinc ;)
I happen to have one of these too and would love to understand more of its inner workings, even just for the fun knowledge of it.
-
One might take a look at the DSO quad community firmware (wildcat) which is an OSS app to drive the tiny oscilloscope.
Nice, hadn't noticed it was alive again. Will have to dig mine out again :)
-
Christer Weinigel did something similar for the OWON SDS7102.
http://blog.weinigel.se/ (http://blog.weinigel.se/)
He got as far as dumping correct ADC data to disk.
It's a different architecture, though some of the techniques to reverse engineer the FPGA-SOC and ADC-FPGA connections could be reused.
http://blog.weinigel.se/2016/05/29/sds7102-fpga-pins.html (http://blog.weinigel.se/2016/05/29/sds7102-fpga-pins.html)
http://blog.weinigel.se/2016/07/08/sds7102-capture.html (http://blog.weinigel.se/2016/07/08/sds7102-capture.html)
-
I wonder if it would be possible to keep part of the original Rigol code running while it's getting analyzed and block by block replaced with a 'open source' functionally equivalent version of it.
-
OK, I am up for it...
Have ordered £350 DS1054Z for the job, since I don't want to risk trashing my £1000 MSO1104Z-S.
To get me started...
1 Does anybody have a link to schematic for input circuitry please? Dave's reverse engineer video shows part schematic, but maybe there is something better since?
2 Any hints on disassembling code for FPGA (is disassemble even the correct term) and ARM chip?
3 Any other info available that might help me assist with the firmware re-write?
4 Do I/we need to be careful about breaking Intellectual Property or Copyright rules?
Note that I am well aware that this is a totally pointless exercise, so no need for any negativity. Purely a fun thing for an experienced hobbyist to do with too much free time available :)
Any hints or assistance appreciated, and hopefully I can contribute to the bigger project in return.
Seems to me I need to learn:
a) Spartan 6 XC6SLX25 FPGA (the thing with the heatsink). I know nothing of FPGA - is it hard to learn?
b) ACTEL ProASIC3 ASP030. I know nothing of ASIC - is it hard to learn
c) MCIMX283(DVM4B) freescale ARM 9 - I am familiar with ARM at amateur level - maybe this is where I can add value to this thread?
I have multi-meter with continuity function and I am not afraid to use it :)
I will soon have spare Rigol and I am not afraid to break it :)
-
1 Does anybody have a link to schematic for input circuitry please? Dave's reverse engineer video shows part schematic, but maybe there is something better since?
See the link I posted earlier in the thread.
-
Can I make the 1st entry in wish list ? ;D
Nothing spectacular, use the whole damn screen just for traces only, I mean horizontally, without those annoying both sides buttons bars.
At least not permanently occupying at both sides.
-
See the link I posted earlier in the thread.
Thanks Cerebus, I am embarassed that I did not read the earlier thread posts properly :-[
Not sure the schematics for front end apply to DS1054Z, but the other schematics will probably get me off to a good start.
Thanks,
-
Seems to me I need to learn:
a) Spartan 6 XC6SLX25 FPGA (the thing with the heatsink). I know nothing of FPGA - is it hard to learn?
a: FPGA's are a very different from micro processors. They even need a different type of source code called Hardware Description Language or HDL for short. Verilog and VHDL are the most common. VHDL is more Complicated and more common in europe while Verilog is more simpler and more common in america. Unlike classic programming languages, you are not describing a sequence of Operations. You have to describe a digital circuit instead. (OK, your digital circuit could be a CPU which can then be programmed, but thats off topic). But I have to say the learning curve can be very steep and there are a lot of pitfalls that arent even possible on classic porgramming languages. But dont fear, the internet has a lot to tell you about that.
One word to Xilinx/Spartan 6: Xilinx has a lot of Code Generators and other stuff we can use but there are a lot of nasty bugs in it. There are whole books just dedicated to these bugs. The suite we need is the now discontinued ISE from Xilinx. The newer Xilinx Vivado doesnt support Spartan 6 (I'm pretty sure thats on purpose >:( ). ISE for that FPGA is free, but it phones home for whatever reasons. And i can recommend emacs for VHDL editing. Besides the good templates the ability to edit the same buffer in two or more windows alone is worth it.
I have a different question:
A project like this can produce several thousand lines of code (maybe in the millions) among other countless files and documents. How do we organize this? +we need some versioning like SVN or so.
-
FPGAs are absolutely fascinating and amazing devices. I'm not actually sure if knowing how to program microcontrollers makes it easier or harder to get started in FPGAs. The thing that is hardest for most people to grasp is that writing HDL is not writing a program. Instead you are describing the function of a digital circuit using a special language that happens to superficially resemble a computer programming language. Tell yourself that over and over until it sinks in.
The best beginner resource I found was a free pdf book called Free Range VHDL. In the US Verilog is more popular but I found VHDL makes more sense to me. My advice if you read that book is to first read it through cover to cover and don't worry too much about absorbing it all. Then go back and read it again, this time trying the examples as you go along. Existing projects are a great source of information too, I found Grant Searle's Multicomp to be very helpful.
-
I have a different question:
A project like this can produce several thousand lines of code (maybe in the millions) among other countless files and documents. How do we organize this? +we need some versioning like SVN or so.
Github (https://github.com/)
-
"microcontrollers makes it easier or harder"
I would say harder because you always think "inside the box", and FPGA is a totally different philosophy, where sequenced thighs must be changed to parallel, Microprocessor is a generic hardware to solve problems with software, FPGA is Pure hardware defined by software tool, but after definition 100% hardware ( except if you define a microprocessor IP )
-
Struggling to add photos - but will keep trying...
OK, I give in....
How do I add a dozen photos of MSO1104Z-S daughter card for Sig Gen?
EDIT: found add attachment option, but now get attachment too large.
Don't want to play this game any more :(
Detail shots added, but bigger pictures left out due > 1MB
You will have to use your imagination to guess what the whole board view looks like :(
I guess that the money shot is the second one, except maybe the glue from the sticker makes chip info hard to read
-
Dave has taken some photos of the scope already: https://www.flickr.com/photos/eevblog/albums/72157646442125864 (https://www.flickr.com/photos/eevblog/albums/72157646442125864)
EDIT: Oh sorry, didn't see that you were adding pictures of MSO1104Z-S.
BR Jonas
-
There's a "(more attachments)" just below where you posted your first one.
-
Is that a altera Cyclone?
How is the Generator board connected?
-
There's a "(more attachments)" just below where you posted your first one.
Yep, individuals can't be bigger than 1Mb and the total for a post can't be bigger than 2Mb.
For a project like this some need to be hi res and then it's better to add more posts with bigger pics and then all the imagery is on Dave's server where it won't get lost.
-
@hexreader, how did you get the lighting such that the chip identifiers are readable?
-
Is that a altera Cyclone?
How is the Generator board connected?
Yes, Altera Cyclone.
Board connects to stake pins right hand side of main board next to piezo buzzer, then 2 flying leads for output to 2 BNCs on daughter board. That is what the bigger pictures would have shown if picture limit was 2 meg instead of 1 :(
how did you get the lighting such that the chip identifiers are readable?
Just used USB microscope with built-in light. Sometimes I need to turn off microscope light and shine a torch side-ways on
By the way... I notice that the interesting jumpers next to JTAG connector are 0100100 001 for both DS1074Z-S and for MSO1104Z-s.
Dave's pictures for DS1054Z show 0000101 001, while my DS1054Z has 0000100 001
Maybe the second jumper from the left sets the "S" option????
-
With a bit of cropping.... maybe I can post picture of top of signal generator board...
... and most of the bottom of the board, with just a bit lost at lower edge, which luckily has no components on
-
hexreader are the BGAs for the Logic analyser populated on your scope?
I looked at daves hi res photos of the PCBs to get an idea of the bootstrapping.
https://www.flickr.com/photos/eevblog/15354530840/in/photostream/ (https://www.flickr.com/photos/eevblog/15354530840/in/photostream/)
There are
-a 128 MBbyte Flash, i guess it holds the software for the CPU
-a 25x4 SPI Flash, i guess the Spartan 6 boots from that
-a I2C FRAM(MB85RC16), no idea whats that for
-the ACTEL FPGA has build in flash
theres a ic i cant read the part number of, its the "im XSZ ..."
Clocking for the hardware is not that hard i think:
25 MHz -> ADF4360-7 -> ADC -> FPGA -> maybe others.
We need to figure out what clock comes out of the ADF chip.
What questions me is that the Spartan 6 has a maximum Speed in the ballpark of 400MHz (if you use a very very veeeeeeeeerrrryyyyyy quick HDL) but it is specified at 1GSa/s. So how did they implement that?
-
hexreader are the BGAs for the Logic analyser populated on your scope?
No doubt they are, but I am not willing to pull all of the buttons off of the scope and undo those tiny ribbon connectors to find out.
When I get cheap DS1054Z delivered, then I am willing to take more chances. If I break my MSO1104Z-s I will be heart-broken and never recover.
theres a ic i cant read the part number of, its the "im XSZ ..."
MCIMX283(DVM4B) freescale ARM 9 - which I gained by watching Dave's tear-down video
-
How did you figure out the video driver?
-
Nice !!!
-
Hello All,
First of all, hello everybody, I'm new to the forum, even though I've watched several of Dave's videos.
I think this is a very cool project, I own this scope and I have the skills to help (IMX and FPGA). Maybe we should arrange a jira to organise work?
Kind regards,
Piotr Zdunek
-
Welcome to the forum, Piotr!
-
Hey everyone,
I think this project is very interesting. Might actually push me over the edge so that I finally get one of the Rigol scopes. :)
I really recommend using one of the widely used and proven solutions for open-source project coordination and development like Github organizations or alternatively GitLab to organize code commits and issues. The wiki is maybe not super capable but sufficient for most projects, and allows open coordination of the community effort with good transparency and lot's of useful integrations and tools. I personally would not vote for jira as it will lock the project into the atlassian system, making future migration very difficult. (I speak from experience here)
Just my 2cents. :)
Looking forward to progress in this project and maybe even getting my hands dirty. :)
Cheers,
Esden
-
Bookmarked.
-
OK, Donor DS1054Z has just arrived...
How do I remove ribbons from mainboard sockets please?
Do I just pull, or do I slide the black plastic retainer first (though gentle persuasion does not release retainer so far)
-
Pull out the plastic bit, the cable should pull out easily then
-
Pull out the plastic bit, the cable should pull out easily then
Thanks, that worked.
Needed a lot of persuasion though. Not looking forward to removing display :(
Ah.... now I get it :) just flip the black plastic up like a piano lid - much easier and less destructive
So, starting off with the simplest task:
Left hand keypad keys top to bottom are: K5 K12 K13 K11 K9 K2 K4 K3 K1
Left hand keypad ribbon cable listed top=1 to bottom = 8:
ribbon 1 = K5 R , K1 L , K2 L , K3 L , K4 L
ribbon 2 =K9 L , K11 L , K12 L , K13 L
ribbon 3 = K5 L , K13 R
ribbon 4 = ground to button PCB ground
ribbon 5 = K4 R, K12 R
ribbon 6 = K3 R , K11 R
ribbon 7 = K2 R
ribbon 8 = K1 R , K9 R
I make that a 2x5 matrix with:
ribbon 1 = row 1 (K1 to K5)
ribbon 2 = row 2 (K9 to K13) K10 not fitted
ribbon 3 = column 5 (K5 K13)
ribbon 4 gnd
ribbon 5 = column 4 (K4 K12)
ribbon 6 = column 3 (K3 K11)
ribbon 7 = column 2 (K2)
ribbon 8 = column 1 (K1 K9)
Dave's teardown seems to suggest that the 8 way side-connector is related to the 8-way key connector nearby, but continuity test shows that the two are not directly connected. My guess is that the positioning is co-incidence.
On to the other keyboard panel with all of the rotary encoders on. I see that there is an ASIC hidden away behind the board, so this board more complex than I first guessed.
EDIT: Turns out the two keyboards work as one 6x8 matrix - where row 6 has K41 button (CH4) plus K54 through K59 which are the push function of the rotary switches
-
Anyone have any tips on how to get the little black bit of plastic back into the little white connector once it has been ripped out by mistake :(
The 8 way ribbon connector that goes to Rigol left-hand buttons.
-
Anyone have any tips on how to get the little black bit of plastic back into the little white connector once it has been ripped out by mistake :(
The 8 way ribbon connector that goes to Rigol left-hand buttons.
If something broke, just replace it: http://uk.farnell.com/c/connectors/ffc-fpc-board-connectors?no-of-contacts=8contacts (http://uk.farnell.com/c/connectors/ffc-fpc-board-connectors?no-of-contacts=8contacts)
What's the pin spacing on connector footprint? What about the cable?
If nothing broke, it may be possible to just force the bit of plastic back.
Good luck!
-
Are there any open source oscilloscope applications readily available?
If said software has a proper HAL that can be made working with the (not yet synth´d) FPGA it would be loads and loads less work.
At least the said software could be forked to be used with the scope and the whole UI and math part would be already there and to be improved and customized later on.
I have already proposed to use the DSO quad stuff for the beginning which comes with some verilog that could be fiddled for the spartan architecture and customized for the dac. That way the software would already be interfaced. But its far from perfect.
I will have a look if there are better options... anybody got an idea? Tmbinc, whats your preferred way to do it? Write from scratch? You are the boss :-BROKE ;)
-
Anyone have any tips on how to get the little black bit of plastic back into the little white connector once it has been ripped out by mistake :(
The 8 way ribbon connector that goes to Rigol left-hand buttons.
There's normally 2 styles, one that pushes home and clamps/secures the cable in place and the other has a swing over type clamping arrangement. Close inspection can identify each. Removal is simply the reverse of locking it home.
The "push home" retainers have an infuriating habit of not staying completely open for reinsertion and just a brush will partly close them making the ribbon tricky to insert.
You'll work it out. ;)
-
You'll work it out. ;)
Yes I did work out that it is the second type, but not until I broke the socket by assuming it was the first kind :'(
With luck, and the aid of a microscope, I am hoping I can get the black plastic bit back into to white socket.
....Else I will have to replace the whole socket, which with my rotten soldering skills and bad eyesight will not be pretty
If something broke, just replace it: http://uk.farnell.com/c/connectors/ffc-fpc-board-connectors?no-of-contacts=8contacts (http://uk.farnell.com/c/connectors/ffc-fpc-board-connectors?no-of-contacts=8contacts)
Cool link - many thanks - I think I see the right connector near the bottom of first page - but don't have scope open right now to measure pitch. Will add some to my next order, just in case I cannot repair the old socket
-
Holy, make a picture |O
-
Holy, make a picture |O
Dave already posted pictures of Rigol insides, showing the 8-pin key connector - he is not hampered by the picture file size limit that I suffer.
Will continue to post close-up pictures in due course as I progress, since these are within the post size limit, but without the bigger picture (literally) they convey limited information.
-
Holy, make a picture |O
Dave already posted pictures of Rigol insides, showing the 8-pin key connector - he is not hampered by the picture file size limit that I suffer.
Will continue to post close-up pictures in due course as I progress, since these are within the post size limit, but without the bigger picture (literally) they convey limited information.
You'd be surprised how much we can zoom in on even quite low res pics to see the details we need. ;)
Everyone has their favourite program for this of course. :)
I commonly reduce/shrink them to 100KB and never been asked for larger.
-
Fair enough,
Close-ups attached.
Doesn't look too hopeful to me, but maybe someone else has experienced a similar fix?
Is it just the 8 solder joints that need de-soldering, or is there hidden solder joints under connector?
Could not get ruler flat to board, but those are 1mm ruler markings, so I guess connector is 1mm pitch?
-
I commonly reduce/shrink them to 100KB and never been asked for larger.
You could also increase jpg compression ratio on larger images.
-
And since I now have scope opened and microscope plugged in:
Here is the ASIC on the back of "keyboard A" and some kind of identifier...
EDIT: Turns out the two keyboards work as one 6x8 matrix - where row 6 has K41 button (CH4) plus K54 through K59 which are the push function of the rotary switches
Look at Dave's close-up picture of main keyboard A:
Top two connections on rotary switch are for the push button
Top left connector is row 6 of keyboard matrix
Top right connector goes K59 to column 3, K57 col 4, K58 col 5, K55 col 6, K56 col 7, K54 col 8
CH4 button K41 is Row 6 Column 2
Bottom 3 connectors are the encoder with centre wired to Row 6, left connector diode to common A, right connector diode to common B
K1 to K8 are row 1, col 1-8
K9 to K16 row 2, col 1-8
K17 to K24 row 3, col 1-8
K25 to K32 row 4, col 1-8
K33 to K40 row 5, col 1-8
Guessing here, but since LEDs look to be individually connected to ASIC, then I imagine key matrix probably connects to ASIC too?
Still guessing - I imagine that ASIC handles all buttons and rotary encoders and passes information to Mainboard?
-
Congratulations, the connector is dead. What kind of tools do you use ? Hammer and chisel ?
The pitch is 1.27mm
-
Let's help with some information consolidation
Here Davi's high res picture of Rigol in one rar file 180 M
http://www.transmissor.com/Rigol1054Z.rar (http://www.transmissor.com/Rigol1054Z.rar) < Caution 180M on your hard drive compressed
I would offer to maintain a WordPress site for the purpose of this project, where information and pictures will be hosted, for an easier sharing. If at least the working members and contributors agree I will create. otherwise, will forget due to lack of interest
-
Congratulations, the connector is dead. What kind of tools do you use ? Hammer and chisel ?
The pitch is 1.27mm
Hope that was a joke ;)
The rework can be easely done if you have the right tools and skills. However if you are not used to it, trying DIY could cause more damage. If you want to try to replace it yourself go get some junk electronics and exercise on that first. You'll need a hot air station (to remove the part), solderwick to clean the pads, smd flux, fine solder (leaded should work), a soldering iron with a very fine tip (to solder the new part on) a good tweezer (so you dont block your sight and dont burn your fingers) and a good microscope would be a good idea. There are a lot of videos on Youtube about that. Look for ipad rehab or Lois Rossmann (Warning he's a New Yorker ;)). Ofc this will not save you from exercise on junk electronic. I think there is nobody in the world who didnt f*ck up on the first try on something like that. Or go find a expert that mastered that kind of stuff.
-
Is it just the 8 solder joints that need de-soldering, or is there hidden solder joints under connector?
there are two more (left and right outer edge) there are for mechanical stability, there should be no signals on it (GND maybe)
-
Fennec, if you can tell us where you are, someone nearby can probably swap it for you.
-
Look for ipad rehab or Lois Rossmann.
Please don't, Louis' technique is terrible and he's the first to say so himself. Not the 'go to' guy for a surface mount soldering tutorial.
A soldering iron, flux, wick and solder are all that are strictly necessary. Hot air and a microscope are luxury items unless SMD repair is a regular concern. There is an almost unlimited and inexhaustible supply of existing SMD soldering advice and opinion available on this forum with a simple search, please let's not turn this thread into yet another SMD soldering for newbies tutorial.
-
Let's help with some information consolidation
Here Davi's high res picture of Rigol in one rar file 180 M
http://www.transmissor.com/Rigol1054Z.rar (http://www.transmissor.com/Rigol1054Z.rar) < Caution 180M on your hard drive compressed
I would offer to maintain a WordPress site for the purpose of this project, where information and pictures will be hosted, for an easier sharing. If at least the working members and contributors agree I will create. otherwise, will forget due to lack of interest
If for nothing more than a consolidation of all images (and the context of them) I think would be a great way to keep it all together rather than sifting through numerous posts. All of my favorite project compilations that used WP worked well that way vs endless pages of a thread. Just my 2 cents.
-
I thinks it's a good idea to collect all the info somewhere. A wiki is preferable IMO. I like the Atlassian tools, but I understand that some people don't.
The important thing is that more than one is able to contribute/edit the pages.
I can provide a server to host whatever, if needed.
BR Jonas
-
What about using xDevs? Various folks here have tracked and documented their test equipment/electronics projects there.
https://dev.xdevs.com/
-
I did some research.
According to Dave the ADC in these Scopes is a HMCAD1511.
Datasheet:
http://www.analog.com/media/en/technical-documentation/data-sheets/hmcad1511.pdf (http://www.analog.com/media/en/technical-documentation/data-sheets/hmcad1511.pdf)
Since i think we have to write a new FPGA Frimware image i searched for HDL Code for that chip.
And found it for the EVAL-Board here:
https://ez.analog.com/thread/51904 (https://ez.analog.com/thread/51904)
The EVAL-Kit uses a Spartan 6 too.
By the way im looking to buy one of these scopes so i can do more for this project, so does anybody know where i can get one (can be a used/defect one to some extend).
-
The frontpanel (both buttons and LEDs) are connected to the UART (AUART0 if i remember correctly); it runs at 1MBit/s.
To set the LEDs, you have to send one byte; the upper nibble indicates which LEDs to update, the lower nibble is a bitmask. So, "33" for example would enable SINGLE and REF, but disable MATH and the red RUN/STOP led, and leave the other LEDs alone.
1x 1 rot. button
2 CH1
4 CH2
8 CH3
2x 1 CH4
2 LA
4 SOURCE
8 RUN/STOP green
3x 1 SINGLE
2 REF
4 MATH
8 RUN/STOP red
4x 1 trigger single
2 trigger normal
4 trigger auto
The button presses are little bit complicated, any pressed button generates a packet starting with "AA", then 9 bytes, and then something that appears to be a checksum. I guess with just a little bit of observation it can be figured out.
-
The frontpanel (both buttons and LEDs) are connected to the UART (AUART0 if i remember correctly); it runs at 1MBit/s.
To set the LEDs, you have to send one byte; the upper nibble indicates which LEDs to update, the lower nibble is a bitmask. So, "33" for example would enable SINGLE and REF, but disable MATH and the red RUN/STOP led, and leave the other LEDs alone.
1x 1 rot. button
2 CH1
4 CH2
8 CH3
2x 1 CH4
2 LA
4 SOURCE
8 RUN/STOP green
3x 1 SINGLE
2 REF
4 MATH
8 RUN/STOP red
4x 1 trigger single
2 trigger normal
4 trigger auto
The button presses are little bit complicated, any pressed button generates a packet starting with "AA", then 9 bytes, and then something that appears to be a checksum. I guess with just a little bit of observation it can be figured out.
Thanks, that motivates me to decode further. Might take a while, but I will publish the results...
By the way, curious, how did you work that out please?
-
By the way, curious, how did you work that out please?
I simply observed serial port communication and correlated that with blinking LEDs :).
Later (from Linux) i've systematically tried all combinations.
-
Keyboard A 20 pin connector assuming pin 1 at the top:
1 gnd
2 gnd
3 ?
4 ?
5 ?
6 ?
7 gnd
8 ? (scope shows 24MHz clock at all times at approx 0 to 3V)
9 gnd
10 11 12 3.3V
13 Row 1
14 Row 2
15 Col 5
16 gnd
17 Col 4
18 Col 3
19 Col 2
20 Col 1
The five connections marked ? are resistor-terminated and seem to run to a bus that includes mainboard FPGA (with heatsink) and Cyclone chip to it's right
PSU Connections:
BRN 50Hz (AC_Trig)
ORG Gnd (Fan -)
White 9.0V (Fan)
Red 5.0V (5V5A)
Red 5.0V (5V5A)
Blk Gnd
Blk Gnd
Yel 7.5V (6.3V)
Yel 7.5V (6.3V)
Blk Gnd
Blue 17.5V
Grey -17.5V
Blk Gnd
Grn -7.5V
Picture of PSU main chip attached
-
By the way, curious, how did you work that out please?
I simply observed serial port communication and correlated that with blinking LEDs :).
Later (from Linux) i've systematically tried all combinations.
Sorry to keep bugging you, but I have not managed to find serial communication signals for keyboard and LEDs. Where can I put scope probe(s) to see the signals each way please?
I am slowly getting to grips with how the scope works, but struggling.
-
I have reversed engineering the front end of my DS1000Z too,but not sure if it's right,not confirm yet.Actually,I thought about the same open source scope before,but I know noting about FPGA and Linux,so I give up. :palm:hope you can keep going.If there are anything about analog front end I can help,please let me know.
-
I have reversed engineering the front end of my DS1000Z too,but not sure if it's right,not confirm yet.Actually,I thought about the same open source scope before,but I know noting about FPGA and Linux,so I give up. :palm:hope you can keep going.If there are anything about analog front end I can help,please let me know.
Wow! that is seriously impressive :)
Where did you get component numbering from? (U2A, Q4 etc) . My scope mainboard has no component numbers. Did you make them up? or did you have a way to know Rogol numbering. Either way, your schematic will become the standard that the rest of us will follow.
Many thanks for posting - maybe there is hope for this project after all....
-
I have reversed engineering the front end of my DS1000Z too,but not sure if it's right,not confirm yet.Actually,I thought about the same open source scope before,but I know noting about FPGA and Linux,so I give up. :palm:hope you can keep going.If there are anything about analog front end I can help,please let me know.
Wow! that is seriously impressive :)
Where did you get component numbering from? (U2A, Q4 etc) . My scope mainboard has no component numbers. Did you make them up? or did you have a way to know Rogol numbering. Either way, your schematic will become the standard that the rest of us will follow.
Many thanks for posting - maybe there is hope for this project after all....
just ignore the component number,I made them up.
-
just ignore the component number,I made them up.
On the contrary; those component numbers will now become the standard. Somebody had to assign a numbering system, and it seems you are the first.
Now needs somebody to invent numbers for the remaining components on the mainboard. I would annotate Dave's pictures with component numbers, but with only 1MB limit on pictures, it is more trouble than I can live with :(
-
An alternative to annotating high-resolution photos is to make a component list and corresponding component-finder as is done in many service manuals. The component-finder image would be a line drawing with all the component labels, which should be a much smaller file than a photo.
Of course, one could just put large images elsewhere, such as on xDevs, where all the project details can be tracked and documented.
-
FWIW
In 2004 David Donoho of Stanford introduced the concept of compressive sensing. There is a 2014 PhD dissertation on a compressive sampling oscilloscope. The dissertation is:
https://smartech.gatech.edu/bitstream/handle/1853/.../TZOU-DISSERTATION-2014.pdf
To do this you need to be able to trigger sampling at random times. The granularity of the clock determines the bandwidth of sampling. Typically about 5x increase in BW per sample is achievable, though it takes significant compute, so not for real time yet. But the really cool part is that the random sampling times eliminate aliasing without the expense of an anti-aliasing filter. So a scope that implements compressive sampling is limited only by the BW of the analog front end.
The deep buffer on the DS1000Z series makes this especially attractive. Compressive sensing would make it 5x deeper.
I'm interested in ANY low cost scope that will allow me to treat the ADC channels as one would those on an MCU. But I've got a DS1102E, so Rigol is a natural path to start down. If someone works out how to trigger a single sample after a user specified delay. I'd *really* like to know.
-
Did anybody start with the FPGA part yet?
-
@hexreader, how did you get the lighting such that the chip identifiers are readable?
Very delayed reply, and apols for off-topic, but https://xdevs.com/guide/hwphoto/ is the best guide I've seen for getting high-quality circuit board or component shots.
tl;dr, tripod, slow exposure (10s), dark room, wave a torch around the board from all sides to get rid of reflections & shadows.
-
Link did work for me
This one works
https://smartech.gatech.edu/bitstream/handle/1853/51876/TZOU-DISSERTATION-2014.pdf
-
Thread seems to have died :(
I have been working in the background learning about FPGAs, but am afraid to connect either of my FPGA programmers to Rigol Scope.
Is there any kind person out there who can tell me how to reliably read FPGA information out of the configuration Flash chips for main Xilinx Spartan chip and Altera Cyclone 2 please.
I will be much happier experimenting on FPGAs on DS1054Z when I am confident that I have a "plan B" for restoring scope to working condition.
I bought these two JTAG programmers for the job: http://store.digilentinc.com/jtag-hs3-programming-cable/ (http://store.digilentinc.com/jtag-hs3-programming-cable/)
[url=http://hobbycomponents.com/featured/273-altera-fpga-cpld-usb-programmer-usb-blaster-compatible?search_query=fpga&results=2]
[url=http://hobbycomponents.com/featured/273-altera-fpga-cpld-usb-programmer-usb-blaster-compatible?search_query=fpga&results=2]http://hobbycomponents.com/featured/273-altera-fpga-cpld-usb-programmer-usb-blaster-compatible?search_query=fpga&results=2 (http://hobbycomponents.com/featured/273-altera-fpga-cpld-usb-programmer-usb-blaster-compatible?search_query=fpga&results=2)[/url][/url]
I also bought logi-pi2 and some cheap Altera FPGA boards to experiment on.
My suspicion is that connecting JTAG to scope FPGAs will result in dead scope until I know how recover from bricked FPGAs
Any advice or help much appreciated. I have not given up on this project yet, but live in fear of trashing my DS1054Z.
-
just reading this thread,
before you do the big firmware project, it may be handy if you created a small diagnostic program to check scopes for hardware issues.
just a thought. :)
-
just reading this thread,
before you do the big firmware project, it may be handy if you created a small diagnostic program to check scopes for hardware issues.
just a thought. :)
That's actually a damn fine idea. Part of the very nature of a diagnostic program is that you absolutely must understand the hardware you're driving to get the correct results. Thus writing a diagnostic program is a good way of proving to yourself that your reverse engineering is correct.
Further, reverse engineering often requires quite a lot of trivial test programs to see if a given feature works the way you think it does. Each of those little test programs look a whole lot like the individual tests that go to make up a diagnostic. So a deliberately written diagnostic is going to make a top-notch framework for all those little test routine that will need writing anyway - might as well make them useful in the future and keep them tidily in one place.
-
Is there any kind person out there who can tell me how to reliably read FPGA information out of the configuration Flash chips for main Xilinx Spartan chip and Altera Cyclone 2 please.
You could try soldering wires to the chip and driving it directly but it may not work, depending on what else is connected to the PCB traces.
You could sniff the bus at startup using a logic analyzer.
The only way to be sure is to desolder the chip, read the contents, put it back again. It's a few minutes work if you've got the equipment, a big hassle if you haven't.
-
Thanks Fungus :)
Option 3 is out of the question. I have neither the equipment or the skill for SMD de-soldering.
I will go for option 2 - that looks safest. Will practice on dev boards first to prove the principles.
If option 2 does not work, then I will go for option 1.
Much appreciated...
-
I can boot Linux, which means we have:
USB
LCD/Framebuffer
Ethernet
Frontpanel LEDs
Frontpanel buttons
Thanks tmbinc for sharing the project, I'm an experienced Embedded coder with more than 10 years experience, maybe I could help with developing some drivers for you. But I'm not a linux guy, and in all those years I just wanted to know how to build linux and add custom device drivers to it, do you recommend any path?
-
But I have a Guinea pig ^w^w 1074Z-S. If it can be of any help just let me know :-)
GeorgeOfTheJungle Please send it to me, I will promise you to slay him and used it for the good of the public ;D ;)
-
What questions me is that the Spartan 6 has a maximum Speed in the ballpark of 400MHz (if you use a very very veeeeeeeeerrrryyyyyy quick HDL) but it is specified at 1GSa/s. So how did they implement that?
cBaer, please note that,It has a special hardware in it's IO, it's called SEREDES IO, which it can get to 1GHz and down scale the stream to parallel stream with lower clock inside the FPGA core fabric
-
1) You could try soldering wires to the chip and driving it directly but it may not work, depending on what else is connected to the PCB traces.
2) You could sniff the bus at startup using a logic analyzer.
3) The only way to be sure is to desolder the chip, read the contents, put it back again. It's a few minutes work if you've got the equipment, a big hassle if you haven't.
Thanks Fungus :)
Option 3 is out of the question. I have neither the equipment or the skill for SMD de-soldering.
Ideally you need hot air bit if it's only an 8-pin chip then removing it with chipquick is probably easier than soldering wires to the pins to sniff the bus:
http://www.chipquik.com/store/index.php?cPath=200 (http://www.chipquik.com/store/index.php?cPath=200)
Putting it back isn't difficult either. You don't solder individual pins with SMD, you just put a bit of solder in the general area and rely on the solder mask to do its job. A lot of people use big screwdriver-shaped soldering tips so they can do several pins at once (faster!).
I will go for option 2 - that looks safest. Will practice on dev boards first to prove the principles.
If option 2 does not work, then I will go for option 1.
Much appreciated...
2 is definitely the safest.
1 isn't completely without risk - you'll be applying +/- voltages to bus lines. Don't just short pins to ground, make sure you use resistors to limit the currents. Hopefully the FPGA will set its pins to a sensible, high-impedance state after reading the flash but I have no idea if it does or not - read the datasheet.
Question: Is it necessary to reprogram the FPGA in the initial phase? Can't you leave the FPGA as-is and just work on the main firmware? The most important thing right now is creating an environment where the compile-update cycle is as short as possible. If it takes five minutes to upload/test each iteration then this will go nowhere.
-
Pull out the plastic bit, the cable should pull out easily then
Maybe this instruction needs to be changed. "Pull out" is wrong, the part isn't supposed to be removed. Just "lift the latch and the cable will release easily."
-
Question: Is it necessary to reprogram the FPGA in the initial phase? Can't you leave the FPGA as-is and just work on the main firmware?
I was thinking that I might output a square wave on each FPGA output to help me trace the wiring - since I cannot get to BGA pins.
Where is the main firmware stored? ... and what device is firmware run on please?
Many thanks for the help with my understanding, which is improving steadily.
By the way..... I have no illusions of writing new scope software - I am simply learning, experimenting and having fun. Sorry to disappoint ;)
-
Out of curiosity, could you not toggle the pins through a normal jtag boundary scan? rather than trying to re flash it? it would only need to be 2-3Hz
-
Out of curiosity, could you not toggle the pins through a normal jtag boundary scan? rather than trying to re flash it? it would only need to be 2-3Hz
No idea.....
Seems you know far more than I do :)
Tell me what to do and I will give it a go...
I am just a hobby programmer with a lot of enthusiasm and spare time, but limited knowledge and skill.
Where is the main firmware stored? ... and what device is firmware run on please? .... many thanks, hexreader
-
You could start by watching this:
https://www.youtube.com/watch?v=kb9P1Am9aFU (https://www.youtube.com/watch?v=kb9P1Am9aFU)
-
Got it - thanks
Looks like there is another dev board to buy and a tool-chain to download.
This is a seriously big task :(
-
First of all, I'd like to applaud this initiative, as any ambitious open source project. :-+
Now, I don't know if someone mentioned this already but before embarking on such a bold journey I think it's good to understand all its aspects such as to prevent bitter disappointment.
Designing good software for an oscilloscope is more complex than designing good hardware. Listen to Siglent CEO answer to Dave's question at 03:23 :
https://youtu.be/v9M397sUkEA?t=3m23s
-
Out of curiosity, could you not toggle the pins through a normal jtag boundary scan? rather than trying to re flash it? it would only need to be 2-3Hz
FPGA code is held externally, so you can load a new bitstream over JTAG for reversing which only lasts until power cycle
-
FPGA code is held externally, so you can load a new bitstream over JTAG for reversing which only lasts until power cycle
Thanks, that works great on dev board, so presumably it will work just as well on scope.
I think I will wait until I have a SPI flash image before trying it though - just to be doubly sure.
Progress is slow, but headed the right way....
-
FPGA code is held externally, so you can load a new bitstream over JTAG for reversing which only lasts until power cycle
Thanks, that works great on dev board, so presumably it will work just as well on scope.
I think I will wait until I have a SPI flash image before trying it though - just to be doubly sure.
Progress is slow, but headed the right way....
Doing an SRAM download won't affect anything
-
Hello, folks!
I've recently got a ds1054z, and have been poking in the firmware in IDA, and researching what tidbits of useful information have been posted already. My file full of random notes can be seen at https://github.com/theorbtwo/rigol-ds1000z-stuff/blob/master/info. A dump of the SCPI command table, along with a bit of code to expand out the tree and attempt to find the command in the documentation, is at https://github.com/theorbtwo/rigol-ds1000z-stuff/blob/master/commands.pl, and finally the output of that script is at https://github.com/theorbtwo/rigol-ds1000z-stuff/blob/master/commands3.txt, along with a (very small) amount of notes from reverse-engineering the firmware inline. Undocumented commands are marked with a leading "!". Particularly intersting-looking ones include :vendor:configure (and ?), :system:udevice (and ?), :system:flash:write, :system:information?, :test:{progress,lower,upper,mode,operate}?, with non-? versions of mode and operate, :calibrate:output? and :calibrate:lfstart.
Pull requests for information I've missed *very* welcome. Replies to this post with information I have missed are also welcome. Information on how to share my work in IDA without putting myself out on a limb legally *very* welcome. Ideas on what I should be looking for also welcome.
-
hi, i have bricked rigol ds1302 and i am want to test your firmware. How i can upload firmware to oscill ?
-
[SNIP] Information on how to share my work in IDA without putting myself out on a limb legally *very* welcome. [SNIP]
I'll admit that I haven't used IDA (but I am aware of what it is and what it does).
I am not an IP lawyer, but what about distributing the delta between your commented, reverse engineered IDA file and a plain IDA file of the firmware that anyone can easily produce from their own 'scope? ;)
That way you would not be distributing Rigol's copyrighted code, merely a file which contains your comments etc and (machine readable) information on where to insert it into a locally generated file which already contains Rigol's code. Persons using your diff would of course have to obtain their own dump of the same firmware version that you used.
Another approach (which works for people without IDA licenses) is to distribute a symbol table of memory addresses and what you think they are used for (variables, subroutines, interrupt handlers, etc), which someone can then use to understand locally produced disassembly of the copyrighted code (again, you do not distribute Rigol's code, just a list of what addresses do what).
-
Hello everybody, I'm resurrecting this dead thread to ask for your help, I've got somehow a (semi)defective Rigol DS1104Z main board and I would like to reactivate it just for fun.
this being the most "low-level" thread that I could found, I want to ask for your help regarding the LCD connector (pinout) and eventually finding a compatible LCD, plus the same for the power-supply.
Also if there are some schematics and in the end if somebody has a bricked device and wants to part of front panel, power/supply and case, pleas ePM me.
Thanks,
DC1MC
-
This topic is about a new firmware. Please open a thread in Repair.
-
Thank you all for sharing the work.
Here's a random dump of things that need to be done (and with an estimation of difficulty), non-exhaustive of course.
S: Figure out JTAG port to Xilinx FPGA pinout (Thank you, JJalling! https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1195497/#msg1195497 (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1195497/#msg1195497))- S: document findings in more details (frontpanel, IO, ...) in a public wiki
- S: find a better serial port for debug spew than the frontpanel IO
- M: Figure out connections between FPGA and iMX
- M: figure out existing iMX<>FPGA protocotol
M: reverse input stage (analog stage etc., similar to what has been done for other scopes) Done, thanks Dave and Ink (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1202261/#msg1202261 (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1202261/#msg1202261))- M: figure out, and reverse, role of the Actel FPGA
- M: figure out FPGA pinout to ADC
- M: figure out FPGA to memory pinout
- M: figure out how to easily (i.e. without risk to brick the thing) run custom code without opening the case
- L: reverse full scope PCB to schematics
- L: write host demo code to interface with existing FPGA and drive basic scope functionality
- L: re-implement FPGA firmware
- XL: architect and implement a "scope application"
Awesome news:
konnor found a way for running custom code (plugins) without opening the case: https://www.eevblog.com/forum/testgear/rigol-ds1000z-firmware-patch-plugins/ (https://www.eevblog.com/forum/testgear/rigol-ds1000z-firmware-patch-plugins/)