Author Topic: BNC 625A firmware (Read 13917 times)

Nermash · « **on:** April 02, 2013, 11:56:49 am »

Recently I purchased a Berkeley Nucleonics 625 synthesized generator (aka Telulex SG100), and quickly learned that there were two versions, "premium" one with arbitrary/function/pulse capability (625A model) and standard 625 with only 21.5 MHz sine.

After few hours of reading datasheets and scoping arround the empty socket marked U24, I concluded that the empty socket should hold the DAC, and it turned out to be AD9713 chip.

However, firmware does not automaticaly recognizes that the DAC is present, and selecting arb/pulse/function mode on the front panel produces "mode not available" message. I also discovered that using terminal via RS232, I can enter these "not available" modes by simply entering J,Q and G letters as command. These are undocumented commands, probably left overs from some other impementation, but they do work and produce correct output signal. So I figured out that the answer lies in the firmware.

I have spent hours trying to reverse engineer the firmware, but none of the disassemblers for adsp2115 I have found seems to do a good job. I identified program and data memory sections, and they are the same for all versions, but there is a few hundred bytes section of data that holds the key, and I can not figure out how it enables arb feature.

So, turning to a path of less resistance, I would like to ask all fellow EEVblogers:

Does anyone with 625A (or Telulex SG100/A) version generator can send me the binary flash image containing the firmware?
Flash IC is socketed 29F002BB.

PA0PBZ · « **Reply #1 on:** April 02, 2013, 12:35:22 pm »

Have a look at the Telulex.zip file I found here after a bit of creative surfing: http://www.berkeleynucleonics.com/resources/smartarb/
Not sure if it is the version you are looking for but the same zip file also has a waveform upload program so who knows.

Nermash · « **Reply #2 on:** April 02, 2013, 12:50:18 pm »

Thanks for the effort, but no, these can't help me, I need the complete image:)

Files you found contain data memory part in the SG100-35.tlx file, and boot/program memory part inside the sgload.exe utility (yes, I disassembled that as well

).

The part I am missing is a special part located in between those two sections.

Billc · « **Reply #3 on:** April 03, 2013, 05:55:12 pm »

Hi,
I have both a BNC 625 and a 625A . I would like to upgrade the 625, like you.
Is the necessary code in the flash chip and, if so, how do I read or copy it for our 625s.

Thanks,
Billc

Nermash · « **Reply #4 on:** April 03, 2013, 07:56:33 pm »

I used TL866 programmer that I bought from Franky here on the forum, to read the 29F002 flash.

This is pretty common flash chip, and most universal programmers should be able to read/write from/to it.
As far as I know, only two differences between 625 and 625A are firmware and U24 DAC (AD9713 or MAX5013).

Step by step instructions would be:
1. Read both the 625 and 625A flashes, and save both files (256 KB each)
2. Backup both files, preferably to an online storage
3. Program 625 flash with 625A fw
4. Insert the dac in U24 socket
5. Send me the 625A firmware

Billc · « **Reply #5 on:** April 03, 2013, 08:03:00 pm »

OK
Will do. It might be a while since I need (minimum) an adapter for the plcc.
Give me a few days to get back to you.

Billc

casinada · « **Reply #6 on:** April 04, 2013, 06:05:33 am »

I have both, one original 625A and a converted one. You need to purchase the DAC and reprogram the Flash memory of the non A version. Just be careful as the DAC gets hot. I didn't have to recalibrate mine after the transformation. There is also a BK incarnation of the 625 the BK4070A If I find the Flash I will post it here.

Nermash · « **Reply #7 on:** April 04, 2013, 06:19:46 am »

Yes, there is also BK 4070A version, with arb function enabled. But, firmwares are not compatible

The complete unit is closed and without any air flow, and I also noticed that things can get a little hot. Maybe it wouldn't be a bad idea to drill some holes on the sides, just to get some passive cooling inside.

casinada · « **Reply #8 on:** April 04, 2013, 07:06:14 am »

I found the firmware for the 625A. Not 100% sure. It might still be the 625. Make sure that you use a spare flash memory and not the original flash memory. In either case make a backup of your original flash memory.

Nermash · « **Reply #9 on:** April 04, 2013, 07:35:22 am »

At first glance it looks like 625A fw, it has adittional bytes in the "special" section, but I will have to wait till I get back home to try it out.

In any case, big thanks

Edit: YES, it works, arb is now enabled!

casinada · « **Reply #10 on:** April 05, 2013, 04:03:07 am »

AwArD_RzD · « **Reply #11 on:** February 12, 2014, 10:53:13 pm »

Sorry to necro this topic but it's exactly the problem i'm dealing with and i hope Nermash and Casinada or somebody else are around to give me some precision.

Well long story short i bought a used Telulex sg-100/A on ebay and after some testing i concluded that not the arbitrary one, i think someone changed the front panel and they never tried the arb mode before listing it. So now i have a normal 625/ telulex SG-100 and i want to change it to the A model but my board seem to differ from yours.

The U24 is a 28 pin dip, i took some picture and i concluded after checking the Datasheet for the AD9713 that the U21 plcc is where the DAC go. My flash chip is a AM29f002bb and match the flash size of your zip file.

The problem here is i don't have any programmer or socket to program the device, i know there a dos software where you can program via the rs-232 port so my question is have you tried or know if it's safe to do that via the rs-232. I plan to buy the DAC soon but i don't know if i really need the programmer to do that.

Thanks

casinada · « **Reply #12 on:** February 13, 2014, 05:51:57 am »

I programmed the Flash memory with a programmer. I haven't tried anything using the RS-232. Check to see if you have somebody from this forum that lives near you and is willing to program the chip for you. Let us know.

edavid · « **Reply #13 on:** February 13, 2014, 06:28:21 am »

OT question... what do people think of the keypad on these units? It looks kind of crappy in photos.

Nermash · « **Reply #14 on:** February 13, 2014, 07:55:25 am »

Regarding the RS232 firmware update, I have tried it few times with some dubios firmware versions from BK and other Berkley Nucleonics units, and I bricked it a few times...Not a big deal since I have programmer.
However, I am pretty sure that correct firmware would update fine, since code differentiating non arbitrary and arbitrary version sits at the same offset in both files. In any case you should try to source someone with programmer as a backup measure first.

Regarding the keypad, yes it is pretty crappy. Low tactile feedback, front plate that flexes when you press the key harder. Not suitable for fast entry.

AwArD_RzD · « **Reply #15 on:** February 13, 2014, 12:56:17 pm »

Thanks for the reply !

i found a tlx file who supposed to be a 625a firmware and i still have a rs-232 port on my x58 motherboard so i will try that first, i don't know anyone near me who have a programmer on hand so the worst thing is i will need to buy one and a plcc remover if the unit brick, not a big deal then !

Yeah the Keypad is pretty crappy, the housing is "cheap" (flex and move with enough pressure) and the menu interface is hell. We had a bunch of these at the school many year ago and they worked flawlessly and was always spot on, since it's just for an hobby use the unit is perfect for my need.

I will keep you informed, the DAC is on the way and i have a Hp 8594e where i need to change the battery (battery is 22 year old!) i will post the result in a few week

Have a good day everyone.

AwArD_RzD · « **Reply #16 on:** March 06, 2014, 12:48:11 am »

Well update time

I tried to update the 625 via the rs232 port and it didn't work, the software freeze when i try to flash the rom with the 625a firmware but no problem with the original telulex rom file, i even tried on a old 1996 PC with windows 95 and it seem the software just don't like to flash the 625 to the 625a., so i bought the TL866 and i followed Nermash step and bingo all the function are enabled and spot on

thank you very much !!

casinada · « **Reply #17 on:** March 08, 2014, 11:42:23 pm »

Welcome to the worlD OF ARB

Remember to monitor tbe dac's temperature, it can get really toasty

AwArD_RzD · « **Reply #18 on:** March 09, 2014, 12:29:52 am »

Thanks !!

I plan to add some airflow in the case and add a little heat sink on the DAC before the summer. Don't know if it's to save cost or they was happy and under the temperature limit for this design.

tomwim · « **Reply #19 on:** October 16, 2014, 10:23:16 pm »

I know this thread is kind of old, but I have the same 625 Model. Is there any way someone could send the firmware for the -ARB? Or throw it online for everyone to enjoy?

Regards,
Tom

AwArD_RzD · « **Reply #20 on:** October 16, 2014, 10:38:52 pm »

I used this firmware with my 625a, just change the .txt to .bin enjoy !!

tomwim · « **Reply #21 on:** October 17, 2014, 01:19:10 am »

Thank you so much AwArD_RzD! Now All i have to do is fiddle a programmer together

Regards,
Tom

nidlaX · « **Reply #22 on:** February 09, 2015, 12:29:45 am »

Hey guys, here's another thread necro.

I went ahead and got an SG-100/A in need of repair after coming across this thread and seeing that there are owners on the forum here. After some preliminary testing, I've discovered that:

1. Fuse F5 on the signal output is open. I don't know what caused it, but probing the other side shows that the sine wave output seems to be working properly (frequency, gain, offset).

2. Although all function/arbitrary/pulse options are available in the firmware, I'm getting no output of the expected signals. I recall AwArD_RzD's first post with the PCB picture, and sure enough U21 is missing (I'm sad, there isn't even a socket soldered $:-\$ ).

This (2.) leads to my first question: is it normal for an SG-100/A with no arbitrary output option installed to have the options available in firmware, but U21 un-populated? (my guess is yes, but more evidence would help)

3. Probing the pins on the MAX532 (U45), I find that VDD and VSS, which are nominally +12/-12V from Telulex's schematic, measure at +15.6V/-15.1V. From Maxim's datasheet, I see that 15V power supply is fine, but should I be concerned that voltages are not as indicated on the manufacturer's schematic? (if someone could probe the test points for their MAX532, I would really appreciate it)

If all is as expected, my plan is to replace the blown fuse and install a socket+DAC. Can anyone please advise if I should proceed or if there are further pitfalls I should look for first?

Thanks!

Addendum: My SW version is 3.3, HW version is 1.7. The unit identifies itself as "SG100" on power up, so I'm further convinced that this is the normal behavior of an SG-100 without the A option (despite the label on the front panel).

nidlaX · « **Reply #23 on:** February 21, 2015, 07:47:48 am »

I started working on my unit today and ended up doing three things:
1. Replaced the output SMD fuse
2. Soldered a PLCC socket at U21
3. Installed an AD9713B

Now I have working sine wave and pulse / function output.

I would like to upgrade my firmware from V3.3 to V3.5 and retain my serial number and other model specific info. Is there anything I need to edit in the BNC625A ROM besides the serial number? Upgrading using SGLOAD.EXE from DOSBox doesn't work, must be some issue with DOSBox or my USB to RS232 converter...

nidlaX · « **Reply #24 on:** February 22, 2015, 11:30:13 pm »

Another update (and a word of caution to future modders):

I did some stability testing with the V3.5 BNC625A flashed SG-100/A and found that the unit would hard crash / lockup around every 30 minutes or so (no controls, output relay clicks, output lost). Strangely, the unit also seemed to be running hotter than it was with the V3.3 SG100 firmware. Finding this suspicious, I checked the power supply again, but it looks like the +-15V unit was intentionally used (as opposed to a +-12V unit). I contacted AwArD_RzD and was told that his unit behaves identically with the BNC625A firmware. Since my V3.3 firmware seems stable and already has the function/pulse/arb features enabled, I've flashed it back for the time being.

As an aside, it looks like the section of ROM that contains the calibration data has more values than what can be adjusted by using the SG100CAL program. Anyone who wants to flash over the entire ROM might want to copy at least the original calibration data as well as the serial number. The calibration data starts around offset 0600 while the serial number starts at 6F00.

Finally, I successfully applied the SG100-35 update over serial, but it seems to lock out the arb generator features on my unit. There's also an SG100c0 update available for the BNC 630/632, but flashing this one bricked the unit (although the bootloader recovery still works).


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: BNC 625A firmware (Read 13917 times)

Share me