Low Cost PCB's Low Cost Components

Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1263126 times)

0 Members and 1 Guest are viewing this topic.

Offline LeoIt

  • Newbie
  • Posts: 4
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #4375 on: August 21, 2017, 08:16:30 AM »
Hello everybody,

I have a question about DSA815....

I searched a lot in the forum to get information about the component U1220 it is a SOIC8 marked as MQD2C.... I didn't find what is it, somebody out there could help, it seems connected to the 4 pins strip near to the power supply connector, I suppose it it something controlled by TWI or SPI ?

May be it is a serial flash that contains some calibration or configuration data ?

Any help is much appreciated !

Many Thanks.
« Last Edit: August 21, 2017, 08:19:37 AM by LeoIt »

Offline TurboTom

  • Frequent Contributor
  • **
  • Posts: 259
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #4376 on: August 21, 2017, 09:40:25 AM »
This chip appears to be an 8 bit microcontroller, MC9S08QD2, see the datasheet here: http://www.nxp.com/docs/en/data-sheet/MC9S08QD4.pdf.

If the 2k of memory that it contains is enough for calibration data is something I'ld doubt. But it chould well be involved in license management. Yet more probable is that it's used for something much more mundane, like generating a power good signal/reset circuitry as it features four A/D channels. Food for thought...


Offline LeoIt

  • Newbie
  • Posts: 4
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #4377 on: August 22, 2017, 05:58:12 AM »
Thank you very much TurboTom !

You are right, it sould be HCS08 Micro, the Power supply pins are quite strange, not much used (+3 and -4)  and are compatible, also the strip connectio to pin 1 - Reset and  2 - BKGD are conneted to the strip (probably used to pogram o configuration and.... Single wire "debugging" ;-).....

I agree with you, its memory (2K Flash) is too small for DSA calibration data.....

Because its power supply seems separated from the main DSP and related chips, I think it will be used to power up the instruments....
I mean to make the fading blink of the ON/OFF button and to check its status to turn ON and OFF the entire system.

I hope, but not sure, it is not used like a sort of harware key to identify each device.
Or used to store the MAC address and other unique information of the instrument (but for this they should use the U1105 FRAM .... ? ).

Thank you again for your help....


Offline TurboTom

  • Frequent Contributor
  • **
  • Posts: 259
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #4378 on: August 23, 2017, 03:10:45 AM »
You're most probably right: The HCS08 variant appears to be part of several of Rigol's designs that feature the BlackFin processor as the digital core and a soft power button, see here the DS2000 (as per Dave's teardown photos, in the lower right corner, yet here it's the 4kB variant):

Similar situation for the DM3068, the DG4000 series and also the DS4000, yet in the latter Rigol uses a higher pin count / memory variant of the HCS08 series, the MC9S08JM60.

In contrary, the DS1000Z series doesn't seem to contain the HCS08 controller and this instrument features a "hard" power switch, so the usage of the controller for the soft power circuitry is very likely.

« Last Edit: August 23, 2017, 03:13:03 AM by TurboTom »

Offline chevdor

  • Newbie
  • Posts: 1
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #4379 on: August 24, 2017, 07:48:19 AM »
I have seen some questions several times (while searching myself) so I will try to provide a few facts based on my trials.

Using a Mac with an Olimex ARM-USB-OCH-H does work.
Just don´t expect to see anything in /dev/cu*. This is OK so.

My scope is a MSO1104Z-S. This is a recently purchased (2017-08) scope with the latest firmware (00.04.04.SP3).
The board shows version v01.04_20141024 on the PCB.

You guys probably saw the great video at: http://www.youtube.com/watch?time_continue=7&v=OvcGn_ScG5w
This video helps a lot if you take your time. Highly recommended. Yes, you will need to open your scope.

A little surprise though, the JTAG headers are not longer part of the board. You still have the holes and traces in the PCB but no header. Surprising but not really an issue.

New comers will probably miss the openocd config files. They are here:

Compiling rigup on a Mac is a breeze. Follow the guides.

You may get an error when running openocd:
Error: An adapter speed is not selected in the init script. Insert a call to adapter_khz or jtag_rclk to proceed.

No panic, you can add the following line:
Code: [Select]
adapter_khz 5000as line 34 in imx28.cfg

I did a few tests regarding the speed. Some failed, I am not sure whether it was due to the speed or the temperature.
I used a few fans during the process...

adapter_khz 1000 => works, just damn slow. Expect a dump in around 40-50 minutes. I did not wait...
adapter_khz 5000 => works. Around 10:30 minutes for the dump.
adapter_khz 8000 => failed me, the scope rebooted
adapter_khz 10000 => failed me, the scope rebooted

Code: [Select]
adapter_khz 5000, the dump will take about 10:30 minutes. I got it to work 2/2 times with pins simply hanging around in the PCB holes... Do not shake your desk  :-DD and make sure your fan does not move things around too much.

I did not apply the 0x1C080 (100 MHz) obviously.

Respect to the team who put that together.  :-+

Rigol plays it smart on that one as I am sure they are aware that they end up selling more of there 'hackable' scopes, thus making more $$$ than selling a few software options that are anyway harder to buy on their site than it is to find this thread!

A little warning though, you do need a few tools to get this to work:
- TX10 screwdriver
- 14mm flat wrench helps
- a fan is probably recommended
- a good lamp :)
- some stickers (not for the sticker, but for the waxed paper supporting them)
- clean headers (2x 5 pins). Those won´t be soldered so clean them up or use new ones. Forget those 5 years old headers you used 20 times...
- a few clean cables: if you start messy, chances of success will decrease...

Good luck

« Last Edit: August 30, 2017, 06:32:55 PM by chevdor »

Offline El Viking

  • Newbie
  • Posts: 1
  • Country: fr
Re: Sniffing the Rigol's internal I2C bus
« Reply #4380 on: September 02, 2017, 11:39:33 PM »

On a MSO1074z, software version 00.04.04.SP1, board version 2.1.4 a very new scope, delivery this week. Jtag was not populated.
I use a PC on W10-64-pro.
I setup olimex arm...h (some problems with driver solve with zadig).
I use rigup w64 version 0.4.2 from
I dump memory with openocd 0.10.0

first time I have used rigup-0.4.2-x86_64-win.zip  ==>good txt file, with good serial number, but license number don't run==>invalide licence
I made many dump.... same txt file, same key...
Second time I try with rigup-0.4.2-i686-win.zip==> same txt file, but license key accepted by the scope...
Now MSO is full option, I have all ready testing the RS232 decode, it run correctly.

Many thankssss to the working team!!!!


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo