REVIEW - Owon SDS7102 - A look at the SDS series from Owon

[kptn]

Ok, now I understand. You've replaced all the ports.
I've only used "TopJTAG Probe" and "TopJTAG Flash Programmer" with the hardware "Bus Blaster v4.1a" as "JTAGKey" clone. It run with a TCK freq. of 15MHz Max..
I'm not sure if with this HW (JTAGKey) I could make a NAND backup. In theory, yes:

Carrington,

Few month ago tinhead's description of JTAG pins was sufficient for me to make a full flash backup. I've used H-JTAG software.
Most recent H-JTAG has support for S3C2416 and the flash chip.

But when I did this it has become evident to me that this action is excessive for my purpose (my scope had only chineese menu language and I wanted to enable full langpack).
Because Owon's factory upgrade tool can do more than documented in the upgrade manual.

Upgrade tool (launcher.exe) is 100% java software and can be easily de-compiled back to source code.

Owon's firmware is encrypted while in storage. But the encryption key is included in the zip. (public.key)
One of the upgrade tool's command line modes is 'launcher.exe encrypt'. This helps to encrypt and decrypt firmware files (tx, os, fp, me, help,...) in both directions.
In order to submit a single file into the scope 'launcher.exe usbpatch' command line is in use.

My experience is explained in a little bit more details here:
    http://radiokot.ru/forum/viewtopic.php?p=1526909#p1526909
and here:
   http://radiokot.ru/forum/viewtopic.php?p=1725552#p1725552

Because it is in russian, you will need to use any online translator.

[Carrington]

Ok, now I understand. You've replaced all the ports.
I've only used "TopJTAG Probe" and "TopJTAG Flash Programmer" with the hardware "Bus Blaster v4.1a" as "JTAGKey" clone. It run with a TCK freq. of 15MHz Max..
I'm not sure if with this HW (JTAGKey) I could make a NAND backup. In theory, yes:

Carrington,

Few month ago tinhead's description of JTAG pins was sufficient for me to make a full flash backup. I've used H-JTAG software.
Most recent H-JTAG has support for S3C2416 and the flash chip.

But when I did this it has become evident to me that this action is excessive for my purpose (my scope had only chineese menu language and I wanted to enable full langpack).
Because Owon's factory upgrade tool can do more than documented in the upgrade manual.

Upgrade tool (launcher.exe) is 100% java software and can be easily de-compiled back to source code.

Owon's firmware is encrypted while in storage. But the encryption key is included in the zip. (public.key)
One of the upgrade tool's command line modes is 'launcher.exe encrypt'. This helps to encrypt and decrypt firmware files (tx, os, fp, me, help,...) in both directions.
In order to submit a single file into the scope 'launcher.exe usbpatch' command line is in use.

My experience is explained in a little bit more details here:
    http://radiokot.ru/forum/viewtopic.php?p=1526909#p1526909
and here:
   http://radiokot.ru/forum/viewtopic.php?p=1725552#p1725552

Because it is in russian, you will need to use any online translator.

I'm watching all now, thank you very much. Let's see if I can translate.

[Carrington]

@ kptn

Good job, finally you enabled the full langpack.


I load the SDS8202V's firmware on my SDS8102V, modifying this file (is very easy):
x:\Program Files\OWON\Patch\config.xml

It works perfectly, but is necessary to change the serial number, to enable SDS8202V's features (BW). But the funny thing is that the windows PC SW oscilloscope identifies it as a SDS8202V.

The Owon input stage supports more than 200MHz, the limit is only imposed by the LMH6518, so would be interesting hack it.

[Carrington]

I've only used "TopJTAG Probe" and "TopJTAG Flash Programmer" with the hardware "Bus Blaster v4.1a" as "JTAGKey" clone. It run with a TCK freq. of 15MHz Max..
I'm not sure if with this HW (JTAGKey) I could make a NAND backup. In theory, yes:

First:
My S3C2416XH-40 (KS88C0216) device Id. is: 00000111100100100110111100001111 (0x0000000007926F0F). It does not match with the BSDL file posted here.
I tried modifying the id. in the bsdl file, but does not work. And I can't find the correct BSDL file for this processor.

Second:
TopJTAG does not support this type of NAND (S29GL-P MirrorBit).

So, for the moment, I can't do a NAND dump.

[tinhead]

the BSDL file is ok, simply don't care about the ID.

[Carrington]

the BSDL file is ok, simply don't care about the ID.

Yes, no doubt. But I need other software to make a dump.

[tinhead]

But I need other software to make a dump.

TOP JTAG Flash works only for CFI/NOR memory, not NAND. I'm using here H-JTAG, as it does support both the SoC and NAND.
If you don't want spend money for H-JTAG USB (USD159 + shippment) you can still build LPT wiggler and let run the H-JTAG flasher for a day or two - and you will get dump of NAND as well. How to build such LPT wiggler has been describen in the H-JTAG software help file.

Any FTDI based wiggler (so ARM wiggler) and openocd should work as well (i have here only setups, schematics, tools for S3C2440 and smaller NAND, so not useful for you, but goodle is your friend)

[Carrington]

TOP JTAG Flash works only for CFI/NOR memory, not NAND. I'm using here H-JTAG, as it does support both the SoC and NAND.
If you don't want spend money for H-JTAG USB (USD159 + shippment) you can still build LPT wiggler and let run the H-JTAG flasher for a day or two - and you will get dump of NAND as well. How to build such LPT wiggler has been describen in the H-JTAG software help file.

Yes, I'm on it.
I'm thinking about using a USB-LPT based on a CH340 chipset.

Any FTDI based wiggler (so ARM wiggler) and openocd should work as well (i have here only setups, schematics, tools for S3C2440 and smaller NAND, so not useful for you, but goodle is your friend)

Don't worry, I might end selling it.

Thanks. 

for a day or two

Woow, very slow.

[akis]

I have got lost touch with this thread, what are you guys trying to do?

[Carrington]

I have got lost touch with this thread, what are you guys trying to do?

I want more BW.

[AndrejaKo]

I have got lost touch with this thread, what are you guys trying to do?

If I remember correctly, someone took the time to go through the firmware update package and found out how to decrypt the firmware for the scope. Right now, they seem to be trying to get some more firmware dumps from the scope itself to compare with data in the firmware (maybe?).  There's a suspicion that the 2 GSa/s model has software-controller bandwidth, so it may be worth hacking it.

There's been a big pause in this thread, so for the newest topic of interest, only the last two pages are relevant.

[akis]

Ah ok so this does not apply to the SDS7102 which is in the title of this (very long) thread?

[AndrejaKo]

I'd say that it does, but in an indirect way. You see, my perception is that they're building  a base for firmware hacking for the whole series. While the current goal of Carrington for example may be to increase the bandwidth of his scope, results would be useful for any other further firmware hacking.

[Carrington]

I'd say that it does, but in an indirect way. You see, my perception is that they're building  a base for firmware hacking for the whole series. While the current goal of Carrington for example may be to increase the bandwidth of his scope, results would be useful for any other further firmware hacking.

Exactly that's. At least, I want to try.


Custom firmware?
https://www.eevblog.com/forum/testgear/review-of-owon-sds7102/msg64492/#msg64492

[akis]

I thought the 1Gb/s limit was the ADC + clock frequency and did I read somewhere that if you use two channels it drops to 500Kb/s because of something shared or something?

In other words I had thought the SDS7102 has a hardware limit to 1Gb/sec.

[TomC]

Correct, but the SDS8102 is 2GB/s, different ADC scheme. I don't think the intent here is to change the sampling rate. However, this hardware sampling rate is sufficient to properly represent input frequencies beyond 100MHz. So if the input BW can be increased, the 2GB/s scope can be usable at perhaps 300MHz.

[akis]

For those who have the SDS7102 however the hard limit is 1Gb/s ?

How many samples per cycle are absolute minimum to display a meaningful 100MHz curve? I'd say 2 at least, hoping we'd hit the top and the bottom, and many more if we want to display a sine rather than a triangle?

[AndrejaKo]

Whoa there, don't make such dangerous assumptions about those ADCs. The ADC types in SDS7102 are two channel 500 MB/s (that's real MB/s, not MiB/s) units, which can be set to work as single channel 1 GB/s unit. These aren't Gb/s or kb/s ADCs! I've heard of research in very high speed sigma-delta ADCs which could in theory be used for imaging or datacapture with just one bit, but we're not close to having them in our "simple" oscilloscopes.


Next, in order to get relevant data, for 100 MHz sine wave with bit depth of 8 bits per sample, we need rate of 200 MB/s. This is due to the type of interpolation used, namely the sinc(x) function. The downside of this calculation is that we can get some pretty big problems if for example the start of the signal and the start of our sampling period aren't correctly matched. Basically, we need two correctly placed data points to use sinc interpolation to get a sine wave. I'm not sure how much points we'd need exactly, if there's a mismatch. It should be fun to calculate, so I'll try to get some results and graphs one of these days.

For a triangle, we'd definitely need even more data than we'd need for the "simple" sine wave. I'll try to make some experiments with that too, but I can't make any promises.


The SDS8000 series uses a two channel, 1 gigasample per second ADC, which can be set to work as single channel 2 GSA/s ADC.


In any case, on paper, SDS7102 should be capable of showing data with no aliasing up to 500 MHz and 8000 up to 1 GHz. I did use my SDS7102 go look at spectrum from DC to 500 MHz and the data looks OK, expect of course the high frequencies are severely attenuated. I could make out lower VHF TV channels though. I'll post a picture as soon as I dig it up.

This leaves us with the sample rate=bandwidth*10 rule of thumb, which would be violated in case of bandwidth increase. How big of a problem that would be, I'll leave for someone else to answer .

[Carrington]

I thought the 1Gb/s limit was the ADC + clock frequency and did I read somewhere that if you use two channels it drops to 500Kb/s because of something shared or something?

In other words I had thought the SDS7102 has a hardware limit to 1Gb/sec.

Highly summarized:
  - For real time sampling acquisition and bandlimited signal: Fs > 2Fmax.
    Now use common sense: Everything depends on the details that you want (I'm not talking about ADC dynamic range), more details -> more frequency components -> more BW, then -> more Fs.
    i.e.: The sampling rate must also be sufficient for an acceptable reconstruction of the signal, for example a square pulse.   

  - For equivalent time sampling acquisition and only periodic bandlimited signal, then Fs can be less than signal's BW. But I think that this is not the case.

An interesting document (211 to 236) [220]:
http://w140.com/Handbook_of_Oscilloscope_Technology.pdf

[kptn]

If you don't want spend money for H-JTAG USB (USD159 + shippment) you can still build LPT wiggler and let run the H-JTAG flasher for a day or two - and you will get dump of NAND as well. How to build such LPT wiggler has been describen in the H-JTAG software help file.

tinhead, that's correct.
As an example, I've already told that I've used this http://item.taobao.com/item.htm?id=10448149057 wiggler to dump the image of my SDS7102. Wait time was not critical for me - I prefered to buy a device for few bucks instead of soldering it for few hours.

H-JTAG sofware were good enough to access the flash. I don't know if it works with USB-LPT converters, I've used old PC motherboard with LPT port built-in.

Full flash read of the scope took me 6-7 hours. H-JTAG were able to show read performance in advance, so I just left in running for full night.


Tinhead, thank you as well for analysis of the flash dump you've made on this thread two years ago. I've used it to get my tx file  (calibration data).
Unfortunately, I did not succeed with Yaffs stuff - no one of public Yaffs readers I've tried were able to give me flash content.
Finally, I took my tx from raw image.

When looking at the flash dump I was surprised that each firmware upgrade been made takes a portion of the flash free space. So once upon a time the scope may reject you to perform next upgrade when the space will be exhausted!
This means that we probably should avoid to upgrade the device unless we actually want to use a specific new feature that comes with this particular upgrade.

[marmad]

This leaves us with the sample rate=bandwidth*10 rule of thumb, which would be violated in case of bandwidth increase. How big of a problem that would be, I'll leave for someone else to answer .

Highly summarized:
  - For real time sampling acquisition and bandlimited signal: Fs > 2Fmax.
    Now use common sense: Everything depends on the details that you want (I'm not talking about ADC dynamic range), more details -> more frequency components -> more BW, then -> more Fs.
    i.e.: The sampling rate must also be sufficient for an acceptable reconstruction of the signal, for example a square pulse.   

For sin(x)/x interpolation, a sampling rate of 2.5x the highest frequency is considered good enough to faithfully reconstruct the signal from the samples. But sin(x)/x is highly susceptible to errors if the original signal contains frequencies higher than the Nyquist frequency.

That is why the Rigol DS2000 series automatically switches from sin(x)/x interpolation to linear interpolation when the sampling rate <= 500MSa/s - because the Nyquist frequency starts to drop too low for reliable reconstruction. For example, @ 200MSa/s the Nyquist frequency is 100MHz - which easily passes through the BW filter.

When you use linear interpolation, it's cruder so it requires a higher sample rate ratio for faithful reconstruction (at least 8x, but 10x is considered the rule of thumb as AndrejaKo mentioned), but it won't introduce false peaks at slower sample rates like sin(x)/x might.

I'm not sure which (or when, if switching between them) interpolation scheme the Owon uses.

[Carrington]

Only as complement: pages 260-262 of the previous link.
Thanks marmad.

[tinhead]

Tinhead, thank you as well for analysis of the flash dump you've made on this thread two years ago.

you welcome

When looking at the flash dump I was surprised that each firmware upgrade been made takes a portion of the flash free space. So once upon a time the scope may reject you to perform next upgrade when the space will be exhausted!
This means that we probably should avoid to upgrade the device unless we actually want to use a specific new feature that comes with this particular upgrade.

oh that's ugly, i thought they using part as scratchpad, part as backup and part an live firmware.

[tony3d]

I bought the SDS7201 for $365.00 this past week. I rather like this scope, especially for the price. Plus it came with a free bag, and free shipping! Not a bad deal at all.

[TomC]

Yeah, I noticed that special sale at Saelig. I bought mine from them last January, but I paid $429. At the time the scopes being shipped had the GND noise issue, so I had to spend extra money later on to upgrade the PSU. Luckily, the scopes being shipped now don't have that issue. Hope you enjoy your new scope.