Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1841398 times)

0 Members and 4 Guests are viewing this topic.

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Sniffing the Rigol's internal I2C bus
« Reply #2175 on: December 27, 2013, 12:57:38 am »
I would rather worry about overshoot:
Yes, That's what I meant.

I thought that everyone would understand.
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline jkw13

  • Contributor
  • Posts: 18
Re: Sniffing the Rigol's internal I2C bus
« Reply #2176 on: December 27, 2013, 10:50:19 am »
I tried that also, ("SYSTEM:OPTION:UNINSTALL") just times out with "Remote command is incorrect!" appearing on DP832 screen.
The other thing I notice is that V1.06 has 30 calibration DAC points, V1.08 has only 29 points.
I think there is something sinister going on here, hope to be proved wrong |O

Thanks!
« Last Edit: December 28, 2013, 02:00:06 am by jkw13 »
 

Offline mightyzen

  • Contributor
  • Posts: 36
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #2177 on: December 27, 2013, 04:29:50 pm »
I would rather worry about overshoot:



This is for 0 cm, 1 cm, 5 cm and 10 cm stubs, using vacuum (air) as dielectric. So this should correspond to about 0 cm, 0.5 cm, 2.5 cm and 5 cm stubs for real world dielectrics.

Very interesting. What program did you use for this?
 

Offline EV

  • Frequent Contributor
  • **
  • Posts: 525
  • Country: fi
  • Aficionado
Re: Sniffing the Rigol's internal I2C bus
« Reply #2178 on: December 27, 2013, 05:08:18 pm »
Text added!  :)
 

Offline m-joy

  • Contributor
  • Posts: 45
Re: Sniffing the Rigol's internal I2C bus
« Reply #2179 on: December 27, 2013, 06:09:41 pm »
Well this is pretty much theory. This is the case if the coax cable impedanz is perfectly 50ohm which is not the case and if the Transmission line inside is perfectly and if the Terminator is perfectly 50ohm ... I would worry more about tolerances than this line theory
 

Offline clifford

  • Regular Contributor
  • *
  • Posts: 64
  • Country: at
    • www.clifford.at
Re: Sniffing the Rigol's internal I2C bus
« Reply #2180 on: December 27, 2013, 06:27:29 pm »
Very interesting. What program did you use for this?

This is Qucs (http://qucs.sourceforge.net).
 

Offline clifford

  • Regular Contributor
  • *
  • Posts: 64
  • Country: at
    • www.clifford.at
Re: Sniffing the Rigol's internal I2C bus
« Reply #2181 on: December 27, 2013, 06:57:08 pm »
Well this is pretty much theory. This is the case if the coax cable impedanz is perfectly 50ohm which is not the case and if the Transmission line inside is perfectly and if the Terminator is perfectly 50ohm ... I would worry more about tolerances than this line theory

The argument stays the same: It all happens within a few centimeters of the receiver.

But you are right: Screw the theory and lets make a simple experiment. :-/O



This is the fastest rise time I could generate within a few minutes for a simple test (that's the trigger output of my DG1022). So maybe someone with access to a faster rising edge could create a better test case.

The white trace (R1) is with the coax going directly into the scope input. So technically this is unterminated. But there is 50 Ohms termination on the other end, so it should more or less look the same as if we had 50 Ohms termination in the scope. The yellow trace (1) is with a BNC T connector with a 50 Ohms terminator on the second port.

We can see that it wants to overshoot a bit, as we would have expected from the simulation. But because the signal itself rises not fast enough we only end up with a trace slightly above the trace from the first case.

This is on my DS2072 (HW 2.0, SW 00.02.01, "upgraded" to a DS2303) with averaging of 1024 triggers.

PS: Yes, the trigger level is a bit awkward. I only realized that after I have created the screenshot. (I think that is simply the level I had already set and I did not bother to touch it because the trace looked fine.) The behavior does not change if I move the trigger down a bit. I've tried that, I just did not bother to create new screenshot.
« Last Edit: December 27, 2013, 07:01:10 pm by clifford »
 

Offline EV

  • Frequent Contributor
  • **
  • Posts: 525
  • Country: fi
  • Aficionado
Re: Sniffing the Rigol's internal I2C bus
« Reply #2182 on: December 27, 2013, 08:45:44 pm »
Try scopes trigger out signal. It is very fast


This is the fastest rise time I could generate within a few minutes for a simple test (that's the trigger output of my DG1022). So maybe someone with access to a faster rising edge could create a better test case.

 

Offline Wim13

  • Regular Contributor
  • *
  • Posts: 241
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #2183 on: December 28, 2013, 09:04:49 am »
Very interesting. What program did you use for this?

This is Qucs (http://qucs.sourceforge.net).

One thing you have to add to your simulation.

The scoop entry is also a low pass filter, in this case a 300 Mhz low pass filter,

thats why signals going to the 300 Mhz always look always like a sine wave, because of the low pass filter.
All the harmonics are gone after 150 Mhz, all is left is a sine wave..

So a scoop of 300 Mhz is usefool to 20 Mhz.
 

Offline clifford

  • Regular Contributor
  • *
  • Posts: 64
  • Country: at
    • www.clifford.at
Re: Sniffing the Rigol's internal I2C bus
« Reply #2184 on: December 28, 2013, 12:53:51 pm »
One thing you have to add to your simulation.
The scoop entry is also a low pass filter, in this case a 300 Mhz low pass filter,

This is tricky because the 16pF / 1 MOhm scope input is already part of the 300 MHz spec. But I've created bode plots of the original circuit and with an added first order 300 MHz low pass:

http://imgur.com/a/sMYNH

This set of images also contains a transient simulation of the circuit with the added additional filter. As you can see, the rise time is slightly lower now but it does not really make any difference regarding the qualitative effect of the short transmission line between the termination resistor and the scope input.

thats why signals going to the 300 Mhz always look always like a sine wave, because of the low pass filter.
All the harmonics are gone after 150 Mhz, all is left is a sine wave..

So a scoop of 300 Mhz is usefool to 20 Mhz.

I think you are confusing bandwidth and sampling frequency here. All DS2000 scopes have a sampling frequency of 2 GHz.

Also: The harmonics above the nyquist frequency (1 GHz in this case) are not gone or magically filtered by the sampling. They show up as aliasing frequencies. You have to actively filter those components out using an anti-aliasing filter. If you sample fast enough you already have significant low pass characteristics on your input path and don't need to build a filter, its just implicitly there. That's the 300 MHz in this case.

But those filters never do have an ideal sinc impulse response. So you will never see a signal just morphing into a pure sine wave when approaching the filter edge frequency. (You can build such filters in a DSP of course: Just perform an FFT, mask out the frequencies you do not want, and run an IFFT. But you will never see the equivalent of that in an analog filter.)

There is this rule of thumb that you should have at least a factor 10 between sampling frequency and bandwidth. It is a good rule of thumb, but it is not the ultimate answer. The minimum factor between sampling frequency an signal bandwidth depends on the kind of signal you are interested in, the kind of aliasing filter you are using and the interpolation method you are using. In most RF applications you can get pretty close to the nyquist frequency, because you have extremely band-limited signals, use high order filters and you effectively use a sin(x)/x interpolation (you will never actually look at the signal in the time domain, but the algorithms work with an equivalent representation).
 

Offline tirulerbach

  • Contributor
  • Posts: 33
Re: Sniffing the Rigol's internal I2C bus
« Reply #2185 on: December 28, 2013, 02:36:41 pm »
Hello,

Just to make sure: Is the JTAG-port on DS2202A at 3.3 Volt?
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Sniffing the Rigol's internal I2C bus
« Reply #2186 on: December 28, 2013, 02:57:13 pm »
One thing you have to add to your simulation.
The scoop entry is also a low pass filter, in this case a 300 Mhz low pass filter,

This is tricky because the 16pF / 1 MOhm scope input is already part of the 300 MHz spec. But I've created bode plots of the original circuit and with an added first order 300 MHz low pass:

http://imgur.com/a/sMYNH

This set of images also contains a transient simulation of the circuit with the added additional filter. As you can see, the rise time is slightly lower now but it does not really make any difference regarding the qualitative effect of the short transmission line between the termination resistor and the scope input.

thats why signals going to the 300 Mhz always look always like a sine wave, because of the low pass filter.
All the harmonics are gone after 150 Mhz, all is left is a sine wave..

So a scoop of 300 Mhz is usefool to 20 Mhz.

I think you are confusing bandwidth and sampling frequency here. All DS2000 scopes have a sampling frequency of 2 GHz.

Also: The harmonics above the nyquist frequency (1 GHz in this case) are not gone or magically filtered by the sampling. They show up as aliasing frequencies. You have to actively filter those components out using an anti-aliasing filter. If you sample fast enough you already have significant low pass characteristics on your input path and don't need to build a filter, its just implicitly there. That's the 300 MHz in this case.

But those filters never do have an ideal sinc impulse response. So you will never see a signal just morphing into a pure sine wave when approaching the filter edge frequency. (You can build such filters in a DSP of course: Just perform an FFT, mask out the frequencies you do not want, and run an IFFT. But you will never see the equivalent of that in an analog filter.)

There is this rule of thumb that you should have at least a factor 10 between sampling frequency and bandwidth. It is a good rule of thumb, but it is not the ultimate answer. The minimum factor between sampling frequency an signal bandwidth depends on the kind of signal you are interested in, the kind of aliasing filter you are using and the interpolation method you are using. In most RF applications you can get pretty close to the nyquist frequency, because you have extremely band-limited signals, use high order filters and you effectively use a sin(x)/x interpolation (you will never actually look at the signal in the time domain, but the algorithms work with an equivalent representation).
@ clifford: I agree, and I add some additional information that is related, read also attached fille:

Highly summarized:
  - For real time sampling acquisition and bandlimited signal: Fs > 2Fmax.
    Now use common sense: Everything depends on the details that you want (I'm not talking about ADC dynamic range), more details -> more frequency components -> more BW, then -> more Fs.
    i.e.: The sampling rate must also be sufficient for an acceptable reconstruction of the signal, for example a square pulse.   

  - For equivalent time sampling acquisition and only periodic bandlimited signal, then Fs can be less than signal's BW. But I think that this is not the case.

An interesting document (211 to 236) [220]:
http://w140.com/Handbook_of_Oscilloscope_Technology.pdf
For sin(x)/x interpolation, a sampling rate of 2.5x the highest frequency is considered good enough to faithfully reconstruct the signal from the samples. But sin(x)/x is highly susceptible to errors if the original signal contains frequencies higher than the Nyquist frequency.

That is why the Rigol DS2000 series automatically switches from sin(x)/x interpolation to linear interpolation when the sampling rate <= 500MSa/s - because the Nyquist frequency starts to drop too low for reliable reconstruction. For example, @ 200MSa/s the Nyquist frequency is 100MHz - which easily passes through the BW filter.

When you use linear interpolation, it's cruder so it requires a higher sample rate ratio for faithful reconstruction (at least 8x, but 10x is considered the rule of thumb as AndrejaKo mentioned), but it won't introduce false peaks at slower sample rates like sin(x)/x might.

I'm not sure which (or when, if switching between them) interpolation scheme the Owon uses.
Only as complement: pages 260-262 of the previous link.
Thanks marmad.
« Last Edit: December 28, 2013, 03:15:23 pm by Carrington »
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Sniffing the Rigol's internal I2C bus
« Reply #2187 on: December 28, 2013, 03:01:49 pm »
Hello,
Just to make sure: Is the JTAG-port on DS2202A at 3.3 Volt?
Yes, I think.
« Last Edit: December 28, 2013, 03:04:13 pm by Carrington »
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline dtran11

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #2188 on: December 28, 2013, 04:23:30 pm »
I will try it later tonight as well, just need to hack something together that generates a fast rising edges first, to test the 100 MHz with  :)

I can try it too. Is latest DS1000Z firmware 00.02.01.SP1 requested for unlocking 100MHz?
Do we have some info or change list for this firmware? Thanks :)

I just got a DS1074Z. Do the keys still work if I upgrade to 00.02.01.SP1? Also is there anyway to revert the options if I need to send in for repair?

Thanks
 

Offline Avotronics

  • Regular Contributor
  • *
  • Posts: 58
  • Country: gb
    • Rigol Hacks
Sniffing the Rigol's internal I2C bus
« Reply #2189 on: December 28, 2013, 04:44:12 pm »

I will try it later tonight as well, just need to hack something together that generates a fast rising edges first, to test the 100 MHz with  :)

I can try it too. Is latest DS1000Z firmware 00.02.01.SP1 requested for unlocking 100MHz?
Do we have some info or change list for this firmware? Thanks :)

I just got a DS1074Z. Do the keys still work if I upgrade to 00.02.01.SP1? Also is there anyway to revert the options if I need to send in for repair?

Thanks

Ifaik the DS1000Z isn't hackable yet.
Why would you buy something ready made when you can make it yourself with half the features for twice the money!
 

Offline neamyalo

  • Contributor
  • Posts: 12
Re: Sniffing the Rigol's internal I2C bus
« Reply #2190 on: December 28, 2013, 05:58:14 pm »
Finally I have a full memory dump from my DS2072A.

It was taken in a single snapshot, approx 1 min after booting with no user interaction (options details window had timed out/disappeared and CH1/CH2 traces were visible)

https://mega.co.nz/#!rcl23CyD!Pp9LZgukP_k4T2OmqfUtmncP2chWoaGDI0yVS5x5Mis
 

Offline neamyalo

  • Contributor
  • Posts: 12
Re: Sniffing the Rigol's internal I2C bus
« Reply #2191 on: December 28, 2013, 06:04:23 pm »
I'm having a few issues with my JTAG probe

Thanks for your efforts on this. Did you manage to do a JTAG verify of dump file against the device?. I'm not very familiar with DS code, but there is a lot of 0xFF empty space in the dump which would make me suspicious if I had dumped it.

I haven't been able to verify the dump as my JTAG link is extremely slow (12 hours to dump 32MB of SDRAM), but I've no reason to think it is incorrect (i.e. no error messages etc, and "RIGOL Technology" strings are present in the data)
 

Offline dtran11

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #2192 on: December 28, 2013, 06:27:42 pm »

I will try it later tonight as well, just need to hack something together that generates a fast rising edges first, to test the 100 MHz with  :)

I can try it too. Is latest DS1000Z firmware 00.02.01.SP1 requested for unlocking 100MHz?
Do we have some info or change list for this firmware? Thanks :)

I just got a DS1074Z. Do the keys still work if I upgrade to 00.02.01.SP1? Also is there anyway to revert the options if I need to send in for repair?

Thanks

Ifaik the DS1000Z isn't hackable yet.

There are codes for the ds1000z already in the latest riglol.
 

Offline clifford

  • Regular Contributor
  • *
  • Posts: 64
  • Country: at
    • www.clifford.at
Re: Sniffing the Rigol's internal I2C bus
« Reply #2193 on: December 28, 2013, 06:35:04 pm »
@ clifford: I agree, and I add some additional information that is related, read also attached fille:
[...]

Wow! The Agilent AppNote is a good read. Thanks!
(Nothing really new but everything in one place.) :-+

I've bookmarked it for future reference, as this is a topic that seams to come up every now and then.

http://cp.literature.agilent.com/litweb/pdf/5988-8008EN.pdf

PS: When I said "filters with an ideal sinc impulse response" I was referring to "brick wall" filters of course, but I did not remember the word, so I described it. Fortunately it was mentioned in that AppNote, so at least for today I know the word again.

PPS: I really like the introduction to sin(x)/x interpolation given in the following article. (Nothing new there either, just another nice document that summarizes a topic.) But it is ridiculous that they managed to f*ck up the formulas in the pdf..  :palm:

http://www.eetimes.com/document.asp?doc_id=1272526
 

Offline Teneyes

  • Frequent Contributor
  • **
  • Posts: 498
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #2194 on: December 28, 2013, 07:00:37 pm »
PPS: I really like the introduction to sin(x)/x interpolation given in the following article.
@ Clifford and Non "first-impressions" readers
Just a few displays to demo Sin(x)/X on the Rigol DS2000, to help show what happens
1. Display of 1 dot off line,
2. Displayed with Vectors,
3. Display of 2 dots off line,
4. Display of 2 samples in vectors,    ( a bit off topic so I will delete soon 18v)
« Last Edit: December 31, 2013, 04:15:22 pm by Teneyes »
IiIiIiIiIi  --  curiosity killed the cat but, satisfaction brought it back
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2195 on: December 28, 2013, 07:03:11 pm »
I will try it later tonight as well, just need to hack something together that generates a fast rising edges first, to test the 100 MHz with  :)
I can try it too. Is latest DS1000Z firmware 00.02.01.SP1 requested for unlocking 100MHz?
Do we have some info or change list for this firmware? Thanks :)

I just got a DS1074Z. Do the keys still work if I upgrade to 00.02.01.SP1? Also is there anyway to revert the options if I need to send in for repair?

Thanks
Ifaik the DS1000Z isn't hackable yet.
Yes DS1000Z is hackable: http://riglol.3owl.com
Quote
DS1000z device options:
DSAB - Advanced Triggers
DSAC - Decoders
DSAE - 24M Memory
DSAJ - Recorder
DSBA - 500uV Vertical
DSEA - 100MHz
DSFR - all options

The hacks are even mirrored at your own website Avotronics ;) :-DD http://rigol.avotronics.co.uk/mirrors/riglol/


Also is there anyway to revert the options if I need to send in for repair?
Use the SCPI command ":SYSTem:OPTion:UNINSTall" to remove installed option keys again. Search this topic for :SYSTem:OPTion:UNINSTall
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Sniffing the Rigol's internal I2C bus
« Reply #2196 on: December 28, 2013, 07:25:18 pm »
@clifford:

Wow! The Agilent AppNote is a good read. Thanks!
(Nothing really new but everything in one place.) :-+

...

The first pages [1-5] have reminded me those days studying signals and systems.
Figure 4 is a point of view very graphic about the aliasing.
Pages 6, 8 and 9 are interesting, too.
I wonder if the DS2000 have the FIR filter implemented in the DSP, or in the FPGA.

Thanks.  ;)



@Teneyes:

Teneyes and its magic.
Lovely sinc...



A few days ago someone mention something about a Tek oscilloscope that in dots mode showed more samples than should be.
It's not magic, are interpolated (maths).
« Last Edit: December 28, 2013, 07:58:41 pm by Carrington »
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline Avotronics

  • Regular Contributor
  • *
  • Posts: 58
  • Country: gb
    • Rigol Hacks
Sniffing the Rigol's internal I2C bus
« Reply #2197 on: December 28, 2013, 08:10:25 pm »

I will try it later tonight as well, just need to hack something together that generates a fast rising edges first, to test the 100 MHz with  :)
I can try it too. Is latest DS1000Z firmware 00.02.01.SP1 requested for unlocking 100MHz?
Do we have some info or change list for this firmware? Thanks :)

I just got a DS1074Z. Do the keys still work if I upgrade to 00.02.01.SP1? Also is there anyway to revert the options if I need to send in for repair?

Thanks
Ifaik the DS1000Z isn't hackable yet.
Yes DS1000Z is hackable: http://riglol.3owl.com
Quote
DS1000z device options:
DSAB - Advanced Triggers
DSAC - Decoders
DSAE - 24M Memory
DSAJ - Recorder
DSBA - 500uV Vertical
DSEA - 100MHz
DSFR - all options

The hacks are even mirrored at your own website Avotronics ;) :-DD http://rigol.avotronics.co.uk/mirrors/riglol/


Also is there anyway to revert the options if I need to send in for repair?
Use the SCPI command ":SYSTem:OPTion:UNINSTall" to remove installed option keys again. Search this topic for :SYSTem:OPTion:UNINSTall

Bugger! Lol.

That'll teach me. I was certain there were no hacks.
Wonder if I was thinking of another model....

Wait. Wasn't it that, originally, the DS1074Z hacks didn't add 100MHz option? Is that a new addition?
Why would you buy something ready made when you can make it yourself with half the features for twice the money!
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2185
Re: Sniffing the Rigol's internal I2C bus
« Reply #2198 on: December 28, 2013, 08:12:23 pm »
neamyalo thank you for your work - would you be willing to upgrade to the latest firmware and repeat the full dump?

Your dump says it is 00.02.00.00.04 and the latest fw I know of is 00.02.01.00.03.

Thanks!
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2199 on: December 28, 2013, 08:30:57 pm »
Bugger! Lol.

That'll teach me. I was certain there were no hacks.
Wonder if I was thinking of another model....

Wait. Wasn't it that, originally, the DS1074Z hacks didn't add 100MHz option? Is that a new addition?
Yes that's probably what you were thinking of. The 100 MHz option is a relatively new addition posted by seronday on 12 December 2013: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg346786/?topicseen#msg346786
Anyone who wants to change their new DS1074Z into a DS1104Z use the following Codes:-

DSHA  makes a  DS1104Z with no options enabled .
DSHR  makes a  DS1104Z with all options enabled .

The 3dB bandwidth for the DS1104Z is approx 160Mhz.
The 3dB bandwidth for the DS1074Z is approx 90Mhz.



Minor correction to my previous post after some further investigation.

DSHA also enables the 500uV setting and another unknown, (at present), option.

DSEA is the correct code to change to a DS1104Z only. ( no options ). See table below.

 Code      DS1104z    Unknown     500uV setting
DSBA                                               X
DSCA                            X
DSDA                            X                 X
DSEA           X
DSFA           X                                  X
DSGA           X               X
DSHA           X               X                 X

So to change a DS1074Z into a DS1104Z with all options enabled except the 500uV/div (which does not work correctly at present),
the code  will be DSER.

It is possible to revert back to original, by using the SCPI command " :SYSTem:OPTion:UNINSTall " .

As mentioned in my previous post, the measured 3dB down bandwidth after changing to a DS1104Z, is approx 160Mhz.
All the tests were done on a DS1074Z with Ver:00.02.00.SP1.
« Last Edit: December 28, 2013, 08:32:34 pm by AndersAnd »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf