Rigol DS10xxZ firmware re-write

[tmbinc]

As outlined in https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/, I started to look into re-writing the RigolDS10xxZ firmware. The goal is to provide new software for the iMX as well as for the FPGA so we have an open-source (software) scope that's easily hackable. To be very plain: this hasn't happened yet. But I still want to open this thread in case other people want to work with me.

Motivation

The motivation for this effort is that the Rigol DS10xxZ is a dirt-cheap scope with okay-ish hardware that's hackable. Other scopes either have inferior hardware, are more expensive, have weird application processor architectures for which no open toolchains (compiler, debugger, infrastructure in general) exist, or use ASICs. The DS10xxZ is in sweet spot where it's affordable, uses off-the-shelf chips, ARM architecture, Xilinx Spartan-6 FPGA (for which a free toolchain exists), and is decently-spec'ed. I understand there are other scopes which are similar, but it seems the Rigol one is most popular.

(It is a valid question whether a Zynq-based scope would be a better target, and I would immediately say "yes" if availability for these wouldn't be so poor at a sub-400EUR price point.)

What I have today



I can boot Linux, which means we have:

• USB
• LCD/Framebuffer
• Ethernet
• Frontpanel LEDs
• Frontpanel buttons

u-boot is here: https://github.com/tmbinc/rigol-uboot
I load u-boot via JTAG/OpenOCD and then boot from USB-storage, I haven't yet looked into writing u-boot to flash. I'm not saying that Linux is the ideal choice, but it's a good test vehicle to validate that the hardware works.

There's a lot of things to figure out - including the whole "scope" part, the FPGA pinout, the FPGA<>iMX communication.

I can add more information if other people are interested in this.

[Kilrah]

NICE! 

[bitseeker]

Thanks for starting a dedicated thread for this project. It certainly deserves it. Definitely continue adding info and progress updates to pique interest.

[Aigor]

Nice Project  as far you know, there are some possibility to add support for logic analyzer?

Many thanks

[tautech]

Link in OP doesn't work as it's got a comma embedded at the end of the URL.
Fixed:
https://www.eevblog.com/forum/buysellwanted/wtb-broken-rigol-ds10xxz-scopemainboard/

[tmbinc]

Sorry, fixed it.

Here's a random dump of things that need to be done (and with an estimation of difficulty), non-exhaustive of course.

• S: Figure out JTAG port to Xilinx FPGA pinout (Thank you, JJalling! https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1195497/#msg1195497)
• S: document findings in more details (frontpanel, IO, ...) in a public wiki
• S: find a better serial port for debug spew than the frontpanel IO
• M: Figure out connections between FPGA and iMX
• M: figure out existing iMX<>FPGA protocotol
• M: reverse input stage (analog stage etc., similar to what has been done for other scopes) Done, thanks Dave and Ink (https://www.eevblog.com/forum/projects/rigol-ds10xxz-firmware-re-write/msg1202261/#msg1202261)
• M: figure out, and reverse, role of the Actel FPGA
• M: figure out FPGA pinout to ADC
• M: figure out FPGA to memory pinout
• M: figure out how to easily (i.e. without risk to brick the thing) run custom code without opening the case
• L: reverse full scope PCB to schematics
• L: write host demo code to interface with existing FPGA and drive basic scope functionality
• L: re-implement FPGA firmware
• XL: architect and implement a "scope application"

Feel free to grab one of these items and work on it .

[Lightages]

Great to see this effort! 

I will be following this for sure.

[pelule]

Sound promissing
I have bookmarked to following this.

[JJalling]

• S: Figure out JTAG port to Xilinx FPGA pinout

I have attached a picture of the JTAG pinout of the FPGA

BR Jonas

[ajb]

 

Out of curiosity, what in particular would you be looking to improve in an eventual open-source firmware versus the standard firmware?  Obviously there's a lot of work to do just to get to parity with the factory firmware, but just curious about your ultimate motivation. 

[Kilrah]

Same as any open source initiative - the ability for anyone to then modify or implement a feature for his needs.

Off the shelf products always do 99% of the things you want, but there's no way to get that last 1% unless the manufacturer happens to add it. If there's a decent open base you can code it yourself.

[bitseeker]

Off the shelf products always do 99% of the things you want, but there's no way to get that last 1% unless the manufacturer happens to add it. If there's a decent open base you can code it yourself.

There's also changing the way the manufacturer did things to better suit your requirements, workflow, etc. Granted, an open source project don't always result in something that's on par or better than the original, but it opens the possibility to do more, do it differently, or keep it going longer than the manufacturer wants to support it.

[DrTune]

If it was pretty much anyone except Felix Domke behind this project I'd dismiss this as a wildly overambitious pipe-dream...  but now I'm excited! :-)

[james_s]

If it could come anywhere close to the success of the open source firmware available for popular broadband routers then that would really be something. A scope seems a lot more complex, at least on the surface, but perhaps it's actually not. I don't know how much of the "magic" is done in hardware and how much relies on the software.

[GeorgeOfTheJungle]

• M: Figure out connections between FPGA and iMX
• M: figure out existing iMX<>FPGA protocotol

What i.MX is that? I'm currently repurposing a kindle 4 as a datalogger (I love that eink display), it's an i.MX508. Amazon has published most of the gpled code and there's a lot of info @ mobileread.com. Have you managed to get any sources? from Rigol perhaps? That would help a lot.

[tmbinc]

It's an i.MX28 (http://www.nxp.com/assets/documents/data/en/data-sheets/IMX28CEC.pdf), so it's really not awesome (and still an ARM926, i.e. ARMv5T).

As far as I know, Rigol didn't use any GPL'ed code. Other than that, most of the i.MX28 functionality works - it's rather everything scope-specific that we need to figure out.

[Cerebus]

Just so there's a reference to it in this thread: There's a wiki that has some schematics and other assorted hardware info for the DS1052, here: http://rigol.codenaschen.de/index.php/Main_Page

[Fungus]

I don't know how much of the "magic" is done in hardware and how much relies on the software.

I suspect there will be a fair bit of disassembly and reverse engineering of existing firmware in this project.

[GeorgeOfTheJungle]

Oh, what a pity, that -to me- sounds like bad news. I can read the sources of the eink driver and not have to figure it all out. Or see exactly how/what does it do to read the battery's mAh from the gas gauge chip, etc.

But my project is essentially different because as I'm not trying to use the kindle as a kindle anymore I don't need to use nor understand any of its apps (whose sources aren't available), but you will have to. I have even deleted them already! With the sources headers and configs I can compile my own drivers and apps and be happy.

But no sources at all? No, I for one would be totally lost if I were you!

[GeorgeOfTheJungle]

But I have a Guinea pig ^w^w 1074Z-S. If it can be of any help just let me know :-)

[cBaer]

Hi,
saw this featured on Hackaday, so i decided to join the party. I call a Rigol MSO1104Z (one with logic analyzer) my own. I like the scope, but i think it could perform better. Its mostly aliasing(REALLY ANNOYING), slow interface responding and an XY-Mode (that is actually a joke) which could be well improved. Try to put oscillofun on it and you see what i mean. Maybe we can add more features like XYZ-Mode, SDR stuff, eye diagrams and others.

Since I'm into SDR and Spartan 6 Ill try to help where i can.

To the RE:
I think theres a chance of getting the firmware and bitstreams of the FPGA, but because of the nature of FPGA's it will be next to impossible to RE the bitstreams. Thats bad because the HDL is directly coupled with the software. I would start with getting the full schematic together and then find out how it is driven and how it performs tasks like calibrating, selftest and so on.

Since this is my only scope im not going to tear it apart, maybe ill find another one on ebay.

[GeorgeOfTheJungle]

With that i.MX sadly I don't think there's much room for improvement in the cpu/performance side of things.

[bitseeker]

Ah, but once the software is open, then upgrading some of the hardware might be an option. At least one can hope for it.

[PhiMX]

Cool! This is awesome!

I just bought my ds1054z yesterday and now such a thing happens!
One might take a look at the DSO quad community firmware (wildcat) which is an OSS app to drive the tiny oscilloscope. It is quite feature-packed compared to the
original software and might be easy to port over and be a starting point. The hardware is different (Lattice ICE65) but the verilog code is out there, quite simple and might be also possible to re-target.
I am unsure if its a good idea to port it rather than start from scratch, but at least it´s something worth to take a look at.

Oscilloscope app overview and download, source included:
http://www.seeed.cc/DSO-Quad-community-edition-Wildcat-updates-t-6071.html
git for thhe older community app:
https://github.com/pmos69/dso203_gcc
git for the original source including FPGA source:
https://github.com/Seeed-Studio/DSOQuad_SourceCode


As I already said it is no request to port it over, it´s just a working and open soure embedded oscilloscope app and fpga source that´s worth to be looked at.

[Redline99]

Sounds like fun tmbinc 

I happen to have one of these too and would love to understand more of its inner workings, even just for the fun knowledge of it.