Lecroy wavesurfer 3024 fail to boot

[bson]

My WS3054 has started acting up again and the micro-SD based recovery doesn't seem to help. It displays the logo and steps through "Upgrading Logo", "Upgrading FPGA", and "Upgrading Boot IMG" (or "Image", forget off hand as I'm typing this); it stops at the latter for 5 seconds or so, then starts over.  I take this to mean it failed and reset.  I've tried both 32GB and 8GB (SDHC) cards, MBR partition tabled, with a single primary partition set to active.  FAT32 with 16k and 8k extents, respectively. (I used diskpart on Win10.)  No dice, both cards behave exactly the same...
The file I have and used is WS3K_ACQ3ND_8.4.1.5.zip

I have a gut feel this means the NAND flash has too many errors for the CRC to be recoverable and it needs to be reformatted (presumably the bad sectors will be replaced).  But if I'm going to do that and go through a complete reformat and reinstall I might be better off replacing them (assuming not super high density BGA).  If BGA there might also be a detached or cracked ball...

Looking for ideas...

[bson]

I have not attempted 9.6.0.1 yet. I would like someone to confirm that it does indeed work for WS3000

Super belated comment... but yes, 9.6.0.1 is what I have on my non-Z 3054 and it worked great.  I assume you already figured out the answer, but maybe this is of some use to someone else coming across this thread in the future.

[analogRF]

My WS3054 has started acting up again and the micro-SD based recovery doesn't seem to help. It displays the logo and steps through "Upgrading Logo", "Upgrading FPGA", and "Upgrading Boot IMG" (or "Image", forget off hand as I'm typing this); it stops at the latter for 5 seconds or so, then starts over.  I take this to mean it failed and reset.  I've tried both 32GB and 8GB (SDHC) cards, MBR partition tabled, with a single primary partition set to active.  FAT32 with 16k and 8k extents, respectively. (I used diskpart on Win10.)  No dice, both cards behave exactly the same...
The file I have and used is WS3K_ACQ3ND_8.4.1.5.zip

I have a gut feel this means the NAND flash has too many errors for the CRC to be recoverable and it needs to be reformatted (presumably the bad sectors will be replaced).  But if I'm going to do that and go through a complete reformat and reinstall I might be better off replacing them (assuming not super high density BGA).  If BGA there might also be a detached or cracked ball...

Looking for ideas...

by "again" you mean you had done recovery before and it had worked for a while?

I think formatting the flash should fix it. In case you want to replace it, the FLASH chip is MT29C4G96MAZBACKD-5 (marking JW732)
but the board is HUGE and very thick, so personally I dont have the courage to replace that chip frankly 

[bson]

by "again" you mean you had done recovery before and it had worked for a while?

I think formatting the flash should fix it. In case you want to replace it, the FLASH chip is MT29C4G96MAZBACKD-5 (marking JW732)
but the board is HUGE and very thick, so personally I dont have the courage to replace that chip frankly 

Yeah, got stuck in a boot loop before and I restored it back to working order.  This was about a year ago.

Will I need anything else other than rename '_format.bin' to 'format.bin'?  I see there's a 182MB file there (LecroyNK.up), is this some sort of compressed package file?  Or do I need some sort of separate installer or packages afterwards?

Also, if it's self-contained, which I assume it is - will it also recover the S/N, licenses and cal data from a more reliable or duplicate record?  If so I would guess it reverts to factory defaults plus licenses, so will need at least an auto cal.

And, yeah, I'd rather not start replacing chips.  But a 0.5mm QFP isn't a big deal, it's just fine-pitch BGAs that I've had mixed results with.

BTW, I'm astonished this scope is powered by a 1GHz Cortex-A8 from 2011, with its firmware fitting in something like a 185MB archive, even if compressed... simply astonishing.

[analogRF]

Will I need anything else other than rename '_format.bin' to 'format.bin'?  I see there's a 182MB file there (LecroyNK.up), is this some sort of compressed package file?  Or do I need some sort of separate installer or packages afterwards?

Also, if it's self-contained, which I assume it is - will it also recover the S/N, licenses and cal data from a more reliable or duplicate record?  If so I would guess it reverts to factory defaults plus licenses, so will need at least an auto cal.

And, yeah, I'd rather not start replacing chips.  But a 0.5mm QFP isn't a big deal, it's just fine-pitch BGAs that I've had mixed results with.

BTW, I'm astonished this scope is powered by a 1GHz Cortex-A8 from 2011, with its firmware fitting in something like a 185MB archive, even if compressed... simply astonishing.

yes just change to format.bin.
you will lose cal data and S/N and options. must be restored from EEPROM from the service menu (PW 9472) /BTD calibration/ restore BTD from EEPROM

[bson]

yes just change to format.bin.
you will lose cal data and S/N and options. must be restored from EEPROM from the service menu (PW 9472) /BTD calibration/ restore BTD from EEPROM

Tried it; still no go.  It adds a FORMAT step on boot, but then still resets on Boot IMG Update...

Starting to think something is truly borked, will have to take it apart and check if there's anything on the console output.

[analogRF]

yes just change to format.bin.
you will lose cal data and S/N and options. must be restored from EEPROM from the service menu (PW 9472) /BTD calibration/ restore BTD from EEPROM

Tried it; still no go.  It adds a FORMAT step on boot, but then still resets on Boot IMG Update...

Starting to think something is truly borked, will have to take it apart and check if there's anything on the console output.

that doesn't sound good. Usually the formatting should have fixed it. Please keep us posted on your findings. At this point it seems like a bad NAND flash chip
debug boot record should be very helpful.

it may not be important but Lecroy specifically says after you clean and format the SD card (fat32) first copy the MLO file on to the root of SD and then copy the rest of the files next to it. I dont know why that should be important but maybe you want to keep that in mind too

[tooki]

I kindly ask for your help to share the firmware with me; you would greatly assist me. On the official Teledyne LeCroy website, the firmware upgrade for the WaveSurfer 3000 oscilloscope version 9.2.0.5 did not approve my registration, and I cannot download the firmware because I am from Ukraine (It's very strange that they didn't ask about the color of my skin  ). Unfortunately, if you don't help me, I'll have to discard the LeCroy WaveSurfer 3000 and switch to an oscilloscope from another company without racism, such as Tektronix or LeCroy.

It’s not racism, it’s export controls.

And another company, such as… LeCroy?!?

Slavic languages form sentences differently. It does not always translate directly.

"Not translates itself directly" is valid structure...

I think he mentions LeCroy and Tek as an example of companies that do export control and therefore which he might avoid.

Translation between slavic languages and English is more like a "explain it in your own words but keep the meaning" activity.

Translation is the art of taking a text in one language and rewriting it in another language, such that it is understandable to the reader of the target language. It’s always “in your own words” because it has to be. Taking a sentence in one language and replacing its words with the equivalent words of the target language (without rearranging, adapting to grammar, etc) is not translating, it’s just word-by-word transliterating, and is typically useless. Every proper translation is a rewording. Source: I used to work as a translator. (And I studied linguistics at university.)

None of what you said has anything to do with translation, though. A person’s native language will influence what mistakes they make when speaking or writing a foreign language. (I have so much experience with German and its native speakers that I have become quite adept at decoding what they mean when they write broken English, for example.) With that said, I don’t know any Slavic languages so I can’t “decode”, so I have to take what is written at face value. With that said, I don’t think the issue here was a language barrier, but a slip-up: I assume they meant to write “…Tektronix and [Keysight or R&S or Rigol or Siglent]”.

[bson]

the FLASH chip is MT29C4G96MAZBACKD-5 (marking JW732)

It's also totally obsolete and finding one requires going fishing on the various scam markets.  It's a 137 pin BGA, which isn't too bad, but I'd rather not go through 5 to find one that is the genuine article!  Being BGA I'd also want to reball with leaded solder paste.

Debating whether to bother with this or to sell it for parts...  I might take the board out to take a look at the other side to see if I can put it on a heater - but I suspect it's going to have a bunch of passives on the opposite side that would need to come off first for that.

[analogRF]

the FLASH chip is MT29C4G96MAZBACKD-5 (marking JW732)

It's also totally obsolete and finding one requires going fishing on the various scam markets.  It's a 137 pin BGA, which isn't too bad, but I'd rather not go through 5 to find one that is the genuine article!  Being BGA I'd also want to reball with leaded solder paste.

Debating whether to bother with this or to sell it for parts...  I might take the board out to take a look at the other side to see if I can put it on a heater - but I suspect it's going to have a bunch of passives on the opposite side that would need to come off first for that.

were you able to find a UART debug port and look at the boot record?

[ranvocd1]

Hey I actually have a broken shaft on my potentiometer for a basically similar device (3074) but you are the only one that did an almost to full teardown. Were you able to remove the front black faceplate? It seems like two screws that are used to mount the display are somehow also holding the faceplate, preventing the removal of the faceplate regardless of how much I pull or wiggle. I did not want to force it open in fear of breaking the whole front face plate on the stuck mounts and I have tried to peer in with a flashlight to see if there is a clip or anything but no luck... just two posts that seemed like they are screwed in, but inaccessible.

[tautech]

Hey I actually have a broken shaft on my potentiometer for a basically similar device (3074) but you are the only one that did an almost to full teardown. Were you able to remove the front black faceplate? It seems like two screws that are used to mount the display are somehow also holding the faceplate, preventing the removal of the faceplate regardless of how much I pull or wiggle. I did not want to force it open in fear of breaking the whole front face plate on the stuck mounts and I have tried to peer in with a flashlight to see if there is a clip or anything but no luck... just two posts that seemed like they are screwed in, but inaccessible.

Welcome to the forum.

Remove the model decal/sticker and you should find additional securing screws behind it.

[ranvocd1]

Thanks for the information, did not seem like it was a sticker initially since it was very tight. Since you are familiar with Siglent, Would you happen to know if this individual board can be sourced or is that not possible?

[tautech]

Thanks for the information, did not seem like it was a sticker initially since it was very tight. Since you are familiar with Siglent, Would you happen to know if this individual board can be sourced or is that not possible?

Maybe via Siglent NA however these older SDS3000 (China only model) have been discontinued and I have no idea of parts stocks.
Maybe the same encoder PCB was used in the later 3000X models (IIRC Z in LeCroy) and that's an exercise for you to investigate.

What's wrong with the PCB ?
You should be able to find an equivalent encoder.

[ranvocd1]

Though I do think I can find an equivalent encoder when removed and by researching the part reference, I do not think I have the proper equipment nor skills to properly remove potentiometers that are SMD mounted without potentially damaging the board. SMD resistors, capacitors, inductors I can do due to the small pad size and use of 2 pins, not much solder removal involved.

[tautech]

Though I do think I can find an equivalent encoder when removed and by researching the part reference, I do not think I have the proper equipment nor skills to properly remove potentiometers that are SMD mounted without potentially damaging the board

Low temp AG solder and solder sucker or desoldering iron should handle encoder replacement with ease as it's a TH part not SMD.
I'd give it a go, and on any day of the week.
 

[lianghx]

hello,friend ,I have one wave surfer 3054 boot loop can you help ?I need the serial console pinout
thanks

[tautech]

hello,friend ,I have one wave surfer 3054 boot loop can you help ?I need the serial console pinout
thanks

Welcome to the forum.

See the first few posts in this thread for the recovery tools.
With the correct tools there is no requirement to open the scope.

[6av]

For everyone with a Wavesurfer 3000 non-Z series I want to say thanks for posting this fix.  My hunch is over time more and more people will be finding this on AI RAG help trawls, like me.

I was seeing a slightly different boot loop, literally logo, then blank then repeat.

I removed the rear cover and the upper section with the PSU and managed to just separate  the sections enough without unhooking all the ribbons and connectors, this allowed me to replace the Lithium backup batter which everyone will recognise from PC motherboards as a CR2032, just a hint, there are incredible number of poor quality fakes looking like major brands, so get yours from well known trusted retailer.

Then I simply copied the recovery disk files to the microSD, no need for any special formats or boot disk enabler

The machine eventually came back up

Then I repeated copying the .fla upgrade file and on the menu went to Utilities and selected option to upgrade

You see a file system menu but can navigate to the SD folder, it’s slightly non traditional PC because there isn’t a separate drive letter, but easy to find

Then reboot and sit back for around 3-4 mins

Can’t thank you enough for your post, hope this extra detail helps others

It’s a great scope and they will get more affordable used over time

[chenobalun]

Investigations at the time indicated only a LeCroy recovery package would fix it.

Did you work with Martin Jet Packs?

No, only had interest in it as our customer Dazz1 that's not too far from you in the Hutt was interested in it and I recognized it as a Siglent rebrand.
Study the thread I linked.

I contacted Lecroy. They were quite friendly but did not want to go as far as providing files, etc... I was about to send it to them to fix. The re-flashing disk Kendor provided was the salvation.

Yes I could get the SDS3000 recovery files from Siglent but after it would have no longer been a LeCroy.
You certainly owe Kendor a beer or 2. 

Also it has the signal generator extra.
I will get the digital now and it will be a neat piece of equipment.

By the looks of the MSO socket the probe is most probably all passives and likely you can find one on EvilBay for not too much.

Hello! I have a Siglent SDS3104 oscilloscope (with serial number SDS300B21443109) that sticks in the boot logo and reboots repeatedly. I can't find any resource for this model at any of the Siglent HQ/EU/NA websites. Could you send a recovery package to me? Thank you.

[tautech]

Hello! I have a Siglent SDS3104 oscilloscope (with serial number SDS300B21443008, MFG date 2017-07-14) that sticks in the boot logo and reboots repeatedly. I can't find any resource for this model at any of the Siglent HQ/EU/NA websites. Could you send a recovery package to me? How many beers would you like to have? Thank you.

Welcome to the forum.

You won't find any any Siglent resources in the west for SDS3000 as the development agreement with LeCroy gave them exclusive western marketing rights.

Best you contact Siglent HQ for assistance.
support@siglent.com

[chenobalun]

@ollopa Would you like to tell about the OpenOCD configuration you had used when connecting the DM3730's JTAG port on the board?

Because the Siglent HQ haven't sent the firmware for SDS3104 to me, I decided to try out the Lecroy's firmware at first, but before this I should perform some backup of the original firmware.

About the UART: I found the 4-pin connector at the pad for an unsoldered buzzer, in which there is a power pin, the DM3730's log UART Tx (3.3V), and a pin which is probably Rx, and then a likely empty pin. I checked the UART log output from "Lecroy EBOOT 0.0, BSP BSP_WINCE_ARM_A8 2.30.00.03", and found no prompt like pressing some key for stoping the auto boot, instead there is just "Preparing for download...", "SDCardInit: No media!", as if it is looking for some package via the SD card interface, but I don't know what package would be valid for this. In fact I don't want to flash any image, I just wanted to load something to be executed in memory in order to dump the flash image. It seems like this version of EBOOT doesn't have such a menu for performing this.

Then I tried to connect its JTAG; thanks to your provided clue, The chip's primary TAP is detected by my J-Link after lifting and pulling-up the 2OE pin of the 74ALVC164245 (disabling output) shown in your photo; it doesn't seem to be a level shifter, but doing that might be blocking some other signal that disturbs the TMS and TCK in the TI 14-pin JTAG connector when the 2OE pin is low.

However, the OpenOCD 0.12's configuration for this chip is probably broken (?). What I get initially:

Code: [Select]

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : J-Link V9 compiled May  7 2021 16:26:12
Info : Hardware version: 9.70
Info : VTarget = 1.820 V
Info : clock speed 10 kHz
Info : JTAG tap: dm37x.jrc tap/device found: 0x2b89102f (mfg: 0x017 (Texas Instruments), part: 0xb89
1, ver: 0x2)
Error: Invalid command argument
E:/msys64/mingw64/share/openocd/scripts/target/amdm37x.cfg:132: Error: Tap 'dm37x.dap' could not be
found
in procedure 'jtag_init' called at file "src/jtag/core.c", line 1684
at file "E:/msys64/mingw64/share/openocd/scripts/target/amdm37x.cfg", line 132

I am a bit bold that I changed the tap name 'dm37x.dap' to 'dm37x.cpu' under that line, then this is what I can get:

Code: [Select]

Warn : dm37x.cpu: ran after reset and before halt ...
Warn : Debug base address for target dm37x.cpu has bit 31 set to 0. Access to debug registers will likely fail!
Please fix the target configuration.
Info : dm37x.cpu: hardware has 6 breakpoints, 2 watchpoints
Error: JTAG-DP STICKY ERROR
Error: JTAG-DP STICKY ERROR

Maybe it is similar to the issue in <https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1106954/tms570ls3137-debugging-with-openocd>, but I need to learn more.

[tautech]

.............
Because the Siglent HQ haven't sent the firmware for SDS3104 to me, and @tautech haven't told me how many beers he might want to have, I decided to try out the Lecroy's firmware at first, but before this I should perform some backup of the original firmware.

AFAIKT all you need is the recovery package in the OP then follow the advice of member 6av a few posts above.
FYI we have zero SDS3000 resources as this model range was only available to LeCroy in western markets.

Your best choice for help will be Siglent HQ support:
support@siglent.com

[ollopa]

Just letting you know I saw your message.  It was a long time ago that I dumped some flash over JTAG and it took forever, the full dump would have taken too long.  It is far faster to boot from Linux on a MicroSD card and read the flash from there, you could do it over telnet or ssh if you have no screen.  It would actually be super cool to get the display working under Linux, but I'm too pressed for time to work on it any time soon.  Future project:  Bootable Linux recovery image people can just DD to an SD card...

The openocd config I used would be on a different machine, I'll see if I can find it tomorrow.

[chenobalun]

I tried to connect the DM3730's JTAG with OpenOCD 0.8 in a newly installed Debian 8 i386 virtual machine, it was able to connect, reset, and halt the main MPU through its DAP port. However I am unable to configure the NAND controller with the OpenOCD `davinci` NAND controller driver.

I checked the source file `src/flash/nand/davinci.c` (there's no other driver for any TI device) in both OpenOCD 0.8 and the OpenOCD master branch version, and realized the register offset values defined in this code seriously mismatchs with the DM3730's GPMC register map (as described in DM3730's TRM). The register address offset values in this code can be found in "TMS320DM35x Digital Media System-on-Chip (DMSoC) Asynchronous External Memory Interface (EMIF) Reference Guide", where the AEMIF is the NAND controller. (there's no EMIF in DM3730, but the GPMC has similar functions)

Then I searched the `davinci` keyword in the DM3730 TRM, and only found it in a sentence under "5.4.4.5.2 Mapping a Queue to a Transfer Controller": "TPTC0 and TPTC1 are not symmetrical; their numbers are just inverted, compared to the Davinci device. To improve compatibility with Davinci devices, invert the mapping of the event queue to the transfer controller, as shown below". This indicates that it's not a Davinci device by itself.

In https://handwiki.org/wiki/Engineering:Texas_Instruments_DaVinci, DM37x is not listed in the Davinci family.

Now I'm almost sure that OpenOCD's NAND driver does not support the DM3730, and I wonder what is the "dump" you have made with OpenOCD...

I should probe some basic info (especially NAND config register values) of the original EBoot with OpenOCD, and then try to build an U-Boot image for dumping the NAND, based on the U-Boot version found within <https://www.ti.com/tool/LINUXDVSDK-DM37X>.