EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: Nermash on April 02, 2013, 11:56:49 am
-
Recently I purchased a Berkeley Nucleonics 625 synthesized generator (aka Telulex SG100), and quickly learned that there were two versions, "premium" one with arbitrary/function/pulse capability (625A model) and standard 625 with only 21.5 MHz sine.
After few hours of reading datasheets and scoping arround the empty socket marked U24, I concluded that the empty socket should hold the DAC, and it turned out to be AD9713 chip.
However, firmware does not automaticaly recognizes that the DAC is present, and selecting arb/pulse/function mode on the front panel produces "mode not available" message. I also discovered that using terminal via RS232, I can enter these "not available" modes by simply entering J,Q and G letters as command. These are undocumented commands, probably left overs from some other impementation, but they do work and produce correct output signal. So I figured out that the answer lies in the firmware.
I have spent hours trying to reverse engineer the firmware, but none of the disassemblers for adsp2115 I have found seems to do a good job. I identified program and data memory sections, and they are the same for all versions, but there is a few hundred bytes section of data that holds the key, and I can not figure out how it enables arb feature.
So, turning to a path of less resistance, I would like to ask all fellow EEVblogers:
Does anyone with 625A (or Telulex SG100/A) version generator can send me the binary flash image containing the firmware?
Flash IC is socketed 29F002BB.
-
Have a look at the Telulex.zip file I found here after a bit of creative surfing: http://www.berkeleynucleonics.com/resources/smartarb/ (http://www.berkeleynucleonics.com/resources/smartarb/)
Not sure if it is the version you are looking for but the same zip file also has a waveform upload program so who knows.
-
Thanks for the effort, but no, these can't help me, I need the complete image:)
Files you found contain data memory part in the SG100-35.tlx file, and boot/program memory part inside the sgload.exe utility (yes, I disassembled that as well :) ).
The part I am missing is a special part located in between those two sections.
-
Hi,
I have both a BNC 625 and a 625A . I would like to upgrade the 625, like you.
Is the necessary code in the flash chip and, if so, how do I read or copy it for our 625s.
Thanks,
Billc
-
I used TL866 programmer that I bought from Franky here on the forum, to read the 29F002 flash.
This is pretty common flash chip, and most universal programmers should be able to read/write from/to it.
As far as I know, only two differences between 625 and 625A are firmware and U24 DAC (AD9713 or MAX5013).
Step by step instructions would be:
1. Read both the 625 and 625A flashes, and save both files (256 KB each)
2. Backup both files, preferably to an online storage
3. Program 625 flash with 625A fw
4. Insert the dac in U24 socket
5. Send me the 625A firmware ;)
-
OK
Will do. It might be a while since I need (minimum) an adapter for the plcc.
Give me a few days to get back to you.
Billc
-
I have both, one original 625A and a converted one. You need to purchase the DAC and reprogram the Flash memory of the non A version. Just be careful as the DAC gets hot. I didn't have to recalibrate mine after the transformation. There is also a BK incarnation of the 625 the BK4070A If I find the Flash I will post it here.
-
Yes, there is also BK 4070A version, with arb function enabled. But, firmwares are not compatible |O
The complete unit is closed and without any air flow, and I also noticed that things can get a little hot. Maybe it wouldn't be a bad idea to drill some holes on the sides, just to get some passive cooling inside.
-
I found the firmware for the 625A. Not 100% sure. It might still be the 625. Make sure that you use a spare flash memory and not the original flash memory. In either case make a backup of your original flash memory.
-
At first glance it looks like 625A fw, it has adittional bytes in the "special" section, but I will have to wait till I get back home to try it out.
In any case, big thanks :)
Edit: YES, it works, arb is now enabled!
-
:)
-
Sorry to necro this topic but it's exactly the problem i'm dealing with and i hope Nermash and Casinada or somebody else are around to give me some precision.
Well long story short i bought a used Telulex sg-100/A on ebay and after some testing i concluded that not the arbitrary one, i think someone changed the front panel and they never tried the arb mode before listing it. So now i have a normal 625/ telulex SG-100 and i want to change it to the A model but my board seem to differ from yours.
The U24 is a 28 pin dip, i took some picture and i concluded after checking the Datasheet for the AD9713 that the U21 plcc is where the DAC go. My flash chip is a AM29f002bb and match the flash size of your zip file.
The problem here is i don't have any programmer or socket to program the device, i know there a dos software where you can program via the rs-232 port so my question is have you tried or know if it's safe to do that via the rs-232. I plan to buy the DAC soon but i don't know if i really need the programmer to do that.
Thanks
-
I programmed the Flash memory with a programmer. I haven't tried anything using the RS-232. Check to see if you have somebody from this forum that lives near you and is willing to program the chip for you. Let us know. :)
-
OT question... what do people think of the keypad on these units? It looks kind of crappy in photos.
-
Regarding the RS232 firmware update, I have tried it few times with some dubios firmware versions from BK and other Berkley Nucleonics units, and I bricked it a few times...Not a big deal since I have programmer.
However, I am pretty sure that correct firmware would update fine, since code differentiating non arbitrary and arbitrary version sits at the same offset in both files. In any case you should try to source someone with programmer as a backup measure first.
Regarding the keypad, yes it is pretty crappy. Low tactile feedback, front plate that flexes when you press the key harder. Not suitable for fast entry.
-
Thanks for the reply !
i found a tlx file who supposed to be a 625a firmware and i still have a rs-232 port on my x58 motherboard so i will try that first, i don't know anyone near me who have a programmer on hand so the worst thing is i will need to buy one and a plcc remover if the unit brick, not a big deal then !
Yeah the Keypad is pretty crappy, the housing is "cheap" (flex and move with enough pressure) and the menu interface is hell. We had a bunch of these at the school many year ago and they worked flawlessly and was always spot on, since it's just for an hobby use the unit is perfect for my need.
I will keep you informed, the DAC is on the way and i have a Hp 8594e where i need to change the battery (battery is 22 year old!) i will post the result in a few week
Have a good day everyone.
-
Well update time
I tried to update the 625 via the rs232 port and it didn't work, the software freeze when i try to flash the rom with the 625a firmware but no problem with the original telulex rom file, i even tried on a old 1996 PC with windows 95 and it seem the software just don't like to flash the 625 to the 625a., so i bought the TL866 and i followed Nermash step and bingo all the function are enabled and spot on
thank you very much !!
-
Welcome to the worlD OF ARB :)
Remember to monitor tbe dac's temperature, it can get really toasty
-
Thanks !!
I plan to add some airflow in the case and add a little heat sink on the DAC before the summer. Don't know if it's to save cost or they was happy and under the temperature limit for this design.
-
I know this thread is kind of old, but I have the same 625 Model. Is there any way someone could send the firmware for the -ARB? Or throw it online for everyone to enjoy? :)
Regards,
Tom
-
I used this firmware with my 625a, just change the .txt to .bin enjoy !!
-
Thank you so much AwArD_RzD! Now All i have to do is fiddle a programmer together :)
Regards,
Tom
-
Hey guys, here's another thread necro. >:D
I went ahead and got an SG-100/A in need of repair after coming across this thread and seeing that there are owners on the forum here. After some preliminary testing, I've discovered that:
1. Fuse F5 on the signal output is open. I don't know what caused it, but probing the other side shows that the sine wave output seems to be working properly (frequency, gain, offset).
2. Although all function/arbitrary/pulse options are available in the firmware, I'm getting no output of the expected signals. I recall AwArD_RzD's first post with the PCB picture, and sure enough U21 is missing (I'm sad, there isn't even a socket soldered :-\).
This (2.) leads to my first question: is it normal for an SG-100/A with no arbitrary output option installed to have the options available in firmware, but U21 un-populated? (my guess is yes, but more evidence would help)
3. Probing the pins on the MAX532 (U45), I find that VDD and VSS, which are nominally +12/-12V from Telulex's schematic, measure at +15.6V/-15.1V. From Maxim's datasheet, I see that 15V power supply is fine, but should I be concerned that voltages are not as indicated on the manufacturer's schematic? (if someone could probe the test points for their MAX532, I would really appreciate it)
If all is as expected, my plan is to replace the blown fuse and install a socket+DAC. Can anyone please advise if I should proceed or if there are further pitfalls I should look for first?
Thanks!
Addendum: My SW version is 3.3, HW version is 1.7. The unit identifies itself as "SG100" on power up, so I'm further convinced that this is the normal behavior of an SG-100 without the A option (despite the label on the front panel).
-
I started working on my unit today and ended up doing three things:
1. Replaced the output SMD fuse
2. Soldered a PLCC socket at U21
3. Installed an AD9713B
Now I have working sine wave and pulse / function output. 8) I would like to upgrade my firmware from V3.3 to V3.5 and retain my serial number and other model specific info. Is there anything I need to edit in the BNC625A ROM besides the serial number? Upgrading using SGLOAD.EXE from DOSBox doesn't work, must be some issue with DOSBox or my USB to RS232 converter...
-
Another update (and a word of caution to future modders):
I did some stability testing with the V3.5 BNC625A flashed SG-100/A and found that the unit would hard crash / lockup around every 30 minutes or so (no controls, output relay clicks, output lost). Strangely, the unit also seemed to be running hotter than it was with the V3.3 SG100 firmware. Finding this suspicious, I checked the power supply again, but it looks like the +-15V unit was intentionally used (as opposed to a +-12V unit). I contacted AwArD_RzD and was told that his unit behaves identically with the BNC625A firmware. Since my V3.3 firmware seems stable and already has the function/pulse/arb features enabled, I've flashed it back for the time being.
As an aside, it looks like the section of ROM that contains the calibration data has more values than what can be adjusted by using the SG100CAL program. Anyone who wants to flash over the entire ROM might want to copy at least the original calibration data as well as the serial number. The calibration data starts around offset 0600 while the serial number starts at 6F00.
Finally, I successfully applied the SG100-35 update over serial, but it seems to lock out the arb generator features on my unit. There's also an SG100c0 update available for the BNC 630/632, but flashing this one bricked the unit (although the bootloader recovery still works).
-
On a final note, some brute force reflashing has revealed that the byte at offset 0x601B in the ROM seems to control which model is displayed at boot up and enable pulse/function/arb.
For example, my unit originally has 14, while AwArD_RzD's has 54. Changing it to 55 or 5D results in a BNC 625, while 5E or 5F results in a BNC 625A. If you have a unit that's stable and you just want to enable arb mode, I suggest only editing your own ROM and reflashing instead of flashing over the entire BNC625A ROM that's on here and losing your calibration data.
Tested with V3.3 and V3.5. By the way, if you ever have a bad flash over RS232, you can hold down the Remote key on boot up to enter boot loader code download mode. Boot loader versions I've seen include B2.1 and B2.2.
-
Finally :) All along I had a feeling that there is a magic byte ;D
My 625 original FW had 54 value at offset 0x601B (version 3.5), changing it to 5F unlocked the arb functionality.
My unit also experiences lockups, but only once per session, and approximately 60 minutes after power up.
-
My unit also experiences lockups, but only once per session, and approximately 60 minutes after power up.
I'll test V3.3 for a few hours to see how stable it is and compare with V3.5 update.
Your next task is to reverse engineer the BNC 632 ROM so we can all get 31.5 MHz for free. ;)
-
I was asked regarding the schematics for the Telulex SG100, so here they are: http://imgur.com/a/GDnOU (http://imgur.com/a/GDnOU)
I can't remember where I got the files from originally.
-
Finaly, I repaired the generator, but it seems to be a little unstable. I'd like to try older firmware, but all I have is v3.5. Is here someone who would send me the v3.3 for instance, please?
Thanks :)
-
Finaly, I repaired the generator, but it seems to be a little unstable. I'd like to try older firmware, but all I have is v3.5. Is here someone who would send me the v3.3 for instance, please?
Thanks :)
Alright, here it is! I think this is the stock firmware from my unit, modded to enable the arb functionality. If your generator is unstable due to firmware, I recommend you copy your calibration data from your original firmware to whichever firmware you plan to use. This assumes that you backed it up before you made any changes.
-
Thank you man, I'll try it following your recommendations :)
-
A warning for those of you who have this unit: CHECK THE CAPS ON THE PSU! My unit's PSU had some leaky caps which probably resulted in an overvoltage condition that blew up the DAC and also killed some portion of the synthesizer!
I believe Meanwell makes a drop-in replacement PSU with +-12V that's pretty cheap. I'm still not sure if there's any reason to use a +-15V PSU when the PCB and schematics all specify 12V.
-
Thanks for the info nidlaX i will check those, i don't use it very often so i think it's a good time to open it and check those cap
Anyone fixed the freeze/crash problem when the unit is power on more that 30-60 min ? It still a pain in the ass when the unit do that in the middle of an experiment but usualy i store the config i'm using and when this happen i unplug the signal cable cycle the power and reload my it, take 10 sec so this don't bother me too much.
I have some picture of the schematic from this unit (maybe from this forum i don't remember where i got them), maybe it's time to give it a go but this is not a big priority on my to do list for now !
Thanks for keeping this little signal generator alive, the spec is not great but the unit is very usefull !
-
I think the unit overheats. Check some of the components inside. I have the same problem. :-//
-
Here is a good and informative 625A manual for the B&K clone.
https://www.digikey.com/htmldatasheets/production/642800/0/0/1/4070A-Manual.pdf (https://www.digikey.com/htmldatasheets/production/642800/0/0/1/4070A-Manual.pdf)
I bought 3 of the Berkeley 625A units at some insane price like $150 for all three about 7 years ago & never messed with them (they ended up in random places in the house, one was in a cabinet with rolls of gift wrap, another was buried in some piles of books). I needed to generate AM outdoors last week & finally gave one a try; it is much lighter than my "big bench" generators & none of my other little generators had internal modulation. The 625A fired up & was good (ver 3.5)!
-
Necro-ing the thread to add some Tech Ref for future generations. ;)
I'm using the SG-100 Schematic linked here to troubleshoot my own B&K 4070A; I've done some cleanup so I could print it legibly and made a denotated version as well. Both are attached here, along with the 8070A-specific version I made for myself.
For those who care, the 4070A is not a clone... it's an outright rebadge of the Berkeley Nucleonics Model 630.
Cheers,
mnem
:-/O