The Rigol DS1052E

[drieg]

Wow, many question raised. I'll try to answer them, but first I'd like to say, that my intention was not to cause panic or hold Dave liable for this. I just wanted to warn people of this issue and remind them that it's always a risk unless you exactly know, what is going on inside.

OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

I didn't use any "command" method (serial or USB) because I didn't find it reliable. To be honest I have only little experience with USB, but I have some bad experience with serial cable. As I didn't monitor the serial communication between my laptop and scope, I can't exactly say if the problem was terminal software which I used (HyperTerminal, Realterm), cable, my serial port or SCPI command implementation inside firmware. I'm only sure that I didn't hit Enter key accidentally and the data gets corrupted even so. Another thing is, that sometimes I get different answers from scope for same commands. The good example is :INFO:MODEL command. Sometimes you have to perform it several times, till the new value is written into flash. The same problem with another command which writes HW revision into this area. And finally... I didn't like the fact, that even if you hit Enter by mistake, the whole part of flash is written by "random" data. It makes me think, that command implementation inside is not done well. The firmware should be immune to these mistakes. These are the reasons, why I gave up on these "command" methods totaly and did it another way.

@dimlow
You are on the good way to ruin your scope totally Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...
Anyway, let me know, when you need repair

[dimlow]

OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

Please give details of how you did it ?

@dimlow
You are on the good way to ruin your scope totally Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...
Anyway, let me know, when you need repair

Please how do you know what data is stored where ? more detail please. And i have another two scopes, not really bothered now if i scrap the scope or not. So were do i start if i want to dump the data ?

Oh i so you can repair my scope ? Great, lets get started. who are you, what your is relationship with the Rigol scope. what it the timescale for the repair. where do i send it to ? maybe we should do this via PM.

@others
 wont be doing any  testing today, well maybe later, went out on the beer yesterday, head hurts today! will try to answer more questions later. Oh and the scope has not changed since i put in the long serial numbers.

[darkith]

Be caferul, there is limited space for model and serial info inside flash and I don't know, if the string is truncated before writting into flash. Right after these fields there are other vitally important data (HW revision, and others)...

As you say, that's the kicker.  It's not the communication method per se, it's the code that takes the argument string for the ":INFO:MODEL" command, and conceivably writes the entire string length to memory without truncating/verifying length.  If the code did a sanity check (model_arg < model_max_len), it would prevent truly breaking things.  At worst, a mistaken control character (backspace, enter, etc) would munge the value, but could be easily fixed.  Not verifying the length means that the corruption can be pushed outside of the model and serial fields, and that could be very bad...

Anyway, let me know, when you need repair

So....you're saying you have a method using an external or JTAG programmer, would you be willing to share that?  It sounds like there are a few people who need this procedure, and probably a known-good flash dump to over-write their corrupted settings.

D.

[Mechatrommer]

Mr dimlow: you've made a very brave attempt (long serial). then it proved that it will not get things even worst. as somebody else did with backspace and enter key. now i'm stumbled even more.

"drieg: The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production."

the header sits right next to the blackfin is connected to EMU, TMS, TCK, TRST, TDI, TDO. i heard with my brain, it sounds like JTAG (MOSI, MISO CLK, ISPDAT, ISPCLK sounds pretty similar). will study more on this. i dont have any programmer, any suggestion? can i program arduino mega to do that? blackfin 531 is a way much more powerful than atmega1280, i dont know if i can make arduino outruns blackfin.

i hope the precaution to not make any mistake while hyperterminaling is spoken out loud.

p/s: i corrupted the EEPROM data, but i dont know how it happened. now, i have to fix it, but how? i dont know what will happen.

[bushing]

OK, here's my experience.

The safest "upgrade" method is to backup flash memory and modify just the fields that are needed to modify. You can do it through external programmer or JTAG, which I beleive is the way how they do it in production.

Please give details of how you did it ?

Seconded.  FWIW, I doubt they do it that way in the factory -- I think they probably do the initial programming via the card-edge SPI connector on the PCB that I posted about earlier in the thread -- that would be a lot faster than plugging in a JTAG cable, and it would explain why the connector is there in the first place.  I would also expect that they then use the serial or USB interface to write the device-unique information -- they have to hook one of those cables up anyway to perform automated testing/calibration, and it would explain why those commands exist on the USB/serial interfaces.

That being said, you seem to have ... more insight into all of this than I do, so I'd also love to hear more about the flash memory and how you've modified it -- I've considered desoldering it (the NOR flash) and reading it externally, but reading it out over JTAG would be safer.   Sadly, I don't think OpenOCD supports BlackFin, but my FT2232D-based JTAG dongle is similar enough to http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice that we might be able to just use their tools.   Hmmm...

[RayJones]

A sure fire way to enter a non munged value would be to simply cut and paste from notepad.

However, I'd never use Hyperterminal as it really is a woefully crap software terminal.
My fav for a long time has been ZOC - works with socket(ie telnet) or serial ports. FTW.

Using ZOC, you can highlight a phrase on the terminal area, and it automatically gets picked up in the clipboard.
Drop it into notepad, fix it up, then reverse the procedure.
Too simple!

[opus131]

  There is no need for the firmware in the DSO1502E to recognize 'backspace' and implement its behavior:
the commands are most likely not for interactive use.  Hyperterminal sends characters as they are
typed and could fill up a buffer and possibly corrupt the stack, crashing and possibly corrupting data.
  CuteCom on gnu/linux does not send anything until the enter key is pressed and the enter key can be
configured to send a linefeed only.  This means that if someone is not being as diligent as required
when using Hyperterminal, backspaces and such cause no harm when using CuteCom.

[wd5gnr]

http://realterm.sourceforge.net/ is a choice for Windows (although I use Linux anyhow, but I deal with enough Windows that I have a copy of this stashed).

I ordered one from DX and am hopeful it will be upgradeable. Great info.

[rct]

CuteCom on gnu/linux does not send anything until the enter key is pressed and the enter key can be
configured to send a linefeed only.

Excellent! thanks for the pointer to CuteCom.  I was wondering if there was a *nix equivalent of realterm.

For linux with USB, with the default somewhat broken usbtmc driver one could get away with

Code: [Select]

echo "*IDN?" > /dev/usbtmc0 ; cat < /dev/usbtmc0
echo ":INFO:SERIAL?" > /dev/usbtmc0 ; cat < /dev/usbtmc0


[rct]

Hyperterminal sends characters as they are typed and could fill up a buffer and possibly corrupt the stack, crashing and possibly corrupting data.  CuteCom on gnu/linux does not send anything until the enter key is pressed and the enter key can be configured to send a linefeed only.  This means that if someone is not being as diligent as required when using Hyperterminal, backspaces and such cause no harm when using CuteCom.

Err, it's not just hyperterm, the default mode for most serial terminal emulators is character based, not line buffered with local editing, because that's what the vast majority of what they are emulating did.   (Sure some ancient green screens did have a local editing line buffered mode particularly for really slow links).   Unfortunately hyperterm doesn't have that mode.   I think the distinction is lost on most people.

I believe the intent of the instructions to use HyperTerm and a serial cable was show the simplest possible method that avoids  any hassle with installing any special software.  Otherwise the instructions probably would have been install visa, etc. & going the USB route.

There is no need for the firmware in the DSO1502E to recognize 'backspace' and implement its behavior:
the commands are most likely not for interactive use.

Did you forget the smiley on that?   Thinking like that keeps all those virus writers & security vendors employed.

Unfortunately, you are correct, it appears that the behavior isn't localized to just the undocument :INFO:set commands, it is in the general serial command parser, so you can't make a mistake typing any command.    I wouldn't be surprised if there was no bounds checking on the whole input buffer and it would just keep going until it smashed the stack.

[RayJones]

Ah yes, the good ol' buffer overrun error.

You'll never see that problem in Microsoft products 

[bushing]

"but my FT2232D-based JTAG dongle is similar enough to http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice that we might be able to just use their tools.   Hmmm..."
thanx for d info, i think that will help alot. using just ftdi chip as JTAG. no extra mcu is needed. can u already poke the eeprom data out my bushing? since u already have the usb device?
anyone knows where to buy this usb jtag?

I haven't actually tried it yet, but I downloaded the BlackFin JTAG tools, and they're just bundling a version of urjtag, which should be able to support most FT2232-based devices.   I just need to get my scope open again and make an adapter cable...

FWIW, I've compared the 02.02.04 firmware with the 02.02.02 firmware using one of the crudest methods imaginable -- run strings on both binaries, then opendiff the output from each.

Most changes are boring, here are the ones that are remotely interesting:

Code: [Select]

Version number in header changed from "02.02.02.00" to "00.02.04.00" ... very odd

A new block of text with hints of DS1204B support?
Last two bytes in buffer = %x %x
Warning:  No End_of_Image marker 0xFFD9 found
Replacing last two bytes with EOI [0xffd9]
 Error in Interleave Format....Check
DS1204B
Rigol
RIGOL Technologies, Inc.
Screen Oscillograph
Copyright (c) 2009 Rigol.
Exif
Unknown
Adobe
JFIF

Added or changed commands:
:MEMD? -> :MEMP?
:MDEP?
:MDEP
:SRATE?
:SRAT?

:RAMO -> :RAM?
:GAMOUNT?
:GAM?

Removed commands -- warning, there's not a lot you can infer from this. As you can see, there's a lot of duplication, so these commands may still exist elsewhere.
*RIGOL *TEK
:UNLOCK :UNL
:FACTORY :FAC FACTORY

:ACQUIRE :ACQ ACQUIRE
:STATE STOP
:MODE? :MOD? PEAKdetect AVErage SAMple :MODE :MOD SAMPLE AVERAGE PEAKDETECT PEAK
:NUMAVG? :NUMAV? :NUMAVG :NUMAV
:CH1
:BANdWIDTH? :BAN? :BANDWIDTH :BAN
:INVERT? :INV? :INVERT :INV
:COUPLING? :COUP? :COUPLING :COUP
:PROBE? :PRO? :PROBE :PRO
:POSITION? :POS? :POSITION :POS
:SCALE? :SCA? :SCALE :SCA :SELECT :SEL SELECT
:CH1? :CH2 :CH2?
:MATH :MATH?
:CH2
:BANdWIDTH? :BAN? :BANDWIDTH :BAN
:INVERT? :INV? :INVERT :INV
:COUPLING? :COUP? :COUPLING :COUP
:PROBE? :PRO? :PROBE :PRO
:POSITION? :POS? :POSITION :POS
:SCALE? :SCA? :SCALE :SCA
:DISPLAY :DIS DISPLAY
:STYLE? :STY? DOTs VECtors :STYLE :STY DOTS VECTORS
:PERSISTENCE? :PERS? :PERSISTENCE :PERS
:INVERT? :INV? :INVERT :INV
:FORMAT? :FORM? :FORMAT :FORM
:MATH MATH
:DEFINE HANNING RECTANGULAR RECT CH1+CH2 CH2+CH1 CH1-CH2 CH2-CH1 CH1*CH2 CH2*CH1
:VERTICAL :VER :POSITION :POS :POSITION? :POS?
:SCALE :SCAL :SCALE? :SCAL?
:FFT
:HORIZONTAL :HOR
:VALUE? :VAL?
PK2PK MAXIMUM MAXI MINIMUM MINI MEAN CRMS FREQUENCY FREQ PERIOD PERI RISE FALL PWIDTH NWIDTH
:MEASUREMENT :MEASU MEASUREMENT MEASU
:IMMED :IMM
:SOURCE1 :SOU
:TYPE :TYP
:SOURCE
MATH
:DATA :DAT DATA
:CURVE? :CURV?
:WAVFRM? :WAVF?
CURVE? CURV?
WAVFRM? WAVF?
:WAVEFORMANALYSIS WAVEFORMANALYSIS
:SAVE :SAV SAVE
:SETUP :SETU
:WAVEFORM :WAVE
:IMAGE :IMA
:FILEFORMAT :FILEF
:RECALL RECALL
FACTORY *SAV *RCL
:AUTOSET :AUTOS AUTOSET AUTOS
EXECUTE EXEC
:LANGUAGE? :LANG?
LANGUAGE? LANG?
KOREan JAPAnese ENGLish FRENch GERMan ITALian Russian SPANish PORTUguese
:LANGUAGE :LANG LANGUAGE LANG
SIMP TRAD KOREAN KORE JAPANESE JAPA ENGLISH ENGL FRENCH FREN GERMAM GERM ITALIAN ITAL RUSSIAN RUSS SPANISH SPAN PORTUGUESE PORTU
:RS232 RS232 :BAUD? :BAU? :BAUD :BAU
:CALIBRATE :CAL CALIBRATE
:INTERNAL
SIMPlifiedchines TRADitionalchinese SIMPLIFIEDCHINESE TRADITIONALCHINESE
:HORIZONTAL :HOR HORIZONTAL
:VIEW? MAIn WINDOW :VIEW MAIN
:SCALE? :SECDIV? :SCA? :SEC? :SCALE :SECDIV :SCA :SEC
:POSITION? :POS? :POSITION :POS
:MAIN:MAI
:DELAY :DEL
:LEVEL? :LEV? :LEVEL :LEV
:SOURCE? :SOU? ACLINE :SOURCE :SOU
:MODE? :MOD? AUTO NORMal SINGLE :MODE:MOD NORMAL NORM
:COUPLING? :COUP? HFRej LFRej :COUPLING :COUP HFREJ LFREJ
:SLOPE? :SLO? FALL ALTERNATION RISe :SLOPE :SLO RISE
:LEVEL? :LEV? :LEVEL :LEV :POLARITY? :POL? POSITIVe NEGAtive
:WHEN? INside OUTside EQual
:POLARITY :POL POSITIVE POSITIV NEGATIVE NEGA
:WHEN INSIDE OUTSIDE EQUAL
:SOURCE? :SOU? ACLINE :SOURCE :SOU
:MODE? :MOD? AUTO NORMAL SINGLE :MODE :MOD NORM
:WIDTH? :WID? :WIDTH :WID
:TYPE? :TYP? EDGE PULse SLOPE VIDeo ALTERNATION PATTERN DURATION :TYPE :TYP PULSE VIDEO
:HOLDOFF? :HOLDO? :HOLDOFF :HOLDO
:VALUE? :VAL? :VALUE :VAL
:TRIGGER :TRIG TRIGGER TRIG
:STATE? SAVE WAIT SCAN AUTO ERROR FORCE FORC
:MAIN :MAI
SETLEVEL SETL
:MODE? :MODE :MOD? :MOD
:LEVEL? :LEVEL :LEV? :LEV
:EDGE :PULSE :PUL :WIDTH :WID :VIDEO :VID
:SOURCE? :SOU? :SOURCE :SOU
:POLARITY? :POL? NORMal INVert :POLARITY :POL NORMAL NORM INVERT
:STANDARD? :STAND? NTSc
:STANDARD :STAND NTSC
:SYNC? LINE EVEN :SYNC :LINE? :LINE

Notably, the :INFO:MODEL and :INFO:SERIAL commands are still there, so if they don't work, they're enabled/disabled by some other means.

A "typo" fix?
"<<Press 'RUN/STOP' Key Three Times to Exit The Test>>" -> "<<Press 'RUN/STOP' Key three Times to Exit The Test>>"

DSP code upgraded from v02.15 to v02.20


[dimlow]

i saw this in the firmware, "<<Press 'RUN/STOP' Key three Times to Exit The Test>>"
i was just wondering what test it refers to, i don't think i have seen that message on the screen
anyone else ?

[Simon]

well I've read the entire manual and it say's nothing like that for using the scope during stand alone operation so it pertains exsclusively to computer connected applications

[Ferenczyg]

Hi all.

For anyone interested, I received my DS1052E from dealextreme yesterday. It was requested march 28th and it has factory docs march 23th (or so it seems, its in chinese..). FW version is 02.02.02 sp2. No customs fee at all (Spain).

Reading the pdf's included in the CD there are examples for coding in C and VB proggies for the pc that are sending commands to the osc. Maybe a little proggie that sends the rigth strings are the optimal solution for the softmod?. Sadly my experience in programming is not enough to try it

[Simon]

you don't need any programming experience for the mod, if you read back to near the beginning of this thread you will find me asking a lot of dumb questions and a lot of information on the mod including full instructions. all you need is a pc (win XP as the M$ dodo's took hyperterminal off vista - or use a freeware hyperterminal program) and a straight serial cable - ie: not a crossed or null modem one. of course as it has emerged later there are other considerations so beware and don't hold me responsable but my scope works just fine

[rossmoffett]

If you don't have a serial cable, especially a rare female/female one, what I did is just wire from pins 2, 3 and 5 on the Rigol to pins 2, 3 and 5 on the PC.  I used some female pins we had for cable-making, you could also probably safely use heat shrink to temporarily make contact with a wire end.  You can't make it longer than about a meter though, or you can expect failures due to noise.

[drieg]

@dimlow and shafri
I believe the solution for you could be to dump binary file with correct data to serial port (e.g. with realterm). The idea is to rewrite corrupted fields in the same way how they got corrupted, i.e.  :INFO:MODEL <correct bin data> <LF>
When I have time, I'll do some tests and let you know if this could be the way...

@bushing and especially shafri
JTAG: Please do not do any experiments with JTAG interface unless you exactly know what you are doing. You need to know CPU's surroundings very well before you can make use of it. As the attached flash exceeds cpu's address space, some signals are generated inside Lattice CPLD. You won't be able to read the flash unless you know how. Easier to use external programmer at this point.

@bushing
JTAG/SPI: The SPI PCB-connector is quite new to Rigol scopes (only some recent scopes have it) and there is need to write more unit-specific data into flash than just model and sn info (what commands allows you). That's the reason why they must use JTAG in final phase of production...

Could you upload 02.02.04 firmware somwhere?

[Ferenczyg]

you don't need any programming experience for the mod, if you read back to near the beginning of this thread you will find me asking a lot of dumb questions and a lot of information on the mod including full instructions. all you need is a pc (win XP as the M$ dodo's took hyperterminal off vista - or use a freeware hyperterminal program) and a straight serial cable - ie: not a crossed or null modem one. of course as it has emerged later there are other considerations so beware and don't hold me responsable but my scope works just fine

Hi Simon

I am aware of the serial link method, in fact that was the reason to buy the scope. I was ready to take the serial way until the 'other considerations' you are mentioning appeared. From that moment I've just checked that my scope is able to be softmodded via rs232 and stopped because I really do not need the additional features by now.  But just as an alternate way to avoid f*cking whatever I am just asking/suggesting if making a proggie that sends the strings as ultrascope send commands could be a safer way.

In any case the 'old' method documentation, including David's video is well kept in a directory of my HD for when it can be needed.

/F

[Simon]

well mine went off without a hitch but if your in doubt then hold fire till you want a fasrer scope

[wd5gnr]

Argh... from Deal Extreme this morning:

Dear customer,

Sorry for keeping you waiting so long.

Kindly inform you that we are afraid your order has been put on hold as the item you ordered has stopped in production.Would you like to change it into another similar item or cancel it and get the refund?Please advise.

Thank you for your understanding and patience.

###

You can imagine they are reflashing existing inventory :-(

[darkith]

Strange...
Yesterday they had it marked as backordered (April 30th I think).  Now it shows as shipping in 18 days on May 1st, but not "out of stock" liked I'd expect.

Shrug.  They also dropped the price to $389 (from $404 IIRC).

D.

[Waifian]

That is very weird... I got mine for $389 from Dealexcel but it didn't go on back order and I was still able to mod it. This was several weeks back however.

[Miroslav]

I've got the same from DX folks. On my question what's going on with my order, yesterday they responded with

"Dear customer:
we are informed that sku30573 will be in stock after 17th April. would you like to wait few days with pateicne?? we will try our best to help you
regards
selina"

and this morning I woke up with the update:

"Dear customer,
Sorry for keeping you waiting so long.
Kindly inform you that we are afraid your order has been put on hold as the item you ordered has stopped in production.Would you like to change it into another similar item or cancel it and get the refund?Please advise.
Thank you for your understanding and patience.
Best regards,
charlene"

[stardust]

Hi folks,

tonight I searched for a good scope, stumbled over this hack and ordered the DS1052E, immediately :-)

The remaining question is:

IF I should get one with the FW 2.04 installed, can I downgrade it to 2.02 and WHERE can I get the FW 2.02???
(Sorry, I read the whole important part of this thread, but did not find the answer to this question...)

Kind Regards from germany,
Steve