Old firmware for Siglent based Axiomet oscilloscope

[rteodor]

A warm hello to everybody, first post on this forum.

I need help to salvage an oscilloscope bought about 10 years ago and that paradoxically is good as new.

It is an Axiomet AX-DS1100CFM that has decent hardware for the money: 2 channels, 100MHz, 1Gsa/s, 1Mpts/ch.
Software on the other hand ruins the usability quite badly.
I mean knobs debouncing is really bad. Trigger sometimes fails every second time or it has random time-shift. And there are many more UI issues that can be fixed in software.

It has the original firmware 3.01.01.21.
    lsusb
    Bus 005 Device 012: ID f4ec:ee38 Atten Electronics / Siglent Technologies Digital Storage Oscilloscope
    bInterfaceClass       220 Diagnostic
Display is 480x234 so it is not a "+" model.

Problem is that I do not know the exact Siglent equivalent and the firmware that that I tried blindly from their site
    SDS1000CFL Series Digital Storage Oscilloscopes(Discontinued)
    SDS1000CFL 2CH Firmware - 5.08.02.38 (Release Date 03.10.15)
only returned
    "Product Type is not acordant!"

Well... my English is not perfect either ...

I dug quite a lot for a better firmware but I could not find any.
It may be that an upgrade path in several steps is needed and that train left years ago.

So, maybe, somebody has some stash of old Siglent firmware for SDS1000 series that you could share? Please?

[tautech]

Welcome to the forum.

5" or 7" display ?

[rteodor]

It is 7''.

[tautech]

It is 7''.

Ok then I suspect it is a SDS1102CML. CFL models didn't have 1Mpts/ch but much less like 40kB which is why we never marketed them.

Pop me a PM with your email address and I can send V100R005B01D02P32 and a CFG file to you.

However you do say you have a V3 firmware installed whereas the only V3 firmware I have is for the earlier 5" CM models.
Meanwhile I'll keep looking through my archives.

[tv84]

So, maybe, somebody has some stash of old Siglent firmware for SDS1000 series that you could share? Please?

It would be safer if you open the scope and take a pic of the motherboard. Then we would be certain of it.

Look here. There is a risk in going around flashing some FW packages of that time because some models use the same Product ID and, as such, you are not fully protected against flashing the wrong model FW.

[rteodor]

There is a risk in going around flashing some FW packages

Not really keen on desoldering NAND chips for reflashing so I will come back with pictures a.s.a.p.

[tautech]

Look here. There is a risk in going around flashing some FW packages of that time because some models use the same Product ID and, as such, you are not fully protected against flashing the wrong model FW.

Now based on the OP description I'm thinking this instead a rebranded Atten as the firmware versions in this thread are a better match:
https://www.eevblog.com/forum/repair/need-full-firmware-(full-dump-flash)-oscilloscope-atten-ads-1062cml/

They had CAL and IIRC CML models and if the OP's unit has 1 Mpts x 2 them it's definitely a CML model.
I might have some CAL firmware but don't think any Atten CML firmware.

[rteodor]

Got images:








It is very similar with this one https://www.eevblog.com/forum/testgear/atten-ads-1102cal-photos/ (but there are at least some silk screen differencies)

[tv84]

As tautech hinted, it's precisely this model:

https://www.eevblog.com/forum/repair/need-full-firmware-(full-dump-flash)-oscilloscope-atten-ads-1062cml/msg881795/#msg881795

Read that thread carefully.

It seems a CAL model. So this FW could be an upgrade. BUT read carefully!

[tv84]

Not really keen on desoldering NAND chips for reflashing so I will come back with pictures a.s.a.p.

That would be the least of your problems! The major problem here is that there is no NAND and you can ruin the device's CPLD for which there is no public flash file, AFAIK.

[tautech]

It seems a CAL model.

I'm not so sure.
The OP indicates mem depth is 1m x 2 therefore total 2Mpts = CML model as pics from rteodor show the PCB fully populated with memory chips.

AFAIK CML can be flashed to CAL however it won't use all the memory available.

[tv84]

Sorry, I meant an Atten CAL. Not a Siglent CAL. Let me fire up my firmware storage...

From past experiences I STRONGLY SUGGEST you stop thinking in flashing a Siglent FW. All of the available model-L ones are versions 5.x.x.x and I think your HW is older than what is necessary to accept those versions.

So your best solution is an Atten xxL FW.

I have Atten_ADS1000 3.1.1.31R16 firmwares for CAL (80), CL+ (80) and CML (80) models.

And that is the biggest problem: all of them use the same Product ID = 80!

[rteodor]

From past experiences I STRONGLY SUGGEST you stop thinking in flashing a Siglent FW

Hardware version is the same old as for routerfan and alexitaly: 3-41-1.61.
I'm not set on some specific firmware. If Atten firmware would fix the 2 most annoying bugs (knob debouncing and trigger) then I'm happy.
Even better: with Atten firmware I might keep using 'attenload' tool to get screenshots via USB.

The OP indicates mem depth is 1m x 2 therefore total 2Mpts

Yes it is a 2 * 1Mpts/ch.
I did not understand if there is different firmware/configuration for memory option or the same firmware makes the detection dynamically ?

I just saw in other's pictures that there is another PLD device under the MB (this PLD devices are quite a mystery to me).
Do you know what is the function of each (Cyclone and Lattice) ?

I want to see how to do a backup and this will take some time.
routerfan had a post on JTAG chaining Lattice and Blackfin. But what about Cyclone firmware ? Does it have a JTAG too ?

[tautech]

The OP indicates mem depth is 1m x 2 therefore total 2Mpts

Yes it is a 2 * 1Mpts/ch.
I did not understand if there is different firmware/configuration for memory option or the same firmware makes the detection dynamically ?

There has always been different firmware versions for CNL and CML models so one presumes the memory selection is made in SW however I'm not certain of that. Years ago adding the additional mem chips that your scope seems to have would allow conversion of CNL models to a CML so maybe the additional memory was just detected and used, IDK. You might still find those old threads here if you search.

I just saw in other's pictures that there is another PLD device under the MB (this PLD devices are quite a mystery to me).
Do you know what is the function of each (Cyclone and Lattice) ?

I want to see how to do a backup and this will take some time.
routerfan had a post on JTAG chaining Lattice and Blackfin. But what about Cyclone firmware ? Does it have a JTAG too ?

tv84 is your man to advise you on this stuff as I wouldn't know where to start. 

[tv84]

I want to see how to do a backup and this will take some time.
routerfan had a post on JTAG chaining Lattice and Blackfin. But what about Cyclone firmware ? Does it have a JTAG too ?

That would be great, for you and the community. Having a dump of a working unit is always a good thing.

I think that with a dump you would be safe to try some FWs. I think the Cyclone will not have JTAG.

The dump would probably allow me to have a better understanding of which FW is the one.

[rteodor]

It seems that debug support for Balckfin is either dead or dying.
I could not get the JTAG working neither with OpenOCD or urJTAG.

LATER EDIT: Silly me. It was wiring. I did not put the 3V3 in the right place.
Will be back.

LATER EDIT 2: We've got  bytes.

Code: [Select]

UrJTAG 2021.03 #
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable ARM-USB-OCD vid=0x15ba pid=0x002b
Connected to libftdi driver.
jtag> detect                                 
IR length: 5
Chain length: 1
Device Id: 01100010011110100101000011001011 (0x627A50CB)
  Manufacturer: Analog Devices, Inc. (0x0CB)
  Part(0):      BF533 (0x27A5)
  Stepping:     6
  Filename:     /usr/share/urjtag/analog/bf533/bf533
warning: ARM-USB-OCD: untested cable, set wait_clocks to 30
jtag> initbus bf53x                         
...

Code: [Select]

jtag> readmem 0x20000000 0x800000 dump_11_axiomet_bf53x_0x20000000_0x800000.bin
address: 0x20000000
length:  0x00800000
reading:
addr: 0x20800000
Done.

I made the dump 3 times and compared MD5 sums. All 3 were the same.
Not quite sure if I got the address or the size right because the compressed size should be bigger.

 dump_11_axiomet_bf53x_0x20000000_0x800000.bin.7z (103.61 kB - downloaded 42 times.)

[tv84]

The dump has good data BUT your 0x00800000 block is 8x the same 0x00100000 block.

Try dumping starting at 0.

[rteodor]

Code: [Select]

jtag> readmem 0x0 0x800000 dump_12_axiomet_bf53x_0x0_0x800000.bin             
error: out of bounds: reading external memory not supported

Datasheet says at 0x0 is external SRAM.

So I went to take it bank by bank (4 banks as in the datasheet). Maybe urtag has an addressing issue.
But the compressed size is again ~100KB.

Then I got also a 8KB dump of the first boundary. Looking inside this dump it seems that it is not contiguous.
I have no idea at the moment of what is wrong.

[tv84]

That's why I'm suggesting a read from address 0.

Suppose address 0 is a mere offset starting at 0x20000000.

[rteodor]

That's why I'm suggesting a read from address 0.

Yes but urjtag does not read from 0x0 (error returned).

I compressed all dumps from each bank. Look at their sizes:

Code: [Select]

103K Feb 20 12:51 dump_13_axiomet_bf53x_0x20000000_0x100000.bin.7z
  435 Feb 20 12:52 dump_14_axiomet_bf53x_0x20100000_0x100000.bin.7z
  450 Feb 20 12:52 dump_15_axiomet_bf53x_0x20200000_0x100000.bin.7z
  410 Feb 20 12:52 dump_16_axiomet_bf53x_0x20300000_0x100000.bin.7z
The first bank might be ok. The next ones definitely not.

[tv84]

The first bank might be ok. The next ones definitely not.

Agree. I'll try to parse the BF code in the 1st block just to validate it. But the end is definitely cut. Some detail is missing in your setup... Can't help there, sorry.

[rteodor]

It seems that there is a bank switching method.
https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg3568004/#msg3568004

As described there it did not work so I asked in that thread for help.