For those interested, here is how control of the input mode and offset is performed:
( I programmed the EEPROM for AP020 and used a preprocessor that acknowledges all transactions. )
1. The quality of the contacts in the connector matters, poor contact leads to a transition to strange modes (a red bar “Processing ...” appears. When I realized this, the work became predictable. EEPROM address - 50h (all address inputs must be at zero)
2. The binary images on the Internet contain only the valid data. The default programmer leaves FF in an unused area. It confuses the firmware. All free memory must be filled with zeros.
3. The oscilloscope reads entire EEPROM sequentially, regardless of the size of the data block, in one pass. Then it recognizes the probe, and switches the input mode (in my case, DC coupling is turned on and 50 ohms is not turned on - perhaps the resistor in the probe, although in the picture you can see only the place for its installation.
4. When you rotate the offset knob, the oscilloscope sends the following commands to two PCF8574 port expanders - at addresses 0x23 (data port) and 0x21 (command port). First, the most significant byte of the offset is written to the data port (for positive numbers, the most significant bit = 1, for negative numbers = 0). Then bit 0x01 is set in the command port (latch new data in 74573), after that the bit is cleared (data remains in 74573) and then the low byte is written to the data port. Perhaps this leads to a small glitch at the DAC output, but they are OK with it.
5. If these transactions are not acknowledged, the oscilloscope makes 4-6 recording attempts and stops.
6. For example, 0x8000 = offset = 0, 0x7FFE = offset = -2mV, 0x8002 = offset = + 2mV. In this case, the DAC code is likely to scale, since for the sequence 1,2,3,4,5,6mV codes 0x8002,0x8004,0x8006, 0x8007, 0x8009, 0x800A. But I am not 100% positive in scaling.
7. When switching the vertical scale and if the offset is not zero, the oscilloscope sends the correspondingly changed offset - that is, on the 1mV range, the 10mV offset will be replaced by 50mV when switching to 5mV. If offset was zero, the transaction is not done as it stays zero.
8. Depending on the input mode, the command port bits have the following meaning - 0x10 - when set, the DC coupled input. 0x40 = when set, the input is AC coupled (on probes, is this?) When both bits are cleared, the input must be Grounded. That is, switching the mode and writing a new offset corresponds to 0x23 = MSB, 0x21 = 0x11, 0x21 = 0x10, 0x23 = LSB for DC coupled, 0x23 = MSB, 0x21 = 0x01, 0x21 = 0x00, 0x23 = LSB for GROUND, 0x23 = MSB, 0x21 = 0x41, 0x21 = 0x40, 0x23 = LSB for AC coupled. The relay may be switching Ground.
9. I did not find the purpose of the remaining bits in the control port, other buttons and knobs do not affect the samples.
The schematic which illustrates the concept of control in case of AP020,AP022. The DAC appears in complementary offset binary.
Other bit settings may appear needed for other probes. It looks that WavePro recognizes newer probes (ZDxxx, ZSxxx) and lists their names, but does not send offset data to probes on I2C. Newer scopes should be able to do that.