Voltcraft DSO-3062C

From Random Projects
Revision as of 01:49, 2 April 2012 by Uwe Hermann (talk | contribs) (System information)
Jump to: navigation, search
Voltcraft DSO-3062C

The Voltcraft DSO-3062C is an inexpensive (299.- Euros as "special offer" from Conrad) 2-channel digital oscilloscope with 60MHz bandwidth and 1GSa/s samplerate (or 500MSa/s when both channels are used) that can be modified to a 200MHz bandwidth scope via a software change.

It is based on the Samsung S3C2440 (ARM9 SoC) and runs Linux, thus is a very nice "hackable" target in general.

My unit

I ordered the device on March 23, 2012 from Conrad, it arrived March 27, 2012. The following versions apply to my unit:

  • Model: DSO3062C
  • SW-Version: 2.06.3(120224.0)
  • HW-Version: 10070x555583e9
  • Serial number: T 1G/012 00xxxx



How to open the device

To be continued...



System information

System info

See Voltcraft DSO-3062C/Sysinfo for the output of various commands run from within the Linux system on the scope (via UART).

Creating a backup

You can use this tool to create a backup of the oscilloscope firmware.

$ wget 'http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/?action=dlattach;attach=11522' -O fw_backupV3a.zip
$ unzip fw_backupV3a.zip
$ cd Universal
$ mv special_secret_dst1kb_9.99.9_cli\(200101.1\).up 'dst1kb_9.99.9_cli(200101.1).up'

Copy dst1kb_9.99.9_cli(200101.1).up to a USB thumb drive (FAT32 file system), insert the thumb drive in the scope, wait a few seconds, press Utility, press F2 (Firmware upgrade), press F5 (Confirmation that the firmware upgrade should start). Now wait 1-5 minutes, when the process is finished a dialog box tell you to restart the scope.

Afterwards, the USB thumb drive will contain a dump/ directory with boot.bin, kernel.bin, and root.bin files which are dumps of the respective NAND flash partitions.

Upgrading the device to 200MHz bandwidth

USB (Windows)


USB (Linux)

You can use this little Python script (edit it to your needs) as root in order to upgrade the scope from 60MHz to 200MHz.


You'll need to download and install PyUSB >= 1.0 first (the python-usb Debian package does not work, that version is too old and incompatible).

$ unzip pyusb-1.0.0a2.zip
$ cd pyusb-1.0.0a2
$ python setup.py install (as root)

Upgrade script:

IMPORTANT: Use at your own risk! In the worst case your scope could be "bricked"! You have been warned!

#!/usr/bin/env python
# Written by Uwe Hermann <uwe@hermann-uwe.de>, released as public domain.

from array import array
import usb

# Uncomment the line you want to run, or add your own for other variants.
# Filenames: 60MHz = dst1062b, 100MHz = dst1102b, 200MHz = dst1202b
cmd_str = 'mv /dst1062b /dst1202b' # 60MHz -> 200MHz
# cmd_str = 'mv /dst1202b /dst1062b' # 200MHz -> 60MHz

# Find and open the device.
dev = usb.core.find(idVendor = 0x049f, idProduct = 0x505a)
if dev is None:
    print("Voltcraft DSO-3062C not found. Did you connect it via USB?")

# On Linux the 'cdc_subset' driver grabs the device, unload it first.
if dev.is_kernel_driver_active(0):

cmd = [0x43, 0x18, 0x00, 0x11] + map(ord, cmd_str)
checksum = sum(cmd) & 0xff

dev.write(0x01, cmd + [checksum])
# print("Reply: " + str(dev.read(0x82, 64))) # Ignore reply for now.

print("Upon the next boot the scope should be upgraded if nothing went wrong.")


Press CTRL-C to kill dso.exe, press enter to get a shell, then run:

$ mv /dst1062b /dst1202b

Reboot the scope. That's it.

Example captures before and after the 200MHz upgrade

This is a set of example captures done using the Voltcraft DSO-3062C oscilloscope. I used the original PP-80 probes it ships with (60MHz, 10X, 1.2 meters), as well as Tektronix P6139A probes (500MHz, 8.0pF, 10MOhm, 10X, 1.3 meters) for comparison.

50MHz clock signal

This is a set of captures of a 50MHz digital (clock) signal from an FPGA to an SRAM chip.

As a reference, a capture (of the same signal) was done on a Tektronix TDS744A oscilloscope (500MHz bandwidth, 2GSa/s) using the Tektronix P6243 active probe (1GHz, 1MOhm, <1pF, 10X).

100MHz clock signal

This is a set of captures of a 100MHz digital (clock) signal from an FPGA to an SRAM chip.

As a reference, a capture (of the same signal) was done on a Tektronix TDS744A oscilloscope (500MHz bandwidth, 2GSa/s) using the Tektronix P6243 active probe (1GHz, 1MOhm, <1pF, 10X).


Use the J801 header. (TODO: Photos, pinout)

My modular UART cable setup

I'm using a standard FTDI TTL-232R-3V3 cable with some additional custom soldered cables which connect to the three UART pins (RXD0, TXD0, GND) on the PCB. I soldered three individual pins on the PCB for that.

The FTDI cable fits nicely through the space at the back side of the scope which is intended for an Ethernet jack (but not used in this model).


See Voltcraft DSO-3062C/Bootlog for the debug messages output during the boot process.

Login shell via UART

Press CTRL-C to kill dso.exe, then press enter to get a shell.



The board has a standard 20pin ARM JTAG connector (just the vias/holes, no pins) onboard. However, it's in 2mm pitch, not the usual 2.54mm pitch most JTAG adapters can attach to per default. You can either solder a 2mm pinheader if you have a proper cable, or build a small converter PCB to 2.54mm pitch, or abuse an old IDE cable (like I did) to solder your own 20pin 2.54mm pitch adapter directly to the PCB. This allows you to attach any standard JTAG adapter easily.

OpenOCD config

(This has been sent upstream and should be obsolete soon)

Copy this file into OpenOCD's board directory (in the OpenOCD install location).

$ cat voltcraft_dso-3062c.cfg
# Voltcraft DSO-3062C digital oscilloscope (uses a Samsung S3C2440)
# http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/
# http://www.mikrocontroller.net/topic/249628
# http://elinux.org/Das_Oszi
# http://randomprojects.org/wiki/Voltcraft_DSO-3062C

# Enable this if your JTAG adapter supports multiple transports (JTAG or SWD).
# Otherwise comment it out, as it will cause an OpenOCD error.
### transport select jtag

source [find target/samsung_s3c2440.cfg]

adapter_khz 16000

# Samsung K9F1208U0C NAND flash chip (64MiB, 3.3V, 8-bit)
nand device $_CHIPNAME.nand s3c2440 $_TARGETNAME

# arm7_9 fast_memory_access enable
# arm7_9 dcc_downloads enable

nand probe 0
nand list

# TODO: RAM init etc. later for U-Boot/Kernel usage (probably based on mini2440.cfg).

Starting OpenOCD

I'm using a Floss-JTAG adapter here, replace flossjtag-noeeprom.cfg with the config file for your adapter.

$ openocd -f interface/flossjtag-noeeprom.cfg -f board/voltcraft_dso-3062c.cfg
Open On-Chip Debugger 0.6.0-dev-00493-gd40cb56 (2012-04-01-02:14)
Licensed under GNU GPL v2
For bug reports, read
Info : only one transport option; autoselect 'jtag'
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
12000 kHz
Info : max TCK change to: 30000 kHz
Info : clock speed 10000 kHz
Info : JTAG tap: s3c2440.cpu tap/device found: 0x0032409d (mfg: 0x04e, part: 0x0324, ver: 0x0)
Info : Embedded ICE version 2
Info : s3c2440.cpu: hardware has 2 breakpoint/watchpoint units
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000480
MMU: disabled, D-Cache: disabled, I-Cache: disabled

Using OpenOCD

In another xterm run:

$ telnet 4444

You can now dispatch any OpenOCD commands you want, for example:

> targets
    TargetName         Type       Endian TapName            State       
--  ------------------ ---------- ------ ------------------ ------------
 0* s3c2440.cpu        arm920t    little s3c2440.cpu        halted

> scan_chain
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 s3c2440.cpu            Y     0x0032409d 0x0032409d     4 0x01  0x0f

> nand probe 0
NAND flash device 'NAND 64MiB 3.3V 8-bit (unknown)' found

> nand list
#0: NAND 64MiB 3.3V 8-bit (unknown) pagesize: 512, buswidth: 8,
        blocksize: 16384, blocks: 4096

Dumping the NAND flash


Building buildroot and an arm-linux cross toolchain


Building a kernel


Building U-Boot


Building Barebox

Note: This is work in progress!

Add the bin directory (where the toolchain you built above resides) to your $PATH:

$ export PATH=$PATH:~/buildroot-git/output/host/usr/bin

Get the Barebox source code via git:

$ git clone git://git.pengutronix.de/git/barebox.git
$ cd barebox

Configure Barebox:

$ make ARCH=arm menuconfig

You have to select a few important options, the other ones are optional and you can configure them as you see fit.

  • ARM system type (Samsung S3C2410, S3C2412, S3C2413, S3C2440, S3C2442, S3C2443)
  • S3C24xx Board Type (Mini 2440) (for now)
  • ...

Build Barebox:

$ make ARCH=arm CROSS_COMPILE=arm-linux-
LD      barebox
SYSMAP  System.map
OBJCOPY barebox.bin
CHKSIZE barebox.bin

Running Barebox from RAM

In OpenOCD run:

> init_2440
> load_image barebox.bin 0x31fc0000
95984 bytes written at address 0x31fc0000
downloaded 95984 bytes in 3.942175s (23.777 KiB/s)
> resume 0x31fc0000

On UART you will see something like this (for now):

barebox 2012.03.0-00113-g96a43ca (Apr  1 2012 - 23:34:21)

Board: Mini 2440
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bi)
Bad block table not found for chip 0
Bad block table not found for chip 0
Scanning device for bad blocks
Bad block table written to 0x03ffc000, version 0x01
Bad block table written to 0x03ff8000, version 0x01
refclk:    12000 kHz
mpll:     405000 kHz
upll:      48000 kHz
fclk:     405000 kHz
hclk:     101250 kHz
pclk:      50625 kHz
SDRAM1:   CL4@101MHz
SDRAM2:   CL4@101MHz
Malloc space: 0x31bc0000 -> 0x31fbffff (size  4 MB)
Stack space : 0x31bb8000 -> 0x31bc0000 (size 32 kB)
envfs: wrong magic on /dev/env0
no valid environment found on /dev/env0. Using default environment
running /env/bin/init...
not found