Open replacement firmware for the Siglent SDS1000CML+ oscilloscope

Open replacement firmware for the Siglent SDS1000CML+ two-channel oscilloscope (developed on the SDS1102CML+). It turns a budget 100 MHz scope into a deep-memory protocol and analysis instrument: both channels at 500 MS/s into a 1 M-sample record, hardware triggers on fifty-two serial protocols, continuous decoding, super-resolution and a full web interface. It replaces the application on the scope's ARM processor and the FPGA images that application loads. Nothing is flashed: a power cycle always brings back the factory firmware.

⚠️ Use at your own risk. This firmware takes over a mains-powered instrument and drives its relays, DACs and acquisition bus. It is for the SDS1000CML+ series only. There is no warranty (see LICENSE and SAFETY.txt).

Trigger on the data of a 104 MHz SPI flash, directly on the scope. The FPGA decodes the bus from the converters' samples and triggers on the flash's Fast Read command 0B 00 10 00 (read at address 0x001000). The BUS workspace lists each decoded read in a fixed hex column with its text beside it: here the 286 reads in one stopped record, every byte of them.

One capture, 1,048,576 samples a channel. A SINGLE capture holds 2.1 ms at the full 500 MSa/s. The bar under the trace below is that whole record, all 286 flash reads in it; the large view is 2 µs of it at 200 ns/div, the triggered read with every clock edge resolved and its bytes decoded under it; the packet list decodes all 19,769 bytes of the one capture.

Every capture here is from a live SDS1102CML+ running this firmware, with 10x probes. An Alchitry Au drives a look-alike of an SPI flash read at 104 MHz (clock on C2, data on C1; each read is 0B 00 10 00, a dummy byte, SPI FLASH 104MHZ OPEN-SDS 0123 and 32 counting bytes), and the serial trigger matches 0B 00 10 00. LCD images are the native 800 × 480 screen.

Five task workspaces, one per printed F-key on the rail at the right. Pressing the shown workspace's key again switches to its next view.

The web UI on port 8080 has the same five workspaces (Alt+1 to Alt+5), a strip with run control, timebase, channels and trigger, and All settings (Ctrl+,). A workspace's key pressed again shows its next view, as on the scope.

http://<scope>:8080/r is a remote for the scope's settings: it shows no waveform and never opens anything on the scope's screen.

Channels 2, sampled together

Sample rate 500 MS/s per channel, real time, on both channels at once (1 GS/s aggregate)

Record length 1,048,576 samples per channel at full rate, captured on every acquisition; the full record is read on STOP or SINGLE

Live display 16–24 frames/s from 1 µs/div to 1 ms/div, protocol decode included (about 12 at 5 ms/div)

Precision mode 16-bit filtered samples, 524,288 per channel; decimation ×16 to ×1,048,576 for long records (137 s at 50 s/div)

Super-resolution up to a ×64 time grid (31.25 ps); about +4 bits from FPGA stacking

Timebase 1 ns/div to 50 s/div

Roll mode AUTO at 10 ms/div and slower scrolls continuously; optional gap-free streaming, verified loss-free at ~1 M samples/s per channel (3.9 MB/s) with about 1 s of buffering in the scope's SRAM

Vertical 2 mV/div to 10 V/div; DC, AC or GND (AC and GND applied to the samples); 20 MHz bandwidth limit; probe ×1, ×10 or ×100

Serial protocols 52, each with a hardware trigger, decode and AUTO detection: UART, I²C, SPI, CAN / CAN FD, FlexRay, ARINC 429, MIL-STD-1553, SENT, Manchester, USB low and full speed, LIN, DMX512, MIDI, Modbus RTU, 1-Wire, WS281x, DHT / AM230x, HDMI-CEC, SAE J1850 VPW, IR NEC, IR Sony SIRC, IR RC-5, IR RC-6, DALI, USB Power Delivery, S/PDIF, PS/2, SWD, MDIO, Wiegand, quadrature encoder, stepper STEP/DIR, PWM, PT2262 / EV1527 remote codes, Oregon Scientific OOK, ISO 14443 Miller, Morse, DCF77, EM4100, EM4305, T55xx, STM8 SWIM, SDQ, PJON (PJDL), DSI, Qi, SD card (SD mode), AVR PDI, cJTAG, Maple bus, digital caliper, IR multi-protocol (Samsung, JVC, NEC16/42, Kaseikyo, Matsushita, Denon)

Streaming decode continuous, gap-free protocol decoding, not one capture at a time: 921,600-baud UART ran for 3 minutes without losing a byte, with the full-rate record kept for every frame

Analysis 18 automatic measurements, cursors, math, FFT, spectrogram, eye diagram and jitter, mask test, bus layers, SOUND (audio meters, tuner, envelope, modulation, harmonics, Listen)

Interfaces web UI in any browser, SCPI over VXI-11 (LAN), the scope's own LCD and front panel

Acquisition

Full-depth capture on both channels. Every acquisition fills the scope's 2 MiB SRAM: 1 M samples per channel at 500 MS/s, 2.1 ms. While running, only a display-sized view of it is read, so the screen keeps up; STOP or SINGLE reads the full record (about 4 s, with a loading indicator), which can then be zoomed, measured, decoded and exported at full resolution. SINGLE shows its capture at once, as a live frame, and stops; the full record of that same capture follows. In Average, ERES and Precision, SINGLE completes one result as the live view does and stops on it, and STOP keeps the result shown. Changing V/div, offset or timebase on a stopped record redraws it from memory.

Calibrated five-way interleaving. Each channel runs five 100 MS/s converters in turn. Per-core correction removes the interleave pattern (the comb drops from 11 codes to 0.15).

Converters checked. About one FPGA load in a hundred left some converters not converting, which put a fake pattern at a fifth of the sample rate under every capture. The scope restarts the converters' encode clocks after every load and reads the ten cores; it reads them again every minute and whenever a full-rate record shows a core holding one code, and brings stuck ones back (an encode restart, then reloading the image). If they stay stuck, a notice on the LCD and the web UI's status line names them ("ADC fault: converter E2 not converting - restart the scope") and /api/status carries adc_fault; adc_recoveries counts the ones brought back.

Precision mode. At slow timebases the FPGA decimates by a power of two, ×16 to ×1,048,576, through a CIC filter. The ARM applies a 63-tap compensation filter and keeps 16-bit samples, so a slow record gains resolution instead of aliasing. The UI shows the resulting bandwidth and bit gain.

Modes: normal, average (a running average of up to 256 captures, aligned on the trigger), enhanced resolution and precision.

Live min/max envelope: the FPGA reduces the screen to 4,096 min/max points, so narrow events stay visible at any zoom. Zoomed in until fewer of those points than pixels are shown (the LCD from 10×, the web page alike), the zoomed stretch of the same capture is read again at full detail, a min/max pair per column: a 1 MHz square at 200 µs/div zoomed 50× shows its 40 cycles, not the screen's points stretched (read in the same request as the screen: 1 to 3 frames a second of cost, the most where the zoom shows a fast signal's edge every few columns). The points are put back in time order, so protocol decode, masks and trigger placement run on live frames too. Average, ERES and precision use a decimated live capture of 8,192 samples instead (their filtering needs true samples; the FFT takes 8,192 to 16,384 filtered samples, its 8,192 points one for one, or up to 32,768 at the full rate at 5 µs/div and faster); eye diagram and super-resolution read raw samples while in use.

Roll mode. In AUTO at 10 ms/div and slower the view scrolls instead of waiting for a trigger. By default it is built from back-to-back decimated captures, so a timebase change responds at once; it captures about two thirds of the time, and the gaps between captures hold the last value, drawn dimmed, and are left out of measurements. HORIZ F4 (web: SCOPE, Horizontal, Roll: Stream) switches to gap-free streaming on the FPGA stream image: every averaged (or min/max) sample reaches the ARM, at up to 978,000 samples/s per channel (decimation ×512, 3.9 MB/s; the bus carries about 5.1 MB/s). The scope's 2 MiB SRAM buffers the stream, so the ARM can stall for about 1 s at ×1024 (0.5 s at ×512) without losing a sample; a longer stall is reported, never silent.

Responsive controls: front-panel keys and lamps answer within tens of milliseconds, even during a long readout; a LOADING indicator (LCD and web) shows while a record is being read.

Faster FPGA readout

Compared with CPU readout from the factory FPGA, our DMA path demonstrated roughly 3× higher raw transfer throughput in earlier benchmarks (11.1 MB/s versus 3.1–3.9 MB/s). DMA replaces the vendor's per-word CPU read loop; the current driver still polls for completion.

For live viewing, the FPGA sends an 8 KiB min/max envelope instead of a 2 MiB raw record—256× less sample data to transfer (about 10–30 ms instead of about 2 s), while keeping the full record in SRAM for STOP, SINGLE and detailed review.

Edge in hardware, with sub-sample placement: 0.19 ns peak-to-peak edge wander at 5 ns/div.

Pulse width, slope and video (PAL / NTSC, line select) in hardware: the qualify FPGA image measures the width or slope time in 4 ns ticks and counts video lines, and fires on the event.

Auto, normal and single modes; holdoff up to 10 s; force trigger.

Protocol triggers in the FPGA for all fifty-two protocols. Match a byte, word, address, ID or frame pattern, with masks and wildcards. The forty-two added after the first ten (LIN onward) share one programmable block in the qualify image: it times each run of a line, classifies it through a table the app writes, takes the bits by pulse width, by a re-timed sampler or by a clock line, and matches a 64-bit window. AUTO in BUS finds a bus from an edge-triggered capture and arms its frame-start trigger. The decoded-event stream (BUS Stream view) carries the first ten, MIDI and USB full speed; the forty-one on the symbol trigger stream decoded in software, the BUS sheet's Stream mode row saying how.

Sequence trigger: chain up to 32 protocol events, including trigger on error.

Zone trigger: draw up to four boxes on the screen that the waveform must cross or avoid; the FPGA keeps a history of where the signal was and decides each edge.

Every trigger is decided in the FPGA; the app only places the trigger point exactly on the event.

Mask test: build a golden mask from live frames with time and voltage tolerances. Count failures or stop on the first one, and browse the failure gallery.

Serial protocols

Every protocol has an FPGA trigger and a decoder. The scope loads the FPGA image a protocol needs automatically.

The fast FPGA image decodes SPI, UART and I²C from the converters' own samples instead of 125 MHz line levels. Each line's crossings are found in the raw 2 ns samples and timed to a sixteenth of a nanosecond by interpolation; the receivers read the bits at those times. A byte trigger decided in the FPGA fires on the matched frame, and the decoded stream carries every byte.

All three run in one fast image (86 % of the FPGA's logic, timing met). The general image's receivers stay for everything they read: UART to 5 MBd 8N1, I²C to fast-mode plus, SPI to about 20 MHz. Past that, or with Receiver = Samples on the BUS sheet, the scope loads the fast image by itself (about four seconds). Detection names these buses too: a 62.5 MBd UART and high-speed I²C.

SPI data delay. A flash read at 104 MHz puts its data out 6 to 8 ns after the clock edge that launches it, most of a period late. The BUS sheet's Data delay = Auto reads the record's data eye: every data transition between clock edges gives its phase, and the eye is the widest phase interval holding none. The receiver reads the data at the middle of that interval, and the row shows the delay and the timing margin left on each side.

18 automatic measurements: Vpp, Vmax, Vmin, Vmean, Vrms, AC rms, Vtop, Vbase, amplitude, overshoot, preshoot, frequency, period, duty cycle, rise time, fall time, +width and −width. On the live min/max view, rise, fall and over/preshoot come from two short full-rate reads around the trigg