aioscilloscope / Hardware / Owon ADS800A

Inside the Owon ADS800A, part by part

A Nexell S5P4418 runs the scope on Android 7.1; a Xilinx Spartan-7 XC7S75 FPGA, configured from a file at every boot, catches the samples and hands them to the SoC over its static-memory bus — not PCIe, as on the Rigol scopes. This page is what we have read on our own ADS802A, from read-only captures of its stock system. Each part is marked by how we know it. NovaOS now boots on it, on Linux 7.2.10 (where it stands); this is the map the work is built from, and it grows as the work does.

CH1The block diagram

Signal flows left to right across the top: input, front end, ADC, FPGA. The FPGA captures the record and the SoC reads it back over a 16-bit parallel memory bus. Solid lines carry data; dashed lines are slow control. Our bench unit is a 2-channel ADS802A; the 4-channel models in the family add two more input chains and an arbitrary-generator FPGA that this unit does not fit.

Drawn by us from our ADS802A's device tree and its boot and system captures. Parts marked * are named or driven by the firmware but not yet read off the board.

CH2Every part we know of

verified on our unit means we read it ourselves on our ADS802A: a node in the running device tree, a live /sys or /proc entry, or the FPGA's own ID code. in the firmware means the stock kernel or app names or drives it, but we have not seen the part itself. public is a published claim, or a known part, we have not confirmed. in progress is what we are working out now.

Part	Job	Connected by	How we know
Nexell S5P4418	Runs everything: OS, UI, drivers. 4 × Cortex-A9 up to 1.2 GHz, Mali-400 GPU	—	verified on our unit CPU IDs and the SoC node
2 GiB DDR3	Main memory	SoC DRAM controller	verified size and range
eMMC 8 GB (7.28 GiB)	The only storage: Android system, the `/oem` identity and FPGA image, and the settings partition	SD/MMC bus, 4-bit, 100 MHz, non-removable	verified protocol and partition map
Xilinx Spartan-7 XC7S75	Acquisition FPGA: capture, trigger, record memory, read-out, and it serializes the front-end relays	SoC static-memory bus (16-bit, `0x34000000`); configured over 5 GPIOs	verified from its ID code (0x037C8093), and in the firmware's loader
Analog front end ×2	Per channel: attenuator and coupling (AC/DC/GND) relays and a VGA, whose own filter is the 20 MHz bandwidth limit. The inputs are 1 MΩ only: Owon's firmware has a 50 Ω setting for other boards, and never uses it on this one	Relays shifted into a 74HC595 chain by the FPGA; VGA set over FPGA registers	in the firmware the control path. in progress the analog parts (LMH6518 class)
ADC	Sampling, 12-bit	To the FPGA	in the firmware a TI ADC12DL500-class part, as the stock software sets it up. in progress the exact marking and the sample rate
Goodix GT928	Capacitive touch, 1024 × 600, 5-point	I²C, address 0x5d	verified device and live driver
7″ LVDS panel	1024 × 600, ≈ 51.4 MHz pixel clock	LVDS from the SoC display controller	verified timing and live output. in progress the panel controller marking
HDMI out	The SoC's own HDMI output, sharing the panel's DDC bus	—	verified the output node is enabled
X-Powers AXP228	Power management: all core, I/O and DDR rails, and an RTC LDO	Bit-banged I²C, address 0x34	verified device and live driver
NXP PCF8563	Real-time clock (the SoC's own RTC is disabled)	I²C, address 0x51	verified device and clock-out
TMP175	Board temperature; it re-trims the front-end gain over temperature	I²C, address 0x37	verified device. in the firmware the temperature-compensation callback
Realtek ALC5623	Audio codec	I²S, plus I²C control at 0x1a	verified device and live driver
Ethernet (GMAC)	LAN control; the SCPI, VXI-11 and web services	RGMII to a Realtek RTL8211F PHY (MDIO address 4)	verified the MAC, the PHY's ID and a gigabit link
USB device port	A gadget carrying USBTMC (SCPI), ADB and MTP at once	dwc2 OTG	verified the live gadget configuration
SMSC USB2514	4-port USB 2.0 hub	SoC USB host (EHCI/OHCI)	in the firmware driver registered. in progress its exact role on this board
Board peripherals	Buzzer, logic-analyser probe detect, front-panel LED chain and keys	GPIO; a 74HC595 LED chain	verified buzzer and LA-detect live. in the firmware the LED chain; only the Home key is live
AWG (“AG”) FPGA	Arbitrary-generator FPGA on the 4-channel models	would use its own GPIOs	verified not fitted on the ADS802A (boots with `ag=0`); its pins read as pulls

CH3The FPGA, the register bus and the front end

The FPGA is configured at every boot. There is no configuration flash on the FPGA. A kernel driver clocks an image file from the /oem partition into the Spartan-7 as a slave-serial bit stream, over five GPIOs (PROG, CCLK, DIN, DONE, INIT_B). It refuses any image whose ID code is not 0x037C8093, the XC7S75's.
Read over a memory bus, not PCIe. Unlike the Rigol scopes, the FPGA is not a PCIe endpoint. It sits on the SoC's static-memory bus (the Nexell MCU-S/EIM controller) as chip-select bank 13: a 64 MiB window at 0x34000000, 16 bits wide, with 16 address and 16 data lines. The scope reads sample blocks and writes control as 32-bit register accesses into this window.
The front end is driven through the FPGA. The per-channel attenuator and coupling relays are not on a kernel GPIO. The app writes the relay and gain words to FPGA registers, then pulses an enable bit so the FPGA shifts them out into the front end's own 74HC595 chain. A TMP175 reading re-trims the gain DAC over temperature.
The ADC is a 12-bit part behind the FPGA, set up by the stock software as a TI ADC12DL500-class part. Its marking on the board and its sample clock are still being worked out; we do not state a number we have not read.
Display: a 1024 × 600 LVDS panel at about a 51.4 MHz pixel clock; HDMI is enabled alongside it.

We deliberately leave the analog bandwidth, the sample rate and the record memory depth off this page: they are not yet established from a primary source, and a guessed figure here would be worse than none. When we measure them on the unit, they will appear here with how we measured them.

Still unknown, and how we will check

The ADC, the VGAs and the front-end parts: from photos of our own open board and the chips' datasheets.
The panel controller: from the board, or a controller ID read-back.
The sample rate, analog bandwidth and record depth: by tracing the FPGA's clock and depth registers, and by measuring on the unit.
The front-end relay bit order: obfuscated in the app; we will recover it from the FPGA's behaviour and a live capture when the front-end driver is written, not guess it.
What differs across the ten models, and the Voltcraft and CEI rebrands: we have one 2-channel unit, so we rely on owners of the others for now.

Credits and sources

Thank you to the owners in EEVblog's Voltcraft DOV thread, who mapped this platform first.

EEVblog forum: Voltcraft DOV series
Owon's ADS secondary development documents: the ADS Series Programming Manual and demo code
AMD/Xilinx 7 Series configuration (UG470) and the Spartan-7 data sheet, for the slave-serial load and the ID code

We read and measure; we do not publish Owon's code. OWON, Voltcraft and CEI are trademarks of their owners. Have an ADS800A, an ADS900A, a DOV702/DOV704 or a CEI914/CEI924, and photos of its board? Tell us — we will credit you and fill in the parts we list as in progress.