QSC RAVE Firmware Corruption via Update Failure
A while ago I picked up a pair of QSC RAVE 88S. These magic wonders from my favorite commercial audio company use technology from PEAK Audio/Cirrus Logic to shove audio across computer networks at low latency. This system is called CobraNet, and it’s implemented in hardware from a number of companies. I think it’s legacy now, with the newer Dante standard getting all the love. These RAVE 88S are pretty crusty, having been superseded by units from the QSC BASIS line. However, home user + budget = the cheap $20 units from eBay. I remember getting them working, then I put them on a shelf for later use. The 88S models each features 4 stereo pairs of digital audio in and out (AES/EBU, which is like the coaxial connection you find on some CD, DVD, DAT, MiniDisc and computer sound cards. 2 channels, not 5.1 or 7.1. It cannot do 8 channels from ADAT. AES/EBU is the professional version of the digital RCA jack, using a balanced XLR connector.) There are other models that are 16 in, or 16 out, and another series of analog in and out. I’d really like some of the analog ones like the 161S, but there is more competition to get hold of those.
MAGFest is coming up and this is motivation to get a lot of stuff working. I borrowed from my friend Robert 3 CobraNet endpoints from PRN. I didn’t have much luck with them but didn’t realize one of my RAVE 88S wasn’t transmitting any audio on the network so I need to go back and investigate further. The PRN units might attenuate the audio level based on room sound level — not sure. It’s in the patent.
Through the magic of looking at eBay, which I try to avoid, I picked up 3 QSC BASIS 904zz units. These are CobraNet endpoints, they’re much newer, and they have the functionality of controlling the amplifiers I own from QSC. I have an older unit called a CM16A which has similar functionality, but without CobraNet and without the DSP. I didn’t know what I was getting into, but the BASIS is just totally bad ass. Similar to modern DAW programs you can draw out “cable routing” between the CobraNet audio coming in, the DSP system and the amplifiers attached to the unit. Many band EQs, Crossovers, Delays based on feet per second of sound travel… doodle it in the software, sync it to the unit and it’s there. I didn’t even know it could do this stuff, I was just after CobraNet out that worked!
BUT… on to screwing up the firmware in my RAVE units. I was having tons of problems with the PAM units receiving audio from my RAVE units. The RAVE units are configured with this utility known as CobraNet Disco (CobraNet Discovery.) All the CobraNet stuff seems to be based off of reference designs, but I’m not sure 100%. After a lot of fighting with the RAVE boxes I finally decide that I should bring the RAVE units to the same version of CobraNet / firmware as the BASIS units are running and the PRN units are running. So I use the Disco utility + firmware snatched via Archive.org (RAVE boxes are old!) and … clicked update.
The utility kicks in, does it’s thing till about 3/4ths of the way … then freezes. It says it can’t do it’s thing any more, and halts. I try again, no go. I try to upload the firmware that was in the unit originally, and it doesn’t work either. Take a deep breath, power cycle the thing…. and it’s a 1u rackmount brick.
I try setting the rotary encoders on the front to FFFF, no go. Apparently there is a recovery method outside the one I came up with, TFTP + RARP style that QSC has. But I don’t know the details.
I took my unit apart, because who doesn’t want to know whats inside. It’s a lot of screws. But once inside I notice after picking off a sticker that the main program store chip is an AMD flash device. I pull the chip, throw it in the programmer and save off the contents. For giggles, I upload the firmware straight from the HEX file that the Disco utility uses, slam it in the RAVE 88S and it boots fine. One caveat, and that is the MAC address is half FF’s. The vendor side is okay but the unique unit side is not.
In the earlier firmware I did find the MAC address near offset 00007C04 in the chip. On the earlier version of the firmware I believe the MAC address was in there straight, but the newer version has FF padding in between each octet. So you will need to randomize this otherwise the use of two units on the same network switch will go south.
The flash chip is an AM29F010B in my units.
Now, one of my units for some reason doesn’t work. It doesn’t take digital audio and put it on the network. I think it RX’s fine but just won’t transmit. This is what threw me off since I was trying to do use the PRN units with this one. The second RAVE 88S, I had to hit it to get it to work (no ethernet link/no LEDs at all except one pulsing.) Technical tap they call it. After pushing down on all the seated chips (probably GAL/PAL type chips since there are versions written on them?) I haven’t had an issue. I think the unit that won’t transmit audio — it might be a SNMP value that is wrong but I haven’t spent the time to try to compare the output of snmpwalk against both units (Disco utility I think mostly uses SNMP to do all control functions.)
I was also concerned the RAVE 88S wouldn’t lock up to 44.1KHz and would require 48KHz bitrate. This isn’t true, it has sample rate conversion internal. I’ve been driving mine with both a Denon CD player and a minidisc field recorder, single ended into the XLR.
I never did solve why Disco can’t update the firmware. I didn’t have it on an isolated network, so that might be one issue.
I do plan to try to make fan out cables from the DB-HD-15 connectors on the BASIS units to hook them to 3rd party self amplified PA speakers (the BASIS units I have are meant to only connect straight to QSC amplifiers via the dataport connector on the back, a VGA type cable (that has to have all wires in the cable separate and straight though! Cheap VGA cables not ideal – shared grounds!!))
Also, did I mention, the BASIS units are way cool!!
And in case you came here sniffing around, here is the last versions of the RAVE firmware (Note the topic of this post about bricking units trying to update firmware:
QSC RAVE Firmware Files – The last ones