Readback of the Virtex5 configuration

[Kastil Jan]

Hi all,
I am trying to build external SEU generator for our experimental purposes.
The basic idea is similar to the SEU generation makro from Xilinx, the
only difference is that I want to generate SEU through JTAG interface (so
the generator is not able to damage itself).
The generator requires to readback the configuration frame from the FPGA,
make some change (only one bit to simulate SEU) and write it back.
Unfortunatelly, I failed in the first part. I am not able to readback
anything from the FPGA. I am using the ML506 development board and I am
sure I missed something essential. I am hoping, that there is someone who
has any experiences with the readback and is able to tell how I could
readback something from FPGA (configuration prefferably).
I am trying to use chipscope to readback status register from the FPGA as
it is described in UG191 table 7-5 (I readed also AppNote138 and 139) but
I receive only IDcode of the device:

I open the connection to the JTAG and it works (I am able to reconfigure
device)
set Chain [csejtag_tap autodetect_chain $handle $CSEJTAG_SCAN_DEFAULT]
;#discover all JTAG chain connected to the cable

set CFG_IN "3C5" ;# define instruction for JTAG controller
set CFG_OUT "3C4"
set DUMMY "FFFFFFFF"
#bitstream commands
set SYNC "AA995566"
set NOP "20000000"
set READSTAT "2800E001"
#step1
csejtag_tap navigate $handle $CSEJTAG_TEST_LOGIC_RESET 5 0 ;# Resets
JTAG controller
csejtag_tap navigate $handle $CSEJTAG_RUN_TEST_IDLE 0 0 ;# Resets JTAG
controller
csejtag_tap navigate $handle $CSEJTAG_SELECT_IR_SCAN 0 0 ;# Resets JTAG
controller
csejtag_tap navigate $handle $CSEJTAG_SHIFT_IR 0 0 ;# Resets JTAG
controller
#step2
csejtag_tap shift_device_ir $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SELECT_DR_SCAN 0 10 $CFG_IN ;#Loads CFG_IN into the
configuration register of the JTAG
csejtag_tap navigate $handle $CSEJTAG_SHIFT_DR 0 0
#step3
csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SHIFT_DR 0 32 $SYNC
csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SHIFT_DR 0 32 $NOP
csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SHIFT_DR 0 32 $READSTAT
csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SHIFT_DR 0 32 $NOP
csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SELECT_IR_SCAN 0 32 $NOP
csejtag_tap navigate $handle $CSEJTAG_SHIFT_IR 0 0
#step4
csejtag_tap shift_device_ir $handle 4 $CSEJTAG_SHIFT_WRITE
$CSEJTAG_SELECT_DR_SCAN 0 10 $CFG_OUT
csejtag_tap navigate $handle $CSEJTAG_SHIFT_DR 0 0
#step5
set stat [ csejtag_tap shift_device_dr $handle 4 $CSEJTAG_SHIFT_READ
$CSEJTAG_SELECT_IR_SCAN 0 32 $DUMMY]
puts $stat
puts $DUMMY

Thank you for any help or related comment.
Jan