Reverse engineering FNIRSI-5012H

[ataradov]

Programming instructions added https://github.com/ataradov/open-5012h/blob/master/doc/Programming.md

[cliffyk]

Excellent job.

It seems that there is a new device with firmware upgrade capabilities:
https://www.aliexpress.com/item/4000571425898.html?spm=a2g0o.productlist.0.0.12fa7d388Lzfjc&algo_pvid=6c34e913-1d3d-4385-ac47-d42bf2ff2b22&algo_expid=6c34e913-1d3d-4385-ac47-d42bf2ff2b22-0&btsid=5ef1452f-80b4-4876-9a21-5162ea7dc9a2&ws_ab_test=searchweb0_0,searchweb201602_5,searchweb201603_53 

Be warned that the seller is new without any feedback, and he has only this item for sale ... 

There is a Russian page with more information about it and a firmware in Mediafire:
https://mysku.ru/blog/discounts/78121.html 

It's too risky to buy anything from the specific store, but if it is not a scam, there will be plenty of clones in the near future, with upgrade function.

Now that is an amazing instrument--look at these precisely defined 53.8 MHz square waves:

[ataradov]

Exquisite photoshop work. Too bad they did not remove 200 us/.

[wasp09]

Perfect square wave at 53.8MHz?  We need a bandwidth to support 9th harmonics to show a not so sharp square.  For a perfect square, the front end needs to be able to handle something around 500MHz or more.  Too good to be true for a scope at a price range as 5012H.

My 5012H did pick up 9x MHz distorted sinewave from my analog sig gen manufactured in the 70s,  but it stopped working slightly beyond 100MHz.  It is kind of up to spec via some kind of sampling.   

BTW, is the philips screw on the probe for 10X tuning?  I can't turn it and don't want to break it yet. 

[ataradov]

BTW, is the philips screw on the probe for 10X tuning?  I can't turn it and don't want to break it yet. 

Yes, it is a standard probe compensation thing. It should turn pretty easy. But don't use actual philips screwdriver, they are too pointy for that. Use a flat screwdriver that fits into the widest part of the trimmer cap.

[Bud]

Exquisite photoshop work. Too bad they did not remove 200 us/.

Right..., if the 200 is uS/ then it is just a 1kHz waveform displayed. Funny.

[cliffyk]

Here is a mathematically generated square wave, constructed from the first 101 harmonics:



Still not as good as the image in the scope's ad copy--or a 53.8 MHz looking as good as shown above would require a 5,433,800,000 (5.5 GHz) front-end bandwidth.

Here are the numbers that drove the waveform's construction;



This stuff is 30+ years old, it was part of my Master's work...

[ataradov]

There is really no point in discussing poor photoshop job. You can spend entire life debunking pictures from Ali. 

[cliffyk]

There is really no point in discussing poor photoshop job. You can spend entire life debunking pictures from Ali.

A disappointing number of people don't understand that...

[thinkfat]

There is really no point in discussing poor photoshop job. You can spend entire life debunking pictures from Ali.

A disappointing number of people don't understand that...

Heh, but then they exactly get what they deserve The instant Karma of Aliexpress punishes stupidity without fail.

[Martinn]

I will publish binaries at some point.

A bit out of curiosity I threw the source into an empty CubeIDE project. After a few tweaks (like compiler -O3, setting a few defines in the options dialogs) at least there was no error during compilation and a binary file came out.
I ordered both the scope now from Ali and some GD32F407 from LCSC, now long wait...

[wasp09]

Did you order any tools for swapping out surface mounted chips?   I wonder if anyone had succeeded in desoldering/soldering GD32F407 using a regular solder iron.

[ataradov]

Did you order any tools for swapping out surface mounted chips?   I wonder if anyone had succeeded in desoldering/soldering GD32F407 using a regular solder iron.

You definitively want a hot air rework station.

Absent that I would carefully cut the pins close to the chip first and then remove leftover stubs with a soldering iron. This is a bit annoying and takes a long time, but I've done that before for very large packages that are hard to remove even with hot air. It does work, but requires care.

If you have a hot air station, the trick I started using recently is to pass a thin wire (single strands from a multi-strand wire) under the chip. This creates a very convenient pull handle. It also lets you know the exact moment chip is ready to come off. No unnecessary overheating.  This also avoids the need for a vacuum pickup, which are typically not the greatest.

[Bud]

Place the board on the coffee mug warmer if you do not have a pre-heater, wait 15 minutes then apply hot air, the chip will come off much easier. I measured my coffee warmer runs at 94 C, i use it all the time for jobs like that.

[ataradov]

Sure, having proper equipment makes things easier, but where is the fun in that?

I never had a coffee mug heater. Are they even remotely hot enough to helping with desoldering?  Another issue that I can see is that actually heating up the boars would require very close positioning, which may not work due to other parts on the board.

In case of this oscilloscope the challenge with using a lot of non-directed heat is there is a display attached to the board. It flips away from the board, so it is fine, but it is still too close and flops around when handling.

In any case removing 100-pin package is not that hard. I was talking more about 208-QFP.

[Martinn]

I thought I might add a short tutorial on how to swap a TQFP part. Probably there are several on YT already, one more probably can't hurt...
If people think they need a hot air rework station before they can swap the processor, it will be a very lonely thread here I fear. I guess many not so experienced believe that swapping a QFP is way beyond their skill level (hint: it's not).
What do you think?

- Martin

[ataradov]

Do you have a way to remove TQFP parts without hot air? Can you at least describe it?

The issue is that no matter what method you are using, chances of screwing up are pretty high if you are doing it the first time.

[Martinn]

I guess the most foolproof beginner suitable method would be the Chip-Quik alloy. Dave has a video on it.

But I'd also recommend hot air. More universal and cheaper than a hot air rework station would be a hot air gun with (at least some basic) air flow and temperature control. That's what I'd recommend and also what I'll do for my unit (although I have access to all kinds of higher end equipment). In brief:
From the backside, preheat PCB to 130-150 °C (check with IR thermometer) with the hot air gun (I'll use a heat plate, but not everyone has one and it works with the hot air gun well enough). Turn over. Mask GD32 area: Cut a square hole into office paper and tape it to the PCB with polyimide ("Kapton") tape so everything around the GD32 is covered (actually do this before preheating). With lowest air flow and moderate temperature (maybe 300 °C) on the hot air gun, heat up the GD32 and remove it when the solder melts. Nice idea with the thin wire BTW!
This requires just a decent hot air gun (which is a useful tool anyway) and the PI tape (cheap on ebay/Ali). As you say I'd also strongly recommend practising this on scrap PCBs before messing up the scope. Maybe it's also worth mentioning the wave solder tips (like Weller GW style) - these are incredible for QFP soldering and to my knowledge not widely known.

- Martin

[ataradov]

There is really no need for any of this. Any cheap hot air station like this https://www.ebay.com/itm/110V-858D-700W-Electric-Hot-Air-Heat-G-un-Soldering-Station-Desoldering-Tool-LED/193176118091 would do the trick. No need to mask anything.

I do cover the LCD screen out of abundance of caution, but it is probably not necessary.

[perdrix]

So with your re-written firmware, what does this wee beastie actually achieve in terms of real bandwidth, etc. etc.

IOW is it worth me buying one installing your firmware?

David

[ataradov]

So with your re-written firmware, what does this wee beastie actually achieve in terms of real bandwidth, etc. etc.

125 MSPS sampling rate. The real bandwidth is unknown, but it is high enough for the sampling rate.

IOW is it worth me buying one installing your firmware?

Only if you want a "hackable" device you can modify for your needs and generally mess around. If you just plan to use the firmware as is, it is probably too early. There are some features missing that I would like to implement, but I need to take a break for some other projects. I'll get back to it eventually.

Overall, the analog performance is mediocre, especially when it comes to compensation. My personal preference would be to redesign the whole PCB, and I have no issues with the digital part, but the analog part would require some experimentation, and I don't have time for that right now.

[GeorgeOfTheJungle]

I'm almost ready to flash, my GD32F407s from lcsc arrived today! @ataradov, is the compiled binary in github?

[ataradov]

I'm attaching latest binaries here for now.

But really, it is better to set up and build them for yourself.

[GeorgeOfTheJungle]

I'm attaching latest binaries here for now.

Thank you very much!

But really, it is better to set up and build them for yourself.

Sure, but I don't know how to do that yet. I've tried with platfomio and I get a .bin that's not like yours:

Code: [Select]

          mine       yours
.elf    148264      148052
.hex     62701       97838
.bin     22264       34756

Edit:
Alex, any idea how to compile it with this?
https://docs.platformio.org/en/latest/boards/ststm32/black_f407vg.html

[ataradov]

Well, compiler versions are likely different. ELF files include debug information, so they are going to be different no matter what unless you put your files at exactly the same place as I do. Plus my stuff was build on Linux.

They may use different settings for hex files too. The only thing you can really compare is output of the arm-none-eabi-size command or the size of the raw binary files.