Author Topic: Reverse engineering FNIRSI-5012H  (Read 65070 times)

0 Members and 2 Guests are viewing this topic.

Offline thinkfat

  • Supporter
  • ****
  • Posts: 1485
  • Country: de
    • Matthias' Hackerstübchen
Re: Reverse engineering FNIRSI-5012H
« Reply #250 on: June 18, 2020, 12:14:40 pm »

 They're in a different class .........It's 100x better but also 100x 5x more expensive...


Good, following this 5x logic, its vertical sensitivity should be 2.5mV/div and not degrading 50mV/div.

As I wrote, even 3x cheaper micro toy DSO112A (different class) has better vertical sensitivity of 2mV/div.

Trying to observe small signal it is a big difference.

5mV/div according to the spec, and those are real 5mV/div? Or just digitally scaled up?
Everybody likes gadgets. Until they try to make them.
 

Offline rigol52

  • Contributor
  • Posts: 37
  • Country: si
Re: Reverse engineering FNIRSI-5012H
« Reply #251 on: June 19, 2020, 07:36:17 am »

5mV/div according to the spec, and those are real 5mV/div? Or just digitally scaled up?


You mean DSO112A?

5mV/div was previous model, which was year or two ago improved to 2mV/div.


"DSO112A Upgrade Version 2MHz Touch Screen TFT Digital Mini Handheld Oscilloscope With Battery

DSO112A is an upgraded model of DSO112 with re-designed schematic and PCB. Due to the new design
 this oscilloscope becomes more accurate and reliable.
As high as 2mV/div sensitivity and ultra low background noise made the device particularly useful for
measuring weak signals. Up to 24 presets with customizable titles allow setups be retrieved in seconds."


 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #252 on: June 19, 2020, 07:39:06 am »
Yes, and the next year model would be 1 mV/div. This is not realistic in any way, so what's the point of discussing it? I can multiply numbers til the cows come home, but there is no chance any of those things have front-end good enough for this sensitivity. 
Alex
 

Offline rigol52

  • Contributor
  • Posts: 37
  • Country: si
Re: Reverse engineering FNIRSI-5012H
« Reply #253 on: June 19, 2020, 12:07:39 pm »

Yes, and the next year model would be 1 mV/div.
This is not realistic in any way, so what's the point of discussing it?


Maybe 1mV next year, I don't know. Not really interested. Nevertheless.

If you live in world of logic analyzer, then probably vertical sensitivity is not theme of discussing.

But if you live in world of oscilloscope and small signals, then vertical sensitivity is very important parameter.

50mV/div is simply not acceptable (despite other technical data of FNIRSI-5012H are adorable)

If your cows are all home, then look at this 40 euro mini scope toy, it is really funny:

(Rigol DG1011 is not able to go lower than 4mV pp, and firmware of my old DSO112A still start at 5mV)


« Last Edit: June 19, 2020, 12:10:52 pm by rigol52 »
 
The following users thanked this post: GeorgeOfTheJungle

Offline thinkfat

  • Supporter
  • ****
  • Posts: 1485
  • Country: de
    • Matthias' Hackerstübchen
Re: Reverse engineering FNIRSI-5012H
« Reply #254 on: June 19, 2020, 03:47:45 pm »
Yes, and the next year model would be 1 mV/div. This is not realistic in any way, so what's the point of discussing it? I can multiply numbers til the cows come home, but there is no chance any of those things have front-end good enough for this sensitivity.

The bandwidth of these pocket scopes is not very high. It's much easier to achieve high sensitivity in a 2MHz front end than in a 200MHz front end.
Everybody likes gadgets. Until they try to make them.
 

Offline gf

  • Frequent Contributor
  • **
  • Posts: 410
  • Country: de
Re: Reverse engineering FNIRSI-5012H
« Reply #255 on: June 19, 2020, 03:50:58 pm »
Yes, nice toy ;) I have one, too. IIRC, they simply use a TL04x or similar for the frontend amp. Obviously sufficient for the offered 2mV/div, but don't forget, the bandwith is pretty limited, too. At high bandwidths, the same is no longer that easy to achieve, and not at all at the same low cost.
 

Offline thinkfat

  • Supporter
  • ****
  • Posts: 1485
  • Country: de
    • Matthias' Hackerstübchen
Re: Reverse engineering FNIRSI-5012H
« Reply #256 on: June 19, 2020, 03:57:14 pm »

 They're in a different class .........It's 100x better but also 100x 5x more expensive...


Good, following this 5x logic, its vertical sensitivity should be 2.5mV/div and not degrading 50mV/div.

As I wrote, even 3x cheaper micro toy DSO112A (different class) has better vertical sensitivity of 2mV/div.

Trying to observe small signal it is a big difference.

That is nonsense. The DSO112A has 2mV/div but only due to its tiny bandwidth. Increase the bandwidth to 150MHz and see if you can achieve 2mV/div easily.
Everybody likes gadgets. Until they try to make them.
 

Offline gf

  • Frequent Contributor
  • **
  • Posts: 410
  • Country: de
Re: Reverse engineering FNIRSI-5012H
« Reply #257 on: June 19, 2020, 04:50:27 pm »
That is nonsense. The DSO112A has 2mV/div but only due to its tiny bandwidth. Increase the bandwidth to 150MHz and see if you can achieve 2mV/div easily.

Well, 2mV/div may be achievable - if you don't mind that the signal drowns in the noise floor :-DD

The point ist just, everybody wants a scope with the highest bandwidth and sampling rate one can get for the money - and then they complain about limited sensitivity and too much noise. However, for some use cases one does not need the bandwidth at all, but rather a better sensitivity. In the low-cost sector usually one cannot get both. Even the 20MHz BW limit is usually not sufficient to drop the noise to a level which were suitable for a higher sensitivity than say 5mV/div, but the scope would rather need a dedicated low-bandwith pre-amp for the high-sensitivity ranges (which is not an option for a low(est)-cost device due to extra cost).
« Last Edit: June 19, 2020, 06:43:10 pm by gf »
 

Offline thinkfat

  • Supporter
  • ****
  • Posts: 1485
  • Country: de
    • Matthias' Hackerstübchen
Re: Reverse engineering FNIRSI-5012H
« Reply #258 on: June 19, 2020, 08:41:37 pm »
Well, that's the real reason why a 500MHz scope has a 20MHz bandwidth limiter: If you want to measure e.g. power supply ripple in the 10mV range, 500MHz bandwidth is not really an advantage, rather the opposite. SMPSUs usually don't switch in the high MHz, more with a couple hundred kHz. That limits the dirt they output above 20MHz.
Everybody likes gadgets. Until they try to make them.
 

Offline gf

  • Frequent Contributor
  • **
  • Posts: 410
  • Country: de
Re: Reverse engineering FNIRSI-5012H
« Reply #259 on: June 19, 2020, 09:30:21 pm »
Well, 2mV/div may be achievable - if you don't mind that the signal drowns in the noise floor :-DD

I have certainly exaggerated a bit ;) If the signal is eligible for averaging, then 2mV/div is well feasible, too, on a say 100MHz scope at full bandwidht, even if it is as noisy as my Hantek 6xx4 (-> about 300uV RMS, or ~1.5mVpp, @2mV/div). When averaging e.g. 64 frames, the noise drops to ~0.2 divpp, and then 2mV/div starts becoming usable, too.

Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?
« Last Edit: June 19, 2020, 09:44:26 pm by gf »
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #260 on: June 19, 2020, 09:48:11 pm »
Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?
It basically has 256 Ksamples of DMA-accesible memory and may be 32Ksamples for a storage buffer that is only CPU-accessible.

Doing any averaging you would be sacrificing number of samples a lot. You will also run into performance issues.

The default firmware actually tries to do some averaging at high ADC clocks, but they do it to hide that their actual sampling rate is bad.

Those things are not high performance devices. I'm not sure why people want them to be.
Alex
 

Offline gf

  • Frequent Contributor
  • **
  • Posts: 410
  • Country: de
Re: Reverse engineering FNIRSI-5012H
« Reply #261 on: June 19, 2020, 10:36:21 pm »
Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?
It basically has 256 Ksamples of DMA-accesible memory and may be 32Ksamples for a storage buffer that is only CPU-accessible.
Doing any averaging you would be sacrificing number of samples a lot. You will also run into performance issues.
The default firmware actually tries to do some averaging at high ADC clocks, but they do it to hide that their actual sampling rate is bad.
Those things are not high performance devices. I'm not sure why people want them to be.

If there is not enough memory to keep N buffers for N-fold averaging, then a less memory-hungry alternative might be a single accumulator buffer and exponential moving average (e.g. Anew = Aold - Aold/16 + newSample/16).

Assumedly the display width is not more than 500..1000 pixels, so I guess any samples beyond that are just recorded for zooming/panning anyway?

Btw, if I remember correctly, you also own a Hantek 2000. Do you see any areas where the FNIRSI-5012H outperforms the Hantek 2000, or do you think that the Hantek 2000 is generally still one level above the FNIRSI? [ Like the FNIRSI, I guess that the Hantek could likely also benefit from an improved firmware. ]
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #262 on: June 19, 2020, 10:55:56 pm »
If there is not enough memory to keep N buffers for N-fold averaging, then a less memory-hungry alternative might be a single accumulator buffer and exponential moving average (e.g. Anew = Aold - Aold/16 + newSample/16).
Yes, sure you can get creative, but I'm not sure there are any real benefits to it.

Assumedly the display width is not more than 500..1000 pixels, so I guess any samples beyond that are just recorded for zooming/panning anyway?
LCD panel is 320x200, the horizontal size of the visible area is 300 px.

My firmware for a set horizontal time scale calculates the highest sampling rate that at least will fill the screen. And yes, it stores more samples than displayed for zooming.

Btw, if I remember correctly, you also own a Hantek 2000. Do you see any areas where the FNIRSI-5012H outperforms the Hantek 2000, or do you think that the Hantek 2000 is generally still one level above the FNIRSI? [ Like the FNIRSI, I guess that the Hantek could likely also benefit from an improved firmware. ]
I don't use Hantek that much. I find it clunky and hard to use, so I just don't bother.

I use FNIRSI quite a bit, but I found even FNIRSI too much for what I need. In most cases I need a simple scope like this is to check that my UART baudrate is set correctly or a pin toggles at the expected rate. Simple stuff like this. For this I'm not really interested in vertical accuracy. I want to see a general waveform shape though. Basically similar to analog capabilities of the higher end Saleae logic analyzers. For anything more complicated, it is just easier to bring out the real scope.

Alex
 

Offline dmendesf

  • Regular Contributor
  • *
  • Posts: 186
  • Country: br
Re: Reverse engineering FNIRSI-5012H
« Reply #263 on: June 26, 2020, 02:58:06 am »
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #264 on: June 26, 2020, 03:00:05 am »
There are pictures of it apart. It used CPLD and separate memory to store samples, so it is less demanding of the MCU. But the analog fron-end still looks pretty bad. And ADC is overclocked again, so who knows the real quality of the samples.
Alex
 

Offline Ivanko1

  • Contributor
  • Posts: 43
Re: Reverse engineering FNIRSI-5012H
« Reply #265 on: July 08, 2020, 10:12:35 pm »
Is 5012H still better then FNIRSI-1C15? And does they better then Fnirsi PRO (5MHz) - compare to 2x price?
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #266 on: July 08, 2020, 10:16:56 pm »
It is hard to "define" better in this case. I have not used 1C15, but I can imagine that joystick thing being pain in the rear. Button controls are good enough.

I don't think anyone has looked closely at the performance of the 1C15. But based on the pictures of the boards, it is probably about the same.

PRO is a toy, essentially, so yes, either one would be better than PRO. But that also depends on your needs.
Alex
 

Offline Renate

  • Super Contributor
  • ***
  • Posts: 1080
  • Country: us
Re: Reverse engineering FNIRSI-5012H
« Reply #267 on: July 08, 2020, 11:28:45 pm »
I don't use Hantek that much. I find it clunky and hard to use, so I just don't bother.
Round knobs on a screen GUI are just horrible. (They don't even respond to a scroll wheel.)
 

Offline raihei

  • Newbie
  • Posts: 3
  • Country: de
Re: Reverse engineering FNIRSI-5012H
« Reply #268 on: July 12, 2020, 06:58:45 pm »
Hi everyone,

thank you for your amazing work, ataradov and all who helped with it!
I'm looking forward to buy a 5012H and install your firmware on it.
I have a (maybe dumb) question: Can I replace the MCU with a STM32F407VGT6 instead of one from GigaDevice?
From a quick glance in the datasheets they look compatible to me (just checked the pinout and the main specs)
The STM version seems much easier to get and also seems cheaper.
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #269 on: July 12, 2020, 07:02:52 pm »
No, you can't. We take advantage of memory architecture of the GD devices. You will alt least have to move the code into SRAM. Also, we overclock things, and it is not clear how ST part will deal will that.

We also rely on a very specific timing of the DMA controller, and it it not clear if it is the exact same behaviour as the ST part. On normal applications you may not notice a one or two cycles of difference, but here it is likely to matter.
Alex
 
The following users thanked this post: raihei

Offline tzenis

  • Contributor
  • Posts: 23
  • Country: sk
Re: Reverse engineering FNIRSI-5012H
« Reply #270 on: July 19, 2020, 01:22:20 pm »
Hello,
at beginning, I want say thank Alex for developing and sharing this project.
I try to replace and flash CPU in my scope.
- Replacement is done without troubles, Soldering looks OK.
- Flashing ends with an error in the first 32 kB. I tried to flash image at once and in 32 ad 16 kB blocks. The error is "Target voltage (12 mV) too low for 32-bit flash, using 8-bit flash writes
size: 16384
2020-07-18T09:30:56 ERROR flash_loader.c: flash loader run error
2020-07-18T09:30:56 ERROR common.c: stlink_flash_loader_run(0x8004000) failed! == -1
stlink_fwrite_flash() == -1"
I can read the image from the scope to a PC and the image is good (no differences). I use a stlink programmer from a nucleo board with burned CPU. I am not sure if the programmer is good.
- The scope doesn't run. Sporadically  blinks with display or the mechanical relay create noise. The activity is sometime in 5-10 seconds, sometime  a minute without any activity. I showed an image on the scope display only 2 times for very short period.
- I looked a signal on the 20 MHz crystal oscillator and there are only spikes at 610 Hz. Is the CPU resetting after changing clock source? The spikes disappear after pressing the F2 key.

Any idea what to do?
The CPU is corrupted, and must be changed again (I have 2 more).
The flashing is incorrect, but I can read full image from the CPU.
My CPU can't run at 250 MHz.

Many thanks with help!
Cheers,
  Tibor
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #271 on: July 19, 2020, 05:55:01 pm »
Can you show the picture of your board? Make sure is the right version of the board (with one relay).

Hos do you connect the programmer?

Also, I'm not clear on your description. You say there is an error while programming and then say that you can read the firmware back. Is this error intermittent.
Alex
 

Offline tzenis

  • Contributor
  • Posts: 23
  • Country: sk
Re: Reverse engineering FNIRSI-5012H
« Reply #272 on: July 19, 2020, 07:58:24 pm »
Hello Alex,
my board contains only one relay.
I connected the programmer with a short usb cable. The cable looks ugly. The cable was 2 m long (before cutting) and was able to transfer files from phones. I think, the cable is good.
When I flash the full image, only the first 32 KiB were programmed. The flash from the address 0x8000 was empty, contained 0xff. I split the image into blocks of 32 (16) kiB (split -b 32768 open-5012h.bin open-5012h.bin.) and flashed each part standalone (st-flash write open-5012h.bin.ab  0x8008000). The flashing of the first part(s) ends with an error, the short final part can flash successfully. I can read full image from the CPU. I tried to flash the image downloaded from this forum also compiled by me.
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 7703
  • Country: us
    • Personal site
Re: Reverse engineering FNIRSI-5012H
« Reply #273 on: July 19, 2020, 08:08:59 pm »
I think your STLink  tries to measure the target voltage and does something goofy when it does not find it. See if there VTREF signal on that connector and supply 3.3 V to it (from the target device or from the debugger itself, should not make a difference).

I would definitely work on getting a clean programming first.

If you van build the code, then you may want to try a simple application that just blinks the backlight, for example.
Alex
 

Offline tzenis

  • Contributor
  • Posts: 23
  • Country: sk
Re: Reverse engineering FNIRSI-5012H
« Reply #274 on: July 20, 2020, 11:34:36 am »
I fixed the stlink vdd-target. There was missing R9. Now it uses 32bit flash writes but failed again:
# st-flash write /tmp/open-5012h.bin  0x8000000
st-flash 1.6.1
2020-07-20T10:34:48 INFO common.c: F4xx: 192 KiB SRAM, 512 KiB flash in at least 16 KiB pages.
file /tmp/open-5012h.bin md5 checksum: f996eee3dccbc7f318a3bde681d79faa, stlink checksum: 0x00343fb5
2020-07-20T10:34:48 INFO common.c: Attempting to write 34756 (0x87c4) bytes to stm32 address: 134217728 (0x8000000)
EraseFlash - Sector:0x0 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08000000 erased
EraseFlash - Sector:0x1 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08004000 erased
EraseFlash - Sector:0x2 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08008000 erased
2020-07-20T10:34:48 INFO common.c: Finished erasing 3 pages of 16384 (0x4000) bytes
2020-07-20T10:34:48 INFO common.c: Starting Flash write for F2/F4/L4
2020-07-20T10:34:48 INFO flash_loader.c: Successfully loaded flash loader in sram
enabling 32-bit flash writes
size: 32768
2020-07-20T10:34:49 ERROR flash_loader.c: flash loader run error
2020-07-20T10:34:49 ERROR common.c: stlink_flash_loader_run(0x8000000) failed! == -1
stlink_fwrite_flash() == -1

I think my gd32f407 is corrupted. I disabled switching to high speed clock (in sys_init()). The display remains on. The scope hangs at different points. The relay switches never, once or two times after power on. The best situation I caught is 3/4 of scale on the display.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf