Reverse engineering FNIRSI-5012H

[thinkfat]

 They're in a different class .........It's 100x better but also 100x 5x more expensive...

Good, following this 5x logic, its vertical sensitivity should be 2.5mV/div and not degrading 50mV/div.

As I wrote, even 3x cheaper micro toy DSO112A (different class) has better vertical sensitivity of 2mV/div.

Trying to observe small signal it is a big difference.

5mV/div according to the spec, and those are real 5mV/div? Or just digitally scaled up?

[rigol52]

5mV/div according to the spec, and those are real 5mV/div? Or just digitally scaled up?

You mean DSO112A?

5mV/div was previous model, which was year or two ago improved to 2mV/div.


"DSO112A Upgrade Version 2MHz Touch Screen TFT Digital Mini Handheld Oscilloscope With Battery

DSO112A is an upgraded model of DSO112 with re-designed schematic and PCB. Due to the new design
 this oscilloscope becomes more accurate and reliable.
As high as 2mV/div sensitivity and ultra low background noise made the device particularly useful for
measuring weak signals. Up to 24 presets with customizable titles allow setups be retrieved in seconds."

[ataradov]

Yes, and the next year model would be 1 mV/div. This is not realistic in any way, so what's the point of discussing it? I can multiply numbers til the cows come home, but there is no chance any of those things have front-end good enough for this sensitivity. 

[rigol52]

Yes, and the next year model would be 1 mV/div.
This is not realistic in any way, so what's the point of discussing it?

Maybe 1mV next year, I don't know. Not really interested. Nevertheless.

If you live in world of logic analyzer, then probably vertical sensitivity is not theme of discussing.

But if you live in world of oscilloscope and small signals, then vertical sensitivity is very important parameter.

50mV/div is simply not acceptable (despite other technical data of FNIRSI-5012H are adorable)

If your cows are all home, then look at this 40 euro mini scope toy, it is really funny:

(Rigol DG1011 is not able to go lower than 4mV pp, and firmware of my old DSO112A still start at 5mV)

[thinkfat]

Yes, and the next year model would be 1 mV/div. This is not realistic in any way, so what's the point of discussing it? I can multiply numbers til the cows come home, but there is no chance any of those things have front-end good enough for this sensitivity.

The bandwidth of these pocket scopes is not very high. It's much easier to achieve high sensitivity in a 2MHz front end than in a 200MHz front end.

[gf]

Yes, nice toy I have one, too. IIRC, they simply use a TL04x or similar for the frontend amp. Obviously sufficient for the offered 2mV/div, but don't forget, the bandwith is pretty limited, too. At high bandwidths, the same is no longer that easy to achieve, and not at all at the same low cost.

[thinkfat]

 They're in a different class .........It's 100x better but also 100x 5x more expensive...

Good, following this 5x logic, its vertical sensitivity should be 2.5mV/div and not degrading 50mV/div.

As I wrote, even 3x cheaper micro toy DSO112A (different class) has better vertical sensitivity of 2mV/div.

Trying to observe small signal it is a big difference.

That is nonsense. The DSO112A has 2mV/div but only due to its tiny bandwidth. Increase the bandwidth to 150MHz and see if you can achieve 2mV/div easily.

[gf]

That is nonsense. The DSO112A has 2mV/div but only due to its tiny bandwidth. Increase the bandwidth to 150MHz and see if you can achieve 2mV/div easily.

Well, 2mV/div may be achievable - if you don't mind that the signal drowns in the noise floor

The point ist just, everybody wants a scope with the highest bandwidth and sampling rate one can get for the money - and then they complain about limited sensitivity and too much noise. However, for some use cases one does not need the bandwidth at all, but rather a better sensitivity. In the low-cost sector usually one cannot get both. Even the 20MHz BW limit is usually not sufficient to drop the noise to a level which were suitable for a higher sensitivity than say 5mV/div, but the scope would rather need a dedicated low-bandwith pre-amp for the high-sensitivity ranges (which is not an option for a low(est)-cost device due to extra cost).

[thinkfat]

Well, that's the real reason why a 500MHz scope has a 20MHz bandwidth limiter: If you want to measure e.g. power supply ripple in the 10mV range, 500MHz bandwidth is not really an advantage, rather the opposite. SMPSUs usually don't switch in the high MHz, more with a couple hundred kHz. That limits the dirt they output above 20MHz.

[gf]

Well, 2mV/div may be achievable - if you don't mind that the signal drowns in the noise floor

I have certainly exaggerated a bit If the signal is eligible for averaging, then 2mV/div is well feasible, too, on a say 100MHz scope at full bandwidht, even if it is as noisy as my Hantek 6xx4 (-> about 300uV RMS, or ~1.5mV_pp, @2mV/div). When averaging e.g. 64 frames, the noise drops to ~0.2 div_pp, and then 2mV/div starts becoming usable, too.

Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?

[ataradov]

Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?

It basically has 256 Ksamples of DMA-accesible memory and may be 32Ksamples for a storage buffer that is only CPU-accessible.

Doing any averaging you would be sacrificing number of samples a lot. You will also run into performance issues.

The default firmware actually tries to do some averaging at high ADC clocks, but they do it to hide that their actual sampling rate is bad.

Those things are not high performance devices. I'm not sure why people want them to be.

[gf]

Btw, does the FNIRSI-5012H actually have enough resources (particularly memory) to allow averaging?

It basically has 256 Ksamples of DMA-accesible memory and may be 32Ksamples for a storage buffer that is only CPU-accessible.
Doing any averaging you would be sacrificing number of samples a lot. You will also run into performance issues.
The default firmware actually tries to do some averaging at high ADC clocks, but they do it to hide that their actual sampling rate is bad.
Those things are not high performance devices. I'm not sure why people want them to be.

If there is not enough memory to keep N buffers for N-fold averaging, then a less memory-hungry alternative might be a single accumulator buffer and exponential moving average (e.g. A_new = A_old - A_old/16 + newSample/16).

Assumedly the display width is not more than 500..1000 pixels, so I guess any samples beyond that are just recorded for zooming/panning anyway?

Btw, if I remember correctly, you also own a Hantek 2000. Do you see any areas where the FNIRSI-5012H outperforms the Hantek 2000, or do you think that the Hantek 2000 is generally still one level above the FNIRSI? [ Like the FNIRSI, I guess that the Hantek could likely also benefit from an improved firmware. ]

[ataradov]

If there is not enough memory to keep N buffers for N-fold averaging, then a less memory-hungry alternative might be a single accumulator buffer and exponential moving average (e.g. A_new = A_old - A_old/16 + newSample/16).

Yes, sure you can get creative, but I'm not sure there are any real benefits to it.

Assumedly the display width is not more than 500..1000 pixels, so I guess any samples beyond that are just recorded for zooming/panning anyway?

LCD panel is 320x200, the horizontal size of the visible area is 300 px.

My firmware for a set horizontal time scale calculates the highest sampling rate that at least will fill the screen. And yes, it stores more samples than displayed for zooming.

Btw, if I remember correctly, you also own a Hantek 2000. Do you see any areas where the FNIRSI-5012H outperforms the Hantek 2000, or do you think that the Hantek 2000 is generally still one level above the FNIRSI? [ Like the FNIRSI, I guess that the Hantek could likely also benefit from an improved firmware. ]

I don't use Hantek that much. I find it clunky and hard to use, so I just don't bother.

I use FNIRSI quite a bit, but I found even FNIRSI too much for what I need. In most cases I need a simple scope like this is to check that my UART baudrate is set correctly or a pin toggles at the expected rate. Simple stuff like this. For this I'm not really interested in vertical accuracy. I want to see a general waveform shape though. Basically similar to analog capabilities of the higher end Saleae logic analyzers. For anything more complicated, it is just easier to bring out the real scope.

[dmendesf]

Has anyone got theys hands in this one:

https://www.banggood.com/DSO1C15-Digital-Oscilloscope-500MSs-Sampling-Rate-110MHz-Analog-Bandwidth-Support-Waveform-Storage-With-2_4-Inch-Screen-p-1634767.html?currency=USD&utm_source=rtbhouse&utm_medium=cpc_brand&utm_content=all&utm_campaign=rtb-tools-all-en&cur_warehouse=CN

Claims true 500MSPS (but just one channel) and firmware upgradeable. I'd like to see it torn apart to discover what chinesium powers it 

[ataradov]

There are pictures of it apart. It used CPLD and separate memory to store samples, so it is less demanding of the MCU. But the analog fron-end still looks pretty bad. And ADC is overclocked again, so who knows the real quality of the samples.

[Ivanko1]

Is 5012H still better then FNIRSI-1C15? And does they better then Fnirsi PRO (5MHz) - compare to 2x price?

[ataradov]

It is hard to "define" better in this case. I have not used 1C15, but I can imagine that joystick thing being pain in the rear. Button controls are good enough.

I don't think anyone has looked closely at the performance of the 1C15. But based on the pictures of the boards, it is probably about the same.

PRO is a toy, essentially, so yes, either one would be better than PRO. But that also depends on your needs.

[Renate]

I don't use Hantek that much. I find it clunky and hard to use, so I just don't bother.

Round knobs on a screen GUI are just horrible. (They don't even respond to a scroll wheel.)

[raihei]

Hi everyone,

thank you for your amazing work, ataradov and all who helped with it!
I'm looking forward to buy a 5012H and install your firmware on it.
I have a (maybe dumb) question: Can I replace the MCU with a STM32F407VGT6 instead of one from GigaDevice?
From a quick glance in the datasheets they look compatible to me (just checked the pinout and the main specs)
The STM version seems much easier to get and also seems cheaper.

[ataradov]

No, you can't. We take advantage of memory architecture of the GD devices. You will alt least have to move the code into SRAM. Also, we overclock things, and it is not clear how ST part will deal will that.

We also rely on a very specific timing of the DMA controller, and it it not clear if it is the exact same behaviour as the ST part. On normal applications you may not notice a one or two cycles of difference, but here it is likely to matter.

[tzenis]

Hello,
at beginning, I want say thank Alex for developing and sharing this project.
I try to replace and flash CPU in my scope.
- Replacement is done without troubles, Soldering looks OK.
- Flashing ends with an error in the first 32 kB. I tried to flash image at once and in 32 ad 16 kB blocks. The error is "Target voltage (12 mV) too low for 32-bit flash, using 8-bit flash writes
size: 16384
2020-07-18T09:30:56 ERROR flash_loader.c: flash loader run error
2020-07-18T09:30:56 ERROR common.c: stlink_flash_loader_run(0x8004000) failed! == -1
stlink_fwrite_flash() == -1"
I can read the image from the scope to a PC and the image is good (no differences). I use a stlink programmer from a nucleo board with burned CPU. I am not sure if the programmer is good.
- The scope doesn't run. Sporadically  blinks with display or the mechanical relay create noise. The activity is sometime in 5-10 seconds, sometime  a minute without any activity. I showed an image on the scope display only 2 times for very short period.
- I looked a signal on the 20 MHz crystal oscillator and there are only spikes at 610 Hz. Is the CPU resetting after changing clock source? The spikes disappear after pressing the F2 key.

Any idea what to do?
The CPU is corrupted, and must be changed again (I have 2 more).
The flashing is incorrect, but I can read full image from the CPU.
My CPU can't run at 250 MHz.

Many thanks with help!
Cheers,
  Tibor

[ataradov]

Can you show the picture of your board? Make sure is the right version of the board (with one relay).

Hos do you connect the programmer?

Also, I'm not clear on your description. You say there is an error while programming and then say that you can read the firmware back. Is this error intermittent.

[tzenis]

Hello Alex,
my board contains only one relay.
I connected the programmer with a short usb cable. The cable looks ugly. The cable was 2 m long (before cutting) and was able to transfer files from phones. I think, the cable is good.
When I flash the full image, only the first 32 KiB were programmed. The flash from the address 0x8000 was empty, contained 0xff. I split the image into blocks of 32 (16) kiB (split -b 32768 open-5012h.bin open-5012h.bin.) and flashed each part standalone (st-flash write open-5012h.bin.ab  0x8008000). The flashing of the first part(s) ends with an error, the short final part can flash successfully. I can read full image from the CPU. I tried to flash the image downloaded from this forum also compiled by me.

[ataradov]

I think your STLink  tries to measure the target voltage and does something goofy when it does not find it. See if there VTREF signal on that connector and supply 3.3 V to it (from the target device or from the debugger itself, should not make a difference).

I would definitely work on getting a clean programming first.

If you van build the code, then you may want to try a simple application that just blinks the backlight, for example.

[tzenis]

I fixed the stlink vdd-target. There was missing R9. Now it uses 32bit flash writes but failed again:
# st-flash write /tmp/open-5012h.bin  0x8000000
st-flash 1.6.1
2020-07-20T10:34:48 INFO common.c: F4xx: 192 KiB SRAM, 512 KiB flash in at least 16 KiB pages.
file /tmp/open-5012h.bin md5 checksum: f996eee3dccbc7f318a3bde681d79faa, stlink checksum: 0x00343fb5
2020-07-20T10:34:48 INFO common.c: Attempting to write 34756 (0x87c4) bytes to stm32 address: 134217728 (0x8000000)
EraseFlash - Sector:0x0 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08000000 erased
EraseFlash - Sector:0x1 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08004000 erased
EraseFlash - Sector:0x2 Size:0x4000 2020-07-20T10:34:48 INFO common.c: Flash page at addr: 0x08008000 erased
2020-07-20T10:34:48 INFO common.c: Finished erasing 3 pages of 16384 (0x4000) bytes
2020-07-20T10:34:48 INFO common.c: Starting Flash write for F2/F4/L4
2020-07-20T10:34:48 INFO flash_loader.c: Successfully loaded flash loader in sram
enabling 32-bit flash writes
size: 32768
2020-07-20T10:34:49 ERROR flash_loader.c: flash loader run error
2020-07-20T10:34:49 ERROR common.c: stlink_flash_loader_run(0x8000000) failed! == -1
stlink_fwrite_flash() == -1

I think my gd32f407 is corrupted. I disabled switching to high speed clock (in sys_init()). The display remains on. The scope hangs at different points. The relay switches never, once or two times after power on. The best situation I caught is 3/4 of scale on the display.