FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator

[don.r]

Coffee Morning Sunshine and a pleasant 22 degrees in the shack 

My lab in the garage is 2 degrees this evening. 

I remember being in Chicago in early November once when the NW wind came in out of Canada wasn't pleasant at all.

Building Voltage references in shorts and a Tshirt at present

I shouldn't complain really. I just spent two weeks in Hawaii. Maybe that's why 2 degrees feels like -20 right now. 

[cybermaus]

So, I read out the 25 spi flash Winbond 25Q16BVSIG flash chip.
Content attached. Did cursory review, some patterns, some empty space, some high density data.

What I would like is if someone with a 2.9 or 3.2 or even also 3.2.1 model to also do this, so we can check if indeed there are only settings in the FLASH.
Presumably waveforms are all the same between 2.9 and 3.1, so if there are only very little changes, it would point to calibration.
Similar for 30MHz models.

However, (should not need to mention it on this forum, but do so anyway) this is at your own risk. I am not responsible for you messing up your device.


Please note that I think the flash is not all the firmware. The display board ARM SoC also has internal flash. It is quite possible these 2 are not always compatible when different versions.
But waveforms is definitely be in the flash, likely also the Cyclone, but probably not the UI programming or the user settings.
Posted some more on Winbond flash memory map here.

Used a cheap CH341A clone SPI programmer . See this video (not mine)
tool download link in video

Warning: not all CH341A clones are 3.3V. Ensure you have one that can be properly set to 3.3V.
Note that depending on the clone, you need to pay attention to chip orientation. Both the program icon and the video instruction did not match correct orientation for my programmer clone (I have the exact one of the link above, but there seem to be 2 or 3 more variants.
So look at the silkscreen, use the 25x position for this Winbond chip.



FY6600 Programming header (Cyclone header):

1	CLK	GND	2
3	DONE	Vcc	4
5	/CFG	/CE	6
7	DO	/CS	8
9	DI	GND	10

Pinout mapping:

JTAG	FPGA	FLASH
1	12	6	CLK
2		4	GND
3	92		Conf_Done	Pulled up with 10K
4		8	Vcc
5	14		nConfig	Warning, low can clear the FPGA? Is pulled high by 10K
6	21		nCE	When high FPGA disable in tri-state
7	13	2	DO / Data0
8		1	/CS	When high FLASH disable in tri-state
9	6	5	DI / ASDO
10		4	GND

To program Cyclone IV:
- Instructions to be interpreted by a Cyclone expert, being someone else then me
- Keep /CS from Winbond HIGH to disable Winbond Flash
- Pins CLK, /CFG,/CE, DO, DI, DONE have Cyclone functions DCLK, nConfig, nCE, Data0, ASDO, Conf_Done
- Use ByteBlaster II or USB Blaster 10-pin header

To program Winbond:
- Ensure 3.3V or lower programming level
- Connect GND, but Vcc is probably not needed (already fed from FY6600)
- Warning, never make /CFG or nConfig from Cyclone low, as this may clear the Cyclone
   maybe best not to even wire the /CFG pin.
- Keep /CE from Cyclone HIGH to disable the Cyclone
- Connect CLK, DO, DI, /CS to SPI programmer (or keep CS low)
- WP and HOLD are already connected high on the FY6600 board

Winbond Cable FY6600-JTAG to DIL-8 emulated chip footprint:
- Loop /CE to Vcc. /CE is normally 10K to ground, so must be lower impedance to Vcc
- Connect GND, CLK, DO, DI, /CS to SPI programmer
 
When you connect the cable the Cyclone IV FPGA will not start up because nCE is looped high to Vcc. Not even if the other end of the cable is not connected. But the FY6600 does does show its logo. I guess the logo is burned into the screen driver rather then driven by the FPGA

Cable for Flash read/write
WARNING: I wrote this down incorrectly and swapped in 4 and 6. Sorry. Correct now.

JTAG	DIL-8
1	6
2	4
3
4		loop to 6
5
6		loop to 4
7	2
8	1
9	5
10

Edit: While analyzing the firmware, I made some interesting new finds:
More detailed info here, but a summery:

The programming header is a standard Cyclone USB Blaster II header, see newly attached image.
Also, I now believe the first x05ffff bytes of the flash are the Cyclone configuration bitstream. The cyclone itself reads this without the intervention of a CPU, as shown in this document.

Flash structure:
0x000000 Cyclone bitstream
0x060000 Most build in waveforms (not in 1:1 mapping) (the ones repeating in Arb).
0x100000 Arb1~64 in blocks of x4000 bytes (first 32 a repeat of 0x060000)

There is likely no user settings or calibration in the flash. I changed settings, and reread, and nothing was changed.
So user settings are likely stored in SoC on the display board, which controls the Cyclone by simply serial commands.

In other words, the SoC has the User UI firmware, that is not stored in the Winbond flash, and we need to retrieve that too.

[Ebel0410]

Hey Cybermaus, you did a great job !
Day after day we're moving forward to the Graal...

Now we need the help of someone who's is talking FGPA and hacking fluently.
I read that for example and it was really awesome (http://blog.weinigel.se/2016/05/01/sds7102-hacking.html)
, that man would be very helpful to move one step higher.
Christer christer@weinigel.se , if you feel inspired, don't hesitate 

[cybermaus]

Well, if you want that kind of help from someone not already part of the FY6600 community, you may need to gift them a device (in the form of a dropship) with no expectations attached.

But more to the point: his Owon has a SoC CPU controlling the FPGA. A CPU typically works from a file system, with a bootloader and mountable partitions.
And in fact the CPU feeds the FPGA the configuration bitstream, so that FPGA config is a readable file in said filesystem. Its what your android does when it upgrades its radio/modem sub-firmware.


In our case, there is no SoC, its only the FPGA. And thus it is not programmed through the CPU, but directly from the header, as evident by the pins on the header.
This is why we cannot upgrade via USB. While you can configure a simple virtual CPU core on an FPGA, you cannot use programming on that core itself to reconfigure itself.
Also as far as I understand them a typical FPGA configuration cannot be read, only written.

So, sorry I do not think there will be hacking of the FPGA, not even by an expert like your Christer
(unless if I completely misunderstands FPGA's, not entirely impossible)


Also, it is unlikely the actual programming for any virtual CPU is in the flash. It is probably also in the FPGA.
Maybe a very small UI program (though I did not even see any strings, there was a high density section in the memory).

The reason I think so are these:
- The system starts up way too fast to download much software out of flash first
- The waveforms themselves (36+64@8192words) take up 1.6MB out of the 2MB. So not much left
- The actual signal processing at 2x250MSa/s does not allow for CPU based logic. Its all configured transistors.


BUT: At least we will be able to repair the broken waveform for that guy who lost his SINE. What that you or someone else?



EDIT: new info found (see other post for more info):

- Cyclone can self-read config, and its bitstream likely is in start of the windbond flash. So can be upgraded by us
- UI is in display SoC, still need to figure out how to read/write that.

[Diabolo]

Hello,

On the front panel there is, unless I am mistaken, 1 STM32F103C8.
What do you think ?

Diabolo

[don.r]

Hello,

On the front panel there is, unless I am mistaken, 1 STM32F103C8.
What do you think ?

Diabolo

... and its jtag is just under the connector to the main board. Should be capable of a dump.

[cybermaus]

Hmm, I did not even look at the display board. A bit short sighted of me.

I will look at that, out of interest, but I suspect the situation remains the same, its just a display driver.

[don.r]

Hmm, I did not even look at the display board. A bit short sighted of me.

I will look at that, out of interest, but I suspect the situation remains the same, its just a display driver.

There are a couple of issues with the display that could be fixed. For one thing, the font. Its gross and not the most legible. Another thing is the frequency display. Strip leading zeros, standardize units, more legible colours, etc. I'm sure there are other changes that people would want. If its only the display driver, maybe FeelTech could see their way to making it Open Source.

[Mr. Scram]

There are a couple of issues with the display that could be fixed. For one thing, the font. Its gross and not the most legible. Another thing is the frequency display. Strip leading zeros, standardize units, more legible colours, etc. I'm sure there are other changes that people would want. If its only the display driver, maybe FeelTech could see their way to making it Open Source.

Yeah, that very typical font has to go. A lot of the cheap Chinese stuff comes with it and it's a shame to have it detract from the device. Mind you, I can imagine it's all the same to someone whose native alphabet is different.

[Ebel0410]

BUT: At least we will be able to repair the broken waveform for that guy who lost his SINE. What that you or someone else?

In reply to Cybermaus : Yes, it's me ! The Sine memory waveform is a flat line on both channels.
And I guess that could help that guy too : https://www.eevblog.com/forum/repair/reflashing-or-resetting-a-feeltech-fy6600-signal-generator/

[cybermaus]

well, get your own CH341A and read the flash, so we can compare and then repair.

[cybermaus]

Not sure if I can get as motivated about fonts as for the other stuff that was already done.

For new buyers and users, a summery of what can be done, with links.
(so no desires and rants but achieved items)

1: The power supply can be made less leaky
Simple solution is to add a grounded socket and either fully ground the device, or add some Y-caps or reconnect the one already there
Deep solution is to fully replace the supply

2: The time base can be made more precise
Simple solution is to replace CXO with a 0.1ppm TCXO, either directly 50Mhz or a a 10MHz one with a PLL multiplier
Deep solution is to add a external GPSDO or OCXO or external 10MHz reference source

3: Good waveform at lower Vpp, but at full 20Vpp and above 5MHz, it can be improved
Replace the end opamp with two separate better ones
May also need a new power supply, with a little more oomph to keep the +-15V up, see 1: above

4: DC Offset and Vpp calibrations can be tuned.
Unfortunately not (yet) by firmware, but simply tweak the pots on the board.


Did I miss anything? (something people can do, not things we would like to do)

[Diabolo]

Hello,

For the power supply with 15V, be careful the internal capacitors are maximum 16V !!

Diabolo

[ArthurDent]

Cybermaus has listed the modifications that have been tried and seem to work so you can pick and choose what ‘options’ you want to add to your FY6600 from the list.

I have chosen to carry the ground (earth) from the 3-wire cord I added through to the power supply output ground and to replace the wimpy original supply with a heftier one. I’m not convinced that anyone can guarantee that all the parts will continue working at +/-15V instead of the +/-12V the board calls for. The board appears to work just fine with the +/-15V but with the part numbers ground off some ICs I don’t think there is any guarantee that some of the mystery parts aren’t seeing a higher voltage than they are designed for so I’m going to stick with a replacement +/-12V supply. The one I had used originally was a 40W supply that was much larger than needed but I had it on hand. I found a good quality 25W +/-12V supply for $13 plus shipping that doesn’t waste as much power (2W less than the 40W supply) so I’m using that supply as shown in the photos. I did find an excellent +/-15V supply that will just physically fit if I decide later to go with the higher voltage and that supply cost me about $13 with shipping and I have a photo showing how that would fit in the FY6600.

The OCXO I added is working great and if I leave the rear switch on so the OCXO is always warmed up the 10Mhz seems to generally stay within +/-.005Hz (9,999,999.995Mhz to 10,000,000.005Mhz) and I have the switch and BNC I added to the back to connect an external 10Mhz standard if I want.

I should get the THS3095D chips to replace the output amplifier chips and I think that is the last (really!) modification I’ll make unless I go with the +/-15V supply at a later date.

+/-12V supply  http://www.mpja.com/ Stock No: 34322 PS
+/-15V supply Ebay # 263326410466

[don.r]

I'll definitely do the time base next as the TCXO and PLL only consume a few more mA than the current 50Mhz crystal so the original PSU is still OK. It would also be an opportunity to add an external port for the 10Mhz like you did. This should be standard on even low end wavegens. I'm going to wait for the 3491's to be released and examined before I go further as I'm not sure about running the rest of the board at 15V. I don't have much of a need for more than a few V's of output anyhow.

[cybermaus]

I’m not convinced that anyone can guarantee that all the parts will continue working at +/-15V instead of the +/-12V the board calls for.

Remind me, why do we believe the board calls for +/-12V?

At first I also I also thought it was a common +5V +12V board because not only is that common, but also someone reported that. But that very same person also mentioned his 12V supply was not very good because it was almost 15V. And mine is also hovering between 14.5V and 15.2V.

So I am wondering, maybe it simply is supposed to be a 15V supply? After all, +-15V is not an uncommon rail for OpAmps. So indeed, remind me, why do we think it is a +/-12V board?

I do agree though, if 15V, make sure you do not creep toward 16V.

[don.r]

I’m not convinced that anyone can guarantee that all the parts will continue working at +/-15V instead of the +/-12V the board calls for.

Remind me, why do we believe the board calls for +/-12V?

At first I also I also thought it was a common +5V +12V board because not only is that common, but also someone reported that. But that very same person also mentioned his 12V supply was not very good because it was almost 15V. And mine is also hovering between 14.5V and 15.2V.

So I am wondering, maybe it simply is supposed to be a 15V supply? After all, +-15V is not an uncommon rail for OpAmps. So indeed, remind me, why do we think it is a +/-12V board?

I do agree though, if 15V, make sure you do not creep toward 16V.

Its stamped +-12V on the board. Mine measures +15.8V and -15.2V unloaded.

[ArthurDent]

Here's a photo of the voltages on the power supply board. The numbers are almost hidden by the connector.

[don.r]

Somewhat unnerving that its labelled as 12v but measuring 15.8V and has 16V rated output caps. They should be 25V rated.

[Diabolo]

Hello,

Nobody tried the THS3092 which contains 2 AOP +/- of THS3091 in the same S0P8 case, or almost "equivalent" to 30021 of origin FY6600 ?
Datasheet THS3092 :
http://www.ti.com/lit/ds/symlink/ths3092.pdf
----
Buy THS3092 :
https://fr.aliexpress.com/item/THS3092-THS3092D-THS3092DDA-THS3092DDAR-3092-SOP/32827398519.html?ws_ab_test=searchweb0_0,searchweb201602_3_10152_10065_10151_10344_10068_10345_10342_10343_10340_10341_10541_10562_10084_10083_10305_10304_10307_10306_10177_10302_10060_10155_10154_10539_10312_10059_10313_10314_10184_10534_10533_100031_10103_10073_10594_10557_10596_10595_10142_10107-10177,searchweb201603_14,ppcSwitch_4&btsid=fa0c137f-85cc-4348-92e5-524764005c20&algo_expid=d4b84c0c-c840-4c1c-99cd-e0f428d02b99-7&algo_pvid=d4b84c0c-c840-4c1c-99cd-e0f428d02b99&rmStoreLevelAB=0


Diabolo

[cybermaus]

+/-12V supply  http://www.mpja.com/ Stock No: 34322 PS
+/-15V supply Ebay # 263326410466

Ebay # 263326410466 : Does not ship to the NL
HUGE pity, because $6 seems a steal, even pre-owned.

Same on Mouser: End of Life: Scheduled for obsolescence. And a €93 price (on top of nl.mousers standard of € 20 shipping)
Makes the $6 seem like even more of a steal. Even when adding $8 shipping to US.

I am tempted to ask you to get me two of those boards, but I will not be in US till May, and not sure what privately international shipping would add to the cost. Why do so many US eBayers not ship international! (I did send him a message, but usually they answer they simply do not want the hassle)

Actually, this Meanwell is local and not a bad price:
http://www.meanwell.nl/products/Meanwell-PT-45C---PSU-pcb--plus-5V-5A---plus-15V-23A---15V-05A__PT-45C.aspx
A bit oversized though, but it seems to be there smallest tripple output

[Vytautas]

As a reply concerning the 3092. It could be a better option than the original "30021" also, though sharing the load between two chips instead of one is better, IMHO.

[cybermaus]

Some more info on the firmware from the flashchip:

Waveforms:

By creating square waveform, uploading, and then rereading the flash, I found the following:

A waveform is 16K in size. Arb1 starts at 0x0100000 with 64 waves that means precisely the last 1M (iow, second half of the full 2MB chip) is filled with the 64 ARB waves of which the first 32 is a repeat of build in, and the last 32 are all xFFFF values. There is no meta-data at all. The little graph on the screen is calculated on the fly, and there is no descriptive string,.

Looking at the data, it is all xFF3F for +1 and x0000 for -1 of the defined square wave as defined in the tool.
So the data is in LSB, and should read x3FFF instead, which is exactly 14 bits.
x0000 is -1, what we consider 0Vdc is x2000 and +1 is x3FFF

I also possibly spotted an a few wave definition errors:

The wave generated and uploaded by the tool is 8191 words long, the space in the flash 8192 words long, and indeed there seems to be one leftover word with a odd value in the flash. This could give spikes on the waveform? Need to check.

The square wave generated by the tool starts with a single +0.5 value before staying on +1 half the way. I suspect it is because the tool average values and start with 0. In any case, this could explain the 7.4ns risetime I noticed on the official square wave, vs 4.8ns on all other vertical edges. It may be they generated the official one also with the tool.
Indeed, when I made my own square wave, it gave me a 4.8ns risetime. Pretty nice 31.250 MHz square (no jitter on 250MSa/31.250MHz)

Position 0x060000 to 0x0DFFFF are the build in waveforms, an exact copy of 0x100000 to 0x17FFFF, but not an exact match for the build in waves of the UI
I suspect that some of them, like Sine, Square, CMOS, DC are hardcoded FPGE procedural instead of numerical. Sine so it can go up higher, and Square and CMOS so you can control the duty cycle. And DC because I found no block of x2000 values.

Settings and Calibration:

By changing settings and then rereading the flash, I found the following:
Nothing changed in the Winbond flash. So there are no settings in the flash. None.
And I now believe also no calibration. Instead those are thus stored in the as yet unreadble STM32 chip on the UI board.

Cyclone Config:

I read some info on the Cyclone, and I now believe the first 0x05FFFF bytes are the Cyclone IV bitstream, which are read at startup. I added some references to the other post about flashing, including the official header description. So the flash is most of the firmware, it also has the FPGA stuff. But the display board SoC actually has the UI programming as well as all settings.

Memory map:

Unknown
0x000000 to 0x0000ff Mostly ff, some other values
0x000100 to 0x001341 Patterns many in dual byte pairs
0x001342 to 0x059d4f very low density data, mostly 0 bits
                     Maybe FPGA matrix pin connections?
                     Can FPGA self-program from flash? (answer: yes it can)
                     I am guessing. Not program or waveform data though
0x059d50 to 0x05ffff all ff. Filler to boundery


Build in waveforms in blocks of x4000
0x060000 to 0x0dffff (32 waveforms)

0x0e0000 to 0x0effff all ff
0x0f0000 to 0x0f0fff 16x a count from 00~ff (user or leftover development junk?)
0x0f1000 to 0x0fffff all ff

Waveform Arb1~64 in blocks of x4000
0x100000 to 0x17ffff repeat of x060000 to x0dffff
0x180000 to 0x1fffff all ff

[ArthurDent]

Cybermaus, check these Ebay listings for +/-15V power supplies as possible replacements for the +/-12V one in the FY6600. Both are small and should fit. I don’t know anything about the seller but their feedback is 100% and these supplies have worldwide shipping (~$20 to NL) so they might be worth checking. You first might want to measure what the minimum current drawn from each voltage rail is in your FY6600 is and check the specs on the power supply datasheet for each supply. I didn’t check the specs carefully so I may have missed something you’d find important. If both meets your needs I’d lean toward the RPT-60C model. Here are the Ebay listing numbers   252596788777  252511042883

[chtech0710]

Hi,

i've got my FY6600 recently and now it has stopped working 

Because i've replaced the power supply, modified the housing and added some shielding, i can't send it back to the seller (or Feeltech anyways).
I don't think the new power supply has caused the problem, it's a really good one (actually the same that ArthurDent uses in one of his.)

I've measured all suppy rails (also on the voltage regulators), which seems fine.
I also read the Flash content and compared with the uploaded content from cybermaus (btw. THX for uploading  ) and it's identically.
The next thing i've checked was the nStatus pin (pin 92, also available at R2) and the Conf-Done pin (pin 9, also available at R3) from the cyclone after power-on - if there is any error. Even all clocks are present and fine so the Cyclone seems to be okay.

But nothing happens on the front panel. Just 2 relay clicks after power-on. No display, no LEDs light up, no beep.

My guess is, the little STM32 is gone bad or it's memory became corrupted.
That would be most likely the case, because the FY6600 stopped working after a factory reset and power-off.

My question: is it possible to get the flash content from the STM32?
I would try to reflash it or replace the whole IC if i got the firmware.