Author Topic: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator  (Read 316065 times)

0 Members and 1 Guest are viewing this topic.

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #525 on: January 20, 2018, 09:14:11 am »
Dear forum members, I'm glad to announce the first official results of the FY6600 bus sniffing.

General considerations:
Pinout you can see it on the page 17 of this thread, signal level is 3V3 logic.
The data is transfered form the FP (front panel) to the SB (signal board) and back via 16bit word SPI transfers with an 18MHz clock, MSBit first.
Logically we are talking about a number of 32bit registers, in big-endian format, and one MOSI transfer consists of 16bit register address (so far observed addresses are less than 0x20, but the night is young), followed by the MSW and LSW .

Frequency registers general note:
- There are two 32 bit consecutive address registers for each channel, one holds the frequency in increments of 0.1Hz and the other one the centi-Hz and beyond, going to 0.099999Hz. On my 60MHz unit it goes to the max value and any further attempts to increase the frequency programs the same value. Values are 1to1 linear, no offsets or table lookup found.
The full control message programs 20 x 32bit registers, the register for CH1 are number 9 and 10 in the control message and for CH2 are 11 and 12 (these are positions in the 20 transfers control message starting from 1, NOT the actual register addresses !!!). Order is MSW then LSW, don't know if it matters.
- Frequency setting register addresses:
  CH1 MSW 0x02, LSW 0x01
  CH2 MSW 0x04, LSW 0x03


 >:D note: Is the freq limit hardcoded in the FP (bypassed by a new firmware or MCU), in the SB (bypassed by copying the SB flash) or in the components used (bypassed by soldering the right ones) ?

Next to come: Amplitude

Bonus, for amateur detectives: a Full sine frequency setting message, amplitude is set to 5.0000V, offset 0.00000, duty cycle 50%, phase shift 0.00000.

  8) First prize: The finder of one or the rest registers for setting the amplitude , phase and duty cycle, using just this provided sample.
 :-+ Second prize: The finder of current frequency settings by using the information I've provided.
 >:D Third prize: There is no third prize !!!

Sample (A.M.L):
1D.0000.0002
24.0000.0010
2B.0000.07FF
2C.0000.07FF
06.0000.00C0
06.0000.00C0
2D.0000.0E65
2E.0000.0E65
02.0BEE.32EF
01.0000.AB5C
04.0001.86A0
03.0000.0000
2F.0001.0000
30.0001.0000
05.0000.0000
38.07FF.DFFF
39.07FF.DFFF
08.000F.FFFF
09.000F.FFFF
37.0000.0000


Now  :box:

DC1MC





   

CH
 
The following users thanked this post: tek2232

Offline cybermaus

  • Frequent Contributor
  • **
  • Posts: 523
  • Country: nl
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #526 on: January 20, 2018, 10:25:32 am »
The unmodified 10KHz of channel B is easy.
The 20.015.998.343.868 uHz on Channel A is also not too hard, but a bit of a random number though.

But is a quiz really the right format to bring us new knowledge. Even if you are in teacher-testing mode, didactically the number set should have been one not obvious from the quiz, but once decoded reward the student with a good feeling. Like 02.075B.CD15 01.0000.04D2 would have. or if thats too obvious, maybe 02.075B.CD08 01.0000.D431

As to the others. Likely this:
The 50% ones are obviously one of the 7FF... values, do not even need a calculator for that. But offset is also a 50% value (0 being the middle)
Of course there are multiple candidates, depending on the resolution I would go for 07FF.DFFF, (not sure about the D) and 0000.07FF for offset.
Phase shift would be one of the 0000 values.


HOWEVER:

If for some technical reason, it was easier to build the FPGA blocks like that, they could just as easily use the 0001.0000 values as a hex 50%, and therefore a full scale would be 0000.0000 to 0001.FFFF to map out the offset. Or the duty cycle.

Or they could use proper binary values, with x0000 being 0, and negative offsets as signed binary, like 0FFFF for -0.001V and x7FFF being the maximum rather then the middle


You see, you are not really playing nice. You had multiple samples, saw what changed when, and know the answers. But now you make the questions as if your answers are the only possible ones, but without extra info, there are multiple solutions.


Anyway, more seriously:
 
>:D note: Is the freq limit hardcoded in the FP (bypassed by a new firmware or MCU), in the SB (bypassed by copying the SB flash) or in the components used (bypassed by soldering the right ones) ?

I would argue (but am not absolutely certain):
- Hardware differences are unlikely due to production cost, cost of keeping multiple stock.
- FPGA is unlikely as it is not protected
- CPU is likely, and in fact the reason why they do not distribute the firmware, even more then them worrying about IP

We can prove the FPGA is not it if someone with a 30MHz V3.1 reads the Winbond, so I can compare with my 60MHz V3.1
« Last Edit: January 20, 2018, 10:33:40 am by cybermaus »
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #527 on: January 20, 2018, 10:40:36 am »
Oh cybermaus, you hurt me  :P, this is my first capture with the LA, I even forgot what was the idea, prolly to generate a binary pattern of 0x123456789ab.
Besides this I have no clue what other parameter are formated and in which addresses are stored, I'll get them after returning from shopping, now that the other Saturday chores are done.
Parameter settings are easy, but when you press F1 repeatedly, it rereads stuff from the FPGA, I'm really curious what is there.
And of course, Sysinfo decoding it will be interesting.
It really sucks that nobody wants to hook an LA to its unit as well :(, but I will do whatever captures are needed or suggested.
But first parameter settings must be fully determined.
Now Accepting Ideas about some wave forms  to determine the waveform loading procedure!!!

Cheers,
DC1MC
 

Offline cybermaus

  • Frequent Contributor
  • **
  • Posts: 523
  • Country: nl
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #528 on: January 20, 2018, 11:07:57 am »
Sorry, I did not mean to curb your enthusiasm

Possibly I misinterpreted whether you were quizzing for the duty/offset/phase or did not know yet and was asked us.
But that misunderstanding is then also due to the bringing us the frequency as a quiz. As I said, I do not think quizzing is the way to go here.

The reason I am not LA' ing is multiple:

- I spend a lot of time  learning the STM32 and its features on a blue-pill with the hope of reading it. And I have at this moment confirmed that all the security measures described in the reference manual are in place and working. Many ideas to hack around it came and went out the door again. No closer to reading the FB, but I did spend my time.

- Reading the protocol is interesting, and I am not against puzzles, but it would be only half the work. After that there is also the grinding work of reprogramming another device as UI. Maybe said stm32 blue-pill, but a lot of extra work, and we are bound to also make bugs, like feeltech.

- as stated, my LA is a bit sub-par.

« Last Edit: January 20, 2018, 11:25:16 am by cybermaus »
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #529 on: January 20, 2018, 02:55:27 pm »
Back from shopping in the most miserable goth-mannheimisch weather evar :(.
So cybermaus, about the the security measures, can you detail, is the MCU closed on level 1 (doable) or on level 2 (not doable) ?
Also there was another kind soul that said he'll work on the FP schematic, any results yet, after the protocol is done I intend to do a Fraunhoffer on the FP, but not before.
In the end, the STM is providing really cool libraries for graphical LCD any many other goodies, it's doable with a bit elbow grease.
Now, enough talkin and more analyzing, up next, output voltage, phase and offset.
DC1MC

 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #530 on: January 20, 2018, 04:16:12 pm »
- Reading the protocol is interesting, and I am not against puzzles, but it would be only half the work. After that there is also the grinding work of reprogramming another device as UI. Maybe said stm32 blue-pill, but a lot of extra work, and we are bound to also make bugs, like feeltech.

I'm ready to start testing using another device as soon as I have a description of the bus protocol.  I plan to start by using Mecrisp to control the AWG board from a terminal window.  I have an ample supply of dev boards, etc.  This has the major advantage that exhaustive protocol testing is trivially scripted.

I've written thousands of lines of software professionally that were in service for almost 20 years with NO user reported bugs.  This included FORTRAN initializing a function pointer table in C that called FORTRAN routines to populate FORTRAN structures, so not trivial code either.  I realize that is unusual, but it shouldn't be.

@DC1MC Please start a new thread, "FeelTech FY-6600 Firmware Recovery"  in the "Repair" group and put all the information you have  collected in the first post, updated as we collect more information.  That will make it much easier to find out the current status of work.  We should keep the discussion here so as not to clutter up the technical documentation.

I'm still a few days from completing a major workspace  reorganization, but should be in full swing by next weekend at which point I'll start verifying the accumulated documentation. At least in theory I should be able to automate verification using the MSO2204EA features to verify the AWG output for all the bus commands.  It will be an interesting test of the Instek SCPI implementation.

[Edit]  I just saw this.  Never heard of the package, but obviously highly relevant.

https://www.eevblog.com/forum/microcontrollers/truestudio-v9-released-100-free-but-only-for-stm32/?topicseen
« Last Edit: January 20, 2018, 04:21:37 pm by rhb »
 

Offline SMB784

  • Frequent Contributor
  • **
  • Posts: 294
  • Country: us
    • Tequity Surplus
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #531 on: January 20, 2018, 06:13:33 pm »
Perhaps just a general repair thread outlining what steps are necessary to make the power supply safe, ground the device, give it a proper reference, and fix the UI display would be good. Put it all in one place!

Also, my device is also on the slow boat from China, what kind of logistics analyzer is needed to accomplish what's left to do?

i.e. how many channels, what sample rate, and how much sample memory?

If something like this would work, I will spring the cash and join the effort:
https://m.ebay.com/itm/USB-Logic-Analyzer-16CH-100MHz-4CH-400MHz-Base-on-Xilinx-Spartan-6-FPGA-in-US/162474227153?hash=item25d437f5d1:g:3NAAAOSwjyxZcVTv

Offline cybermaus

  • Frequent Contributor
  • **
  • Posts: 523
  • Country: nl
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #532 on: January 20, 2018, 06:26:07 pm »
So cybermaus, about the the security measures, can you detail, is the MCU closed on level 1 (doable) or on level 2 (not doable) ?

Short answer: it has RDP1

Longer answer: RDP1 and RDP2 does not exist on the STM32F103C8. Not exact.

You see, the Frauenhofer document is specifically for the STM32F0xx series, which is slightly newer, and indeed have an extra protection option. And because there are 3 protection levels, they call it 0, 1, 2. The older STM32F1xx devices only have RDP, or no RDP (on or off, if you will). No mention of levels anywhere in the document.
But functionally, RDP on is similar to RDP level 1.

That also means that the exact cold-boot race condition that Frauenhofer described, may or may not work.
It is a different device, with a specific implementation change in this specific part of the chip. The flaw was likely also already there in the older series, but we cannot be sure.

I am actually studying the Frauenhofer document at the moment, not merely skimming it an looking at the video, but trying to read and understand every word of it.
But to be honest: Don't hold your breath, I have other stuff to do too.




 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #533 on: January 20, 2018, 09:07:25 pm »
Hello again, after a short nap to rest these old eyes, here are some quick answers to the messages until now and some new findings, aka "level control is a new level of...":

@cybermaus: Thanks for clarifying the RDP situation with the FP MCU, I downloaded the code form the Fraunhoffer project, once I have the protocol figured out (in case the firmware/FP dies at least I can control the SB via something else). I wish you'll find some time to contribute further to our little project, but thanks again for all your previous work, it was an inspiration.

@rhb: Your offer to do a detailed and formal protocol testing is wonderful, we need this and we desperately need at least one person with another AWG to do some investigation, as far as I was able to see until now, there are no "secret sauce" calibration values stored somewhere, the firmware trusts the SB to do its stuff, for example, I didn't see so far any difference in setting the amplitude for the channels in the actual firmware, but with your help we can really devise a calibration procedure for the device. Also thanks for the advanced debugger package info, it will come handy later. Finally, I will continue this thread for a while and tomorrow I will start  a new one as suggested.

@SMB784: I will offer some of my findings to kick start your stuff, some are fact(F) and some are anecdotal (A, personal experience):
 - F: As the SPI interface clock is 18MHz, you need an LA that can work reliably at least 100MHz in sample mode.
 - F: The absolute minimum number of channels is 3: CS, CLK and MISO or MOSI, better is 4 (to see simultaneously both data pins) and best is 6, because we have some other signals (an assumed extra CS to select another device, and a "mystery" signal, not determined yet).
 - F: The logic levels are 3V3, single ended, ALL the LA in the world should be able to cope with this.
 - F: The LA has to have some on device memory, either large or with RLL or other compression method, we have some kind of trifecta thing, the data it's very fast when is coming,  but come in widely spaced bursts, and a "naive" LA that once triggered, keeps on sampling, it will need to have a real large sample buffer.
 - F: To add to the sample buffer size, I still have to see how the waveform loading goes over the SPI bus, it could be that my Intronix is insufficient for this.
 - F: The LA should be able to have a reliable 16bit, MSBit first, protocol decoder, or it's useless.
 - A: Personally I use an Intronix LogicPort (one right now on fleabay, https://www.ebay.de/itm/INTRONIX-Logicport-34-Channel-Logic-Analyzer/192427289565 ),  and they are still sold, while dated, it does the job (praise benevolent Fraser that offered one at a good price), it has RLL compression and some minuscule sample memory, so while the data can come as it wants, the few Kbits of sample buffer it fills up pretty fast and game over. Buuuut, if one is not lazy and expects the whole control msg in one shot, he can increase the number of trigger condition (CS going down) repetitions and position directly on the needed value or do a multi-segment acquisition. So far it proved to be OK, but I'm shopping for another LA, eventually with USB3 interface, and definitely with a large on device sample memory.
It's a tragedy that the Intronix guy got some kind of brain fart and totally refuses to update the design, he's a very pleasant and helpful person to talk with, UNTIL the design update subject comes :(.
 - A: I was also looking at the DS Xilinx whatever clones, it doesn't seem to have RLL compression implemented, and if so, even with the 256KBits sample memory, it's useless. In streaming mode is definitely useless. But of course, I can only use the seller provided information, that is some distorted chinglish and on 10 similar looking devices you've got 10 different descriptions, they are throwing whatever shit and see which of it sticks on the wall and sells more. And most likely the software is nicely done and a pleasure to work with  >:D.

I have lowered my LA standards as low as possible, but even so, finding a device that has the same features as the Intronix and a bit of extra buffer space under 1000EUR it's just not possible, Chinese or not. And btw, fuck those SA--äE sales drones with a rotating cactus, it took me half an hour with their miserable support software AI or cognitively challenged salesoid to confirm that the latest and grates expensive POS still doesn't have on device memory and doesn't do any RLL compression on acquisition and "it uses the PC memory". Sigh.

As this post has become too long, I will post the amplitude registers and description in my next post (that one will be also long, but with nuuuumeeeers :)

 Cheers,
 DC1MC



 if it's one of these devices that are just some Cypress USB interfaces with some analog front end,


 

Offline cybermaus

  • Frequent Contributor
  • **
  • Posts: 523
  • Country: nl
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #534 on: January 20, 2018, 09:31:15 pm »
... I downloaded the code form the Fraunhoffer project....

What? Where?
I was under the impression they did not publish the code.

edit: never mind. got it.

Also this is my analysis of the Frauenhofer paper (bad news):

- Cold-Boot SRAM attack: This assumes the bootloader first does a firmware CRC check, so every flash byte passes through the SRAM in an ordered and well-timed fashion. And I think our devices do not do a CRC check. Otherwise, how could they boot up with corrupted firmware

- SWD race attack: Quote: "experiments on a few samples indicate, that other series might not be vulnerable"
Translation: they tried it already on a STM32F1 and could not get it to work (in other places they also refer to F1 by name as "other series")

I am probably going to try anyway...

« Last Edit: January 20, 2018, 10:54:18 pm by cybermaus »
 

Offline SMB784

  • Frequent Contributor
  • **
  • Posts: 294
  • Country: us
    • Tequity Surplus
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #535 on: January 20, 2018, 10:08:13 pm »
- A: I was also looking at the DS Xilinx whatever clones, it doesn't seem to have RLL compression implemented, and if so, even with the 256KBits sample memory, it's useless. In streaming mode is definitely useless. But of course, I can only use the seller provided information, that is some distorted chinglish and on 10 similar looking devices you've got 10 different descriptions, they are throwing whatever shit and see which of it sticks on the wall and sells more. And most likely the software is nicely done and a pleasure to work with  >:D.

Would it matter if the device has 256 MBits of onboard storage memory, like this one?
« Last Edit: January 20, 2018, 10:09:57 pm by SMB784 »
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #536 on: January 20, 2018, 11:03:07 pm »
- A: I was also looking at the DS Xilinx whatever clones, it doesn't seem to have RLL compression implemented, and if so, even with the 256KBits sample memory, it's useless. In streaming mode is definitely useless. But of course, I can only use the seller provided information, that is some distorted chinglish and on 10 similar looking devices you've got 10 different descriptions, they are throwing whatever shit and see which of it sticks on the wall and sells more. And most likely the software is nicely done and a pleasure to work with  >:D.

Would it matter if the device has 256 MBits of onboard storage memory, like this one?

Not really 256MBits, the description says:
"DSLogic basic version Specifications:

- Hardware storage:256Kbits"
The ony one that comes close to what I want is/was USBee QX, but they are gone now :(
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #537 on: January 21, 2018, 12:02:06 am »
And now the log awaited amplitude settings:

General Notes:
Register addresses:
 CH1 - 0x2D
 CH2 - 0x2E

Range of digital values, both channels, no difference, no channel specific values:
 0x0000..0x0E65 (?!?!)

Ranges and corresponding relay bits in register 0x06 (NOTE the firmware has a naive way to set the register 6, it does one write for CH1 followed by another write with CH2 bits added, Bits 7to4 are undetermined yet):
 CH1 - 0.0000 to  0.5000V ( Bit 3 = 0, Bit 2 = 1 )
 CH1 - 0.5001 to  5.0000V ( Bit 3 = 0, Bit 2 = 0)
 CH1 - 5.0001 to 20.0000V ( Bit 3 = 1, Bit 2 = 0 )
 CH2 - 0.0000 to  0.5000V ( Bit 1 = 0, Bit 0 = 1 )
 CH2 - 0.5001 to  5.0000V ( Bit 1 = 0, Bit 0 = 0 )
 CH2 - 5.0001 to 20.0000V (Bit 1 = 1, Bit 0 = 0 )

Long list of panel value and actual digital representations over the SPI, there is clearly either a formula or some kind of calculations done, one can see some arithmetic rounding issues, the values are identical for the both channels for the same amplitude value, the new fw will benefit of some calibration tables.

0.0000V - 0000
0.0003V - 0001
0.0004V - 0002
0.0005V - 0003
0.0007V - 0004
0.0008V - 0005
0.0009V - 0006
0.0010V - 0007
0.0020V - 000E
0.0030V - 0031
0.1000V - 02E1
0.2000V - 05C2
0.3000V - 08A3
0.4000V - 0B84
0.5000V - 0E65
=== KLAK ===
0.5001V - 0170
0.5007V - 0171
0.5031V - 0172
0.5043V - 0173
0.5055V - 0174
0.5068V - 0175
...
0.5100V - 0177
0.5200V - 017E
0.5500V - 0195
0.6000V - 01B9
0.7000V - 0203
0.8000V - 024D
0.9000V - 0297
1.0000V - 02E1
1.1000V - 03A2
2.0000V - 05C2
3.0000V - 08A3
4.0000V - 0B84
5.0000V - 0E65
=== KLAK ===
5.0001V - 0399
5.0037V - 039A
5.0098V - 039B
5.0147V - 039C
5.0208V - 039D
...
5.0500V - 03A2
5.1000V - 03AB
5.2000V - 03BE
5.5000V - 03F5
6.0000V - 0451
6.5000V - 04AD
7.0000V - 0509
7.5000V - 0565
8.0000V - 05C2
8.5000V - 061E
9.0000V - 067A
9.5000V - 06D6
9.9963V - 0731
10.000V - 0732
10.0025V - 0733
10.500V - 078E
11.000V - 07EB
11.500V - 0847
12.000V - 08A3
...
19.000V - 0DAD
19.500V - 0E09
19.9971V - 0E64
20.0000V - 0E65
=== BEEEP ===

For short time taking requests for special voltage values and thankfully accepts nice plots and graphs.

WANTED: DIGITAL SECRETARY TO MAKE A NICE SUMMARY DOCUMENT, EXPORTABLE TO PDF

Tomorrow, offset and phase, time permitting.

 DC1MC


10.500V - 0
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #538 on: January 21, 2018, 12:19:18 am »
There are 17 switches and an optical encoder on the FP.  Would someone with a functioning (V 3.2+) unit document the state machine?  Most of the switches just select which input parameter is controlled by the optical encoder and the LCD panel switches.  It would also be helpful to know more about the RS-232 port and the LCD display.  That will let me start designing new FW.

I don't think it is worth spending much time on the FT FW aside from pure entertainment of trying the Fraunhofer attack.

I got my test monitor mounted to the wall, so I should be able to cable most of the bench tomorrow.  Then I'll install programming  pins and make an LA probing cable.  I've got an STM32F429 Discovery board, so I'll probably use that for the initial FW dev work as it has lots more resources and I know I can reprogram it.

I'm not clear on the "registers" DC1MC mentions.  Are these in the FPGA or the STM32?
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #539 on: January 21, 2018, 12:34:26 am »
There are 17 switches and an optical encoder on the FP.  Would someone with a functioning (V 3.2+) unit document the state machine?  Most of the switches just select which input parameter is controlled by the optical encoder and the LCD panel switches.  It would also be helpful to know more about the RS-232 port and the LCD display.  That will let me start designing new FW.

I don't think it is worth spending much time on the FT FW aside from pure entertainment of trying the Fraunhofer attack.

I got my test monitor mounted to the wall, so I should be able to cable most of the bench tomorrow.  Then I'll install programming  pins and make an LA probing cable.  I've got an STM32F429 Discovery board, so I'll probably use that for the initial FW dev work as it has lots more resources and I know I can reprogram it.

I'm not clear on the "registers" DC1MC mentions.  Are these in the FPGA or the STM32?

Cool, more hand and eyes needed.
Usually this the name for things implemented in the FPGA that are addressable, they are called registers.
We have an SPI interface and a number of these 32bit  registers in the FPGA, each with their own address (so far less than 8bits address space).
The registers that I've documented are in the FPGA and loaded/read via the SPI interface with 3 x 16bit word SPI transfers, first is the address (A), then the most significant bits in big-endian format(M) and the least significant bits (L) in the last transfer.
To start the new FW programming on the old FP we need the schematic, one member promised to work on it, but I didn't hear form him recently, if you want to use your own board then you need just an SPI interface to the signal board and 2 I/O pins for secondary functions, for start they can be skipped and  just use a 4 wire SPI.

Out of the registers block I have fully documented: 0x01,0x02,0x03,0x04,0x2D,0x2E and some bits in 0x06.
As functions we have now full control of the frequency and amplitude on sinus wave.
I've also posted a full configuration packet, that sets 20 registers at a time, for sine wave settings.
Tomorrow I will try to document phase and offset registers as well for the sine wave and channel enable bits (I have a hunch that they are also in register 6).

 Any questions welcome.

 Cheers,
 DC1MC

 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #540 on: January 21, 2018, 01:11:29 am »
Here is a plot of the "register" value vs voltage that DC1MC posted with the values converted from base 16 to base 10.

We really need for someone with a V3.2+ unit to verify that the voltage-register relationship is not borked.  I'll split off ranges and plot to check for calibration effects.
 

Offline SMB784

  • Frequent Contributor
  • **
  • Posts: 294
  • Country: us
    • Tequity Surplus
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #541 on: January 21, 2018, 01:21:22 am »
If my unit that arrives sometime next week is v3.2+, I will attempt to verify that. What is the necessary procedure for doing that?

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #542 on: January 21, 2018, 01:31:46 am »
Here is a plot of the deviation from a linear fit of voltage and register value based on my recollection that the DAC is 12 bit for the range from 5-20 V.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #543 on: January 21, 2018, 01:39:10 am »
[
I've also posted a full configuration packet, that sets 20 registers at a time, for sine wave settings.


Where?
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #544 on: January 21, 2018, 08:23:07 am »
Reply #532 has a complete control message, the things there now are starting to make more sense, and if we have the phase and amplitude registers today, it will be even more clear.
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #545 on: January 21, 2018, 12:47:41 pm »
Hello everybody, some more registers have meaning now:

Phase shift:

 CH1 - Reg. 0x08
 CH2 - Reg. 0x09

Phase shift range:
 0x00002..0xFFFFF

Phase shift interesting values (sine waveform):
 000.000" - 0xFFFFF
 089.999" - 0xC0002
 090.000" - 0xBFFFF
 090.001" - 0xBFFFC
 179.999" - 0x80002
 180.000" - 0x7FFFF
 180.001" - 0x7FFFC
 399.999" - 0x00002

Offset:

 CH1 - Reg. 0x2B
 CH2 - Reg. 0x2C

Offset range:
 0x155..0xEA8 corresponding to -10.000V..+10.000V

NOTE: The relays activates according with the ranges described in the message dealing with Amplitude

Offset interesting values (sine wave 1.0000V amplitude)

 0.0000V - 0x07FF
-0.002V - 0x07FE
+0.003V - 0x0800

  As usual, taking requests for special values of interest, if any.

 Cheers,
 DC1MC
 
The following users thanked this post: sorin

Offline ArthurDent

  • Super Contributor
  • ***
  • Posts: 1193
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #546 on: January 21, 2018, 01:42:32 pm »
Is the phase shift table above correct or am I misunderstanding what it is indicating? Is the symbol " meant to be ° for degrees and if so is the last entry meant to be 359.999° ?
-Arthur

Phase shift interesting values (sine waveform):
 000.000" - 0xFFFFF
 089.999" - 0xC0002
 090.000" - 0xBFFFF
 090.001" - 0xBFFFC
 179.999" - 0x80002
 180.000" - 0x7FFFF
 180.001" - 0x7FFFC
 399.999" - 0x00002
 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #547 on: January 21, 2018, 02:07:43 pm »
Is the phase shift table above correct or am I misunderstanding what it is indicating? Is the symbol " meant to be ° for degrees and if so is the last entry meant to be 359.999° ?
-Arthur

Phase shift interesting values (sine waveform):
 000.000" - 0xFFFFF
 089.999" - 0xC0002
 090.000" - 0xBFFFF
 090.001" - 0xBFFFC
 179.999" - 0x80002
 180.000" - 0x7FFFF
 180.001" - 0x7FFFC
 399.999" - 0x00002

On the left are the values of phase as indicated on the Front Panel, the " was used instead of whatever sign indicating degrees was used on the FP.
On the right are the digital numbers loaded in the corresponding state machine register in the Signal Board FPGA via the SPI interface, I try to be very careful and repeat the measurements a number of times before I post something, but of course, nobody's perfect, so if you spot any possible issue, I can redo the measurement.

 Cheers,
 DC1MC
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3082
  • Country: us
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #548 on: January 21, 2018, 04:35:28 pm »
A few stray thoughts:

The memory corruption may be a HW design fault.  In particular, failure to hold the power good pin off long enough for the PSU to stabilize. Mine worked fine until I turned it on for the Nth time.  My understanding is that same scenario applies to the other failures.  so potentially another thing that needs to be fixed.

The units may need individual calibration to correct for DAC errors.  The extent of the memory corruption makes any existing calibration tables highly suspect.  Recalibrating with limited equipment is likely to be quite challenging.

I looked at a couple of YoutTube reviews , one with a teardown,  of the JDS6600 which uses a different FPGA and generates the output voltages from a 5 V input.  It also uses the STM32F103, but the UI board is different. Unfortunately, neither of the reviews checked the voltage on the BNC ground.



 

Offline DC1MC

  • Super Contributor
  • ***
  • Posts: 1059
  • Country: de
Re: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator
« Reply #549 on: January 21, 2018, 04:44:48 pm »
A few stray thoughts:

The memory corruption may be a HW design fault.  In particular, failure to hold the power good pin off long enough for the PSU to stabilize. Mine worked fine until I turned it on for the Nth time.  My understanding is that same scenario applies to the other failures.  so potentially another thing that needs to be fixed.

The units may need individual calibration to correct for DAC errors.  The extent of the memory corruption makes any existing calibration tables highly suspect.  Recalibrating with limited equipment is likely to be quite challenging.

I looked at a couple of YoutTube reviews , one with a teardown,  of the JDS6600 which uses a different FPGA and generates the output voltages from a 5 V input.  It also uses the STM32F103, but the UI board is different. Unfortunately, neither of the reviews checked the voltage on the BNC ground.

We need another unit to check, but it could be that there are NO calibration tables in the exiting fw, at lest for frequency, amplitude, phase and offset, that I've tested here. It could be that they measured once and determined the values and then left these trimmer resistors for tunning and that's it. The units will benefit for some individual calibration.
For the PSU they do offer a power-good pin that goes 0 when the power is there (it's a transistor with a resistor to base, of course, this one it's also not calibrated).

I hope that in the end I will produce enough data for the people that can't return their devices anymore and got more or less bricked, to be able to connect a blue pill board or something similar with an SPI interface to the SB and serial or USB to the outside and manage to control their board.
And for the people with better expectation to be able to aclibrate and control better their unit.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf