FNIRSI-1013D "100MHz" tablet oscilloscope

[cliffyk]

Here are some results of my testing bandwidth in X1 mode using alligator clips:

10kHz reference (5.04 Vpp):


1 MHz (4.99 Vpp -0.087 dB)


10 MHz (5.39 Vpp +0.58 dB)


20 MHz (4.99 Vpp -0.087 dB)


30 MHz (4.36 Vpp -1.26 dB)


34 MHz (3.47 Vpp -3.24 dB)


So, there it is -3 dB @ 33 to 34 MHz with alligator clips! Not too shabby,,,

Note that the square-wave on CH2 (X1 mode via a 50 Ω patch cable) turned to crap at > 10 MHz, which actually validates the 30+ MHz bandwidth...

[rhb]

If you can go higher please plot values for a sine wave as I did today in the Rigol DS1202Z-E thread.

https://www.eevblog.com/forum/testgear/rigol-ds1202z-e-entry-level-scope-(200mhz-2-channel)/msg3143092/#msg3143092

That will give a much better idea of the usable BW.  For a lot of uses such as HF RF work they seem to be pretty viable even with the attenuation and aliasing at higher frequencies.

Have Fun!
Reg

[cliffyk]

If you can go higher please plot values for a sine wave as I did today in the Rigol DS1202Z-E thread.

https://www.eevblog.com/forum/testgear/rigol-ds1202z-e-entry-level-scope-(200mhz-2-channel)/msg3143092/#msg3143092

That will give a much better idea of the usable BW.  For a lot of uses such as HF RF work they seem to be pretty viable even with the attenuation and aliasing at higher frequencies.

Have Fun!
Reg

My current signal sources (other than my pirate FM station) max out at 60 MHz. Pushing the ADS1013D beyond the 34 MHz I posted just revealed further and relatively linear attenuation (which I view as "a good thing"). It's response does run up (peak) a bit between 10 and 20 MHz, but < 1.0 dB max--comes back down ∼ 22 MHz.

Although, and as I posted in a bulleted list earlier, when using the X10 mode and the supplied HF probe I could "adjust" the probe compensation to create all sorts of peaky responses using pretty solid 25 MHz square-waves. These peaky responses varied with each vertical sensitivity setting making them just useless abnormalities. I think in general the X10 mode in this device is worthless...

 

[boggis the cat]

Hey, I just worked out how to turn off the auto triggering level. It's in the system menu  This scope just got a lot better 

The menu system is weird.  It's also where you set / unset the FFT function.  A somewhat bizarre FFT, too...

Did you figure out the fast/slow setting near the top that changes responsiveness to the (single-point) screen movement?  The single-tap on the left or right on screen to alter the time-base.  (I could not figure this out for ages... gah!)

It has very basic functionality and works adequately within those limitations.  The vertical accuracy on mine is way off, though, so you should check that against something else if you intend on believing what it claims.

[boggis the cat]

34 MHz (3.47 Vpp -3.24 dB)


So, there it is -3 dB @ 33 to 34 MHz with alligator clips! Not too shabby,,,

Note that the square-wave on CH2 (X1 mode via a 50 Ω patch cable) turned to crap at > 10 MHz, which actually validates the 30+ MHz bandwidth...

My results seemed a little better: this is 3 Vpp at 50 kHz and 50 MHz, ~2.3 dB down.  I was using a calibrator with active heads directly attached to this instrument, though.





Cabling can cause lots of degradation, and alligator clips is not ideal for high frequency.

Edit: can't math properly.

[cliffyk]

Hey, I just worked out how to turn off the auto triggering level. It's in the system menu  This scope just got a lot better 

The menu system is weird.  It's also where you set / unset the FFT function.  A somewhat bizarre FFT, too...

Did you figure out the fast/slow setting near the top that changes responsiveness to the (single-point) screen movement?  The single-tap on the left or right on screen to alter the time-base.  (I could not figure this out for ages... gah!)

It has very basic functionality and works adequately within those limitations.  The vertical accuracy on mine is way off, though, so you should check that against something else if you intend on believing what it claims.

My first 'scope was a Bell & Howell Model 34 recurrent sweep monstrosity I got for Christmas when I was 10 or 11 (1956 or '57; I wanted so badly to "see" electricity and my parents indulged me). It came from a local junk/pawn shop, and maybe cost $5--likely pawned by someone who got a VA "TV Repair" grant.

Because of that harrowing experience and years of experience with analog 'scopes I have never considered vertical accuracy to be worth a damn and rarely consider it as other than a rough indicator of what's going on.

It is not possible for an  8-bit digital scope to have especially good vertical accuracy anyway--I have access to a Lecroy Waverunner 204 Xi. it's vertical accuracy spec is  ±1.5% (Of full scale); same as my WaveJet 322...

The digital readouts displaying hundredths of a volt are total eyewash...

[cliffyk]

My results seemed a little better: this is 3 Vpp at 50 kHz and 50 MHz, ~2.3 dB down.  I was using a calibrator with active heads directly Cabling can cause lots of degradation, and alligator clips is not ideal for high frequency.

Yeah, I was deliberately presenting it with a worst-case scenario...

[cliffyk]

Something I just ran across, there is no triggered sweep at slower than 10 ms/division--that could be a deal breaker for me.

According to the manual it's not supposed to go into "scroll mode" 'til 100 ms/div, but at 20 ms/div the trigger position and level indicators go away and it devolves into some recurrent sweep sort of mode...

[GeorgeOfTheJungle]

I'll send $20 US via PayPal to the first person to post a FW dump.

There you go, a FW dump:

 7600GT-imac6,1.rom.zip (85.26 kB - downloaded 285 times.)

Paypal: me@my.com

[GeorgeOfTheJungle]

Ohh, so the "3ns rise time" looks more like "30ns rise time", LOL. What a waste. It's a pity because @200MSps that could look much much better with a decent front end. Maybe the software of this one is the least of the problems.

Can anybody post a "dots" display mode of that WF, so we can count the dots?

[Fungus]

Ohh, so the "3ns rise time" looks more like "30ns rise time", LOL. What a waste. It's a pity because @200MSps that could look much much better with a decent front end. Maybe the software of this one is the least of the problems.

That's what we're figuring out.

So far it seems like the capacitance in a 1x probe compensates for the front end and makes it a workable 30MHz 'scope (low pass filter).

The nest step would be to work out the ideal capacitance (for max bandwidth), add a capacitor internally, go back to using 10x probes.

This fix would mean you can place a lot more trust in what's on-screen. If it's 30Mhz then 30Mhz it is. There's nothing wrong with that at this price and with 200MSamples/sec you get a decent bandwidth:sample rate ratio.

[rf-loop]

Ohh, so the "3ns rise time" looks more like "30ns rise time", LOL. What a waste. It's a pity because @200MSps that could look much much better with a decent front end. Maybe the software of this one is the least of the problems.

Can anybody post a "dots" display mode of that WF, so we can count the dots?

With my old but experienced eyes risetime looks more like 17ns than 30ns.
with 200MSa/s it have in this image 10 samples per div, 3.4sample in 10-90% rise time.



Roughly we can say what is needed realtime single shot sampling speed for measure rising time in signal under measure (rtum). (when analog BW is "enough").
Result is MSa/s
5000/rtum for quite accurate risetime measurements
3500/rtum for medium quality measurements
1750/rtum for only poor accuracy measurement or "looking around for fun"
1250/rtum very poor accuracy, useless for measurements

Old demonstrations for some tiny teaching purposes

1.25s for edge rising time (10 - 90%)


1.75s for edge rising time


3.5s for edge risetime(still there can see 10 and 90% points have some time jitter for risetime measurements purposes

No image for 5s for edge. There is no sampling interval based errors when mesurement are specified for 10 and 90%.


just for thinking.

------------------------------------
Personally I can not understand at all why so small amount of noise and ranting is about this "1GSa/s  100MHz" total hoax - fraud. Totally shameful outrageous scam if it is just as in Dave's video and HW is like displayed and if it is true what ADC there is. Also some tests support the assumption that there is max 200MSa/s.
Here in China I can see it selling in many places, example Jingdong, also Tmall/Taobao and all these claim they have quite tight rules for scams.  How long they can continue this hoax. Everywhere they advertise it 100MHz oscilloscope with 1GSa/s samplerate.  Why peoples accept it. Example here in China is quite strong customer protection system IF customers know how to use it. But looks more like "who knows...who cares".  This kind of business peoples do not think anything but what is money coming today to pocket and after soon they hide and escape and start some other hoax. Why they do not sell chickens. There is less numerical specifications what can easy check and test. Only need take the stones out from stomach before weighing and tell final price.

[UniSoft]

Would you mind dumping the winbond SPI flash and posting it here?

attached...

You'll need a CH341A (preferred)...

This is totally shit programmer...
I bought EZP2019+... Each reading get different result...
After that order SP16-B (www.sofi-tech.com) this one read stable.

[rhb]

Here are the horizontal and vertical settings from the FW image:

Vertical settings:

5V/div
2.5V/div
500mV/div
200mV/div
100mV/div
50mV/div
25V/div
10V/div
2V/div
1V/div
500V/div
250V/div
100V/div
50V/div
20V/div

Horizontal settings:

50S/div
20S/div
10S/div
5S/div
2S/div
1S/div
500mS/div
200mS/div
100mS/div
50mS/div
20mS/div
10mS/div
5mS/div
2mS/div
1mS/div
500uS/div
200uS/div
100uS/div
50uS/div
20uS/div
10uS/div
5uS/div
2uS/div
1uS/div
500nS/div
250nS/div
100nS/div
50nS/div
25nS/div
10nS/div

Apparently 4 rebranders:

UTX-1013.bin
FSI-1013.bin
YPK-1013.bin
DAN-1013.bin

It appears to be an AD9288:

AD9288
AD9288_1
AD9288_2
AD9288_1_2

I'm guessing that the last is a reference to merging all 4 channels into one. So there may be variants which implement that.

Does anyone have a disassembler for the chip?  If the compiler doesn't do a lot of optimization then it might be possible to write C code from reading the disassembly and incrementally start reverse engineering source code for it.

Have Fun!
Reg

[UniSoft]

It appears to be an AD9288:

Yep, I said it before...

I'm guessing that the last is a reference to merging all 4 channels into one. So there may be variants which implement that.

They don't have hardware support to merge all 4 channels into one...

Does anyone have a disassembler for the chip?

IDA Pro, Ghidra... it is ARM9 core

[cliffyk]

Ohh, so the "3ns rise time" looks more like "30ns rise time", LOL. What a waste. It's a pity because @200MSps that could look much much better with a decent front end. Maybe the software of this one is the least of the problems.

Can anybody post a "dots" display mode of that WF, so we can count the dots?

It does not have a "raw point" display mode, only interpolated x/sin(x) "vector" mode....

[Fungus]

Personally I can not understand at all why so small amount of noise and ranting is about this "1GSa/s  100MHz" total hoax - fraud. Totally shameful outrageous scam if it is just as in Dave's video and HW is like displayed and if it is true what ADC there is.

Are you in a position to do anything about it?

We're busy hacking it into something useful.

[Fungus]

Does anyone have a disassembler for the chip?

IDA Pro, Ghidra... it is ARM9 core

The main chip is this:

https://linux-sunxi.org/images/b/ba/F1C100s_Datasheet_V1.0.pdf

ARM9 with built-in display controller.

[GeorgeOfTheJungle]

Code: [Select]

0030ba0: f001 bde8 0000 a0e3 0082 bde8 1cd0 8de2  ................
0030bb0: f001 bde8 0100 a0e3 0082 bde8 0060 7380  .............`s.
0030bc0: 01ff ff00 01ff ff80 7377 6974 6368 2069  ........switch i
0030bd0: 6e74 6f20 6869 6768 2073 7065 6564 206d  nto high speed m
0030be0: 6f64 6520 2121 210d 0a00 0000 04e0 2de5  ode !!!.......-.
0030bf0: 8bdf 4de2 0120 a0e3 ac10 8fe2 0d00 a0e1  ..M.. ..........
Any idea what's that?

Code: [Select]

004d330: e13f a0e3 b0c0 d0e1 9b00 5ce3 1900 009a  .?........\.....
004d340: 0110 81e2 0c20 82e0 0118 c1e3 1800 00ea  ..... ..........
004d350: ccaf 1880 506c 6561 7365 2069 6e73 6572  ....Please inser
004d360: 7420 7465 7374 2063 6c69 7020 616e 6420  t test clip and
004d370: 7072 6573 7320 4f4b 2074 6f20 636f 6e74  press OK to cont
004d380: 696e 7565 2021 0000 9ced 1880 5901 0000  inue !......Y...
004d390: 4f4b 0000 7227 1980 58cd 1980 02b8 1a80  OK..r'..X.......
004d3a0: cdcc 0000 72cf 1a80 0180 8be2 0ca0 8ae0  ....r...........
004d3b0: 01b8 c8e3 0130 53e2 0200 80e2 dcff ff1a  .....0S.........

And this?

[tv84]

Who assured that the FW is only the SPI mem contents?

It only has a bootloader, a small app and a bitmap...   

I only opened it with a hex-editor but I think something is missing...

[iscle]

attached...

Thanks! It looks like it's not Linux in this case. But can be easily ported!

This is totally shit programmer...

It works fine for me! I used it in different situations, bios flash, firmware dump, etc and never had any problems

[rhb]

I realized that Dave thought it was an AD9288, but the chips had been sanded off.  My point was confirmation from the binary image.

Does anyone recognize the filesystem?  It doesn't appear to be UBI which is the only flash filesystem I have any familiarity with, and that is *very* little.

There's a string "F1C100S  XiaoTaoQi  Disk 1.0 " but a search with google didn't turn anything up other than a translation to "Rascal Disk 1.0".

There are these strings:

/pic_system.sys
/piclist.sys
/wave_system.sys
/wavelist.sys
eGON.BMP
eGON.EXE

If we can mount the filesystem we should be able to start disassembling the code and making variable maps to identify major sections of the code.

Have Fun!
Reg

[iscle]

Who assured that the FW is only the SPI mem contents?

The F1C100s has no internal memory, only RAM, so it must be in flash. Normally they run Linux, but in this case they must be using something else (somebody suggested XBoot paired with other software). It makes sense as the flash chip is only 2MB, Linux won't fit in there.

[iscle]

I realized that Dave thought it was an AD9288, but the chips had been sanded off.  My point was confirmation from the binary image.

Does anyone recognize the filesystem?  It doesn't appear to be UBI which is the only flash filesystem I have any familiarity with, and that is *very* little.

I've tried Binwalk and it's not recognizing anything from the binary... We'll have to do some more research...

[tv84]

"F1C100S  XiaoTaoQi  Disk 1.0" inside.

https://linux-sunxi.org/images/b/ba/F1C100s_Datasheet_V1.0.pdf

There is a big part that looks obfuscated (starting around offset 0x184C80).