FNIRSI-1013D "100MHz" tablet oscilloscope

[frenky]

This looks great. Your effort is really appreciated. 

[pcprogrammer]

Don't think I threw in the towel

Due to my fibromyalgia / chronic fatigue syndrome acting up more the last week it is harder to focus and things slow down. This happens from time to time. Still working on it and the user interface of the signal generator is coming along. So bear with me, it will be finished at some point

[voltsandjolts]

@frenky didn't mean to imply you stopped, just that your ongoing effort is much appreciated...which it is

I don't have one of these scopes but it's interesting to follow along. Thanks for all the updates.

[pcprogrammer]

That was not the why behind my post. It was to explain why it is taking longer to finish this bit of the project and that may have made people think that I stopped.

Which is not the case.

[Fungus]

I was just wondering ...

We know this thing tops out at about 20MHz bandwidth. Would it be worth modding it with a capacitor to limit the input to around that frequency and help it keep things together at higher frequencies? (ie. not show rubbish on screen)

[pcprogrammer]

I don't think that will help. The crap is in the FPGA even if the input is a pure sine below the 20MHz. Less frequent but still there. The only way to really improve this thing is to redesign the front end and the FPGA programming. And then still for a proper signal representation it needs to be kept below 40MHz since it only has a max of 200MSa/s per channel.

Not a bad thing because 40MHz is good for many hobby projects.

With redesigning the front end I mean calculate new values for the resistors and capacitors to give it a better sensitivity range and raise the low pass filter point to suite the 40MHz if possible. Have the software do more range scaling and sacrifice one or two bits in resolution. Accept it to never be a precise instrument to do spot on measurements.

But first of all getting an open source firmware working on it as is, is the first hurdle to take. Getting close, but still a lot to do.

[btidey]

I am really looking forward to replacing the stock firmware with the results of your hard work.

I previously used a DSO203 which really benefited by using the open source firmware; much better than the stock version.

When I need extra sensitivity issue I use a battery powered home built front end 2 channel pre-amp. One channel based on OPA355 (x10) has a bandwidth of ~ 15MHz and the other (transistor based) for audio type work, is switchable x10, x100 with a bandwidth ~5MHz.

Thanks for your skill and efforts on this.
 

[pcprogrammer]

@btidey, your welcome.

And your idea of an external amplifier is also a solution to crank up the sensitivity. 

[morris6]

What do you think, is this a genuine Altera Cyclone IV?

The part number found in the programming stream by tv84 is 0x020F1, that checks with the IDCODE for EP4CE6 (Cyclone IV Device Handbook, Volume 1, table 10-2).

How about a JTAG connection? A 10 pin IDG header and a few wires later: As expected, Quartus IDE programmer (USB Blaster) does not recognize this as an Altera (Intel) EP4CE6. The JTAG Chain Debugger does find a device: UNKNOWN_18006C31.

Before going into OpenOCD to try a connection over JTAG with the FPGA I connected  with Flashrom program to the FPGA Flash part. On my board that is a Zbit ZB25VQ80. Connecting with the Flashrom program failed, unknown chip. But, it found a manufacturer and part ID. I updated the flashrom flashchip.c and -.h files with this chips info and now at least reading the chip worked. For comparison the file is attached.

Next is comparing the content of this flash with the bit stream of the flash for the real Altera Cyclone IV...

[tv84]

The part number found in the programming stream by tv84 is 0x020F1, that checks with the IDCODE for EP4CE6 (Cyclone IV Device Handbook, Volume 1, table 10-2).

Just an estimate as I'm not 100% sure about those bits decoding. I think it can go up to 0x024F1. But... it is my best shot.

[pcprogrammer]

@morris6,

interesting findings. Are you going to try to reverse the FPGA? Or is it just to see what the part is?

The fact that you were able to connect a jtag device to it at least shows the pin out looks to be the same. Can you put up some pictures of how you connected the jtag header?

Did you look at what you read from the FLASH and compared it to the readout I made? I know there are different versions floating around. Mine was uncompressed.

Edit: did the compare here, and the files are the same.

[morris6]

Well, that's nice. At least it looks like the clone FPGA is in fact a copy of the real thing, in as much the one in the older Fnirsi-1013D is the real thing..!? Most probably a development for the original Altera (Intel) FPGA will work on the Chinese clone.

Reversing the FPGA? AFAIK that is impossible.

Now I have to figure out how to get OpenOCD talking to the clone, since Quartus is not. Or maybe Quartus can be tricked?

Results so far with OpenOCD, calling the chip "sesame":

Code: [Select]


Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'usb_blaster' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
Info : No lowlevel driver configured, will try them all
Info : usb blaster interface using libftdi
Info : This adapter doesn't support configurable speed
Info : JTAG tap: sesame.tap tap/device found: 0x18006c31 (mfg: 0x618 (<unknown>), part: 0x8006, ver: 0x1)
Error: sesame.tap: IR capture error; saw 0x3ff not 0x1
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined


It comes up with the same chip identifier as Quartus IDE programmer, and also sees a manufacturer. Have to look further to get the chip config file for openocd working. OpenOCD is all new stuff for me.

Attached some pictures of front- and backside of my board with JTAG and ICSP connectors. I added also a RESET jumper and jumpers to freeze the FPGA nCONFIG (low) and nCE (high).

[pcprogrammer]

Hi Maurits,

nicely done Your in luck it is not a multi-layer board, otherwise drilling through might have wrecked something.

Reversing the FPGA is not impossible, but granted it is very hard and time consuming to do. There are some claims on the net of people who done this with the Altera cyclone IV devices, but I did not find any software to do it. My take on it would be to first identify the bit-stream parts for the pins by making test files with different settings and see what changes. Then expand this for the lookup tables etc. A hell of a job, and time probably better spend in creating something new from the ground up.

Still on the user interface of the signal generator. Will see how far things get done today.

The waveform select works and the frequency and phase buttons are starting to work. 

[voltsandjolts]

I didn't know there were clones of the EP4CE6 - is that fact or rumour?

Genuine EP4CE6 share the same die as the next up in the range EP4CE10 and have the same IDCODE.
So you can program a EP4CE6 as if it were a EP4CE10 and get the benefit of a bit more logic.
However, your CE6 might be a CE10 reject so you can't really depend on it if distributing bitstreams.

[pcprogrammer]

About the clones of the EP4CE6 who knows. In time I will look at mine too see what it's responses are.

The fact that the EP4CE6 and the EP4CE10 are basically the same is interesting. You are right that it can't be depended on for distributing new programming, but experimenting with it will be fun. It offers room for bigger sample buffers.

Any idea on how it can be tested to see if it offers the full EP4CE10 capabilities?

[voltsandjolts]

Any idea on how it can be tested to see if it offers the full EP4CE10 capabilities?

No, that would be quite a task, testing every configuration bit and its hardware.
But my feeling is you would be unlucky if you found a CE6 that didn't work as a CE10

[pcprogrammer]

Uploaded the simulator code to the repository. The signal generator user interface is not completely done, but far enough to continue with the signal generation and scope FPGA emulation part.

[morris6]

About the clone FPGA that is not "seen" by the Quartus programmer.

Further googling examples of programming Altera devices with OpenOCD learned me that I have to use a .svf file for programming. So going into Quartus to make something to try it. Then program the chip over JTAG. Expected to be "Harmless", after re-powering the scope the test stuff is gone... As a first experiment I propose a "Blinkenlichtchen" on an unused FPGA pin. So some more hardware adaptation to do.

Results so far with OpenOCD, still calling the chip "sesame":

Code: [Select]


Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'usb_blaster' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
Warn : sesame.tap: nonstandard IR value
Info : No lowlevel driver configured, will try them all
Info : usb blaster interface using libftdi
Info : This adapter doesn't support configurable speed
Info : JTAG tap: sesame.tap tap/device found: 0x18006c31 (mfg: 0x618 (<unknown>), part: 0x8006, ver: 0x1)
Warn : gdb services need one or more targets defined
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 sesame.tap             Y     0x18006c31 0x18006c31    10 0x03  0x03
open("project.svf"): No such file or directory
svf svf [-tap device.tap] <file> [quiet] [nil] [progress] [ignore_error]
xsvf (tapname|'plain') filename ['virt2'] ['quiet']


To be clear, no project.svf file was present in the attempt above.
For your entertainment and inspection a Zip of the configuration files for OpenOCD I'm using. These are in a directory 'OpenOCD' from where openocd is called. It looks for the default openocd.cfg and executes that. It loads the adapter driver from /usr/share/openocd/scripts/interface/...whatever.cfg. In my case a clone usb-blaster. And then opens my 'sesame.cfg' as target.

To be continued...

[pcprogrammer]

The signal generator is working, at least on channel one a signal is coming through

There is no trigger or proper scaling yet. Need to implement more code in the FPGA stub functions to handle all the settings the scope does and based on that implement some trigger logic.

Why the second channel is only showing this small ripple I don't know yet.

But yet another step has been taken.

Edit: the signal generators second channel was set to 100MHz, which the scope can't measure Lowered it and now the scope shows signal

[pcprogrammer]

While working on the FPGA emulation I was wondering about the two commands the MCU waits on for a 1 to be returned.

0x05 which is checked twice in a row and 0x0A which is checked a bit later in the process but still before the reading of the sample data. During the latter the user can interrupt the waiting with touch, which is not the case when waiting on the 0x05 command.

My first thoughts on this were, could the 0x05 be for waiting on trigger and the 0x0A for capture buffer filled, but this would lead to a freeze of the scope in normal or single trigger mode, which it does not.

So it looks like the 0x0A is the wait for triggered command. The question is then what is the use of the 0x05 command?

Anyone any thoughts on this?

[morris6]

Sorry for this late reaction, I was fighting with Quartus. It feels like the program changed since the last time I used it for some De0-nano exercise, building a video driver for a TFT display.
About the FPGA commands: Since freezing the system is not acceptable the 0x05 command will be something that is certain to terminate. Maybe a reset of a capture cycle, clearing counters and or memory?

[pcprogrammer]

Think you are right about that. The more I work on it the more it becomes clear what a crap it is. Trying to get the signal offset on screen to work, but to get it spot on is not that clear cut. Have something working which will do for now, so next up is emulate trigger behavior.

So Maurits, if your are thinking of making a new FPGA programming that would be a great help. The software can be much simpler with a better FPGA setup

[morris6]

Well, first things first. Get programming the sesame Cy"clone"IV working. Yesterday I fumbled some LED's on the board with a 74LVC00 driver connected to some unused pins (114 and 115) of the FPGA. I also have now a working visual CONF-DONE indication. I could have used the pins of the relay's for my experimental programming, but the extra led's can have some debug function later.

To be continued...

[pcprogrammer]

Improved the simulator signal generation and it is now working reasonably well. Still an issue with the two signals missing a fixed phase relation so even when on the same frequency the not triggered on signal keeps scrolling.

Also found that I did not wrote the selected trigger mode to the FPGA in the scope code I had so far. Fixed that, so normal and single are possible options now.

Noticed that with this test setup the triggering is not very stable. Part of it will be my emulation of it, but on the actual scope hardware it was not so stable either. Well at least there is a tool to do development on.

The latest code is uploaded to the repository: https://github.com/pecostm32/FNIRSI-1013D-Hack

[pcprogrammer]

I noticed a strange behavior on channel 2 on both the real hardware as on the simulator and wonder if it has to do with calibration values or something else.

Can someone try this on their hardware. I tested it with a 5MHz sine on channel 1 and a 10Mhz sine on channel 2 and it happens when the signal on channel 2 goes below the bottom of the screen. Instead of a straight line it shows a ripple. This does not happen on channel 1, at least not on my systems. (It happens on other frequencies too)

See the picture for how it looks here on the simulator.

Attached is the latest build of the scope code as it is now. Just load it on the SD card as explained on page 45 of this thread.

Edit: Added a version with the shifted display and the somewhat fix for the ripple.