New bench scope - Fnirsi 1014D, 7", 1GSa/s

[pcprogrammer]

Im curious about the 100mhz, can this device measure 100 mhz correctly ?

Nope, with 200MHz sample rate and the ~30MHz low pass bandwidth at the input it can't do 100MHz (assuming you do mean mega Hertz, upper case M and not milli Hertz, lower case m)

Did you make a copy of the FPGA FLASH? If so, can you post it here?

[free_electron]

When I was a youngster a very simplistic analog hobbyist scope costed nearly 10 times this price.

amazing what they can do for 100$ these days. My first scope was a Hameg 604. I paid over 1000$ back in 1985

[joseph4511]

Sure i can upload. Also uploaded the image of special IC with marking

[joseph4511]

Also they accepted refund without returning the goods So we can surgery every part on them, if you have any idea you can give. I do not understand software stuff, i m hardware guy

[pcprogrammer]

Hardware guy, well then it will not be easy. I did some thinking about the problem and knowing that the "I2C" implementation is not to good, there might be a problem with the pull ups being to high. 10K where 2K2 is more usual for I2C. Still a bit weird that after exchanging the "special ic" to the other board left you with two broken boards.

I have to search for the details on the communication between the FPGA and this "special ic" to devise a test you could perform. Others and I did do measurements on it with a saleae logic analyzer clone, so if you have such or a similar device it might shed more light on what is going on.

Maybe it is also possible to hook up the "special ic" to an actual I2C bus connected to a linux machine and see if it responds.

I'm more of a software guy, but with a long ago hardware background, so I know a bit about how things work. Especially not to high frequency digital stuff. 

[pcprogrammer]

Hi Joseph,

here you can find some screen captures of what the communication between the FPGA and the "special ic" looks like: https://www.eevblog.com/forum/testgear/fnirsi-1013d-100mhz-tablet-oscilloscope/msg3583988/#msg3583988

To test the "special ic" with a dedicated I2C interface you could try a read of address 0. It should return multiple bytes of data.

Cheers,

Peter

[joseph4511]

I guess firmware in it is gone. No response from IC when i connect it to pc with I2C to usb adapter.

[pcprogrammer]

I wonder if there is a way to identify the chip. The fact that the "I2C" clock is ~820KHz makes it harder for bit banging, so a tiny85 (AVR based) might be to slow.

It intrigues me. I will take a look at the code and see if it is possible to remove the communication with the "special ic" from it, without it taking a lot of time.

[joseph4511]

Be careful, that crap tends to be broken. I dont want you to brick your device.

Edit: Can you compare your fpga rom file with file of mine? I did not applied heat there but im curious. Also found a Se98 datasheet, pinouts match maybe you can take a look.

[pcprogrammer]

Be careful, that crap tends to be broken. I dont want you to brick your device.

Edit: Can you compare your fpga rom file with file of mine? I did not applied heat there but im curious

I'm not touching the hardware Just looking at the firmware. It is looking back in what I did many months ago. As said the code is similar to the 1013D code, which I almost fully reverse engineered.

The code does an initialization of the "special ic" and it most likely hangs while waiting for a response. There is no timeout on that code. So removing the call to the initialization should allow the code to get a bit further. It will be a try and error game.

For comparing the fpga rom I have to extract the data from mine first. That is a bit of a pain in the bum to do, so maybe later.

[joseph4511]

Can you remove that line from firmware for that chip? I do not have knowledge for that.

[pcprogrammer]

Actually that is what I just did

The attached file is from last October 6th. Rename it to FS-1014.bin and load it on the SD card. The scope checks on startup if this file is present and will then write the flash with this data. If all goes well of course. This is the normal update procedure of FNIRSI

I have not tried it on my scope.

For those interested, what I did is change 4 bytes at location 0x04B330 from 0xFB, 0xBD, 0xFF, 0xEB to 0x00, 0x00, 0xA0, 0xE1. This changes a bl xxxx instruction to mov r0,r0.

[pcprogrammer]

Edit: Can you compare your fpga rom file with file of mine? I did not applied heat there but im curious. Also found a Se98 datasheet, pinouts match maybe you can take a look.

I looked at your fpga bitstream and at least the header looks to be correct. Don't expect any problems there, but you never know.

The se98 does not match the behavior of this "special ic" judging by the software. It is a bit strange that they left some marking on it. The three FNIRSI scopes (2x 1013D and 1x 1014D) I have don't have any markings on these ic's.

If the modified firmware I posted changes what your scope does I will make some more modifications to see if it is possible to make it work without this "special ic"

Edit: The SE98 also has a dedicated I2C address of 0x30 to 0x37 and not 0x00 which FNIRSI is using for this special ic.

[joseph4511]

everything stand still. Stucked on logo, takes 1.1 amps from supply. Can you replace the lines from whole firmware ?

[pcprogrammer]

Sure.

I expected it to show the scope screen and then hang, but there might be a call to the translate function before.

Hopefully this will have the scope continue, but it will not function as intended. I just disabled the call to the special ic without taking the needed actions on the data. When this indeed continues into the scope screen I will make a patch to make it work without the "special ic".

[joseph4511]

nothing have changed, device does not route to update screen

[pcprogrammer]

Hmm that is unfortunate.

I will have to dig a bit deeper. It might be that it needs a proper result from one of the call's to this translate function.

Later this week I have some time to play with it some more. Will use my scope with FEL mode to test things. Takes a bit of setting up but makes testing easier.

[joseph4511]

Thanks mate, i checked main firmware and i saw binary lines which match update binary. Maybe you can swap those lines like its updated.

Edit: I left a comment their YouTube channel and now they re responding very well. Let's see whats going to happen. The video link is : https://youtu.be/LuBntXGnRZ0 and my name is Yusuf Oylum

[pcprogrammer]

Thanks mate, i checked main firmware and i saw binary lines which match update binary. Maybe you can swap those lines like its updated.

Edit: I left a comment their YouTube channel and now they re responding very well. Let's see whats going to happen. The video link is : https://youtu.be/LuBntXGnRZ0 and my name is Yusuf Oylum

Hi Yusuf,

the first message beneath that video states that the October 6th firmware version is the most recent one. It is the one I have disassembled in Ghidra (a software tool for disassembling binary code) and labeled a lot of the functions in. That is how I'm able to make the needed modifications. Anyway the goal is to get something working first and worry about updates later.

I'm curious to see what reply comes from the youtube channel. When I broke the front glass panel of my first 1013D scope I emailed FNIRSI if it was possible to get a replacement part. They did reply but stated they could not send a replacement part.

You are lucky I already did the work on the 1013D, that saves a lot of time. Lets see if I can get it done in a couple of day's.

Cheers,
Peter

[joseph4511]

Hello Peter

Nice to meet you by the way. Im grateful to your researchment and yes i am curious about how they are going to solve my problem. I said them what i have tried so far, its 11 pm there so they are not working Right now. They could reply tomorrow morning. I mentioned the special IC in my comments. You can follow from YT i left the link above. Just switch to newest comments.

[pcprogrammer]

Hi Yusef

same here and you are welcome. Happy to help where I can

About FNIRSI solving your problem, don't hold your breath waiting for it

[joseph4511]

I got my money back and the 2 motherboard stay with me I dont think they re going to solve anything.

Edit : maybe you can write a comment with me to force them to help

[pcprogrammer]

Well with your money back and an additional motherboard you can't complain

Left a comment with the video telling them what rubbish it is, so check it out.

Later today I'm going to play with it to see if I can get it to work without the special ic communication.

[joseph4511]

When we get them both working, i ll stop complaining can not you extract the firmware with i2c tool?

[pcprogrammer]

Since there is no idea on which chip they used for this special ic it will not be easy to get to the bottom of it. It is also not needed because I know what the main cpu needs from it. There are a handful of commands or parameters (just semantics) in use. I know how to mimic them all, so patching the main firmware is a much simpler solution.

The new firmware I wrote for the 1013D does not use it either. The scope works even better without it. I don't know if they made improvements for the 1014D, but the code tells me that the basics are the same as in the 1013D.