New Zoyi multimeter+oscilloscopes - ZT-70xS, up to 50MHz/250MSps (nov 2022)

[Kris0725pl]

New version

[ajar171]

Sure but out intention is to make a good firmware and make this device works the best, it is not worth losing thousands of hours and not having original recources of bootloader and so on

Please don't get me wrong, I am thankful for any support I get

The first version of the bootloader is done and working now. It is not perfect, but it works, and it is a start.

It is just bad luck, that the more powerful MCU won't work as-is with the PCB. A PCB respin (only 2-3 pin changes needed) would make the more powerful MCU work, maybe Zoyi will consider it (hope dies last, as it is said in Germany  ). With some bodge wires, it would work even with the v2.2 PCB, but I am too lazy to do it.

Good news: RTD (Pt100, Pt500, Pt1000, Pt2000) measurement is working
Edit: 4-20mA mode is also working now

[ajar171]

It is possible, and what I managed to determine is that when you upload damaged firmware, a rescue mode is triggered, and a RAM/Firmware folder appears, about 600KB in size. You can manipulate GUI strings and replace them with others, as long as the byte size remains the same. I tried using Hashcat for testing, with my RTX 3060, the process would take around 4 days, or even up to 10 in some cases, but I’m not sure if I found the correct hashes.

@RedFox01: can you please explain step-by-step, how you got into the rescue mode?

[OLderDan]

New version
(Attachment Link)

I'm in, even without network, I love this quirky oscilloscope/multimeter!

[ajar171]

Because I got asked, my progress (and some preliminary documentation) can be found here:

https://github.com/kmikl/open-zt703

[tol]

Because I got asked, my progress (and some preliminary documentation) can be found here:

https://github.com/kmikl/open-zt703

I don't know how to program the STM32, but I hope that one of the good points of your work is that the original Zotek developers will learn your code and do the same in their original firmware Copy and paste is what they can do really well

[ajar171]

I don't know how to program the STM32, but I hope that one of the good points of your work is that the original Zotek developers will learn your code and do the same in their original firmware Copy and paste is what they can do really well

They cannot use my code for the ZT703 as-is, because it is already bigger, then size of the flash inside the MCU (and I did not really touch the scope part yet, only did some testing...). Beacuse of their bad design decisions and the stupid firmware encryption, they are stuck with the 128k of flash. I do not want any feature or usability compromises, just to fit in the 128k of flash available.

I also don't want any nice looking MSPS numbers, and push the ADC far out of its specs for marketing, just to get way off voltage readings from the ADC in exchange.

[maxmatteo]

I don't know how to program the STM32, but I hope that one of the good points of your work is that the original Zotek developers will learn your code and do the same in their original firmware Copy and paste is what they can do really well

They cannot use my code for the ZT703 as-is, because it is already bigger, then size of the flash inside the MCU (and I did not really touch the scope part yet, only did some testing...). Beacuse of their bad design decisions and the stupid firmware encryption, they are stuck with the 128k of flash. I do not want any feature or usability compromises, just to fit in the 128k of flash available.

I also don't want any nice looking MSPS numbers, and push the ADC far out of its specs for marketing, just to get way off voltage readings from the ADC in exchange.

as i said before, just a great project! will follow closely guess its time to find my stlink

[indman]

Because I got asked, my progress (and some preliminary documentation) can be found here:
https://github.com/kmikl/open-zt703

You refused to add "switchable analog scale (bargraph)" for lack of flash memory size?

[tol]

They cannot use my code for the ZT703 as-is, because it is already bigger, then size of the flash inside the MCU (and I did not really touch the scope part yet, only did some testing...). Beacuse of their bad design decisions and the stupid firmware encryption, they are stuck with the 128k of flash. I do not want any feature or usability compromises, just to fit in the 128k of flash available.

So have you added additional physical memory, or saved some of the available memory by getting rid of the encryption and other useless and ugly-designed code?

[ajar171]

Because I got asked, my progress (and some preliminary documentation) can be found here:
https://github.com/kmikl/open-zt703

You refused to add "switchable analog scale (bargraph)" for lack of flash memory size?

No, I messed up there. I did not properly decode the bargraph data sent from the DMM chip to the MCU, and since I don't have the stock firmware anymore I can't do it. The "needle" position can can be calculated from the measured value too, but the bargraph data would have been the quick, easy and code size efficient way.

This feature is postponed for now, but You are correct, the strikethrough was wrong there. Corrected it.

Thermocouple mode, saving/recalling settings, and limits are the priority, so we can do a beta testing and bugfixing round as soon as possible.

[ajar171]

So have you added additional physical memory, or saved some of the available memory by getting rid of the encryption and other useless and ugly-designed code?

The memory was on the board the whole time, it is the external SPI flash. Zoyi just cannot use it, beacuse of their design decisions, using the external flash would break the security. The MCU is perfectly enough, for what they wanted to achive and even for my firmware.

I would be glad to pay 5-10€ more for a faster MCU with more flash directly from Zoyi, even more, if they would put a big-ish (with at least 64kpoints/channel memory) FPGA between the ADC and MCU 
I know, that they are competing in a tough market, but I would really like a scopemeter, with this housing, a big MCU and an FPGA and the possibility to add functions to the firmware, that I need myself.
Edit: there is an LCD-screen on the market in China, with the same form factor, but double the resolution. Sadly the board v2.2 does not support it as-is (would work with some bodge wires).

So to clarify, how my stuff works:
- the meter is powered on
- the bootloader in the internal flash verifies the checksum of the firmware in the external flash
- if the checksum is OK, the firmware from the external flash gets copied into the internal RAM
- execution is handed over to the firmware in RAM

I think their goal was, to stop other chinese manufacturers from copying their design easily, and not to hinder anyone making an alternative firmware for their meter. As far as I know, this goal is fulfilled

[ajar171]

If someone would design an adapter PCB from TQFP-100 to a BGA variant of the STM32H743 plus an FPGA and also add 4 solder points for an additional SPI port (for the better LCD), we could make the best little scopemeter on the world

[tol]

I would be glad to pay 5-10€ more for a faster MCU with more flash directly from Zoyi, even more, if they would put a big-ish (with at least 64kpoints/channel memory) FPGA between the ADC and MCU 

As far as I know, Zotek is reading this thread and your dreams can become reality some day, but most likely they will abandon 703 and make 704 because it's easier for them to make a new model rather than fix bugs in old models. But this approach is not perfect because new 704 will surely have new bugs and the current story with good hardware and bad firmware will take place again. You will have to make reverse engineering from the beginning for the new hardware I think a great way of 703 development would be if you could cooperate with Zotek and become their consultant to fix existing bugs and make the best out of current 703 hardware using the official firmware, but they don't seem to have much interest in firmware development and bugs fixing, so it just goes as it goes.

I can understand why they encrypted the firmware, because Fnirsi 2C53T/2C23T is their direct competitor that has a lot of firmware bugs too, so it makes some sense to protect some good ideas from being stolen by the competitors. But that would be OK if the firmware was perfect and everyone would want to steal it, but now I'm not sure if Zoyi should steal the code from Fnirsi or Fnirsi should steal the code from Zoyi When I decided which one to buy, I choose Zoyi just because it had less firmware bugs at that moment, but now I'm not sure if it was the correct choice At the other hand, Fnirsi has the same horrible update approach, they make a new model every year and abandon previous models, leaving their users with lots of unfixed bugs that will never be fixed. This is why I will never buy Fnirsi hardware.

[chebo]

At a scan rate of 200 ms or slower, synchronization does not work. Is this the case for everyone?
FW 1.5.6.

I made a short video about this, please see. Have you met this phenomenon?
https://youtube.com/shorts/Cta1GJWkTtw?si=vsH-_A4qYfZAGS2O

[ajar171]

I would be glad to pay 5-10€ more for a faster MCU with more flash directly from Zoyi, even more, if they would put a big-ish (with at least 64kpoints/channel memory) FPGA between the ADC and MCU 

As far as I know, Zotek is reading this thread and your dreams can become reality some day, but most likely they will abandon 703 and make 704 because it's easier for them to make a new model rather than fix bugs in old models. But this approach is not perfect because new 704 will surely have new bugs and the current story with good hardware and bad firmware will take place again. You will have to make reverse engineering from the beginning for the new hardware I think a great way of 703 development would be if you could cooperate with Zotek and become their consultant to fix existing bugs and make the best out of current 703 hardware using the official firmware, but they don't seem to have much interest in firmware development and bugs fixing, so it just goes as it goes.

I can understand why they encrypted the firmware, because Fnirsi 2C53T/2C23T is their direct competitor that has a lot of firmware bugs too, so it makes some sense to protect some good ideas from being stolen by the competitors. But that would be OK if the firmware was perfect and everyone would want to steal it, but now I'm not sure if Zoyi should steal the code from Fnirsi or Fnirsi should steal the code from Zoyi When I decided which one to buy, I choose Zoyi just because it had less firmware bugs at that moment, but now I'm not sure if it was the correct choice At the other hand, Fnirsi has the same horrible update approach, they make a new model every year and abandon previous models, leaving their users with lots of unfixed bugs that will never be fixed. This is why I will never buy Fnirsi hardware.

Sure, the ZT703 won't get any hardware upgrades from Zoyi, a new hardware would mean a new model number, and that is absolutely correct. The hardware of the 703 is pretty good for the price, they have just limited themself with the 128k of flash, but at least they are using a genuine ST MCU. I am not fixing their bugs, because without seeing their code, I think the scope part of the stock firmware is fundamentally broken and unfixable with 128k of flash. I would be more then happy to cooperate with them to make my dream scopemeter I think they should make a cheap scopemeter as a competition to Fnirsi, and also make a more expensive, but capable one. Seeing the hardware of the 703, they are more, then capable of designing good hardware for a good price, so why not make a "professional" scopemeter?

I also have no problem with them encrypting their software. It's their software, so they should protect it, as good as they can. I had very bad experience with Fnirsi, Zoyi is at least trying to fix some of the bugs, Fnirsi abandonded all the stuff I bought from them in 6-12 months. I am not buying anything from Fnirsi anymore. If Fnirsi is the direct competition for Zoyi, then IMO Zoyi has already won

I also bought a scopemeter from Owon, which of course works, but the hardware is also much more capable (and costs a lot more), so no surprises there.

I really would like to make the 703 as capable as the hardware allows, becuse the overall design is nice, the MCU is good enough for the task and also why not

Here goes my wishlist for the 703 version 2:
- high resolution display (3.5", 640x480), no touch
- at least 400MHz MCU, with minimum 1MB of flash
- a big-ish FPGA, with lots of RAM (say Gowin GW2AR-18 <-- could do 32MPoints/channel  )
- original ADC from Analog or TI

[tol]

I think they should make a cheap scopemeter as a competition to Fnirsi, and also make a more expensive, but capable one. Seeing the hardware of the 703, they are more, then capable of designing good hardware for a good price, so why not make a "professional" scopemeter?

Most likely they understand that there is some kind of price limit that divides 2 kinds of products: the cheaper "toys" for arduino amateurs that is also suitable for fast and approximate diagnostics and the expensive professional stuff for everything else. Not many users would want to buy something in between, that is not as cheap as 703 and just a bit less expensive than simple models from professional oscilloscope manufacturer that are quality proven and have reliable support and long time upgrades. Besides, there appear producers that already try to find their place in that middle, for example  ZEEWEII DSO3D12, but it's more expensive and evidently many people still prefer to buy a cheaper 703 even if it has less powerful hardware.

I agree that Fnirsi is not worth buying until they change their update policy,  you know it and I know it, but there are thousands of users who don't know it. Fnirsi often offers neat-looking colorful GUI in their devices and it attracts customers even if it is a set of lags and bugs. Besides, Fnirsi has a rather aggressive marketing spendings. I know that they send a lot of free devices to popular youtube bloggers in exchange for a video review (sometimes they are fair and sometimes they are not), so I think many people still buy Fnirsi even if their stuff is full of bugs. A few month ago I wanted to buy a transistor tester, I found LCR-P1 made by Fnirsi, and luckily I saw a review where a user tested diodes and that fnirsi showed all of them in reverse polarity! Other users confirmed that issue. Thanks to them I saved some money and bought an old gm328 which is twice cheaper and has most features of LCR-P1 but makes the measurements correctly

640x480 would be too cool for this kind of device. It requires more mcu resources, more memory and more money I think we can live with 320x240 fine, but what I hate in the current 703 implementation is that we cannot zoom to the top/bottom of the signal to see it in detail because the 0V level cannot be moved higher or below the visible area of the screen, so if we have a high-amplitude signal, we just can't zoom to its peaks to see what happens there. I would also change the way the measurements are shown because they cover almost the whole bottom half of the screen. I think Fnirsi solution is much better - they show the measurements on a transparent background, so the signal and the measurements can be printed on the same part of the screen and it's easy to read both because the text and the graph have different colors. Other things, I think, look rather neat in zoyi 320x240 screen (I don't mention the buggy and non-working horizontal scroll bar that they still can't fix of course).

[ajar171]

As for the quality hardware and firmware from a "cheap" manufacturer, just look at Rigol. They also started as a "cheap" company, and look at where they are now.

Strange menu of the Zoyi: I have completely ignored it, and have gone my own way

 

[tol]

As for the quality hardware and firmware from a "cheap" manufacturer, just look at Rigol. They also started as a "cheap" company, and look at where they are now.

Rigol quickly understood that they should listen to the users and make them happy to become successful. Zotek has some difficulties with understanding this As far as I understand they do believe that their firmware is perfect and if some user is unhappy with the product quality it is because this user does something wrong

[OLderDan]

... I would also change the way the measurements are shown because they cover almost the whole bottom half of the screen. I think Fnirsi solution is much better - they show the measurements on a transparent background, so the signal and the measurements can be printed on the same part of the screen...

Actually, the owon has a great menu implementation where the screen "shrinks" to allow menu display along the bottom, then resumes full zoom after a timeout to give a larger display for observation. The menu is kind of like windows taskbar with autohide.

[Phb]

As far as I know, Zotek is reading this thread and your dreams can become reality some day, but most likely they will abandon 703 and make 704 because it's easier for them to make a new model rather than fix bugs in old models.

YOOOOOOHOOOOO @ ZOYI/ZOTEK

In the spirit of making things better, (And this is all I dare say, standing against the giants of this forum).
While I do understand that English is not a first language....

When you can, this is from Rev 1.56 FW.

[ajar171]

Actually, the owon has a great menu implementation where the screen "shrinks" to allow menu display along the bottom, then resumes full zoom after a timeout to give a larger display for observation. The menu is kind of like windows taskbar with autohide.

This is exactly, where a more powerful MCU or an FPGA would come in handy. There are simply no resources left to do nice animations. The MCU has to "race the beam" of the LCD, to draw the whole screen in the blanking period, but a double framebuffer would eat up too much RAM. At the moment I have enough RAM to spare for double buffering, but I am not doing it, because I can draw the screen without screen tearing artefacts and I am saving up RAM for later.

Altough I must admit, that I can only draw the screen with every option (averaging, graph display, envelope display, logging) turned on, with the help of compiler optimisations. In debug mode (no optimisation), there is already screen tearing visible. This is a trade-off between code readability and speed, where I have favored readability...

Edit: finally got limits working properly

[tol]

There are simply no resources left to do nice animations.

I'm strictly against any animations in such devices. I think all the power of the mcu should be used for useful tasks. For example, I noticed that turning on the on-screen measurements makes the work of the oscilloscope very slow and unstable (it can skip fast signals), so the device hardly has enough power to do the basic tasks that it should do. When I just bought this device I turned on 4 possible real-time measurements but now I disabled them all and enable them only rarely when they are really needed.

For Zoyi developers:
In this respect I want to ask Zotek engineers to make a button that can quickly enable and disable pre-selected realtime measurements. Now we have to press menu button to reach "Measure" submenu, then select 4 items, then watch the measurements, then go to that menu again, deselect the 4 measurements, and it really takes a lot of time. One button for it will save a lot of time. For example, some buttons are not assigned for a long-press action. Long press of "F4" could quickly turn on/off the cursors, and long press of "MODE" could turn on/off the measurements. This would be more quick and handy than doing it through menus.

[RedFox01]

@RedFox01: can you please explain step-by-step, how you got into the rescue mode?

Nothing special, the device simply works normally without the SPI chip, and a RAM/firmware mode is available via USB. Alternatively, if the firmware upgrade with the SPI chip fails (e.g. due to corrupted firmware), after three attempts an "update failed" message appears, and the device switches to the RAM/firmware mode, which is most likely part of the bootloader. Of course, the MCU has RDP enabled, so the bootloader cannot be damaged by the firmware and is not updated, or at least it seems to me that the bootloader isn't updated

[ajar171]

There are simply no resources left to do nice animations.

I'm strictly against any animations in such devices. I think all the power of the mcu should be used for useful tasks. For example, I noticed that turning on the on-screen measurements makes the work of the oscilloscope very slow and unstable (it can skip fast signals), so the device hardly has enough power to do the basic tasks that it should do. When I just bought this device I turned on 4 possible real-time measurements but now I disabled them all and enable them only rarely when they are really needed.

For Zoyi developers:
In this respect I want to ask Zotek engineers to make a button that can quickly enable and disable pre-selected realtime measurements. Now we have to press menu button to reach "Measure" submenu, then select 4 items, then watch the measurements, then go to that menu again, deselect the 4 measurements, and it really takes a lot of time. One button for it will save a lot of time. For example, some buttons are not assigned for a long-press action. Long press of "F4" could quickly turn on/off the cursors, and long press of "MODE" could turn on/off the measurements. This would be more quick and handy than doing it through menus.

A short press of the POWER/REL button could be used to turn measurements on/off, as REL has no function in scope mode. Thanks for the idea, noted