New Zoyi multimeter+oscilloscopes - ZT-70xS, up to 50MHz/250MSps (nov 2022)

[AGMAR1]

1) Ajar171 thank you for the New Year's wishes, may we be successful.

The next questions may be lame, but I think that you need to know the block structure of the tool to use it well and interpret data (errors). I am interested in the problem of trigger(s) and memorizing samples from ADCs (DFSDM). Synchronization of these blocks, because I see a big hardware and software problem here (not eliminated by the programmer of this device).

2) ad3 " All filtering, averaging is done in HW, see the DFSDM block diagram (ignore the serial and parallel ADC part, the data is coming from the bus) " I attached your drawing and led in Red the processing in Oscilloscope mode. In Blue DMM. I did this to make sure I understand you correctly. And I have further questions:
   ad3.1 Where is the 128 kB of memory, I understand that it is a circular buffer (filled with DMA packets, where is the grouping of this data)?
  ad3.2 Does HW supervise this (it has to, but how?)?.
  ad3.3 I mean how is the data in this memory synchronized with time (is time measured successively by adding the ADC sampling time value?).
  Ad3.4 Is this buffer filled all the time even when no trigger has occurred (I think so)
  Ad3.5 How does HW know (synchronize) the trigger occurrence… but this problem after explaining how the trigger circuit works.

3T) In your list you wrote a few things about triggering in this device:
3T.1 You wrote that this is software triggering. Then that there are simple comparators there. How is that?
3T2 I imagine that the comparator detects exceeding the threshold (UweTrig). The HW circuit has a setting on the pin to interrupt the transition from state 0 to 1 or vice versa. And then it is necessary to precisely determine the current position of the data recording in the 128 kB buffer, i.e. precisely synchronize: the data positions at the time of the trigger. Then determine how many ADC samples must be saved after the trigger (here the position of the time trigger) to interrupt the measurement at the right time. If this time is too long, then the data is overwritten at the beginning of the samples, if the old data is too small. And this sometimes happens in the meter. This very very difficult for hardware and SW.

4) Here I would like to describe my observations of the measurement in the oscilloscope mode, one channel, single trigger. I know that you do not care how this software works, but if you specified the sampling frequency (maybe the amount of data), it would be a sure source of knowledge for us. In addition, I always think that a person can learn from the mistakes of others.
4.1 The oscilloscope with small time bases from 10 ns to 10 us always records 128 kB samples with the highest possible frequency (I think so). This gives an approximate recording time of +- 300 us (time trigger in the middle). You can see this by pressing the hold key, and then increasing the time base. Picture 2 and 3.

4.2 The problem with this meter is as follows:
4.2.1 when several triggers occur in a row, it incorrectly determines the data copying positions from the buffer;
4.2.2 if the trigger is triggered before the time of 320 us, the data is initially zeroed.
4.2.3 when the time base is less than 500 ns, there is a shift between the trigger position and the data (this situation can also occur on other bases).

4.2.4 I generally stopped going below 1 us with the time base, because the same data is recorded anyway, which I can later see in Hold mode.


AD4 "280MSPS is electrically possible only on channel 1 (it is still 140MHz ADC clock, but with a 180° clock phase shift)", does this mode require the same signal to be applied to the CH2 ADCs input or is it done internally

[ajar171]

2) ad3 " All filtering, averaging is done in HW, see the DFSDM block diagram (ignore the serial and parallel ADC part, the data is coming from the bus) " I attached your drawing and led in Red the processing in Oscilloscope mode. In Blue DMM. I did this to make sure I understand you correctly.

The drawing is wrong, as stated above you should have ignored the serial and parallel ADC part. The DMM is a separate circuit, completely isolated from the scope and MCU part, it communicates with the MCU via a serial link.

And I have further questions:
   ad3.1 Where is the 128 kB of memory, I understand that it is a circular buffer (filled with DMA packets, where is the grouping of this data)?
  ad3.2 Does HW supervise this (it has to, but how?)?.
  ad3.3 I mean how is the data in this memory synchronized with time (is time measured successively by adding the ADC sampling time value?).
  Ad3.4 Is this buffer filled all the time even when no trigger has occurred (I think so)
  Ad3.5 How does HW know (synchronize) the trigger occurrence… but this problem after explaining how the trigger circuit works.

Tha data has to be stored in AHB SRAM1 and 2, I don't see any other way at the moment. The ADC is connected to the GPIO Port D, wich is also in AHB domain. The rest is up to the DMA controller in circular buffer mode, the DMA has to run continously, while waiting for a trigger of course. The MCU used in this meter is a pretty capable one, it should be able of running this scope with some limitations (limitations, not bugs).
 

3T) In your list you wrote a few things about triggering in this device:
3T.1 You wrote that this is software triggering. Then that there are simple comparators there. How is that?
3T2 I imagine that the comparator detects exceeding the threshold (UweTrig). The HW circuit has a setting on the pin to interrupt the transition from state 0 to 1 or vice versa. And then it is necessary to precisely determine the current position of the data recording in the 128 kB buffer, i.e. precisely synchronize: the data positions at the time of the trigger. Then determine how many ADC samples must be saved after the trigger (here the position of the time trigger) to interrupt the measurement at the right time. If this time is too long, then the data is overwritten at the beginning of the samples, if the old data is too small. And this sometimes happens in the meter. This very very difficult for hardware and SW.

3T1: I did not find the comparators at first, took me some time to RE that part, I don't do this every day. They did some strange design decisions, those robbed me a lot of time.
3T2: Yes, that would normally be the job of the missing FPGA. I will see, how I want to do this exactly, I have an idea, but I will test it first, when I get there.

4) Here I would like to describe my observations of the measurement in the oscilloscope mode, one channel, single trigger. I know that you do not care how this software works, but if you specified the sampling frequency (maybe the amount of data), it would be a sure source of knowledge for us. In addition, I always think that a person can learn from the mistakes of others.
4.1 The oscilloscope with small time bases from 10 ns to 10 us always records 128 kB samples with the highest possible frequency (I think so). This gives an approximate recording time of +- 300 us (time trigger in the middle). You can see this by pressing the hold key, and then increasing the time base. Picture 2 and 3.

I can only tell you the maximum sampling rates: 100MSPS and 140MSPS, with both channels active. That is what I have measured myself. With a memory depth of 64kbytes@100MSPS, you get 644µs, that checks out.
I have erased the stock firmware from my meter, so I can not tell you how fast they are sampling apart from the max speeds.

4.2 The problem with this meter is as follows:
4.2.1 when several triggers occur in a row, it incorrectly determines the data copying positions from the buffer;
4.2.2 if the trigger is triggered before the time of 320 us, the data is initially zeroed.
4.2.3 when the time base is less than 500 ns, there is a shift between the trigger position and the data (this situation can also occur on other bases).
4.2.4 I generally stopped going below 1 us with the time base, because the same data is recorded anyway, which I can later see in Hold mode.

Exactly the reason, why I have erased the stock firmware.

AD4 "280MSPS is electrically possible only on channel 1 (it is still 140MHz ADC clock, but with a 180° clock phase shift)", does this mode require the same signal to be applied to the CH2 ADCs input or is it done internally

The input signal from channel 1 can be routed internally to the ADC input of channel 2. 

[Astur_TorQue]

I am not posting anything, that I have reverse engineered, since I don't know if it is even legal in Germany.

I have heard before that it's legal in EU, not in the US...


https://www.tme.eu/en/news/library-articles/page/56932/reverse-engineering-what-is-it-and-is-it-legal/

In the European Union, reverse engineering is permitted – under the verdict of the Court of Justice issued in 2012 – for creating computer programs with operation analogous to the original program. In that verdict, the Court of Justice ruled that the functionality of software is not protected by copyrights within the territory of the EU, which opened the door to research and testing of original programs so as to reproduce (not copy) their behavior in another program.

As far as I know, reverse engineering is legal everywhere

While you don't copy the original code, if the result is the same, totally legal

[EU1]

Has anyone identified the battery used in this DMM?

The ZT-703S charger can be either the ME4059D or, in newer revisions, the ME4086B. Both are designed to charge up to 4.34V, suggesting the battery should have a maximum voltage of 4.35V.

However, the battery's protection chip, a DW01 from XIN FEI HONG, is designed for 4.2V batteries and has an overcharge protection voltage of 4.3V. This implies the battery might actually be a standard 4.2V max type.

[LucSVK]

Guys, pls do you know how the baseline calibration works on ZT703S?

Maybe I am doing it wrong, but mine always ends with a message "check failed"

The baseline calibration is described on page 19 in the manual.

---
Baseline Calibration:
The instrument is factory-calibrated at 100%. However, if there is a
baseline offset due to large environmental temperature deviations or
prolonged periods of non-use, baseline calibration can be performed.
1. Enter the third menu, press F1, and the screen will prompt "Unplug
the plug and press the menu key to start calibration."
2. Press the MENU key to start the calibration.
During calibration, please note the following:
1. Do not connect the probe or input signal during calibration, as it
may cause calibration deviation or damage to the instrument.
2. Do not perform other operations during the calibration process.
Wait patiently until the calibration is complete.

Thanks a lot.

[indman]

Guys, pls do you know how the baseline calibration works on ZT703S?
Maybe I am doing it wrong, but mine always ends with a message "check failed"

Enable both channel CH1 and CH2 in the menu and repeat the calibration. This feature has already been mentioned on the topic pages before.

[LucSVK]

Guys, pls do you know how the baseline calibration works on ZT703S?
Maybe I am doing it wrong, but mine always ends with a message "check failed"

Enable both channel CH1 and CH2 in the menu and repeat the calibration. This feature has already been mentioned on the topic pages before.

Thanks. It helped. Sorry, I tried to search for keywords calibration, baseline and so on but I wasn't able to find it.

[AGMAR1]

Thanks ajar171 for his time and explanation of how the processing works in this meter for two modes.

1) I won't waste your time with additional questions because you are working on a completely new version and you have completely deleted the previous one. Switching to two different versions takes time and I understand that you are not able to determine the converter sampling or buffer width for individual time bases.

2) For me, this device lacks information on how the sampling frequency and buffer width change depending on the time base and the number of enabled channels. Such information gives me a preview of how short pulses will be detected depending on the base.

3) I had the opportunity to check the meter in this respect of peak detection and it is quite good. The youth tormented this device in a real situation where there was an error (a peak of several microseconds) of the load (current voltage converter) and the 703s detected it as well. I also checked what pulse widths it detects without losing in Scroll Mode: 200ms and more, for a time base of 200ms pulses with a time of 40 microsec.

[ToKreTu]

Mine has the BNC issue as well (BNC cables won't go on far enough to "click" into place, very frustrating).
How hard is it to remove the plastic behind the BNC connectors? I may go this route so I don't have to make a custom "connector saver" that fits the BNCs.

I just removed the thick sticker at the bottom of the cavity of the two BNC connectors with a small screwdriver (see pictures before and after) and then was able to conect all my scope probes and BNC cables without any problems.

[Baltar]

Hey deforme,

I had the same issue with my 703, i.e. that the multimeter stopped working, no measurements shows, no reaction to the F1-4 buttons.
In my case it was working at first but after using once, it stopped working.
However, I was able to fix it by applying some hot air to the DMM chip, which is labeled DM1109CEN (left to the battery). I heard it clicking like there was some tension. 

[bson]

As far as I know, reverse engineering is legal everywhere

While you don't copy the original code, if the result is the same, totally legal

Same in the U.S., reverse engineering is only illegal for the purpose of defeating copy protection.  Which obviously only applies if someone distributes copies, but no one here I think has any interest in distributing the OEM firmware, or more specifically using it in competing products.

Same with hardware, without cloning there's no copyright issue and reverse engineering isn't a problem at all.  There may be patents, but they don't prevent reverse engineering (in fact patents explain how things work) and doesn't prevent DIY projects.

I think it would be great to have open source instrument software.  Did anyone figure out what the LQFP-100 is?  STM32 of some flavor?  Presumably something with an LCD controller on a set of pins, which would narrow it down substantially...

[LucSVK]

Ajar171 has mentioned it's something like .. STM32H7B0VBT

He attached a pinout at page 34 of this topic.

[ajar171]

Just to set some things straight:

- I will upload the source of my firmware to github, when there is something usable to upload. Please wait until at least the DMM part is finished and working properly. The firmware is being written from sratch, no original code used, so it takes some time. I just don't want to post the schematics, that I have reversed.
- I have not recovered the decrypted firmware from the meter as it is just simply not worth any effort
- If you erase the firmware from the meter, there is no going back. It is not possible to install the stock firmware again, because we don't have the encryption keys. The stock firmware has to be erased, before flashing a third party firmware to the meter.
- To flash an inofficial firmware to this meter, an SWD debugger is necessary (something STM32Cube compatible, at least a 2€ ST-LinkV2 clone)

[Atlan]

Can't you disconnect the original uP and install a new empty one?

[ajar171]

Can't you disconnect the original uP and install a new empty one?

Sure, that is always an option 
The MCU costs 6.2€ at Mouser if you buy a single piece, so it is not that expensive

[AGMAR1]

1) ajar171 Thanks for the post starting with "Just to set some things straight:"
2) This post really describes the situation for a certain group of people (like me). The most important thing is that you can't go back to the original version.
3) Unfortunately, for some time we are doomed to the ZOYi company "as user tol said"
4) I really support and admire this project you are doing.
5) Out of curiosity, has anyone managed to get a response from ZOYi about the bugs... Because I haven't received one yet.

[Astur_TorQue]

Just to set some things straight:

- I will upload the source of my firmware to github, when there is something usable to upload. Please wait until at least the DMM part is finished and working properly. The firmware is being written from sratch, no original code used, so it takes some time. I just don't want to post the schematics, that I have reversed.
- I have not recovered the decrypted firmware from the meter as it is just simply not worth any effort
- If you erase the firmware from the meter, there is no going back. It is not possible to install the stock firmware again, because we don't have the encryption keys. The stock firmware has to be erased, before flashing a third party firmware to the meter.
- To flash an inofficial firmware to this meter, an SWD debugger is necessary (something STM32Cube compatible, at least a 2€ ST-LinkV2 clone)

Thanks ajar!

Don't rush yourself... the firmware will be ready when it's completed.

Everybody is expecting with excitement, it's normal! But here in spain we have a saying: "Vísteme despacio que tengo prisa" ("Dress me slowly, I'm in a hurry").

Take the time you need, i'll will be great while you don't abandon the project

thanks a lot

[vvzvlad]

I await the open firmware with great interest. As soon as it becomes at least a little usable for use as an oscilloscope, I will install it for myself and join the development (if the code will not be too complicated, I am not good at C++, only at pure C)

[patchbr]

It's a very good device, and I'm very satisfied with it. However, I'm unhappy with the resistance measurement. In my case, shorting the lead wire using the probe shows 0 ohm, but it actually seems to be expressing negative resistance. In this case, if the device can express negative resistance, I think the REL function can help me measure the resistance more accurately. Wait for the firmware update.

[tol]

It's a very good device, and I'm very satisfied with it. However, I'm unhappy with the resistance measurement. In my case, shorting the lead wire using the probe shows 0 ohm, but it actually seems to be expressing negative resistance. In this case, if the device can express negative resistance, I think the REL function can help me measure the resistance more accurately. Wait for the firmware update.

My wires show 0.02-0.05 Ohm, never 0 or negative. And by the way, there is REL function, it is the red power button (short press).

[LucSVK]

It's a very good device, and I'm very satisfied with it. However, I'm unhappy with the resistance measurement. In my case, shorting the lead wire using the probe shows 0 ohm, but it actually seems to be expressing negative resistance. In this case, if the device can express negative resistance, I think the REL function can help me measure the resistance more accurately. Wait for the firmware update.

I wonder why are you so satisfied with this device. The device is in fact terrible.  The scope part is buggy, there is a lot of info about this in this topic. DMM is maybe acceptable, but it's not so extraordinary. You can buy for example ZT225 which is 25 000 counts and I believe the same accuracy, as well, but has also temperature measuring, NCT etc. + some small but solid oscilloscope. For example if I had the information what I know right now, I wouldn't buy it. But unfortunately I wasn't able to return it back where it came from because of holidays. So right now I am stuck with this crappy device.

[oliv3r]

I got one of the ZT-703S's as an impuls buy, and I'm quite happy with it. It's a neat little device, that's "good enough".

I wouldn't use it for proper scoping (got a mso5000 for that), but to quickly checkout stuff, validate/verify things, see what's going on, it's perfectly fine. For the 'Arduino crowd' it's a fine scope.

For the regulars of this form, I get the critique, but I had the same with the DS1074. My statement was, these devices are dirty cheap, put them on every EE's desk. Useful and makes them feel valued. Have a proper scope in the lab for the die-hard EE's or critical measurements.

Mind you, we where an embedded linux shop, so we ran things at 'consumer speeds'. E.g. the most complex stuff being looked at was power supplies and their ripples/startup voltages, current dips, and the usual I2C and SPI inspection.

I would argue today, that the ZT-703S is even good enough for these tasks, except logical analyzer work, but the DS1074 etc where not great at those tasks either (they worked, most of the time).

As for ajar171's efforts, I bow deeply for you and wish you the best. I will be a happy tester once it becomes functional enough!!

I've reverse engineered PCB's (often from just photo's) in the past and done even drawn kicad schematics from it. So if time permits, I'd be happy to play with this for a bit. Obviously I don't want to fully duplicate your work

[tol]

5) Out of curiosity, has anyone managed to get a response from ZOYi about the bugs... Because I haven't received one yet.

I wrote to zotektools.com and zoyitools.com, but got no answer. They are so busy accepting the payments that they don't have time to answer to their customers To say the truth, it feels like they are not willing to develop it further so they make it look as if they don't receive our bug reports, because if they answer something they will have to fix these bugs, otherwise it will be difficult to look as a professional manufacturer that they pretend to be. But if they don't answer anything they can always say that they don't know that there are any bugs in their products and they are clean. Just for the purpose of fun, you can write to them again, but this time don't say anything about the bugs, write that you want to place an order for 10000 pieces, I bet you will get an answer pretty much soon

[chebo]

I wrote to zotektools.com and zoyitools.com, but got no answer. They are so busy accepting the payments that they don't have time to answer to their customers To say the truth, it feels like they are not willing to develop it further so they make it look as if they don't receive our bug reports, because if they answer something they will have to fix these bugs, otherwise it will be difficult to look as a professional manufacturer that they pretend to be. But if they don't answer anything they can always say that they don't know that there are any bugs in their products and they are clean. Just for the purpose of fun, you can write to them again, but this time don't say anything about the bugs, write that you want to place an order for 10000 pieces, I bet you will get an answer pretty much soon

I also wrote to them several times with exactly the same result. But Brymen answered me almost immediately (I only had to remind them about myself once  ).

[indman]

They are so busy accepting the payments that they don't have time to answer to their customers

That's why even earlier I wrote something like this
https://www.eevblog.com/forum/testgear/new-zoyi-multimeteroscilloscopes-zt-70xs-up-to-50mhz250msps-(nov-2022)/msg5722843/#msg5722843