Hacking the Victor VC-921

[itsthatidotagain]

I picked up a Victor VC921 True RMS pocket multimeter to add to my growing pile of ultra cheap (and mildly hazardous) multimeters used mainly for low voltage microcontroller hacking, and naturally the first thing I did was take it apart.



It seems there are at least two variants of this meter, the one I have is the 4000 count "true RMS" variant.

It turns out this meter is based on the DTM0660 chipset, which means  it is possible to hack in a serial port (using an optoisolator IRLED and a 100 Ohm resistor), so that mod was promptly done. NOTE: You will need to update the contents of the 24c02 eerom to switch this on.

More details here.
 
For additional fun, I also modified it to 8000 counts.
It should also be fairy simple to add a Select and Hold button, and perhaps even Temperature modes.

A full set of teardown pictures are available here...



I also added the DTM0660 protocol to QtDMM (a Qt based DMM readout and logger).

Code on Github here.... https://github.com/pingumacpenguin/QtDMM-DTM0660-Version



Enjoy.

[tronde]

Some reading from Russia:

While versed with his instrument, a lot of looking for information, came across the instrument baby Victor VC921 several times. Think again failed to include in its frequency device, then buy something else with a frequency counter. VC921 has multiple versions, I was looking for just such where they were and Hold the Select button under the battery cover. ... I bought and upgraded.
ALL WORK MODES!

Scroll down and use google translate
http://kazus.ru/forums/showthread.php?t=112135&page=68

more
http://kazus.ru/forums/showthread.php?t=112135&page=69

[itsthatidotagain]

Some reading from Russia:

While versed with his instrument, a lot of looking for information, came across the instrument baby Victor VC921 several times. Think again failed to include in its frequency device, then buy something else with a frequency counter. VC921 has multiple versions, I was looking for just such where they were and Hold the Select button under the battery cover. ... I bought and upgraded.
ALL WORK MODES!

Scroll down and use google translate
http://kazus.ru/forums/showthread.php?t=112135&page=68

more
http://kazus.ru/forums/showthread.php?t=112135&page=69

Thanks for that, I had already read it, but it makes interesting reading for those following on. If you look carefully at http://kazus.ru/forums/showthread.php?t=112135&page=69 the image of the DTM0660 based variant includes my knees.  alvadep has "borrowed" the image from my Google Album here => https://photos.google.com/share/AF1QipPykJgrz2vMySXTkFdst6YsfoTs0Mzs1vmWZXa-XQ5EGBxVeRmFiqj-jO2c44IFcA?key=T01ITXVCa015U0x5WV9UZUV6dUdiSGdXUTBENF93

The rest of those pictures might also help anyone trying to replicate the hack.

This might also be of interest. http://stm32duino.com/viewtopic.php?f=45&t=1296
 

[tronde]

Ready for surgery.

As far as I can understand:

Anode of LED to pin 8 on 24c02 and cathode of LED to pin 20 on DTM0660? Series resistor to the most convenient pin.

Make sure I have +3,3V on pin 8 / 24c02 from programmer as a power supply while programming.

Anything else to consider?

[pascal_sweden]

Do they also sell a version with all options provided by the chipset enabled by default?

How much does that one cost extra?

Or is that one not sold under Victor but under another brand?

[tronde]

I think I am in need of a helping hand...

I have got this programmer and clip as sugested in the UT210E tread.

http://www.ebay.com/itm/252228485325
http://www.ebay.com/itm/252135254293

I use the parallel driver and program version 1.13 from here

https://tosiek.pl/ch341-eeprom-and-spi-flash-programmer/

because virustotal.com indicates no extra payload in the *.zip for 1.13.

I have seen this on youtube


and I am aware of the correct orientation of the clip and the program says the programmer is connected so I assume the driver is OK.
I have +3,3V on pin 8 / 24c02 and the same on pin 56 / HY12P6x.

When I try to read the 24c02 I get only 00 00 00...
If I try to read without connecting the clip I get only FF FF FF..., so something is alive.

I can choose between different manufacurers in the program, and I have selected 3V chips, all 24c02 of course. Same result for all.

What have I got wrong? 
I have zero experience with seraial EEPROMS. The VC921 apperas to be OK after the reading so I guess I have not damaged anything.

[tronde]

I have a lot to learn...

I read about another CH341 programmer, and it seems like they are not meant for in-circuit programming on the fly. A suggestion was to stop the targets x-tal oscillator. I paralleled the x-tal with a 1k resitor, and now I have read the chip. Next will be to figure out how to program it.

[tronde]

Conclusion:

The cheap CH341 prorammer can read and write to the 24c02 if we clamp down the x-tal oscillator. No other modifications needed.
I used a 1k resistor because I dislike to short pins on an IC without being sure its OK.

At the moment I have a flashing led and a nice pulse-train on my scope when the RS-232 function is activated.
I need to tweak the optical receiver as I use other parts than suggested.

[tronde]

Some tweaking got me a working optical receiver.

Our Russian friends suggested a software from PeakTech.
They are obviously nice people, so they offer the software free of charge to everyone.

http://www.peaktech.de/productdetail/kategorie/software/produkt/dmm-tool-basic.1034.html

I used the large complete ISO version, but I think the smaller EXE will do as well. There are no need for drivers to be installed, except the one for the serial to USB coverter.  Be aware that the files are compressed with Win rar. A free evaluation copy will do. http://www.rarlab.com/download.htm


When installed, select PeakTech 3415 as device in the connection tab, and off we go.

I noticed that the transmitting LED in VC921 is still lit when the instrument is automatically powered off. No problem with manual power off.

Next will be to try bluetooth serial communication.

Proof of function.

[tronde]

I have played more with this little cutie.

"macboy" gave inspiration to try the mV-ranges.
https://www.eevblog.com/forum/testgear/canadian-tire-mastercraft-dmm-new-and-old-revision-teardown/msg927276/#msg927276

They are available here too, and seems quite useful. They must be programmed to either the ohm, capacitor, diode or continuity position of the rotary switch. I don't use continuity, so it became DCmV. Continuity became a second function under ohm, so it is available. If you don't want to add the "select" button and have no need for one or more of the original four switch positions, you just program for instance DCmV as first on continuity as I did.

It's a lot of info floating around on the internet about the DTM0660, and I have tried to compile the most useful for VC921 into the modified HEX-dump attached.

As of today I have RS232, 8000 count scale length, temperature in °C and °F, warning level of 110V AC/DC and overload for 120V AC/DC (I don't trust VC921 for 230V) NCV, and toggle between AC and DC when in ACV or DCV.

I have found that the TX-LED for RS232 becomes lit when the instrument enters auto power down, so I have disabled APO. I have also found that the warning and overload does not function as expected if programmed to a value below 100V. In my instrument with 8000 counts, the warning did not work at all, and it entered overload at 80V regardless of what I programmed. From 100V upwards it seems to be OK.  In the Chinese datasheet for DTM0660 they suggest a 500 ohm resistor in series with the TX-LED. I have not encountered any problems using that, and the benefit is less current consumption.

I am awaiting some small micro push-button switches from China so I can get the "select" on front of the instrument. While waiting I made an X-ray like image with a 5mm raster to help finding some free space for the switch. I attach it here.

[indman]

Hi,friends!
On a photo buttons which I used are visible. I changed a firmware to 10000 counting, flight normal. On a photo comparing with HP-890CN when sampling about the ION of AD584-10Volt(Agilent=9.98857) and also from independent reference supply source of Uout =8.9027.
On measurement of capacity - upper limit 99.99milliF. The lower limit at VC921 managed with the help of constants to be held on to 50 pF. Self-correcting of zero on capacity in a firmware at it is driven into minus if to draw out up, then nonlinearity of measurements appears.
On measurement of frequency in the "Hz" mode - I decided to check an upper limit. Apparently on a photo, takes also 100 MHz, but in case of Vpp>10V from the generator without loading.

[tronde]

Hi indman, I try to follow the Russian forum but some details are lost in translation.

I can see that some of you use a separate button for Hz/Duty. What is the reason for that? Do you get access to more functions than by using a combined Hz/Duty and REL button?

[indman]

Hi, tronde! Yes, I added 3 buttons on the front panel of a multimeter. I will explain functions of each button. "Hold/Backlight" - can add illumination of the display and holding of indications. "SELECT" - if to retain this button clicked in case of switching on of a multimeter, then the APO mode won't work, also this button has awakening function if the device entered a doze mode. "Hz/Duty" - this button allows to include measurement of frequency in the mode V ~.
I think that clear I explained everything, excuse for my English! 

[tronde]

"Hz/Duty" - this button allows to include measurement of frequency in the mode V ~.

OK, so when you use a separate Hz/Duty button you get the option of frequency in ACV. What have you changed in the EEPROM to achieve this?

I have seen some images published in a zip-file by AST78512 (18.07.2016, 14:47 ) http://kazus.ru/forums/showthread.php?t=112135&page=69 so I understand that you cut some traces on the PCB, and connect the switches directly to the DTM0660 chip.

I am aware of the APO disable function, but I have found that the LED for RS232 transmit will light up when the instrument is turned off by APO if RS232-function is enabled in the EEPROM. This seems to be a bug, because the LED will use almost the same current (or even more) as the instrument without the LED. Is this bug still present when you use a separate button for Hz/Duty?

[indman]

I think that the photo of a board will explain everything. For operation of this mode it isn't necessary to do any changes in EEPROM. I connected the Hz/Duty button on contacts 31-24.
The RS232 mode isn't necessary to me therefore I didn't include it.

[tronde]

Thanks, indman. This makes a lot more sense than google's understanding of the Russian language...

I have tried it, and it works fine on the normal ACV function as well as the the extra ACmV function.

I am a little puzzled by this image. It's from the same zip as yours. It seems like they cut one trace? What is the reason for doing so? The translation does not make any sense to me. I have marked it with yellow.

[indman]

Ok!I will try to explain. Ast78512 assigned the Hz/Duty (31-24) function only to the blue button. And it assigned the "Rel/RS232"(19-24) function to one of 4 gray additional buttons. For this purpose it is necessary to cut off the track from contact 19 which goes on the blue button, otherwise it will hinder the correct operation of all functions.

After updating of a firmware, technical characteristics of a multimeter look as on a photo   

[tronde]

Thanks again, indman! This makes good sense. It is kind of challenging to grab all the finer details when I have to rely on google translate, especially when the discussion covers several different instruments as in the Russian forum.

I think I have all functions working now, except backlight which I have not tried yet. I will also try to change the RS232 protocol to Volfcraft VC840 as shown. "alvadep" also mention "PC-LINK" as an option for RS232. Is that the software for HP-890CN?

[indman]

No. PC-Link-is a software for a multimeter of HoldPeak HP-90EPC. The most interesting is the fact that else none of owners of HP-890CN managed to include the RS232 mode?! Possibly, this mode is disabled in the DTM0660 processor which is set in this model. And in VC921 the RS232 mode works perfectly.

[tronde]

If you read the documentation for HY12P66 you will see that the chip is one-time programmable to suit your needs. It is also an RS232 receive function available for programming in addition to the transmit we use. I guess it is meant for a remote controlled instrument.

It seems like Victor saved some money and re-used a chip design from a more advanced instrument.
The EEPROM for VC921 contains current modes, hFE, mV  and temperature as functions on the rotary switch as well.

Compare the hex dump shown earlier with this image from the Chinese data sheet for DTM0660.

[indman]

Yes, I agree! I would make in addition some more buttons on the front panel of a multimeter, for example, MAX/MIN,hFe, but is very difficult to find the empty seat in this miniature casing.

[tronde]

I think you must add some more circuitry and probably make some changes to the rotary switch if you want hFE and current modes. The data sheets show some examples.

Another thing - you have extended the counts to 10000. I have read that the AC/DC converter is a digital signal processor, and that it will fail if the measured value is above ~12000 internal counts. A pure sinus will have 14142 internal counts for 10000 counts AC voltage. This should give that a pure sinus ACV of more than ~8485 counts will show some error. Have you tested this?

[indman]

No, I didn't test in details the ACV mode. I work generally with the mode DCV therefore I was interested in operation on measurement of constant voltage more in case of 10000 counting. Besides it is necessary to remember that there is the known problem of this update - in case of 10000 counting automatic switchings of limits only about 400 Hz correctly work in the ACV mode. If alternating voltage with a frequency over 400 Hz or there are high-frequency harmonicas, then the automatic machine works not correctly. It is in that case expedient to transfer to a manual choice of limits.

[tronde]

Inspired by hgg in the UT-210E tread

https://www.eevblog.com/forum/testgear/a-look-at-the-uni-t-ut210e/msg1058296/#msg1058296

I did som testing with an modified and an unmodified VC-921. I used 60Hz sine.

The modifed (8000 counts plus added functions) shows some strange behaviour in the 800mV range (06H). The unmodified instrument has 400mV native. Between about 150mV and 500mV it shows some 5 - 10mV too much, decreasing at higher value.

I have added the 80/800mV ranges as well (02H). No errors there. The unmodified VC-921 did not show any errors in the native 400mV range.

Anyone experienced something like this with their hacked VC-921?

[indman]

A pure sinus will have 14142 internal counts for 10000 counts AC voltage. This should give that a pure sinus ACV of more than ~8485 counts will show some error. Have you tested this?

Hi! I checked operation upgraded (9999 counting) multimeters of VC-921 and HP-890CN in the ACV (mV) mode. From the generator the sine signal with a frequency of 60 Hz is measured. Video can be watched according to this link https://yadi.sk/i/F2N06kz9ybS4v