Hantek - Tekway - DSO hack - get 200MHz bw for free

[MasterFX]

Yes I know. Therefore, I was not clear why the interest for VOLTCRAFT DSO-3062C. MasterFX will buy 1062C so I'm waiting hes review.
Does anyone else have experience with 1062C, and witch firmware they use?

Not a review but a Systeminfo Screen. Looks it is almost the same but it has e8 instead of the e9 at the end. Seems like it has something to do with the FPGA.

It looks better than on the picture on the conrad page. It has a black backcover!

Conrad also provides a CD with the sourcecode on it

[brainwash]

Just got my Hantek clone from Germany, after almost one month of waiting, 300E+VAT. I was not watching Conrad and missed the offer. Or perhaps they bought one from Conrad and rebranded it, who knows.

Plugged it in at work, connected the 1kHz test signal -> white screen. Ok, fair enough, some other guy was twisting the buttons without knowing what he's doing, so maybe he found a bug. Restarted the scope, played for 20s, again white screen. One restart and 15s later another white screen. The scope was still responding so I assumed (after googling) that the LCD connector was off from transportation.

Came home, started the scope with no signal and it ran fine for ~15min. I connected the test signal and it crashed almost immediately.
After opening I saw that the connectors looked fine and solid, regulators were not extremely warm. Being out of ideas I just removed and plugged back the two power connectors coming to the main board, it seemed to work fine afterwards. I will test it for some time before doing the hack to confirm it is actually running fine.

System info:
model: DSO5062B
SW: 2.06.3 (121023.0)
HW: 10070x555583eb
lcd.front.ts: 0.0.0

Initial usablity impressions: power button feels really cheap and with reversed feedback, the horizontal and vertical positions knobs cannot be rotated with one finger, but the V00 and trigger ones almost can. Somewhat the opposite of what it should be. Vertical LCD viewing angles are pretty poor. On the good side the boot time is pretty short, controls are most of the time responsive, menu layout is decent, lots of options.

[tinhead]

Being out of ideas I just removed and plugged back the two power connectors coming to the main board,
it seemed to work fine afterwards.

that should be good enough. The connector rating is for sure high enough (on paper) but only if it's plugged properly.

the horizontal and vertical positions knobs cannot be rotated with one finger

one finger, urgs, are you iphone generation kid or what?

Vertical LCD viewing angles are pretty poor.

Ehm, this device is designed to be used with 6 o'clock and not 12 o'clock view angle.
When the DSO is stright/in front of your eyes or above them the display is simply perfect. For me, having a lot of other gears
here in front of my eyes (and in another one level above them) this is a perfect viewing angle.
My desk is for DUTs and not gears, and this is not only because of desk space. Having more that 2-3 gears you will
always chose such setup, you can't simply have them all on desk, multilevel above desk is increasing efficiency and
usability.

Unfortunatelly more and more gears are designed to be used below the eyeview line (so with 12 o'clock).
This might be "cool" and useful for marketing departement (to shot some nice pictures, with happy engineers
sitting in front of 10 sq. m desk, having one small PCB to test and 100k DSO in front of them - a typical
combination of unrealistic things).

Sure, in the real world you might have DSO on your desk, but then you will still don't want to look from top on it,
but stright to display (which is why there are plastic foldout feets under each lab gear to align the angle).

[brainwash]

Hi tinhead, thank you for this thread, it was the reason why I bought this scope.

I agree with everything that you wrote, so to clarify:
- one finger turning is better if you want to move the waveform fast around since these knobs do not have any acceleration on them.
- vertical viewing angle is for better portability, I already have a bench scope and sometimes I just wish to measure something in another room or in the car

Oh, I wrote the price wrong, it was actually 285+19%

[marmad]

Sure, in the real world you might have DSO on your desk, but then you will still don't want to look from top on it,
but stright to display (which is why there are plastic foldout feets under each lab gear to align the angle).

This is a good point which prospective scope buyers should take into consideration when deciding which scope to buy. The designers of each model have a different idea of the optimum placement for the DSO and choose an LCD accordingly. For example, if you want to place your scope on a shelf above the workbench while using, the Rigol DS2000 series would be a bad idea - it has a crap viewing angle from below - it's definitely designed for bench top use. On the other hand, the HanTekCraft works very well on a shelf.

[MasterFX]

Here is the fw dump of my Voltcraft DSO-1062D: http://www21.zippyshare.com/v/61232718/file.html

[MasterFX]

I just wondered if it is possible to hack the DSO to 200 MHz by using DSO-USB-Tool (http://www.dreisiebner.at/dso-usb-tool/)
Because with this tool you're able to read and write the system files /sys.inf,/tmpdst, /logotype (see attached image) and execute system commands via shell.

And what about the 83e8 and 83e9 FPGA?? What are the differences?

[tinhead]

I just wondered if it is possible to hack the DSO to 200 MHz by using DSO-USB-Tool (http://www.dreisiebner.at/dso-usb-tool/)
Because with this tool you're able to read and write the system files /sys.inf,/tmpdst, /logotype (see attached image) and execute system commands via shell.

of course it is

And what about the 83e8 and 83e9 FPGA?? What are the differences?

In principle 83E8 design is slower, especially in dual channel and memory depth >= 40k there are big diferences.

I've made detailed table (for timebase 200ns/DIV to 2ns/DIV, other timebase settings affected as well)

EDIT: I've added some comments and changed from 800ns to 200ns/DIV which makes more sense as 800ns/DIV and
400ns/DIV are more complex. But i think this table is good enough to understand the diffs.
I've added MSO findings as well, MSO is using even never 83E9 FPGA design version, however the MSO firmware
itself is slowing sampling down (always - which is bug because it should only wen LA enabled) to synch the LA data
to DSO data. This shows me that the LA is sampling with max 250MS/s when 40k or 512k samples are enabled,
which is good enough for that amount of sample memory.

EDIT: I've added overview of FFT differences, they are important as well.

EDIT: some of the things i said here are wrong, the firmware - at the time of testing - was cheating about the enabled memory
depth, therefor i got higher values than they really are (none of the FPGA designs allows 400MS/s or 500MS/s when both
channels and long memory enabled). Still, it make sense to change to 83E9 design if someone have 83E8, however it does
not make sense to downgrade to 83E9 if someone have already 83EA/83EB/83EC/83ED (or later) version installed.

I living the attached picture for historical reason, but as said, none of the designs can sample with 400MS/s or 500MS/s
while dual channels and long memory enabled. The maximal sample rate in long memory mode with dual channel
enabled is - and this depends on model, 200MS/s or 250MS/s.

[tinhead]

What these 83E8, 83E9 means ?

In principle they are expansion stage numbers, e.g. on the slower/cheaper
models (Tekway DST4000, DST3000) they marked as 83ED, 83EE, 83EF, 83F4 and 83F5.
The firmare (dso.exe) is reading back these number during startup from FPGA register
and changing DSO features to what they should be for specific stage number.
These are, afaik, sample rate, memory depth, filters, equ sampling, avg sampling.

For the DSOs in this thread (Handheld and Benchtop) there are two expansion stage
numbers, 83E8 and 83E9.

Even if most ppl recognized the 83E9 since i think Nov 2011, they were available from the beginning.
The first "fast" 83E9 version was already in Dec. 2009 available, however with sme bad as trigger issues,
so Tekway downgraded DSOs to 83E8. Later Hantek tried to pimp up the mainboard and the FPGA design,
the result was a disaster model hw 1005 and very unstable FPGA/firmware.

Finally the issue was solved and with hw1007 in Nov 2011 the "fast" FPGA design version was rolled
out to production DSOs. The hw 1007 83E9 FPGA design is however very hard on limit, to fix a littlebit
the skew is no room anymore, an FPGA overclocking is not possible as well (max cloc in 105MHz).
With older, but slower, FPGA design 83E8 the FPGA was working with no issues with 125MHz input clock,
giving max sample rate of 1,25GS/s

----------------------------------------------------------------

If you wish to test/play arround with available FPGA design, see attached file.
I've only included the official production versions, there are few test versions as well
but i don't think they really important.

WARNING - if you own hw1005 DSO remember that your DSO is already unstable and will probably
not like any FPGA deisgn changes.

For the benchtop B/BM/BMV models in folder DST1000B there are:

dn_hw0_83E9_date_091201.rbf (very first "fast" FPGA design for DST1000B)
dn_hw0_83E8_date_100224.rbf (the first "step back" version)
dn_hw1005_83E8_date110225.rbf (a complette Hantek hw1005 disaster)
dn_hw1005_83E9_date110423.rbf (... bit updated disaster)
dn_hw1005_83E9_date110427.rbf (... and finaly the only stable version for hw1005)
dn_hw1007_83E8_date110522.rbf (back to the root)
dn_hw1007_83E9_date111122.rbf (first stable "fast" version 83E9)

For low cost models Tekway DST3000, DST4000 series and the Hantek DSO5000C (which i think didn't exists anymore)
you will find a subfolder "DST3000_4000_models" in the attached file. Remember, these designs are NOT compatible
with DSOs from this thread, meaning Tekway DS1000B and Hantek DSO5xxxB/BM/BMV. I'm attaching these
files only for test purpose/testing.

I've included as well design from Handheld Hantek DSO1xxxB/BM/BMV

dn_handheld_hw1001_83E8.rbf

This is, from the point of skew between ADCs (bug 6 in the bug list, see attahement in the first post of this thread)
the best design ever - however it is 83E8 version only and it requieres on Benchtop to execute factory calibration
(not self cal !!!) to work properly with trigger. This is due different skews and trigger circuit.
Vice versa you can use benchtop designs on handhelds as well, however you need to execute factory caibration as well.

EDIT: I've added as separte attachement the FPGA design from MSO models.

dn_MSO_83E9_date111123.rbf

It seems to be never than the latest DSO 83E9 version, it is for sure compatible with B/BM/BMV benchtop models.
To use with handheld it require additionaly factory calibration. As far i think the only difference to
dn_hw1007_83E9_date111122.rbf design is clock out/enable from FPGA (K9, F6) to I/O header, which of course
have no function as long there is no LA board added. I haven't tested it deeper, no time for that now.

How to install? Simply copy to flash drive from there to root fs of the DSO as dn.rbf, e.g.
cp /mnt/dn_hw1007_83E9_date111122.rbf /dn.rbf

delete then /param/sav/run* and reboot the DSO.

After that run self calibration (at least, see notes above if factory cal necessary as well), this will synch the
firmware t the FPGA design.

[carloscuev]

Very interesting tinhead, any way to know which 83E8 version I got? Maybe I have the best design ever 83E8 and will just ruin it upgrading it to the latest 83E9

[tinhead]

Very interesting tinhead, any way to know which 83E8 version I got? Maybe I have the best design ever 83E8 and will just ruin it upgrading it to the latest 83E9

copy from DSO to flash drive and binary compare on PC with attached versions

[carloscuev]

copy from DSO to flash drive and binary compare on PC with attached versions

hehe I suspected something like that knowing that linux sees it as a file. Thanks !

[tinhead]

copy from DSO to flash drive and binary compare on PC with attached versions

hehe I suspected something like that knowing that linux sees it as a file. Thanks !

in principle you could check file timestamp, but there is a "small" problem.
Every time the root fs was updated the timestamp was changed, so even if files are binary the same
the timestamp may vary.

The best is to compare them binary on PC (or DSO - however the last time i've tried diff or cmp the DSO linux crashed)

[MasterFX]

The Voltcraft DSO-1062D has the "DN_HW1007_83E8_DATE110522.RBF" in it.
Interestingly dn_hw0_83E8_date_100224.rbf and DN_HW1007_83E8_DATE110522.RBF are binary the same.

The dn_hw1007_83E9_date111122.rbf is less than half the filesize, seems they throw much garbage away.

What about the factory calibration on the benchtop DSOs?

[walt]

What these 83E8, 83E9 means ?

Hi,  tinhead
hw version: 0x555583e8

to experiment or not to experiment ?
that is the question
(c) almost Shakespeare

[tinhead]

The dn_hw1007_83E9_date111122.rbf is less than half the filesize, seems they throw much garbage away.

hehe no, it is simply compressed.

What about the factory calibration on the benchtop DSOs?

very first posting in this thread, look for "factory calibration" links.

[tinhead]

a person from Germany asked me if there is a chance to request from HanTekway to remove the automatic
20MHz lowpass filter. Well, maybe they will do it some day, but for now i have DIY solution.

You don't know what i'm talking about? Probably you do. Each time while changing volt/DIV from 5mV/DIV
to 2mV/DIV the firmware is automatically enabling the 20MHz lowpass. While this is only pissing me off
a bit there is another example which really sucks. When you set to 2mV/DIV and disable the 20MHz lowpass
you can't then change anything in Acquire menu (e.g. sampling type from normal to avg, or even
not the memory depth) without having the 20MHz lowpass activated again.

I've attached patched dso.exe (firmware 2.06.3_121027.0), to install it just copy it over uart to DSO and reboot.

If you don't have uart connected or linked use the tool from Peter

http://www.dreisiebner.at/dso-usb-tool/

to copy it from e.g. usb flash drive to DSO, e.g.

cp /mnt/dso_update.exe /

After the reboot the startup script will move the dso_update.exe to dso.exe and your DSO will
startup with patched version (it will display  2.06.3_121027.1 )


For those of you who wish to learn what i did in the firmware (note: this is fw for 2.06.3_121027.0).

 - to disable 20MHz lowpass while changing Volt/DIV from 5mV to 2mV/DIV


 In the firmware there is function "DoCoastCountVoltBase" (hex address 0x3BE88), which
 contains two jumps to another one function - this is what i changed from "BL BwLimitWhenVbChange"
 to "NOP". The first address to patch is 0x3C008, the 1C FD FF EB need to be repalced by 00 00 A0 E1.
 The second address is 0x3C098, here the F8 FC FF EB must be repalced by 00 00 A0 E1.


 - to disable 20MHz while operating in Acquire menu


 In the firmware there is function "InitLcdUnwaveareaShow" (hex address 0x2E34C), which
 contains two jumps to 2 other functions. The first change is from "BL SetBwLimitVal" to "NOP",
 the second is "BL BwLimitWhenVbChange" to "NOP". The first address to patch is 0x2E52C,
 the A8 12 00 EB need to be repalced by 00 00 A0 E1. The second address is 0x2E534, here
 the D1 33 00 EB must be repalced by 00 00 A0 E1.


As said above, these changes are for current fw 2.06.3_121027.0, for other versions you will
have to disassemble both (this and target fw), compare the affected functions to find out the
new address and the patch it away.

EDIT: Btw, there is another one situation where the fw is auto enabling the 20MHz lowpass,
when you se both channels to 2mV/DIV and change to XY from YT. In my opinion this is ok,
i don't see a reason to have lowpass disabled here - but if you don' t like it, well patch it away.

[brainwash]

Excellent! I was wondering why no one was complaining about this.

[leverler6]

im new to scope hacks (or rather linux hack???)

but reading this thread up to 40++ i have to post this, you sir Mr TinHead is amazing! i salute you ...

i currently do not have a DSO, and came about to hunt for 1.

i am very impressed with the agilent DSO. their screen refresh rate is touted at 50k ...

of course, i cant spend that kind of money ...

so i was wondering, after seeing this --> ... it does seem like this little DSO have a raw but amazing refresh rate. does any 1 know approx what is it? 1k refresh? 2 k?

also i found a ebay seller that sells 5102 for USD436 ... im not sure if i should order from them. after seeing many feedback that forumers have bought theirs for USD5xx, i wonder could anything be wrong with this? http://www.ebay.com/itm/New-7-LCD-USB-DSO5102B-Hantek-Digital-100MHz-2-Channel-Oscilloscope-1GSa-s-/251189174571?pt=LH_DefaultDomain_0&hash=item3a7c0aa12b

i am of course tempted to carry out the hack mod :p

[tinhead]

... it does seem like this little DSO have a raw but amazing refresh rate. does any 1 know approx what is it? 1k refresh? 2 k?

Tekway said 2500 wfms/s

http://www.tekway.net/views2.asp?newsid=205&sess=2

which they confirmed after i asked "why user manual i having 2000 instead of 2500".

I actually made some measurments 1.5y ago, showing what the DSO is caable to do:

https://www.eevblog.com/forum/chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg60316/?topicseen#msg60316

When i compare (with latest firmware loaded), pure visually, to Tektronix TDS700 series (yes, i bought again one. I
was very disapoited, Hantek/Tekway promised to release 4ch DSO in first Q 2012, but they didn't and i needed in
summer a 4ch DSO) there is only a small difference*



so i think there is really something between 2000 and 2500 wfms/s

* - Tektronix trigger out is connected to freq counter, Tek is set to not capture too much (to have a chance to compare
 with Tekway/Hantek) - on the video ~6000 wfms/s. Test signal is coming from Yokogawa Signal Gen, it is set to
 produce ~ 50000 jitter frames.

[marmad]

it does seem like this little DSO have a raw but amazing refresh rate. does any 1 know approx what is it? 1k refresh? 2 k?

Keep in mind that any DSO manufacturer that specifies a wfrm/s rate (and many don't) uses the fastest possible rate - and there is only one single timebase setting + sample depth (with a single channel) that will achieve that rate. You can see in this table I made of the Rigol DS2072s waveform capture rates at all scale and memory depths that it peaks at the 20ns setting - but other DSOs have different 'sweet spots'. If you know what it is for your DSO, then you can specifically use that setting when glitch-hunting,

[bobblehat]

Just got a Voltcraft DSO-1062D. It appears to be another rebadged Tekway DST-1062B with 10070x555583eb hardware and 2.06.3(121012.0) software.

I've managed to hack it to a Tekway DST-1202B via USB using the DSO-BW-CHANGER tool available from here:

https://www.eevblog.com/forum/chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg91877/#msg91877

I now have a 2ns timebase position and a risetime of ~1.8ns for a fast pulse.
The amplitude of a 130MHz sine wave signal from a lashed up Colpitts oscillator has increased by 60%, so bandwidth has also been improved, although at this stage I cannot confirm full 200MHz capability.


It's available from Conrad and Voelkner in europe for 329 euros:

http://www.conrad.de/ce/de/product/122485/VOLTCRAFT-DSO-1062D-2-Kanal-Oszilloskop-Digitales-Speicheroszilloskop-Bandbreite-60-MHz

http://www.voelkner.de/products/376954/VOLTCRAFT-DSO-1062D-2-Kanal-Oszilloskop-Digitales-Speicheroszil.html


or in the UK for £290:

http://www.conrad-uk.com/ce/en/product/122485/Voltcraft-DSO-1062D-2-Channel-Oscilloscope-Digital-Storage-Oscilloscope


PS:Thanks to tinhead in particular and everybody else who has contributed to this forum.

[tinhead]

The amplitude of a 130MHz sine wave signal from a lashed up Colpitts oscillator has increased by 60%, so bandwidth has also been improved, although at this stage I cannot confirm full 200MHz capability.

oh well, so far i know nothing changed on hardware side so it should be still 200MHz.
Of course we need to watch out what we measure, with good signal source properly terminated
i have only 0.5dB amplitde nonlinearity, the total bw ends up ~ 245MHz (In the real world it's "only" ~218MHz)

See attached pic1



- the "S" cursor is on 0dBm in relation to CH1 position, the "E" cursor is on -3dB level.
The signal starts with 10MHz and increase by 20MHz per DIV (middle of the screen also 150MHz).

And yeah, of course we have to be careful how we measure - the setup above is typical Scope bw measurment,
but we have digital era, so it contins two common "errors" :
- the most modern oscilloscopes are using digital filters, they don't need to be properly implemented in 8s/DIV
- we undersample, this don't need to be accurate (and we can't enable avg here, at least long mem is helping a bit)

A better ay to measure the bandwidth is to check with FFT. Unfortunately my spread spectrum generator
is not calibrated properly, so i've used 50 snapshots - from a same signal generator as above picture - merged
together to show the frequency response.



there is small peak in the frequency response, it is exactly on 125MHz which comes from the ADC clock,
on the video below you can see it better:



As within FFT (and 200ns/DIV) the DSO is sampling with 1GS/s the accuracy should be acceptable,
or well at least the best we can get withou avg/hi-res mode.

This time "E" cursor is 0dBm level and "S" cursor on -3dB.

[bobblehat]

Hi tinhead,

I should be able to get my hands on a proper RF signal generator soon and then I can check the gain flatness up to and above 200MHz.

I'm guessing from the schematics that you have posted in this thread that to get proper HF performance from this 60MHz model, I would need to change some values in the front end.

Is that correct?

[tinhead]

I'm guessing from the schematics that you have posted in this thread that to get proper HF performance from this 60MHz model, I would need to change some values in the front end.

Is that correct?

this depends on the components in your DSO (i saw already 60MHz models with 200MHz frontend-values)
and of course on what exact you wish - if in worst case ~180MHZ bw are ok then you don't need to do anything,
but if you wish to get any available Hz bw then for sure you need to solder neew parts.