Hantek 2000 series - 2C42/2C72/2D42/2D72

[Evi]

I do not know how true this is, because the guy only claims to have hacked the device. Without any affirmations.


https://www.nickbel.com/2019/01/28/hantek-2c42-2d42-2c72-2d72-hack.html#cut

[tsman]

I do not know how true this is, because the guy only claims to have hacked the device. Without any affirmations.

He's managed to patch the firmware to reenable the AWG on the C models. He won't release the patch however. He knows roughly what the missing parts are but doesn't know the values or the exact DAC/opamp used.

R915 needs to be removed as otherwise a 400Hz signal is connected to the DAC output as well. Not sure why it is 400Hz. If it was 1KHz then it would have been then the calibration signal.

[Microcheap]

Any body measured more then 400V in DMM mode?

No. The datasheet states that the maximum voltage is 600V, but I don't use nothing that generates such high voltages and if I needed to measure something in this level, I would use a more trustworthy meter.

Drop voltage in diode mode 0.999 V max, is it a hardware limit?

Maybe, I couldn't find the multimeter's chipset datasheet, but apparently the CS7721CN is pin compatible with FS9721 that can measure diodes up to 1.5V. Hantek specifies the maximum 1V diode voltage in the manual, though.

I'm also attaching some slightly better pictures of the PCB. The marking on U12 was erased using some chemical that dissolved the IC's case.  I can barely see only the last 3 letters of what looks like a brand, it is ...FAK or ...PAK.
U14 and U15 are marked "3130", TPS73130 maybe? http://www.ti.com/lit/ds/symlink/tps73130-ep.pdf

[AxGxP]

Do you have ST-Link? Can you readout a dump of from your device. It will be interesting to compare it with lower version.

[gf]

Any body measured more then 400V in DMM mode?

Connected to my insulation tester, I measured 946V DC, so there does not seem to be a 400V limit.

DVM is isolated from the oscilloscope, and the insulation did withstand 1kV as well, >= 2000MOhm - beyond the limit of my insulation tester  .

Still it is specified only for 600V CAT II, so one should not go beyond that.

gf

[gf]

He knows roughly what the missing parts are but doesn't know the values or the exact DAC/opamp used.

He speculates OPA690, which is a (500MHz unity gain) voltage-feedback opamp.

The AWG of the Hantek 6xx4BD (which has roughly similar specs) uses a 5166ISZ behind the DAC902, which is a 1.4 GHz current-feedback amp. So I'm wondering wheter it is supposed to be a current feedback amp as well in the 2Dx2 models (and maybe also a faster one than OPA960)? Just a guess...

EDIT: I could not resist and opened my 2D72. U13 is a 5166ISZ as well, like in the 6xx4BD models.

EDIT: just realized that a photo of U13 was already posted here: https://www.eevblog.com/forum/testgear/hantek-2c422c722d422d72/msg2183363/#msg2183363 - interestingly, the IC is a different model (LMH6702 vs. 5166ISZ in my 2D72).

gf

[Microcheap]

Do you have ST-Link? Can you readout a dump of from your device. It will be interesting to compare it with lower version.

I do have a ST-Link, but to be honest I've never used it, I bought it with a stm32 blue pill board to start learning some ARM micro, but didn't have the will to start yet. 

If you can provide some direction I can certainly try it.

[Microcheap]

The AWG of the Hantek 6xx4BD (which has roughly similar specs) uses a 5166ISZ behind the DAC902, which is a 1.4 GHz current-feedback amp. So I'm wondering wheter it is supposed to be a current feedback amp as well in the 2Dx2 models (and maybe also a faster one than OPA960)? Just a guess...

What is your board revision? Hantek uses the DAC902E and the EL5166ISZ in their DSO4000 series bench scopes that also has an AWG. They could be using new ICs in newer revision boards, the marking on the DAC in my 2D42 was erased, but the little I could see doesn't look a DAC902 and I doubt they would have two different boards for the 2D42 and 2D72.

[gf]

My board revision is HT2xxx_M Rev. A08, 2018.

After removing the board and turing it around I noticed the same as you did - the markings on the ADC are not readable.

EDIT: It seems to end with the letters ...AK, or maybe ...ZAK. I'll add a photo.

EDIT: According to the 2nd photo, it could also be ...EAK or ...FAK.

EDIT: The connections of the DAC to other components of the board suggest a pinout like DAC902's, though. I measured ADC clock of 250 MHz clock (as specified). The DAC902 in my Hantek 6074BD (here the marking it is readable) runs only at 200 MHz (which is alrady overclocked by 21%). Searching for an (almost) pin-compatible alternative to DAC902, I found only AD9742, which is specifed for a higher rate of 210 MSPS minimum. Maybe there exist Chinese pin-compatible DAC ICs as well?

Looking at the datasheets of the amps, the EL5166 and LMH6702 are both CFAs. The EL5166 can be enabled/disabled, though, via pin 8 (-> power saving), and pin 8 is indeed driven low/high, when the AWG is turned on/off. Besides that, both ICs have the same pinout, so that LMH6702 can likely replace the EL6166 almost 1:1 if power saving is renounced. Unity gain bandwidth of LMH6702 is a bit higher, on the other hand the EL5166 has a higher slew rate and can drive more output current (not sure if this is relevant for this particular use case). The other components around U13 look identical in your and my photo.

gf

[AxGxP]

There was a hardware problem with measuring voltage more then 400 V. Burned resistor R15 (1kOhm). Changing to new one solved the problem.

To readout the firmware by ST-Link yo need to download "STM32 ST-LINK Utility".
Connect ST-Link to display board. (GND, SW_CLK, SW_DAT)
Push power button to power on the oscilloscope.
In ST-LINK Utility:
 Address: 0x08000000
 Size: 0x800000
 Menu: Target->Connect
 You will see the content of the memory.
 Right click on "Device Memory" -> Save to file
 Select HEX and save. (the file will be 1.2Mb)
 Press menu: Target->Disconnect
 Disconnect the wiring.

[gf]

DVM is isolated from the oscilloscope, and the insulation did withstand 1kV as well, >= 2000MOhm - beyond the limit of my insulation tester

Nevertheless, the power supply transformer for the DMM still does not convince me fully - the distance between primary and secondary windings is pretty small - less than 1mm. Is the cup possibly supposed to be filled with resin? The 5kV optocouplers are certainly OK, other insulation gaps/distances on the board look OK as well at the first glance (did not look under the battery compartment).

EDIT: Do I worry too much? Is the insulation capability of the enamelled copper wire alone already sufficient to provide the desired safey (as long as it is not damaged)?

gf

[gf]

Hello forum, does anybody here have experience with the AD9288?

Is my understanding correct that the data of channel A are generally sampled by the T&H at the rising edge of ENCODE_A, and the data of channel B are generally  sampled at the rising edge of ENCODE_B, indepent of S1 and S2 pins? The timing diagrams in the datasheet are IMO not perfectly clear in this regard, since the inputs A and B are not shown separately, but only with a common line. The timing of the parallel outputs certainly is affected by S1 and S2, but I could not learn from the datasheet whether S1 and S2 also affect the samping at the ADC inputs.

Background of my question is that I notice a time offset between channels 1 and 2 on my 2D72, when both channels capture the same sigal, which is as large as 50ns at timebase settings of 10us/div and slower, and I suspect that this offset is caused by the way how the AD9288 is operated in the 2D72.

I have not checked all possible combinations of singe vs. two-channels enabled and all time/div settings, but for the combinations I did check I see that ENCODE_A and ENCODE_B are always 180° out of phase, regardless whether both channels or only a single channel is enabled. S1 and S2 are 1,0 in dual-channel mode, and 1,1 when only CH1 is enabled.

This could explain a time offset of 1/2 ADC clock period between CH1 and CH2 (where the ADC is clocked at either 125, 100 or 10 MHz, depending on the timebase setting. For >= 10us/div, the ADC is clocked with 10MHz -> 50ns offset).

gf

[gf]

I'm facing gltches/spikes in the AWG output of my 2D72 at particular combinations of amplitude/waveform/frequency.

Please find more details here https://www.eediscuss.com/forum.php?mod=redirect&goto=findpost&ptid=14705&pid=17746.

I'm not absolutely sure yet, but I suspect a timing issue with not always meeting the setup times of the DAC inputs. Maybe it's also related to overclocking the DAC902 (250 vs 165 MHz) which has already been questioned in several previous messages?

gf

[Microcheap]

Do you have ST-Link? Can you readout a dump of from your device. It will be interesting to compare it with lower version.

Sorry for the delay, but finally I had time to open my meter to extract the firmware.

edit: Altered .bin file to hide the SN of my meter. Replaced with CN00000000000000-40

After removing the board and turing it around I noticed the same as you did - the markings on the ADC are not readable.

I found the manufacturer of the DAC chip it is a Chinese brand http://www.3peakic.com.cn/En/product/productes/catid/147.html but I still can't read the part number. There is also no 12bit DAC on the manufacturer web site, maybe it's a new IC I don't know but it is apparently pin compatible with the ISL5861, AD9762 or DAC902.

Please find more details here https://www.eediscuss.com/forum.php?mod=redirect&goto=findpost&ptid=14705&pid=17746.

Thanks for the information, I did open that thread to report some bugs I'm finding, I wanted to see Hantek's response.

[tsman]

Sorry for the delay, but finally I had time to open my meter to extract the firmware

Nice. The bootloader is in there as well and you've got the big block of data at the end of flash as well. Presumably that block has calibration and other things like serial number + model. What is strange is that block has "CN19XXXXXXXXXXXX-40" in it but that doesn't match up with the serial number label on your board. I wonder if the 40 indicates 40MHz since you have a 2D42. No clue if there are checksums etc...

[edit]Altered serial number[/edit]

[Microcheap]

Oops, yes that is the serial number on my meter, so it would make sense that the  "-40" indicates its maximum BW.

[tsman]

Oops. I've hidden your serial number now. A flash dump from somebody with a 70MHz model with/without the AWG would be handy. I wonder if just changing the 40 to 70 would alter the performance.

[Microcheap]

I wonder if just changing the 40 to 70 would alter the performance.

That is a good question, I'll see if I can try it later to test it

[Microcheap]

I wonder if just changing the 40 to 70 would alter the performance.

Maybe it's that simple indeed! Well, some more tests is needed to confirm that it really changes the BW or it just modify the sys info page.

Would be nice if someone with a 2D70 and a 2Cx0 model could provide their firmware to compare.

[AxGxP]

Here is nice overview of 2с42 in Russian. Bugs are shown.

https://youtu.be/lTojWKUGZ5g

[elefan]

I found a new model of hantek 2000series is on sale,the model is Hantek 2d82auto,which is special designed for vehicle diagnosis according to the seller description.And the bandwidth is raised up to 80 MHz.Guys who bought it may give some advice.Also there are several videos about hantek 2d82auto on YouTube.
I found the model here:
https://m.aliexpress.com/item/32967310745.html?pid=808_0000_0101&spm=a2g0n.search-amp.list.32967310745&aff_trace_key=&aff_platform=msite&m_page_id=5101amp-SfoeWTWficlstvlXNAdcxQ1551687199957

[JimBeam]

I did some measurements in single channel mode (with -70...):
- The frontend seems to be good to at least 100MHz.
- The displayed amplitude is a bit on the low side below about 20MHz
- The displayed amplitude is acceptable between ca. 20 and 45MHz
- The displayed amplitude is a bit too high beyond ca. 45MHz.
- Sine waves are displayed quite OK up to about 80 MHz - that's perhaps why HANTEK dares to issue the 2D82auto...
- Above 80MHz the sampling rate is too low, so aliasing effects become prevalent.
- Frequencies displayed correctly to above 100MHz!

And now for the brave - retrofitting the AWG using info gathered from YouTube videos, pictures of the PCBs and this thread.

But be aware: the parts nearly cost as much as the price difference between the 2Cx2 and 2Dx2 - so better give those few bucks to HANTEK, because
- they have put effort and manpower in designing this neat, little device
- you can't destroy your device with your plumbers soldering iron 
- you keep your warranty

Anyway, here it is (see attached picture):

[disclaimer]Don't blame me, if anything is or goes wrong![/disclaimer]

- fit DAC902 at position U12
- remove R315
- R63, R70 = 50 Ohms (R63 was already fitted in my device)
- C70, C71 = 20 pF (C71 was already fitted in my device)
- fit R65 = 560 Ohm
- I did change R61 from 1,78 kOhm to 2,2 kOhm as the AWG amplitude of my device was too high with the stock resistor

In the frontend section (see picture from reply #56):
- fit EL5166
- fit BAV99
- change 0 Ohms resistor at the output of the OpAmp to 50 Ohms
- change 0 Ohms resistor at pin 3 of OpAmp to 150 Ohms
- change 0 Ohms feedback resistor (at OpAmp left side) to 560 Ohms

No software modification is needed!
But: the quality of the AWG is - uhmm - let's say: suboptimal. Clearly visible spikes and distortion everywhere.
I hope HANTEK will fix this in future versions or is it (only) related to overclocking the DAC902 (250 vs. the specified 165MHz = ~50% over)?

Btw. can someone confirm, that the +3,3V and -5V voltages are way too low (see attached picture)?
I have only 2,9V on the 3,3V rail, which is acceptable, as no analog circuitry seems to use it.
But the -5V rail delivers less than -4V which is not enough for the EL6155 in the AWG, which clipped at the negative half wave at full swing of 2.5V (EL5166 specs say +/-3,8V output at 5V Vdd and 150R Rload).
If your -5V rail also is too low, you can change the marked resistor to 27k which then gives about -4,7V (nominal for -5V would be 29,4k).
I guess HANTEK lowered the voltages to save energy - so I also only raised it bit, just enough to work...

And: don't forget - all modifications void your warranty... 

[gf]

...which is not enough for the EL6155 in the AWG, which clipped at the negative half wave at full swing of 2.5V...

Exactly. In my 2D72, the negative rail of the EL5166 measures rather about -3.3V, which limits the negative output swing to about -2.3V (consistent with datasheet - about 1V drop from each rail). Hantek support has confirmed that they cannot fix it with a firmware upgrade, since it would reqire a hardware modification. I'm not sure if the voltage which is labeled -5V at the power supply test points is really supposed to be -5V or whether it is intentionally lower?

...the quality of the AWG is - uhmm - let's say: suboptimal. Clearly visible spikes and distortion everywhere...

AWG burrs have also been reported to Hantek support. They think they can fix it with a firmware upgrade.
Otherwise the AWG is just a "classical" DDS, thus all theoretical DDS limitations (e.g. phase truncation) do apply.

Yet another unfortunate issue is noise, which affects in particular CH2 of the scope.
One of the noise sources is obvoiusly the AWG (when it is turned on), but there seem to be others as well.

I also noticed a time offset between CH1 and CH2 when both channels are active, which puts in particular the usefulness of X-Y mode (which is now available in the latest firmware) into question.

See also Hantek support forum:
https://www.eediscuss.com/forum.php?mod=viewthread&tid=14705
https://www.eediscuss.com/forum.php?mod=viewthread&tid=14706
[ images and attachments ony visible with login ]

gf

[gf]

I did some measurements in single channel mode...

May I kindly ask what kind/model of signal generator you did use for these measurements?

...Above 80MHz the sampling rate is too low, so aliasing effects become prevalent...

For more detailed analysis, the FFT of the captured signal may be interesting (at the slowest timebase which still samples at 250 MSPS - in order to get as many non-interpolated samples as possible) -> harmonics, spurs, SFDR,...

gf

[tsman]

No software modification is needed!

Interesting. Somebody else had to modify the firmware on their version. I looked at the firmware and does have several error strings mentioning that a specific model doesn't have the AWG feature. Is it somehow detecting it from the presence/absence of the DAC?

Nice work on getting the AWG working and doing the tests.