Author Topic: Tonghui TH2822 LCR meter review, teardown and possible hacking  (Read 24810 times)

0 Members and 1 Guest are viewing this topic.

Offline vtlTopic starter

  • Regular Contributor
  • *
  • Posts: 136
  • Country: au
Tonghui TH2822 LCR meter review, teardown and possible hacking
« on: January 12, 2012, 07:47:17 am »
Just got myself a Tonghui TH2822 LCR meter. While the name might make you think of cheap chinese crap, this is actually the OEM who sell this meter to BK Prescision, who rebrand it as the 879B

I bought the TH2822 model for $190AUD on eBay delivered which sounds like a lot of money and it is. Some people might think its crazy to pay almost $200 when you can buy a cheap LCR meter off ebay for like $30. But the meter I bought are a proper LCR meter that does all the other important secondary measurments which includes ESR.

Also if you look at those cheap LCR meters the cap and inductance range can be shit; Most won't measure large capacitance and low inductance.

Proper LCRZ meters are quite expensive and prices start around the $300+ for Agilent/BK/Extech/etc models.

The Tonghui meters are sold on ebay (just search and sort by price) and differentiated primarily by test frequency. And you pay through the nose for it! I bought the 1KHz model which is a bit weak but theres also the TH2822A at 10Khz (~$230) and the TH2822C ($430!!!!).

You can also buy the discontinued older TH2821 10Khz model  for around $180 and the 1Khz for $150. They looked kind of crappy so I would rather get something newer and potentially hackable.

I looked at some teardowns and all the TH2822s seems like they all share the same PCB. The TH2822 lacks a backlight only tests at 1K and does not do 20% tolerance testing.

Package

Pretty good packaging and a nice box includes:
Chinese Manual - Not english/multilang and can't download from the website without registering, fuck you. Registered, no confirmation email, couldnt log in.
USB cable - standard mini-usb, the device shows up as a USB to serial bridge when plugged in - software can't download without logging in grrr
Calibration strip - a gold plated metal strip used to calibrate the short circuit resistance
9V battery - Labelled 'DLG' and apparently alkaline. Good that they didn't ship it installed in the unit like my Fluke meter did, means it wont leak in your new toy. Also the LCR meter draws a small amount of current when turned off.
12V ac adapter - Good thing to have since it'll probably only have 30-50 hours battery life. Meter also has a handy feature of reading out the battery/DC in voltage.
Test Leads - look quite nice, read 0.1150 ohms when shorted out.

Attached photo shows the test waveform, looks like a perfect sine which is lovely. My model has 100Hz/120Hz/1KHz test frequencies. This is in contrast to the capacitance test waveform on multimeters which is usually a square with some slight filtering on it. The test waveform on this LCR meter does not change to DC when measuring purely resistance, contrary to what some people believe.

I'll probably add some more comments on the usage of this meter once I've had it for a while.

Teardown

Looks almost exactly like the BK 879B, except the Tonghui appears to have more input protection. Seperate PCB for the input jacks with a lot of diodes. Blade terminals look like a bit more robust than the 879B arrangment. Other than that, identical PCB. I'm guessing the protection activate when you put a charged capacitor. Theres also some sort of resettable fuse system because I've tested some large capacitors that have been sitting around for a while (dielectric absorbtion anyone?) and the screen briefly said "error fuse" for about half a second.

Construction looks good quality, good branded parts an all connections are gold plated. Looks like there a multiturn pot for adjustment, I thought these things would hold cal data in flash memory?

Soldering is good for the SMD components but not that fantastic with the throughole stuff, theyre hand soldered with a bit of residue. Not a big deal I suppose, maybe I'm too used to PC components which always have flawless soldering.

On the input jacks board theres a tiny bodge capacitor on the + terminal end ground. Almost didnt see it, looks pretty dogdy was it that critical for the decoupling?

Theres some unpopulated footprints for the TH2822C battery charging circuitry and some unpopulated footprints on the front, no idea what they are for.

Also hooked it up to my power supply, battery low indicator comes on at 7v which is about 1.17 volts per cell which isn't that brilliant. The thing actually powers up at 4V though. I was thinking of maybe running it off a pair of 3.7V 14500 (same size as AA). Theres enough length in the battery compartment but not enough width to fit both of them in, bummer.

When unit turned off draws 0uA, surprising since theres no physical switch. Powered on it uses around 20mA. Drops to 15mA if you power it from 12V

Possible Hacking:

Adding backlight:

On the better models the RMT button's secondary function is a backlight and I wondered what would happen if I held the button down. The meter beeps and nothing happens. So I figure the backlight function is not removed (possibly identical firmware). Inside the unit there are some footprints next to the LCD labelled A and K (obviously for Anode and Kathode). Probed them after holding the RMT key and got 5.6V! I'm guessing the higher end units have some kind of clip in diffuser unit with 2 leds per side wired in series. 2.8V sounds about right for the voltage drop of an LED. So its a pretty trivial task to add the backlight option, the footprints are throughole so you can just wire up 2 LEDs per side maybe with a diffuser if you like.

Possible test frequency hack:

Because they haven't bothered to remove the backlight feature in firmware, I'm wondering if they all share a common firmware and simply change some ID in flash? Would be interesting to see if this can be hacked. Would be handy since the 100Khz test frequency is crazy expensive.

Overall, quite good, I'm happy with the purchase, will experiment with some leds and see if I can get a nice backlight going with it.
« Last Edit: January 12, 2012, 11:53:52 am by vtl »
 

Offline bsgd

  • Regular Contributor
  • *
  • Posts: 171
  • Country: br
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #1 on: January 12, 2012, 12:27:41 pm »
Very nice review, thank you!

I was wondering about the quality of the Tonghui bench LCR meters. I bought a B&K 879B and Im quite disappointed, so Im not sure if I should get a Tonghui TH2811D or spend a fortune on a Agilent 4263B...
 

Offline vtlTopic starter

  • Regular Contributor
  • *
  • Posts: 136
  • Country: au
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #2 on: January 13, 2012, 02:41:03 am »
How much is support worth to you? Like I said, no english manual and couldn't download it, same with software (although its SCPI compliant so I guess not a big deal). But remember we're talkign about hundreds of dollars here you'd kind of expect the basics such as manual.

I don't know if the TH2811D will be for you if the 879 didnt meet your needs, the 879b is a Tonghui design after all.

That said, I'd be reasonably certain at least the hardware will be of good quality and construction.

Also some differences I've noticed with the 879b and Tonghui meters:

Button layout is different, the Tonghui has this fancy Auto measurment mode and it will select LCRZ according to your DUT, very, very useful. Also has the option to increase the update rate of the screen, I'm not sure of the speed maybe 5/sec?


EDIT: Was able to login to the site, they must activate acounts after a 24 hour period, no confirmation email though. Downloaded manual and software off the site (slow too, <1kb/sec). Software looks the same as the BK. I wonder if the unit can be sent serial commands to hack the device like the rigol. *IDN? command shows the model number, serial number and firmware

These things would mean the firmware is definetly different between the two and not interchangable. I've also located an eeprom next to the microcontroller, I beleive this stores startup settings and hopefully some values that can be changed to hack the unit. It seems to be an Atmel 24c64b i2c eeprom, probed the SDA SCL pins on startup, get some edges but haven't gotten around to recording.
« Last Edit: January 13, 2012, 07:37:54 am by vtl »
 

Offline bsgd

  • Regular Contributor
  • *
  • Posts: 171
  • Country: br
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #3 on: January 13, 2012, 09:33:30 pm »
To be honest, service and support are not a concern to me. Here in my country, they alll just suck... I mean, even big brand name companies do not offer anything that I would consider anywhere near good.

I am mostly interested in the actual quality of the equipment. I guess I'll just get an Angilent LCR. Thing is they cost a fortune here, so I was looking at some alternatives.
My choice right now is the 4263B.
 

Offline vtlTopic starter

  • Regular Contributor
  • *
  • Posts: 136
  • Country: au
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #4 on: January 17, 2012, 09:47:38 am »
Been playing around with backlight ideas and its a lot more difficult than it would inially seem. Definetly more involved than just glueing in some LEDs. I tried to use two smd white leds and didn't end up with very good results, you end up with just 2 hot spots.

I looked into how LCDs typically diffuse the light and they have a mirror like reflector that then goes through a number of lenses and diffusers. So I added a mylar reflector which I cut from a space blanket and the results were much better. The gold side is not conductive so i could safely just tape it to the PCB.
I need to add some diffuser material though since the mylar sheet is not perfectly flat and theres quite a bit of uneveness.

The photos look better than it actually is in real life. The uneveness kind of blends out in the long exposure I took.

Not entirely happy with it yet but not too bad I suppose.

Attached are the photos of the backlight with and without the mylar reflector.
 

Offline carloscuev

  • Regular Contributor
  • *
  • Posts: 122
  • Country: mx
    • Spanish Freescale Developers Forum
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #5 on: August 10, 2012, 02:23:43 am »
Sorry to wake up this old thread but my TH2822A doesn't have that bodge cap, but I can tell sometimes the measurement jumps a lot, maybe it's missing it. Could you measure its value with your DMM please? Thanks !
« Last Edit: August 10, 2012, 02:32:02 am by carloscuev »
 

Offline vtlTopic starter

  • Regular Contributor
  • *
  • Posts: 136
  • Country: au
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #6 on: December 18, 2012, 08:54:17 am »
1nF, Late reply, but better late than never.
 

Offline Wartex

  • Frequent Contributor
  • **
  • Posts: 411
  • Country: ca
    • http://headsplosive.com
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #7 on: December 22, 2012, 10:53:17 pm »
Wanted to buy 2822C so badly... but it has some firmware problems... bought Fluke pm6304. That thing is pure sex.
 

Offline valentinc

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ro
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #8 on: April 01, 2013, 12:47:03 pm »
vtl, have you tried to read the contents of the EEPROM ?
Valentin
 

Offline Hydrawerk

  • Super Contributor
  • ***
  • Posts: 2640
  • Country: 00
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #9 on: April 01, 2013, 07:27:32 pm »
This LCR meter is too much complicated...
Amazing machines. https://www.youtube.com/user/denha (It is not me...)
 

Offline reagle

  • Supporter
  • ****
  • Posts: 554
  • Country: us
    • KuzyaTech
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #10 on: April 06, 2013, 09:35:09 pm »
Just bought a TH2822A on ebay shipped form China and am pretty happy with it. $175+$35 shipping, got it in less than a week and it's a solid instrument.
A full review is coming up in a bit, but it's already pretty obvious there is no way it's a copy of a BK Precision's design. They are definitely made from the same design or even made by the same people (probably Tonghui if I had to guess) and then just tweaked for branding purposed. Other than a position of a few buttons, the BK and TH are the same thing. Every software feature, behavior etc are identical. Definitely not a copy, more like variants :)
 I even watched Dave's review of the BK Precision one again to compare notes- everything was the same minus the Min/Max/Avg bug that TH did not have. And of course the PC software and its inability to handle more than 5 or 6 com ports is the same either ;)
So- a solid meter and a good buy

Offline crisr

  • Contributor
  • Posts: 46
  • Country: br
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #11 on: July 24, 2013, 10:02:08 pm »
Hi, got here after I saw a local ad for a TH2822A for a reasonable price. The thing that seems to differentiate it from the BK879B and others it's that, according to the ad and the datasheets I found, it does 4-wire measurement (the 5-terminal test slot, if you count guard), and even comes with Kelvin test leads. It also has a backlight, according to the pictures. Nowhere in the BK879B datasheet or on the other threads about this model I saw anything about 4-wire measurement...

Anyway, I am between this model and a Agilent U1733C (which would cost about 40% more). One of the things I would like to do is measure low resistance and capacitance, so I think 4-wire is very convenient for me, but in the past I have been disappointed with "no brand" test equipment (a local-rebranded multimeter) which turned out to be unusable in the uA / low mA range and since then I have always tried to buy brand-name (read Fluke / Agilent) gear. What would be your opinion about it's quality and accuracy compared to the brand name ones?
 

Offline vtlTopic starter

  • Regular Contributor
  • *
  • Posts: 136
  • Country: au
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #12 on: July 28, 2013, 03:38:59 am »
As requested, I got my hot air station and sucked off the I2C eeprom and read the contents with a universal programmer
 

Offline carloscuev

  • Regular Contributor
  • *
  • Posts: 122
  • Country: mx
    • Spanish Freescale Developers Forum
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #13 on: July 29, 2013, 07:29:31 am »
Here I posted my findings by sniffing my TH2822A. By looking at your EEPROM dump I noticed that the data accessed by my meter when going into 10kHz mode are empty in yours, they are:

Switching Frequency from 1k to 10k:
Read @0x0326: A5 5A
Read @0x0328: 3A 9D BF 49 9C 23 3A CB
Read @0x073A: A5 5A
Read @0x073C: C8 9A 21 3D 02 39 35 3C
Read @0x0B26: A5 5A
Read @0x0B28: 03 AB 7E 3F 8E 2B 33 3D

In your EEPROM they appear empty, I'm not so sure about what does that data is, but I think it may be calibration data because in that other forum topic, reagle's (user) meter sniffing threw out different data in those same adresses. If this is not calibration data it could be some encrypted code, the funny thing is that for each frecuency selection the meter reads a new set of data, please read my entire post on the other topic.

I do not have a unviersal programmer, but I got a bus pirate, just need to learn how to use it to make a backup of my eeprom and start playing around.

But by now you could try changing the address 0x0054 to the value 0x0B (instead of 0x07 as it is in your memory dump) which means to power-up in 10kHz mode, this might not work because this is just the power-up frecuency value, there might be other bits to flip in order to make it possible, but it would be a nice try, if possible, reading the probes with an oscilloscope would confirm if it's generating 10kHz.

From address 0x0052 to 0x0063 there's the power-up data and this are my updated findings:

Write @0x0052: 01 (Mode, 00: L, 01: C, 02: R, 03: Z)
Write @0x0053: 0E (Sec. Display, 11: Frequency, 0E: ESR, etc. )
Write @0x0054: 0B (Frecuency, 0B: 10kHz, 07: 1kHz, 03: 120Hz, 02: 100Hz)
Write @0x0055: 00
Write @0x0056: 00
Write @0x0057: 00
Write @0x0058: 00
Write @0x0059: 00
Write @0x005A: 00
Write @0x005B: 00
Write @0x005C: 00 (??, 00: L, 01: CRZ)
Write @0x005D: 00
Write @0x005E: 00
Write @0x005F: 00
Write @0x0060: 00
Write @0x0061: 00
Write @0x0062: 00 (Rate, 00: slow, 01, fast)
Write @0x0063: 00 (01: AUTO, 00: otherwise)

I can tell your meter powers-up in AUTO mode, starting in capacitance measurement (this is normal because the leads are usually open reading some pF of capacitance), showing on the secondary display the ESR, in 1kHz frequency and in FAST update rate.

Nothing different between your 1kHz meter and my 10kHz meter so far. They could be different firmwares, or the presumable calibration data is not really that, but some encrypted code which tells the MCU which version it is, or maybe even both. But if this is true, the encryption key would be different for each meter, as we 3 (reagle, you and me) got different data for the 100Hz, 120Hz and 1kHz ranges.
« Last Edit: July 29, 2013, 02:22:38 pm by carloscuev »
 

Offline trobbins

  • Frequent Contributor
  • **
  • Posts: 826
  • Country: au
Re: Tonghui TH2822 LCR meter review, teardown and possible hacking
« Reply #14 on: November 12, 2023, 06:00:52 am »
Checking if anyone has attempted to fix a 2822 LCR meter, or has come across service info or a schematic for any similar LCR variants.

I have the MCP BR2822 handheld version, and accidentally sparked the input with a charged capacitor.  The meter still powers up and functions, but displayed measurements are not correct.  The 4 kelvin input terminals are protected by back-to-back diodes in a few configurations (although no identifiable fusing), but are directly connected to opamp input (U19 TL071C pin 2) and capacitor coupled (under pcb) to other opamp inputs (U15 TL064C pins 3, 5 and 12), and through analog switch to U15 pin 10.  So hopefully just one or both opamps, but there are a few 74HCT4052 analog switches that may have suffered.

The BK 879 seems to be significantly different - certainly in layout, and it has an smt fuse (https://www.eevblog.com/forum/testgear/bk-precision-lcr-meter-879b-with-adc-failure/), so perhaps not too helpful.

I'll try and do some sleuthing of voltages through the opamps and analog switches to see if there is anything obvious.
« Last Edit: November 12, 2023, 06:02:42 am by trobbins »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf