Hantek - Tekway - DSO hack - get 200MHz bw for free

[tinhead]

... and finally input circuit picture from real 200Mhz device. As expected there are some small
differences between AD8370 and LMH6552 (280R vs. 301R, 330R vs 390R, unknown C + "varicap" vs. unknown C + "varicap").

From what i got reported, the bw is higher than on hacked 100MHz DSOs
(210Mhz vs 260MHz -3db, 240MHz vs. 320MHz -6db - don't compare these valuse to bw pulse measurment, they always higher)
which is of course a bonus for those who buy 200Mhz DSO instead of hacking 60Mhz or 100Mhz model.

I assume the 60MHz model have some differences too, unfortunately i never had a chance to test it by myself.
People who hacked 60MHz DSO reported 200MHz bw, the question is only how accurate they measured
the bw (i think it is between 170-180MHz for hacked 60MHz DSOs).

I ordered 60MHz today, not sure when it arrives (because no stock) but i will report back the results.

[LostInSpace]

dfnr2,

If I'm reading this series right, you paid about $650 and they sold you the 200 Mhz labeled scope through their close to black friday sale.  Right? 

Many thanks!

[saturation]

An interesting review of Tekway, as a clone of Tektronix:


http://translate.googleusercontent.com/translate_c?hl=en&sl=zh-CN&u=http://tm.eefocus.com/stupid/blog/09-08/174338_65029.html&prev=/search%3Fq%3D3458a%2Breview%2Beefocus%26hl%3Den%26safe%3Doff%26client%3Dfirefox-a%26hs%3DPGy%26rls%3Dorg.mozilla:en-US:official%26prmd%3Div&rurl=translate.google.com&twu=1&usg=ALkJrhhQDHHxxHFcqjNYZo4kvO9LBkAV3Q

[tinhead]

For NA folk good news, the 60MHz Hantek seems to be orderable

https://www.mortoncontrols.com/index.php?main_page=product_info&cPath=66_67&products_id=450

[Igor]

To: tinhead.
What can you say about Oscilloscopes OWON PDS8102T/PDS8202T?
Can I change the first model in the second (100 MHz to 200 MHz)? 
I choose the oscilloscope, and looking at your messages. 
Thank you! 
Igor, Russia.

[tinhead]

To: tinhead.
What can you say about Oscilloscopes OWON PDS8102T/PDS8202T?
Can I change the first model in the second (100 MHz to 200 MHz)?  
I choose the oscilloscope, and looking at your messages.  
Thank you!  
Igor, Russia.

Igor,

no idea yet. What you can do is, take it apart, make some detailed pictures, create a separate review
thread here in forum (you don't have to write much).
We can see then what inside, and maybe there is a chance.

[Igor]

Tinhead, I don't have such a device. I just choose.
But most likely choose Hantek DSO5102M, and take your recommendations for upgrading.
And for sure I will contact you.

[Gall]

Just received my 100 MHz Hantek. I'm thinking about replacing dso.exe with something that would be more extensible, i.e. with wavelet support in addition to FFT etc. Are there such projects already?

[tinhead]

Just received my 100 MHz Hantek. I'm thinking about replacing dso.exe with something that would be more extensible, i.e. with wavelet support in addition to FFT etc. Are there such projects already?

Afaik not that i know. To replace the dso.exe we need first to reverse few thigs, like FPGA control, front panel control, to
understand the data coming from FPGA, to udnerstand how the trigger, the input stage and self-calibration are working and how to
control them ... a lot of things for single person.

I'm currently busy with Ethernet addon board and evt. wireless usb stick for this DSO.

[Gall]

Yesterday I tried to analyze dso.exe. For now, I suspect that dso.exe contains a small piece of GPLed code (not everything is linked dynamically). It would be great.

What exactly I'd like to add first is another algorithm of sample averaging for low-frequency modes. This would reduce ADC noise and increase effective bit-resolution if the 20 MHz filter is on. (I expect to see a perfect straight line in low-freq, high-voltage modes).

Upd: I made another firmware extract utility. It does exactly the same but does not modify any files on oscilloscope at all. Everyting is done inside the update script on tmpfs. See attached file.

[tinhead]

Upd: I made another firmware extract utility. It does exactly the same but does not modify any files on oscilloscope at all. Everyting is done inside the update script on tmpfs. See attached file.

The trick with tmpfs is good idea.

@All

Gall's utility is dumping the firmware during firmware update directly (just be more patient), so no need to play with usb stick and usb cable after reboot.

[am2pgs]

Tinhead et all,

this has been a very facinating thread for me. I have been looking at affordable scopes for a while , and this thread finally helped make my mind. So I went ahead and ordered the Hantek DSO5102B from Goodluckbuy last week.  I am expecting it any day now.

To start with, I'll have a go at backing up the firmware (in NAND flash) once I get the unit. One question, does the USB firmware dump utility backup the vivi bootloader as well? I am not sure if Nanddump utility could access that partition at all.

Also any idea where in NAND flash the factory settings are stored or what these settings are for?
 
Thanks again,
great job.

[tinhead]

To start with, I'll have a go at backing up the firmware (in NAND flash) once I get the unit.
One question, does the USB firmware dump utility backup the vivi bootloader as well?
I am not sure if Nanddump utility could access that partition at all.

Again, i can only recommend to backup the firmware. The best way is to do it with JTAG (to have everything not only the 3 "partitions".
The USB firmware dump utility is saving boot, kernel and root "sectors". Vivi is stored in boot dump. Such backup can
be restored only to own NAND and as long NAND was not completly erased.

In case NAND is broken or erased there are two additional things necessary to restore it
- 135168 byte "blank" sector (must be filled with FFh)
- 16896 byte "mizi_tag" sector - this is just a marker (not sure if this is NAND unique, but it worked for me on two DSOs and dev board)

To get a full NAND backup with OOB blocks you have to merge all these files:

copy /B boot.bin + blank.bin + kernel.bin + root.bin + mizi_tag.bin fw_backup.bin

and then the fw_backup.bin is the full NAND backup.

However, in most cases it is enough to have backup of boot, kernel and root FS.

Also any idea where in NAND flash the factory settings are stored or what these settings are for?

afaik there is factory calibration data directly in root of root FS:

tdc_edge125M
tdc_overtime125M
tdc_pulse125M

there are additionally some *.log files directly in root of root FS (not sure what they for, but it seems dso.exe is using them) :

i2c.log
mult_adc.log
tdc.log

Everything else seems to be not unique, so in case something mising/deleted/broken you can still ask someone here to get a copy.

[am2pgs]

@ Tinhead

Thanks for the extra .bin files. I received my Hantek today, and did a firmware dump.

It is reassuring that the total of the .bin file sizes (including the ones you posted) works out to be the same as the Nand Flash memory size.

[tinhead]

@ Tinhead

Thanks for the extra .bin files. I received my Hantek today, and did a firmware dump.

It is reassuring that the total of the .bin file sizes (including the ones you posted) works out to be the same as the Nand Flash memory size.

you welcome.

[Crippled]

Is the 60MHz also hackable to 100 or 200MHz?
At which China internet warehouse is it for sale? I know the 100MHz is for sale at goodluckbuy.

thanks  

edit
found the 100mhz at taobao.com:


http://translate.googleusercontent.com/translate_c?hl=nl&ie=UTF-8&sl=zh-CN&tl=en&u=http://item.taobao.com/item.htm%3Fid%3D4727827746&prev=_t&rurl=translate.google.com&twu=1&usg=ALkJrhgIAaJdhC3FJaM0olzo1VLJF3Kbdw

[Gall]

Is there a schematic of Hantek input stage, maybe reverse engineered?

[tinhead]

Is there a schematic of Hantek input stage, maybe reverse engineered?

afaik no, only the part between AD8370 and LMH6552 is known. It is like Rigol input stage,
the varicap D1 is BBY65-02V, C1=C2=160pF

Pin8, Pin9 in the picture are connected to AD8370 and over resistors (they a bit different per model, but it didn't change that much)
to LMH6552 input. The voltages on the picutre are fom Rigol, Tekway/Hantek have different levels
(as we have 20,60,100 and 200MHz bw selectable).

Everything else has been afaik not yet reversed (even not for Rigol)

[am2pgs]

Has anybody got the TTscope to work under windows 7 with the DSO5102B?

The application installs but I seem to miss the USB driver.

[Gall]

tinhead, thank you for the schematics!

I was investigating Hantek's noise. Now I'm pretty sure that it is NOT normal ADC sampling noise, it is just too big. Looks like mine has only 6 significant bits while 2 bits measure noise even on strong input signals (5 V/div on 1:1 or 50 V/div on 1:10 probe)! I expected 7.5 significant bits of course.

The nature of the noise is unknown. It is uncorrelated between 1st and 2nd input channels so it cannot be EMI (I've seen interference from FM radio broadcasts on 2 mV range but not here). I suspect it is kind of Johnson-Nyquist noise or something. I hope it can be reduced somehow to less than 1 significant bit.

Of course, some noise is always expected, all DSOs have noise, but low-end ones have more. It is strange that a fast DSO measures strong low-frequency signals worse than just some resistors and comparator hooked to PC parallel port.

[am2pgs]

Just converted my DSO5102 to DSO5202 and I can say it really works. What a difference!

The following traces were captured using the same scope, same probe and exactly the same point of measurement, one with the original DSO5102 Firmware, and the other after it was modified to DSO5202.

Not very scientific, but it is a relative test indicating that the frequency response has doubled.

Thanks!

[tinhead]

Is there a schematic of Hantek input stage, maybe reverse engineered?

i did reversed the complete input stage from ch1 / ch2, and some internal logic control, see attached pdf.
Few controls sognals are still missing, but it think it is good enough to understand the circuit.

The input stage (up to AD8370 input pin) is flat up to 400MHz, so there is room for more improvements (e.g. 350MHz bw ...)

As the input stage is almost equal to Rigol this schematic might be interessting also for Rigol hacks.

EDIT: Updating schematics right now ... be patient

In principle S3C2440 is controlling over i/o the CPLD, the CPLD is controling FPGA/SRAM.
FPGA is capturing data and controling some input stage signals and front panel
(which was a small suprise, i was thinking s3c2440 is doing this).
It can be that there are some other connections between FPGA and S3C2440,
however multilayer board is not easy to reverse with components soldered on it.

The interessting thing is that no matter what kind of C/R/Varicap combination i used, the bw was always the same.
Somehow the CPLD is controling the bw of AD8370, maybe we need to check with LA what's going there (VAG control words)
The DAC LTC2601 is providing always 2.7V to Varicap, no matter what settings (hmm, haven't tested during self calibration yet)
or which model (60,100 or 200MHz), this didn't really make sense.

Normaly this part of the circuit should change the bw (like Rigol is doing) via reverse voltage applied to varicap,
no idea why Hantek/Tekway is not using it - however this is only checked on my very early Tekway,
maybe somone else can test it too (Anode of the Varicap).

[Gall]

Great work! What a Christmas gift! Thank you!!

It's a bad surprise that FPGA seems to go to CPLD and not to ARM directly. Looking at the board, I suspected that CPLD does just very simple thing - connecting SRAM to both FPGA and ARM and mapping SRAM into ARM's address space. Looks like I was wrong. Also looks like that everything is memory mapped.

It is unclear why CPLD is used at all. FPGA should be able to do the same by itself. This may indicate that input stage including ADC and FPGA part is ingeneered by someone else and bought by both Rigol and Hantek, thus CPLD is used as glue logic between ready-made FPGA design and the CPU.

The varicap seems to be used for correction and not for frequency filtering. Its connection does not look like a filter, there are no resistors or inductors between AD8370 and the varicap. Of course, AD8370 has 95 Ohm output impedance but it is not intended to be used in such a way.

I think about analyzing connections between CPLD, FPGA and ARM by using their JTAGs in boundary scan mode.

[tinhead]

i have to correct myself, both FPGA and CPLD are memory mapped to ARM, and both CPLD and FPGA are controlling some
signals. I know that CPLD is controlling input stage HC595 and generating for example 1kHz, the FPGA front panel and some other
signals. The question is now who is master, probably FPGA and not CPLD ... unfortunately without special equipment we can't see it
and Han/Tek/way will never publish the schematics.

You right, it could be easier to use boundary scan instead of unsoldering components or x-ray PCB. I hope Han/Tek/way will really
publish the firmware sources, it will help defnitely to understand the design.

[Frank Q.]

Testing a new DST1062 I see, keys and rotary encoders are working not reliable. Often a pressed key is not recognized and has to be pushed once again. Rotary encoders (e.g. VO and Horz. Position) are working if tuned slowly. Faster rotation will result to slower motion. Is this typical to tekway scopes?
Will the 'newer' software described here reduce/kill these errors?

Thanks!