Amazon Commercial 90DM600 multimeter hacks

[sequoia]

Amazon Commercial 90DM600 DMM appears to be a rebadged CEM DT-9560/9561 meter. This is a rugged (IP67 certified) 6,000 count meter that has Intertek/ETL safety certification and currently sells for about $30 (US): https://www.amazon.com/AmazonCommercial-Count-Compact-Digital-Multimeter/dp/B07W3BXNMP/



Chipset is DM1106EN (found on many meters from UNI-T, Victor, etc...) that stores its configuration/calibration data in a 24LC02B (2Kbit) I2C EEPROM.

Searching information about this chipset brought up multiple threads here on this forum about hacking UNI-T, etc. meters based on this same chipset.
So it would appear it is possible customize settings on this meter and possibly enable 10,000 count mode (as chipset appears to support it).



 
I was able to dump the EEPROM using a CH341A programmer using a SOIC8 test clip and temporarily holding CPU in reset mode by grounding R25 (end that connects to IC1 pin 55) to the PIN 1 on the Program header.   Meter needs to be powered on (I used the V~ setting).  No soldering needed if you have steady hands

EDIT: To be extra careful, I may be best to use "pull down" resistor (1k to 10k range) to hold CPU in reset.


NOTE! Most (if not all?) CH341A programmers have flaw that Vcc is 3.3V but the signals are 5V, so using a unit that is not fixed, might damage your DMM... (This post shows one possible fix: https://www.eevblog.com/forum/repair/ch341a-serial-memory-programmer-power-supply-fix/msg1347050/#msg1347050)

Backup of factory settings of the meter:

Code: [Select]

0000000 ff ff ff ff ff ff ff ff ff 52 00 0e 01 e8 d4 03
0000010 10 27 38 18 4e 02 66 66 3d 3d ff 3b 0a ff 40 ff
0000020 bb 99 1b 81 fa 00 32 00 00 80 2d 8d ad 8d 95 f7
0000030 4e 02 09 04 12 09 6b f8 0a d0 1b 0a 1a 01 0a 00
0000040 00 01 00 01 00 07 98 00 64 00 64 00 64 00 c0 00
0000050 00 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80
0000060 c4 7f bd 84 01 00 0c 2b 00 00 00 00 00 00 00 00
0000070 28 80 00 80 a4 83 e8 7d 0a 27 00 00 00 00 00 00
0000080 00 00 00 00 00 00 11 0f 00 13 0d 12 02 07 04 03
0000090 00 00 00 00 00 00 10 0e 00 15 0c 00 01 0a 00 00
00000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00
00000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00
00000c0 0d 00 02 20 0d 00 03 20 20 00 03 20 20 00 03 10
00000d0 41 00 03 08 41 00 03 05 41 00 03 05 0d 00 02 20
00000e0 e2 f1 0b 80 00 80 db 7f cc 7f a6 7f 9d 7f 00 80
00000f0 00 80 00 80 00 80 00 80 5a c6 ec 0f 05 00 00 00

Comparing this to examples found in thread https://www.eevblog.com/forum/testgear/a-look-at-the-uni-t-ut210e/ seems to point that it should be possible to "hack" this meter by by reprogramming the EEPROM.

Lot of information about modifying EEPROM for DM1106EN/DTM0660L chipsets can be found at: https://github.com/bdlow/UT210E


It would seem like it may be possible to modify this meter to 10,000 one and possibly even enable the temperature measurements mode (to make this functionally same as the more expensive 90DM610 model...)

[Muttley Snickers]

So it would appear it is possible customize settings on this meter and possibly enable 10,000 count mode (as chipset appears to support it).

Nice work but what about the LCD ?   
The LCD layout in the image above appears to be for a 6000 count or less meter as the DC icon is in a position where it would conflict with any additional digits. I suspect their higher count models probably have a completely different layout in the display when compared to the lower count models.

[sequoia]

Nice work but what about the LCD ?   
The LCD layout in the image above appears to be for a 6000 count or less meter as the DC icon is in a position where it would conflict with any additional digits. I suspect their higher count models probably have a completely different layout in the display when compared to the lower count models.

LCD is 4 digits only, so cant get 10,000 count but should be able to get to "9,999 count"... 

Looking the factory EEPROM settings it would seem full range value is set from factory to 10,000 counts (0x2710).
And and upper limit (for automatic range switch) is set to 6,200 (0x1838), so presumably changing that to 9,999 (0x270f) might work?

[sequoia]

Success! I was able to enable temperature measurement by adding those modes to the "Hz %" selector setting (now pressing mode button toggles between "Hz", "C", "F" modes).

I also changed successfully uA, mA, A, and mV ranges to default "DC" mode instead of factory default "AC"...



To update meter save copy of the original settings and then edit following locations:

[sequoia]

I guess this could be called "9999 Counts" ?




I changed factory limits for the autoranginng:  upper limit changed from 6200 to 9999, and lower limit changed from 590 to 990:

[Caliaxy]

Great Job! 

[Electro Detective]

 

interesting to see if any performance compromises of this 'unlocked'? meter versus the standard meter

..and there goes another $40   

[sequoia]

interesting to see if any performance compromises of this 'unlocked'? meter versus the standard meter

..and there goes another $40   

As range is set to 10000 counts from the factory (and chipset supposedly is designed to support that as well), presumably it won't be too bad.

I haven't done any extensive testing, but quick comparison when meter showed 5.999 VDC (unmodified) it was 6mV "up" from what my GDM-8251A displayed (this is a 120,000 count DMM). 

After modifying the meter and meter showing 9.999 VDC, reading was still "up" same 6mV from the reading on the GDM-8251A.

[karamba]

Should unsubscribe from these forums. Minus $40 for me.

[sequoia]

It would appear that DM1106EN  behaves slightly differently from the DTM0660L when it comes to EEPROM location/settings:
- EEPROM location 0xFC (backlight timeout) seems to be in minutes (vs on DTM0660L its in seconds).   
- EEPROM location 0xFA Bit 1 (enable Serial UART output via long press of "REL") doesn't seem to enable UART

I sniffed the I2C bus for the EEPROM activity to get better understanding what EEPROM locations meter appears to be using (reading).

Following shows the changes (highlighted in red) that I've made to factory settings (so you'll see the data from "90dm600-hack.bin" being read by the meter on the captures):




Meter power up (to "V~" mode):

Code: [Select]

  54556-55231 24xx EEPROM: Operations: Sequential random read (addr=F8,  6 bytes): 5A C6 EC 1E 0A 00
  55250-56527 24xx EEPROM: Operations: Sequential random read (addr=10, 15 bytes): 10 27 0F 27 DE 03 66 66 3D 3D FF 3B 0A FF 40
  56546-57621 24xx EEPROM: Operations: Sequential random read (addr=33, 12 bytes): 04 12 09 6B F8 0A D0 1B 0A 1A 01 0A
  57642-58250 24xx EEPROM: Operations: Sequential random read (addr=0B,  5 bytes): 0E 01 E8 D4 03
  58269-58812 24xx EEPROM: Operations: Sequential random read (addr=20,  4 bytes): BB 99 1B 81
  58831-60041 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
  60060-60468 24xx EEPROM: Operations: Sequential random read (addr=4E,  2 bytes): C0 00
  60492-61167 24xx EEPROM: Operations: Sequential random read (addr=2A,  6 bytes): 2D 8D AD 8D 95 F7
357725-358066 24xx EEPROM: Operations: Random access read (addr=8E, 1 byte): 04
358086-358427 24xx EEPROM: Operations: Random access read (addr=9E, 1 byte): 00
358447-358788 24xx EEPROM: Operations: Random access read (addr=AE, 1 byte): 00
358808-359148 24xx EEPROM: Operations: Random access read (addr=BE, 1 byte): 00
359208-360417 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
360436-360844 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
360866-361275 24xx EEPROM: Operations: Sequential random read (addr=28, 2 bytes): 00 80
361305-361720 24xx EEPROM: Operations: Sequential random read (addr=E6, 2 bytes): DB 7F


Switching to range "V~":

Code: [Select]

   11-353 24xx EEPROM: Operations: Random access read (addr=8E, 1 byte): 04
  373-714 24xx EEPROM: Operations: Random access read (addr=9E, 1 byte): 00
 734-1075 24xx EEPROM: Operations: Random access read (addr=AE, 1 byte): 00
1094-1435 24xx EEPROM: Operations: Random access read (addr=BE, 1 byte): 00
1494-2704 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2723-3131 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3153-3561 24xx EEPROM: Operations: Sequential random read (addr=28, 2 bytes): 00 80
3592-4007 24xx EEPROM: Operations: Sequential random read (addr=E6, 2 bytes): DB 7F


Switching to range "V":

Code: [Select]

   12-353 24xx EEPROM: Operations: Random access read (addr=8F, 1 byte): 03
  373-713 24xx EEPROM: Operations: Random access read (addr=9F, 1 byte): 00
 733-1074 24xx EEPROM: Operations: Random access read (addr=AF, 1 byte): 00
1094-1434 24xx EEPROM: Operations: Random access read (addr=BF, 1 byte): 00
1492-2702 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2721-3129 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3152-3827 24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7
8483-8891 24xx EEPROM: Operations: Sequential random read (addr=E6, 2 bytes): DB 7F


Switching to range "mV":

Code: [Select]

   11-353 24xx EEPROM: Operations: Random access read (addr=8C, 1 byte): 01
  373-714 24xx EEPROM: Operations: Random access read (addr=9C, 1 byte): 02
 734-1075 24xx EEPROM: Operations: Random access read (addr=AC, 1 byte): 00
1095-1436 24xx EEPROM: Operations: Random access read (addr=BC, 1 byte): 00
1493-2703 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2722-3130 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3153-3829 24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7


Switching to "Ohm":

Code: [Select]

   12-353 24xx EEPROM: Operations: Random access read (addr=8D, 1 byte): 07
  373-714 24xx EEPROM: Operations: Random access read (addr=9D, 1 byte): 0A
 734-1075 24xx EEPROM: Operations: Random access read (addr=AD, 1 byte): 09
1094-1435 24xx EEPROM: Operations: Random access read (addr=BD, 1 byte): 0B
1482-2291 24xx EEPROM: Operations: Sequential random read (addr=60, 8 bytes): C4 7F BD 84 01 00 0C 2B
2311-3387 24xx EEPROM: Operations: Sequential random read (addr=70, 12 bytes): 28 80 00 80 A4 83 E8 7D 0A 27 00 00


Switching to mode "Hz":

Code: [Select]

   12-353 24xx EEPROM: Operations: Random access read (addr=8B, 1 byte): 12
  373-714 24xx EEPROM: Operations: Random access read (addr=9B, 1 byte): 13
 734-1075 24xx EEPROM: Operations: Random access read (addr=AB, 1 byte): 15
1095-1436 24xx EEPROM: Operations: Random access read (addr=BB, 1 byte): 00


Switching to mode "10A":

Code: [Select]

   12-353 24xx EEPROM: Operations: Random access read (addr=86, 1 byte): 10
  373-714 24xx EEPROM: Operations: Random access read (addr=96, 1 byte): 11
 734-1076 24xx EEPROM: Operations: Random access read (addr=A6, 1 byte): 00
1095-1443 24xx EEPROM: Operations: Random access read (addr=B6, 1 byte): 00
1500-2710 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2728-3136 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3160-3835 24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7


Switching to mode "mA":

Code: [Select]

   12-353 24xx EEPROM: Operations: Random access read (addr=87, 1 byte): 0E
  373-714 24xx EEPROM: Operations: Random access read (addr=97, 1 byte): 0F
 734-1075 24xx EEPROM: Operations: Random access read (addr=A7, 1 byte): 00
1094-1435 24xx EEPROM: Operations: Random access read (addr=B7, 1 byte): 00
1492-2702 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2721-3129 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3152-3827 24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7


Switching to mode "uA":

Code: [Select]

   12-354 24xx EEPROM: Operations: Random access read (addr=8A, 1 byte): 0C
  374-715 24xx EEPROM: Operations: Random access read (addr=9A, 1 byte): 0D
 735-1076 24xx EEPROM: Operations: Random access read (addr=AA, 1 byte): 00
1096-1443 24xx EEPROM: Operations: Random access read (addr=BA, 1 byte): 00
1500-2710 24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
2729-3137 24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00
3160-3835 24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7


[sequoia]

Initial analysis of EEPROM access seems to reveal what memory locations in the EEPROM are actually used by the meter.
And as expected these locations mostly match to what is documented in DTM0660 datasheet (http://www.kerrywong.com/blog/wp-content/uploads/2016/04/DTM0660DataSheet.pdf)


Boot sequence for the meter is as follows (followed by the reads associated with the mode switch):


Chipset "main" configuration:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=F8, 6 bytes): 5A C6 EC 1E 0A 00

Locations:

0xF8 (5A): ???
0xF9 (C6): configuration data (bitmap)
0xFA (EC): configuration data (bitmap)
0xFB (1E): auto power-off timeout (minutes)
0xFC (0A): backlight timeout (minutes)
0xFD (00): configuration data (bitmap)


Chipset full range and range switch configuration:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=10, 15 bytes): 10 27 0F 27 DE 03 66 66 3D 3D FF 3B 0A FF 40

Locations:

0x10-11 (2710): Default full range (10,000)
0x12-13 (270F): Range switch upper limit (9,999)
0x14-15 (03de): Range switch lower limit (990)
0x16      (66): DC Voltage OL value (102 = 1020V)
0x17      (66): AC Voltage OL value (102 = 1020V)
0x18      (3D): DC Voltage warning threshold (610V)
0x19      (3D): AC Voltage warning threshold (610V)
0x1A      (FF): uA Current warning threshold (2550uA or disabled?)
0x1B      (3B): mA Current warning threshold (590mA)
0x1C      (0A):  A Current warning threshold (10A)
0x1D      (FF): ???
0x1E      (40): NCV display symbol


Unknown data:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=33, 12 bytes): 04 12 09 6B F8 0A D0 1B 0A 1A 01 0A

Locations:

0x33-3E: ???


Temperature measurement calibration data:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=0B, 5 bytes): 0E 01 E8 D4 03

Locations:

0x0B-0C   (010E): Environment temperature (25 C)
0x0D-0F (03D4E8): Environment temperature default ADC value


Amplifier parameter and mV calibration adjustment ratios:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=20, 4 bytes): BB 99 1B 81

Locations:
0x20-21 (99BB): Amplifier parameter
0x22-23 (811B): 500mV calibration adjustment ratio


AC mV / V range calibration data:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00

Locations:
0x40-41 (0100): AC60mV range noise to be subtracted (input signal is internally amplified)
0x42-43 (0100): AC600mV range noise to be subtracted (input signal is not amplified)
0x44-45 (0700): AC600mV range noise to be subtracted (10M/1.111M resistor divider, amplified)
0x46-47 (0098): AC6V range noise to be subtracted (10M/1.111M resistor divider)
0x48-49 (0064): AC60V range noise to be subtracted (10M/101K resistor divider)
0x4A-4B (0064): AC600V range noise to be subtracted (10M/10K resistor divider)
0x4C-4D (0064): AC1000V range noise to be subtracted (10M/1K resistor divider)

Unknown (calibration?) data:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=4E, 2 bytes): C0 00

Locations:

0x4E-4F: ???

Current calibration data:

Code: [Select]

24xx EEPROM: Operations: Sequential random read (addr=2A, 6 bytes): 2D 8D AD 8D 95 F7

Locations:
0x2A-2B (8D2D): uA calibration adjustment ratio
0x2C-2D (8DAD): mA calibration adjustment ratio
0x2E-2F (F795):  A calibration adjustment ratio



Without datasheet for this chipset, it's hard to determine what the "unknown" memory locations do. But comparing EEPROM dumps from different meter using same chipset might reveal something.

Especially interesting would be to find out if there is any DMM out there using this same chipset (DM1106EN) that has data logging capability?
EEPROM dump from such meter might reveal how to enable it on this meter as well...

[sequoia]

 
Looks like serial output may not be easily enabled on this meter or its on different pin than 20....

Flipping bit 1 on EEPROM location 0xFA doesn't seem to enable serial output on this pin:




No activity seen on this pin before or after the change (and long press of "REL" button doesn't seem to do anything).

Pressing "REL" button however triggers pulses on this pin:




I guess having Serial capability easily enabled would have been too good to be true.... Still, great meter for the price (about $30 currently)...

[Kaluluka]

Hello to everyone!
Great work I have to say, but on my brand new 90DM600 hack like above messed up AC and DC Voltage readings!
So, for now, I just added only °C temperature to my meter and it works great.
Regards to all!

Below is ORIGINAL EEPROM from my 90DM600, if someone needs it:

[coromonadalix]

shhhhhhhhhh  loll  Amazon will rise their prices