Hantek - Tekway - DSO hack - get 200MHz bw for free

[mobiletester]

You are right, the threat is too long.
My 5072P has 40k Memory and FFT.
I tried out the BW Changer. The timebase can set to 2ns but the input signal will be filtered. I measured the -3 dB point with a signal generator at 80 MHz.
So I must check if a SW downgrade to 3.3 is possible. And the how to do and the necesary files.

[tinhead]

You are right, the threat is too long.

well, all necessary informations - to hack - are on the first page, as well all links to useful things. If this is not enough,
while in thread, search for 5072.

I tried out the BW Changer. The timebase can set to 2ns but the input signal will be filtered. I measured the -3 dB point with a signal generator at 80 MHz.
So I must check if a SW downgrade to 3.3 is possible. And the how to do and the necesary files.

others reported no problems with 5072p. If you don't mind make a good picture of the PCB and especially the input stage (open the metal cover).

[mobiletester]

Thanks for your reply.
Here are the pics. Another question: Is the memory soft or hardware limited?
The HW Version: 1000xffff8103

[echen1024]

Has anyone tried writing serial decode + triggering packages for this scope?

[mobiletester]

Can you explain this for me?
I think Hantek splits the modelcheck in the filtermodul for the frontend and the part of the timebase.

[tinhead]

Can you explain this for me?

The input stage does have 4 sections - the JFET/NPN input, the VGA, the bw filter, the driver (in case of "P" models THS4505, on others LHM6552). The first section is same on all models (except some diff. in attenuator and series resistor, but that does not have any influence here), and not only Tekway/Hantek models but as well Siglent/Atten and Rigol (even the DS2000) are almost same here. Sure, the workpoint is set different here and there, but in generally they all good enough for lot more than 200MHz BW. The VGA does not have any filtering (except its own output impendace), th BW filter is only used for 20MHz (nothing else, there is no other function implemented - not like on Rigol), the driver is for sure fast enought. Sure, on "P" models the THS4505 is good up to 260MHz (G=1, and this is hat "P" model is doing). I don't see anything diferent on your model, other "P" model owner have no BW issues.

part of the timebase.

you have to understand the firmare first, all timebases are loaded - then, based on model type - some blocked.As well the FIR filter will get set to specific frequency, e.g. 100MHz model is using fileter=10, which is 100MHz. That said, at 150MHz the attenuation will be -16dB (and at 100MHz -3dB). The firmare is selecting the filter value based on model name, so when you do hack, not only the timebase will get unlocked (and on some models FFT and some memory), but as well the filter will get set. When you however set wrong name (or something goes wrong), and the model name is not /dst1202b then the firmware might do everything but not what it should. Sure, there is as well possibility that the firmware you using is blocking higher model names. But hey, you can downgrde firmware, or you can set the filter manually (which will override the value set by firmware). All you have to do is to creat file on the SO, in / dir, named tst. Then edit that file, type inside

  [filter] 25

and save it. After next reboot the DSO will using 250MHz as filter value, which is exactly what 200MHz DSO is doing. That's all.
So as you can see there is always a way to hack. Btw, you should cleanup your frontends, there is lot of solder residue on the varicaps (between VGA and THS4505).

So first cleanup varicaps, then check if you did the hack properly. In the meantime would be good to know if other "P" models owner installed latest firmware (afaik yes, and afaik no problems) and if still everything working as before. Any ?

Then you can try the /tst file trick and check again .. btw, are you using the org. probes or how you measured the BW?

[mobiletester]

I have used my Spectrum Analyzer with Tracking Generator. The span is set to 0 herz and the frequency was changed. The cabel to the scope is terminated with a 50 Ohm feedthrough resistor on the scope side.
I know there is a missmatch, but when I connect the "scope side" (with the termination), to the RF input the frequency response at single frequencies is less than 1 dB up to 250 MHz. This is only a check.
Now I tried it with an "real" signal generator. The same result.
I cannot belive the limited BW comes from dirty PCB. Both channels shows the exact same damping and the filter curve is "to linear".
Thank`s for the explanation. I'm not so fit in software. I must check where I can get the SW to get access into the scope. I have read a lot of information in your thread, so I must check them again.

[tinhead]

I have used my Spectrum Analyzer with Tracking Generator. Now I tried it with an "real" signal generator. The same result.

so we can assume the source signal is ok.

I cannot belive the limited BW comes from dirty PCB.
Both channels shows the exact same damping and the filter curve is "to linear".

both are dirty at varicap, which is connected to two 150p caps. when forward biased, the resulting 75p and AD8370 output source implendace are bulding the 20MHz BW filter. As said before, other models are using only 20MHz and no filter, but from technical point of view it is possible to reverse bias the varicap from 2.5p to 35p. To get 80MHz filter total 40p would be necessary, with already 75p in series that means 90p from varicap - for sure not possible with the originaly used BBY65-02V. So if they doing LPF here, then varicap is not BBY65-02V and/or these two series caps are probabyl not 150p as well.

The dirt on PCB can for sure have influence, but the combination to get together 40p is not that likely (and as you said, linearity).

I would still cleanp and check again (and test if the 20MHz bw is working as expected)

Both channels shows the exact same damping and the filter curve is "to linear".

but let assume the other ppl who tested "P" models made mistakes, and let assume it is firmware:

the FIR filter value will be set based on model, in "Filter_Init" is caling "CalMaxCornerFreq". Here the "GetDSTBandWidth" which be called first, which tests the value of "m_bandWidthID" which set before by readin the model number. Then there is jump to "TST_GetCornerFreqID" - which tests first if /tst file exists - if not the "CalMaxCornerFreq" will set the right filter parameters (based on model), but if there is /tst file then the vaue from that file will be translated and taken.

So i've copared the "P" model and "B" model firmware (3.40 vs. 2.7 on "B" where we know that hack works) and in the filter code described above os no difference (except the fact that "P" model is using 160MHz value for 100MHz "P" model and not 140MHz as "B" model is doing, so bit more BW available here). I see as well the main, init and all the threads calling filter - so no diff here. Honestly, if there is any difference then i can't see it (which didn't means anything, but wondering why hack is working for other "P" models users, but sure, it is possible they haven't tested deeper when timebase changed).

Around the THS4504 there is nothing wrong (except the resistors they used are not out of spec) in the circuit, 499R and 22R series are exactly as it should be (G=1 and 499 for feedback are exact as specified by TI, 22R series is withinn the 10-25p for high capacitive load, which we have here due 8 ADC x 2p each + 2-3p from relais).

Honestly, all i can say is - cleanup the varicap, measure the voltages when 20MHz LPF on/off, you can as well (for test purpose) remove one of the caps near varicap (if you do changes, always on both channels) and test then the BW, try the /tst file trick.

And let us know if any changes there. I don't have "P" model, so all i can do is to read the schematic/datasheets and check the decompiled firmware.

[mobiletester]

Thanks for your support!
I cleaned the PCB with Flux Off, no changes.
So I try out the software solution. For this I must study which tools I need, and do the modifications.

[tinhead]

Thanks for your support!
I cleaned the PCB with Flux Off, no changes.
So I try out the software solution. For this I must study which tools I need, and do the modifications.

you can use the USB Tool from Peter :

http://peter.dreisiebner.at/dso-usb-tool/

you can use it to upload the previously created "tst" file into /

You can as well disasemble the enclosure and connect physical uart<->ub converter, then run terminal app on you PC and work from there with editor like "vi" to create the "tst" file.

[tayfun]

Hi;
I recently got my brand new MSO5202D V3.2.35. I download latest firmware from www.hantek.com website and put in to usb stick. Then I upgrade the scope. Menu appears please restart the scope. When I restart the oscilloscope Hantek logo comes then blue screen comes and restarts forewer. I thing that it was wrong version (SW: V2).
Now I have dst1kb_3.2.35_15202d_fact130826.0.up file but i hope it is not too late. Please help me.....

[rigrunner]

I've been looking at some sine waves recently and i've noticed something odd.
The RMS calculations seem to be wrong. 880mV peak to peak should give 311mV RMS but my hacked voltcraft doesn't seem to agree.
It's a 1007 board and it is running dst1kb_2.06.3__130814.1 firmware.

I've also noticed that at 10MHz the levels are measured slightly lower than under 10Mhz. Is this the front end problem that you mentioned a while ago Tinhead?

Please take a look at the peak to peak and RMS figures in the screen shots and tell me what you think?

[joaoc]

This thread is way too long ! Is anybody running a forum with the topics a bit more searchable ?!

I'm looking at buying one of the hantek scopes but having trouble working out the tradeoffs. I don't think there's any saving in buying the DSO1062, and I'm not convinced 1GS/s is enough for 200Mhz mode, so I'll probably stick with 100MHz bandwidth. I've got faster analog scopes anyway.

But there's the choice of B, BM, P and MSO5120D.   

B is a bit cheaper
BM has 2M memory (but does that make it really slow update ?)
MSO is useful but only 1M memory.
P is really cheap but only 40K memory (or maybe 24k?)

Of course, I'd really like the best of everything ! It seems the MSO option isn't that great and can be added fairly easily. So maybe the 2M is the best choice ?

Are there any options now with ethernet already fitted ? There seem to be some add-in boards, or I can put a wifi adapter in the USB.

I would also like to know what is the best to buy.

From this site the BM is cheaper that the B model... http://www.rigoloszilloskop.de/search/?DirID=&q=dso5062 I'm trying to stay close to the 300€ mark...

Thanks for the help!

[tinhead]

EDITED: i should not take that many drugs ...

The RMS calculations seem to be wrong. 880mV peak to peak should give 311mV RMS but my hacked voltcraft doesn't seem to agree.
...
I've also noticed that at 10MHz the levels are measured slightly lower than under 10Mhz.

which RMS, cyclic or periodic? When you look exactly, the periodic is always the same, where cyclic depends on the position of the first waveform cycle and amount of cycles (resolution).

So let's RTFM now   "Cyc RMS - Calculate the actual RMS measurement of the first complete cycle of the waveform"
(RMS over the first cycle in the waveform), so it does not have anything to do with frequency, but on the first visible and measured cycle.

Let's check now the measurment inaccuracy: with 200mV/DIV and 10.24DIV vertical resolution (this is hat the DSO is doing) 1LSB is equal 8mV. The periodic RMS you measured is 304mV, and this is 1LSB from the pk-pk back calculated value (as you said it is 311mV, the next steps on display can be however 312mV and 304mV, your DSO is displaying 304mV). Sorry, but that by far within specs. You should as well always try to use full vertical resolution, on your pictures you measuring only with half of the full range. Even the worst cyclic RMS value is here still within specs.

Is this the front end problem that you mentioned a while ago Tinhead?

short answer = no.

These problems i spoke about, they apply only to signals between 130 and 200MHz with highest inaccuracy at 165MHz or so, they apply afaik only to (still only some?) 60 and 100MHZ DSOs hacked to 200MHz.

[tinhead]

I would also like to know what is the best to buy.

it depends what you need. Due the fact that some distirbutors stil might have hw1007 models, i would be careful buying. It does make more sense to buy the latest hardware and not the hw1007. So watch the SN.

From this site the BM is cheaper that the B model... http://www.rigoloszilloskop.de/search/?DirID=&q=dso5062 I'm trying to stay close to the 300€ mark...

yeah, look on that crap webite, "Wir sprechen Deutsch", yeah my dog as well.

When you in Germany, buy from Conrad/Voelkner or Pinsonne.

[rigrunner]

Thank you for that detailed explanation Tinhead 

[joaoc]

I would also like to know what is the best to buy.

it depends what you need. Due the fact that some distirbutors stil might have hw1007 models, i would be careful buying. It does make more sense to buy the latest hardware and not the hw1007. So watch the SN.

That makes sense! I will hask for the hw model or SN when buying.

From this site the BM is cheaper that the B model... http://www.rigoloszilloskop.de/search/?DirID=&q=dso5062 I'm trying to stay close to the 300€ mark...

yeah, look on that crap webite, "Wir sprechen Deutsch", yeah my dog as well.

Lol. I'm from Portugal with zero knowledge of German, i've used google translator and the translations seams normal (for google...). I'm avoiding the store now...

When you in Germany, buy from Conrad/Voelkner or Pinsonne.

Thanks for the tips! I'm trying to buy inside the EU to avoid the border/custom taxes...

[tinhead]

Hi;
I recently got my brand new MSO5202D V3.2.35. I download latest firmware from www.hantek.com website and put in to usb stick. Then I upgrade the scope. Menu appears please restart the scope. When I restart the oscilloscope Hantek logo comes then blue screen comes and restarts forewer. I thing that it was wrong version (SW: V2).
Now I have dst1kb_3.2.35_15202d_fact130826.0.up file but i hope it is not too late. Please help me.....

you need an uart<->usb converter, if you have one then we can continue - without no chance to restore.

[wolfgam]

Hi,

i just purchased Voltcraft DSO-1062D (equivalent Hantek DSO5062B) with HW revision hw1010, SN: > 15000 (SN: 015996).
Does anyone know:
- difference between hw1007 and hw1010
- does the 200Mhz hack still work?

regards
Wolfgang

[STS463]

Hi,

maybe somebody can help me regarding an Error Code.

I have purchased a 200MHz TEKWAY MST1202B (7"TFT 1Mpoints 2CH+16x Logic) - SW VERSION: 3.2.35 (130926.0), HW VERSION: 1010x 55558340.

The "Self Calibration" function does fail at "self calibration step (13/34)" with message "Self calibration failed, error x502".

Can somebody tell me the meaning of "error x502" (what function of the MSO does not work)?

Thank you very much for your help.

[csaba66]

Hi,

I'm new here and have a Hantek DSO1102BV (hw version: 0x555583e8, SN: DSO0501xxx, PCB marking: DSO1000H v.1.00.1).

I haven't changed anything yet, except for a fw upgrade from 2.01.1 (120701) to 2.01.1 (130129).

After having read through the forum, I have several questions:

- I'm a bit puzzled by the Wave and Save Wave submenus under SAVE/RECALL: setting Media to USB or Flash, Save and Recall work as expected, but Recall fails when Media is set to SD even though Save succeeds according to the message. The SD card status is "built in"; is the "EEPROM licensing hack" still needed if I want to use the SD card for saving waveforms?

- The Save Wave button always saves to USB, regardless of the Media settings; is this a bug or normal?

- The UART header is marked differently on two pictures (RX and TX are swapped,
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/?action=dlattach;attach=50483 vs.
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/?action=dlattach;attach=19887 ). Ok, one is the pinout of the DSO itself, and the other of the module to be connected, but which is which?

- Beside the UART header, there is a four hole connector marked @WLAN. What module can be used there?

Thanks for all the useful info already here, and any answers to come, cheers

[sabresfan03]

Hi all,

I got my 1st scope, a DSO5062BM, 15000 version, because I liked what I read here and because of the great work of Tinhead.  Anyway, its menus are all in Chinese and I cant read it.  Does anyone know how to switch the language?  Thanks.

[tinhead]

Hi all,

I got my 1st scope, a DSO5062BM, 15000 version, because I liked what I read here and because of the great work of Tinhead.  Anyway, its menus are all in Chinese and I cant read it.  Does anyone know how to switch the language?  Thanks.

press Utility -> F6 -> F2 (to select language)

[tinhead]

The "Self Calibration" function does fail at "self calibration step (13/34)" with message "Self calibration failed, error x502".
Can somebody tell me the meaning of "error x502" (what function of the MSO does not work)?

unfortunately not :\

[tinhead]

- I'm a bit puzzled by the Wave and Save Wave submenus under SAVE/RECALL: setting Media to USB or Flash, Save and Recall work as expected, but Recall fails when Media is set to SD even though Save succeeds according to the message. The SD card status is "built in"; is the "EEPROM licensing hack" still needed if I want to use the SD card for saving waveforms?

i don't have handheld anymore, so can't check that ...

- The Save Wave button always saves to USB, regardless of the Media settings; is this a bug or normal?

is there a way to select SD as destination? if not, then it is not a bug, if yes - well, then it is bug.

- The UART header is marked differently on two pictures (RX and TX are swapped,

one of them

- Beside the UART header, there is a four hole connector marked @WLAN. What module can be used there?

yeah, i remember that header. On the bottom side you can see missing IC near that header, which is in principle USB mux like on BM/BMV model (check the hw1007 benchtop scheematic). I assume the intention was to enable second USB Host (and a usb wlan card connected to that header), but there is not option in firmware yet to use that from the menu (sure, you can add a script doing this or oatch firmware to enable it instead of beeper ...)