What is the main chipset used in the EEVblog BM235 Multimeter?
Dave finds out.
http://www.ic-fortune.com/
http://www.cyrustek.com.tw/
http://www.hycontek.com/
http://www.hycontek.com/attachments/DMM/DS-HY12P65_EN.pdf
Forum: http://www.eevblog.com/forum/blog/eevblog-912-bm235-multimeter-reverse-engineering/'>http://www.eevblog.com/forum/blog/eevblog-912-bm235-multimeter-reverse-engineering/
EEVblog Main Web Site: http://www.eevblog.com
The 2nd EEVblog Channel: http://www.youtube.com/EEVblog2
Support the EEVblog through Patreon!
http://www.patreon.com/eevblog
EEVblog Amazon Store (Dave gets a cut):
http://astore.amazon.com/eevblogstore-20
T-Shirts: http://teespring.com/stores/eevblog
๐Ÿ’— Likecoin โ€“ Coins for Likes: https://likecoin.pro/ @eevblog/dil9/hcq3

Hi I've done several videos on my Eevblog bm2 3:5 multimeter, I've done repairs and I've done troubleshooting and tear downs and all sorts of calibration. All sorts of weird and wonderful things. But one thing I haven't done and I mentioned it before is what chipset? What multimeter chipset is used inside the Eevblog / Breeman be m23 5 Because Bromanor the company of that design and manufacture this thing and I don't know. They won't actually tell me I'm and I'm not sure why it's You know, they just don't want it released to the public even if it is me.

I guess they just don't want word to get out. But anyway, it's usually not hard to just look at it and reverse engineer aboard. Not completely reverse engineer, but just do a few basic things to try and figure out what morning, what chipset is being used or what chip is being using. Any particular design doesn't have to be the Eevblog multimeter here, but I thought that would take a look at it and see if we can actually figure it out.

Now I don't think it's a custom ASIC because Brian ID they just not. I Don't think they're big enough and bold enough to do their own custom ASIC So I'm pretty sure it's gonna be an off-the-shelf multimeter chipset now. The new BM 230 Series differs from the venerable BM 250 series the 2 5, 7 which a lot of people are familiar with. and here's a photo of the underside of the BM 2 5 7 up.

sorry I'll just say get rid of me And here's a photo of the bottom side and it uses a substantially different chipset and you can see it's labeled BTC Orb Roman Technology Corporation and this just got some weird custom part number like that. so obviously that's in a much bigger quad flat-pack It's got the LCD driver built-in You can see the the tracers going off to the contacts here, which then go through the zebra strips there over to the LCD So that's all contained in one chipset. So that's one of those very typical complete multimeter chips. It does.

It's got the processor in there, it's got the ADC, all the measurements, switching and arranging, and all that sort of stuff. plus the LCD Driver building. But the BM 2, 3, 5 is significantly different. So let's actually go in and have a closer look here at the at the board and you'll notice that it is branded BTC again by Man Technology Corporation.

It's got some weird part number there. so they've got this obviously custom silk-screened and this is not how you can get this from virtually any chip manufacturer. Just go to them and say hey, I Want you know I Want to buy 10,000 of these chips? Can you also custom silkscreen brand them for me or laser brand them for me And there you go. No worries, we'll do that.

Put your own custom part number on, but it's an off-the-shelf chip so just because it might have Bremen on it does not mean it's an ASIC. In fact, in this case, I'm pretty darn sure it's not an ASIC because there's only a few companies out there that specialize in multimedia chipsets and it makes sense just to use one of those off-the-shelf chipsets. So anyway, they've gone for the BM 230 series is a lower cost than the 250 series. even though it uses two separate chips, they've obviously lowered the cost and you'll notice that down here.
Bingo! We've looked at this before the Hyr Twenty Six One Three. In fact, if we have a look here, I actually have a video on my second channel eevblog - if you're not subscribed to Eevblog - you should be. It's where I put various stuff comparing the BM - 5 7 to the 2 3 5 here and I had a look at whether or not you could hack the 2 3 5 4 serial output and I won't spoil it. You'll have to go watch it yourself anyway, because the main difference between the BM 2 5, 7 and the 2 3 5 is that the 257 a has a bar graph and B has a serial output capability and get like an Rs-232 infrared serial.

So I wanted to see if that was possible because the cases are identical between them, including the window for the IR module. Anyway, I am actually spoiling that videos. so the first thing we're gonna do is go check out some typical multimeter chipset manufacturers. and I know three offhand.

I'm sure there's more, but like off the top of my head I Can't think of them anyway. Three of the major ones. one is Fortune Semiconductor I see Fortune.com and if you go in here under measurement, here we go. They've got Healthcare but yep and all sorts of like custom and lug E-type chips.

There's companies that specialize in these things and make an absolute killing from them. Here we go the FS 9700 series 9800 series and they're using tons of multimeters, including the low end Chinese made flukes and things like that. So they not only do like complete multimeter chip sets like this, but they also do for example, a DC's Now these aren't just a DC's they're actually specifically designed. Take this one down the bottom.

the FS are 97 Oh X for example, specifically designed. as for multimeters, but it's just the front end Delta-sigma ADC plus the range switching and you know all that multimeter. It doesn't include the processor and doesn't include the LCD driver. so they're typically like a serial output type thing you know.

and you can go in and have a look at the data sheets of chips like this and they are significantly different. But in this case, we're looking for a complete multimeter chipset. this one in I've had a look at this one before for a design I'm working on for five thousand, 50 thousand count and log front-end and that's pretty much all it does. Here we go what it's a there we go typical application circuit.

You've got the front end but then you've got but then you need the processor in LCD driver over here. So completely different type of chip to the multimeter chipsets. Anyway, these fourteen semiconductor and then there's Cirrus Tech mode. They're very, very popular in a lot of the Chinese meters and they've got basic 2000 count once 3000, 4000, 5000, 6000 Now if we were looking at for a chipset for the BM two, three five, it's a six thousand count multimeter so it could certainly be one of those and there's many, many to choose from.
Check it out. Once again, these analog there's there's the smart DMM ones which are complete process and then there's just the front end ICS and things like that so it could certainly be a serious tech. and then the third major one is high con and Haikon manufacture. You can see down the side here they've got mixed signal staff, battery management I sees data converters, mixed signal controllers, and digital multimeter.

I season. They're basically got two chipsets here, the 3131 series. I've also looked at for a multimeter type design before and but that's like a high-end like fifty thousand count designed. But if we go over to here the Hy 12 P series is we want to have a look at through the different versions here because if we go over to the back to the photo here, let's have a look at the pin count.

Bingo! It's a 64 Pn quad flat-pack so you can eliminate anything that is not in a 64 pin package. What are we got here? Bingo L Qf P 64 64 So you can actually rule out a bunch of these, but you'd have to go in individually to see what size packages they're available in. Sure, the manufacturer can put them in different packages for you and things like that. They might even be able to do small custom variants.

but yeah, I don't know it could be a custom variant. it could come down to that Anyway, the high contact ones. certainly we're looking at here we go, but they've got built-in LCD drivers now. we'll come back to this.

but if we actually have a look at the table here, these two down here are 5000 count ones here and here now. Of course the BM T35 is 6000 count. but hey, I've seen chipsets being extended beyond their counts before so I'm not necessarily going to rule it out because it is the 64 pin quad flat-pack and the other reason that I suspect it actually maybe a hike on tech part is because if you have a have a look down here Bingo Our LCD driver is a high contact Hy 26 1 3 C So Bingo! we've got ourselves a hike on tech CD driver and that is the specific one that's actually been used in here. It's not there.

We're not using that package. We're actually using this package here. So the reason I suspect this high contact is because it's very common to use the same brand chip like this because they you can get better price and you say hey, I'm gonna use your LCD chipset as well as use your multimeter chipset. You know, hey, give us a few cents off or something like that and they can make a huge difference to the bond cost and then to your final retail price for this thing.

And they were trying to get the price down on the BM 230 series compared to the 2 5 7 so they've probably got a good deal. So I You know that's good circumstantial evidence that it could be a high contact part in. But and so that is where I would look first. So if we go down here and have a look at these ones at the 5000 count parts here, look the peak hold.
Now the peak hold function out. there's one that has peak hold one that doesn't Now the Two Five Seven had the peak hold the 230 series. the Two Three Five does not so and it does not have in rush current capability and it does not have the serial port UART But let's not get into that so it's you know I'm gonna have a look at the Hy 12 P 66 that one. Yeah, smells like it might be doing the business, but the thing is, look, it's got an LCD driver building as I said, a 4 by 15 segments.

so that is actually just capable of doing the LCD here. it does have a couple of more segments actually up in here. They were going to have a variation of this meter with for audio sorry Autumn for automotive stuff as well. So the LCD does actually have a couple of other segments here in here.

but in theory I believe that that chipset could actually do it. So why they're using if it is this one, why they're using separate LCD chip I Don't know. there could be some other technical reason. anyway.

I don't know, it's this one. So if we go down and have a look all beautiful, look beautiful lookup tables there. There register mapping tables for the individual bits to show you the flow and things like that. That's just excellent.

Absolutely brilliant data sheets. the haikon tech ones if you want to like it, follow through and see how multimeters actually multimeter chipsets actually work. Highly recommended. Well looky what we have here.

We've got ourselves the pin out at the bingo. We can actually go and compare this with our PCB This is looking pretty good. so if we have a squiz here at the chip, look at this. I've got them pin aligned.

so pin one down here and pin one down here. Check out all these unused pins all the way along here and up there. Sure, they could be going to something under there you can't see underneath. They could be going through some vias down to the other side of the board, but hey, that's pretty good Circumstantial evidence that this chipset that they're using with a lot of unused pins has a built-in LCD driver.

Otherwise, why if you were doing this is a custom AC you wouldn't be wasting all these pins. You'd be going for a smaller package. Sure, you could have like a dual use you know scenario in mind or something like that. But anyway, look map the pins from pin 1 through to pin 12.

Over there are the segments so only the last four are something else. so I can actually go in and expand that. There you go to show you what ones those are and you can see the last four pins. It matches up.

The rest are segments. So because we don't have, we're using a separate LCD driver in this multimeter. Bingo! We don't use the internal segment so this matches up perfectly. So right there you go.
Aha! So unless the manufacturers are like ripping off the pin outs between chipsets which I don't think they do I think they're pretty substantially differ, then hey, this is looking really good. Anyway, So these segments over here at you. so one, two, three, four, five pins unused. One two three four, five pins unused.

But ah, look. come one and comm zero are actually connected. That's interesting. If it is.

this chip comes your own comm one are connected. Hmm. interesting. Anyway, let's go up here.

It looks like the pin 49 up here is a power or ACM What's that? We'd have to have a look at that and analog ground. Look 48 Up here. 48 over here is looks, you know it's got a nice fat trace going to it, so that's likely analog ground. There's a couple of unused pins over here don't know what they are, or they could be going under the chip for example.

But anyway, so right off the bat there, that looks like a very good contender. It's almost too much of a coincidence. so if it's not this one, it could certainly be a high contact. really points towards high contact being the manufacturer of this chipset.

And do we have any other evidence? Well, operation voltage from two point four to three point six volts. Perfect for operation of a couple of triple eight to triple A's like we've got in here at six. K word. One-time programmable program memory of 256 bytes of data memory.

Um, that's more than enough I Know for a fact that this is an OTP or one-time programmable micro because they just actually upgraded the firmware on it, fixed our bug and they can't rewrite them. hence the name one-time programmable. So once you program them, Bingo! If you want to upgrade the firmware you've you can't do it. You've got to scrap all those chips or ship them with the old firmware.

only blank ones can you actually program that and also 6k Words limited when they were doing the development of this thing when I was talking with them I Didn't really help with the development of this, but they sent me an early well that they sent me like early spec sheets and things like that while they while working on and I said hey, you know in some of these modes are a bit limiting can you and these modes in and then they came back and said ah, we're not sure the firmware guys are saying that it's and it's There's not much room left in the firmware, but they did manage to squeeze it in so you know. and the operation mode for megahertz? Bingo. We've got a four megahertz crystal on here, but hey, that's pretty stock standard. although chipset I'm working off the moment uses four point, one, seven something or other and uses an oddball value.

So anyway, yeah, I wouldn't go by that, but it does have the UART module built in. but yeah, it's looking good. true RMS Bandwidth 1 point 5 kilohertz I'm not sure these specs because the BM 235 has true RMS but it's only SPECT up to 440 Hertz It can go beyond that, but I do know for a fact that it does actually die and do weed stuff beyond 1.5 kilohertz or thereabout. So I think I Measured it once and it did do that so adds its stack it up pretty well.
It's it's one of these puppies, obviously the one without the inrush current and the peak old. That seems to be the only difference between the two. Is it? Yep, I mean so obviously they're saving some cost because there's no inrush current capability or peak old. Hmm.

and if you're wondering what sort of processor it's got in this thing, well, there you go CPU ho8 A and it's got an 8 by 8 hardware multiplier. haha. Kicking some serious butt there if you go over to the page. Actually, they've got some decent stuff here.

They've got the development kit software, the programmer ah, for frequency calibration. okay, they've got the software for that and user manuals and the hardware user manual and performance test to all sorts of jazzy stuff. I might have to have a play with the hex loader for the program. You've got to physically have the programmer though.

And here we go: the HOA instruction set manual. So that's actually A. It's I believe. it's like their own variation of some architecture and they've got the compiler here and the configurations and all sorts of stuff.

So here you go. There's the instruction said. So they've got their own processor. go.

figure. But it's all there. There you go. EDD See, it's a familiar to anyone.

Hey Dell there you go. So the ripoff of the Hey Che? Hmm. by the way, this configurations document that you that you can get here. it's brilliant.

Check out Look. it's got all the different configurations or switching configurations. It shows you the signal flow for each particular mode. Look at that.

So in 500 milli volt DC Volt mode, that's how it flows. This is how it uses the Aid Delta-sigma ADC bingo which registers you turn on all sorts of stuff. Incredibly comprehensive and this is not proprietary stuff. You can just go.

so there are website and and download. This is fantastic. As I said. If you want to actually see the architecture inside our multi meter chipset, there's no better way to do it than this.

It's absolutely fantastic. Look at a comprehensive that is Cheese. They go into town and some waveforms there. Wow Brilliant.

There we go. Is that the capacitance? Yep, that's the capacitance mode telling you exactly how it does it. Anyway, check it out. I'll link it in down below.

it's awesome. Oh great bedtime reading. So although this is looking really good, the sticking point here is these two comm terminals over here. Now look, there's a that looks like a ground eater.
Well, no, that's going to the positive side of this tantalum cap here. So that is supposed to be the comm 0 pin. yeah, that's supposed to. That's pin 58 supposed to become 0.

There's no alternate function for that. So whether or not we've got the wrong chip although I'm reasonably confident at this point it is a high contact of some sort. But whether or not we got the wrong chip or whether or not they've ordered a custom variant of this chip I don't know and they actually removed all the LCD functionality. but they checked and kept all the pin out and everything the same and maybe just changed a few of the functions there.

I Yeah, I don't know. Anyway, we're close, but still no cigar, just the smell of a cigar. Hmm. and once again, if we have a look here, you'll notice that the negative of this tantalum cap.

Okay, this is our big ground here. or some ground. it goes, that's actually pin 55 there. Okay, that's pin 55 and pin 55 here is our St VPP So it's reset IC or EEPROM rewrite voltage source so it's not quite making sense.

Anyway, pin 54 is VSS ie. ground and sure enough, the one next to it 54 that also looks like it goes to the negative side of these caps so that could be ground, but something else is happening there. In fact, it even says VSS there it is digital VSS 1 So that's the correct pin. so Pin 54 is correct.

Not entirely sure what's happening with Pin 55 here, but yeah, we're doing it reasonably well. Look and then Charge Pump capacitor port Pins 52 and 53 here. so we expect to see a capacitor on there. What do we do yet? We find a capacitor C 15 there.

Bingo! We've got a charge pump and then what is that? Charge Pump Voltage Source 51: Yep, there we go. That comes from the positive side of that tantalum. So that could be the charge pump voltage source and then the next pin in there. and log circuit voltage source.

Bingo! So Pin 50. Okay, so the second pin across. what are we get? We expect that to be VDD analog the analog circuit voltage source. So you you expect to see some sort of star ground in point because all you know star grounding is gonna matter in not something like this.

So let's follow the money here we go. Pin 50 go on across. sorry, I should make my cursor bigger, but hopefully you can see that. And Bingo! What do we get stuck around in point? There's a point here.

The ground runs off here and it runs off down through a via. They're going buggering off to somewhere else. It runs over to C 16 here, so that's exactly what we expect. so it's all matching up.

These two comport down here. don't match up. They could be going off doing something else. Maybe the internal micro can program them to do something else.

Perhaps. Anyway, yeah, it's those pins. I'm matching up. So I'm really liking this and if we keep going here, let's go.
48 is analog ground. Yep, that looks like yeah, that looks like a ground going through there to pin 48. Pin 47 is a reference voltage port. Okay, that's going off to a yep, there we go.

that's going off to a capacitor there. Okay, no worries. I'm happy with that. And then Pa0 that's the switch of the analog.

Network Okay, so pins 46 through 240 are a well no actually all going up here are all party analog. Network and bingo this is. Look all these all these resistors and cap. C That's all part of the analog networks.

That's exactly what you expect to see. So all those pins are matching up very nicely. If we have a look to see where our UART pins are here, we go transmit and receive 20 and 21 here. So if you go over here, pin 17, 18, 19, 20, and 21.

Okay, so they're buggering off down here somewhere doing something. but they're also multi-purpose pins. so there can be digital input digital I/o for example. Obviously, this meter does not have, as we saw in the previous video, does not have the Rs-232 serial output capability.

So obviously they've programmed the micro in. E If it is this one, program the micro not to have any serial output, it's obviously it's going to be buggering off to the chipset, but they seem to be going down to some trend transistors down here. A couple of caps: I Don't know something's yeah, something's going on, but they have to have a serial interface going over to the LCD driver chip and if we take a look at our else the driver chip here the high contact part. it's an I squared C interface.

Bingo! So that's SC l SDA So we can find those pins on the sorry on the package here: L Q F P 48 That's the one we've What's the ABC versions are. they're slightly different in terms of backlight and things like that. Anyway, we're looking at pins 9 and 10. There you go: Pins 9 and 10.

They're on all the packages so follow the money over to here and we can have a look. Hopefully they're on the top. Pins 9 and 10 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 bugger. they're going off under there any way.

I Could get the physical board and flip it over and try and see where those are veers go but we expect those. Yeah. I'll go do that now. Actually, I'll spare the details right? So I've had a look at the physical board and the I squared C pins under here.

They go off to some Vias up here which then snake off over to these which then go through these zero ohm jumper z' here. Yes, you can get zero Ohm resistors and a yes they do have a tolerance on the datasheet. It's funny. Anyway, they go through here and bingo they go up to pin 17 and 18.

What's Pin 17 and 18? I Hear you ask? Well, let's have a look. digital input output and yeah, there. I open. So yep, it matches up.

they could. Although it doesn't say that this thing actually has I Squared C capability, they could be bit banging. the I Squared C port doesn't necessarily have to. Micros don't have to have an I Squared C peripheral in them for you to use.
I Squared C I've written my own I Squared C bit banging routines before and it's not that hard. It's pretty easy, you know it doesn't. It takes. you know, tens are lines of code.

It doesn't take much at all to implement an I Squared C interface, so it looks like they're the two pins and there's probably pull-up resistors somewhere. Yeah, there's a video here via there. It probably goes off to a pull-up resistor somewhere because an I Squared C's gotta have some pull ups. And if we have a look at pins fifteen and sixteen here, where do they go? They go off to the crystal their bingo and that's exactly their purpose in here.

even digital I/o so probably you. There's an internal oscillator in this thing if you want to use it or output for the external oscillator, so it's all matching up pretty well. It's hard to fold it so far, so if we go back to the high contact page here like it's not going to be one of these mixed signal microcontrollers because it needs to have the multimeter functionality building. There's no a separate chip.

It's definitely doing all the multimeter functionality in this chip and the only two that they have here listed on their website Hey yet? Granted, there could be others which haven't made it to the website, which we don't know about. subtle variations on parts or whatever. Could certainly be one of those. but it's not the 31:31 series here because that one's like a high-end fifty thousand count.

You're not going to gild the lily and use that in a six thousand count meter. Price sensitive six thousand count meter, so it's looks like it is the Hy Twelve P 65 / 66 here. it's not going to be the others two thousand count, but they're obviously over counting them here. But the way these dual slope art converters work inside these things, you can actually get a higher count out of them.

so it looks like they are pushing it to six thousand count. But why they're not using the internal LCD driver of this thing? they're using the external LCD chipset. Not entirely sure at this stage. maybe something will come to me.

but anyway, they are definitely doing it. They could have I Think that could have got away with that chipset. but there's probably some technical reason why they're using the second chipset there. But anyway, that's interesting.

That is almost certainly a Hy 12 P 66 I'd say best guess I Tell you what. These two chips over here u4 and U5 look interesting. Look a pin SOS and you'll notice that these four pins over here. These four are all tied together like this.

It's almost as if they're like and addressable. They're addressable pins set in a dress and this one has three pins tied the other ones buggering off somewhere else. So that makes me think that these are I squared C devices. So actually one of those has got to be ground.
So you know, probably ground and power here like this because that's going to a bypass cap. So power pin here ground over here. So they're going to have three addressable pins here. so that'll give you our eight addresses for the I squared C So and then you got your ground over here.

These look like your digital address pins. but then you've got to have your I squared C pins as well. So they're going to take two pins and it makes sense that it's I squared C Cuz look if this is the power pin here pin eight then because it's going to the bypass cap, then this is going to the top side of a 10k resistor here. 103 10k Very typical I squared C pull-up resistor value.

So that is potentially an I squared C pin. but in that case, it doesn't leave much left. Fear enough Pins Left right. Back to the datasheet.

This does not have a squared prom built in. It needs it because this multimeter is actually quite smart. It will remember the last mode that you put it in if you leave it in DC Volts mode. for example.

It'll go back to DC Volts mode if you leave it in capacitance mode instead of Dyer mode. It'll go back there when you turn the meter off. So it's obviously storing that in a squared prom. And this thing.

if it is this chip which we think it is, it does not have any E squared prom in it. So which is also why if you go back to the oh, go back here. Tada 24:02 Look at that external a squared prom. Umm, so that could be the best guess for those, but why you would need to? Because this thing does not do data logging at all.

so it's not like it needs to store. You know, a lot of stuff. So why you would have to? E squared Prom chips I Don't know. Strange.

Bingo. I Found it. It's a Rome E Squared promise. Sure enough, look here's the product name marking from the data sheet.

It's the BR 24 L That's why it's only got Lo2 on here. And sure enough, the Lo2 is the product marking for the SOP 8 package. Bingo! there we go. So it's a to scale a squared prom.

Why they've got two of them I Got no idea. Anyway, yeah, I squared C and if I saw it's right about the I squared C interface. If we go down, have a look at the pin out. Bingo there it is.

I was right. power ground, three address pins and that is your know Bob that's your right protect and then your I squared C lines there. but yeah, it's got force K of B squid prom Why I mean I don't get it. And of course you need an E Square prom to hold the calibration data in there.

but that still doesn't explain to chips. I mean 2k is plenty to hold the calibration data I one would suspect and then hold the mode the last mode it was in. Jeez, You know if you couldn't do that in a in a single byte then I don't think you were trying. So that is just yeah.

Strange that they've used to I Thought this was a real cost-cutting measure multimeter in terms of like Broman one. they were trying to get the cost down, but no, they went for the extra bomb item there so that is. that is rather unusual. I you know.
I Also suspect that they've gone overboard on the tantalum caps. One two three four five, six, seven eight. that big one there. the big yellow one there.

that would be for the battery and there's nothing one down there that would be for the LCD Okay, fair enough. Yeah, maybe you've gone a bit overboard these transistors here obviously for to drive the buzzer here and that's about or she wrote. hmm and if you are curious about the other chipsets, the Cirrus Tech for example, you go in here for the 6000 count D mm No there hundred pin quad flat packs. Maybe they might have used those 128 are they do no 64? So whether or not you know they use that in maybe the 257 I don't know they might have changed to a hike on tech perhaps? I Don't know.

but yes, 6000 count autorange d Mm there doesn't seem to be like you know, a hundred and hundred and twenty-eight pin. Nope, there's just no. it's nothing, just takes it over there. so it looks like a peaking rush jewel display.

We don't have jewel display so it's not going to be that 50000 counts? yeah, they could have with Cap for example, one hundred and Twenty eight p M-- quad flat-pack Definitely not that. And as far as the Fortune Semiconductor ones go, well, they handy package guide here. They do have a 64 pin quad flat-pack but that's only for the Mm. can't one there which doesn't even do capacitance and everything else so it's definitely not that.

So there you go, Almost certainly this is the Hy 12 P 65 / 66 or I wouldn't rule out some custom variant of it for Bremen I Would not rule that out, but it looks like yeah, it's an off-the-shelf thing they've reprogrammed. they've decided not to use the building LCD Drivers don't know why, even though I think it might have enough segments to actually do it. but in anyway I hope you found that. An interesting little look inside the Bremen BM @ 230 series and some unusual are choices in.

they're certainly not unusual to use our hike on tech chipset and but separate LCD driver to E-squared problems I Don't know Anyway, discuss down below. go for it. Oh, and I'm sure people will ask you know, can this be hacked to do other things and things like that? I Don't think so because it's an OTP part. it's one-time program that's not leaking.

Get in there, get the tool, and then reprogram it to, you know, repurpose it to do something else. It looks like they're repurposed the UART lines for example. So you're not going to be getting serial data out of this puppy anytime soon. It's basically going via I Squared C to the LCD driver.

So if you wanted to actually get data out of this thing wirelessly I Guess you could actually make up your own little module to hack onto the I squared. C Line Read the data coming out of that because you will have the data format for the LCD. So what goes into the LCD Even though we don't have what the data that's been outputted from the micro itself, it doesn't matter. It's got to match what the High Contech I Squid see data sheet will say when what that chip is expecting.
So if there you could read that, decode it and you know, shift that you know send that out via bluetooth or something else wirelessly if you wanted to hack something in that way. But apart from that, no, sorry, it's an OTP part. Hmm. bummer.

And if you're wondering what this puppy is down here, this little jumper linker j1 my hunch was correct I did actually check. This goes over to the right protect pin of this E squared prom here. So this one, this lower one u5 is almost certainly the calibration a square problem. Maybe that's why they did it.

Maybe that's why they're using two. They're just separating the calibration. in fact. Bingo.

It just occurred to me. Dole. Hang on. Yes, the reason that they're using two is for robustness.

Okay, they're doing this for protection. basically our physical protection so that you cannot erase the regardless of you know, some bug in the software cannot erase the calibration settings of the meeting you've got to actually put that jumper on to enable the right pin the physical right pin of u 5. Here, the E Squared probe that Taine's the calibration data whereas the other a squared prime over here will be used for like the power on/off settings and things like that. It seems like if you're really penny-pinching every cent, you would have taken that risk.

that okay, you're going to just not have this jump it not to have this calibration jumper here and just rely on the fact that the software can just store in a different address for the power up and down so well. And I guess you don't want to lose your calibration data these how many writes on this thing? How many writes was it I don't know but I Guess if your power on the meter 10,000,000 times or whatever. Surely it's got 40 years a million. Okay, so I think your contacts would wear out and you switch before you powered this meter off and on a million times assuming that they got it right in software and they only maybe they are actually right into it every single time you change a range.

That would be interesting. So if you're switching for example, between the capacitance mode and the diode mode or you're changing between AC and DC, maybe they're instantly writing that into that chip. So in theory, you could wear out the top E squared from here you for by you know, pressing the button a million times or whatever and you still wouldn't lose your calibration data. You would lose the ability for it to store the last mode you're in, but that's not a showstopper.
Your meter would still work in a separate chip, so there's decided just to physically separate that out. So that's a nice engineering design decision. and they didn't penny pinched there. That's really interesting.

Maybe I could like set up a like a button pusher and automate a button pusher that actually pressed the button on the Moldy Like pressing like the Ac/dc button. I should actually do a separate video to prove that I won't do it now. I think I'll get the scope on there and actually see if it is actually writing to that chip. Uh-huh.

Will this be a second chance video? or a part two? Anyway, whether or not it's doing that every time you press that button. Interesting. Anyway, this videos been way too long, so I'll save that for another one. Catch you next time and a completely shameless plug because I do flug this thing on my website.

So if you do want any Vblog, be M23, Five, malta me that go over to Evie Blogger.com and check it out in if you're inter. As a bonus for watching this whole forty minute waffle. and if you do want one, put in the coupon code waffle or upper case and you'll get I think 20 bucks off. Bargain for a limited time only.

Hey check this out! Look amazing Symmetrical Modi Made a stacking just like the Philadelphia Mass turbulence in 1984 aren't believable. No human could stack multimeters like this. Hmm, well, that's a few multimeters 40 to be precise. I Can't explain it, but there's something very therapeutic about doing this.

Oh yeah.

Avatar photo

By YTB

26 thoughts on “Eevblog #912 – bm235 multimeter reverse engineering”
  1. Avataaar/Circle Created with python_avatars Alien X says:

    cheap

  2. Avataaar/Circle Created with python_avatars Marcin Kurczalski says:

    So with coupon one could get EEVblog marked Brymen below your costs (AFAIK you sell them with almost no profit, am I right?)
    already got one anyway, happy to use it.
    Good Waffle can go on ๐Ÿ™‚

  3. Avataaar/Circle Created with python_avatars mreyeballz says:

    Is the boardlayout of the bm257s similar to the bm257(without the s) or are there differences?

  4. Avataaar/Circle Created with python_avatars germimonte says:

    not a clue, but the lcd uses multiplexing, so maybe the lcd coms from the main chips are used for something else(maybe buzzer?) or maybe to make the layout neater, to reduce the number of layers

  5. Avataaar/Circle Created with python_avatars Paulo Constantino says:

    Dave, I am so addicted to your videos that during the last 2 days I was feeling depressed and didn't know why until I came to watch you! ๐Ÿ™‚ Love you man ! ๐Ÿ™‚

  6. Avataaar/Circle Created with python_avatars Carlos Lucas says:

    Hi Dave,
    I noticed on the picture of the BM that the external oscilator pins are 14 and 15, and the datasheet of the micro you were considering to be the on on the BM says pins 15 and 16 for the external oscilator.

  7. Avataaar/Circle Created with python_avatars Mohd Lee says:

    The HY12P65/66 datasheet says crystal is on pin 16/17, but looks like it's 15/16 on the board.

  8. Avataaar/Circle Created with python_avatars JanicekTrnecka says:

    IRFANVIEW-> my favourite!

  9. Avataaar/Circle Created with python_avatars Alyx says:

    Let's tap the i2c!

  10. Avataaar/Circle Created with python_avatars Eddie Hermansson says:

    Cupon already expired? Better be quick here at the EEVblog, 3 days!

  11. Avataaar/Circle Created with python_avatars PuchMaxi says:

    Decap the IC and throw it under the old microscope!

  12. Avataaar/Circle Created with python_avatars Jonas Forster says:

    Hi Dave!… I smell something fishy in the air… could it be…. power from footsteps?

  13. Avataaar/Circle Created with python_avatars Reckโ€™s Design and Fabrication says:

    video on hacking the i2c bus would be cool.

  14. Avataaar/Circle Created with python_avatars Sergej says:

    By some weird coincidence, I'm trying to repair one instrument with an HY3131 chipset inside… It's a 50.000 counts current clamp meter where they didn't bother to remove or alter the markings.

  15. Avataaar/Circle Created with python_avatars George Snyder says:

    Dave,

    GREAT BLOG………How about a class on Volt Amps. Real power vs Apparent power. There seems to always be confusion on this subject. Thanks.

    George………

  16. Avataaar/Circle Created with python_avatars Chris Baker says:

    As an embedded software engineer, if I knew I had an entire 2k EEPROM to work with and had to update a setting very regularly (like once per second for a clock or every time a mode change happens), I would split the data up into a linked list of records and write them into the EEPROM successively. With a EEPROM you can usually change a bit from 1 to 0 for free and you only impact the cycle count when you erase a sector back to all 1s. So you can have a "validity" bit in each record that you set to 0 once you have written the next record successfully and this will tell you when you read back the data to ignore that record and move on to the next. Then you would only erase the part once you have filled up the entire 2k bytes with records. By doing this your 100000 or 1 million erases will last you years and years even if you write to the part once per second.

    For example, if you had 4 bytes of mode information to store, you can make a 5 byte record (or put an index table at the beginning of the part) and get roughly 360 records in 2k EEPROM. Then, if you write a new record once per second, the part will still last for 10 years instead of just 11 days.

  17. Avataaar/Circle Created with python_avatars SaNjA2659 says:

    Just wanted to comment my assumption that one of the dual EEPROMs is probably physically write-protected, but you figured it out yourself. A question about star grounds and power routing: how viable it really is? Is it true that they can pick up EMI due to long individual traces? How does star compare to filled ground plane? A video on correct analog ground routing would be great!

  18. Avataaar/Circle Created with python_avatars maged asd says:

    Hi Dave do you have test equipment to give it away
    Thanks

  19. Avataaar/Circle Created with python_avatars Discophil says:

    do a part 2! ๐Ÿ™‚

  20. Avataaar/Circle Created with python_avatars Misha Davidov says:

    How did you identify those three vendors as the main suppliers of meter ascis? Just tribal knowledge or did you apply a methodology?

  21. Avataaar/Circle Created with python_avatars leigh Moom says:

    WAFFLE but i bought mine months ago. Another interesting video

  22. Avataaar/Circle Created with python_avatars Station Plaza says:

    BTW…Waffle on as much as you like Dave…After all it's your channel! ๐Ÿ™‚

  23. Avataaar/Circle Created with python_avatars Station Plaza says:

    I've been looking at some multimeters online today including here on EEVblog…I think I'm leaning toward a Gossen.
    They look so solid. Quite apart from the fact that German built stuff is great, they do seem to offer some potentially good value models. It all depends of course what you envision using it for.

  24. Avataaar/Circle Created with python_avatars omfgbunder2008 says:

    volume is a little low

  25. Avataaar/Circle Created with python_avatars Mohammed Algailani says:

    If I would like to extend the life of the EEPROM, I would set a circular buffer to let the firmware write data in different location each time the meter is powered on. This is possible because it needs a couple of bytes or so for mode saving, and the EEPROM has plenty space for that.

  26. Avataaar/Circle Created with python_avatars Joop Terwijn says:

    A part two!

Leave a Reply

Your email address will not be published. Required fields are marked *