‘Unlocking’ RS232 output from your multimeter

There is a band of products within the handheld multimeter market which, regardless of the manufacturer, are all based around an IC family from Taiwanese manufacturer CyrusTek. You can see this in Dave Jones’ multimeter teardowns – nearly all the units he opens up have a CyrusTek IC running the show. So in terms of feature sets they are all on a fairly level playing field; the price spread mostly comes from build & component quality and the user interface design.

If you read the datasheet for those ICs – the ES519xx series – you’ll make the interesting observation that they all do RS232 compliant output. So a vast number of multimeters – quite possibly yours – are capable of serial communication, but most manufacturers don’t break it out to the front panel for you.

(This site has moved to http://www.flashingleds.net, go there if you have comments or questions)

Fair enough perhaps – it adds to the cost and it might not be a popular feature that everybody wants. On high end bench instruments (voltmeters, lock-in amplifiers, electrometers…) it’s a completely standard feature. Typically with those instruments you’re recording a lot of data, and you don’t want to be writing it down on a piece of paper like some chump from the 1960’s. For hobby applications, let’s imagine you want to monitor the resistance of a sensor… once a second. For 2 days. Maybe you want to measure the temperature of a heatsink as a function of the current going into your circuit to determine some operational limits. Maybe you built your own signal generator, and you want to calibrate it by measuring with a multimeter in 1Hz steps. And so forth and so such; I’m basically telling you that this can be a pretty handy tool to have kicking around.

I’m accustomed to only seeing serial output on $100+ meters, and even then it’s not guaranteed. If you’re willing to scrounge around it is in fact possible to find an RS232-enabled meter at a reasonable price – at $35 this TekPower from Amazon is the cheapest I’ve seen so far. But as you might have guessed, if you already own a CyrusTek based meter I’m about to spell out for you how to do it even cheaper by extracting the latent RS232 functionality from it. If you’re willing to cut some holes in your prized possession that is.

I’m going to show you how to do this on an ES51973 based meter that I have lying around, an overpriced $300 ‘ISO-TECH IDM 98II’. For different Cyrustek controllers it will obviously pay to read the datasheet – these are readily available on the net – but I don’t imagine the process will be much different to this.

Let’s crack this thing open and have a look:

The guts of a CyrusTek meter

Let me highlight that this is not an RS232 meter, there is no provision for it anywhere. That said, to enable serial output you just need to touch the ‘RS232′ pin to the ‘V-‘ pin. You’ll hear it beep, and you might even see an RS232 segment light up if the LCD has one. Note that this mode is not permanent – you can change measurement settings without losing it but every time you turn off the meter it will leave this mode. You’ll want to rig up a momentary contact, normally open switch across these two pins and make it available from the outside of the case. I’m going to leave the build details up to your engineering imagination, since this is not actually my personal meter and I’m therefore not at liberty to cut holes in it. (“If you can’t open it, you don’t own it. But sometimes if you don’t own it, you can still open it”)

Enter the Konami code Touch these two pins to enable serial output

The meter is now continuously ralphing out data – there is a 3V, 2400 baud serial signal appearing between ‘SDO’ and ‘DGND':

Serial out!

Note the voltage levels; if you call DGND 0V, the serial signal will go between 0 and -3V. But because it’s battery operated we actually have some freedom to chose where we put the ground reference. To capture some data I attached a USB logic analyzer with it’s ground on SDO and the signal line on DGND. This gives an inverted serial signal which stays positive (0 to 3V).  Here’s what you see:

Capture of the serial data

On the ES51973 it comes in 11 packet chunks (1 packet=start bit+7 databits+stop bit+parity bit), and will tell you all sorts of things including the measurement function, range and the measured value. You can refer to the datasheet to decode the databits. In the example I’ve shown above the meter was set to resistance mode with no probes connected, hence the overload condition.

As long as you’re going to be quite careful about what you do with the multimeter and it also remains battery operated, the easiest way to get data out is to directly wire to the SDO and DGND pins like I’ve done above. In general it’s not a great idea though; you’ll find a more common approach is to maintain electrical isolation by optocoupling the pins. This is also an easy way to see if you have things working – use a visible LED and you’ll see it flashing if you have serial data present. Alternatively if you can find enough room in the case you could think about something really neat like hiding a microcontroller in there to read the datastream, parse it and send it out wirelessly.

To see how the professionals do it, let’s crack open another meter that was built with RS232 in mind. My own primary meter is a freebie SDA2010 (RRP $320) which has a miniUSB jack at the top and some custom software to interpret the data.

The guts of an SDA2010

In this case the controller is hiding under an epoxy blob, but it’s still pretty easy to see the optocoupling arrangement. An infrared LED placed across the two serial pins shines onto an infrared receiver on a separate board. To be really, really sure about electrical isolation that second board is sealed up in a plastic casing. On that board is a UART to USB chip, powered over USB. All parsing of the serial data happens in the custom PC software.

This seems like a pretty good solution, but again I leave the choice of implementation up to you. Now that you’ve seen how simple it is, go bust open your multimeter in search of an exposed Cyrustek chip! I’d love to hear from anybody that executes a modification like this.

About these ads

About Craig
Craig is getting towards the end of a PhD in experimental nanotechnology. Arguably he might be finished by now if it weren't for all the crap described on this blog. Queries/comments to flashingleds@gmail.com

37 Responses to ‘Unlocking’ RS232 output from your multimeter

  1. Pingback: Unlocking RS232 serial comm on a multimeter - Hack a Day

  2. Simon says:

    I have a Uni-T meter (that comes with a RS232 attachment. I spent a while decoding the protocol documented it here, along with a simple app to dump data to text.

    http://www.mungewell.org/ut61b/

    Feel free to use if it is of any use…
    Simon.

    • Craig says:

      Thanks Simon. Typically the software provided with RS232 meters is complete garbage, so it can definitely be worth your while to do your own application.

    • Verasak says:

      Thanks to Simon also. I just found UT-61b from local store and buy it. Your code is very helpful for getting start my own application.

  3. Jason says:

    Pretty cool stuff. After checking my Amprobe 34XR-A meter, there is a CyrusTek chip and it indeed has a serial data out. Not too sure if there’s an RS-232 icon on the LCD though.

  4. athousandleaves says:

    Just cracked open an old ABRA DM-9700 to find that it was sporting a ES5108L chip!

    From what I can see in the datasheet there isn’t an RS-232 enable pin on the chip, leading me to believe that its always on?

    http://pdf1.alldatasheet.com/datasheet-pdf/view/329805/CYRUSTEK/ES5108L.html

    Any idea?

    • Craig says:

      Looks like this one behaves slightly differently, you have to provide it with a clock signal before it will send out serial data. It’s discussed in the datasheet. You’ll need a microcontroller to interface between the multimeter and a PC.

  5. Pingback: Unlocking RS232 multimeter | makecircuits.com

  6. Nice article. Acquiring data from places that are not supposed to is my favorite hack. I will feature this in pcbheaven.

  7. lindworm says:

    I was really exited by this hack, so I tried it with my Mastech MS8229.
    In short: it’s easy if you know which freakin chip is used, if not it may require some serious research…

    Here’s the whole story:
    http://www.eevblog.com/forum/index.php?board=6.0

    You did a great job and inspired many people to do the same!
    Hope to see some more hacks with other meters :-)

  8. villamany says:

    great work!. I have a vc99 from Ebay. If you hold down the “REL” button (relative measurement) you can read “RS232″ on LCD. I think that this is the enable UART method on this model :).
    Nothing about this on user manual. Greetings…

  9. Pingback: ‘Unlocking’ RS232 output from your multimeter »

  10. Chris says:

    I’m using that TP4000ZC (the cheap one you mentioned). My problem is figuring out the protocol! I’m getting 14 byte bursts. The first 4 bits of every byte is just the position– i.e. 1,2,3,4,5,6,7,8,9,A,B,C,D,E. So I’m ignoring those bits. But what I’m left with, when I look at the second-half of each byte, is “7051FFE0500048″ (hexadecimal). That’s what I get when the LCD on the MM shows 13.61V. But I’ve tried looking at the data a bunch of different ways– and if the digits are represented individually in there somehow, I can’t figure it out.

    • Craig says:

      Hi Chris,

      I didn’t look into that meter in any depth before linking it, I just pointed it out as a really cheap option. I just read their ‘data protocol’ manual now, and wow it’s pretty terrible documentation huh?

      So here’s what’s going on. Your data packet is actually information about the LCD, which you have to manually map back to a meaningful reading. The LCD has 56 individual segments, and by segments I mean for example the continuity icon or the 7 lines making up each digit. The data packet is just telling you which segments are on. Since they haven’t provided it, it will unfortunately be up to you to map the order in the packet to the layout on the screen (e.g. the last bit of byte7 might correspond to the ohm symbol). You’ll be able to do this by getting the LCD display to only change a few segments and comparing the packets. Super tedious, but it will work. A possible alternative method is to see if their custom software makes that information available, but I would be surprised if it did.

      Be sure to share your results with the world if you do go to the effort!

      • Chris says:

        Thanks Craig! Your hint led me to solve the problem. I didn’t completely decode the protocol because all I needed was the digits on the display (including pos/neg and any decimal points). So here’s what I’ve got:
        First off, you get a 14-byte burst every quarter-second (250 ms). That’s 112 bits.
        Ignore the first 4 bits of every byte (or use it to provide synchronization). They will be in this format:
        (HEX FORMAT, “X” indicates variable data)
        byte 1: 1X
        byte 2: 2X
        .
        .
        .
        byte 9: 9X
        byte 10: AX
        byte 11: BX
        byte 12: CX
        byte 13: DX
        byte 14: EX

        So, if you take all the X’s from above (the second half of all the bytes) and put them together, you have a 56-bit data stream. Each bit indicates (1-ON, 0-OFF) an indicator (such as V or AC) or a segment (part of a digit such as the top line of a 7) or a decimal point.

        The layout of the 56 bit stream is as follows:

        first 4 bits: indicators (ignored – I did not decode these)
        bit 5: positive (1) or negative (0) for the displayed number
        bits 6-12: 7-bit code for the first (left-most) digit on the display. See below for how to decode this into a digit.
        bit 13: decimal point (1=present, 0=not present) between the first and second digit.
        bits 14-20: 7-bit code for second digit
        bit 21: decimal between 2nd and 3rd digit
        bits 22-28: 3rd digit
        bit 29: decimal point between 3rd and 4th digit
        bits 30-36: 4th digit
        bits 37-56: indicators (did not decode)

        The line segments that make up each digit are numbered as follows:
        ##3##
        # #
        2 7
        # #
        ##6##
        # #
        1 5
        # #
        ##4##

        SO, here’s how to decode 7 bits into a character in a given digit-position:
        this is a visual BASIC function — bnum$ is a string of 7 zero’s and ones:

        Function ledconvert(bnum$)
        Select Case bnum$
        Case “0000000”: ledconvert = ” ”
        Case “0000101”: ledconvert = “1”
        Case “1011011”: ledconvert = “2”
        Case “0011111”: ledconvert = “3”
        Case “0100111”: ledconvert = “4”
        Case “0111110”: ledconvert = “5”
        Case “1111110”: ledconvert = “6”
        Case “0010101”: ledconvert = “7”
        Case “1111111”: ledconvert = “8”
        Case “0111111”: ledconvert = “9”
        Case “1111101”: ledconvert = “0”
        Case “1101000”: ledconvert = “L”
        Case Else: ledconvert = “X” ‘ (error)
        End Select

        Hopefully this will give some friendly googler a head start.

        • Chris says:

          I see the consecutive spaces in my diagram were ignored in the above post. Let me try again:
          _##3##_
          #_____#
          2_____7
          #_____#
          _##6##_
          #_____#
          1_____5
          #_____#
          _##4##_

          • Craig says:

            Nice! Enjoy your new datalogger, and thanks for sharing the info

            • Anonymous says:

              I made up a nice PDF detailing the protocol for the TP4000ZC… I sent it to the company and they posted it on their website:

              http://www.multimeterwarehouse.com/TP4000ZC/TP4000ZC_serial_protocol.pdf

              They even offered me a free meter for my trouble!

              Thanks again for your help..

              • Craig says:

                Haha, that’s really cool! Times like this I love the internet. Glad I could help Chris.

                • tgilbert says:

                  Does anyone know of an archive for multimeter brand vs. serial data frame format? I have a Mastech M9803R that has a serial port on the back, and I’m not sure of the organization of the RS232 message. I know that N31 formatting has 10-bits; but RS232’s flexibility allows companies to create their own format for the data frame.

                  • Craig says:

                    I would be (pleasantly!) surprised if such a thing existed. In the absence of a datasheet you will probably have to just listen to the meter in a terminal program (e.g. Brays terminal for windows) and try to nut it out. It’s not insurmountably difficult; by changing readings/settings on the meter you should be able to get there.

                    By all means email me or post some data dumps here if you get stuck.

                    If it’s the actual frame settings you’re wondering about (e.g. baud, handshaking etc) then again playing around in a terminal program is a good way to trial-and-error it out. But that said, I think I’ve encountered about 3 instruments in my entire life that don’t default to 9600 baud 8N1

              • Paul says:

                Hey – thanks so much! What a big help!

  11. Anonymous says:

    Nice work everyone. I like the protocol pdf on MultimeterWarehouse’s site.

    You might want to check out:
    http://www.mtoussaint.de/qtdmm.html
    It supports several 14 byte formats.

    and:
    http://perfec.to/ut60e/
    if you want a command line interface for logging.

  12. remick says:

    Good stuff!

    I got Brymen 837 multimeter. Unfortunately IC surface is sanded. I can’t see IC type. Maybe some digits could be decrypted.
    Anyway – I did try to short circuit pins 45 and 97 but that didn’t work out.

    So my question is. What are other known IC’s for multimeters? (apart of ES519xx series)
    Maybe I could find out what chip I have and then try to find out datasheet for it.

    • Craig says:

      Sanded surface, that’s pretty frustrating. Those DMM chips tend to have many tens of pins, so trial and error is probably not a good idea.

      The three other manufacturers I can name off the top of my head are fortune semiconductor, hycon and maxim. I’m sure google can tell you some more. See Felipe’s earlier comment for an example of a similar operation with a fortune chip.

      Good luck, and if you do make any progress please share it!

  13. Marcos says:

    Your article is very interesting.

    Fortunately I got the protocol of the multimeter (ET-2800, Minipa/ http://www.minipa.com.br/modelos.aspx?ID_Sub_Categoria=70). What I want to do is capture the data on line in Excel/VBA program, but I don’t know how to do this. I have seen that the “.DLL” files are required for this purpose. Is that right ? I don’t know which specific file is required or how to use it.

    According to protocol, it is necessary to send the code “55H 55H 00H 00H AAH” (H-HEXADECIMAL) every time you want to get a multimeter reading. The multimeter sends 59 bytes (in binary code – 1 byte with 8 bits).

    Can you help me to do this ?

    Thank you in advance.

    • Craig says:

      Hi Marcos,

      I don’t know, but we can certainly try! Send me an email with any documentation you have on the meter and any progress you’ve made – we’ll see what we can figure out together. (flashingleds at gmail)

  14. Pingback: The Project: Build a Resistivity Meter | OS Archaeology

  15. rubberbrick says:

    I have a Unitrend digital multimeter http://www.uni-trend.com/ut61e.html and am attempting to read the serial output from the unit using a Arduino Duemilanove ATMega328 clone. Hardware setup on arduino is what I think is a Vishay IR Receiver Module http://kevin.org/frc/2004/TSOP34840.pdf salvaged from a Topfield PVR on pin 2, running various sketches proves that it receives normal remote control signals correctly. The DMM (Digital Multimeter) uses a cyrustek es51922 chipset http://www.cyrustek.com.tw/spec/ES51922.pdf with well documented output info. Output of DMM is via infrared transmitter but trying to capture output timings using http://playground.arduino.cc/Code/InfraredReceivers code produces weird results ie no decernable pattern of on/off timings. I am wondering if anyone has attempted to do similar project and if maybe the ir output from DMM is at an incomparable frequency. I have done extensive web searches to try to find an answer but to no avail. I am neither an electronic nor a coding expert. Thanks for you input in advance.

    • Craig says:

      This would be an easy problem if you have a logic analyzer or oscilloscope, but I’m assuming that’s not the case. We can still figure out out though. With no promises, send me an email (flashingleds@gmail) with some more information about what you’ve tried and maybe we can figure it out.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.