MHS-5200A Serial Protocol Reverse Engineered - Page 1
Forum section: electronics / testgear

author: wd5gnr
author_rank: Regular Contributor
timestamp: June 27, 2015, 08:57:39 pm
content: I picked up an MHS-5200A DDS Signal Generator for about US$80 on eBay. The Windows software is horrible, plus it is in Windows. Would probably work in Wine, but I can't get NI-VISA to install in Wine and don't really care.So here's the basic serial protocol for the device (it looks like a COM port):https://docs.google.com/document/d/1HbLQ4u87RJkD3Ktyw7k9U7Zh5BPNzbrhMlszNGdXiiY/edit?usp=sharingI missed one or two, but all I really want it to shove the arbitrary buffers in. I don't even care about a GUI, to be honest so.... that will be my next post is my solution for that ;-)Here's what I know so far. Corrections or comments welcome.https://docs.google.com/document/d/1HbLQ4u87RJkD3Ktyw7k9U7Zh5BPNzbrhMlszNGdXiiY/edit?usp=sharingBy the way, the software is listed as for the 5200 or the 3200 but a different document on the 3200 shows a pretty different protocol so the software must adapt.

author: wd5gnr
author_rank: Regular Contributor
timestamp: June 28, 2015, 03:19:01 am
content: Ok after a busy day, here you go:https://github.com/wd5gnr/mhs5200aI didn't bother trying to operate the instrument from the software (although you can), I only care about loading the arbitrary waveform memories.

author: Muxr
author_rank: Super Contributor
timestamp: June 28, 2015, 06:26:04 am
content: Nice, I should give this a try on my MHS-3225. Wonder if they are compatible. Just re-read your first post, and noticed the protocol is different.

author: wd5gnr
author_rank: Regular Contributor
timestamp: June 28, 2015, 01:05:11 pm
content: Yup. In addition, I have a bug somewhere. It only works when I have the port open with some test software. I am trying to fix that this morning. Worse case, I'll rewrite in C.Ok, fixed and enhanced. I have a few more pushes today and then hopefully done at least for now.

author: wd5gnr
author_rank: Regular Contributor
timestamp: June 28, 2015, 04:23:07 pm
content: If you can't stand not having a GUI, I found the TTI Waveform Manager Plus runs well under Wine and is free to download (registration required). If you export to "normalized" you can import to the MHS5200A by using the -f flag to the software I provide. Here's some screen shots:The app:The scope showing the uploaded wave from the signal generator:The TTI app is athttp://tti1.co.uk/downloads/waveman-plus.htm

author: Polossatik
author_rank: Frequent Contributor
timestamp: July 02, 2015, 08:43:08 am
content: the specs I found on ebay list only higher than 6MHz for “sine wave” in the 3 “top” models (12/20/25 MHz),all other wave forms are speced at 6MHzCare to open up and have a look if the difference is pure in firmware or they add in the more expensive ones some kind of additional ( hardware?) sine wave generator.?

author: free_electron
author_rank: Super Contributor
timestamp: July 02, 2015, 10:00:06 am
content: Teardown !

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 02, 2015, 03:01:59 pm
content: Yes it is on my list, although the cost difference between the units is pretty small so I just got the 25MHz one. I think the span is about $10 from low to high, but I might be remembering wrong.What I am currently about 1/2 way done with is a setup that will create a virtual file system (like ~/dds with a subdirectory for each slot. Then it launches waveman or another editor of your choice. You save your wave to (for example) ~/dds/5 and it sends it to the instrument and moves the file to ~/dds/5/sent for future reference. That would make using waveman a lot easier.Almost done with it and will update github when it is done.

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 03, 2015, 04:20:36 am
content: I just posted a draft version of the wavegen script. You WILL have to edit it for your use. Basically, it creates some directories and launches the TTI editor (or any editor). Then you simply save your file in CSV or NRM format into the directory you want and the download happens magically. For example, I save to ~/dds/4 to write to slot 4.

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 12, 2015, 06:01:20 pm
content: Fixed a small bug in the software if you haven't updated lately, you should. Meanwhile, here's the innards of the device:https://imgur.com/a/dAPBi#0Here's the first of the 5 pictures:

author: lcltech
author_rank: Newbie
timestamp: July 13, 2015, 06:29:02 am
content: Quote from: Muxr on June 28, 2015, 06:26:04 amDoes anybody know what else is the difference between MHS-3200A and MHS-5200A? The specs are exactly the same.

author: janoc
author_rank: Super Contributor
timestamp: July 20, 2015, 09:12:37 pm
content: Quote from: free_electron on July 02, 2015, 10:00:06 amI have received my 25MHz unit and it is pretty much the same as in the photo. The architecture seems to be an STM8 micro (small TQFP on the right) handling the coms & display, CH340G (upper right TSOP) usb uart bridge deals with the USB part. The signals are produced by a Lattice MachXO2 CPLD/FPGA (large QFT in the center) with 2 8bit resistor DACs (left of it) with some opamps (immediately left of the DAC ladders) and AD603ARs (left from the opams). I didn't remove the heatsink, so not sure what is under it - perhaps some power transistors.The rest is not very interesting - there are relays to switch the outputs on and off, standard 2 line LCD, encoder knob on a separate board and a boatload of passives. The bottom right of the board is a switching PSU.It looks fairly well built, actually, especially for the price. I have seen much much worse already.However, what I would love to get is an English manual. The original is in Chinese, unfortunately. I still haven't figured how to actually use the counter functionality the unit is supposed to have nor how to use the various synchronization inputs, including the TTL inputs and outputs on header in the back.Quote from: Polossatik on July 02, 2015, 08:43:08 amThere isn't any separate gen for 25MHz and 6MHz square wave. I have checked the signal on my scope and when set to square wave, the signal starts getting distorted around 1-2MHz and the higher you go, the more sine-like it looks, until you get basically straight sine wave above around 4-5MHz (it might do 6MHz, but I didn't probe it correctly). On the scope it looks like as if there was a heavy low pass filter and the higher harmonics were getting progressively cut from the signal as the frequency was increased. Not sure whether there is a physical low pass filter on the output or whether it is an artifact of the sampling.

author: janoc
author_rank: Super Contributor
timestamp: July 20, 2015, 09:47:32 pm
content: Quote from: wd5gnr on June 28, 2015, 04:23:07 pmThanks for this, that software is really pretty good. I have tried your scripts to upload the waveforms to the generator and hats off to your shell scripting :-pI would probably rather do it using Python or something like that though, shell/awk isn't the best choice for this type of job, not to mention that Python is a bit more portable than the above combo.BTW, a pro tip for anyone using this generator - record a waveform with a scope, save as CSV, open it using Waveman, clean up and upload to the generator. Bingo, signal reproduced for debugging stuff. Works like a charm!

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 21, 2015, 04:33:58 am
content: I don't have an English manual, but I've worked it all out. You probably figured that what the main buttons do (pgup/dn for the menu). For the counter on the menu look for:MSR-Sel. Press OK to go external or TTL.MSR-Mode. Press Ok to select frequency/count/pos pulse width/neg pulse width/period/duty cycleGate-Time. Freqency gateOne of the menu items changes depending on your MSR-Mode (the one after Gate time). If it says C it is reading counts.pressing ok pauses. If it says F it is reading frequency. You can probably figure the rest out from there.

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 21, 2015, 04:34:40 am
content: I'm not a big Python fan, but the script works well and with Cygwin actually that is a pretty portable combo too ;-)

author: janoc
author_rank: Super Contributor
timestamp: July 21, 2015, 08:36:49 am
content: Quote from: wd5gnr on July 21, 2015, 04:33:58 amAh ok! Really "obvious"!Jeeze, that user interface was designed by monkeys ...BTW, any idea how the TTL outputs actually work? There are 8 outputs and in input. I guess the input is for the counter and perhaps to synchronize the frequency sweep, but how to use the outputs?

author: janoc
author_rank: Super Contributor
timestamp: July 21, 2015, 08:39:36 am
content: Quote from: wd5gnr on July 21, 2015, 04:34:40 amOuch, Cygwin ...I will probably try to hack a little app up to manage the uploads for this.

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 21, 2015, 12:09:17 pm
content: Quote from: janoc on July 21, 2015, 08:36:49 amNope, haven't played with the TTL outputs yet.

author: przemek
author_rank: Newbie
timestamp: July 22, 2015, 05:50:40 am
content: I compiled an English manual from Google-translated original Chinese text and other sources of information:https://github.com/przemekklosowski/mhs52xx/raw/master/MHS5200.pdf

author: wd5gnr
author_rank: Regular Contributor
timestamp: July 22, 2015, 12:06:04 pm
content: Awesome! Thank you for doing that!

author: biot
author_rank: Regular Contributor
timestamp: July 22, 2015, 03:38:56 pm
content: May I suggest sticking some sort of license on that document, at least on the translation and protocol documentation part? Perhaps CC-BY-SA or something like it.Very nice to see such nice work coming out of a community, in view of the vendor's underwhelming support.

author: przemek
author_rank: Newbie
timestamp: July 23, 2015, 02:36:57 am
content: Initially I thought the translation will be useful to the manufacturer, but I pinged them by email and they didn't reply. I then essentially rewrote the thing, so I feel I am entitled to controlling the copyright, and of course I prefer a collaborative license like CC. Will do, although I will have to put this project off for a while now.By the way, it's written in LyX/LaTeX, and the source is on Github, so you're welcome to clone it and push patches. It uses quite a bit of optional packages/style files, easy to pick up from error messages if you start creating PDFs.

author: przemek
author_rank: Newbie
timestamp: July 23, 2015, 02:43:35 am
content: By the way, I want a FOSS/Linux program to drive MHS5200. I considered writing a Python/Qt app, but it occurred to me that maybe it could be interfaced to sigrok: it already supports Hantek and Siglent generators. Thoughts?

author: biot
author_rank: Regular Contributor
timestamp: July 23, 2015, 09:16:56 am
content: Quote from: przemek on July 23, 2015, 02:43:35 amAlas, sigrok does not support signal generators as an instrument class yet. Those listed on the hardware support page are marked red (planned). You're welcome to take it on.And you're right, a UI for these just screams Python/Qt.

author: janoc
author_rank: Super Contributor
timestamp: July 24, 2015, 09:53:14 am
content: Quote from: przemek on July 22, 2015, 05:50:40 amBig kudos for this! This manual looks better than the original, even!

author: Kintekobo
author_rank: Regular Contributor
timestamp: August 03, 2015, 01:44:13 pm
content: Quote from: przemek on July 22, 2015, 05:50:40 amHi przemekThanks for the superb work on the manual. Top class!I have a couple of things to add if you haven't already found them.The arbitrary waveform transfer is actually -:aX0,n2,.........n64<CRLF>:aX1,n65,n66........n128<CRLF>..:aXF,n.........n1024<CRLF>where X is an arbitrary waveform store from 0 to F (Hex). There is an OK<CRLF> returned between each block when transfer is successful.The Sweep time message is :s5tn from trial and error.Regards,Chris

author: pascal_sweden
author_rank: Super Contributor
timestamp: August 03, 2015, 05:49:53 pm
content: Would be nice if the protocol for the FeelTech signal generator can also be reverse engineered, or has somebody already confirmed that they are identical?

author: danadak
author_rank: Super Contributor
timestamp: September 14, 2015, 09:09:28 pm
content: Here is some eval of the generator performance.Regards, Dana.

author: Howardlong
author_rank: Super Contributor
timestamp: September 14, 2015, 09:23:49 pm
content: Quote from: danadak on September 14, 2015, 09:09:28 pmLooking at the ringing, how did you probe it?

author: danadak
author_rank: Super Contributor
timestamp: September 17, 2015, 05:03:30 pm
content: The pics were all probed with 10X probe, 1M, 12 pF. Also a 10X 10M 14.5 pF probe.When looked at with 50 ohm scope termination, straight short coax, not much changed in termsof ringing, distortion.I looked recently at narrow pulse, low duty cycle, at 1 Mhz pulse looks like slew rate limitingof output amp. At 6 Mhz just 1.5 V, lots ringing severely distorted.Regards, Dana.

author: janoc
author_rank: Super Contributor
timestamp: September 17, 2015, 09:21:28 pm
content: It is slew-rate limited and heavily downpass filtered.This article actually describes two mods that improve the performance somewhat:http://www.analogzoo.com/2015/08/fixing-the-mhs-5200a/I have done it (replaced the opamps and did the "cheap" mod on the filters) and it works better, but I still get distortion at maximum amplitude. That is probably due to the insufficient supply voltage, though.

author: janoc
author_rank: Super Contributor
timestamp: October 18, 2015, 07:24:06 pm
content: I was playing with some HF filters today and thought about trying the sweep function on the generator to check the filter characteristics. Of course, I am aware that with the variable amplitude of the sig gen it would be only very approximate, but that's ok for my needs atm.However, does anyone know how to synchronize the sweep with a scope? I have tried all sorts of things - like feeding the scope trigger output into the input BNC on the sig gen, probed the TTL outputs on the back to see whether there is a sweep start signal or something but nada.The other thing I have found seems like a bug - when I set the sweep limits (SET SWEEP FREQ1 and SET SWEEP FREQ2) only the lower limit seems to be respected and the generator always sweeps up 25MHz. Is that normal behavior?

author: briselec
author_rank: Regular Contributor
timestamp: October 24, 2015, 12:48:58 pm
content: If you use channel 1 for sweep, set channel 2 to output a square wave with a period equal to the sweep time. Connect channel 2 to one of the channels on your scope and use that as the trigger.TTL OUT1 and TTL OUT2 appear to output a square wave at the same frequency as channel 1 and channel 2.When a channel is generating a signal that doesn't agree with the settings, try turning the unit off and back on.Usually fixes it. Definitely has some bugs in it.

author: janoc
author_rank: Super Contributor
timestamp: October 24, 2015, 05:38:17 pm
content: Hmm, didn't think of that. However, isn't that going to drift all over the place? The trigger vs. the sweep start, I mean.

author: briselec
author_rank: Regular Contributor
timestamp: October 25, 2015, 06:17:15 am
content: The display of the sweep will drift slightly. The settings resolutions aren't fine enough to precisely match the 2 channels.

author: janoc
author_rank: Super Contributor
timestamp: October 25, 2015, 11:16:00 pm
content: Right, makes sense. I guess better than no sync at all.On the other hand, this device really begs to have its firmware replaced and these silly problems fixed - there is a ton of free I/O available on the connectors to provide a proper sync signal

author: Peter Axelsson
author_rank: Newbie
timestamp: March 31, 2016, 04:03:39 pm
content: Anyone have the serial command to change the display from channel 1 to channel 2?Best regardsPeter Axelsson

author: EU1
author_rank: Regular Contributor
timestamp: July 16, 2016, 09:38:07 pm
content: Protocol specification in Chinese, I hope it will be helpful:

author: tomonthelam
author_rank: Newbie
timestamp: September 23, 2016, 06:05:05 am
content: This is great work...thanks for the effort...Just getting my feet wet so I though I would fire up old Hyperterminal, point it at the COMM port, and see if I could tickle the 5200A, but no joy.Any ideas?

author: nickcres13
author_rank: Newbie
timestamp: January 10, 2017, 01:43:58 am
content: I know im late, but thought I would put in a word about some scripts im developing to further gain access to the MHS5200A device via serial commands. Namely, I have started with a dumb script that asks it for the frequency (on "EXT_IN") once a second and plots it in gnuplot. Links to the github repo and a boring video of me using it below. Let me know what needs fixed!NOTE: I compile and run on Ubuntu, should work on other Linux distros, as for Windows and hackcoughblechApple there is work to do still obviously...https://github.com/electricsheeplabs/mhs5200aDataLogger

author: janoc
author_rank: Super Contributor
timestamp: January 12, 2017, 02:00:45 pm
content: Hello,I have this same generator too and perhaps this is a completely dumb question, but what is your use case for this? Why are you datalogging the frequency?Are you trying to characterize the stability of the instrument?EDIT: Yes, it was a dumb question - on re-reading I have found that you are logging the EXT_IN external input, so using the device as a counter, not generator. D'oh!

author: nickcres13
author_rank: Newbie
timestamp: January 12, 2017, 06:20:36 pm
content: Janoc,Not to worry! Indeed using as a counter... I think this could be a useful tool for certain measurement tools, such as monitoring a frequency in a lab. I was hoping to use it to monitor the frequency of a crystal oscillator, ore more specifically, a quartz crystalmonitor, whose freq changes as mass is deposited on it (and by calibrating, one can measure minute amounts of mass that get deposited on it)...anyhow, let me know if you come up with any cool uses for the script! And also if you would like it to have other functionality. Its easy to send and receive other messages to the device...Nick

author: janoc
author_rank: Super Contributor
timestamp: January 13, 2017, 09:02:56 pm
content: Yes, I know, I have the same generator on my desk. It is not stellar, but hard to beat for the price.My have asked the original question because I thought you were logging the frequency of the generator - which isn't of much use when measured/provided by the generator itself. So I thought I am missing something there.

author: nickcres13
author_rank: Newbie
timestamp: January 16, 2017, 04:23:33 pm
content: Indeed! Yup im using it to monitor the frequency of external sources...though what is very interesting to me (and as other people in this thread have pointed out) is that if you wire the output into the EXT_IN, the value of the input and output don't agree! For example, you set the generator to "sine wave" at 10 Mhz and read that signal on the EXT_IN, and you will see something like 10.000123...so the counter and generator don't agree, even though they are presumably running on the same clock! Not sure why this is, maybe someone who knows more about FPGA/signal generators can comment...

author: janoc
author_rank: Super Contributor
timestamp: January 16, 2017, 08:15:53 pm
content: Quote from: nickcres13 on January 16, 2017, 04:23:33 pmReally??I haven't tried that on mine. But it is well possible it is the consequence of some firmware problem - the generator has plenty of jitter so who knows how they have implemented the DDS and how accurate the frequency is. I certainly wouldn't use it for something where accurate frequency generation or measurement mattered.

author: BugCatcher
author_rank: Contributor
timestamp: January 18, 2017, 10:07:31 am
content: please read my old comment:https://www.eevblog.com/forum/testgear/mhs-5200a-function-generator-teardown-review-reverse-engineering/msg1055618/#msg1055618btw. to add another surpriseif you try to tweak the oscillator for correct frequency ... the nominal crystal frequency is not 16.000.000Hz!you can find my other observations/modifications underhttp://www.analogzoo.com/2016/08/revisiting-the-mhs5200a/#comment-16400Have Fun

author: janoc
author_rank: Super Contributor
timestamp: January 18, 2017, 08:15:49 pm
content: Sounds about right.I remember your blog - I have done the opamp replacement and modded the filter on mine (the older version).

author: JHav
author_rank: Newbie
timestamp: February 15, 2017, 02:36:36 pm
content: Hello,I purchased recently MHS-5200A and developing control SW for it. Some functions are still not working properly (Save/Load M0 - M9). I can catch all codes with serial port analyzer and original SW but the device behaviour is strange...

author: nickcres13
author_rank: Newbie
timestamp: February 22, 2017, 11:24:11 am
content: JHav,Looks cool! What language/interface are you developing with? I hope it is Linux compatible, I would love to get a copy of it when you are done (or maybe I could help beta test? haha). Let me know if i can help too, I have mainly C and shell script experience. Best of luck.Nick

author: technogeeky
author_rank: Frequent Contributor
timestamp: February 23, 2017, 03:55:54 am
content: Quote from: nickcres13 on February 22, 2017, 11:24:11 amIf it can be run in Linux (using WINE or whatever), I can make it happen. I will do it ASAP if I get my hands on the software.

author: nickcres13
author_rank: Newbie
timestamp: February 25, 2017, 04:39:08 am
content: Jhav,Cool, looking forward to it, lemme know!Nick

author: diyfan
author_rank: Newbie
timestamp: March 01, 2018, 02:19:53 pm
content: Quote from: nickcres13 on January 16, 2017, 04:23:33 pmHi, I´m new in this forum.I just bought one of this sets (KKmoon...) mainly as acounter and I could need some help.I am repairing a wallclock , the pendulum is swinging with 0.86666666 Hz T = 1,153846s.If I want to adjust the pendulum for qanerror of 1s per day I need a resolution of 12ppm, or I have to wait many hours for the next adjustment.With the period measurement I am not really successful because the periods are not consistant, depending on the accuracy of the cowheels and mainly of the escapement wheel which has 26 teeth. I would have to measure at least 26 periods or better a multiple of that. At the moment the 5th digit is changing continuously.To read out aall results would help, so I could do the averaging in Excelthanks in advancepaul

author: kevinateev
author_rank: Regular Contributor
timestamp: November 18, 2018, 01:27:31 pm
content: Here is a different approach. It is MacOS based and command line driven. written in Swift 4.2. It will work for a number of variants of this device and can upload waveforms (this was my primary reason for writing it).https://github.com/kpishere/mhs52xxA

author: kevinateev
author_rank: Regular Contributor
timestamp: December 29, 2018, 11:29:01 pm
content: Thanks to all for the research and work around this! Labours of love but still, thanks.Here is what I managed to put together from this info ... a native macOS control utility written in Swift to control and upload arbitrary waveforms on the MHS5200 related units.https://youtu.be/43wMURP_9eg

author: proppa
author_rank: Newbie
timestamp: March 10, 2019, 03:32:04 pm
content: Can anyone recommend a way to change the sweep function on channel 2 using the serial monitor? I can't seem to find a code to select channel. I am using ext.in.

author: trebi
author_rank: Newbie
timestamp: September 18, 2024, 03:14:40 pm
content: Hi,I wrote a small program to control the device. What causes that if I send a command (:s1f10000) to generate a 10000Hz frequency, the device only generates a 100Hz signal?Thx.