Hacking DTM0660L Based Multimeters

In my previous post, I did a review of the 6000 counts ennoLogic eM860T true RMS multimeter. This meter is based on a signal chip design using the versatile DTM0660L DMM chip. Besides the ennoLogic eM860T, several other multimeters such as UNI-T 139C, Velleman DV4100, Tekpower TP40 etc. are also based on the same chip.

One key feature of this chip is that most of the configurable parameters as well as the calibration data are all stored in an external EEPROM. This means that we could potentially change certain settings and enable certain settings (e.g. enabling UART communication, backlight duration, auto power off duration, etc.) by just changing values in the configuration EEPROM without having to do any hardware modifications. We will take a look at how to make these configuration changes in this post.

Since sigrok (a cross-platform signal analysis software suite) already added support for the DTM0660 chip, we can use the sigrok-cli command line utility to talk to the meter via UART/RS232 once we have the functionality enabled .

As I mentioned in my previous post, the PCB of the eM860T already had REL/PC Link printed on its silk screen, but this feature was not enabled for the meter as long press on REL button does nothing. According to the datasheet for DTM0660 (if you follow the link on sigrok’s supported devices page, you can find the datasheet hosted on a Chinese document share website, unfortunately is not in a very user friendly format), UART functionality is supported via external EEPROM configuration as well as some other functionalities.

The EEPROM used in eM860T is an 24C02A. It uses I2C protocol for programming. eM860T has the I2C header populated on the PCB already, but I didn’t realize that at first. As you can see in the picture below I soldered three wires directly onto the board when I was playing around with the 24C02A. The WP pin of the on-board 24C02A has a pull-up resistor connected to VCC (e.g. the chip is in write protected mode). In order to write data to it, WP pin needed to be pulled low (in the picture you can see a wire soldered from pin 7 to ground).

Since the calibration data is also stored on the same EEPROM chip, it is highly recommended that you back up the content before making any changes. Also at least in this meter there are two solder bridges that you can remove (see SW1 and SW2 below). These bridges connect the I2C bus of the 24C02A and that of the DTM0660L together. While you don’t have to remove these solder bridges when reading from or writing to the EEPROM since these chips have different I2C addresses, it is highly recommended that you do as in the rare event if a wrong command with a wrong I2C address is issued you could inadvertently alter the content in DTM0660L (I am not sure whether this chip has any on-chip EEPROM or not, but it is always good to be safe than sorry) and brick the device.


So I went ahead and dumped the content of the 2kb in the 24C02A with the help of an Arduino (the actual code I used is included here).

#include <Wire.h>
const int I2C_ADDR = 0x50;

void setup() {

  //writeByte(I2C_ADDR, 0xFA, (byte) 0xCE); //enable RS232
  //writeByte(I2C_ADDR, 0xFC, (byte) 0x1E); //Backlight time 30s

void loop() {}

void dumpEEPROM()
  for (int i = 0; i < 256; i++) {
    byte b = readByte(I2C_ADDR, i);
    Serial.print(b, HEX); Serial.print(" ");
    if ((i + 1) % 16 == 0) Serial.println();

void writeByte(int i2cAddr, unsigned int addr, byte data) {

byte readByte(int i2cAddr, unsigned int addr) {
  byte data = 0x00;
  Wire.requestFrom(i2cAddr, 1);
  while (!Wire.available()) ;

  data = Wire.read();
  return data;

And here is the content of the 24C02A in its entirety:

    0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00 FF FF FF FF FF FF FF FF FF 52 00 36 01 EC D7 03 
10 10 17 38 18 44 02 6E 6E 64 64 3C 3C 0A FF 40 FF 
20 46 98 E8 80 00 03 C2 01 00 80 52 80 07 80 96 B5 
30 4E 02 09 2D 02 09 80 FC 0A 9B 1B 0A 8D 02 0A 00 
40 00 01 00 01 00 07 98 00 64 00 64 00 64 00 00 00 
50 00 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80 
60 E9 7F 3E 80 01 00 AA 2A 00 00 00 00 00 00 00 00 
70 38 81 00 80 DA 81 E0 7C B3 01 00 00 00 00 00 00 
80 00 00 00 00 00 00 13 12 10 03 0E 09 01 0C 04 07 
90 00 00 00 00 00 00 15 00 11 00 0F 0A 02 0D 1E 0B 
A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
C0 0D 00 02 10 0D 00 03 20 20 00 03 20 20 00 03 10 
D0 41 00 03 08 41 00 03 05 41 00 03 05 0D 00 02 20 
E0 00 80 00 80 00 80 00 80 00 80 00 80 F8 7F 06 80 
F0 00 80 FF FF FF FF FF FF 5A CB CC 0F 0F 82 00 00

Specifically, I was interested in the following three bytes (marked in red in the EEPROM dump above). According to the datasheet, here is what the values in these three locations mean:

FA: bit 1 controls whether RS232/UART can be enabled by pressing REL. 
    0: function unavailable
    1: long press on REL key enables RS232/UART

FB: time before auto power-off (1~255 minutes, auto power-off is disabled if set to 0). 
FC: backlight on duration (1~255 seconds, if set to 0 it's controlled by the backlight button only)

From the EEPROM dump we can see that the current settings on my meter are as below:

FA: CC (1100 1100) RS232/UART disabled
FB: 0F (0000 1111) 15 minutes
FC: 0F (0000 1111) 15 seconds

To enable entering RS232 mode with a long press on the REL button, the byte in FA needs to be changed to CE (1100 1110). And to extend the on time for the backlight or to increase the auto power off duration of the meter I can change the bytes in FB or FC. I wanted to set the backlight auto off time to 30 seconds so I set the content in address FC to 1E. The default 15 minutes auto power-off is fine for me so I left it alone. But for some people a longer on idle time might be more preferable and in that case the desired value in minutes for the time before automatic power down can be written to address FB.

Once the UART functionality is enabled, a long press on REL will turn on the PC-link indicator on the LCD as shown here:


Next, I wired an IR diode onto the D9 footprint. Conveniently, the PCB already has the pads designation for the diode and it even has the current limiting resistor soldered in place. The IR diode can be mounted through the small hole on the back cover. Since the receiving IR diode will be placed directly against the transmitting diode, range and interference are not of any concerns. Thus I could get away with just a simple IR diode instead of an IR module that modulate the RS232 signal onto a higher carrier frequency.

irheader mod3

To make life a bit easier when mating an external IR receiver for data logging, I glued a ring magnet around the IR transmitter inside the case. I also had an identical piece of magnet glued on the receiver sensor side so the they can be connected magnetically.

In the picture below, you can see the receiver I made. I used a section of rubber standoff for housing the IR diode and the resistor. This isolated datalink works quite well and can be connected/disconnected easily. While you could just connect the UART-to-USB adapter directly to the serial output of the meter directly, it is highly recommended that you use proper opto-isolation as otherwise you could damage the DUT, the meter and even the connected computer if the measurement is not done correctly.

mod1 iradapter

The receiver side is just an IR photodiode and a resistor since there is no demodulation involved and the transmission range is negligible. The value of the resistor is chosen such that the output voltage swings close to either supply rail. Cable length is not critical since the data rate is very low, at only 2400 bps. The transmitter and receiver circuits are included below for reference. Note that the IR emitting diode is connected between the driving signal and the positive rail, so in idle mode the IR is off. Because of this, the IR photo diode needs to be ground referenced so that the RX signal going into the UART/USB module remains high when idle.


I cut a hole in the rubber holster directly over the opening where the IR emitting diode is mounted so the receiver can be connected and disconnected with ease.

mod2 iradaptermounted

To communicate with a PC I used sigrok‘s command line utility sigrok-cli. The available driver for DTIM0660L is velleman-dvm4100. Here is the command for outputting measurement results continuously on my Linux box:

sigrok-cli --driver velleman-dvm4100:conn=/dev/ttyUSB0 --continuous

And here is a picture showing the output when the meter was set to the mV range. The output uses “V” for all voltage ranges, so the only difference among different ranges is the resolution.


Besides the above mentioned functionalities, there are many other hackable parameters (such as range switching threshold, high voltage/high current warning threshold, UART format etc.) You can take a look at the manual linked from sigrok’s site for more information. If there is enough interests, I can translate the datasheet into English and post it on my website. So if you are interested, please let me know.


The translated datasheet for DTM0660 can be found here.

Be Sociable, Share!


  1. hugo says:

    Hi Kerry,

    How did you know the address of 24C02A eeprom is 0x50 ?

    Thank you

    • kwong says:

      Hi Hugo,

      According to the datasheet:

      Chip selection is
      then accomplished through software by setting the bits
      A0, A1 and A2 of the slave address to the corresponding
      hard-wired logic levels of the selected 24C01A/02A/04A.
      After generating a START condition, the bus master
      transmits the slave address consisting of a 4-bit device
      code (1010) for the 24C01A/02A/04A, followed by the
      chip address bits A0, A1 and A2.

      For a single chip configuration (which is the case when using a single chip), A0 A1 and A2 are all 0 so the 7 bit I2C address is 0101 0000 which is 0x50.

      • Ivan says:

        where are the populated pins(if any) to write to the eeprom??

        • kwong says:

          The header is towards the top of the image (next to the calibration switch). SW1 and SW2 are connected to those pins.

          • Ivan says:

            Ohh, thanks for the fast reply. I was wondering how to use it, and do you still have to set the eeprom pin to ground?
            And how do you calibrate the meter with the switch, and would you recommend this meter or is there a safer option for around the same price??
            Best regards Ivan

          • kwong says:

            Yes, you need to tie the WP pin to ground. There are quite a few meters based on the same chip and in theory they can all be hacked, but this one is the only one I have. I do like this meter a lot (except for the slow ohm range). Victor VC921 and some UNI-T models are also based on the same chip.

  2. […] Wong] decided to take matters into his own hands and hack a serial-out port into his relatively inexpensive multimeter, giving him the ability to record anything the meter can […]

  3. […] Wong] decided to take matters into his own hands and hack a serial-out port into his relatively inexpensive multimeter, giving him the ability to record anything the meter can […]

  4. Diogo Mendes says:

    I jumped at my UT-139C and changed the backlight duration to 60sec, no luck on enabling rs232, but there are no pads for it. Thank you very, very much.

  5. 12458 says:

    Hi Kerry,
    Can you review and hack the ut139c from uni-t?

    • kwong says:

      I don’t have a UT139C, but it’s using the same chip so the performance should be comparable. Also, The hack would be similar as well. The feedback I got from a few folks who hacked their UT139C told me that the UT139C does not have the IR port pads in place, which means you will need to solder wires directly to the IC UART TX/RX pins.

  6. flywheelz says:

    Hi Kerry,

    First of all, what a neat hack and thank you for sharing with the world.

    Some of the guys applied the info to upgrade UT210E 2000 to 6000 counts! Here http://www.eevblog.com/forum/testgear/a-look-at-the-uni-t-ut210e/50/

    One issue is when you zero out the DC current, the unit some how reverts back to 2000 counts. Switching back to Auto gets back to 6000 counts. So its like its hard coded in micro or maybe uses other bytes in eeprom besides 12h-15h

    Any ideas why this is?

    Thank you.

  7. Nick Maleas says:

    Hello, thanks for the article! I have ut139c. Do you know if I can stop the beep sound when I change states of themultimeter or push buttons. Is there any option for this If I change the eeprom?

  8. mematyi says:


    I have the UNI-T UT139C, and I am very curious to convert it, but:

    I tried to track the UART lines from the IC, but they use these pins for another role. They are going into the circuitry of the dmm, and to the leds, etc.

    Anyway, they are not unused.

    Do you think it still permits the conversion, or this feature makes it un-convertable?


    • kwong says:

      That was another person who commented on YouTube said as well. I don’t have a UT139C on hand, but I am curious to see how those two pins (20, 21) are used in 139C. depending on what they are used for, you may or may not be able to repurpose them.

      • mematyi says:


        I tried to trace those pins from the controller ic, there are the pics:


        I am not sure if they are 100% correct, it would be great if you could see them.

        If i am correct, the RX pin is unused, but the TX is used for button-sensing(?).
        It is strange because the manual says it is an output-pin.

        The original pics are from eevblog thread, 6.page.

  9. 12458 says:

    I tried this on my uni t 139c meter but I ended up bricking it. It turns out that the pin pitch of the IC so small that I had created a short. I removed the short by adding solder and wicking it away. Then the dmm started to wort again.

  10. Andy Hull says:

    If you want a cheap multimeter to experiment with, that appears to be based on the DTM0660, you could try a Victor VC 921 pocket multimeter, but get the one with “True RMS” on the front, as there appears to be an earlier version based on a different chipset.

    A full set of teardown pictures are here. https://photos.google.com/share/AF1QipPykJgrz2vMySXTkFdst6YsfoTs0Mzs1vmWZXa-XQ5EGBxVeRmFiqj-jO2c44IFcA?key=T01ITXVCa015U0x5WV9UZUV6dUdiSGdXUTBENF93

    As you can see from the pictures, the pinout of the epoxy blob matches the DTM0660 and there is the tell tale 24c02 eerom, and even the two additional buttons needed for calibration, on the back of the PCB.

    When I get a spare moment, I’m going to solder a couple of wires on to the thing and see if my hunch is correct. If so, this will be the cheapest 6000 count meter with RS232 (some soldering required) on the market. :¬)

  11. Andy Hull says:

    I finally got a chance to dump the eerom on my Victor VC 921 pocket multimeter. The good news is that it all looks pretty similar to the dump above.

    — : 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

    00 : FF FF FF FF FF FF FF FF 52 00 FA 00 00 BE 03 A0
    10 : 0F 68 10 7C 01 6E 50 64 4B 3C 3C 0A FF 40 FF BE
    20 : 98 14 82 64 00 96 00 00 80 00 80 00 80 00 80 4E
    30 : 02 09 C6 06 09 8B FF 0A 19 11 0A 09 FF 09 00 00
    40 : 01 00 01 00 07 98 00 64 00 64 00 64 00 00 00 00
    50 : 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80 FE
    60 : 7F 00 83 01 00 A1 2A 00 00 00 00 00 00 00 00 AB
    70 : 7E 00 80 03 83 E0 7C 18 01 00 00 00 00 00 00 00
    80 : 00 06 08 12 0B 05 0C 00 01 10 0E 0A 09 14 13 00
    90 : 00 00 00 00 00 00 0D 00 02 11 0F 00 00 00 15 00
    A0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    B0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0D
    C0 : 00 02 10 0D 00 03 20 20 00 03 20 20 00 03 10 41
    D0 : 00 03 08 41 00 03 05 41 00 03 05 0D 00 02 20 00
    E0 : 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80 00
    F0 : 80 FF FF FF FF FF FF 5A C7 CC 0F 0F 80 00 00 FF

    The bad news is that I have lost one of the spring contacts from the rotary switch, so a little extra hacking will be needed to bring it back to life.
    I’ll keep you posted.

    • Andy Hull says:

      I also spotted a bug in my dumper, the above dump is one byte out, so there is an FF byte missing at the start, and the last byte is nonsense.

      It should read..


      I2C device found at address 0x50
      — : 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

      00 : FF FF FF FF FF FF FF FF FF 52 00 FA 00 00 BE 03
      10 : A0 0F 68 10 7C 01 6E 50 64 4B 3C 3C 0A FF 40 FF
      20 : BE 98 14 82 64 00 96 00 00 80 00 80 00 80 00 80
      30 : 4E 02 09 C6 06 09 8B FF 0A 19 11 0A 09 FF 09 00
      40 : 00 01 00 01 00 07 98 00 64 00 64 00 64 00 00 00
      50 : 00 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80
      60 : FE 7F 00 83 01 00 A1 2A 00 00 00 00 00 00 00 00
      70 : AB 7E 00 80 03 83 E0 7C 18 01 00 00 00 00 00 00
      80 : 00 00 06 08 12 0B 05 0C 00 01 10 0E 0A 09 14 13
      90 : 00 00 00 00 00 00 00 0D 00 02 11 0F 00 00 00 15
      A0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      B0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      C0 : 0D 00 02 10 0D 00 03 20 20 00 03 20 20 00 03 10
      D0 : 41 00 03 08 41 00 03 05 41 00 03 05 0D 00 02 20
      E0 : 00 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80
      F0 : 00 80 FF FF FF FF FF FF 5A C7 CE 0F 0F 80 00 00

      … Note that I have now enabled the RS232 function… next I need to see if it actually does anything.

  12. Andy Hull says:

    One more point, the DTM0660L appears to be so similar to the HyconTek HY12P66 as to suggest they are one and the same device, or at least one is derived from the other. The pinouts match, and the specs are almost identical. The HY12P66 has a datasheet in English too => http://www.hycontek.com/attachments/DMM/DS-HY12P65_EN.pdf

  13. Andy Hull says:

    I finally got a chance to try this out. A long press on the REL△HzDuty button produces as satisfying beep, and serial data starts to stream from the pin 20 pad on the board (which is not routed anywhere). I’m watching the output on my ‘scope with a big grin on my face.

    It works!

    If I get a few more spare moments, I’ll fit an IR LED and a 100 Ω resistor, and test it with my IR USB serial cable for my UniT. I’ll let you know how that goes, and post the results online of course.
    For now.. 99.9% working

  14. Andy Hull says:

    Long pressing the REL△HzDuty button also lights the “MAX” flag on the LCD when it is streaming serial data, I thought it might light the unused “LED” flag, but what the heck, nobody’s perfect. I might also look at adding a backlight, and setting it for 6000 counts.

    I’m liking this little toy multimeter so much that I just bought a second one. For £7 or there abouts, they are an even better toy than the 2000 count DT830x “disposable” meters, although just as dangerous if you plug them in to anything above 100V I would imagine. Despite the “CAT II” rating stamped on the front, the almost complete lack of input protection does make the Victor VC 921 a bit of hazardous for all but the lightest of duty.

    As a data logging Volts/Ohms/Amps/Hz/uF (and possibly temperature, watch this space for results of that mod) device, this gadget looks excellent.

  15. Andy Hull says:

    I have added DTM0660 support to the excellent QtDMM DMM readout software and recorder – Get it on github -> https://github.com/pingumacpenguin/QtDMM-DTM0660-Version/blob/master/README.md it should be relatively bug free, but let me know if you spot any issues by posting a bug on github in the usual manner.

    • kwong says:

      Hi Andy,

      I just downloaded and tried it out. It worked perfectly. Thanks! Wondering why you didn’t choose to contribute it back to the original project?

      • Andy Hull says:

        I have tried to contact Matthias Toussaint, who is the author of QtDMM but so far not heard back from him. I figured that there was no point in my code languishing on my laptop if others could find a use for it, so I stuck it on Github in the meantime. Once Mattias responds, I suspect my changes will get ported back in to his version. Its probably easier for him if it is on github, as from there he can either get me to do a pull request to his repo, or use a merge/diff from mine. Likewise if I spot any bugs in my code, I can simply update my repo and let him know.

        I also need to document my hack of the Victor VC921 in case anybody else wants to play with it.

  16. Andy Hull says:

    I set the thing for 8000 counts and that also works, I’ll need to see how easy it is to add 8000 count mode to my QtDMM code, also I’ll need to try 6000 counts which my version already supports.

  17. Andy Hull says:

    A quick write up and the sketch used to program the 24C02 can be found here -> http://stm32duino.com/viewtopic.php?f=45&t=1296&p=16704#p16704

  18. Trond E says:

    According to the HY12P Family User’s Guide


    the EUART is bidirectional. See page 90.

    “The EUART can be configured
    as a full-duplex asynchronous system that can communicate with peripheral devices,
    such as CRT terminals and personal computers.”

    What kind of fun can be made of this?

    They mention “Auto-wake-up on character reception” so I guess some kind of computer controlled multimeter is possible?

  19. Kent says:

    Hi Kerry,

    This info may have been in the above information, but I can’t seem to locate it. I was wondering what the part numbers for D1 and D2 so I can order them. Not familiar with using IR diodes, but want to try this hack. Thanks, Kent.

  20. Frederik says:

    Hi Kerry,

    my UT139c has an issue with pretty low contrast of the LCD. If I understand it correctly, the LCD biasing is set via configuration in the EEPROM for dtm0660 instead of surface mounted resistors. Is that correct? If so, what options do you see in changing the bias to fix the low contrast and bad viewing angle?

    I have also reached out to Uni-Trend about this, but did not get a reaction so far.

    Thank you and best regards,

  21. Kbird says:

    1st…. thx Kerry ….

    With the Uni-T 139C you do no need to add wires etc to the Chip itself, you can use an IC Clip as Fredrick (above) did (FrozenFrog on EEVBlog) or you can add a 5pin Female Header to the Pogo Pin Breakout area on the RH side of the PCB like I did (no need to remove LCD) as I could not get a Clip locally. I have a revision 4 PCB, I am not sure if they are all the same and all have the 5 holes above the 2 CAL Port holes or not? I have left the Female Header in place for future Mods if needed as well.

    More Info on wire connections etc over at EEVBlog and some Pics.



  22. alex says:

    Hi! Can anyone confirm that RS232 can be enabled on their UNI-T UT139C? From the pictures it looks like the pins are used for something else. Thank you.

    • alex says:

      After some more reading, there are some people that say that DTM0660L is a clone of HY12P65 made by Hycon. The datasheet can be downloaded from their website (file name “DS-HY12P65-EN.pdf”). Some interesting things:

      – In the features list, the manufacturer says the chip has 6K Word OTP (One Time Programmable) program memory so most likely the chips inside the meters have firmware written by the company that makes them e.g. by UNI-T.

      – Pin 20 (TX) has its description like this “Digital input/output”. So just like in microcontrollers, the firmware can enable and disable pins or change their function by writing into certain registers.

      Because of the reasons above, most likely that in UT139C, UNI-T have set the pin as input and they use it for the keys. This means that probably the RS232 cannot be enabled on this multimeter, even if it is enabled in the EEPROM. I really wanted to get this meter for the rs232 hack, but I guess I’ll have to get something else. Unless someone manages to somehow dump and reprogram the memory, it’s not looking good for this model.

      Thank you Mr. Wong for all the info. I’ll keep reading.

  23. Peter says:

    Hi Kerry, thanks for the post. I’m troubleshooting a UT139C with this chip whose temperature measuring doesn’t work. Low caps (nF) and high resistors (MOhm) aren’t measured well neither, other seem fine. Taking a look at the schematic in the chinese datasheet I think it may be a faulty dtm0660 chip. Any suggestions? Thank you.

Leave a Reply