Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 422920 times)

0 Members and 3 Guests are viewing this topic.

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #75 on: March 10, 2017, 06:25:33 am »
Regarding the "Revisions"
LP1 = Lab Prototype 1 (normal first prototype build with final design)
LP2 = Lab Prototype 2 (second interation)
PP = Production Prototype (Final production design to do tests with, dropping, climate chamber, EMC and such)
put those bad emissions on frequencies of the nearby radio station next to the testlab! So no one will know ;)

Sounds reasonable, except these aren't prototype units.
 

Offline Monkeh

  • Super Contributor
  • ***
  • Posts: 7990
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #76 on: March 10, 2017, 06:56:29 am »
Regarding the "Revisions"
LP1 = Lab Prototype 1 (normal first prototype build with final design)
LP2 = Lab Prototype 2 (second interation)
PP = Production Prototype (Final production design to do tests with, dropping, climate chamber, EMC and such)
put those bad emissions on frequencies of the nearby radio station next to the testlab! So no one will know ;)

Sounds reasonable, except these aren't prototype units.

Yes, but you're inserting much lower values than your production unit started with. You originally had a product config of 24, with a revision of FPR.
 

Online Someone

  • Super Contributor
  • ***
  • Posts: 4508
  • Country: au
    • send complaints here
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #77 on: March 10, 2017, 07:44:28 am »
Regarding the "Revisions"
LP1 = Lab Prototype 1 (normal first prototype build with final design)
LP2 = Lab Prototype 2 (second interation)
PP = Production Prototype (Final production design to do tests with, dropping, climate chamber, EMC and such)
put those bad emissions on frequencies of the nearby radio station next to the testlab! So no one will know ;)

Sounds reasonable, except these aren't prototype units.

Yes, but you're inserting much lower values than your production unit started with. You originally had a product config of 24, with a revision of FPR.
Yes, just some leftover identifiers in the firmware images that haven't been cleaned out. Exactly the sort of thing that can get invalidated by a new firmware update.
 

Offline Solberg

  • Contributor
  • Posts: 30
  • Country: dk
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #78 on: March 10, 2017, 08:41:32 am »
You can calculate the voltage needed for a given ID by this equation.

x=ID#

5/1024*64*x=Voltage
 
The following users thanked this post: luiz_aug

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #79 on: March 10, 2017, 09:02:12 am »
Yes, but you're inserting much lower values than your production unit started with. You originally had a product config of 24, with a revision of FPR.

Right.
FPR=Final Production Revision?
 

Offline CJay

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #80 on: March 10, 2017, 09:43:44 am »
But it never ceases to amaze me seeing Dave use this huge soldering iron tip on small board items (me, I prefer the small tips for that ! I guess it's an Australian thing, like the butcher knife ...  :)).

I reckon it might be a genetic thing from British ancestry, my go to Iron is a Weller W60D with a 3.2mm tip and it gets used for *everything* down to and including rework on stuff like this BL1551 (which is in a smaller package than the SOT363 and yes, I did catch the plastic on the connector but replaced it afterwards for cosmetic reasons).

For really small stuff I might use a smaller iron tip.
 

Offline Wonderbar

  • Newbie
  • Posts: 3
  • Country: af
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #81 on: March 10, 2017, 11:29:40 am »
Yes, but you're inserting much lower values than your production unit started with. You originally had a product config of 24, with a revision of FPR.

Right.
FPR=Final Production Revision?

Yep it´s "Production Run"
L* is normally not produced by the production P* is produced on the production line, this is especially relevant if the production site is not the same site as the development site IMHO..
Most of the time the serial numbers gives away the country of origin, so US* is produced in US (at least assembled and tested) as far as i know.
 

Offline hauptbr09

  • Contributor
  • Posts: 12
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #82 on: March 10, 2017, 01:33:26 pm »
I'm surprised no one has put a set of digital potentiometers, wacked in a relay, and automated the configuration testing

Sent from my SM-G935V using Tapatalk

 
The following users thanked this post: Free_WiFi

Offline technix

  • Super Contributor
  • ***
  • Posts: 3507
  • Country: cn
  • From Shanghai With Love
    • My Untitled Blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #83 on: March 10, 2017, 01:43:50 pm »
Actually using a row of d-pots you can automate the testing process, and then you can select the model you want before boot through an Arduino-based interface, setting the d-pots to the appropriate values.
 

Offline Relaxe

  • Regular Contributor
  • *
  • Posts: 53
  • Country: ca
  • Keepin' it civilized
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #84 on: March 10, 2017, 01:53:51 pm »
Does someone have an image of the AWG section from a NON-AWG version?

As Dave brillantly pointed out, that option seems to be enabled by those ID resistors.
I'm really interested to know if the parts are fully unpopulated or simply missing the BNC.
As the option brings the price of the scope up by about 200$US, a "solder yourself" part list would be a great aftermarket warranty-voiding option!

Thanks!
 

Offline S13

  • Contributor
  • Posts: 45
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #85 on: March 10, 2017, 02:12:29 pm »
Great news that the hack is working on Dave's unit. But remember that he has the full list of software keys enabled.

It might be that the resistors allow the system to know the capabilities of the scope's hardware, but the final decision of enabling and disabling an upgradable feature could very well still be up to software licence keys. That would be at least how i would design such a product feature.

So perhaps Dave's scope is not the best scope to verify all these upgrades on... But still good news that a 100MHz enabled bandwidth scope can be upgraded to a 200MHz+ model  :)
 
The following users thanked this post: Someone

Offline Wonderbar

  • Newbie
  • Posts: 3
  • Country: af
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #86 on: March 10, 2017, 02:18:28 pm »
I wonder why they even do it that way (configuration resistors).. So they have to keep boards with different part numbers in their warehouse for the different configurations... Otherwise production could just assemble the units, whack on a sticker with the correct model number they are currently producing and flash it to the right Bandwidth / Samplerate setting via Software.. So one Board version instead of X...

The BNC Connector + analog circuits could be put on a daughterboard which is only installed once someone buys the option in the models with that option.. So you can mass produce the base boards and use them in all productversion instead of doing a specific board for each version...
 

Offline f4eru

  • Super Contributor
  • ***
  • Posts: 1086
  • Country: 00
    • Chargehanger
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #87 on: March 10, 2017, 03:10:15 pm »
It could be  that the resistors Dave changed are only the "pullup" resistors (or better said the fixed part of the divider), and that the config resistors are on the other board. Which makes more sense.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13693
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #88 on: March 10, 2017, 03:59:05 pm »
resistors are generally to tell the software what build variant the hardware is, so there will be other differences spart from the R's
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 
The following users thanked this post: Someone

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13693
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #89 on: March 10, 2017, 04:31:03 pm »
Just spotted this in the datasheet, implying that at least some of the wavegen hardware is fitted as standard.
Quote
All models come standard with built-in training signals
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 
The following users thanked this post: Relaxe

Offline Relaxe

  • Regular Contributor
  • *
  • Posts: 53
  • Country: ca
  • Keepin' it civilized
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #90 on: March 10, 2017, 08:08:03 pm »
One other thing,
The EDU models have very limited memory depth: 100kpts vs 1Mpts for the non EDU.
I'm wondering if this is easily verifiable to check if a hacked scope will get more of those sweet pts'es.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13693
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #91 on: March 10, 2017, 08:27:23 pm »
I think someone needs to go buy an EDUX...
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Monkeh

  • Super Contributor
  • ***
  • Posts: 7990
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #92 on: March 10, 2017, 08:28:07 pm »
I think someone needs to go buy an EDUX...

You think anyone round here's going to buy one before the end of the month? ;)
 

Offline Pampalini

  • Newbie
  • Posts: 7
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #93 on: March 10, 2017, 09:38:38 pm »
There is more difference:
Quote
Trigger types: edge, pulse width, and video on EDUX1000-Series models.
DSOX1000-Series models add: pattern, rise/fall time, and setup and hold.
but this seems to be only software modes.
 

Offline David

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #94 on: March 10, 2017, 10:10:53 pm »
I think someone needs to go buy an EDUX...

Agreed!
David
(United Kingdom)
 

Offline RossS

  • Contributor
  • Posts: 25
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #95 on: March 11, 2017, 01:16:40 am »
Does someone have an image of the AWG section from a NON-AWG version?

I bought the 70MHz version without AWG (DSOX1102A). Here are pics of the main board.
 
The following users thanked this post: EEVblog, thm_w, Relaxe, Lord of nothing, wxqhigh

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13693
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #96 on: March 11, 2017, 01:38:01 am »
So that answers the question about population -  not only the function gen outputs not fitted but also some PSU components near the power-in connector.
Is the PSU the same ?
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #97 on: March 11, 2017, 01:41:58 am »
15 and 18 volt supplies for the Wavegen I guess.
VE7FM
 

Offline RossS

  • Contributor
  • Posts: 25
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #98 on: March 11, 2017, 01:57:21 am »
Is the PSU the same ?

Here's the power supply. Looks the same to me as the one in Dave's teardown. I'm happy to take other pictures of the scope if anyone would find them useful.
« Last Edit: March 11, 2017, 02:26:19 am by RossS »
 
The following users thanked this post: Relaxe

Offline hauptbr09

  • Contributor
  • Posts: 12
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #99 on: March 11, 2017, 02:44:56 am »
I wonder, if you do the mod described, if you would get an error for missing components.

Sent from my SM-G935V using Tapatalk

 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf