Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 423254 times)

0 Members and 3 Guests are viewing this topic.

Offline brumster

  • Contributor
  • Posts: 10
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #250 on: March 18, 2017, 09:58:40 am »
I suppose the obvious question is, can it be ripped off to release the full potential? Looks like there's a few passives to add on as well... but is there a further hardware limitation somewhere? Not too worried about the probes - as has been said, makes sense to only ship 75MHz ones rather than 200's for a model marketed as a 50 meg scope.

(Looks around the room - fears he's the guinea pig here)
 

Online nfmax

  • Super Contributor
  • ***
  • Posts: 1556
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #251 on: March 18, 2017, 10:23:35 am »
It looks as if the only upgrades that don't require hardware changes are the ones Keysight sell licenses for. They seem to have taken care to make the hardware different enough to cause 'issues' if you try to fool it. That doesn't mean it won't be possible to hack, if you are prepared to get all hot with a soldering iron, though!
 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 4510
  • Country: au
    • send complaints here
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #252 on: March 18, 2017, 10:26:49 am »
The lower bandwidth EDU has extra parts? That's interesting...
An extra hardware filter?




It looks like the ADC/ASIC does the bandwidth limiting, and will probably only do 70MHz - there isn't a 50MHz DSOX2000 model. So this being a 50MHz bandwidth limiter makes sense if Marketing decides that they need a 50Mhz model to avoid competing with the DSOX product.
Its likely that's just a simple opamp front end for the low end product, and although having the extra parts visible it's then missing all the discrete front end under the can.
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #253 on: March 18, 2017, 10:31:57 am »
The lower bandwidth EDU has extra parts? That's interesting...
An extra hardware filter?




It looks like the ADC/ASIC does the bandwidth limiting, and will probably only do 70MHz - there isn't a 50MHz DSOX2000 model. So this being a 50MHz bandwidth limiter makes sense if Marketing decides that they need a 50Mhz model to avoid competing with the DSOX product.
Its likely that's just a simple opamp front end for the low end product, and although having the extra parts visible it's then missing all the discrete front end under the can.
That's a good point - can we see under the can of the EDUX please?
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #254 on: March 18, 2017, 02:14:49 pm »
Quote
can we see under the can of the EDUX please?

EDUX1002G Input Channel 2
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #255 on: March 18, 2017, 02:30:47 pm »
I noticed some differences in some components between the EDU and DSO models.  EDU has missing components on the EXT TRIG input section (missing RELAY, Analog comparator with resistors and caps) and EDU has additional components on both input sections compared to the DSO model.

EDUX only has a single range for the EXT input, hence no relay
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #256 on: March 18, 2017, 05:14:00 pm »
What is the name of the 8 pin square chip in center right? Can be a band limiting amplifier.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #257 on: March 18, 2017, 06:41:43 pm »
What is the name of the 8 pin square chip in center right? Can be a band limiting amplifier.
The 8 pin square chip is HMC626ALP5E 0.5 dB LSB GaAs MMIC 6-BIT DIGITAL VARIABLE GAIN AMPLIFIER, DC - 1 GHz (same chip on both EDUX and DSOX)

The 14 pin U40 chip is OPA4872 4:1 High-Speed Multiplexer (On Dave's DSOX1102G unit it is LMH6574MA)
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #258 on: March 18, 2017, 08:15:40 pm »
What is the name of the 8 pin square chip in center right? Can be a band limiting amplifier.
The 8 pin square chip is HMC626ALP5E 0.5 dB LSB GaAs MMIC 6-BIT DIGITAL VARIABLE GAIN AMPLIFIER, DC - 1 GHz (same chip on both EDUX and DSOX)
Don't think so - HMC626 is a 32 pin QFN
Quote

The 14 pin U40 chip is OPA4872 4:1 High-Speed Multiplexer (On Dave's DSOX1102G unit it is LMH6574MA)
Weird - comparing Digikey pricing,  looks like they're spending more on the 50MHz front-end than the 200MHz one!
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #259 on: March 18, 2017, 08:39:59 pm »
What is the name of the 8 pin square chip in center right? Can be a band limiting amplifier.
The 8 pin square chip is HMC626ALP5E 0.5 dB LSB GaAs MMIC 6-BIT DIGITAL VARIABLE GAIN AMPLIFIER, DC - 1 GHz (same chip on both EDUX and DSOX)
Don't think so - HMC626 is a 32 pin QFN


You are right... I took it from Dave's teardown video: @ 22:59
The marking on the package is HVB #626
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #260 on: March 18, 2017, 08:46:11 pm »
The 14 pin U40 chip is OPA4872 4:1 High-Speed Multiplexer (On Dave's DSOX1102G unit it is LMH6574MA)
Weird - comparing Digikey pricing,  looks like they're spending more on the 50MHz front-end than the 200MHz one!

The 50MHz front-end is definitely more expensive if you add the EL5166ISZ current feedback amplifier on each channel
 

Offline markb82

  • Regular Contributor
  • *
  • Posts: 63
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #261 on: March 18, 2017, 08:48:42 pm »
The missing EL5166ISZ opamp could just be a production optimisation once they were comfortable enough with leaving it off(they decided it wasn't needed).  Same for the different mux manufacturers, the boards probably have different manufacturing dates.
« Last Edit: March 18, 2017, 10:10:46 pm by markb82 »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #262 on: March 18, 2017, 09:35:23 pm »
So Dave's guess was incorrect, the small square chip is not HMC626a. This is also obvious from the pinout. The output of the IC on the board is pin 1. What is it then...?
Facebook-free life and Rigol-free shack.
 

Offline Fungus

  • Super Contributor
  • ***
  • Posts: 16562
  • Country: 00
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #263 on: March 18, 2017, 09:41:08 pm »
The 14 pin U40 chip is OPA4872 4:1 High-Speed Multiplexer (On Dave's DSOX1102G unit it is LMH6574MA)
Weird - comparing Digikey pricing,  looks like they're spending more on the 50MHz front-end than the 200MHz one!

I don't think they're doing it to save on the BOM.
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #264 on: March 18, 2017, 09:50:13 pm »
So Dave's guess was incorrect, the small square chip is not HMC626a. This is also obvious from the pinout. The output of the IC on the board is pin 1. What is it then...?
Probably a single-ended to differential buffer for the ADC
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #265 on: March 18, 2017, 10:35:07 pm »
In that case the additional amplifier IC on the 50MHz model would ruin symmetry of the differential connection between that chip and LMH6552. The additional IC has voltage gain of 4. So no, unlikely the small chip is a single to differential converter.

Looking at the resistor values, the combined gain between the small IC and output of LMH6552 is twice as high for 50 MHz model  as that of 100/200MHz one. Makes me wonder why they had to boost it for 50 MHz model.
Facebook-free life and Rigol-free shack.
 

Offline Towger

  • Super Contributor
  • ***
  • Posts: 1645
  • Country: ie
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #266 on: March 18, 2017, 10:40:23 pm »
From memory, Dave has an earlier prototype from last year, as well as the newer dumpster scopes.  I am not sure which he took appart and photoed, but I know he said they had different rev numbers on the boards.

Dave are the front ends the same on both versions?
 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37664
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #267 on: March 18, 2017, 11:24:01 pm »
I suppose the obvious question is, can it be ripped off to release the full potential?

Very likely.
 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37664
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #268 on: March 18, 2017, 11:24:39 pm »
From memory, Dave has an earlier prototype from last year, as well as the newer dumpster scopes.  I am not sure which he took appart and photoed, but I know he said they had different rev numbers on the boards.
Dave are the front ends the same on both versions?

That top part seems to be. My videos were on the production unit.
 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37664
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #269 on: March 18, 2017, 11:28:17 pm »
Don't forget I have hires teardown photos:
https://flic.kr/s/aHskPVQpFq
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #270 on: March 19, 2017, 03:34:22 pm »
I was able to get 100MHz on EDUX using Product ID 03 (it has the same issues with Channel 2 as described previously), but could not get 200MHz, so there must be some differences in the front end (the extra EL5166ISZ opamp?)

Going back to Product ID 24 as 03 has many issues.
« Last Edit: March 19, 2017, 04:38:42 pm by TK »
 
The following users thanked this post: fullyBoricua

Offline Windfall

  • Contributor
  • Posts: 30
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #271 on: March 20, 2017, 02:36:29 am »
It looks as if the only upgrades that don't require hardware changes are the ones Keysight sell licenses for. They seem to have taken care to make the hardware different enough to cause 'issues' if you try to fool it. That doesn't mean it won't be possible to hack, if you are prepared to get all hot with a soldering iron, though!
The continuous assumption in this whole discussion (correct me if I'm wrong) is that all of the identity of the machine is in the hardware. It need not be. There might be a bunch of hidden data bits somewhere that say 'I'm model xxx' (programmed anti-fuses in some chip, or an OTP part of a ROM). No amount of hardware hacking will be enough, then, to fool the main software into concluding it runs on model yyy, unless you find out all about the ID bits.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #272 on: March 20, 2017, 04:34:47 am »
I was able to get 100MHz on EDUX using Product ID 03 (it has the same issues with Channel 2 as described previously), but could not get 200MHz, so there must be some differences in the front end (the extra EL5166ISZ

Can you measure the bandwidth of the front end? Source signal to the scope input and measure the output of the lmh6552 on one shoulder.
Facebook-free life and Rigol-free shack.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #273 on: March 20, 2017, 05:01:23 am »
It looks as if the only upgrades that don't require hardware changes are the ones Keysight sell licenses for. They seem to have taken care to make the hardware different enough to cause 'issues' if you try to fool it. That doesn't mean it won't be possible to hack, if you are prepared to get all hot with a soldering iron, though!
The continuous assumption in this whole discussion (correct me if I'm wrong) is that all of the identity of the machine is in the hardware. It need not be. There might be a bunch of hidden data bits somewhere that say 'I'm model xxx' (programmed anti-fuses in some chip, or an OTP part of a ROM). No amount of hardware hacking will be enough, then, to fool the main software into concluding it runs on model yyy, unless you find out all about the ID bits.

This is certainly possible but going by how the DSOX2000/3000 series operates it seems most things are set by jumper.
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #274 on: March 20, 2017, 10:53:03 am »
It looks as if the only upgrades that don't require hardware changes are the ones Keysight sell licenses for. They seem to have taken care to make the hardware different enough to cause 'issues' if you try to fool it. That doesn't mean it won't be possible to hack, if you are prepared to get all hot with a soldering iron, though!
The continuous assumption in this whole discussion (correct me if I'm wrong) is that all of the identity of the machine is in the hardware. It need not be. There might be a bunch of hidden data bits somewhere that say 'I'm model xxx' (programmed anti-fuses in some chip, or an OTP part of a ROM). No amount of hardware hacking will be enough, then, to fool the main software into concluding it runs on model yyy, unless you find out all about the ID bits.
It is certain that you cannot go from the model without signal generator to the G model, and from EDUX to DSOX without adding the missing hardware components.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf