Metrix Scopix II OX7062 Review / Teardown

[shakalnokturn]

I recently bought a lightly used Metrix OX7062 handheld DSO.

It came with the original box, USB-RS232 cable, 10 Base T Ethernet cable, PSU, one HX0030 (10:1 250MHz isolated probe), one HX0034 (80A AC/DC current clamp).
At the same time I found a separate set of two HX0004, 10:1 250MHz isolated probes for an extra 25€ postage included. They do not use the scope's Probix bus though.

The scope is a dual isolated channel 60MHz model, with 1GS/s real time sampling, 12bit resolution and 2500 samples/channel as standard (50k optional).
Display is 320x240 STN colour with resistive touchscreen. (This model also exists with a monochrome display.)
The GUI is a primitive windows style, most adjustments can be either accessed either by the top drop-down menus or by double-tapping on areas of the display.
The scope's size is a hard compromise between a portable bench scope and a handheld scope, it fits very well on a bench with the rear stand, it's slightly too bulky to my likings to be handheld for a long time.


HX0034 current probe has 2 programmable buttons, commonly used for changing A/div, there is a third button for degaussing/zeroing the DCA measurement.
HX0030 has the same 2 programmable buttons, the third key lights a white led as an aid to see where you're probing.
Connecting or removing a Probix probe brings up a window telling you the acquisition channel it is on, as well as the probe bandwidth and other limitations.


The good points:
Casing, apart from the rear stand, the casing looks and feels really rugged.
Colour display, nice to have it, arguably there is more point to this on a 4 channel version.
Battery still lasts about 3 hours of continuous use.
Ethernet.
1GS/s, 12bits actually gives the FFT option some meaning.

The bad points:
STN display a little low on resolution and very slow.
Resistive touchscreen, would have been nice to have a double-tapping sensitivity adjustment.
It is sold as a 5 in 1 instrument "OSCILLOSCOPE ; MULTIMETER ; FFT ANALYSER ;
HARMONIC ANALYSER AND RECORDER" but as default there are no harmonic analyser or recorder. These must be added with option keys.
DMM autorange is ridiculously slow, also DMM has no dedicated acquisition channel, a Probix adapter must be used on one of the scope inputs.


Opening the case...

Six T10 headed screws hold the two halves of the shell together.
Removing the rear reveals a PCB showing mainly the shielding to the two channel frontends and the unpopulated footprints for the other two channels.
Only 2 Phillips head screws at the bottom secure this PCB in place. Once removed the interconnect bottom right opposes a little resistance (do not lift board out from the top, leaver up from bottom right).
The scope is split into two PCB's most of it being on the first one. The main PCB holds the frontend and acquisition system, graphics, CPU, some power supplies...
The other PCB holds the keyboard, some power supplies including CCFL inverter.
LCD panel is a Kyocera KCS057QV1AD-G23.

Given the 1GS/s and 12bit specs I was really curious of the acquisition hardware to be found under the shielding.
It turns out to be a CCD type of setup.
A first ASIC marked "SCALING 0732V2.2" sees to the input amplification/attenuation, BWL.
It looks like a AQY216EH static relay is used for bypassing the AC coupling capacitor.
A second ASIC  marked "PIPELINE V3" must be the CCD storage, the output from this is then fed to a slow AD7472A 12 bit ADC.
The isolation is built around transformers (of course!) an ADUM2402 digital isolator and a HCNW2611 high speed logic level opto.

The processing, display and interlink are taken care of by a EP1K50 FPGA and XPC823 CPU.
Ethernet link is based on a LXT905.


I didn't get round to removing the grey plastic isolation shield between channels, it seems that it should slide off pulling towards the Probix connectors but is likely held firmly in place by the screwed-in coaxial connectors themselves, a ribbon cable runs along it's back to connect to the Probix bus.
seeing the top side layout I'm not expecting to find much other than passive components on the hidden side.


Evolution?

Of course one of the motivations to open it was to get a first idea on how much it could be hacked.
The top of the series models have 100MHz bandwidth, I suppose this is the one thing that could be hacked easily.
The display could be upgraded to a TFT model with LED backlight like the NHD-5.7-320240WFB but that comes at a price.
Then there's the stuff to be enabled with software keys, the 50k points memory is probably one of them.

Photo album is here (not fantastic photos):
https://photos.app.goo.gl/K8jYtuxE7kifzeYx8

[noidea]

Thanks, I have seen the 4 channel ones on US ebay and wondered what they were like

[widlokm]

Hello shakalnokturn,

Are You still playing with OX7062? I have very similar model OX7042 (scopix III) - looks almost the same from the inside and I also thinking about hacking it. In fact I already tried to read firmware directly from onboard flash (failed, but it is possible) and I got the bin file from Metrix update tool.
The scope uses VxWorks OS and some java code, but this is everything I know now from the software perspective.
Scope board also has BDM (debug interface for MPC823) connector on its side and it was possible to connect some interface to it, however it is rather unpopular connection and much more work is needed to use it.

Anyway if You still thinking about hacking the scope pleas tell me, maybe we can work together.
Regards,
Michael Widlok 

[ServoTom]

Hi,
did someone succesfully hacked the scopix so far? I own a OX7042 as well.

Best regards
Tom

[shakalnokturn]

Not that I know of.
I'm not into software much besides I don't rely on this scope often enough to want to go to the bother on my own right now.

Could do with some detailed photos of front ends of other models to determine if there are a couple of passives to change to gain  bandwidth or if it is software clipped.

[bestel]

Hi guys!

Some update.

I've unpacked all firmware (not encrypted) from the "firmware update manager" and try to disassemble it.
I've not figure out how to decompile the code, but I think I found something.

All models (not the 1st & 2nd one) have in memory some strange strings, that look like this :

Code: [Select]

.....OptionsNonInstallees.... - Multimeter4rdfGP45... - Harmonic78jdfs#KL4... - Recorder%%%%%%hdf<... - Memory:df$$z89AZ*$... - ColorDisplay@6Yg45... - PowerMeter45sdfq%.... - Extension1*.^12nNq........|.......|.......


It could be a non initialized memory, but it's seems to be a string... so very strange.
And if you take that one for example : "Memory:df$$z89AZ*$" and you try to encode it in base64, it give you that :

"TWVtb3J5OmRmJCR6ODlBWiok" = Amazing! This is what the software want, 6 x 4 = TWVt b3J5 OmRm JCR6 ODlB Wiok

I've tried to enter this code in reverse, lowercase, uppercase.... nothing works...


For those who will want to try something, here is my program for unpacking the "vers.mx" file containing all the "XPC8xx" firmware based :
(Still a Work in progress - and yes it's dirty)

The program need to be launch in the same directory, and will output 3 type of file :

OUTRAW_x => It's the hexadecimal code without any modifications (beside removal of "HEX" protocol and CRC). You can open it with an hexadecimal editor.
OUTPUT_x => will be the main output : it's OUTRAW converted from HEX. You can open it with an hexadecimal editor.
O_TEXT_x => It's the OUTPUT_x directly in ASCII. You can open it with any text software.

Code: [Select]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>


typedef enum
{
STATE_SYNC,
STATE_ID,
STATE_SIZE,
STATE_ADDR,
STATE_DATA,
STATE_CRC,
STATE_END,
} STATE;


int main()
{
FILE *mx, *raw, *binary, *text;

printf("Let's begin!\n");

mx = fopen("vers.mx", "rb");
if(mx == NULL)
{
perror("fopen read");
return EXIT_FAILURE;
}

STATE current = STATE_SYNC;
char buf[64];
unsigned read_length, addr_length, data_length;
unsigned real_read;
unsigned char new_file = 1;
unsigned char state_id = 0;
unsigned char output_id = 0x30;
char outputRAW_str[13], outputBIN_str[13], outputTEXT_str[13];

strncpy(outputRAW_str, "OUTRAW_x.txt", 12);
outputRAW_str[12] = 0;

strncpy(outputBIN_str, "OUTPUT_x.txt", 12);
outputBIN_str[12] = 0;

strncpy(outputTEXT_str, "O_TEXT_x.txt", 12);
outputTEXT_str[12] = 0;

while(1)
{
// SELECT HOW MANY TO READ
switch(current)
{
case STATE_SYNC:
{
read_length = 1;
break;
}
case STATE_ID:
{
read_length = 1;
break;
}
case STATE_SIZE:
{
read_length = 2;
break;
}
case STATE_ADDR:
{
read_length = addr_length;
break;
}
case STATE_DATA:
{
read_length = data_length;
break;
}
case STATE_CRC:
{
read_length = 1;
break;
}

case STATE_END:
{
printf("Should not be there\n");
break;
}
}

// READ
real_read = fread(buf, 1, read_length, mx);
if(real_read != read_length)
{
current = STATE_END;
}

// PROCESS
switch(current)
{
case STATE_SYNC:
{
if(buf[0] == 'S')
{
current = STATE_ID;
}
break;
}
case STATE_ID:
{
state_id = buf[0] - 0x30;

switch(state_id)
{
// Special memory ? Bootloader ?
case 1:
// Real shit
case 2:
{
if(new_file == 1)
{
new_file = 0;
outputBIN_str[7] = output_id++;
binary = fopen(outputBIN_str, "w+");
if(binary == NULL)
{
perror("fopen write");
}

outputRAW_str[7] = outputBIN_str[7];
raw = fopen(outputRAW_str, "w+");
if(raw == NULL)
{
perror("fopen write");
}

outputTEXT_str[7] = outputBIN_str[7];
text = fopen(outputTEXT_str, "w+");
if(text == NULL)
{
perror("fopen write");
}
}

current = STATE_SIZE;
break;
}

// EOF - but not the end of the mx file
case 9:
{
new_file = 1;
fclose(raw);
fclose(binary);
fclose(text);

current = STATE_SIZE;
break;
}

default:
{
printf("ERROR: WRONG ID %d -- %x -- RESYNC\n", state_id, buf[0]);
current = STATE_SYNC;
break;
}
}

break;
}
case STATE_SIZE:
{
int size = ( (buf[0]-0x30) *16) + (buf[1]-0x30);
if(size > 20)
{
printf("ERROR: SIZE=%d - SKIP and RESYNC\n", size);
current = STATE_SYNC;

if(new_file == 0)
{
new_file = 1;
fclose(raw);
fclose(binary);
fclose(text);
}
break;
}

switch(state_id)
{
case 1:
{
addr_length = 4;
data_length = (size * 2) - addr_length - 2;
break;
}
case 2:
{
addr_length = 6;
data_length = (size * 2) - addr_length - 2;
break;
}
case 9:
{
addr_length = 4;
data_length = 2;
break;
}
}

current = STATE_ADDR;
break;
}
case STATE_ADDR:
{
current = STATE_DATA;
break;
}
case STATE_DATA:
{
char data[32];
char hex[2];

for(int i=0 ; i < data_length /2 ; i++)
{
hex[0] = buf[(i*2)];
hex[1] = buf[(i*2)+1];
data[i] = (char)strtol(hex, NULL, 16);
}



// Output raw unpacked data
fwrite(buf, 1, data_length, raw);
//fwrite("\n", 1, 1, raw);

// Output converted bytes
fwrite(data, 1, data_length /2, binary);

// Output converted bytes to ascii
for(int i=0 ; i < data_length /2 ; i++)
{
if(data[i] >= 0x20 && data[i] < 0x7F)
{
fprintf(text, "%c", data[i]);
}
else
{
fprintf(text, ".");
}

}

current = STATE_CRC;
break;
}
case STATE_CRC:
{
current = STATE_SYNC;
break;
}

// EOF
case STATE_END:
{
fclose(mx);
return EXIT_SUCCESS;
}
}

}

printf("Over!\n");

}



UPDATE It seems that evey code is unique, so it seems to be more complicated than this.
Here is the source in french :

Installation des différentes options de l’instrument.
Une option est installée en saisissant un code de 24 caractères et en cliquant sur la touche OK.
Ce code est unique pour l’option acquise et pour votre instrument (il ne peut pas être installé sur un autre instrument).
Lors de l’acquisition d’une option, vous devez spécifier le numéro de série et la clé de l’instrument dans votre commande, et CHAUVINARNOUX vous fournira ce code.
Le numéro de série et la clé sont inscrits dans la barre de titre de la fenêtre « Options ».
# : 123456ABC-2997

[shakalnokturn]

I recently acquired a used Scopix III with options installed when I find some time and quiet I'll try dumping the flash and post it here along with the scope's serial number.
If the option keys are in flash the corresponding serial could help find the math behind it.

[bestel]

I recently acquired a used Scopix III with options installed when I find some time and quiet I'll try dumping the flash and post it here along with the scope's serial number.
If the option keys are in flash the corresponding serial could help find the math behind it.

Yes, for the moment I have no idea where the UID is... maybe a unused part of the flash.
Do you know a cheap solution to dump the flash?

I hope they did not used the FPGA for the "security" part 

[shakalnokturn]

Yes, hopefully not the FPGA.
I was hoping for a I²C EEPROM somewhere for serial number, factory calibration, option keys... I haven't spotted one.
I know of no easy way to dump the flash, no doubt it can be done over Ethernet when you know how to. I don't so the plan is to take a little risk and desolder the TSOP then read it externally.
I wish at least some service software and schematics would leak from C.A. once in a while.

[bestel]

Is there any law to force them to provide these information?
Something like "the right to repair something I bought"?

I could try to ask them 

[shakalnokturn]

Did you also get free Probix probes with your free scope? I can't believe how hard it is to get hold of those at a decent price.


I finally got round to completely removing the FE PCB on the OX7062-C

To do that the input coax connectors centre must first be de-soldered, then you either need a specific tool with 4 teeth that will slide between the coax shield and the surrounding plastic or you can get away with just a piece of metal tube if it has the right diameter and is slightly conical, that's what I did.

There's not that much going on on the hidden side of the PCB, a lot of decoupling capacitors, and a little extra on CH4 for the DMM input.

I made some in circuit measurements of FE capacitor values (DE-5000 @100kHz) and partially sketched the input.

Added a few photos to the gallery.