EEVblog 1415 - Reverse Engineering the DP10007 Differential Probe

[EEVblog]

Reverse engineering the Micsig DP10007 high voltage differential probe.
Turning the PCB into a schematic.



Reverse enginering how-to for the Rigol oscilloscope:
DIY light box for PCB photography:

[BrianHG]

     Old fashioned 'Paint Shop Pro' allows adding multiple graphics layers and geometry layers for text and arrows which you can adjust the transparency between them and their layer order and layer-layer alignment on the fly.  In fact, I would use and still use today my old Paint Shot Pro 6 from the year 2000 to do exactly what you want.  It also has the edge outline filters if you want such image processing.

     Also, if you have equal spacers at the 4 corners of the pcb, some flatbed scanners will generate a perfectly square edge-edge accurate image even though the spacers lift the PCB off of the glass so that the components don't sit in a bumpy random height from the flatbed scanner.

[voltsandjolts]

Regarding the relay, using a latching type avoids thermal emfs on the contacts generated by the heat from a continuously powered coil.
Although, being post-amplifier here the signal levels aren't tiny....ah, but that amp is unity gain of course.

Regarding the SMD input dividers, board cleanliness is going to be critical to get any flux out from under those components.
SMD is obviously good for automated assembly, so I might have used larger parts with slots underneath for more effective cleaning.

[tszaboo]

There aren't too many things in this differential probe. Still probably a bunch could be shaved off from the BOM, if we throw out the digital part, replace it with a slider switch and two comparators. Not that it matters probably, as most of the cost is the injection moulds/distribution.
I wonder how hard can be to make a DIY version of it.

[floobydust]

I reverse-engineered a Pintek DP15K-Q high-voltage differential probe. Specs 15kVp-p 35MHz Input impedance 30MEG (I think), x100, x1000.
Pintek is an OEM you might want to take a look at Dave.

The circuit is your usual instrumentation three op-amps config with AC and DC CMRR adjust, relay for x100 atten, DC-DC converter to make +/-12VDC with 6-12V in (typ. 9V), a DC servo for offset.
I didn't get all the circuit, the numbers were sorta sanded off IC's and traces running around under things. Input op-amps THS4631D, TL062? for servo, THS3091 for the diff amp - all the same circuit as many others. No MCU.

Making one of these would be a good kit. I couldn't believe the markup on American private label versions of the same product. What a cash cow. It's just too expensive for what it is then.

edit: added pics of the HV front-end, it's just two 10kV rated resistors and comp caps likely rated as not as much    The probe is rated 15kVp-p differential and 5.5kV RMS common-mode Cat. II/Cat.III

[Cerebus]

The MOSFETs that mystified Dave, and he'll kick himself when he realises this, are configured as an H-bridge. The relay's a single coil latching type, so it needs both polarities for drive, one to latch on, the other to latch off.

[free_electron]

H-bridge driver for a latched relay. One reason for having a latched relay is signal integrity. An energized coil leaks enough magnetic field that his has an impact on the signal.
An ac signal traveling through an magnetic field sees a complex impedance. This throws a spanner in the gain flatness if that relay is used to switch gain settings. The bandwidth will change with energized/non energized state. This behavior is frequency dependent too.
i found this out the hard way when making test equipment for ADSL. even though the signals there are only up to the 1.3 MHz range, traveling through an energized relay was enough to have a few kilobit impact on the line. So i switched to dual coil relays (set-rest type) and the problem went away.
when i left one of the coils energized you could clearly see the drop.

[BrianHG]

throw out the digital part, replace it with a slider switch and two comparators.

The telecom latching relay used is hermetically sealed.  The switching lisfespan of these where clean noise free contacts being made is worth the expense when engineering such measurement devices like a probe.

Really, for a piece of test hardware, the minute under extra 10$ of parts is worth it.

[NiHaoMike]

H-bridge driver for a latched relay. One reason for having a latched relay is signal integrity. An energized coil leaks enough magnetic field that his has an impact on the signal.
An ac signal traveling through an magnetic field sees a complex impedance. This throws a spanner in the gain flatness if that relay is used to switch gain settings. The bandwidth will change with energized/non energized state. This behavior is frequency dependent too.
i found this out the hard way when making test equipment for ADSL. even though the signals there are only up to the 1.3 MHz range, traveling through an energized relay was enough to have a few kilobit impact on the line. So i switched to dual coil relays (set-rest type) and the problem went away.
when i left one of the coils energized you could clearly see the drop.

For some nice entertainment, let the audiofools know about that and watch them argue about it.

[KT88]

Why are they using a relay in the first place? The gain switching happens at a low-impedance node behind the differential stage. An analog CMOS switch would be perfectly fine for the job at less power, size and less cost...

Cheers
Andreas

[tszaboo]

H-bridge driver for a latched relay. One reason for having a latched relay is signal integrity. An energized coil leaks enough magnetic field that his has an impact on the signal.
An ac signal traveling through an magnetic field sees a complex impedance. This throws a spanner in the gain flatness if that relay is used to switch gain settings. The bandwidth will change with energized/non energized state. This behavior is frequency dependent too.
i found this out the hard way when making test equipment for ADSL. even though the signals there are only up to the 1.3 MHz range, traveling through an energized relay was enough to have a few kilobit impact on the line. So i switched to dual coil relays (set-rest type) and the problem went away.
when i left one of the coils energized you could clearly see the drop.

Also, the energized relay is using quite a bit of power. 5V 100mA or something like that, depending on voltage maker and so on. Say 0.5W in that package. It heats up, and the contacts create thermocouples. So if the signal level is small, in the 100mV range, these effects can easily influence your measurements.

Why are they using a relay in the first place? The gain switching happens at a low-impedance node behind the differential stage. An analog CMOS switch would be perfectly fine for the job at less power, size and less cost...

Cheers
Andreas

Analogue switches have some serial resistance. This is also function of the signal being switched. It also has some input capacitance, so you cannot "just increase the feedback resistance" to get rid of this.  It's not like it is impossible to solve these issues, but I'm not surprised if the designer doesn't want to deal with them, and decides to use a simpler method that doesn't have these issues.

[Cerebus]

Why are they using a relay in the first place? The gain switching happens at a low-impedance node behind the differential stage. An analog CMOS switch would be perfectly fine for the job at less power, size and less cost...

Cheers
Andreas

Analogue switches have some serial resistance. This is also function of the signal being switched. It also has some input capacitance, so you cannot "just increase the feedback resistance" to get rid of this.  It's not like it is impossible to solve these issues, but I'm not surprised if the designer doesn't want to deal with them, and decides to use a simpler method that doesn't have these issues.

There's less to deal with than one might at first think. Figures for the 74HC4053 analog switch (3PDT), which I just happen to have a data sheet handy for: input capacitance 3.5pF, ON resistance 100 , ON resistance mismatch between switches 9 .  The THS4631 input amplifier has an input capacitance of 3.9pF and that's in the high impedance zone so 3.5pF in the low impedance zone isn't going to be a problem.

It's as well to remember that the original purpose of the venerable 4066 before people started using them to switch pukka analogue signals around was to switch high speed digital signals around, copying from the IC design technique of building multiplexers and the like from pass transistors rather than from gates. These aren't low frequency components.

I'd use a slightly different topology if I was to use analogue switches, there are little tricks to putting them in places where their resistance (and more importantly the non-linearity of that resistance) has little effect - think "switch currents not voltages".

I don't think the designer was necessarily looking to minimise the work they had to do - adding a whole microprocessor sounds like unwanted/unnecessary complexity to me. As to choosing a latching relay over active switching, perhaps the designer is, like me,  a latching relay fanboy. I however avoid the single coil versions to avoid having to mess around with reversing the coil polarity.

[free_electron]

Figures for the 74HC4053 analog switch (3PDT)

these days there's much. much better ones ... DGxxx family , texas instruments has a whole range TSX series. . very low channel  to channel leakage , high bandwidth ( you can switch USB3 signals) and cheaper than that relay

[tszaboo]

Why are they using a relay in the first place? The gain switching happens at a low-impedance node behind the differential stage. An analog CMOS switch would be perfectly fine for the job at less power, size and less cost...

Cheers
Andreas

Analogue switches have some serial resistance. This is also function of the signal being switched. It also has some input capacitance, so you cannot "just increase the feedback resistance" to get rid of this.  It's not like it is impossible to solve these issues, but I'm not surprised if the designer doesn't want to deal with them, and decides to use a simpler method that doesn't have these issues.

There's less to deal with than one might at first think. Figures for the 74HC4053 analog switch (3PDT), which I just happen to have a data sheet handy for: input capacitance 3.5pF, ON resistance 100 , ON resistance mismatch between switches 9 .  The THS4631 input amplifier has an input capacitance of 3.9pF and that's in the high impedance zone so 3.5pF in the low impedance zone isn't going to be a problem.

It's as well to remember that the original purpose of the venerable 4066 before people started using them to switch pukka analogue signals around was to switch high speed digital signals around, copying from the IC design technique of building multiplexers and the like from pass transistors rather than from gates. These aren't low frequency components.

I'd use a slightly different topology if I was to use analogue switches, there are little tricks to putting them in places where their resistance (and more importantly the non-linearity of that resistance) has little effect - think "switch currents not voltages".

I don't think the designer was necessarily looking to minimise the work they had to do - adding a whole microprocessor sounds like unwanted/unnecessary complexity to me. As to choosing a latching relay over active switching, perhaps the designer is, like me,  a latching relay fanboy. I however avoid the single coil versions to avoid having to mess around with reversing the coil polarity.

I had my fair share of designs with analogue switches.  Probably my favourite is the ADG5408 and 9, that solve that nasty latch-up issue for inputs.

While you can use different topologies, buffer opamps (which don't get overloaded, when switching their input) and others, as I said, maybe the designer just didn't want to deal with the design complexities.
Maybe they had to put a microcontroller on it. I had a design like that, I finished it, presented it. They asked how much Firmware work do I estimate, I said 0, there is no microcontroller on it. I solved the task at hand with a couple of logic gates.
I had to go back and replace those with a micro, so it can be programmed, "Just in case they want to change the functionality"

One other explanation is the lack of clean sheet design. Totally imaginable, they had to start with an existing topology, and only replace the mechanical switch, and couldn't rearrange the opamps to get a better product.

[thm_w]

There aren't too many things in this differential probe. Still probably a bunch could be shaved off from the BOM, if we throw out the digital part, replace it with a slider switch and two comparators. Not that it matters probably, as most of the cost is the injection moulds/distribution.
I wonder how hard can be to make a DIY version of it.

If we can get or guess the component values, seems like it wouldn't be hard to make a "barebones" version of the probe as you describe.
Opamps footprints are common enough that it should be possible to substitute something else with better/worse performance.
Trimmer pots are cheap.

MELFs would be cool to use, just because. But I'm not sure how critical the tempco etc is.
LCSC has some 0.1% 25ppm 200V 1206 for 15c each, should be good enough no?

edit: good write up here: https://circuitcellar.com/research-design-hub/high-voltage-differential-probe/
they used 1M 0.1%/10pF, and 1GHz opamps. The bandwidth goal was 25MHz but unsure of the end result.

[EEVblog]

As to choosing a latching relay over active switching, perhaps the designer is, like me,  a latching relay fanboy. I however avoid the single coil versions to avoid having to mess around with reversing the coil polarity.

It could simply be BOM reuse from another product that needed it. They might have had a million in stock or something.

[EEVblog]

The MOSFETs that mystified Dave, and he'll kick himself when he realises this, are configured as an H-bridge. The relay's a single coil latching type, so it needs both polarities for drive, one to latch on, the other to latch off.

Yes, I took a quick glance at the datasheet and missed that it was latching, the 210 is latching, the 200 is non-latching. So I had in my mind standad relay and therefore WTF.
I actually edited out a bit where I speculated it was for an optional latching relay 

[RafaPolit]

Hey! Am I really thick, or what am I missing? The first phrase of the video claims a “previous video” where you look at, talk about and open up the probe.  “Link in the description below”.  Where is that video? Hidden in the Rigol one?

What am I missing? Thanks,
Rafa.

[RafaPolit]

I found it, sorry.  I was expecting a name with DP1000, not "turning it up to 11"

It's:

But it is not "linked in the description below'.

[SilverSolder]

Re. software for overlaying board pictures (reverse engineering),  any version of Photoshop will do that job very well...  as well as many other jobs!

[thm_w]

Re. software for overlaying board pictures (reverse engineering),  any version of Photoshop will do that job very well...  as well as many other jobs!

Sure, but his point was something very specific dedicated to the task:
- simple keyboard shortcut to switch between top and bottom layer
- ability to draw traces/notes on the top/bottom layer and have them only appear when that layer is active
- ability to tag components/designators and enter a value for them, then make this available via csv file.
- netlist creation (hard one)

[SilverSolder]

Re. software for overlaying board pictures (reverse engineering),  any version of Photoshop will do that job very well...  as well as many other jobs!

Sure, but his point was something very specific dedicated to the task:
- simple keyboard shortcut to switch between top and bottom layer
- ability to draw traces/notes on the top/bottom layer and have them only appear when that layer is active
- ability to tag components/designators and enter a value for them, then make this available via csv file.
- netlist creation (hard one)

OK.  Just keep in mind that it doesn't make sense to use dedicated software for something one can reasonably easily do with a general purpose tool, UNLESS the task is repeated so often that the time savings are worth it!

E.g. you could use Photoshop together with LTSpice to reverse engineer, if you need diagram/netlists/notes etc.  -  if you only do this occasionally, it works fine.

[Cerebus]

Re. software for overlaying board pictures (reverse engineering),  any version of Photoshop will do that job very well...  as well as many other jobs!

Sure, but his point was something very specific dedicated to the task:
- simple keyboard shortcut to switch between top and bottom layer
- ability to draw traces/notes on the top/bottom layer and have them only appear when that layer is active
- ability to tag components/designators and enter a value for them, then make this available via csv file.
- netlist creation (hard one)

OK.  Just keep in mind that it doesn't make sense to use dedicated software for something one can reasonably easily do with a general purpose tool, UNLESS the task is repeated so often that the time savings are worth it!

E.g. you could use Photoshop together with LTSpice to reverse engineer, if you need diagram/netlists/notes etc.  -  if you only do this occasionally, it works fine.

Photoshop - a snip at only £19.97 a month. That might be a bloody good reason not to use Photoshop.

[SilverSolder]

Re. software for overlaying board pictures (reverse engineering),  any version of Photoshop will do that job very well...  as well as many other jobs!

Sure, but his point was something very specific dedicated to the task:
- simple keyboard shortcut to switch between top and bottom layer
- ability to draw traces/notes on the top/bottom layer and have them only appear when that layer is active
- ability to tag components/designators and enter a value for them, then make this available via csv file.
- netlist creation (hard one)

OK.  Just keep in mind that it doesn't make sense to use dedicated software for something one can reasonably easily do with a general purpose tool, UNLESS the task is repeated so often that the time savings are worth it!

E.g. you could use Photoshop together with LTSpice to reverse engineer, if you need diagram/netlists/notes etc.  -  if you only do this occasionally, it works fine.

Photoshop - a snip at only £19.97 a month. That might be a bloody good reason not to use Photoshop.

Any old version of photoshop (pre-subscription) is a good tool to have in the box...  IF you have other things to use it for.

It is not exactly easy to learn to use, but it is very good...

There are open source alternatives, e.g. the Gimp

[Just_another_Dave]

Yesterday I had a bit of free time, so I build a prototype of the tool for switching between both photos mentioned in the video on reverse engineering the probe. It doesn’t support marking the components yet and the web version has a bug that impedes loading photos (Godot doesn’t provide access to the native file system and its filedialogue component does not work properly in html5 exports).

Although I’m planing releasing the source code when the application is completed, I’ve uploaded an early prototype to itchio just in case someone is interested in trying it: https://just-another-dave.itch.io/reverse-engineering-helper

Edit: corrected a typo

[Just_another_Dave]

Yesterday I had a bit of free time, so I build a prototype of the tool for switching between both photos mentioned in the video on reverse engineering the probe. It doesn’t support marking the components yet and the web version has a bug that impedes loading photos (Godot doesn’t provide access to the native file system and its filedialogue component does not work properly in html5 exports).

Although I’m planing releasing the source code when the application is completed, I’ve uploaded an early prototype to itchio just in case someone is interested in trying it: https://just-another-dave.itch.io/reverse-engineering-helper

Edit: corrected a typo

I’ve just seen that it has been mentioned in the eevblog Twitter account, so I wanted to thank you for giving it visibility. I’m currently working on solving the known bugs, as well as implementing a system to allow adding marks. Thankfully, one of the bugs has been solved in a great open source tool called pixelorama, so the web version will probably work in the near future

[David Hess]

H-bridge driver for a latched relay. One reason for having a latched relay is signal integrity. An energized coil leaks enough magnetic field that his has an impact on the signal.
An ac signal traveling through an magnetic field sees a complex impedance. This throws a spanner in the gain flatness if that relay is used to switch gain settings. The bandwidth will change with energized/non energized state. This behavior is frequency dependent too.
i found this out the hard way when making test equipment for ADSL. even though the signals there are only up to the 1.3 MHz range, traveling through an energized relay was enough to have a few kilobit impact on the line. So i switched to dual coil relays (set-rest type) and the problem went away.
when i left one of the coils energized you could clearly see the drop.

In the 1970s Tektronix was making their own relays, and selling them to others, for use up to at least 100 MHz in low and high impedance circuits which did not have that problem, but later they used latching relays if only for power conservation.  The distinguishing thing about their relays at the time was that the contacts were located at the bottom of the frame limiting wire length and capacitance, which apparently became a design feature in later "telecom" style relays.

Why are they using a relay in the first place? The gain switching happens at a low-impedance node behind the differential stage. An analog CMOS switch would be perfectly fine for the job at less power, size and less cost...

It is difficult to get sufficient frequency and phase flatness out of CMOS switches, which raises the question about how solid state channel switches were designed in the past without relays.  They used current switching instead of voltage switching which works fine with bipolar transistors or diodes.

[oliv3r]

I really like how Marco of https://diystuff.nl/tradfri/tradfri-zigbee-light-link-module/ reverse engineered the IKEA tradfri module (or rather I really like the end-result



I asked him once how he did it, but sadly it's mostly just manual work

Without fancy tools, what I do, I load up various photo's in separate layers (I use the GIMP) and then use the opacity slider in the layer toolbox, pretty much as to what Dave suggested. A snapshot of 50% looks like .

When adding the layers, getting orientation, rotation etc can all be adjusted (requires a beefy CPU too :p) so yes getting everything ideaal is best when taking the photo's, but you can fix quite a lot actually with the '3D transform' I think, as there are anchor points that can be used for alignment (vias for example).

Even adding an X-Ray layer can be useful but then you really need to do the outline thing first (hadn't done that bit yet ...) and again, doing fades on multiple layers in the gimp is easy enough to highlight the things you care about ...

Following that I trace out (either through some image tricks with outline selections n stuff or even manually) the traces in separate colors, to try to get the same result Marco has. Mine where never as pretty My feeble attempt in the attachment ...

Anyway, some food for thought ...

(sorry for the oversized pic there)

[Smokey]

...
edit: good write up here: https://circuitcellar.com/research-design-hub/high-voltage-differential-probe/
they used 1M 0.1%/10pF, and 1GHz opamps. The bandwidth goal was 25MHz but unsure of the end result.

Did anyone actually build this circuit?  I wonder how well it works as written.

[David Hess]

...
edit: good write up here: https://circuitcellar.com/research-design-hub/high-voltage-differential-probe/
they used 1M 0.1%/10pF, and 1GHz opamps. The bandwidth goal was 25MHz but unsure of the end result.

Did anyone actually build this circuit?  I wonder how well it works as written.

That topology will work at lower frequencies.  At higher frequencies common mode rejection of the operational amplifiers will limit performance.  Overload recovery will be horrible.  Unfortunately no measurements of the performance are shown.

I wonder why they did not use a simpler design; it would have been higher performance.