Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 423004 times)

0 Members and 7 Guests are viewing this topic.

Online JPortici

  • Super Contributor
  • ***
  • Posts: 3452
  • Country: it
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #325 on: June 05, 2017, 09:23:31 am »
how about setting up a scripting languange? at the simplest, once you've set up logic levels you have state,timestep, time at each transition. User only writes the script
maybe slower than direct access but no need to give away secret sauce i think

Then to more complex stuff, like events (start/stop frame) and "higher level" decode: if i wanted to decode MIDI all i needed to do is to use UART decode but display the corresponding event in the table, along with the decoded byte
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #326 on: June 06, 2017, 03:56:41 pm »
As the software hack at least released the 200MHz option (no serial decode liberated yet), I am going to do the MOD on the front end.  Right now, I am only getting around 90MHz and it drops significantly at 100MHz and up.  Need to remove one IC, remove some SMD resistors and caps, swap some resistor values and replace the LMH6550 for LMH6552.

Just as an exercise, I might do all the mod except for replacing the differential amplifier and see if the chip specification really matters.

EDITED: when running with the hacked software, it looses all the installed options.  And if you try to install a new license, it fails complaining about the date being wrong.
« Last Edit: June 08, 2017, 02:40:02 am by TK »
 
The following users thanked this post: krasimir.k

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #327 on: June 06, 2017, 03:58:18 pm »
Thanks for posting the info, have you tried using a custom cab to dump the entire filesystem to a flash drive?
I tried the copy again, this time killing the scope application first... same result.  It does not allow copying the DLLs.  I was able to copy TXT files and some EXE as well.
 

Offline lukier

  • Supporter
  • ****
  • Posts: 634
  • Country: pl
    • Homepage
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #328 on: June 07, 2017, 12:25:03 pm »
I agree this would be super-useful. It's something I have (and will continue to) pitch, but it's a tricky thing to do without giving away our secret sauce.

You could expose some well defined .NET API (you are using .NET framework on the WinCE equipment, right?), so people can write dll plugins in, let's say C#. Some sandboxing would be needed to prevent people from bricking the scope with bad code.

I don't know how much sense it makes in Keysight's case, as a lot of hard work is done in the ASIC and I guess the scope design is oriented this way. If you need some inspiration check LeCroy's XDEV option that allows implementing custom measurements, waveform processing and even UI elements with various tools: http://cdn.teledynelecroy.com/files/pdf/xdev_datasheet.pdf
But yeah, in LeCroy's case the scope is designed with PC and CPU processing in mind, so such feature is almost for free.
 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #329 on: June 08, 2017, 02:46:23 am »
What would really steal sales from the DS1054Z in my opinion would be if Keysight decided to open up the API for writing third party decoder plugins. How easy or practical this would be given their software architecture, I have no idea.
I agree this would be super-useful. It's something I have (and will continue to) pitch, but it's a tricky thing to do without giving away our secret sauce.

But the decoders are built into the Megazoom IV ASIC. Does the scope do any sort of decoding in application software?
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #330 on: June 08, 2017, 01:48:20 pm »
There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrjiffy6

  • Contributor
  • Posts: 10
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #331 on: June 08, 2017, 04:55:30 pm »
You are right, Mike. According to Keysight's application engineers:

Quote
I agree the DSOX1000 has enough channels to capture the SPI Clock, MOSI, and MISO.  However the FPGA that performs the decode within the scope has only one decoder path.  A big benefit of using the FPGA to perform hardware-based decode is that it can decode in real time, capturing rare events as they happen.  With this hardware limitation it means that the number of decoded buses cannot be easily expanded in the scope.  The scope supports decode of only 1 bus at a time.  MOSI and MISO would have to be treated as two separate buses.

which I can totally understand. However, in that case, shouldn't UART's TX/ RX data line be affected as well? Well not really because obviously TX/RX can be decoded at the same time. And the answer to that is:

Quote
My description was an over simplification.  The oscilloscope can decode both directions of UART, both TX and RX, at the same time.  With the UART protocol there are no other signal qualifiers so it requires fewer resources.  Decode can be performed with only TX and RX signals.  The minimum for SPI is the Clock and either MOSI or MISO, with CS being optional.
  :blah:

which makes me doubt about the only one decoder path thing. I understand SPI involves additionnal signals but those does not need decoding, only triggering!
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #332 on: June 08, 2017, 07:45:57 pm »
It's probably about total FPGA resorces, assuming it isn't loading a protocol-specific bitstream. If it was, then I wouldn't expect there to be a limitation unless it's extremely full. SPI has stuff like an edge counter, which may account for it using more resources than uart.
ISTR the1000 uses a smaller FPGA than the 3000, not sure about the 2000
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrjiffy6

  • Contributor
  • Posts: 10
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #333 on: June 08, 2017, 08:39:55 pm »
Again, according to Keysight's application engineers

Quote
I hope you’ll consider the Keysight DSOX2004A 70MHz oscilloscope or DSOX2014A 100MHz oscilloscope.  These 4-channel oscilloscopes have twice the FPGA resources so they can decode the full 4-wire SPI, both the MISO and MOSI, at the same time.

So, it seems that the 4-wire SPI decoding is not even available on a two channel 2000x. I've seen the Dave's 2000x 4-channel teardown but not a 2-channel, so I cannot tell about that. :-//

Besides, it looks like the 2000x product webpage / datasheet is still very unclear about what is supported on what model, regarding the SPI decoding capacities of the scopes, as Mike already mentionned in one of his videos on the 1000x series (from post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg913919/#msg913919). As a plus, it seems that Daniel had followed that thread. Still, one year later, nothing changed?  :--

 

Online Fred27

  • Supporter
  • ****
  • Posts: 726
  • Country: gb
    • Fred's blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #334 on: June 09, 2017, 07:39:12 pm »
Well, at least keep this on topic rather than "my scope's better than yours".
 
The following users thanked this post: TK

Online Simon

  • Global Moderator
  • *****
  • Posts: 17728
  • Country: gb
  • Did that just blow up? No? might work after all !!
    • Simon's Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #335 on: June 09, 2017, 08:27:56 pm »
Thread being locked as this has become a slanging match between scope manufacturers!
 
The following users thanked this post: TK

Online Simon

  • Global Moderator
  • *****
  • Posts: 17728
  • Country: gb
  • Did that just blow up? No? might work after all !!
    • Simon's Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #336 on: June 09, 2017, 10:08:02 pm »
Thread unlocked after what I hope is a clean up. Please stop hitting each other over the head with your favourite scope brand or I'll just start banning, this thread is about the technical detail of one scope not how it compares to anything else.
 
The following users thanked this post: EEVblog, Brumby, TheSteve, Jono427

Online nctnico

  • Super Contributor
  • ***
  • Posts: 26751
  • Country: nl
    • NCT Developments
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #337 on: June 09, 2017, 11:16:51 pm »
It's probably about total FPGA resorces, assuming it isn't loading a protocol-specific bitstream. If it was, then I wouldn't expect there to be a limitation unless it's extremely full. SPI has stuff like an edge counter, which may account for it using more resources than uart.
ISTR the1000 uses a smaller FPGA than the 3000, not sure about the 2000
AFAIK Keysight does decoding in the megazoom Asic and the 2000 doesn't have enough of these to do both decoding and digital channels. I think it was Daniel from Keysight who has explained this.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #338 on: June 10, 2017, 02:38:06 am »
EDUX front end mod to DSOX partial results.

I did the following mod to see if I can get 200MHz modding the front end on the EDUX to mimic the DSOX front end.

I worked on CH2 and the result is partial because I was not able to replace the LMH6550 to LMH6552 because it requires a package change from VSSOP to WSON.  The PCB has the footprint for both package types.

First picture shows the table of Vpp, Vmax and VRMS measurements of the different stages of the mod compared to the micsig TO1104 (just as validation of values).
The EDUX with just the resistor swap to make it think it is a DSOX: you get 70MHz, as is indicated on the utility/service/about this scope screen.
The EDUX with the resistor swap + the software hack (infiniiVisionLauncher.exe from /Secure): you get 120MHz, but utility/service/about this scope screen shows 200MHz.
The EDUX with the resistor swap + the software hack + the partial front end mod: you get less than 50MHz, as the front end mod removes the additional OPAMP that was added to the EDUX in the front end, and as it does not have the LMH6552 yet, it cannot get to 200MHz.

Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package

Third picture is the original DSOX (From Dave's Teardown)
« Last Edit: June 10, 2017, 04:24:21 am by TK »
 
The following users thanked this post: thm_w, lukier, krasimir.k, tek2232, skander36

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #339 on: June 10, 2017, 03:03:02 am »
There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.

It's built into the ASIC:
 

Offline tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #340 on: June 10, 2017, 04:44:24 am »
There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.

It's built into the ASIC:
Excellent.
Just because I questioned a members view on this and he took exception we got this:
Thread being locked as this has become a slanging match between scope manufacturers!
:-//
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline Brumby

  • Supporter
  • ****
  • Posts: 12288
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #341 on: June 10, 2017, 04:53:09 am »
^^^ That post should have stopped at the word "Excellent" ^^^
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #342 on: June 10, 2017, 06:25:04 am »
EDUX front end mod to DSOX partial results.
<snip>

Looking forward to further results on this!
VE7FM
 

Offline ebclr

  • Super Contributor
  • ***
  • Posts: 2328
  • Country: 00
EDUX 1000X 1000X Hack Status
« Reply #343 on: June 10, 2017, 06:45:29 am »
With the actual hack/ mod knowledge, what can I expect from a Keysight Edux 1000X hacked/moded

How a 30 Mhz SPI signal with regular probes appear on the Edux screen

Here a reference for the same signal on Rigol 1054Z hacked with regular probes ( not spring ) based on ESP32 generating a counting SPI








 

Offline KhronX

  • Frequent Contributor
  • **
  • Posts: 341
  • Country: fi
    • Khron's Cave - Electronics Blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #344 on: June 10, 2017, 07:00:46 am »

Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package


You don't need solder paste for that ;)

Flux and tin the pads with a soldering iron (and optionally wick off the excess), do the same on the LMH6552, dab a bit more flux on the board, and hot-air it into place.
Khron's Cave - Electronics - Audio - Teardowns - Mods - Repairs - Projects - Music - Rants - Shenanigans
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 26751
  • Country: nl
    • NCT Developments
Re: EDUX 1000X 1000X Hack Status
« Reply #345 on: June 10, 2017, 11:43:55 am »
With the actual hack/ mod knowledge, what can I expect from a Keysight Edux 1000X hacked/moded

How a 30 Mhz SPI signal with regular probes appear on the Edux screen

Here a reference for the same signal on Rigol 1054Z hacked with regular probes ( not spring ) based on ESP32 generating a counting SPI
There isn't anything special about that picture and I'm very sure the 100MHz version of the 1000X will show exactly the same. BTW I could post a picture from a 125MHz SPI bus with decoding from another Asian scope but this isn't the right thread to do that.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EDUX 1000X 1000X Hack Status
« Reply #346 on: June 10, 2017, 12:52:42 pm »
With the actual hack/ mod knowledge, what can I expect from a Keysight Edux 1000X hacked/moded

How a 30 Mhz SPI signal with regular probes appear on the Edux screen

Here a reference for the same signal on Rigol 1054Z hacked with regular probes ( not spring ) based on ESP32 generating a counting SPI


I am getting the ESP32 board to replicate your experiment on various scopes I have, including the EDUX1002G modded to DSOX + software hack to 200MHz and front end mod to match the actual DSOX.  I will post the results next week.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #347 on: June 10, 2017, 12:55:07 pm »

Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package


You don't need solder paste for that ;)

Flux and tin the pads with a soldering iron (and optionally wick off the excess), do the same on the LMH6552, dab a bit more flux on the board, and hot-air it into place.
I tried with a flux pen (liquid that evaporates very quickly) and it didn't work well.  I did not have a lot of time to do it, so I can repeat today.  I ordered flux paste as I expect it to work better than the liquid flux pen for this type of application.

Thanks for the suggestion.
 

Offline KhronX

  • Frequent Contributor
  • **
  • Posts: 341
  • Country: fi
    • Khron's Cave - Electronics Blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #348 on: June 10, 2017, 01:00:01 pm »
Without flux, in a pinch, you can even try that with rosin-cored solder :) The flux is just to help the solder flow onto / wet the pads.

Where there's a will, there's a way...



Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package


You don't need solder paste for that ;)

Flux and tin the pads with a soldering iron (and optionally wick off the excess), do the same on the LMH6552, dab a bit more flux on the board, and hot-air it into place.
I tried with a flux pen (liquid that evaporates very quickly) and it didn't work well.  I did not have a lot of time to do it, so I can repeat today.  I ordered flux paste as I expect it to work better than the liquid flux pen for this type of application.

Thanks for the suggestion.
Khron's Cave - Electronics - Audio - Teardowns - Mods - Repairs - Projects - Music - Rants - Shenanigans
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #349 on: June 10, 2017, 01:08:19 pm »
There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.

It's built into the ASIC:

Yes,but I can't imagine they'd have committed to an ASIC with no way to add new protocols. For example the latest 3000T firmware has added a manchester/biphase decode, seem unlikely that was just sitting in there all these years just waiting to be turned on.
At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf