Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 212914 times)

0 Members and 1 Guest are viewing this topic.

Offline EEVblog

  • Administrator
  • *****
  • Posts: 32488
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #350 on: June 10, 2017, 01:22:57 pm »
At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA

Yes it could be a very configurable decode block(s), but I'm told the actual decoding is all done within the ASIC, no outside help. Stuff like the event table might be shunted off to the GUI processor though.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #351 on: June 10, 2017, 02:07:36 pm »
There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.

It's built into the ASIC:

Yes,but I can't imagine they'd have committed to an ASIC with no way to add new protocols. For example the latest 3000T firmware has added a manchester/biphase decode, seem unlikely that was just sitting in there all these years just waiting to be turned on.
At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA
Maybe it is more a SoC than 100% fixed logic ASIC and has some configurability like an FPGA
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #352 on: June 10, 2017, 09:07:51 pm »
Without flux, in a pinch, you can even try that with rosin-cored solder :) The flux is just to help the solder flow onto / wet the pads.

Where there's a will, there's a way...



Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package


You don't need solder paste for that ;)

Flux and tin the pads with a soldering iron (and optionally wick off the excess), do the same on the LMH6552, dab a bit more flux on the board, and hot-air it into place.
I tried with a flux pen (liquid that evaporates very quickly) and it didn't work well.  I did not have a lot of time to do it, so I can repeat today.  I ordered flux paste as I expect it to work better than the liquid flux pen for this type of application.

Thanks for the suggestion.
Well, I managed to solder the LMH6552.  The result is amusing me... CH1 is unmodified, CH2 has been matched to the DSOX including the LMH6552.  I put the same signal on both CH1 and CH2 and what I notice is that CH1 starts attenuating the signal starting around 25MHz, but around 100MHz it recovers the original level.  CH2 does not attenuate the signal all the way up to 100MHz.  Then after 100MHz, both CH1 (unmodded) and CH2 (modded) attenuates at the same level until 125MHz and up... the scope can measure frequency (COUNTER) up to 200MHz or more with signal considerably attenuated.

So I think the extra opamp on the EDUX front end is acting like an inverse bandpass filter (attenuates from around 25MHz to 100MHz), I don't know the reason.

But anyway, with CH2 matched to the DSOX, I cannot get near 220MHz as Dave in the original DSOX...
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3226
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #353 on: June 11, 2017, 10:56:36 pm »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #354 on: June 11, 2017, 11:16:28 pm »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3226
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #355 on: June 11, 2017, 11:48:52 pm »
Hopefully that is good enough to get accurate measurements, without good termination the levels can easily show double the true value.

So with the DSOX modified channel and using your hack to enable 200 MHz of bandwidth the bandwidth still remains around 100 MHz?
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #356 on: June 12, 2017, 01:14:33 am »
Hopefully that is good enough to get accurate measurements, without good termination the levels can easily show double the true value.

So with the DSOX modified channel and using your hack to enable 200 MHz of bandwidth the bandwidth still remains around 100 MHz?
Yes, still remains around 100MHz.  Better the modified channel than the original, but just by a little.  I am using scope mode 24 (DSOX1102G), I have not tried the other modes where Dave and Mike got 200MHz.  I was hopping the hacked software, that shows 200MHz in about screen, would enable it, but I think it is still controlled by the scope mode that can be changed using the 4 resistors.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #357 on: June 12, 2017, 01:32:14 am »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #358 on: June 12, 2017, 01:35:24 am »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?
Do you mean frequencies?
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3226
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #359 on: June 12, 2017, 01:35:59 am »
There might be a 100 MHz mode set by jumper that will allow the bandwidth to be upgraded to 200 MHz by the firmware. In the 2000/3000 the hardware bandwidth jumper has a higher priority then the software license.
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #360 on: June 12, 2017, 01:40:06 am »
There might be a 100 MHz mode set by jumper that will allow the bandwidth to be upgraded to 200 MHz by the firmware. In the 2000/3000 the hardware bandwidth jumper has a higher priority then the software license.
I think scope mode 24 is 70MHz HW setting.  Dave's scope has this mode by default + BW10 software enabled option.  I will try the other modes by switching the resistor values tomorrow.

Thanks
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3226
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #361 on: June 12, 2017, 01:54:08 am »
The default mode from Dave's scope is likely the best combo to try. If they planned for the future they could just sell a 200 MHz license.
VE7FM
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #362 on: June 12, 2017, 01:55:14 am »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?
Do you mean frequencies?

Where do you connect your scope probe ? I read a few pages back and could not see what test point in the circuit you are measuring.

EDIT: I assumed you are using an external oscilloscope , but perhaps your simply reading the voltage from the screen of this DUT scope ?
« Last Edit: June 12, 2017, 01:59:50 am by Bud »
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #363 on: June 12, 2017, 02:02:24 am »
You have to measure/compare these components, this is a low pass filter. Bets are the component values  are different in EDU model.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #364 on: June 12, 2017, 10:59:28 am »
Are you testing bandwidth with a good 50 ohm pass-through terminator?
I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?
Do you mean frequencies?

Where do you connect your scope probe ? I read a few pages back and could not see what test point in the circuit you are measuring.

EDIT: I assumed you are using an external oscilloscope , but perhaps your simply reading the voltage from the screen of this DUT scope ?
I only have 100MHz scopes, so I was using the measurement tool in the EDUX itself.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #365 on: June 12, 2017, 11:02:03 am »
You have to measure/compare these components, this is a low pass filter. Bets are the component values  are different in EDU model.
I don't have a DSOX to compare the values of these components.  What I can do is to bypass it... what can happen if high frequency noise is injected into the ADC?  I will remove them and measure the values.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #366 on: June 12, 2017, 12:40:16 pm »
Nothing is going to blow up. Perhaps you will see some waveform distortions , but the bandwidth will still be limited by the rest of the frontend circuit. Should give you a qualitative indication if this filter is what is choking your scope at 100MHz.
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #367 on: June 12, 2017, 12:48:19 pm »
I don't have a DSOX to compare the values of these components.
I'd think there should be plenty of people here that have one including the forum owner. Try asking. Worst case it can be modeled and new values found. Could be just the caps.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #368 on: June 12, 2017, 08:18:57 pm »
I tried scope mode 03 reported by Mike to get 200MHz with some triggering issues when serial decode is active.  I don't get 200MHz, I am stuck at the same level, so it is being filtered by HW in the frontend.

Does the schematics (picture 1) I draw make any sense?  I tested 150MHz and 200MHz signal on both channels (modded and unmodded) right outside the positive output of the differential opamp and measured with the micsig TO1104. 

Picture 2: 150MHz modded
Picture 3: 150MHz unmodded
Picture 4: 200MHz modded
Picture 5: 200MHz unmodded
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #369 on: June 12, 2017, 09:20:56 pm »
Does the schematics (picture 1) I draw make any sense?

Not quite, connection to the ADC is on the right side of the inductors.

EDIT: how much signal do you apply to the input ?
« Last Edit: June 12, 2017, 09:22:34 pm by Bud »
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #370 on: June 12, 2017, 10:04:52 pm »
Does the schematics (picture 1) I draw make any sense?

Not quite, connection to the ADC is on the right side of the inductors.

EDIT: how much signal do you apply to the input ?
I will check the schematics again.  I am applying 630mVpp.  The pictures are just to compare the modded vs unmodded channels, I don't have any scope that can do more than 100MHz, so the voltage I am measuring is not accurate.
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 20675
  • Country: nl
    • NCT Developments
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #371 on: June 12, 2017, 11:06:33 pm »
I'd measure the values in the front end and simulate using LTSpice. That should show where things go wrong. I gues a capacitor to ground has a different value.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #372 on: June 12, 2017, 11:40:00 pm »
I'd say go ahead with measuring the filter component values, i'd be surprised if it is of any higher bandwidth than 100Mhz.
Facebook-free life and Rigol-free shack.
 

Offline Keysight DanielBogdanoff

  • Frequent Contributor
  • **
  • Posts: 752
  • Country: us
  • ALL THE SCOPES!
    • Keysight Scopes YouTube channel
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #373 on: June 13, 2017, 06:54:18 pm »
At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA

Yes it could be a very configurable decode block(s), but I'm told the actual decoding is all done within the ASIC, no outside help. Stuff like the event table might be shunted off to the GUI processor though.

Yes, we have configurable decoder blocks built in and some standard set-logic decoders. The event table is an ASIC thing, too.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4671
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #374 on: June 14, 2017, 04:46:14 am »
I may have solved the EDUX ADC buffer amplifier topology riddle.

As we know, EDUX has an additional amplifier stage (Intersil EL5166) in front of the ADC differential buffer amplifier. Looking at the resistor values, voltage gain can be calculated for each scope model and each gain stage. The following simplified schematic shows the topology and gain figures for each scope model. It can be seen the overall gain for each scope model is the same, Av=8.46.



So why in EDUX model the second stage has gain of only 2 , whereas in DSOX it is 8.46 ? Well, I am glad you asked. Assuming the second gain stage IC in EDUX is LMH6550  (vs LMH6552 in DSOX 1000X), which is a 90MHz bandwidth amplifier, we check the datasheet (we are not rigol employees, so we always check datasheets) and find a gain/bandwidth chart that shows most of the bandwidth is utilized with Gain=2.



Now, in order to maintain the ADC input level, we need to boost the signal to the same level as in DSOX. Additional gain that is required for that is 8.46/2=4.23. So there has to be a pre-amp and that is what the EL5166 must be doing in EDUX. Looking at its voltage gain figure - you guessed it - it is 4.23.
So the combilned gain in the dual stage EDUX buffer amplifier is exactly the same as in DSOX single stage one. The DSOX just achieves it with a single LMH6552 wideband amplifier. In EDUX the lower bandwidth amplifier ICs are used to help limit the bandwidth. Looking at the EL5166 datasheet (we are not rigol employees, we always check datasheets) it can be seen the bandwidth pretty much mirrors LMH6552 bandwidth when the latter is set to gain=2. Both start rolling off after 50MHz.



So there you go. The buffer amplifier in EDUX is a limited bandwidth component and certainly has to be replaced with that of DSOX as user TK has done in order to extend the front end bandwidth in addition to straping and software options. Also, the bandpass filter at the output of the buffer amplifier must be measured and adjusted as required to support the extended front end bandwidth.

Weird - comparing Digikey pricing,  looks like they're spending more on the 50MHz front-end than the 200MHz one!

A quick pricing check at Digikey showed that price of EDUX's 2-stage EL5166+LMH6550 and DSOX single LMH6552 is pretty much the same. So no, does not seem they are spending more on the EDUX front-end.
« Last Edit: June 14, 2017, 04:49:40 am by Bud »
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: tom66, tautech, lukier, KE5FX, krasimir.k, TK, skander36


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf