EEVblog #978 - Keysight 1000X Hacking

[Brumby]

But, you theoretically could get a "souped-up" WaveGen that has questionable specs.

This is an example of why I get a little hesitant about any field hacks.

I know the effort here is to try them out and characterize the result, but I always get a niggle in the back of my head that something unexpected will surface at a most inopportune time - and that it might not be obvious if it does.

Kudos to those making the effort, though.  It is really interesting and very educational about contemporary circuit design of such equipment.

[markus-k]

Maybe not directly related to the topic of this thread, but at least scope hacking related: Has anyone ever tried or investigated what it takes to get Linux working on this or any other Keysight scope? I couldn't find anything yet. The ARM chip should run linux no problem, of course there aren't any drivers for the ASIC etc. The usefulness could be questioned for sure, but at least it could be a fun project for us Linux fanboys.

[TK]

Hardware mod for CH2 is done.  200MHz using the software hack infiniivisionLauncher.exe from Secure.  It can get comfortably up to 200MHz and 215MHz is kind of the absolute max regarding frequency measurement.

I got an MSOX2004A the other day and I compared the modded EDUX to the MSOX2004A (software hacked to 200MHz).  The MSOX2004A can get up to around 350MHz.

What is is most important is the -3 dB point or the scopes rise time. The MSOX2004A should have a -3 dB point around 230 MHz.
Can you measure that on both? Feed in 1 Vpp with a 50 ohm termination and increase the frequency until you you get to .707 Vpp. The amplitude should also remain quite flat as the frequency is increased with no sudden peaks or drops.

edit - I should add that I believe it may be possible to get the MSOX2004A up to 500 MHz bw with some part swaps, this isn't confirmed though.

The EDUX with the DSOX1102G mods + software hack has the -3 dB point @ 220MHz.  It is not flat, after 100MHz amplitude increases slightly and the goes down slowly up to -3dB point

[Free_WiFi]

Im too much lazy to follow the entire post about this ,however my question is :
If i will hack my own x1000 scope ,then after this operation, the calibration would be alive in my scope or i will be obligated to re-calibrate it again ?

[TK]

Im too much lazy to follow the entire post about this ,however my question is :
If i will hack my own x1000 scope ,then after this operation, the calibration would be alive in my scope or i will be obligated to re-calibrate it again ?

Factory or last user calibration will be OK.  But if for any of the reasons recommended by Keysight you need to perform self test or user calibration, you need to set the scope to EDUX mode (revert the 2 SMD resistors back to original values as shipped from Factory), then calibrate and reinstall the DSOX hack

[hv222]

Hi,
Is any difference in ADC's used in 1000 X series? In datasheet EDUX have 1GSPS and DSOX have 2Gsps. I don't found any information about used ADC IC.

[TK]

EDUX and DSOX use the same ADC.  The EDUX hacked to DOSX can do 2GSa/s.  The front end is slightly different (70MHz limitation on the EDUX, +200MHz on the DSOX)

[hv222]

What is the name of the 8 pin square chip in center right? Can be a band limiting amplifier.

The 8 pin square chip is HMC626ALP5E 0.5 dB LSB GaAs MMIC 6-BIT DIGITAL VARIABLE GAIN AMPLIFIER, DC - 1 GHz (same chip on both EDUX and DSOX)

Don't think so - HMC626 is a 32 pin QFN

You are right... I took it from Dave's teardown video: @ 22:59
The marking on the package is HVB #626

HVB is AD8337 and is variable gain amplifier. Probably this part limit bandwidth. I have idea (maybe crazy) to design 500MHz analog front-end for this scope. With 2GSPS it can be possible, but minimal time base 5ns can be a problem. What about memory depth after hacking - is 1 Mpts available?

[TK]

After EDUX to DSOX resistor hacking you get 1Mpts memory depth.  If you add the software hack, you get 200MHz (2ns time base) but gets limited by the EDUX front end, unless you make the changes to match the DSOX front end.

[Sany1984]

Hello,

now i use the Cab Hack for my DSOX1102A, for extend the Bandwidth with -l BW10, thats works....

now, i want to use EMBD, AUTO and other, but this doesn't work, when i launch the install, the DSO reboots, and the Licenses are by default....
Can any one help me?

[TK]

AFAIK there is no hack to enable any option on the 1000X series.  Just by running the hacked launcher without any options will enable 200MHz but nothing else.

[Sany1984]

Hum okay....

Now i tested any options on my DSO, and i take a userroots.p7b Certificateroot, the Certificates in this Certificate Roots, are all expired, i wonder..... o.O
Copy the infiniiCore.dll is not possible... i try any bugs on CE 6.0, to get root righs on the file system...

[hv222]

Will someone share me a schematic (can be without capacitors and inductors values) of analog frontend and trigger circuit in this scope. I want buy one, but delivery time is 6 weeks.   Maybe someone can make x-ray photos of inner layers?

[TK]

Part of the front end was discussed here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1233118/#msg1233118.

[Sany1984]

Hello,

Now i am Trying to read the NAND Flash from my oszi, with wich, Clocks / MHZ Runs the SPEAR600?
From the Data pdf, goes this CPU up to 333 MHZ, now i need the JTAG Clock divider for the JTAG, now i found no Datasheet for the Micron NAND and DRAM?

Thanks guys

[Sany1984]

Extracted from the Scope's NAND via JTAG:

https://www.dropbox.com/s/ehzetadm7xibs13/1000XSeries.01.01.2016092801.ksx?dl=0

[hv222]

D9LHT is MT47H64M16HR-25E:H - datasheet at https://www.micron.com/parts/dram/ddr2-sdram/mt47h64m16hr-25e - SDRAM 1GB
NQ432 is MT29F1G08ABADAH4-ITX:D    - datasheet at https://www.micron.com/parts/nand-flash/mass-storage/mt29f1g08abadah4-itx - NAND 1GB
D9SBJ is MT47H32M16NF-25E:H - datasheet at https://www.micron.com/parts/dram/ddr2-sdram/mt47h32m16nf-25e SDRAM 512MB

I seen this post with schematics with part of analog frontend. I'm looking for full schematic. It is not possible to make it only from teardown pictures

Thanks for NAND copy. It looks like main processor is programmer for FPGA. Maybe is it possible to make reverse engineering of FGPA internal configuration. I try to check it out.

[djcrunkmix]

Hey guys, I just got a DSOX1102G. Went through the entire thread and Dave's hacking video.

Anyone figured out the combinations that enable serial comm (DSOX1EMBD) and automotive packages (DSOX1AUTO) using the BLT_MODULE_CONFIG_0/1?

Also, from Dave's video, it seems that there are 2 pairs of resistors providing 2 voltage values to the BLT_PRODUCT_CONFIGs. Where are the resistors for BLT_MODULE_CONFIG?

[TK]

If you watch the video again, I think Dave tries first hacking the module and there are additional resistors on the CPU module... or maybe it was in a previous video, I don't remember now.

I think there are no MODULE configuration options to enable serial decode, unless you hack the software.

You can request the serial decode trial to Keysight and change the date on the scope after 1 month to reactivate it, as discussed on this thread: https://www.eevblog.com/forum/testgear/problems-registering-promotional-dsox1102g/msg1257164/#msg1257164

[thuttu77]

I bought EDUX1002A and I have few questions about mods if I do understand right
I need to change model from EDUX to DSOX to get some extra features I think I will ok with 70Mz or 100MHz so proppably SW mod wont needed
just front end mod and EXT trig mod but does Trial Lics or bought lics for DSOX1AUTO work with that then? ar can they even bought.

[hv222]

maybe trig 2 is with other range?

According the datasheet, EDUX model has only +/- 8V range, DSOX has additionally +/- 1.6V.
This is ratio 5.
"/1" or "/5" probably means 1.6V and 8V range respectively (More logical to be opposite, but log data shows only /5 for EDUX, which have 8V range only).
In the DSOX log, there are two lines for Trig2 which contain both ranges (/1 and /5), so Trig2 is not related to the second range.

B1 and B0 are gain/offset coefficients (but I have no idea, which one is the gain or the offset).

I spotted one additional hardware difference between EDUX and DSOX regarding the External Input.

There are 2 resistors to the right of the LEFT CPU board socket.  The DSOX has only the lower resistor populated with value 30.1 ohms (marking 47X) and the EDUX has only the upper resistor populated with a 0 ohm jumper (marking 000).  When I switched the resistors to the correct DSOX configuration, I was able to get a very consistent digital trace for the External Input.  The resistor seems to be related to the EXT_VIEW signal that comes from the Analog comparator on the EXT INPUT section.  Before switching this resistor, the trace was fluctuating rapidly between logic 0 and 1 unless triggering from External Input.  Now I see a nice digital trace when triggering on CH1 or CH2 and I can even use EXT INPUT to create an Analog Bus and get bus values in HEX (only 1-3 bit bus).

But still User Calibration FAILS...

Did you add 10kOhm resistor on the bottom side of PCB?  It is connecting external trigger components (not mounted in edu version and ADC board). Photo comes from Dave teardown.

 In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005

[TK]

maybe trig 2 is with other range?

According the datasheet, EDUX model has only +/- 8V range, DSOX has additionally +/- 1.6V.
This is ratio 5.
"/1" or "/5" probably means 1.6V and 8V range respectively (More logical to be opposite, but log data shows only /5 for EDUX, which have 8V range only).
In the DSOX log, there are two lines for Trig2 which contain both ranges (/1 and /5), so Trig2 is not related to the second range.

B1 and B0 are gain/offset coefficients (but I have no idea, which one is the gain or the offset).

I spotted one additional hardware difference between EDUX and DSOX regarding the External Input.

There are 2 resistors to the right of the LEFT CPU board socket.  The DSOX has only the lower resistor populated with value 30.1 ohms (marking 47X) and the EDUX has only the upper resistor populated with a 0 ohm jumper (marking 000).  When I switched the resistors to the correct DSOX configuration, I was able to get a very consistent digital trace for the External Input.  The resistor seems to be related to the EXT_VIEW signal that comes from the Analog comparator on the EXT INPUT section.  Before switching this resistor, the trace was fluctuating rapidly between logic 0 and 1 unless triggering from External Input.  Now I see a nice digital trace when triggering on CH1 or CH2 and I can even use EXT INPUT to create an Analog Bus and get bus values in HEX (only 1-3 bit bus).

But still User Calibration FAILS...

Did you add 10kOhm resistor on the bottom side of PCB?  It is connecting external trigger components (not mounted in edu version and ADC board). Photo comes from Dave teardown.

 In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005

Can you post a picture of the PCB where you added the 10K resistor?

[TK]

I bought EDUX1002A and I have few questions about mods if I do understand right
I need to change model from EDUX to DSOX to get some extra features I think I will ok with 70Mz or 100MHz so proppably SW mod wont needed
just front end mod and EXT trig mod but does Trial Lics or bought lics for DSOX1AUTO work with that then? ar can they even bought.

All trial license will work if you just change the resistors to make it DSOX.  It stops working when you make the SW mod.

[hv222]

Here it is. Value is 10k 1% Do you know what is part name of BNC connector? I searched in Digikey, Mouser, Farnell and I didn't found it. It have smaller footprint than standard connectors. I want to add generator to my scope. Also capacitors and inductors (from long RL filter) values will be helpful.

[TK]

In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005

My scope has PCB REV A004