Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 212265 times)

0 Members and 1 Guest are viewing this topic.

Offline thuttu77

  • Contributor
  • Posts: 8
  • Country: fi
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #425 on: October 19, 2017, 12:54:12 pm »
I bought EDUX1002A and I have few questions about mods if I do understand right
I need to change model from EDUX to DSOX to get some extra features I think I will ok with 70Mz or 100MHz so proppably SW mod wont needed
just front end mod and EXT trig mod but does Trial Lics or bought lics for DSOX1AUTO work with that then? ar can they even bought.

Nice I need to figure out what resistor(s) I need to change to get it to DSOX mode (I assume that its config 23)
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #426 on: October 19, 2017, 02:17:26 pm »
In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005
My scope has PCB REV A004

Which one multiplexer amplifier do you have in scope? I'm not sure. Maybe edux have OPA4872 and dsox have LMH6574.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #427 on: October 19, 2017, 05:09:07 pm »
In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005
My scope has PCB REV A004

Which one multiplexer amplifier do you have in scope? I'm not sure. Maybe edux have OPA4872 and dsox have LMH6574.
My EDUX have OPA4872 multiplexer amplifiers.  Dave's teardown pictures of the DSOX shows LMH6574.  Cost is similar. 

OPA4872 has 0.1 dB Gain Flatness to 120MHz
LMH6574 has 0.1 dB Gain Flatness to 150MHz

I did not notice this difference before... time to go back and check all the components.
« Last Edit: October 19, 2017, 05:27:06 pm by TK »
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #428 on: October 19, 2017, 05:30:06 pm »
On BLT (ADC) board was also changes between rev 002 and 003. D9LHT is replaced by D9RZH in rev 003. All 0201 resistors dividers around memory are connected with memory pins. Maybe some bias on digital lines.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #429 on: October 19, 2017, 09:53:26 pm »
Here it is. Value is 10k 1% Do you know what is part name of BNC connector? I searched in Digikey, Mouser, Farnell and I didn't found it. It have smaller footprint than standard connectors. I want to add generator to my scope. Also capacitors and inductors (from long RL filter) values will be helpful.
OK, I soldered this missing 10K resistor and external digital input seems to work more reliably and self test passes.  User calibration still fails, but it can be calibrated going back to EDUX mode, then back to DSOX for normal use.

I took the scope apart one more time to solder the 10K resistor... I am amazed at the construction quality of this instrument.  It is very resilient and a pleasure to tear down and reassemble.
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #430 on: October 20, 2017, 08:18:24 am »
I found another missing resistor in EDUX. Marking 13A - 133Ohm. Here it is. Photo again comes from Dave's teardown.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #431 on: October 20, 2017, 10:46:48 am »
My EDUX has the 133Ohm resistor.  Maybe it is not needed.
« Last Edit: October 20, 2017, 10:48:53 am by TK »
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #432 on: October 20, 2017, 03:13:17 pm »
My EDUX has the 133Ohm resistor.  Maybe it is not needed.
That is interesting. Do you have version with generator?
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #433 on: October 20, 2017, 09:37:04 pm »
Yes, I have the EDUX with wavegen (EDUX1002G)
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #434 on: November 01, 2017, 08:16:17 pm »
I starts reverse engineering of my scope. I found another difference between my scope and Dave's photos. It is U29 In DSOX it is R4PC in sot23-5. In EDUX it is R30E in sot23-3. It is very hard to see this difference  ;) This part is in self cal area (located between generator stuff and ch1 analog front end).
« Last Edit: November 01, 2017, 09:00:33 pm by hv222 »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #435 on: November 01, 2017, 08:51:04 pm »
I starts reverse engineering of my scope. I found another difference between my scope and Dave's photos. It is U29 In DSOX it is R4PC in sot23-6. In EDUX it is R30E in sot23-3. It is very hard to see this difference  ;) This part is in self cal area (located between generator stuff and ch1 analog front end).
Nice catch, I hope it is the reason why self calibration fails on the EDUX when converted to DSOX.

R30E is a CMOS Voltage Reference in SOT-23-3 package.  It is specifically REF3040AIDBZR: 4.096V reference.  Still looking for R4PC, it should be a voltage reference as well.

EDIT: I think it is R4FC, TI LM4132CMFX-4.1.  Also 4.096V voltage reference in SOT-23-5 package... similar to REF3040AIDBZR but it has enable pin
« Last Edit: November 01, 2017, 09:21:24 pm by TK »
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #436 on: November 01, 2017, 09:15:41 pm »
Sorry. I look closer to photos and it looks like R4FC not R4PC. R4FC is LM4132CMF-4.1/NOPB http://www.ti.com/lit/ds/symlink/lm4132.pdf Pin out is matching. But it also is 4.096V ref and enable pin is shorted with vin, so it is no difference in use between these two components :(
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #437 on: November 09, 2017, 02:30:32 pm »
I have almost complete schematic of main PCB. I don't found more hardware differences. I add missing trigger and generator components and it is work. I change resistor divider on main board to have ID 24. I don't change resistor dividers on BLT board, so I have DSOX1002G with 70MHz bandwith. Scope passing user calibration.

Code: [Select]
**** External Trigger Level ****
/1 Trig B1 = 5303.000, B0 = 35789.000
/5 Trig B1 = 1071.000, B0 = 35789.000
/1 Trig 2 B1 = 17283.000, B0 = 28593.000
/5 Trig 2 B1 = 3492.000, B0 = 28593.000
**** CAL PASSED **** Time: 2 seconds


I'm going to make some test with wave gen, because I don't know the right values of capacitors and inductors.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #438 on: November 09, 2017, 02:56:28 pm »
I need to check the ext trigger input on my hack... as yours passes the user calibration.  How did you find out the capacitor values (100nF, 33nF)?
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #439 on: November 09, 2017, 03:20:30 pm »
Pin 5 of LMV7219 is positive supply voltage and have decoupling capacitor do ground. Typical decoupling capacitor value is 100nF. Pin 4 of LMV7219 is inverting input and these components looks like RC filter. One of these capacitor have same color like capacitor near pin 5. So it's probably 100nF and reasonable value for second one is something smaller then 100n, so i chose 33n. On other PCB side is also 10kohm resistor connected with these components (missing in EDUX version). I guess it is RC filter array making DC from PWM.
 
The following users thanked this post: TK

Offline thuttu77

  • Contributor
  • Posts: 8
  • Country: fi
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #440 on: November 09, 2017, 05:30:10 pm »
Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V
« Last Edit: November 09, 2017, 07:54:39 pm by thuttu77 »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #441 on: November 09, 2017, 08:55:03 pm »
Before removing everything to get to the back of my PCB... Is the 10K resistor on the back of the PCB the same that you identified in a previous post?  I checked the values on my hack, changed the capacitor from 100nF to 10nF (I don't have 33nF on hand) and still does not pass the user calibration. 
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #442 on: November 09, 2017, 11:10:46 pm »
Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V

Try use values from post below. It is about 2000x and 3000x series, but should work. Other resistor values are in Dave videos about 1000x scope.

Here is 3000 series board strapping info. 2000 series and 4000 series are pretty much the same. Pin strapping is done with 8 pairs of resistors. Each pair encode an integer value in 0 to 8 range.
Attached photos were annotated with strap resistor positions. Ln stands for Low (GND) side resistor and Hn is High (2V5) side resistor.
Based on analysis of Dave's teardown photos and my own board I've filled full resistor encoding table and believe it to be correct.
Note the L7 resistor is missing. I think it's routed to external module connector and it's encoding is fixed with 10k ohm high side on the main board.

You can't upgrade your scope just by altering these settings! Strapping represents the real difference in hardware!

Code: [Select]
Strapping resistor encoding
Value - Voltage - Lr/Hr
0 - 0.00V - 10k / none
1 - 0.23V - 10k / 100k
2 - 0.69V - 46,4k / 121k
3 - 0.98V - 64,9k / 100k
4 - 1.25V - 100k / 100k
5 - 1.52V - 100k / 64,9k
6 - 1.81V - 121k / 46,4k
7 - 2.27V - 10k / 100k
8 - 2.50V - none / 10k

Incomplete table of strap functions:
Code: [Select]
Strap 0 (CH 0) Channels:
  0 - 2 Channels
  1 - 4 Channels
Strap 1 (CH 1) Bandwidth
  0 - 100MHz
  1 - 200MHz
  2 - 500MHz
  3 - 1GHz
  4 - 1.5GHz (4000 series only)
Strap 2 (CH 2) Sample Rate:
  0 - 5GSa
  1 - 4GSa
Strap 3 (CH 3) Gating ?
Strap 4 (CH 4) Board Revision ?
Strap 5 (CH 5) Family:
  1 - 3000 series
  2 - 4000 series
  3 - 2000 series
Strap 6 (CH 7) MSO revision ? - not for 4000 series
Strap 7 (CH 6) External module - not for 4000 series:
  0 - LAN
  1 - GPIB
  8 - No External Module

On external module 0 Ohm to GND should set LAN module (pin short on the DIY LAN may be for this strap) and 1k should be for GPIB module.

For experiments you only want to alter Strap 1 and Strap 2 to update the Sample Rate and Bandwidth.
Have fun!


Yes It is these same resistor from my previous post. I start user calibration after hardware RTC reset - on default clock settings. Maybe here is goal. I start reverse engineering of BLT PCB. I found some pins for Ethernet and next USB Host on unmounted connector. Maybe it is possible to add Ethernet module with PHY and play with licenses hacking :)
« Last Edit: November 09, 2017, 11:14:38 pm by hv222 »
 
The following users thanked this post: thuttu77

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #443 on: November 09, 2017, 11:32:24 pm »
Yes It is these same resistor from my previous post. I start user calibration after hardware RTC reset - on default clock settings. Maybe here is goal. I start reverse engineering of BLT PCB. I found some pins for Ethernet and next USB Host on unmounted connector. Maybe it is possible to add Ethernet module with PHY and play with licenses hacking :)
Do you think the RTC reset is important?  Can you please test user calibration without the hardware RTC reset?  If I change the scope hack back to EDUX, user calibration passes, without any RTC reset.
 

Offline thuttu77

  • Contributor
  • Posts: 8
  • Country: fi
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #444 on: November 10, 2017, 11:16:07 am »
Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V


Thanks a lot I ll try those also it does put me think if I did actually change wrong resistor set since I didnt find pic what would say which one is ID0 and which one is ID1 but when I did look those values
maybe my 12k vas actually 121k so i did change wrong id bit.
« Last Edit: November 10, 2017, 11:18:39 am by thuttu77 »
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #445 on: November 10, 2017, 12:18:01 pm »
It pass user calibration even with normal RTC time. I don't have more ideas. Maybe one of yours components is broken. I used https://pl.mouser.com/Search/ProductDetail.aspx?R=LMV7219M5%2fNOPBvirtualkey59500000virtualkey926-LMV7219M5%2fNOPB and 1% resistors also from Mouser. I my hacking I use 5V coil relay instead of 4.5V (was out of stock, but it is powered from 595 shift register, so it isn't big difference) and I use ferrit bead (600ohm at 100MHz) instead of 10ohm (01x) resistor on power supply line of comparator) all other components are same like in Dave photos.
 
The following users thanked this post: TK

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #446 on: November 10, 2017, 02:17:41 pm »
My unit used to pass user calibration if set back to EDUX mode, but now it does not.  I guess is the front end modification I made and not the external trigger input circuit.
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #447 on: November 10, 2017, 03:08:15 pm »
I don't think so. It looks like user calibration stops at first detected error. I also replaced components on frontends. I don't change  U40, U35 and U401. Below is photo of my hack. Resistors without making code are 16.2ohm.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #448 on: November 10, 2017, 03:20:30 pm »
You are missing a resistor marked 17B near U39.  Did you miss it on purpose?
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 66
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #449 on: November 10, 2017, 05:04:19 pm »
You are right. Thanks. I miss these resistors. I add it and it pass calibration again.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf