EEVblog #978 - Keysight 1000X Hacking

[mikeselectricstuff]

Mine is 1102g with 100Mhz and all options

[JPortici]

Wasn't aware of that - seems some Chinese manufacturers are paying more attention to software - about time!

I'm old enough [sigh] to remember how the first Japanese cars were laughed at when they arrived in North America in the 60's.   Nobody's laughing now...   but many more of us are driving nice cars!    That seems a lot like what is happening in the scope market now.

i know a guy who have to deal with chinese made cars, he doesn't want to laugh, at all. quite the opposite
(note the difference)

[frogmaster]

OK folks bad news.
I've run through all the codes on the two links Dave played with.
12-18,28-88 and 04 give clock errors.
Some codes show offsets on the Y traces, and also time offsets between trigger event and trigger point on screen.

03 is the only code that gives 200MHz and apparently plausible operation, but it does have problems.

In no way are we leaking info for or sponsoring a Keysight hackathon scenario.

But 

Hmm, what does Daniel know? He seemed so impressed Dave hacked it to 200MHz that quickly. 

[MarkL]

Also, keep in mind that the few bugs (including the clock jitter) in the Rigol DS scopes were not discovered until long after they had been introduced and used quite happily by many customers. Who knows what bugs are waiting to be discovered in the new Keysight scopes?. 

Except that most of the software and hardware has been proven over many years (SPI decode issue notwithstanding!) in the 2/3000, and you can expect updates from Keysight, whereas updates from Chinese manufacturers have been slow or nonexistent.

Granted that the Agilent 2000/3000 don't have many bugs, but Keysight is no angel either when it comes to updates.  For example, they haven't put out an update for X2000A/X3000A scopes for 1.5 years (latest = 2.41, 2015-11-02).  I don't think that should be interpreted as the firmware reaching perfection.

I'd like to be proven wrong, but it seems once they've turned their attention to the latest and greatest, it's a slim chance any new features or bug fixes will trickle down to the older models (even though they're still being sold).

[mrpackethead]

1 GHz is significantly higher than 100 MHz. In general, you can get to a 200 MHz with fairly standard off-the-shelf components. But, pushing beyond that starts to require more custom work.

Somewhere on this thread people are doing hardware hacks to change their 3000 X-Series scopes, but it looks pretty hands-on and is definitely not recommended.

I'll also reiterate again that neither I, nor anyone else in Keysight, gave info to Dave about board IDs, hacking, etc.

Also, LP stands for "Lab Prototype" 

Hi Daniel,   seems that R&S really wanted to upstage to.   I was about to buy a 3000X because i wanted a bit more bandwidth than these 1000'x offfered..   Their new scope they are offering for $2000 or so changed the landscape a bit..  What do you have that matches those features at that price point.

[brumster]

I've got a brand new EDUX1002G here - when I have the courage to void the warranty, I'll open it up and see what we have in comparison to the other models. If I've read this thread right, no-one has categorically proven that the base model can be hacked up to 70/100/200MHz, or the serial functions can be hack-enabled, right?

[ebastler]

If I've read this thread right, no-one has categorically proven that the base model can be hacked up to 70/100/200MHz, or the serial functions can be hack-enabled, right?

I would go further than that. If I have read the thread right (especially Mike's posts, describing his systematic analysis of the various resistor settings using his neat BCD encoder), nobody has shown that any of the models can be hacked to higher bandwidth without unwanted side effects. Right?

[mikeselectricstuff]

If I've read this thread right, no-one has categorically proven that the base model can be hacked up to 70/100/200MHz, or the serial functions can be hack-enabled, right?

I would go further than that. If I have read the thread right (especially Mike's posts, describing his systematic analysis of the various resistor settings using his neat BCD encoder), nobody has shown that any of the models can be hacked to higher bandwidth without unwanted side effects. Right?

Correct, but there is a lot of ID space still to explore.
Despite the issues, info from an EDU would be very useful, in particular the boot text to see the ID settings, and trying ID03 to see what effect licensing differences have on behaviour.

[brumster]

Yeah, I'm not particularly greedy to be honest, an upgrade to 70MHz is still a nice freebie - but the serial decode functions are more likely to be of use to me than bandwidth and samples. I need to have a root around for something to do the serial I/O, I think I have an old Atmel dev board I could use with a quick bit of coding... leave it with me but don't expect "fast response" here

EDIT: Ahhh, who am I kidding, I can't wait to rip it apaaaaart (in best Dave voice!). Here's some high res pics but, from what I can make out with my admittedly-somewhat-crippled eyes, this looks absolutely identical to the innards of Dave's top of the line scope (EDIT: It's not; there are differences at the top area of the front ends, just where it is exposed above the shielding, and on the external trigger ). For clarity, it's an EDUX1002G. Apologies for the size, I figured you guys would want to see the detail - and I can't see a "spoiler" tag/feature to wrap it with...

[nfmax]

Interesting that it looks as if the input stage shields were intended at one stage to cover the differential driver stage (if that's what it is) as well. More value engineering?

[mikeselectricstuff]

Interesting that it looks as if the input stage shields were intended at one stage to cover the differential driver stage (if that's what it is) as well. More value engineering?

Probably just a precaution - easier to design in and not fit than vice versa

I wouldn't expect any HW difference between DSOX and EDUX as all differences are in options.
Probably not even any difference in option links, but worth looking to check though - a few are under the sub-PCB

[brumster]

Aye, just for completeness, the underside of the processor board looks no different - obviously I expect/hope the resistor values are different, but probing will have to wait to another time... day job and all that

[mikeselectricstuff]

Aye, just for completeness, the underside of the processor board looks no different - obviously I expect/hope the resistor values are different, but probing will have to wait to another time... day job and all that

I meant on the main PCB, under the sub-board

[brumster]

Sorry, apologies! Leave it with me

EDIT: Ok, yep, they're on there in same positions.... link and link.

Different values to the ones in Dave's video, obviously. The top 2 are 12k, the bottom two are 4.64K on mine, whereas the 100MHz factory one in Dave's video had 10K/12K on top row, and 10K/4.64K on bottom, I think. I'm not up on SMD resistor codes so I used an online calculator

EDIT2: Just working those out, it all rings true, if you work out those voltage dividers then that gives a product config setting of 22 on the EDU model, as opposed to 24 on the reviewed model. The left-hand pair of resistors are config 0 divider, the right hand ones are config 1.

[TK]

I wouldn't expect any HW difference between DSOX and EDUX as all differences are in options.

I noticed some differences in some components between the EDU and DSO models.  EDU has missing components on the EXT TRIG input section (missing RELAY, Analog comparator with resistors and caps) and EDU has additional components on both input sections compared to the DSO model.

Changing the ID from 22 (default ID for EDUX1002G) to 24 (default ID for DSOX1102G) activates Segmented Memory, Additional Trigger modes, BW to 70MHz, 2GSa/s and most of the features available with DSOX1102G, but fails self test (Comparator & Mux error) and does not pass User Calibration (probably due to missing components on EXT TRIG input section).

[KhronX]

Upon looking to see the component differences on the ext trig, i also noticed the extra components on the two channels. Oddly enough, these are replaced by a "000" jumper on the DSO model.

What're the odds that's an active 50MHz low-pass? 

I wouldn't expect any HW difference between DSOX and EDUX as all differences are in options.

I noticed some differences in some components between the EDU and DSO models.  EDU has missing components on the EXT TRIG input section (missing RELAY, Analog comparator with resistors and caps) and EDU has additional components on both input sections compared to the DSO model.

Changing the ID from 22 (default ID for EDUX1002G) to 24 (default ID for DSOX1102G) activates Segmented Memory, Additional Trigger modes, BW to 70MHz, 2GSa/s and most of the features available with DSOX1102G, but fails self test (Comparator & Mux error) and does not pass User Calibration (probably due to missing components on EXT TRIG input section).

[TK]

The probes included with the EDU model are 75MHz and not 200MHz

[Bud]

I do not think 75MHz probes prove anything. If they exist why to include 200MHz probes with a 50MHz scope.

[TK]

Upon looking to see the component differences on the ext trig, i also noticed the extra components on the two channels. Oddly enough, these are replaced by a "000" jumper on the DSO model.

What're the odds that's an active 50MHz low-pass? 

I measured the input level and it gets attenuated below -3dB after 70MHz, and Scope About screen shows "70MHz" (Product ID 24).

[PA0PBZ]

Upon looking to see the component differences on the ext trig, i also noticed the extra components on the two channels. Oddly enough, these are replaced by a "000" jumper on the DSO model.

What're the odds that's an active 50MHz low-pass? 

Looks like the chip is EL5166ISZ current feedback amplifier.

[krasimir.k]

I think that the missing SOT23-5 component in the EXT TRG part is the comparator TI LMV7219.
The picture is not clear enough, but I can recognize mark C14A which is LMV7219M5 component.
The wide body tssop 8 pin below probably is the dual op-amp TI TLC272 with marking P272C.

[EEVblog]

The lower bandwidth EDU has extra parts? That's interesting...
An extra hardware filter?

[EEVblog]

I do not think 75MHz probes prove anything. If they exist why to include 200MHz probes with a 50MHz scope.

Because the DSO model has a 100MHz software upgrade option, and demonstrably a 200MHz front end. Makes sense to include 200MHz probes with that.
Cheaper 50MHz probes with the EDU makes sense. No software upgrade option on that.

[Fungus]

The lower bandwidth EDU has extra parts? That's interesting...
An extra hardware filter?

Not software switchable...no hacking!

[mikeselectricstuff]

The lower bandwidth EDU has extra parts? That's interesting...
An extra hardware filter?

It looks like the ADC/ASIC does the bandwidth limiting, and will probably only do 70MHz - there isn't a 50MHz DSOX2000 model. So this being a 50MHz bandwidth limiter makes sense if Marketing decides that they need a 50Mhz model to avoid competing with the DSOX product.