Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 247351 times)

pnv57 and 6 Guests are viewing this topic.

Offline Freitas389

  • Newbie
  • Posts: 1
  • Country: dk
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #800 on: May 03, 2021, 11:03:08 am »
I soldered the components to turn my DSOX1102A into a DSOX1102G, and I got the function generator to work but the amplitude of the signals is too high and causes signal clipping.
If I set the amplitude to a lower values the signals look fine.
When I traced back the signals, I could see it is the DAC itself that is outputting the larger than supposed amplitude and not the opamps that I soldered. It seems like the function generator is missing a calibration.
Can anyone who tried this let me know if you experienced a similar issue and how it can be fixed?
Thanks
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #801 on: May 10, 2021, 05:06:37 am »
I had that and it was fixed after running a user calibration. The scope however needs to be modded to the proper model with the strapping resistors.
Facebook-free life and Rigol-free shack.
 

Offline amx

  • Contributor
  • Posts: 13
  • Country: ua
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #802 on: June 10, 2021, 07:19:34 pm »
Hello all,
I did go thru all thread, great work! thanks for effort, now I am happy user of DSOX1102A.
I have a couple a questions:
 - Is fercsa.ksx can be applicable for FW 01.20 ? Found answer in post #767
 - Is anybody tried solder not populated components for signal generator?

Thanks!
« Last Edit: June 11, 2021, 02:04:13 am by amx »
 

Offline amx

  • Contributor
  • Posts: 13
  • Country: ua
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #803 on: June 21, 2021, 07:48:12 pm »
Hi All I found all answers thanks.
I did order parts, but I disappointed with BNC connector... The BNC jack which used in DSOX 1102X is non-standard...
Is anybody know part number for BNC which Keysight use?

Thanks
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 366
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #804 on: June 21, 2021, 08:06:17 pm »
Did you find a full list of the other non-populated signal generator parts, including capacitor and inductor values?
 

Offline amx

  • Contributor
  • Posts: 13
  • Country: ua
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #805 on: June 21, 2021, 10:22:40 pm »
I am going to start with: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2544486/#msg2544486
The unspecified caps and inductor I am going use some regular value - I have standard kit of caps and inductors.
But I stuck with BNC it has smaller layout than regular BNC jack...
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 366
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #806 on: June 21, 2021, 11:10:38 pm »
 

Offline amx

  • Contributor
  • Posts: 13
  • Country: ua
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #807 on: June 21, 2021, 11:43:49 pm »
No ( since layout size for mounting posts biggest then layout at the PCB...
I already bought nice metallic BNC jack with the same size but it not fit.
I just wondering is any other BNC size for mounting posts is exists or Keysight use some custom BNC jack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1684
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #808 on: June 22, 2021, 12:09:33 am »
Do you think this BNC connector might work?

https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/1-1634505-0/1755945
It took me months to find the correct BNC for the 1000X (EDUX1052A) and this one fits perfectly: https://fieldcomponents.com/RFB-1112-1B.html
 
The following users thanked this post: JDubU, wxqhigh

Offline regged

  • Contributor
  • Posts: 5
  • Country: am
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #809 on: August 20, 2021, 10:33:43 am »
I soldered the components to turn my DSOX1102A into a DSOX1102G, and I got the function generator to work but the amplitude of the signals is too high and causes signal clipping.
If I set the amplitude to a lower values the signals look fine.
When I traced back the signals, I could see it is the DAC itself that is outputting the larger than supposed amplitude and not the opamps that I soldered. It seems like the function generator is missing a calibration.
Can anyone who tried this let me know if you experienced a similar issue and how it can be fixed?
Thanks
Did you make any photos? How many components do i need to do this modification? Because i did not disassemble yet my scope.
« Last Edit: August 20, 2021, 10:56:46 am by regged »
 

Offline rvt23

  • Newbie
  • Posts: 2
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #810 on: September 03, 2021, 04:58:47 pm »
Hóóóii!
Can I help with this? Or isn't necessary anymore.

I've flashed the 1.2 hack on my EDUX1002A that i've bought with my first jobs!(factory eletronics/Firmware V1.1).

I get a little problem when measuring signals like Probe Comp,
Aparently there is a bug on display signal/points(?)

So I've downloaded and flashed the FERCA v1.1, aparently everything is fine, now I can try to use UART/i2c which was my biggest curiosity.

Has anyone scheduled all the upgrades we can do on an edux1002?
Without hardware, basically we can enable i2c and uart functions...maybe the acquisition memory?

With hardware we can modify the band from 50 to 200Mhz and add a functions generator, would the memory acquisition part be here too(on the dso model resistors select)?

Dave is the best english teacher ever!
best regards
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #811 on: September 03, 2021, 05:11:04 pm »
I've flashed the 1.2 hack on my EDUX1002A that i've bought with my first jobs!(factory eletronics/Firmware V1.1).

I get a little problem when measuring signals like Probe Comp,
Aparently there is a bug on display signal/points(?)

So I've downloaded and flashed the FERCA v1.1, aparently everything is fine, now I can try to use UART/i2c which was my

You should try the original 1.2 firmware and if the problem is there, report it to Keysight.
Facebook-free life and Rigol-free shack.
 

Offline rvt23

  • Newbie
  • Posts: 2
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #812 on: September 03, 2021, 05:14:21 pm »
I'll still be able to patch and unlock the decoding features?
 

Offline hhappy1

  • Contributor
  • Posts: 18
  • Country: kr
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #813 on: September 04, 2021, 11:02:02 am »
But...wait ! There is more !    :D

It comes with 2 Megapoints of memory , double of what was achieved until now   :box:



I used hacked 1.20 firmware.
Everything is a full option. Thank you sir.

Is the memory now 2M?
Or should I use another method?
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #814 on: September 04, 2021, 07:57:14 pm »
It is unlocked as part of the 1.20 package.
Facebook-free life and Rigol-free shack.
 

Offline hhappy1

  • Contributor
  • Posts: 18
  • Country: kr
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #815 on: September 05, 2021, 09:13:47 am »
It is unlocked as part of the 1.20 package.

Wow, that's amazing.

Have a nice day.
 

Offline JiriB

  • Contributor
  • Posts: 9
  • Country: cz
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #816 on: September 16, 2021, 04:47:27 pm »
I agree. Just for fun I send some charts. It's not going to get any better...
Thank you.
« Last Edit: September 30, 2021, 06:20:56 pm by JiriB »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #817 on: September 20, 2021, 02:52:39 am »
But...wait ! There is more !    :D

It comes with 2 Megapoints of memory , double of what was achieved until now   :box:



Here are test screenshots of memory depth of 1 and 2 MPoints - the 1.20 firmware captures twice as much of a waveform with 2 MPoints.





Edit: Mind you this is the EDUX which stock model comes with only 0.1 MPoints.  :D
« Last Edit: September 20, 2021, 06:30:06 pm by Bud »
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #818 on: September 21, 2021, 04:55:31 am »
A few more notes on Keysight acquisition memory.

The Single acquisition memory is the amount of sampling memory used when you press the “Single” button. In this mode the scope in general uses all available memory in full (still depends on Time/div setting). Attached is information that was collected from the Keysight 1000x Infiniivision oscilloscopes user manual. I think this information is important to understand and is worth memorizing (no pun intended) to be able to apply it to specific use cases and to maximize useful memory that will be used by the scope.
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #819 on: September 21, 2021, 05:05:53 am »
Segmented Memory mode:

We previously talked that v1.20 hack enabled 2 MPoints of  Single acquisition memory and referred to Keysight’s explanation how it is used in different acquisition modes. Now, in reality things are a bit more complicated and may be confusing to an extent. This specifically applies to Segmented memory mode. Surprisingly, in fact FERSA 1.10 hack already made 2M Points of Segmented memory available, but it could only be used by the scope in Segmented mode (vs 1M points in Single acquisition mode). This new v1.20 hack has liberated 2M points for Single acquisition mode while Segmented memory stayed at 2M points. It is probably fair to say that most of the users will use Single acquisition mode much more often than Segmented one, so doubling the Single acquisition memory in v1.20 hack was of a great value to them.

To add to the confusion, the v1.20 hack actually also increased utilization of the Segmented memory by the scope. Stay with me to understand why. Let’s for the moment refer back to the following part of the above screenshot about the maximum number of data points:

Quote
- Whether segmented memory (available on DSOX1000-Series models) is on. Acquisition memory is divided by the number of segments

I found the second part of it not being entirely accurate. Calculating the number of points per segment is not as simple as dividing total memory by the number of segments. The scope seems to have a sophisticated algorithm for memory partitioning in Segmented mode and the number of points not always adds to 2M points. I am guessing this may be because some of the memory is used by the scope to perform the task for calculations, indexing of segments and such. It may vary as much as 50% depending on the number of segments selected by the user and is especially pronounced at low segments count, approaching more or less even and full memory utilization at higher segments count.

If that was not enough of a confusion and you want more, here it is. In Segmented memory mode there are actually two of them: Linear and Circular.  Up until this point we were talking about Linear segmented mode. When you select Linear segmented mode, the scope will wait until all of segments are filled with data and then automatically stop the acquisition and display the captured data. In Circular mode the scope will continuously wrap around after all of segments are filled and it is up to the user when to hit the Stop button (while running in Circular the scope will display a rough segment counter but will not display the signal being acquired).

But this is not the only difference between Linear and Circular modes. They also seem to have different memory allocation algorithms. Number of memory points per segment in Circular mode always is less than that of in Linear mode under all other conditions being equal. My guess is the same as in the Linear mode this may be because of additional overhead required by the scope to perform the task, plus some more for additional calculation or alignment of segments, or to maximize the speed, do not know. The difference in number of samples per segment for a given Time/div between Circular and Linear modes can be as big as 50 %, that is – in Circular mode you may get twice as less number of points per segment then in Linear mode (depending on the number of segments). I think this is something that may need to be understood and kept in mind.

Now to the good news: the v1.20 mem hack provides an improvement in memory utilization in both Linear and Circular segmented modes, as much as 30% at some lower segments count. The chart below represents memory utilization in Linear mod for v1.20 with no mem hack and the same v1.20 with one.


Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #820 on: September 21, 2021, 03:00:31 pm »
Replacing the splash screen on 1000X:

You can use the attached scripts to install and restore a custom boot splash screen. The scripts were tested on EDUX 1002A but are expected to work for other 1000X series scopes. Instructions are in Readme files and are self-explanatory.

A few ready to use splash screen samples are also attached. You can use your own image but you need to format it to the specs outlined in the Readme file in Install Splash zip archive.

Here is the Altium parkour image installed as the custom splash screen on the EDUX:

Facebook-free life and Rigol-free shack.
 
The following users thanked this post: SilverSolder, TheSteve

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #821 on: September 21, 2021, 03:32:10 pm »
Hacking into the WinCE shell:

The attached script allows to drop into the WinCE operating system shell. From there you can browse around and explore the application files/data, run external tools from USB to explore the Registry, run DOOM, etc. You can connect a keyboard or mouse to the USB port. This is more of a tool to satisfy your curiosity rather than anything for normal scope use.

This tool is based on an other fellow's work published earlier in this thread. My contribution was to wrap it in a script to make it simple to use.

Facebook-free life and Rigol-free shack.
 
The following users thanked this post: TheSteve, JiriB, hhappy1

Offline JiriB

  • Contributor
  • Posts: 9
  • Country: cz
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #822 on: September 25, 2021, 04:21:01 pm »
Hi,

add a line with "copy" works great ...

%1\ShowTaskbar.exe
copy \Secure\cal\*.* \USB\
\windows\cmd.exe /c \windows\createUserAccounts.exe
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4959
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #823 on: September 26, 2021, 02:53:01 pm »
If you want to make a copy of the calibration files you can simply run that command from the command line after dropping into WinCE shell.
Facebook-free life and Rigol-free shack.
 

Offline JiriB

  • Contributor
  • Posts: 9
  • Country: cz
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #824 on: September 26, 2021, 04:53:01 pm »
It is true! Thank you.
But I fight with calibration. On the 1.6V External Trigger stops. When the EXT trigger is turned on, the timeline breaks down .  I don't even want to advise, it's strange. :phew:


Trig Hyst B1 = 18937.725, B0 = 8124.452                                   **** CAL PASSED **** Time: 13 seconds
**** External Trigger Level ****                                                /1 Trig B1 = 5303.000, B0 = 35814.000
/5 Trig B1 = 1071.000, B0 = 35814.000                                       **** CAL FAILED ****
Cal Date Fri Sep 17 13:59:06 2021                                             Update Cal Failed Header
Factory Cal Mode                                                                         Revision     : 2
Cal Mode     : Factory                                                                   Cal Satus    : CAL_OK
Firmware Ver : 01.01.2016092800                                              Cal Temp     : 24.250000 C
Cal Date     : Fri Sep 30 11:35:23 2016                                       Cal Duration : 401s
Service Cal Mode                                                                         Revision     : 1                                                               
Cal Mode     : Service                                                                  Cal Satus    : CAL_OK
Firmware Ver : 01.01.2016092800
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf