Sniffing the Rigol's internal I2C bus

[andyturk]

Just applied the cybernet magic to my DS4014...

See the attached screen shots for details. Source signal was a Jim Williams pulser (#4 from free_electron).

[Gunb]

impossible to say for me because i dont even own a DS4k - but the hardware experts in that forum say its all the same.

OK. Meanwhile I'm at home and flashed my scope - works fine with 1ns/DIV now. Cool man!

Thank you, mate!

[apelly]

Isn't this cyberCAD® DS2k JTAG pinout schematic enough?
https://www.eevblog.com/forum/testgear/dg4000-a-firmware-investigation/

No with TOPJTAG.

Understood.

Didn't want to pay the freight on cybernet's recommended JTAGkey-Tiny, and people seem to have had issues dealing with them.

[Gallymimus]

This is very cool.  I've been holding out on buying a ds4014 until this mod came along.

Really I probably only need a ds1000z!

[mtdoc]

Did the upgrade and working great.    But not yet displaying 2302

the "recalc" of the string is triggered by option un/install - so flush keys, and reapply them and it will become active.

OK - stupid question - what exactly do you mean by above?  Do a new kegen and use option code DSAA (or DSAS?)  to clear all options then do it again with DSAZ?  ( I tried just with DSAZ but no luck)

Just wanted to check before I do something stupid ..

[Gallymimus]

Did the upgrade and working great.    But not yet displaying 2302

the "recalc" of the string is triggered by option un/install - so flush keys, and reapply them and it will become active.

OK - stupid question - what exactly do you mean by above?  Do a new kegen and use option code DSAA (or DSAS?)  to clear all options then do it again with DSAZ?  ( I tried just with DSAZ but no luck)

Just wanted to check before I do something stupid ..

If not that, it might mean to use the SCPI uninstall function.

[alank2]

OK - stupid question - what exactly do you mean by above?  Do a new kegen and use option code DSAA (or DSAS?)  to clear all options then do it again with DSAZ?  ( I tried just with DSAZ but no luck)

My theory is that there are both "factory model" and "current operating model" values stored in flash.  When you install/uninstall a key it seems to go back to the "factory model" and then decide what to elevate it to by looking at the key bits, in this case 100M or 200M.  I think cybernet's modded firmware overrides the "factory model" setting with a 2302.  So after flashing it you need to uninstall and reinstall any keys you had to get it to do this "current operating model" calculation process.

[Co6aka]

i hope u dont end up in a "bad forum" one day, could be surprising ..

Hey wait a minute... Why is my DS4K using up all of my network bandwidth now...?   

Anyway... So far so good with your patch! 

(Next time you find yourself in Nooh Yawk, there's a few tall-cold-ones waiting! )

[mtdoc]

Did the upgrade and working great.    But not yet displaying 2302

the "recalc" of the string is triggered by option un/install - so flush keys, and reapply them and it will become active.

OK - stupid question - what exactly do you mean by above?  Do a new kegen and use option code DSAA (or DSAS?)  to clear all options then do it again with DSAZ?  ( I tried just with DSAZ but no luck)

Just wanted to check before I do something stupid ..

If not that, it might mean to use the SCPI uninstall function.

Yeah, I thought of that possibility. I haven't tried using SCPI commands yet.

So... the answer is???

OK- that was it!  Just used the SCPI uninstall then install commands and it worked!  Thanks.

[jamesb]

Not to be too much of a buzzkill ... however, have a look at the attached images.


10MHz signal generated from DSA815-TG (50ohm output) set to zero-span mode, N-to-BNC cable with 50ohm inline termination to DS2202 (reflashed with modified FW).
Observed waveform shows 74mVpp amplitude.
Bandwidth being -3dB or 0.707.. we find 74mVpp / sqrt(2) = 52.3mVpp (-3dB voltage)


At 250MHz zero-span output, the observed amplitude is 52.4mVpp
Thus, it appears that 250MHz is the actual bandwidth of a DS2000 series scope

I do not like the pulse generator method of finding the bandwidth because it appears that there is much confusion as to how to properly measure the pulse width (not the slope of the curve) and even in doing so, 0.1ns can generate a very significant difference in derived BW. It seems this method is more prone to gross systematic errors. Kinds of like the recent speed of light debacle

Would anyone care to further discuss these findings?

edit: spelled pulse as "pule"

[alank2]

Curiously jamesb, where does it get to the -3 dB point when the 200M bandwidth limit is turned on?  How much lower?

[JDubU]

jamesb:

Which hardware version is your DS2000?

[jamesb]

Curiously jamesb, where does it get to the -3 dB point when the 200M bandwidth limit is turned on?  How much lower?

180MHz reliably at BW limit = 200MHz
100MHz at BW limit = 100MHz
20MHz at BW limit = 20MHz

edit: added data points

[jamesb]

jamesb:

Which hardware version is your DS2000?

SW: 00.01.01.00.02 modified version
HW: 1.0.1.0.0
FPGA:
 SPU: 03.01.05
 WPU: 00.06.05
 CCU: 12.29.00
 MCU: 00.05

[Carrington]

@ jamesb:

I have a question: Where do you get the 250 MHz signal?

[jamesb]

@ jamesb:

I have a question: Where do you get the 250 MHz signal?

Tracking generator output from a DSA815-TG set to zero-span mode

[mtdoc]

@ jamesb:

I have a question: Where do you get the 250 MHz signal?

Tracking generator output from a DSA815-TG set to zero-span mode

Have you checked its output at those frequencies on a known high bandwidth scope?

[jamesb]

Have you checked its output at those frequencies on a known high bandwidth scope?

Fair question, however ..

What is more likely? A 200MHz scope which has been hacked to "allow" 350MHz BW operation ... or a spectrum analyzer with tracking generator whose range is 9kHz to 1.5GHz is not outputting its correct amplitude?

I have verified the linearity of the tracking generator using the spectrum analyzer. To ensure output linearity, I confirmed that the output power was -20dBm for all frequencies prior to checking their amplitude on the oscilloscope. In all cases, the bandwidths reported were at the same (measured) output levels.

[mtdoc]

Have you checked its output at those frequencies on a known high bandwidth scope?

Fair question, however ..

What is more likely? A 200MHz scope which has been hacked to "allow" 350MHz BW operation ... or a spectrum analyzer with tracking generator whose range is 9kHz to 1.5GHz is not outputting its correct amplitude?

No argument at all.  Just covering the bases....  A perusal of the manual of the DSA815-TG shows the tracking generator specs at +/-  3dB output flatness across its range.

[olsenn]

No argument at all.  Just covering the bases....  A perusal of the manual of the DSA815-TG shows the tracking generator specs at +/-  3dB output flatness across its range.

The input of the DSA815 is MUCH more accurate than the output (Tracking Generator), so forget the manual, just connect the TG directly to the input of the SA to see what the amplitude is at your desired frequency. Each DSA815-TG will have a different frequency response for its TG, and although +-3db is the worst case scenario according to the datasheet, I think most units will have much flatter responses than this

[Teneyes]

@andyturk

All the talk of Rigol hacks got me curious about what goes on inside my DS1102E's non-volatile RAM.

Just applied the Cybernet magic to my DS4014...

Well Andy, you started this back in May, and I would say an excellent, interesting and well participated Topic .  Success to All

[seronday]

Not to be too much of a buzzkill ... however, have a look at the attached images.

10MHz signal generated from DSA815-TG (50ohm output) set to zero-span mode, N-to-BNC cable with 50ohm inline termination to DS2202 (reflashed with modified FW).
Observed waveform shows 74mVpp amplitude.
Bandwidth being -3dB or 0.707.. we find 74mVpp / sqrt(2) = 52.3mVpp (-3dB voltage)

At 250MHz zero-span output, the observed amplitude is 52.4mVpp
Thus, it appears that 250MHz is the actual bandwidth of a DS2000 series scope

I do not like the pulse generator method of finding the bandwidth because it appears that there is much confusion as to how to properly measure the pulse width (not the slope of the curve) and even in doing so, 0.1ns can generate a very significant difference in derived BW. It seems this method is more prone to gross systematic errors. Kinds of like the recent speed of light debacle

Would anyone care to further discuss these findings?

The issue that you have run into here is the loading effect due mainly to the input capacitance of the DSO channel.
As an example, the DS2000 series is specified as having approx 16pf input capacitance.
At say 300Mhz, this is approx 33ohms reactance across the 50ohm external termination.

High end oscilloscopes have a correct 50ohm impedance termination built in.

It is possibble to get around this issue by using a suitable high frequency probe. eg. an active probe.

From the point of view of measuring the DSO channel bandwidth, it is possible to do this with a spectrum analyzer and tracking generator.

The idea is to monitor the signal level directly at the input to the DSO and adjust the Generator output to maintain a constant signal level at the DSO input.
Any drop in signal level seen on the DSO screen is then due to frequency response of the internal circuitry after the input connector.
So this is measuring the DSO frequency response only and ignores the effect of changes in the input loading.
 
This can be done as follows:-

Connect the Generator output to the DSO input channel using a BNC "T" piece on the front of the DSO.
The Generator output is connected to one side of the "T" and a 20dB 50ohm inline attenuator to the other side of the "T".
Then from the 20dB inline attenuator connect back to the spectrum analyzer input.
The 20dB attenuator acts as a 50ohm termination for the Generator.

[andyturk]

Well Andy, you started this back in May, and I would say an excellent, interesting and well participated Topic .  Success to All

Indeed. Many thanks to cybernet and the other rock stars in this thread!

[oe6kyg]

i have two HP8640B Signal Generators up to 512 MHz
Output ist linear on both measured with HP 70000 Analyser

connected Gen to DS2072(updatet) through a 50 Ohm Termination (which is also linear up to 1 GHZ)
my 3 dB Frequency was 344 Mhz
up from 344 Bandwith goes down dramaticaly and over 380 Mhz Scope does show frozen Signal and Frequency

see att. PIC

[jamesb]

My precise procedure was as follows:

• turn on both devices and let sit idle for 30m
• connect TG output to 50ohm termination via N-to-BNC cable
• connect 50ohm termination to SA input using BNC barrel connector and then BNC-to-N cable
• engage TG at -20dBm ouput, zero span on 20MHz & verify output level (-22.7dBm)
• connect output of TG to DSO channel 1 using N-to-BNC cable and 50ohm termination
• measure peak-to-peak voltage (as displayed)
• calculate -3dB point (for voltage) as being 74mVpp * {1 / sqrt(2)} or 52.3mVpp
• increase TG output frequency until ~52mVpp observed
• reconnect TG output to SA input as above and gradually increase output from -20dBm to -19dB to achieve roughly the same output level as the 20MHz value (-22.8dBm)
• reevaluate BW on scope and confirm waveform amplitude is ~52mVpp
• re-do entire procedure above and obtain different results
• realize that my original results may be wrong as I am getting much more favourable results

My latest iteration comes up with 300MHz as the BW when I corrected for the TG output "flatness" (increased output from -20dBm to -19dBm to achieve same value at SA input). It seems that my own methodology is no better than the pulse width method for systematic error - or I am just so systematically error prone that I am the root cause

I lack the two 20dB attenuator pads - however, the SA does have a built-in attenuator and I've got a good 10dB attenuator - I will try seronday's suggestion using 10dB (which I understand will not be the 10x factor I am looking for [20log(v1 / v2)] just to see what I get for values.

It appears that I may have been a bit premature with my nay-saying.
[/s]

This procedure is flawed due to "calibrating" the TG output with the 50ohm termination in place. The results will read artificially high as a result.
I will redo the entire experiment and report back, this time without making the RF newbie error.