EEVblog #978 - Keysight 1000X Hacking

[EEVblog]

At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA

Yes it could be a very configurable decode block(s), but I'm told the actual decoding is all done within the ASIC, no outside help. Stuff like the event table might be shunted off to the GUI processor though.

[TK]

There's also an FPGA.I wouldn't expect decode functionality to be nailed into an ASIC,except maybe display support.
They wouldn't want to exclude the possibilty of adding new decodes in future.

It's built into the ASIC:

Yes,but I can't imagine they'd have committed to an ASIC with no way to add new protocols. For example the latest 3000T firmware has added a manchester/biphase decode, seem unlikely that was just sitting in there all these years just waiting to be turned on.
At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA

Maybe it is more a SoC than 100% fixed logic ASIC and has some configurability like an FPGA

[TK]

Without flux, in a pinch, you can even try that with rosin-cored solder The flux is just to help the solder flow onto / wet the pads.

Where there's a will, there's a way...

Second picture shows the hardware mod of the front end.  The hardware mod is partial because I am waiting for the solder paste to arrive to be able to solder the WSON Package

You don't need solder paste for that

Flux and tin the pads with a soldering iron (and optionally wick off the excess), do the same on the LMH6552, dab a bit more flux on the board, and hot-air it into place.

I tried with a flux pen (liquid that evaporates very quickly) and it didn't work well.  I did not have a lot of time to do it, so I can repeat today.  I ordered flux paste as I expect it to work better than the liquid flux pen for this type of application.

Thanks for the suggestion.

Well, I managed to solder the LMH6552.  The result is amusing me... CH1 is unmodified, CH2 has been matched to the DSOX including the LMH6552.  I put the same signal on both CH1 and CH2 and what I notice is that CH1 starts attenuating the signal starting around 25MHz, but around 100MHz it recovers the original level.  CH2 does not attenuate the signal all the way up to 100MHz.  Then after 100MHz, both CH1 (unmodded) and CH2 (modded) attenuates at the same level until 125MHz and up... the scope can measure frequency (COUNTER) up to 200MHz or more with signal considerably attenuated.

So I think the extra opamp on the EDUX front end is acting like an inverse bandpass filter (attenuates from around 25MHz to 100MHz), I don't know the reason.

But anyway, with CH2 matched to the DSOX, I cannot get near 220MHz as Dave in the original DSOX...

[TheSteve]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

[TK]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

[TheSteve]

Hopefully that is good enough to get accurate measurements, without good termination the levels can easily show double the true value.

So with the DSOX modified channel and using your hack to enable 200 MHz of bandwidth the bandwidth still remains around 100 MHz?

[TK]

Hopefully that is good enough to get accurate measurements, without good termination the levels can easily show double the true value.

So with the DSOX modified channel and using your hack to enable 200 MHz of bandwidth the bandwidth still remains around 100 MHz?

Yes, still remains around 100MHz.  Better the modified channel than the original, but just by a little.  I am using scope mode 24 (DSOX1102G), I have not tried the other modes where Dave and Mike got 200MHz.  I was hopping the hacked software, that shows 200MHz in about screen, would enable it, but I think it is still controlled by the scope mode that can be changed using the 4 resistors.

[Bud]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?

[TK]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?

Do you mean frequencies?

[TheSteve]

There might be a 100 MHz mode set by jumper that will allow the bandwidth to be upgraded to 200 MHz by the firmware. In the 2000/3000 the hardware bandwidth jumper has a higher priority then the software license.

[TK]

There might be a 100 MHz mode set by jumper that will allow the bandwidth to be upgraded to 200 MHz by the firmware. In the 2000/3000 the hardware bandwidth jumper has a higher priority then the software license.

I think scope mode 24 is 70MHz HW setting.  Dave's scope has this mode by default + BW10 software enabled option.  I will try the other modes by switching the resistor values tomorrow.

Thanks

[TheSteve]

The default mode from Dave's scope is likely the best combo to try. If they planned for the future they could just sell a 200 MHz license.

[Bud]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?

Do you mean frequencies?

Where do you connect your scope probe ? I read a few pages back and could not see what test point in the circuit you are measuring.

EDIT: I assumed you are using an external oscilloscope , but perhaps your simply reading the voltage from the screen of this DUT scope ?

[Bud]

You have to measure/compare these components, this is a low pass filter. Bets are the component values  are different in EDU model.

[TK]

Are you testing bandwidth with a good 50 ohm pass-through terminator?

I am using 50 ohm cables with BNC and BNC T connector and 50 ohm terminator.  I don't have a 50 ohm pass-through

What point are your measuring ?

Do you mean frequencies?

Where do you connect your scope probe ? I read a few pages back and could not see what test point in the circuit you are measuring.

EDIT: I assumed you are using an external oscilloscope , but perhaps your simply reading the voltage from the screen of this DUT scope ?

I only have 100MHz scopes, so I was using the measurement tool in the EDUX itself.

[TK]

You have to measure/compare these components, this is a low pass filter. Bets are the component values  are different in EDU model.

I don't have a DSOX to compare the values of these components.  What I can do is to bypass it... what can happen if high frequency noise is injected into the ADC?  I will remove them and measure the values.

[Bud]

Nothing is going to blow up. Perhaps you will see some waveform distortions , but the bandwidth will still be limited by the rest of the frontend circuit. Should give you a qualitative indication if this filter is what is choking your scope at 100MHz.

[Bud]

I don't have a DSOX to compare the values of these components.

I'd think there should be plenty of people here that have one including the forum owner. Try asking. Worst case it can be modeled and new values found. Could be just the caps.

[TK]

I tried scope mode 03 reported by Mike to get 200MHz with some triggering issues when serial decode is active.  I don't get 200MHz, I am stuck at the same level, so it is being filtered by HW in the frontend.

Does the schematics (picture 1) I draw make any sense?  I tested 150MHz and 200MHz signal on both channels (modded and unmodded) right outside the positive output of the differential opamp and measured with the micsig TO1104. 

Picture 2: 150MHz modded
Picture 3: 150MHz unmodded
Picture 4: 200MHz modded
Picture 5: 200MHz unmodded

[Bud]

Does the schematics (picture 1) I draw make any sense?

Not quite, connection to the ADC is on the right side of the inductors.

EDIT: how much signal do you apply to the input ?

[TK]

Does the schematics (picture 1) I draw make any sense?

Not quite, connection to the ADC is on the right side of the inductors.

EDIT: how much signal do you apply to the input ?

I will check the schematics again.  I am applying 630mVpp.  The pictures are just to compare the modded vs unmodded channels, I don't have any scope that can do more than 100MHz, so the voltage I am measuring is not accurate.

[nctnico]

I'd measure the values in the front end and simulate using LTSpice. That should show where things go wrong. I gues a capacitor to ground has a different value.

[Bud]

I'd say go ahead with measuring the filter component values, i'd be surprised if it is of any higher bandwidth than 100Mhz.

[Keysight DanielBogdanoff]

At the very least I'd expect it's some sort of very configurable decoding engine, but for maximum flexibilty I'd imagine there would be some way to have it helped by software and/or FPGA

Yes it could be a very configurable decode block(s), but I'm told the actual decoding is all done within the ASIC, no outside help. Stuff like the event table might be shunted off to the GUI processor though.

Yes, we have configurable decoder blocks built in and some standard set-logic decoders. The event table is an ASIC thing, too.

[Bud]

I may have solved the EDUX ADC buffer amplifier topology riddle.

As we know, EDUX has an additional amplifier stage (Intersil EL5166) in front of the ADC differential buffer amplifier. Looking at the resistor values, voltage gain can be calculated for each scope model and each gain stage. The following simplified schematic shows the topology and gain figures for each scope model. It can be seen the overall gain for each scope model is the same, Av=8.46.



So why in EDUX model the second stage has gain of only 2 , whereas in DSOX it is 8.46 ? Well, I am glad you asked. Assuming the second gain stage IC in EDUX is LMH6550  (vs LMH6552 in DSOX 1000X), which is a 90MHz bandwidth amplifier, we check the datasheet (we are not rigol employees, so we always check datasheets) and find a gain/bandwidth chart that shows most of the bandwidth is utilized with Gain=2.



Now, in order to maintain the ADC input level, we need to boost the signal to the same level as in DSOX. Additional gain that is required for that is 8.46/2=4.23. So there has to be a pre-amp and that is what the EL5166 must be doing in EDUX. Looking at its voltage gain figure - you guessed it - it is 4.23.
So the combilned gain in the dual stage EDUX buffer amplifier is exactly the same as in DSOX single stage one. The DSOX just achieves it with a single LMH6552 wideband amplifier. In EDUX the lower bandwidth amplifier ICs are used to help limit the bandwidth. Looking at the EL5166 datasheet (we are not rigol employees, we always check datasheets) it can be seen the bandwidth pretty much mirrors LMH6552 bandwidth when the latter is set to gain=2. Both start rolling off after 50MHz.



So there you go. The buffer amplifier in EDUX is a limited bandwidth component and certainly has to be replaced with that of DSOX as user TK has done in order to extend the front end bandwidth in addition to straping and software options. Also, the bandpass filter at the output of the buffer amplifier must be measured and adjusted as required to support the extended front end bandwidth.

Weird - comparing Digikey pricing,  looks like they're spending more on the 50MHz front-end than the 200MHz one!

A quick pricing check at Digikey showed that price of EDUX's 2-stage EL5166+LMH6550 and DSOX single LMH6552 is pretty much the same. So no, does not seem they are spending more on the EDUX front-end.