DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[tonyc]

Hi Folks,
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses? I am interested in hack to scope to run my own code. One example I had in mind is to write a program to enable telnet over USB connection.

[TheSteve]

Top work memset, you continue to impress!

[Howardlong]

Hi Folks,
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses? I am interested in hack to scope to run my own code. One example I had in mind is to write a program to enable telnet over USB connection.

It is CE Embedded 6.0.

[memset]

Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses?

2000, 3000, 4000 series are Microsoft Windows CE 6.0 R3 based. BSP for SPEARHEAD600 CPU is from Adeneo (not public).
6000 model runs Microsoft Compact Embedded 7 (WINCE7) on i.MX6 CPU.

[Wiljan]

Nice to see new progress here 

!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!

Will this work for MSO-X2014A V2.41 as well?
or will there be a need to a 2ka_v241_linkinstall.cab version?

Thank you

[Sparky]

I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.

Incredible work, memset!   This seems to be the "holy grail" method to activate options when upgraded firmware to v2.41, which until now would require LAN module to telnet into scope after it boot.  I will look forward to testing this out!

Best,
Sparky

[memset]

Will this work for MSO-X2014A V2.41 as well?
or will there be a need to a 2ka_v241_linkinstall.cab version?

Hmm. This should work on 2000X as well, but I can't be sure about it. I don't have 2000 so it's not tested.
If you'd like to try, make sure you have a LAN module ready to undo changes via telnet if something goes wrong.
Generally, lnk file contents should be the same as for 3000A series.

For sure this cab should NOT work on 3000T and 4000X / 6000X series because of different version requirements.

[TheSteve]

So for those of you who have 2.41 and a dsoxlan card it looks like you could just copy the .lnk file you make from the USB drive to \Secure\Startup\infiniivision_ext.lnk using telnet or use memset's cab file upgrade.
At this point it is looking like there isn't too much incentive to stay on 2.39 or older unless you want to be able to boot directly from a USB drive.

[Wiljan]

Just installed the usb update lnk file from memset on DSOX2014A and it works great on v2.41.Thx 😀

[Howardlong]

So for those of you who have 2.41 and a dsoxlan card it looks like you could just copy the .lnk file you make from the USB drive to \Secure\Startup\infiniivision_ext.lnk using telnet or use memset's cab file upgrade.
At this point it is looking like there isn't too much incentive to stay on 2.39 or older unless you want to be able to boot directly from a USB drive.

FWIW, to switch it off, I have been renaming the new .lnk file to .xxx via telnet

[TheSteve]

I'm pleased to report that I performed the mod this afternoon on my DSOX3014A and it is working perfectly(as far as I can tell anyway!).

After swapping the parts I fully reassembled the scope and verified all channels worked - everything actually seemed to still be bang on where it should be as far as triggering and levels go. I let it warm up and then performed a user cal. It passed with no problems. For the user cal I made 4 BNC patch cables each 10 inches long and used the recommended splitters to connect all 4 channels to trigger out. I used RG142 for all cables.

Here are my numbers so far:

3 dB point measured by inputting 1 Vpp and then increasing frequency until the signal level was .707 Vpp.
Signal gen is an HP 8921A with 4 feet of RG142.

Pre mod 100 MHz was 131 MHz
Pre mod 200 MHz was 227 MHz

Post mod 350 MHz is 389 MHz
Post mod 500 MHz is 593 MHz

I also tested it with a Jim Williams style pulse generator - these numbers are certainly not correct as the pulse needs a flatter top. It does show a quicker time as the bandwidth is increased though.
The pulse gen performance was verified using a 1 GHz TDS7104 which indicated a 350 ps rise, again though no flat top was observed. I'll work on improving the pulse gen.

100 MHz - 2 ns rise
200 MHz - 1.16 ns rise
350 MHz - 690 ps rise
500 MHz - 520 ps rise

All channels were verified to perform the same.

So things are looking extremely positive. As memset mentioned you really need to be confident in your abilities before taking on this mod. The parts are cheap enough but they aren't the easiest to swap. The pads are very small and the differential lines actually sink quite a bit of heat. On the plus side working space isn't too bad. You want to be sure you can handle delicate 0603 parts.

Thank you again to memset for attacking this project and Howard who was willing to desolder and measure parts on a perfectly good(and far from cheap) scope as well as the others who provided pictures.

For anyone interested in performing this mod here are the exact parts I used in my DSOX3014A:

H1 strap resistor - 121K 0603 1%, Vishay # CRCW0603121KFKEA, Digikey # 541-121KHCT-ND, quantity 1
L1 strap resistor - 46.4K 0603 1%, Vishay # CRCW060346K4FKEA, Digikey # 541-46.4KHCT-ND, quantity 1
R1 - 110 ohm 1206 1%, Vishay # CRCW1206110RFKEA, Digikey # 541-110FCT-ND, quantity 4
R2 - 162 ohms 0603 1%, Vishay # CRCW0603162RFKEA, Digikey # 541-162HCT-ND, quantity 4
C1 - 2.2 pF 0603, 100V NPO, Murata # GQM1885C2A2R2BB01D, Digikey # 490-4838-1-ND, quantity 4
C2 - 2 pF 0603, 100V NPO,  Murata # GQM1885C2A2R0BB01D, Digikey # 490-6092-1-ND, quantity 4
L1,L2,L3 - 15nH 0603 2%, Coilcraft 0603CS-15NXGEU, quantity 12 (ordered direct from Coilcraft)
L4 - 27nH 0603 2%, Coilcraft 0603CS-27NXGEU, quantity 4 (ordered direct from Coilcraft)

Any questions/comments let me know.

edit - just updated to version 2.41, my infiniivision_ext.lnk file contains the following:

217#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l DIS -l ASV -l RML -l BW50

edit #2:
Compared rise times, amplitudes etc to my TDS7104A using a pulse/pattern gen and all of the numbers are exactly as they should be. I also tried the 20 MHz bw limiter and it is working perfectly as well.

[memset]

Nice work, TheSteve!

[trevwhite]

Yeah, well done everyone. It really is impressive, I am asking myself should I do it and do I really need to. I have a DSOX3024A and it does what I need it to. I think I might just hold off until such a time as I need the extra bandwidth. I suppose the other thing would be scope probes for such a modification. Upping to 500Mhz, what probes are people using?

Trev

[TheSteve]

I bought my DSOX3014A direct from Keysight as a refurb so it came with no probes(price was great though). I was then lucky and found as new Agilent 1161A 500 MHz probes for 40 bucks each in the original pouch with all accessories so I grabbed those as my passive probes. Now that I have 500 MHz of bandwidth I'm also looking for some affordable active probes. There are some reasonable options if you're willing to modify an older probe to work with the DSOX3000 series. The 1152A is an example of that.

I have attached a picture of the removed parts in case I needed I hit the "undo" button.

[Howardlong]

Another vote for the 1160A series, I use the 1165A here for a day to day passive probe because they are small and light weight. The stock probes that come with the x3054a are Duplo size in comparison.

Although I have a selection of lo-z and FET probes, they don't come out very often, but it depends what you're doing, my work is almost all low impedance digital and mixed signal stuff.

[Neganur]

There was this article written by someone who made a power supply interface for the smart probe (auto probe?) interface. I think that's a better solution than opening the 1152A since you won't be able to use them with scopes that did support the probe anymore.

I'll see if I can find it once I'm back home.

Ps, keysight's new 1GHz 1M/0.7pF active probes are nice in principle and sometimes can be had for ~500 but they are really unwieldy, impossible to probe two test points next to each other. Also the GND clip pisses me off regularly since it turns in all directions.

EDIT (link): http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf

[TheSteve]

I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.

So I guess the answer is 500 MHz (closer to 600 really). Of course memset might further impress us all and still wire in the Teledyne relays to push his scope to 1 GHz. Wiring it in doesn't look too bad, maintaining proper impedance along the way is another story.
Too bad there isn't a way to mod only a single channel.

[Sparky]

I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
...

Fantastic work, memset! 

I gave this a go on my DSO-X 3034A, which was previously running the v2.39 firmware.  I upgraded to v2.41 and then used the cab file to install the link.  In my .lnk file I have:

Code: [Select]

96#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l BW50 -l memMAX -l ASV -l CABLE -l SGMC
In the past I bought the DSOX3k app bundle so I only needed to activate a few options.  When on firmware v2.39 or earlier the existing licenses are kept and the options (-l MSO etc.) add the additional licenses.  However, in this case for firmware v2.41 I found that only the options I listed were installed.  All the options I have installed via the app bundle license did not appear.  Did anyone notice this?  Did anyone else notice this?  Is that why people are using -l All, or specifying all the options?


By the way, according to Microsoft the number before the # is the number of characters *after* (not including) the pound sign.  Perhaps it's not so critical, though, as the default .lnk on the scope seems to get it "wrong", too...

[TheSteve]

I didn't notice that as I have no factory licenses. I would think it is related to the changes Keysight made between 2.39 and 2.41. The biggest being that no binary needs to be patched to enable all licenses.
I specify all of the licenses I want simply so I don't see the * beside everything on the about screen.

[Sparky]

@TheSteve: Thanks for the follow-up.  I too prefer not having * beside all the options.

I removed the _ext.lnk file via USB "uninstall" and that worked with all my licensed options back.  Then I modified the .lnk with all options and "installed" again, and that worked like a charm

There's a modern HTML5 web front end now -- I hadn't seen it before!  Pretty neat!

[TheSteve]

Was playing around some more and decided to look at the trigger out from my pulse/pattern gen. In ECL mode it is spec'd for a typical rise time of 600ps. Connecting it to my TDS7104(1GHz scope) I see a rise time of 500ps. Connecting it to the modified DSOX3014A I see rise times between 600 and 660 ps. I believe this represents a very realistic value you can expect to see in real world use and is right inline with what we would expect with the mod.

[Howardlong]

This is from a kosher MSOX3054A. Source is HP 54121T with a system rise time of <33ps.

The measured rise time varies between 630 and 670ps on the 3054a with the fastest timebase (1ns/div).

If you reduce the timebase to 5ns/div it flucuates between either 600 or 700ps, I'd suggest due to more limited resolution as ISTR these scopes measure using the screen data rather than directly the samples themselves.

[TheSteve]

Perfect -  exactly what I see with my "special edition". Thanks Howard!

[Sparky]

Anyone having troubles with LAN on v2.41 or after the new patch method?

I found today that the LAN interface is not being configured -- see the photo below.

I've not had this happen before.  Everything seemed fine just a few days ago.  I plugged the Ethernet into a switch; my router handles the IP address assignments using DHCP.  I've always used this setup without problems.

I tried the "reset LAN" option from soft-button menu but it leads to the same result.

I tried removing and VGA/LAN card and plugging it back in.  Also tried different sockets in my switch and different Ethernet cables...

Has anyone seen this before?  Is the IP address shown (92.251.81.2) typical in the case of not being able to obtain IP address from DHCP server?  Other instruments seem to be working fine...

[TheSteve]

I'm seeing the same thing. It was fine with 2.39 - not sure if it is 2.41 with a home brew dsox2lan or if it is using the external link. Either way mine still works fine via DHCP even though the IP information on screen is not displayed correctly.