DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[jjoonathan]

When the Keysight salesman dropped by work a few months ago, he was demoing MSOX4000s (IIRC, might have been higher, out of my price range at any rate) and he mentioned that bandwidth limiting was done by way of a FIR filter in the ASIC, the idea being that you would get a couple extra bits of precision from the high sample rate even if you were using a low-bandwidth model. He was quite specific - FIR filter in the ASIC - although I obviously can't personally vouch for his accuracy.

[nctnico]

I doubt they use FIR filtering. It is much easier to accomplish in the analog frontend.

[jjoonathan]

How would you get the extra bit depth from oversampling without one?

I don't doubt that there is bandwidth limiting in the analog front end (last few pages of thread), but wouldn't the extra samples otherwise just contribute noise?

[Jay_Diddy_B]

Hi group,

I could see doing the 20 MHz limit with a FIR, but not the scopes bandwidth.

The Tektronix TDS744A and TDS754 are 1GHz scopes, turned down to 500MHz by a filter between the front end and the ADC.

I described this in this thread:

https://www.eevblog.com/forum/testgear/conversion-of-500mhz-tds744a-to-1ghz-tds784a/msg568463/#msg568463

Regards,

Jay_Diddy_B

[TheSteve]

OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz. This is all rather logical and what we would expect to see. I am sure the behavior of the 350/500 MHz board/models are inline with this. So whatever portion of the circuit is able to switch between 100 and 200 MHz is where we need to look to modify the upper bandwidth limit.
As jumper values are used to set the model bandwidth/minimum displayed timebase but not the actual front end bandwidth it would seem the physical bandwidth limits are "programmed" via resistor/capacitor/inductor in the front end or a different front end ASIC is used for each of the model series and those fixed limits are simply selected via the processor.

[Pinkus]

As jumper values are used to set the model bandwidth/minimum displayed timebase but not the actual front end bandwidth it would seem the physical bandwidth limits are "programmed" via resistor/capacitor/inductor in the front end or a different front end ASIC is used for each of the model series and those fixed limits are simply selected via the processor.

Right, I doubt too it is in done software. There is no reason for this jumper/resistor ladder to differentiate different models if the information about the model (bandwidth) is available in the software anyway.

[memset]

OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.

I think that software-based bandwidth reduction is made by digital filtering in ASIC.
Still there are frontend BW and system BW. I'll try to measure frontend BW by probing its output.
I hope some new pictures from 3104A or unsheilded 3054A would arrive soon.

[Howardlong]

OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.

I think that software-based bandwidth reduction is made by digital filtering in ASIC.
Still there are frontend BW and system BW. I'll try to measure frontend BW by probing its output.
I hope some new pictures from 3104A or unsheilded 3054A would arrive soon.

When I get a moment I will take it apaaaart again and see how easy it is to remove a shield. Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.

Regarding the 50 ohm path, you mentioned earlier that this is different between various BW versions, what was it that leads you to this conclusion? I am not saying you're wrong, just interested to understand.

[memset]

When I get a moment I will take it apaaaart again and see how easy it is to remove a shield. Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.

Regarding the 50 ohm path, you mentioned earlier that this is different between various BW versions, what was it that leads you to this conclusion? I am not saying you're wrong, just interested to understand.

Shileds are on 4 surface-only solder points (by corners), very easy to unsolder.
Both side photos of unshielded input path would be very useful to check for possible component difference between 200 MHz and 500 MHz versions.

50 Ohm path is different for 1GHz version only. I think something like on this photo:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/
could be found inside 3104A. K201 and 6-pin through hole relay should be used in 1 GHz 50 ohm path.
500 MHz version use simplified 50 Ohm path via K203. Note that K201 and K203's control paths are the same. So K203 should be unpopulated in 1 GHz version.
Unfortunately 200 - 500 MHz boards miss most of required components and routes. You can examine unshielded photo to see some unpopulated components and even floating pads near input ASIC. Floating pads may indicate that AFE PCB design was imported from full-featured scope version and cut down to remove 1GHz path components.

BTW, I've read through MSO7000 series upgrade thread. Looks like BW hack wasn't finally found for these series.

[memset]

Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.

If you have a sig gen and 1GHz scope with differential probe you can tap AFE's output just before and/or after output AA filter. Try to feed in 100 MHz, 500MHz and 1GHz sine signals of the same amplitude and measure output amplitude. I'll try to do the same on my 200MHz board. I think I'll be able to arrange such setup with an extra scope at the end of the week.

[Howardlong]

From the 3054a. Sorry about the picture quality today, my decent camera seems to be DoA today :-(

[TheSteve]

Excellent pictures Howard - a quick scan shows there is a different value inductor near C520 and a different resistor(2150 vs 1100). The Agilent part # on the ASIC looks to be the same - 2AD2-0001. I am sure there are more differences but those few jumped out at me.

[Carrington]

I was planning to do the same with my MSO6034A. Now I have a good LCR/Impedance analyzer (see link below) to measure some critical components (inductors). But I need a good RF signal generator.

www.thestuffmade.com/ImpedanceAnalyzer

[memset]

Amazing photos, Howardlong!
Definitely some (filter?) networks are different.

Before I've got your pictures I've used Dave's 3054A backside photo to see different inductors on this big star-shaped network.
After some reversing I've found the top network of C520-inductor-110R and bottom network of R519-inductor-STAR-inductor-162R are switched at C520/R519 end via K502 relay directly to the input BNC, regardless of AC/DC and impedance settings. Interestingly, all 3 capacitor-coupled parts of the star are grounded at capacitor ends.
K502 relay is an attenuation selector. Main 1Mohm signal path goes via the second part of K502.
Just to try I've replaced the inductor near C520 to the lesser one and got zero change in the bandwidth.

[Carrington]

Is the same ASIC?



Source: https://www.eevblog.com/forum/repair/keysight-mso7034b-teardown-and-repair/msg964822/#msg964822

[memset]

I think I'll need to determine capacitor values in these C520/R519 networks and replace everything: resistors, inductors and caps.
The problem is I don't understand the schematic and purpose behind these C520/R519 things.

Is the same ASIC?

Yep, that's the same ASIC.

[Carrington]

A simulation can give you some ideas. But yes, you need the correct values.

[memset]

From the 3054a.

Do you have any means to measure capacitors? Without desoldering ofc.
Could you please measure C520 and star's capacitors?

Without desoldering I've got (using Mastech MS8910 handheld smd tester):
C520 - 590pF
star center cap - 18 pF
star rays caps - all 39pF (maybe that's a sum).

A simulation can give you some ideas. But yes, you need the correct values.

Nice! Did you measured the caps or that's some guessed values?

[MarkL]

I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.

Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it.  But if it means unsoldering the front end shield, I'm afraid I'm not up for that.

Thanks for your will to help!
Where are still much interesting with the shields intact:
- AA filter in fine details via the top side window (like Howardlong's);
- relays photo from the smaller bottom windows;
- photo of the board's bottom side (need to remove the main board);
- you can also try to read ASIC marking via the top window.

I'm pretty sure 3000 series 200-500MHz boards are trimmed of 1GHz 50 Ohm signal path routing. Like K201 unpopulated relay switching signal to the dead end.
This Dave's photo from 4000 series could be useful as a reference:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/
That's 200MHz board of 1.5GHz capable series. I think the alternative way for 50 Ohm coupling goes through K201 and further to that big 6 pin through-hole component. K203 may be left unpopulated on 1GHz board.

Ok, here ya go:

  http://www.employees.org/~markl/msox3104a_pics_2.zip

The photos of the back are right half, left half, then 6 more zoomed in on a 2x3 grid.  And then a final closeup of a front end from the back (picked Ch4) since that's of most interest.

The relay photo might be a little hard to read and it was impossible to get a clean shot of the second one.  But they're both Panasonic AGQ210S4H (qty 2 per channel).

There's a large metal encased something, 6-pin thru hole device under the shield (img_4238.jpg).  The number must be on the top.  It's connected to the 50 ohm terminator and is numbered K504, K404, etc.  Very likely it's the relay for the terminator.  I don't see it in the 500Mhz and less photos.

[memset]

There's a large metal encased something, 6-pin thru hole device under the shield (img_4238.jpg).  The number must be on the top.  It's connected to the 50 ohm terminator and is numbered K504, K404, etc.  Very likely it's the relay for the terminator.  I don't see it in the 500Mhz and less photos.

Whoa! Exactly as expected, completely different 50 Ohm signal path.
Big through hole device must be a Teledyne GHz attenuator relay.

[Carrington]

Do you have any means to measure capacitors? Without desoldering ofc.

Not a good idea, is better measure everything off the board.

[memset]

Yes, measured from a DSO610xA.

Was you able to improve BW on your scope?

Not a good idea, is better measure everything off the board.

I can't ask people to unsolder their scopes into pieces. Also, that's not absolutely necessary for the task.

BTW, I've tried to do some semi-random mods on these networks and got zero change in the BW. Current -3dB frequency is so stable so I'm almost sure it's limited by the software.

[Howardlong]

How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?

[Howardlong]

From the 3054a.

Do you have any means to measure capacitors? Without desoldering ofc.
Could you please measure C520 and star's capacitors?

Without desoldering I've got (using Mastech MS8910 handheld smd tester):
C520 - 590pF
star center cap - 18 pF
star rays caps - all 39pF (maybe that's a sum).

I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)

I do have a Keysight U1733C LCR with SMD tweezers, and a pair of Smart Tweezers. The Keysight will measure nH, but not accurately single figure nH, and certainly not in circuit (I tried!). If necessary for the low value Ls I can put the part a calibrated test fixture and measure on a VNA. I suspect that from the coloured dot and # of turns we can ascertain the L values anyway. Lifted Cs are very easy to measure.

[memset]

How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?

ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.

I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)

Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.

BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.