Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 744710 times)

kimwu, ikari_01 and 2 Guests are viewing this topic.

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Just completed upgrade to 500MHz on one channel.

Since I don't have a license for 500MHz, my scope became 350MHz.
Effective -3 dB bandwidth is ~400 MHz now. Tested on periodic signal only.
I'll try a 500MHz license command line option later when I'll get possibility to change command line in software.

My next steps are to document changes and revert the scope back to 4GSa/s.
200->500MHz upgrade seems to be easy for anyone with decent smd soldering skill. Upgrade price is negligible as only cheap passive components are to be replaced.

Later I'll continue research on 200MHz -> 1GHz upgrade, as it was my original goal (I want to get good DDR3 debugging capabilities).
For sure 1GHz upgrade its going to be for real nerds only since required components are not routed on the board.
 
The following users thanked this post: Pinkus, Andrew, tonyc

Offline trevwhite

  • Frequent Contributor
  • **
  • Posts: 841
  • Country: gb
Okay this is seriously impressive, well done!
 
The following users thanked this post: Andrew

Offline HighVoltage

  • Super Contributor
  • ***
  • Posts: 4594
  • Country: de
It works again,
- 500 ps rise time
- 2 ns fall time
Both are the same as before I opened the case and can.

And the seal is not even broken.

There are 3 kinds of people in this world, those who can count and those who can not.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Nice to hear your scope is OK after reassembly!
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
I've updated all channels now to 500MHz with ch 4 left for experiments on 1GHz BW.
I'm surprised how I see 2nd Nyquist frequency on this channel.

Can someone with 3104A (1GHz model) and 3054A (500 MHz model) and a 2.5GHz signal generator try to do a test:
- connect sig gen to one input via direct coax;
- select 50Ohm coupling and turn on both adjacent channels (1 & 2 or 3 & 4) to get half of the sampling freq (2GS/a or 2.5GSa/s) on each channel;
- set sig gen to 10 MHz 0 dBm and make sude incoming signal is ~220mV RMS;
- set sig gen to: 2010 MHz for 3054A and 2510 MHz for 3104A.
- can you see anything like an untriggered 10MHz signal at 5mV/div? If yes, stop acquisition and get an RMS reading.

Note: even on 2GSa/s you'll need to use 2010MHz, not 1010MHz due to specific ADC.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.
 
The following users thanked this post: Andrew

Offline HighVoltage

  • Super Contributor
  • ***
  • Posts: 4594
  • Country: de
Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

« Last Edit: July 18, 2016, 07:22:05 pm by HighVoltage »
There are 3 kinds of people in this world, those who can count and those who can not.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

Thank you for the test! I expect in on the same channel, ch 2 in your case. Very little amplitude. Just keep ch 1 on to downgrade sampling rate.
« Last Edit: July 18, 2016, 07:31:00 pm by memset »
 
The following users thanked this post: Andrew

Offline HighVoltage

  • Super Contributor
  • ***
  • Posts: 4594
  • Country: de
Ahh, ok.

Well there seems to be a 10 MHz signal in the hiding
There are 3 kinds of people in this world, those who can count and those who can not.
 
The following users thanked this post: Andrew, memset

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Well there seems to be a 10 MHz signal in the hiding
Oh, thanks for the test!
Now I better understand why they use 5GSa/s on 1GHz model. 1GHz's output LPF is slow fading. For 4 GSa's 2010 MHz signal can clearly be seen via 1 GHz-like filter. It's much better at 2510 MHz - almost nothing could be seen.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.

A follow-up for the previous info: after user cal trigger is back to normal timing.
Still I can see how the signal curve fluctuates around trigger point as I change test signal frequency from 10MHz to 350MHz. Total drift is about 1ns. Can't say yet if it's normal or not because all my channels are now modified. Could be result of unexpected phase response of the new filters. Need to check pulse response to see the edge.
Also I see some BW decrease after user cal. It was like 400MHz at -3 dB level. Now its 360MHz at -3dB level.

My user cal fixture was of awful quality and scope remained in a half-disassembled state. I'll rerun user cal after the scope is fully reassembled, shielded and equipped with better user cal fixture. That's my last chance to improve accuracy.

Anyway, I consider 500 MHz upgrade to be done, although it would possibly compromise scope's accuracy  :-BROKE
Will post upgrade details asap.
 
The following users thanked this post: Andrew

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5049
  • Country: gb
Let me know if you want any trigger tests on a kosher unit. 1ns is quite a way out.

In addition, I'd see how you get on with -bw50.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
As expected from Agilent/Keysight, they seem to use top-notch components in sensitive paths. I've used random quality parts from several local shops, like unknown tolerance caps from unnamed sources, etc.
I'll redo the mod using better components when I'll get them in hands. That should improve results a bit.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.

To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.

This is a description of hardware modifications on sensitive signal paths of the scope!
Applying any of these mods will void your warranty and calibration!
Loss of factory calibration and accuracy is inevitable!
DISCLAIMER: do this at your own risk only! Irreversible damage may be caused by these modifications. You've been warned!

Required materials for 4-channel models:
1. Coilcraft 0603CS-15NXG 0603 15nH 2% inductors - 12 pcs
2. Coilcraft 0603CS-27NXG 0603 27nH 2% inductors - 4 pcs
3. 0603 2.2pF NP0 capacitors - 4 pcs
4. 0603 2.0pF NP0 capacitors - 4 pcs
5. 1206 110R 1% resistor - 4 pcs
6. 0603 162R 1% resistor - 4 pcs
7. 0603 121K 1% resistor - 1 pcs
8. 0603 46.4K 1% resistor - 1 pcs

User cal fixture is required for post-modification calibration.

BACKUP NOTE: save all removed components in separate places for each position and channel to secure way back to original values!

Modification process (see attachments for pictures):
1. For each channel replace yellow-marked parts as follows:
AFE top layer (afe_top_layer_mod.jpg):
L1: 100nH(?) -> 15nH
R1: 215R -> 110R
L2, L3: 47nH(?) -> 15nH
C1: 4.7pF -> 2.2pF
C2: 4.7pF -> 2.0pF
AFE bottom layer (afe_bot_layer_mod.jpg):
L4: 100nH(?) -> 27nH
R2: 261R -> 162R
2. Replace two board strap resistors:
Top layer near CPU (gnd_straps.jpg):
Strap resistor L1: 10K -> 46.4K
Bottom layer under CPU (2v5_straps.jpg):
Strap resistor H1: 100K -> 121K

NOTE: all capacitor values are guessed or measured and may not be 100% correct.

Run a brief per channel check of scope functionality before fully reassembling the scope. For a final assembly be sure to mount all shields and covers. Run User cal procedure with a high-quality user cal fixture to compensate replacement of AFE components.
Done, you'll get a 350MHz scope. 350MHz to 500MHz upgrade is software-only and possibly discussed elsewhere.

I'd like to thank all eevblog members who contributed to this mod with their knowledge and time and did measurements on their scopes.
This wouldn't be possible without their kind help.
« Last Edit: July 20, 2016, 02:13:17 pm by memset »
 
The following users thanked this post: Pinkus, benst, Sparky, Relaxe, [IDC]Dragon, Andrew, tonyc, Belgarath

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3269
  • Country: ca
  • Living the Dream
Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.
VE7FM
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

If you're up to perform the mod, sacrifice single less-used channel first to check results. But I think you'll need to modify all channels to run user cal with meaningful results. And w/o user can the scope won't behave properly.
For caps I'm not even sure in that 2.2pF/2.0pF difference. These caps well may be the same value ranging from 1.8pF to 2.2pF.
About inductors, CS series is just a guess. For <500MHz range HP shouldn't have any real preference. But if you'll buy both and try to find any visible difference between them we'll maybe able to distinguish them better. As for me I've used Murata LQW18A series because Coilcraft wasn't available in local stores.

On -3dB BW, right after the mod I've got 400MHz at -3dB. After user cal BW has been decreased to 360MHz (no 500MHz license in my scope). I have no idea why.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?
I don't think its a good idea for 500MHz BW because there are no such model in 3000 series and its software may behave erroneously in such a chimera. But you can give it a try if you want. It works.
« Last Edit: July 20, 2016, 08:45:16 pm by memset »
 
The following users thanked this post: Andrew

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5049
  • Country: gb
Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

2pF and 2.2pF were measured out of circuit and cross checked using three testers, and Agilent U1733C with SMD tweezers at 100kHz, Smart Tweezer ST5L at 10kHz and a Peak LCR40 at 200kHz with SMD tweezers. Parasitic capacitances on the measurement probes were either nulled out or measured and subtracted from result. There could reasonably be a 5 or even 10% tolerance mismatch there.

I also measured one of the inductors to align with the Coilcraft colour dot codes, and the CS and HP (the CS and HP series seem to share the same colour coding) were the closest correlation. Other series did not correlate with the measurements.

3dB 500MHz bw: 584MHz
3dB 350MHz bw: 377MHz

Measured with HP 8656B 2Vpp, 2m Suhner RG58-sized BNC-BNC cable, and averaging 8 acquisitions. Scope settings 50 ohm, 500mV/div and 1ns or 2ns/div depending on bandwidth limitation.
 
The following users thanked this post: Andrew

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5049
  • Country: gb
Rise times:

500MHz: 640ps
350MHz: 970ps

Source is HP 54121T in TDR mode with system rise time measured at 33ps.
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3269
  • Country: ca
  • Living the Dream
Thank you for the information guys. It is very tempting to use Murata inductors here as well. I can buy them direct from Digikey for 10% of the price of Coilcraft who insist anyone in US/Canada must order direct from them.
Ideally I'd like to see if I can match Howard's 3dB numbers and then provide the exact manufacturer/part number for each part I used for others who want to do the mod. I will order the resistors/capacitors from Digikey either way so I may throw the Murata parts in the order, all of them are only a few dollars.

Once the bandwidth mod is done I may experiment with the 5 GS/s mod as well. The 3000t series uses 5 GS/s on all models. Obviously stable performance is the most important aspect of the mod.
VE7FM
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3269
  • Country: ca
  • Living the Dream
I've ordered all of the parts needed for the mod. I also ordered the parts needed to build a Jim Williams pulse generator so I can check rise times as well as 3dB bandwidth with a signal gen. Already had the parts in stock to build the needed BNC patch cables to run user calibration.
I can hopefully build the pulse gen this weekend and then do the scope mod the following weekend once the Coilcraft order arrives.
VE7FM
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
Meanwhile I've tried 500MHz mode and it works well.
 
The following users thanked this post: Andrew

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5049
  • Country: gb
I have a quick comment about reworking these high impedance front ends.

Avoid cleaning the board with anything more than the absolute minimum of IPA or flux cleaner/solvent, and any you do use scrub it off with qtips etc, because residues are conductive enough to very significantly affect things like DC offsets. Once it's found itself inside shelters like relays, it will take a long time to evaporate.

Put some IPA into a small petri dish or other contianer and measure it with your DMM. If you're probing two close pins the resistance can drop to low single digit meg ohms.

Let's just say I discovered that the hard way, and it took a long time for the penny to drop.  :'(
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 136
  • Country: ru
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
This solution will add extra lnk file to the internal ROM to alter the startup process.
That's quite dangerous because you can brick your unit by copying overlong or incorrect lnk file. Prepare lnk file carefully!
I wasn't able to find something different because USB boot is incapacitated in v2.41.

As v2.41's boot process differ from older softwares, this method fits v2.41 ONLY.

Readily included lnk file contains no command line.
Add any options you need, but READ THE INSTRUCTIONS FIRST.

This method works via running supplied 3ka_v241_linkinstall.cab file as software update.
NOTE: supplied .cab file mimics software update process, but contains NO original proprietary files from authentic software update packages.
DISCLAIMER: Use at your own risk only. No one else is responsible for what you do with this software.

!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!


"3ka_v241_linkinstall.cab" file is made to install extra link file into internal ROM's filesystem.
For v2.41 this will enable firmware to run with arbitrary command line string.

Applying this mod to any software prior to v2.41 may lead to unpredictable consequences.
DO NOT use with older software!


Integrity check for cabinet file:
2b75c5ecaecd0837ec8cbd819715a907951bb119  3ka_v241_linkinstall.cab

Code: [Select]
How to install extra link to run firmware with custom command line:
------------------------------------------------------------------
1. Prepare infiniivision.lnk: add desired command line options after .exe file name and recalculate string length.
   lnk format: N#\path\to\file.exe -command_options
   N is 2-3 digits of length value of the following string, including '#' char.
   After lnk file contents are edited replace N with corrent number.
   Maximum lnk file size is 260 bytes including size field itself. Do not exceed this value!
   !!! WARNING Maximum lnk file size is 260 bytes total !!!
   !!! WARNING Incorrect lnk file contents may brick your unit !!!
2. Copy 3ka_v241_linkinstall.cab and infiniivision.lnk to the root folder of USB drive.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
   !!! WARNING It's extremely dangerous to run cab files from unknown sources as they may contain malicious instruction to the unit !!!
4. Unit should reboot and work with extra warning about Unfinalized software.

How to remove extra link to revert to original firmware startup:
---------------------------------------------------------------
1. Copy 3ka_v241_linkinstall.cab to the root folder of USB drive.
2. Delete infiniivision.lnk from the root folder of USB drive or make sure it's not present there.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
4. Unit should reboot and work without any extra warnings.

Troubleshooting:
----------------
1. The hardest problem would be incorrect lnk file leading unit to hang on boot (brick!).
It's only possible to solve that by connecting to the unit via Telnet and removing that incorrect link file:
del \f \Secure\Startup\infiniivision_ext.lnk
 
The following users thanked this post: Sparky, tru, [IDC]Dragon, viki2000, Andrew, pkramer

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5049
  • Country: gb
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
....

Wow!

My infiniivsion.lnk (edit: on an MSOX3054a)
Code: [Select]
63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw50
 
The following users thanked this post: Andrew

Offline tonyc

  • Contributor
  • Posts: 5
  • Country: us
This is really awesome!

I have to specify SCPIPS manually after the -l all argument. Here is my command:

72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
 
The following users thanked this post: Andrew


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf