Has anyone hacked or cracked OWON XDS series?

[Plasmateur]

I'm considering to purchase an OWON just for the higher bit resolutions - for a dedicated application I have in mind.

I want the functionality of a XDS3204AE and was wondering what base model I could purchase in order to crack it up to this model. Searching on the internet I haven't found too much information on this.

Link to scopes - https://www.owon.com.hk/products_owon_xds3000-e_series_4ch_8_|_14bit_touchscreen_digital_oscilloscope

Also, searching EEVBlogs I see a few threads and discussion about OWON scopes, but not nearly the amount that are found on Rigol or Siglent. Overall the sentiment seems pretty negative. I've also watched both of Dave's videos on the XDS3202A and he stated that scope wasn't all that bad, but it wasn't good either.

So from all of this, I figured, if I can get a base model like the XDS3064E and crack it up to a XDS3204AE, I wouldn't mind spending sub $500 on a scope like this. With that said, has anyone hacked this? If not, any suggestions on how I go about getting started on doing that myself?

[maxwell3e10]

I have a few XDS scopes and generally like them. They are not without problems, but it's nice to have high vertical resolution, larger memory and larger screen than a basic scope.  Higher bandwidth doesn't make that much sense since 12 bit is limited at 500 MHz sample rate for one channel. So XDS3064AE and XDS3062A are mostly sufficient and they do have a little larger bandwidth than spec. There is also a cheaper XDS2102A model. One can also get relatively inexpensively touchscreen, build-in function generator and internal battery options. So, it's a cheap version of "high-end" scope.

I am not aware of hacking attempts and to what extend the hardware already exists in lower models.

[Kosmic]

I don't think anyone hacked a Owon XDS scope. That been said this guy (http://blog.weinigel.se/2016/05/01/sds7102-hacking.html) did a lot of reverse engineering on a older model (SDS7102). I guess the XDS series share a lot similarities.

[mawyatt]

I have a few XDS scopes and generally like them. They are not without problems, but it's nice to have high vertical resolution, larger memory and larger screen than a basic scope.  Higher bandwidth doesn't make that much sense since 12 bit is limited at 500 MHz sample rate for one channel. So XDS3064AE and XDS3062A are mostly sufficient and they do have a little larger bandwidth than spec. There is also a cheaper XDS2102A model. One can also get relatively inexpensively touchscreen, build-in function generator and internal battery options. So, it's a cheap version of "high-end" scope.

I am not aware of hacking attempts and to what extend the hardware already exists in lower models.

Is this actually using true 12 bit ADC? If so, do you know what ADC? Does the vertical channel chain hold-up to the 12 bit resolution? Asking since we are considering this as the Siglent 6000 will not be offered in NA, and the LeCroy is quite expensive for us, we are on a limited budget.

Thanks for any help.

Best,

[maxwell3e10]

There is discussion of ADCs in the EEVblog review. 12/14 bit models use HMCAD1520, I suspect 8 bit model uses HMCAD1511. I posted some data on the noise of XDS3062A here at one point.

[mawyatt]

There is discussion of ADCs in the EEVblog review. 12/14 bit models use HMCAD1520, I suspect 8 bit model uses HMCAD1511. I posted some data on the noise of XDS3062A here at one point.

If you could do an FFT in the 12 bit mode (14 bit if it's available) at maximum FFT resolution for say a clean sinewave 1MHz signal and show result, I would greatly appreciate it. A two tone test would show how good the ADC and input amplifiers are, we've used a tone at 1MHz and at 1MHz +10KHz summed together with a resistive network of 1K & 50 ohm shunt to show the resultant IMD artifacts, but this is a lot to ask.

Thanks so much 

Best,

[maxwell3e10]

Does this help:
https://www.eevblog.com/forum/testgear/signal-quality-of-budget-waveform-generators/msg3047624/#msg3047624

[mawyatt]

Were those FFT plots generated within the DSO using it's built-in FFT feature, or generated with an outside software routine acting upon a data file from the DSO?

Edit: Having looked more into the valuable plots you've done. If these 25MHz tones were created by the DSO and not the generator as mentioned, this points to the scope input circuits prior to the HMCAD1520 ADC. This ADC has a SFDR of 60~75dB in 12 bit mode (data sheet), so if this is a legit AD part then the additional distortion must be coming prior to the ADC, thus pointing to the scope "front end". This is what we feared OWON had done, simply replace an 8 bit input channel and ADC with a higher resolution ADC but still using the same front end designed for 8 bit use, so the overall result isn't much better than 8 bit performance from a usable dynamic range standpoint.

If Siglent could use this 1520 ADC with the superb front end design in the SDS2000X+, one might benefit from the full DR of the 1520 ADC
A True 8/12/14 Bit, with ERES on top of that, and all the features in the SDS2000X+ baseline MSO would emerge

Don't think the competition would like to see that 

Thanks so much for the information



Best,

[maxwell3e10]

The analog input circuit is not so bad, since for shorted input the spectrum is pretty clean. Also see this comparison to other scopes
https://www.eevblog.com/forum/testgear/owon-xds3062a-input-noise-(good)-and-glitches-(bad)/msg1433850/#msg1433850

I think the broad artifacts that appear when a signal is applied are due to clock jitter.

[mawyatt]

The noise level certainly looks good on the input, but I was more concerned about the linearity of the input chain to the ADC. The classic two tone IMD will show this. BTW we have two of the SDS2000X+ and can confirm the low input referenced noise on these.

Best,

[seronday]

Atttached are screen prints of a 2 Tone Test with a 12 bit OWON XDS2102A and Siglent SDS2000X plus.

The signal source is a Rigol DG4062 generator with Ch1 set to 1.0Mhz and Ch2 set to 1.01Mhz and then combined via 1K resistors to the 1M ohm Ch1 input on the DSO. 

The Owon XDS2102A is the lower cost version of the XDS3000A series. ( the main circuit board in the XDS2102A is marked as XDS3000 ).

Regards.

[mawyatt]

If you don't mind could you redo this test with a ~100 ohm shunt resistor to ground at the sum of the 2 1K resistors (this helps isolate the two signal sources better). Since the OWON FFT doesn't have the resolution of the Siglent FFT, increase the 2nd frequency for a 20KHz offset (10.02MHz) which may show the 3rd order products (F1 -deltaF, F2+deltaF, where deltaF = F2-F1) a little better on the OWON.

BTW what's the difference between the lower cost XDS2102A and the XDS3000A?

Thanks so much for the test, much appreciated

Best,

[maxwell3e10]

This calls for a Wavetek 195 generator which has 4 channels that can be all summed internally. Incidentally, it was manufactured by Aim/TTI  and still sold until recently as Aim/TTi TGA1244 and Fluke 284.

Here is a capture of 0.9 MHz, 0.99 MHz, 1.01 MHz and 1.1 MHz sine waves, each 2Vpp. The vertical scale is 10 dB/div.  One can get SFDR of 60 dB, its probably better than that since little peaks are just random. If output of the function generator is turned off the noise level goes down another 5dB.

[seronday]

@mawyatt
       Two tone test repeated as requested with 100 ohm termination and 20Khz separation.
Have also applied some averaging to find the IMD signals buried in the noise.

I have not used an XDS3000A DSO, but from reading the spec sheets for both the XDS2102A and XDS3000A series, it seems that the main difference being the XDS2102A is offered with none of the options.
The specifications for both are attached.

[seronday]

Picture of XDS2102A main board.

[tv84]

Any UART output, boot log, flash dump, memdump?

[mawyatt]

@mawyatt
       Two tone test repeated as requested with 100 ohm termination and 20Khz separation.
Have also applied some averaging to find the IMD signals buried in the noise.

I have not used an XDS3000A DSO, but from reading the spec sheets for both the XDS2102A and XDS3000A series, it seems that the main difference being the XDS2102A is offered with none of the options.
The specifications for both are attached.

Very nice, exactly what I was looking for. With ~80dB IMD, shows that the input amplifier chain is not limited the DR performance!!

Looks as if the PCB is the same for both 2102A and 3000A.

Thanks so much for the test & information

Best,

[seronday]

Owon XDS series are also re-badged and sold under other names.
MULTICOMP PRO - MP720024 sold by Farnell is a re-badged XDS2102A

Any UART output, boot log, flash dump, memdump?

Attached is the only UART output that I have found.

[maxwell3e10]

@seronday
I was wondering how you got the spectrum "XDS2102A 2 Tone test.png", did you do any averaging? What are the FFT settings? I can't get any better than about -90dB noise level with built-in FFT.

[tv84]

Attached is the only UART output that I have found.

So, as here.

Could anybody sniff the SPI bus, at boot, and dump the loading of the NAND? Should be simple.

[seronday]

@seronday
I was wondering how you got the spectrum "XDS2102A 2 Tone test.png", did you do any averaging? What are the FFT settings? I can't get any better than about -90dB noise level with built-in FFT.

The averaging was set to 64.

All other settings are as shown on the screen print

Regards.

[priitv8]

Dear fellow Owon XDS users!

I can contribute the shots of my XDS3064E internals.
I had to pull the MoBo out of my scope in order to ship it back to factory for warranty repair.
Sorry that I did not take better closeups of the front-end...
I suspect the repair must have consisted of some sort of reflashing or software fix, as I see no signs of any interventions to PCB.
The support person also told me that they are not in a position to replace the MoBo as a unit, so I shall send mine in for repair.

Last but not least - how do you guys charge the battery pack for this scope?
First time it broke down with a no-start condition after 8 months of usage.
I had left it connected to AC power, in turned off state, to recharge the battery.
After some 4 hours of charging, the oscilloscope did not start! Now, just 3 days ago, about a year after I got it repaired in warranty, it happened again!
I can see the splash screen, but after that it turns off.
Only the RUN/STOP button lights up in red, no others have the green light, as they should.
It is very disturbing, that the battery charging can break the whole oscilloscope.
I think it should not be used with the battery at all. Otherwise there is constant risk of having this non-start condition with this device.
Or should I charge the battery only in the powered on state of the scope?

PS Lucky me, I got it back into running state, with the firmware flasher I was sent by support tech the first time. Back then it did not help, hence I was asked to send the MoBo in.

[maxwell3e10]

Thanks. I am curious if on 3064E scope (8 bit) they use HMCAD1511 or use HMCAD1520  and limit it to 8 bit in firmware. I think it's chip U45.

[priitv8]

Thanks. I am curious if on 3064E scope (8 bit) they use HMCAD1511 or use HMCAD1520  and limit it to 8 bit in firmware. I think it's chip U45.

I tried to make most of my shot, and i can see the following:
-the last number is painted over
-the third number is 1, not 2
I shall take the back cover off again and take a better picture.

[maxwell3e10]

It's interesting the last number is painted over. There is HMCAD1510, with maximum sample rate of 500 MSPS,  HMCAD1511 with maximum sample rate of 1000MSPS,  HMCAD1512 with maximum sample rate of 900 MSPS but without support for quad channel mode, and HMCAD1513 with maximum sample rate of 500 MSPS in dual mode only. So they should be using 1511, but I wonder if they managed to use one of the other chips.