Products > Test Equipment

LeCroy Probus reverse engineering

(1/10) > >>

ollopa:
I'll dump everything I know about Probus here.  There are bits and pieces of information scattered around the Internet but I think this will be the most complete and accurate repository on the topic.

Let's start with the basics:  Probus is LeCroy's 6-pin header for active probes and probe adapters.  It has +/-12V power, an I2C interface, ground, and a connection to the probe ring.

Images of the connector, the pinout, and probe ring:




In case the image links go bad, the pinout when looking at the face of the scope is:

--- Quote ---1 3 5
2 4 6

1 = +12V
2 = -12V
3 = I2C_SDA
4 = I2C_SCL
5 = Probe Ring
6 = GND

--- End quote ---


The Probe Ring connector forms a voltage divider that is sampled by an ADC and used to determine what type of probe is attached.  For Probus probes this should be type "Bus" which is identified by a 270 Ohm resistor between Ring and GND.  Passive probes use a spring pin to the ring around the BNC connector whereas Probus probes use pin 5 of the Probus header which is tied to the ring.

As an aside, I painstakingly compiled a list of the ADC decision points and associated resistor values as well as the mid-point (maximum margin between decision points) and best selection of E24 resistor.

Setup:  I used a Keithley Sourcemeter to simulate a resistor between the probe ring and ground.  The sourcemeter regulated the current through the circuit which I adjusted to find the scope's decision points.  By measuring the corresponding voltage at the probe ring I could then back-calculate the equivalent resistance between the probe ring and ground.

The ADC column is the number reported by the scope when it first changed from the previous point as reported by service diagnostics.  The current column is the driving current from the sourcemeter and the voltage column is the measured voltage at the probe ring node.  The equivalent resistor values is voltage divided by the current.

The midpoint resistance is the exact middle between two decision points and the E24 column is the nearest 5% tolerance resistor to the midpoint value.  Note that LeCroy uses a 10k resistor in their 10x probes which is fine, though not perfectly centered, and Tek uses 11k in their 10x probes. 



ADC counts (hex)Probe TypeCurrent (mA)Volts (V)Rmax (Ohm)Rmid (Ohm)Rmin (Ohm)E24 (Ohms)LeCroy Value (Ohms)0x3ffNone03.000Open--33046--0x3da1x.0872.875330462516017275240000x3ae10x.1602.7641727512889850313000100000x35c100x.32.55185036224394562000x2e51xa.552.17039453426290733000x2a52x.681.97729072548218824000x2625x.8121.77721881930167220000x22020x.9431.57716721471127115000x1dc50x1.0791.3711271111094911000x195200x1.2191.1579498317138200x153500x1.3480.9627136606066800x1301000x1.4160.8586065104155100x0e810xa1.5560.6454153763373900x0c7Bus1.6210.5473372561762702700x077BusInt1.7760.312176112481100x031Short1.9210.09148240--0x000Short1.960.000000--

The I2C interface is connected at minimum to (inside the probe) a 24C series I2C EEPROM, usually a 24LC02, and optionally one or more I2C IO expanders (PFC8574).  The EEPROM write-protect is pulled high and must be shorted to ground to enable erase/write.  Typically there is a 2-pin 100mil header inside the probe for this purpose.  The address lines are all tied low.




The contents of the EEPROM are arranged into order-independent packets with a two-byte header.  The first byte is the packet type and the second byte is the packet size (including the two header bytes).  Although firmware can read and parse packets that are out of order, it is best practice to store them in ascending order by the packet type byte.

At a bare minimum the probe needs to implement the model name packet or else the probe will not be identified.
The list of recognized probes and adapters is hard-coded in firmware as are some of the default probe parameters.  For example probe input capacitance and bandwidth typically (maybe always?) come from hard-coded values in firmware rather than from the EEPROM data.  So if you are making your own probe you most likely need to fake an existing model or else be faced with this:






Let's look at a simple example for the AP100 probe.  EEPROM contents are very short:
01 08 00 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0A

Begin parsing by looking at the first two bytes, 01 08.  This is type 01 (model name) and size 08:
01 08 00 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0A

So the first packet consists of the first 0x08 bytes:
01 08 00 41 50 31 30 30
The next packet is type 0x011, 0x06 bytes:
11 06 00 00 A0 40
Then type 0x12, also 0x06 bytes:
12 06 AE 47 81 3F
Then type 0x36, 0x03 bytes long:
36 03 00
And finally it ends with type 0x38, 0x07 bytes:
38 07 31 30 30 EA 0A

As mentioned before, packet type 0x01 is the probe model name.  It begins with a null byte for some reason (all values of this byte seem to be ignored) and then comes the name in ASCII.  (41 50 31 30 30 = AP100)
Type 0x04 is the probe serial number.  Sometimes it is in ASCII (AP022) and other times the hex values of the data are displayed (AP021).
Type 0x38 is an ASCII string for the coupling label, though it appears to be overridden by hard-coded firmware values (you can change the value in the EEPROM but it doesn't reflect in the GUI).  It seems to always be terminated with a line feed (0x0A).

There are many other packet types but I am so far unable to determine what their significance is.

Type CodeMeaningStorage Type0x01Probe model nameASCII with a leading null0x04Serial numberASCII or sometimes decimal0x11Attenuation attributeSingle point precision float, reversed bytes0x38CouplingASCII with line feed terminator0x41Delay attributeSingle point precision float, reversed bytes0x62BW in GHz (newer probes like ZD200)Single point precision float, reversed bytes
Attached is a zip of EEPROM data for 139 different probe types.  Maybe somebody will join me in trying to decode the many other packet types.

Mechatrommer:
seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body. if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

tv84:

--- Quote from: Mechatrommer on February 04, 2019, 01:07:47 pm ---seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

--- End quote ---

Here it is.

ollopa:

--- Quote from: Mechatrommer on February 04, 2019, 01:07:47 pm ---seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

--- End quote ---

I've seen that thread before but I'll remark that 1) the pin numbering in that post is incorrect and 2) the resistor value table I created is more precise and complete.

The pin numbering correction I made matches the schematics:




--- Quote from: Mechatrommer on February 04, 2019, 01:07:47 pm ---as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body.
--- End quote ---

Interesting but there has to be something there for the scope to detect the probe.  My guess is that the probe ring resistor is switched in after power-up.  Perhaps the differential probes have a microcontroller on the I2C bus with a slow startup or some other requirement to delay Probus enumeration.  I'll see if my AP033 AP034 behaves this way.


--- Quote from: Mechatrommer on February 04, 2019, 01:07:47 pm ---if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

--- End quote ---

I believe I've used this arduino library successfully before:  https://github.com/jlesech/Eeprom24C01_02

Mechatrommer:

--- Quote from: ollopa on February 04, 2019, 04:33:43 pm ---The pin numbering correction I made matches the schematics:
https://i.ibb.co/Br046Nh/Pro-Bus-Schematic.jpg

--- End quote ---
now where did you get that schematics?

Navigation

[0] Message Index

[#] Next page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod