LeCroy Probus reverse engineering

[ollopa]

I'll dump everything I know about Probus here.  There are bits and pieces of information scattered around the Internet but I think this will be the most complete and accurate repository on the topic.

Let's start with the basics:  Probus is LeCroy's 6-pin header for active probes and probe adapters.  It has +/-12V power, an I2C interface, ground, and a connection to the probe ring.

Images of the connector, the pinout, and probe ring:




In case the image links go bad, the pinout when looking at the face of the scope is:

1 3 5
2 4 6

1 = +12V
2 = -12V
3 = I2C_SDA
4 = I2C_SCL
5 = Probe Ring
6 = GND

The Probe Ring connector forms a voltage divider that is sampled by an ADC and used to determine what type of probe is attached.  For Probus probes this should be type "Bus" which is identified by a 270 Ohm resistor between Ring and GND.  Passive probes use a spring pin to the ring around the BNC connector whereas Probus probes use pin 5 of the Probus header which is tied to the ring.

As an aside, I painstakingly compiled a list of the ADC decision points and associated resistor values as well as the mid-point (maximum margin between decision points) and best selection of E24 resistor.

Setup:  I used a Keithley Sourcemeter to simulate a resistor between the probe ring and ground.  The sourcemeter regulated the current through the circuit which I adjusted to find the scope's decision points.  By measuring the corresponding voltage at the probe ring I could then back-calculate the equivalent resistance between the probe ring and ground.

The ADC column is the number reported by the scope when it first changed from the previous point as reported by service diagnostics.  The current column is the driving current from the sourcemeter and the voltage column is the measured voltage at the probe ring node.  The equivalent resistor values is voltage divided by the current.

The midpoint resistance is the exact middle between two decision points and the E24 column is the nearest 5% tolerance resistor to the midpoint value.  Note that LeCroy uses a 10k resistor in their 10x probes which is fine, though not perfectly centered, and Tek uses 11k in their 10x probes. 

ADC counts (hex)	Probe Type	Current (mA)	Volts (V)	Rmax (Ohm)	Rmid (Ohm)	Rmin (Ohm)	E24 (Ohms)	LeCroy Value (Ohms)
0x3ff	None	0	3.000	Open	--	33046	--
0x3da	1x	.087	2.875	33046	25160	17275	24000
0x3ae	10x	.160	2.764	17275	12889	8503	13000	10000
0x35c	100x	.3	2.551	8503	6224	3945	6200
0x2e5	1xa	.55	2.170	3945	3426	2907	3300
0x2a5	2x	.68	1.977	2907	2548	2188	2400
0x262	5x	.812	1.777	2188	1930	1672	2000
0x220	20x	.943	1.577	1672	1471	1271	1500
0x1dc	50x	1.079	1.371	1271	1110	949	1100
0x195	200x	1.219	1.157	949	831	713	820
0x153	500x	1.348	0.962	713	660	606	680
0x130	1000x	1.416	0.858	606	510	415	510
0x0e8	10xa	1.556	0.645	415	376	337	390
0x0c7	Bus	1.621	0.547	337	256	176	270	270
0x077	BusInt	1.776	0.312	176	112	48	110
0x031	Short	1.921	0.091	48	24	0	--
0x000	Short	1.96	0.000	0	0	0	--

The I2C interface is connected at minimum to (inside the probe) a 24C series I2C EEPROM, usually a 24LC02, and optionally one or more I2C IO expanders (PFC8574).  The EEPROM write-protect is pulled high and must be shorted to ground to enable erase/write.  Typically there is a 2-pin 100mil header inside the probe for this purpose.  The address lines are all tied low.




The contents of the EEPROM are arranged into order-independent packets with a two-byte header.  The first byte is the packet type and the second byte is the packet size (including the two header bytes).  Although firmware can read and parse packets that are out of order, it is best practice to store them in ascending order by the packet type byte.

At a bare minimum the probe needs to implement the model name packet or else the probe will not be identified.
The list of recognized probes and adapters is hard-coded in firmware as are some of the default probe parameters.  For example probe input capacitance and bandwidth typically (maybe always?) come from hard-coded values in firmware rather than from the EEPROM data.  So if you are making your own probe you most likely need to fake an existing model or else be faced with this:






Let's look at a simple example for the AP100 probe.  EEPROM contents are very short:
01 08 00 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0A

Begin parsing by looking at the first two bytes, 01 08.  This is type 01 (model name) and size 08:
01 08 00 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0A

So the first packet consists of the first 0x08 bytes:
01 08 00 41 50 31 30 30
The next packet is type 0x011, 0x06 bytes:
11 06 00 00 A0 40
Then type 0x12, also 0x06 bytes:
12 06 AE 47 81 3F
Then type 0x36, 0x03 bytes long:
36 03 00
And finally it ends with type 0x38, 0x07 bytes:
38 07 31 30 30 EA 0A

As mentioned before, packet type 0x01 is the probe model name.  It begins with a null byte for some reason (all values of this byte seem to be ignored) and then comes the name in ASCII.  (41 50 31 30 30 = AP100)
Type 0x04 is the probe serial number.  Sometimes it is in ASCII (AP022) and other times the hex values of the data are displayed (AP021).
Type 0x38 is an ASCII string for the coupling label, though it appears to be overridden by hard-coded firmware values (you can change the value in the EEPROM but it doesn't reflect in the GUI).  It seems to always be terminated with a line feed (0x0A).

There are many other packet types but I am so far unable to determine what their significance is.

Type Code	Meaning	Storage Type
0x01	Probe model name	ASCII with a leading null
0x04	Serial number	ASCII or sometimes decimal
0x11	Attenuation attribute	Single point precision float, reversed bytes
0x38	Coupling	ASCII with line feed terminator
0x41	Delay attribute	Single point precision float, reversed bytes
0x62	BW in GHz (newer probes like ZD200)	Single point precision float, reversed bytes

Attached is a zip of EEPROM data for 139 different probe types.  Maybe somebody will join me in trying to decode the many other packet types.

[Mechatrommer]

seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body. if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

[tv84]

seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

Here it is.

[ollopa]

seems inlined with the report here..
https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=

there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.
https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/

I've seen that thread before but I'll remark that 1) the pin numbering in that post is incorrect and 2) the resistor value table I created is more precise and complete.

The pin numbering correction I made matches the schematics:

as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body.

Interesting but there has to be something there for the scope to detect the probe.  My guess is that the probe ring resistor is switched in after power-up.  Perhaps the differential probes have a microcontroller on the I2C bus with a slow startup or some other requirement to delay Probus enumeration.  I'll see if my AP033 AP034 behaves this way.

if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

I believe I've used this arduino library successfully before:  https://github.com/jlesech/Eeprom24C01_02

[Mechatrommer]

The pin numbering correction I made matches the schematics:
https://i.ibb.co/Br046Nh/Pro-Bus-Schematic.jpg

now where did you get that schematics?

[ollopa]

There are a couple of service manuals for the older scopes floating around.  It's also the industry standard pin numbering for female 2-row headers.

[MilkmanCDN]

now where did you get that schematics?

Yep, they're readily available from various online sources.    Here's a schematic snippet from an older WaveRunner front-end.   Same thing.

[MilkmanCDN]

if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

You can also use something more readily available like an Aardvark (TotalPhase).    I just used mine this evening to pull down the EEPROM contents from 2x PP090 probes.    They match exactly what ollopa included in the EEPROM dump.

[Scratch.HTF]

I've seen ProBus modules which contain license keys for certain options (one of which was for Telecom Mask Testing) which can be transfered scope to scope.

[ollopa]

as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body.

Interesting but there has to be something there for the scope to detect the probe.  My guess is that the probe ring resistor is switched in after power-up.  Perhaps the differential probes have a microcontroller on the I2C bus with a slow startup or some other requirement to delay Probus enumeration.  I'll see if my AP033 AP034 behaves this way.

And so another evening was spoiled   I measured between pins 5 and 6 of my AP034 differential probe and sure enough, it was open-circuit.  Next I connected my dual tracking power supply to +12V/-12V/GND of the probe and measured resistance across pins 5 and 6.  It measured 270 Ohms somewhere between 1 and 2 seconds after turning on the power supply.  In fact the probe ring resistor being switched in exactly coincided with the x1 LED on the probe turning on.

So it seems my info was good:  Active probes use 270 Ohms / BUS identification and apparently probes with slow booting logic will hold off enumeration until it is configured / booted.

In the case of the AP034 I think it's a replacement for the I2C IO expanders.

The hardest part about taking this probe apart are the buttons.  There's not much poking out to get a grip on but they need to be removed before the PCB can slide out:
 

A little bit of a surprise once it's out:  A chunky PLD with way more IO than is necessary and two PCBs mated together with 4 tiny headers:


You can see pin 5 going straight to top-left header pin in this photo:


And if you follow it on the mating PCB it heads over to a resistor switched in by a transistor:


That resistor measured 267 Ohms across it.

You can also use something more readily available like an Aardvark (TotalPhase).    I just used mine this evening to pull down the EEPROM contents from 2x PP090 probes.    They match exactly what ollopa included in the EEPROM dump.

PP090 is a 75 Ohm adapter so it's pretty basic and I guess that's why the EEPROM is a perfect match.  Let's break it down:

01 08 00 50 50 30 39 30:   0x01 = probe model name, 8 byte packet, 0x00 dummy byte, ASCII "PP090"
11 06 00 00 00 40:         0x11 = Attenuation attribute 6 byte packet, data = 0x00000040 = divide by 2
36 03 00:                  0x36 = Unknown 3 byte packet, data = 0x00
38 06 37 35 EA 0A:         0x38 = Coupling options,  6 byte packet, ASCII "75" Ohm symbol extended ASCII), line feed
41 06 3F E3 7C 2F:         0x41 =Delay (single precision float, 230ps)

Unfortunately not a very exciting EEPROM.  There's no serial number (0x04) and likely no cal or anything else.

I have 2 AP022's and the only difference between them is one byte of the serial number.
It could very well be that some of the EEPROM data is only parsed by the older VxWorks scopes and X-Stream only pays attention to the model name and serial number. 

[ollopa]

I've seen ProBus modules which contain license keys for certain options (one of which was for Telecom Mask Testing) which can be transfered scope to scope.

Hi Scratch,

That would be the PP100 which looks like this:
01 08 00 50 50 31 30 30     0x01 = name = "PP100"
53 04 00 02                       0x53 = ??   Count of licenses maybe?  0x002
61 0D 00 4D 54 30 31 2C 4D 54 30 32 00  "MT01,MT02" and a null terminator

Very easy to fake.  These are not actual instrument licenses, though.  For example if you put "I2C" in there you will not get the I2C protocol decode option.

These wind up in a different option store as mentioned in the manual on the SCPI command to retrieve the list of custom application options:

The CU_OPT? query identifies options currently enabled due to the
presence  of  a  PP100.  These  options  can  also  be  enabled  by  the
normal  ‘option  key’   mechanism.    If  so,  they  are  reported  by  the
*OPT?  query  instead  of  CU_OPT?.    The  response  to  CU_OPT?
consists of a series of response fields listing all the options enabled
due to the presence of a PP100.

RESPONSE FORMAT
CU_OPT <option_1>, <option_2>,...,<option_n><option_n> =
MT01: Mask Tester option for ITU
MT02: Mask Tester option for ANSI
MT03:  Mask Tester for Optical Signals
0: No custom options installed

[ollopa]

OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type:

0x11 = Probe attenuation attribute.

In the PP090 it's divide by 2 and the data is 11 06 00 00 00 40 so 0x00000040 = divide by 2.
In the AP100 it's divide by 5 and the data is 11 06 00 00 A0 40 so 0x0000a040 = divide by 5.
D1305 is divide by 2.828, data is 11 06 81 04 35 40 so 0x81043540 is divide by 2.828.
D1330 11 06 C8 A7 D8 40  divide by 6.770
CP015 11 06 00 00 20 41 is divide by 10 when copied into AP100

This is a single-precision float:
2 = 0x40000000
5 = 0x40A00000
10 = 0x41200000
0x40350481 = 2.82839989662

And another:
0x41 = Delay attribute, single precision float LE

[ollopa]

Refresh the thread and see my updates.  It's actually a single-precision float with the bytes in reverse and represents the probe delay attribute.

230e-12 (230ps) = 0x2F7CE33F as a float.  In reverse that's 3f e3 7c 2f.

Edit:  Added 0x62   BW in GHz (newer probes like ZD200)   Single point precision float, reversed bytes.  See bottom of first post for an up-to-date list of the tags I've identified so far.

[Mechatrommer]

Unfortunately not a very exciting EEPROM.  There's no serial number (0x04) and likely no cal or anything else.

i think an "adapter" like PP090 wont have cal data, the coax cable will just run straight through from input to output, so transfer function should be... 1? i'm interested to see eeprom comparison of active probes like AP020 and AP034. there should be some interesting data thats unique to each probe? i'm thinking to do this kind of work but i cant get to this yet, since i'm locked with other stuffs my desk piled up with things.

OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type:

i ar wun aint no have an PP090 i think its tv84 who provided it..

[MilkmanCDN]

OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type:

i ar wun aint no have an PP090 i think its tv84 who provided it..

No worries.   They were mine.     

[MilkmanCDN]

FYI, If anyone is looking for replacement accessories case used in almost all of Lecroys active probes, you can get them here: 

- https://www.amazon.com/Plano-Small-Sided-Tackle-Box/dp/B0000BY57W

[ollopa]

i think an "adapter" like PP090 wont have cal data, the coax cable will just run straight through from input to output, so transfer function should be... 1?

No, definitely not.  There will be an impedance matching circuit of some sort.  For a wide frequency range and flat response it would likely be a matching pad rather than a tuned circuit or transformer, but I don't know the specs of the PP090 offhand.  In any case with a divide-by-two attenuation attribute the transfer function is definitely not 1. 

 

i'm interested to see eeprom comparison of active probes like AP020 and AP034. there should be some interesting data thats unique to each probe? i'm thinking to do this kind of work but i cant get to this yet, since i'm locked with other stuffs my desk piled up with things.

Yes please post anything you can.  I've compared a couple sets of probes and so far nothing significant has been different.

i ar wun aint no have an PP090 i think its tv84 who provided it..

Oops, sorry to you and MilkmanCDN both.  And thanks MilkmanCDN!

[Mechatrommer]

FYI, If anyone is looking for replacement accessories case used in almost all of Lecroys active probes, you can get them here: 
- https://www.amazon.com/Plano-Small-Sided-Tackle-Box/dp/B0000BY57W

there are also a few in ebay...
https://www.ebay.com.my/itm/Plano-Small-2-Sided-Tackle-Box/282622389504?hash=item41cd9b6d00:g:5EkAAOSwfRdZK9D6:rk:2:pf:0
https://www.ebay.com.my/itm/Plano-Small-2-Sided-Tackle-Box/141990494258?hash=item210f4b0032:g:BvcAAOSw8vZXNILk:rk:1:pf:0
i have that came with D500PT and soft carrying bag. its good because its compact 2 sided, but i'm not fan we have to flip over to get to the other side, the parts inside the other side will fall to the lid under. so for sensitive parts we need to brace with foam or something top and bottom. for my case, it came only to store some clips, mini pins inside a mini plastic bottle, and the lecroy stripline test circuit i guess for calibration or skew testing i dont know. the case not even fit in the probe 2 legged stand and probe's head clip, useless. i have to get another box for them later.

i'm interested to see eeprom comparison of active probes like AP020 and AP034. there should be some interesting data thats unique to each probe? i'm thinking to do this kind of work but i cant get to this yet, since i'm locked with other stuffs my desk piled up with things.

Yes please post anything you can.  I've compared a couple sets of probes and so far nothing significant has been different.

let see what i can do..

now where did you get that schematics?

Yep, they're readily available from various online sources.    Here's a schematic snippet from an older WaveRunner front-end.   Same thing.

in your linked schematics, the resistor to pin 5,4,3 is 33 and 22 ohm instead of 100 ohm in dda5005 and sda6000 wavelink interface (wavemaster series). just to let you people know, and i guess it wont make much difference. i think the voltage divider logic provided by ollopa still applies, if not then we have to redo the test again. attached are pcb for the probe's interface on 5005 and 6000.

and while at it, the rest of the attachment shows whats inside a D13000PS diff probe body. there is no 24C02 (eeprom) chip that i can spot, only a hobby grade pic16f872 chip. some sellers sell this body at insane price they dont know the most expensive is the probe head, this probe body is just interfacing platform any hobby can build at few cents of price, they are crazy. these probe's body (both D13000PS and WL600) can accept D500PT head and i suspect also applies for other compatible head like D600AT-T, D350PT, D300PT et al. the DSO will show nothing when probe's body alone is connected, only shows probe's head ID when the head is connected to the body, so i guess there is also some eeprom chip inside those small probe head, that need some courage and risk to open up, thats where the real money is, we broke that we lose some $K of money. maybe we can just sniff pin 3,4,5 for safer hack.

imo hacking these differential probe is too much, they are specialized lower input impedance lower dynamic range probe. and the very high frequency BW is not easily replicated by hobby if the purpose is to make a 3rd party cheap compatible probe alternative. so maybe we can stick with more general purpose high impedance higher dynamic 1-2GHz probe like AP020 and AP034. i only provide it for food of thought maybe usefull for someone, fwiw...

[JPortici]

yeah, the PIC is probably there to act as eeprom and probably to handle all the trimming inside the probe

[wingel]

Has anyone managed to find a supplier that sells the edge mount BNC push-on connector or the 6 pin header?  For testing one can make do with a normal BNC connector on a cable and a pin header, but it would be nice to be able to build something like that AP034 board.

[Mechatrommer]

btw, i think it will take more than just a eeprom dump hack on a AP020 clone... (the edge mount BNC push-on connector and the 6 pin header can be seen here i'm also looking)

[wingel]

I have found a supplier in China that can sell  a push-on BNC connector similar to the one used in the LeCroy probes.   It's their normal PCB edge mounted BNC connector without the coupling nut.   The LeCroy connector seems to be about 12mm long, the connector I have found is about 17mm long, but if someone is making their own PCB it shouldn't be much of a problem.  Since this is a product from China I don't know anything about the quality yet, hopefully it has decent 50Ohm impedance matching but you never really know until you actually have tested it.

I'm probably going to buy a few of these.  With shipping, import duties and taxes the price should be less than EUR 5 per connector.  I live in Sweden which is part of the European union.  Is anyone else in EU interested in these connectors?  Shipping and all the extra costs will probably be quite expensive, so I could buy a few extra connectors and resell them.  For people outside of EU it's probably easier to just talk to the manufacturer.

As for the pin header, it seems to be a custom connector which one would have to get someone to manufacture specially.  Probably rather expensive to do.  But I think it might be possible to hack something together out of Mill-Max 5107 double tail header pins, an angled 2mm female pin header and some 3D-printed parts.

[wingel]

One more thing.  Could someone who has a LeCroy probe measure the pin header and post the exact dimensions.  I'm trying to find a supplier who can manufacture the connectors just to see how much it would cost, and it would be nice to be able to give them some drawings of the part.

[ollopa]

The mill-max connectors look nice (not the push-pin but standard gold plated round connectors).

I think LeCroy was smart in realizing that the ProBus connector would be plugged and unplugged many times during the lifetime of the scope, so they chose very high quality interconnects with a very smooth finish.  I do worry that using budget square pin connectors with a rough finish may distort and damage the female headers on the scope, especially after repeated use.  Anyway mill-max probably already has or can produce an adequate replacement connector.

For home use you don't really need to reproduce LeCroy's plastic housing and use right-angle connectors on the PCB.  You could just have a straight header on a pigtail that gets pushed into the ProBus connector (just have to be careful about inserting it upside-down!)

[Mechatrommer]

I have found a supplier in China that can sell  a push-on BNC connector similar to the one used in the LeCroy probes.   It's their normal PCB edge mounted BNC connector without the coupling nut.   The LeCroy connector seems to be about 12mm long, the connector I have found is about 17mm long, but if someone is making their own PCB it shouldn't be much of a problem.  Since this is a product from China I don't know anything about the quality yet, hopefully it has decent 50Ohm impedance matching but you never really know until you actually have tested it.

I'm probably going to buy a few of these.  With shipping, import duties and taxes the price should be less than EUR 5 per connector.  I live in Sweden which is part of the European union.  Is anyone else in EU interested in these connectors?  Shipping and all the extra costs will probably be quite expensive, so I could buy a few extra connectors and resell them.  For people outside of EU it's probably easier to just talk to the manufacturer.

As for the pin header, it seems to be a custom connector which one would have to get someone to manufacture specially.  Probably rather expensive to do.  But I think it might be possible to hack something together out of Mill-Max 5107 double tail header pins, an angled 2mm female pin header and some 3D-printed parts.

for non EU members, can you share the source?