EEVblog #978 - Keysight 1000X Hacking

[TK]

Thank you Bud.

More tests results: CH1 (yellow) is unmodded, CH2 (green) is modded, now with bypassed low pass filter outside LMH6552.

Tested 1MHz, 50MHz, 100MHz, 200MHz and 250MHz.  Then 1MHz -40dBm signal using 2mV/div setting on the scope.
I think the delay between CH1 and CH2 is because of the elimination of the extra opamp before the differential path.








I was not able to measure the values of the caps and inductors... I don't have the appropriate instrument.

[Bud]

So this is the best result so far, isn't it. After removing the LPF you are getting what, maybe 170MHZ 3dB bandwidth or something. Can you find someone to help you measure the LPF components?

Also try 200MHz 16mV p-p at 2mV/ to exlude the attenuator from the path, to see if some of the roll-off is because of the attenuator.

Looks this puppy may be a great buy, providing everything else works with this hack.

[TK]

So this is the best result so far, isn't it. After removing the LPF you are getting what, maybe 170MHZ 3dB bandwidth or something. Can you find someone to help you measure the LPF components?

Also try 200MHz 16mV p-p at 2mV/ to exlude the attenuator from the path, to see if some of the roll-off is because of the attenuator.

Looks this puppy may be a great buy, providing everything else works with this hack.

I need to find the values and make the substitution, CH2 is noisy without the LPF, but the hack looks promising

[TK]

The DSOX3000 200MHz scope has C1,C2 = 4.7pF and L2,L3 = 47nH in the LPF outside the differential opamp.  If I use the same values in my 1000X, I should get a LPF with cutoff frequency above 200MHz, right?

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126

Ordered the parts from mouser... next week I will post the results.

[TheSteve]

I am not sure if the inductors in the 200 MHz version of the scope are really 47 nH, they might be 30 nH.

[TK]

What can happen if I use the values of the 500MHz frontend LPF?

Ordered more parts from mouser to try, I will also test 30nH

[TheSteve]

I'll do my best to measure one of the inductors from a 200 MHz front end tomorrow. I have the gear but need to build a jig to connect the 0603 sized part to my VNA.
I doubt you'll get to 500 MHz with the 1000 - aiming for 200 MHz is a good target.

So nobody with a stock DSOX1102 has wanted to try enabling the 200 MHz license to see what happens?

[Bud]

I am not sure if the inductors in the 200 MHz version of the scope are really 47 nH, they might be 30 nH.

30nH seems to be too small, a sim shows the filter 3dB BW almost at 400MHz.  47nH looks OK.

[Bud]

I doubt you'll get to 500 MHz with the 1000 - aiming for 200 MHz is a good target.

It already rolls off too much at 200, perhaps being limited by what is in front of the buffer amplifier, or by non optimal PCB tracks layout for that frequency range.
Even with 200 it looks a good value for the money.

[TK]

Sorry for the confusion, I just wanted to ask what the side effects could be by using the LPF components of the 500MHz front end, as they are the only known and confirmed values.

[Bud]

A noisier trace, because of the wider noise bandwidth.

[TheSteve]

Just wanted to confirm the 200 MHz low pass filter in the DSOX3000 series of scopes uses a 47nH inductor. I tried like heck to get a better focus on the jig itself without success. It is an SMA jack with a tiny pogo pin that will hold 0603 sized parts.
edit - added the capacitor as well which does appear to be 4.7 pF.

[TK]

Just wanted to confirm the 200 MHz low pass filter in the DSOX3000 series of scopes uses a 47nH inductor. I tried like heck to get a better focus on the jig itself without success. It is an SMA jack with a tiny pogo pin that will hold 0603 sized parts.
edit - added the capacitor as well which does appear to be 4.7 pF.

Thank you for measuring the components.  Nice fixture for the Network Analyzer!!!

[nickdepinet]

I've been working with TK on the software unlocks side of things, and it looks like the 1000x series is in the same spot as the 3000T. However, we don't yet have an unlocked infiniivisionlauncher.exe (maybe in the first firmware update?) to look through. I'm going to investigate the new 3000T one and see what differences we can find there. We've been proceeding carefully because without a Lan port unbricking the scope looks to be difficult to impossible. Additionally, we can't fake the installed licenses on the scope without finding the key and algorithm used to generate the signatures, each stored license is signed.

I can't test the 200Mhz performance from the software unlock we have currently on my DSOX, so if someone with a 100Mhz DSOX and the ability to test the 200Mhz performance wants to try it out and help us see what the hardware limitations are on the DSOX line please PM me.

[TK]

I tested rise time on the unmodded (CH1 yellow) and modded (CH2 green no LPF after differential opamp) channels.  Signal is eMMC clock signal from BeagleBone Green board.




As a comparison, I only get 6.5ns rise time on the micsic TO1104 (1GSa/s 4 channel table scope).  Actually, to be fair to the micsig, I would like to comment that the EDUX I have has the personality set to DSOX and it has the software hack that enabled 200MHz.  I am using the same 200MHz probes on both tests.

[nickdepinet]

So with some raspberry pi jankiness I can generate a 200Mhz signal^TM. This is really the limit of what you can get out of the GPIO pins on a raspberry pi, so things are a lot wonky...

However, if we only look at the voltage measurements on my DSOX1102G - 200Hz signal gives us 4.5 volts.

Things get really wonky at high frequencies - the raspberry pi really doesn't like generating this signal... But, we can see some interesting voltages:

Stock Firmware: 2.38V -- That's a loss of ~5.5dB
Unlocked Firmware: 3.43V -- That's a loss of ~2.4dB

So it looks like the DSOX line can natively do over 200Mhz with only software tweaks - no hardware mods needed... We just need to figure out unlocking 200Mhz while retaining access to licenses - modded software removes all licensed options and can't install any new ones (reverting to stock software re-enables these). Additionally - the modded software removes the limits on the wave gen (Can set crazy values like 200Mhz pulse) - but doesn't actually output any signal 

[TK]

Hardware mod for CH2 is done.  200MHz using the software hack infiniivisionLauncher.exe from Secure.  It can get comfortably up to 200MHz and 215MHz is kind of the absolute max regarding frequency measurement.

I got an MSOX2004A the other day and I compared the modded EDUX to the MSOX2004A (software hacked to 200MHz).  The MSOX2004A can get up to around 350MHz.

In the pictures CH1 (yellow) is the unmodded channel, CH2 (green) is the modded channel.

[TheSteve]

Hardware mod for CH2 is done.  200MHz using the software hack infiniivisionLauncher.exe from Secure.  It can get comfortably up to 200MHz and 215MHz is kind of the absolute max regarding frequency measurement.

I got an MSOX2004A the other day and I compared the modded EDUX to the MSOX2004A (software hacked to 200MHz).  The MSOX2004A can get up to around 350MHz.

What is is most important is the -3 dB point or the scopes rise time. The MSOX2004A should have a -3 dB point around 230 MHz.
Can you measure that on both? Feed in 1 Vpp with a 50 ohm termination and increase the frequency until you you get to .707 Vpp. The amplitude should also remain quite flat as the frequency is increased with no sudden peaks or drops.

edit - I should add that I believe it may be possible to get the MSOX2004A up to 500 MHz bw with some part swaps, this isn't confirmed though.

[Bud]

200MHz using the software hack infiniivisionLauncher.exe from Secure. 

While you are fresh at it, can you post a link to the software hack procedure ?

[JiriB]

Yes, BenchVue with EDUX works great. Test Flow will allow you to program, for example, sweep (https://community.keysight.com/thread/25100). You need a license or 30-day trial.

[TK]

200MHz using the software hack infiniivisionLauncher.exe from Secure. 

While you are fresh at it, can you post a link to the software hack procedure ?

I detailed the procedure here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1224021/#msg1224021

This is the makecab configuration file I used:

Code: [Select]

.OPTION EXPLICIT

;    CabinetNameTemplate is the name of the output CAB file:

.Set CabinetNameTemplate=1000X.link.install.ksx

.Set DiskDirectory1=.
.Set CompressionType=MSZIP
.Set Cabinet=on
.Set Compress=on
.Set CabinetFileCountThreshold=0
.Set FolderFileCountThreshold=0
.Set FolderSizeThreshold=0
.Set MaxCabinetSize=0
.Set MaxDiskFileCount=0
.Set MaxDiskSize=0

1000X.link.install\infiniiVisionSetup.cab

1000X.link.install\install.xml
I started with the V421_link_install method, renaming and modifying recipe.xml to install.xml

The infiniivision.lnk file content I used:

Code: [Select]

62#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l BW10
But it is not taking the options.  Even with BW10 it activates 200MHz but no other software option and you lose the official licenses while you are in hacked mode.

[JiriB]

Why 62 # and not 63 #?
LEN("#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l BW10") = 63
Opinions counting # differ...
Thanks

[TK]

You must count the characters AFTER #

[Keysight DanielBogdanoff]

Additionally - the modded software removes the limits on the wave gen (Can set crazy values like 200Mhz pulse) - but doesn't actually output any signal 

It's not unreasonable to get extra capabilities out of the WaveGen, we limit it now to match specs. But, you theoretically could get a "souped-up" WaveGen that has questionable specs. For example, it's probably trying to do the pulse you described but can't get there. But, you could likely push it beyond current as-shipped limits.

[bitseeker]

That sounds like classic HP gear. You can push them beyond the specified limits, but there's no guarantee they'll deliver the stated accuracy when doing so.