EEVblog #978 - Keysight 1000X Hacking

[thuttu77]

I bought EDUX1002A and I have few questions about mods if I do understand right
I need to change model from EDUX to DSOX to get some extra features I think I will ok with 70Mz or 100MHz so proppably SW mod wont needed
just front end mod and EXT trig mod but does Trial Lics or bought lics for DSOX1AUTO work with that then? ar can they even bought.

Nice I need to figure out what resistor(s) I need to change to get it to DSOX mode (I assume that its config 23)

[hv222]

In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005

My scope has PCB REV A004

Which one multiplexer amplifier do you have in scope? I'm not sure. Maybe edux have OPA4872 and dsox have LMH6574.

[TK]

In my scope are OPA4872 are replacing LMH6574 in older version. This amplifiers are in trigger circuit and in analog frontends. My PCB is REV A005

My scope has PCB REV A004

Which one multiplexer amplifier do you have in scope? I'm not sure. Maybe edux have OPA4872 and dsox have LMH6574.

My EDUX have OPA4872 multiplexer amplifiers.  Dave's teardown pictures of the DSOX shows LMH6574.  Cost is similar. 

OPA4872 has 0.1 dB Gain Flatness to 120MHz
LMH6574 has 0.1 dB Gain Flatness to 150MHz

I did not notice this difference before... time to go back and check all the components.

[hv222]

On BLT (ADC) board was also changes between rev 002 and 003. D9LHT is replaced by D9RZH in rev 003. All 0201 resistors dividers around memory are connected with memory pins. Maybe some bias on digital lines.

[TK]

Here it is. Value is 10k 1% Do you know what is part name of BNC connector? I searched in Digikey, Mouser, Farnell and I didn't found it. It have smaller footprint than standard connectors. I want to add generator to my scope. Also capacitors and inductors (from long RL filter) values will be helpful.

OK, I soldered this missing 10K resistor and external digital input seems to work more reliably and self test passes.  User calibration still fails, but it can be calibrated going back to EDUX mode, then back to DSOX for normal use.

I took the scope apart one more time to solder the 10K resistor... I am amazed at the construction quality of this instrument.  It is very resilient and a pleasure to tear down and reassemble.

[hv222]

I found another missing resistor in EDUX. Marking 13A - 133Ohm. Here it is. Photo again comes from Dave's teardown.

[TK]

My EDUX has the 133Ohm resistor.  Maybe it is not needed.

[hv222]

My EDUX has the 133Ohm resistor.  Maybe it is not needed.

That is interesting. Do you have version with generator?

[TK]

Yes, I have the EDUX with wavegen (EDUX1002G)

[hv222]

I starts reverse engineering of my scope. I found another difference between my scope and Dave's photos. It is U29 In DSOX it is R4PC in sot23-5. In EDUX it is R30E in sot23-3. It is very hard to see this difference  This part is in self cal area (located between generator stuff and ch1 analog front end).

[TK]

I starts reverse engineering of my scope. I found another difference between my scope and Dave's photos. It is U29 In DSOX it is R4PC in sot23-6. In EDUX it is R30E in sot23-3. It is very hard to see this difference  This part is in self cal area (located between generator stuff and ch1 analog front end).

Nice catch, I hope it is the reason why self calibration fails on the EDUX when converted to DSOX.

R30E is a CMOS Voltage Reference in SOT-23-3 package.  It is specifically REF3040AIDBZR: 4.096V reference.  Still looking for R4PC, it should be a voltage reference as well.

EDIT: I think it is R4FC, TI LM4132CMFX-4.1.  Also 4.096V voltage reference in SOT-23-5 package... similar to REF3040AIDBZR but it has enable pin

[hv222]

Sorry. I look closer to photos and it looks like R4FC not R4PC. R4FC is LM4132CMF-4.1/NOPB http://www.ti.com/lit/ds/symlink/lm4132.pdf Pin out is matching. But it also is 4.096V ref and enable pin is shorted with vin, so it is no difference in use between these two components

[hv222]

I have almost complete schematic of main PCB. I don't found more hardware differences. I add missing trigger and generator components and it is work. I change resistor divider on main board to have ID 24. I don't change resistor dividers on BLT board, so I have DSOX1002G with 70MHz bandwith. Scope passing user calibration.

Code: [Select]

**** External Trigger Level ****
/1 Trig B1 = 5303.000, B0 = 35789.000
/5 Trig B1 = 1071.000, B0 = 35789.000
/1 Trig 2 B1 = 17283.000, B0 = 28593.000
/5 Trig 2 B1 = 3492.000, B0 = 28593.000
**** CAL PASSED **** Time: 2 seconds


I'm going to make some test with wave gen, because I don't know the right values of capacitors and inductors.

[TK]

I need to check the ext trigger input on my hack... as yours passes the user calibration.  How did you find out the capacitor values (100nF, 33nF)?

[hv222]

Pin 5 of LMV7219 is positive supply voltage and have decoupling capacitor do ground. Typical decoupling capacitor value is 100nF. Pin 4 of LMV7219 is inverting input and these components looks like RC filter. One of these capacitor have same color like capacitor near pin 5. So it's probably 100nF and reasonable value for second one is something smaller then 100n, so i chose 33n. On other PCB side is also 10kohm resistor connected with these components (missing in EDUX version). I guess it is RC filter array making DC from PWM.

[thuttu77]

Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V

[TK]

Before removing everything to get to the back of my PCB... Is the 10K resistor on the back of the PCB the same that you identified in a previous post?  I checked the values on my hack, changed the capacitor from 100nF to 10nF (I don't have 33nF on hand) and still does not pass the user calibration. 

[hv222]

Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V

Try use values from post below. It is about 2000x and 3000x series, but should work. Other resistor values are in Dave videos about 1000x scope.

Here is 3000 series board strapping info. 2000 series and 4000 series are pretty much the same. Pin strapping is done with 8 pairs of resistors. Each pair encode an integer value in 0 to 8 range.
Attached photos were annotated with strap resistor positions. Ln stands for Low (GND) side resistor and Hn is High (2V5) side resistor.
Based on analysis of Dave's teardown photos and my own board I've filled full resistor encoding table and believe it to be correct.
Note the L7 resistor is missing. I think it's routed to external module connector and it's encoding is fixed with 10k ohm high side on the main board.

You can't upgrade your scope just by altering these settings! Strapping represents the real difference in hardware!

Code: [Select]

Strapping resistor encoding
Value - Voltage - Lr/Hr
0 - 0.00V - 10k / none
1 - 0.23V - 10k / 100k
2 - 0.69V - 46,4k / 121k
3 - 0.98V - 64,9k / 100k
4 - 1.25V - 100k / 100k
5 - 1.52V - 100k / 64,9k
6 - 1.81V - 121k / 46,4k
7 - 2.27V - 10k / 100k
8 - 2.50V - none / 10k

Incomplete table of strap functions:

Code: [Select]

Strap 0 (CH 0) Channels:
  0 - 2 Channels
  1 - 4 Channels
Strap 1 (CH 1) Bandwidth
  0 - 100MHz
  1 - 200MHz
  2 - 500MHz
  3 - 1GHz
  4 - 1.5GHz (4000 series only)
Strap 2 (CH 2) Sample Rate:
  0 - 5GSa
  1 - 4GSa
Strap 3 (CH 3) Gating ?
Strap 4 (CH 4) Board Revision ?
Strap 5 (CH 5) Family:
  1 - 3000 series
  2 - 4000 series
  3 - 2000 series
Strap 6 (CH 7) MSO revision ? - not for 4000 series
Strap 7 (CH 6) External module - not for 4000 series:
  0 - LAN
  1 - GPIB
  8 - No External Module

On external module 0 Ohm to GND should set LAN module (pin short on the DIY LAN may be for this strap) and 1k should be for GPIB module.

For experiments you only want to alter Strap 1 and Strap 2 to update the Sample Rate and Bandwidth.
Have fun!

Yes It is these same resistor from my previous post. I start user calibration after hardware RTC reset - on default clock settings. Maybe here is goal. I start reverse engineering of BLT PCB. I found some pins for Ethernet and next USB Host on unmounted connector. Maybe it is possible to add Ethernet module with PHY and play with licenses hacking

[TK]

Yes It is these same resistor from my previous post. I start user calibration after hardware RTC reset - on default clock settings. Maybe here is goal. I start reverse engineering of BLT PCB. I found some pins for Ethernet and next USB Host on unmounted connector. Maybe it is possible to add Ethernet module with PHY and play with licenses hacking

Do you think the RTC reset is important?  Can you please test user calibration without the hardware RTC reset?  If I change the scope hack back to EDUX, user calibration passes, without any RTC reset.

[thuttu77]

Can some one tell me working values to ID 23 I got my edux go to 70MHz 2GSa SGM etc but I cant get signal at all
I had 12k on top and 33k on bottom on left side set when connector is up of them so it should get 0.91V
EDIT: that were wrong but bith 15k and 15k I should get ID 24 and no signbal at all also trtied 12k and 8k but no signal either it was  0.98V

Thanks a lot I ll try those also it does put me think if I did actually change wrong resistor set since I didnt find pic what would say which one is ID0 and which one is ID1 but when I did look those values
maybe my 12k vas actually 121k so i did change wrong id bit.

[hv222]

It pass user calibration even with normal RTC time. I don't have more ideas. Maybe one of yours components is broken. I used https://pl.mouser.com/Search/ProductDetail.aspx?R=LMV7219M5%2fNOPBvirtualkey59500000virtualkey926-LMV7219M5%2fNOPB and 1% resistors also from Mouser. I my hacking I use 5V coil relay instead of 4.5V (was out of stock, but it is powered from 595 shift register, so it isn't big difference) and I use ferrit bead (600ohm at 100MHz) instead of 10ohm (01x) resistor on power supply line of comparator) all other components are same like in Dave photos.

[TK]

My unit used to pass user calibration if set back to EDUX mode, but now it does not.  I guess is the front end modification I made and not the external trigger input circuit.

[hv222]

I don't think so. It looks like user calibration stops at first detected error. I also replaced components on frontends. I don't change  U40, U35 and U401. Below is photo of my hack. Resistors without making code are 16.2ohm.

[TK]

You are missing a resistor marked 17B near U39.  Did you miss it on purpose?

[hv222]

You are right. Thanks. I miss these resistors. I add it and it pass calibration again.