DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[hs3]

Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...

I haven't read the PLL thread in a long time but if I remember correctly it seemed that there were issues due to unstable voltage regulator which was because in some manufacturing batches an incorrect "equivalent" substitute part had been used. And that only some were affected by the issue and most didn't experience it.

There are some forum users who like to often post that link but choose to not mention the above. If I remember it wrong I'm happy to take these words back.

Neither was my intention to say 1M wfm/s is the most important thing nor the best metric to measure scopes. But a consequence of the memory (and price) differences is due to this different design. (and really has nothing to do with it being fair or not)

This mention about architecture, memory and price made me think. Would it be completely wrong to say that the Keysight Megazoom ASIC based scopes might actually be cheaper to manufacture than the Rigol DS4000 series scopes that use 5 pieces of expensive Xilinx Virtex 5 XC5VLX30-1FFG676C parts to implement similar functionality that in the Keysight scope is handled by their own ASIC?

[Howardlong]

Even if you don't need it and you measure something different, it is very useful if your scope can show you such glitches, and you can see it by accident before it gets a problem for a customer of your product.

While that is true, and just like memory depth, it's very application dependent, as well as being a bit of an arms race.

The difference between 100kWfm/s and 1MWfm/s is nice to have, but realistically how often are you going to be the situation where you have a glitch that benefits from this? How about 10MWfm/s? 100MWfm/s?

The same applies to deep memory, how much you need is roughly as long as a piece of string, and largely adheres to the law of diminishing returns.

[georgd]

@viki2000,  as DSOX2000 owner have you tried --perf option mentioned in post below:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1099382/#msg1099382

Georg

[viki2000]

@ FrankBuss
I understand that and I agree.
You show me repeated signals with superimposed noise, which is not always my case.
My case is with the non-repetitive asymmetrical signals during normal operation mode, which happens/repeat only under certain conditions, for example during startup of a device.
Each system, electrical or mechanical, has during startup time a strange behavior before stabilization state is achieved.  I am looking many times at the startup process and for that a DSO with deep memory and high sampling rate for long time base is helpful, more like a DAQ, digitizer. From here my initial question about why not the long cheap memory is not installed by default in many DSO. I understand the trick done by Keysight with segmented memory, but is still not what I expect.
I heard all the time up to now all kind of explanations why you do not need deep memory and how other functions can complement that.

Why there is so low memory with only several million of points in today’s DSO when the DDRAM todays is so cheap for tenths of GB? But how much can really cost few GB of RAM for these DSO? What is so special about them? What is the price of existing RAM memory chips in Agilent and/or Rigol or other known oscilloscopes? What is their type, model, brand? Why they ask so much money for memory upgrade?

@ georgd
No, I have not tried “--perf” option. I have read about it, but was not essential at the moment of my unlocking trials.
I will try it and I will let you know.
Actually I want to reopen a discussion and clarify also for new readers the content of the link file.

[Neganur]

I give up!

What is the price of existing RAM memory chips in Agilent

The acquisition RAM is inside the ASIC for the InfiniiVision series.

[viki2000]

That is good to know and explains why is low memory and high price.
If the architecture/design would be with external RAM blocks/slots then it could be lots of high speed RAM with cheaper price, but then who would make money out of RAM upgrade?

[MarkL]

@ Bud
I am really impressed about your work and your findings. I have only bravo and applause. It is a Master work.
https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/

Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...

One method used to determine PLL stability during the Rigol thing was to capture a maximum length record from a known stable source such as a crystal oscillator, and then examine the FFT on an external computer.

Unlocked PLLs and other instabilities would be quite obvious, but whether the user actually notices it depends on: 1) what they are trying to measure and, 2) the severity of the instability.  (But it's still no excuse for poor PLL design.)

You could check your scope using this method if you are concerned.  It is discussed in the longer thread referenced in the first post of the Yaigol thread if you need more detail.

[Keysight DanielBogdanoff]

Trust me, if we could feasibly put a memory controller on that ASIC and have a deeper acquisition we'd do it.

[Someone]

“We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for”

I need it and I used it for non-repetitive asymmetrical “long” time signals/events. More or less a DAQ with high speed digitizers would definitely fit better to such analysis, but they were too expensive and I need it once in a while, maybe couple up to several times per year, so occasionally and for the rest of time a simple DSO is just fine. In a previous job I had in my hands for 2 weeks a Yokogawa DL850E scopecorder which was quite good for what I needed, but was around 25K €, quite expensive, but 16 channels with continuous recording at 100MSa/s was good. We were almost ready to buy it together with other instruments, but some things changed in the company and the project of improving the lab stopped and later I left that company. In fact I wanted initially to transform a high end PC into s signal recorder by adding high speed digitizers and dedicated software. A second option was to use frame for digitizers from National Instruments, but the price with software and setup time came close to a ready-made system as the one from Yokogawa.
 I will not provide here full details of the application(s), but I will provide below setup examples.

You do need to be very specific, as there are ways to trigger on most problems with sufficient memory around the trigger to get context.

but I work in the range 40Hz-100KHz with repetitive and non-repetitive signals, at which, sometimes/occasionally I detect signal event superimpose noise/pulses of max, 100MHz and even narrower pulses. The problem is that I need to see if these non-repetitive abnormalities of high frequency are maintained for longer period of time.

Filters and acquisition modes should be able to extract the information without needing to store all the high frequency information if that high frequency information is no useful.

Between samplings the ADC is blind and the points are shown only with interpolation.

It depends which acquisition mode you are in, very few requests I've seen for deep memory couldn't be solved with peak detect or envelope mode. There are applications for deep memory where you are needing to extract the high frequency information but it tends to be limited to RF/telco uses.

Why is then the Rigol memory slow?
It is good enough.
The only problem is at waveforms/s, which is not important for me.

Great, then its probably a good scope for you. Rent/borrow/evaluate (don't buy yet) one and share your thoughts about it with us. Or try one of the PC based scopes, at these lower sample rates they can often stream direct to the PC for practically infinite memory depths.

And then my focus was on memory size compared with overall price of the instrument. It still makes no sense for me to put so small RAM memory in DSO today, when you look at the price of memory on the market and compare it with overall price of the instrument and particularly how much each DSO company asks for memory upgrade; it is ridiculous.

Memory is not cheap compared to the cost of the product, and just the memory alone is not the limiting factor. There is a long thread recently on this hence my dismay you bring it up again so quickly:
https://www.eevblog.com/forum/testgear/oscilliscope-memory-type-and-why-so-small/?all

[FrankBuss]

My case is with the non-repetitive asymmetrical signals during normal operation mode, which happens/repeat only under certain conditions, for example during startup of a device.

I've used one of the bigger scopes at a clients site, don't remember the model, but it was one of these scopes that costs as much as a house, is as loud as a lawnmower because of all the fans, but you can record seconds of a signal and zoom into it endlessly, perfect for analyzing startup sequences. But you can do this with less memory, too, if you set the right trigger points, trigger delay, output some debug signals etc., you just need longer for it. But I don't know a workaround if your scope doesn't have the millions of waveforms per second update, you simply don't see as much of what is going on.

My first digital scope was a TDS1002 and I thought it was a nice scope after I sold my analog Hameg scope. But when I bought my DSO-X 3012A it was like magic

[viki2000]

@georgd
I have tried the „--perf“
It adds 3 more functions in math menu and several more in trigger menu.

[Luminax]

Hmm.... I saw Dave's 1000x hacking video and I wonder... Mine's a DSOX2014A with Firmware 'hack' for firmware version 02.41.
Interestingly... I could've sworn I patched it for 200 MHz B/W or something but it's showing 70MHz and I don't have a capable frequency gen to check it out, but I do notice the horizontal scale goes down to 5 ns so mayhaps...

Anyway, I'm wondering if there's any other capabilities that I can explore without making some major modifications to the board or even if I should open this thing at all, hmm... granted a few bodge wires and some resistor divider swap isn't going to likely cause any major fault or anything, hmmmmm.... 

[TheSteve]

If it is showing 70 MHz then it likely is, the model # won't change with a hack but the usable bandwidth will be reported correctly in the system info screen. You probably need to check what options you've used with the hack.

[Luminax]

A-ha! I don't know how that BW100 options got there... should've been BW20 
Did someone document all the switches somewhere? I remember there's a post somewhere in this thread... time to go digging! 

[TheSteve]

I am still working on the 1 GHz mod. I am confident we have all of the info needed to do it except for some capacitor values. If someone with a 1 GHz 3000A or 3000T scope can remove and measure some caps I am prepared to offer a reward

I have also been playing with LTspice to simulate the balanced front end low pass filter - I could probably approximate some of the values but that likely isn't as ideal as having the proper ones.

edit - it appears the extra capacitor and resistors in the 1 GHz model balanced filter add a gain hump after 500 MHz - possibly to compensate for non-linearities in the rest of the circuit.

Attached some LTspice samples - this is the first time I have used it. I am assuming they use a 50 ohm input to the Megazoom ASIC. The circuit has been redrawn as two single ended filters. I am quite sure the inductor values are 6.8nH, and we know the resistor values. I basically halved the capacitor values from the 500 MHz model in the first simulation and then added the extra resistors(R7.R8) and capacitors(C5,C6) used only in the 1 GHz model in the second simulation. I experimented with the values and settled on 1 pF for C5/C6 which gives a flatter response. I'd like to think I'm in the ballpark but could also be dreaming.

[adranp]

:TheSteve is doing an excellent job on trying to do this reverse engineering job. Reverse engineering the entire front-end is quite a task and can be easily bypassed by having the required caps measured.

The result is not very far.  There is surely an incentive from Steve and I may also come with something along that.

We just need those caps measured. If anyone is able to do that on a 3104A or 3104T scope please help to do this mod.

As :TheSteve explained keep in mind that it's also possible to have a mod which would raise the bandwidth to 1.5 Ghz, so not just those with lower end scopes can benefit.

[Thermodynamics]

Hi,
I am considering a new x2002, but only if the hacks are still live. Otherwise it's the rigol..... can someone confirm the hacks are still golden with the latest firmware on that unit?

[mikeselectricstuff]

Hi,
I am considering a new x2002, but only if the hacks are still live. Otherwise it's the rigol..... can someone confirm the hacks are still golden with the latest firmware on that unit?

I saw on another thread that there is new 2000/3000 FW just out today.

[Dubbie]

Mike, Is that just for the A version? Not the T?

I can't find any new firmware for the 3000T anywhere.

[viki2000]

The hacks have been confirmed up to now with firmware 2.41.
It seems now the firmware 2.42 has been released:
http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014479&nid=-32976.973676&id=2014479
http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014548&nid=-32976.970765.02&id=2014548
Here you may see the differences between 2.42 and the previous versions:
http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf

The 3000-T version firmware:
http://www.keysight.com/main/software.jspx?ckey=2573488&lc=ger&cc=DE&nid=-32541.1150442&id=2573488

[azer]

I notice the firmware files for the X series are also "ksx" files now, though they are not encrypted so you can rename to zip.

[TK]

I notice the firmware files for the X series are also "ksx" files now, though they are not encrypted so you can rename to zip.

In the Release Notes it says to rename to .cab for scopes with firmware older than 2.41

[m00wn]

Just in case: I have a couple of original license files for my 3000T series scope, if someone is interested/capable in reverse engineering.

[januszb]

Does anyone have the 2000X 2.41 firmware cab to hand?  It has been pulled off the Keysight website since 2.42 has been put up and I unfortunately didn't keep a copy...    Would be most grateful if anyone could share!

[viki2000]

Firmware 2.41 for DSO-X 2000 series:
https://goo.gl/gj3NJ7