DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Hexley]

For instance, a pad pattern for a vertical mounting through hole micro USB connector could be added to a PC board design and connected to otherwise unused pins of a CPLD.  In this case, you would have a 5 channel gang connection, which by programming can monitor any signals in the CPLD.  Just alter the CPLD program to move your hardware probe points and reprogram without taking it off of the PC board.

Welcome to the forum.

Your idea for dedicated MSO connections using a micro USB connector on the target system seems like it would be great for CPLD development work.

I hope someone can provide pix of the bottom side of the board near the MSO connector, so you can figure out the scope's internal termination. That would be a nice contribution to knowledge.

[LA7SJA]

This is what I manage to collect so far:

MSO (digital channels). Upgradable from DSO. MSO channels 8 channels (D0 to D7)
Maximum sample rate 1 GSa/s Maximum record length 500 kpts per channel (digital channels only).
125 kpts per channel (analog and digital channels). Threshold selections TTL (+1.4 V),CMOS (+2.5 V), ECL (-1.3 V), User-definable (± 8.0 V in 10 mV stops). Threshold accuracy 1 ± (100 mV + 3% of threshold settings)

You don't need any special digital probe. The digital connector on the DSOX2000 scope has this layout: The input resistance is about 10kΩ to ground and 90kΩ to probe end.


Maximum input voltage ± 40 V peak CAT I Maximum input dynamic range ± 10 V about threshold Minimum voltage swing 500 mVpp. Input impedance 100 kΩ ± 2% at probe tip, ~8 pF Minimum detectable pulse width 5 ns. Channel-to-channel skew 2 ns (typical), 3 ns (maximum)

[Matt Coates]

Hi all,

Apologies for the laziness but I didn't fancy reading through 106 pages of posts to get to the bottom of my query.

Can anybody familiar with the topic please let me know where I can find details on how to unlock the options for my DSO2024A scope?

Thanks!

[LA7SJA]

I would start about here https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3388792/#msg3388792

LA7SJA

[wavylogic]

Hello LA7SJA, is it possible for you to post higher resolution photo sections for the part of the main board surrounding U1104?  I need about 2x or better resolution for that part of the photos "MSO Input PCB backside.jpg" and "MSO Input PCB toppside.jpg which surrounds U1104 and for about 1/2 inch past the group of components which surrounds the chip.

I see that this section seems almost identical to the one previously seen in teardown photos of an MSO3104 on the site, there are a few small unimportant differences.  I'm pretty sure the layout was copied and modified.
 
On your other comments about MSO, from what I read going through the site it appears that the 2000 series (which this board is from) has only 8 MSO channels because it has only one set of acquisition chips, whereas the 3000 series has two sets of acquisition chips and support 16 channels as a result.  Is that right?

Then the question is:  Since a 3xx2 has 16 MSO channels but only 2 analog signal inputs, does it have 1 or 2 sets of acquisition chips?  I have found that if you use 2 inputs simultaneously on the 3022, its maximum sampling rate drops in half, which is the same result as can happen on a 4 channel unit because 1 & 2 share one acquisition chip set, and 3 & 4 share the second.

This all points to the possibility that a 2xx4 machine could theoretically handle 16 MSO channels if the parts were installed and the software changed.  Have you seen anything about this?

The threshold ratings, hysteresis, and maximum voltage are all at the effective 10X probe division ratio formed by the MSO cable and its 90K series pods.  The values are 10 times smaller at the front panel connector, and the ESD protection is a lot less.  If you don't use the cable with 90K resistors, operation will be different.  The usable signal range is only +/-1 volt.

If you use ordinary ribbon cable without correct compensation networks to connect to 90K at the probe end, the frequency response will be wrong.  It may have excessive peaking, or it may have greatly reduced bandwidth.  The result is that the logic inputs will not be able to provide the nanosecond signal measurements which the 1 GHz sampling would imply.  In the worse case, ringing could cause entirely erroneous logic signal indications.

For these reasons, I am trying to determine by simulation what termination networks are needed to get 1 nanosecond response when using ordinary ribbon cable.  I think it is possible based on similar work I have done in previous years.  This eliminates the need to have the special 'woven cable' or its equivalent used on the original logic analyzers.

My intention is that when this design research is finished then I will publish it on this blog so that all those who have MSO enabled but need a cable can then make their own easily and get good response.

[LA7SJA]

On your other comments about MSO, from what I read going through the site it appears that the 2000 series (which this board is from) has only 8 MSO channels because it has only one set of acquisition chips, whereas the 3000 series has two sets of acquisition chips and support 16 channels as a result.  Is that right?

Yes that is right! Dave compared the MSO on x2000 and X3000   @ 07:00
If I have enough lighting and find the old macro lens and intermediate rings then I will try to get time to open my DSO-2024 and get some better pictures. Have you tryed to put a small compensation capacitor parallel to the 90k resistor and used a active probe to look at the signal on the MSO input? The wire used in the original cable is of the "Lossy" type (as in oscilloscope cables and it's "pure unobtainium").

LA7SJA

[IUST]

I have failed in Bandwidth upgrading of my DSOX3024T. It is stuck at 200MHz and -l -BW50 is not working for it.
The activated license always show the BW20.
What is wrong with me?

In the .dll file, there is a branch that judge about passing through bw20_3k or bw50_3k. for bandwidth upgrading, Should  I have to force the code to pass through the bw50_3k section?

Bandwidth of DSOX3024T is not license only up gradable according to the manufacturer information.  I know that for BW upgrading the scope may need to send to the manufacturer for calibration and whatever But I am just curious about the possibility of this bandwidth up-gradation.

[LA7SJA]

There is notting wrong with you!
But you need different hardware (Return-to-Keysight bandwidth upgrade) to go over 200MHz bandwith!

These are permitted license updates on the M/DSO-X 3XXX:
License only bandwidth upgrade models

3000T X-Series
DSOXT3B1T22 License only 100 to 200 MHz upgrade, 2 ch
DSOXT3B1T24 License only 100 to 200 MHz upgrade, 4 ch
DSOXT3B3T52 License only 350 to 500 MHz upgrade, 2 ch
DSOXT3B3T54 License only 350 to 500 MHz upgrade, 4 ch

Return-to-Keysight bandwidth upgrade models
3000T X-Series
DSOXT3B1T32U Service center 100 to 350 MHz upgrade, 2 ch
DSOXT3B1T52U Service center 100 to 500 MHz upgrade, 2 ch
DSOXT3B1T102U Service center 100 to 1 GHz upgrade, 2 ch
DSOXT3B1T34U Service center 100 to 350 MHz upgrade, 4 ch
DSOXT3B1T54U Service center 100 to 500 MHz upgrade, 4 ch
DSOXT3B1T104U Service center 100 to 1 GHz upgrade, 4 ch
DSOXT3B2T32U Service center 200 to 350 MHz upgrade, 2 ch
DSOXT3B2T52U Service center 200 to 500 MHz upgrade, 2 ch
DSOXT3B2T102U Service center 200 MHz to 1 GHz upgrade, 2 ch
DSOXT3B2T34U Service center 200 to 350 MHz upgrade, 4 ch
DSOXT3B2T54U Service center 200 to 500 MHz upgrade, 4 ch
DSOXT3B2T104U Service center 200 MHz to 1 GHz upgrade, 4 ch
DSOXT3B3T102U Service center 350 MHz to 1 GHz upgrade, 2 ch
DSOXT3B3T104U Service center 350 MHz to 1 GHz upgrade, 4 ch
DSOXT3B5T102U Service center 500 MHz to 1 GHz upgrade, 2 ch
DSOXT3B5T104U Service center 500 MHz to 1 GHz upgrade, 4 ch

LA7SJA

[wavylogic]

I looked at the video #148, I had missed that one.  But looking closely at the 3000 back side, all the MSO signals go into the 'master' Megazoom chip, supposedly therefore this could also have been done on the 2000 scope.  I didn't see the back side on that one.  The choice of 8 channels on the 2000 looks mainly like a marketing decision, since the board is an almost all new layout, and yet they did include positions for 16 channel buffers.

On setting up the MSO cable compensation, I did consider using an active probe as you mention, but the internal circuit is complex, and may be doing some frequency shaping of its own.  So getting a good transient response at the front panel 40 pin connector may not actually give the best system response.  That is what I am investigating.

The goal here is to obtain good performance without using the lossy cable design.  It should be possible, its just not as easy.

[LA7SJA]

I gave up finding "lossy" cable after just few years. The input have som signal cleanup on the signal before the ASIC. Later when I take som new pictrures I wil try to measure the differens betwen  1 meter of flat cable and 1 meter old scope lossy cable with a 10MHz, 20, 40, 50 and 60Mhz good square-wave just on one MSO input. Do you still need better pictures? I don't want to remove the mainboard so only pictures from componet side of the 40pin connector.


LA7SJA

[wavylogic]

Hi LA7SJA, I already have good high resolution pictures of the side with the ICs for the MSO input, the problem is that about 1/2 of the circuitry is on the side against the front panel, and no one seems to make pictures of that side.  The pictures you had when blown up just didn't have enough resolution to see some of the fine traces reliably. Hopefully someone else will have a board they can photograph.  Even photos of a dead board would suffice for this purpose.  Any version of the DSO or MSO 2000 or 3000 series would suffice, they seem to all use the same MSO input circuitry, which is all I need to see.

On the lossy cable, I already have complete characterization as needed for simulations, so don't worry about measuring that.  It is easy to model and simulate using LT Spice. 

Thanks for your help.

[MarkL]

I gave up finding "lossy" cable after just few years.
...

One way to get some lossy coax is to buy a used logic analyzer cable that's the tiny coax ribbon type (not the woven type).  You can then peel it apart in singles or in groups as desired.  The cable in the photo is a 16715-61601 which has 36 lossy coax runs, 1.3M long (it's in 2 ribbons, each having 18 each plus 4 regular conductors).  The cable can be had for around US$25-$30 each (hint: try searching for "(hp,agilent) logic analyzer cable", not the part number).

I realize the goal here is to replace these lossy coaxes with a suitable termination network, but if you can get the coax easily maybe it's worth re-purposing it for your specific applications.

[tabajaralabs]

I believe I've written about this, I''ll create a blog post
To create a cable set for the scope, get an HP logic analyser cable, cut the CONNECTOR (pay attention to that) that goes to the logic analyser blade, where the two flat cables enter, and solder a 40 pin (2x20) connector routing the signals D0-D7 to the proper pads on PCB. In the other side of the cable, use an HP "hydra" connector, but with just 8 wires. It is THAT simple.
DON'T TRY TO SOLDER THE WIRES, USE THE HP BOARD WHICH WENT TO THE HIGH DENSITY CONNECTOR. The wires are so small they are IMPOSSIBLE to solder.
DON'T USE NORMAL WIRES FROM THE SCOPE TO THE PROBES, THE NOISE WILL DRIVE THE SCOPE NUTS.
ASAP I'll publish a complete tutorial with photos.

[analogRF]

Here ya guys go..

Patched 3000X 2.50 Firmware with 'options' and 'nag' patch already applied..

https://mega.nz/#!eqg0yYJK!l73FwnABwNBNsl_l_2fAC8Md8PCVEEBgZ-u0T1eNZ08

can someone kindly send me a link to the patched firmware please? the above link has been removed

[LA7SJA]

This one worked for me:

https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0

LA7SJA

[analogRF]

This one worked for me:

https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0

LA7SJA

thanks so much
just to be sure, should I follow step by step procedure in post #2201 on page 89?
I have been reading this thread for a couple of days but I am confused with several methods that are proposed
I dont have the LAN card but I do have access to the serial console

[Gribo]

I still have some DSOXLAN cards available. PM me if you want some.

[analogRF]

Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   

this is interesting? so where is the FRA on 3000A? is it a hidden option that only Keysight guys know about?

[LA7SJA]

@wavylogic
Her are some photos from Dave's teardowns you could use:
https://www.flickr.com/photos/eevblog/5736597744/in/album-72157626755861230/

LA7SJA

[Kibabalu]

Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.60.20201011001_patched  https://mega.nz/file/OjAhhAjI#o6s6Fi4cGhxN0v6jgJOVAxhNNk33qv_w46eiO_QyEhc
md5: <2B8FFCC4D5963FC9277AEBDD61CCC5B1>

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

DSOX 3000T Series:  FW:  7.35.2020120822_patched https://mega.nz/file/nmJliKrJ#iMkMhe6xWFkJLJH7rgbh-QoFvRjzfVbsXhOOgu-5osc
md5: <D430C8F87A3865B48E035A1B99B0A421>

DSOX 4000X Series:  FW:  7.35.2020120823_patched  https://mega.nz/file/q3ABzQ5b#BH08CEf_Q0T7Z3kQMOzmHZTGubIGKPanCiq8my69TyM
md5: <04D0B52B8400F03B3EA87B90DE8FC004>

Please let me know if there are any issues with any of these!

For a DSO-X 2000A model I have to use

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

right?

[LA7SJA]

On my (M)DSO-X 2024A I use this one.

DSOX 2000X Series:  FW:  02.60.20201011001_patched  https://mega.nz/file/OjAhhAjI#o6s6Fi4cGhxN0v6jgJOVAxhNNk33qv_w46eiO_QyEhc
md5: <2B8FFCC4D5963FC9277AEBDD61CCC5B1>

LA7SJA

Kibabalu
For a DSO-X 2000A model I have to use

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

right?

[analogRF]

I have a question about the upgrades on Agilent 3000A:
now that I am on FW 2.6 and upgraded, what happens if a next firmware is released and I want to update the firmware?
Do the options disappear and need a patched firmware or I can install future firmwares with no issue?

[Kibabalu]

I have a question about the upgrades on Agilent 3000A:
now that I am on FW 2.6 and upgraded, what happens if a next firmware is released and I want to update the firmware?
Do the options disappear and need a patched firmware or I can install future firmwares with no issue?

At least for the last two FW updates a special patched firmware was necessary to keep all the 'hacked' options. Most likely this will also the case for future FW updates.

[LA7SJA]

Enhancements for 3000A
- New SCPI command to start the probe degauss operation for the N7026A and N2893A probes.
Enhancements for both 2000A and 3000A
- Completed software and built-in online help localization.
- New SCPI commands for clearing persistence data from the display and querying the run state.
Bug Fixes for both 2000A and 3000A
- Fixed network print issue where a valid printer address format was not accepted.

I do not want to replace all options turned on with "update" above! Maybe if they remove the automatic language help at startup / screensaver exit. I can manage with the version 2.5 v software for the life of the oscilloscope. I think no revolutionary changes for the better will come to an 11 year old instrument (HP, Agilent, Keysight prove me wrong, I challenge you).

LA7SJA

[Miketee]

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......

These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things

*** Note:  ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...  so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx


DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

Please let me know if there are any issues with any of these!

Thanks PhillyFlyers, I did the patch on my DSO-X 3034A and it works!

I used the following infiniivision.lnk file:
93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

It is now upgraded to 500 MHz and includes the very rich D3000BDLA, which includes D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, and all hardware based serial decoding (RS-232, I2C etc.), mask testing, video analysis, and even advanced math.

This is already great, again thanks.

However, the last 3 options in the file (MSO, MEMUP and WAVEGEN) did not work.
Did I do something wrong? It would be nice to have WAVEGEN and MEMUP... ;-)

cheers

MT