DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[memset]

Just completed upgrade to 500MHz on one channel.

Since I don't have a license for 500MHz, my scope became 350MHz.
Effective -3 dB bandwidth is ~400 MHz now. Tested on periodic signal only.
I'll try a 500MHz license command line option later when I'll get possibility to change command line in software.

My next steps are to document changes and revert the scope back to 4GSa/s.
200->500MHz upgrade seems to be easy for anyone with decent smd soldering skill. Upgrade price is negligible as only cheap passive components are to be replaced.

Later I'll continue research on 200MHz -> 1GHz upgrade, as it was my original goal (I want to get good DDR3 debugging capabilities).
For sure 1GHz upgrade its going to be for real nerds only since required components are not routed on the board.

[trevwhite]

Okay this is seriously impressive, well done!

[HighVoltage]

It works again,
- 500 ps rise time
- 2 ns fall time
Both are the same as before I opened the case and can.

And the seal is not even broken.

[memset]

Nice to hear your scope is OK after reassembly!

[memset]

I've updated all channels now to 500MHz with ch 4 left for experiments on 1GHz BW.
I'm surprised how I see 2nd Nyquist frequency on this channel.

Can someone with 3104A (1GHz model) and 3054A (500 MHz model) and a 2.5GHz signal generator try to do a test:
- connect sig gen to one input via direct coax;
- select 50Ohm coupling and turn on both adjacent channels (1 & 2 or 3 & 4) to get half of the sampling freq (2GS/a or 2.5GSa/s) on each channel;
- set sig gen to 10 MHz 0 dBm and make sude incoming signal is ~220mV RMS;
- set sig gen to: 2010 MHz for 3054A and 2510 MHz for 3104A.
- can you see anything like an untriggered 10MHz signal at 5mV/div? If yes, stop acquisition and get an RMS reading.

Note: even on 2GSa/s you'll need to use 2010MHz, not 1010MHz due to specific ADC.

[memset]

Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.

[HighVoltage]

Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

[memset]

Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

Thank you for the test! I expect in on the same channel, ch 2 in your case. Very little amplitude. Just keep ch 1 on to downgrade sampling rate.

[HighVoltage]

Ahh, ok.

Well there seems to be a 10 MHz signal in the hiding

[memset]

Well there seems to be a 10 MHz signal in the hiding

Oh, thanks for the test!
Now I better understand why they use 5GSa/s on 1GHz model. 1GHz's output LPF is slow fading. For 4 GSa's 2010 MHz signal can clearly be seen via 1 GHz-like filter. It's much better at 2510 MHz - almost nothing could be seen.

[memset]

Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.

A follow-up for the previous info: after user cal trigger is back to normal timing.
Still I can see how the signal curve fluctuates around trigger point as I change test signal frequency from 10MHz to 350MHz. Total drift is about 1ns. Can't say yet if it's normal or not because all my channels are now modified. Could be result of unexpected phase response of the new filters. Need to check pulse response to see the edge.
Also I see some BW decrease after user cal. It was like 400MHz at -3 dB level. Now its 360MHz at -3dB level.

My user cal fixture was of awful quality and scope remained in a half-disassembled state. I'll rerun user cal after the scope is fully reassembled, shielded and equipped with better user cal fixture. That's my last chance to improve accuracy.

Anyway, I consider 500 MHz upgrade to be done, although it would possibly compromise scope's accuracy 
Will post upgrade details asap.

[Howardlong]

Let me know if you want any trigger tests on a kosher unit. 1ns is quite a way out.

In addition, I'd see how you get on with -bw50.

[memset]

As expected from Agilent/Keysight, they seem to use top-notch components in sensitive paths. I've used random quality parts from several local shops, like unknown tolerance caps from unnamed sources, etc.
I'll redo the mod using better components when I'll get them in hands. That should improve results a bit.

[memset]

3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.

To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.

This is a description of hardware modifications on sensitive signal paths of the scope!
Applying any of these mods will void your warranty and calibration!
Loss of factory calibration and accuracy is inevitable!
DISCLAIMER: do this at your own risk only! Irreversible damage may be caused by these modifications. You've been warned!

Required materials for 4-channel models:
1. Coilcraft 0603CS-15NXG 0603 15nH 2% inductors - 12 pcs
2. Coilcraft 0603CS-27NXG 0603 27nH 2% inductors - 4 pcs
3. 0603 2.2pF NP0 capacitors - 4 pcs
4. 0603 2.0pF NP0 capacitors - 4 pcs
5. 1206 110R 1% resistor - 4 pcs
6. 0603 162R 1% resistor - 4 pcs
7. 0603 121K 1% resistor - 1 pcs
8. 0603 46.4K 1% resistor - 1 pcs

User cal fixture is required for post-modification calibration.

BACKUP NOTE: save all removed components in separate places for each position and channel to secure way back to original values!

Modification process (see attachments for pictures):
1. For each channel replace yellow-marked parts as follows:
AFE top layer (afe_top_layer_mod.jpg):
L1: 100nH(?) -> 15nH
R1: 215R -> 110R
L2, L3: 47nH(?) -> 15nH
C1: 4.7pF -> 2.2pF
C2: 4.7pF -> 2.0pF
AFE bottom layer (afe_bot_layer_mod.jpg):
L4: 100nH(?) -> 27nH
R2: 261R -> 162R
2. Replace two board strap resistors:
Top layer near CPU (gnd_straps.jpg):
Strap resistor L1: 10K -> 46.4K
Bottom layer under CPU (2v5_straps.jpg):
Strap resistor H1: 100K -> 121K

NOTE: all capacitor values are guessed or measured and may not be 100% correct.

Run a brief per channel check of scope functionality before fully reassembling the scope. For a final assembly be sure to mount all shields and covers. Run User cal procedure with a high-quality user cal fixture to compensate replacement of AFE components.
Done, you'll get a 350MHz scope. 350MHz to 500MHz upgrade is software-only and possibly discussed elsewhere.

I'd like to thank all eevblog members who contributed to this mod with their knowledge and time and did measurements on their scopes.
This wouldn't be possible without their kind help.

[TheSteve]

Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

[memset]

There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

If you're up to perform the mod, sacrifice single less-used channel first to check results. But I think you'll need to modify all channels to run user cal with meaningful results. And w/o user can the scope won't behave properly.
For caps I'm not even sure in that 2.2pF/2.0pF difference. These caps well may be the same value ranging from 1.8pF to 2.2pF.
About inductors, CS series is just a guess. For <500MHz range HP shouldn't have any real preference. But if you'll buy both and try to find any visible difference between them we'll maybe able to distinguish them better. As for me I've used Murata LQW18A series because Coilcraft wasn't available in local stores.

On -3dB BW, right after the mod I've got 400MHz at -3dB. After user cal BW has been decreased to 360MHz (no 500MHz license in my scope). I have no idea why.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

I don't think its a good idea for 500MHz BW because there are no such model in 3000 series and its software may behave erroneously in such a chimera. But you can give it a try if you want. It works.

[Howardlong]

Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

2pF and 2.2pF were measured out of circuit and cross checked using three testers, and Agilent U1733C with SMD tweezers at 100kHz, Smart Tweezer ST5L at 10kHz and a Peak LCR40 at 200kHz with SMD tweezers. Parasitic capacitances on the measurement probes were either nulled out or measured and subtracted from result. There could reasonably be a 5 or even 10% tolerance mismatch there.

I also measured one of the inductors to align with the Coilcraft colour dot codes, and the CS and HP (the CS and HP series seem to share the same colour coding) were the closest correlation. Other series did not correlate with the measurements.

3dB 500MHz bw: 584MHz
3dB 350MHz bw: 377MHz

Measured with HP 8656B 2Vpp, 2m Suhner RG58-sized BNC-BNC cable, and averaging 8 acquisitions. Scope settings 50 ohm, 500mV/div and 1ns or 2ns/div depending on bandwidth limitation.

[Howardlong]

Rise times:

500MHz: 640ps
350MHz: 970ps

Source is HP 54121T in TDR mode with system rise time measured at 33ps.

[TheSteve]

Thank you for the information guys. It is very tempting to use Murata inductors here as well. I can buy them direct from Digikey for 10% of the price of Coilcraft who insist anyone in US/Canada must order direct from them.
Ideally I'd like to see if I can match Howard's 3dB numbers and then provide the exact manufacturer/part number for each part I used for others who want to do the mod. I will order the resistors/capacitors from Digikey either way so I may throw the Murata parts in the order, all of them are only a few dollars.

Once the bandwidth mod is done I may experiment with the 5 GS/s mod as well. The 3000t series uses 5 GS/s on all models. Obviously stable performance is the most important aspect of the mod.

[TheSteve]

I've ordered all of the parts needed for the mod. I also ordered the parts needed to build a Jim Williams pulse generator so I can check rise times as well as 3dB bandwidth with a signal gen. Already had the parts in stock to build the needed BNC patch cables to run user calibration.
I can hopefully build the pulse gen this weekend and then do the scope mod the following weekend once the Coilcraft order arrives.

[memset]

Meanwhile I've tried 500MHz mode and it works well.

[Howardlong]

I have a quick comment about reworking these high impedance front ends.

Avoid cleaning the board with anything more than the absolute minimum of IPA or flux cleaner/solvent, and any you do use scrub it off with qtips etc, because residues are conductive enough to very significantly affect things like DC offsets. Once it's found itself inside shelters like relays, it will take a long time to evaporate.

Put some IPA into a small petri dish or other contianer and measure it with your DMM. If you're probing two close pins the resistance can drop to low single digit meg ohms.

Let's just say I discovered that the hard way, and it took a long time for the penny to drop. 

[memset]

I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
This solution will add extra lnk file to the internal ROM to alter the startup process.
That's quite dangerous because you can brick your unit by copying overlong or incorrect lnk file. Prepare lnk file carefully!
I wasn't able to find something different because USB boot is incapacitated in v2.41.

As v2.41's boot process differ from older softwares, this method fits v2.41 ONLY.

Readily included lnk file contains no command line.
Add any options you need, but READ THE INSTRUCTIONS FIRST.

This method works via running supplied 3ka_v241_linkinstall.cab file as software update.
NOTE: supplied .cab file mimics software update process, but contains NO original proprietary files from authentic software update packages.
DISCLAIMER: Use at your own risk only. No one else is responsible for what you do with this software.

!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!


"3ka_v241_linkinstall.cab" file is made to install extra link file into internal ROM's filesystem.
For v2.41 this will enable firmware to run with arbitrary command line string.

Applying this mod to any software prior to v2.41 may lead to unpredictable consequences.
DO NOT use with older software!

Integrity check for cabinet file:
2b75c5ecaecd0837ec8cbd819715a907951bb119  3ka_v241_linkinstall.cab

Code: [Select]

How to install extra link to run firmware with custom command line:
------------------------------------------------------------------
1. Prepare infiniivision.lnk: add desired command line options after .exe file name and recalculate string length.
   lnk format: N#\path\to\file.exe -command_options
   N is 2-3 digits of length value of the following string, including '#' char.
   After lnk file contents are edited replace N with corrent number.
   Maximum lnk file size is 260 bytes including size field itself. Do not exceed this value!
   !!! WARNING Maximum lnk file size is 260 bytes total !!!
   !!! WARNING Incorrect lnk file contents may brick your unit !!!
2. Copy 3ka_v241_linkinstall.cab and infiniivision.lnk to the root folder of USB drive.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
   !!! WARNING It's extremely dangerous to run cab files from unknown sources as they may contain malicious instruction to the unit !!!
4. Unit should reboot and work with extra warning about Unfinalized software.

How to remove extra link to revert to original firmware startup:
---------------------------------------------------------------
1. Copy 3ka_v241_linkinstall.cab to the root folder of USB drive.
2. Delete infiniivision.lnk from the root folder of USB drive or make sure it's not present there.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
4. Unit should reboot and work without any extra warnings.

Troubleshooting:
----------------
1. The hardest problem would be incorrect lnk file leading unit to hang on boot (brick!).
It's only possible to solve that by connecting to the unit via Telnet and removing that incorrect link file:
del \f \Secure\Startup\infiniivision_ext.lnk


[Howardlong]

I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
....

Wow!

My infiniivsion.lnk (edit: on an MSOX3054a)

Code: [Select]

63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw50


[tonyc]

This is really awesome!

I have to specify SCPIPS manually after the -l all argument. Here is my command:

72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS