Author Topic: Tektronix Probes TPP0250 and TPP0500B. Whats the difference? Teardown time!?  (Read 16725 times)

0 Members and 1 Guest are viewing this topic.

Offline FivePoint0Topic starter

  • Contributor
  • Posts: 28
Does anyone know what the physical difference is between the TPP0250 and TPP0500B (and indeed the TPP1000)?  From the outside they certainly look identical.  I am really curious to see inside.  There must be intelligence inside (1 wire bus?) because the 'scope reads the probe serial number and displays it on the screen.  Also it can calibrate each probe on each channel, which is cool!

However if you plug a TPP0250 into a 350MHz or more (MDO3000) 'scope the bandwidth is limited (in the scope it seems) at 250MHz.  Is it possible the probe is actually capable of more than 250MHz?

Can the P6139B be used on a MDO3K, and hows does it compare to the TPP0500B?  If I get time I may try this at work!
 

Offline w2aew

  • Super Contributor
  • ***
  • Posts: 1780
  • Country: us
  • I usTa cuDnt speL enjinere, noW I aR wuN
    • My YouTube Channel
Can the P6139B be used on a MDO3K, and hows does it compare to the TPP0500B?  If I get time I may try this at work!

Yes, the P6139B can be used with the MDO3000.  Performance basically similar to the TPP0500B, but must be manually compensated with the diddle stick.
YouTube channel: https://www.youtube.com/w2aew
FAE for Tektronix
Technical Coordinator for the ARRL Northern NJ Section
 

Offline FivePoint0Topic starter

  • Contributor
  • Posts: 28
Just captured this from the scope-probe connection:-



Anyone want the .csv to see if we can decode?
« Last Edit: December 17, 2014, 11:15:39 pm by FivePoint0 »
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Could you upload the CSV file again?

Here are some images of the TPP0250 probe. I couldn't resist to open it ...
The IC is a DS2431 1-Wire chip from Maxim.
http://datasheets.maximintegrated.com/en/ds/DS2431.pdf

Does anyone have a dump of the content of a TPP0500 or even a TPP1000?
« Last Edit: September 30, 2015, 08:53:00 pm by steffenmauch »
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5410
  • Country: gb
What a coincidence, I took one of my TPP0250's apart a couple of days ago!

The probes appear to be compensated inside the scope, not on the probe itself. The scope keeps track of the probes it knows about using their serial numbers, and applies compensation appropriately once each probe has been calibrated on each channel.

After figuring out what was inside it, I ordered up some parts and last night I spent some time looking at the 1-wire. The scope simply reads the first 112 bytes from the EEPROM in a single command. I have not seen any other activity. The scope treats each readout channel as the only device on the bus, it does not read the 1-wire device's serial number. I didn't see any writing back to the probe.

Comparing four probes, the last byte looks like a CRC or checksum of some sort, everything else is identical apart form the serial number of the probe, in clear ASCII, as is the probe model number. It doesn't look like a simple checksum, because the serial numbers of my probes are very close, all within a dozen or so serial number-wise.

I managed to copy the EEPROM into another blank DS2431, and it was recognised as a clone of the original probe. One caveat, you need to load the bus with a 3.9k resistor as well as the 1-wire device, it won't recognise or attempt to "probe the probe" otherwise, the scope wants to see 3.8V on the readout pin.

I tried doing 1 bit changes to the serial number, but the scope won't then recognise it as a valid probe, so the checksum/CRC is definitely used.

So I spent some time with a CRC8 check, seeing if I could massage the polynomial and start condition to come up with a consistent result for all four probes by an exhaustive check, but no luck I'm afraid. I would say, though, that I don't have experience of this kind of entertainment, so I am sure there are other methods. It may well not be a CRC at all of course.

Probe name is at offset 0x0c ("TPP0250\0"), and serial number is at offset 0x14 immediately afterwards ("C######")

Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 30
32 35 30 00 43 30 33 36 31 34 32 00 00 01 06 12 <- C036142
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B 6E 4D 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 00 C8 44 08 85 01 00 02 03 01 04 3D <- 0x3D checksum/CRC

Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 30
32 35 30 00 43 30 33 36 31 35 33 00 00 01 06 12 <- C036153
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B 6E 4D 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 00 C8 44 08 85 01 00 02 03 01 04 59 <- 0x59 checksum/CRC

Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 30
32 35 30 00 43 30 33 36 31 34 30 00 00 01 06 12 <- C036140
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B 6E 4D 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 00 C8 44 08 85 01 00 02 03 01 04 D1 <- 0xD1 checksum/CRC

Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 30
32 35 30 00 43 30 33 36 31 35 34 00 00 01 06 12 <- C036154
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B 6E 4D 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 00 C8 44 08 85 01 00 02 03 01 04 CE <- 0xCE checksum/CRC

 
The following users thanked this post: Mechatrommer

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Well, I did the same thing last night. Tried XOR, Modulo checksum as well as different kinds of CRC8.

Anyway, I have a dump of a TPP1000.
Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 31
30 30 30 00 43 30 31 33 35 30 31 00 01 01 06 12  <- C013501
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B 6E 4E 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 00 48 44 08 85 01 00 02 03 01 04 31 <- 0x31 checksum/CRC

And here a dump of a TPP0500 probe:
Code: [Select]
05 03 31 70 9E 6B 04 03 10 5D 14 02 54 50 50 30
35 30 30 00 43 30 31 34 31 34 32 00 01 01 06 12 <- C014142
4B 1B B6 31 06 16 80 96 18 4B 06 18 14 38 89 2C
06 14 28 6B EE 4D 06 1A 00 00 96 43 06 10 CD CC
CC 3D 0E 5D 00 24 74 48 00 1B 37 49 00 7C 12 48
17 8A 01 E0 9E 14 4B CC B2 64 2C 7C 6F FC 72 77
6F 3E 2E 00 40 58 44 08 85 01 00 02 03 01 04 F0 <- 0xF0 checksum/CRC

Can you check, by using the content above, if the probe will
physically be able to measure higher frequency? I think they will limit the bandwidth by signal processing.
But I am not so sure anymore, as the PCB looks somehow different inside the TPP0500 or TPP1000.
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5410
  • Country: gb

Can you check, by using the content above, if the probe will
physically be able to measure higher frequency? I think they will limit the bandwidth by signal processing.
But I am not so sure anymore, as the PCB looks somehow different inside the TPP0500 or TPP1000.

Very useful. I'll give it a go, not in the lab at the moment, will be back later today.

As I am sure you know, the scope band limits the TPP0250 probes internally to 250MHz. It'll be interesting to see what sense it makes out of a TPP0250 masquerading as a TPP0500 or TPP1000!

Do you have any pics of the TPP0500 or TPP1000 internals by any chance?

The TPP0250 is a pretty good probe, with only 3.9pF loading. Combined with the scope, even when band limited to 250MHz, it works well, with ringing artefacts minimised and some almost text-book representations of real signals: I typically use a Jim Williams pulse generator with a 6ns stretcher and a CMOS level 125MHz canned oscillator for my comparative tests. This may well be a double-edged sword: whether the lack of ringing artefacts are down to the imposed band limiting or not I don't know yet. But if it is, would you really want your signals to be messed about with involuntarily? Well that's hypothetical for now!
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Well, I reprogrammed my TPP0250 with the content of the TPP1000.
Unfortunately, the result is not satisfactory as the amplitude change when reprogramming the probe.
I did the compensation with the scope but that changes only the edge ...
Looks as if there are some more data coded onto the probe.

Identified content of the 1-Wire chip:

0x0C to 0x12 is the name of the probe
0x14 to 0x1a the serial number of the probe
0x1C is different for a TPP0250 but not for any other probe; 0 for TPP0250 all others so far 1
0x34 to 0x35 identical for each type of probe but different to any other
0x64 to 0x65 identical for each type of probe but different to any other
0x6F checksum or something similar

I have some pics of the TPP0500 and TPP1000 but the metal guard I haven't removed.
So I cannot see whats below; but anyway, the guard of my TPP0250 was soldered with two vias
the TPP0500 and TPP1000 was soldered complete onto the PCB.
I will upload some pics later.

 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5410
  • Country: gb
I'm afraid I have to report the same regarding trying to fool the TPP0250 into being a TPP0500.

After compensation, it behaved worse than the TPP0250!

Trace below are with a Jim Williams pulse generator with a foot or so of coax to extend the pulse width, and the pulse generator output is terminated with a 20dB SMA pad before probing.

Probing for the first two traces was done with the spring ground and pogo pin directly onto the pad.

(I would take the rise times shown with a large pinch of salt and make an estimate yourself: the measurement indicators don't seem to be making terribly sensible decisions all the time.)

Reference trace, original TPP0250 compensated.


Scope fooled into thinking it's a TPP0500, after compensation.


Direct connection of pulse generator+pad into scope, no cable, 1M ohm termination


Direct connection of pulse generator+pad into scope, no cable, 50 ohm termination

« Last Edit: October 02, 2015, 09:09:42 pm by Howardlong »
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
So here are more images of the TPP0250, TPP0500 and TPP1000.
As I previsously mentioned, the PCB is different between TPP0250 and TPP1000/TPP0500 but if the components differ, I don't know
as I haven't open the cage of the TPP1000 and TPP0500.

The values of the tpp0250-pcb-front-values.jpg are measured with an multimeter; therefore, the capacitance values are questionable.
R6 can't be measured without removing L1 as they are parallel.

If someone will like to open the probe too, you have to remove the sticker half way
(can be one without any damage ...), see open-back.jpg such that a screwdriver can unlock the
snap tap. Then you have to press the unlock button, see open-front.jpg.
While doing this, you should be able to easily separate the two parts.
« Last Edit: October 03, 2015, 10:21:48 am by steffenmauch »
 
The following users thanked this post: Mechatrommer, luisprata

Offline jdoshier

  • Contributor
  • Posts: 10
  • Country: us
One thing for certain is there is no justification for the TPP1000 to cost $1000 USD. 8)
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Got one step further:

using the hidden debug console and probesDumpVpiData, I got the following data
when one TPP250 is connected:
Code: [Select]
==========================================
CHAN 3:
==========================================
    probeType:                12
    VPIDataValid:             1
    tpaBncAdapterIsPresent:   0
    baseScale:                0.1
    offsetCapable:            0
    offsetScale:              1
    rangeCapable:              0
    number of ranges:          0
    couplingCapable:          0
    bypassCapable:            0
    dcRejectCapable:          0
    autozeroCapable:          0
    degaussCapable:           0
    dynamicHalf:              1
    maxPower:                 2.5
    coupling:                 0
    fileSystemAvailable:      0
    filterFile:               
    inputUnits:               V
    typeId:                   TPP0250
    serialId:                 C027350
    fwVersion:                v0.01
    numberOfPathSwitches:     0
    probeDegaussState:        0
    probeAutozeroState:       0
    baseBandwidth:            2.5e+08
    baseDelay:                5.3e-09
    eventQueueCapable:        0
    autozeroCorrection:       0
    FWVersionMajor:           0
    FWVersionMinor:           1
    unsupportedElements:      0
    inputR (probe tip):       1e+07
    inputCapacitance:         3.9e-12
    hostResistance:           250000
    hostResistanceHigh:       750000
    hostResistanceLow:        150000
    measuredOutputResistance: not specified
    seriesR:                  9.74e+06
    seriesC:                  3.25e-12
    shuntR:                   1e+31
    shuntC:                   4.33e-11
    effectiveR:               1600
    dynamicRange:             300
    driftLimit:               0
    bandwidthCapable:         0
    numBw:                    0
    enumCount:                0

The dump of 1-wire chip of the same probe is here:
Code: [Select]
0x05 0x03 0x31 0x70 0x9E 0x6B 0x04 0x03
0x10 0x5D 0x14 0x02 0x54 0x50 0x50 0x30
0x32 0x35 0x30 0x00 0x43 0x30 0x32 0x37
0x33 0x35 0x30 0x00 0x00 0x01 0x06 0x12
0x4B 0x1B 0xB6 0x31 0x06 0x16 0x80 0x96
0x18 0x4B 0x06 0x18 0x14 0x38 0x89 0x2C
0x06 0x14 0x28 0x6B 0x6E 0x4D 0x06 0x1A
0x00 0x00 0x96 0x43 0x06 0x10 0xCD 0xCC
0xCC 0x3D 0x0E 0x5D 0x00 0x24 0x74 0x48
0x00 0x1B 0x37 0x49 0x00 0x7C 0x12 0x48
0x17 0x8A 0x01 0xE0 0x9E 0x14 0x4B 0xCC
0xB2 0x64 0x2C 0x7C 0x6F 0xFC 0x72 0x77
0x6F 0x3E 0x2E 0x00 0x00 0xC8 0x44 0x08
0x85 0x01 0x00 0x02 0x03 0x01 0x04 0x3D

As e.g. tpaBncAdapterIsPresent is mentioned, all the data do not have to be directly related to the content of the 1-wire chip.
Right now, I do not have a TPP0500 or TPP1000 to compare :(
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
It took a while but now I also have the 'probesDumpVpiData' of a TPP0500 and a TPP1000.

Code: [Select]
==========================================
CHAN 1:
==========================================
    probeType:                12
    VPIDataValid:             1
    tpaBncAdapterIsPresent:   0
    baseScale:                0.1
    offsetCapable:            0
    offsetScale:              1
    rangeCapable:              0
    number of ranges:          0
    couplingCapable:          0
    bypassCapable:            0
    dcRejectCapable:          0
    autozeroCapable:          0
    degaussCapable:           0
    dynamicHalf:              1
    maxPower:                 2.5
    coupling:                 0
    fileSystemAvailable:      0
    filterFile:               
    inputUnits:               V
    typeId:                   TPP0500
    serialId:                 C014152
    fwVersion:                v1.01
    numberOfPathSwitches:     0
    probeDegaussState:        0
    probeAutozeroState:       0
    baseBandwidth:            5e+08
    baseDelay:                5.3e-09
    eventQueueCapable:        0
    autozeroCorrection:       0
    FWVersionMajor:           1
    FWVersionMinor:           1
    unsupportedElements:      0
    inputR (probe tip):       1e+07
    inputCapacitance:         3.9e-12
    hostResistance:           250000
    hostResistanceHigh:       750000
    hostResistanceLow:        150000
    measuredOutputResistance: not specified
    seriesR:                  9.74e+06
    seriesC:                  3.25e-12
    shuntR:                   1e+31
    shuntC:                   4.33e-11
    effectiveR:               865
    dynamicRange:             300
    driftLimit:               0
    bandwidthCapable:         0
    numBw:                    0
    enumCount:                0


==========================================
CHAN 2:
==========================================
    probeType:                12
    VPIDataValid:             1
    tpaBncAdapterIsPresent:   0
    baseScale:                0.1
    offsetCapable:            0
    offsetScale:              1
    rangeCapable:              0
    number of ranges:          0
    couplingCapable:          0
    bypassCapable:            0
    dcRejectCapable:          0
    autozeroCapable:          0
    degaussCapable:           0
    dynamicHalf:              1
    maxPower:                 2.5
    coupling:                 0
    fileSystemAvailable:      0
    filterFile:               
    inputUnits:               V
    typeId:                   TPP1000
    serialId:                 C013501
    fwVersion:                v1.01
    numberOfPathSwitches:     0
    probeDegaussState:        0
    probeAutozeroState:       0
    baseBandwidth:            1e+09
    baseDelay:                5.3e-09
    eventQueueCapable:        0
    autozeroCorrection:       0
    FWVersionMajor:           1
    FWVersionMinor:           1
    unsupportedElements:      0
    inputR (probe tip):       1e+07
    inputCapacitance:         3.9e-12
    hostResistance:           250000
    hostResistanceHigh:       750000
    hostResistanceLow:        150000
    measuredOutputResistance: not specified
    seriesR:                  9.74e+06
    seriesC:                  3.25e-12
    shuntR:                   1e+31
    shuntC:                   4.33e-11
    effectiveR:               800
    dynamicRange:             300
    driftLimit:               0
    bandwidthCapable:         0
    numBw:                    0
    enumCount:                0

Comapring it with the TPP0250, one can see that the fwVersion is changing but most important, the effectiveR is changing.
I do not have any clue of the meaning of this value ... anyone else?
Interesting is that the TPP0250 are bought recently whereas the TPP0500 and TPP1000 are older but still having a higher fwVersion.
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 837
  • Country: es
VPI dump processing tools: check/correct checksum, dump data as len-tag-value. Requires Python 2.x
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 837
  • Country: es
Value at 32-35 is baseBandwidth in 32-bit little endian float format (this converter works fine on it: http://www.scadacore.com/field-applications/programming-calculators/online-hex-converter)
Value at 63-66 is effectiveR in same format.
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 837
  • Country: es
Dump tool updated to display floats and some field names.
Also found a second checksum: 05 03 31 70 9E - 9E is a checksum of [05] 03: 31 70, but it looks like there is no point to update the teksum tool since this field never changes
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Wow thats amazing. I extended the python script just a little to display the seriesR, seriesC, ...

Also, I attached a Octave/Matlab script to generate the 1-wire sequences when using a BusPirate.
You can now easily reprogram your probe as desired :)

P.S.
Today I had the TPP1000, TPP0500 and TPP0250 side-by-side and the cable of the TPP1000 and TPP0500 is thicker compared with a TPP0250.
Additionally, the plastic chassis of the tip is different of the TPP1000 and TPP0500.
Looks as if, at least some, :-DD physical properties are different between the three probes.
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5410
  • Country: gb
Even the TPP0250 is a good probe, although only usable with compatible Tek scopes as the compensation is done internally in the scope, not on the probe.

With only 3.9pF of capacitive load, it gives impressive results, although the scope also band limits the signal to 250MHz when it detects the TPP0250, so it is likely that the results, although they look good, may be rather synthetic due to the processing.
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 837
  • Country: es
I think you should try changing just the baseBandwidth field (copy it straight from 500/1000 dump), leaving all other parameters as is. Not sure if the physical properties will allow anything significantly higher than 250MHz, but it shouldn't get worse at least
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
I think I know why whe had no luck when faking the TPP0250 as TPP0500 or TPP1000.
The TPP0500 and TPP1000 uses an internal 250k termination.
I don't know why but look a the image ...

 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5410
  • Country: gb
I think I know why whe had no luck when faking the TPP0250 as TPP0500 or TPP1000.
The TPP0500 and TPP1000 uses an internal 250k termination.
I don't know why but look a the image ...

Kinda weird to use 250k termination as these are 10:1 10Mohm probes.
 

Offline luisprata

  • Regular Contributor
  • *
  • Posts: 61
  • Country: br
« Last Edit: April 09, 2016, 04:55:03 am by luisprata »
 

Offline luisprata

  • Regular Contributor
  • *
  • Posts: 61
  • Country: br
Did anyone measure the loss of the probe? How many ohms from probe tip to connector? It's different between them (TPP0250-TPP1000)?
 
« Last Edit: April 09, 2016, 03:02:54 pm by luisprata »
 

Offline luisprata

  • Regular Contributor
  • *
  • Posts: 61
  • Country: br
Hi all,

TPP0250 is also 250k terminated.
I connected wires to ground and detection pin of the probe. Without plug the probe completly, I only connected this wires to scope leaving BNC exposed.
The scope detected a probe, then using a multimeter, I've tested the resistance on scope`s BNC. It showed 250K.

Other measures:
Loss of the cable TPP0250: 270 ohms aprox.
The tip resistance TPP0250: 9.75MOhms.

I also measure R6 (248 ohms) in schematic of steffenmauch post.
I can't confirm 70pF capacitor values. By indirectly measuring I've found about 50pF (what is close enough to 70pF).

I've tested the probe without R2 (that connects R1 and R5 to C2) and I didn't notice any change. Is this part of circuit some kind of bandwidth limiter?

Thank you.
 

Offline steffenmauch

  • Contributor
  • Posts: 33
  • Country: de
Hmm, the 250k are curious for the TPP0250 as the messages in the Tek gui only names TPP0500 and TPP1000.

Right now there is a very cheap TPP1000 listed in Ebay america ...

http://www.ebay.com/itm/Tektronix-TPP1000-Passive-Voltage-Probe-1-GHz-10X-3-9-pF-/281994065029?hash=item41a827f485:g:cMkAAOSwjwlXBFel
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf