Hi Somebody asked me if I could reverse engineer the Mixig Dp-1007 High Voltage Differential Probe that we looked at, did a tear down of and some experiments with in the previous video linked in down below if you haven't seen it because I have actually torn down a differential probe before and explained with the intention of explaining how the differential probe actually works. So once again, linkedin somewhere up here and down below if you haven't seen that video. Highly recommended. It was quite popular and this is where I uh, reverse engineered the Uh.

Lacroix slash Sapphire High Voltage Differential R probe. and if we take a squeeze out of here you can see that it's really old school, all through-hole design and everything. Absolutely fantastic. Designed by Mr.

Wu. Everyone knows Mr. Wu designs the the best uh probes. so Mr.

Wu from Sapphire Absolutely fantastic. Anyway, all through whole design and stuff like that, they did rub the numbers off the chips here, but whatever the intention was was actually to get a reverse engineered schematic of how this one worked. This one actually had uh, discrete effects on the input and it, you know, like a standard Op-amp differential amplifier, front-end high voltage resistor divider string here, and stuff like this. and this is how all high voltage probes work.

So we're going to have something very similar here, but instead of the discrete fets here, we're actually going to have just Fit input, high speed fit input, Op Amps area. I thought yeah, it'd be interesting to, uh, just reverse engineer this and get at least a partial schematic out of I don't want to do an absolute full schematic because I don't see any reason to like reverse engineer like the power supply and maybe the micro controller and stuff down here. That's like meh. It doesn't really matter, but this is not going to be a how to reverse engineer because I've already done an extensive video which was very popular.

Got 153 000 views. Also linkedin in the cards up here and down below and this is how basically how to do reverse engineering of a Pcb. In this particular case, I use the example of the Rygold Ds1054z oscilloscope and the front end for it. Lots of cool tips in here of how to actually do this and uh, the way that I used in this particular case was to actually get photos of the board.

Make sure your camera is like right on top and it's centered and your board's flat and then you convert them to black and white and then you convert them. I use Earphone View here. Highly recommended. I'm an Earphone View fanboy.

Um, I use Openview to then convert to like what I use the find edges tool so that it kind of uh, creates like an edge outline. like this I show how you can actually then lift them up and you can put them back down and then you can flop essentially flip-flop between see what I did there mirror or weak flip-flop between the top and the bottom so you can trace things out. And the good thing about using the transparent overlays is that you can use marker pens to uh, then mark off all the components and traces i use uh, whiteboard markers and then you can mark them off anyway. There's lots of other tips in here that there you go.

You can actually mark it up like this: This is a how to reverse Engineer video and lots of tips how to do it so I'm not going to cover that in this video. By the way, I mentioned this on Twitter and a lot of people seem to agree with me that I reckon there's a niche market out there for a tool, a reverse engineering tool that was just dedicated to this particular car and task and what it needs is it's just like a image editor like this that allows you to load in two photos, one top, one bottom. possibly with some alignment and stuff like that, but you can do that yourself but then has like a big fader bar or something like that that just allows you to fade between the two images like this, right top and bottom like that and then it'd be really cool if I had like a toolbar up the top here that just allows you to like mark it up mark like you know like a you can put like an x on like components. you can just click and it put like? an x on a component that you've already marked off and maybe a different color highlight for traces and things like that when you're on the top.

like this did show all the components of the top that you've done and then when you faded through to the bottom like this, it had changed to all the components that you've marked off the bottom and stuff like that. That would be really cool. It'd be an absolute bonus if that particular program actually you know, allowed you to like. Maybe create a schematic netlist or something like that in keycad or something like that.

That'd be really cool. But even like just a program, I'm sure there's some people out there who could just write this in like five minutes. But done, That's easy, Dave. No worries.

here it is. Um, yeah. like there's probably myself and a lot of other people would probably pay for a a dedicated Pcb reverse engineering tool like this. Leave it in the comments down below.

I'm sure all my audience can come up with many different ways to make such a program useful, but I think that would be really cool. anyway. The way I'm fading between these at the moment is I'm actually using my video editing program Magix Vegas formerly Sony Vegas and I've just put the two images one on top of each other and I'm just simply using the fader bar. I took these photos not intending to actually reverse engineer this because it's important when you take these photos to have the board completely flat like it needs to be completely flat or the camera needs to be completely right angle with the board.

And also, you've got to use a proper one-to-one macro lens. That really helps. Otherwise you get like distortion of the board and and you know it warps with the lens and and things like that, so it's really important to, uh, get that. So when I took these photos which are available on my Flickr account, by the way, when I, oh, almost always when I do tear downs, I actually, uh, not just do video, I actually take macro photos as well.

and I always put those on my Flickr account. So I've probably got like a hundred different tear downs of all high res tear down photos on my Flickr account, so I'll link that down below if I remember. So anyway, I didn't intend to actually do this reverse engineering video, otherwise I would have put a bit more effort into making sure these boards were completely flat. It's really difficult when you've got like cables like running off this thing.

You've got big components like these Tor components like the Dc-dc converter, or big electrolytic caps or whatever it is. It's often hard to ensure that your board is a completely flat relative to the camera. and of course, you could actually set this up. And if I was, uh to do this, I would have put the board in my light box with like little standoffs like this so like on each corner of the board.

So I knew that the board was completely flat and then the components wouldn't affect the you know, it wouldn't wobble and all that. but I just sort of like just took basic, uh, photos like this so um, with no intention of reverse engineering. So I've done my best to sort of line them up and overlay top and bottom like that so you can see like on this side over here it's a little bit off. Um, but yeah, it's It's good enough for Australia, right? I'm going to be able to easily reverse engineer this.

So anyway, this one should be fairly easy to reverse engineer because although it is a full layer board and you can see the dark outline in there, that's the internal ground plane. You can see the ground planes like that and often, uh, you can hold these things up to a light box. it board up to a light box as well. You can take photos of them through a light box and that helps like expose, uh, the inner layers and stuff like that.

but in this particular case, we've got hardly any traces on the bottom. Look, we just got a couple here like this: these are just like. these are probably just, uh, like the power supply bypassing for the fit and power supply filtering. so this one's going to be pretty easy.

I shouldn't have to put much work into it now. Of course, when like traces go under components like this, this is when you this the all these tips are in my reverse engineering video. Yeah, you might have to start off like you know, scraping off like the annulus ring around the via or something like that and then probing out where things go. And like you know, sweeping your probe across the board to find where all the uh traces go.

And if you want all the values as well, you often have to go in there and measure them. and some of them are hard to do in circuit. But you know, if you want to know what the value of these capacitors here is, I don't know. Is it you know, a couple of puffs? Is it tens of puff? I don't know.

something like that. I might even have to lift components out of circuit so I'm not going to go into a huge depth to do this. It's just going to be a bit of a how you doing job. These high voltage differential probes.

You know how they're going to work. They're going to have a symmetrical string like this so I wouldn't even bother reverse engineering this bottom part down here like this. There's just no point because it's going to be completely identical to this top half up here. This is how differential amplifiers work.

It only starts to differ when you start talking the nitty-gritty details around the output side of the fet input buffer here, and the output over here is once you've done all the work up there, this bottom one, you just duplicate it. But of course, every circuit is different. Some are a pain in the ass, some are relatively easy. Like this one, I can see most of the traces.

And the good thing is once you learn all your building block. uh, circuits. you can pretty much guess when you've gone wrong. Uh, like if you can see that.

Oh, this Op-amp doesn't have any feedback. Oh, I forgot to, you know, R49? There is probably the feedback resistor, for example. So like it's pretty obvious when you've goofed up or you've shorted things out and it doesn't make any sense. Things are connected here or there that don't make any sense, and sometimes it's really obvious if you know your building blocks.

It really helps if you were reverse engineering this without some of that knowledge. It's just a little bit harder to spot obvious goofs. but I don't think I'm not going to print like a transparent overlay like I did for the rygole scope. for this, I don't think I need to.

I'm just going to fade. Between that and that, measure a few things. And Bob's your uncle. Um, hopefully we'll have a half polished turd of a schematic at the end of this.

Okay, so I'm part of the way through and here's a progress. Pretty easy up until this point. and now I've got to do the feedback resistor on the Op Amp here. Obviously, it needs a feedback.

uh, resistor. You can see that. As I said, r49 here, that seems to be the feedback resistor because look, two traces bugger off under here like this. so you've got to assume that that one goes down there.

I actually have put the product back together so I can't actually, um, I have to crack it open if I want to measure anything at this point. So this is obviously go into the output, which is Pin Six here. and you can see that buggering offer to the output resistor divider here and the relay switch in for the gain. But you notice that there's no other resistor here.

and obviously the other side of this. R49 here obviously goes to pin two. Pin three is the positive, so that's the input and then pin two is the negative, the inverting input of the Op amp. But there's only one resistor and if I drag that under like that, you can see that there's no other resistors on the bottom.

So if there's only a single resistor for the feedback like this and it's a standard Op-amp then well, then you can see like these are. There's obviously an inductor here and a cap, which then occur. A couple of caps are for different frequencies, which then uh, powers the Uh chip. so that's filtered.

but there's no other resistors here. So obviously by deduction, I can draw that resistor in there is going to the Um input like that. so it's a unity gain buffer. I didn't think that Op Amp was capable of unity gain, but apparently it is.

No wackers whatsoever. There it is 325 megahertz unity gain bandwidth, maximum bandwidth 325 meg. It's plenty. And then you'll notice that in here the positive input.

Here, it has two additional trim pots, which the negative side does not. so obviously they're using these to balance out the positive. all the variances in the positive input compared to the negative input, and this can improve your common mode rejection ratio. So obviously, once you've drawn this one, you know that this one's going to be identical.

except that one of the resistors in here is going to be replaced by one of the trim parts, and you'll notice that. Sure enough, this has a block of four resistors here. Like this, this only has three of them and it goes off to the resistor here. So clearly it's exactly the same.

Except this resistor here, which is R34, has been replaced by a trim pot. So when you go in and draw it, there's our negative input there that has fixed resistance. The positive one just has that one there, just replaced by a little trimmer there and the other trimmer down here. Like this is just to compensate for the gain divider that's fixed up here and they just and then trim it.

Somebody goes with their tongue at the right angle and trims that sucker to the right value. So there you go. that makes sense. I don't even need to buzz that sort of stuff out on the board, even if you can't see the traces going under the parts or whatnot, which well, you can't like.

You know there's some traces under here which I just physically can't see, but it's obvious that's where they're going. Now here's a really annoying thing. I'm trying to trace out the micro controller on here. What we've got on here is obviously a Qfn 16 package.

Four pins per side there. It's one of these Efm8 busy B things or something. B you get the data sheet and there's no. there's an Soic 16, but there's only Qfn 20s.

And sure enough, if I go to Like Digikey and search for all of the Busy Bee parts 596 of them, the only available packages are 16 pin chip scale and uh, Soic. And and the chip scale one is, of course. um, like the little Bga thing pain in the ass so that's annoying. Is it like an obsolete package that they've discontinued or something? Or is it in some other series that Digikey happened to not carry? Ah, and that's a trap for young players, including Dave.

I quickly realized that yet here's the footprint. They're all Qfn 20s. There's four extra pads on the corner there, which you can't actually see inside here like this. like you zoom like I'm I've also got like a zoomed in uh, picture up here.

and oh no. Actually, I can just see it. there. It is there.

maybe. Can you see a tiny little bit of solder on the side there and there? And sure enough, I should have Not like. There's a track going in there. There you go.

Yep, another track going in there and another one going in there and that one's probably not connected or it's going under there doll. and Qfn 20. don't rely on your mark. One eyeball trap for young players.

Anyway, my input here comes across here, goes over to here, goes over to here that's a not fitted part and then goes into Pin. Now that I know it's a 20 Pin 18.. So yep, goes into Pin 18. So the feedback from the output goes into Pin 18..

So looking at the pin outs here, sorry, I haven't got my green screen this time and couldn't be bothered turning my lights on. So yeah, whatever. Uh. Anyway, let's go down here to the package: 20 Pin Qfn There it is there.

So Pin 18 there is Po4 18, multi-function Io. It's a Po Mat, whatever that is, it's an Adc. Okay, there you go. So it's an Adc input comparator.

positive and negative. so I don't think they're doing any comparator function with it. Can't see why you do that on the output. This is this pin is directly sampling the output via two series resistors.

That must be what measures the clip in for the output because you saw in the previous video how the lead button flashes. If you get over range, that's how they're doing it. That's going into the Adc And here's where we enter the bizarro world of the 6604. It's a sort of six pin slot 23 package down here, and well, if you go, look this up.

Um, okay, there's no one 6604. so if you actually know what's going on here, please leave it in the comments. But anyway, here's an Mch-6604 from On Semiconductor. Okay, it's a dual mosfet.

As you'd expect in a six pin package. If you know, you wouldn't get a six pin package. Uh, for a mosfet unless you're you know, unless it's a dual jobby, this one's actually not a sot uh 23 package. so it's not the actual one.

Anyway, it's a dual end punch in channel power mosfet and we'll have a look at the pin out in a second. But if we go over to this one over here, this is an alpha and omega one. Um, Ao6604. and well, it's look an N channel and a P channel.

It's a six pin slot 23. So yeah, okay right. So you can, you know, use them like as a totem pole output or something. Uh, like you know, totem pole driver or something like that.

You know, really handy kind of thing. motor drive stuff like that. So very handy. N channel and P channel in the same package? Nice, But you go over to this one.

Ah, this is a Toshiba Tpc 6604 jobby and well, let's have a look at this one. Um, that doesn't look like a mosfet that looks like a bipolar. Um, yeah, and it's a single. It's not a jewel.

so what the heck? Um, I found like three just searching three different types of 6604. Anyway, if we go to the actual board in here, you can see they're actually connected in parallel. Whatever it is that they've got inside in here look parallel like that. These are the gate terminals on one of the package.

the gate terminals and this was like the uh, source I think on one of them or the drain or whatever. and they're both connected in parallel. Okay, and that obviously goes off to the relay drive. but this other one here.

Once again, they're connected parallel depending on the configuration and that's going up here and I can't actually see under there. but well, I don't know where. like I assume, it's going over to the other side of the relay here. So are they like differentially driving the relay? Why I you know the Micros obviously are driving this thing.

like the gate, this trace here. If this is the gate, right? I like. I think all the gates connected inside there like that. and if you have a look on the bottom side, there's just a couple of.

there's just a couple of resistors and stuff in there and that'll go off to the micro which drives it. but I don't. I don't know why or what the heck's going on with that relay drive, so I'm not even gonna bother to try and include that. anyway.

Relay switches on and off. Which like I can only assume that they use the 6604 as a standard bomb item in many of their products and they just didn't want another type of transistor in here. But there you go. Um, no.

these are diodes. Okay, no. I thought the whole little uh, three pin, uh, transit? No. here's a no Q Q5.

Here's a transistor over here. Whatever. that one is 703. Why couldn't they use that to drive the relay? I don't.

I don't get it. All you need is like a standard Bjt to drive the or a mosfet or whatever single to drive the relay from. like the plus 12 volt rail or with a plus. Yeah, it's plus minus 12 isn't it or whatever.

And yeah, I don't know. I don't get it. Alright, so we've got my final Dave Cad here. Only final because I really couldn't be bothered going in here and like reverse engineering the Efm8 and the U6 and you'll see why in a second.

Anyway, Um, we've basically come to the conclusion that here's the output resistor here: 50 Ohm 49.5 and 9 Ohms. Good enough for Australia. Um, and that drives the coax out here. And then we're Actually, I don't know why they're tapping off two here, but they tap off the output here and then this goes into a dual op amp.

I forgot to put the part number on there, but anyway, it goes into a dual op amp in a standard inverting uh configuration. Here, it's just drawn a bit differently. don't When you look at building blocks like this, the positive goes down to ground there via a matching resistor. I've done a video on this and how that matches input, bias, currents, and things like that, but anyway, you don't necessarily have to have it.

You can just ground the non-inverting input there and that's a standard inverting op amp. I don't know where that actually goes out to. I presume it eventually goes back into the micro somewhere because what is the functionality of this thing? It just simply reads the output and and flashes the lead for uh, like, over range. and then it controls the relay.

Um, here. So yeah, like that'll have a like a transistor, that weird R6604 transistor driver in there to drive your uh uh, dual relay here. and which switches the gain by the way, um on both of the channels. But anyway, so the Efm8, it doesn't really have to do much, but if we have a look at the actual board for this thing, uh, the bloody thing doesn't retain my um, zoomed in status.

Anyway, here it is. So here's our 50 ohm output resistor. This is our coax up here. I've just zoomed in a bit more and here's R26 that we had there and that goes into this Op amp up.

It goes into the Op Amp here. so this is. I don't know what part that is a Ti 98. I had a look, Opmi had a look, I don't know if you know what it is, leave it in the comments down below.

but anyway, it looks like it is a Ti jobby of some description. Uh, couldn't be bothered decoding the part number. But anyway, yeah, so the top half of the Op amp in there is the basic non-inverting uh sorry inverting Op amp. So I I don't know what the bottom Op amp is doing and look at all these parts around here.

I don't know what's going on there, but anyway like because once again I I put this thing back together and I so I haven't bothered to. Actually, I don't have access to it again. I couldn't just couldn't be bothered taking it apart. Um, to get into the nitty-gritty detail.

But look, there's a lot of stuff in here and what these diodes over here are doing. And and stuff like that, they've got three diodes over here. We know that this tap r22 as we saw on the schematic. this goes down here.

This jumps. This actually jumps over to the on the bottom side over to here. and this is what then goes into that pin of the micro that we saw, which is actually either an Adc or a comparator. I don't know where.

Yeah, I don't know what how it could be a comparator, so I think that they're using that as an Adc. But why They have to read off both sides of this? Um, I presume. Maybe it's got another error detection mode to detect shorted output. Like you know the load is shorted your oscilloscope's you know you're shorter the output or whatever.

Um, so yeah, I don't know, but there's a awful lot of stuff in there from Micro. That's its only purpose essentially is to drive this relay off and on. When you push a button, you know which range do you want, the times 10 or the times 100 range and it just switches that relay and then it just flashes the lead when it's over rain. So all it needs is like an Op-amp like the Abc and Bob's your uncle, so I don't know.

I don't know if you've got any ideas leave it in the comments down below, but yeah, I couldn't be bothered actually reverse engineering. um, the whole kit and caboodle. So anyway, um, yeah, this is rather interesting. So I am actually surprised that they use, um, quite.

Um, you know, like 1206 parts in here. I thought, you know, I'm surprised to survive the 1100 volts Rms that we actually put on it because normally I think 1206s only have a 250 or 300 volt rating each, don't they? So you know like you're really like, yeah, you're pushing your luck there. But it's interesting that, uh, this one and I think somebody on the forum mentioned that one of the higher end models doesn't have these trimmers or doesn't have one of these trimmers or something like that. I think it's the Cmrr one from memory, So yeah there.

So anyway, they have added a common mode rejection ratio trimmer in here, which just means that you're matching because common mode rejection ratio will, uh, involve. You know, if these are unmatched. If the value of this string here, which includes these resistors and the lower divider resistor here, then uh, if they're unmatched, I should show you the schematic for this. So if the bloody yeah, why can't you keep the zoom status? What's going on here? Maybe there's a setting? I don't know.

Anyway, I'm using drawboard Pdf For those who don't know, it's got like this laser tool that can you know if you draw it like this, it'll go like that really cool and you can just do up, you know, annotate Pdfs. It's really quite cool. Anyway, I think it's designed for like it's an Australian software which uh designed for like uh, marking up Pdfs for like architects and things like that I think and stuff like that. Anyway, we can have a yeah so if if this entire string here is unbalanced compared to this one up here, and that's going to screw up your common mode rejection ratio.

So that's why they have the Cmrr trimmer in there and then they've got a gain trimmer here just to match the gain for the differential amplifier here. this is a standard differential, a single op amp differential amplifier circuit they aren't using like a specific diff amp. it's just a very high speed regular op amp and that's it. And they just do the relay switch in here for the gain which uh is determined by of course these resistors here and this one and these here.

So they they determine the gain of this because these are just buffer amplifiers here and that's it. Got a little bit of compensation there and this up here is interesting. This is A they've got a resistor on the bottom. Nf means not fitted so that's just a common thing on schematics if it's not or do not fit or you know, Dnf or something like that not fitted Dnf um and yeah.

so they've got these uh, footprints for the resistors but this capacity here. I've shown it as a shared capacitor because if we go over to the board here, you can see on the top side here the resistors aren't fitted and they've got these just pads and of course but a pad with another pad. on the other side is a capacitor. So yeah, they're just using those and they got one big square pad on the bottom like that.

I don't have the other one loaded up, but they've got one big square pad and there's another resistor in here like this which then goes to yeah, here it goes to here. so it's across that resistor there. So they've got some sort of like compensation network that uses the Pcb pads and I'm not sure You know it's obviously like some sort of upper resistor compensation or something. I don't I don't know what if you got any idea what they're trying to actually do there or tried to do, they didn't do it on the uh production version obviously.

So yeah. anyway and they've got uh, dual compensation down here like this. which is you know, going to town a bit. I don't know why they need the dual compensation but but anyway, like I haven't gone in like measured part values and stuff like that.

We just really want to look at the topology of this thing and it is a pretty bog standard uh you know implementation of a high voltage differential amplifier. the high voltage stream, the high voltage resistors like this, the lower side of the resistor divider completely matched. um, positive and negative. and this is once again, have a look at that video of how a differential probe works.

I go into a bit more detail, but there you go. Um, that's yeah. interesting. Anyway, I don't know what all this stuff and what's going on here.

I don't that's strange, Got any idea? Leave it in the comments down below. but I hope you found that video interesting. If you did, give it a big thumbs up. As always, discuss down below: catch you next time you.