Hi Now you've seen this little baby in several previous videos The Road and Schwartz HMO 1202 series scopes and click here if you want to have a look at the I've done a teardown a video of this thing I've also done videos for comparing the FFT MO which I really like on this thing and things like that. It's a really nice little compact professional scope you so I Love this little thing and you'll notice that at the top here it does not have a bandwidth listed on it, which is quite unusual and the reason they do that is because this is a software upgradeable bandwidth scope as many on the market are nowadays probably the you know a good majority of them actually have the full bandwidth inside them in the vertical amplifiers here. Well, the bandwidth is actually there, but then they software limit you via license keys and everything else else to various bandwidth. Now this one is available in 100 megahertz as the base bandwidth.

That's about Gos current price is about thirteen hundred US dollars for that one. and there's also a two hundred megahertz version and my one here is the three hundred megahertz version, but you shouldn't know it by looking at the front panel because you've got it's just a license key inside which upgrades the bandwidth. So even the base model hundred megahertz unit you buy for you know, twelve, thirteen hundred bucks or something like that is has the full 300 megahertz bandwidth in here. So I Thought: just for educational purposes, we will crack this thing open yet again and we'll have a look at the front end here yet again and see what chip it's using, what topology it's using, and see if there's any little tweaks that we can make to potentially get greater bandwidth out of the base model.

you know? Unfortunately, I've actually got unfortunately in quote marks I've got the 300 megahertz the license keys already installed for this one because full bandwidth, but we should be able to probe some things and and have a look at how they're actually doing. That should be fun. Let's go. and the only thing that tells me this is a 300 megahertz version is just this sticker on the back they've got here, so they've obviously this is done at the factory they've worked the sticker on, but you can actually buy the license upgrade later.

So here's inside the unit as we've seen in the previous site: teardown video: I Got metal cans on the top here for our two analog channels and unfortunately metal cans on the bottom which are even more unfortunately soldered in place. but there's only one point there, one solder point. so I can do solder that and lift this hand off without having to take the board out. So yeah, okay, small weed.

Now if we have a look at the front end here I've got that bottom side can off, then there's our BNC We've got to us some attenuation switching relays and these transistors down in here. they're probably them. those 23 packages. They're likely transistors.

They're probably the J FET front-end probably. you know, a couple of J fits and a BJT or something like that. And apart from that, if and I've got, here's a photo of the other side of the board. I won't bother taking the other side of the board I Think you have to get the whole board out to get that out died and there's nothing terribly interesting there.

The part we are interested in is, however, right here. That puppy that's doing all the business. and here it is. Sorry about the angle, but it's hard to read this number if you don't get annoyed at the right angle.

it's a 65 1/8 and this is quite a common part. You'll find these in a lot of scopes on the market and we'll see that this might be doing some magic. Let's go to the datasheet. So here we go: The LM 8 65 1/8 900 Megahertz digitally programmable Vga that's not video graphics adapter, that's variable gain amplifier.

and this is specifically look. It tells you a Scylla Scope programmable gain amplifier and this is the internal block diagram. There's an input preamp, there's a ladder attenuator which should be being used. Most likely it's being used by the volts per division setting, so we'll be checking that here today as well.

But look bandwidth limit in circuit right inside. there. There it is. That's what we're interested in and it's got a differential output driver so differential input differential output there.

and it's got an auxiliary port also tapped off here which you can use for triggering as well, so that's very handy to. you know when you select Channel 1 triggering. It's most likely going to be coming from here so we can actually go down. There's all sorts of jazz here.

900 megahertz, blah blah blah. We won't go through all the specs which are quite impressive. It's a very nice sir. Very nice part are perfect for scope front ends.

Here is our pin out. so we're actually looking. What we want to do is tap in to the serial line on this thing, the SPI line. So here they are: Chip select SD IO and s clock there.

So those three pins pins 9, 10, and 11. they're the ones we want to tap into to see. Oh by the way, here are the here. Here are the various art responses for the different attenuation settings which we'll see.

So if we go down here, they've got some very comprehensive parametric graphs there. I Like it. that's terrific and but what we want to do is see down here. Here's the signal path.

There's a ladder step attenuator. no problems whatsoever. As I said, the volts per division setting is probably doing that. Front in 10 you ators and we're getting we're getting down here.

Trust me, he comes. The exciting part, it's coming I know it Is I Know it is And there's an example digital oscilloscope front-end so maybe that's you Know there might have used this as an example of how to do this, but you know they've been designing scopes for a long time. They would have their own implementation. So here's the SPI pins.

It's three wire SPI interface. Here's the serial protocol stuff, which will no doubt have a look at. but aha, here it is. Table 6: the filer, filer, filter selection, data field and these are the bandwidths.

Look, you can actually choose full bandwidth if you're writing 0 0 0 to a register somewhere in the chip. Or you can get 756 5350. Not quite the 300 megahertz maximum bandwidth which this one has, so the bandwidth is most likely been limited somewhere else. Here's the theory, but the 200 megahertz and 100 megahertz bandwidth.

Bingo. They sell 100 megahertz and 200 megahertz versions of this scope. software license will software license upgradeable, so you can bet your bottom dollar. All they're doing is setting a couple of registers inside this chip.

You buy your license code, you plug it in, and it's you know, Got, you know? 200 megahertz for example. all they're doing is setting one, just changing a couple of bits in a register there. which limits the bandwidth inside that front end chip because they've already gone to all the expense and effort to design the 300 megahertz bandwidth, front end and characterize it and everything else. It doesn't make sense to really build a scope that has a 100 physical 100 megahertz limitation.

So the these companies very common these days. They actually build the bandwidth into the scope and then software limit the options and they do that in this case using a chip whereas I think one of the early Rygel ones where as the GS 1052 II was it or the could be the 1054 Zed as well I forget. but yet it's using like a very cap diode and then uses the digital line to drive that and it sort of sets a bandwidth limit and you know that sort of stuff. So this one uses a specific chip which has filter a programmable a digitally programmable filter analog filter.

It's not a digital filter analog filter built in and all you do is flipping those bits. So that's what we're gonna try today. We're gonna probe that bus and see if those bits pop it up I bet you they will. So this is real easy to find Here we go: pin one here and four pins per side exactly as per the Dutch sheet.

one two, three, four, five, six, seven, eight on that side and bingo 9, 10, 11 and look, they go out to convenient V is there so that we can put some little mod wire in there like difficult a probe like you. Yes you can probe them with your scope but trying to hold three on there at once as it, you know it's ridiculous. So yeah, what we'll do is we'll sold us some little you know, 35 gauge mod wire or something on there and we'll be able to then crack into that with our logic analyzer and see what's going on. That'll be fun.

And of course this will apply to any scope on the market. You that uses the LM H 65 one eight. and if your scope does use this chip in the front end and and and it's got like selectable bandwidth, then you can bet your bottom dollar that that's but there. That's how they're doing the bandwidth-limited in this thing because this thing has, as we saw in the datasheet, the 20 megahertz bandwidth limit.

So practically every scope has a 20 megahertz bandwidth limit, and this is almost certainly how they're doing it. If they have this chip, just send an SPI command in. Bingo! You've got your 20 megahertz bandwidth limit and it's most likely how they're doing the bandwidth. The software license upgradeable bandwidth as well.

So I'll do this using my Art Sugano microscope here. And yes, I've got a prop it up on some books, so why not prop it up on the Art of Electronics Beauty? So yeah, because it can't It's got a big working distance, but of course you can't have it flat on the bench and be this high up it just the working distance doesn't work there. So I've got my little remote control and we can zoom in. Yay! Excellent! All right, we're gonna use some 30 AWG wire wrap.

Why I should do the job. Otherwise known as mud wire Hack wire whatever you want to call it, let's go. No. I think that so damask coming over the pads.

it's almost not quite tinted. It's like you know, 10 20 % tinted which is really rather annoying. Hmm. we can access a pad, but yeah, having a hard time getting that iron onto it so we might actually have to go for a sharper, more conical tip to actually get right in there.

So let's give this one a bill. It's not often that I use the conical point tips so this is the for those playing along at home. that's the JBC tip. I'm gonna use now so we'll just whack some flux around that chip there.

This is all really fine. pitch stuff. You'd have a hard time doing this without magnification. I they you know I can I have done this stuff before without it, but yeah, it's just a real pain in the ass.

But yeah, I don't like our chances of getting down those videos. What I'll do is I'll just scrape away some of that solder mask first just so that I can get more iron contact on to the pad which then can maybe run to. Let's give that a bill. This could get messy, it looks ugly, but then you were clean it up and it looks just fine.

There we go I think we got one. don't like my chances of putting it down the hole, but that's okay. we'll just tack it there onto the pad. She'll be right.

a strict a bit too much off there I think and just apply a dab of flux again each time just to make your life easier. And bingo, we've got some more solder in there. By the way, with this some fine conical tip, you're gonna want to turn the temperature up. I've currently got it set to 325 where as our fine stuff like this I'd normally do with my wedge and things like that at like 275 you know, 270 something like even 265 something like that.

but because you know the physical surface area is not there, then you know you might have to turn your temp up a bit. But I found just a little experiment that you know I've had to. you know, up the temperature just a bit. This is why you need a temperature controlled soldering iron.

Every job is different. that's a bit nasty, but there we go. I think she flowed yes, I did Tim these wires beforehand, but yet you just want to put a fresh coat on there and don't have a big blob and we'll just clean that up a little bit and that will evaporate and she'll be right. No worries now.

I've deliberately left these wires long, so I can you know? handle the ends of them? put your probes on, get them off the board, and things like that because signal integrity is not a big issue here and allows us to put some tape on there. You definitely want to put some tape down on there so that when you handle these leads on the other end, there's no stress on those leads. So you can get down here. you know, hook up your probes and wiggle them around.

no problems whatsoever. Move the thing around the bench and you know you're not going to break your little tiny little joint in there. And of course, that wouldn't have been an issue. If we could have got these like down the veer properly and then would have had real, you know, a lot of mechanical strength, then we probably could have got in there with a smaller gauge like a multi-strand wire like this and we could have got in there and used that smaller stuff like that, Maybe got down the veer, but it doesn't matter.

This is more than good enough. We just want to prove it's not like a permanent fix or anything. But you'll notice that Channel 2 is picking up some 50 Hertz hum here because we've taken the can off. It's unshielded and we've hooked up lines in there.

Everything's capacitively coupled in all over the place. And yeah, that's interesting. so bugger it. I've had enough of using this thing.

the probe its own clacker. Let's have a look now at hooking up the SPI line here. So I've got all three channels coming in. By the way, it is not a true SPI as you know it, because SPI If we go in here is normally a four wire thing, we've got our clock out.

What bloody touchscreen! Our Mazi and our My So IE input and output data signals and chip select. But in this case it's actually a three wire SPI interface. It's still SPI buts three wire so it shares. It's bi-directional here, so it's not as great a throughput.

It goes tri-state and everything else. So anyway, we don't actually have specific support for that. so I've just set it up here. haven't set up the bits yet, but let's just trigger this thing and have a look.

I'll press the bandwidth button and Bam There we go. look at this. We've got our clock, We've got our data, We have our chip select. This is exactly what we expect and let's just have a look to see if this data it.

now here changes I haven't tried it. Okay, so we're in let's go to normal mode. so let's go to a quiet yet we're in normal mode. Okay, so we're gonna run it here.

we go. So I press it. let's press it again. Look Bingo! There we go.

Nice and now we can get in there and actually decode the bit. That's exactly what I expect. It's exactly as per the datasheet. Here it is.

It's exactly what we expected with the 24 bits or whatever. Here we go, rewrite, operate, write, operation. There we go. It's supposed to send 24 bits, the command and then the data field and we have the data for that and we can see the bit changing.

Yeah, it's somewhere over here. Yep, if you correlate it, look, It looks to be in the right spot to have the D6, d7, and D8 which is our filter selection field. All right. So let's just have a look at the first section which is the command section here and we'll just expand that out.

And here's where it starts here. and the command to write is a 0. by the way, the read is a 1 there. so that's basically it all the others are don't care so that's actually pretty wasteful.

So anyway it is 0 because it's the first transition. Remember after the chip select goes low which it which it is it has done which is way off screen. It does it some time before that, then the first positive edge there is and the data is a zero. So we are in right mode.

so it is writing and now we can and all these bits are zeros there or don't care. So then we have to figure out where the next bits go. Okay, so this first high here is actually if you count the positive edges there unless I'm wrong then that is the 14th count. So we've already got the first 8 bits are the command word so it'll be at 9, 10, 11, 12, 13, and 14 here.

So the first 1 bit there is, we're looking at the full power so it's not in full power mode. It's obviously in ox-hide mode. You have to look at the data sheet to know what that does. We don't care about that, we're after the filter, so the next bit is 0.

Sure enough, it is. And then Tada. Here we go. It's this bit, this bit, and this bit.

so we've got 0 0 1. Let's have a look down here. 0 0 1 Wow What do you know? Surprise surprise 0:01 20 megahertz bandwidth. No, who worries and what I'll do here just because I can I'll actually line up the waveform with this on the screen here.

That can just be a handy way to actually do it. And the way you do this is with your horizontal here. This is one of your uses for your fine horizontal control. So you go in there and because if you don't do that then you've got these huge big jumps right? Your was typical 1, 2, 5 sequence.

but if your go in there fine you can actually adjust this and move it across and all that sort of stuff. And we said before that that bit was maybe I should stick the paper there, but you know we said that. That first bit lined up with that one there and you just scale it to match. So there you go that's not actually too far out.

We could tweak it a little bit better. It doesn't help that these things and doctor even like D tenors like the width there. Anyway, we can see that this transition here this would be D6 down here. That's what we got 0, 0, 1 and then D5 it just squeezes in that one's a 0 as it should be and LG and HG mode I can't recall what that is.

We'd have to read the datasheet that's a zero so we're in LG whatever that is and see Table seven. This is the ladder attenuation field, so this value here is going to change based on the attenuation setting and what's required for the front end. so that won't change if we just change the bandwidth or anything like that. But when we change the volts per division setting for Channel 2, we'd expect this data here to change.

so we know that chipset is definitely being used for the 20 megahertz bandwidth attenuation, which exactly what you expect. There's no other hardware in there, you don't have to examine any other rest of the front end circuitry to know that the 20 megahertz bandwidth limit is being done inside this LM hey chip. So now we'll we'll undo the bandwidth. So remember my 1 is software licensed to 300 megahertz.

Okay, so we want to see what that go. - will it go to full bandwidth or will it go to the 350 mega bandwidth setting? Only one way to find out. Here we go: Oh Hit it and there we go. I Can jump back and forth between those and because we're triggering on exactly the same point.

This is really neat. All right, we'll be able to see it. So what we've got is we've got one one and zero. Okay, so one One zero.

Let's have a look. What's one one, Zero, One One zero. Oh, look at that 750 megahertz. Wow There's one there.

four full. so it's not zero Zero zero. But they're certainly not sending it to 350. So obviously because the - a 300 band with 300 megahertz band with scope? that's the maximum in this range.

Obviously, the 300 megahertz bandwidth is being done else. What? Like in the heart, the rest of the front end is only capable of 300 megahertz. so they're actually capping it there. But you can bet your bottom dollar that the 200 megahertz version and the hundred megahertz version of this scope would enable those bits there.

I 99.9% Sure. So there you go. That's interesting. No, obviously they've put it to a high limit.

Maybe they 750 just takes the edge off something? perhaps rather than just the full bandwidth because I think this chips capable of like 1 gig or something ridiculous like that. So yeah, it's interesting to know that they've chosen 750 are not 650 and not 350? I Can probably understand why they didn't choose 350. Maybe that would have an impact some of the roll-off there. and it's issues you know to do with pulse response to the front end and everything else.

so you know there you go. it's set to 750 megahertz, right? So let's now see well if this latter attenuation changes here when we change our Watts per division setting, it may not change on every setting, but let's give it a burl here. and whoa, hello, that's significantly changed. I Did not expect no, No.

I think maybe our timing is out. Is it I'm not sure I'm changing the time, but strange there. Would have expected everything here to remain the same. all of the bandwidth stuff, but it's not.

That's interesting. The bandwidth could change by the way. right down the lote. 1 millivolt per division or something like that.

but I'm going up to 2 volts per division. Something else is is happening. so let's have a look at that. There we go, that's better.

That's a better look at it. Well this is interesting look. we're getting no chips select now. when I do that? where's our chip select gone? But let's do the bandwidth.

The bandwidth does do the chip select and that's the invert button. I'm hitting the invert. Aha, Look, we're getting that. Are we getting that extra packet there? What's going on? Hank I'm not a single shot.

Capture that. Bingo. Look at that. So the invert is doing 2 writes that with no chip select.

That is interesting. Surely you need the chip select to also do the read you have to. But I Do find it rather fascinating that that's a hell of a lot more than not 24 cycles. But both of these are supposed to be 24 read and write to this serial interface.

This 3-wire SPI are supposed to be 24 cycles and we're getting a lot more than that. My only conclusion is that there's something else on the bus. The chip select is not going lower there. so this chip is not being selected.

This data is not destined for this chip. another one which we could capture. Perhaps that is doing the chip enabled. There we go.

So we need to actually trigger on the chip and able to get this. Okay, I'm now triggering from Channel 1 and Bingo There we go. That's the only data that matters. so there's other.

The only other conclusion Part B The only other conclusion is that there are other chips on this bus. hence why they're using the three wire interface with the tri-state ability. Because only the only the selling a chip has been accessed here. and that is the data.

So that's actually the data that's actually the data that we want to look at for the front end. Okay, so let's let's call that up there. we go. let's just have a look at it that way.

and now I will change the time base city there up there. We go there, we go. You can see it changing. all those low-order bits changing there.

Yep, low order bits changing stuff. I'm right down to 1 millivolt per division. 2 5, 10, 20. There you go.

Then there's all our lower bits, all our lower bits changing to match that data table there for the latter attenuation. So they are using the internal attenuators inside that chip as well as the bandwidth. So we have other chippies in there that are doing something old onto the same bus. Joe You know, annoying that sort of.

You know? It was a bit of a red herring there for a little bit, but yep, easily figured it out. Trigger off the chip. select. No worries.

Anyway, what I wanted to determine is that I was that filter being implemented in the LM Hey chip? And yes, it is exactly as it expected. No worries whatsoever in the attenuation. All that sort of stuff and almost certainly the bandwidth of these things with the license options is being set in the bits in that chip. And that's it.

Unfortunately I don't seem I don't I can't find an option to actually uninstall my 300 megahertz license here. If I was able to do that, then I you liking and revert back to the hundred megahertz base unit. We'd be able to verify that that hundred megahertz option tada in there was actually being set. and you can bet your bottom dollar it is.

That's how they're doing it because they've got a hundred Megahertz model. They've got a 20 Megahertz model. They're engaging the 20 megahertz, so they're definitely doing it. It's working for your regular 20 megahertz bandwidth limits, so almost certain that they're engaging both the because we know it's the same hardware and this seven 50 megahertz figure is being engaged.

It's been set when on. You know the full bandwidth for the three hundred megahertz version of this scope. So that's interesting that you could actually get in here and hack this thing. It's a bit ugly, but you could if you wanted to.

If you had the hundred Megahertz low-end version of this scope, you could have a little micro on that bus that actually inter bit bit because it's not a fault like a proper SPI bus. You can't just like plug it in series with the bus because there's other. As we saw, there's other chips here on the bus there right? so you don't want to interfere with any of those. But what you could do is any time that you you know you could sit in micro you could sit there and watch it.

It'd have to intercept the chip select line of course and then, but if it did that, you could actually feed data on there to do that. But you have to make sure that you didn't conflict with any of the other data here because you're writing onto a common data bus which is clearly shared with something y'all so don't know what. There's nothing obvious in the other front end. Some of the chips are not easy to identify and yeah, I don't know what they're doing so, but you've got to be careful not to overwrite that other data because who knows what's going to be happening.

But it's possible to actually get in there and just using you know little man in the middle attack so to speak. and you tweak those register studies to get yourself the full bandwidth scope. So there you go. I Hope you found that interesting and educational.

even if we did follow a few red herrings down a few rabbit holes there. It was fun nonetheless. So if you want to discuss it, leave comments down below a V bug for all the usual stuff I Hope you enjoyed it. Catch you next time! So this has got to be a Peb! CAC I'm just trying to sanity check to figure out what's going on here.

Sorry about all this, This is like real time. You know this is a real problem I'm encountering here so I'm going to show it. but like I'm getting nothing there I swear I swear I'm probing exactly the same damn point down there. there's the probes look Oh Exactly the same point and like what? what? That is One of the weirdest things.