Keysight 3000T scope 1 GHz(or more) hardware upgrade mod - Page 1
Forum section: electronics / testgear

author: TheSteve
author_rank: Unknown
timestamp: June 30, 2017, 04:03:13 am
content: My Keysight MSOX3024T was born with 200 MHz of bandwidth, it now has 1 GHz.There have been plans in the works to upgrade a 3000T series scope to 1 GHz for a while. The 1 GHz upgrade follows in the footsteps of the 3000A series 500 MHz upgrade found here -https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126Here are the main points of interest regarding the upgrade:#1 - This upgrade only applies the "T" series as the 500 MHz and below 3000A series scopes have a different PCB that cannot be populated with the required parts#2 - I think I was borderline crazy to perform this upgrade as there were quite a few unknowns. Parts list or not think long and hard before attempting this as a 3000T series scope is far from cheap and you'll lose any/all calibration and warranty on it. My scope channels didn't work on the first few attempts as every part that needed to be swapped was not known.#3 - The mod requires installing/replacing/removing 168 components, the smallest being 0402 in size.#4 - You will need decent soldering/rework gear and skills to perform the mod and should have a hot air station#5 - I was able to purchase all of the needed parts for under $200.00 USD including shipping/taxes#6 - There are no modifications to the firmware to perform this mod, no changes or patches to the flash memory are needed andthere are no hacked licenses etc. You don't require a network card.#7 - Any licensed features you already have will still operate just fine, including the MSO feature#8 - The scope's model # and serial # will not change, only the reported bandwidth is updated#9 - The mod is reverseable if care is taken to save/bag each component(highly recommended)#10 - You will need the required BNC cables and splitters to perform a User Cal.#11 - The parts list was compiled from pictures and component removal/measurement. I can't say the measured values are 100% exact and am not responsible if they aren't#12 - If your scope blows up, runs away, makes you bleed(mine did) etc from the mod I'm not responsible.#13 - All channels have a -3dB point greater then 1 GHz as they should#14 - The noise floor closely matches a factory 3104T scope#15 - User Cal passes with no issues#16 - The 20 MHz BW limit works just fine after the mod#17 - The 50 ohm path is much improved with the updated front end and use of the Teledyne 20 dB attenuator relaysNow this upgrade wasn't performed without some struggles. There were some missing parts in the earlier research so nothing worked at first. I identified those and kept going.I modified one channel at first to see if it looked like it would work. The trigger levels and such were way off but I expected that. The bigger worry was that on some volts/div with 50 ohms enabled the values were double what they should be. That seemed like a lot for a UserCal to compensate for. Turned out to be a non-issue as the front end attenuation switches in at 200mV/div for a 1 GHz model and 500mV/div for 100-500 MHz models. So a UserCal handles the problem just fine.The biggest issue though is that the amplitudes of each of my channels was not matched as the frequency got higher. By the time I had reached 1 GHz the channels varied by 5-10%.I spent considerable time attempting to determine why this is. I swapped many parts and experimented but was not able to pin it down to any one component. The difference does not appear to be related to passive component tolerance. It could be Keysight has additional calibration for higher frequencies, it could be the front end ASIC varies. It could be some mystery component that was not measured/changed. Ideally the schematic of the entire front end should be drawn up which would make for much easier analysis.In my specific case channel 1 had the highest amplitude, channels 2 and 3 matched each other and channel 4 was in between. The scope was 100% usable and when you're looking at high frequencies it is doubtful you're trying to determine the exact amplitude using a scope with an 8 bit AtoD. It still bothered me though so I had a play with LT SPICE and determined that changing the value of C1 slightly would alter the low pass frequency the nicest. To that end I changed the value of C1 to 2.4 pF on channel 4 and 3.3 pF on channel 1. This gives me amplitudes within 10-15mV between all channels when looking at a 1 Vpp signal at 1 GHz. The 3 dB cutoff frequency of all channels is between 1060 and 1070 MHz. At 1 GHz the attenuation is about 1.5 dB. Seems like pretty darn acceptable performance to me.Another forum member will be modifying his scope in the near future, so we will see how his does.The following forum members helped make this mod possible:memsetHardDrivemikeselectricstuffTopLoserHowardlongadranpHighVoltageEEVblog(Dave)And thanks to Keysight for making a cool scope that can do so much - please don't hate me!Here are some pictures:1 GHz signal @ 1Vpp in normal mode:The same 1 GHz signal with some averaging:The about screen after the mod:Rise time of a 10 MHz square wave before the mod:Rise time of the same 10 MHz square wave after the mod:A pulse:Input SWR of the 50 ohm path for both attenuation paths before the mod:Input SWR of the 50 ohm path for both attenuation paths after the mod:

author: TheSteve
author_rank: Unknown
timestamp: June 30, 2017, 04:04:21 am
content: 400 MHz ECL internal clock from an Agilent 33250A AWG measured with a 1134A 7 GHz differential active probe:Square waves:1 GHz signal with 3Khz 100% AM:My updated front panel label:

author: TheSteve
author_rank: Unknown
timestamp: June 30, 2017, 04:05:23 am
content: Here is the parts list and matching picturesNote all part identifiers reflect designators used in the the previous 500 MHz mod and diagrams where applicable.The following parts are listed per channel(so you'll need 4 of each for a 4 channel scope) I have included the part # of the exact parts I used, feel free to select your own.R1 110 ohms 1206 CRCW1206110RFKEAR2 162 ohms 0603 CRCW0603162RFKEAR3 100K 0805 RC0805FR-07100KLR4 23.7 ohms 0603 CRCW060323R7FKEAR5 23.7 ohms 0603 CRCW060323R7FKEAR6 50 ohms 3024T only(move to position R7)R7 50 ohms 3104T onlyR8 68.1 ohms 0805 CRCW080568R1FKEAR9 51.1K 0603 CRCW060351K1FKEAR10 51.1K 3104T only CRCW060351K1FKEAR11 51.1K 3024T only CRCW060351K1FKEAR12 0 ohm (10 ohms in MSOX3024T)C1 2pF 0603 NPO GQM1885C2A2R0CB01D ***See my comments in the first post***C2 2pF 0603 NPO GQM1885C2A2R0CB01DC3 4pF 0603 NPO GQM1885C2A4R0CB01DC4 4pF 0603 NPO GQM1885C2A4R0CB01DC5 10pF 0603 NPO GQM1885C1H100GB01DC6 10nF 0603 GRM188R71H103KA01DC7 10nF 0603 GRM188R71H103KA01DC8 100nF 0603 GRM188R71H104KA93DC9 100nF 0603 GRM188R71H104KA93DC10 100nF 0603 GRM188R71H104KA93DC11 100nF 0603 GRM188R71H104KA93DC12 100nF 3024T onlyC13 10nF 0402 GRM155R71H103KA88DC14 100nF 3024T onlyC15 100nF GRM188R71H104KA93DL1 15nH green dot Coilcraft 0603CS-15NXGEUL2 6.8nH red dot Coilcraft 0603CS-6N8XGEUL3 6.8nH red dot Coilcraft 0603CS-6N8XGEUL4 47nH brown dot Coilcraft 0603CS-47NXGEUL5 6.8nH red dot Coilcraft 0603CS-6N8XGEUQ1 IRLML2402 SOT23 (original is MMBF0201NL but that is discontinued)D1 HSMP-3892 SOT23 HSMP-3892-TR1GCR1 BAV99 SOT23BD1 - ferrite bead 0805 Wurth 742792040K1 - Teledyne A150-20-12 - 3104T only - This is the money part. I bought mine from a trusted vendor in China and verified they were 100% legit before install.K2 - AGQ210S4H 3024T only (I recommend carefully removing using hotair)K3 - AGQ210S4H 3104T only***I don't recommend planning to re-use the removed AGQ210S4H relays - buy new ones***These parts only require 1 of each for the mod:Frequency Strapping resistorsR13 (L1) - 64.9K 0603 for 1 GHz CRCW060364K9FKEAR14 (H1) - 100K 0603 for 1 GHz CRCW0603100KFKEAU1507 74ACT04 SOIC(3.90mm width)

author: TheSteve
author_rank: Unknown
timestamp: June 30, 2017, 04:06:24 am
content: Pictures of the PCB front and back with the parts swapped/installed:I also want to show a picture that demonstrates just how epic the HP/Agilent 1152A 2.5 GHz active probe is.In this screen shot there is a reference image in the background showing a 1 GHz signal being fed directly into the scope. The same signal was then fed into a SMA 50 ohm termination. I am probing the termination with the 1152A active probe. You have to love how close the waveforms match even though the frequency is 1 GHz.This is the termination being probed by the 1152A. The termination is an SMA chassis mount jack with 3 0603 150 ohm 0.1% resistors soldered on the end. Using 3 resistors seems to give the best return loss figures.UserCal hardware:

author: Muxr
author_rank: Super Contributor
timestamp: June 30, 2017, 04:12:12 am
content: How do you sit down to use that scope with balls that big? Epic mod.

author: mrpackethead
author_rank: Super Contributor
timestamp: June 30, 2017, 04:22:55 am
content: Really good work there.Are you intending to publish the hack? ... I think i just need to be paitent. I see more stuff beig posted above.

author: BravoV
author_rank: Super Contributor
timestamp: June 30, 2017, 04:28:34 am
content: Subbed ! Thanks for sharing !

author: TiN
author_rank: Super Contributor
timestamp: June 30, 2017, 04:34:04 am
content: Holy batmans that's a lot of steps. Well done, I'm almost became a time-nut reading all this.

author: VK5RC
author_rank: Unknown
timestamp: June 30, 2017, 05:46:07 am
content: Absolutely amazing, lost for words!

author: Jwalling
author_rank: Unknown
timestamp: June 30, 2017, 09:30:09 am
content: Quote from: VK5RC on June 30, 2017, 05:46:07 amSame here! An incredible amount of work and perseverance pays off BIG! Nice job, Steve!

author: HighVoltage
author_rank: Super Contributor
timestamp: June 30, 2017, 09:35:14 am
content: You made it !Just amazing how you pulled this one through.Congratulations.

author: Zucca
author_rank: Unknown
timestamp: June 30, 2017, 10:06:22 am
content: Impressive!!!!Crap now I need to buy a 3000T, anyone want a 500MHz not T?

author: cgroen
author_rank: Unknown
timestamp: June 30, 2017, 11:10:40 am
content: Impressive!I have a MSOX3024T, but I'm afraid I lack the balls to do the modification

author: Dubbie
author_rank: Unknown
timestamp: June 30, 2017, 11:22:36 am
content: I really am keen to try this but I am not sure I have the courage. Can you do it to a single channel? Or is is all or none?

author: HighVoltage
author_rank: Super Contributor
timestamp: June 30, 2017, 12:51:20 pm
content: Quote from: TheSteve on June 30, 2017, 04:03:13 amYou asked me before, to measure the -3dB point of my 1 GHz MSOX3104AHere are the pictures of the measurementsI am using my trusted 3.2 GHz Agilent 8648C for a sine wave output, 50 Ohm in 50 OhmMy MSOX3104A has the -3dB point at 1.16 GHz

author: GlowingGhoul
author_rank: Regular Contributor
timestamp: June 30, 2017, 03:26:10 pm
content: Incredible work. A huge boon for the hobbyist, and I doubt this will impact commercial sales one iota.Seeing as how this has a BOM of only $200 retail, it really makes the market segmentation pricing seem absurd at this point.Next generation entry point of the 3000 level scope should be at least 500Mhz, with a path to 2Ghz or higher.

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: June 30, 2017, 03:45:46 pm
content: Quote from: GlowingGhoul on June 30, 2017, 03:26:10 pmImpressive mod! It probably won't impact commercial sales like you said, but it's a great pathway to 1 GHz for guts folks.A 1 GHz scope price has as much to do with design and NRE as BOM, and that tech trickles down into the lower bandwidth models. So, if we dropped prices on the high bandwidth models, the entire line would stop being feasible. Designing a 200 MHz scope is much, much easier than designing a 1 GHz scope. And, as is made clear by the mod, the whole backend of the scope is capable to 1 GHz (or higher)I wouldn't bank on a 3000 level scope starting at 500 MHz for a long, long time. I won't go into sales details, but for basically every line of scopes all the way up to the top, we sell a lot more of the lower bandwidth models than the higher bandwidth models.

author: mrpackethead
author_rank: Super Contributor
timestamp: June 30, 2017, 04:31:05 pm
content: Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmMaybe because everyones hacking them. :-) Probably because in all reality your average workshop/lab doe'snt need too many 1Ghz Scopes. We have 4 100Mhz scope and 1 500Mhz Scope. The 100Mhz scopes are the workhorses and do 95% of the work.. They are cheap enough that you can leave them sitting on a bench, and not have to move them around. the 1 500Mhz scope is on a trolley and gets moved to where its needed. Not sure if this model scales out, but it works for us.

author: philpem
author_rank: Frequent Contributor
timestamp: June 30, 2017, 05:20:43 pm
content: Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmBandwidth: if you need it, youreallyneed it. If you don't? Well... save a bit of brass and maybe buy SPI/UART Decode and MSO

author: electrolust
author_rank: Unknown
timestamp: June 30, 2017, 05:36:32 pm
content: Quote from: GlowingGhoul on June 30, 2017, 03:26:10 pmNot at all. The BOM cost is not in the noise, but it's one of the smaller factors for a product like this (sales numbers in the thousands per year, not millions, with high NRE costs). As something of an example, I do high grade security stuff, and folks that make EAL4 and up secure elements won't even talk to you until you're in the 100k of volume and at that volume you're a one-off. They can't sell you unit quantities of chips even if they wanted to, because you can't afford the NRE. When you're doing 1M+ of volume, that's when your NRE is spread across significant units and when BOM cost starts to be of primary importance.If anything, it reflects how much of a bargain it is to buy the smaller bandwidth version of the same scope. All the same engineering had to go into the product. All the support costs are the same.

author: electrolust
author_rank: Unknown
timestamp: June 30, 2017, 05:39:29 pm
content: This is amazing!! I wouldn't do this myself, but just wow!

author: lukier
author_rank: Unknown
timestamp: June 30, 2017, 05:51:03 pm
content: Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmThat is at the point of sale I guess, but what about the BW upgrades? How many of these lower bandwidth ones end up getting a BW option?

author: electrolust
author_rank: Unknown
timestamp: June 30, 2017, 05:56:26 pm
content: Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmThe gauntlet has been thrown! OK next level mod is to take this thing to 1.2 or 1.5GHz!!

author: electrolust
author_rank: Unknown
timestamp: June 30, 2017, 05:58:15 pm
content: Can you characterize the response curve? My memory might be bad, but as I recall from the literature, the sub-1GHz models have gaussian response and the 1GHz (as shipped from Keysight) has maximally flat response. Apologies if the posted traces show that fact, I'm a bit excited and haven't read through in detail!

author: electrolust
author_rank: Unknown
timestamp: June 30, 2017, 06:06:51 pm
content: Quote from: TheSteve on June 30, 2017, 04:03:13 amWould this part of the mod be worth doing just on its own, for a 200MHz scope, without doing the rest of the mod? Or at 200MHz is it not gaining you so much.

author: Amazing
author_rank: Regular Contributor
timestamp: June 30, 2017, 06:12:08 pm
content: Great job! that really took guts.Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmThe first version of the 3000T manual mentions a 1.5GHz model that was never sold...

author: TheSteve
author_rank: Unknown
timestamp: June 30, 2017, 08:07:49 pm
content: Quote from: Dubbie on June 30, 2017, 11:22:36 amThis is an all or nothing mod and if you aren't sure please don't risk your scope.Quote from: Keysight_DanielBogdanoff on June 30, 2017, 03:45:46 pmIs that a challenge?I know the front end ASIC is capable of at least 1.5 GHz as it is used in the 4000x series. My dream was a 1.5 GHz upgrade but without seeing a 4000 series 1.5 GHz front end it just isn't going to happen. It was hard enough to determine the required values for 1 GHz.There is the jumper option on the board for 1.5 GHz but as far as I am aware it will be rejected as it isn't a 4000 series board. I have no desire to get into firmware hacking.I don't need to sleep, I'll be pondering it.Quote from: electrolust on June 30, 2017, 06:06:51 pmThere is nothing to be gained by modifying the 200 MHz front end for a better 50 ohm match. It also wouldn't work properly as the relay/attenuator controls change when you go from 100-500 to 1 GHz hardware.Quote from: electrolust on June 30, 2017, 05:58:15 pmI do believe the 1 GHz model has the flat response. If you look at the anti alias/low pass filter on the output of the front end ASIC you'll see the 1 GHz model has an added series resistor/capacitor. In simulation this prevents attenuation above 500 MHz and changes the curve around 1 GHz.I will plot the curve when I get a chance.

author: WastelandTek
author_rank: Frequent Contributor
timestamp: June 30, 2017, 10:27:02 pm
content: wowwwww...

author: G0HZU
author_rank: Super Contributor
timestamp: June 30, 2017, 10:59:34 pm
content: Impressive stuff...Some equipment can be upgraded simply by creating a valid licence file. A couple of years ago I reverse engineered Agilent/Keysights option licencing system so I could upgrade my E5071 VNA to add time domain analysis. It just requires a text based licence file with a key code to unlock the option.They appear to use a similar system on a lot of test gear, I tried upgrading a DSO 80000 series scope just by creating a valid licence file for its serial number. It took me about 10 minutes to hack the 80000 scope system and I managed to write a licence that unlocked loads of options and upgraded the BW from 4GHz to 12GHz (proved/measured with a 20GHz sig gen).https://www.eevblog.com/forum/testgear/agilent-infiniium-dso8000a-hacking-anyone-done-this/

author: G0HZU
author_rank: Super Contributor
timestamp: June 30, 2017, 11:27:10 pm
content: I'm not a scope guru and I know nothing about the 3000 series but I wonder if there is another way to do your mod without needing to change hardware?From my limited time spent with Agilent scopes I think they sometimes have switchable front end LPF sections in them. I think Agilent prefer to limit the bandwidth in hardware if you select user settings with a low sample rate and this minimises alias issues on certain timebase settings. So maybe your scope could be upgraded in code to manage the LPF as well as doing your BW upgrade. It might not be necessary to change any components? The higher BW LPF may already be in the scope waiting to be selected? But this is just a guess.

author: TheSteve
author_rank: Unknown
timestamp: July 01, 2017, 12:28:17 am
content: Parts have to be changed, absolutely no question. There are three hardware versions. 100/200, 350/500 and 1000 MHz. The 100 can be software updated to 200 and the 350 can be updated to 500. Each has unique hardware filters that the laws of physics dictate.

author: bson
author_rank: Unknown
timestamp: July 01, 2017, 02:04:47 am
content: Isn't it likely that minor channel level variation and possibly zero variance is handled through calibration? That looks like the ideal method if the response is otherwise reasonably flat.

author: TheSteve
author_rank: Unknown
timestamp: July 01, 2017, 04:00:53 am
content: Quote from: bson on July 01, 2017, 02:04:47 amThis is totally possible. But so far I have never found any information detailing any calibration info beyond the UserCal built into the scope.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 01, 2017, 07:44:00 pm
content: Quote from: TheSteve on June 30, 2017, 04:03:13 amDo you think this will be the same on all scopes, or is this something that more likely will need to be tweaked on a per scope basis?

author: TheSteve
author_rank: Unknown
timestamp: July 01, 2017, 07:49:13 pm
content: A rough guess suggests it will vary on all scopes. We should know in a week or two when another scope meets the soldering iron.

author: LabSpokane
author_rank: Super Contributor
timestamp: July 02, 2017, 01:24:40 am
content: Quote from: electrolust on June 30, 2017, 05:56:26 pmThe next step is for someone to design and open-source active probe to make use of this kind of horsepower between 500Mhz and 1GHz. Keysight's 2795A probe starts at $1K ea, which is a lot less than what they used to be, but still not inexpensive.

author: Someone
author_rank: Super Contributor
timestamp: July 02, 2017, 02:48:32 am
content: Quote from: LabSpokane on July 02, 2017, 01:24:40 amKeep an eye out for any of the N2795A, 1156A, and 1152A. All come up well under $1000.

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 02:57:45 am
content: Quote from: Someone on July 02, 2017, 02:48:32 amKeep in mind that to use the 1152A with the 3000A/3000T series of scopes the probe needs to be modified.https://www.eevblog.com/forum/testgear/agilent-1152a-active-probe-'smartprobe'-conversion-for-dsox3000-series-scopes/

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 04:19:19 am
content: is this hack likely to work on a DSOX3014T ?

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 04:24:47 am
content: Quote from: mrpackethead on July 02, 2017, 04:19:19 amYes, the DSOX3014T has the identical hardware as the MSOX3024T I started with.

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 05:14:48 am
content: This is why I suggest nobody tries to re-use the original relays. I used as little hot air as possible to remove them yet they just don't look so great. All I really cared about was nothing else being exposed to excessive heat so the hot air was focused directly on the relays to remove them.

author: Dubbie
author_rank: Unknown
timestamp: July 02, 2017, 05:58:17 am
content: Are they not through hole?Why did you not just suck the solder from the pins?Worried about damaging the pads?

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 06:02:02 am
content: Nope, not through-hole. They are tiny little SMT buggers.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 08:29:37 am
content: Did you preheat the board?

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 08:32:48 am
content: Quote from: TheSteve on June 30, 2017, 04:05:23 amJust a little confused by this..and can you share ( pm maybe ) the trusted source for the part.Which bits are replaced if I'm going from a 3014T?

author: adranp
author_rank: Regular Contributor
timestamp: July 02, 2017, 08:37:20 am
content: :mrpacketheadK1 has to installed (the most expensive part from the upgrade BOM and the most hard to get)K2 has to be removedK3 has to be installed (new part required due to hotair removal procedure which will most probably damage the part from K2)Steve did not preheat the board as far as I know..

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 08:44:33 am
content: My scope is 20,000km away, so i dont' have one to look at. :-)K1 has to installed (the most expensive part from the upgrade BOM and the most hard to get) -So this part is unpopulated?K2 has to be removed -K3 has to be installed (new part required due to hotair removal procedure which will most probably damage the part from K2)In the photos it seems that both K2 and K3 are left installed??Steve did not preheat the board as far as I know..

author: tautech
author_rank: Super Contributor
timestamp: July 02, 2017, 08:47:44 am
content: See #17 in the OP.

author: adranp
author_rank: Regular Contributor
timestamp: July 02, 2017, 08:53:35 am
content: :mrpacketheadK1 is unpopulated in models lower than 1Ghz.Look carefully in the picture for K2 and K3 designators. K3 is unpopulated in lower than 1Ghz models and K2 is populated. There's the same relay at K502 position which is going to stay there (in all models).Also wanted to add that probably I'll be the next person doing this mod (some of my parts are here already and some will arrive next week)..Steve did a wonderful job putting this mod in a form that's quite easy to understand.. He explained a lot of things he encountered..As he said already, please be advised this mod is not very simple. The number of parts to be added/swapped/removed is quite a task. Without proper soldering skills and tools this is going to be a nightmare.Before doing this mod I highly advise any of you to look at the other forum thread and understand the mod for 350/500Mhz and then come here and look at what should be done for 1Ghz.There are a lot of steps which could damage the PCB, so be advised on that.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 08:57:48 am
content: Got it! there are still 2 of the Relays on the board. K2 is removed and K3 installed. theres a relay that doesnt get moved at all.. I did'nt see K2 is in the text on the unpopulated pads.I suspect that some preheating will make it easier to get the thing off.. ALso reduces the risk of damaging the board. Hate to lift a track.. You might also be able to use some low melt solder in there...

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 09:04:17 am
content: Quote from: adranp on July 02, 2017, 08:53:35 am

author: adranp
author_rank: Regular Contributor
timestamp: July 02, 2017, 09:13:16 am
content: Hotair is required just for the relay removal at K2.On the back of the board you have the BNC connectors which might give you some trouble putting the board on preheater.A tool which would make your life much easier would be a soldering tweezer.

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 04:30:15 pm
content: Quote from: mrpackethead on July 02, 2017, 08:29:37 amAs adranp mentioned I did not preheat the board at all. If I was doing it again I might gently warm the entire board with a heatgun. I had planned to sacrifice the relays all along though. The space is very tight so you can't direct the hotair right at the legs of the relays, it basically gets directed right on the top of them. The relay you need to keep and not damage is only a few millimeters away(less then a quarter inch).Lifting traces shouldn't be an issue unless you're way to aggressive trying to remove the relays. The PCB is of high quality and you should be very gentle when removing the relays.

author: nctnico
author_rank: Super Contributor
timestamp: July 02, 2017, 04:32:33 pm
content: You could use polyimide tape to shield parts of the board from the heatgun. Recently I did rework on a delicate board as well and the polyimid tape worked like a charm.

author: TheSteve
author_rank: Unknown
timestamp: July 02, 2017, 04:51:58 pm
content: Quote from: nctnico on July 02, 2017, 04:32:33 pmThis was absolutely done - and metal shields too. Without it the other relays would be cooked too.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 02, 2017, 07:52:54 pm
content: Makes me think that i should buy some extra relays, just in case.

author: Gandalf_Sr
author_rank: Super Contributor
timestamp: July 03, 2017, 02:14:04 am
content: Damn Steve - DAMN!

author: TheSteve
author_rank: Unknown
timestamp: July 05, 2017, 04:04:19 am
content: Hmm, anyone have a DSOX4154 and want to take some pictures?

author: mrpackethead
author_rank: Super Contributor
timestamp: July 05, 2017, 05:49:23 am
content: 1Ghz is plenty for me. but i can see the challenge. how much attenutation are you seeing there.. i saw 120mV PP, but not sure how what you were inputing.

author: TheSteve
author_rank: Unknown
timestamp: July 05, 2017, 05:58:30 am
content: I was inputting 1 Vpp at 1.5 and 2 GHz. The attenuation is completely expected of course as the input filter maxes out at 1 GHz and the antialias/low pass filter is also tuned to 1 GHz. Both would need to be altered to have a true 1.5 GHz of bandwidth. I was impressed with the triggering though, even at 2 GHz it was solid.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 08, 2017, 12:48:44 pm
content: Im having trouble getting the atenuators.. ANy suggestions of where to get them.

author: mrpackethead
author_rank: Super Contributor
timestamp: July 13, 2017, 02:33:55 am
content: Sorry for the bump, but i'm really struggling to be able to locate those attentuators? Any one can you make a suggestion.. Maybe i'm looking in the wrong place.

author: TheSteve
author_rank: Unknown
timestamp: July 13, 2017, 02:42:06 am
content: A few weeks back avnet had stock and you could buy them in single quantities, now it appears they have none and you need to buy 25 of them. I haven't looked at official distributors outside of US/Canada myself. You can also get quotes via seekic. I got mine from here: xingsheng.member.seekic.com

author: KE5FX
author_rank: Super Contributor
timestamp: July 13, 2017, 04:05:54 am
content: Sounds like Keysight has been buying up all the attenuators.

author: Jwalling
author_rank: Unknown
timestamp: July 13, 2017, 09:25:52 am
content: Quote from: mrpackethead on July 13, 2017, 02:33:55 amhttp://www.oemstrade.com/search/A150-20-12Online components (if these are legit...)

author: adranp
author_rank: Regular Contributor
timestamp: July 13, 2017, 10:17:24 am
content: I can confirm my relays are also from xingsheng.. They just arrived 2 days ago.. Seem legit and also new.. Take great care on seekic as there are a lot of sellers who sell used parts..

author: adranp
author_rank: Regular Contributor
timestamp: July 16, 2017, 04:17:22 pm
content: Just a quick update. I have successfully upgraded my scope to 1GHz.One important thing to add is that there is 100% chance to remove safely and reuse the K2 relays using preheating plate and hot air + kapton tape and metal shields. I've preheated the pcb at around 90 degrees Celsius (measured near the relay) and then removal was without any issues.No discolouration or melting on the removed relays.I'll post detailed info in a few days.

author: Zucca
author_rank: Unknown
timestamp: July 20, 2017, 08:39:34 am
content: Quote from: adranp on July 16, 2017, 04:17:22 pmPlease!!!!!

author: adranp
author_rank: Regular Contributor
timestamp: July 20, 2017, 08:41:07 am
content: Please bear with me a little more.. The mod is working perfectly but we're trying to give you a nice bonus raising the bar to 1.5 Ghz

author: Zucca
author_rank: Unknown
timestamp: July 20, 2017, 08:58:52 am
content: ok, now I can't sleep anymore. Thank you.

author: TheSteve
author_rank: Unknown
timestamp: July 20, 2017, 04:10:50 pm
content: Hah - I dream of more bandwidth every night! Anyway, we're working on it and the dream is 1.5 GHz.

author: Netroman
author_rank: Contributor
timestamp: May 19, 2018, 05:07:11 am
content: @TheSteve: Thanks 1000 times for the superiour description and hard work to make this mod possible - also thanks to all the supporters of Steve.I have completed the mod on my MSOX3024T - now with 1 GHz. I used a special rework station to be able to solder the 0603 and 0402 parts (JBC Nase) - no chance with my old Ersa, even with the smallest tips.There was a lot of soldering, but at the end successfullThe only problem I have now, is, that the user calibration (I use 4 equal length cables from Telegärtner) fails after about 1/2 min.Though measured Signals look equal on all 4 channels - just slightly difference in measured voltages, which does not matter much for me (but maybe for cal?).Maybe it's possible to figure out, which channel causes the problem - for now, I have no clue. I wonder, if the Serialport gives some hints, where the calibration fails.Nevertheless I'm very happy with my 'brandnew' 1 GHz scope

author: TheSteve
author_rank: Unknown
timestamp: May 20, 2018, 12:14:05 am
content: Netroman - I'd say there is an issue with an attenuator stage or the drive signals for an attenuator stage based the PM's you've sent and the data you provided.

author: Netroman
author_rank: Contributor
timestamp: June 01, 2018, 06:53:43 am
content: I've just completed my mod (MSOX3024T now 1GHz) and it works great - many thanks to all envolved users from this Forum; especially Steve for additional hints and support.If someone needs contacts, i got plenty of offers for the teledyne relays. Most where between ~40-59 US (i bought mine much too expensive and they are not very hard to get).For the really tiny parts i used a JBC NASE nano rework station - not cheap, but definitive worth the money. I did not believe that, but i'll never buy another brand anymore.I had some problems with the user calibration, but the reasons were just wrong ordered parts. Especially the Driver "74ACT04" - MUST be an "ACT", because it is driven by Levels about 2.4 Volts and Needs to be able to work with TTL-Levels. So the "ACT" is absolute must (i had a "HCT" which has much too low power, whilst the ACT delivers up to 25 mA).And i made absolute equal length cables for the calibration with 250mm (important: not longer than 300mm per cable), also bought hight quality tee-connectors bnc.Though i was successful in reusing the desoldered cheaper relays, i would also suggest to buy new ones, because these should work for years without Troubles. I replaced the two ones in channel 1 whilst finding out my calibration problems.Best regards from Austria, Josef

author: EE-digger
author_rank: Frequent Contributor
timestamp: June 02, 2018, 01:01:30 am
content: Thanks for your report ! Now I'm stoked again to perform the mod. I had a thought on clean shield removal. What do you guys think about heating a single corner, sliding a piece of Kapton film under it, then on to the next 'til done? Re-soldering should be a piece of cake but I might use NC paste to keep it neat.Also, 74ACT is almost twice as fast as 74HCT. Is this the cal signal? The 74HCT rise time may have been inadequate.

author: TheSteve
author_rank: Unknown
timestamp: June 02, 2018, 02:11:37 am
content: Quote from: EE-digger on June 02, 2018, 01:01:30 amRemoving the shields isn't actually too bad. You can just lift them up corner by corner. The 74ACT04 drives the FET's that turn the Teledyne attenuator relays on and off.

author: EE-digger
author_rank: Frequent Contributor
timestamp: June 02, 2018, 02:55:46 am
content: There must be some other loading on the '04 output then, that does not permit the HC04 to satisfy the Vgs.

author: Netroman
author_rank: Contributor
timestamp: June 05, 2018, 06:30:07 pm
content: @EE-digger: I broke a small piece of GND-route, because the shields do not really bend well. I suggest to spend some solder wick to remove as much as possible before you lift the corners. IMHO the corners do not lift (bend) more then 1/2 to 1 mm - that was not enough (too much solder on it and at first i did not use wick) in one case, so i ripped the route :-(Josef

author: adranp
author_rank: Regular Contributor
timestamp: June 05, 2018, 08:26:54 pm
content: As I said previously, lifting the shields works best with pre-heater and hot-air gun. This way you won't have problems. Solder wick requires good skills.

author: EE-digger
author_rank: Frequent Contributor
timestamp: June 06, 2018, 12:34:39 am
content: adranp: That's why I thought that a hot iron, slide some high temp, thin film under that corner. Clean up after all four have been lifted. I may give it a shot. I have bottom heat but would rather not involve that side. I know it would work great thoughDid you ever finish your mods?Josef: Sorry about your lifted copper. That can be heartbreaking but glad that your scope works well

author: Samogon
author_rank: Frequent Contributor
timestamp: August 29, 2018, 11:42:48 am
content: Got 4024A and being inspired by TheSteve will try to mod it to 1G or 1.5G with his and hopefully community help.here are some pictures of areas we interested.

author: Samogon
author_rank: Frequent Contributor
timestamp: August 29, 2018, 12:09:42 pm
content: In ideal if someone can open little expensive 4104A or 4154A scope remove backside shield and make hirez pictures that would be fantastic.

author: Pinkus
author_rank: Frequent Contributor
timestamp: August 29, 2018, 12:22:45 pm
content: The "back" picture shows a lot of flux as if somebody already reworked this. Did they (Agilent) really deliver such a board?The front end looks (almost) identical to the 3000 series, thus it should be not a big deal. Though the mod for 1.5 Ghz has afaik not been made yet.

author: sibeen
author_rank: Frequent Contributor
timestamp: August 29, 2018, 12:31:08 pm
content: You are all mad, and my DSOX3024T is sitting on my bench and madly agreeing with me.As I work in the power area I sometimes go as high as the 60th harmonic, so 3 kHz. I think I'll leave mine well alone, but respect to those who did this mod.

author: Samogon
author_rank: Frequent Contributor
timestamp: August 29, 2018, 12:34:56 pm
content: in contrast to 3000T series we have already populated inverter U1507 74ACT04 on 3000T corresponds to U1613 on 4000xThis is how CPU manages front attenuator relays. It uses serial data going to Serial to parallel converter U502 74AHCT594 and then finally transistors drive relays.

author: Samogon
author_rank: Frequent Contributor
timestamp: August 29, 2018, 12:37:28 pm
content: Quote from: Pinkus on August 29, 2018, 12:22:45 pmWell board has flux all over it especially where through hole components are, looks to me nobody cared to clean it. But board looks intact

author: Samogon
author_rank: Frequent Contributor
timestamp: August 29, 2018, 01:59:11 pm
content: Quote from: sibeen on August 29, 2018, 12:31:08 pmWell it depends what tasks you are aiming. For you probably 50Mhz scope would be enough.For me just as example i needed 500MHz scope minimum to measure Pulse Edge Time of Agilent 33250A when calibrating it.

author: TheSteve
author_rank: Unknown
timestamp: September 02, 2018, 07:37:50 am
content: Had another look at the input SWR to my modded scope tonight with a newer VNA. I am quite pleased with what I see. Generally scopes seem to be specified as having an input SWR of 1.5:1 or less over the rated bandwidth with the 50 ohm input enabled. The scope beats this spec with and without the Teledyne attenuator switched in to 1.5 GHz. With that in mind I'll have another look at the low pass filter components and see if we can't finally mod the 3000t series to a full 1.5 GHz.100 mV range(Teledyne switched in):200 mV range:

author: Samogon
author_rank: Frequent Contributor
timestamp: September 02, 2018, 07:54:09 am
content: Monster TheSteve!

author: 2N3055
author_rank: Super Contributor
timestamp: September 19, 2018, 10:29:55 pm
content: I apologize if somebody already asked this. I was reading 3000T X-series User manual and found this mentioned in few places:"With the 3000T X-Series 1 GHz and 1.5 GHz bandwidth models"Is that just remnant from when they rewrote (reused,recycled) manual from 4000 series or there ever was mention of 1.5 GHz version of 3000T ?Regards,Sinisa

author: TheSteve
author_rank: Unknown
timestamp: September 20, 2018, 01:59:06 am
content: Quote from: 2N3055 on September 19, 2018, 10:29:55 pmThere is no factory released 1.5 GHz 3000 series model.

author: badbiki
author_rank: Newbie
timestamp: October 05, 2018, 03:54:55 am
content: Ok I'm keen. Ordered all parts bar the relays.I've PMd someone on here about them.. if anyone has four cheap?I have a MSOX3024T and assume I need them, even tho the comment;Quotesays only for 3104T.. bit weird.DescriptionManufacturerManufacturer Part NumberDigi-Key Part NumberDesignatorReference DesignatorQtyUnit PriceFERRITE BEAD 600 OHM 0805 1LNWurth Electronics Inc.742792040732-1620-1-NDBD1Per Channel1$0.25CAP CER 2PF 100V C0G/NP0 0603Murata Electronics North AmericaGQM1885C2A2R0CB01D490-3555-1-NDC1 C2Per Channel2$0.59CAP CER 4PF 100V C0G/NP0 0603Murata Electronics North AmericaGQM1885C2A4R0CB01D490-3557-1-NDC3 C4Per Channel2$0.59CAP CER 10PF 50V C0G/NP0 0603Murata Electronics North AmericaGQM1885C1H100GB01D490-6087-1-NDC5Per Channel1$0.76CAP CER 10000PF 50V X7R 0603Murata Electronics North AmericaGCM188R71H103KA37D490-4778-1-NDC6 C7Per Channel2$0.10CAP CER 0.1UF 50V X7R 0603Murata Electronics North AmericaGCM188R71H104KA57J490-8020-1-NDC8 C9 C10 C11 C12 C14 C15Per Channel7$0.17CAP CER 10000PF 50V X7R 0402Murata Electronics North AmericaGCM155R71H103KA55J490-13295-1-NDC13Per Channel1$0.10HIGH RELIABILITY AND SMALL MOLDRohm SemiconductorBAV99HMFHT116BAV99HMFHT116CT-NDCR1Per Channel1$0.25DIODE PIN 100V 250MW SOT-23Skyworks Solutions Inc.SMP1321-005LF863-1097-1-NDD1Per Channel1$0.78RELAY TELECOM DPDT 2A 125VPanasonic Electric WorksAGQ210S4HZ255-2096-1-NDK2Per Channel1$2.17MOSFET N-CH 20V 300MA SOT-23ON SemiconductorMMBF0201NLT1GMMBF0201NLT1GOSCT-NDQ1Per Channel1$0.57RES SMD 110 OHM 1% 1/4W 1206Vishay DaleCRCW1206110RFKEA541-110FCT-NDR1Per Channel1$0.10RES SMD 162 OHM 1% 1/10W 0603Panasonic Electronic ComponentsERJ-3EKF1620VP162HCT-NDR2Per Channel1$0.10RES SMD 100K OHM 1% 1/8W 0805Panasonic Electronic ComponentsERJ-6ENF1003VP100KCCT-NDR3Per Channel1$0.10RES SMD 23.7 OHM 1% 1/10W 0603Vishay DaleCRCW060323R7FKEA541-23.7HCT-NDR4 R5Per Channel2$0.10RES SMD 68.1 OHM 1% 1/8W 0805Vishay DaleCRCW080568R1FKEA541-68.1CCT-NDR8Per Channel1$0.10RES SMD 51.1K OHM 1% 1/10W 0603Vishay DaleCRCW060351K1FKEA541-51.1KHCT-NDR9 R10 R11Per Channel3$0.10RES SMD 10 OHM 1% 1/10W 0603YageoAC0603FR-0710RL311-10LDCT-NDR12Per Channel1$0.10RES SMD 64.9K OHM 1% 1/10W 0603Panasonic Electronic ComponentsERJ-3EKF6492VP64.9KHCT-NDR13-L1Per Device1$0.10RES SMD 100K OHM 0.5% 1/10W 0603Vishay DaleCRCW0603100KDHEAP541-100KAYCT-NDR14-H1Per Device1$0.32IC INVERTER 6CH 6-INP 14SOICTexas InstrumentsSN74ACT04DR296-1065-1-NDU1507Per Device1$0.48This is my BOM. I've used GCM over GRM cap parts due to availability and better specs being automotive. I could be wrong tho.

author: TheSteve
author_rank: Unknown
timestamp: October 05, 2018, 04:15:28 pm
content: You absolutely need the Teledyne attenuator relays to perform the bandwidth upgrade(they are used in the 3104T only which is why you need them as that is what hardware you're upgrading to).

author: badbiki
author_rank: Newbie
timestamp: October 08, 2018, 02:53:10 am
content: Ye I reread the upgrade and the comment about the upgraded relays makes it clear. I have four on order so I’ll see how it goes.Is anagilent 1130A probe sufficient for testing and general scoping? Can eBay one for around 1kIll take some photos of my unit pre and post. Will use my ESD room and straps on all irons for sure!

author: badbiki
author_rank: Newbie
timestamp: October 11, 2018, 09:57:03 pm
content: My relays arrived fromhttps://wwwmasterelectronics com/teledyne-relays/a1502012-12686042.htmlTheir documentation seems legit and they came well packaged. Gold pins and underbelly with a nickel played top and markings.Getting the shields off was a pain. Ended up wiking most of the solder off each corner and then using a heat gun and flux to lift a side at a time. I would t recommend prying corners. The sheils have tabs mid way forcing a vertical lift. They really could have used 1/5 the solder to put these on IMHO.A lot of residue marks on the board before dissassemby and I even found a stray solder ball!Perhaps I should X-ray the board before final assembly:)It really is a work of art inside. My pre mod user cal ran through to success so here goes.I’m removing, desoldering, cleaning (Kim wipes and IPA) then fluxing and reapplying or installing new parts. Am I missing anything?I’ll photo check with my SLR pre/post mods.ESd Mat and strap in use.Using lead free solder. I’m assuming this is RHOS mostly?

author: TheSteve
author_rank: Unknown
timestamp: October 11, 2018, 11:09:01 pm
content: The shields can be a pain, with experience they get much easier. Add a little leaded solder to each joint, then use good quality wick to remove the solder. I am generally able to then lift each corner .5mm or so one at a time working my way around. If they don't want to move then just add heat while lifting, they should stay raised when you remove the heat as there should be next to no solder left holding them in place.The scope is certainly assembled with lead free solder. I always use leaded during rework.More then anything I'd say just take your time with the mod, don't rush it. To me the biggest challenge was removing the existing relays as I didn't want to damage anything else. With some board preheating(which I didn't do) they will come off very nicely though. The pads are very tiny on the signal path so inspect your connections very carefully. It is too much of a pain to be disassembling and reassembling too many times.

author: badbiki
author_rank: Newbie
timestamp: October 12, 2018, 03:18:12 am
content: I agree with taking time and not rushing. Lifting tracks is my worst fear.Touch wood, I’ve only lifted 1980s era traces thus far.I too added a little leaded to help it flow, with tacky flux and good quality wick. CHIPQUIK 291 flux and chemtronics no clean desoldering braid, multiple sizes with hoof tipI was trying not to mix types of solder during rework. I find it comes out dull and doesn’t wet well otherwise. Even thought I hate reworking lead free.I was thinking of using kapton tape and some little insulators I have from my 3D printer to act as air barriers to remove the relays. I don’t have an IR or heated mat under my pcb holder at home. Perhaps I should borrow one for the weekend.Also don’t yet have my active GHz probe (shipping atm) or a ghz source handy.Any ideas of some cheap quick solutions for testing? My friend works at a lab with Calibrated rf gear, or I may call in a favour to use some equipment at my EDM.Do you tack the shields down with a little less solder?Also, one channel had a green sticker on it. I noticed some pictures have different colours or none at all. Are they a post check or marker for component values? As in they have a different set to pass?Green dot, red dot, orange... what do they mean?

author: TheSteve
author_rank: Unknown
timestamp: October 12, 2018, 06:09:10 am
content: No idea on the dots, but it is normal. Ideally to determine performance you need a signal generator that goes to 1.5 GHz or so with a level output. You don't want to use a probe for testing, the signal generator should be directly connected to a channel input with 50 ohm mode enabled.I would use kapton tape to protect the areas around the relays, or metal shields if you have them. You can always at least warm the board a little with a heat gun - just don't go crazy.

author: badbiki
author_rank: Newbie
timestamp: October 13, 2018, 05:21:58 pm
content: Lifted one pad on a removed relay... could patch if going backwards but otherwise alll relaysbin.Kapton tape and insulation pads from 3D printer hot ends works well. Make wrap around a for the protecteded relays and a lifted one for the removal. Easy.Not good enough to reuse but don’t damage the remaining relayMore tomorrow.

author: badbiki
author_rank: Newbie
timestamp: October 15, 2018, 08:33:05 am
content: MOd completespent hours cleaning residue from all the traces and components.... so many hours!I matched the 27.5 ohm resistors in pairs between 3 and 9mOhm difference. I would think it would be wise to also match the mirrored capacitors also, and match the mirrored inductors per channel.Ideally I would have also bought more of C1 and C2 to match filter frequencies between channels. However it was late and I didn’t have a good 4wire measurement system setup for 0603/0805 passives. I’ll revise my BOM above and purhaps post my annotated drawings which print well on B&W and show movements/removals.I’ll take it to my friends RF lab soon to check each channel at high frequencies. So far the user calibration passes so long as my cables T out to 1,3 and 2,4 otherwise it failed the first time.Top hacking

author: Samogon
author_rank: Frequent Contributor
timestamp: October 15, 2018, 09:45:55 am
content: To measure 1pF caps is a big deal, not many systems could do it.

author: badbiki
author_rank: Newbie
timestamp: October 23, 2018, 11:20:28 pm
content: I had a very quick hookup using a Rigol 70kHz-3.2GHz spectrum analyser set on 0dBm with each channel terminating into 50ohm with a 400mm BNC to SMA cable. Too quickly as I was rushing out the door to get home.I will setup better for it next time to do a sweep up the frequency range and perform a segmented capture across the MHz and into the GHz.Ch/Freq1GHz (mVpp)1.5GHz (mVpp)1GHz (dBm)1.5GHz (dBm)Ch1562.21145.34-1.02-12.77Ch2491.96125.38-2.18-14.06Ch3481.91128.14-2.36-13.87Ch4511.3120.653-1.85-29.72I have a feeling that the last entry I captured was not setup correctlyI should have had this set as 3.97940 dBm for a clean 1Vpp signal.I read a 1.699-1.718ns rise time on the trigger output with ~200MHz bandwidth measurement with Math FFT(d/d(t)).

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: October 25, 2018, 04:19:16 pm
content: Not exactly on topic, but I've been collecting shorted input noise spectra for various oscilloscope in this thread:https://www.eevblog.com/forum/testgear/oscilloscope-input-noise-comparison/So far R&S RTM3000 is the winner, so to be fair we need some data from a Keysight 3000 series scope. It would also be interesting to compare the noise for mod and non-mod versions.

author: badbiki
author_rank: Newbie
timestamp: October 31, 2018, 05:40:49 am
content: Ye sure why not. That’s a lot of data to collectevery div every channel

author: 1359944032
author_rank: Newbie
timestamp: September 05, 2019, 09:55:52 pm
content: I am going to buy 3014t and upgrade it to 1Ghz, but I don't know how to crack the license. Can someone tell me, thank you very much.I am currently learning English

author: badbiki
author_rank: Newbie
timestamp: September 06, 2019, 11:43:15 pm
content: Moving the jumpers “unlocks” the higher frequencies.. no license work to be done. Unless there are future software updates that block it?Have funflux, clean, leave no traces of muck!

author: 1359944032
author_rank: Newbie
timestamp: September 07, 2019, 09:07:00 pm
content: Thanks for your reply, the license I am referring to is to open more features. For example, MSO, FRC, etc.

author: TheSteve
author_rank: Unknown
timestamp: September 07, 2019, 10:00:49 pm
content: Quote from: 1359944032 on September 07, 2019, 09:07:00 pmThat information is all contained in the original hacking thread here:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/

author: 1359944032
author_rank: Newbie
timestamp: September 08, 2019, 05:46:55 am
content: Thank you very much, forgive me for not looking at it seriously.

author: oaba
author_rank: Contributor
timestamp: January 01, 2022, 05:10:33 pm
content: To save the pads.Use low temperature solder (Like chipquick, etc. ) first with load of flux. Prior removal.

author: EE-digger
author_rank: Frequent Contributor
timestamp: February 06, 2022, 02:00:35 am
content: Fearing the shields, I held off any mods for a long time. Finally did a 500MHz this morning on my 3000T and couldn't be happier. 605MHz BW (0.707) and 750MHz (50%). Triggers beautifully everywhere but response hits a brick wall just a hair above 1GHz on this mod.But regarding shield removal, it was a piece of cake. I used a Pace medium/large chisel and Chemtronics Soder-Wick of the Rosin type. Solder wicked away easily and the pads cleaned up like new.Did the component removal with hot air and, against my better judgement, with no bottom heat. This does take a bit longer when an attached via ties to a plane but still not bad. This was with a Quick 861DW hot air station, my new favorite. Super low air velocity is a plus for this tool. It made my old Pace ThermoJet look like a toy in comparison to the wattage it delivers to the air.With irons, the biggest shortcoming in SMT removal is inadequate heat and too small a tip, which cannot transfer the heat adequately. Especially with the higher melting point of unleaded solder.TheSteve had a good idea with his "undo" kit of parts. He used separate bags. Being somewhat lazy, I used double sided tape stuck to a card. Parts are laid on the tape by channel and rough arrangement. I let the parts cool first so they wouldn't get permanently "glued" to the card.

author: maomi84
author_rank: Contributor
timestamp: April 18, 2022, 08:45:06 am
content: This is amazing！THANKS! SteveI `ll do it myself.I have more question.1、About K1 relay,Can I use 10dB relay here , such as a150-10-12 & a150-10-5(Add dc-dc ),I can only buy 10dB relays.2、Is calibration necessary after mod.

author: TheSteve
author_rank: Unknown
timestamp: April 18, 2022, 02:57:23 pm
content: I doubt you can sub in a different value for the attenuator relays and have the scope handle range changes properly.The self calibration seems to take care of the calibration issues. If this is adequate for your use case only you can decide.

author: dew
author_rank: Contributor
timestamp: April 21, 2022, 10:36:19 pm
content: There seems to be more differences in in 4000 series hardware. I took some pictures of the area with missing Cyclone IV FPGA and it's surrounding on both sides of the board. Firmware would be puzzled when it fails to find that FPGA that suppose to be there on 1 GHz model. Lots of bypass capacitors and other stuff are missing there as well on 200 MHz model.

author: analogRF
author_rank: Super Contributor
timestamp: April 21, 2022, 10:42:32 pm
content: Quote from: dew on April 21, 2022, 10:36:19 pmI dont have this scope but I think that FPGA is for one of the options (USB decoding maybe?) so if you dont enable that option, I guess it should work

author: TheSteve
author_rank: Unknown
timestamp: April 21, 2022, 11:54:59 pm
content: The 4000 series has the extra FPGA installed on the 1 and 1.5 GHz units.

author: EE-digger
author_rank: Frequent Contributor
timestamp: May 06, 2022, 01:59:08 pm
content: ** parts have been sold **I decided to sell the parts I had collected for a mod of my 3014T. All are new, from distributors, except for one of the semi's may have been from ebay.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: August 09, 2022, 02:17:30 pm
content: This is amazing level of hacking! I am wondering if it would be slightly simpler if one starts with a 500MHz 3054T? Would that substantially reduce the number of components that need to be replaced to get to 1 GHz?

author: EE-digger
author_rank: Frequent Contributor
timestamp: August 09, 2022, 07:56:55 pm
content: TheSteve will probably chime in with better info but I don't think there is an easy method of identifying the parts that need to be swapped. I believe other efforts started with the 100MHz model.Also, keep in mind that 500MHz units I've looked at actually had a bandwidth around 600 to 625 MHz. I believe I've seen that the 1GHz scope has more of a brick wall above 1GHz (whereas the lower BW scopes keep going and going, albeit with loss of amplitude.) Just an FYI.

author: EEVblog
author_rank: Unknown
timestamp: August 18, 2022, 02:15:06 am
content: Quote from: maxwell3e10 on August 09, 2022, 02:17:30 pmAgreed. I'm impressed that people are willing to hardware mod such an expensive high end scope.

author: 2N3055
author_rank: Super Contributor
timestamp: August 18, 2022, 07:13:59 am
content: Quote from: maxwell3e10 on August 09, 2022, 02:17:30 pmDid you read this topic?Literally in first post by OP there is a link to 500 MHz conversion by Memset where it is explained.https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/msg1245159/#msg1245159500 MHz conversion is substantially easier.Sorry my memory serves me badly... That particular conversion was 3000A, not 3000T to 500MHz.

author: TheSteve
author_rank: Unknown
timestamp: August 18, 2022, 02:15:24 pm
content: The 500 MHz mod for the T series should be roughly the same as the A series however I don't think anyone has ever actually done it to verify 100% the exact components that need to be changed. And yes, it would be much simpler compared to the 1 GHz mod.

author: tv84
author_rank: Super Contributor
timestamp: August 18, 2022, 03:10:38 pm
content: Quote from: EEVblog on August 18, 2022, 02:15:06 amAfter Steve lead the way, for others should be child's play (except me, of course...).

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: August 18, 2022, 03:50:59 pm
content: Quote from: TheSteve on August 18, 2022, 02:15:24 pmI haven't seen it done either and agree that it would be roughly the same. There's not a lot of difference in signal paths between the A/T/G versions.

author: TheSteve
author_rank: Unknown
timestamp: August 18, 2022, 04:22:57 pm
content: Quote from: Keysight DanielBogdanoff on August 18, 2022, 03:50:59 pmThe 1.5 GHz mod is more fun, wouldn't you agree?

author: pquadrat
author_rank: Regular Contributor
timestamp: August 19, 2022, 07:18:14 am
content: Quote from: tv84 on August 18, 2022, 03:10:38 pmI did the 500MHz mod on a 3104T. Working perfectly. Before calibration, the bandwith was about 750Mhz, which gets "corrected" in calibration.I did not even know that it was for the A model. Everything seems to be identical.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: August 19, 2022, 05:38:57 pm
content: Quote from: TheSteve on August 18, 2022, 04:22:57 pmTo summarize the basic difference if I understand it correctly: upgrading up to 500 MHz requires changing a few L, C and R per channel. The most difficult part is unsoldering the RF shields. To upgrade to 1 GHz requires changing relays and other multi-terminal components which are trickier to desolder.

author: TheSteve
author_rank: Unknown
timestamp: August 19, 2022, 07:06:52 pm
content: Pretty much, the 1 GHz mod is a much more extensive upgrade - and it costs a lot more because of the Teledyne attenuator relays.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: August 20, 2022, 03:33:04 am
content: Quote from: TheSteve on August 19, 2022, 07:06:52 pmIt's good to know the price difference between 500M and 1GHz versions is not just pure mark-up

author: EE-digger
author_rank: Frequent Contributor
timestamp: August 20, 2022, 09:53:13 pm
content: Quote from: maxwell3e10 on August 20, 2022, 03:33:04 amNot pure ... let's just leave it at that. The R&D for a company the size of Keysight to develop a 1GHz scope is probably significant. It was done a long time ago though, just like the Megazoom IV.I had all parts on hand for the 1GHz mod and decided to try the 500MHz first, which was simple. I've gotten used to 0402 and 0201 parts though so the component swaps were for BIG components. I thought I had marked photos of the 3000T to follow. Matter of fact, it was the 3000T because it was a 3014T but had footprints for the Teledyne relays. 3000A did not.There are around 132 or so components for the 1GHz mod. I would have done it but finally, a pristine 3104T appeared and with option bundle to boot. Someone on here grabbed the parts just to get the 4 relays in the set.

author: EE-digger
author_rank: Frequent Contributor
timestamp: May 08, 2025, 03:55:54 pm
content: Quick 2025 update. Should have invested in relays instead of the market. The relays were $60 a few years ago and now $150 from the same source.

author: tv84
author_rank: Super Contributor
timestamp: May 08, 2025, 04:49:10 pm
content: Quote from: EE-digger on May 08, 2025, 03:55:54 pmMake Relays Great Again!

author: TheSteve
author_rank: Unknown
timestamp: May 08, 2025, 06:40:31 pm
content: Painful. I seem to recall they were always expensive, and hard to get in small quantities. I couldn't get them in North America.

author: EEVblog
author_rank: Unknown
timestamp: May 08, 2025, 10:23:42 pm
content: I have forgotten about this.Does the 3000T PCB have a dedicated path layout for the 1GHz bandwidth input and the (132?!) components just left out?And the 500MHz version uses another path that gets left unpopulated if it's the 1GHz model?

author: analogRF
author_rank: Super Contributor
timestamp: May 08, 2025, 10:33:57 pm
content: Does upgrading 4000A from 1GHz to 1.5GHz really need a hardware mod?datasheet says upgrade ay service center but I wonder what could be the difference between 4104A and 4154A front ends?

author: EEVblog
author_rank: Unknown
timestamp: May 08, 2025, 10:35:29 pm
content: Quote from: analogRF on May 08, 2025, 10:33:57 pmMy bet would be it's just better characterisation, probably with some extra software compensation points.The upgrade is probably them just hooking it to their custom test system, it sweeps it and then stores the compensation results internally.

author: analogRF
author_rank: Super Contributor
timestamp: May 08, 2025, 10:45:55 pm
content: Quote from: EEVblog on May 08, 2025, 10:35:29 pmso only a fresh calibration (alignment)?it's a bit hard to believe they didnt calibrate it all the way to 1.5GHz if the board is designed for both 1GHz and 1.5GHz models like their lower freq models (350M to 500M for example etc...)

author: TheSteve
author_rank: Unknown
timestamp: May 09, 2025, 01:34:31 am
content: Quote from: EEVblog on May 08, 2025, 10:23:42 pmAll of the 3000T bandwidth options use the same PCB. If you get the 500 MHz or lower version they use a different(lower cost) relay/attenuator combination. So as you guessed same PCB, but different paths/parts based on bandwidth.

author: TheSteve
author_rank: Unknown
timestamp: May 09, 2025, 01:36:17 am
content: Quote from: analogRF on May 08, 2025, 10:33:57 pmYes, it will be subtle but different hardware. The lowpass filter between the front end amp and the ADC will be tuned differently.

author: BillCRM
author_rank: Contributor
timestamp: May 23, 2025, 04:46:47 pm
content: Some info I acquired these years：2000/3000/4000A/T/G shared the same input chip (code name llama, used in some late dso5000/6000 too), the same ADC (code name talon), and the ADC might be a slightly modified vesion from old dso5000/6000 series, and the waveform procseeor chip (Megazoom, code name baldwin, it also used in 6000X series too).The 3000A can mod to 500Mhz, but can't go to 1GHz due to lack some pads.The 3000T/G can mod to 1GHz, but need 4 expensive relays. I belive use some normal relays and external attenuation networks will also works.The 4034A can software hack to 4054A. The hardware mod to 1/1.5GHz is basicly impossible. As the mod requires to install a fpga between the ADCs to do USB decode, and an agilent 1NE5-0001B is also need to finish the signal path. But if ignore the potential error message, only do the mod to input part, the mod will be very similar to 3000 series.As for the calibration after those hardware mod, the factory cal is also possible by just add a command in the infiniivison.lnk. Then the user cal will magically turned into factory cal.As for the serial number and model number hack, the agilent secure data tools (DTD,OPD) is also leaked. Be careful as there were already some modded machines on the market.As for the Keygen, yes the Keygen, is also achieved by someone in China, but he won't release it of course. But hacked firmware is enough for us to use so no keygen is also not a big problem.Hope these info will help someone in the future.

author: TinLethax
author_rank: Regular Contributor
timestamp: August 22, 2025, 10:16:39 am
content: Quote from: BillCRM on May 23, 2025, 04:46:47 pmNo wonder why 2nd hand Agilent/Keysight scopes are so pricey on Taobao.