LeCroy Probus reverse engineering - Page 1
Forum section: electronics / testgear

author: ollopa
author_rank: Regular Contributor
timestamp: February 04, 2019, 12:15:54 pm
content: I'll dump everything I know about Probus here. There are bits and pieces of information scattered around the Internet but I think this will be the most complete and accurate repository on the topic.Let's start with the basics: Probus is LeCroy's 6-pin header for active probes and probe adapters. It has +/-12V power, an I2C interface, ground, and a connection to the probe ring.Images of the connector, the pinout, and probe ring:In case the image links go bad, the pinout when looking at the face of the scope is:QuoteThe Probe Ringconnector forms a voltage divider that is sampled by an ADC and used to determine what type of probe is attached. For Probus probes this should be type "Bus" which is identified by a 270 Ohm resistor between Ring and GND. Passive probes use a spring pin to the ring around the BNC connector whereas Probus probes use pin 5 of the Probus header which is tied to the ring.As an aside, I painstakingly compiled a list of the ADC decision points and associated resistor values as well as the mid-point (maximum margin between decision points) and best selection of E24 resistor.Setup: I used a Keithley Sourcemeter to simulate a resistor between the probe ring and ground. The sourcemeter regulated the current through the circuit which I adjusted to find the scope's decision points. By measuring the corresponding voltage at the probe ring I could then back-calculate the equivalent resistance between the probe ring and ground.The ADC column is the number reported by the scope when it first changed from the previous point as reported by service diagnostics. The current column is the driving current from the sourcemeter and the voltage column is the measured voltage at the probe ring node. The equivalent resistor values is voltage divided by the current.The midpoint resistance is the exact middle between two decision points and the E24 column is the nearest 5% tolerance resistor to the midpoint value. Note that LeCroy uses a 10k resistor in their 10x probes which is fine, though not perfectly centered, and Tek uses 11k in their 10x probes.ADC counts (hex)Probe TypeCurrent (mA)Volts (V)Rmax (Ohm)Rmid (Ohm)Rmin (Ohm)E24 (Ohms)LeCroy Value (Ohms)0x3ffNone03.000Open--33046--0x3da1x.0872.875330462516017275240000x3ae10x.1602.7641727512889850313000100000x35c100x.32.55185036224394562000x2e51xa.552.17039453426290733000x2a52x.681.97729072548218824000x2625x.8121.77721881930167220000x22020x.9431.57716721471127115000x1dc50x1.0791.3711271111094911000x195200x1.2191.1579498317138200x153500x1.3480.9627136606066800x1301000x1.4160.8586065104155100x0e810xa1.5560.6454153763373900x0c7Bus1.6210.5473372561762702700x077BusInt1.7760.312176112481100x031Short1.9210.09148240--0x000Short1.960.000000--The I2C interfaceis connected at minimum to (inside the probe) a 24C series I2C EEPROM, usually a 24LC02, and optionally one or more I2C IO expanders (PFC8574). The EEPROM write-protect is pulled high and must be shorted to ground to enable erase/write. Typically there is a 2-pin 100mil header inside the probe for this purpose. The address lines are all tied low.The contents of the EEPROMare arranged into order-independent packets with a two-byte header. The first byte is the packet type and the second byte is the packet size (including the two header bytes). Although firmware can read and parse packets that are out of order, it is best practice to store them in ascending order by the packet type byte.At a bare minimum the probe needs to implement themodel namepacket or else the probe will not be identified.The list of recognized probes and adapters is hard-coded in firmware as are some of the default probe parameters. For example probe input capacitance and bandwidth typically (maybe always?) come from hard-coded values in firmware rather than from the EEPROM data. So if you are making your own probe you most likely need to fake an existing model or else be faced with this:Let's look at a simple example for the AP100 probe. EEPROM contents are very short:01 08 00 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0ABegin parsing by looking at the first two bytes, 01 08. This is type 01 (model name) and size 08:01 0800 41 50 31 30 30 11 06 00 00 A0 40 12 06 AE 47 81 3F 36 03 00 38 07 31 30 30 EA 0ASo the first packet consists of the first 0x08 bytes:01 0800 41 50 31 30 30The next packet is type 0x011, 0x06 bytes:11 0600 00 A0 40Then type 0x12, also 0x06 bytes:12 06AE 47 81 3FThen type 0x36, 0x03 bytes long:36 0300And finally it ends with type 0x38, 0x07 bytes:38 0731 30 30 EA 0AAs mentioned before, packet type 0x01 is the probe model name. It begins with a null byte for some reason (all values of this byte seem to be ignored) and then comes the name in ASCII. (41 50 31 30 30 = AP100)Type 0x04 is the probe serial number. Sometimes it is in ASCII (AP022) and other times the hex values of the data are displayed (AP021).Type 0x38 is an ASCII string for the coupling label, though it appears to be overridden by hard-coded firmware values (you can change the value in the EEPROM but it doesn't reflect in the GUI). It seems to always be terminated with a line feed (0x0A).There are many other packet types but I am so far unable to determine what their significance is.Type CodeMeaningStorage Type0x01Probe model nameASCII with a leading null0x04Serial numberASCII or sometimes decimal0x11Attenuation attributeSingle point precision float, reversed bytes0x38CouplingASCII with line feed terminator0x41Delay attributeSingle point precision float, reversed bytes0x62BW in GHz (newer probes like ZD200)Single point precision float, reversed bytesAttached is a zip of EEPROM data for 139 different probe types. Maybe somebody will join me in trying to decode the many other packet types.

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 04, 2019, 01:07:47 pm
content: seems inlined with the report here..https://groups.io/g/LeCroyOwnersGroup/topic/probus/989251?p=there is also linked eeprom content for other probe such a AP020 but i dont have membership so i cant see it.https://groups.yahoo.com/neo/groups/LeCroy_Owners_Group/files/ProBus/as the report said, differential probe is a bit tricky as there is no connectivity between probe's ring pin 5 and gnd when measured with DMM, i confirmed this with WL600 and D13000PS probe body. if you can get a AP020 eeprom content, maybe we can compare the content with mine, just need a tool to read and save the eeprom content, thinking about building an arduino eeprom reader. keep up the good work...

author: tv84
author_rank: Super Contributor
timestamp: February 04, 2019, 03:51:30 pm
content: Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmHere it is.

author: ollopa
author_rank: Regular Contributor
timestamp: February 04, 2019, 04:33:43 pm
content: Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmI've seen that thread before but I'll remark that 1) the pin numbering in that post is incorrect and 2) the resistor value table I created is more precise and complete.The pin numbering correction I made matches the schematics:Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmInteresting but there has to be something there for the scope to detect the probe. My guess is that the probe ring resistor is switched in after power-up. Perhaps the differential probes have a microcontroller on the I2C bus with a slow startup or some other requirement to delay Probus enumeration. I'll see if myAP033AP034 behaves this way.Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmI believe I've used this arduino library successfully before:https://github.com/jlesech/Eeprom24C01_02

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 04, 2019, 05:06:53 pm
content: Quote from: ollopa on February 04, 2019, 04:33:43 pmnow where did you get that schematics?

author: ollopa
author_rank: Regular Contributor
timestamp: February 04, 2019, 05:24:43 pm
content: There are a couple of service manuals for the older scopes floating around. It's also the industry standard pin numbering for female 2-row headers.

author: MilkmanCDN
author_rank: Contributor
timestamp: February 05, 2019, 11:54:56 pm
content: QuoteYep, they're readily available from various online sources. Here's a schematic snippet from an older WaveRunner front-end. Same thing.

author: MilkmanCDN
author_rank: Contributor
timestamp: February 05, 2019, 11:58:09 pm
content: Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmYou can also use something more readily available like an Aardvark (TotalPhase). I just used mine this evening to pull down the EEPROM contents from 2x PP090 probes. They match exactly what ollopa included in the EEPROM dump.

author: Scratch.HTF
author_rank: Regular Contributor
timestamp: February 06, 2019, 06:41:26 am
content: I've seen ProBus modules which contain license keys for certain options (one of which was for Telecom Mask Testing) which can be transfered scope to scope.

author: ollopa
author_rank: Regular Contributor
timestamp: February 06, 2019, 06:58:05 am
content: Quote from: ollopa on February 04, 2019, 04:33:43 pmAnd so another evening was spoiledI measured between pins 5 and 6 of my AP034 differential probe and sure enough, it was open-circuit. Next I connected my dual tracking power supply to +12V/-12V/GND of the probe and measured resistance across pins 5 and 6. It measured 270 Ohms somewhere between 1 and 2 seconds after turning on the power supply. In fact the probe ring resistor being switched in exactly coincided with the x1 LED on the probe turning on.So it seems my info was good: Active probes use 270 Ohms / BUS identification and apparently probes with slow booting logic will hold off enumeration until it is configured / booted.In the case of the AP034 I think it's a replacement for the I2C IO expanders.The hardest part about taking this probe apart are the buttons. There's not much poking out to get a grip on but they need to be removed before the PCB can slide out:A little bit of a surprise once it's out: A chunky PLD with way more IO than is necessary and two PCBs mated together with 4 tiny headers:You can see pin 5 going straight to top-left header pin in this photo:And if you follow it on the mating PCB it heads over to a resistor switched in by a transistor:That resistor measured 267 Ohms across it.Quote from: Mechatrommer on February 04, 2019, 01:07:47 pmPP090 is a 75 Ohm adapter so it's pretty basic and I guess that's why the EEPROM is a perfect match. Let's break it down:01 08 00 50 50 30 39 30: 0x01 = probe model name, 8 byte packet, 0x00 dummy byte, ASCII "PP090"11 06 00 00 00 40: 0x11 = Attenuation attribute 6 byte packet, data = 0x00000040 = divide by 236 03 00: 0x36 = Unknown 3 byte packet, data = 0x0038 06 37 35 EA 0A: 0x38 = Coupling options, 6 byte packet, ASCII "75" Ohm symbol extended ASCII), line feed41 06 3F E3 7C 2F: 0x41 =Delay (single precision float, 230ps)Unfortunately not a very exciting EEPROM. There's no serial number (0x04) and likely no cal or anything else.I have 2 AP022's and the only difference between them is one byte of the serial number.It could very well be that some of the EEPROM data is only parsed by the older VxWorks scopes and X-Stream only pays attention to the model name and serial number.

author: ollopa
author_rank: Regular Contributor
timestamp: February 06, 2019, 07:07:06 am
content: Quote from: Scratch.HTF on February 06, 2019, 06:41:26 amHi Scratch,That would be the PP100 which looks like this:01 08 00 50 50 31 30 30 0x01 = name = "PP100"53 04 00 02 0x53 = ?? Count of licenses maybe? 0x00261 0D 00 4D 54 30 31 2C 4D 54 30 32 00 "MT01,MT02" and a null terminatorVery easy to fake. These are not actual instrument licenses, though. For example if you put "I2C" in there you will not get the I2C protocol decode option.These wind up in a different option store as mentioned in the manual on the SCPI command to retrieve the list of custom application options:Quote

author: ollopa
author_rank: Regular Contributor
timestamp: February 06, 2019, 08:52:48 am
content: OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type:0x11 = Probe attenuation attribute.In the PP090 it's divide by 2 and the data is 11 06 00 00 00 40 so 0x00000040 = divide by 2.In the AP100 it's divide by 5 and the data is 11 06 00 00 A0 40 so 0x0000a040 = divide by 5.D1305 is divide by 2.828, data is 11 06 81 04 35 40 so 0x81043540 is divide by 2.828.D1330 11 06 C8 A7 D8 40 divide by 6.770CP015 11 06 00 00 20 41 is divide by 10 when copied into AP100This is a single-precision float:2 = 0x400000005 = 0x40A0000010 = 0x412000000x40350481 = 2.82839989662And another:0x41 = Delay attribute, single precision float LE

author: ollopa
author_rank: Regular Contributor
timestamp: February 06, 2019, 09:53:03 am
content: Refresh the thread and see my updates. It's actually a single-precision float with the bytes in reverse and represents the probe delay attribute.230e-12 (230ps) = 0x2F7CE33F as a float. In reverse that's 3f e3 7c 2f.Edit: Added 0x62 BW in GHz (newer probes like ZD200) Single point precision float, reversed bytes. See bottom of first post for an up-to-date list of the tags I've identified so far.

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 06, 2019, 12:15:02 pm
content: Quote from: ollopa on February 06, 2019, 06:58:05 ami think an "adapter" like PP090 wont have cal data, the coax cable will just run straight through from input to output, so transfer function should be... 1? i'm interested to see eeprom comparison of active probes like AP020 and AP034. there should be some interesting data thats unique to each probe? i'm thinking to do this kind of work but i cant get to this yet, since i'm locked with other stuffs my desk piled up with things.Quote from: ollopa on February 06, 2019, 08:52:48 ami ar wun aint no have an PP090i think its tv84 who provided it..

author: MilkmanCDN
author_rank: Contributor
timestamp: February 06, 2019, 02:52:35 pm
content: Quote from: Mechatrommer on February 06, 2019, 12:15:02 pmNo worries. They were mine.

author: MilkmanCDN
author_rank: Contributor
timestamp: February 06, 2019, 03:34:33 pm
content: FYI, If anyone is looking for replacement accessories case used in almost all of Lecroys active probes, you can get them here:-https://www.amazon.com/Plano-Small-Sided-Tackle-Box/dp/B0000BY57W

author: ollopa
author_rank: Regular Contributor
timestamp: February 06, 2019, 04:33:09 pm
content: Quote from: Mechatrommer on February 06, 2019, 12:15:02 pmNo, definitely not. There will be an impedance matching circuit of some sort. For a wide frequency range and flat response it would likely be a matching pad rather than a tuned circuit or transformer, but I don't know the specs of the PP090 offhand. In any case with a divide-by-two attenuation attribute the transfer function is definitely not 1.Quote from: MechatrommerYes please post anything you can. I've compared a couple sets of probes and so far nothing significant has been different.Quote from: MechatrommerOops, sorry to you and MilkmanCDN both. And thanks MilkmanCDN!

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 07, 2019, 05:51:55 am
content: Quote from: MilkmanCDN on February 06, 2019, 03:34:33 pmthere are also a few in ebay...https://www.ebay.com.my/itm/Plano-Small-2-Sided-Tackle-Box/282622389504?hash=item41cd9b6d00:g:5EkAAOSwfRdZK9D6:rk:2:pf:0https://www.ebay.com.my/itm/Plano-Small-2-Sided-Tackle-Box/141990494258?hash=item210f4b0032:g:BvcAAOSw8vZXNILk:rk:1:pf:0i have that came with D500PT and soft carrying bag. its good because its compact 2 sided, but i'm not fan we have to flip over to get to the other side, the parts inside the other side will fall to the lid under. so for sensitive parts we need to brace with foam or something top and bottom. for my case, it came only to store some clips, mini pins inside a mini plastic bottle, and the lecroy stripline test circuit i guess for calibration or skew testing i dont know. the case not even fit in the probe 2 legged stand and probe's head clip, useless. i have to get another box for them later.Quote from: ollopa on February 06, 2019, 04:33:09 pmlet see what i can do..Quote from: MilkmanCDN on February 05, 2019, 11:54:56 pmin your linked schematics, the resistor to pin 5,4,3 is 33 and 22 ohm instead of 100 ohm in dda5005 and sda6000 wavelink interface (wavemaster series). just to let you people know, and i guess it wont make much difference. i think the voltage divider logic provided by ollopa still applies, if not then we have to redo the test again. attached are pcb for the probe's interface on 5005 and 6000.and while at it, the rest of the attachment shows whats inside a D13000PS diff probe body. there is no 24C02 (eeprom) chip that i can spot, only a hobby grade pic16f872 chip. some sellers sell this body at insane price they dont know the most expensive is the probe head, this probe body is just interfacing platform any hobby can build at few cents of price, they are crazy. these probe's body (both D13000PS and WL600) can accept D500PT head and i suspect also applies for other compatible head like D600AT-T, D350PT, D300PT et al. the DSO will show nothing when probe's body alone is connected, only shows probe's head ID when the head is connected to the body, so i guess there is also some eeprom chip inside those small probe head, that need some courage and risk to open up, thats where the real money is, we broke that we lose some $K of money. maybe we can just sniff pin 3,4,5 for safer hack.imo hacking these differential probe is too much, they are specialized lower input impedance lower dynamic range probe. and the very high frequency BW is not easily replicated by hobby if the purpose is to make a 3rd party cheap compatible probe alternative. so maybe we can stick with more general purpose high impedance higher dynamic 1-2GHz probe like AP020 and AP034. i only provide it for food of thought maybe usefull for someone, fwiw...

author: JPortici
author_rank: Super Contributor
timestamp: February 07, 2019, 06:57:30 am
content: yeah, the PIC is probably there to act as eeprom and probably to handle all the trimming inside the probe

author: wingel
author_rank: Contributor
timestamp: March 05, 2019, 06:56:00 pm
content: Has anyone managed to find a supplier that sells the edge mount BNC push-on connector or the 6 pin header? For testing one can make do with a normal BNC connector on a cable and a pin header, but it would be nice to be able to build something like that AP034 board.

author: Mechatrommer
author_rank: Super Contributor
timestamp: March 06, 2019, 12:30:02 am
content: btw, i think it will take more than just a eeprom dump hack on a AP020 clone...(the edge mount BNC push-on connector and the 6 pin header can be seen here i'm also looking)

author: wingel
author_rank: Contributor
timestamp: March 08, 2019, 07:30:39 pm
content: I have found a supplier in China that can sell a push-on BNC connector similar to the one used in the LeCroy probes. It's their normal PCB edge mounted BNC connector without the coupling nut. The LeCroy connector seems to be about 12mm long, the connector I have found is about 17mm long, but if someone is making their own PCB it shouldn't be much of a problem. Since this is a product from China I don't know anything about the quality yet, hopefully it has decent 50Ohm impedance matching but you never really know until you actually have tested it.I'm probably going to buy a few of these. With shipping, import duties and taxes the price should be less than EUR 5 per connector. I live in Sweden which is part of the European union. Is anyone else in EU interested in these connectors? Shipping and all the extra costs will probably be quite expensive, so I could buy a few extra connectors and resell them. For people outside of EU it's probably easier to just talk to the manufacturer.As for the pin header, it seems to be a custom connector which one would have to get someone to manufacture specially. Probably rather expensive to do. But I think it might be possible to hack something together out of Mill-Max 5107 double tail header pins, an angled 2mm female pin header and some 3D-printed parts.

author: wingel
author_rank: Contributor
timestamp: March 08, 2019, 08:27:13 pm
content: One more thing. Could someone who has a LeCroy probe measure the pin header and post the exact dimensions. I'm trying to find a supplier who can manufacture the connectors just to see how much it would cost, and it would be nice to be able to give them some drawings of the part.

author: ollopa
author_rank: Regular Contributor
timestamp: March 08, 2019, 08:27:40 pm
content: The mill-max connectors look nice (not the push-pin but standard gold plated round connectors).I think LeCroy was smart in realizing that the ProBus connector would be plugged and unplugged many times during the lifetime of the scope, so they chose very high quality interconnects with a very smooth finish. I do worry that using budget square pin connectors with a rough finish may distort and damage the female headers on the scope, especially after repeated use. Anyway mill-max probably already has or can produce an adequate replacement connector.For home use you don't really need to reproduce LeCroy's plastic housing and use right-angle connectors on the PCB. You could just have a straight header on a pigtail that gets pushed into the ProBus connector (just have to be careful about inserting it upside-down!)

author: Mechatrommer
author_rank: Super Contributor
timestamp: March 09, 2019, 12:00:56 pm
content: Quote from: wingel on March 08, 2019, 07:30:39 pmfor non EU members, can you share the source?

author: ollopa
author_rank: Regular Contributor
timestamp: March 09, 2019, 12:31:18 pm
content: There are a few panel-mount push-on male BNC connectors out there.https://www.aliexpress.com/item/RF-electrical-terminal-connector-BNC-Plug-panel-mount-Quick-Push-on-bulkhead-with-Solder-cup-connector/32443473110.htmlhttps://www.aliexpress.com/item/5PCS-BNC-Panel-Mount-Plug-Quick-Push-on-with-Nut-and-Solder-Cup/32704864505.htmlObviously PCB mount would be preferred so I'm looking forward to hearing back from wingel.

author: Mechatrommer
author_rank: Super Contributor
timestamp: March 09, 2019, 12:48:59 pm
content: yes i saw that deck mount quick bnc type connector sold in ebay, the price is a bit high for a china brand. and its less neater than the original, the ground connector is "loose" type i'm not sure it will be impedance controlled. that will be the last option.

author: wingel
author_rank: Contributor
timestamp: March 11, 2019, 07:08:28 am
content: > for non EU members, can you share the source?sure, I just wanted to check with the supplier that i was allowed to post their product drawing in a public forum.I found an edge mounted BNC connector from a Chinese company called "Eastron" (eastron.cn) on Alibaba:https://www.alibaba.com/product-detail/RF-50ohms-ST-180-degree-edge_60634004992.htmlWhen I contacted them it turns out that they also have a "push-on" variant of the connector without the coupling nut as in the attached picture. Not too hard for them to do such a variant I guess, since all they have to do is to build a batch of the normal connector and not mount the coupling nut. And they are willing to sell just a handful of them since they still have a few in stock.The Alibaba page shows a picture of a vector network analzyer (looks like a HP 8753E which goes up to 3GHz or 6GHz depending on options) so they should be able to check the impedance matching of the connectors they manufacture. I'm hopeful that the connector will be of decent quality.Please don't buy up all of their stocks though, I want to buy some first.

author: wingel
author_rank: Contributor
timestamp: March 11, 2019, 07:23:23 am
content: (Updated. Darn, I can't spell when I have just woken up and should be on my way to work.)Finding a decent pin header turns out to be much harder. I haven't found any supplier with any angled connector with 0.03" pins.If one could just find a straight pin with the proper rounded end and surface finish (a couple of micrometers of gold on nickel) one could probably 3D-print or mill a plastic support to put the pins in. And then build something like the attached picture with a bulk-head push-on-BNC to SMA adapter that one can find on eBay for a few dollars.Build a small PCB like that with an I2C EEPROM on it and you'd have something that fits nicely in the LeCroy scope with no risk of inserting the pin header in the wrong direction.Do you know any decent manufacturer that have an automatic lathe who could manufacture a run of a hunded pins or so and then plate them with nickel and gold? It shouldn't be that hard to do, I just have no idea where to find a manufacturer who can do it for a decent price.

author: Mechatrommer
author_rank: Super Contributor
timestamp: March 11, 2019, 07:47:12 am
content: Quote from: wingel on March 11, 2019, 07:08:28 amdont worry, alibaba is a bit inconvenient for me (not sure how to make order (and paypal payment possible?) and look at seller rating) and i'm not in great need, otherwise we still have alternative the china nutted version above. if you want you can buy all and post in ebay for non-EU member as well. the alibaba link you provided has the outer rotating/lock ring, lecroy doesnt. but i'm thinking we can improvise that by removing the outer ring using brute force or something hard. i thought i've linked earlier the pcb side mount of a BNC connector with lock ring. i measure it about 15.5mm tip to pcb edge. i have this a few in stock.Quote from: wingel on March 08, 2019, 08:27:13 pmnot entirely sure what you want, but measuring with my rusty caliper on AP020, the internal of protruding rectangular plastic protecting/guiding the pins is 6.7 W x 5.3 H x 5 D (mm) the pin diameter is about 0.76mm type, the mill-max also have 0.46mm diameter pins like what i bought from china no brand ebay here, which is too loose and not suitable. the linked pogo spring loaded in 1.07mm dia i dont think that will fit. i browsed mill-max catalog i cant find 2mm pitch headers with 0.76mm pin diameter, 0.76mm pin only available in 2.54mm pitch format, so maybe need to improvise again

author: Someone
author_rank: Super Contributor
timestamp: March 11, 2019, 09:03:33 am
content: Quote from: Mechatrommer on March 11, 2019, 07:47:12 amYou should be able to assemble a suitable pin array from mil-max 3150-2-00-15-00-00-08-0 or 3330-2-00-15-00-00-03-0. A PCB structure is robust enough to support and align an active interface as in here:https://www.eevblog.com/forum/projects/diy-100mhz-differential-probe/

author: wingel
author_rank: Contributor
timestamp: March 11, 2019, 10:16:50 am
content: Mill-max 3330-2 looks like it could work. Thanks!

author: ollopa
author_rank: Regular Contributor
timestamp: March 13, 2019, 05:07:44 am
content: Somewhat related thread on DIY probe construction for the older scopes, epoxy putty based ProBus connector, a couple more EEPROM dumps:https://www.eevblog.com/forum/testgear/lecroy-pp092-2gssec-adapter/25/

author: sixtimesseven
author_rank: Frequent Contributor
timestamp: December 12, 2019, 05:34:18 pm
content: Quote from: wingel on March 11, 2019, 10:16:50 amDid they work out in the end?

author: MilkmanCDN
author_rank: Contributor
timestamp: March 12, 2020, 01:26:40 pm
content: Folks,Many of the plastic tabs seem to be broken off on my older active probes. I an effort to solve this problem, I took some calipers and created a 3D model. .STL attached in the .ZIP file.To test fit the model, I printed on a FDM (Prusa MK3S) using Prusament Galaxy Black PLA filament. The results were much better than I expected. The fit is wonderful and after mounting it to an existing probe chassis, it feels like brand new. Tight fit.Side-note: the back-side of the original connector appears to be covered in some kind of metallic paint. I've found a few options, but haven't tested any of them yet.I suspect printing on an SLA would produce better results, but alas, I don't have one (yet..). If some one does, would it be possible for you to print and post pictures?

author: MilkmanCDN
author_rank: Contributor
timestamp: March 12, 2020, 01:31:59 pm
content: Folks,I believe someone was asking for 3D models of these two parts. Pictures and Models attached.If anyone finds a place to source these, I'm all ears. I've been looking for quite some time but have always come up empty.

author: dmderev
author_rank: Contributor
timestamp: October 11, 2020, 06:58:46 am
content: Hello, could you please tell what is the marking on the chip located near R23 and R25 in the picture showing location of green jumper in your post. Most likely it should be a DAC? Which probe model this picture is from? Did you ever reverse engineered schematics?

author: ollopa
author_rank: Regular Contributor
timestamp: October 11, 2020, 08:30:40 am
content: Quote from: dmderev on October 11, 2020, 06:58:46 amThis is the probe AP022. No, I did not ever try to reverse the schematics.74HCT573C Octal D type latchQ1 looks like a 5V regulatorBut on the other side is your DAC: DAK703KU 16-bit monolithic DAC

author: 2N3055
author_rank: Super Contributor
timestamp: October 11, 2020, 08:53:14 am
content: HCT573 is transparent octal D latch, PCF8574 is I2C 8 bit I/O expander. With those 3, you can clock in 16 bits for D/A converter (DAC703 16 bit voltage mode D/A with built in reference) to set offset with the help of LT1112 dual opamp....

author: dmderev
author_rank: Contributor
timestamp: October 19, 2020, 04:26:23 am
content: For those interested, here is how control of the input mode and offset is performed:( I programmed the EEPROM for AP020 and used a preprocessor that acknowledges all transactions. )1. The quality of the contacts in the connector matters, poor contact leads to a transition to strange modes (a red bar “Processing ...” appears. When I realized this, the work became predictable. EEPROM address - 50h (all address inputs must be at zero)2. The binary images on the Internet contain only the valid data. The default programmer leaves FF in an unused area. It confuses the firmware. All free memory must be filled with zeros.3. The oscilloscope reads entire EEPROM sequentially, regardless of the size of the data block, in one pass. Then it recognizes the probe, and switches the input mode (in my case, DC coupling is turned on and 50 ohms is not turned on - perhaps the resistor in the probe, although in the picture you can see only the place for its installation.4. When you rotate the offset knob, the oscilloscope sends the following commands to two PCF8574 port expanders - at addresses 0x23 (data port) and 0x21 (command port). First, the most significant byte of the offset is written to the data port (for positive numbers, the most significant bit = 1, for negative numbers = 0). Then bit 0x01 is set in the command port (latch new data in 74573), after that the bit is cleared (data remains in 74573) and then the low byte is written to the data port. Perhaps this leads to a small glitch at the DAC output, but they are OK with it.5. If these transactions are not acknowledged, the oscilloscope makes 4-6 recording attempts and stops.6. For example, 0x8000 = offset = 0, 0x7FFE = offset = -2mV, 0x8002 = offset = + 2mV. In this case, the DAC code is likely to scale, since for the sequence 1,2,3,4,5,6mV codes 0x8002,0x8004,0x8006, 0x8007, 0x8009, 0x800A. But I am not 100% positive in scaling.7. When switching the vertical scale and if the offset is not zero, the oscilloscope sends the correspondingly changed offset - that is, on the 1mV range, the 10mV offset will be replaced by 50mV when switching to 5mV. If offset was zero, the transaction is not done as it stays zero.8. Depending on the input mode, the command port bits have the following meaning - 0x10 - when set, the DC coupled input. 0x40 = when set, the input is AC coupled (on probes, is this?) When both bits are cleared, the input must be Grounded. That is, switching the mode and writing a new offset corresponds to 0x23 = MSB, 0x21 = 0x11, 0x21 = 0x10, 0x23 = LSB for DC coupled, 0x23 = MSB, 0x21 = 0x01, 0x21 = 0x00, 0x23 = LSB for GROUND, 0x23 = MSB, 0x21 = 0x41, 0x21 = 0x40, 0x23 = LSB for AC coupled. The relay may be switching Ground.9. I did not find the purpose of the remaining bits in the control port, other buttons and knobs do not affect the samples.The schematic which illustrates the concept of control in case of AP020,AP022. The DAC appears in complementary offset binary.Other bit settings may appear needed for other probes. It looks that WavePro recognizes newer probes (ZDxxx, ZSxxx) and lists their names, but does not send offset data to probes on I2C. Newer scopes should be able to do that.

author: MilkmanCDN
author_rank: Contributor
timestamp: January 29, 2022, 06:44:01 pm
content: I've been tinkering away a little bit with the calipers as I believe someone asked for dimensions of the 6-pin probe connector. I've attached a drawing which should give all the details one might need.Also included is an updated .STEP (AP214) model to allow input into popular CAD programs.Again, if someone knows where to source these, I'm all ears.

author: dmderev
author_rank: Contributor
timestamp: May 25, 2022, 07:26:10 am
content: For those interested, here is how I solved the problem of round pins on 6-pin 2mm connector.There is a Mill-Max part number 3330-2-00-15-00-00-03-0 (Mouser part 575-3330200150000030) - and also Mill-Max 3330-1-00-15-00-00-03-0. These are bulk round pins, gold plated. I made a spacer from 3mm thick FR4, and plugged these pins into a right-angle PCB dual-row 2mm header.I cut a piece of 3 positions from the 40 pin header. Since the pins are thicker than regular 0.5mm pins of such header, one need to push them in rather strong. Once the pins are in the connector, I applied epoxy and pushed in additional FR4 spacer. This creates a nice angle connector which reliably plugs into the probe socket.When combined with the 3D-printed shell, this allows to build the probe PCB that fits. The picture shows two connectors: angle one to put on PCB, and a straight one which I used for connecting to logic analyzer.On the side note: I printed the shell from PETG filament. Because the walls are thin, they may split. Applying acrylic solvent cement (dichloromethane or dichlorethane?) "welds" and bonds the shell layers and makes it strong enough to latch on the probe connector.

author: dmderev
author_rank: Contributor
timestamp: May 30, 2024, 02:30:05 am
content: Does anyone know where I can get the mating (receptacle) 3x2 pin 2mm pitch connectors to build the extender for the probus? The standard 2mm connectors have too small holes and the probe pins do not go there freely. I found that a cutout from DVI connector (it has 1.94mm pitch) can be mated, but I am looking for a better solution... Or, alternatively, are there any receptacle pins that mate with Mill-Max round 0.8mm round pins?

author: Momchilo
author_rank: Regular Contributor
timestamp: May 30, 2024, 09:34:45 am
content: They have a lot of different receptacles.From their website:https://www.mill-max.com/products/match/mating-receptacles/3330

author: bson
author_rank: Unknown
timestamp: May 30, 2024, 06:34:10 pm
content: Are you sure type 04 is a serial number? It looks like at least sometimes it's an ascii version number, for the newer probes. Maybe for older probes it's a binary version number?ZD1000:04 06 41 30 30 31 'A001'ZS1000:04 06 31 34 38 32 '1482'ZS2500:04 06 41 30 30 35 'A005'AP020:04 06 96 18 00 99Maybe 99 is 1999 and they changed the encoding at Y2K?

author: bson
author_rank: Unknown
timestamp: May 30, 2024, 07:02:35 pm
content: I think 38 is the input coupling and impedance, while while sometimes 39 is only the coupling. Not sure why both would be there, especially since 39 is often merely the two first characters of 38. Some probes only have 38. It seems a bit helter-skelter.DA18000AC.bin :38 09 41 43 20 35 30 15 0a 'AC 50'39 05 41 43 0a 'AC'DA1820A.bin :38 0b 45 78 74 65 72 6e 61 6c 0a 'External'39 05 45 78 0a 'Ex'OE695G.bin :38 08 58 58 58 6e 6d 0a 'XXXnm'PP090.bin :38 06 37 35 ea 0a '75\xea'ZS1000.bin :38 09 44 43 20 31 4d 15 0a 'DC 1M'39 05 44 43 0a 'DC'I wonder what those 0xea and 0x15 bytes are for, but I'm sure they serve some purpose.I assume if it says DC or AC the coupling is locked. Same if it has an impedance.

author: ollopa
author_rank: Regular Contributor
timestamp: June 01, 2024, 05:13:23 am
content: Quote from: bson on May 30, 2024, 06:34:10 pmI'm not saying that it's an actual unique serial number, but it is in the "serial#" field of the probe info.Also note that I don't have real dumps from actual probes for all of these, some are EEPROM values used for simulation so they may have SN values with some other meaning to the firmware developers.

author: ollopa
author_rank: Regular Contributor
timestamp: June 01, 2024, 08:09:22 am
content: Quote from: bson on May 30, 2024, 07:02:35 pmLook at the attached picture and you will see that there are two places in the UI where the coupling appears, one location is just 2 bytes and the other is the longer selection string. This may be a clue as to the reason why, but I'm not sure. The 0x39 tag doesn't seem to do anything to the UI but if I change the 0x38 tag in the ZS1000 EEPROM then it does change the input channel coupling selection between DC and AC coupling. And if you look at the second screenshot I can change the text in the UI to something ridiculous like 5GOhm.It could be that 0x38 is just the UI label and 0x39 controls the hardware setting, with 0x39 defaulting to DC 1M when not specified.Quote from: bson on May 30, 2024, 07:02:35 pmThey do. 0xEA is the omega symbol in the extended ASCII table and 0x15 appears to be an alias.

author: ollopa
author_rank: Regular Contributor
timestamp: June 01, 2024, 08:13:48 am
content: One more experiment. Look what I did by changing 0x38 and removing 0x39. I can set arbitrary text for the coupling UI

author: heize0
author_rank: Contributor
timestamp: April 13, 2025, 02:39:05 am
content: Thanks to everyone.I successfully did a converter to use a Tek TCP202 current probe on my Waveusrfer 44MXS-B oscilloscope.

author: ollopa
author_rank: Regular Contributor
timestamp: April 13, 2025, 03:46:33 am
content: That's awesome! Are you willing to share the design?

author: heize0
author_rank: Contributor
timestamp: April 13, 2025, 04:40:17 am
content: Yes. I wish it can help.Tek TCP202 current probe isn't sensitive to the +-15V supply voltage, so I used the +-12V suplly rails on the Probus directily and it works well.

author: heize0
author_rank: Contributor
timestamp: April 13, 2025, 04:52:04 am
content: I use the easyEDA to do the design. I found it's a little weird after conversion. So I attached the Gerber files.

author: dmderev
author_rank: Contributor
timestamp: April 13, 2025, 06:37:00 am
content: Hi, for those interested, I am attaching the results of reverse engineering of HFP2500 probe and the protocol on I2C it is using. The contents of EEPROM is published on this forum somewhere.One interesting thing - this probe has RGB LED that turns on the color matching that of the trace on the screen. However, I did not reverse engineer how exactly the LEDs are connected. I guess that there is some transcoding in PIC firmware. But if someone can suggest a simpler circuit that converts the bits as they are sent by the scope to 3 LED wires, it will be great. The codes are in attachment...

author: zhongzuocheng520
author_rank: Contributor
timestamp: April 26, 2025, 07:35:41 am
content: NB啊！兄弟