EEVblog #976 - Keysight 1000 X-Series Oscilloscope Teardown

[mikeselectricstuff]

So at boot it appears to indicate what it is capable of. Swapping jumpers might just bump it to a 200 MHz model with 4 GS/s.

I doubt it's that simple - the application software will need to also co-operate, and I think the functionality, layout etc. is sufficiently different that it's likely to be different builds, not universal firmware that decides funcitonality based on what hardware it thinks it's running on. Also the flash may be smaller to reduce cost.
I could be wrong-  I'll leave it to others to investigate-too much other stuff to play with.

Not too implausible that some extra funcitonality might be possible. I did look at the SPEAR datasheet to see if adding a magjack would be possible, but looks like it needs an external PHY as well. The UART pins are on that unpopulated connector and I'd put money on the PHY connections also being on there. The SPEAR BGA is fully via'd so it would be possible to trace it out. Would be a lot of work only to maybe find the firmware didn't have networking built in.

It may be that there are some hidden options in the firmware, but can't imagine there's a link to turn it into a 3000X anywhere.

[TheSteve]

Well it is probably that easy to fool it into believing it has those spec's. That doesn't mean the analog front end etc will cooperate.

The jumper matrix could be just above and to the right of the 25P40, unless it reads the settings from the analog board through a connector.

I don't think we can blame Mike for not experimenting further, there are now some areas to play with if one falls into the right hands.

[mikeselectricstuff]

And don't forget that many features will be controlled by license keys etc., though I suspect there will be people working on that at some point.

[EEVblog]

And don't forget that many features will be controlled by license keys etc., though I suspect there will be people working on that at some point.

Yes, you can forget about hardware hacks being useful if you don't hack the license keys as well.
In theory it should only require a license key hack on the EDU G model.
The bandwidth, serial decode, and wavegen are all software license key options. So even if you got the non-G version and added the signal gen hardware (if the footprints are there), then you still need the license key to enable it.

[amitchell]

And don't forget that many features will be controlled by license keys etc., though I suspect there will be people working on that at some point.

Yes, you can forget about hardware hacks being useful if you don't hack the license keys as well.
In theory it should only require a license key hack on the EDU G model.
The bandwidth, serial decode, and wavegen are all software license key options. So even if you got the non-G version and added the signal gen hardware (if the footprints are there), then you still need the license key to enable it.

Are the prize oscilloscopes fully loaded @EEVblog?

[EEVblog]

Only other connections I could see ( including by x-ray) are power and possibly one line to the module.

Did the x-ray show you how many layers the processor board is?

[MrBungle]

Only other connections I could see ( including by x-ray) are power and possibly one line to the module.

Did the x-ray show you how many layers the processor board is?

A visual did....

Back on topic, the sub-board is 10 layers.

Edit: bah! Photo didn't copy across. Maybe this will work....

[EEVblog]

A visual did....
Edit: bah! Photo didn't copy across. Maybe this will work....

Thanks. Getting medieaval was going to be my next step 
It did look like at least 10

[EEVblog]

Found a UART - boot text below.

Where did you find the UART?
I found a UART port on a via near the unused board-board header operating at 57600 but it seems to get gibberish out on boot. Unless I'm not decoding it right.

[Fungus]

The firmware is so buggy on these Keysight scopes that I avoid them for any troubleshooting work.

Weird. I was assured by several forum members that only Rigol 'scopes had bugs.

Sexy LCD and fast CPU but I had to laugh when I kept getting a blank trace and putting a Tektronix to the same probe point gave me a trace, just as I expected.
I especially love setting it to AC coupled and turning the trigger level negative -0.2V really makes sense 

 

Anywhere that's "on the signal" makes perfect sense.

"Off the signal" makes sense too - you might be looking for rare signal glitches.

If your Tek can't do it then it's a problem with the Tek, not the Keysight.

[mikeselectricstuff]

Found a UART - boot text below.

Where did you find the UART?
I found a UART port on a via near the unused board-board header operating at 57600 but it seems to get gibberish out on boot. Unless I'm not decoding it right.

On the unpopulated board-board connector on the processor board - looks like the only one of the 2 SPEAR600 UARTS connected to anything.

[PA0PBZ]

Found a UART - boot text below.

Where did you find the UART?
I found a UART port on a via near the unused board-board header operating at 57600 but it seems to get gibberish out on boot. Unless I'm not decoding it right.

On the unpopulated board-board connector on the processor board - looks like the only one of the 2 SPEAR600 UARTS connected to anything.

There is at least one more port, because half way into the boot text:

SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)

1C200 = 115.200

[mikeselectricstuff]

Found a UART - boot text below.

Where did you find the UART?
I found a UART port on a via near the unused board-board header operating at 57600 but it seems to get gibberish out on boot. Unless I'm not decoding it right.

On the unpopulated board-board connector on the processor board - looks like the only one of the 2 SPEAR600 UARTS connected to anything.

There is at least one more port, because half way into the boot text:

SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)

1C200 = 115.200

As far as I could tell only one of the 2 UARTs (UART2) on the SPEAR600 is connected to anything. Didn't test comprehensively - just a continuity swipe over all the connector pins and anything that looked like a test pad.

[EEVblog]

My terminal dump:
(Should be the same as Mike's, I haven't compared)

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-16-10   7:86:38.44 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-16-10   7:86:38.44 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A80C40, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-16-10   7:86:38.47 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Sep 28 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 1 ms
   SNANDFLASH: 1 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
=========================================
BLT Product Config 24
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : FPR
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : No
BLT Module Config 02
   Rev         : LP3
   Sample Rate : 5GSa/s
=========================================
BLT_PRODUCT_CONFIG_0, 1.251v, ID4
BLT_PRODUCT_CONFIG_1, 0.692v, ID2
BLT_MODULE_CONFIG_0, 0.687v, ID2
BLT_MODULE_CONFIG_1, 0.005v, ID0
CANINE_BOARD_REV, 0.002v, ID0
CANINE_MODEL_NAME: MARSUPIAL, 1.738v, ID6, MARSUPIAL
CANINE_EXTMODULE, 2.488v, ID8, SWID8
CANINE_MSO_REV, 0.628v, ID2, SWID2
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Sep 28 2016, 00:17:51
Initializing FPGA...
************************************
FPGA Type: Marsupial
Ver: 1.067 Released
Build Time: Tue Jun 14 17:13:42 2016
Build Machine: 2UA5461ZWH
************************************
cMarsupialCalMgr::cMarsupialUserCalFactors::cMarsupialUserCalFactors size 146412
cMarsupialCalMgr::cMarsupialServiceCalFactors::cMarsupialServiceCalFactors size 704
cMarsupialCalMgr::cMarsupialFactoryCalFactors::cMarsupialFactoryCalFactors size 896
Calibration mode User
Recall \Secure\cal\FactoryCal2.dat - ok
Recall \Secure\cal\ServiceCal1.dat - ok
Recall \Secure\cal\UserCal8.dat - ok
Cal Date Sun Sep 25 15:11:58 2016
will do USB phy workaround: CheckCRC
Startup sequence is complete.
System has been running 16.841095 seconds
Start Up Sequence 7.470958
Memory Load 50%
   System Physical Memory 36.441 / 73.465 MB
   Process Virtual Memory 46.938 / 1024.000 MB
-----> InfiniiVision is running <-----
[00]


[EEVblog]

As far as I could tell only one of the 2 UARTs (UART2) on the SPEAR600 is connected to anything. Didn't test comprehensively - just a continuity swipe over all the connector pins and anything that looked like a test pad.

I can't find another port either.
If it's there and we have probed it then maybe it doesn't output anything at boot?

I might have identified one of the config resistors, no time right now to play though unfortunately.

[EEVblog]

I also have a prototype unit and here is the dump:
Some slight differences including resistor set voltages and modes.

Code: [Select]



U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-17-3   2:85:23.27 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-17-3   2:85:23.27 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOX
OOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOORewrite recommended, internal ECC corrected data at 0x166f
OOXOXOOOOOXXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXXOXOXOXOOXXOXXXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOOXXXXXOXXXXOOOXOXXOOX
XOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1AEEE00, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1AEEE00  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-17-3   2:85:23.42 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Aug 30 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1460: RewriteEbootBlocks from 0x166f to 0x166f
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
=========================================
BLT Product Config 25
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : PP
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : No
BLT Module Config 02
   Rev         : LP3
   Sample Rate : 5GSa/s
=========================================
BLT_PRODUCT_CONFIG_0, 1.515v, ID5
BLT_PRODUCT_CONFIG_1, 0.689v, ID2
BLT_MODULE_CONFIG_0, 0.694v, ID2
BLT_MODULE_CONFIG_1, 0.015v, ID0
CANINE_BOARD_REV, 0.002v, ID0
CANINE_MODEL_NAME: MARSUPIAL, 1.740v, ID6, MARSUPIAL
CANINE_EXTMODULE, 2.490v, ID8, SWID8
CANINE_MSO_REV, 0.648v, ID2, SWID2
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
QA build, Aug 30 2016, 06:12:04
Initializing FPGA...
************************************
FPGA Type: Marsupial
Ver: 1.067 Released
Build Time: Tue Jun 14 17:13:42 2016
Build Machine: 2UA5461ZWH
************************************
cMarsupialCalMgr::cMarsupialUserCalFactors::cMarsupialUserCalFactors size 146412
cMarsupialCalMgr::cMarsupialServiceCalFactors::cMarsupialServiceCalFactors size 704
cMarsupialCalMgr::cMarsupialFactoryCalFactors::cMarsupialFactoryCalFactors size 896
Calibration mode User

cCalMgr: ************************************************
cCalMgr: >>>>> Verifying ASCII cal factors. <<<<<
cCalMgr: User cal mode - ok
cCalMgr: Service cal mode - ok
cCalMgr: Factory cal mode - ok
cCalMgr: ************************************************

Recall \Secure\cal\FactoryCal2.dat - ok
Recall \Secure\cal\ServiceCal1.dat - ok
Recall \Secure\cal\UserCal8.dat - ok
Cal Date Wed Aug 31 12:54:45 2016
will do USB phy workaround: CheckCRC
Startup sequence is complete.

CEO: **************************************************
CEO: >>>>> Validating control system. <<<<<
CEO: Total groups = 38, Total groups validated = 38.
CEO: Total ctrls = 1464, Total ctrls validated = 1464.
CEO: OK, errors = 0, warnings = 0, info = 0
CEO: **************************************************

System has been running 19.383053 seconds
Start Up Sequence 10.295580
Memory Load 55%
   System Physical Memory 39.547 / 73.184 MB
   Process Virtual Memory 50.250 / 1024.000 MB
-----> InfiniiVision is running <-----
[00]


[mikeselectricstuff]

Might be interesting compare messages and ID values with a 2/3000X unit.

Here are the points on the 1000X module

[Fungus]

Microsoft Windows CE

 

[mikeselectricstuff]

Microsoft Windows CE

 

Nothing wrong with that - it gets the job done.

[mmagin]

My terminal dump:
(Should be the same as Mike's, I haven't compared)

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500


Wow, is there anything that doesn't have U-Boot in it?

[rrinker]

 The German Navy is everywhere!

[Keysight DanielBogdanoff]

The firmware is so buggy on these Keysight scopes that I avoid them for any troubleshooting work.
Sexy LCD and fast CPU but I had to laugh when I kept getting a blank trace and putting a Tektronix to the same probe point gave me a trace, just as I expected.
I especially love setting it to AC coupled and turning the trigger level negative -0.2V really makes sense 

What scope are you using? Overall I'd expect that it's more of a use-model thing than a buggy firmware thing...

[mikeselectricstuff]

The firmware is so buggy on these Keysight scopes that I avoid them for any troubleshooting work.

Weird. I was assured by several forum members that only Rigol 'scopes had bugs.

Sexy LCD and fast CPU but I had to laugh when I kept getting a blank trace and putting a Tektronix to the same probe point gave me a trace, just as I expected.
I especially love setting it to AC coupled and turning the trigger level negative -0.2V really makes sense 

 

Anywhere that's "on the signal" makes perfect sense.

"Off the signal" makes sense too - you might be looking for rare signal glitches.

If your Tek can't do it then it's a problem with the Tek, not the Keysight.

I've been using HP/Agilent/Keysight scopes daily for 25+years and have yet to see a bug of any significance.

[mikeselectricstuff]

Am I crazy in thinking did they send one to Mike for the purpose of hacking it? 

If that was the intention, they'd have sent the lowest end version

[SilverSolder]

The firmware is so buggy on these Keysight scopes that I avoid them for any troubleshooting work.
Sexy LCD and fast CPU but I had to laugh when I kept getting a blank trace and putting a Tektronix to the same probe point gave me a trace, just as I expected.
I especially love setting it to AC coupled and turning the trigger level negative -0.2V really makes sense 

What scope are you using? Overall I'd expect that it's more of a use-model thing than a buggy firmware thing...

Is it not possible for an AC signal to drop below zero volts?  You should be able to set the trigger at any level in the AC wave form - positive or negative - no?  That seems to be how my scope works.