Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[Emanuel]

Not working 
If I move the resistor it hangs at start-up and keeps running the labels illumination in a sequence.
I tried to upload the sys6000.jzp from the usb (.bin was also on the usb) using the emergency procedure...nada.
So I switched it back to the original jumper configuration and uploaded the software first.
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information:
PC-Board/Status A/D problem".

I uploaded the changed sys6000.jzp, switched the resistor and goes again in "hang" mode.

It seems the MSO6012A won't accept any jumper setting other than the original which is with R3 removed.
However, looking at photos at the thread's beginning, I see a different setting, maybe this is what is causing it to hang.

[Emanuel]

As mikeselectricstuff already discovered:

MODEL    X1 X0 ------------------- 6032       0    0 6102       0    1 6034       1    0 6104       1    1

X1 = Nº Channels.
X0 = BW.

As I had the same findings as mikeselectricstuff had while playing with this set of jumpers (MSO6012A hangs at startup);

Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware

I went back to the early pages and there is something missing, already noticed by abyrvalg

So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
Sad that 03->10 doesn't change BW, but maybe some other modifications like 01->03 will work, who knows. Need to compare the frontends otherwise.

This set of jumpers works on 603x and 610x, setting apparently the BW and CH no.
What about the 601x and 605x models? Maybe they have nothing to do with them and this is why the 6012 hangs?

I noticed another set of jumpers was found, also with no results.

If you can, please check this:

These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.

What about these other sets of jumpers? Any idea?

[Carrington]

Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information: PC-Board/Status A/D problem".

Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware

This set of jumpers works on 603x and 610x, setting apparently the BW and CH no.
What about the 601x and 605x models? Maybe they have nothing to do with them and this is why the 6012 hangs?

Seems as if the FPGA is the responsible of checking the ASICs/ADCs status. This fit with my previous theory, ie the FPGA also set the oscilloscope model in function of ASICs configuration. All this is only an assumption, perhaps the FPGA only set one flag, and the CPU checks the corresponding ASICs/ADCs.

Enable decoders for two-channel models, with firmware patches, may be a nightmare. The firmware was not designed for that purpose, however I still thinking that Agilent did not allow this feature intentionally.

These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.

ADG451/DG444 (analogue switches), are directly controlled by the 74ATC174, no need to change anything here.

What about this set of jumpers? Anyone tested them?

Dont bother, look where they are connected, also, no need to change anything here (IMG_1490.jpg and IMG_1488.jpg).
http://www.onsemi.com/pub_link/Collateral/MC100LVEL14-D.PDF

For (IMG_1493.jpg) I had not seen this resistor before, I will check now where they are connected, but I think you've found something important.

[Emanuel]

Yes, already checked, it is a clock distribution IC.
Take a look at the third photo I just added, there is another set of jumpers next to the digital inputs circuit.
One pull down resistor is not there on the 6012.

[Carrington]

Yes, already checked, it is a clock distribution IC.
Take a look at the third photo I just added, there is another set of jumpers next to the digital inputs circuit.
One pull down resistor is not there on the 6012.

Yes exactly, on my oscilloscope this pull-down (R3) is mounted.

[Carrington]

For (IMG_1493.jpg) I had not seen this resistor before, I will check now where they are connected, but I think you've found something important.

All are connected to the FPGA.
I have a trick to quickly find where they are connected, is a conductive foam.   
Will I have to discard my earlier theory?    Hopefully!
The circuit is as follows:



Note: Until tomorrow I can't do any tests.

[bg8up]

Two pictures

[Carrington]

@bg8up: Good pictures, thank you very much.   

More pictures:
R3 set MSO.
The last is mikeselectricstuff DSO6034A.

[Emanuel]

R3 set MSO.
The last is mikeselectricstuff DSO6034A.

I don't think R3 sets the MSO.
In my MSO6012 is is NOT installed, same in the photo of the DSO7104.
As it looks from the last photo in DSO6034 is also not installed
So far the MSO6104 is the only one with this jumper installed.

 

[Carrington]

R3 set MSO.
The last is mikeselectricstuff DSO6034A.

I don't think R3 sets the MSO.
In my MSO6012 is is NOT installed, same in the photo of the DSO7104.
As it looks from the last photo in DSO6034 is also not installed
So far the MSO6104 is the only one with this jumper installed.

 

Well, you may be right, it has been a fast deduction.

[bg8up]

R3 maybe  extension,

R2 maybe model family .

[bg8up]

Not working 

So I switched it back to the original jumper configuration and uploaded the software first.
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information:
PC-Board/Status A/D problem".

seem the picture?

[Emanuel]

yes, this is what I got when uploaded the hacked sys6000.jzp

[Carrington]

First results of the test (X1=1, X0=0):

Y3  Y2  Y1  Y0        Model            gpInstOptions ------------------------------------------------------------- 0    0    0    0         MSO6034A    000002a2 0    0    0    1         MSO6034A    000002b2 0    0    1    1         MSO6054A    000002b4 0    0    1    0         MSO6054A    000002a4 0    1    0    0         MSO7034A    00000aa2 0    1    0    1         MSO7034A    00000ab2 0    1    1    1         MSO7054A    00000ab4 0    1    1    0         MSO7054A    00000aa4 1    0    0    0         MSO5034A    000006a2 1    0    0    1         MSO5034A    000006b2 1    0    1    1         MSO5054A    000006b4 1    0    1    0         MSO5054A    000006a4 1    1    0    0         MSO6034A    00000ea2 1    1    0    1         MSO6034A    00000eb2 1    1    1    1         MSO6054A    00000eb4 1    1    1    0         MSO6054A    00000ea4

Plus other 16 other combinations with X0 = 1. And other 32 with X1=0.
But please, note that I will not test the 64 combinations. 

The previous firmware patch produces the same effect, ie no BW improvement. But I still have an ace under the sleeve. 

[Carrington]

Do you see any direct CPU-frontend traces there?

The front-end is controlled directly by the CPU (only 74ATC174s between both).

So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.

You were right. 

[abyrvalg]

Great!

I think there is no need to try all 64 combinations since reg bits looks grouped independently (combining BW bits shouldn't affect model family and vice versa). Just match these new bits with my reg fields table: https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg390572/#msg390572

I was wrong about "Rattler" device: I've looked at some wrong register access function which made me thinking that "Rattler" is some single chip attached to "Ponderosa" ASIC, but in fact "Rattlers" are accessed throught GPIO and latches as 12 bits long serial devices (one device per channel, each one has eight 9-bit wide regs, so 3 bits of 12 selects reg, rest 9 bits are data) - all this matches Carrington's info on 1NB7 chips control interface: https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg394190/#msg394190
So "Rattlers" must be 1NB7-xxxx frontend chips themselves, so we can inspect their regs with dumpRegValues command. But here rises another question: since we are cheating the CPU with a patch/straps, it should write correct values into 1NB7 regs, but this doesn't affect real BW. So there must be some other BW limiting factor: ether a different 1NB7 model (the worst case) or some straps right on 1NB7 pins or some different component values in frontend section. So we are back: we need to see real 6054/7054 board.

[bg8up]

PONDEROSA=MeagZoom III ASIC
      NEVADA=FPGA Display Core
        TALON=ADC @4Gas/S ?include 32 TalonSlices @125Ms/S

[abyrvalg]

bg8up, thanks, that confirms our guesses. Can you please check who are "Rattler" and "Scorpion"?

[Carrington]

32 slices @ 125Ms/s woow! 
That explains why the 1NB4-5057 is always cold as ice.
All are integrated on the same chip, so I hope that it keep the interleaved distortion within a reasonable margins.
http://www.ti.com/lit/wp/snaa111/snaa111.pdf

I attach some related images.

[tesla500]

Here's some papers on the Talon ADC, written by one of the designers:

http://poulton.net/papers.public/2002isscc_10_1_tal.pdf
http://poulton.net/papers.public/2002isscc_10_1_tal_slides.pdf

And lots of other interesting papers: http://poulton.net/papers.html

[Carrington]

@Tesla500: Excellent documentation, thank you very much. 

Carbon printed resistor and smd capacitors inside the hybrid!



I've got this faulty board (this is my ace), perfect for testing and I don't rule out a front-end schematic and a "transplant".

And other possibility to achieve 500 MHz is the TELEDYNE relay (A150-20-12), but only with 50 Ohm option. The problem is that each relay costs ~55 € ($76):
http://www.mouser.com/ds/2/404/a150-16358.pdf

[bg8up]

Wonderful paper!Thanks TESLA500  a lot! 

[Carrington]

Between 500MHz and 300MHz models, only change the values of three RC networks (two at the top and one at the bottom), the rest is identical for both. However, these RC networks are set according to the BW and to the 1NB7 (ie as a external compensation). Seems that hybrids are pre selected to be as similar as possible, generally they have consecutive serial/batch numbers.

The TELEDYNE relay is only used for 1GHz models, but all the 1NB7-8453s are pin to pin compatible with the 1NB7-8477s, and with the same functionality. Additionally is possible modify the input stage to allow the use the TELEDYNE relay with the 1NB7-8453 (only for 6000 and 7000 boards). On the other hand, is not logical do that, and is not cheap (>220€ four channels).

Well, I just wanted comment all this as a curiosity.

The next board is a DSO5054A, RC networks in red (only top), serial/batch numbers in green.

Cheers.

[euzer]

Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

[mikeselectricstuff]

Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Download packjzp and unjzp tools from here

Unpack to a binary using unjzp , and use a hex editor to make the following changes

sys6000.bin 06.16.0001:
002E7B80: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

sys7000A.bin 06.16.0001:
002E7C60: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

save the edited version, and repack to .jzp using packjzp.

Note pack/unpack are quite slow - about a minute

Update the scope firmware with the new version

Then enable each license by entering the 3-letter license name, with all zeros as the rest of the key

Note that decodes only work on models with 4 analogue channels - it will refuse to install on 2-ch models and consensus is the decodes use some hardware that isn't present on 2ch models

Enjoy!