I've done quite a bit of work reverse engineering the firmware on my MSO6034A scope, so I might be able to fill in some blanks.
It definitely does check the model number against a list in the firmware (see attached image).
For older probes, it seems to have an ID number instead of the model string.
I went through the code that does the probe calibration and it seems to get the default offset & gain values from floats at 0x53 and 0x57 in the EEPROM for the newer named probes. Older probes may have them at 0x40 & 0x44 instead. I haven't tested changing them, but I think you're better setup to try it out
Hi Miek,
agrees with my observation that a "database" (you just proved its dumb hardcompiled code) of probe types is kept in the scope.
I also agree that there ARE probes that write back calibration information. An example is my (very complex) N7026 high-sensivity current probe. When you insert this one, I sniffed that not just probe ID and serial number are retrieved, but also a lot of other information at several locations. An I2C scan also reveals several EEPROM locations, not just 0x51. When you calibrate, quite some info is written back to the probe EEPROM.
Older (and simpler) probes like the N2795A or N2796A dont read anything else than serial number and probe type. This was verified by sniffing the bus during a calibration operation.
The expected outcome of my modest probe attempts is to supply a calibratable and detectable interface to probes that Keysight does not supply. At the moment, I have three types:
1) wide voltage range 1:10 FET probes with minimal capacitance (10-200Mz). This works now with AutoProbe, I'll write a webpage in a few
weeks about this
2) 1.-1.5GHz AC Fet probes. Works, but for the moment without Autoprobe. Could also be run under N2795A.
3) current transformer probes to measure small AC currents in the frequency range from 2MHz to 200MHz (I needed those for my PhD work).
Candidate for current probe missing.
Something I would also like to have is a differential probe with wide input range. That should not be too difficult, but I lack a similar Keysight model to
start from.
For type 3 I am currently searching for a close enough Keysight probe that can be used to make the hack possible.
As said, Keysight does not want to disclose the interface (I guess to avoid competition for their probes), so some creativity will be needed.
Everybody having similar issues and/or other Keysight probes of interest (I just have N2795A and N7026A). is invited to join efforts by suppling EEPROM images.
Regards
Wolfgang DL1DWG