Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[Howardlong]

I strongly suspect there are some AFE similarities between the DSOX3000A series and the DSO6000/7000A/B series from your pictures.

Below are some 3000A links with pics about upgrading a 100/200MHz AFE to 350/500MHz, plus some 3000A 1GHz AFE pics. I can't remember if anyone managed a 1GHz upgrade: the 3000A 1GHz model has a different board layout plus an additional expensive looking Teledyne canned relay.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983061/#msg983061
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983501/#msg983501
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg985356/#msg985356
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg993078/#msg993078

The 7104B is always the one that I turn to first! The front panel is a little better than the 7104A as it has a couple of extra knobs and buttons, and I believe that more knobs have push functions on the B. The GUI is as fast as it gets on a DSO.

[Howardlong]

I'm not so sure it's good news, as well as the Teledyne relay, there looks to be a "special" ASIC on the 7104B.

This is split into three posts due to the upload limit.

The original hi-res image links are here:

7104B Pic 1
7104B Pic 2
7104B Pic 3
7104B Pic 4
7104B Pic 5
7104B Pic 6
7104B Pic 7

One note when re-assembling: mine has apparently had its fan cable trapped since manufacture as it's squished. When I re-assembled it, I tried to do it without trapping the cable, but in so doing, I forgot about paying attention to the on/off switch, so I managed to break the plastic mechanical switch extension thingy going to the front panel. It broke off at switch end. I managed to superglue it back together with a shim splint reinforcement made out of a bit of PCB, and it seems to have worked.

[Howardlong]

Some more (sorry of some are a bit glary, I didn't realise until afterwards)...

[Howardlong]

Last one.

Also some links to higher res versions below.



7104B Pic 1
7104B Pic 2
7104B Pic 3
7104B Pic 4
7104B Pic 5
7104B Pic 6
7104B Pic 7

[TiN]

It broke off at switch end.

Sorry about that. 

Thank you for photos. Your unit was build beginning of 2005, so it is older and have ceramic hybrid front end chip, instead of newer plastic 2DA2-0001 one. Plastic chip still can do faster BW, it's used in real 1.5G scopes too.
It's start for me to start on schematics for front-end.

[Orange]

TiN,

You might want to have a look on the mods I did to make it a 500MHz model.

https://www.eevblog.com/forum/testgear/agilent-dso7014a-upgrade-to-mso7054a/

[TiN]

Yes, I already did that, but my ultimate goal would be 1 jiggagurz .
Thanks for sharing BTW.

[Orange]

Let see if this is possible, BTW your fotos are very much appreciated, such high detail, and ultra sharp !

ps. which strap config did you use to get an 1GHz model ?

[DC1MC]

Hello everybody, I've got a MSO6054A with the 8M licence already there, is it anything that can be "improved" on it, like activating some extra options, service menus, software updates that are worth doing ?

Also, how is the firmware stored, little HDD, compact flash or what, is it anything that needs backup ?

Any known weak point, capacitors, power supply and similar ?

How does the user calibration goes and is it a document somewhere describing it in detail ?

And finall, the unicorn, any service documents, schematic ?


 Thanks for any information and cheers,
 DC1MC

EDIT:
Calibration and Service Manual found here:
http://engineering.case.edu/lab/circuitslab/sites/engineering.case.edu.lab.circuitslab/files/docs/Agilent_6000_Series_Oscilloscope_Service_Guide.pdf

[mikeselectricstuff]

Hello everybody, I've got a MSO6054A with the 8M licence already there, is it anything that can be "improved" on it, like activating some extra options, service menus, software updates that are worth doing ?

Yes, decodes, segmented memory. All info is in this thread.

Also, how is the firmware stored, little HDD, compact flash or what, is it anything that needs backup ?

onboard flash

Any known weak point, capacitors, power supply and similar ?

Not as far as I've seen
How does the user calibration goes and is it a document somewhere describing it in detail ?
[/quote]
RTFM

[DC1MC]

The RTFM has been found and read  , the "user calibration kit" has been ordered form  -bay for around 9EUR, the scope has the original calibration from 2005 !!! along with software versions 1.xx  , I think that an update is badly needed.
I didn't even know there were extra options for this MSO model, besides the 8M points, in the license list there are no decoders license, but there is a huge list of them (UART, I2C, CAN and so on...) in the scope menu, hopefully I'll be able to add even more.

Any chance to activate the battery option in the upper compartment or is painful ?

Thanks Mike for the tip, hopefully I'll find the post in the thread jungle 

 Cheers,
 DC1MC

[mikeselectricstuff]

The RTFM has been found and read  , the "user calibration kit" has been ordered form  -bay for around 9EUR, the scope has the original calibration from 2005 !!! along with software versions 1.xx  , I think that an update is badly needed.
I didn't even know there were extra options for this MSO model, besides the 8M points, in the license list there are no decoders license, but there is a huge list of them (UART, I2C, CAN and so on...) in the scope menu, hopefully I'll be able to add even more.

Any chance to activate the battery option in the upper compartment or is painful ?

Thanks Mike for the tip, hopefully I'll find the post in the thread jungle 

 Cheers,
 DC1MC

Don't think anyone has investigated the BAT option but this needs additional hardware so probably not much point. Battery was  not a retrofittable option - only an ordering option on new scopes.

[DC1MC]

Kindly please disregard the original content of this post, there was some kind of imbecile default setting of bless (Linux hex editor), insert mode instead of overwrite  , as well as a PEBAK, because I  didn't verify the file size  . How did the thing booted, it's a small wonder to me  .
Everything works absolutely perfect, one more time thanks to all the people involved  .

Now I have a couple of more questions:
- are there any application notes from Agilent describing in detail the usage of each option, especially the FPGA (do they need a separate adapter or are they working with the supplied pod).

- Is  there a chance to move the 500MHz variant to "jigaaaheertz", even with some soldering needed, like 300 -> 500 ?

 Thanks,
 DC1MC


I wanted to try the cool hack described here, but with the latest fw from the Keysight site it doesn't work, the header is:
... snip ...
[

[dogbert]

What's the 3-letter name for the 8Mpts memory? MEM-8M and 8ML doesn't seem to work. Thanks!

[Haasje93]

Hi there,

The codes are 008 of AMM

Regards,
Christiaan

[syau]

Anybody doing similar hack for MSO9000 series 

[jxjbsd]

about 2ch OSC (my DSO6052A ) hacked 
sys6000.bin    REV: 06.20.0000
002e8138: change to ->  81 61 20 20 80 0b 20 04 7c 08 03 a6 83 eb ff fc 7d 61 5b 78 38 60 20 20 4e 80 20 20 

good luck !

[HighVoltage]

about 2ch OSC (my DSO6052A ) hacked 
sys6000.bin    REV: 06.20.0000
002e8138: change to ->  81 61 20 20 80 0b 20 04 7c 08 03 a6 83 eb ff fc 7d 61 5b 78 38 60 20 20 4e 80 20 20 

good luck !

Nice, thanks for sharing and welcome to the forum.

[analogRF]

This is somewhat off topic but I got a very clean DSO6054A which does not boot. The front panel LEDs blink in order and finally the Single button lights up for a few seconds and then all off, no display (backlight is OK).
I tried the USB recovery as per keysight website and I can see the LED on my USB stick blinks for a while (when Single button is ON) and then
it goes off and nothing...tried multiple times and tried to play with that 4 seconds timing...should the USB stick be formatted in a special way?

I also tried LAN connection and again although the orange LAN LED in the back blinks (and the green one is ON) but it does not show up on my network so I cannot telnet to it...

Does anybody know a serial console on this scope so that I can access to the boot prompt that way and see what is going on?

[KE5FX]

This is somewhat off topic but I got a very clean DSO6054A which does not boot. The front panel LEDs blink in order and finally the Single button lights up for a few seconds and then all off, no display (backlight is OK).
I tried the USB recovery as per keysight website and I can see the LED on my USB stick blinks for a while (when Single button is ON) and then
it goes off and nothing...tried multiple times and tried to play with that 4 seconds timing...should the USB stick be formatted in a special way?

I also tried LAN connection and again although the orange LAN LED in the back blinks (and the green one is ON) but it does not show up on my network so I cannot telnet to it...

Does anybody know a serial console on this scope so that I can access to the boot prompt that way and see what is going on?

The 6000-series scopes (including mine) had a widespread problem similar to this that was generally solved with a motherboard swap at Agilent.  The service bulletin is probably still floating around on the 'net. 

I don't believe I ever found out exactly what was wrong, possibly a soldering defect that showed up after multiple heat cycles.  Hopefully yours is just a power supply issue or something similarly obvious.

[analogRF]

It's not power supply issue, I have checked all the regulators on the main board and every one of them is ok
I found that Agilent service note that you mentioned. Well , it applies to DSO6034A and for low serial numbers <MY44001000.
Mine has a MY5007xxxx serial number. So apparently that service bulletin does not apply to it.

It seems the firmware (or just the bootloader) is running to some point but then stops. I need to find a serial console on the board
that I can attach to and see if there is any error or clue. It reads the USB stick but then does nothing. Maybe it tries to load into memory (SRAM) and fails. Bad SRAM maybe? The LAN LED blinks when I connect it to router but no IP

Does the rescue USB need to have a special format? FAT16 or FAT32 etc?

Is anyone aware of a serial console port on the board?

[analogRF]

please read my posts about the above fault in here
https://www.eevblog.com/forum/repair/agilent-dso6054a-boot-problem/

[Venturi962]

Not sure how many folks are using these scopes nowadays, but wanted to share a few notes on the serial decodes:

Max UART / RS232 Decode is 5 Mbps, can decode two streams but only one baud rate at a time.

Signal:


Decode:

[Teichhermelin]

Is there a key for the service menu on a DSO5054A? Or is it just the hex code?

[wp_wp]

The link of tools is not available now,can someone give a new link?Thank you.