Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[abyrvalg]

From sw side most (or all?) analog side parameters are controlled by a set of virtual "registers" that can be dumped with dumpRegValues console command. Physical implementations of those regs varies: DACs inside Ponderosas (gains, offsets,...), latches on CPU GPIOs (relays, some other signals - must be those 74ACT174s), some serial shift register on CPU GPIO, several regs in FPGA (calibration signal generator).

100MHz models have significantly different register set - more Ponderosa DACs, some small "Scorpion preamplifier" chip controlled by CPU GPIOs, while all higher models use some big "Rattler" chip replacing both "Scorpion" and many Ponderosa internal DACs.

Conclusion: FPGA has little control over analog side, so try faking F6000004 reg value directly:
20BE10: 83 C9 00 04 -> 3B C0 xx xx
where xxxx - lower 16 bytes of desired F6000004 value (see my previous post on that reg). Dump your original value, take lower 4 nibbles, edit lowest nibble to change BW option.

Another interesting thing: looks like entire serial decoding is done in FPGA, but based on our patch failures I guess FPGA disables all this functionality based on "center left" resistor that defines number of channels.

[Carrington]

@ tesla500:

Wow! Thank you so much for the pictures. 
Now we can definitely discard the 1GHz option.

I found a picture of the bottom, see attachments.


Now, we need to see inside of an 605*.

[Carrington]

From sw side most (or all?) analog side parameters are controlled by a set of virtual "registers" that can be dumped with dumpRegValues console command. Physical implementations of those regs varies: DACs inside Ponderosas (gains, offsets,...), latches on CPU GPIOs (relays, some other signals - must be those 74ACT174s), some serial shift register on CPU GPIO, several regs in FPGA (calibration signal generator).

I have to try that. It must be a long string of "0" and "1". 

100MHz models have significantly different register set - more Ponderosa DACs, some small "Scorpion preamplifier" chip controlled by CPU GPIOs, while all higher models use some big "Rattler" chip replacing both "Scorpion" and many Ponderosa internal DACs.

It's amazing how you handle the SW. 

Conclusion: FPGA has little control over analog side, so try faking F6000004 reg value directly:
20BE10: 83 C9 00 04 -> 3B C0 xx xx
where xxxx - lower 16 bytes of desired F6000004 value (see my previous post on that reg). Dump your original value, take lower 4 nibbles, edit lowest nibble to change BW option.

First I have to re-mount the oscilloscope, now is completely disassembled. PSU, display, fan, ...
But don't hesitate, I'll try that. 

Another interesting thing: looks like entire serial decoding is done in FPGA, but based on our patch failures I guess FPGA disables all this functionality based on "center left" resistor that defines number of channels.

Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.

[Carrington]

This would suggest that on both the 6054 and the 6104, it uses the whole ADC, and maybe both input amps for one channel instead of muxing it between 2 channels.

Yes, both models use the whole ADQ ASIC for one of the inputs.

I suspect that the omitted, bypassed, relay on the 6034 is to connect the two inputs together to feed into the two parallel channels. Would be pretty easy to check this.

I can't find the connection between stages. I think that this is done internally in the ADC, ie the two ADCs (within the ASIC) get sampled from only one of the inputs.

I think this means that you're probably more likely to be able to upgrade a 6054 to a 6104 than a 6034 to a 6054.

We need to see inside of an 605*.

However I expect the 6054 and 6104 differ mostly by the frontend - really  looking forward to seeing Tesla500's 6104 pics - make sure you look under those cans (assuming they haven;t soldered them for 1GHz!)

I hope that the 605* use the 1NB7-8453.

[abyrvalg]

Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.

I have an idea: set 2CH model to 4CH with resistor, but patch F6000004 read to report 2CH to sw, so FPGA will not disable decoders (if there was any real disable), but sw will not try to access nonexisting channels. If this config will work, then probably a more fine-grained patch (enable decoders, but keep 2CH mode) will work.

[Carrington]

Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.

I have an idea: set 2CH model to 4CH with resistor, but patch F6000004 read to report 2CH to sw, so FPGA will not disable decoders (if there was any real disable), but sw will not try to access nonexisting channels. If this config will work, then probably a more fine-grained patch (enable decoders, but keep 2CH mode) will work.

It's a great idea!
But I can't prove it, because is necessary a DSO/MSO6**2A.
I just have a MSO6034A, and mikeselectricstuff has put on sale his 6012A.

If anyone with an DSO/MSO6**2A wants to try, I can prepare the firmware.

[mikeselectricstuff]

I still think there must be some fundamental reason why decodes aren't enabled on 2ch - why would they lose out on the potential license sales, and why would they impose a restriction over what the existing licensing system implements?

[tesla500]

Perhaps the FPGA doesn't get the raw "digital" (analog channel after going through a comparator) signals fed to it? I wonder if the trigger is less advanced on the 2 channel models, or the external trigger channel takes up the comparator that would otherwise be used for the serial decode.

Do we have a board picture of a 2 channel 300MHz+ version? Mike's 6012A has only the ADC + one ASIC, the 4channel ones have 2 ADCs feeding 2 ASICs and another ASIC in between the two. Does the 6xx2A have the extra ASIC as well, or does it look like the 6012 with only 2?

[abyrvalg]

I think that extra ASIC in the middle is "Rattler" device I've mentioned already. From sw side it looks quite big (tens DACs controlling gain, offset, hysteresys, flatness of each channel), it's control interface is connected to master "Ponderosa" (twin ASICs closer to CPU, each serving 2 channels) and it is single, shared between all channels.
"Rattler" is present on all models with BW>100MHz regardless of channels.

[tesla500]

I think that extra ASIC in the middle is "Rattler" device I've mentioned already. From sw side it looks quite big (tens DACs controlling gain, offset, hysteresys, flatness of each channel), it's control interface is connected to master "Ponderosa" (twin ASICs closer to CPU, each serving 2 channels) and it is single, shared between all channels.
"Rattler" is present on all models with BW>100MHz regardless of channels.

Thanks for the insight! That makes sense, I didn't think that "Rattler" would have much to do with the primary acquisition functions, otherwise it would be a major architecture change between 100MHz and higher models.

Another tidbit, apparently the SEC option can be removed. At my previous job, we bought a 7000 series off demo that had SEC enabled. I really wanted it removed, and after fighting awhile with Agilent (initially they were going to give out a "kill" license that removes all licenses, but later said that wouldn't work for SEC), they agreed to remote in via network and remove it. Unfortunately we had some firewall problems that delayed it, and I left the company before we could do it. I was planning to do a packet capture when it happened to know what they did and maybe get a lead on hacking it. Would have been nice to have this hack 3+ years ago.

[Carrington]

There are many things that we don't know. I have no idea why Agilent not design the models with two channels to allow digital decoding.

I would love to know what's under the sink that is in between the two ASICs, ie "Rattler".
It should not be a big IC, because under the heatsink can be seen a lot of parts around, but I can't see the periphery of the ASIC.

Today I almost finished cleaning it, tomorrow will be completely assembled, it will look like new.

[abyrvalg]

tesla500, the magic command is writeFeatureRegister(0xFFFF) in C shell. Confirmed by another forum user who had activated SEC for curiosity. That "feature register" is just a location in flash.

Rattler looks like a big patch for the original architecture (single chip replaces so many functions originally belonging to both Ponderosas). I suspect something went wrong with Podnerosa at higher frequencies, but it was too late (ASIC in production), so they had fixed it this way.

[Carrington]

I modified the firmware, as you indicated, it produces the same effect as my previous patch, but is more elegant.

Also without changing any parameters between firmwares, dumpRegValues returns this:

1. Original firmware (MSO6034A):

Code: [Select]

latcha                 0x30          0x70          0x70          0x30
latchb                 0x7c          0x78          0x78          0x7c
rattler0              0x168          0x80          0x80         0x168
rattler1               0xc0         0x100         0x100          0xe0
rattler2               0xf8          0xc8          0xc8          0xf8             <-
rattler3              0x104          0xc8          0xba          0xfc
rattler4               0xbe          0x92          0x94          0xaa
rattler5               0000          0000          0000          0000
rattler6              0x179          0x11          0x39         0x1cf
rattler7              0x1c0         0x11d         0x125         0x1c0
offset             0x01feef      0x01ff5e      0x0204d9      0x01fee4
level ext            0x7fe0
pod thresh           0x5f10        0x6dc0
ti ramp adj          0xb813             <-
hamster0                 00
hamster1                0x4
hamster2               0xf3
hamster3                 00
hamster iramp         0x800
probe                0x8000        0x8000        0x8000        0x8000
value = 10 = 0xa
2. Patched firmware (MSO6054A):

Code: [Select]

latcha                 0x30          0x70          0x70          0x30
latchb                 0x7c          0x78          0x78          0x7c
rattler0              0x168          0x80          0x80         0x168
rattler1               0xc0         0x100         0x100          0xe0
rattler2              0x140         0x148         0x148         0x140             <-
rattler3              0x104          0xc8          0xba          0xfc
rattler4               0xbe          0x92          0x94          0xaa
rattler5               0000          0000          0000          0000
rattler6              0x179          0x11          0x39         0x1cf
rattler7              0x1c0         0x11d         0x125         0x1c0
offset             0x01feef      0x01ff5e      0x0204d9      0x01fee4
level ext            0x7fe0
pod thresh           0x5f10        0x6dc0
ti ramp adj          0xb7c4             <-
hamster0                 00
hamster1                0x4
hamster2               0xf3
hamster3                 00
hamster iramp         0x800
probe                0x8000        0x8000        0x8000        0x8000
value = 10 = 0xa
After doing several tests, I discovered that the oscilloscope used a serial protocol to communicate with the 1NB7-8453.
To open captures, download this software: http://tools.asix.net/download/analyzers/sigma-omega_2013-09-19_en.exe



?        The last string recivier, is returned on falling edges (1NB7-8453 output) .
Q1[0] New data to the 1NB7-8453, it get on rising edges (1NB7-8453 input).
Q0[0] CLK to the 1NB7-8453 (1NB7-8453 input).
Q2[0] As indicator (1NB7-8453 input).

Example Q1[0]:
   BW Limit CH4 ---------------
   0101 1001 1101
   0010 1001 0000
   0111 0011 0000
   ---------------------------------

   Full BW CH4 -----------------
   0100 0001 1101
   0010 0110 0000
   0111 1001 0000
   ---------------------------------

What the hell we must send to set a BW of 500MHz? 

Full captures:
   Star Up: Star_Up_CH4_.zip (see attached files).
   BW Limit to Full BW: LMT-BW_to_Full-BW_CH4_.zip (see attached files).


Q0[0] = (see pictures).
Q1[0] = (see pictures).
Q2[0] = (see pictures).
Q3[0] = U308 (CH2).
Q4[0] = U308 (CH2).
Q5[0] = Unknown.

Q0[1] = Relay.
Q1[1] = AC/DC.
Q2[1] = Unknown.
Q3[1] = Relay.
Q4[1] = TRT Q400 (CH3).
Q5[1] = Unknown.

Note: [1] registry is related to latcha.


Edit1: I have corrected some errors, sorry.
Edit2: I added a partial protocol description, it may be wrong  (no documentation).

[abyrvalg]

"rattler2" regs are "Gain Vernier" DACs.

I think there is no point trying to send something on CPU-1NB7 link: the CPU is already cheated with our patch, so it must send correct values w/o any further intervention (unless there is some other limit setting). The problem must be in some other place: either in FPGA or some hardwired 1NB7 pins.

Is there some BW limit setting in scope's UI ? I mean some normal parameter like gain/offset to filter out undesired frequencies (I see some UI-related functions with names like setChanBwLimit). Perhaps something in UI needs to be adjusted after BW patch?

Another quiestion is probes - are they suitable for that higher frequency? Are they just simple cable/connector/matching? I see names mentioning "ProbeId" - no way to detect that probe is wrong and limit BW here?

Bad news about DeBIT: it's support for Spartan3 is very basic, I see no IOs in it's output at all

[Carrington]

"rattler2" regs are "Gain Vernier" DACs.

Well, it's the only thing that changes in these records. 
Which of them corresponds to the BW?

I think there is no point trying to send something on CPU-1NB7 link: the CPU is already cheated with our patch, so it must send correct values w/o any further intervention (unless there is some other limit setting). The problem must be in some other place: either in FPGA or some hardwired 1NB7 pins.

Sure! But the above test also shows that the original firmware (MSO6034A) does not send the same command to set full BW, but the only change is one bit.
   
   Full BW CH4 -----------------
   0100 0001 1001
   0010 0110 0000
   0111 1001 0000
   ---------------------------------

Is there some BW limit setting in scope's UI ? I mean some normal parameter like gain/offset to filter out undesired frequencies (I see some UI-related functions with names like setChanBwLimit).

Yes, to my knowledge the only is BW limit, that sets a maximum frequency of 25MHz.

Perhaps something in UI needs to be adjusted after BW patch?

I don't know.

Another quiestion is probes - are they suitable for that higher frequency? Are they just simple cable/connector/matching?

The default probes are of 500MHz . And has a x10 identifier pin, but nothing more.

I see names mentioning "ProbeId" - no way to detect that probe is wrong and limit BW here?

Yes, some probes do this, but I don't have any of those.
I don't have a signal generator that reached up to 500 MHz, so I rely only on the impulse response (tr).

Bad news about DeBIT: it's support for Spartan3 is very basic, I see no IOs in it's output at all

A shame.

[Carrington]

I think so, ie, is required another firmware patch to set the BW in the 1NB7-8453.


Everything that starts with 0111 is offset.

[Carrington]

As we know the last BW patch is as follows (6000 series): At 0x0020BE10: 83 C9 00 04 -> 3B C0 02 A*
Where * corresponds with bits 3 to 0 of 0xF6000004 (FPGA): 0x1 -> 100MHz, 0x2 -> 300MHz, 0x4 -> 500MHz and 0x8 -> 1GHz.
Now the content of gpInstOptions[A8]=0x00966E60 acquires its value based on bits 3 to 0 of 0xF6000004, and it can be:
0x03 -> 300MHz, 0x04 -> 500MHz and 0x05 -> 1GHz (among other).

So, if now in cmd mode, with the command "mem modify -w 1 0x00966E60" we change the value pointed by gpInstOptions[A8]
by one of the above, ie (0x03,0x07,0x04,0x08 or 0x05) and after that, in C mode we execute "initFamilyMemberDiff", then ta-daah!
We have changed many front end parameters (BW limit, rise time limit, etc). However, not all the hardware is compatible between different models, so you may get unwanted results.
But the important thing is, it does not check anything, it just try to apply changes.

So, the patch does what it should do, so extra BW patches are not needed. Now, why a significant increase in BW is not appreciated going from 6034A to 6054A? No idea, may be is necessary do a calibration after the patch. Or the HW does not support this BW, no idea.

[Emanuel]

It's a great idea!
But I can't prove it, because is necessary a DSO/MSO6**2A.
I just have a MSO6034A, and mikeselectricstuff has put on sale his 6012A.

If anyone with an DSO/MSO6**2A wants to try, I can prepare the firmware.

Hello everyone, I am following the nice achievements in this forum for a while, but paractically this is my first post.
As I purchased the MSO6012A from mikeselectricstuff if there is anything I can help with, for example the quoted test I'll be glad to help.

[Carrington]

Hello everyone, I am following the nice achievements in this forum for a while, but paractically this is my first post.
As I purchased the MSO6012A from mikeselectricstuff if there is anything I can help with, for example the quoted test I'll be glad to help.

Hi, welcome to the EEvblog forum.

If you want to try is so simple:

1. Download this tool: https://bitbucket.org/flowswitch/agltzip/downloads/jzp_0.2.zip (courtesy of abyrvalg).
2. Extract the binary file from sys6000.jzp.
3. In the binary file at 0x0020BE10 reemplace this 83 C9 00 04 by 3B C0 02 61 (using a hex editor).
4. Compress the new sys6000.bin to sys6000.jzp.
5. Install the patched firmware.
6. Set 2CH model to 4CH with resistor, X1 = '1' (remove R2).

Please note that there is no guarantee that this will work.

Edit: I added a link to the correct tool.

[Emanuel]

Well, unless there is a serious hardware change between the 2 and 4 ch. versions I believe that eventually it will work.
So far, during the last week I managed to apply the FLIR E4 and Rigol DSA815 mods, you guys do a great job, I highly appreciate your enthusiasm and skills.

The MSO is supposed to be in my hands hopefully before the weekend (it was shipped today) and I will make the test.

[bg8up]

The hybird module 200M_VB1985;500M_1NB7-8453,new is 2AD2-0001;1G_8477;2G_8511should include BW limiter

174 drive the Relays?DG444

ASIC U2900?3000 is MEGA ZOOM 1821-1465?include ACQMEM?DAC(offset,balance,gain,triglvl;based PWM)?logic channel Acq(U2900 only)

[Carrington]

Hi guys.

Around the ASIC (U2900 and U3000) there are a lot of 0 ohm resistors (603 smd case) probably used as jumpers, because these resistors connects some ASIC's pins to VDD (2.5V) or GND. Perhaps these resistors set the ASIC configuration (slave/master) and other features. And why not, these resistors and the FPGA may define the oscilloscope model.

That's why I want to see pictures of one DSO/MSO6054A mainboard or an DSO/MSO7054A, with enough resolution/detail to compare with a MSO6034A mainboard. But I can't find any, and I have searched and searched for several days. I found only what is shown in attached files (source agilent website).

So please, can anyone with one of these oscilloscopes (DSO/MSO6054A or DSO/MSO7054A) take some photographs (both sides if possible)?

Thanks in advance.

[alex.forencich]

I have an MSO7104A that I successfully applied the telnet service menu hack to.  Would pictures of its mainboard be of any use?

[Carrington]

I have an MSO7104A that I successfully applied the telnet service menu hack to.  Would pictures of its mainboard be of any use?

Thank you so much, they may be worth, to check differences between 7104 and 6104 (tesla500).
So if you can take pictures, go ahead. But I still needing images from a MSO6054A.
Thank you again.

[Emanuel]

If you want to try is so simple:

1. Download this tool: https://bitbucket.org/flowswitch/agltzip/get/84418d8ae30f.zip  (courtesy of abyrvalg).
2. Extract the binary file from sys6000.jzp.
3. In the binary file at 0x0020BE10 reemplace this 83 C9 00 04 by 3B C0 02 61 (using a hex editor).
4. Compress the new sys6000.bin to sys6000.jzp.
5. Install the patched firmware.
6. Set 2CH model to 4CH with resistor, X1 = '1' (remove R2).

Please note that there is no guarantee that this will work.

Got the MSO6012A today, played with it a little and already downloaded the sys6000.jzp.
Tomorrow I will make the jumper setting and see what happens