Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[bc17101]

Is there a patch location for the latest Agilent DSO6104 (.20)  code to enable all the features ? If not, is there a download location for the .16 code used in many of the above examples.

Thanks,

Bill

[HighVoltage]

Is there a patch location for the latest Agilent DSO6104 (.20)  code to enable all the features ? If not, is there a download location for the .16 code used in many of the above examples.

Thanks,

Bill

Just enable the  "service menu" and all options will be available.
It is the easiest way to activate the options.

[bc17101]

Could you please point me to the correct steps to enable the service menu?

[HighVoltage]

Could you please point me to the correct steps to enable the service menu?

Service menu on MSO7000

telnet <ip> 5810
username: panther
password: pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

“cmd”
then press enter.  At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter. 
Then type “0x01” and press enter again. 
Then type “.” and press enter again.


 Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'

reboot scope

Done


====================
Only for 6000 series type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".

[bc17101]

I tried both addresses (for the 7000 and 6000) and neither one gives me the service menu in my DSO6104.
I'm assuming that the magic location will vary with the software version. I am using the latest V6.20 (not the V6.16 that seems to be prevalent in this thread.
Does anyone have either the magic address for the 6000 scope with V6.20 software or a location that I can download the 4 necessary files for V6.16?

Thanks in advance,

Bill

[Howardlong]

Could you please point me to the correct steps to enable the service menu?

Service menu on MSO7000

telnet <ip> 5810
username: panther
password: pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

“cmd”
then press enter.  At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter. 
Then type “0x01” and press enter again. 
Then type “.” and press enter again.


 Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'

reboot scope

Done


====================
Only for 6000 series type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".

Is this dependent of a certain firmware version, or is it universal?

[HighVoltage]

This information was found and collected from post's in this thread in regards to the 6000 and 7000 series.
Personally I have only tried it on the 7000 series.
I got it to work on a couple of 7000B series scopes without any problems.

May be the 6000 series has the telnet access on a different port?
May be you can make quick scan?

I am not sure if it is depending on FW.


 

[Howardlong]

The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

[HighVoltage]

The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

I will have a look tomorrow on my 7000B series, as to what FW is installed.
So, you always boot yours from a USB stick?
You never tried to access with telnet on FW v 6.17?
 

[Howardlong]

The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

I will have a look tomorrow on my 7000B series, as to what FW is installed.
So, you always boot yours from a USB stick?
You never tried to access with telnet on FW v 6.17?

I don't remember ever doing so. I did have a look at the .bin images and determined that the "other" way was in different locations, I don't know if that is the case for setting the service menu on, but my concern was more about the risk in bricking the scope if it was in a different place, and the possible damage caused by poking an unknown location.

So to minimise risk I booted off a USB stick with 6.16, enabled the service menu with the location given, and then rebooted back to 6.17 that was on the scope already. I've since updated to 6.20, and unlike 6.16, 6.17 wasn't ever available on the Keysight web site as far as I could see, so I don't have 6.17 available to try any more.

[Carrington]

I tried both addresses (for the 7000 and 6000) and neither one gives me the service menu in my DSO6104.
I'm assuming that the magic location will vary with the software version. I am using the latest V6.20 (not the V6.16 that seems to be prevalent in this thread.
Does anyone have either the magic address for the 6000 scope with V6.20 software or a location that I can download the 4 necessary files for V6.16?

Thanks in advance,

Bill

Hi Bill,

Try this:

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.

[RFasic]

Hi to all DSO6000  family owners,

I have made a real good bargain just before xmas on a MSO6034A.... 800€ with all probes !
This reliable machine is now fully modified by using the Mike's method (a nice and easy way to avoid the SEC option without forgetting the other ones).

I have a question for "Carrington" who dare to try to modify his 6034A to reach the 6054A level performances ... :
You successfully added the 4Gs/s rate to your 6034A; your modified address location was 0x00231420 for the 4 modified octets, but for what firmware version ?
I am currently using the 6.20 version, do you know which adress i should use for this version (unfortunately,  the string 38 09 FF FD is present at many different places ?)

Did you succeded into the modification of the front end passive components (filtering adjustments before and after the 1NB7-8453 hybrid) ?

Thanks again to Mike, Carrington and Abyrvalg for this very informative post. 

[Carrington]

I have made a real good bargain just before xmas on a MSO6034A.... 800€ with all probes !

Woow! Yes, for that price is really a bargain.

You successfully added the 4Gs/s rate to your 6034A; your modified address location was 0x00231420 for the 4 modified octets, but for what firmware version ?

It was the previous version to 6.20, the 6.16, I think.

I am currently using the 6.20 version, do you know which adress i should use for this version (unfortunately,  the string 38 09 FF FD is present at many different places ?)

Go to 0x00231998 and replace 38 09 FF FD by 38 00 00 01.

Did you succeded into the modification of the front end passive components (filtering adjustments before and after the 1NB7-8453 hybrid) ?

No, because as we have said many times here we need to know the proper value of the RC network see inside the front end  on the 500MHz versions, and unfortunately no one has contributed.

[Carrington]

Please, take a look to the next picture, is from an DSO5054A:


Now look at this other:


I wonder if removing that capacitor is enough to increase the BW to 500MHz. 

[Keysight DanielBogdanoff]

I wonder if removing that capacitor is enough to increase the BW to 500MHz. 

No, it's not that simple. 

[Carrington]

Is this dependent of a certain firmware version, or is it universal?

The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

Effectively it varies with the firmware version.
Excuse me for taking so long time to reply, I checked today.

I don't remember ever doing so. I did have a look at the .bin images and determined that the "other" way was in different locations, I don't know if that is the case for setting the service menu on, but my concern was more about the risk in bricking the scope if it was in a different place, and the possible damage caused by poking an unknown location.

The "showServiceMode" function is still present in version 6.20, so the easy way is:

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.

[Carrington]

I wonder if removing that capacitor is enough to increase the BW to 500MHz. 

No, it's not that simple. 

Opps Keysight cauhgt us! LOL...

Hi, Daniel, just kidding, sorry.
Thanks for the clarification, but obviously you can't help us with that, right?

[Gandalf_Sr]

Just picked up a MSO7104B but need to get some probes before anything else.  There's a list of probes in the generic datasheet but there seems to be more probes available than is listed on the datasheet.  Questions:

1. Can ordinary non-Agilent probes be used for low frequency (100 MHz) stuff?
2. For faster stuff (350 MHz) what is the best probe to look for? I'm thinking a couple of passive 500 MHz probes and maybe look out for an active single-ended 800 MHz or 1 GHz probe or two - any suggestions?
3. For the MSO probe, the datasheet lists 01650-61607 and 54620-68701, are these the only 2 that will work with the MSO7104B?

Thanks,

[nctnico]

For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.

[Gandalf_Sr]

For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.

Thanks but am I limited to the ones that Agilent (Keysight) lists?  There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon. I realize these are passive but they're supposed to be good for 500 MHz?  Active probes are $600 - $1,500 each.  I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.

[mikeselectricstuff]

Any passive probe is fine in terms of actually working, the x10 pin ID is standard across all probes and scopes.
 

[nctnico]

For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.

Thanks but am I limited to the ones that Agilent (Keysight) lists?  There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon. I realize these are passive but they're supposed to be good for 500 MHz?  Active probes are $600 - $1,500 each.  I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.

These aren't Lo-Z passive probes but regular 1:10 probes so don't waste your money on those! Look for probes from a firm called Testec; I think Farnell/Element14 carries these. The probes from Testec are cheap and very suitable for general purpose (<100MHz) probing.

I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.

Here is some more info on high frequency probing:
http://paulorenato.com/joomla/index.php?option=com_content&view=article&id=93:praise-for-the-lo-z-probe&catid=4:projects&Itemid=4

[Howardlong]

Here are my experiences with probes on the 7000.

The 10073c/d 500MHz passive probes turn up fairly regularly on eBay, the only difference as far as I can tell is that the D versions are ROHS.

I bought four 10073C for just under £150 total for all four in the past few months including all accessories like spring grounds, coloured ident rings and ground croc leads.

The 1165A have slightly lower capacitance loading and are spec'd to 600MHz. I've bought several of these over the past eighteen months, ranging from £25 (£50/2) to about £50 each on eBay, all with cases and ground and ident clips etc. They are much nicer probes ergonomically than the 10073x, much lighter weight, and have thinner lighter coax with a longer reach too.

For day to day use, I find the light weight and slightly smaller form factor of the 1165A much better than the 10073x.

All well and good, but the capacitive loading and frequency response of the "high impedance" passive probes often renders them useless in high speed digital.

You can also find lo-z 1.5GHz probes like N2874 (10:1) and N2876 (100:1) which will correctly auto ident with the 7000B. I bought two each at £50 each recently on eBay, together with accessories like spring and low inductance copper grounds as well as the usual flying lead croc clips.

For FET probes recently I bought a 1130A 1.5GHz probe with appropriate accessories including a single ended browser with tips for £50 on eBay but that is exceptional. A 3.5GHz 1131A with differential browser was £185 from the same seller (a TE sales and rental house) which I consider a bargain too.

Be careful of unsupported probes: the Infiniimax "standard" has caveats, so probes like the fairly widely available 1152A 2.5GHz single ended probe don't work with the 7000B, the probe interface is physically identical but it doesn't support the probe's voltage/power requirements.

[Howardlong]

Regarding the digital LA probe, these turn up regularly on eBay for about $200 or so. Worth every penny, but make sure that they come with all flying leads. The spring clips on the other hand can be purchased anywhere, and I hardly ever use them, preferring soldered in machined pin probe points instead.

Those probe pods are not just a bit a bit of reassuringly expensive ribbon cable, by the way! Well, not if you probe anything more than an S-100 bus anyway.

[Gandalf_Sr]

Howard, nctnico, thanks for the detailed probe info, exactly what I needed.  I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended except they are only 500 MHz - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each.  The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'.  I guess if they don't work, I can return them as technically they are not the advertised item.

I'm still working on the LA probe stuff.

The more I read about the MSO7104B, the more confident I get that this was a great choice.  I thought I might be having buyers remorse right now but I'm not.  A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.