Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[mikeselectricstuff]

Do we know what 1MV actually does?

Yes, it is a magnification of 5mV/div, no real range.

I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standard

[Carrington]

I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standard

Yes, but for 100MHz models 1mV/div is a magnification of 2mV/div.

[mikeselectricstuff]

Better close-up of 6034A - resistor in different position, but voltages are the same.

However if they're using links to indicate hardware versions, chances are there are other differences which probably mean there's limited scope for useful enhancements.

I had a play with the centre two resistors (1K) on the 6034A :
Left  Right
N     N   6104A
N     Y    6034A
Y      Y    6102A
Y      Y    6032A

In 6104 mode, timebase goes to 500ps/div , but no extra bandwidth 

Also something odd happens when 50R input selected - I suspect the relay control lines may be used differently on the 610xA
Will try on 6012A tomorrow.

[abyrvalg]

So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
Sad that 03->10 doesn't change BW, but maybe some other modifications like 01->03 will work, who knows. Need to compare the frontends otherwise.

[dfnr2]

All this is very interesting indeed.  I'm temporarily unable to access my scope or my home computer for a few more days, so I'm unable to join in the fun at the moment, except vicariously.

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed? 

[Carrington]

Well, that's great. 
So we just have to dig a bit deeper.

No 500MHz version yet? Intriguing... 
I know that the frontends (hybrid chip) at the DSO5054A and MSO/DSO6034A is 1NB7-8453.
But perhaps, the BW is set by a jumper on the same input stage, and 20MHz BW limit is set by a separate pin.

The 6000 series datasheet says:
   MSO/DSO601xA/603xA 2GSa/sec each channel.
   MSO/DSO605xA/610xA 4GSa/sec half channel; 2GSa/sec each channel.
   Equivalent-time sample rate: 400GSa/s (real-time off)
   LA sample rate: 2GSa/sec one pod; 1GSa/sec each pod.

So this is not true (in red) for 6000 series (I mistook with the 30000X series, I'm sorry):

When I get time I'll see if the digital channels are improved.
I wonder if the sample rate hack will improve sample rate on digital channels on that...?

No, this improvement is only for 1GHz models [MSO610*A MSO710*A].

Mike, many thanks for testing. 

[mikeselectricstuff]

All this is very interesting indeed.  I'm temporarily unable to access my scope or my home computer for a few more days, so I'm unable to join in the fun at the moment, except vicariously.

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?

MSO is a purely software option as the hardware is the same for a DSOxxxx and MSOxxxx

[Carrington]

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?

I would have to check it in the code, but probably nothing.

It's simple, double check.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

With the BW option is different, some BW features (GSa/s, ns/div) can be forced by a firmware patch, but others not.
To force something via software, the HW must have ability to do that and also the HW must allow enable it by SW.


I apologize for my English, sometimes is not easy to me express what I really mean.

[mikeselectricstuff]

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?

I would have to check it in the code, but probably nothing.

It's simple, double check.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

The only thing that wouldn't have MSO is a 5000 - though this may be indicated by an build option link.
My guess is that anything that is selected by a hardware link needs a different hardware build - why would they limit themselves?

[abyrvalg]

FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

The code proves the opposite: you need to have fpga mso bit set AND some mso feature (FMS/MSO) installed to have MSO. So no fpga mso bit set -> no MSO.

[Carrington]

The code proves the opposite: you need to have fpga mso bit set AND some mso feature (FMS/MSO) installed to have MSO. So no fpga mso bit set -> no MSO.

Thanks for clarifying, because now I have no need to review the code. 

[abyrvalg]

I'm getting a feeling these fpga bits are not for cutting the options, but to indicate true hw limits like no 4ch - no sw way to use it, no MSO circuit - again, no sw can fix that, serial terminal instead of normal panel - no way to use normal panel, no battery compartment - no battery option (found such value in 5-bit group recently). Only BW options are under question - same frontend chips on some models gives hope.

[mikeselectricstuff]

Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware

[Carrington]

If you can, please check this:

[Carrington]

7000 series mainboard:

[abyrvalg]

mikeselecricstuff, can you please post 6012 board picture? How does it's original resistor combination look?

[mikeselectricstuff]

If you can, please check this:

These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.

[mikeselectricstuff]

mikeselecricstuff, can you please post 6012 board picture? How does it's original resistor combination look?

Already did :
https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg387483/#msg387483

[Carrington]

These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.

Damn, I thought that it could be what we seek.
Thanks for testing. 

[dfnr2]

I agree with abyrvalg that the FPGA strap options is most likely setting hard limits; so MSO=(6000/7000), /MSO=(5000).  Probably these decisions were wired in before the marketing department started gearing up.

Obviously the question is, did Agilent purposely cripple the scopes to prevent 2-channel serial decodes, or do they disallow it to prevent an invalid condition. 

For example, I could imagine that the implementation is such that the MUXes in the FPGA (or ASIC) want to talk to all digital + All 4 analog channels, but if only 2 channels are active, some handshaking never happens and the decoder hangs, but if all four channels are activated on a 2-channel scope, then some handshaking at the A/D FIFO doesn't happen, and the scope hangs, etc.

So, it might be interesting to follow the serial decode code, both option setup, and decode setup to see how it sets up the hardware.  I think that if it's not a hardware limitation, that is where the answer lies.  BTW, do the 5000 series have the serial trigger option, or nothing at all?

Dave

[mikeselectricstuff]

Enabling decodes by software patches lets you get as far as enabling, but as soon as acquisition starts it hangs.
This seems to suggest some reliance on hardware that's only present on 4ch models. Hard to see what this could be, as 2ch models use the same size of FPGA.
I wonder if maybe the acquisition ASIC has something, memory perhaps, that is used for 2ch and also 4ch , but the same hardware in the second ASIC fitted in the 4ch models is used for decodes.
As they already have the licensing scheme, and a system that lets them charge more for the same license on higher-end models, I can't see why there would be any reason to have additional disables on decodes, so I think it's reasonable to assume the decodes need some hardware that's not in the 2ch build.
 
Thinking about it, on the 2ch, the ASIC handles 2 analogue plus 16 digital channels, but on 4ch, it only has to deal with the additional 2 analogue channels, so maybe the MSO logic is somehow shared with decodes.

I may be mis-remembering this, but ISTR reading that on the MSOX models, you can't do decodes on the digital channels, which suggests some shared resources.
 

[Carrington]

Please, correct me if you think that I'm wrong, but I think that little more can be done.
Well, all what we have achieved is quite good.

Special thanks to abyrvalg, without your support all efforts have been in vain.
Also to mikeselectricstuff, chiefly by having the courage to make the hardware tests.
Thanks also to dfnr2 for their collaboration.

Great job guys. 

[mikeselectricstuff]

Please, correct me if you think that I'm wrong, but I think that little more can be done.
Well, all what we have achieved is quite good.

Special thanks to abyrvalg, without your support all efforts have been in vain.
Also to mikeselectricstuff, chiefly by having the courage to make the hardware tests.
Thanks also to dfnr2 for their collaboration.

Great job guys. 

I'd tend to agree, though 300->500MHz might be possible - if we could see the inside of a 605x that would be handy to compare.
ISTR reading the specs many years ago and noticing the 1GHz versions looked like they were significantly different, but don't recall why - may have been that they gang up channel pairs.  There is certainly something different about the relay switching, and there is an unpopulated, bypassed relay position on the 6034A.
However there may still be other hardware differences that preclude anything useful here.

However a lot of useful functionality has been acheived :
1) Freedom from reliance on Agilent to supply trial licenses, which could stop at any time, and not needing to set the date back.
2) 8M memory for old scopes which didn't have it as standard (they changed to 8M standard and increased the cost fairly early on)
3) Circular segmented memory
4)? firmware support for DIY battery option?
 

[abyrvalg]

Time to open 9000/90000 thread?

[dfnr2]

Hey guys, this has been a very educational experience.  Thanks to abyrvalg for the magic and wisdom.  I will still have to work my way through all the recent discoveries when I can get back to the scope.  Thanks to Carrington and Mike for energy and for pushing forward.