EEVblog #978 - Keysight 1000X Hacking

[Bud]

There is a version with 2Mpts but it is only good for 1- or 2-channel modes. If you turn on 3rd channel (external input), the displayed signal starts wrapping around on bigger time/ settilngs because of insufficient memory for 3 channels. That may cause confusion if the user does not understand that, so in general using the version with 1Mpts is safer.

[Anthocyanina]

The StupidBear LAN board for the EDUX provides 100Mbit/s full duplex network Ethernet connectivity. It also has a USB-to-UART bridge and a second USB Host port, which  were used for debugging and to connect a keyboard or mouse. They are not needed if only LAN is required. The board gets power from the main board. Refer to the PDF attachment for the schematic.



The board was designed to plug in to the installed mezzanine connector J104 on the  BLT board and then is secured to the main board's existing mounting poles via 2.5mm spacers. Raising the StupidBear LAN board above the main board by 2.5mm was required in order to maintain proper mating to the mezzanine connector J104 on the  BLT board. The  BLT board has to be unscrewed and lifted off, the LAN board is connected to it, then the entire assembly is carefully placed on the main board, and is secured with 4 BLT board screws and two new screws by the LAN connector (again, two 2.5mm spacers are needed under the LAN board to maintain proper height above the main board).



The stock scope does not have J104 soldered. The connector must be purchased and soldered onto the BLT board. The connector data:
Amphenol 61083-041402LF
Digikey part number: 609-1667-1-ND



Also attached is the BOM that has DigiKey part numbers for the critical components, and the Gerber files to order a PCB if you want to build a StupidBear LAN board for your Keysight 1000X including the EDUX model and have some fun.
Important: The LAN PCB thickness must be 1mm in order to have some clearance above the components under it on the scope's main PCB.

Hi Bud, I had an accident today when trying to diagnose a USB problem with my scope. The USB port isn't detecting anything, and between 5V and ground, i read 120 ohm, and there's 5V between each data line and ground as well. Anyway, when i was taking it apart, one of the connectors in the BLT module came apart, half of the pins remained on the PCB, and the other half stayed with the connector, which fell off the PCB. Fortunately no pads were damaged, and I was able to put the connector back on the PCB by carefully aligning the pins with the holes, but this just makes contact with the pads very loosely. I'm wondering if you know what temperature these connectors can withstand as i intend to attempt to resolder the connector with a hot air station and this is my first time trying to solder a connector of this type and the datasheet doesn't specify soldering temperatures.

I'm also curious about the part number you mention. Is that also the same part for the connectors already present on the board? Asking since you mention adding a spacer for the LAN board, so it would make sense that the parts already in the board are taller ones than the one you installed. I think it would be good to buy a few connectors and practise soldering on a test board.

And also, if you could measure the resistance between ground and +5V of the USB port and let me know, that would be great, because i really doubt 120 ohm is  what it's supposed to be.

Thank you!

[Bud]

The connector is same as the other ones if i remember correctly. A spacer was needed to provide a clearance between the LAN board and some other circuit under it, i recall that was a DC power converter or something. For same reason the LAN PCB thickness has to be 1mm (I wrote in my post what it should be).
Soldering the connector with hot air was difficult and I melted just a bit of the shroud, so be careful. I would recommend preheating the board or use a suitable soldering iron and microscope. i cant say the temperature, just go with whatever melts the solder after 30 sec. You also can wrap the connector housing in kapton tape to protect from heat. I recall i used a piece of aluminum foil from a chocolate bar for that.

[Anthocyanina]

after days practising on scrap boards with tiny connectors i decided to attempt to resolder the original connector. i first wanted to find the fault with the USB host connector, and it turns out the power chip IC is shorted, so i removed it (the magnetic component on the USB data line was removed accidentaly with hot air, but should be easy to resolder). I don't know if anything upstream is also damage or what damaged it since the last time i used it to get data onto a flash drive it worked fine.

anyway, here's the end result of the repair. it's far from the best soldering job for sure, but it's the best i could do with the crappy irons with large tips i have, and it works. i'm glad this was the connector going to the display and not the one on the analog side. i checked all the other connectors on the BLT board to see if any of them had also suffered damage from removing the board, but luckily they were all fine. i reassembled the scope now with the USB switch IC removed, and everything works fine, except for the usb port at the front, of course. i ended up preheating the board for a bit and that helped when i went in with the iron.

thank you Bud!

[Bud]

Good that you were able to get it back! 
Weird problem with the USB power switch IC ....

[Anthocyanina]

something else happened now with this scope. it was running fine, and then it froze, then i shut it off, and when i turned it on, all LEDs are on, and the relays clicked, but no light sequence. When i resoldered the connector i left it running for about 6 hours and it was fine. Any idea what may have happened now?

Thank you! 

[Bud]

Does it produce any output on the debug serial console ?

[Anthocyanina]

Does it produce any output on the debug serial console ?

I'm going to open it up and let you know. But I think i might have to rework that connector on the BLT, cause i just noticed another symptom: the display presents a barely visible black bar that covers a quarter of it on the side of the buttons, like a checkered pattern. i tried getting a picture of that, but it doesn't show on camera, it's a very faint checker pattern with black and unlit pixels.

Thank you!

[Anthocyanina]

i opened it up, and removed the BLT to solder wires for the serial port. out of curiosity i powered the scope without the BLT plugged in and it behaved in the same manner it did after it froze.

i inspected the solder joints of all the BLT connectors again, and the connectors on the main board, and they all looked ok, no loose pins or broken joints or anything mechanically suspect.

i then soldered the wires for the serial port, made sure there were no bridges, both by visual inspection and by measuring resistance before and after soldering between the neighbouring pads.

i powered on the scope, with the two wires for the serial port plugged to probes on another oscilloscope, powered it on, and no activity, one of the two wires went high, the other remained low, and that was it.

i pressed on the BLT to make sure the connectors had mated properly, but no changes. i then started poking around the BLT with another oscilloscope and all the JTAG points went high, and all the debug points were low except for one which had a 200MHz signal on it.

what else?

another thing i noticed was the arm spear600 soc was still getting hot. not burning hot, but still significantly warm, the FPGA wasn't getting noticeably hot, so this might be significant?

i also probed directly on the via dave used to get serial out, thinking maybe my wire could be broken inside the insulation, but nope, no activity at all.

does this spear600 chip also handle USB host? i wonder if the USB port dying could be due to some internal damage in that chip somehow and whatever had died inside killed the spear600 for good?

i really don't want to lose this scope, both because it's the nicest to use i have and because turning it into e-waste would be way too awful. I've been looking around to see if anyone sells the BLT board on ebay or elsewhere, since i damaged the connector, but no luck.

 

[Bud]

Yes the USB controller (2 of them) are on Spear600.

Put the BLT board back, connect the scope to your computer USB (use the USB port on the back of the scope). Turn audio on on the computer. Power on the scope and listen if the computer makes a sound blip indicating a USB device connected. Check the USB devices list in Device Manager for a new device or new unrecognized device. It may show up as Spear600 SOC or something. Post here what was the outcome.

Edit: provide adequate cooling to BLT module if you keep back cover removed. I use a PC fan blowing from the side and the fan is powered from a separate walwart PS.

Edit2: while the scope is open, check if the keypad flat cable is seated correctly, or re-seat it.

[Anthocyanina]

Yes the USB controller (2 of them) are on Spear600.

Put the BLT board back, connect the scope to your computer USB (use the USB port on the back of the scope). Turn audio on on the computer. Power on the scope and listen if the computer makes a sound blip indicating a USB device connected. Check the USB devices list in Device Manager for a new device or new unrecognized device. It may show up as Spear600 SOC or something. Post here what was the outcome.

Edit: provide adequate cooling to BLT module if you keep back cover removed. I use a PC fan blowing from the side and the fan is powered from a separate walwart PS.

Edit2: while the scope is open, check if the keypad flat cable is seated correctly, or re-seat it.

Unfortunately, no USB sound, and no device is detected. other than the fan turning on, the relays clicking and the front panel lighting up, this scope has no signs of life. 

now i'm looking into maybe replacing the spear600, but the mystery behind its apparent death, and what else might have died, remains!

Thank you!

[Anthocyanina]

new development on the death of my scope!

I plugged it back in just now, thinking maybe just as it froze to never turn back again randomly it might decide to come back to life, and well, it kind of did just that. this time it did the circling lights bit and showed the megazoom splash-screen then the keysight logo and it froze on the keysight logo for a few minutes until i shut it off. I tried turning it back on again and it wouldn't turn on, presenting the same symptoms as before (all front panel lights on, weird pattern on the screen, fan spin)

this may be a stretch, but could its reluctance to turn on be related to the real time clock battery? when i broke the connector then fixed it, when it turned on for the first time after the repair it gave me an error related to the time, and the controls were locked until i restarted the scope once. maybe this was also a sign it was going to die, maybe it really needs the battery? i'm going to open it up again tomorrow and check the coin battery to see if it's good, this is quite a long shot, but there's nothing to lose with trying that! 

[Bud]

If I were you I would keep the serial debug console connected and log all boot attempts. It may help with troubleshooting.

[JDubU]

Anthocyanina:

If you need to replace the BLT connector, here's the source that I used:
https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/5-5177986-1/4569888

Same thing happened to me the first time I removed the BLT board.  As Bud recommended, Kapton tape to protect the plastic body makes soldering them a whole lot easier.

[Anthocyanina]

Anthocyanina:

If you need to replace the BLT connector, here's the source that I used:
https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/5-5177986-1/4569888

Same thing happened to me the first time I removed the BLT board.  As Bud recommended, Kapton tape to protect the plastic body makes soldering them a whole lot easier.

Thanks, yeah, i found the connector, but as funds are extremely limited at the moment, i was able to resolder it, which gave some life back to the scope, which sadly died a few days later in an inexplicable manner, or inexplicable with my limited knowledge.

-----

Another update on the scope's death:

after opening it yet again to test the battery hypothesis, i find the battery is fine, but i removed it and replaced it anyway, connected the serial lines to a serial usb adapter and another scope to check for any signs of life, then i pressed the power button, and no signs of life again, i removed the new battery, powered the scope back on, still no signs of life. i placed the old battery back in, turned it on once more, still no signs of life, so i put it back together, and i think that will be the sad end of this scope.

maybe eventually i'll have the money to buy an used edux version to get the BLT module from it or harvest the wavegen parts from mine and make an 1102g out of two scopes.

for now, this is just a nice to look at paperweight as it remains to my eyes the nicest looking oscilloscope out there.

also, if anyone out there is selling a BLT module, i don't know, perhaps your 1000x scope fell off the bench and is broken beyond repair and still has a good BLT on it, i'm willing to buy it, just not right this moment as i have no money, but in the near future for sure. if you, person who is reading this, have a working BLT module and are willing to sell it, message me! (i do wonder tho about compatibility between the 1000x and 1200x series BLT modules)

[Palmer]

Hi,

Reading the exchanges between Bud and TT-392 users, I am trying to fix an oscilloscope with a typical nand problem. (I repaired the x3000 series a few weeks ago).

However, after reprogramming the memory, calculating the checksums I am shown as expected the caption:
"Press [ENTER] to launch image stored in flash or [SPACE] to cancel."

but the oscilloscope doesn't respond to pressing buttons on the keyboard 
space, enter, r , just nothing....

I am working on a laptop. I have already tried to connect the USB keyboard to the computer and to the oscilloscope. I have run out of ideas...

Do you have any advice?

[Bud]

Which oscilloscope is that? Can you give more context, it is unclear how you got to what you wrote.

[Palmer]

Which oscilloscope is that? Can you give more context, it is unclear how you got to what you wrote.

The oscilloscope I am repairing is the DSXO1102A.
I have fixed the error of no keyboard response, the Tx lead to the oscilloscope was incorrectly connected to FTDI cable.
I have the connection made according to the video in post 1.

Despite this interrupting the boot procedure, I do not enter pboot :-(

In memory, I changed pbootdelay and bootdelay to 3, along with CRC correction.
I attach the logs and the memory file.

log -1 without interrupt loading (nand corruption issue)
log -2 aborted loading procedure, I was hoping that pboot would appear ;-(

[Anthocyanina]

I can't seem to be able to let this scope rest in peace, so i took it apart yet again, serial plugged in to another scope and to an USB adapter, it seems my adapter is dead, so it's good i prepared theo ther scope for decode and the longest record possible. after turning it on and off for a few times, i got some serial output, finally!

seeing the cpu ID itself was great, there was nothing on the screen, no rolling front panel lights still, but there was that line on the serial, telling me it's at least partially alive still.

The last bit captured on that boot attempt is what you see on the second image. It abruptly stopped at "Ethernet Bootload." (is this the end of this line? or was it meant to be "Ethernet bootloader..."?) and after that, the serial output completely stopped and the line remained high until i shut it off. I tried again for about 50 times, but never got another message on the serial line, just like last time after seeing the logo on the screen.

So! something is for sure either preventing boot, or stopping it, seemingly at random, with more fully prevented boots than stopped boot attempts, but still unpredictable. I'm going to see if i can get another USB to serial adapter.

Does this tell you anything, @Bud?

Thank you!

[Bud]

In memory, I changed pbootdelay and bootdelay to 3, along with CRC correction.
I attach the logs and the memory file.

Try replacing usbtty -> serial 
Recalculate the checksum then.

[Anthocyanina]

Ok! there's been yet another development! I kept turning it off and on multiple times, and on the latest partial boot, i got this. I captured 5.5 seconds of data. moving it around, i saw a short pulse spiking over 15V on the line, and then i started scrolling over the capture to see what was new.  this time it got past the "Ethernet bootload" bit, it really was "Ethernet bootloader" of course,  and i compared what i got with the output Dave captured on his hacking video.

it followed the normal output until "BL_IMAGE_TYPE_BIN", and then I got a couple of messages saying "Rewrite recommended, Internal ECC corrected data at 0xca" and the same message with another address "0xc7".

in between the ECC corrected messages i was getting the X and O letters seen on Dave's output, and the recorded data ended with an O, and the line remained high for the next couple of seconds until the record ended.

this has been a lot more informative and now appears to show a likely cause, corrupted memory, perhaps? hmmm! still very curious that the boot process continues to stop in seemingly random places, with two attempts without data getting it as far as showing the logos on the screen, and these two latest attempts with data stopping way before that.

[Bud]

Get a normal serial adapter man, stop torturing yourself and us 

[Bud]

So! something is for sure either preventing boot, or stopping it, seemingly at random, with more fully prevented boots than stopped boot attempts, but still unpredictable. I'm going to see if i can get another USB to serial adapter.

Double check that the NOR EEPROM chip is soldered well.

[Anthocyanina]

So! something is for sure either preventing boot, or stopping it, seemingly at random, with more fully prevented boots than stopped boot attempts, but still unpredictable. I'm going to see if i can get another USB to serial adapter.

Double check that the NOR EEPROM chip is soldered well.

is that the M25P40? if so, It is well soldered. removing the BLT module again to see that was a bit easier this time. I'll keep it unplugged for now. would it help to get a dump from it?

watching Dave's video again, the first few lines list CPU, DRAM Flash, and NAND, and on the NAND line, it says "internal ecc 128MiB". since the strange line i get says something about internal ecc corrected data at... would it still be more likely it is something with the flash and not something with the internal memory of the spear600 itself?

Thank you!

[Bud]

There is a Uboot environment variable in EEPROM that sets ECC type. If for whateve reason that variable is not loaded you will get those ecc correction errors during boot.