Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot

[pnv57]

Hi, I have recently acquired two Keysight EDUX1002As to repair, with sticky notes on them. One worked, and has been hacked into the highest model (awaiting trigger and frontend parts) but the other fails to boot. When I swapped BLT (processor/ASIC/FPGA) boards, the problem followed the bad board. Upon booting, I logged the UART output (below). I'm thinking some kind of flash chip failed? Which one is it? Perhaps I could dump my other scope, buy a new flash chip, copy it, and install a replacement? I don't have any tools for working with BGA chips, or anything for working with NAND flash also.

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2080-165-23   7:145:99.56 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2080-165-23   7:145:99.56 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXRewrite recommended, internal ECC corrected data at 0xfe9
OXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXORewrite recommended, internal ECC corrected data at 0x111a
OOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXRewrite recommended, internal ECC corrected data at 0x12af
OOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOORewrite recommended, internal ECC corrected data at 0x1eab
OOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXRewrite recommended, internal ECC corrected data at 0x221b
XBlock length: 0x3fffffff  is larger than 0x10000
 CeDecompressFlashBlock failed
****** Data record 173 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

[Bud]

This is NAND memory corruption problem. You need to write a good image into it. You do not have to replace the NAND memory chip. However the problem with stock EDUX is it does not have a LAN interface and UBoot is locked. There are ways to upload an image but this will require a surgery to unlock UBoot or build a StupidBear LAN card (information is in the 1000x hacking thread).
Hit spacebar as soon as the UART comes alive and see what menu you get.

[pnv57]

This is NAND memory corruption problem. You need to write a good image into it. You do not have to replace the NAND memory chip. However the problem with stock EDUX is it does not have a LAN interface and UBoot is locked. There are ways to upload an image but this will require a surgery to unlock UBoot or build a StupidBear LAN card (information is in the 1000x hacking thread).
Hit spacebar as soon as the UART comes alive and see what menu you get.

So you don't believe that is a bad memory chip? And that it got corrupted through another mechanism? What kind of surgery would it require to unlock UBoot? I hooked up a keyboard to the front USB-A port, and it won't respond to spacebar on startup, nor will it respond to "r" at the end where it says "Press r to reset". Also, my keyboard doesn't light up at all. Do you mean the USB-B port in the back? Or the USB port on the StupidBear LAN card?

[Bud]

NAND corruption is a well known problem on Keysight scopes even on higher end models. I do not think anyone arrived to a conclusion why it happens. The fix is to write a new recent firmware image to it, Keysight apparently made some changes to mitigate the problem.
I mean hit the spacebar at the computer that you have connected to the BLT board, isn't that how you got the UART log?

[pnv57]

NAND corruption is a well known problem on Keysight scopes even on higher end models. I do not think anyone arrived to a conclusion why it happens. The fix is to write a new recent firmware image to it, Keysight apparently made some changes to mitigate the problem.
I mean hit the spacebar at the computer that you have connected to the BLT board, isn't that how you got the UART log?

Ohh. I'm using a 5V TTL arduino uno with only the TX pin connected, plugged into a terminal on my PC because I don't have a 3.3V level serial adapter. Maybe I can cook something up, will post once I have.

[Bud]

Yes, you need a functional 2-way UART connection to be able to do anything meaningful.

[Bud]

What kind of surgery would it require to unlock UBoot?

You will need to reprogram U701 chip on the bottom side of the BLT board. I recommend unsoldering it and keeping as a backup, buy a new one from Digikey or Mouser , burn a replacement firmware in it and install. This is a vanila serial memory chip and is supported by many typical chip programmers. 

This will give you access to UBoot commands which then can be used to manipulate memory blocks. From there may exist a few ways to fix the NAND. But if you are not comfortable with that then you probably should just forget it and sell the scope as non-working. I can help with an advice and directions but not with step by step instructions.

[felixsys]

Hello,
Same problem with my 1000x... nand crashed
Did you find a solution?

[Meow]

Hi same problem with my EDUX1052A, unable to boot, stuck at LED lights and the screen is black. Anyone know how to fix it. Thanks

[Meow]

Here is my uboot log. Does this mean it has NAND corruption?

Code: [Select]

U-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)
Configure DDR
Trying to boot from NOR

U-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)
Configure DDR
Trying to boot from NOR

[Bud]

This is a very strange log, never seen it before. I looked up Uboot SPL:

SPL (Secondary Program Loader) is a small binary, generated from U-Boot
source, that fits in the SRAM and loads the main U-Boot into system RAM

So maybe the NOR ( 8-pin serial memory chip on the bottom of the module) or the dynamic RAM (DDR) is bad. NAND may be ok because it seems Uboot fails before accessing it. You can try replacing the NOR - you'd need to buy a blank IC and program it with the 1052 NOR image (if you can find an image or someone can dump it for you).

[Meow]

This is a very strange log, never seen it before. I looked up Uboot SPL:

SPL (Secondary Program Loader) is a small binary, generated from U-Boot
source, that fits in the SRAM and loads the main U-Boot into system RAM

So maybe the NOR ( 8-pin serial memory chip on the bottom of the module) or the dynamic RAM (DDR) is bad. NAND may be ok because it seems Uboot fails before accessing it. You can try replacing the NOR - you'd need to buy a blank IC and program it with the 1052 NOR image (if you can find an image or someone can dump it for you).

Is NOR IC the U701 chip on the BLT board? Thank you!

[Bud]

Yes

[TT-392]

I have a similar UART log as OP:

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK 
RTC: 2024-23-11   1:94:20.31 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board 
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-23-11   1:94:20.31 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOORewrite recommended, internal ECC corrected data at 0x13ea
OOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 137 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Resetting

Press r to reset

I am open to doing surgery to unlock UBoot:

What kind of surgery would it require to unlock UBoot?

You will need to reprogram U701 chip on the bottom side of the BLT board. I recommend unsoldering it and keeping as a backup, buy a new one from Digikey or Mouser , burn a replacement firmware in it and install. This is a vanila serial memory chip and is supported by many typical chip programmers. 

This will give you access to UBoot commands which then can be used to manipulate memory blocks. From there may exist a few ways to fix the NAND. But if you are not comfortable with that then you probably should just forget it and sell the scope as non-working. I can help with an advice and directions but not with step by step instructions.

I actually already desoldered and read U701 before and confirmed its contents were identical to "xloader_image.bin", which I extracted from keysight's firmware upgrade file. (This seemed like easy low hanging fruit to check before connecting the UART console).
So, with that experience, writing new firmware to that chip should be doable. Am I understanding correctly that the method for reprogramming UBoot involves writing some firmware with UBoot writing capabilities to that chip, and using that to flash a new UBoot image? If so, then my question is, where would I find this magical UBoot unlocking firmware image?



edit:
I also have a J-Link EDU Mini to talk to the JTAG connector could I maybe program the UBoot directly like that?