Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[tv84]

For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it...   

9000/90000 is similar to 5000/6000/7000. What is the latest FW version?

[Howardlong]

For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it...   

9000/90000 is similar to 5000/6000/7000. What is the latest FW version?

Pretty sure 9000 is Windows 7 based, not vxWorks or WinCE.

Maybe this thread? https://www.eevblog.com/forum/testgear/exploring-the-secrets-of-agilent-9000h-series-scopes/

[Howardlong]

As are the 8000, 80000 and 5483x.

Sorry, I was only trying to give you a subtle hint as to where you might find an answer to your question ;-)

[Greybeard]

PROBLEM SOLVED!
(DSO6000 series, firmware ver 6.16.0001.).

--------------------------------------------------------------------------
Problem was:

Here is how you enable the service menu:

telnet <ip> 5810
username panther
password pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope

I tried this exactly as described, but this happened:
...
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x79-

0x79 instead of 0x00?
I cancelled it and hopefully nothing was changed.
What went wrong?
The address 0x009A2187 is for use with DSO7000 series!

Look here:

Just as a curiosity, to enable the service menu (only for 6000 series) type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".


Note: To enable service menu in the 7000 series use this command:
mem modify -w 1 0x009A2187

[kangalooj]

Does anyone has any version older than 7.31.20 for Keysight DSOX6004A which is current version!?
Keysight deleted all old versions from its website!

[Greybeard]

Does anyone has any version older than 7.31.20 for Keysight DSOX6004A which is current version!?

Sorry, you are in the wrong thread.
You were asking for DSOX:
https://www.eevblog.com/forum/search2/

[eric6004]

Hello,

You can find the 6.11 version here:
http://www.jays.co.kr/Service2_view.asp?idx=246&page=3&layer=2

[Pitrsek]

Hi,
have anyone succeeded  in hacking 500Mhz version into 1Ghz version in the end?
I'd be particularly interested in 7000, ie. 7054  to 7104. Thanks!

[DC1MC]

Hi,
have anyone succeeded  in hacking 500Mhz version into 1Ghz version in the end?
I'd be particularly interested in 7000, ie. 7054  to 7104. Thanks!

And speacking of "upgrading", does anybody knows if these applies to the 9000 series ?

[gogoman]

Could you please point me to the correct steps to enable the service menu?

Service menu on MSO7000

telnet <ip> 5810
username: panther
password: pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

“cmd”
then press enter.  At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter. 
Then type “0x01” and press enter again. 
Then type “.” and press enter again.


 Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'

reboot scope

Done


====================
Only for 6000 series type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".

hello my 6102A scope has 6.20 FW installed, after entering the code above, the  service mode options is unavailable,  where did I do wrong,  Is a work around  available?

thanks   

[HighVoltage]

I only have the 7000 series scopes.

Probably a typo?
The service menu hack has been verified many times.

Or you try an older FW and see if that makes a difference.

Or check this message out:
https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg3312458/#msg3312458

[gogoman]

Hello  high Voltage, I to was wondering about a typo, if someone spots a typo please let me know.
The other option is to try version 6.16, or better yet a patch version of 6.20

thanks

[Venturi962]

Can you try 'setServiceMode(1)' instead of memory address?  Should work on 6.20

https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414538/#msg414538

[gogoman]

 

Can you try 'setServiceMode(1)' instead of memory address?  Should work on 6.20

https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414538/#msg414538

 

Its alive,  , well almost. missing logic probes, pm me if you have a set

thanks for the help

[simonov]

Hi everyone. Is there any way to get the older sys6000.jzp system 6.16.0001 version of the firmware? I recently purchased an old DSO5014A. Keysight seem to have removed all older versions of the firmware of their website. 

[swperk]

I think this is what you're looking for. Let me know. I had to zip the .jzp file to get below the 4 MB limit for posting.

[simonov]

Hello,
thanks for the help.  I will share some info once I get the scope in my hands.

[Miek]

Does anyone know a reasonable source (or maybe have a spare) of the frontend Teledyne relay? From previous posts I believe the part number is A150-20-12, but it seems impossible to get now (without spending $365 for QTY1 )

I recently upgraded to an MSO6104A but after some use I noticed a problem with it. On channel 1 with the 50ohm termination enabled and the scale set to 200mV/div or above, the termination actually measures around ~120ohm. Going below 200mV I hear a relay click and the termination measures correctly. So, I'm assuming the attenuation path of the relay is fried and the through path is OK. This is just an educated guess from the behaviour and looking at PCB photos people have posted in the past, so if anyone has more info that'd be great.

I haven't opened it up to measure and confirm yet, but I'll update when I do.
The backup plan is either live with it and use the other channels, or bodge in an A150-20-5 (5V coil) relay that I could find for a reasonable price.

[KM5TZ]

Does anyone know a reasonable source (or maybe have a spare) of the frontend Teledyne relay? From previous posts I believe the part number is A150-20-12, but it seems impossible to get now (without spending $365 for QTY1 )

I recently upgraded to an MSO6104A but after some use I noticed a problem with it. On channel 1 with the 50ohm termination enabled and the scale set to 200mV/div or above, the termination actually measures around ~120ohm. Going below 200mV I hear a relay click and the termination measures correctly. So, I'm assuming the attenuation path of the relay is fried and the through path is OK. This is just an educated guess from the behaviour and looking at PCB photos people have posted in the past, so if anyone has more info that'd be great.

I haven't opened it up to measure and confirm yet, but I'll update when I do.
The backup plan is either live with it and use the other channels, or bodge in an A150-20-5 (5V coil) relay that I could find for a reasonable price.

I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?

[mikeselectricstuff]

Does anyone know a reasonable source (or maybe have a spare) of the frontend Teledyne relay? From previous posts I believe the part number is A150-20-12, but it seems impossible to get now (without spending $365 for QTY1 )

I recently upgraded to an MSO6104A but after some use I noticed a problem with it. On channel 1 with the 50ohm termination enabled and the scale set to 200mV/div or above, the termination actually measures around ~120ohm. Going below 200mV I hear a relay click and the termination measures correctly. So, I'm assuming the attenuation path of the relay is fried and the through path is OK. This is just an educated guess from the behaviour and looking at PCB photos people have posted in the past, so if anyone has more info that'd be great.

I haven't opened it up to measure and confirm yet, but I'll update when I do.
The backup plan is either live with it and use the other channels, or bodge in an A150-20-5 (5V coil) relay that I could find for a reasonable price.

I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?

How often do you use all 4 channels on 50 ohms.. ? Maybe swap it with Ch4 ?

[Miek]

I opened up my scope to do some tests and try to confirm my theory from above.

I did confirm that the relay part is A150-20-12:



Also, I traced out the 50ohm path. It goes through the first relay, through the Teledyne attenuator, then terminates into the 1NB7 IC:



I also put it on the TDR and took some measurements. The blue trace is with the scope set to <200mV/div (good), yellow is with it set to 200mV/div (bad), the solid marker is lined up (in time) with the pad exiting the first relay, and the dashed marker is on the pad of the 1NB7 IC. So it does look like the Teledyne attenuator is bad, I think.

I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?

On mine at least, the 50ohm termination is built into the Agilent 1NB7 IC. The Teledyne relay is a switchable attenuator sitting in front of that termination. However, since yours is a 500MHz model, it shouldn't have the Teledyne relay installed at all. I'm not sure where the termination is for those models.

How often do you use all 4 channels on 50 ohms.. ? Maybe swap it with Ch4 ?

Yeah, that's a good idea. I might just do that.

[KM5TZ]

Some drawbacks:
- FMS, BAT, FRS, TEL, 1MV, TOM, CIR features are not enabled by "ALL"
- the address is version dependent, this one will not work on 5k/6k

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.

Scope is a DSO7054A running system version 06.20.000.
Logged in with Telnet and executed setServiceMode(1)
An 'Options' selection appears in the licenses menu. Pressing it lists a selection of command line options (verbose, Service Mode, Diagnostics...). I'm not sure how to proceed.... selecting all licenses or MSO does not appear to do anything?

I figures it out...
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope

Looks like it works!

[analogRF]

I might have missed it but is it possible to upgrade bandwidth of DSO6000A?
Not to 1GHz necessarily but for example 100MHz or 300MHz to 500MHz?

[mikeselectricstuff]

I might have missed it but is it possible to upgrade bandwidth of DSO6000A?
Not to 1GHz necessarily but for example 100MHz or 300MHz to 500MHz?

from memory I think there are very major hardware differences between 100 and 300, not sure above that

[analogRF]

How about 300M to 500M? Does anyone know?
There seems to be a major difference here too because 300M is 2Gs/s but 500M is 4Gs/s so I am assuming it is not possible?