Keysight 1000X (EDUX1002A) Fails to boot - UART logged at boot - Page 1
Forum section: electronics / repair

author: pnv57
author_rank: Contributor
timestamp: October 27, 2021, 04:21:45 am
content: Hi, I have recently acquired two Keysight EDUX1002As to repair, with sticky notes on them. One worked, and has been hacked into the highest model (awaiting trigger and frontend parts) but the other fails to boot. When I swapped BLT (processor/ASIC/FPGA) boards, the problem followed the bad board. Upon booting, I logged the UART output (below). I'm thinking some kind of flash chip failed? Which one is it? Perhaps I could dump my other scope, buy a new flash chip, copy it, and install a replacement? I don't have any tools for working with BGA chips, or anything for working with NAND flash also.Code:U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500CPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: internal ecc 128 MiBDebug serial initialized ........OKRTC: 2080-165-23 7:145:99.56 UTCMicrosoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008PHY not found.System ready!Preparing for download...RTC: 2080-165-23 7:145:99.56 UTCLoading image 1 from memory at 0xD0600000OBL_IMAGE_TYPE_BINXXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXRewrite recommended, internal ECC corrected data at 0xfe9OXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXORewrite recommended, internal ECC corrected data at 0x111aOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXRewrite recommended, internal ECC corrected data at 0x12afOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXXOOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOORewrite recommended, internal ECC corrected data at 0x1eabOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXRewrite recommended, internal ECC corrected data at 0x221bXBlock length: 0x3fffffff is larger than 0x10000CeDecompressFlashBlock failed****** Data record 173 corrupted, ABORT!!! ******Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x1A80C40 Name="" Target=RAMLoading image 1 failed, trying next oneLoading image 2 from memory at 0xD1E00000BL_IMAGE_TYPE_UNKNOWNLoading image 2 failed, trying next oneAll images failedPress r to reset

author: Bud
author_rank: Super Contributor
timestamp: October 27, 2021, 05:50:49 am
content: This is NAND memory corruption problem. You need to write a good image into it. You do not have to replace the NAND memory chip. However the problem with stock EDUX is it does not have a LAN interface and UBoot is locked. There are ways to upload an image but this will require a surgery to unlock UBoot or build a StupidBear LAN card (information is in the 1000x hacking thread).Hit spacebar as soon as the UART comes alive and see what menu you get.

author: pnv57
author_rank: Contributor
timestamp: October 27, 2021, 06:47:23 pm
content: Quote from: Bud on October 27, 2021, 05:50:49 amSo you don't believe that is a bad memory chip? And that it got corrupted through another mechanism? What kind of surgery would it require to unlock UBoot? I hooked up a keyboard to the front USB-A port, and it won't respond to spacebar on startup, nor will it respond to "r" at the end where it says "Press r to reset". Also, my keyboard doesn't light up at all. Do you mean the USB-B port in the back? Or the USB port on the StupidBear LAN card?

author: Bud
author_rank: Super Contributor
timestamp: October 27, 2021, 07:08:48 pm
content: NAND corruption is a well known problem on Keysight scopes even on higher end models. I do not think anyone arrived to a conclusion why it happens. The fix is to write a new recent firmware image to it, Keysight apparently made some changes to mitigate the problem.I mean hit the spacebar at the computer that you have connected to the BLT board, isn't that how you got the UART log?

author: pnv57
author_rank: Contributor
timestamp: October 27, 2021, 07:32:40 pm
content: Quote from: Bud on October 27, 2021, 07:08:48 pmOhh. I'm using a 5V TTL arduino uno with only the TX pin connected, plugged into a terminal on my PC because I don't have a 3.3V level serial adapter. Maybe I can cook something up, will post once I have.

author: Bud
author_rank: Super Contributor
timestamp: October 27, 2021, 08:28:12 pm
content: Yes, you need a functional 2-way UART connection to be able to do anything meaningful.

author: Bud
author_rank: Super Contributor
timestamp: October 27, 2021, 08:56:19 pm
content: Quote from: pnv57 on October 27, 2021, 06:47:23 pmYou will need to reprogram U701 chip on the bottom side of the BLT board. I recommend unsoldering it and keeping as a backup, buy a new one from Digikey or Mouser , burn a replacement firmware in it and install. This is a vanila serial memory chip and is supported by many typical chip programmers.This will give you access to UBoot commands which then can be used to manipulate memory blocks. From there may exist a few ways to fix the NAND. But if you are not comfortable with that then you probably should just forget it and sell the scope as non-working. I can help with an advice and directions but not with step by step instructions.

author: felixsys
author_rank: Contributor
timestamp: February 02, 2022, 08:32:29 pm
content: Hello,Same problem with my 1000x... nand crashedDid you find a solution?

author: Meow
author_rank: Newbie
timestamp: February 07, 2023, 09:42:50 pm
content: Hi same problem with my EDUX1052A, unable to boot, stuck at LED lights and the screen is black. Anyone know how to fix it. Thanks

author: Meow
author_rank: Newbie
timestamp: February 21, 2023, 09:04:49 pm
content: Here is my uboot log. Does this mean it has NAND corruption?Code:U-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)Configure DDRTrying to boot from NORU-Boot SPL 2019.01+tlo+g39e79cf090 (Jun 22 2020 - 20:27:25 +0000)Configure DDRTrying to boot from NOR

author: Bud
author_rank: Super Contributor
timestamp: February 21, 2023, 11:12:22 pm
content: This is a very strange log, never seen it before. I looked up Uboot SPL:QuoteSo maybe the NOR ( 8-pin serial memory chip on the bottom of the module) or the dynamic RAM (DDR) is bad. NAND may be ok because it seems Uboot fails before accessing it. You can try replacing the NOR - you'd need to buy a blank IC and program it with the 1052 NOR image (if you can find an image or someone can dump it for you).

author: Meow
author_rank: Newbie
timestamp: February 22, 2023, 12:07:05 am
content: Quote from: Bud on February 21, 2023, 11:12:22 pmIs NOR IC theU701 chipon the BLT board? Thank you!

author: Bud
author_rank: Super Contributor
timestamp: February 22, 2023, 01:19:04 am
content: Yes

author: TT-392
author_rank: Contributor
timestamp: November 12, 2023, 01:49:29 pm
content: I have a similar UART log as OP:Code:U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500CPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: internal ecc 128 MiBDebug serial initialized ........OKRTC: 2024-23-11 1:94:20.31 UTCMicrosoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008PHY not found.System ready!Preparing for download...RTC: 2024-23-11 1:94:20.31 UTCLoading image 1 from memory at 0xD0600000OBL_IMAGE_TYPE_BINXXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOORewrite recommended, internal ECC corrected data at 0x13eaOOOXXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXODeCompressFlash: CeCompressDecode() failedCeDecompressFlashBlock failed****** Data record 137 corrupted, ABORT!!! ******Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x1A80C40 Name="" Target=RAMLoading image 1 failed, trying next oneLoading image 2 from memory at 0xD1E00000BL_IMAGE_TYPE_UNKNOWNLoading image 2 failed, trying next oneAll images failedPress r to resetResettingPress r to resetI am open to doing surgery to unlock UBoot:Quote from: Bud on October 27, 2021, 08:56:19 pmI actually already desoldered and read U701 before and confirmed its contents were identical to "xloader_image.bin", which I extracted from keysight's firmware upgrade file. (This seemed like easy low hanging fruit to check before connecting the UART console).So, with that experience, writing new firmware to that chip should be doable. Am I understanding correctly that the method for reprogramming UBoot involves writing some firmware with UBoot writing capabilities to that chip, and using that to flash a new UBoot image? If so, then my question is, where would I find this magical UBoot unlocking firmware image?edit:I also have a J-Link EDU Mini to talk to the JTAG connector could I maybe program the UBoot directly like that?

author: rg58
author_rank: Regular Contributor
timestamp: August 03, 2025, 12:27:25 pm
content: Same issue here. Same scope, same UART messages.Has anyone made some progress?

author: Bud
author_rank: Super Contributor
timestamp: August 03, 2025, 01:59:13 pm
content: It is not simple. Refer to this post and read on:https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg5176692/#msg5176692

author: rg58
author_rank: Regular Contributor
timestamp: August 03, 2025, 02:44:57 pm
content: Thanks a lot for pointing me to this thread!This indeed seems to require a lot of effort, but at the end he managed to fix his scope with your help. Impressive job!