Keithley 4200-SCS Adventures

I recently acquired a Keithley 4200-SCS extremely cheaply, however it was not without some issues (a completely wiped hard drive, some chassis damage, no DUT cables, and potentially more!). Of course, I saw this as a fun challenge, and the prospect of a functional 4200 was far too tempting to pass up!

Front: Display, CD & Floppy Drive, 2x USB ports, and status lights (Measuring, Interlock, HDD activity)

Rear: PSU on left, COM & LPT on top alongside the Ground Module (GNDU), and below from left to right: Integrated PC, Trigger Module (4200-TM), GPIB Card (KPCI-488LP) and 4x SMU cards (4200-SMU)

Above: Three triax connections for connecting to the DUT, as well as a connector for the optional preamp (4200-PA)

What the hell does this thing even do, you may be asking yourself? Well, the Keithley 4200-SCS (datasheet) is essentially designed to characterize semiconductor devices, and it does this using SMUs (Source Measure Units).

A very good explanation of what an SMU is can be found here, but it is essentially a device that both source a voltage/current, and also measure voltage and/or current. Unlike conventional PSUs, for example, SMUs are four quadrant devices: meaning they can both source or sink currents, for either positive or negative voltages. This principle can be seen below, in the case of the 4200-SMUs in question:

The SMUs internally operate as shown - the separate force and sense terminals are for kelvin sensing, and the guard terminal prevents leakage in the cables (more on that later!)

The specifications of the SMUs in the 4200-SCS can be seen below - they are indeed extremely impressive!

Enough about the specifications - lets get it to work!

Hardware “repair”

Upon powering it up, the display simply remained black, although with the backlight on. No HDD noises led me to believe there was an issue booting. I had a look inside, and first took out the PC board (Portwell ROBO-8712VLA) - a massive pain given all the connectors. The board seemed fine, but I replaced the CMOS battery which was indeed dead. I then connected everything back together again to see if this would allow the computer to boot properly, and indeed it did! This is the first time I have seem a dead CMOS battery preventing booting!

I also installed Windows XP onto a spare hard drive I had lying around just to test if it would boot correctly: (sick gaming setup anyone?)

Chassis damage & Interlock connector

There were also some large dents in the rear - I was unbeliveably lucky that this did not damage any of the PCBs, as the connector that seems to have been bashed the most (the interlock connector) was wired to the PCB instead of soldered directly to it! The same damage to any other connector would have caused serious damage to the PCB it was soldered to. The bend in the rear brackets was easily straightened out, and replacing the interlock connector with my own connector was simple as well.

Software installation

Well, this is where things get really, really interesting! First, a short backstory. (I promise this is relevant!)

Keithley initially introduced the Keithley 4200-SCS in 2001 (I believe), which ran Keithley’s KTE Interactive software on Windows XP. The 4200-SCS went through many hardware revisions (latest in 2015) and many KTEI software revisions, the final software release being KTEI 9 which mandated Windows 7 instead of Windows XP.

Keithley also released the 4200A-SCS, a successor to the 4200-SCS. This was largely a facelift - the SMUs were still identical! Instead of KTEI, the 4200A-SCS ran Keithley’s Clarius software, initially supporting Windows 7 up to Clarius 1.3, and with later versions only supporting Windows 10.

Initially, I wanted to run the latest KITE revision (as intended) but unfortunately I was not able to find a copy online (I looked very very hard) - only PC “demo” editions are available for download. I even contacted Tektronix, but they were extremely reluctant to give me a copy, and told me that I would have to send it to them to install it for me - and the install cost alone was over 1000 EUR!

So I had to get a little more creative. I then had a very interesting idea - since the 4200A used the same SMUs as the 4200, would it be possible to install Clarius on the 4200? Well, Clarius 1.3 was available online…

I do have to note, that these are entirely uncharted waters (there is quite literally no information about the 4200 software online, for obvious reasons) and everything below had to be figured out myself, often painfully. Also, this is of course not an entirely ideal software configuration, so be warned if you are trying this yourself!

Windows 7 Installation

First, I needed to install Windows 7 SP1 x86 (as required by Clarius 1.3). I therefore downloaded the relevant ISO from an MSDN archive (en_windows_7_ultimate_with_sp1_x86_dvd_u_677460.iso, md5=2572274e6b0acf4ed1b502b175f2c2db), and performed a fresh installation. The OOBE is fairly straightforward, and I created the administrator account with a username of kiadmin as indicated in the reference manual.

Clarius Installation

So now on to installing Clarius - I first downloaded ClariusV1.3_4200A-CLARIUS-V1.3.zip (md5=3c6f6997af0c5f690a8185cf2d7cc67d) from the Tektronix download center, and tried to run it. This is a version that can be installed on both a PC (with “spoofed” hardware), or on a real 4200A. When I first ran it, it wanted to install in PC mode, as expected.

I therefore needed to figure out how to make the installer think it was being installed on a real 4200A, so I had to decompile the Installshield inx file - most available Installshield 6 decompilers did not work, but thankfully I found InstallShield Decompiler v1.00 beta 16 by NEKOSUKI which did a really great job. From the output I found that the following registry modifications were necessary:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Keithley]
"SystemSoftwareVer"="4200A-852"
"PlatformVersion"="4200A-"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\OEMInformation]
"Manufacturer"="Keithley Instruments"
"Model"="4200A"
"SystemSN"="1234"

You can find the output of the decompilation here if you wish to have a look.

Installing SMU Drivers

The SMU drivers must next be installed, which is automatically done by running PCIDrivers/dpinst.exe. Below are the four SMUs shown in Device manager - they use the vendor code 11FE (belongs to Keithley Metrabyte), and the device code 4200.

Initialize user

Not entirely sure why this needs to be done but the manual requests it - simply run C:\s4200\sys\bin\InitUser.exe. Seems to intialize necessary registry keys for the user (HKCU hive).

Installing GPIB drivers

I also needed to install the drivers for the KPCI-488LP Card (this was mandatory as all the Clarius software was (indirectly) linked against it). The correct installer can be found on the Tektronix website (KI-488_v5.0.0_KI-488-5.0.0.zip, md5=bf56ac1c9867534b2ff1a43682ae8488).

Below is the interface for the driver - It did not need any configuration:

I was then able to use Clarius’ KCXI (Keithley External Control Interface), which I have tested to work well:

KXCI does not just allow remote control over GPIB, but also network connections, as can be seen in this application note.

GPIB Missteps

I figured this out the hard way, however. Initially before installing the GPIB drivers, all the Clarius tools would crash. From the Event Viewer, I saw that the fault was: "Exception code: 0xC0000096" in the “msvcrt.dll” module.

After a little ollydbg-ing I realized that this was due to an issue with gpib-32.dll calling _inpd and _outpd, both of which will result in an 0xc000096 exception (STATUS_PRIVILEGED_INSTRUCTION). I (initially) patched the gpib-32.dll library so that there is simply a ret instruction in the respective thunk functions, preventing any crashes.

Configure SMUs

I next had to use KCON to discover the SMUs and save them to the configuration. This involved opening KCONClient in field service mode, by running KCONClient.exe /fieldservice, and entering KIFS as the password when prompted.

Click scan system in the top menu bar, and then click save configuration when this completes. It is important to note that verifying the configuration will not work due to a lack of PCI trigger module.

And that is everything needed to fully install and configure Clarius a 4200(A)-SCS.

Using the LPTlib

Keithley provides an accompanying Linear Parametric Test Library (LPTlib) (Library Reference). This is a relatively low-level library that provides full control of the SMUs and other instruments - perfect for my uses.

First I installed a C++ Compiler - (VS 2010 Ultimate), and configured it to find the LPTlib headers and link against the LPTlib library files.

First tests

Well, the 4200 should now be in a position where we can test out the SMUs. Let’s use the LPTlib to run some simple tests:

Firstly, setting all the SMUs to 10V, and reading back the voltage.

extern "C" {
#include "lptdef.h"
}

int _tmain(int argc, _TCHAR* argv[])
{
    tstsel(1);
    devint();

    double v;

    for (int i = SMU1; i <= SMU4; i+=2){
        forcev(i, 1);
        measv(i, &v);
        std::cout << "SMU" << (i-SMU1)/2+1 << " " << v << std::endl;
    }

    devint();
    return 0;
}

Output:

SMU1 10.0006
SMU2 10.0007
SMU3 10.0001
SMU4 10.0001

Nice - all four SMUs seem to be working well!

How about a voltage sweep on SMU1 (albeit with not DUT):

extern "C" {
#include "lptdef.h"
}

#define STEPS 20

int _tmain(int argc, _TCHAR* argv[])
{
    tstsel(1);
    devint();

    double v[STEPS+1];
    double vset[STEPS+1];
    double i[STEPS+1];

    smeasv(SMU1, v); // Measure SMU1 Voltage throughout sweep
    smeasi(SMU1, i); // Measure SMU1 Current throughout sweep
    rtfary(vset);    // Measure forced voltage throughout sweep
    sweepv(SMU1, 0.0, 35, STEPS, 0.01); // perform sweep (0 -> 35V, 20 steps, 10ms delay time)
    forcev(SMU1,0);

    for (int n = 0; n < STEPS; ++n){
        std::cout << "VSET: " << vset[n]
                  << "\tVMEAS: " << v[n]
                  << "\tIMEAS: " << i[n]
                  << std::endl;
    }
    devint();
    return 0;
}

Output:

VSET: 0         VMEAS: -7.29829e-005    IMEAS: 2.81535e-012
VSET: 1.75      VMEAS: 1.74988          IMEAS: 1.91657e-011
VSET: 3.5       VMEAS: 3.49979          IMEAS: 3.13233e-011
VSET: 5.25      VMEAS: 5.25041          IMEAS: 3.04849e-011
VSET: 7         VMEAS: 6.99992          IMEAS: 3.46767e-011
VSET: 8.75      VMEAS: 8.75002          IMEAS: 3.92892e-011
VSET: 10.5      VMEAS: 10.501           IMEAS: 5.061e-011
VSET: 12.25     VMEAS: 12.2513          IMEAS: 5.01892e-011
VSET: 14        VMEAS: 14.0005          IMEAS: 5.06096e-011
VSET: 15.75     VMEAS: 15.7485          IMEAS: 5.01892e-011
VSET: 17.5      VMEAS: 17.4998          IMEAS: 4.97727e-011
VSET: 19.25     VMEAS: 19.2492          IMEAS: 5.31259e-011
VSET: 21        VMEAS: 20.9999          IMEAS: 5.5641e-011
VSET: 22.75     VMEAS: 22.7539          IMEAS: 6.90555e-011
VSET: 24.5      VMEAS: 24.4984          IMEAS: 7.07362e-011
VSET: 26.25     VMEAS: 26.2543          IMEAS: 6.98935e-011
VSET: 28        VMEAS: 27.9994          IMEAS: 8.12154e-011
VSET: 29.75     VMEAS: 29.7576          IMEAS: 7.99564e-011
VSET: 31.5      VMEAS: 31.5027          IMEAS: 7.99588e-011
VSET: 33.25     VMEAS: 33.2469          IMEAS: 8.79189e-011

Even though I have not autocalibrated any of the SMUs, the results do seem to be in line with what I would expect. There does seem to be a small leakage current - this is to be expected. I am also not yet testing the 200V range.

LPTlib Python binding

AutomatisierungsTechnik-Voigt-GmbH have written a very good Python binding for the 4200 LPT library, if somewhat incomplete. You will need to install Python 3.8 as this is the last supported 32 bit version of Python. Installing packages like matplotlib and its dependencies is a pain given that wheels are rarely provided for 32 bit packages anymore - I suggest using older package versions that provide wheels.

https://github.com/AutomatisierungsTechnik-Voigt-GmbH/AtvK4200Lpt

What next?

All four SMUs are in a functional state but until I acquire the necessary cables to connect DUTs I can’t really do too much more.

The original cables provided were the 4200-MTRX-X triax cables, however are prohibitively expensive and are also virtually impossible to find on the used market.

I am considering making the cables myself - The required connector appears to be a LEMO FFC.00.650.CLAC35, and the original triax cable is Keithley’s ultra low noise SC-181.

I have also started to take a closer look at the SMU modules, as well as analyzing the firmware, so stay tuned for a sequel!

Feel free to email me if you have any questions/comments, I would love to hear from you!

Nov 2023 Update

I was very kindly provided with a full copy of KTEI 9.1 from a reader which I am now using. With some more software finangling, all the hardware (inc. Trigger Master Card) now works!

Everything I have written about Clarius is now superfluous, however I am far too lazy to change it all!

Dec 2023 Update - Cables & Measurements

Constructing DUT cables

Unfortunately the 4200-SCS didn’t come with any cables, and as I could not find any for sale I was left with no choice but to make my own. Two connector types are used on the instrument - Lemo’s FFC.00.650.CLAC35 miniature triaxial connectors for the SMUs, and a standard 3 lug triaxial (TRB) connector (e.g. Trompeter PL75 series) for the ground unit.

I also needed the correct triax cable, however I was unable to find anything a) in a reasonable length b) at a reasonable price, or c) in stock. Just in case you are not aware, a triax cable has are three conductors - Force, Guard (buffered to same voltage as Force), and the shield (common). Since the force and the guard are at the same potential, virtually no leakage current will flow. (This is a pretty poor explanation, take a look at Keithley’s Low Level Measurements Handbook for more info - well worth a read!)

I decided that I would have to make do with Coax cable for now until I could find the necessary triax cable. To make my life easy, I decided to just reterminate some rather cheap kelvin test lead sets which were terminated with BNC connectors.

Of course, two is less than three [citation needed], and I had to decide whether to connect the guard or common to the shield on the coax. Safety is an important consideration, as the guard will reach the same (up to 200V) potentials, meaning that it must not be exposed. Since the shield is not exposed anywhere on the test lead itself, I decided that it is safe to connect the guard to the shield on the coax. This would have the benefit of allowing lower current measurements due to the lower leakage currents. I am also not sure how this affects the noise compared to the shield connected to common instead, but is certainly better than leaving the shield disconnected.

There is also the question of whether to use full kelvin connections - I decided against it for now, given their limited use at low currents, and would also require more connectors (£££)!

I therefore decided to just order two of each of the two types of connector, just as a sort of first test (around £50 for the connectors, and believe me, those test leads are cheap).

PL75-7

This is the necessary connector for the ground unit, and was actually very simple to assemble (especially for it being my first), and helpful instructions were also provided. Since the diameter of the shield on the coax cable was the same as the connector’s expected size of the inner shield assembly was a breeze.

I took extreme care not to touch the dielectrics, and also minimizing flux residues.

FFC.00.650.CLAC35

This is where things get a little nasty. I was expecting the connector to be small, but it was way smaller than I was expecting. I also couln’t find the appropriate assembly instructions for the connector with the triaxial (650) insert - not that I would be following it anyway with my coax cable.

I therefore decided to just solder the connector as best as I could, knowing that it wouldn’t be perfect. After assembling it, I tested to make sure there were no shorts, and thankfully there weren’t (albeit only tested up to a resistance of about 10M - it is possible for there to be some relatively significant leakage currents). Again, these cables are really only for testing, so I wasn’t too worried.

Connections

Connection to SMU

Connection to Ground Unit

Testing for leakage

I first wanted to see what current the SMU reported with not DUT connected. To also isolate the force and (unconnected) sense of the lead, I just (somewhat naively) clamped the connectors onto the label on a plastic bag as shown:

I then biased the SMU to 20V¹, and was quite suprised to see the reported current to be on the order of 2.5e-9A - I was expecting something lower! I then unclipped the connectors from the bag, and saw the current drop down to a fairly consistent 30e-12A. I was indeed just measuring the resistance across the label (8 Gigaohms, as it turns out!²). I was also quite happy with the new given leakage current given that without the test lead the SMU reported a very consistent 12e-12A (within spec, and not too bad given it’s been more than 13 years since last cal).

So the cables seem to work “okayish” - especially given the price.

2 Terminal Devices

Zener diodes

I connected various valued zener diodes (anode to SMU1, cathode to GNDU), and ran a linear current sweep from 100mA to -100mA at 0.5mA increments (421 points).

We can see that for the 4.7V diode the zener effect is causing the breakdown, whereas for the other diodes the avalanche breakdown is dominant (this is the case above around 5V).

Varying temperature

I also tested the 4.7V zener diode again at a temperature of around 250 degrees celcius!³ We can see the zener voltage drops slightly.

LEDs

How about some LEDs?⁴ Feel free to switch between linear and log y-scales.

At 10mA, the forward voltage of the blue LED is around 0.8V higher!

Low current devices

We can also use the SMUs as simple voltage sources and (very accurately) measure current. How about measuring the current draw of a Casio fx-83GT Plus that I found in a drawer?

Casio claims an active power consumption of around 200uW, or 133uA.

3 Terminal devices

NPN BJT

Below is an I-V plot for the collector of a BC337 NPN transistor, at varying base currents. (P.S. you can zoom in!)

Hope you enjoyed reading this, as always feel free to email me with questions/suggestions/anything else!

Addendum A - Extra software tool unlocking

There were also some other provided tools, some of which were .NET, which meant I could easily decompile/debug these binaries. Below are the most interesting ones.

hwdiag.exe

The first tool that looked interesting to me was hwdiag.exe - presumably a tool for hardware diagnostics. It is however password protected!

No problemo - a quick look into the source revealed that the password is hashed (sha256) and checked against 3e0dc1a97230493b269814eca42f1ab75aa2c5ce4cf9f8eadb6f3f7ffcee161d. Instead of wasting my time educated guessing/cracking, I simply patched the CIL instruction that checks if the hashes match.

We should now be able to use any password, and bingo, we’re in!

SMU calibration can be done in the “SMU Registers” tab:

KCONclient.exe “admin” modes

There are also three KCONclient “admin” modes - the name must be passed as an argument to KCONclient.exe and the respective passwords are also shown:

For example, kconclient.exe /systemtest, and entering KIST on the following prompt:

Below is KCON running in one of these modes: notice the “scan system” button.

FWUpgrade.exe

/j enables engineering mode, which seems to bypass checking whether the firmware upgrade is actually possible.

Addendum 2 - Easter eggs

It seems the engineers left some sort of motif throughout the instrument & software - perhaps a reference to some sort of charge trapping?

Photo of it on the (somewhat dusty) mainboard:

It also makes an appearance in HwDiag (as a tiled background) so was clearly only for the amusement of the employees working on it! This was later removed from HwDiag with the introduction of Clarius, being replaced with a more generic corporate background.

Addendum 3

And if you are for some reason disappointed by a lack of SMU related content, then I have good news for you! - so stay tuned!