It is not uncommon to have “easter eggs” in electronic equipment with complex firmwares.
Often hidden functions are implemented for debug and development purposes, but sometimes just for run too.
Firmware engineers are human beings too, after all. In article below some of secret functions of Keithley test equipment are covered.

Feel free to try these on your gear, but do remember that information provided here is “AS IS” and no warranty provided by vendor or any other 3rd party. For example, changing Model ID on Keithley 24xx SourceMeter units cause permanent loss of calibration data. Obvious culprits are noted in this article, but something can be lost still.

Let’s get started.

Overview of how key pressing works when powering the meter (K2000, K2010 and alike).

Communication between main/digital board (MB) and front panel (FP) is done via simple UART, 9600 bps. Around 2.168 ms after reset line from MB become high, FP reads buttons state connected to PA3 MCU pin. This state is saved and then transmitted as part of FP identification message that FP sends as response for 0×0F command.

Here are such messages for K2001-style and K2000-style front panels respectively.

{'2', '0', '0', 'x', '/', '7', '0', '0', 'x', ' ', 'A', '0', '2', ' ', ' ', 0x80, 0x00}
{'2', '0', '0', '0', ' ', 'A', '0', '2', ' ', ' ', 0x80, 0x00}

Byte 0×80 near the end contains info about buttons. 0×80 – no buttons pressed. Other number represent sum of codes of buttons pressed – 7 bits available for
7 buttons.

Here is the table of button location for different units (according to schematics).

MCU pin	Single button code	K2000/K2010	K2001/K2002	K7001
PB0	0×81 = 0×80 + 0×01	N/A	CAL	LEFT
PB1	0×82 = 0×80 + 0×02	OPEN	FREQ	6
BP2	0×84 = 0×80 + 0×04	CLOSE	MATH	2
PB3	0×88 = 0×80 + 0×08	STEP	CONFIG	EXIT
PB4	0×90 = 0×80 + 0×10	SCAN	DCI	OPEN
PB5	0xa0 = 0×80 + 0×20	DIGITS	TRIG	STORE
PB6	0xc0 = 0×80 + 0×40	RATE	INFO	CLEAR LIST

Thus, pressing MATH + FREQ gives magic code 0×86. K2001-style panel used in other units such as K2400, K6517, … so buttons are on their places but with their own names.

Button actions for K2010, K2182 multimeter and similar single-line VFD display platform units.

Code	Button	Action
0×82	OPEN	BUILT-IN and DIAG menu appear in TEST menu as they are in K2000, providing more tools for meter debugging and validation
0×84	CLOSE	Interactive mapping between all symbols that front panel can display and their hex codes
0×88	STEP	Temporarily loads default calibration constants, after reset meter loads as usual. Display will show “DEFAULT CAL”
0×90	SCAN	Loads DIAG menu immediately
0xa0	DIGITS	Displays all VFD symbols like during the start, waits for EXIT key to continue (also seen that if meter is turned off, all-on segments are still there after turning it on again if EXIT wasn’t pressed before …)
0xc2	OPEN + RATE	WARNING !!! Resets calibration constants to default ones, i.e. effectively erases all calibration data. That is irreversible action and there is no any confirmation before that, meter will just display “DEFCAL SAVED”

Button actions for K2001, K2002 multimeters and similar with DUAL line VFD display.

Code	Button	Action
0×81	CAL	Enable low-level factory calibration
0×82	FREQ	Display advertisement message – meter capabilities, in English
0×84	MATH	Display advertisement message – meter capabilities, in French
0×86	MATH + FREQ	Enable secret menu
0×88	CONFIG	Display advertisement message – meter capabilities, in German
0×90	DCI	??? Maybe something related to scan card
0xa2	TRIG + FREQ	Shows design team

Now simple user representation of same information:

Keithley Model 2001 DMM (Axx firmware versions)

This 7½ multimeter features dual line dot matrix VFD. This kind of display is handy for displaying lots of text data.

1. Ensure unit is powered off.
2. Press and hold button "FREQ" and button "MATH" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Firmware versions with “A” index are more constrained in size due to only single 4Mbit ROM chip being used on digital board. It is a PLCC32 package 27C4096, located in socket near CPU. Here is information based on latest A08 version.

Secret menu have next items:

Menu item	Detail	Default	Note
BKGD-DLY	Background delay	5	unknown effect
SIGNAL-DLY	Signal delay	5	unknown effect
CREDITS	Lists software team developers
SCANNER	Override scan card detection	No	Unlocks scanner card functions even without actual card present
INIT-BB-RAM	Initialize BB-RAM		Initialize option battery-backed NVRAM to operation data
COMP-CAL	Skip AC in comprehensive calibration	No

Init BB-RAM is a easy option to update memory options with replaced DALLAS NVRAM.
Before upgrade procedure was covered in article here which required use of ROM program tool.

Also when secret mode is enabled, there is extra 8½ resolution setting available in DCV function mode.
But its more for demo purposes, as 2001 analog board/ADC does not really provide necessary noise and linearity performance for real 8½ digit meters.
Software team using same digital board to develop functions for both 2001 and 2002 multi-meters, and were working on 2002 firmware even before actual 2002 analog hardware was available.

8½ mode is also available to use if use GPIB command 8.5;. By GPIB it’s possible to set ACV, DCI, ACV, 2wire Ohms, 4wire Ohms to higher 8½ resolution mode as well, by same :DIG 8.5; operand in
mode selection command, while front panel secret menu allows this only on DCV function.

Keithley Model 2001 DMM (Bxx firmware versions)

“B” version firmware is using larger ROM size, since it’s split between two ICs for odd and even bytes. One of ours 2001’s have digital board revision K, which have this configuration and using two ST M27C4001 DIP32 UV-erasable EPROM.

Here’s secret menu options with firmware version B15, kindly provided by one of Keithley Model 2001 owners.

Entrance is same as A-version 2001:

1. Ensure unit is powered off.
2. Press and hold button "FREQ" and button "MATH" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Ignore error codes, these are due to wrong calibration data in I2C EEPROM, since unit in video is under repair. Normal 2001 will not
have any error codes while entering secret mode.

Menu item	Detail	Default	Note
MESSAGES	Hidden messages submenu		Entry to show credit messages in english/french/german and game
INIT-OPTIONS	Initialize EEPROMs for option cards
FREEZE	Freeze display	Off	Turning this on causes the PREV button to freeze display
OPTION	Override installed addon card detection		Enable meter to init EEPROM on option cards
AC-CAL	Skip AC in comprehensive calibration		Allow manually view and change some of cal data, offsets/gains

MSGS Item	Detail	Note
CREDIT	Shows The Design Team: credits	Lists all team members who work on Model 2001. ~30 seconds
ENGLISH	Listing features and capabilities	English language demo mode (likely used for trade shows, ~2min)
FRENCH	Listing features and capabilities	French language demo mode ~ 2 minutes
GERMAN	Listing features and capabilities	German language demo mode ~ 2 minutes
GAME	Easter egg: game?	Entering this submenu on B15 firmware does nothing :)

Also when secret mode is enabled, there is extra 8½ resolution setting available in DCV function mode, same as with A-version firmware.

Keithley Model 2002 DMM

Model 2002 have similar menu like 2001, but with more settings and more easter eggs in it.
This flagship Keithley DMM was designed with main competitor in mind, HP 3458A. It also have compatibility mode for GPIB interface,
so existing software could interface 2002 using 3458A SCPI commands.

Unlocking hidden menu is same as Model 2001:

1. Ensure unit is powered off.
2. Press and hold button "FREQ" and button "MATH" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Here is video overview of all items:

Menu item	Detail	Default	Note
MSGS	Hidden messages submenu		Entry to show credit messages in english/french/german and eggs
INIT-OPTS	Initialize EEPROMs for option cards
OPTION	Override installed addon card detection
RAW-DISP	Display measurements in ADC counts		Shows counters data for ADC operation in various modes
CAL-CONSTS	Setting offset and gains for DCV/Ohms		Allow manually view and change some of cal data, offsets/gains
SKIP-AC-CAL	Skip AC in comprehensive calibration
BKGD-AV	Background averaging function	Enabled	Some digital filter, perhaps?

Here details of second-level submenus:

MSGS Item	Detail	Note
CREDIT	Shows The Design Team: credits	Lists all team members who work on Model 2002. ~30 seconds
ENGLISH	Listing features and capabilities	English language demo mode (likely used for trade shows, ~2min)
FRENCH	Listing features and capabilities	French language demo mode ~ 2 minutes
GERMAN	Listing features and capabilities	German language demo mode ~ 2 minutes
HP-KILLER	Easter egg: 2002 eating 3548 digits	2002 number are coming and eating 3548, funny demo :)
HP-SHOOTER	Easter egg: 2002 shoots 3548 digits	2002 shooting rockets to 3548, killing one digit every time :)

INIT-OPTS	Detail	Note
BB-RAM	Initialize BB-RAM	Prepares DALLAS NVRAM to enable MEMx option installation
PREAMP	Initialize EEPROM on PREAMP	PREAMP option card module EEPROM initialize? Changes scan functions to PREAMP
PHASE	Initialize EEPROM on PHASE	PHASE measurement card module EEPROM initialize? Changes scan functions to PHASE
TC-OHMS	Initialize EEPROM on TC-OHMs	TC-OHMS option card module EEPROM initialize? Changes scan functions to TC-OHMS

—-

Keithley have Preamp option for 2001 and 2002, called Model 1801, and likely internal phase and TC-OHMs (thermo compensated ohms mode?) cards on modules which can fit Model 2002 in scanner card slot. Not sure last two do, but since enabling these options via secret menu changes scanner control functions and menus to related hidden menus, it’s the guess.

Preamp Keithley Model 1801 enhances low-side range measurement capability of 2001/2002 DMMs. There is scarce information available about it, just a brief sheet. According to which, preamp is designed to connect with DMM via option slot, instead of scanner card. According to datasheet, option card features just low-noise power supply to external Model 1801 nanovolt preamp module.
Gain with preamp module is 1000 on 2 mV range, 10000 on 200 uV range and 100000 on 20 uV range.
DMM with preamp option have only next ranges available:

DCV	20uV, 200uV, 2mV, no peak measurements, resolution down to 1 pV, Noise min 0.6 nV p-p, 1GOhm impedance
ACV	500uV RMS low-frequency, no normal RMS/Peak/Crest factor measurements, resolution down to 100pV
4W Ohms	2 mOhm, 20 mOhm, 200 mOhm, 2 Ohm, 20 Ohm, 200 Ohm, resolution down to 100 pOhm, 9.2 mA current source, 5V
Frequency	1 Hz to 1000 Hz, 5 digits resolution, 400uV p-p minimum signal level
Temperature	Thermocouple or uV/°C value, resolution 0.0001 °C)

PREAMP configuration:

PREAMP CONFIG	Detail	Note
CONTROL	PREAMP CONTROL: Enable or disable	Enable changes available ranges to those available with preamp
FILTER	Selects between filter speed of preamp	Available options Slow/Medium/Fast
CALIBRATION	Initialize meter calibration constants	Reads preamp calibration data and calibrate DMM to use them
TC-OHMS	Initialize EEPROM on TC-OHMs

Phase card is another option. Google knows nothing about this item.

PHASE configuration:

PHASE CONFIG	Detail
CONTROL	Phase measurement control: Enable or disable
SPEED	Measurement speed setting, like normal DMM functions in NPLC
FILTER	Filtering options, just like normal DMM functions
CHANNEL	Select phase options for signal or reference
SCALE	Setting phase scale between +-180 or 0-360 degree
UNITS	Setting degrees, radians or grads for phase unit
REF-RES	Setting reference resistance, in ohms
CAL	Calibrate phase reading

TC-OHM did not change either settings, but I did not check every option yet.

—-

Back to Secret menu, Options submenu:

OPTIONS	Detail
NONE	No option override, detect by HW
SCANNER	Scanner card option override
PREAMP	Preamp card option override
PHASE	Phase measurement option override
TC-Ohm	Override option detect to TC-Ohm

Keithley Model 24xx series SourceMeter

On 2400 series SMUs entering mode is using same buttons:

1. Ensure unit is powered off.
2. Press and hold gray button "^" and button "SWEEP" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Here are hidden menu items on Model 2400 with firmware C32:

Menu item	Detail	Default	Note
MODEL#	Override model ID		Allow to force ID to 2400/2410/2420/2430/2426/xxxx. Warning! Calibration will be LOST!
FB-BURN-IN	Burn-in all VFD pixels
DIGITAL-REV	Write digital board revision ID into ROM		Stores digital board revision in calibration ROM
ANALOG-REV	Write analog board revision ID into ROM		Stores digital board revision in calibration ROM
CONTACT	Enable contact option 24xx-C(need hw)		Allow to enable CONTACT option hardware

Of course, changing MODEL ID will not make SMU working with other ranges, since analog boards on different models within 24xx series are physically different.
This function is in firmware to allow developers test and use same digital board and same firmware, while connected to different analog boards.
Do not change Model# if you don’t have calibration-grade DMM available! Calibration data will be permamently lost!

Keithley Model 2510/2510-AT

1. Ensure unit is powered off.
2. Press and hold gray button "T" and button "CONFIG" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Hidden menu items on Model 2510 with firmware A11:

Menu item	Detail	Default	Note
FB-BURN-IN	Burn-in all VFD pixels
BOARD-REV	Write board revision ID into ROM		Stores board revision in calibration ROM
AUTOTUNE	Enable/disable autotune option		Allow to select between 2510 or 2510-AT Model SMU

Keithley Model 6517A Electrometer

This unit does have secret menu as well, but since don’t have one (just yet?) unable to make video for it. Secret mode is also required to enable access to meter’s full diagnostics and calibration menus.

1. Ensure unit is powered off.
2. Press and hold button "SEQ" and button "Voltage source DOWN" and power on unit
3. Secret menu available now in MENU/GENERAL/SECRET
4. After power down unit enters normal operation mode as usual.

Firmware code C05 for 6517A“http://doc.xdevs.com/article/keithley-instruments/ does have neccessary strings for secret stuff:

00085BA0                               SECR
00085BC0   ET CAL MENU  yBB-RAM   5156 INIT
00085BE0   IALIZE OPTIONS  NONE   6521   65
00085C00   22   5156 OPTION INSTALLED   y  
00085C20   HP-SHOOTER yCREDIT  ENGLISH  FRE
00085C40   NCH  GERMAN  yHIDDEN MESSAGES   
00085C60   BKGD-AVG  DISP-BURN-IN  DQ-CAP y
00085C80   MSGS OPTION INIT-OPT CAL-STUFF  
00085CA0    ySECRET MENU

And actual menu tree:

Menu item	Detail	Default	Note
MSGS	Hidden messages submenu		Entry to show credit messages in english/french/german and eggs
OPTION	Override installed addon card detection		Force installed option (None / 6521 / 6522 / 5156)
INIT-OPTS	Initialize EEPROMs for option cards		Initialize NVRAM or 5156 calibration option ROM
CAL-STUFF	Various calibration items		Allow manually view/change cal data, calculate cal data, reset
BKGD-AVG	Background averaging function	Enabled	Some digital filter, perhaps? Can be either ON or OFF
DISP-BURN-IN	Burn-in all VFD pixels
DQ_CAP	Use DQ capacitor?		Can be enabled or disabled

Here details of second-level submenus:

MSGS Item	Detail	Note
CREDIT	Shows The Design Team: credits	Lists all team members who work on Model 6517. ~30 seconds
ENGLISH	Listing features and capabilities	English language demo mode (likely used for trade shows, ~2min)
FRENCH	Listing features and capabilities	French language demo mode ~ 2 minutes
GERMAN	Listing features and capabilities	German language demo mode ~ 2 minutes
HP-SHOOTER	Easter egg: 6517 shoots 4339 digits	6517 shooting rockets to 4339, killing one digit every time :)

INIT-OPTS	Detail	Note
BB-RAM	Initialize BB-RAM (NVRAM)	Prepares DALLAS NVRAM to enable MEMx option installation
5156	Initialize EEPROM on 5156	Initialize 5156 calibration module EEPROM

CAL-STUFF	Detail	Note
CONSTANTS	View calibration constants
PROCEDURES	Calibration procedures?
CALC&SAVE	Calculate calibration date and save
FACTORY	Reset data to factory state
RESTORE-ALL-DEFAULTS	Revert back to default data

5156 Option is a calibration box with precision characterized resistances and capacitor.

Keithley Model 6517B Electrometer

Menu item	Detail	Default	Note
FB-BURN-IN	Burn-in all VFD pixels
ANALOG-REV	Write digital board revision ID into ROM		Stores digital board revision in calibration ROM
DIGITAL-REV	Write analog board revision ID into ROM		Stores digital board revision in calibration ROM

Keithley Model 7001/7002 switching frame

Switching frame Model 7001 have just credits information display.
To enter this mode do next

1. Ensure unit is powered off.
2. Press and hold button "6" and button "STORE" and power on unit
3. Enjoy credits information with developer team names listed
4. After showing all names, unit enters normal operation mode automatically

Model 7002 also have shooting game using switch LEDs and light pen, but since we don’t have this unit cannot give exact details on it.
Entrance to hidden mode should be same, hold buttons “6” and “STORE” on power on.

Keithley 2010/2182/2182A service mode

There is also some additional hidden modes available in Keithley instruments with single-line VFD screens.

On Keithley 2010 manufacturing calibration mode is activated by holding OPEN button while powering meter up. When meter booted in this mode full self-test diagnostics and debug menu are now available under SHIFT-TEST key combination. This is very handy for repairing old 2010 as sanity check of meters operation.

That’s if for now, if anyone have more details regarding Keithley gear, feel free to share via email (team[doggy]xdevs.com) or
on EEVBlog forums here