But looking at a hex dump of B17 firmware there is plenty of space left and the BUILT-IN tests are there, all the plain text strings anyway. There also appears to be two menus for the TEST button. One with just TEST: DISP and TEST: KEY and another with TEST:BUILT-IN, TEST: DIAG, TEST: DISP, and TEST: KEY

So, how do we enable these diagnostic functions? Is there some secret key combination or remote SCPI command?
