EEVblog Electronics Community Forum

Electronics => Projects, Designs, and Technical Stuff => Topic started by: gnif on February 22, 2013, 08:17:09 am

Title: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on February 22, 2013, 08:17:09 am
Hi All,

Update: It has been confirmed that the U1732C LCR meter can be upgraded to a U1733C also!

I am opening this here as it is a more appropriate place to discuss this, please see the following message for the history of this:
https://www.eevblog.com/forum/buysellwanted/ex-demo-agilent-u1241's-for-sale-in-oz/msg194648/#msg194648 (https://www.eevblog.com/forum/buysellwanted/ex-demo-agilent-u1241's-for-sale-in-oz/msg194648/#msg194648)

A quick synopsis:

The U1241A has a Atmel I2C EEPROM in it, that when the SCL and SDA lines are shorted on power up, the meter upgrades into a U1242A, as such I have just managed to dump the EEPROM and I am now proceeding to try to upgrade the thing :).

If anyone has a U1242A and is inclined to crack it open, it would be great if you could dump the EEPROM contents to make it easier to figure out how to upgrade this thing.

EDIT: This will also work for the U1241B as it is functionally identical.
Title: Re: Agilent U1241A to U1242A hack
Post by: gnif on February 22, 2013, 12:41:23 pm
I found it! I have all the features of the U1242A in my U1241A now!

Change byte 0x1e5 from 0x01 to 0x02!

This enables:
  J type Thermocouple
  AC Harmonic Ratio Measurement
  T2 Temerature Measurement
  T1-T2 Temperature Delta Measurement
  Scanning Temperature Measurement
  Data Logging
 

Edit: It might be just me, but it seems that the continuity tester is much faster to latch now also.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: Lightages on February 22, 2013, 11:27:47 pm
Interesting find. Personally I find it curious that the U1241B exists at all. It costs $206 retail at one online retailer and the U1242B costs only $226, less than 10% difference.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 23, 2013, 01:09:38 am
Agreed, but it makes me wonder how many other higher priced meters can be upgraded to their more expensive models which do have a larger price gap.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: EEVblog on February 23, 2013, 01:12:06 am
Nice find!

Dave.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: BravoV on February 23, 2013, 05:01:52 am
Thank you ! Great finding !  :-+

Mind share the process how did you manage to find it ? If you don't mind of course.

Curious if this hack applicable to "B" version as well.

Now, the fun part, stalking great deal or bargain on NOS U1241.  :-DD
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 23, 2013, 08:24:15 am
Thanks,

The B model is just a colour change according to the manuals, the website and the spec sheets, so it should work on it just fine also. If you are worried you can obtain a 2nd hand A model from Trio here (http://www.triosmartcal.com.au/1164-agilent-u1241a.html). This is why I bothered to try to enable these features because I got the cheaper meter and the price difference wasn't just $20-30 for me, it was over $100.

The process was pretty simple, I did a tear down to inspect it and comment on its build on this forum. I noted that others had upgraded the firmware in other Agilent devices to fix firmware bugs, so I kept an eye out for an EEPROM when I had it apart. There was only one there, so as a quick and simple test, I shorted out the i2c lines to prevent the micro talking to it on start up, which presented an error, but was still functional. Checking the setup menu I found I had the additional options to configure, and all the other values were set to FF or FFFF, etc.. so the micro defaults values to FFFF when it cant read the EEPROM.

I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

Since I knew that 0xFF was a good value to set to enable these features I started out by setting portions of the data to all 0xFF, powering on the meter and checking if it had the additional features.  If it didn't work, I reversed it, and tried another area, until it did work. Then I just repeated the process until I found the exact byte to change, and experimented with it's value.

A word of caution if you attempt this in any meter, make your EEPROM read only by pulling the write protect pin high before you start to be 100% sure you back up its contents before altering them, as the EEPROM also contains all the calibration data for your meter, and changing it will cause your meter to read things incorrectly.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: fcb on February 23, 2013, 03:11:00 pm
somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 23, 2013, 03:50:34 pm
If they do it will only affect new units, as these are a OTP device.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: vl400 on February 24, 2013, 04:45:38 am
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 24, 2013, 05:19:04 am
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

You are most welcome, it is awesome to know that it is not just applicable to my meter. If you let me know the byte to change and what to I will update the first post. I will now also re-title this thread as it seems that there might be quite a few that this can be done to.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: EEVblog on February 24, 2013, 07:26:32 am
Probably a similar thing on the 1250 series 1270 series too!
But there is not a big difference in the price between the two models in each of these groups anyway.
Dave.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: BravoV on February 24, 2013, 08:06:44 am
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

Wow, is that the same address and value ?
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 24, 2013, 08:23:31 am
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

Wow, is that the same address and value ?

From what he said I would suspect that he is just shorting the SCA and SDL lines to see if it will upgrade, that is why he said he just needs to update the EEPROM now.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: ttp on February 24, 2013, 10:39:19 am
I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

This is quite interesting. How do you connect STM32 board to talk to EEPROM, I guess you don't remove/unsolder the EEPROM form original circuit?
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: gnif on February 24, 2013, 11:40:27 am
I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

This is quite interesting. How do you connect STM32 board to talk to EEPROM, I guess you don't remove/unsolder the EEPROM form original circuit?

The device is an i2c EEPROM, so I just used the hardware I2C controller in the STM32 I had handy at the time, it would be much easier to do this with a bus pirate or similar, but I do not have one. And yes, I left it in circuit, but provided a 3.3v source and the 2x 4.7k resistors to pull high the bus lines as per i2c spec. I soldered directly onto the chip's pins using wire wrap.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: TRIO_Smartcal on February 24, 2013, 10:20:29 pm
Have a look at these.  Ex-stock off our website.

http://triosmartcal.com.au/1687-total-phase-aardvarkt-iscspi-host-adapter-tp240141.html (http://triosmartcal.com.au/1687-total-phase-aardvarkt-iscspi-host-adapter-tp240141.html)

http://triosmartcal.com.au/1004-total-phase-beagle-iscspimdio-protocol-analyzer-tp320121.html (http://triosmartcal.com.au/1004-total-phase-beagle-iscspimdio-protocol-analyzer-tp320121.html)

Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on February 25, 2013, 05:42:17 am
From what he said I would suspect that he is just shorting the SCA and SDL lines to see if it will upgrade, that is why he said he just needs to update the EEPROM now.

Correct, only stopped the processor from reading the I2C to see if it responded the same which it did. For now am just probing the signals, it does 2 blocks of data on boot to grab a heap of data. The write enable pin is tied to ground, address lines are also all tied to ground.
Title: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: ddavidebor on February 25, 2013, 06:10:11 am
Where you have bought that probes?
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on February 25, 2013, 06:25:55 am
And success for the model, address 0x0A is 0x01 in a 1732C. Change to 0x00 for U1733C or downgrade to U1731C by setting to 0x02. However..... this allows 100KHz to be selected but does not provide a 100KHz measurement.


Where you have bought that probes?
They came with a logic analyser

Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on February 25, 2013, 10:22:02 am
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on February 25, 2013, 01:04:43 pm
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.

The additional features are most certainly usable, but I have not yet (aka, don't know how to) test the AC harmonic ratio measurement, data logging works fine though as does the temperate delta measurement.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: IanB on February 25, 2013, 03:29:25 pm
somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....

I don't think Agilent needs to worry. The skill, knowledge and tools to do this are beyond the ability and motivation of 99.99% of purchasers. They are not going to lose sales over it.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on March 15, 2013, 03:30:49 am
As seen on Hack A Day!

http://hackaday.com/2013/03/14/eeprom-hack-unlocks-crippled-features-in-agilent-multimeter-and-lcr-meter/ (http://hackaday.com/2013/03/14/eeprom-hack-unlocks-crippled-features-in-agilent-multimeter-and-lcr-meter/)
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: BravoV on March 15, 2013, 04:48:51 am
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.
Any new progress on the 100Khz feature ? I got an offer locally for a U1732C bout $250 in pristine condition.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: logic on March 15, 2013, 04:52:56 am
As seen on Hack A Day!

http://hackaday.com/2013/03/14/eeprom-hack-unlocks-crippled-features-in-agilent-multimeter-and-lcr-meter/ (http://hackaday.com/2013/03/14/eeprom-hack-unlocks-crippled-features-in-agilent-multimeter-and-lcr-meter/)

That's how I found this thread.  Great Find!

Patrick
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: Technics on March 15, 2013, 07:19:51 am
I asked this over on HAD. Have you checked that the extra ranges have been calibrated? I would imagine calibration of each range is done in the factory and stored in the EEPROM. I don't imagine they calibrate ranges that aren't enabled. It would be good to check EEPROM images of several meters. If all ranges are calibrated then it's a good find.  :-+
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on March 15, 2013, 07:35:36 am
I asked this over on HAD. Have you checked that the extra ranges have been calibrated? I would imagine calibration of each range is done in the factory and stored in the EEPROM. I don't imagine they calibrate ranges that aren't enabled. It would be good to check EEPROM images of several meters. If all ranges are calibrated then it's a good find.  :-+

This does not enable additional ranges, just features such as data logging. Also this meter supports calibration via the menus, so if you have the standards you could calibrate it yourself anyway.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: Teemo on March 15, 2013, 09:14:39 am
All this good info certainly brought the Agilent meters to my attention. And made me think about puchasing one... This is somehow compelling to know that it is possible to activate some hidden features :). To make thing to do what it was not supposed to do.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on March 15, 2013, 09:37:32 am
Have not done anything else with the U1732C to U1733C mod, it still thinks its a 33 but does nothing in 100KHz mode. If someone has a 31 that they can get an EEPROM dump from, or even better a 33, would make it much easier than randomly changing bytes.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on March 15, 2013, 11:06:45 pm
Have not done anything else with the U1732C to U1733C mod, it still thinks its a 33 but does nothing in 100KHz mode. If someone has a 31 that they can get an EEPROM dump from, or even better a 33, would make it much easier than randomly changing bytes.

For those that may be worried about copyright infringement by posting such a dump should not be concerned, the EEPROM only contains the device config, not the firmware :).
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: BravoV on March 16, 2013, 12:34:30 pm
I don't have any problem to dump content of my Agilent U1242B eeprom, as long anyone has patience and kindly enough to assist/guide me (read, a noob ee wannabe) in using my Stellaris Launchpad as logic analyzer to dump it, as this topic here -> Stellaris Launchpad Logic Analyser (https://www.eevblog.com/forum/microcontrollers/stellaris-launchpad-logic-analyser/). Yes, I have those probes for hooking up a soic chip like vl400's photos.

Of course, you also must provide the serial number's address in order for me to overwrite it.  ;)
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: gnif on March 16, 2013, 12:37:46 pm
I don't have any problem to dump content of my Agilent U1242B eeprom, as long anyone has patience and kindly enough to assist/guide me (read, a noob ee wannabe) in using my Stellaris Launchpad as logic analyzer to dump it, as this topic here -> Stellaris Launchpad Logic Analyser (https://www.eevblog.com/forum/microcontrollers/stellaris-launchpad-logic-analyser/). Yes, I have those probes for hooking up a soic chip like vl400's photos.

Of course, you also must provide the serial number's address in order for me to overwrite it.  ;)

I assume you mean the address of the i2c device? If so, then it is in the datasheet. You do not need a logic analyser, just interface to the device via I2C directly while the meter is off and dump the EEPROM, alter it and flash it back into the EEPROM. I am sure the Stellaris Lauchpad has an I2C interface.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: BravoV on March 17, 2013, 09:03:11 am
My problem is I dont have any dumping gadget like bus pirate or similar, while my programming skill at Stellaris only passed recently at the grade on making "Hello world !".  :-DD

About the SN address, its just for anonimity purpose before I give it to someone.  ;)
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on March 17, 2013, 09:31:05 am
My U1732C looks to have all address lines tied to ground, I didnt hook any pins to them to read and write it.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: HackedFridgeMagnet on March 17, 2013, 10:34:55 am
Bravo V, use an Arduino.

I just bought one of those cheap Agilent U1242As too, $127 Au delivered. So I guess at some stage I may change the config.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: vl400 on March 17, 2013, 12:05:51 pm
Could be game over on the U1732C to U1733C EEPROM hack. While you can get the 33 options on the screen it wont measure anything, even with a blank EEPROM the 100KHz signal is never present. Am pretty confident it will require a hardware hack to go along with it  :--
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: alexwhittemore on April 01, 2013, 06:25:13 am
somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....

I don't think Agilent needs to worry. The skill, knowledge and tools to do this are beyond the ability and motivation of 99.99% of purchasers. They are not going to lose sales over it.

That's totally, totally wrong, though! Think about it, if you're going to own an electronics multimeter that retails for between $200 and $500 US (given all the lines this affects), you DAMN well better at least understand what an eeprom is and how to use it :). Now of course, this PARTICULAR meter is more electrical than electronic, but still. The 1253 line isn't.

Anyway, more to the point, *someone already did,* else there'd be no thread. And the process is easy enough for the meter's target market to follow.

The REAL reason they probably don't need to worry is that hobbyists make up a minuscule fraction of their market, and companies aren't going to start buying the cheaper tool and spending precious employee time hack-upgrading it. Which is, of course, why these tools can command such a high retail price despite being (one can only assume based on complexity) relatively cheap to manufacture and high-margin.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: Harvs on June 07, 2013, 11:53:49 am
I finally got around to doing this hack to the 1241.

Just a note the harmonic ratio function doesn't work properly.  It'll only ever display 0 or 100%, it looks like some sort of calibration data is missing (this is the sort of effect I've seen before when a meter's two point calibration are set to the same point.  Unfortunately there's no calibration procedure for it.

So if anyone with a 1242 feels incline to do a dump of the EEPROM, it would be interesting to see if there's some parts of the cal area that are used that aren't in the 1241.  Alternatively I guess I could just start changing some of the values that are currently 0xFF prior to the serial number and see if that does anything.
Title: Re: [SUCCESS] Agilent U1241A to U1242A hack
Post by: millerb on June 07, 2013, 12:21:49 pm
[quote author=alexwhittemore link=topic=14365.msg210779#msg210779 and companies aren't going to start buying the cheaper tool and spending precious employee time hack-upgrading it. Which is, of course, why these tools can command such a high retail price despite being (one can only assume based on complexity) relatively cheap to manufacture and high-margin.
[/quote]

Companies may not make it policy to hack their gear but budget constraints can motivate employees to do it on their own time.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: Harvs on June 08, 2013, 09:01:51 am
I've probed the EEPROM whilst it's in harmonic mode.  There's 4 bytes it reads out that are different to those that are read during the AC volts measurement, when in 1000mV range.  Not surprisingly they're all blank, which would be the problem.

bytes
0x80, 0x81, 0x40, 0x41

are the blank ones it's reading.
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: droffsite on March 04, 2022, 02:21:47 am
9 years later, just did this to a cheap U1241A I got on eBay. Used a TL866II Pro. I had to desolder the EEPROM (attempts to read in circuit kept returning FF's and 80's), but then it worked a treat. Thanks!
Title: Re: Upgrading/Unlocking Agilent Meters via EEPROM
Post by: JJalling on March 04, 2022, 08:04:24 am
How about bench meters like the 34460A? Can they be "upgraded"?

BR Jonas