Author Topic: Upgrading/Unlocking Agilent Meters via EEPROM  (Read 39771 times)

0 Members and 1 Guest are viewing this topic.

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Upgrading/Unlocking Agilent Meters via EEPROM
« on: February 22, 2013, 08:17:09 am »
Hi All,

Update: It has been confirmed that the U1732C LCR meter can be upgraded to a U1733C also!

I am opening this here as it is a more appropriate place to discuss this, please see the following message for the history of this:
https://www.eevblog.com/forum/buysellwanted/ex-demo-agilent-u1241's-for-sale-in-oz/msg194648/#msg194648

A quick synopsis:

The U1241A has a Atmel I2C EEPROM in it, that when the SCL and SDA lines are shorted on power up, the meter upgrades into a U1242A, as such I have just managed to dump the EEPROM and I am now proceeding to try to upgrade the thing :).

If anyone has a U1242A and is inclined to crack it open, it would be great if you could dump the EEPROM contents to make it easier to figure out how to upgrade this thing.

EDIT: This will also work for the U1241B as it is functionally identical.
« Last Edit: February 24, 2013, 05:20:53 am by gnif »
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: Agilent U1241A to U1242A hack
« Reply #1 on: February 22, 2013, 12:41:23 pm »
I found it! I have all the features of the U1242A in my U1241A now!

Change byte 0x1e5 from 0x01 to 0x02!

This enables:
  J type Thermocouple
  AC Harmonic Ratio Measurement
  T2 Temerature Measurement
  T1-T2 Temperature Delta Measurement
  Scanning Temperature Measurement
  Data Logging
 

Edit: It might be just me, but it seems that the continuity tester is much faster to latch now also.
« Last Edit: February 22, 2013, 12:50:25 pm by gnif »
 

Offline Lightages

  • Supporter
  • ****
  • Posts: 4313
  • Country: ca
  • Canadian po
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #2 on: February 22, 2013, 11:27:47 pm »
Interesting find. Personally I find it curious that the U1241B exists at all. It costs $206 retail at one online retailer and the U1242B costs only $226, less than 10% difference.
« Last Edit: February 23, 2013, 01:38:22 am by Lightages »
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #3 on: February 23, 2013, 01:09:38 am »
Agreed, but it makes me wonder how many other higher priced meters can be upgraded to their more expensive models which do have a larger price gap.
 

Offline EEVblog

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #4 on: February 23, 2013, 01:12:06 am »
Nice find!

Dave.
 

Online BravoV

  • Super Contributor
  • ***
  • Posts: 7547
  • Country: 00
  • +++ ATH1
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #5 on: February 23, 2013, 05:01:52 am »
Thank you ! Great finding !  :-+

Mind share the process how did you manage to find it ? If you don't mind of course.

Curious if this hack applicable to "B" version as well.

Now, the fun part, stalking great deal or bargain on NOS U1241.  :-DD
« Last Edit: February 23, 2013, 05:25:26 am by BravoV »
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #6 on: February 23, 2013, 08:24:15 am »
Thanks,

The B model is just a colour change according to the manuals, the website and the spec sheets, so it should work on it just fine also. If you are worried you can obtain a 2nd hand A model from Trio here. This is why I bothered to try to enable these features because I got the cheaper meter and the price difference wasn't just $20-30 for me, it was over $100.

The process was pretty simple, I did a tear down to inspect it and comment on its build on this forum. I noted that others had upgraded the firmware in other Agilent devices to fix firmware bugs, so I kept an eye out for an EEPROM when I had it apart. There was only one there, so as a quick and simple test, I shorted out the i2c lines to prevent the micro talking to it on start up, which presented an error, but was still functional. Checking the setup menu I found I had the additional options to configure, and all the other values were set to FF or FFFF, etc.. so the micro defaults values to FFFF when it cant read the EEPROM.

I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

Since I knew that 0xFF was a good value to set to enable these features I started out by setting portions of the data to all 0xFF, powering on the meter and checking if it had the additional features.  If it didn't work, I reversed it, and tried another area, until it did work. Then I just repeated the process until I found the exact byte to change, and experimented with it's value.

A word of caution if you attempt this in any meter, make your EEPROM read only by pulling the write protect pin high before you start to be 100% sure you back up its contents before altering them, as the EEPROM also contains all the calibration data for your meter, and changing it will cause your meter to read things incorrectly.
« Last Edit: February 23, 2013, 08:26:15 am by gnif »
 

Offline fcb

  • Super Contributor
  • ***
  • Posts: 2117
  • Country: gb
  • Test instrument designer/G1YWC
    • Electron Plus
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #7 on: February 23, 2013, 03:11:00 pm »
somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....
https://electron.plus Power Analysers, VI Signature Testers, Voltage References, Picoammeters, Curve Tracers.
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #8 on: February 23, 2013, 03:50:34 pm »
If they do it will only affect new units, as these are a OTP device.
 

Offline vl400

  • Regular Contributor
  • *
  • Posts: 62
  • Country: au
    • Delcohacking.net
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #9 on: February 24, 2013, 04:45:38 am »
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #10 on: February 24, 2013, 05:19:04 am »
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

You are most welcome, it is awesome to know that it is not just applicable to my meter. If you let me know the byte to change and what to I will update the first post. I will now also re-title this thread as it seems that there might be quite a few that this can be done to.
 

Offline EEVblog

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #11 on: February 24, 2013, 07:26:32 am »
Probably a similar thing on the 1250 series 1270 series too!
But there is not a big difference in the price between the two models in each of these groups anyway.
Dave.
 

Online BravoV

  • Super Contributor
  • ***
  • Posts: 7547
  • Country: 00
  • +++ ATH1
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #12 on: February 24, 2013, 08:06:44 am »
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

Wow, is that the same address and value ?

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #13 on: February 24, 2013, 08:23:31 am »
Thanks for the mod  :-+ Works for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM  :)

Wow, is that the same address and value ?

From what he said I would suspect that he is just shorting the SCA and SDL lines to see if it will upgrade, that is why he said he just needs to update the EEPROM now.
 

Offline ttp

  • Regular Contributor
  • *
  • Posts: 151
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #14 on: February 24, 2013, 10:39:19 am »
I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

This is quite interesting. How do you connect STM32 board to talk to EEPROM, I guess you don't remove/unsolder the EEPROM form original circuit?
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #15 on: February 24, 2013, 11:40:27 am »
I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.

This is quite interesting. How do you connect STM32 board to talk to EEPROM, I guess you don't remove/unsolder the EEPROM form original circuit?

The device is an i2c EEPROM, so I just used the hardware I2C controller in the STM32 I had handy at the time, it would be much easier to do this with a bus pirate or similar, but I do not have one. And yes, I left it in circuit, but provided a 3.3v source and the 2x 4.7k resistors to pull high the bus lines as per i2c spec. I soldered directly onto the chip's pins using wire wrap.
 

Offline TRIO_Smartcal

  • Contributor
  • Posts: 40
  • Country: au
    • Trio SmartCal  - Test & Measurement, Sales, Rental & Calibration
Your One-Stop-Shop for Quality Test Equipment.     *** Clearance bargains !!!   http://triotest.com.au/303-clearance-items  ***
Phone : 1300 853 407   (within Australia)
Web    :  http://www.triotest.com.au
 

Offline vl400

  • Regular Contributor
  • *
  • Posts: 62
  • Country: au
    • Delcohacking.net
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #17 on: February 25, 2013, 05:42:17 am »
From what he said I would suspect that he is just shorting the SCA and SDL lines to see if it will upgrade, that is why he said he just needs to update the EEPROM now.

Correct, only stopped the processor from reading the I2C to see if it responded the same which it did. For now am just probing the signals, it does 2 blocks of data on boot to grab a heap of data. The write enable pin is tied to ground, address lines are also all tied to ground.
 

Offline ddavidebor

  • Super Contributor
  • ***
  • Posts: 1190
  • Country: gb
    • Smartbox AT
Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #18 on: February 25, 2013, 06:10:11 am »
Where you have bought that probes?
David - Professional Engineer - Medical Devices and Tablet Computers at Smartbox AT
Side businesses: Altium Industry Expert writer, http://fermium.ltd.uk (Scientific Equiment), http://chinesecleavers.co.uk (Cutlery),
 

Offline vl400

  • Regular Contributor
  • *
  • Posts: 62
  • Country: au
    • Delcohacking.net
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #19 on: February 25, 2013, 06:25:55 am »
And success for the model, address 0x0A is 0x01 in a 1732C. Change to 0x00 for U1733C or downgrade to U1731C by setting to 0x02. However..... this allows 100KHz to be selected but does not provide a 100KHz measurement.


Where you have bought that probes?
They came with a logic analyser

« Last Edit: February 25, 2013, 06:37:16 am by vl400 »
 

Offline vl400

  • Regular Contributor
  • *
  • Posts: 62
  • Country: au
    • Delcohacking.net
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #20 on: February 25, 2013, 10:22:02 am »
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #21 on: February 25, 2013, 01:04:43 pm »
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.

The additional features are most certainly usable, but I have not yet (aka, don't know how to) test the AC harmonic ratio measurement, data logging works fine though as does the temperate delta measurement.
 

Offline IanB

  • Super Contributor
  • ***
  • Posts: 11790
  • Country: us
Re: [SUCCESS] Agilent U1241A to U1242A hack
« Reply #22 on: February 25, 2013, 03:29:25 pm »
somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....

I don't think Agilent needs to worry. The skill, knowledge and tools to do this are beyond the ability and motivation of 99.99% of purchasers. They are not going to lose sales over it.
 

Offline gnifTopic starter

  • Administrator
  • *****
  • Posts: 1672
  • Country: au
 

Online BravoV

  • Super Contributor
  • ***
  • Posts: 7547
  • Country: 00
  • +++ ATH1
Re: Upgrading/Unlocking Agilent Meters via EEPROM
« Reply #24 on: March 15, 2013, 04:48:51 am »
So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.
Any new progress on the 100Khz feature ? I got an offer locally for a U1732C bout $250 in pristine condition.


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf