Electronics > Microcontrollers

Dim OLED Screen replacement for Agilent Keysight U1253A U1253B U1273A U1273AX

(1/24) > >>

Background: U1273AX has OLED display that is dying. OLED display uses SSD1303 controller, EOL of which was in 2010. Current OLEDs of same parameters use SSD1309 controller, command set of which is slightly different. Direct replacement results in mirror inverted image plus shift of the display by two columns.

Here is the translated to English German document (I Google translated it) that basically explains the problem:

Instead of adding circuitry I thought if it is possible at all to adjust the firmware to the U1273AX directly.
Keysight provides firmware updates for the multimeter. Here is the latest 3.03 version:

Inside it there is a binary file u1273ax_v303.ag which is uploaded to the D78F0547 during an update.

Thankfully there is an awesome soul who wrote a decompiler for this series of microcontrollers:
It is written to work with ASxxxx Cross Assembler: https://shop-pdp.net/ashtml/asxget.php

I had to update two files command.py and symbols.py with command sets and pinouts that correspond with D78F0547
Here are the links to them:

Here is the hardware manual for 78K0 series and also programming document:

Here is the datasheet for ssd1303 controller:

Here is the datasheet for ssd1309 controller:

I do not know assembly. Can someone who understands all this please at least encourage me to continue or tell me this is an impossible task, and why. It of course would be awesome if someone is willing to help to adjust firmware to be compatible with SSD1309, but I cannot hope it will happen.
I do not want to spend many hours of monkeying around with assembly and understanding all of the ins and outs of controllers just to find out down the road that it is impossible to adjust this firmware successfully.

How I plan to upload the firmware - roll back existing 3.03 version to 3.01 on meter, then update it back to 3.03 but with edited code. Keysight allows rolling back this multimeter.

Additional info:

The D78F0547 is communicating to the screen via SPI
The following pins are related to OLED SSD1303 PCB:

pin   func
58   P57   (Port 5) 0xFF05
57   P56   (Port 5) 0xFF05
56   P55   (Port 5) 0xFF05
55   P54   (Port 5) 0xFF05
45   P53   (Port 5) 0xFF05
44   P52   (Port 5) 0xFF05
43   P51   (Port 5) 0xFF05
42   P50   (Port 5) 0xFF05
69   P130   (Port 13) 0xFF0D
75   P145/STB0   Port 14 / Serial strobe      (Serial interface CSIA0) 0xFF0E
76   P144/SOA0   Port 14 / Serial data output      (Serial interface CSIA0) 0xFF0E
77   P143/SIA0      Port 14 / Serial data input      (Serial interface CSIA0) 0xFF0E

Thank you for your attention!

How to replace the Agilent / Keysight OLED display for just $10!

- Buy the display: Aliexpress (Or search for "SSD1309 8080").


- You might need to install the Prolific drivers. If getting code 10, install the attached drivers.
- Make sure Windows is using them: Open the Device Manager, check those under USB devices/USB serial port and COM ports/USB serial port, replace driver if needed.
- Don't attempt loading a firmware from another model, it'll brick the device! (Not irreversible, see Recovering section below)

Agilent / Keysight U1273A / U1273AX

  If your device has firmware version v4.xx it will work straight away, no firmware modification is required!

 - Confirmed working!
 - Download and extract U1273A(X)_V303_mod.zip.
 - Run the updater.

 - Original installers from Keysight: U1273A, U1273AX .
   Must be v3.01, newer version will check the current firmware and block the update if already in the latest version!
   Just change the firmware name to U1273A(X)_V301.AG. (A or AX).

Agilent / Keysight U1253A

  - Confirmed working!
  - Download and unpack Agilent U1253A Firmware Update V120_mod.zip.
  - Run the updater.

Agilent / Keysight U1253B

 - Same mod as 1253A, so it should work.
 - Download and extract U1253B_V304_1123a_mod.zip.
 - Run the updater.

Reverse enginnering details

All the bits & low-level details can be found few posts below.


If something goes wrong, it's pretty easy to recover using a usb-serial converter, read the messages starting here.

Looks like the column shift by +2 is here:

--- Code: ---ROM:4538                 movw    MUL_B, AX
ROM:453A                 mov     X, #80h
ROM:453C                 call    !MUL            ; :AX*MUL_B
ROM:453F                 movw    HL, AX
ROM:4540                 add     A, #02h ; <<<<<<<<<< add 2 to start addr
ROM:4542                 movw    HL, AX
ROM:4543                 movw    AX, #0080h
ROM:4546                 push    AX
ROM:4547                 movw    DE, #I2CBuf80
ROM:454A                 push    DE
ROM:454B                 movw    AX, HL
ROM:454C                 call    !I2CSend

--- End code ---

Edit: @DavidAlfa: thanks, man, I've mapped most of the I2C-related lower level stuff just to find out that firmware talks to two addresses: A0 (EEPROM ?) and 90 (LM75 ?), then read entire thread again and found that only ref to I2C is your last message, OP never mentioned it  :-DD

To anyone who is visiting this thread: DavidAlfa and I have cleaned up the R&D process, so there are no now useless back and forth for many many pages of trials and errors.

You can see in the post #1 original question and request.

In post # 2 is a summary of all the firmware discoveries that have been made by DavidAlfa and also assisted by abyrvalg.

For the later part of firmware modification abyrvalg was not involved and also he has not visited this thread for a while, so his messages are still here showing some of the R&D that was done.

I also reached out to a couple of places on other trheads on eevblog where people are directly wondering what to do with their dim/dying screens and gave a quick summary with links to here for reference.

I hope this work will make life easier for a lot of us who have the same meter!
Maybe similar patching can be done with other Agilent/Keysight meters with an OLED screen if the original OLED is hard to come by.

It looks like the flash is divided into two areas:
0000-3000 - bootloader
3000-end - app
App reuses bootloader functions (including those two display write ones), bootloader never calls anything above 3000.
I think the bootloader is never updated (it would need to overwrite itself somehow otherwise, but there is nothing like copy some code to RAM and run from there).


[0] Message Index

[#] Next page

There was an error while thanking
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod