Mystery of the Agilent 1169A Smart Probe ID EEPROM

[Hugoneus]

Hello!

In my latest video I did a quick repair of an Agilent 1169A:

youtu.be/KKItbyz6564

There is an EEPROM inside the unit which was dead. I copied the EEPROM from a working unit onto the broken one. This basically makes the two probes to have identical serial numbers. While the probe is now fixed, because of the serial number duplication the scope can't tell them apart. This causes problems during calibration.

The EEPROM content is attached. Somewhere there must be a CRC checksum, because if I just change the serial number the probe does not get identified and I get a probe ID error.

Can any of you discover where the CRC part is so I can use a different serial number?

[TheSteve]

The checksum is the 3rd byte - if you increment the serial # value by one then decrement the checksum by one and you should be good to go.

btw, the autoprobe pin out is known, you can just clip onto the pins and read/write, no need to break out the soldering iron. In circuit the base address of the eeprom is $A2.

[Hugoneus]

The checksum is the 3rd byte - if you increment the serial # value by one then decrement the checksum by one and you should be good to go.

btw, the autoprobe pin out is known, you can just clip onto the pins and read/write, no need to break out the soldering iron. In circuit the base address of the eeprom is $A2.

You are awesome! Thanks. How did you find out?

Just to make sure, the third byte here is 0x13. What is the actual algorithm of the CRC?

[TheSteve]

I wanted to fix some oddities with a 1158A probe that gave a warning message. I compared eeprom dumps from a few probes and then experimented a little. I don't know exactly what areas are covered by the checksum. The 1158A is a single ended 4 GHz active probe - there was no unique information in the eeprom dump other then the serial number and checksum.
It would be easiest to change the serial # by one digit but creating the image with the proper original serial # should be possible.

[Hugoneus]

I wanted to fix some oddities with a 1158A probe that gave a warning message. I compared eeprom dumps from a few probes and then experimented a little. I don't know exactly what areas are covered by the checksum. The 1158A is a single ended 4 GHz active probe - there was no unique information in the eeprom dump other then the serial number and checksum.
It would be easiest to change the serial # by one digit but creating the image with the proper original serial # should be possible.

I just tried it, made the serial number to US49410572 and changed the third byte from 0x13 to 0x12. But it still doesn't work unfortunately.

[TheSteve]

Just checked my notes and verified that is how the checksum works with the 1156/7/8A series. I really didn't think they would use a different algorithm with a different series of probe. The eeprom's use a very similar format.
I did quite a bit of testing with my 1158A's just two weeks ago.

[TheSteve]

I did some testing and simulated a 1169A probe using a 1152A I have modified with an eeprom. With your good image my DSO81204A detects it as a 1169A correctly and reads the serial number properly. If I change the serial number(but leave the checksum) then it fails to read the probe as expected. If I then perform the checksum correction as I described it detects the probe and serial number correctly.
I used the serial number you tried(one higher then the original) and decremented the checksum.

I have attached the file for you to try. Like your original file it is a raw bin with the .zip extension added so the forum will accept it.

If programming using the autoprobe pins be sure to change the programming base address to $A2.
I am 99.9% sure it will work - maybe it just didn't program correctly when you tried it.

[thinkfat]

Some comments on the youtube video suggested that it's not a CRC but a simple 8 bit checksum that must add up to '0'.

If that's true, it effectively doesn't matter which byte you pick as the checksum byte. Of course, you would not want to randomly pick a calibration value

Somebody suggested the second byte (0xDC) is the content length, and that the last byte at offset 0xDB is the actual checksum byte.

I hope the solution is obvious now: If you don't know where the checksum byte is, just modify a value that you definitely know can be changed with no harm: Just modify _two_ bytes of the serial number, increase one, decrease another one :-D

[TheSteve]

It does look like a basic checksum. I know on the 1156a/1157a/1158a series of active probe if you compare eeprom dumps from several of the same model the only difference will be the serial number and the third byte.

[nfmax]

It does look like a basic checksum. I know on the 1156a/1157a/1158a series of active probe if you compare eeprom dumps from several of the same model the only difference will be the serial number and the third byte.

Can you please provide us dumps of the 1156A/1157A/1158A probes, especially if you can show the difference between 'good' EEPROMs and 'invalid characters removed from string' EEPROMs. I am still not clear what the correct location of the serial number is supposed to be.

Did the ICRFS probes have a valid checksum? Which bytes are included in the checksum?