Enable all options on your HP 89441A, 89410A Vector Spectrum Analyzer

[bovist]

Hello all,

just want to share this information:

Since the 89400 Vector Spectrum Analyzer series (89410A, 89441A) is out of support, you're not able to obtain software
options from HP/Agilent/Keysight anymore. Here's a hack to enable software
options using the HP 89400 Service Utility disk (enclosed, just unzip and copy to DOS-formatted floppy):

   1. Create a service disk as described in README of service disk (ommitting instructions 1 to 3,
        as it is already unzipped) and save your current 89400 device
   configuration to it ("CPU replacement/Save Config"). You will need this file to restore factory calibration and
   serial number. So keep a copy of the newly created file in a safe place, also in case something went wrong.
   
   3. Open file "CONFIG_ALL_OPT" with an hex editor (like "Tiny Hexer" from www.mirkes.de).
   
   2. Make copy of newly created "CONFIG" file from your 89400. Open your "CONFIG" file
   with hex editor in a second window.
   
   3. Locate your serial number and factory cal data, beginning at location $0300.
   Serial number string in "" should start at $0305 and match sticker on back of 89400.
   
   4. Copy & Paste serial number to "CONFIG_ALL_OPT" file at same location
   (overwrite bytes - file length should not change!).

   5. Locate factory calibration data, beginning at location behind serial number and
   option strings. Usually starts with byte $3F (8 Bytes, IEC double precision format).
   
   6. Copy & Paste factory calibration data (8 bytes) to "CONFIG_ALL_OPT" file at location $033A
   (overwrite bytes - file length should not change!)
   
   7. Check that pointer at $0207 points to end of data (after last byte of
   pasted cal bytes) and file ends at $03FF. Should be $42 now.
   
   8. Save file as "CONFIG" to floppy disk, overwrite old one.
   
   9. Insert disk into your 89400. Proceed with "CPU replacement/Recall Config" on your 89400.
   
   10. Restart 89400 and check if options have been installed.
   
   11. Make a donation to "info [ at ] keyboardpartner.de" paypal account if you
   appreciate my hack (leave "89441A Upgrade" as comment).

NO WARRANTIES! USE AT YOUR OWN RISK!

Hack Internals

Password for advanced 89400 options is "1125".

Bytes $0000 to $01FF in CONFIG file are LIF format data. Do not change.

Configuration data Block starts at $0300.

Byte at $0207 is a length byte, pointing to the byte behind factory cal IEC
double (minus block start address $0300). With no options it is $1E, with all options it is $42.

All data from $0210 to $02FF written by 89400 is garbage. Disregard.
   
Bytes at $0303 and $0313 are Pascal style string length bytes. Adjust byte at $0313
if you change your option list. String length must include "" (for instrument BASIC, I suppose).

Options are stored as a comma separated string list, enlosed in "", beginning at
location $0315.

Factory calibration data is stored in IEC Double precision format, 8 bytes. On
my 89441A with no options installed, it was located at $0306 to $031D.

All data from end of factory calibration data $0343 to $03FF is garbage. Disregard. I had set all bytes to zero.

RCL_CFG and SAVE_CFG seem to be scrambled/zipped/encoded BASIC files which run
even on a machine with BASIC disabled. No investigations done so far.

[garrettm]

I realize this is an old thread, but I'd like to thank bovist for providing this helpful guide and config file.

I managed to enable all the software options on my Agilent 89410A and HP 89441A by following the guide and tinkering with the config file.

From messing around while upgrading my units, it seems hardware options are determined at boot and are enabled automatically. So there is no need to edit the config file if you have HW options installed. Just replace the serial number and calibration data as stated in the guide. I accidentally goofed when copying the cal data, but the second try worked fine. I would recommend taking a photo of the displayed options and calibration value before and after you perform the mod for comparison purposes--so you know you still have the correct cal value afterwards.

[Fretec]

I just randomly found this thread and since I have one of those, I tried it.

And it worked perfectly! Many many thanks for sharing this!

[Johnny10]

Mark This

[boblevy4321@sbcglobal.net]

Hello
I just found this post.
I am trying to figure this out. I did the service floppy disk and opened it in tiny hex editor.
BUT I found that my unit is different than your description.
At $0207 I have a value of 46 (F).
I am including a snapshot of the file.
Any and all help is appreciated.
I want to activate B7A, B73 , B79 , 080. As you can see I have all the other options.
I don't know what value to put in $0207 .
Thank you
Bob

I just added the memory and was able to get the network link working as per,  https://www.eevblog.com/forum/testgear/ethernet-connectivity-with-agilenthp-89400-series-vector-signal-analyzers/msg3261842/?topicseen#msg3261842
Thanks to all again

[KE5FX]

Hello
I just found this post.
I am trying to figure this out. I did the service floppy disk and opened it in tiny hex editor.
BUT I found that my unit is different than your description.
At $0207 I have a value of 46 (F).
I am including a snapshot of the file.
Any and all help is appreciated.
I want to activate B7A, B73 , B79 , 080. As you can see I have all the other options.
I don't know what value to put in $0207 .

A bit late, but having just gone through this, I would expect $42 to be the right value for location $207.  You have a weird option (**a), but the list is followed by the 8-byte calibration word that begins with $3F as usual.  $46 doesn't make much sense unless the firmware is very different than what Carsten was working with. 

If you were to add more codes, you'd move the 3FF092E6 double word forward in memory as far as necessary and add the same number of bytes to $207.  (Don't forget to update the length prefix before the option string itself, which I did the first time.)