Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B

[smgvbest]

Just got back from work,   amazing whats gets done when I am tied up

@tv84
@abyrvalg

you both are awesome!!   thanks for the hard work
I would love to have a PM chat to understand a bit of how you do this,  it intrigues me

@suj  thank you for your help as well

[abyrvalg]

BootROM HPIB init loops through 0-7 slot numbers, getting a byte from 08000000+4000*slot+3FFE and looking for 01 value, then uses base address of the matched slot for all further IO operations. Same is for floppy (but looking for value 04). Not sure if all slots are equal, maybe some card types must be installed in a specific slot to get i.e. right RF connections, but they are still identified by that +3FFE byte in sw, no hardcoded slots there.

[smgvbest]

BootROM HPIB init loops through 0-7 slot numbers, getting a byte from 08000000+4000*slot+3FFE and looking for 01 value, then uses base address of the matched slot for all further IO operations. Same is for floppy (but looking for value 04). Not sure if all slots are equal, maybe some card types must be installed in a specific slot to get i.e. right RF connections, but they are still identified by that +3FFE byte in sw, no hardcoded slots there.

Each IO card has a 93c66 eeprom on board used to identification and some store calibration data for that card.
i wonder if that address is the address used for the eeprom and getting that byte?   

[suj]

Try to start from this point:
https://www.eevblog.com/forum/testgear/hp-agilent-e4433b-esg-d-series-signal-generator-250khz-4-0ghz/msg3240634/#msg3240634

[analogRF]

After a few more educated googles I arrived here.     

So, we're halfway there!

The licenses should have this format:

FEATURE 202 TMOMID01 1.0 permanent uncounted 0123456789AB  HOSTID=E1234567

Now, we just need the seeds. 

what does 0123456789AB represent. I am almost there 

EDIT: I got it to work for one example that was in the posts, so  I think I got it right 

[analogRF]

I finally got it   
thanks to the one example that was in the posts 

[tv84]

I finally got it   
thanks to the one example that was in the posts 

Here is the example of a good student that does his homework. 

[analogRF]

I finally got it   
thanks to the one example that was in the posts 

Here is the example of a good student that does his homework. 

now I need to buy one of these SAs....have been trying to for quite some time with no success 

[smgvbest]

I finally got it   
thanks to the one example that was in the posts 

Here is the example of a good student that does his homework. 

now I need to buy one of these SAs....have been trying to for quite some time with no success 

I was in same boat.  Finally got one from alltest on eBay.  Made an offer.  Plead my case and they accepted at a bit higher than I wanted ( ie could afford ) to go but took it

Ended up being bricked was all.  I don’t think it had a bad flash. As I’ve now tested that flash many times and no failures

[analogRF]

I finally got it   
thanks to the one example that was in the posts 

Here is the example of a good student that does his homework. 

now I need to buy one of these SAs....have been trying to for quite some time with no success 

I was in same boat.  Finally got one from alltest on eBay.  Made an offer.  Plead my case and they accepted at a bit higher than I wanted ( ie could afford ) to go but took it

Ended up being bricked was all.  I don’t think it had a bad flash. As I’ve now tested that flash many times and no failures

a bricked, broken, defective is what I dig
but still too expensive when they have the "basic" important (for me) HW options on them (1D5,AYX,BAA)

[smgvbest]

So no one wants $1000 ?

Just checking..

Everything you need to do this is in this thread. 
And it’s fairly easy to do

[xymox]

Well no doubt this works..  I tried EVERY option that I had hardware for.. Discovered I want a card, option 119..

[xymox]

NEW CHALLENGE...

One other thing that would be REALLY useful is to find the SCPI (GPIB) commands to do some adjustments (especially the frequency response adjustment.).
Keysight doesn't want to share the commands - They do use them in their own calibration software (N7800A) - but I think they don't want to enable others....

Perhaps if somebody has this calibration software (Keysight doesn't sell it anymore - they stopped selling it a few years back) - then the GPIB commands can be traced using a tracing/logging tool that logs
all GPIB activity...

The calibration software requires a license. There are older versions that run on older versions of windows that might be less protected.. https://cal.software.keysight.com/

Also I really need software that does waterfall plots and spectrograms. Logging to a computer. Etc..

There is Benchlink Web and I think that takes a key. It only runs on NT or Win 2000. Which I have setup..

Now that the SA is more unlocked I will look into all this more..

[suj]

Today I did the initial verification of the E4407B phase noise measurement. I have put together a measuring system consisting of the following elements:
1. R&S SMF100A generator
2. Power divider Anritsu 11N50B
3. DUT1: E4407B
4. DUT2: Advantest R3681
I made the measurements at the frequency of 1.005 GHz.
The first measurement was performed without modulation.
Then I modulated the carrier frequency with the noise generator signal. With the following settings, the result should be a signal with phase noise falling by 20 dB per decade.
It is not a device with outstanding parameters, because probably HP was not supposed to be like that. After all, it could not compete with the higher-end  SA (for example PSA).

[xymox]

Yes i saw that.. I was also after phase noise.. A bit dissapointing, but, its still useful

SO... I spent half my day playing with software..

I got Keysight VSA working on it. This is expensive software and seriously licensed using very modern methods. No hacking this one.. It is however REALLY powerful software.. It does exactly what I want from it.. You gotta install the Lk-VSA personality on the unit. "ESA to 89601A Software Link Utility" Its 2 floppies.

It seriously takes over the unit, complete with turning off the screen..

This software can turn the ESA into a VERY powerful device and can do things never possible from the ESA alone..

This are the AM radio stations around me..

[xymox]

The VSA software does a great many things you can't do with just the unit.

It seems to be tryign to do 5G, all forms of Wifi, DOCSIS 3.1, OFDM, QAM just tons of stuff..

I cant quite get it to decode my cable company DOCSIS 3.1 or my own wifi.. Its trying. I just dont know enough about settings on this yet.. The trial software gives me 1 month.. So I will have some time to play with it fully...

BUT at at least $500 PER YEAR,,, this is not friendly.. Its the PER YEAR part that bothers me...  The spectrogram stuff is great.. Thats all I really want..

I am a tad confuzed by one thing, but, im sure its me.. I can't get a span more then 10Mhz for some reason..

[xymox]

Well this software is nearly unusable for my use. For some freaky reason its limited to a 10Mhz span no matter what I do. This is comeplty useless for me. At the high freq is useless. Like how do you look at wifi ? This limitation seems to be with the hardware. I can simulate other devices and they have different max spans, but still not full. Even brand new keysight gear does not do the full span like the actual device will..

Because of this, the software seems crippled for my use.

[xymox]

Well that is interesting...

I have a second ESA-E Very basic.

I licensed 1DR narrow resolution bandwidth and 1D5 Hi Stability Freq Ref... These work.. I can now hit a span of 100hz and a Res BW of 1 hz.. OK Sure I enabled the software, but, I dont have those right ? WELL its performance exactly the same as my main one which has those options for real. BUT this can't be right

SO.. One thing for sure.. Its now possible to cheat.. Units could be made to look like they have more options then they actually have.. So thats not good.. However,, in this case, it added to functionality, even if its a bit wonky.

Makes me wonder what other options could be enabled this way..

[xymox]

I truly stuffed full ESA... I cant fit anything else..

There is hardware I dont have which limits me. Low freq extension, modulation analysis board, noise measurement board..

GPIB can do a lot. I will have to explore this. I would imagine any software written for GPIB Spectrum Analyzers will work as the GPIB commands look pretty universal. Well. I can load a number of standards, so, hopefully.. VSA does not do what I need and is stupid expensive with little hope of a keygen and patch.

[smgvbest]

Well that is interesting...

I have a second ESA-E Very basic.

I licensed 1DR narrow resolution bandwidth and 1D5 Hi Stability Freq Ref... These work.. I can now hit a span of 100hz and a Res BW of 1 hz.. OK Sure I enabled the software, but, I dont have those right ? WELL its performance exactly the same as my main one which has those options for real. BUT this can't be right

SO.. One thing for sure.. Its now possible to cheat.. Units could be made to look like they have more options then they actually have.. So thats not good.. However,, in this case, it added to functionality, even if its a bit wonky.

Makes me wonder what other options could be enabled this way..

There are items that are License Only.
1DR i think is one, Preamp is another past a certain serial number
there 5-6 that are license only

[xymox]

I dont suppose in any of the dumps is a list of things that can be turned on ? Maybe there are some undocumented ones ? It knows all these because it populates names for them after you enable them.. You never know, maybe there is some fun option that enables something interesting.

[smgvbest]

I dont suppose in any of the dumps is a list of things that can be turned on ? Maybe there are some undocumented ones ? It knows all these because it populates names for them after you enable them.. You never know, maybe there is some fun option that enables something interesting.

They are all in the ESAFW file and dumps
I do not recall anything thats not already listed on the keysight page

https://www.keysight.com/main/editorial.jspx?cc=US&lc=eng&ckey=277453&nid=-32406.536881907.02&id=277453

BTW:  I just started a new thread in the repair forum for repairing the Tracking Generator thats getting a Source Unlevel error if anyone is interest
https://www.eevblog.com/forum/repair/e4407b-tracking-generator-repair/msg3246922/#msg3246922

[xymox]

BTW:  I just started a new thread in the repair forum for repairing the Tracking Generator thats getting a Source Unlevel error if anyone is interest

You will eventually need to calibrate it. We gotta figure out how to do that..

I am trying to get Keysight to simply quote me on TME.. I want a license for "self Maintainers" and for a single serial number unit. They responded once and asked me what the company name was, I told them it was for personal use and they never responded again. I would pay them for this.. As long as it was not a insane number. BUT they seem to be going in the direction that will lead to the system getting hacked into. At the least the GPIB stuff that goes back and forth during calibration can be captured and easily figured out. Im going to ask one more time.

I want this https://cal.software.keysight.com/?id=2525023  under this license.. https://www.keysight.com/us/en/assets/7018-01623/data-sheets/5989-6956.pdf  for 1 unit, a ESA E4402B.. Its supported..

I VASTLY prefer to use software legitly. As long as its not too expensive, I am happy to pay it.

Keysight seems to be unpleasant and stupid.

What they should do is just allow all these tools and things to go free. Real businesses are not buying these older devices, hobbyists are. Like me, a Ham radio guy.. They are NOT loosing sales to this old gear...

Maybe I need to target someone higher up the chain at Keysight..

[smgvbest]

BTW:  I just started a new thread in the repair forum for repairing the Tracking Generator thats getting a Source Unlevel error if anyone is interest

You will eventually need to calibrate it. We gotta figure out how to do that..

I am trying to get Keysight to simply quote me on TME.. I want a license for "self Maintainers" and for a single serial number unit. They responded once and asked me what the company name was, I told them it was for personal use and they never responded again. I would pay them for this.. As long as it was not a insane number. BUT they seem to be going in the direction that will lead to the system getting hacked into. At the least the GPIB stuff that goes back and forth during calibration can be captured and easily figured out. Im going to ask one more time.

I want this https://cal.software.keysight.com/?id=2525023  under this license.. https://www.keysight.com/us/en/assets/7018-01623/data-sheets/5989-6956.pdf  for 1 unit, a ESA E4402B.. Its supported..

I VASTLY prefer to use software legitly. As long as its not too expensive, I am happy to pay it.

Keysight seems to be unpleasant and stupid.

What they should do is just allow all these tools and things to go free. Real businesses are not buying these older devices, hobbyists are. Like me, a Ham radio guy.. They are NOT loosing sales to this old gear...

Maybe I need to target someone higher up the chain at Keysight..

Keysight is not in business to support hobbyist.  that's not their business model.   for TME you're looking at 5K+ i believe.
Hobbyist arent buying these usually either,   at a cost of 3K+ for a broken one most hobbyist can not afford that.   every now and then you find you for much less.  I did,  I got very lucky and the repair was simple.   the TG may be a different issues.   it's been repaired before.   I need to figure out if the Source Unlevel is the LO Control board (i hope) or the BITG which is not documented

Far as calibration,   first run a performance test to see if it need to be calibrated.  All documented in the calibration guide

[xymox]

Yea I have been thru the "calibration" guide.. Hehehe..  Im still not sure how to set Course and Fine in the timebase in the service menu..

I do have something off on both my units. If I give them my rubidihum clock std 10Mhz it displays slightly off center if I set the SA for 1hz res bw and 100 hz span. Also the freq counter is off a bit..

Amplitute is reading slightly off at various frequency points.

These are not much off, but with this many years on these devices, its normal to have drift.

Also if we want to swap boards around between units and maintain these over the next 10 years we just gotta be able to calibrate them.

These calibration adjustments must also be kept in some flash. If the flash goes or gets wiped, thats it. No hope of recovery.

We gotta be able to do TME.. I can't find old versions of TME. Or maybe some old different program used to calibrate.

I have sent a nice email to Ron Nersesian. He has a awesome career that goes way back with HP. Back to the good old days of HP. I have suggested that hobbyists fuel young engineers and so thier future customers could well be buying this older gear from ebay. i suggested its helpful for EoL devices that are locked away with keys to maybe get a free online key gen process. This would fuel many hobbyists into engineers and maybe future customers. It wont hurt Keysight sales as hobbyists cannot afford to buy new gear and companies using this kind of test equipment don't buy old gear like this.

Im sure I wont get a response. BUT the email did not reflect back. So I did find the right email to use for him.

WTH... Why not try...

BTW the self calibration license has provisions for a single serial number instrument. That would have to be way cheaper then a single seat.

Maybe I can get a trial license. If so, I can capture all the GPIB..AND calibrate my unit at least once..