Author Topic: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B (Read 65891 times)

abyrvalg · « **Reply #200 on:** September 18, 2020, 04:08:21 pm »

Supported hmon devices:
DOWNLOAD - this is wrong, no such device in device table
HPIB - HP's GPIB ?
RS232BINARY - self-explanatory
this command invokes a dedicated protocol handler supporting commands like "jump to address", "write to RAM", "write to flash", "start fw from flash", so nothing new there.

Baudrate:
there are 4 baud rate generators (each can be assigned to one of 4 ports independently), all of them are initialized to the same value corresponding to 19200 @25MHz source. I didn't searched for BRG->port assignment, it looks faster to try writing to divider regs one by one until we loose the communication (that will mean that speed is changed, time to reconfigure the PC port and try the new speed).

Divider register addresses:
815F0
815F4
815F8
815FC
- all are 32-bit, so use slong cmd to write to them

Values for different baud rates:
100A0 - 19200 (current setting)
10050 - 38400
10034 - 57600
1001A - 115200

suj · « **Reply #201 on:** September 18, 2020, 04:16:00 pm »

I'll try. This is the serial port which we use.

abyrvalg · « **Reply #202 on:** September 18, 2020, 04:28:10 pm »

So the correct register is 815F4

- write new value with slong
- check if communication is lost
- change the baudrate of PC to the new value
- check if communication is back
- do dumps at high speed
...
- profit!

smgvbest · « **Reply #203 on:** September 18, 2020, 04:28:48 pm »

Quote from: abyrvalg on September 18, 2020, 04:08:21 pm

Supported hmon devices:
DOWNLOAD - this is wrong, no such device in device table
HPIB - HP's GPIB ?
RS232BINARY - self-explanatory
this command invokes a dedicated protocol handler supporting commands like "jump to address", "write to RAM", "write to flash", "start fw from flash", so nothing new there.

Baudrate:
there are 4 baud rate generators (each can be assigned to one of 4 ports independently), all of them are initialized to the same value corresponding to 19200 @25MHz source. I didn't searched for BRG->port assignment, it looks faster to try writing to divider regs one by one until we loose the communication (that will mean that speed is changed, time to reconfigure the PC port and try the new speed).

Divider register addresses:
815F0
815F4
815F8
815FC
- all are 32-bit, so use slong cmd to write to them

Values for different baud rates:
100A0 - 19200 (current setting)
10050 - 38400
10034 - 57600
1001A - 115200

BINGO
dlong 815F4 1001A
wrote, disconnect, reconnect at 115200

btw:
dlong 815f0 1001a loose connect and can not reconnect

abyrvalg · « **Reply #204 on:** September 18, 2020, 04:34:46 pm »

Great!

Looks like 815F0 controls some internal module-to-module port, so the CPU looses the communication with some essential part of hw.

suj · « **Reply #205 on:** September 18, 2020, 04:38:39 pm »

I have edited my list in the post https://www.eevblog.com/forum/testgear/enabling-options-on-agilent-esa-series-e4402b-e4404b-e4405b-e4407b/msg3238350/#msg3238350. As memo.

tv84 · « **Reply #206 on:** September 18, 2020, 05:00:38 pm »

Quote from: smgvbest on September 18, 2020, 03:46:38 pm

Do you want the same dump we've had before or a different one?

To start let's do:

A memdump from 0x045A 0000 up to 0x0490 0000.

Before doing it, try to license 1 or 2 options, as you did before.

suj · « **Reply #207 on:** September 18, 2020, 05:44:31 pm »

My memory dump with real licences.

smgvbest · « **Reply #208 on:** September 18, 2020, 06:02:56 pm »

Quote from: tv84 on September 18, 2020, 05:00:38 pm

Quote from: smgvbest on September 18, 2020, 03:46:38 pm
Do you want the same dump we've had before or a different one?

To start let's do:

A memdump from 0x045A 0000 up to 0x0490 0000.

Before doing it, try to license 1 or 2 options, as you did before.

Order is important on this
follow the steps from @suj

dump started @ 115Kb
dbyte 045a0000 3538944

lincenses entered
AYZ 888888888888
IDS 999999999999

smgvbest · « **Reply #209 on:** September 18, 2020, 06:12:06 pm »

Quote from: suj on September 18, 2020, 05:44:31 pm

My memory dump with real licences.

What options/keys did you have installed? might help searching for them

FWIW , according the sanatazation guide. Options/Licenses are stored in FLASH.
the FLASH on the BOARD is for FW, the FLASH SIMM is where your c: drive is an likely where options are stored permamently

suj · « **Reply #210 on:** September 18, 2020, 06:16:35 pm »

My E4407B came to me with the following licensed options:
1D5 Hi Stability Freq Ref
1DR Narrow Resolution BW
AYZ External Mixing

smgvbest · « **Reply #211 on:** September 18, 2020, 06:25:53 pm »

Quote from: suj on September 18, 2020, 06:16:35 pm

My E4407B came to me with the following licensed options:
1D5 Hi Stability Freq Ref
1DR Narrow Resolution BW
AYZ External Mixing

1DR Narrow Resolution BW
this is where I think we should start. most by not all SA's have the hardware for this built in

Mine has no licensed options installed, but hardware options that do not require licenses I have

1D5 Hi Stability Freq Ref
1DN TG 3.0Ghz
IDN

abyrvalg · « **Reply #212 on:** September 18, 2020, 06:28:47 pm »

BTW, with modern serial ports supporting fractional baud rates (i.e. FTDI-based) and terminal sw supporting arbitrary baudrate numbers (not a dropdown list of fixed values) it should be possible to achieve speeds higher than 115200. The relation is: baudrate=25000000/(16*(((BRG & FFFF)>>1)+1), so the theoretical maximum is 1.56mbps. With 25MHz base frequency higher speeds deviate too much from the standard values, but fractional-capable ports should handle it. The only question is ESA’s hardware limit (i.e. some slow buffers in the signal path).

smgvbest · « **Reply #213 on:** September 18, 2020, 06:30:49 pm »

Quote from: tv84 on September 18, 2020, 05:00:38 pm

Quote from: smgvbest on September 18, 2020, 03:46:38 pm
Do you want the same dump we've had before or a different one?

To start let's do:

A memdump from 0x045A 0000 up to 0x0490 0000.

Before doing it, try to license 1 or 2 options, as you did before.

dbyte 045a0000 3538944

lincenses entered
AYZ 888888888888
IDS 999999999999

dump attached

smgvbest · « **Reply #214 on:** September 18, 2020, 06:34:01 pm »

Quote from: abyrvalg on September 18, 2020, 06:28:47 pm

BTW, with modern serial ports supporting fractional baud rates (i.e. FTDI-based) and terminal sw supporting arbitrary baudrate numbers (not a dropdown list of fixed values) it should be possible to achieve speeds higher than 115200. The relation is: baudrate=25000000/(16*(((BRG & FFFF)>>1)+1), so the theoretical maximum is 1.56mbps. With 25MHz base frequency higher speeds deviate too much from the standard values, but fractional-capable ports should handle it. The only question is ESA’s hardware limit (i.e. some slow buffers in the signal path).

The RXD_RP and TXD_RP go direct to U63/MAX232ACWE

suj · « **Reply #215 on:** September 18, 2020, 06:39:10 pm »

From DS MAX232ACWE

Code: [Select]

High Data Rates
These transceivers maintain the RS-232 ±5.0V minimum
driver output voltages at data rates of over
120kbps. For data rates above 120kbps, refer to the
Transmitter Output Voltage vs. Load Capacitance
graphs in the Typical Operating Characteristics.
Communication at these high rates is easier if the
capacitive loads on the transmitters are small; i.e.,
short cables are best.

smgvbest · « **Reply #216 on:** September 18, 2020, 08:08:11 pm »

@suj

Do you by chance have a XGecu T56 Universal programmer by chance?
I just got my PCB to try to read the FLASH SIMM
assuming it works I could send a board to you to read out yours.

unless we know the address for that FLASH SIMM and we can read out thru the monitor now?

suj · « **Reply #217 on:** September 18, 2020, 08:25:37 pm »

I don't have this programmer. I have an older SEPROG programmer that supports some FLASH but I have to check. I doubt if such large memories. I finished using the programmer and EPROM emulator with the end of the 8051 and EPROM with a UV window era. Maybe send me your PCB gerbers? I will order from JLCPCB or locally and I will have it in a week. I would also have to order a 72 pin SIMM socket from Mouser. I haven't seen a SIMM anymore at the local main supplier, but I will check with smaller sellers.
I can also locally look for a more modern programmer. Any suggestion of type of the programmer?

smgvbest · « **Reply #218 on:** September 18, 2020, 08:43:41 pm »

Quote from: suj on September 18, 2020, 08:25:37 pm

I don't have this programmer. I have an older SEPROG programmer that supports some FLASH but I have to check. I doubt if such large memories. I finished using the programmer and EPROM emulator with the end of the 8051 and EPROM with a UV window era. Maybe send me your PCB gerbers? I will order from JLCPCB or locally and I will have it in a week. I would also have to order a 72 pin SIMM socket from Mouser. I haven't seen a SIMM anymore at the local main supplier, but I will check with smaller sellers.
I can also locally look for a more modern programmer. Any suggestion of type of the programmer?

I'm making some changes to the PCB to fix some minor issues I encountered. happy to share the gerbers though
this could be used with any programmer that supports the FLASH Memory but is designed for the T56
the T56 is the TL866II Plus (very popular unit) bigger brother and the direction they are going. supports 25K+ memorys and logic IC's

suj · « **Reply #219 on:** September 18, 2020, 08:50:40 pm »

My quick research favors TL866II+. Over 3x cheaper in my country than the T56.

smgvbest · « **Reply #220 on:** September 18, 2020, 09:05:33 pm »

Quote from: suj on September 18, 2020, 08:50:40 pm

My quick research favors TL866II+. Over 3x cheaper in my country than the T56.

But it can’t read the flash on the simm module
T56 has extra I/O to do it

If you want a unit for general use the TL866II+
Is a great unit

suj · « **Reply #221 on:** September 18, 2020, 09:08:26 pm »

I performed a memory dump after a reset. It's different

abyrvalg · « **Reply #222 on:** September 18, 2020, 09:11:45 pm »

I can derive a rough memory map from QUICC's BRx/ORx regs initialization:
0: 00000000 [20000] SRAM-like, slow timing - this is BootROM as we already know
1: 04000000 [400000] DRAM-like, fast timing - this is DRAM bank 0
2: 04400000 [400000] DRAM-like, fast timing - this is DRAM bank 1
3: 02000000 [20000] SRAM-like, external timing - FPGA ? DIP switches regs are here, flash size reg, DRAM size reg
4: 08000000 [100000] SRAM-like, external timing - ??
5: 0A000000 [80000] SRAM-like, external timing - this is SRAM
6: 0C000000 [400000] SRAM-like, external timing - this is firmware flash
7: 0E000000 [20000] SRAM-like, external timing - ??

Try dumping a small piece from each of the two unknown regions (08000000, 0E000000), maybe the content will provide some ideas.

suj · « **Reply #223 on:** September 18, 2020, 09:20:39 pm »

Code: [Select]

->dbyte 08000000 256                                                            
08000000  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000010  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000020  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000030  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000040  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000050  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000060  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000070  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000080  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
08000090  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000a0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000b0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000c0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000d0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000e0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................    
080000f0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff   ................

Code: [Select]

->dbyte 0E000000 256                                                            
0e000000  05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00   ................    
0e000010  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000020  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000030  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000040  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000050  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000060  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000070  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000080  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e000090  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000a0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000b0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000c0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000d0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000e0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................    
0e0000f0  bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00   ................

suj · « **Reply #224 on:** September 18, 2020, 09:31:51 pm »

Maybe this memory map is related to CS signals from QICC?


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B (Read 65891 times)

Share me