Author Topic: Hacking the Advantest R3*61 Spectrum Analyzers. (Read 11616 times)

chick0n · « **on:** August 15, 2013, 07:33:25 pm »

Maybe anyone here owns an Old Advantest R3261 or R3361 Spectrum Analyzer.

I was able to Convert my R3361A (2,6GHz) to R3361B (3,6GHz) and Enable all Options, just by Changing some Firmware bits.

You can find Everything here:
http://groups.yahoo.com/group/advantestinstrument/files/-%3DAdvantest%20-%20R3261%263361%3D-/

chick0n · « **Reply #1 on:** August 15, 2013, 09:37:44 pm »

New Method:

There is a Debug Menu you can Enter, by typing "SHIFT" and then "BK SP" where you can Read and write the Complete Memory Map. (EEPROM is between 1A0000 and 1A3FFF). So you can Change the few Bits without Desoldering.

----------------------------------------------------------
When "Debug Mode Method" is used, you can Change from R3*61A to B (3,6GHz)
without Problems. No Desoldering.

The Compensation Data won't get Corrupted!! The Analyzer will work fine to
3,6GHz even with Tracking Generator.

!!!! BE EXTREMELY CAREFUL WHEN YOU DO SOMETHING IN DEBUG-MODE !!!!

Or you're screwed

Address Content
1A3FE0 0003 - Don't Change
1A3FE2 361A - You Can Change to 261A/B 361A/B

1A3FE4 0000 - ONLY CHANGE TO 1111 WHEN YOU HAVE "CONTROLLER" BOARD
INSTALLED!!!!!!!!! Or Analyzer will Freeze on Boot up.

1A3FE6 2222 - "OBW/ADJ" Option
1A3FE8 3333 - "Gated Sweep" (Hardware Option?)
1A3FEA 4444 - "Serial I/O" (Hardware Option)
1A3FEC 5555 - "Preselector" (Hardware Option)
1A3FEE 6666 - "New Synthesizer" Don't Change.
1A3FF0 7777 - "Printer" Option?
1A3FF2 8888 - "Multi Marker" Option
-------------------------------------------------------------

Fraser · « **Reply #2 on:** August 15, 2013, 10:43:45 pm »

GREAT ! Thank you.

I have just such a unit and this upgrade will be very useful indeed.

Thank you for the effort you put into this

GregerG · « **Reply #3 on:** February 17, 2014, 06:08:10 pm »

I've uploaded my E04 version firmware to the advantest yahoo group file area if you have an older version.
Firmware eproms are socketed btw so is an easy update.
Send me a note if you prefer a direct download link...

Just did the hack myself and it works great... 3.8GHz is nice!

Fraser · « **Reply #4 on:** February 17, 2014, 08:29:36 pm »

Great. Thank you

I have not had a chance to change my unit to a 3361A but its on the 'to do ' list.

I am a member of the Advantest Groups so will download the later firmware images.

Cheers

Aurora

Svuppe · « **Reply #5 on:** February 18, 2014, 05:41:02 am »

You are talking about R3361A and B, but I have a 3361C. Does anyone know what the difference is? And does the same hack work on mine to make it into a D model?

Richard Head · « **Reply #6 on:** February 18, 2014, 07:26:47 am »

I also have a 3361C. Will the mod work on this model also?

Unrockstar · « **Reply #7 on:** March 05, 2014, 09:17:25 am »

Hello Guys, Sorry for Hijacking this Threat.

Can anyone check the Adress 184000 (Ramp generator) ,
i only can write data to this adress, but the R3261A only read ffff from this adress.
my Spectrum Analyzer has a problem in the digital part.
When i press start the R3261A Reboot and when i press Freq Span the R3261A Hang Up.

I check the U503 with a Logic Analyzer and i became no Ack to the Bus,
RD WR Clock and CS are Fine.
I think the U503 is my Problem or a IC around of this.

Can Anyone check on his R3261 if its possible to write and read data from this adress?

Thanks

Tantratron · « **Reply #8 on:** February 10, 2022, 01:46:43 pm »

Does anyone knows what are the key differences between R3x61A and R3x61C ?
Same question between version B and versions D ?
Suppose that I purchase a A serie, will I miss some features or enhancement as opposed a C serie ?
Thank you, Albert

chick0n · « **Reply #9 on:** February 10, 2022, 02:29:05 pm »

The R3x61 was Produced for a long time. I think from 1980`s till the 2000`s.

The C and D Versions are slightly upgraded revisions. More modern/better? parts, etc..... Because the older parts werent available anymore.... Maybe they have slightly better specs....

The C and D Version also have a more Modern CPU Board. Its faster, produces better picture, and maybe has more functions.. (Measuring Window
Function)

chick0n · « **Reply #10 on:** February 10, 2022, 04:45:44 pm »

When I look at the datasheets, I can spot no Differences.

https://www.testequipmenthq.com/datasheets/ADVANTEST-R3261C-Datasheet.pdf
http://usedpribor.ru/data/Advantest_R3261A,_R3261B,_R3361A,_R3361B.pdf

I own a used R3361A, that was used in a production environment for a decade.
I never had problems with it, except a few dryed out caps in the CRT.

Maybe the AB versions are even better, because they used standart electrolytic caps. And the CD version has the infamous SMD Caps from the 90s.

Tantratron · « **Reply #11 on:** February 10, 2022, 04:50:56 pm »

Quote from: chick0n on February 10, 2022, 02:29:05 pm

The R3x61 was Produced for a long time. I think from 1980`s till the 2000`s.

The C and D Versions are slightly upgraded revisions. More modern/better? parts, etc..... Because the older parts werent available anymore.... Maybe they have slightly better specs....

The C and D Version also have a more Modern CPU Board. Its faster, produces better picture, and maybe has more functions.. (Measuring Window
Function)

I'm intending to purchase one or two used R3x61y for specific pre-compliance EMC testing but still confused about different versions.

When viewing some old datasheets, it seems bad idea to purchase no suffix model (plain R3x61 with no letter) because max dBm is less and span starts from 50KHz instead of 10KHz.

This means Advantest improved their design starting from suffix A/AN (9KHz-2.6GHz) and B (9KHz-3.6GHz) towards new design C/CN and D. Maybe the RF acquisition board stayed the same so only the main board or processor board improved, no idea since I've not seen any of these so far.

The AN and CN seems able to go different RF input sensitivity (-19 dBu to +132 dBu) versus (-130 dBm to +25 dBm) for A/B/C/D.

Do you think wise and better that I purchase the C or D instead of older design A or B ?

As for the CRT display, is there quick failure and LCD-TFT replacement kit ?

Thank you for guidance, Albert

chick0n · « **Reply #12 on:** February 10, 2022, 04:58:54 pm »

I never heard of R3x61 without suffix.

The N versions have 75Ohm input.

I dont know about a LCD replacement. But you can hook up a external monitor, it has composite video output.

Tantratron · « **Reply #13 on:** February 10, 2022, 05:11:24 pm »

Quote from: chick0n on February 10, 2022, 04:58:54 pm

I never heard of R3x61 without suffix.

The N versions have 75Ohm input.

Thank you for alerting me about the 75 ohms versus 50 ohms RF input so then I'll rather only go A/B/C/D and not CN/DN for my EMC pre-compliance testing project (conducted noise and radiated noise).

Tantratron · « **Reply #14 on:** February 10, 2022, 05:28:08 pm »

Do you know if the acquisition board of R3261x is the same as the R361x so in other words, does the RF input board host both the the Tracking generator then if yes, is it possible to software hack to add the TG ?

Of course one would need to solder an N-type output RF connector.

chick0n · « **Reply #15 on:** February 10, 2022, 05:29:15 pm »

Quote from: Tantratron on February 10, 2022, 05:28:08 pm

Do you know if the acquisition board of R3261x is the same as the R361x so in other words, does the RF input board host both the the Tracking generator then if yes, is it possible to software hack to add the TG ?

Of course one would need to solder an N-type output RF connector.

No TG is an extra Module.

serg-el · « **Reply #16 on:** February 11, 2022, 09:32:38 am »

Spectrum analyzer data tables from the 1990, 1992-93, 1994 and 1998 catalogs.
R3361K_NK are designed to test cable television systems. Although they can be used for other purposes.

Tantratron · « **Reply #17 on:** February 11, 2022, 09:53:11 am »

Quote from: serg-el on February 11, 2022, 09:32:38 am

Spectrum analyzer data tables from the 1990, 1992-93, 1994 and 1998 catalogs.
R3361K_NK are designed to test cable television systems. Although they can be used for other purposes.

Many thanks so do you mean the K versions could ne be used for EMC pre-compliance testing (logarithmic X-axis display, QuasiPeak estimation)... ?

Does the K version firmware blocks or restricts some specific spectrum analyzer functions ?

serg-el · « **Reply #18 on:** February 11, 2022, 10:49:09 am »

The difference from version C and D is as follows:

(1)   Frequency can be set by specifying the channel number of the television.
(2)   Programs in the memory card can be executed easily.
(3)   Audio can be monitored through the built-in speaker.
(4)   Good visual recognition in the outdoors is provided by adopting the high brightness green CRT.

User manual R3261_3361_C_D_K :
https://cloud.mail.ru/public/b4bn/umJexn7hE

Silicium81 · « **Reply #19 on:** May 13, 2024, 07:30:06 pm »

Hello,
I would like to transform my R3361A into R3361B using debug mode and modify the affected byte.
However, I have a problem... How do I enter a hexadecimal address using the keyboard? Should this address be transformed into decimal?
Or is there a solution to enter the characters a, b, c, d, e and f?
Edit: find !
a: CENTER FREQ
b: FREQ SPAN
c: START
d: STOP
e: REF LEVEL
f: COUPLE

Hack R3361A to R3361B successfull

Use GHz key touch for validation

Tantratron · « **Reply #20 on:** February 16, 2026, 04:33:18 am »

Hello, I now own 3 Advantest R3x61 which have been reconditionned (R3261A, R3361A, R3361K) running under different firmware revision (D00, E04 and E20).

So I've used the hacking method based on DEBUG mode described here applied to tried my R3361K (special custom model made by Rohde&Schwarz for an unknow customer in Germany). When viewing the register 1A3FE2 the result is 361E so I thought to write 361F value to see if it would extend to 3.6 GHz like the A/B or C/D paradigm.

When it reboot, it would ask lot of question which you can see in my screen shots attached.

I was luckily able to try different version so end up from the same platform running under E20 firmware with either R3361A, R3361B, R3361C, R3361D and R3361K as well as adding different options (see attached screenshots.

Tantratron · « **Reply #21 on:** February 16, 2026, 04:34:47 am »

Further findings where I've decided to force to unkown model 361F into my R3361A running with older firmware E04.
Same conclusion as before where it will propose to identify and choose what model, what options as with under firmware E20, see new attached screenshots.
Note it does not propose to choose between A/B or C/D which seems logical (older firmware) so you can only be A/B and to my surprise, you could still choose K.

Tantratron · « **Reply #22 on:** February 16, 2026, 04:36:55 am »

Here are now the tracking generator results transforming into R3361B and R3361D. I believe my RF coaxial link (HYTHEM) for the TG test to be high quality so the result should be flat in theory.

Attached both results which shows one case (R3361B) to be quite good when extending to 3.6 GHz, the 2nd case (R3361D) not so good which quite confirm the wrong theory or claim in the past about EEPROM constant to be valid up to 3.6 GHz. Their values are only valid to 2.6 GHz and only if authentic factory 3.6 GHz then EEPROM constant would be correct.

Unless I'm wrong, so far nobody has ever dumped the EEPROM content of real R3361B/D which is sad because we'll never know the exact data structure of this calibration.

Tantratron · « **Reply #23 on:** February 16, 2026, 04:39:33 am »

By the way, the LCD color retrofit to replace monochrome CRT is not a hack per say, still the result are really nice if you are interested as shown in my YouTube channel


EEVblog® Main Site	EEVblog® on Youtube	EEVblog® on Twitter	EEVblog® on Facebook	EEVblog® on Odysee

Author Topic: Hacking the Advantest R3*61 Spectrum Analyzers. (Read 11616 times)

Share me