Has anybody enabled Tracking Gen on Agilent N9340B?

[tv84]

Done, here is full list with corresponding handler functions:
https://pastebin.com/Ue5WtKm8

"CMD=" form means "CMD with parameters"

@abyrvalg,

I don't think this list is totally correct. It seems there are many commands which are not valid.

My comment is just from an analytical POV and not from commands experimentation and/or code analysis. I think Agilent/KS would never create commands like, for example:

STATUS:QUESTIONABLE:EVENT:INTEGRITY:EVENT:UNCALIBRATED:EVENT:NTRANSITION?
CALCULATE:MARKER:SET:SET:FCOUNT:STATE

Also, how could 1800+ commands generate only 300+ different functions?

I did my parsing, using this rules:
0xFF - means end of tree branch
0x00 - tree leaf
current_state_idx == next_state_idx - bypass

My output is attached. I could be missing something (or not) but, definitely, this list seems more like "usual" SCPI commands. Even though, it still generates 808 commands.

Edit: I just corrected the current_state_idx == next_state_idx processing because all already included the SET command. New file attached.

Edit1: New output in a later msg.

[abyrvalg]

Yes, some commands don't look good definitely. Digged the parser a bit deeper - it is much more complicated than I've thought:
- functions specified by func_idx are called for all matching intermediate keywords too (not just for leaves) and they can affect further parsing by setting/clearing some flags (i.e. s_bool, s_unbool), checking for some conditions etc
- the current state is checked for some specific values and some parsing actions are taken right in parser loop
So just walking those state arrays is not enough, much more manual work is required (check for each of those intermediate flags-changing funcs in script logic to take some actions, check for special states etc). Doable, but it doesn't look like fun anymore, this is closer to "harvesting a field" than to "hunting" already
The same tree with intermediate functions: https://pastebin.com/xgi3wkcd

[tv84]

- functions specified by func_idx are called for all matching intermediate keywords too (not just for leaves) and they can affect further parsing by setting/clearing some flags (i.e. s_bool, s_unbool), checking for some conditions etc

I thought you has previously studied that part.

I had that question myself from the beginning but decided to close my eyes to that. Nonetheless, the last func is the important one.

Doable, but it doesn't look like fun anymore, this is closer to "harvesting a field" than to "hunting" already

  I'll have a look to see if I can add something valid.

[tv84]

New SCPI command list with lower/upper cases. Includes 322 different commands.

I've filtered all the repeated commands.

For me, this is the final command list. Fun's over.

@abyrvalg, the intermediate "functions" allow for the parsing of what I did manually in this filtering. Not worth the trouble of reversing.

[analogRF]

confirmed:
DEBUG:REMOTE:OPTION:CLEAR works
with DEBUG:REMOTE:OPTION you can enable/disable individual options

EDIT: DO NOT try undocumented options 

[1design]

Agilent N9340B license generator

For all owners of this Agilent HSA, here is a quick vacation gift (created in less than 1 hour between some pool dives  ).

The code is C# but should be totally self-explanatory.

Code: [Select]

        private static void calc_Agilent_N9340B(string hostID)
        {
            string[] option = { "PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF",
                                "INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01" };
           
            if (hostID.Length != 8)
                Console.WriteLine("Error in hostID length!");

            for (int m = 0; m < option.Length; m++)
            {
                byte[] hash = MD5.Create().ComputeHash(Encoding.ASCII.GetBytes(hostID + option[m]));

                Console.Write("{0,-2}   {1}   ", m, option[m]);
                for (int i = 0; i < hash.Length; i++)
                {
                    byte c = 0;
                    for (int j = 0; j < 8; j++)
                        c += (byte)(hash[i] ^ hostID[j]);

                    c = (byte)(c % 36 + 48);
                    if (c > 57)
                        c += 7;
                    Console.Write(Convert.ToChar(c));
                }
                Console.WriteLine();
            }
        }

Is there any way of getting this in Python? I am a HW kind of guy and translating from C# into something I can run locally is sadly above my head..

[tv84]

Is there any way of getting this in Python? I am a HW kind of guy and translating from C# into something I can run locally is sadly above my head..

Sorry, I hate python. Maybe someone can do that for you.

[ytterligare]

Hello, I resume this topic because I was able, thanks to the hard work of a lot of people here, to "supercharge" my 2nd hand N9340B.... ( especially with the help of the diving man  )

Anyhow, I was wondering, among the "dangerous" undocumented options not to be touched, if the following :

DFS   Diagnostics
SO3   Source

could be "less" dangerous to try.


The first was described by abyrvalg as "some diagnostic option, it can be enabled by entering a fixed option code 44448888" ( this last sentence is not really clear to me : where should we enter the "option code" ? After enabling the option ?)

The second, in my idea, could, I say COULD, enable the option of letting the SA act also as a basic RF Generator, something already seen on other more recent SAs

Any thought ?

Andrea

[nexus]

Hi all,

I just picked up a gov. surplus auction n9344c in unknown condition (still on its way in the mail).

Very interesting read here; hopefully if this analyzer works I can get some options installed. It doesn't have the TG hardware but the preamp would be great for EMI probing since the analyzer can tune down to 9khz.

What I'm gathering is that option enabling can be done in a serial terminal (RS232) right under the batt door. Is pic attached the right connector? Also, does anyone have info on the connector type/pinout and baud/parity for connecting a usb 232 uart?

Looking forward to some hacking!

[Mallocated]

I bought myself a N9340B, noticed a similar debug connector and then spent months debugging and dumping decompiled code using the VXWorks console and all the wrong type of decompiling tools.  Eventually I found that all the correct licence codes were output via the console as a debug message whenever you entered any correct or incorrect licence via the instrument.   Too easy.  THEN this post popped up and people who knew what they were doing had it cracked within a few days in between dips in the pool!

I've now got a N9342C, and unfortunately I don't think the SCPI method in this post works - tried it once.  I found a way using the VXWorks console, adding breakpoints and dumping memory locations. 

To get started, see attached, and this;

https://nz.rs-online.com/web/p/wire-to-board-cable-assemblies/1617531/

And you'll need this;
cid
cid123456

And you'll hopefully see the attached bootup sequence and login.  Baud rate I think was either 19200 or 57600.
Baud rate is 115200.

[nexus]

Roger. Thank you for this info!
Will have an update in the coming weeks once I get the analyzer in hand and have a poke around.

[nexus]

Good news. My n9344c came in the mail today. It's seen some love in the field but nothing drastic from the outside.

I bought a new AC/DC 15 volt adapter straight from Keysight so attached the plug pack to my AC6801 ac supply (for safety when attaching unknown analyzer). Plugged in the N9344C and immediately the plug pack went into protect mode, trying to start up every few seconds but cutting out.

So power problem straight away. Measured resistance across barrel jack and under 2 ohms center to shield. Definite problem.

So begin teardown to digital motherboard where barrel jack is mounted. Nothing looks burnt, but there is basically a short on DC input.

Ok, so whip out the thermal camera and hook up programmable psu to barrel jack. 2 volts, 0.1 amps and keep increasing in 0.1 amp steps. At 0.3 amps, the culprit tantalum cap begins to get warm. Found ya!

Took the failed tant off (thank god it didn't explode and ruin the board). Reassembled temporarily and plugged in. Analyzer powers on and sweeps with no errors! Do a firmware update, no problem. It's working with no issues to be seen. Need to test with signal gen but will first clean (a little crusty on the inside too) and replace removed tant. Bought the serial header so we will definitely try to get that preamp option enabled!

[Mallocated]

Good skills.  If you still have the case open, any chance you could post some photos of the GPS module and any identifiers?  Wondering if it's Agilent branded or an off-the-shelf product. I've fitted a generic GPS module to my N9342C and got it working with a firmware modification, but the instrument timebase calibration from GPS PPS output is still no go.  Thanks. 

[Mallocated]

This might help with troubleshooting the DC input and protection circuit....

[nexus]

No problem. Here are some pics. There is only one marking on the board under a sticker, hopefully it can be identified.

I know agilent had some good block diagrams for their equipment back in the day. Nice to have an actual schematic too! Is that snip out of a service manual for an N93XX somewhere online?

[Mallocated]

I've found photos of another Agilent board with the same MSB-01 and MSS-B labels, so that points to Agilent manufacturing.

The module's G253 GPS patch antenna is by Inpaq www.inpaqgp.com


Also there's the logo next to the sticker that looks like FP or PF of you rotate it 90deg.

That's where the trail goes cold for me. 

Keysight still list the GPS module part for $339
https://www.keysight.com/my/partDetail/N9344-65011

[nexus]

Replacement tants came in today, so while I was putting those on the main board I also elected to have a look inside the GPS module.

Definitely is a little custom agilent board. Looks like the module is mainly a GlobalSat EB-3531 SIRF III with a 50 ohm bidirectional coupler and some matching network and filtering passives. If you have the pinout, might be able to reverse engineer and make one that's plug and play.

[Mallocated]

When you look at the design and build quality you can see why the module pricetag is $350.

I fitted a cheapo Adafruit Ultimate GPS breakout board to mine, which has a Globaltop FGPMMOPA6H module with MediaTek MT3339 GPS Chipset.  I had to change the module baud rate to match what the instrument was expecting, which meant reflashing with an altered firmware.  If anyone needs the full process I'll start a new post.  Quite a long process, it would be heaps easier if there is a compatible SIRF-based module out there.

Thanks for disecting your GPS module - for the greater good.

[milesd969]

I'm new to the forum, I would ask for help I have an agilent n9340b, it can't raise the Agilent logo system on the display and that's it.
I will attach a file from the serial console, any help is welcome flash file I would try to write it in my SA, thanks

[analogRF]

I'm new to the forum, I would ask for help I have an agilent n9340b, it can't raise the Agilent logo system on the display and that's it.
I will attach a file from the serial console, any help is welcome flash file I would try to write it in my SA, thanks

Looks very much like the nand flash device is defective or at least corrupted. But most likely the chip itself is bad. Assuming the power supplies are OK

[NA5B]

Hello milesd969, I had the same or similar problem with my N9340B. The logo appeared and stayed forever and nothing else.
This is what I did to fix the problem:
I downloaded Keysight N9340B PC Software and Keysight Connection Expert software first. Found a "Cross Over" LAN cable. Used the device's default 192.168.0.112 IP number. I tried, no success.
Later I set my PC IP to 192.168.0.110  that's what the instructions wrote. Connection Expert program registered the SA as UNKNOWN device! I said ok, at least there is something. I verified this by turning on and off the SA. I was able to see this unknown device appear and disappear.

Later I tried the Keysight N9340B PC Software program. It had a "LAN connection and firmware update" button. I tried to connect to the SA. Again no response. I restarted the software run as admin. Still the same. I ignored this and I went ahead and chose my latest update file. Clicked the UPDATE button and magically it showed the upload bar, uploading files 1,2, and 3 and it stopped for a long time on 3. I was so happy then I got confused. I started thinking that this was a false upgrade move. BUT then it started counting file 4 and up!!!! :- )  So, some files took longer to load. 280 some files later it wrote: Files uploaded, firmware updated, please restart the SA. This file upload took about 10 minutes forever!
I turned the SA off and then on. The Agilent logo stayed a bit longer, then the screen went blank and then showed the actual graphics. Now It works as it should.

[milesd969]

Problem solved, I bought another analyzer N9340b from the motherboard, I unsoldered a flash S29GL512P10TFIR1. I used the Xeltek Superpro 3000U programmer, I managed to get the contents of the flash file, using the binary image I filled the old flash, when I started the analyzer everything worked.
I later unlocked all the options for this analyzer model using an algorithm written by a diving man from this forum

[WernerFalken]

Bumping this again. Any chance on getting an updated code generator to work on N9342C/N9344C? Works great on the N9340B!

[tv84]

Bumping this again. Any chance on getting an updated code generator to work on N9342C/N9344C? Works great on the N9340B!

Colby, it's your lucky day. I revised the previous code and added the N9340C generation code.

Here.

[tv84]

This is the list of options for N9340C family:

Code: [Select]

P06 - Pre-amplifier, 100kHz to 6GHz
TG6 - Tracking Generator, 5MHz to 6GHz
DMA - ASK/FSK Modulation Analysis
AMA - AM/FM Modulation Analysis
PWM - U2000 series support
IBO - IBOC AM and FM
XDS - xDSL Measurement
SIM - Spectrum monitor
CHP - Channel Power
ACP - Adjacent Channel Power Ratio
OBW - Occupied Bandwidth
SEM - Spectrum Emission Mask
FST - Field Strength
F04 - Freq extension to 4.2 GHz
F06 - Freq extension to 6 GHz
F07 - Freq extension to 7 GHz
F13 - Freq extension to 13.6 GHz
F20 - Freq extension to 20 GHz
LAN - LAN port, TCP/IP
RBW - Resolution bandwidth, 10 Hz/3 MHz
FSA - Fine resolution step attenuator
GPS - Built-in GPS receiver and antenna
TPN - Task planner for test automation
TG7 - Tracking Generator, 5 MHz to 7 GHz
SEC - Security features
DST - Temporary License, for demo unit
DT1 - Temporary License
TG4 - Tracking Generator,5 MHz to 4.2 GHz
PA4 - Pre-amplifier, 100 kHz to 4.2 GHz
PA7 - Pre-amplifier, 100 kHz to 7 GHz
P13 - Pre-amplifier, 13.6 GHz
P20 - Pre-amplifier, 20 GHz
CAT - Cable and antenna test
TMG - Time-gated spectrum analysis
BB1 - Baseband input
F7G - Freq extension to 7 GHz
PWS - Power suite
DIA - Diagnostics
F24 - Freq extension to 24 GHz
OPE - Simplified operator mode
SCN - Channel Scanner
CAU - Cable and antenna test
CA7 - Cable and antenna test, 7GHz
CA6 - Cable and antenna test, 6GHz
F08 - Freq extension to 8.5 GHz
PA8 - Pre-amplifier, 100 kHz to 8.5 GHz
PWP - U2020 x-series support
D24 - Temporary License, 24 months
G01 - General-Purpose Interface Bus
CAL - Calibration
RM7 - Reflection Measurement
MNT - Spectrum monitor
PFR - Precision Frequency Reference
P07 - Pre-amplifier, 100 kHz to 7 GHz
EMC - EMC filter and QPeak Detector
TFE - Tracking Generator frequency extension