HP/Agilent 1675x logic analyzer card memory up-hack

[MarkL]

A potential new up-hack has been found for the 16710A and 16711A modules, which can turn them into a 16712A.  This is an increase from 8k and 32k samples, to 128k samples.  These modules are all 100MHz state and 500MHz timing, and have a density of 102 channels per card (that's three pod connectors).

I recently bought a 16712A module for really cheap, and I was able to change it into either a 16710A or a 16711A card by playing with R568 and R569.  They're on the back near the backplane connector (see photo for location).  As with all the other cards in this thread, the sloppy soldering and flux residue gave the ID resistors away immediately.  Plus, in this case, a resistor termination was ripped off and left on the pad - nice!.

I came up with the following table:

   Model   R568  R569
  ------   ----  ----
  16710A    1k    1k
  16711A   open   1k
  16711A    1k   open *
  16712A   open  open

  * - There are two combinations that are recognized as 16711A, but
      this one is used on an actual 16711A, as seen on a picture from
      ebay.

All self-tests pass for all combinations.  I took a guess that the missing ID resistors were 1k.

I'm saying this a POTENTIAL board hack, because taking a maxed out model and lowering its capabilities is not proof that it can go the other way (e.g., convert the lower two into a 16712A).  It seems highly likely, however, given that this works with many of the other cards in the 167xx series.

The 16712A uses 12 x 58L32L36F (32kb x 36), 6 of them on top and 6 on the bottom.  This adds up to 12 x 32k x 36 = 14155776 bits, which is actually enough for 108 channels, so it's a little more than is needed.  Maybe it uses the extra bits for testing or an internal purpose.  But the point is, if the lower memory 16710A and 16711A cards also have this same memory complement, they should be able to be maxed out.

Does anyone have a 16710A or 16711A who wants to try to make it a 16712A to verify all this?  Please post back your results!

[MarkL]

I have another 167xx series module up-hack.  This one allows you to turn a 16716A into a 16717A.

The 16716A and the 16717A are identical in features, except: 1) the 16716A is 512k samples and the 16717A is 2M samples, and 2) the 16716A is 167MHz state and the 16717A is 333MHz.

Like other up-hacks in the 167xx series, the lesser 16716A has the full complement and same speed of memory consisting of 34x OKI M5416283-50 (256k x 16 bits).  I believe the maximum state speed is artificially limited based on its configured model.

I compared a 16717A card that I possess with on-line photos of 16716A and was able to find the ID resistor to turn my 16717A into a 16716A.  The ID resistor removal by the factory on my 16717A card was a little neater than I have seen on other cards, and was easier to overlook.  However, once identified it was quite clearly populated at manufacture time and then later removed.

The ID change from 16716A to 16717A is accomplished by removing a single 0805 1k.  See photo for location.  The area from the photo is on the bottom of the card, near the backplane connector.

Similar to the 16710A/11A/12A cards previously posted, this experiment is taking a card that is maxed out and then reducing it, so it's not proof-positive that it can go the other way, but I have no reason to believe it will not work going from 16716A to 16717A.  If anyone has a real 16716A and performs this up-hack, please post your verification here.


Related info: The 16715A card appears to be the same as the 16716A and 16717A cards except for the lack of the five timing zoom chips on top (1NB4-5040) and supporting zoom circuitry.  I couldn't find any ID resistors or jumpers that are different on the 16715A, which makes me believe the software differentiates between the 16715A and 16717A by looking for the presence of the timing zoom chips.

[keitheevblog]

I have another 167xx series module up-hack.  This one allows you to turn a 16716A into a 16717A.

Similar to the 16710A/11A/12A cards previously posted, this experiment is taking a card that is maxed out and then reducing it, so it's not proof-positive that it can go the other way, but I have no reason to believe it will not work going from 16716A to 16717A.  If anyone has a real 16716A and performs this up-hack, please post your verification here.

Excellent! Assuming my $15 16716A gets here on Saturday(as it's supposed to), and it tests OK, I may have some results on this as soon as this weekend!

[danielbriggs]

Continuing from the other 1690XA motherboard thread, it seems more appropriate for me to post here.

I too think there must have been something stored in the EEPROM's for the user-upgradable action to happen on the 169x cards, however I am keen to have a poke around just incase it's something trivial like the resistor mods. 

My 16902A unit arrived yesterday, and it came with one 16910A installed. It was a bit of a "see what turns up" from the seller, but to my surprise the 16910A is a 500MHz state with 16M memory. Most of the eBay 16910A's I've seen have been 250MHz and low-ish memory depth, so keen to compare this to other 16910A cards to see if we can work out the upgrade combinations.

I have attached some images below of the 16910A 500M State, 16M mem card resistor array combinations.
Are any other users able to do the same of their 16910/11A's + list what state + memory depth?
I think the 16910A's would be more useful than the 1675x's / 16950 due to the 40-pin probe support, vs the pricey 90-pin ones.


I have also attached some images of my 16950A board ID resistors. The state timing for the 16950A's are fixed at 600MHz, but my board here has a mem of 64M. This would be nice to replicate on other boards as is the highest upgradable option.
If you are able to do the same, again maybe we can work out what combination gives what?

However:
The board has a sticker over the PCB legend, saying 16950A. I peeled this back, and it turns out it is a 16974A, which has a listed stock memory depth of 4M.
So I am curious to also see the board ID resistor combinations for a stock 16974A.
Unfortunately my stock board ID seems to be different that MarkL's 16754A -> 16756A tested upgrade. 


I won't be able to power up the chassis for another day or so as waiting on some parts. So what the boards present in software will have to wait a day or two.

All the best,
Dan

[MarkL]

Some of my 16753A/54A/55A/56A boards have the same labeling as your 16950A, "16754-66510", and also underneath a sticker.

One thing to note is that these boards have a Xilinx FPGA (U128) and a Xilinx configuration EEPROM to go with it (U129, the 44-pin PLCC).  It looks like the EEPROM can be programmed after manufacture via either J1200 or P2, located nearby.  There might be something in the FPGA programming that limits fiddling with the ID resistors and/or forces the board to be recognized as a 169xx series.

There's also another EEPROM (U148), but it's possible that's only used for calibration data as implied in the service guide.

64M is the max (full channel) depth for the 16753A/54A/55A/56A cards.  You could count the memory chips on your 16910A card, look up the specs for the memory chip, and do the math to determine the max depth for it.

If you're looking for more cards with 40-pin pod capability, according to the compatibility chart the 1690x chassis supports the 16740A/41A/42A, 16750A/51A/52A, and 16750B/51B/52B with OS 3.70 or later (4 pods/card).  It's only the 16753A/54A/55A/56A and 16760A that are 90-pin in that series.

Yes, it will be interesting to see what your chassis thinks about different resistor combinations.  I can't help much since I don't have anything 169xx.  Nice of them to label the board ID resistors for you!

[Hamster]

Removal of the Resister on a 16716A does indeed pass a 16717A self test.
Removal of the Resister on a 16750A does indeed pass a 16752A self test.


Now, just need to look to fix these 3 errors:

Analyzer Chip Memory Bus Test
System Clocks ( Master/Slave/Psync)
Analyzer Memory Bus SU/H

I have 4 751A all reporting same error, however, they all have had trace damages in different areas that have been fixed, but they all come back to the same 3 errors .. 

[MarkL]

Removal of the Resister on a 16716A does indeed pass a 16717A self test.
Removal of the Resister on a 16750A does indeed pass a 16752A self test.

Thanks for the confirmation.

Now, just need to look to fix these 3 errors:

Analyzer Chip Memory Bus Test
System Clocks ( Master/Slave/Psync)
Analyzer Memory Bus SU/H

I have 4 751A all reporting same error, however, they all have had trace damages in different areas that have been fixed, but they all come back to the same 3 errors .. 

Have you looked at the detailed debug output from "pv"?

Maybe start another thread to dive into it, or continue in the "167xx series defect" thread:

  https://www.eevblog.com/forum/repair/series-defect-on-agilent-167xx-boards/msg3536318/#msg3536318

[Hamster]

16911A "Memory upgrade"

The Serial Eeprom on the underside of the board is for the Altere FPGA
The Unknown Part 16V08 ( Looks like a CPLD ) masquaring as a EEPROM appears to contain config data.

I have a 16911A w/PSYNC clock failure, if i can't figure it out, i may try to power up the board and try to figure out how to read the EEPROM data from the Header Pins.

[danielbriggs]

I'm currently half way through working out how to "liberate" the 16910's (and assumed 11's).
I was going to do a post on here about it once it was complete.

But for now:

I have 2x 16910A's. One which is licenced to 16MB Memory and 500M state, and another one that's a bit ill I'm repairing which is licenced to 256k and 250M state.

I too thought it was the big EEPROM labelled "CONFIG EEPROM" U102 PN: XC18V04
So I ordered a Xilinx USB programmer and tried to read the config EEPROMs. They are not protected, and you can freely read back the images.
I've done this for both of my 16910's and the images are IDENTICAL. 

I extended the backplane via some chunky header cables and means I run the board up outside the chassis + peek around while a card is live. (Keep some form of external cooling on as the cards take quite a bit of power!)

It turns out the actual licence data is held in a tiny Microwire / SPI type 2kb flash on the underside of the board.
(M93C56)
According to some documentation I found from Agilent, this 2kb EEPROM stores "serial number, calibration factors and memory depth enabled".


I'm waiting on a few more parts to arrive, and will carry on the work + update you all with my findings as I go.

What memory depth + 250/500 licence are all of your 16910/11's?

All the best,
Dan

[Hamster]

I have 250Mhz/4M 911a's and 2 250Mhz/256K 911a's

which spi flash has the config? i assumed U90 was for the fpga config for Xilinix on the otherside of the board.

i think if we can figure out the SIGN code in the license data, we could just generate the upgraded license files...  I have 3 911A(s) i would love to upgrade to max Memory Depth.  i have a 4th, but has a PSync Clock failure, which i can't seem to locate the fault.

I also have had this mod done on 2 of my 911A(s) ) basically each board has this done 4 times , and 2 that do not have this mod done ( see attached )

[Hamster]

From my understanding, these cards could be field license upgraded.

For Example here are the .lic files for my cards ( I have masked the Serial # and the last could of digits of the signage )

#START LICENSE INFO
FEATURE 16911_250MHz_State agilent 1.0 permanent uncounted HOSTID=ANY SN=MY44000XXX SIGN=B16B8826xxxx
 
#END LICENSE INFO
#START LICENSE INFO
FEATURE 16911_4Meg_Samples agilent 1.0 permanent uncounted HOSTID=ANY SN=MY44000XXX SIGN=5B56C2D8xxxx
 
#END LICENSE INFO

^^ that card that had the 4Meg Samples still has the 256K memory sticker on it ^^

[tv84]

For all those that need to recover licenses for the Agilent 168x(x)/169x(x), attached is the "secret sauce".

It has been tested with the above licenses and should work with all others.

[Hamster]

Hmm, So what is Seed1 and Seed2 ? and i assume the Vendor is the Feature?

Also, the u90 eeprom data:

[gslick]

For all those that need to recover licenses for the Agilent 16700.

It has been tested with all the above licenses.

Are those the Seed1 and Seed2 values for the 16700 series analyzers, not the 16900 series analyzers?

What do you do with that information? I have seen images of the "Generic FlexLM Crypt Generator v0.5 by Haldir" posted in other threads on the eevblog forum, but have never found any references to that anywhere else on the net. Where can a copy of that tool be found?

[Hamster]

gslick, so, looks like that is a key gen for the Flexeria LMUTils .. and looking at the LA software, it def uses it, i sent all my keys to him and he did verify the key gen..

So its just a mater of figure out the feature codes.. I am assume the 16911 32M feature key is:  16911_32Meg_Samples

The Serial Eeprom only holds the Serial # and 3 extra digits.. i am betting those 3 digits are just option flags. and lmutil decodes the feature key and then updates the Serial Eeprom ( or tells the LPA Service  )

as once the feature is enabled, it travels with the card.

[gslick]

So its just a mater of figure out the feature codes.. I am assume the 16911 32M feature key is:  16911_32Meg_Samples

Here is the list of 16910 / 16911 feature names in the 3rd column below:

Code: [Select]

'16910A-256' HW  16910_256K_Samples               : Acquisition memory depth of 256K                                                                       # Node Locked
'16910A-001' HW  16910_1Meg_Samples               : Increase acquisition memory depth to 1M                                                                # Node Locked
'16910A-004' HW  16910_4Meg_Samples               : Increase acquisition memory depth to 4M                                                                # Node Locked
'16910A-016' HW  16910_16Meg_Samples              : Increase acquisition memory depth to 16M                                                               # Node Locked
'16910A-032' HW  16910_32Meg_Samples              : Increase acquisition memory depth to 32M                                                               # Node Locked
'16910A-250' HW  16910_250MHz_State               : Maximum state speed of 250 MHz                                                                         # Node Locked
'16910A-500' HW  16910_500MHz_Turbo_State         : Increase maximum state speed to 500 MHz                                                                # Node Locked

'16911A-256' HW  16911_256K_Samples               : Acquisition memory depth of 256K                                                                       # Node Locked
'16911A-001' HW  16911_1Meg_Samples               : Increase acquisition memory depth to 1M                                                                # Node Locked
'16911A-004' HW  16911_4Meg_Samples               : Increase acquisition memory depth to 4M                                                                # Node Locked
'16911A-016' HW  16911_16Meg_Samples              : Increase acquisition memory depth to 16M                                                               # Node Locked
'16911A-032' HW  16911_32Meg_Samples              : Increase acquisition memory depth to 32M                                                               # Node Locked
'16911A-250' HW  16911_250MHz_State               : Maximum state speed of 250 MHz                                                                         # Node Locked
'16911A-500' HW  16911_500MHz_Turbo_State         : Increase maximum state speed to 500 MHz


[Hamster]

So, I was able to upgrade my 4Ms card to 32Ms , i am unable to sort the 500Mhz Turbo mode out.

Code: [Select]

EEPROM DATA:
Serial @ 0000-0009
Unknown  000A 0x00 ( changing to 0x01 results in invalid )
Memory @ 000B 0x00 = 256K ( assumed )
0x01 = 1M ( assumed )
0x02 = 4M/250 ( confirmed )
0x03 = 16M/250 ( confirmed )
0x04 = 32M/250 ( confirmed
0x05 = 256k/250 ( confirmed, probably invalid )
0x06 = 256k/250 ( confirmed )
-- I assume any value over 0x04 is treated as 0x00
0x14 = 256k/250 ( confirmed )
Unknown @ 000C  0x16 
-- Changing to 0x17 flagged invalid
-- Changing to 0x32 ( and adding 0x16 to checksum ) - invalid
CheckSum @ 000D

Incrementing a value @ 0B , increment Checksum.
Same goes for incrementing serial #

For example, 0x0A-0x0D

0x00 0x00 0x16 0x27 = 256K [ assumed ]  * not tested
0x00 0x01 0x16 0x28 = 1Ms [ assumed ] * not tested
0x00 0x02 0x16 0x29 = 4Ms
0x00 0x03 0x16 0x2A = 16Ms
0x00 0x04 0x16 0x2B = 32Ms

[gslick]

So, I was able to upgrade my 4Ms card to 32Ms , i am unable to sort the 500Mhz Turbo mode out.

Nice work. Maybe you can apply a 16911_500MHz_Turbo_State feature upgrade using a license file and dump the eeprom before and after to see what changes.

[Hamster]

i just need to figure out how to generate a lic file, the agHwUpgrade program will read the lic and apply it, just need to figure out how to sign it.

it would look like this:

#START LICENSE INFO
FEATURE 16911_500MHz_State agilent 1.0 permanent uncounted HOSTID=ANY SN=? SIGN=???
 
#END LICENSE INFO

if someone has a 500Mhz key for another Serial #, i could change my Serial # to match and apply the license to it.

[Hamster]

the good thing is the card i am using is bad ( PSync Issue, and Bad Memory Bus address ) , so its just a parts board for testing , just have to reboot the LA every time on a Chip contents change.

[tv84]

Are those the Seed1 and Seed2 values for the 16700 series analyzers, not the 16900 series analyzers?

What do you do with that information? I have seen images of the "Generic FlexLM Crypt Generator v0.5 by Haldir" posted in other threads on the eevblog forum, but have never found any references to that anywhere else on the net. Where can a copy of that tool be found?

Sorry,  corrected the reference. The 16700 seeds are posted in another thread.

Yes, you can use them as you're supposing. The tool is available on the net, just needs some googling...

[Hamster]

With help from another forum member, here is how to fully enable a 16911A card.

To Enable 500Mhz Turbo: Change 0x000A to 0x01 , increment value @ 0x000C by the value added to 0x000A
To enable Max Sampling, Change 0x000B to 0x04 , increment value @ 0x000D by the value you incremented at 0x000B

For example on my two cards i did tests on: ( that i read the eeproms on )

0x00 0x02 0x16 0x20  [ stock 250mhz/16ms ]
0x01 0x04 0x17 0x24  [ fully enabled ]

[Hamster]

FYI, the easier option, is to generate a signed .lic file in the correct format, the tools are on the net, but i cannot download them ( i don't have enough rep points ) --

[danielbriggs]

This is just a quick message, for those with "the tool", (many thanks to those who helped) this attached file I found in the Agilent LA installation directory may really help you.
Just pick which software or hardware options you want to add and rerun "the tool". 

For SW, take the first line of each paragraph with your HOSTID=ANY
e.g. xilinx_fpga_dynamic_probe
or Signal_Extractor
You'll need to ensure the appropriate packages are installed.
You can add as many as you one in one file.

For HW, it's the first section
e.g. 16910A-032
Seems to support many many types of mainframe cards or systems.

All the best,
Dan

[DogP]

I recently picked up a 16702B... first of all, thanks for the resistor change info!  I "upgraded" my 16750A, 16750B, and 16533A cards.

Just wanted to add one thing that I hadn't seen this mentioned... it looks R65 and R66 differentiate between the 'A' (R65 populated) and 'B' (R66 populated) versions. 

When I initially compared the 16750A vs. 16750B side-by-side, I noticed that difference (pics attached).  As a test, I populated the 16750B with the resistors described for the 16752A, and the card wasn't detected (showed an empty slot).  Then I swapped R65 and R66, and the board showed up as a 16752B.  So, it looks like the rest of the resistors are the same for the 'B', but R65 and R66 must match the actual type of board.

I guess that also means there's a difference, though I'm not sure what it is (I haven't done an in-depth comparison between them).  Maybe just a minor chip or firmware change that makes them incompatible, though equivalent in performance?


Edit: I just looked at the cards, and the one difference that jumps out at me is that the 'A' uses XCV300 FPGAs, and the 'B' uses XCV300E FPGAs.  The Virtex-E is a 1.8V FPGA instead of 2.5V of the original Virtex.  Additionally, while the part number sounds like they'd be basically the same FPGA, the 300E has more logic resources than the 300, so they almost certainly require different bit files, which the mainframe would need to be aware of.  So, I'd guess the 'A' to 'B' was simply a change to the Virtex-E due to the original Virtex going obsolete.

DogP