Possible upgrade - Agilent 34410A to 34411A

[plesa]

To one member here I make a promise to check the internals of 34410A and 34411A.
After removing covers there was small surprise - boards seems to be identical!!
On both is marking 34410A and also sticker on 64 MBit Flash inside 34411A meter has marking 34410A:)

In brief the main difference is reading speed - for more check http://literature.cdn.keysight.com/litweb/pdf/5989-4039EN.pdf?id=744074
This automatically triggered next step - check firmware, but unfortunately meters seems to be based on VxWorks.

Schematic is available, no information about 34411A in it, maybe JM1102 and JM1103 position needs to be found.
http://www.keysight.com/owc_discussions/thread.jspa?threadID=36971&tstart=-1
In attachment is high resolution picture of main board from internet.

Stay tunned.

[HighVoltage]

Thanks for sharing this.

I just bought a broken 34410A and this schematic  will help a lot.
Do you also have a parts list of all components, as we know it from the 34401A?

[nukie]

Very nice looking forward to your further investigation

[plesa]

Unfortunaltelly units which I can afford to brick do not have J1003 and U1101 (75LV4737) populated. So I decided to start with L4411A which I can brick.
Debug terminal output (9600 baud rate if someone is going to follow)

Code: [Select]

Attaching interface lo0...done

Adding 26466 symbols for standalone.
AMDFLASH
-> rhapsodyInit: programInguard
0x13f87b8 (tOxf): FPGA ready
rhapsodyInit: initInstrumentEngine
KOM_gpib_config
KOM_int_cfgn
0x1206bb0 (tUsb): Config EBIU USB Asynchronous Timings
0x1206bb0 (tUsb): Previous USB EBIU_DCR_BR: 10188398
0x1206bb0 (tUsb): NEW USB EBIU_DCR_BR: 10188368
0x1206bb0 (tUsb): Config EBIU USB Synchronous Timings
0x1206bb0 (tUsb): Previous USB EBIU_DCR_BR: 10188368
0x1206bb0 (tUsb): NEW USB EBIU_DCR_BR: 10188162
0x11d4cb8 (tPollVbus): USB connectPullUp = 0
IP address = 192.168.0.5
+------------------------------------------------------------
| GPIB is enabled
| USB is enabled
| Sockets Server is running on port 5025
| Telnet Server is running on port 5024
| VXI-11 Server is running
| WEB Sockets Server is running on port 5042
| AllegroTaskInit successful
| Web Server is running
+------------------------------------------------------------

-> help

help                           Print this list
ioHelp                         Print I/O utilities help info
dbgHelp                        Print debugger help info
nfsHelp                        Print nfs help info
netHelp                        Print network help info
spyHelp                        Print task histogrammer help info
timexHelp                      Print execution timer help info
h         [n]                  Print (or set) shell history
i         [task]               Summary of tasks' TCBs
ti        task                 Complete info on TCB for task
sp        adr,args...          Spawn a task, pri=100, opt=0x19, stk=20000
taskSpawn name,pri,opt,stk,adr,args... Spawn a task
td        task                 Delete a task
ts        task                 Suspend a task
tr        task                 Resume a task
d         [adr[,nunits[,width]]] Display memory
m         adr[,width]          Modify memory
mRegs     [reg[,task]]         Modify a task's registers interactively
pc        [task]               Return task's program counter

Type <CR> to continue, Q<CR> to stop:

iam       "user"[,"passwd"]     Set user name and passwd
whoami                         Print user name
devs                           List devices
ld        [syms[,noAbort][,"name"]] Load stdin, or file, into memory
                               (syms = add symbols to table:
                               -1 = none, 0 = globals, 1 = all)
lkup      ["substr"]         List symbols in system symbol table
lkAddr    address              List symbol table entries near address
checkStack  [task]             List task stack sizes and usage
printErrno  value              Print the name of a status value
period    secs,adr,args... Spawn task to call function periodically
repeat    n,adr,args...    Spawn task to call function n times (0=forever)
version                        Print VxWorks version info, and boot line

NOTE:  Arguments specifying 'task' can be either task ID or name.

value = 1 = 0x1
-> version
VxWorks (for Agilent KOM PPC405, SA27E rev1) version 5.5.1.
Kernel: WIND version 2.6.
Made on May 22 2015, 14:33:34.
Boot line:
emac(0,0)host:vxWorks h=10.1.1.2 e=169.254.9.80 u=demo pw=demo tn=
value = 78 = 0x4e = 'N'
->


[plesa]

Partial success.
L4411A is now 34411A for this change only header of file needs to be changed.
In file agt34411_instrument_rev241.xs
change row "%model=34411A" to "%model=L4411A"
Meter boot up correctly and in LXI it is 34411A now 
It is also possible to downgrade L4411A to 34410A without any issue.
Only the front panel will be off.After this upgrade L4411A is working in BenchVue 

Similar attempt with 34410A:
Firmware upload by Firmware Update utility finished correctly. But after restart there is message on display : "Please load 34410A firmware" 
Further investigation needed, so stay tuned.

[nukie]

I have 4x 34410 candidates

[HighVoltage]

You are making progress, great.

Are you really sure the hardware is the same between the 34410A and the 34411A instruments?
I would expect a at least a small difference.
But then, may be this was the beginning at Agilent to introduce software downgrading.

[plesa]

You are making progress, great.

Are you really sure the hardware is the same between the 34410A and the 34411A instruments?
I would expect a at least a small difference.
But then, may be this was the beginning at Agilent to introduce software downgrading.

Sure, the partnumber and stickers are the same. According to test above there is some check of meter ID. This should be in one of another firmware or in bootloader.
Any other thoughts? I needs to install IDA /pro dissassembler to chce the VxWorks firmware:)

[asp]

Schematic is available, no information about 34411A in it, maybe JM1102 and JM1103 position needs to be found.

Don't bother with JM1102 and JM1103 as they are for calibration purposes. I have the unpacked firmware somewhere if you need it. The only notable difference seems between 01 and 1x is the check for frmware... for sure there are others

[plesa]

Schematic is available, no information about 34411A in it, maybe JM1102 and JM1103 position needs to be found.

Don't bother with JM1102 and JM1103 as they are for calibration purposes. I have the unpacked firmware somewhere if you need it. The only notable difference seems between 01 and 1x is the check for frmware... for sure there are others

Currently I am looking for 34410A unit with populated serial interface. 34411A/L4411A can be downgraded. So it seems to be in the bootloader or boot parameters.

[HighVoltage]

Did you make any progress?

I just bought a broken 34411A that is on its way.
Once I have it, I will make a good comparison to one of my 34410A

[plesa]

Unfortunately no progress at all. What's wrong with 34411A?

[bitseeker]

@HighVoltage: That comparison will be very interesting indeed.

(Hmm, were your other DMMs getting lonely -- pining for a new team member? )

[HighVoltage]

@HighVoltage: That comparison will be very interesting indeed.

(Hmm, were your other DMMs getting lonely -- pining for a new team member? )

I never owned a 34411A and got it for Euro 100 incl. shipping
Symptoms: Does not turn ON
I still don't  have it, may be an easy repair, may be beyond repair, I don't know.
The 34411A rarely become available at a reasonable price.

May be we really can find out the differences between the 34410A and the 34411A

[bitseeker]

Woah that was a score! Well, I certainly hope it's just the power supply.

My 34410A and I eagerly await your next update.

[plesa]

@HighVoltage: That comparison will be very interesting indeed.

(Hmm, were your other DMMs getting lonely -- pining for a new team member? )

I never owned a 34411A and got it for Euro 100 incl. shipping
Symptoms: Does not turn ON
I still don't  have it, may be an easy repair, may be beyond repair, I don't know.
The 34411A rarely become available at a reasonable price.

May be we really can find out the differences between the 34410A and the 34411A

The board / hardware is identical. the only difference in in software and probably calibration. If I have unit for 100 EUR I will invest more into experiments with programmer. You can easily downgrade 34411A to 34410A by changing model number in firmware file header (%model=34410A).

[bitseeker]

I never owned a 34411A and got it for Euro 100 incl. shipping
Symptoms: Does not turn ON
I still don't  have it, may be an easy repair, may be beyond repair, I don't know.
The 34411A rarely become available at a reasonable price.

May be we really can find out the differences between the 34410A and the 34411A

Congrats on the "no fix" fix, as you put it. Way to score. We anxiously await your revelations as to the potential of upgrading a 34410A to a 34411A. For curiosity, of course. Most of the time, I'm running my 34410A with integration at 10 or 100 PLC.

[zrq]

Sorry to revive this old thread. I'm seeking for a 6 1/2 digits DMM for the home lab and got interested in second hand 34410As, which seems available on ebay for a reasonable price (other suggestions welcome). For obvious reason, the meter will be of better value if it's hackable. I downloaded the firmware (agt34411_instrument_rev243.zip) from Keysight website and start digging into it.

Basically, the xs file is a Motorola S file for the hex content, with tools like 010Editor, we can easily convert to the actual bytes in rom. binwalk indicates there is a Zlib compressed section, use -e to extract, and we get a vxworks image. With -a it turns out in the Agilent ASIC, the firmware runs on a big endian 32bits PowerPC core. Googling shows there is a tool https://github.com/PAGalaxyLab/vxhunter can help me load the memory image in GHIDRA, and I noticed the image comes with a symbol table  . Searching the "Please load" quickly led to the _checkModelNumber__5IEIfcF routine

Code: [Select]


                            **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined _checkModelNumber__5IEIfcFv()
             undefined         r3:1           <RETURN>
             undefined4        Stack[0x4]:4   local_res4                              XREF[2]:     004d4adc(W),
                                                                                                   004d4b40(R) 
             undefined4        Stack[-0x10]:4 local_10                                XREF[1]:     004d4acc(W) 
                             _checkModelNumber__5IEIfcFv                     XREF[2]:     initInstrumentEngine__5IEIfcFv:0
                                                                                          00a4d690(*) 
        004d4acc 94 21 ff f0     stwu       r1,local_10(r1)
        004d4ad0 7c 08 02 a6     mfspr      r0,LR
        004d4ad4 3d 80 90 00     lis        r12,-0x7000
        004d4ad8 a0 8c 00 0a     lhz        r4,offset DAT_9000000a(r12)    <- UNKNOWN ADDRESS
        004d4adc 90 01 00 14     stw        r0,local_res4(r1)
        004d4ae0 2c 04 23 5a     cmpwi      r4,0x235a
        004d4ae4 40 82 00 3c     bne        LAB_004d4b20
        004d4ae8 3c 60 00 96     lis        r3,0x96
        004d4aec 38 63 2c fc     addi       r3=>s_34410_FIRMWARE_00962cfc,r3,0x2cfc          = "34410 FIRMWARE"
        004d4af0 3c 80 00 96     lis        r4,0x96
        004d4af4 38 84 2d 0c     addi       r4=>s_PLEASE_LOAD_00962d0c,r4,0x2d0c             = "PLEASE LOAD"
        004d4af8 4b bc f7 29     bl         updateVfdNow__FPCcT1                             undefined updateVfdNow__FPCcT1()
        004d4afc 48 0c 96 89     bl         theMgr__19GandalfStateManagerSFv                 undefined theMgr__19GandalfState
        004d4b00 38 80 00 00     li         r4,0x0
        004d4b04 48 0c 90 e5     bl         enablePorRecall__19GandalfStateManagerFb         undefined enablePorRecall__19Gan
        004d4b08 3c 60 00 1e     lis        r3,0x1e
        004d4b0c 60 63 84 80     ori        r3,r3,0x8480
        004d4b10 4b d6 e2 c9     bl         spin__9SpinTimerSFi                              undefined spin__9SpinTimerSFi()
        004d4b14 38 60 40 00     li         r3,0x4000
        004d4b18 4b ca 96 15     bl         reboot                                           int reboot(int __howto)
        004d4b1c 48 00 00 24     b          LAB_004d4b40
                             LAB_004d4b20                                    XREF[1]:     004d4ae4(j) 
        004d4b20 28 04 b6 43     cmplwi     r4,0xb643
        004d4b24 41 82 00 1c     beq        LAB_004d4b40

Although still not sure what the code is checking, as I hadn't got to figure out the memory mapping. I guess there is a 0x235a value in the calibration rom which is checked against, and it's possible the value can be changed in the vxWorks shell by the debug commands. But apparently, as there seems to be no secure booting, a trivial solution is to nop out the only code reference to this function in initInstrumentEngine__5IEIfcFv.

Code: [Select]


                            **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined initInstrumentEngine__5IEIfcFv()
             undefined         r3:1           <RETURN>
             undefined4        Stack[0x4]:4   local_res4                              XREF[2]:     004d4f30(W),
                                                                                                   004d4ff4(R) 
             undefined4        Stack[-0x4]:4  local_4                                 XREF[2]:     004d4f2c(W),
                                                                                                   004d5004(R) 
             undefined4        Stack[-0x8]:4  local_8                                 XREF[2]:     004d4f28(W),
                                                                                                   004d5000(R) 
             undefined4        Stack[-0x10]:4 local_10                                XREF[1]:     004d4f20(W) 
                             initInstrumentEngine__5IEIfcFv                  XREF[2]:     vxmain__FiPPc:0005c034(c),
                                                                                          00a661f0(*) 
        004d4f20 94 21 ff f0     stwu       r1,local_10(r1)
        004d4f24 7c 08 02 a6     mfspr      r0,LR
        004d4f28 93 c1 00 08     stw        r30,local_8(r1)
        004d4f2c 93 e1 00 0c     stw        r31,local_4(r1)
        004d4f30 90 01 00 14     stw        r0,local_res4(r1)
        004d4f34 4b be 34 8d     bl         instance__10SoftRebootSFv                        undefined instance__10SoftReboot
        004d4f38 4b b8 ca 6d     bl         subscribeEventBootHandlers                       undefined subscribeEventBootHand
        004d4f3c 4b ff fb 91     bl         _checkModelNumber__5IEIfcFv                      undefined _checkModelNumber__5IE
        004d4f40 4b ff fb 0d     bl         _checkFlashType__5IEIfcFv                        undefined _checkFlashType__5IEIf  <------------HERE
        004d4f44 3f c0 00 c8     lis        r30,0xc8
        004d4f48 3b de 7c c0     addi       r30,r30,0x7cc0
        004d4f4c 48 08 9e 15     bl         newScanController__Fv                            undefined newScanController__Fv()

I don't (yet) have the 34410A to verify this is feasible, but it looks promising.

BTW: who is Gandalf?

[TheSteve]

Going 34410 to 34411 is pretty easy. In the past you just needed swap the names of the bin files so the upgrade package would install the 34411 firmware into your 34410. When it boots it will be unhappy so the other thing required is to edit the model # in the eeprom that is in the back left corner of the unit(8 pin SOIC). You can get an SOIC clip onto it without even removing the PCB. Just edit the instances of 34410 to 34411.

[coromonadalix]

im playing with an l4411A

poking into the serial debug port ...

in my case i have only one user  with loginUserShow()  command

annnnnd  its  gandalf  value = 0 = 0x0

Is it possible to find the user password  ??,  i've read they must be encrypted  with vxencrypt.exe  and be typed encrypted   is there a way to get this file  ?


Tried to create other user   with some i've found out on the web


Upon reset  the added user(s) are cleared  up,  only gandalf remain   loll

[coromonadalix]

Edit    sold the L4411A  and got an 34410a  with the populated debug port  (ic+ plug)     old fw 2.21 .... gonna do a normal upgrade and see the plug pinouts with the known schematic

[coromonadalix]

Was hard to find a way to solder a thin wire on  the jtag connector to hold the cpu in reset  while reading the eeprom in SPI

Changed the 34410 occurrence to 34411     and it still complained   about the model version

attached is the original  non modded AT24C16  eeprom

if someone  has ideas  loll

The wp pin is tied to ground   maybe its a problem,  my programmer seem able to bypass this ??  i've tried some read an writes ... and seems to work ?

Or someone has an defective 34411a board ?

[TheSteve]

You have to mod the eeprom and program the 34411A firmware.

[coromonadalix]

While i have pmed TheSteve

Still no luck with info's given here or TheSteve info's

The Firmware updater seems to check something who's not related to the eeprom model found in it  ??

Tried many combinations  eeprom vs the fw  files, no avail,  the meter will request to have proper 34410 fw  .....

TheSteve did apparently manage to convert 2 meters,  no success for me

On the Keysight Connection Manager, even with the 34411 model put in the eeprom,  it will still identify as a 34410A

The populated debug port on my meter doesn't seems to react at all, checked many times against the schematic


I was maybe or surely too fast to upgrade my version 2.21    

[coromonadalix]

the cpu reset is located on theses pads  (pictures attached)   i was not connected properly, i was on the jtag reset pin ...

One side is DCOM  digital ground / metal casing of the meter

I connected the pin 14 of the lm339  u902   to the ground via an 100 ohms resistor


Still no success,    the info is elsewhere  ... not in the eeprom it seems