Rohde & Schwarz RTO1024 upgrade ??

[TRN]

Hi,

The RTO option keys are saved in the smart card, and not in the firmware.

If your options stopped working with FW version 2.45.1.1, because of some corrupted/damaged files, upgrading to  FW version 3.70 should resolve your issue.

Be advised that installing FW version 3.70 will require that you install OS Win 7 on your system which will also require installation of 8 GB ram versus the 2GB installed on the WinXP systems

[nix239]

Already done. but ther some problem in ch1 . and i cant calibrate.
I revert to old hdd reflash hardware and back to normal state on adc1 .

[TRN]

OK, that is a weird phenomena, that Ch1 has an issue with the newer FW and not with the older one.

What exactly was the problem; an alignment issue on CH1, or a calibration issu on this channel.

[TRN]

Already done. but ther some problem in ch1 . and i cant calibrate.
I revert to old hdd reflash hardware and back to normal state on adc1 .

Since you managed to reflash the HW wth the old FW, and CH1 is now ok & calibrates, I would try to upgrade the FW to 3.70 again, to see if this recreates the problem.

[nix239]

Found problem. frontend on lo voltage 50 ohm damaged. it cant do selftest on 3.70 because type of signal

[analogRF]

Success! I've upgraded my RTO1024 from 2GB RAM Windows XP to 8GB RAM Windows 7 -- which also lets me upgrade the "firmware" from 1.x to 3.x. It's a big step up. Many of the annoyances I had on the old firmware are gone and there are a ton of new features. Mostly locked, but still :-)

Here is the procedure:
* Ordered, installed a new, empty SSD (easy)
    - I looked for SATA-II compatibility because the chipset doesn't support SATA-III
    - Settled on Kingston 240GB A400 SSD 2.5'' SATA 7MM 2.5-Inch SA400S37/240G
    - It was the first SSD I tried and it worked great
    - The sheet metal screw tray made swapping the HDD super easy
* Got at the RAM (hard)
    - You need keys to slide out the CPU board
    - Here is the lock mechanism and how I made keys for it: https://photos.app.goo.gl/M3uLj5EZG8Zk7qXB7
    - There is undoubtedly another way. Hook tools, something to firmly press in the tabs from the outside... be inventive and share your results!
    - Do you really need 8GB RAM? Yes. I tried without. It was painful and didn't work.
* Ordered, installed 2x4GB RAM SODIMMs (easy)
    - I tried two theoretically chipset-compatible DDR3-1066 SODIMMs that didn't POST (black screen, no boot).
    - The RTO is a picky beast.
    - SODIMMs known to work:
        * 2x HMT351S6CFR8C-PB
        * 2x 16KTF51264HZ-1G6K1
        * 2x M471B5273BH1-CF8
* Installed Win7 Pro onto the empty new SSD (easy)
    - I followed instructions on MS help pages to make a USB stick
    - USB stick is before HDD in the RTO's boot order so it Just Works
    - I created a user "jon" before realizing this was different from XP's "instrument" user, but it didn't matter
* Installed R&S Firmware (easy)
    - Got it here: https://www.rohde-schwarz.com/us/firmware/rto1000/
    - Version 3.70.1.0
    - Install ran without a hitch
* Ran the RTx Application (easy)
    - It flashed a few FPGAs, restarted
    - Then "Error, FEC PicoBlaze not ready, switching to Service Mode > CreateDeviceFootprint() failed"
    - Terminated the Rtx app, ran it again with administrator privileges
    - This time it flashed the PicoBlaze correctly and landed in scope mode
    - The instrument model and old options populated automatically from the smartcard
    - Subsequent invocations don't seem to require admin, but subtly broken features are always a possibility

does the scope recover its calibration data?
my scope came with no HDD or the caddy. Any idea if I can get a caddy from anywhere that will fit?

[bg8up]

The thermal design of this set is not very good,it have improved four versions，including heatsink size, structure and cooling air way。

As a result , GBR of CH3/4 is most broken,the GB receiver is a function block of the RTC.

[bg8up]

The scope can recover its calibration data.

[analogRF]

The thermal design of this set is not very good,it have improved four versions，including heatsink size, structure and cooling air way。

As a result , GBR of CH3/4 is most broken,the GB receiver is a function block of the RTC.

those damn GB receivers whatever they are or wherever they are located.
I built a caddy for my scope and made a ssd drive but I got stuck at those GB receiver errors (ch1,2 and ch3,4)
and I could not get rid of it no matter what

[myhobo]

Who has all the installation packages before RTO firmware version 3.7?

[TRN]

The GB receivers are located on the mainboard and are R&S custom made BGA ASIC's. They are unobtainable, no datasheets available, so if your scope has this defect, then you have only a few options to get this fixed.
1) R&S standard repair, which costs around 5,000 USD.
2) try to obtain a second hand mainboard. I have been looking for one for more than 3 years, but with no luck. Nobody appears to have these spare on the shelf
3) If you are lucky, the problem is not with the ASIC's, but with the BGA soldering, so try to locate a shop, which can x-ray the mainboard to see if there are some suspect solder connections under the BGA's
4) if this is the case, you will need to source a company which can rework / reflow the board.

As far as option 4 is concerned, be careful which company you choose. I had my mainboard reworked, by a company, with as result that the board warped, lost a few 0201 resistors and/or capacitors.
Prior to sending the board for repair, Channel 1 & 2 were working fine, but after the "repair attempt none of the channels work anymore.

So be warned!

[TRN]

Hi myhobo,

I have firmware version 2.50 (Setup_Rto_V25027_x86.exe size 366.043KB)

[myhobo]

This is a small problem. I can help you fix it. I can do it remotely until you don't need to mail it.It can't be that the ASIC chip is broken. R&S machine design is very good. The self-protection function is very perfect, so it can't be that there is something wrong with the big chip.

[myhobo]

The solder used by R&S is high-temperature lead-free solder. The plate area is small, and the possibility of virtual welding due to deformation is very small, so there is a problem in the direction of analyzing the problem. I have repaired more than a dozen machines of this series, and I know rto very well.

[myhobo]

Friends of the forum,I used the service password to enter the background to flash the mainboard program, but after waiting for a long time before the flashing was finished, I restarted my machine. After restarting, my machine fan kept turning wildly, and the startup software reported an error "failed to open driver(RTODrv.sys)". I couldn't enter the normal mode or service mode, and I could only enter the simulation mode. Who can help me? Thank you.

[analogRF]

Friends of the forum,I used the service password to enter the background to flash the mainboard program, but after waiting for a long time before the flashing was finished, I restarted my machine. After restarting, my machine fan kept turning wildly, and the startup software reported an error "failed to open driver(RTODrv.sys)". I couldn't enter the normal mode or service mode, and I could only enter the simulation mode. Who can help me? Thank you.

why did you reflash the EEPROM in first place? those eeproms get reflashed automatically to the latest version when a new firmware is installed and FW detects that the eeprom version is older. there is no need to reflash them. if the flash failed there must have been a HW problem on the board and flashing it wont help and it can get corrupted too.
you can desolder the eeprom and program it separately. the binary contents of all eeproms are inside a directory in FW
the only problem is which eeprom exactly we are talking about

[bg8up]

Failed to open RTOdrv.sys，maybe the CHC initialization error

[nix239]

Hi to all. May be someone have some of circuit design.
I fix my bugs with GPIB. but still have troublres with external trigger and first channel.
1. external trigger works perfect on HiZ. external trigger works on 50 Ohm only in highpas mode.(seems some of resistors are damaged). Maybe some one knows where low pas and bypass circuits for ext/ trigger.
2. 1 Channel works in all modes on 200 mv/div and higher . on 100himv/div it works only on hiz. looks like there no normal connection on line or DC block have some trobles similar to ext trigger. strange that on test mode system show that 50 and 100mv div works in test mode and system show pass of tests.(in test mode i see test signal on 50 Ohm and 50 mv/div ).
P.S. ADC very sensitive to thermal paste. use good thermal interface which can work on higher temperature or you will need to reboll ADC.

[anhydrous_cryptography]

Here is how to unlock options of RTO1000. You will need 1 option already unlocked. We will transmute this into a "K0" super option that unlocks everything by patching the "GetOptionIndex" method on the license object so that when you go for 4GHz bandwidth and USB 3 decode madness the scope software drunkenly looks at your shitty I2C/SPI decoder option and says "that'll do!"

First, navigate to C:\Program Files\Rohde-Schwarz\RTx\3.70.1.0\RS.Compass and open RsCompassFramework.dll. Then, use your favorite hex editor to look for

1C 00 00 48 8B 03 83 B8 A4 00 00 00 07 74 0A 0F
B7 40 44 48 83 C4 30 5B C3 B8 FF FF 00 00 48 83
C4 30 5B C3 CC CC CC CC CC CC CC CC CC CC CC CC

and replace with

1C 00 00 48 8B 03 83 B8 A4 00 00 00 07 74 0B 0F
B7 40 44 83 F8 6A 74 09 EB 0C B8 FF FF 00 00 EB
05 B8 00 00 00 00 48 83 C4 30 5B C3 CC CC CC CC

This will transmute option 0x6A (RTO-K1 I2C/SPI) into option 0x00, the universal option.

"But I don't have RTO-K1," I hear you ask. No problem. Simply find the option index of the option that you do have by looking in C:\Program Data\Rohde-Schwarz\RTx\DeviceFootprint_blahblah.xml, searching for "optionIndex" and then converting the value to hex. Suppose you have RTO-K17 "HD mode," another common option. You will find optionIndex=117, 0x75 in hex, and then replace 0x6A with 0x75:

1C 00 00 48 8B 03 83 B8 A4 00 00 00 07 74 0B 0F
B7 40 44 83 F8 75 74 09 EB 0C B8 FF FF 00 00 EB
05 B8 00 00 00 00 48 83 C4 30 5B C3 CC CC CC CC

"But I don't have any options at all." Sorry, I truly am, but I can't help you. Maybe ask for demo options and see if you can unlock those?

"But I don't have RTO1000, I have a RTO2000 or RTO6." Sorry, I have seen the DLLs of the newer software (version 5 rather than version 3) and it looks like this accessor became inlined at some point so this technique no longer works. It might be recoverable through search/replace, but you'll have to chase that down yourself.

"But I don't trust your assembly" It's like 10 instructions, just paste that shit into an online x86 disassembler and convince yourself that it's a conditional "ret 0"

All other RTO1000 enjoyers: have fun!

[D2236]

Worked perfectly! 

[tv84]

when you go for 4GHz bandwidth and USB 3 decode madness the scope software drunkenly looks at your shitty I2C/SPI decoder option and says "that'll do!"

A "ret 0" that upgrades BW and the USB decoder??  That ain't bad!

BTW, in a RTO1000 the K0 is not index 0.    Doesn't matter... "that'll do!"

[jjoonathan]

Verrry interesting! 

Disassembly:
0:  83 b8 a4 00 00 00 07    cmp    DWORD PTR [rax+0xa4],0x7
7:  74 0b                   je     0x14
9:  0f b7 40 44             movzx  eax,WORD PTR [rax+0x44]
d:  83 f8 75                cmp    eax,0x75
10: 74 09                   je     0x1b
12: eb 0c                   jmp    0x20
14: b8 ff ff 00 00          mov    eax,0xffff
19: eb 05                   jmp    0x20
1b: b8 00 00 00 00          mov    eax,0x0
20: 48 83 c4 30             add    rsp,0x30
24: 5b                      pop    rbx
25: c3                      ret
26: cc                      int3
27: cc                      int3
28: cc                      int3
29: cc                      int3

Huh, it looks like there is a magic value at 0xffff as well. Maybe there is an "engineering" K0 and a "marketing" K0 and perhaps optionIndex=0 is the "engineering" K0? 

I found an acceptably priced LCX200 the other day and it came with an expired K0 that was very official and listed on a label with a printed QR code and logo and everything, so "K0" is definitely a term used by the official channels. Perhaps we are looking at company history: originally engineering gave their K0 code to marketing and sales to show off features but due to a desire for tighter control eventually split off the marketing and sales K0 into something with the same name (because that is what marketing and sales and well-connected customers were used to) but a different optionIndex. It's like a "backstage pass" -- there clearly need to be different levels for workers / performers / press / fans that paid extra, but now that the term has entered the public's consciousness the levels need to be denoted some other way. I think we have the good one but in any case "that'll do!" 

[tv84]

Huh, it looks like there is a magic value at 0xffff as well. Maybe there is an "engineering" K0 and a "marketing" K0 and perhaps optionIndex=0 is the "engineering" K0? 

0xFFFF is error value. K0 is an official license (in engineering and marketing terms). But, since most R&S software is developed assuming a K0 with index 0,  there can be abnormal behaviors when the index is different. 

[TRN]

Well, there are actually two different K0's
RTO-K0" partName="Demo"  (Which I think has a max validity of 2 years)
and
K0-FACTORY partName="K0 fuer Fertigungszwecke"used during manufacturing

Both have a different index number

[tv84]

Both have a different index number

AFAIR, same index.