Secrets of the JDSU (Now Viavi) HST-3000

[kc7gr-15]

This post is aimed mainly at those who are into telephony (both POTS and digital) and other telecommunications modes, such as T1/T3, though it will also cover some of the network-testing capabilities of the HST3K. JDSU, according to the unit's data sheet, described it as a "Triple-Play Network Access Tester" and it certainly seems to live up to that. Even its product name contains a hint (HST = Handheld Services Tester).

It's my hope the info offered here will help keep the instruments useful (at least to hobbyists) far beyond its 2018 discontinuance.

SO WHAT IS IT?

In short: This is a multifunction test set designed to handle, depending on which module's plugged in and which software options are enabled, just about any kind of standard testing for copper POTS lines, SIP-based VoIP, T1/T3 circuits, DSL/ADSL/VDSL, Ethernet (fiber and copper), BERT (Bit Error Rate Testing) and TIMS (Transmission Impairment Measuring Set).

THE GUTS AND THE OPTIONS

Viavi does still support these units as of the date of this post, at least for calibration and best-effort repairs, but they never published any publicly-available data on what goes on in the guts of the thing. So, after having been (somewhat rudely) told, "Oh, we don't allow our end users command-line access" I decided to do a little digging of my own.

The unit (at least for the only hardware revision worth messing with, the ACE-II) runs on an Intel PXA270 series CPU clocked at around 500MHz. It uses a Spansion 29GL01GP13 FLASH memory chip to hold its firmware, and a Dallas/AD DS2433 One-Wire EEPROM (8-pin SOIC) to hold version and option info (which is preserved across firmware updates).

It's OS is a shrunken-down Linux core, using Busybox to conserve memory space. All HST-3000's come with a base unit Ethernet port which shares duties between circuit testing and remote access. See page 14 in the Base Unit User's Guide (attached).

The Linux CLI in the unit can be easily accessed by:

• Assigning an IP address to the base unit's Ethernet port, either manually or through DHCP.
• Establish a standard Telnet connection to whatever IP the unit got assigned on your network.
• At the login prompt, give it the user name root and the password is phantom4
• Explore to your heart's content, but, if you value your unit, be bloody careful about changing anything! I have no idea what will happen if you damage the base OS, nor do I have any idea how to recover it -- outside of unsoldering the BGA FLASH chip from a known-working unit, reading it, copying that load into another chip and re-soldering it to the target unit's board!

As far as digging into the hardware goes, have a look at the photos SplitView and 1-wire. In SplitView, you can see there are six machine screws which need to be removed (from the back) to get the thing open. You may have to do some gentle prying, along the perimeter, since the units are weatherproofed with silicone sealant at the factory, but they separate pretty easily once the stuff gives.

SplitView shows the front cover and display assembly on the left, CPU and mezzanine boards in the base unit on the right. Note the unused socket on the backside of the keypad PCB. I'm told this was to accommodate an optional 802.11 WiFi card, though darned if I've ever seen one in that form factor. There's also another version of the front assembly (see the photo bt) which has Bluetooth hardware. Note that it was either one or the other with these sets. I've never heard of, or seen, one with both WiFi and Bluetooth.

Take a closer look at the base unit on the right. Specifically, the photo 1-wire zooms in on the Dallas 2433 chip. To enable all available options, it's best to desolder this one from the board and manipulate its contents with a device programmer (I made use of the Reveltronics Revelprog IS).

Here's the best news: To enable everything, you only have to change ONE byte in the EEPROM. Specifically, at address 0x2C, you'll usually find the hex byte 0D. Change this to anything you want, from 00 to FF (I prefer 42, just to be silly), reprogram the chip and solder it back in. You're good to go!

There is, however, a caveat: Enabling all the software options does not magically make the test set do things it doesn't have the hardware to do. As one example, they don't all come with copper testing capability. While you can certainly turn on options like 'Copper Expert' in software, it won't change a thing if the proper mezzanine board (to actually execute those tests) isn't installed.

Another example is the 802.11 WiFi. I've yet to see a unit which is equipped with the radio module to handle that. It won't hurt anything if the option's enabled in the software, but neither will it start trying to use the nearest WiFi access point if the radio's missing.

I welcome questions or comments. I have a lot more information on these units than I had room to post here.

Happy tweaking.

[BTO]

Hi mate,
I realize its been a while since you posted this topic

Now, you and me seem to have a lot in common

1. Both interested in Electronics
2. Both Liney's  (Difference being, You're in the U.S.A. , I'm in Australia)
3. However, i think it is JUST that advantage that we need when dealing with JDSU and VIAVI

I understand why no one has replied to you, i mean how often do you get a Telecomm's linesman showing up HERE of all places.
then, How many of them actually give a stuff to know this stuff?   Not often i can tell you that.

Now, a bit of background on me
I'm 50,  Been in electronics since i was 6 and it all went from there.
I'm a Telstra Linesman (ISGM) From back in the day before Dial Up came in.
Back when we were working with the LTS-2 , Aegis CZ-3000 MkII and then III , the P.E.T. 's and all that.

Here in Australia, we have the P.O.T.S network as well, we had the C.A.N. (Customer Access Network) and the I.E.N. (Inter Exchange Network), not sure if you called them the same thing in the states. although it looks like we both carried over the POTS thing.
all those acronyms come from the P.M.G (Post Master General) Days,  but again... PMG is an Australian thing to my knowledge.

so mate...
Are you still into this JDSU HST-3000 Unlocking thingy ?
I don't have a HST-3000   ALTHOUGH
i do have ONX-580's
And  ONX-620

Now.. I'm wondering if... All the options get unlocked in the same way that they do on the HST-3000
i have a ONX-580 that was purchased from the states (Kentucky) i think it was
from a pawn broker that wanted to get rid of it ,
Later it was revealed by the company that owned the meter (and i found this out by contacting viavi) that the meter was ISSUED by not given
to an employee of that company

it seems he left the platform and took the meter with him and sold it to a pawn shop.
the company then locked the meter from Strata sync
I'm told from viavi that this lock cannot be removed unless the strata sync account holder removes it

NOW... i also have a strata sync account
and... i know that if i'm able to sync it with my strata sync i can unlock it, TAKE OWNERSHIP in strata sync and it's done

Now i did contact the company , to be fair
spoke to this bloke, can't remember his name, we were in contact and then he left the company, they haven't answered since.

for what i figure.. the meter is mine
and it'd be nice if they unlocked it since i paid for it

now they did say , they'd buy the meter off me for the price that i paid for it.. which is fine.
but then they didn't answer the calls anymore,
i told them
either i give the meter back to you and you reimburse me
or
i keep the meter and you unlock it from your end

they did neither.
so... i figure we can have fun unlocking this thing
and i have several ONX-620

so.. Are you still interested in all this.
I've pulled them all apart, i have photo's
I've looked into JTAG  (However my dad passed and that got put on hold)

I repair Telecomm's electronics for the tech's so i'm very familiar with the inner workings of these things.
it's funny, even calibration is all done in software,   there aren't even POTS that you can adjust to do a CAL

i'd be really interested to do a few things
the first thing would be ,   you know when it boots up with the viavi logo,
i would like to put a  METALLICA - MASTER OF PUPPETS ALBUM Photo on that screen     LOL
or perhaps a business logo   i imagine it'd be a matter of changing the jpeg currently in their

so what are your thoughts mate ?
Also i think it's good having someone in the states that knows this stuff as well, God knows like i feel like i'm the only one here in Australia that knows this stuff.

[kc7gr-15]

Actually, I've done a bit of experimenting with the ONX580 myself. The 'yank the EEPROM' trick does NOT work with it, which tells me Viavi became aware of the bug in the HST's and took steps to correct it in the new instruments.

With that said -- I have discovered, by comparing the two ONX580's I've been able to get hold of so far, that the only difference in their EEPROM contents is a 12-byte long hex string. Since they have different options enabled, I have assumed this string controls said options. I don't think it has anything to do with the instrument's serial number, since I also think Viavi started using the MAC address for that.

I'm hoping to pick back up with it either later this year or May of next year (when I finally retire from my day job).

I'm very much surprised by what you experienced, though. I had no idea it was even possible to lock an instrument up remotely. That's disturbing, and I will make it a point to make sure never to connect to anything other than my own equipment if I decide to play with StrataSync.

I would be very curious to see the contents of the EEPROM in your unit. Do you have the capability to safely unsolder the EEPROM and read it in a device programmer? I could also try sending you the BIN file of my known-working EEPROM to try programming into yours, see if it'll kill the lockout.

No matter what happens, rest assured you're not alone in this. I firmly believe in the first-sale doctrine of 'you bought it, you own it, you can do whatever you bloody well want to with it.'

Happy tweaking.