EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: TiN on September 22, 2013, 07:34:01 am

Title: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on September 22, 2013, 07:34:01 am

After reading this thread (https://www.eevblog.com/forum/testgear/new-toy-tek-tla614-logic-analyzer/msg292439/#msg292439) I got temptation to look into my TLA7AA4 module as well, to unlock some extra memory >:D

I have CS option, which is 2MB of enabled memory with 450MHz rate. There are upper DS and ES (8MB and 32MB).
I looked on board and actually realized that hardware have full memory populated, it's just software disabled.

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/929708w.jpg) (http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/2QJtycAF8m/929708.jpg)

There are 24 (or 48, don't remember if memory also populated on bottom side) x Micron 128Mbit DDR (http://download.micron.com/pdf/datasheets/dram/ddr/128MbDDRx4x8x16.pdf) ICs.
And similar to other Tek machines, there is vxWorks PC in module as well, running on another smaller PCB with MC68360EM25L.
Also RS232 port with console, just like expected, driven by LT1137A converter from SoC.

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/929505w.jpg)

I guess all calibration/key/option data is stored in DS1230AB, which will become a target after i get PROM programmer in my hands, to backup
original data.

Gotcha some console outputs (attached file) too, lkup command seem to output all possible commands/function calls :)

Not familiar with vxWorks at all, but I guess there should be a way to read/write NVRAM from console.
After some googling and trying:

Code: [Select]

temp = malloc(0x8000)
-> sysNvRamGet(temp,0x8000,0)
value = -1 = 0xffffffff

which means error. And temp variable stored nothing meaningful :-X

Title: Re: TLA hacks :)
Post by: EEVblog on September 22, 2013, 08:00:46 am

I doubt anyone has ever bothered investigating this one before?
Good luck.

Title: Re: TLA hacks :)
Post by: nctnico on September 22, 2013, 11:22:16 am

I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

Title: Re: TLA hacks :)
Post by: TerraHertz on September 22, 2013, 03:24:50 pm

Quote from: nctnico on September 22, 2013, 11:22:16 am

I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for?

The problem with using the software upgrade tool, is that (at least for my TLA 614) the 'upgrade kits' (data blobs) are no longer available. According to Tek's web site anyway. So getting the option installer to do its job (so can examine what it does and where the data goes) isn't an easy thing.

Since there's no way in Hell I'm paying money for such a thing anyway, I don't think Tektronix would likely be terribly helpful. Considering my objectives, it's probably better not to even talk to them.

Whether the old Pentium hardware trace units I have will work with the Celeron in my TLA - that's a question to be investigated.

Btw TiN, I didn't get the files yet. Have been too busy procrastinating. ;D Probably tomorrow.

Title: Re: TLA hacks :)
Post by: nctnico on September 22, 2013, 04:52:37 pm

Quote from: TerraHertz on September 22, 2013, 03:24:50 pm

Quote from: nctnico on September 22, 2013, 11:22:16 am
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for?

There is only calibration data in the NVRAM. I went down this road; the first thing I tried was erasing the NVRAM and see if the options would dissapear. They didn't so the options are not in the NVRAM.

Title: Re: TLA hacks :)
Post by: TiN on September 23, 2013, 11:17:39 am

Quote

There is only calibration data in the NVRAM

Well, I got programmer today, so will see. I don't find any other EEPROM/ROM storage except Flash and NVSRAM at first glance.
Of course, Tek could store key data in one of their big ASICs, but that's questionable.
I see few various ways to enable options:

1. Having good key for option (it's not much of a secret, usually it's on sticker @ module label) - fool module ID to match key. PowerFlex tool gives you what is correct module ID for key. To do so need find ID location and alter it's contents.

2. Find "option enabled" flag/storage and alter it to force option enabled, disregarding of ID/key

3. Do some black software magic and reverse correct key for PowerFlex to enable option using known ID :)

Any vxWorks experts around? ::)

UPDATE:

Got 32M now :) Don't know how, it just surrender and decided to give me what I want. :-DD

Before:

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/931247w.jpg)

Now

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/931248w.jpg)

All I did - removed original Dallas DS1230AB NVRAM, soldered DIP socket on PCB.
Put blank DS1245AB with VCC pin 32 shorted to pin 30 (i had DS1245AB from Keithley 2001, it's 1024k 32-pin, while DS1230 is 256k 28pin)
Assemble module back, put back into TLA714 frame - booted, run Powerflex - reports 32M right away.

Too easy! :wtf:

P.S. I guess that's same Murphy law which striked Dave's DSA repair project from recent episode. Thanks Dave! :D

Title: Re: TLA hacks :)
Post by: nctnico on September 23, 2013, 04:34:03 pm

Thats weird and interesting. Where did you get that upgrade key code? Maybe the Powerflex tool just did the upgrade regardless of the wrong module serial number.

Title: Re: TLA hacks :)
Post by: TiN on September 23, 2013, 05:33:26 pm

No, it did not.
I just googled TLA7AA4, and after few pages found photo of ES-optioned module.
Key is usually just printed on module sticker. It does not work if module ID does not match key, which is clearly shown on error message.

I tried again put back stock DS1230AB, erased it first on programmer - and guess what, module got 2M again.
Put back DS1245AB - 32M right away, without any other operations/enabling. Is there way to detect DS1245 SRAM? I remember my
Keithley 2001 did same, MEM1 or MEM2 options were directly depends of what SRAM chip installed. But on Keithley there is 32pin DIP socket,
which allows either 28-pin DS1230 or 32-pin DS1245 to be installed. Here - only 28 pin physically, pins 1,2,31 are not connected (32 shorted to 30, to provide VCC).

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/931328w.jpg)

"modified" DS1245Y and socketed TLA7AA4 board = 32M Depth

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/931374w.jpg)

Or:

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/931307w.jpg)

Original DS1230 in socket = 2M Depth

And yes, calibration data was lost when i changed NVRAMs. But since module can recalibrate by user menu - not a problem at all.

Here are also my aquisition board very hi-res photos from both sides. in case someone need it.

Top side, 33MB, 10233x6331 pixels (http://xdevs.com/test/Tektronix/TLA7AA4/TLA7AA4_Top.jpg)
Bottom side, 34MB, 10156x6352 pixels (http://xdevs.com/test/Tektronix/TLA7AA4/TLA7AA4_Bot.jpg)

Enjoy.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: leafi on September 23, 2013, 06:17:21 pm

I wish someone would do this for a TDS7404, I wont pay 10K for a memory unlock code.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: nctnico on September 23, 2013, 06:39:09 pm

IMHO you stumbled upon a bug in the board's firmware. AFAIK the ID of the NVRAMs can be read by a special sequence just like parallel flash memory. Perhaps it jumps into some kind of calibration mode when the wrong NVRAM is installed. You already noticed that a blank (original) NVRAM doesn't do anything to the available options which is consistent with my own findings.

My approach would still be to run the Powerflex utility in a debugger and see whether it sends the upgrade key to the board or the Powerflex utility checks whether the key is right and reconfigures the board. If the latter is the case it shouldn't be hard to bypass the check.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on September 23, 2013, 11:35:25 pm

Quote

IMHO you stumbled upon a bug in the board's firmware.

Even if so, i would not complain. I'm not really a software guy to mess weeks and weeks with debugger :-/O

Title: Re: TLA hacks :)
Post by: mamalala on September 23, 2013, 11:54:31 pm

Quote from: TiN on September 23, 2013, 05:33:26 pm

[...]
Here are also my aquisition board very hi-res photos from both sides. in case someone need it.

Top side, 33MB, 10233x6331 pixels (http://xdevs.com/test/Tektronix/TLA7AA4/TLA7AA4_Top.jpg)
Bottom side, 34MB, 10156x6352 pixels (http://xdevs.com/test/Tektronix/TLA7AA4/TLA7AA4_Bot.jpg)

Enjoy.

How did you produce these images? They are fantastic! Hi-Res and sharp.

Did you stitch them together from multiple images? First i would have thought it is just a scan (as in: on a scanner), but some connectors out of focus tell me that this is not the case (i think)...

Greetings,

Chris

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on September 24, 2013, 12:34:59 am

Three shots with macro lens (150mm @ f/14) per each side with 10-20% overlap, then align and stitch them manually in photoshop (5 minutes to do :).
You can see gaps if you watch really closely :-DMM

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Carrington on September 24, 2013, 12:36:16 am

Perhaps you used a Nikon D800.
Cheers.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on September 24, 2013, 12:41:47 am

Right. Cannot resist of nice high-res hardware beauty.

Now I only wish to get hands on one of those TLA7BBx modules to play with, would be sick to have newer modules working in ancient frame like TLA714.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on October 16, 2013, 07:19:45 pm

Got Nexus DDR3 interposer for TLA :)
Linked TLA714 with CSA7404 by iView (used regular NI GPIB-USB-HS and BNC cables for trigger in/out and reference)

Works cool, but my TLA7AA4 is too slow :( Need 7BB4, but cannot afford it :'(

DDR3-1067MHz :

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/940658w.jpg) (http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/2QJtycAF8m/940658.png)

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/940665w.jpg)

(http://fotkidepo.ru/photo/115530/50896lhF73OzqbP/940666w.jpg)

:scared:

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 03, 2013, 07:22:13 pm

Hi

I tried to do the same trick to my old TLA7N3 module. I replaced the DS1225 memory with a brand new DS1245.
I lost all the installed options after that so I installed the original memory again and the options were back.
Now I wonder if every TLA7AA module can be hacked this way.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 23, 2013, 07:53:01 pm

TiN, what's the firmware revision of your TLA7AA4 module?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on November 24, 2013, 03:56:19 am

I had updated 7AA4 to 5.8.001 a while ago (As TLA Ver 5.1 is running in server mode on mainframe itself).
Using it so far with remote TLA Application Ver 6.1.

Later I have plans to source another TLA7AA4 and try more unlocking, maybe AS or DS variant, when get some extra budget for hobby projects :)

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 24, 2013, 12:11:17 pm

I just boght a TLA7AA4-CS module. It has 5.0.002 firmware. I'm going to replace the Dallas chip on it tomorrow.
Do you remember what the firmware revision of your module was at the time you hacked it?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on November 24, 2013, 12:47:03 pm

Same version as my previous post, i updated it long ago from 4.4.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 24, 2013, 09:19:36 pm

Did you have any problems getting TLA server v5.1 to work with TLA client
application v6.1?

I can get client - server configuration to work only if they are both v5.1

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on November 25, 2013, 05:01:52 am

No, I had no issues, just had all stuff installed on v5.1 first, then just deinstall and install new 5.8 on remote PC, then did same thing with 6.0 and 6.1.
I remember there were issues with 6.x on one of my HDDs, but on another its working fine. Make sure you have NI VISA installed as well (I used it for LabView, but found that some libraries
are being used by Tektronix software as well).

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 25, 2013, 10:44:07 am

Thanks for the tip about NI VISA, I only have Tek VISA installed. I thought there were conflicts between Tek software and NI VISA. I'll try it.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 27, 2013, 03:18:40 pm

I installed NI Visa drivers on the client computer. Now I can connect to the server but the client aplication
isn't detecting any modules. Did you install NI Visa on the Tek frame as well?

That's so much for bad news. Good news is that my TLA7AA4-CS is now full option 32M.

Thank you very much TiN. :-+

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on November 27, 2013, 03:55:17 pm

No, I did not mess much with mainframe software.

But had issues with modules not detected by ver6 client on remote machine. That's why I rolled back to v5.8 and used it for a year or so. Only recently I tried ver6 and 6.1 as v5.8 had some crashing problems with Nexus DDR3 support module, and it worked well, detecting module and
doing all stuff. Maybe just play around with various versions and see if anything changes.

So dallas NVRAM replacement to 1245 did magic to you too? What's is your module FW version?

I notice also that all TLA apps have memory management issues on my Win2008R2 64bit. If i used more than 8-10GB of memory on remote machine, and try run TLA app - it gives "not enough memory" error and refuse to work. Probably some addressing or resource allocation in TLA app was not done quite right, as i have lots of free memory still available (64GB total RAM)

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jgorsk on November 27, 2013, 04:36:52 pm

My module's firmware is 5.0. I used DS1245AB-100+

I tried to modify TLA7N3 module before and that didn't work.
I tied A15 to VCC then, I'm not sure about A16. This time I left
them both floating. I'm not sure if that matters. In theory
floating address pins may be giving problems but I don't think
I'll test this hack with A15/16 inputs of the DS1245 pulled up
or down uless it stops working properly.

I'm not using any Tek Apps but I'm going to write my own
plugins using TPI.Net when I get some time.

Thanks again.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 26, 2014, 07:40:47 pm

I can confirm the hack works. Modified two TLA7AA4cs modules that now have full memory support.

Used a DS1245AB-100

Tied a15 and a16 high. Desoldering, soldering a socket and installing chip was simple and quick.

Modules work great.

Using TLA5.8 on remote Windoze 7 machine and 5.1 locally on the TLA714.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 28, 2014, 01:32:40 pm

I dissassembled the Firmware in 2009 to upgrade the Module. You can use the NI VISA Talk/Listen Utility for this. It's been a while, but i think the procedure was:

Enable Special Upgrade Mode (Get Firmware Version from IDN query)

Code: [Select]

SYST:PASS:INST:PASS Pitbull<FirmwareVersion>

Set Parameters

Code: [Select]

SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>

Save Parameters:

Code: [Select]

SYST:PASS:INST:UPD <UnixTimeStamp>

This worked on TLA7AA4 and TLA7N4 at least.

Have fun

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: nctnico on June 28, 2014, 06:47:59 pm

What do you fill in for the Unix timestamp?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 28, 2014, 07:34:47 pm

It think it was the standard unix time stamp which means the current time in seconds since 1/1/1970.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 28, 2014, 08:59:10 pm

Quote from: dxl on June 28, 2014, 01:32:40 pm

I dissassembled the Firmware in 2009 to upgrade the Module. You can use the NI VISA Talk/Listen Utility for this. It's been a while, but i think the procedure was:

Enable Special Upgrade Mode (Get Firmware Version from IDN query)
Code: [Select]
SYST:PASS:INST:PASS Pitbull<FirmwareVersion>
Set Parameters
Code: [Select]
SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <UnixTimeStamp>
This worked on TLA7AA4 and TLA7N4 at least.

Have fun

Interesting! I'll give this a go on my TLA7N4 and report back.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 04:50:03 am

Sending those commands are not working at all. I am researching the TLA command structure, but I've tried multiple variations of the listed commands and they are not working.

Will look further into this tomorrow. It is likely a minor syntax issue.

SYST:PASS:INST:PASS Pitbull 5.8.001
6/28/2014 9:53 PM 42.233     0.0001s     VXI1::2::INSTR     Error - The specified operation or request timed out     Error-Read

6/28/2014 9:44 PM 21.457     0.0001s     WDTC-LAB     SYST:CONF:MAX:DEPTH?
     Write
6/28/2014 9:44 PM 21.469     0.0001s     VXI1::2::INSTR     Error - The specified operation or request timed out     Error-Read

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 06:53:49 am

Those are not Queries, you need to just write them to the unit with NI-VISA. There are different buttons in VISA: Write, Read, Query. I think there should also be no space between the "pitbull" password and the firmware version number. It's just one string concatenated as password.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: nctnico on June 29, 2014, 09:13:34 am

Maybe put the password between ""?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 04:17:50 pm

Quote from: dxl on June 29, 2014, 06:53:49 am

Those are not Queries, you need to just write them to the unit with NI-VISA. There are different buttons in VISA: Write, Read, Query. I think there should also be no space between the "pitbull" password and the firmware version number. It's just one string concatenated as password.

I tried them as writes also and no space between pitbull and firmware version. But just to be clear, are you saying each of these lines should be performed as individual write commands and no status is ever read at the end or return results from any of the lines. Just all lines as blind writes then at the end close the VISA and check with powerflex if the options have been enabled? What about the "Set Parameters" and "Code: [Select]" lines are those also supposed to be issued as writes or are those return results?

I will try them all as writes and see what happens, but I thought I did that and got an error returned at some point.

SYST:PASS:INST:PASS Pitbull<FirmwareVersion>

Set Parameters
Code: [Select]
SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>

Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <UnixTimeStamp>

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:22:17 pm

Attempted it verbatim to the posted instructions. Issued "blind" writes, but at the end checked with poweflex and no options installed.

The TLA7N4 goes as high as 4M memory and 200Mhz. I used 4096 for memory depth and 200 for speed. I will try so other numbers like 4M to see if that works.

First attempt log-

6/29/2014 9:56 AM 02.118     0.0086s     TCPIP::192.168.0.144::vxi0,2::INSTR TEKTRONIX,TLA7N4,B011582,SCPI:94.0 FVER:5.5.001     Read

6/29/2014 9:56 AM 38.294     0.0083s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001 Write
6/29/2014 9:56 AM 49.822     0.0083s     WIN-330I86GF26R     Set Parameters Write
6/29/2014 9:57 AM 01.070     0.0083s     WIN-330I86GF26R     Code: [Select] Write
6/29/2014 9:58 AM 38.787     0.0081s     WIN-330I86GF26R     SYST:CONF:MAX:DEPTH 4194304 Write
6/29/2014 9:59 AM 12.170     0.0079s     WIN-330I86GF26R     SYST:CONF:SPEED 200 Write
6/29/2014 9:59 AM 26.366     0.0086s     WIN-330I86GF26R     Save Parameters: Write
6/29/2014 9:59 AM 36.631     0.0078s     WIN-330I86GF26R     Code: [Select] Write
6/29/2014 10:01 AM 47.904     0.0085s     WIN-330I86GF26R     SYST:PASS:INST:UPD 1404025200 Write

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:27:26 pm

Powerflex shows the following options that are valid for this TLA7N4 Module-
Serial number/ID info is redacted as not relevant.

######################################################################
######################################################################
#
#      TLA PowerFlex Upgrade Information File
#
# This file contains information needed when ordering a TLA PowerFlex
# upgrade kit. Contact your local Tektronix representative for pricing
# and ordering information. When ordering an upgrade, include a hard
# copy of this file with your order.
#
#          June 29, 2014
#
######################################################################
######################################################################

Current Configuration:

   Product Type:         TLA7N4
   Serial Number:         XXX
   Unique ID:         XXX
   Memory Depth:         64K
   State Speed:         100 MHz
   Extension:         NA
   Timing Speed:         2 GHz / 250 MHz
   Channels:         136
   PowerFlex Software Version:   5.6.754.0
   TLA Software Version:      5.6.754.0
   Module Firmware Version:   5.5.001

Upgrade Option Selected:

   - No Upgrade Selected -

Possible Upgrades:

   Upgrade Kit & Option   Memory Depth   State Speed   Extension
   TLA7F14 Opt 01      256K      100 MHz
   TLA7F14 Opt 02      1M      100 MHz
   TLA7F14 Opt 03      4M      100 MHz
   TLA7F14 Opt 04      64K      200 MHz
   TLA7F14 Opt 05      256K      200 MHz
   TLA7F14 Opt 06      1M      200 MHz
   TLA7F14 Opt 07      4M      200 MHz

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:32:40 pm

OK, these commands give status that makes sense-

6/29/2014 10:29 AM 45.238     0.0084s     WIN-330I86GF26R     SYST:CONF:SPEED?
     Write
6/29/2014 10:29 AM 45.270     0.0162s     TCPIP::192.168.0.144::vxi0,2::INSTR     100     Read

6/29/2014 10:30 AM 55.937     0.0104s     WIN-330I86GF26R     SYST:CONF:MAX:DEPTH?
     Write
6/29/2014 10:30 AM 55.952     0.0118s     TCPIP::192.168.0.144::vxi0,2::INSTR     4194304     Read

Looks like memory is showing 4MB. Maybe the modules need to be power cycled and rebooted to show new options. I'll give that a go. Speed is still stuck at 100mhz state though. Will issue the speed command again.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 05:38:54 pm

What does a "SYST:ERR?" Query show after the Password command?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:44:27 pm

Hmm. Something has happened now.

After going through the commands a second time, without power cycling yet, Powerflex only show the module and serial number with all other fields blank, and text at the bottom of the window saying- "Update complete successfully."

So Tek uses Chinglish too :D

I'm starting up the TLA Application now to see what it says about memory depth-

No, still shows a max of 64K. I'll reboot the TLA and see what happens.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:46:13 pm

Quote from: dxl on June 29, 2014, 05:38:54 pm

What does a "SYST:ERR?" Query show after the Password command?

6/29/2014 10:45 AM 40.336 0.0201s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:48:36 pm

If I try it another way and put the Pitbull5.5.001 in quotes I get this error after a SYST:ERR? query. It doesn't appear to want quotes.

6/29/2014 10:47 AM 21.830 0.0199s TCPIP::192.168.0.144::vxi0,2::INSTR -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n" Read

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 05:59:14 pm

I've tried the SYST:PASS:INST:PASS several ways now. It is definitely a recognized command, but it is rejecting the password.

6/29/2014 10:45 AM 24.767     0.0130s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001
     Write
6/29/2014 10:45 AM 40.304     0.0084s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:45 AM 40.336     0.0201s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

6/29/2014 10:47 AM 05.482     0.0084s     WIN-330I86GF26R     SYST:PASS:INST:PASS "Pitbull5.5.001"
     Write
6/29/2014 10:47 AM 21.799     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:47 AM 21.830     0.0199s     TCPIP::192.168.0.144::vxi0,2::INSTR     -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n"     Read


6/29/2014 10:50 AM 52.348     0.0078s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001
     Write
6/29/2014 10:50 AM 55.188     0.0078s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:50 AM 55.203     0.0133s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

6/29/2014 10:51 AM 10.522     0.0085s     WIN-330I86GF26R     SYST:PASS:INST:PASS pitbull5.5.001
     Write
6/29/2014 10:51 AM 13.455     0.0076s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:51 AM 13.471     0.0212s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS p"     Read

6/29/2014 10:51 AM 58.445     0.0081s     WIN-330I86GF26R     SYST:PASS Pitbull5.5.001
     Write
6/29/2014 10:52 AM 00.972     0.0082s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:52 AM 01.004     0.0127s     TCPIP::192.168.0.144::vxi0,2::INSTR     -113,"Undefined header; Command not found; SYST:PASS "     Read


6/29/2014 10:52 AM 16.338     0.0082s     WIN-330I86GF26R     SYST:PASS:INST:PASS
     Write
6/29/2014 10:52 AM 19.786     0.0077s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:52 AM 19.801     0.0204s     TCPIP::192.168.0.144::vxi0,2::INSTR     -109,"Missing parameter; Unexpected termination detected; SYST:PASS:INST:PASS\n"     Read

6/29/2014 10:53 AM 32.637     0.0109s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull<5.5.001>
     Write
6/29/2014 10:53 AM 35.274     0.0079s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:53 AM 35.305     0.0226s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

6/29/2014 10:54 AM 00.218     0.0078s     WIN-330I86GF26R     SYST:PASS:INST:PASSPitbull5.5.001
     Write
6/29/2014 10:54 AM 02.854     0.0081s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:54 AM 02.870     0.0188s     TCPIP::192.168.0.144::vxi0,2::INSTR     -110,"Command header error; Illegal character in header; SYST:PASS:INST:PASSPitbull5."     Read


6/29/2014 10:54 AM 24.943     0.0118s     WIN-330I86GF26R     SYST:PASS:INST:PASS [Pitbull5.5.001]
     Write
6/29/2014 10:54 AM 27.689     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:54 AM 27.720     0.0144s     TCPIP::192.168.0.144::vxi0,2::INSTR     -101,"Invalid character; Unexpected character found; SYST:PASS:INST:PASS ["     Read

6/29/2014 10:55 AM 06.065     0.0089s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull
     Write
6/29/2014 10:55 AM 08.264     0.0085s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:55 AM 08.295     0.0182s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

6/29/2014 10:55 AM 34.737     0.0101s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull55001
     Write
6/29/2014 10:55 AM 37.405     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 10:55 AM 37.436     0.0252s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 06:03:15 pm

My TLA7AA4 wants "PitBull" with upper case "B". Can you check whether that works?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 06:04:03 pm

Power cycling the instrument and using Powerflex shows no options installed and the fields are all populated again showing 64K memory depth and 100mhz state.

Not surprising, since it appears the password line isn't working yet. Hopefully we can figure out what it wants.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 06:05:10 pm

Did you try "PitBull5.5.001"?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 06:07:19 pm

Quote from: dxl on June 29, 2014, 06:03:15 pm

My TLA7AA4 wants "PitBull" with upper case "B". Can you check whether that works?

I'm doing this on a TLA7N4. But, i also have a TLA7AA4 that I can try it on (of course it has already been "upgraded" with a new flash).

I used "PitBull" with the TLA7N4, still no go-

6/29/2014 11:05 AM 08.499     0.0305s     WIN-330I86GF26R     SYST:PASS:INST:PASS PitBull5.5.001
     Write
6/29/2014 11:05 AM 17.438     0.0108s     WIN-330I86GF26R     SYST:ERR?
     Write
6/29/2014 11:05 AM 17.469     0.0265s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 06:28:59 pm

Quote from: dxl on June 29, 2014, 06:05:10 pm

Did you try "PitBull5.5.001"?

Didn't work on the 7N4 as posted above. Will check my 7AA4 shortly.

Did you ever get it to work with a 7N4 or just the the 7AA4?

When you disassembled the firmware, did you disassemble the firmware file distributed by tektronix or did you have to pull it out of the module itself. Was the PitBull password plain text in the firmware?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 06:34:29 pm

Data type error; Unrecognized string data - i think youre missing the quotes around the password.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 06:34:53 pm

What does *IDN? tell you?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 06:50:32 pm

Quote from: dxl on June 29, 2014, 06:34:29 pm

Data type error; Unrecognized string data - i think youre missing the quotes around the password.

OK I'll try it with quotes. Just waiting for a reboot.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 06:54:42 pm

Tried the 7AA4 with quotes and now no error! (Without quotes was error on the 7AA4). So good.

Now the 7N4-

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 07:19:23 pm

The 7N4 is locked up. Going to have to pull it out and reseat it. Be a few more minutes to see if the password works.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 07:36:06 pm

OK!

That works on the TLA7N4.

So the correct line is-

SYST:PASS:INST:PASS "PitBull5.5.001"

I had tried quotes before, but without the capital B.

Now on to the other commands.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 07:37:10 pm

Nice :).

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 07:42:23 pm

Quote from: dxl on June 29, 2014, 07:37:10 pm

Nice :).

OK!!!!

Speed has been upgraded to 200mhz. But, not memory depth.

I wonder if that is the right command for setting the memory depth, because SYST:CONF:MAX:DEPTH? query returns the 4MB but in Powerflex the maximum memory depth is 64K and can be upgraded to 4MB.

Even before any modifications SYST:CONF:MAX:DEPTH? query returns 4194304 bytes

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 07:48:10 pm

I think I found it.

Testing now.

The correct command is:

SYST:CONF:DEPTH 4194304

Checking it now...

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 07:55:01 pm

:D :D :D :D

THAT'S IT!!!!!

Thanks for your help!!!

TLA7N4 upgraded to 200mhz and 4M depth

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: dxl on June 29, 2014, 07:59:12 pm

Glad to hear that this finally worked. Sorry for all the trouble with the exact commands - it's been a while since i did that on my LA.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 29, 2014, 09:01:45 pm

Quote from: dxl on June 29, 2014, 07:59:12 pm

Glad to hear that this finally worked. Sorry for all the trouble with the exact commands - it's been a while since i did that on my LA.

Thanks again!

I'm sure a few others will be happy too. Having 4mb of depth instead of 64k is quite the improvement :D

I will write it up concisely on one page a little later.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: nctnico on June 29, 2014, 09:22:30 pm

I guess it is a bad day for Tektronix. Some of these upgrades make a US $50000 difference in price >:D

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on June 30, 2014, 03:04:29 am

Thank eevblog.com user "dxl" for all of this. Good on him! Thank Dave too for making this a fun, friendly, place to meet and share knowledge. Good on you Dave!

This procedure was tested with Tektronix TLA Software versions 5.1, 5.6, and 5.8 on a TLA714.

Modules tested were the TLA7N4 and partially the TLA7AA4 but it is expected that module will work OK with this software hack saving the effort of having to do the hardware hack. No additional software is necessary other than what is default installed by the Tektronix TLA Application software.

Please submit any errata and I will update this post to maintain the most recent and correct procedure.

Thanks to "TiN" and "nctnico" for all their input in this thread. Good on you guys as well.

I have done this procedure, and the instrument was powered down for several hours and still retains the upgrades so it is permanent.

Follow these steps exactly to reproduce my success:

1) Starup the TLA instrument and then connect to it locally or remotely.

2) Launch the TLA Application (this is important on remote connects only) and let it connect to your remote TLA.

3) Use Start menu on Windoze and goto TekVISA folder and select "OpenChoice Talker Listener". If you are doing this remotely, IT IS IMPORTANT you quit the TLA Application once the Openchoice Talker Listener shows your remote modules.

4) Under the upper-leftside pane "Instruments" you will see your various modules listed.

5) Select the module you want to upgrade, if not sure of the slot number just pick one for now.

6) On the upper right side you will see an entry field titled "Enter Command or Script" referred from now on as COMMAND.

7) Enter in the COMMAND field *IDN?

8. Click the "Query" button below the field and note the output in the lowest frame titled "Talker Listener Readout" referred from now on as OUTPUT.

9) Look for the firmware version in OUTPUT and make a verbatim note of it referred to from now on as <VERSION>. Also verify it is the module you want to update, if not, repeat step 5 above and pick the correct one.

10) You now know which module to update and what the firmware version is. You are ready to begin the upgrade.

11) Now you will want to figure out what the Max upgrade you can make. Either you know it already, or you will want to see what maximum your module supports. This document focuses on two things, maximum State acquisition speed, and maximum memory depth.

12) To determine your maximum State speed in Mhz issue this COMMAND then click "Query" and make note of it as <SPEED>:

SYST:CONF:MAX:SPEED?

13) To determine your maximum Memory depth in bytes issue this COMMAND then click "Query" and make note of it as <DEPTH>:

SYST:CONF:MAX:DEPTH?

14) Timestamp is required. For 6/29/2014 you can use 1404025200, if not create a new unix timestamp. Refer to it as <TIME>. Using the exact time may not be important.

15) Make sure the correct module is selected under "Instruments" and enter the following commands into the COMMAND field. After each line, press the Write button under the COMMAND field. An Example of all commands will be shown after all the lines. Note: do not include the < > just the value. Use quotation marks when shown. Commands are case sensitive.

SYST:PASS:INST:PASS "PitBull<VERSION>"
Set Parameters
Code: [Select]
SYST:CONF:DEPTH <DEPTH>
SYST:CONF:SPEED <SPEED>
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <TIME>

WORKING EXAMPLE-

SYST:PASS:INST:PASS "PitBull5.5.001"
Set Parameters
Code: [Select]
SYST:CONF:DEPTH 4194304
SYST:CONF:SPEED 200
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD 1404025200

16) After commands are entered, you can exit OpenChoice Talker Listener and run the TLA Application and note your new upgrades :D

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on June 30, 2014, 04:47:38 am

Cool, thumbs up for dxl (https://www.eevblog.com/forum/profile/?u=97462). :-+

Quote

I will write it up concisely on one page a little later.

I'll have article as well on my site, will test this trick with my TLA714 and 7AA4 on weekend. :-/O

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: bench_knob on February 13, 2015, 06:09:52 pm

Quote from: KK on June 30, 2014, 01:04:29 PM (https://www.eevblog.com/forum/index.php?topic=20936.msg470705#msg470705)>Quote

Thank eevblog user "dxl" for all of this. Good on him!

This procedure was tested with Tektronix TLA Software versions 5.1, 5.6, and 5.8 on a TLA714.
.
.
<<deletia>>
<<deletia>>
.
.
14) Timestamp is required. For 6/29/2014 you can use 1404025200, if not create a new unix timestamp. Refer to it as <TIME>. Using the exact time may not be important.

15) Make sure the correct module is selected under "Instruments" and enter the following commands into the COMMAND field. After each line, press the Write button under the COMMAND field. An Example of all commands will be shown after all the lines. Note: do not include the < > just the value. Use quotation marks when shown. Commands are case sensitive.

SYST:PASS:INST:PASS "PitBull<VERSION>"
Set Parameters
Code:

[Select]
SYST:CONF:DEPTH <DEPTH>
SYST:CONF:SPEED <SPEED>
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <TIME>

Working Example - (use your values instead, ie..fw, speed, & depth), click 'Write' after each line

SYST:PASS:INST:PASS "PitBull5.5.001"
Set Parameters
Code: [Select]
SYST:CONF:DEPTH 4194304
SYST:CONF:SPEED 200
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD 1404025200

16) After commands are entered, you can exit OpenChoice Talker Listener and run the TLA Application, System Properties, Modules and note your new upgrades :D

dxl & kk,

I ran the above commands and sure enough, my TLA7AA4 morphed from a CS to an ES in the blink of a few writes!

Thanks

Just as an FYI...my system is a TLA704 hacked to run Win2k Pro, TLA App 5.1. I used kk's provided 'time-stamp' value.

:))

bench_knob

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Sailor on February 16, 2015, 11:54:37 am

@ bench_knob, KK, dxl, et al,

I'll give this a go on my TLA7AA s this weekend. One of them has max speed, but small depth, the other has max depth, low speed ::). However, I have ~~one~~ two question(s) about the procedure; where you have

Set Parameters
Code: [Select]
and
Save Parameters
Code: [Select]

what is the [Select] parameter? Is it a drop-down box with pre-defined values, or ...???

When you entered 1404025200 as the timestamp, did you have the true (e.g. today's) date set on the TLA, or had you changed the TLA Windows date to, or near to, 6/29/2014?

Thanks,
Sailor

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Mark_O on February 16, 2015, 02:31:48 pm

Quote from: bench_knob on February 13, 2015, 06:09:52 pm

Just as an FYI...my system is a TLA704 hacked to run Win2k Pro, TLA App 5.1. I used kk's provided 'time-stamp' value.

Yeah, I have this thread marked for when I can find some free time to do the same with one of my TLA704's (I have two). I wasn't even aware it was possible to use the 7AA4 modules with it, before I read it here. :-+ Very good stuff, and thanks to all.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: gslick on February 18, 2015, 07:07:03 am

As far as I can tell these lines in the lists of commands to sent to the analyzer module were originally intended to be comments on what the following commands were doing and are not actually intended to be sent as commands to the analyzer module:

Set Parameters
Code: [Select]

Save Parameters:
Code: [Select]

So the literal list of example commands to be sent to the analyzer module would be reduced to the following, where the firmware version in the password string, the sample depth, and the speed would have to match the analyzer module as appropriate:

SYST:PASS:INST:PASS "PitBull5.5.001"
SYST:CONF:DEPTH 4194304
SYST:CONF:SPEED 200
SYST:PASS:INST:UPD 1404025200

I had success in getting these commands to work with a TLA7N4 analyzer module, but the settings did not persist across a power cycle. I believe this might be due to a dead battery in the DS1225AD NV-SRAM in the TLA7N4. I will have to try replacing the DS1225AD NV-SRAM and see if the settings then persist across a power cycle.

One other note, I wasn't able to figure out how to get TekVISA installed on my TLA714 running Windows 2000 SP4 and V4.4 of the analyzer application so I could send the commands to the TAL7N4 module from the TAL714 analyzer mainframe. Instead I installed the TLA7N4 analyzer module in another VXI mainframe with an NI VXI-1394 controller and installed NI-VXI 3.5.2 software on a Window XP system with a 1394 controller connected to the VXI-1394 controller. Then I used the NI-VXI 3.5.2 software to send the commands to the TLA7N4 analyzer module through the VXI-1394 controller. I wasn't sure if I would be able to get that configuration to work together but gave it a try and got it working.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Sailor on February 18, 2015, 11:11:58 am

Quote from: gslick on February 18, 2015, 07:07:03 am

... originally intended to be comments on what the following commands were doing and are not actually intended to be sent as commands to the analyzer module:

Ummm ??? So, no selection list, ...?

Quote

I wasn't sure if I would be able to get that configuration to work together but gave it a try and got it working.

Congratulations, It sounds like an interesting journey :-+

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: gslick on February 18, 2015, 08:58:35 pm

Quote from: Sailor on February 18, 2015, 11:11:58 am

Ummm ??? So, no selection list, ...?

Correct. That text is just commenting on what the commands are doing are not actual commands to be sent to the analyzer module.

Here are the actual commands that I used to update a TLA7N4 with Option 3S (100MHz State, 4M Depth) to Option 7S (200MHz State, 4M Depth). Unlike the first TLA7N4 module I tried this one appears to have a working NV-SRAM chip and the option update persists across power cycles.

(write) and (read) are not included the command and response text sent to and from the analyzer module. I used a unix timestamp of 1424217600 corresponding to 02/18/2015 @ 12:00am (UTC). I don't know if that timestamp is used for anything anywhere.

(write) *IDN?
(read) TEKTRONIX,TLA7N4,B012xxx,SCPI:94.0 FVER:4.3.14
(write) SYST:CONF:MAX:SPEED?
(read) 200
(write) SYST:CONF:MAX:DEPTH?
(read) 4194304
(write) SYST:CONF:SPEED?
(read) 100
(write) SYST:CONF:DEPTH?
(read) 4194304

(write) SYST:PASS:INST:PASS "PitBull4.3.14"
(write) SYST:CONF:DEPTH 4194304
(write) SYST:CONF:SPEED 200
(write) SYST:PASS:INST:UPD 1424217600

(write) SYST:CONF:SPEED?
(read) 200
(write) SYST:CONF:DEPTH?
(read) 4194304

Before and after analyzer properties shown in attached images.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Sailor on February 18, 2015, 11:14:51 pm

Thanks gslick, I look forward to trying it.

Sailor

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: gslick on February 19, 2015, 04:01:28 am

For completeness, this also appears to work the same way with TLA7Lx and TLA7Mx analyzer modules, with the exception that with firmware version 3.2.1 that password is in all uppercase, i.e. "PITBULL3.2.1". And of course the maximum sample depth value choices are smaller.

Here are the actual commands that I used to update a TLA7M3 from 100MHz State to 200MHz State.

(write) and (read) are not included the command and response text sent to and from the analyzer module. The unix timestamp of 1424217600 corresponds to 02/18/2015 @ 12:00am (UTC).

(write) *IDN?
(read) TEKTRONIX,TLA7M3,B010xxx,SCPI:94.0 FVER:3.2.1
(write) SYST:CONF:MAX:SPEED?
(read) 200
(write) SYST:CONF:MAX:DEPTH?
(read) 524288
(write) SYST:CONF:SPEED?
(read) 100
(write) SYST:CONF:DEPTH?
(read) 524288

(write) SYST:PASS:INST:PASS "PITBULL3.2.1"
(write) SYST:CONF:DEPTH 524288
(write) SYST:CONF:SPEED 200
(write) SYST:PASS:INST:UPD 1424217600

(write) SYST:CONF:SPEED?
(read) 200
(write) SYST:CONF:DEPTH?
(read) 524288

Before and after analyzer properties shown in attached images.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: bench_knob on February 19, 2015, 10:13:08 am

Quote from: Sailor on February 16, 2015, 10:54:37 PM (https://www.eevblog.com/forum/index.php?topic=20936.msg610901#msg610901)Quote>

Quote

@ bench_knob, KK, dxl, et al,

I'll give this a go on my TLA7AA s this weekend. One of them has max speed, but small depth, the other has max depth, low speed ::). However, I have ~~one~~ two question(s) about the procedure; where you have

Set Parameters
Code: [Select]
and
Save Parameters
Code: [Select]

what is the [Select] parameter? Is it a drop-down box with pre-defined values, or ...???

When you entered 1404025200 as the timestamp, did you have the true (e.g. today's) date set on the TLA, or had you changed the TLA Windows date to, or near to, 6/29/2014?

Thanks,
Sailor

Hi Sailor,

Hi there GSlick,

I just copied the commands verbatim just as dxl & kk worked things out. The process did not error out. My TLA7AA4 CS upgraded to ES and the modules remember their settings through power-cycles. In other words, I copied and entered the lines exactly; its true, intuitively one considers that there is some type of 'list' expected, but no, just enter the commands verbatim and click the WRITE button.

Set Parameters<click WRITE>
Code: [Select]<click WRITE>
and
Save Parameters<click WRITE>
Code: [Select]<click WRITE>

Re; the 'time-stamp' data, yes, I just used kk's value, and no, I did not change the analyzer's CMOS time or the OS time. I looked around for a way to generate a 'current' Unix Time-Stamp, but couldn't figure it out, so I just tried kk's TIME-STAMP value and it worked just fine.

Let us know how things go...

Cheers,

bench_knob

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: bench_knob on February 19, 2015, 10:36:05 am

Quote from: Mark_O on February 17, 2015, 01:31:48 AM (https://www.eevblog.com/forum/index.php?topic=20936.msg610975#msg610975)>Quote from: bench_knob on February 14, 2015, 05:09:52 AM (https://www.eevblog.com/forum/index.php?topic=20936.msg608889#msg608889)

Quote

>
Quote
Just as an FYI...my system is a TLA704 hacked to run Win2k Pro, TLA App 5.1. I used kk's provided 'time-stamp' value.

Hi MarkO,

The TLA704 hack takes a bit of work, and there is no direct pre-worked-out strategy for some of it. One area is the LCD issue. To run Win2k requires a memory upgrade BIOS flash operation (one TLA-704 motherboard bricked and two others worked just fine), in addition to that, there is an additional BIOS hot-patch hack required (ROM image provided by Mr. Green) to be able to run the LCD at the minimum of 800x600 resolution required by Win2k. An external monitor can be used, but frankly doing so takes lot of bench space. The native TLA704 LCD only runs 640x480 so it must be replaced with something. I very luckily found a new 10" NEC LCD, that was mechanically a virtual a drop-in replacement (only had to cut out a slot), and I had to fabricate a new interface PCB (Eagle 5.5) and find connectors for it, all were available only as SMDs. As I did not have any reliable strategy for cooking SMD parts, I hacked together an SMD oven (that's a whole 'nother story, one that I'll share should anyone care to hear it? I have complete plans that work well, uses a PIC uControler.)

For me, upgrading my TLA704 was a multi-year adventure. Although I do have all the linkages, it'll still require some cutting, hacking, solder'n, copying, pasting...and sweating. But frankly it was very rewarding and it works great when run remotely via EtherNet!! I love it now and with the 32 Mb TLA7AA4, its hot!

:))

bench_knob

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: TiN on February 19, 2015, 04:26:59 pm

Wow, that's lot of pain to go thru.
Would make up a great article about, how to get desire come true :D
I could host and provide storage for files endlessly for stuff like this

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: KK on February 19, 2015, 07:15:13 pm

Verbatim is correct. Use my listed steps verbatim and it will upgrade.

Time on the instrument was close to the time stamp I generated but not exact. I don't think it's important as another user verified he used my same timestamp at a later date.

Good luck!

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Mark_O on February 20, 2015, 02:28:14 am

Quote from: bench_knob on February 19, 2015, 10:36:05 am

For me, upgrading my TLA704 was a multi-year adventure. Although I do have all the linkages, it'll still require some cutting, hacking, solder'n, copying, pasting...and sweating. But frankly it was very rewarding and it works great when run remotely via EtherNet!! I love it now and with the 32 Mb TLA7AA4, its hot!

Thanks, bench_knob! I'm not sure I have the time or energy for a multi-year adventure. But I do know there's much to be learned here.

Most of my lab gear from my latest move isn't even unpacked yet, but I just noticed I had a couple TLA-7N3 modules unboxed, one 2S and one 6S, that I can upgrade to 7S versions (200 MHz, 4 MSa), using the techniques described here recently. That will certainly be worth doing.

One thing I would definitely like to figure out is how to do the channel stacking I read was possible with these. I.e., let's say 136 channels width was overkill for me (it always has been, on my 7N4 module), and sometimes I could get along fine with only 17 channels wide. That collapses the width by 8x, and pushes the depth up by a corresponding factor, so 4M to 32M sample depth.

I never was able to track that one down, but it would come in handy. I think it was described as a "software option", but I never found it.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: nctnico on February 20, 2015, 12:06:48 pm

AFAIK Tektronix calls it channel grouping. For the TLA7AA you can reduce the number of channels by 4 and get 2Gs/s with a 128M depth. But I don't recall being able to set lower sampling frequencies while grouping the channels.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Sailor on February 22, 2015, 09:57:36 am

First of all: - Thank you very much to everyone who has made this possible :-+

The short version:
Last night I upgraded my TLA7AA2 from 120MHz state / 32M depth to 450MHz state / 32M depth. Today I upgraded my TLA7AA4 from 450MHz state / 8M depth to 450MHz state / 32M depth.

Terrific, worked as advertised, what more can you want?

Now the longer version:
When upgrading the TLA7AA2 I did everything absolutely exactly as in KK's post. All upper-case where he had it, and I included those silly Set/Save Parameter and Code: [Select] lines, etc. And, as I said, it all worked perfectly. But come this morning and those 'useless' lines were still annoying my subconcious, so I decided to have a quick look through the TLA7AAx firmware for any strings that looked like they might be associated. The bottom line is that there is a lot of stuff to look through, and I haven't yet made any connections, but in my perusals I noticed that there were virtually no all-upper-case symbols/table-entries etc. The password is there with its mixed case, but that was it. So I decided to try upgrading the second module with just lower-case command entries, and to also only enter the values that needed to be updated. In this case, the only change that needed to be made to the module was to increase the sample depth to 32M, so after establishing communication (remotely) using the Talker/Listener app, all I entered was

syst:pass:inst:pass "PitBull5.0.002"
syst:conf:depth 33554432
syst:pass:inst:upd 1404025200

and that was it.

So now I have 204 channels of nice high-speed capture. I hope I don't need it all to fix this $@#&*! Intel 8039 in my 3468A :palm:

I think there's an option for Ida Pro to look at Wind River stuff (can anyone confirm?) It might be interesting to have a bit of a dig through the code. And, of course, I could have the TLA get all incestuous with itself and capture what the 68360 is doing... ;D

Ahhh...I just noticed an earlier post by dxl

Quote

I dissassembled the Firmware in 2009 to upgrade the Module.

@dxl - Did you use Ida, or some other 68000 dis-assembler? How far did you get into it?

Sailor

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: gslick on February 22, 2015, 07:23:06 pm

Quote from: Sailor on February 22, 2015, 09:57:36 am

When upgrading the TLA7AA2 I did everything absolutely exactly as in KK's post. All upper-case where he had it, and I included those silly Set/Save Parameter and Code: [Select] lines, etc. And, as I said, it all worked perfectly. But come this morning and those 'useless' lines were still annoying my subconcious, so I decided to have a quick look through the TLA7AAx firmware for any strings that looked like they might be associated. The bottom line is that there is a lot of stuff to look through, and I haven't yet made any connections, but in my perusals I noticed that there were virtually no all-upper-case symbols/table-entries etc. The password is there with its mixed case, but that was it.
Sailor

Most likely the only string that is case sensitive is the password string, "PITBULL" on the TLA7Lx and TLA7Mx and "PitBull" on the newer analyzer modules, and all command strings comparisons are case insensitive.

If you dump the strings from the firmware the command text strings are all in mixed case, in the usual convention where the upper case part is the abbreviated version of the string and the lower case part is the remainder of the full length string, and text inside square brackets is an optional qualifier.

I wonder how the channel qualifier would be used with depth and speed and not apply to all channels at the same time?
:SYSTem:CONFig[:CHANnel]:DEPTh
:SYSTem:CONFig[:CHANnel]:SPEed

For the curious attached is the command string text dumped from version 5.0.002 of the TLA7Axx firmware. (The TLA7Axx.lod firmware file is a Motorola S-record file which can be converted to binary and then searched for strings).

It would be interesting to sniff the VXI bus and observe how these commands are used during the operation of the analyzer.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: Sailor on February 22, 2015, 11:43:11 pm

Quote from: gslick on February 22, 2015, 07:23:06 pm

(The TLA7Axx.lod firmware file is a Motorola S-record file which can be converted to binary and then searched for strings).

Yes, that is what I did, but your list is a lot cleaner than I recovered. What did you use to scan the binary? Is your list the raw output from the scan, or have you done some manual cleanup?

It still nags me that it simply ignores set/save and code: commands. Considering that there is no apparent recognition of those strings (i.e. not in the command list), yet they are ignored so quietly while the slightest error in any other command can provoke anything from a warning message to a 'hang'. It makes me wonder if they never actually reach the module... which raises the question of who would be filtering them?

All very low on the list of priorities, I know, but that's just how I'm wired :palm:

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: gslick on February 23, 2015, 12:22:13 am

I just used a simple strings utility on the firmware binary. I was using a Windows PC at the time and this is the one I happened to use (which originally came from www.sysinternals.com (http://www.sysinternals.com)).
https://technet.microsoft.com/en-us/sysinternals/bb897439.aspx (https://technet.microsoft.com/en-us/sysinternals/bb897439.aspx)

As far as I could see all of the command string text was located in one contiguous table. I just manually selected and copied that text.

After seeing some of the other text in the firmware I'm curious what you can do if you attach a serial connection to the analyzer module CPU board. Maybe you can't do anything useful other than learn more about how the analyzer module firmware works. I haven't tried to do any disassembly of the firmware myself yet.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: rtekal on September 11, 2017, 05:52:59 am

I have a TLA614 which I have been using for past 10 years. Last month it started failing the power on diagnostics with the NVRAM check fail. Have gone through the other replies. The question is If I replace the NVRAM IC DS1225AD-85, will the error be eleminated after self-calibration? How to backup the contents of the NVRAM?

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: jasonbrent on February 28, 2018, 05:32:45 pm

For posterity, this works on the 5000 series also.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: avics on May 09, 2022, 01:06:51 pm

Although this is an old topic, I've also succeeded to update a TLA 7AA4 module.
I came across this on the Tek website:

https://www.tek.com/en/support/software/utility/visacmd-command-line-utility (https://www.tek.com/en/support/software/utility/visacmd-command-line-utility)

It also allows scripting.

J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=*IDN?
TCPIP::192.168.178.194::vxi0,2::INSTR <- *IDN?
TCPIP::192.168.178.194::vxi0,2::INSTR -> TEKTRONIX,TLA7AA4,B013745,SCPI:94.0 FVER:<VERSION>

J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=SYST:CONF:MAX:SPEED?
TCPIP::192.168.178.194::vxi0,2::INSTR <- SYST:CONF:MAX:SPEED?
TCPIP::192.168.178.194::vxi0,2::INSTR -> 450

J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=SYST:CONF:MAX:DEPTH?
TCPIP::192.168.178.194::vxi0,2::INSTR <- SYST:CONF:MAX:DEPTH?
TCPIP::192.168.178.194::vxi0,2::INSTR -> 33554432

J:\IDA\TLA\visacmd>notepad update.bat
SYST:PASS:INST:PASS "PitBull<VERSION>"
Set Parameters
Code: [Select]
SYST:CONF:DEPTH 33554432
SYST:CONF:SPEED 450
Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD 1652097781

J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=update.bat /l

This because for some reason The OpenChoice Talker Listener didn't go well for me.

Needless to say change the <VERSION> with what comes out of the *IDN? command.

Title: Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
Post by: tori on September 15, 2024, 10:51:40 am

Hi!

This is very old thread but very useful :) Thanx to all involved...

I bought the TLA5202 cheaply but without HDD (235MHz speed, 512k depth). I installed new HDD, recreated the software (WinXP (originally installed), module firmware upgrade (neccesary), TLA 6.1) and by chance came across this thread, where it was described how to implement the analyzer option upgrade.

Connected locally - Tek visa shows that I have 3 instruments onboard (after *IDN?):

TLA5202
TLA7AB4
TLA7BB4

Firmware rev. after upgrade 5.7.001

So I tried to make it standard way (passed on TLA5202 module only) ->

syst:pass:inst:pass "PitBull5.7.001"
syst:conf:depth 33554432
syst:conf:speed 450
syst:pass:inst:upd 1726396000

Unfortunately - NO LUCK. I tried it many times. In different order, with different spellings, and so on... Communication would hang up, PowerFlex would stop seeing the module and hard reboots of the analyzer were necessary. I thought I might look in the firmware and find something - however, other than the "PitBull" password, I found nothing interesting. I also thought that PowerFlex is a program that helps install options, so I also started to look at this one in the hex editor. of course, I found there the password - PitBull, but also PITBULL, and what is very interesting right before the password PITBULL is placed the word FUJIHIKO.

So I prepared a script in visa and changed the passwords one by one.

2nd attempt
syst:pass:inst:pass "PITBULL5.7.001"
syst:conf:depth 33554432
syst:conf:speed 450
syst:pass:inst:upd 1726396000

Module hangs - restart required
After restart nothing changes - speed 235MHz and 512k depth

3rd attempt
syst:pass:inst:pass "FUJIHIKO5.7.001"
syst:conf:depth 33554432
syst:conf:speed 450
syst:pass:inst:upd 1726396000

Module hangs - restart required
After restart changes are visible - speed 450MHz and 32M depth

So - it works. Thanks to the discussion I managed to upgrade my analyzer as well. Hope it will help another users. Of course it is possible that a PITBULL password will be OK in your case...

tOri

P.S. Next and last step will be memory upgrade to 1GB dual-channel (originally my device had 512MB - not enough for WinXP). I don't plan to make further upgrades :)

SMF 2.0.19 | SMF © 2021, Simple Machines
Simple Audio Video Embedder
SMFAds for Free Forums | Powered by SMFPacks Advanced Attachments Uploader Mod