Upgrading/Unlocking Agilent Meters via EEPROM - Page 1
Forum section: electronics / projects

author: gnif
author_rank: Unknown
timestamp: February 22, 2013, 08:17:09 am
content: Hi All,Update: It has been confirmed that the U1732C LCR meter can be upgraded to a U1733C also!I am opening this here as it is a more appropriate place to discuss this, please see the following message for the history of this:https://www.eevblog.com/forum/buysellwanted/ex-demo-agilent-u1241's-for-sale-in-oz/msg194648/#msg194648A quick synopsis:The U1241A has a Atmel I2C EEPROM in it, that when the SCL and SDA lines are shorted on power up, the meter upgrades into a U1242A, as such I have just managed to dump the EEPROM and I am now proceeding to try to upgrade the thing.If anyone has a U1242A and is inclined to crack it open, it would be great if you could dump the EEPROM contents to make it easier to figure out how to upgrade this thing.EDIT: This will also work for the U1241B as it is functionally identical.

author: gnif
author_rank: Unknown
timestamp: February 22, 2013, 12:41:23 pm
content: I found it! I have all the features of the U1242A in my U1241A now!Change byte 0x1e5 from 0x01 to 0x02!This enables:J type ThermocoupleAC Harmonic Ratio MeasurementT2 Temerature MeasurementT1-T2 Temperature Delta MeasurementScanning Temperature MeasurementData LoggingEdit: It might be just me, but it seems that the continuity tester is much faster to latch now also.

author: Lightages
author_rank: Unknown
timestamp: February 22, 2013, 11:27:47 pm
content: Interesting find. Personally I find it curious that the U1241B exists at all. It costs $206 retail at one online retailer and the U1242B costs only $226, less than 10% difference.

author: gnif
author_rank: Unknown
timestamp: February 23, 2013, 01:09:38 am
content: Agreed, but it makes me wonder how many other higher priced meters can be upgraded to their more expensive models which do have a larger price gap.

author: EEVblog
author_rank: Unknown
timestamp: February 23, 2013, 01:12:06 am
content: Nice find!Dave.

author: BravoV
author_rank: Super Contributor
timestamp: February 23, 2013, 05:01:52 am
content: Thank you ! Great finding !Mind share the process how did you manage to find it ? If you don't mind of course.Curious if this hack applicable to "B" version as well.Now, the fun part, stalking great deal or bargain on NOS U1241.

author: gnif
author_rank: Unknown
timestamp: February 23, 2013, 08:24:15 am
content: Thanks,The B model is just a colour change according to the manuals, the website and the spec sheets, so it should work on it just fine also. If you are worried you can obtain a 2nd hand A model from Triohere. This is why I bothered to try to enable these features because I got the cheaper meter and the price difference wasn't just $20-30 for me, it was over $100.The process was pretty simple, I did a tear down to inspect it and comment on its build on this forum. I noted that others had upgraded the firmware in other Agilent devices to fix firmware bugs, so I kept an eye out for an EEPROM when I had it apart. There was only one there, so as a quick and simple test, I shorted out the i2c lines to prevent the micro talking to it on start up, which presented an error, but was still functional. Checking the setup menu I found I had the additional options to configure, and all the other values were set to FF or FFFF, etc.. so the micro defaults values to FFFF when it cant read the EEPROM.I then programmed a STM32 development board to dump & flash the EEPROM and had a look around in it. The data is pretty easy to see how it is segmented, calibration data, then device name, model and serial number, and after that the config space.Since I knew that 0xFF was a good value to set to enable these features I started out by setting portions of the data to all 0xFF, powering on the meter and checking if it had the additional features. If it didn't work, I reversed it, and tried another area, until it did work. Then I just repeated the process until I found the exact byte to change, and experimented with it's value.A word of caution if you attempt this in any meter, make your EEPROM read only by pulling the write protect pin high before you start to be 100% sure you back up its contents before altering them, as the EEPROM also contains all the calibration data for your meter, and changing it will cause your meter to read things incorrectly.

author: fcb
author_rank: Super Contributor
timestamp: February 23, 2013, 03:11:00 pm
content: somewhere in Agilent, and engineer is adding an encoded checksum routine to the EEPROM driver library....

author: gnif
author_rank: Unknown
timestamp: February 23, 2013, 03:50:34 pm
content: If they do it will only affect new units, as these are a OTP device.

author: vl400
author_rank: Regular Contributor
timestamp: February 24, 2013, 04:45:38 am
content: Thanks for the modWorks for U1732C LCR meter too, shows U1733C on boot and have 100Khz. Now to change the EEPROM

author: gnif
author_rank: Unknown
timestamp: February 24, 2013, 05:19:04 am
content: Quote from: vl400 on February 24, 2013, 04:45:38 amYou are most welcome, it is awesome to know that it is not just applicable to my meter. If you let me know the byte to change and what to I will update the first post. I will now also re-title this thread as it seems that there might be quite a few that this can be done to.

author: EEVblog
author_rank: Unknown
timestamp: February 24, 2013, 07:26:32 am
content: Probably a similar thing on the 1250 series 1270 series too!But there is not a big difference in the price between the two models in each of these groups anyway.Dave.

author: BravoV
author_rank: Super Contributor
timestamp: February 24, 2013, 08:06:44 am
content: Quote from: vl400 on February 24, 2013, 04:45:38 amWow, is that the same address and value ?

author: gnif
author_rank: Unknown
timestamp: February 24, 2013, 08:23:31 am
content: Quote from: BravoV on February 24, 2013, 08:06:44 amFrom what he said I would suspect that he is just shorting the SCA and SDL lines to see if it will upgrade, that is why he said he just needs to update the EEPROM now.

author: ttp
author_rank: Regular Contributor
timestamp: February 24, 2013, 10:39:19 am
content: Quote from: gnif on February 23, 2013, 08:24:15 amThis is quite interesting. How do you connect STM32 board to talk to EEPROM, I guess you don't remove/unsolder the EEPROM form original circuit?

author: gnif
author_rank: Unknown
timestamp: February 24, 2013, 11:40:27 am
content: Quote from: ttp on February 24, 2013, 10:39:19 amThe device is an i2c EEPROM, so I just used the hardware I2C controller in the STM32 I had handy at the time, it would be much easier to do this with a bus pirate or similar, but I do not have one. And yes, I left it in circuit, but provided a 3.3v source and the 2x 4.7k resistors to pull high the bus lines as per i2c spec. I soldered directly onto the chip's pins using wire wrap.

author: TRIO_Smartcal
author_rank: Contributor
timestamp: February 24, 2013, 10:20:29 pm
content: Have a look at these. Ex-stock off our website.http://triosmartcal.com.au/1687-total-phase-aardvarkt-iscspi-host-adapter-tp240141.htmlhttp://triosmartcal.com.au/1004-total-phase-beagle-iscspimdio-protocol-analyzer-tp320121.html

author: vl400
author_rank: Regular Contributor
timestamp: February 25, 2013, 05:42:17 am
content: Quote from: gnif on February 24, 2013, 08:23:31 amCorrect, only stopped the processor from reading the I2C to see if it responded the same which it did. For now am just probing the signals, it does 2 blocks of data on boot to grab a heap of data. The write enable pin is tied to ground, address lines are also all tied to ground.

author: ddavidebor
author_rank: Super Contributor
timestamp: February 25, 2013, 06:10:11 am
content: Where you have bought that probes?

author: vl400
author_rank: Regular Contributor
timestamp: February 25, 2013, 06:25:55 am
content: And success for the model, address 0x0A is 0x01 in a 1732C. Change to 0x00 for U1733C or downgrade to U1731C by setting to 0x02. However..... this allows 100KHz to be selected but does not provide a 100KHz measurement.Quote from: ddavidebor on February 25, 2013, 06:10:11 amThey came with a logic analyser

author: vl400
author_rank: Regular Contributor
timestamp: February 25, 2013, 10:22:02 am
content: So gnif, have you tried out the new functions? I am thinking either there is a block of data missing to enable/calibrate the 100KHz and DCR function of the U1733C or there are other byte to change for it to be a real U1733C, and the byte at 0x0A was enough to get only the display functions working.

author: gnif
author_rank: Unknown
timestamp: February 25, 2013, 01:04:43 pm
content: Quote from: vl400 on February 25, 2013, 10:22:02 amThe additional features are most certainly usable, but I have not yet (aka, don't know how to) test the AC harmonic ratio measurement, data logging works fine though as does the temperate delta measurement.

author: IanB
author_rank: Super Contributor
timestamp: February 25, 2013, 03:29:25 pm
content: Quote from: fcb on February 23, 2013, 03:11:00 pmI don't think Agilent needs to worry. The skill, knowledge and tools to do this are beyond the ability and motivation of 99.99% of purchasers. They are not going to lose sales over it.

author: gnif
author_rank: Unknown
timestamp: March 15, 2013, 03:30:49 am
content: As seen on Hack A Day!http://hackaday.com/2013/03/14/eeprom-hack-unlocks-crippled-features-in-agilent-multimeter-and-lcr-meter/

author: BravoV
author_rank: Super Contributor
timestamp: March 15, 2013, 04:48:51 am
content: Quote from: vl400 on February 25, 2013, 10:22:02 amAny new progress on the 100Khz feature ? I got an offer locally for a U1732C bout $250 in pristine condition.

author: logic
author_rank: Newbie
timestamp: March 15, 2013, 04:52:56 am
content: Quote from: gnif on March 15, 2013, 03:30:49 amThat's how I found this thread. Great Find!Patrick

author: Technics
author_rank: Newbie
timestamp: March 15, 2013, 07:19:51 am
content: I asked this over on HAD. Have you checked that the extra ranges have been calibrated? I would imagine calibration of each range is done in the factory and stored in the EEPROM. I don't imagine they calibrate ranges that aren't enabled. It would be good to check EEPROM images of several meters. If all ranges are calibrated then it's a good find.

author: gnif
author_rank: Unknown
timestamp: March 15, 2013, 07:35:36 am
content: Quote from: Technics on March 15, 2013, 07:19:51 amThis does not enable additional ranges, just features such as data logging. Also this meter supports calibration via the menus, so if you have the standards you could calibrate it yourself anyway.

author: Teemo
author_rank: Regular Contributor
timestamp: March 15, 2013, 09:14:39 am
content: All this good info certainly brought the Agilent meters to my attention. And made me think about puchasing one... This is somehow compelling to know that it is possible to activate some hidden features. To make thing to do what it was not supposed to do.

author: vl400
author_rank: Regular Contributor
timestamp: March 15, 2013, 09:37:32 am
content: Have not done anything else with the U1732C to U1733C mod, it still thinks its a 33 but does nothing in 100KHz mode. If someone has a 31 that they can get an EEPROM dump from, or even better a 33, would make it much easier than randomly changing bytes.

author: gnif
author_rank: Unknown
timestamp: March 15, 2013, 11:06:45 pm
content: Quote from: vl400 on March 15, 2013, 09:37:32 amFor those that may be worried about copyright infringement by posting such a dump should not be concerned, the EEPROM only contains the device config, not the firmware.

author: BravoV
author_rank: Super Contributor
timestamp: March 16, 2013, 12:34:30 pm
content: I don't have any problem to dump content of my Agilent U1242Beeprom, as long anyone has patience and kindly enough to assist/guide me (read, a noob ee wannabe) in using my Stellaris Launchpad as logic analyzer to dump it, as this topic here ->Stellaris Launchpad Logic Analyser. Yes, I have those probes for hooking up a soic chip like vl400's photos.Of course, you also must provide the serial number's address in order for me to overwrite it.

author: gnif
author_rank: Unknown
timestamp: March 16, 2013, 12:37:46 pm
content: Quote from: BravoV on March 16, 2013, 12:34:30 pmI assume you mean the address of the i2c device? If so, then it is in the datasheet. You do not need a logic analyser, just interface to the device via I2C directly while the meter is off and dump the EEPROM, alter it and flash it back into the EEPROM. I am sure the Stellaris Lauchpad has an I2C interface.

author: BravoV
author_rank: Super Contributor
timestamp: March 17, 2013, 09:03:11 am
content: My problem is I dont have any dumping gadget like bus pirate or similar, while my programming skill at Stellaris only passed recently at the grade on making "Hello world !".About the SN address, its just for anonimity purpose before I give it to someone.

author: vl400
author_rank: Regular Contributor
timestamp: March 17, 2013, 09:31:05 am
content: My U1732C looks to have all address lines tied to ground, I didnt hook any pins to them to read and write it.

author: HackedFridgeMagnet
author_rank: Super Contributor
timestamp: March 17, 2013, 10:34:55 am
content: Bravo V, use an Arduino.I just bought one of those cheap Agilent U1242As too, $127 Au delivered. So I guess at some stage I may change the config.

author: vl400
author_rank: Regular Contributor
timestamp: March 17, 2013, 12:05:51 pm
content: Could be game over on the U1732C to U1733C EEPROM hack. While you can get the 33 options on the screen it wont measure anything, even with a blank EEPROM the 100KHz signal is never present. Am pretty confident it will require a hardware hack to go along with it

author: alexwhittemore
author_rank: Frequent Contributor
timestamp: April 01, 2013, 06:25:13 am
content: Quote from: IanB on February 25, 2013, 03:29:25 pmThat's totally, totally wrong, though! Think about it, if you're going to own an electronics multimeter that retails for between $200 and $500 US (given all the lines this affects), you DAMN well better at least understand what an eeprom is and how to use it. Now of course, this PARTICULAR meter is more electrical than electronic, but still. The 1253 line isn't.Anyway, more to the point, *someone already did,* else there'd be no thread. And the process is easy enough for the meter's target market to follow.The REAL reason they probably don't need to worry is that hobbyists make up a minuscule fraction of their market, and companies aren't going to start buying the cheaper tool and spending precious employee time hack-upgrading it. Which is, of course, why these tools can command such a high retail price despite being (one can only assume based on complexity) relatively cheap to manufacture and high-margin.

author: Harvs
author_rank: Super Contributor
timestamp: June 07, 2013, 11:53:49 am
content: I finally got around to doing this hack to the 1241.Just a note the harmonic ratio function doesn't work properly. It'll only ever display 0 or 100%, it looks like some sort of calibration data is missing (this is the sort of effect I've seen before when a meter's two point calibration are set to the same point. Unfortunately there's no calibration procedure for it.So if anyone with a 1242 feels incline to do a dump of the EEPROM, it would be interesting to see if there's some parts of the cal area that are used that aren't in the 1241. Alternatively I guess I could just start changing some of the values that are currently 0xFF prior to the serial number and see if that does anything.

author: millerb
author_rank: Regular Contributor
timestamp: June 07, 2013, 12:21:49 pm
content: [quote author=alexwhittemore link=topic=14365.msg210779#msg210779 and companies aren't going to start buying the cheaper tool and spending precious employee time hack-upgrading it. Which is, of course, why these tools can command such a high retail price despite being (one can only assume based on complexity) relatively cheap to manufacture and high-margin.Companies may not make it policy to hack their gear but budget constraints can motivate employees to do it on their own time.

author: Harvs
author_rank: Super Contributor
timestamp: June 08, 2013, 09:01:51 am
content: I've probed the EEPROM whilst it's in harmonic mode. There's 4 bytes it reads out that are different to those that are read during the AC volts measurement, when in 1000mV range. Not surprisingly they're all blank, which would be the problem.bytes0x80, 0x81, 0x40, 0x41are the blank ones it's reading.

author: droffsite
author_rank: Newbie
timestamp: March 04, 2022, 02:21:47 am
content: 9 years later, just did this to a cheap U1241A I got on eBay. Used a TL866II Pro. I had to desolder the EEPROM (attempts to read in circuit kept returning FF's and 80's), but then it worked a treat. Thanks!

author: JJalling
author_rank: Unknown
timestamp: March 04, 2022, 08:04:24 am
content: How about bench meters like the 34460A? Can they be "upgraded"?BR Jonas

author: OpenDev
author_rank: Newbie
timestamp: May 10, 2024, 01:19:02 pm
content: maybe a bit later. But I recently had access to two devices and thought I'd dump the eeprom

author: psydaddy
author_rank: Contributor
timestamp: May 07, 2025, 09:22:17 pm
content: Have you tried to update the firmware after the hack?https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/u1731c--u1732c--u1733c-firmware-update.html