TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :) - Page 1
Forum section: electronics / testgear

author: TiN
author_rank: Super Contributor
timestamp: September 22, 2013, 07:34:01 am
content: After readingthis threadI got temptation to look into my TLA7AA4 module as well, to unlock some extra memoryI have CS option, which is 2MB of enabled memory with 450MHz rate. There are upper DS and ES (8MB and 32MB).I looked on board and actually realized that hardware have full memory populated, it's just software disabled.There are 24 (or 48, don't remember if memory also populated on bottom side) xMicron 128Mbit DDRICs.And similar to other Tek machines, there is vxWorks PC in module as well, running on another smaller PCB with MC68360EM25L.Also RS232 port with console, just like expected, driven by LT1137A converter from SoC.I guess all calibration/key/option data is stored in DS1230AB, which will become a target after i get PROM programmer in my hands, to backuporiginal data.Gotcha some console outputs (attached file) too, lkup command seem to output all possible commands/function callsNot familiar with vxWorks at all, but I guess there should be a way to read/write NVRAM from console.After some googling and trying:Code:temp = malloc(0x8000)-> sysNvRamGet(temp,0x8000,0)value = -1 = 0xffffffffwhich means error. And temp variable stored nothing meaningful

author: EEVblog
author_rank: Unknown
timestamp: September 22, 2013, 08:00:46 am
content: I doubt anyone has ever bothered investigating this one before?Good luck.

author: nctnico
author_rank: Super Contributor
timestamp: September 22, 2013, 11:22:16 am
content: I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

author: TerraHertz
author_rank: Super Contributor
timestamp: September 22, 2013, 03:24:50 pm
content: Quote from: nctnico on September 22, 2013, 11:22:16 amYou sound so sure, yet offer no hints.Then what would you say the NVRAM is there for?The problem with using the software upgrade tool, is that (at least for my TLA 614) the 'upgrade kits' (data blobs) are no longer available. According to Tek's web site anyway. So getting the option installer to do its job (so can examine what it does and where the data goes) isn't an easy thing.Since there's no way in Hell I'm paying money for such a thing anyway, I don't think Tektronix would likely be terribly helpful. Considering my objectives, it's probably better not to even talk to them.Whether the old Pentium hardware trace units I have will work with the Celeron in my TLA - that's a question to be investigated.Btw TiN, I didn't get the files yet. Have been too busy procrastinating.Probably tomorrow.

author: nctnico
author_rank: Super Contributor
timestamp: September 22, 2013, 04:52:37 pm
content: Quote from: TerraHertz on September 22, 2013, 03:24:50 pmThere is only calibration data in the NVRAM. I went down this road; the first thing I tried was erasing the NVRAM and see if the options would dissapear. They didn't so the options are not in the NVRAM.

author: TiN
author_rank: Super Contributor
timestamp: September 23, 2013, 11:17:39 am
content: QuoteWell, I got programmer today, so will see. I don't find any other EEPROM/ROM storage except Flash and NVSRAM at first glance.Of course, Tek could store key data in one of their big ASICs, but that's questionable.I see few various ways to enable options:1. Having good key for option (it's not much of a secret, usually it's on sticker @ module label) - fool module ID to match key. PowerFlex tool gives you what is correct module ID for key. To do so need find ID location and alter it's contents.2. Find "option enabled" flag/storage and alter it to force option enabled, disregarding of ID/key3. Do some black software magic and reverse correct key for PowerFlex to enable option using known IDAny vxWorks experts around?UPDATE:Got 32M nowDon't know how, it just surrender and decided to give me what I want.Before:NowAll I did - removed original Dallas DS1230AB NVRAM, soldered DIP socket on PCB.Put blank DS1245AB with VCC pin 32 shorted to pin 30 (i had DS1245AB from Keithley 2001, it's 1024k 32-pin, while DS1230 is 256k 28pin)Assemble module back, put back into TLA714 frame - booted, run Powerflex - reports 32M right away.Too easy!P.S. I guess that's same Murphy law which striked Dave's DSA repair project from recent episode. Thanks Dave!

author: nctnico
author_rank: Super Contributor
timestamp: September 23, 2013, 04:34:03 pm
content: Thats weird and interesting. Where did you get that upgrade key code? Maybe the Powerflex tool just did the upgrade regardless of the wrong module serial number.

author: TiN
author_rank: Super Contributor
timestamp: September 23, 2013, 05:33:26 pm
content: No, it did not.I just googled TLA7AA4, and after few pages found photo of ES-optioned module.Key is usually just printed on module sticker. It does not work if module ID does not match key, which is clearly shown on error message.I tried again put back stock DS1230AB, erased it first on programmer - and guess what, module got 2M again.Put back DS1245AB - 32M right away, without any other operations/enabling. Is there way to detect DS1245 SRAM? I remember myKeithley 2001 did same, MEM1 or MEM2 options were directly depends of what SRAM chip installed. But on Keithley there is 32pin DIP socket,which allows either 28-pin DS1230 or 32-pin DS1245 to be installed. Here - only 28 pin physically, pins 1,2,31 are not connected (32 shorted to 30, to provide VCC)."modified" DS1245Y and socketed TLA7AA4 board = 32M DepthOr:Original DS1230 in socket = 2M DepthAnd yes, calibration data was lost when i changed NVRAMs. But since module can recalibrate by user menu - not a problem at all.Here are also my aquisition board very hi-res photos from both sides. in case someone need it.Top side, 33MB, 10233x6331 pixelsBottom side, 34MB, 10156x6352 pixelsEnjoy.

author: leafi
author_rank: Regular Contributor
timestamp: September 23, 2013, 06:17:21 pm
content: I wish someone would do this for a TDS7404, I wont pay 10K for a memory unlock code.

author: nctnico
author_rank: Super Contributor
timestamp: September 23, 2013, 06:39:09 pm
content: IMHO you stumbled upon a bug in the board's firmware. AFAIK the ID of the NVRAMs can be read by a special sequence just like parallel flash memory. Perhaps it jumps into some kind of calibration mode when the wrong NVRAM is installed. You already noticed that a blank (original) NVRAM doesn't do anything to the available options which is consistent with my own findings.My approach would still be to run the Powerflex utility in a debugger and see whether it sends the upgrade key to the board or the Powerflex utility checks whether the key is right and reconfigures the board. If the latter is the case it shouldn't be hard to bypass the check.

author: TiN
author_rank: Super Contributor
timestamp: September 23, 2013, 11:35:25 pm
content: QuoteEven if so, i would not complain.I'm not really a software guy to mess weeks and weeks with debugger

author: mamalala
author_rank: Unknown
timestamp: September 23, 2013, 11:54:31 pm
content: Quote from: TiN on September 23, 2013, 05:33:26 pmHow did you produce these images? They are fantastic! Hi-Res and sharp.Did you stitch them together from multiple images? First i would have thought it is just a scan (as in: on a scanner), but some connectors out of focus tell me that this is not the case (i think)...Greetings,Chris

author: TiN
author_rank: Super Contributor
timestamp: September 24, 2013, 12:34:59 am
content: Three shots with macro lens (150mm @ f/14) per each side with 10-20% overlap, then align and stitch them manually in photoshop (5 minutes to do.You can see gaps if you watch really closely

author: Carrington
author_rank: Super Contributor
timestamp: September 24, 2013, 12:36:16 am
content: Perhaps you used a Nikon D800.Cheers.

author: TiN
author_rank: Super Contributor
timestamp: September 24, 2013, 12:41:47 am
content: Right. Cannot resist of nice high-res hardware beauty.Now I only wish to get hands on one of those TLA7BBx modules to play with, would be sick to have newer modules working in ancient frame like TLA714.

author: TiN
author_rank: Super Contributor
timestamp: October 16, 2013, 07:19:45 pm
content: Got Nexus DDR3 interposer for TLALinked TLA714 with CSA7404 by iView (used regular NI GPIB-USB-HS and BNC cables for trigger in/out and reference)Works cool, but my TLA7AA4 is too slowNeed 7BB4, but cannot afford itDDR3-1067MHz :

author: jgorsk
author_rank: Regular Contributor
timestamp: November 03, 2013, 07:22:13 pm
content: HiI tried to do the same trick to my old TLA7N3 module. I replaced the DS1225 memory with a brand new DS1245.I lost all the installed options after that so I installed the original memory again and the options were back.Now I wonder if every TLA7AA module can be hacked this way.

author: jgorsk
author_rank: Regular Contributor
timestamp: November 23, 2013, 07:53:01 pm
content: TiN, what's the firmware revision of your TLA7AA4 module?

author: TiN
author_rank: Super Contributor
timestamp: November 24, 2013, 03:56:19 am
content: I had updated 7AA4 to 5.8.001 a while ago (As TLA Ver 5.1 is running in server mode on mainframe itself).Using it so far with remote TLA Application Ver 6.1.Later I have plans to source another TLA7AA4 and try more unlocking, maybe AS or DS variant, when get some extra budget for hobby projects

author: jgorsk
author_rank: Regular Contributor
timestamp: November 24, 2013, 12:11:17 pm
content: I just boght a TLA7AA4-CS module. It has 5.0.002 firmware. I'm going to replace the Dallas chip on it tomorrow.Do you remember what the firmware revision of your module was at the time you hacked it?

author: TiN
author_rank: Super Contributor
timestamp: November 24, 2013, 12:47:03 pm
content: Same version as my previous post, i updated it long ago from 4.4.

author: jgorsk
author_rank: Regular Contributor
timestamp: November 24, 2013, 09:19:36 pm
content: Did you have any problems getting TLA server v5.1 to work with TLA clientapplication v6.1?I can get client - server configuration to work only if they are both v5.1

author: TiN
author_rank: Super Contributor
timestamp: November 25, 2013, 05:01:52 am
content: No, I had no issues, just had all stuff installed on v5.1 first, then just deinstall and install new 5.8 on remote PC, then did same thing with 6.0 and 6.1.I remember there were issues with 6.x on one of my HDDs, but on another its working fine. Make sure you have NI VISA installed as well (I used it for LabView, but found that some librariesare being used by Tektronix software as well).

author: jgorsk
author_rank: Regular Contributor
timestamp: November 25, 2013, 10:44:07 am
content: Thanks for the tip about NI VISA, I only have Tek VISA installed. I thought there were conflicts between Tek software and NI VISA. I'll try it.

author: jgorsk
author_rank: Regular Contributor
timestamp: November 27, 2013, 03:18:40 pm
content: I installed NI Visa drivers on the client computer. Now I can connect to the server but the client aplicationisn't detecting any modules. Did you install NI Visa on the Tek frame as well?That's so much for bad news. Good news is that my TLA7AA4-CS is now full option 32M.Thank you very much TiN.

author: TiN
author_rank: Super Contributor
timestamp: November 27, 2013, 03:55:17 pm
content: No, I did not mess much with mainframe software.But had issues with modules not detected by ver6 client on remote machine. That's why I rolled back to v5.8 and used it for a year or so. Only recently I tried ver6 and 6.1 as v5.8 had some crashing problems with Nexus DDR3 support module, and it worked well, detecting module anddoing all stuff. Maybe just play around with various versions and see if anything changes.So dallas NVRAM replacement to 1245 did magic to you too? What's is your module FW version?I notice also that all TLA apps have memory management issues on my Win2008R2 64bit. If i used more than 8-10GB of memory on remote machine, and try run TLA app - it gives "not enough memory" error and refuse to work. Probably some addressing or resource allocation in TLA app was not done quite right, as i have lots of free memory still available (64GB total RAM)

author: jgorsk
author_rank: Regular Contributor
timestamp: November 27, 2013, 04:36:52 pm
content: My module's firmware is 5.0. I used DS1245AB-100+I tried to modify TLA7N3 module before and that didn't work.I tied A15 to VCC then, I'm not sure about A16. This time I leftthem both floating. I'm not sure if that matters. In theoryfloating address pins may be giving problems but I don't thinkI'll test this hack with A15/16 inputs of the DS1245 pulled upor down uless it stops working properly.I'm not using any Tek Apps but I'm going to write my ownplugins using TPI.Net when I get some time.Thanks again.

author: KK
author_rank: Regular Contributor
timestamp: June 26, 2014, 07:40:47 pm
content: I can confirm the hack works. Modified two TLA7AA4cs modules that now have full memory support.Used a DS1245AB-100Tied a15 and a16 high. Desoldering, soldering a socket and installing chip was simple and quick.Modules work great.Using TLA5.8 on remote Windoze 7 machine and 5.1 locally on the TLA714.

author: dxl
author_rank: Regular Contributor
timestamp: June 28, 2014, 01:32:40 pm
content: I dissassembled the Firmware in 2009 to upgrade the Module. You can use the NI VISA Talk/Listen Utility for this. It's been a while, but i think the procedure was:Enable Special Upgrade Mode (Get Firmware Version from IDN query)Code:SYST:PASS:INST:PASS Pitbull<FirmwareVersion>Set ParametersCode:SYST:CONF:MAX:DEPTH <Bytes>SYST:CONF:SPEED <Speed>Save Parameters:Code:SYST:PASS:INST:UPD <UnixTimeStamp>This worked on TLA7AA4 and TLA7N4 at least.Have fun

author: nctnico
author_rank: Super Contributor
timestamp: June 28, 2014, 06:47:59 pm
content: What do you fill in for the Unix timestamp?

author: dxl
author_rank: Regular Contributor
timestamp: June 28, 2014, 07:34:47 pm
content: It think it was the standard unix time stamp which means the current time in seconds since 1/1/1970.

author: KK
author_rank: Regular Contributor
timestamp: June 28, 2014, 08:59:10 pm
content: Quote from: dxl on June 28, 2014, 01:32:40 pmInteresting! I'll give this a go on my TLA7N4 and report back.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 04:50:03 am
content: Sending those commands are not working at all. I am researching the TLA command structure, but I've tried multiple variations of the listed commands and they are not working.Will look further into this tomorrow. It is likely a minor syntax issue.SYST:PASS:INST:PASS Pitbull 5.8.0016/28/2014 9:53 PM 42.233 0.0001s VXI1::2::INSTR Error - The specified operation or request timed out Error-Read6/28/2014 9:44 PM 21.457 0.0001s WDTC-LAB SYST:CONF:MAX:DEPTH?Write6/28/2014 9:44 PM 21.469 0.0001s VXI1::2::INSTR Error - The specified operation or request timed out Error-Read

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:53:49 am
content: Those are not Queries, you need to just write them to the unit with NI-VISA. There are different buttons in VISA: Write, Read, Query. I think there should also be no space between the "pitbull" password and the firmware version number. It's just one string concatenated as password.

author: nctnico
author_rank: Super Contributor
timestamp: June 29, 2014, 09:13:34 am
content: Maybe put the password between ""?

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 04:17:50 pm
content: Quote from: dxl on June 29, 2014, 06:53:49 amI tried them as writes also and no space between pitbull and firmware version. But just to be clear, are you saying each of these lines should be performed as individual write commands and no status is ever read at the end or return results from any of the lines. Just all lines as blind writes then at the end close the VISA and check with powerflex if the options have been enabled? What about the "Set Parameters" and "Code: " lines are those also supposed to be issued as writes or are those return results?I will try them all as writes and see what happens, but I thought I did that and got an error returned at some point.SYST:PASS:INST:PASS Pitbull<FirmwareVersion>Set ParametersCode: SYST:CONF:MAX:DEPTH <Bytes>SYST:CONF:SPEED <Speed>Save Parameters:Code: SYST:PASS:INST:UPD <UnixTimeStamp>

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:22:17 pm
content: Attempted it verbatim to the posted instructions. Issued "blind" writes, but at the end checked with poweflex and no options installed.The TLA7N4 goes as high as 4M memory and 200Mhz. I used 4096 for memory depth and 200 for speed. I will try so other numbers like 4M to see if that works.First attempt log-6/29/2014 9:56 AM 02.118 0.0086s TCPIP::192.168.0.144::vxi0,2::INSTR TEKTRONIX,TLA7N4,B011582,SCPI:94.0 FVER:5.5.001 Read6/29/2014 9:56 AM 38.294 0.0083s WIN-330I86GF26R SYST:PASS:INST:PASS Pitbull5.5.001 Write6/29/2014 9:56 AM 49.822 0.0083s WIN-330I86GF26R Set Parameters Write6/29/2014 9:57 AM 01.070 0.0083s WIN-330I86GF26R Code:  Write6/29/2014 9:58 AM 38.787 0.0081s WIN-330I86GF26R SYST:CONF:MAX:DEPTH 4194304 Write6/29/2014 9:59 AM 12.170 0.0079s WIN-330I86GF26R SYST:CONF:SPEED 200 Write6/29/2014 9:59 AM 26.366 0.0086s WIN-330I86GF26R Save Parameters: Write6/29/2014 9:59 AM 36.631 0.0078s WIN-330I86GF26R Code:  Write6/29/2014 10:01 AM 47.904 0.0085s WIN-330I86GF26R SYST:PASS:INST:UPD 1404025200 Write

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:27:26 pm
content: Powerflex shows the following options that are valid for this TLA7N4 Module-Serial number/ID info is redacted as not relevant.############################################################################################################################################## TLA PowerFlex Upgrade Information File## This file contains information needed when ordering a TLA PowerFlex# upgrade kit. Contact your local Tektronix representative for pricing# and ordering information. When ordering an upgrade, include a hard# copy of this file with your order.## June 29, 2014#############################################################################################################################################Current Configuration:Product Type: TLA7N4Serial Number: XXXUnique ID: XXXMemory Depth: 64KState Speed: 100 MHzExtension: NATiming Speed: 2 GHz / 250 MHzChannels: 136PowerFlex Software Version: 5.6.754.0TLA Software Version: 5.6.754.0Module Firmware Version: 5.5.001Upgrade Option Selected:- No Upgrade Selected -Possible Upgrades:Upgrade Kit & Option Memory Depth State Speed ExtensionTLA7F14 Opt 01 256K 100 MHzTLA7F14 Opt 02 1M 100 MHzTLA7F14 Opt 03 4M 100 MHzTLA7F14 Opt 04 64K 200 MHzTLA7F14 Opt 05 256K 200 MHzTLA7F14 Opt 06 1M 200 MHzTLA7F14 Opt 07 4M 200 MHz

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:32:40 pm
content: OK, these commands give status that makes sense-6/29/2014 10:29 AM 45.238 0.0084s WIN-330I86GF26R SYST:CONF:SPEED?Write6/29/2014 10:29 AM 45.270 0.0162s TCPIP::192.168.0.144::vxi0,2::INSTR 100 Read6/29/2014 10:30 AM 55.937 0.0104s WIN-330I86GF26R SYST:CONF:MAX:DEPTH?Write6/29/2014 10:30 AM 55.952 0.0118s TCPIP::192.168.0.144::vxi0,2::INSTR 4194304 ReadLooks like memory is showing 4MB. Maybe the modules need to be power cycled and rebooted to show new options. I'll give that a go. Speed is still stuck at 100mhz state though. Will issue the speed command again.

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:38:54 pm
content: What does a "SYST:ERR?" Query show after the Password command?

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:44:27 pm
content: Hmm. Something has happened now.After going through the commands a second time, without power cycling yet, Powerflex only show the module and serial number with all other fields blank, and text at the bottom of the window saying- "Update complete successfully."So Tek uses Chinglish tooI'm starting up the TLA Application now to see what it says about memory depth-No, still shows a max of 64K. I'll reboot the TLA and see what happens.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:46:13 pm
content: Quote from: dxl on June 29, 2014, 05:38:54 pm6/29/2014 10:45 AM 40.336 0.0201s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:48:36 pm
content: If I try it another way and put the Pitbull5.5.001 in quotes I get this error after a SYST:ERR? query. It doesn't appear to want quotes.6/29/2014 10:47 AM 21.830 0.0199s TCPIP::192.168.0.144::vxi0,2::INSTR -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n" Read

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 05:59:14 pm
content: I've tried the SYST:PASS:INST:PASS several ways now. It is definitely a recognized command, but it is rejecting the password.6/29/2014 10:45 AM 24.767 0.0130s WIN-330I86GF26R SYST:PASS:INST:PASS Pitbull5.5.001Write6/29/2014 10:45 AM 40.304 0.0084s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:45 AM 40.336 0.0201s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read6/29/2014 10:47 AM 05.482 0.0084s WIN-330I86GF26R SYST:PASS:INST:PASS "Pitbull5.5.001"Write6/29/2014 10:47 AM 21.799 0.0080s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:47 AM 21.830 0.0199s TCPIP::192.168.0.144::vxi0,2::INSTR -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n" Read6/29/2014 10:50 AM 52.348 0.0078s WIN-330I86GF26R SYST:PASS:INST:PASS Pitbull5.5.001Write6/29/2014 10:50 AM 55.188 0.0078s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:50 AM 55.203 0.0133s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read6/29/2014 10:51 AM 10.522 0.0085s WIN-330I86GF26R SYST:PASS:INST:PASS pitbull5.5.001Write6/29/2014 10:51 AM 13.455 0.0076s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:51 AM 13.471 0.0212s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS p" Read6/29/2014 10:51 AM 58.445 0.0081s WIN-330I86GF26R SYST:PASS Pitbull5.5.001Write6/29/2014 10:52 AM 00.972 0.0082s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:52 AM 01.004 0.0127s TCPIP::192.168.0.144::vxi0,2::INSTR -113,"Undefined header; Command not found; SYST:PASS " Read6/29/2014 10:52 AM 16.338 0.0082s WIN-330I86GF26R SYST:PASS:INST:PASSWrite6/29/2014 10:52 AM 19.786 0.0077s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:52 AM 19.801 0.0204s TCPIP::192.168.0.144::vxi0,2::INSTR -109,"Missing parameter; Unexpected termination detected; SYST:PASS:INST:PASS\n" Read6/29/2014 10:53 AM 32.637 0.0109s WIN-330I86GF26R SYST:PASS:INST:PASS Pitbull<5.5.001>Write6/29/2014 10:53 AM 35.274 0.0079s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:53 AM 35.305 0.0226s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read6/29/2014 10:54 AM 00.218 0.0078s WIN-330I86GF26R SYST:PASS:INST:PASSPitbull5.5.001Write6/29/2014 10:54 AM 02.854 0.0081s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:54 AM 02.870 0.0188s TCPIP::192.168.0.144::vxi0,2::INSTR -110,"Command header error; Illegal character in header; SYST:PASS:INST:PASSPitbull5." Read6/29/2014 10:54 AM 24.943 0.0118s WIN-330I86GF26R SYST:PASS:INST:PASS [Pitbull5.5.001]Write6/29/2014 10:54 AM 27.689 0.0080s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:54 AM 27.720 0.0144s TCPIP::192.168.0.144::vxi0,2::INSTR -101,"Invalid character; Unexpected character found; SYST:PASS:INST:PASS [" Read6/29/2014 10:55 AM 06.065 0.0089s WIN-330I86GF26R SYST:PASS:INST:PASS PitbullWrite6/29/2014 10:55 AM 08.264 0.0085s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:55 AM 08.295 0.0182s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read6/29/2014 10:55 AM 34.737 0.0101s WIN-330I86GF26R SYST:PASS:INST:PASS Pitbull55001Write6/29/2014 10:55 AM 37.405 0.0080s WIN-330I86GF26R SYST:ERR?Write6/29/2014 10:55 AM 37.436 0.0252s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:03:15 pm
content: My TLA7AA4 wants "PitBull" with upper case "B". Can you check whether that works?

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:04:03 pm
content: Power cycling the instrument and using Powerflex shows no options installed and the fields are all populated again showing 64K memory depth and 100mhz state.Not surprising, since it appears the password line isn't working yet. Hopefully we can figure out what it wants.

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:05:10 pm
content: Did you try "PitBull5.5.001"?

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:07:19 pm
content: Quote from: dxl on June 29, 2014, 06:03:15 pmI'm doing this on a TLA7N4. But, i also have a TLA7AA4 that I can try it on (of course it has already been "upgraded" with a new flash).I used "PitBull" with the TLA7N4, still no go-6/29/2014 11:05 AM 08.499 0.0305s WIN-330I86GF26R SYST:PASS:INST:PASS PitBull5.5.001Write6/29/2014 11:05 AM 17.438 0.0108s WIN-330I86GF26R SYST:ERR?Write6/29/2014 11:05 AM 17.469 0.0265s TCPIP::192.168.0.144::vxi0,2::INSTR -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P" Read

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:28:59 pm
content: Quote from: dxl on June 29, 2014, 06:05:10 pmDidn't work on the 7N4 as posted above. Will check my 7AA4 shortly.Did you ever get it to work with a 7N4 or just the the 7AA4?When you disassembled the firmware, did you disassemble the firmware file distributed by tektronix or did you have to pull it out of the module itself. Was the PitBull password plain text in the firmware?

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:34:29 pm
content: Data type error; Unrecognized string data - i think youre missing the quotes around the password.

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:34:53 pm
content: What does *IDN? tell you?

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:50:32 pm
content: Quote from: dxl on June 29, 2014, 06:34:29 pmOK I'll try it with quotes. Just waiting for a reboot.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 06:54:42 pm
content: Tried the 7AA4 with quotes and now no error! (Without quotes was error on the 7AA4). So good.Now the 7N4-

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:19:23 pm
content: The 7N4 is locked up. Going to have to pull it out and reseat it. Be a few more minutes to see if the password works.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:36:06 pm
content: OK!That works on the TLA7N4.So the correct line is-SYST:PASS:INST:PASS "PitBull5.5.001"I had tried quotes before, but without the capital B.Now on to the other commands.

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:37:10 pm
content: Nice.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:42:23 pm
content: Quote from: dxl on June 29, 2014, 07:37:10 pmOK!!!!Speed has been upgraded to 200mhz. But, not memory depth.I wonder if that is the right command for setting the memory depth, because SYST:CONF:MAX:DEPTH? query returns the 4MB but in Powerflex the maximum memory depth is 64K and can be upgraded to 4MB.Even before any modifications SYST:CONF:MAX:DEPTH? query returns 4194304 bytes

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:48:10 pm
content: I think I found it.Testing now.The correct command is:SYST:CONF:DEPTH 4194304Checking it now...

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:55:01 pm
content: THAT'S IT!!!!!Thanks for your help!!!TLA7N4 upgraded to 200mhz and 4M depth

author: dxl
author_rank: Regular Contributor
timestamp: June 29, 2014, 07:59:12 pm
content: Glad to hear that this finally worked. Sorry for all the trouble with the exact commands - it's been a while since i did that on my LA.

author: KK
author_rank: Regular Contributor
timestamp: June 29, 2014, 09:01:45 pm
content: Quote from: dxl on June 29, 2014, 07:59:12 pmThanks again!I'm sure a few others will be happy too. Having 4mb of depth instead of 64k is quite the improvementI will write it up concisely on one page a little later.

author: nctnico
author_rank: Super Contributor
timestamp: June 29, 2014, 09:22:30 pm
content: I guess it is a bad day for Tektronix. Some of these upgrades make a US $50000 difference in price

author: KK
author_rank: Regular Contributor
timestamp: June 30, 2014, 03:04:29 am
content: Thank eevblog.com user "dxl" for all of this. Good on him! Thank Dave too for making this a fun, friendly, place to meet and share knowledge. Good on you Dave!This procedure was tested with Tektronix TLA Software versions 5.1, 5.6, and 5.8 on a TLA714.Modules tested were the TLA7N4 and partially the TLA7AA4 but it is expected that module will work OK with this software hack saving the effort of having to do the hardware hack. No additional software is necessary other than what is default installed by the Tektronix TLA Application software.Please submit any errata and I will update this post to maintain the most recent and correct procedure.Thanks to "TiN" and "nctnico" for all their input in this thread. Good on you guys as well.I have done this procedure, and the instrument was powered down for several hours and still retains the upgrades so it is permanent.Follow these steps exactly to reproduce my success:1) Starup the TLA instrument and then connect to it locally or remotely.2) Launch the TLA Application (this is important on remote connects only) and let it connect to your remote TLA.3) Use Start menu on Windoze and goto TekVISA folder and select "OpenChoice Talker Listener". If you are doing this remotely, IT IS IMPORTANT you quit the TLA Application once the Openchoice Talker Listener shows your remote modules.4) Under the upper-leftside pane "Instruments" you will see your various modules listed.5) Select the module you want to upgrade, if not sure of the slot number just pick one for now.6) On the upper right side you will see an entry field titled "Enter Command or Script" referred from now on as COMMAND.7) Enter in the COMMAND field *IDN?8. Click the "Query" button below the field and note the output in the lowest frame titled "Talker Listener Readout" referred from now on as OUTPUT.9) Look for the firmware version in OUTPUT and make a verbatim note of it referred to from now on as <VERSION>. Also verify it is the module you want to update, if not, repeat step 5 above and pick the correct one.10) You now know which module to update and what the firmware version is. You are ready to begin the upgrade.11) Now you will want to figure out what the Max upgrade you can make. Either you know it already, or you will want to see what maximum your module supports. This document focuses on two things, maximum State acquisition speed, and maximum memory depth.12) To determine your maximum State speed in Mhz issue this COMMAND then click "Query" and make note of it as <SPEED>:SYST:CONF:MAX:SPEED?13) To determine your maximum Memory depth in bytes issue this COMMAND then click "Query" and make note of it as <DEPTH>:SYST:CONF:MAX:DEPTH?14) Timestamp is required. For 6/29/2014 you can use 1404025200, if not create a new unix timestamp. Refer to it as <TIME>. Using the exact time may not be important.15) Make sure the correct module is selected under "Instruments" and enter the following commands into the COMMAND field. After each line, press the Write button under the COMMAND field. An Example of all commands will be shown after all the lines. Note: do not include the < > just the value. Use quotation marks when shown. Commands are case sensitive.SYST:PASS:INST:PASS "PitBull<VERSION>"Set ParametersCode: SYST:CONF:DEPTH <DEPTH>SYST:CONF:SPEED <SPEED>Save Parameters:Code: SYST:PASS:INST:UPD <TIME>WORKING EXAMPLE-SYST:PASS:INST:PASS "PitBull5.5.001"Set ParametersCode: SYST:CONF:DEPTH 4194304SYST:CONF:SPEED 200Save Parameters:Code: SYST:PASS:INST:UPD 140402520016) After commands are entered, you can exit OpenChoice Talker Listener and run the TLA Application and note your new upgrades

author: TiN
author_rank: Super Contributor
timestamp: June 30, 2014, 04:47:38 am
content: Cool, thumbs up fordxl.QuoteI'll have article as well on my site, will test this trick with my TLA714 and 7AA4 on weekend.

author: bench_knob
author_rank: Regular Contributor
timestamp: February 13, 2015, 06:09:52 pm
content: Quote from: KK on June 30, 2014, 01:04:29 PM>QuoteSYST:CONF:DEPTH <DEPTH>SYST:CONF:SPEED <SPEED>Save Parameters:Code: SYST:PASS:INST:UPD <TIME>Working Example - (use your values instead, ie..fw, speed, & depth), click 'Write' after each lineSYST:PASS:INST:PASS "PitBull5.5.001"Set ParametersCode: SYST:CONF:DEPTH 4194304SYST:CONF:SPEED 200Save Parameters:Code: SYST:PASS:INST:UPD 140402520016) After commands are entered, you can exit OpenChoice Talker Listener and run the TLA Application, System Properties, Modules and note your new upgradesdxl & kk,I ran the above commands and sure enough, my TLA7AA4 morphed from a CS to an ES in the blink of a few writes!ThanksJust as an FYI...my system is a TLA704 hacked to run Win2k Pro, TLA App 5.1. I used kk's provided 'time-stamp' value.)bench_knob

author: Sailor
author_rank: Regular Contributor
timestamp: February 16, 2015, 11:54:37 am
content: @ bench_knob, KK, dxl, et al,I'll give this a go on my TLA7AA s this weekend. One of them has max speed, but small depth, the other has max depth, low speed. However, I haveonetwo question(s) about the procedure; where you haveSet ParametersCode: andSave ParametersCode: what is the  parameter? Is it a drop-down box with pre-defined values, or ...When you entered 1404025200 as the timestamp, did you have the true (e.g. today's) date set on the TLA, or had you changed the TLA Windows date to, or near to, 6/29/2014?Thanks,Sailor

author: Mark_O
author_rank: Frequent Contributor
timestamp: February 16, 2015, 02:31:48 pm
content: Quote from: bench_knob on February 13, 2015, 06:09:52 pmYeah, I have this thread marked for when I can find some free time to do the same with one of my TLA704's (I have two). I wasn't even aware it was possible to use the 7AA4 modules with it, before I read it here.Very good stuff, and thanks to all.

author: gslick
author_rank: Frequent Contributor
timestamp: February 18, 2015, 07:07:03 am
content: As far as I can tell these lines in the lists of commands to sent to the analyzer module were originally intended to be comments on what the following commands were doing and are not actually intended to be sent as commands to the analyzer module:Set ParametersCode: Save Parameters:Code: So the literal list of example commands to be sent to the analyzer module would be reduced to the following, where the firmware version in the password string, the sample depth, and the speed would have to match the analyzer module as appropriate:SYST:PASS:INST:PASS "PitBull5.5.001"SYST:CONF:DEPTH 4194304SYST:CONF:SPEED 200SYST:PASS:INST:UPD 1404025200I had success in getting these commands to work with a TLA7N4 analyzer module, but the settings did not persist across a power cycle. I believe this might be due to a dead battery in the DS1225AD NV-SRAM in the TLA7N4. I will have to try replacing the DS1225AD NV-SRAM and see if the settings then persist across a power cycle.One other note, I wasn't able to figure out how to get TekVISA installed on my TLA714 running Windows 2000 SP4 and V4.4 of the analyzer application so I could send the commands to the TAL7N4 module from the TAL714 analyzer mainframe. Instead I installed the TLA7N4 analyzer module in another VXI mainframe with an NI VXI-1394 controller and installed NI-VXI 3.5.2 software on a Window XP system with a 1394 controller connected to the VXI-1394 controller. Then I used the NI-VXI 3.5.2 software to send the commands to the TLA7N4 analyzer module through the VXI-1394 controller. I wasn't sure if I would be able to get that configuration to work together but gave it a try and got it working.

author: Sailor
author_rank: Regular Contributor
timestamp: February 18, 2015, 11:11:58 am
content: Quote from: gslick on February 18, 2015, 07:07:03 amUmmmSo, no selection list, ...?QuoteCongratulations, It sounds like an interesting journey

author: gslick
author_rank: Frequent Contributor
timestamp: February 18, 2015, 08:58:35 pm
content: Quote from: Sailor on February 18, 2015, 11:11:58 amCorrect. That text is just commenting on what the commands are doing are not actual commands to be sent to the analyzer module.Here are the actual commands that I used to update a TLA7N4 with Option 3S (100MHz State, 4M Depth) to Option 7S (200MHz State, 4M Depth). Unlike the first TLA7N4 module I tried this one appears to have a working NV-SRAM chip and the option update persists across power cycles.(write) and (read) are not included the command and response text sent to and from the analyzer module. I used a unix timestamp of 1424217600 corresponding to 02/18/2015 @ 12:00am (UTC). I don't know if that timestamp is used for anything anywhere.(write) *IDN?(read) TEKTRONIX,TLA7N4,B012xxx,SCPI:94.0 FVER:4.3.14(write) SYST:CONF:MAX:SPEED?(read) 200(write) SYST:CONF:MAX:DEPTH?(read) 4194304(write) SYST:CONF:SPEED?(read) 100(write) SYST:CONF:DEPTH?(read) 4194304(write) SYST:PASS:INST:PASS "PitBull4.3.14"(write) SYST:CONF:DEPTH 4194304(write) SYST:CONF:SPEED 200(write) SYST:PASS:INST:UPD 1424217600(write) SYST:CONF:SPEED?(read) 200(write) SYST:CONF:DEPTH?(read) 4194304Before and after analyzer properties shown in attached images.

author: Sailor
author_rank: Regular Contributor
timestamp: February 18, 2015, 11:14:51 pm
content: Thanks gslick, I look forward to trying it.Sailor

author: gslick
author_rank: Frequent Contributor
timestamp: February 19, 2015, 04:01:28 am
content: For completeness, this also appears to work the same way with TLA7Lx and TLA7Mx analyzer modules, with the exception that with firmware version 3.2.1 that password is in all uppercase, i.e. "PITBULL3.2.1". And of course the maximum sample depth value choices are smaller.Here are the actual commands that I used to update a TLA7M3 from 100MHz State to 200MHz State.(write) and (read) are not included the command and response text sent to and from the analyzer module. The unix timestamp of 1424217600 corresponds to 02/18/2015 @ 12:00am (UTC).(write) *IDN?(read) TEKTRONIX,TLA7M3,B010xxx,SCPI:94.0 FVER:3.2.1(write) SYST:CONF:MAX:SPEED?(read) 200(write) SYST:CONF:MAX:DEPTH?(read) 524288(write) SYST:CONF:SPEED?(read) 100(write) SYST:CONF:DEPTH?(read) 524288(write) SYST:PASS:INST:PASS "PITBULL3.2.1"(write) SYST:CONF:DEPTH 524288(write) SYST:CONF:SPEED 200(write) SYST:PASS:INST:UPD 1424217600(write) SYST:CONF:SPEED?(read) 200(write) SYST:CONF:DEPTH?(read) 524288Before and after analyzer properties shown in attached images.

author: bench_knob
author_rank: Regular Contributor
timestamp: February 19, 2015, 10:13:08 am
content: Quote from: Sailor on February 16, 2015, 10:54:37 PMQuote>QuoteHi Sailor,Hi there GSlick,I just copied the commands verbatim just as dxl & kk worked things out. The process did not error out. My TLA7AA4 CS upgraded to ES and the modules remember their settings through power-cycles. In other words, I copied and entered the lines exactly; its true, intuitively one considers that there is some type of 'list' expected, but no, just enter the commands verbatim and click the WRITE button.Set Parameters<click WRITE>Code: <click WRITE>andSave Parameters<click WRITE>Code: <click WRITE>Re; the 'time-stamp' data, yes, I just used kk's value, and no, I did not change the analyzer's CMOS time or the OS time. I looked around for a way to generate a 'current' Unix Time-Stamp, but couldn't figure it out, so I just tried kk's TIME-STAMP value and it worked just fine.Let us know how things go...Cheers,bench_knob

author: bench_knob
author_rank: Regular Contributor
timestamp: February 19, 2015, 10:36:05 am
content: Quote from: Mark_O on February 17, 2015, 01:31:48 AM>Quote from: bench_knob on February 14, 2015, 05:09:52 AMQuoteYeah, I have this thread marked for when I can find some free time to do the same with one of my TLA704's (I have two). I wasn't even aware it was possible to use the 7AA4 modules with it, before I read it here.Very good stuff, and thanks to all.Hi MarkO,The TLA704 hack takes a bit of work, and there is no direct pre-worked-out strategy for some of it. One area is the LCD issue. To run Win2k requires a memory upgrade BIOS flash operation (one TLA-704 motherboard bricked and two others worked just fine), in addition to that, there is an additional BIOS hot-patch hack required (ROM image provided by Mr. Green) to be able to run the LCD at the minimum of 800x600 resolution required by Win2k. An external monitor can be used, but frankly doing so takes lot of bench space. The native TLA704 LCD only runs 640x480 so it must be replaced with something. I very luckily found a new 10" NEC LCD, that was mechanically a virtual a drop-in replacement (only had to cut out a slot), and I had to fabricate a new interface PCB (Eagle 5.5) and find connectors for it, all were available only as SMDs. As I did not have any reliable strategy for cooking SMD parts, I hacked together an SMD oven (that's a whole 'nother story, one that I'll share should anyone care to hear it? I have complete plans that work well, uses a PIC uControler.)For me, upgrading my TLA704 was a multi-year adventure. Although I do have all the linkages, it'll still require some cutting, hacking, solder'n, copying, pasting...and sweating. But frankly it was very rewarding and it works great when run remotely via EtherNet!! I love it now and with the 32 Mb TLA7AA4, its hot!)bench_knob

author: TiN
author_rank: Super Contributor
timestamp: February 19, 2015, 04:26:59 pm
content: Wow, that's lot of pain to go thru.Would make up a great article about, how to get desire come trueI could host and provide storage for files endlessly for stuff like this

author: KK
author_rank: Regular Contributor
timestamp: February 19, 2015, 07:15:13 pm
content: Verbatim is correct. Use my listed steps verbatim and it will upgrade.Time on the instrument was close to the time stamp I generated but not exact. I don't think it's important as another user verified he used my same timestamp at a later date.Good luck!

author: Mark_O
author_rank: Frequent Contributor
timestamp: February 20, 2015, 02:28:14 am
content: Quote from: bench_knob on February 19, 2015, 10:36:05 amThanks, bench_knob! I'm not sure I have the time or energy for a multi-year adventure. But I do know there's much to be learned here.Most of my lab gear from my latest move isn't even unpacked yet, but I just noticed I had a couple TLA-7N3 modules unboxed, one 2S and one 6S, that I can upgrade to 7S versions (200 MHz, 4 MSa), using the techniques described here recently. That will certainly be worth doing.One thing I would definitely like to figure out is how to do the channel stacking I read was possible with these. I.e., let's say 136 channels width was overkill for me (it always has been, on my 7N4 module), and sometimes I could get along fine with only 17 channels wide. That collapses the width by 8x, and pushes the depth up by a corresponding factor, so 4M to 32M sample depth.I never was able to track that one down, but it would come in handy. I think it was described as a "software option", but I never found it.

author: nctnico
author_rank: Super Contributor
timestamp: February 20, 2015, 12:06:48 pm
content: AFAIK Tektronix calls it channel grouping. For the TLA7AA you can reduce the number of channels by 4 and get 2Gs/s with a 128M depth. But I don't recall being able to set lower sampling frequencies while grouping the channels.

author: Sailor
author_rank: Regular Contributor
timestamp: February 22, 2015, 09:57:36 am
content: First of all: - Thank you very much to everyone who has made this possibleThe short version:Last night I upgraded my TLA7AA2 from 120MHz state / 32M depth to 450MHz state / 32M depth. Today I upgraded my TLA7AA4 from 450MHz state / 8M depth to 450MHz state / 32M depth.Terrific, worked as advertised, what more can you want?Now the longer version:When upgrading the TLA7AA2 I did everything absolutely exactly as in KK's post. All upper-case where he had it, and I included those silly Set/Save Parameter and Code:  lines, etc. And, as I said, it all worked perfectly. But come this morning and those 'useless' lines were still annoying my subconcious, so I decided to have a quick look through the TLA7AAx firmware for any strings that looked like they might be associated. The bottom line is that there is a lot of stuff to look through, and I haven't yet made any connections, but in my perusals I noticed that there were virtually no all-upper-case symbols/table-entries etc. The password is there with its mixed case, but that was it. So I decided to try upgrading the second module with just lower-case command entries, and to also only enter the values that needed to be updated. In this case, the only change that needed to be made to the module was to increase the sample depth to 32M, so after establishing communication (remotely) using the Talker/Listener app, all I entered wassyst:pass:inst:pass "PitBull5.0.002"syst:conf:depth 33554432syst:pass:inst:upd 1404025200and that was it.So now I have 204 channels of nice high-speed capture. I hope I don't need it all to fix this $@#&*! Intel 8039 in my 3468AI think there's an option for Ida Pro to look at Wind River stuff (can anyone confirm?) It might be interesting to have a bit of a dig through the code. And, of course, I could have the TLA get all incestuous with itself and capture what the 68360 is doing...Ahhh...I just noticed an earlier post by dxlQuote@dxl - Did you use Ida, or some other 68000 dis-assembler? How far did you get into it?Sailor

author: gslick
author_rank: Frequent Contributor
timestamp: February 22, 2015, 07:23:06 pm
content: Quote from: Sailor on February 22, 2015, 09:57:36 amMost likely the only string that is case sensitive is the password string, "PITBULL" on the TLA7Lx and TLA7Mx and "PitBull" on the newer analyzer modules, and all command strings comparisons are case insensitive.If you dump the strings from the firmware the command text strings are all in mixed case, in the usual convention where the upper case part is the abbreviated version of the string and the lower case part is the remainder of the full length string, and text inside square brackets is an optional qualifier.I wonder how the channel qualifier would be used with depth and speed and not apply to all channels at the same time?:SYSTem:CONFig[:CHANnel]:DEPTh:SYSTem:CONFig[:CHANnel]:SPEedFor the curious attached is the command string text dumped from version 5.0.002 of the TLA7Axx firmware. (The TLA7Axx.lod firmware file is a Motorola S-record file which can be converted to binary and then searched for strings).It would be interesting to sniff the VXI bus and observe how these commands are used during the operation of the analyzer.

author: Sailor
author_rank: Regular Contributor
timestamp: February 22, 2015, 11:43:11 pm
content: Quote from: gslick on February 22, 2015, 07:23:06 pmYes, that is what I did, but your list is a lot cleaner than I recovered. What did you use to scan the binary? Is your list the raw output from the scan, or have you done some manual cleanup?It still nags me that it simply ignores set/save and code: commands. Considering that there is no apparent recognition of those strings (i.e. not in the command list), yet they are ignored so quietly while the slightest error in any other command can provoke anything from a warning message to a 'hang'. It makes me wonder if they never actually reach the module... which raises the question of who would be filtering them?All very low on the list of priorities, I know, but that's just how I'm wired

author: gslick
author_rank: Frequent Contributor
timestamp: February 23, 2015, 12:22:13 am
content: I just used a simple strings utility on the firmware binary. I was using a Windows PC at the time and this is the one I happened to use (which originally came fromwww.sysinternals.com).https://technet.microsoft.com/en-us/sysinternals/bb897439.aspxAs far as I could see all of the command string text was located in one contiguous table. I just manually selected and copied that text.After seeing some of the other text in the firmware I'm curious what you can do if you attach a serial connection to the analyzer module CPU board. Maybe you can't do anything useful other than learn more about how the analyzer module firmware works. I haven't tried to do any disassembly of the firmware myself yet.

author: rtekal
author_rank: Contributor
timestamp: September 11, 2017, 05:52:59 am
content: I have a TLA614 which I have been using for past 10 years. Last month it started failing the power on diagnostics with the NVRAM check fail. Have gone through the other replies. The question is If I replace the NVRAM IC DS1225AD-85, will the error be eleminated after self-calibration? How to backup the contents of the NVRAM?

author: jasonbrent
author_rank: Regular Contributor
timestamp: February 28, 2018, 05:32:45 pm
content: For posterity, this works on the 5000 series also.

author: avics
author_rank: Newbie
timestamp: May 09, 2022, 01:06:51 pm
content: Although this is an old topic, I've also succeeded to update a TLA 7AA4 module.I came across this on the Tek website:https://www.tek.com/en/support/software/utility/visacmd-command-line-utilityIt also allows scripting.J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=*IDN?TCPIP::192.168.178.194::vxi0,2::INSTR <- *IDN?TCPIP::192.168.178.194::vxi0,2::INSTR -> TEKTRONIX,TLA7AA4,B013745,SCPI:94.0 FVER:<VERSION>J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=SYST:CONF:MAX:SPEED?TCPIP::192.168.178.194::vxi0,2::INSTR <- SYST:CONF:MAX:SPEED?TCPIP::192.168.178.194::vxi0,2::INSTR -> 450J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=SYST:CONF:MAX:DEPTH?TCPIP::192.168.178.194::vxi0,2::INSTR <- SYST:CONF:MAX:DEPTH?TCPIP::192.168.178.194::vxi0,2::INSTR -> 33554432J:\IDA\TLA\visacmd>notepad update.batSYST:PASS:INST:PASS "PitBull<VERSION>"Set ParametersCode: SYST:CONF:DEPTH 33554432SYST:CONF:SPEED 450Save Parameters:Code: SYST:PASS:INST:UPD 1652097781J:\IDA\TLA\visacmd>visacmd /a=TCPIP::192.168.178.194::vxi0,2::INSTR /c=update.bat /lThis because for some reason The OpenChoice Talker Listener didn't go well for me.Needless to say change the<VERSION>with what comes out of the *IDN? command.

author: tori
author_rank: Newbie
timestamp: September 15, 2024, 10:51:40 am
content: Hi!This is very old thread but very usefulThanx to all involved...I bought the TLA5202 cheaply but without HDD (235MHz speed, 512k depth). I installed new HDD, recreated the software (WinXP (originally installed), module firmware upgrade (neccesary), TLA 6.1) and by chance came across this thread, where it was described how to implement the analyzer option upgrade.Connected locally - Tek visa shows that I have 3 instruments onboard (after *IDN?):TLA5202TLA7AB4TLA7BB4Firmware rev. after upgrade 5.7.001So I tried to make it standard way (passed on TLA5202 module only) ->syst:pass:inst:pass "PitBull5.7.001"syst:conf:depth 33554432syst:conf:speed 450syst:pass:inst:upd 1726396000Unfortunately - NO LUCK. I tried it many times. In different order, with different spellings, and so on... Communication would hang up, PowerFlex would stop seeing the module and hard reboots of the analyzer were necessary. I thought I might look in the firmware and find something - however, other than the "PitBull" password, I found nothing interesting. I also thought that PowerFlex is a program that helps install options, so I also started to look at this one in the hex editor. of course, I found there the password - PitBull, but also PITBULL, and what is very interesting right before the password PITBULL is placed the word FUJIHIKO.So I prepared a script in visa and changed the passwords one by one.2nd attemptsyst:pass:inst:pass "PITBULL5.7.001"syst:conf:depth 33554432syst:conf:speed 450syst:pass:inst:upd 1726396000Module hangs - restart requiredAfter restart nothing changes - speed 235MHz and 512k depth3rd attemptsyst:pass:inst:pass "FUJIHIKO5.7.001"syst:conf:depth 33554432syst:conf:speed 450syst:pass:inst:upd 1726396000Module hangs - restart requiredAfter restart changes are visible - speed 450MHz and 32M depthSo - it works. Thanks to the discussion I managed to upgrade my analyzer as well. Hope it will help another users. Of course it is possible that a PITBULL password will be OK in your case...tOriP.S. Next and last step will be memory upgrade to 1GB dual-channel (originally my device had 512MB - not enough for WinXP). I don't plan to make further upgrades