[time-nuts] HP 53131A - reset security code

Discussion:

Mod Mix

2014-12-23 23:04:34 UTC

Hi,

I got a used HP 53131A to which I added a stability option board (ocxo).
In order to calibrate the device, a security code is needed - I don't
know it. The seller doesn't know it. It's not the facorty set code.
Advice on how the reset the non-volatile memory would be much appreciated.

Thank you very much & happy Christmas

Ulli

From the 53131A service guide:
A calibration security code feature allows you to enter a security code
(electronic key) to prevent accidental or unauthorized calibrations of
the Counter. The security code is set to 53131 or 53132 (corresponding
to the model) when the Counter is shipped from the factory.
If you forget your security code, you can reset the security code to the
model-number default by resetting all of the non-volatile memory to a
default state (Contact Agilent Technologies for this confidential
procedure).
_______________________________________________
time-nuts mailing list -- time-***@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Tom Van Baak

2014-12-24 01:34:51 UTC

Permalink

Ulli,

You're right. The actual procedure is not described in the manual(s):

Operating Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90055.pdf

Programming Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90044.pdf

Assembly-Level Service Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90039.pdf

Component Level Information
http://literature.cdn.keysight.com/litweb/pdf/5989-6308EN.pdf

But I have three ides for you.

1) The last PDF shows U14 is AT28C64B (www.atmel.com/Images/doc0001h.pdf) so if all else fails, you can use a logic analyzer on the address(13) / data(8) pins and see what's in the EEPROM. With some experimentation by you or others on the list we can locate the calibration security. This has the advantage of getting the existing code, without having to clear the entire EEPROM. Some other HP bench instruments use an onboard jumper to override the cal lock, but I don't see that on a 53131A. So perhaps there is a magic front panel sequence or SCPI command to clear NVRAM.

2) Search for 53132 at http://www.ko4bb.com/manuals/index.php and grab the 4 EPROM's. Do a 16-bit merge of U8/U10 and U9/U11 and look for ascii strings. All the SCPI words are in there and not all are documented. For example near the words SYST and CODE and SEC[URITY] is ALL and DEL[ETE]. Probably safe to try. Lots of interesting output strings, both for GPIB and for internal debugging. Even the words EEPROM CLEAR, along with "Oooh! That tickles. I don't know that vector." which we also see in the Z3801A, etc.

There's also a hidden "SERVICE MENU", complete with Easter egg:
MLB TEAM KRISTI BITTNER, LEE COSART, ERIC INGMAN, GARY JACOBSEN, SOOK-LAN LOH, ROB MITCHELL, ROBIN POSKUS, DON SCHREMP, DANA STOFFERS, AND GEORGE TSAI
SOFTWARE L. COSART G. JACOBSEN S. LOH R. POSKUS D. STOFFERS
HARDWARE K. BITTNER E. INGMAN D. SCHREMP
MECHANICAL G. TSAI
PROJECT MGR R. MITCHELL
BASEHIT -- 53132

3) There's a pForth interpreter in this instrument too. Note pr_eeprom_debug and wr_eeprom.

That's enough hints to keep someone on the list (Magnus?) busy over Christmas. Of course, if anyone knows the "confidential procedure", they should just let us know...

Thanks,
/tvb

----- Original Message -----
From: "Mod Mix" <***@t-online.de>
To: <time-***@febo.com>
Sent: Tuesday, December 23, 2014 3:04 PM
Subject: [time-nuts] HP 53131A - reset security code

Post by Mod Mix
Hi,
I got a used HP 53131A to which I added a stability option board (ocxo).
In order to calibrate the device, a security code is needed - I don't
know it. The seller doesn't know it. It's not the facorty set code.
Advice on how the reset the non-volatile memory would be much appreciated.
Thank you very much & happy Christmas
Ulli
A calibration security code feature allows you to enter a security code
(electronic key) to prevent accidental or unauthorized calibrations of
the Counter. The security code is set to 53131 or 53132 (corresponding
to the model) when the Counter is shipped from the factory.
If you forget your security code, you can reset the security code to the
model-number default by resetting all of the non-volatile memory to a
default state (Contact Agilent Technologies for this confidential
procedure).
_______________________________________________
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

_______________________________________________
time-nuts mailing list -- time-***@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Bob Camp

2014-12-24 02:04:54 UTC

Permalink

Hi

I believe you will find that when you do the cal it will ask you:

Security yes/no?

(answer yes)

Enter your key?

(enter a random number)

Enter your key again?

(re-enter random number)

Security enabled.

No, that is not a direct quote of what happens. It’s purely a guess based on the process used on other gizmos.

Yes, there pretty much *has* to be a “wipe the memory” command somewhere. I would not find it surprising if the answer involves a trip back to HP for service. I doubt they will do much on a 53131 now that they have killed off support.

What to do:

1) Try the usual guesses 123, 1234 etc.

2) Try the end of the serial number on the counter

3) Try 53131

Again - only a guess. It does fit the given information - no magic code listed anywhere / Magic code does exist.

Bob

Post by Tom Van Baak
Ulli,
Operating Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90055.pdf
Programming Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90044.pdf
Assembly-Level Service Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90039.pdf
Component Level Information
http://literature.cdn.keysight.com/litweb/pdf/5989-6308EN.pdf
But I have three ides for you.
1) The last PDF shows U14 is AT28C64B (www.atmel.com/Images/doc0001h.pdf) so if all else fails, you can use a logic analyzer on the address(13) / data(8) pins and see what's in the EEPROM. With some experimentation by you or others on the list we can locate the calibration security. This has the advantage of getting the existing code, without having to clear the entire EEPROM. Some other HP bench instruments use an onboard jumper to override the cal lock, but I don't see that on a 53131A. So perhaps there is a magic front panel sequence or SCPI command to clear NVRAM.
2) Search for 53132 at http://www.ko4bb.com/manuals/index.php and grab the 4 EPROM's. Do a 16-bit merge of U8/U10 and U9/U11 and look for ascii strings. All the SCPI words are in there and not all are documented. For example near the words SYST and CODE and SEC[URITY] is ALL and DEL[ETE]. Probably safe to try. Lots of interesting output strings, both for GPIB and for internal debugging. Even the words EEPROM CLEAR, along with "Oooh! That tickles. I don't know that vector." which we also see in the Z3801A, etc.
MLB TEAM KRISTI BITTNER, LEE COSART, ERIC INGMAN, GARY JACOBSEN, SOOK-LAN LOH, ROB MITCHELL, ROBIN POSKUS, DON SCHREMP, DANA STOFFERS, AND GEORGE TSAI
SOFTWARE L. COSART G. JACOBSEN S. LOH R. POSKUS D. STOFFERS
HARDWARE K. BITTNER E. INGMAN D. SCHREMP
MECHANICAL G. TSAI
PROJECT MGR R. MITCHELL
BASEHIT -- 53132
3) There's a pForth interpreter in this instrument too. Note pr_eeprom_debug and wr_eeprom.
That's enough hints to keep someone on the list (Magnus?) busy over Christmas. Of course, if anyone knows the "confidential procedure", they should just let us know...
Thanks,
/tvb
----- Original Message -----
Sent: Tuesday, December 23, 2014 3:04 PM
Subject: [time-nuts] HP 53131A - reset security code

_______________________________________________
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Mod Mix

2014-12-24 02:33:54 UTC

Permalink

Hi Bob,

to enter calibration the bottom <Scale & Offset> is to be pressed during
power on.
In my case, CAL SECURE is displayed and after the next push on <Scale &
Offset> the display reads: CODE: 0.
Using left arrow it makes up to 7 zeros to appear... - quite a lot of
options to try it manually... even more pushes needed as e.g. 4 is
reached be 4-times up arrow...
Still hoping to learn the secret procedure.

I've tried several figures (among them 53131 as said in the manual or
the number printed on a paper lable sticking on the display)...
Neither Serial number nor date code is working - always: BAD CODE.

Nevertheless: thanks!
Ulli

Post by Bob Camp
Hi
Security yes/no?
(answer yes)
Enter your key?
(enter a random number)
Enter your key again?
(re-enter random number)
Security enabled.
No, that is not a direct quote of what happens. It’s purely a guess based on the process used on other gizmos.
Yes, there pretty much *has* to be a “wipe the memory” command somewhere. I would not find it surprising if the answer involves a trip back to HP for service. I doubt they will do much on a 53131 now that they have killed off support.
1) Try the usual guesses 123, 1234 etc.
2) Try the end of the serial number on the counter
3) Try 53131
Again - only a guess. It does fit the given information - no magic code listed anywhere / Magic code does exist.
Bob

Richard Solomon

2014-12-24 01:55:30 UTC

Permalink

Is there some reason you cannot just ask Agilent ??

73 es HH, Dick, W1KSZ

_______________________________________________
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Mod Mix

2014-12-24 02:15:27 UTC

Permalink

Well, it's Christmas - may be there it will be nobody during the next
couple of days being able to answer the question...
I got a now gizmo which I want you learn asap...
That's why I'm asking here.
Ulli

Post by Richard Solomon
Is there some reason you cannot just ask Agilent ??
73 es HH, Dick, W1KSZ

Adrian Godwin

2014-12-24 02:33:07 UTC

Permalink

I'm the seller. The counters, as a matter of interest, came from the
factory that Rakon recently closed in Lincoln. Unfortunately there wasn't
any contact with the actual staff so I have no information about them.

I bought 3, kept one for myself - the only one with the MS option. I
haven't tried the cal procedure yet so I'm not sure if mine is locked, but
I do have the gear to sniff the eeprom bus so will do that if needed.

Only one thing - two of the counters were HP branded, one was Agilent. I
think the Agilent had later firmware and that's the one that went to
Ulli. I meant to copy the ROMs before I sent it but forgot, so I may have
different firmware to him. Not sure if that will affect the EEPROM content.

One thing that occurs to me is that car radios of this era had security
codes in them to deter theft. It was generally held that if you lost the
code, putting them in the freezer would temporarily corrupt the codes long
enough to force them back to reset. Maybe something similar would work -
though it's likely that all the other cals would be cleared too. The
trigger thresholds probably aren't too hard, but would the interpolator be
calibrated too ?

Post by Richard Solomon
Is there some reason you cannot just ask Agilent ??
73 es HH, Dick, W1KSZ

Post by Tom Van Baak
Ulli,
Operating Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90055.pdf
Programming Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90044.pdf
Assembly-Level Service Guide
http://cp.literature.agilent.com/litweb/pdf/53131-90039.pdf
Component Level Information
http://literature.cdn.keysight.com/litweb/pdf/5989-6308EN.pdf
But I have three ides for you.
1) The last PDF shows U14 is AT28C64B (www.atmel.com/Images/doc0001h.pdf)
so if all else fails, you can use a logic analyzer on the address(13) /
data(8) pins and see what's in the EEPROM. With some experimentation by you
or others on the list we can locate the calibration security. This has the
advantage of getting the existing code, without having to clear the entire
EEPROM. Some other HP bench instruments use an onboard jumper to override
the cal lock, but I don't see that on a 53131A. So perhaps there is a magic
front panel sequence or SCPI command to clear NVRAM.
2) Search for 53132 at http://www.ko4bb.com/manuals/index.php and grab
the 4 EPROM's. Do a 16-bit merge of U8/U10 and U9/U11 and look for ascii
strings. All the SCPI words are in there and not all are documented. For
example near the words SYST and CODE and SEC[URITY] is ALL and DEL[ETE].
Probably safe to try. Lots of interesting output strings, both for GPIB and
for internal debugging. Even the words EEPROM CLEAR, along with "Oooh! That
tickles. I don't know that vector." which we also see in the Z3801A, etc.
MLB TEAM KRISTI BITTNER, LEE COSART, ERIC INGMAN, GARY JACOBSEN,
SOOK-LAN LOH, ROB MITCHELL, ROBIN POSKUS, DON SCHREMP, DANA STOFFERS, AND
GEORGE TSAI
SOFTWARE L. COSART G. JACOBSEN S. LOH R. POSKUS D. STOFFERS
HARDWARE K. BITTNER E. INGMAN D. SCHREMP
MECHANICAL G. TSAI
PROJECT MGR R. MITCHELL
BASEHIT -- 53132
3) There's a pForth interpreter in this instrument too. Note
pr_eeprom_debug and wr_eeprom.
That's enough hints to keep someone on the list (Magnus?) busy over
Christmas. Of course, if anyone knows the "confidential procedure", they
should just let us know...
Thanks,
/tvb
----- Original Message -----
Sent: Tuesday, December 23, 2014 3:04 PM
Subject: [time-nuts] HP 53131A - reset security code
Hi,

Post by Mod Mix
I got a used HP 53131A to which I added a stability option board (ocxo).
In order to calibrate the device, a security code is needed - I don't
know it. The seller doesn't know it. It's not the facorty set code.
Advice on how the reset the non-volatile memory would be much appreciated.
Thank you very much & happy Christmas
Ulli
A calibration security code feature allows you to enter a security code
(electronic key) to prevent accidental or unauthorized calibrations of
the Counter. The security code is set to 53131 or 53132 (corresponding
to the model) when the Counter is shipped from the factory.
If you forget your security code, you can reset the security code to the
model-number default by resetting all of the non-volatile memory to a
default state (Contact Agilent Technologies for this confidential
procedure).
_______________________________________________
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.

_______________________________________________
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.

Mod Mix

2014-12-24 13:44:12 UTC

Permalink

Adrian made me to try something which turned out to work.
It's just a bit tricky:

* 7 times arrow left gives 7 zeros (0.000000)
* most left 0 changed to 1 (up arrow: 1.00000)
* proceed to habe 1.053131
* change it to 0.05313 (down arrow at first 1 position
* press Enter
* Bingo!
GPS 10 MHz at Ch1 now reads relative to the internal OCXO
10.000,000.0[01] MHz ,-)

Thanks to all
Ulli
_______________________________________________
time-nuts mailing list -- time-***@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Mod Mix

2014-12-25 11:07:21 UTC

Permalink

Sorry, there was a typo in my previous message.

* change it to 0.053131 (down arrow at first 1 position)

instead of

* change it to 0.05313 (down arrow at first 1 position)

Cheers
Ulli

_______________________________________________
time-nuts mailing list -- time-***@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.