Author Topic: HP 4145B Semiconductor Analyzer: Repair with photos (dead ROM) [FIXED]  (Read 13350 times)

0 Members and 1 Guest are viewing this topic.

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
Notable posts in the tread:
- Small character ROM image:  https://www.eevblog.com/forum/testgear/hp-4145b-semiconductor-analyzer-repair-with-photos-(display-garbage-dead-rom)/msg1702649/#msg1702649
- Big character ROM image: https://www.eevblog.com/forum/testgear/hp-4145b-semiconductor-analyzer-repair-with-photos-(display-garbage-dead-rom)/msg1743677/#msg1743677
- Conclusion to the repair: https://www.eevblog.com/forum/testgear/hp-4145b-semiconductor-analyzer-repair-with-photos-(display-garbage-dead-rom)/msg1743662/#msg1743662




So i managed to score a HP 4145B Semiconductor Analyzer on the cheap and it is quite the boat anchor.



Because these things keep there firmware on floppy disk its pretty good that i got a system disk in it. However it was soon clear that we have a problem. While it boots fine it seams to be only able to display the character "a" in the wrong place, yet seams to still be drawing lines just fine. Clearly there is some issue with the graphics circuitry.



So off we go with the lid and we are kinda mooned. It looks like someone has opened the cover before, so this might be a failed repair attempt. Uh oh...



After a lot of screws later we are in like flin.



Around the back there is nothing interesting apart from the very important floppy drive. Also found a loose screw down here... thats not fun



So looking for the graphics stuff i have a look around the VERY hard to pull out cards. No sight of the graphics hardware, but i did find the Motorola 68000 CPU in here



Running out of ideas i go on to try and take out the CRT if it has any clues. This ended up being quite involved as you have to take apart the front pannel.



Has taken me quite a while to figure it out as i didn't have the full service manual of the thing.
« Last Edit: August 13, 2018, 07:02:43 pm by Berni »
 
The following users thanked this post: ch_scr

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
Eventually i got it out, turns out you have to undo some screws around the frame and 3 screws at the back of the CRT module.



And finally its out, and AHA here is the "graphics card" on the left side of the module!



Its quite a neat assembly actually, turns out this whole thing is a standard part by the name of "HP 1345A Digital Display". Service manual here: http://vectorvgapro.com/PDFs/HP/HP%201345A%20OSM%201985.pdf
It is basically a CRT module that runs from 5V and +/- 15V while having a 16bit parallel interface. Capable of drawing vector graphics and vector text (No raster images tho)



The neat thing about it is that if you just power it up without connecting the data cable it goes into a self test mode and displays a test pattern. Once again its clear that it draws lines just fine, yet text is a mess of "a" characters again



So pouring over the nice service manual of it shows well how it works. It uses a special vector drawing chip that outputs 8bit data to a pair of X and Y DACs (Off to the right) for steering the beam. That self test turns out is done by a 8bit MCU sitting on the bus, and it seams to be the only job for it! A whole MCU just for a self test feature!

So after poking my scope around i noticed that the outputs of the character ROM chip(Shown in red) are always 0 while the address lines are all moving about. Reseating it in the socket does nothing, it gets power and all, so i conclude that this chip is dead. :(



And here is the top side of this vector graphics board. Red arrow is the dead character ROM.





To further confirm it i tried to unplug the chip and run it, indeed i got garbage where the "a" characters used to be, and if i tie one of the lines on it to 5V i get different characters in place of the "a". So yes this thing is toast.

I have tried to find ROM dumps online but so far i could not get anything. So i looked for alternatives. One option is getting a new display module, as of right now these can be found on ebay for about 300 EUR. Since that's almost 3 times as much as i payed for this whole thing that's not so great. Another option is to buy a NewScope5 LCD retrofit kit: http://www.simmconnlabs.com/1401/2501.html But that costs 400 USD. At least that gives me a modern LCD with color but still thats a bit steep.

Does anyone know where to find a ROM image of this chip?

As a last resort i did get the idea to try and guess the contents of the ROM trough brute force. Its only a 512 byte ROM and only half of it is actually used up. The input to it should be ASCII values (The char set is in the service manual), i just don't know what the output should be. Essentially this ROM looks up the address of a character drawing in the larger 2KB ROM, while also generating some control signals for the vector chip. Maybe a CPLD could be used as a ROM emulator to quickly change contents while running. Once i have the correct ROM image from that i can then burn it into a actual memory chip and replace it. Sounds like a lot of work still...


« Last Edit: July 26, 2018, 06:02:51 pm by Berni »
 

Offline mnementh

  • Super Contributor
  • ***
  • Posts: 17541
  • Country: us
  • *Hiding in the Dwagon-Cave*
I vaguely remember reading in one of my newsletters back in the day of someone trying to recover the ROM in a situation like yours; their attack vector was to try differing combinations of under & over-voltage and 1/4-1/2-full speed read attempts until they got data that they could make repeat.

I'll fully admit that I'm grossly ignorant of the nuts & bolts of what they did and how they configured the burner... just that was the gist of their technique.


Cheers,

mnem
*Ifni Bless this mess*
alt-codes work here:  alt-0128 = €  alt-156 = £  alt-0216 = Ø  alt-225 = ß  alt-230 = µ  alt-234 = Ω  alt-236 = ∞  alt-248 = °
 

Offline edpalmer42

  • Super Contributor
  • ***
  • Posts: 2260
  • Country: ca
Quote
To further confirm it i tried to unplug the chip and run it, indeed i got garbage where the "a" characters used to be, and if i tie one of the lines on it to 5V i get different characters in place of the "a". So yes this thing is toast.

Continue with this idea.  Unplug the dead chip.  Set up an Arduino or RaspPi to drive the output lines.  Step through all 256 values and see what appears on the screen.  Maybe you'll be able to figure out the pattern from that.  The fact that 0x00000000 generates a lower case 'a' is a good starting point.  Any bets on whether 0x00000001 gives a lower case 'b'?

What's the part number of the dead chip?

Ed
 

Offline picburner

  • Frequent Contributor
  • **
  • Posts: 496
  • Country: it
Perhaps this file can be useful:
 
The following users thanked this post: Berni

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
It is a N82S147N Signetics (4Kbit PROM)

Oh wow thanks! That does look like its the ROM i need!

Now i just need to source a replacement chip and find a way to burn it.
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
I have contacted http://www.hobbyroms.com for programing me a replacement chip so if all goes well i won't even need to get a programmer for it.

Looks like this will save me a good weekend or two worth of work. Thanks picburner!  :-+ :-+ :-+
 

Offline edpalmer42

  • Super Contributor
  • ***
  • Posts: 2260
  • Country: ca
I see that the chip has tri-state outputs.  Have you checked that the enable line is active?

I also see that the prom has a a second copy of the data in the top half of the chip.  Maybe forcing the most significant bit high would get the chip working.

Ed
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
Update:
I ended up buying a new ROM chip and had it programmed by HobbyRoms for 25 USD including shipping. We will see if it works when i get it in the mail.

Yep i poked all the pins right next to the DIP package body with a scope probe, just in case i had a bad IC socket or something. It did indeed have power right on the pin and was permanently enabled as that pin is directly connected to ground.
 

Offline mnementh

  • Super Contributor
  • ***
  • Posts: 17541
  • Country: us
  • *Hiding in the Dwagon-Cave*
Update:
I ended up buying a new ROM chip and had it programmed by HobbyRoms for 25 USD including shipping. We will see if it works when i get it in the mail.

Yep i poked all the pins right next to the DIP package body with a scope probe, just in case i had a bad IC socket or something. It did indeed have power right on the pin and was permanently enabled as that pin is directly connected to ground.

Yes, but according to Ed Palmer's post, lifting that pin and pulling it HI might enable the 2nd copy of the ROM stored in the second register. Certainly would cost very little effort to confirm, and might prevent killing a new part if there's something else wrong in the circuit.

mnem
*unregistered*
alt-codes work here:  alt-0128 = €  alt-156 = £  alt-0216 = Ø  alt-225 = ß  alt-230 = µ  alt-234 = Ω  alt-236 = ∞  alt-248 = °
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
I looked at the ROM image and i don't see a 2nd copy of it in there.



According to the schematic the pin tied to ground is address 5 of the ROM. So if you tie this pin high this adds 32 to all addresses that are accessed on it. So 0x000 becomes 0x020 and if you look at the hex of the ROM you see that that would cause the rom to always output 0xDE on its output. So this would make the display always show whatever character is mapped to ASCII code 0.

There is some duplication visible in there but its not at the right address.  There is likely a different styled font mapped to those areas. since bits 5,6,7 run past the ROM and change other control lines deeper down.

EDIT: Also i seen the highest address line move while its running so it was reading that duplicated area of memory.
« Last Edit: July 28, 2018, 06:20:39 pm by Berni »
 

Offline edpalmer42

  • Super Contributor
  • ***
  • Posts: 2260
  • Country: ca
I didn't do a full byte-by-byte comparison, but it looks like the duplicated section starts at offset 00000100.  However, when I look at the schematic, I see what you mean about address 5.  I made the mistake of assuming that the bytes were just used in sequential order which would have left address 7 unused and probably tied low.  The truth is stranger than that.  I can't imagine why HP would do it that way.

You could still try driving the outputs and see what shows up on the screen, but since you've got a new prom on the way, there's really no point.  If replacing the prom *doesn't* cure the problem, it might be a useful test.

Ed
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
Yeah i also found it surprising, its possible its a speed thing since these PROMs can be banked inside.

Im going to try it when i get the new PROM chip since for now i assembled the unit mostly back together to store it. It was taking up most of my lab while laying out in so many parts. There is some more gear that needs fixing in the mean time.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
Wow that thing is very dense, lots of stuff in there. Odd that it uses an electrostatic CRT with vector deflection. I'm curious to see what it does with the new ROM.
 

Offline mnementh

  • Super Contributor
  • ***
  • Posts: 17541
  • Country: us
  • *Hiding in the Dwagon-Cave*
Yeah i also found it surprising, its possible its a speed thing since these PROMs can be banked inside.

Im going to try it when i get the new PROM chip since for now i assembled the unit mostly back together to store it. It was taking up most of my lab while laying out in so many parts. There is some more gear that needs fixing in the mean time.

I stand corrected... the core weakness of armchair quarterbacking is that even if you've done the job before yourself, you don't have hands and eyes on the unit on the bench; so best you can offer is an educated guess.

But that'll never stop a engineer from kibbutzing. ;)

Finite space is always a problem... hence my current battle in the mountains of JENGA. But I shall be victorious!!!

mnem
*hiding out from the Tejas suck*

« Last Edit: July 29, 2018, 02:24:35 am by mnementh »
alt-codes work here:  alt-0128 = €  alt-156 = £  alt-0216 = Ø  alt-225 = ß  alt-230 = µ  alt-234 = Ω  alt-236 = ∞  alt-248 = °
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
Wow that thing is very dense, lots of stuff in there. Odd that it uses an electrostatic CRT with vector deflection. I'm curious to see what it does with the new ROM.

Yep it is up there with the most tightly packed gear i seen. I think i have something that even more packed than even this.

Turns out HP got a mention on Wikipedia for its electrostatic vector CRT: https://en.wikipedia.org/wiki/Vector_monitor This XY display they refer to is this HP 1345A Digital Display module. You just send it X Y points over a 16bit bus and it draws them connected by lines. It does make sense that you can draw things much quicker on such a CRT and since HP made scopes back in the day too they had plenty of experience with them.

I have another piece of HP gear that has the same sort of display. The HP 8566B Spectrum analyzer also has a green CRT in that shows vector graphics. I actually looked at the schematics of it to see if it happens to have the same character ROM i need (It didn't, only had a single big ROM for text and the text on it is all single font single style). Turns out the architecture is pretty similar where a ROM table and a DAC are used to electronically drive the beam around. The text, gradicules and multiple waveform traces are all vector drawn by the CPU. However they needed a electrostatic CRT in this because the analyzer also supports a a fast zero span mode. The ADC is too slow to digitize a 3MHz signal out of the detector so what they do instead is draw the gradicules and text under CPU control before switching over the screen into analog oscilloscope mode to draw the waveform and then back to vector mode. So to make a 3MHz CRO you do need static deflection. Oh and as a interesting fact there is no CPU chip in that instrument, the whole computer in there is built out of standard 74 series logic and some RAM and ROM (They do use a few 74 series ALU chips for math tho, but no hardware multiply).


I stand corrected... the core weakness of armchair quarterbacking is that even if you've done the job before yourself, you don't have hands and eyes on the unit on the bench; so best you can offer is an educated guess.

But that'll never stop a engineer from kibbutzing. ;)

Finite space is always a problem... hence my current battle in the mountains of JENGA. But I shall be victorious!!!

mnem
*hiding out from the Tejas suck*

Happens to everyone. I have chased some rather silly red herrings before.

Oh im doing a great job of filling said finite space, if you look closely at the photos you might also find a pair of "HP 6050A System DC electronic load" sitting behind the red tool cart. They are about the same size as this thing, and probably weigh even more when full of modules. One of the modules in there is waiting for a repair, i can also make it a repair thread if anyone is interested.
« Last Edit: July 29, 2018, 08:24:03 am by Berni »
 

Offline bson

  • Supporter
  • ****
  • Posts: 2265
  • Country: us
Looking at the schematic, I'd guess U12 is the main ROM containing shapes, and U5 only contains starting addresses into it, as mulitples of 4 since the A0 and A1 inputs to U12 are tied to ground and D0 out on U5 becomes A2.   A10 is D5 xor D6... Upper/lowercase?

How about this?  I'd offer $25 shipped and see if it has an okay ROM...

https://www.waybumarket.top/hp-agilent-8756a-scalar-network-analyzer-vpc-dot-bd-pn-0134566519-p-10060.html
« Last Edit: July 29, 2018, 06:50:57 pm by bson »
 

Offline bson

  • Supporter
  • ****
  • Posts: 2265
  • Country: us
I really like the local voltage regulation for the U16 vector processor, using Q1 and Q2...
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
I already ordered a replacement ROM with the image burned onto it for 25 USD including shipping. It should get here in about 2 weeks.

I have not reverse engineered it in detail, just far enough to understand that this broken ROM holds the offset for the actual character data in the big ROM. Im guessing they did this to be able to use a smaller ROM for character data. It makes more sense for me to just simply use a slightly bigger ROM and not need this one in front.

As for what the duplication is for is im guessing that this is for the lighter stroked font style and for rotated fonts where maybe the vector processor does the rotation by mirroring and flipping signs.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
If you haven't already, this may be a good time to dump the data from any othe ROMs in the machine, if one has failed it's not entirely unlikely another one will drop at some point.
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
I don't have any parallel EPROM programmers (Yeah I'm not very old) to do that. I am looking to get one since i end up dealing a lot with old equipment and i have a Dallas NVRAM that needs replacing in another piece of gear. Any suggestions what programmer to get that works on modern PCs?

Oh and the ROM for the main CPU is annoyingly not sockected so i probably wont go trough the trouble of reading that one. I guess they figured nobody will need to update it because all it does is load the firmware from floppy disk and run it. Its the floppy that contains the actual firmware.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
I like the GQ-4X, or if you're on a budget there's the TL-866, but look at the supported device list before buying to make sure it does what you want.
 

Offline bson

  • Supporter
  • ****
  • Posts: 2265
  • Country: us
Where did you get the image for the ROM?  It has to match the contents of U12 since it outputs an address for it!  One can probably, reasonably, assume there weren't many revisions if any, and so the chance of success is high but still, if any characters look weird or erroneous, or blocks of codes don't render at all this is probably why...

The next time I have it open I'll upload a dump of my 3577's vector graphics ROMs, but it's not exactly an instrument you just pull off the shelf and pop open. :)

Maybe A10 into U12 is for brightness?  I don't think it has actually has any lowercase glyphs, so the case may be used for brightness and so UC/LC look the same just UC is much brighter.  Just a thought.
 

Online BerniTopic starter

  • Super Contributor
  • ***
  • Posts: 4923
  • Country: si
I like the GQ-4X, or if you're on a budget there's the TL-866, but look at the supported device list before buying to make sure it does what you want.

Thanks il look into those programmers. That TL-866 looks quite capable indeed. I am willing to pay a bit more for a more universal unit. Programmers that can write PROM chips are pretty rare so il probably not get one for that, but reading of mask ROMs could be very useful for making backups of any memory chips i come across in test gear.


Where did you get the image for the ROM?  It has to match the contents of U12 since it outputs an address for it!  One can probably, reasonably, assume there weren't many revisions if any, and so the chance of success is high but still, if any characters look weird or erroneous, or blocks of codes don't render at all this is probably why...

The next time I have it open I'll upload a dump of my 3577's vector graphics ROMs, but it's not exactly an instrument you just pull off the shelf and pop open. :)

Maybe A10 into U12 is for brightness?  I don't think it has actually has any lowercase glyphs, so the case may be used for brightness and so UC/LC look the same just UC is much brighter.  Just a thought.


It does have lower case characters, but most of the menus use uppercase.

I can't know for sure if the ROMs match but given that this display module has real HP product number i would assume all of them are the same thing. I can always fallback to brute forcing the correct ROM image manually if the new chip im getting in the mail doesn't work right. I also have an offer for someone for the whole display module in case there is something more seriously wrong with it.(Like that weird vector processor being damaged)
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
If you find yourself needing to write old bipolar PROMs there are articles from the 70s-early 80s to build manually operated units. The harder part these days though is finding the blank chips, since they were all OTP and haven't been made in years. They're used in a lot of 1970s arcade games.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf