HP 34401A Repair

[corn11]

Hello everyone,

my first post in this forum! (I'm following the eevblog for about three years now)

I recently scored a broken 34401A on eBay, as an addition to my little lab equipment collection.
It was sold as "no display" so I checked all the rails and found out that the front panel uC (U602) drew too much current.

When I power the the uC with my bench supply the VFD test works fine. The keypad scanning works also despite of one key drive pin which is also gone.

But there is no activity on the front panel bus nor on the serial control bus.
I figured out that the reset line is pulled every milisecond. First I thought the vreg (U553 / LM2925T [with power on reset]) causes the problem but after removing the resistor between the vreg reset line and the micro(80C196 / U500) / asic(U501) the problem was still there. I think the micro resets itself or it's watchdog.

But I can't find the reason why?! 
The rom (rev. 10) and the ram work properly (I suppose / checked some pins)  and also the earth referenced circuit is transmitting a data sequence through the optos, but there is also no activity on the cal eeprom bus.
I've checked the HP/Agilent Yahoo group but I only found a problem with the LM2925T and the reset line.

I would be glad if someone has a hint for me.   

regards and thanks in advance

Cornelius

[free_electron]

is this the front with the single chip uPD7xxx from NEC or is it the one with the 8051 and two supertex (or TI) 75888 (
Basically there is either 1 chip in tqfp or 3 chips in PLCC

if it is the one with the upd : Trash. cannot be fixed. these things die. bad chip. these panels are also NOT compatible with the new ones ( 8051 based). software updates don't help.

if it is the one with the 8051 : check the LM339 level shifters. if one goes wonky communication doesn't start. you should have a double beep at power up


this manual has BOTH schematics :
http://cp.literature.agilent.com/litweb/pdf/34401-90013.pdf Chapter 8 has the upD75xx based one while chapter 9 has the new one.

[corn11]

Thanks for the quick answer!

My unit was manufactured round about late 1999.
The front panel part no. is 34401-66512 (Rev. A) and the mainboard part no is 34401-66501 (Rev. D).

I checked the lm339 and it seemed to be ok but to be 100% sure I replaced it with a new one.
The behaviour is still the same: Reset signal of the main micro (U500) is toggling and only one beep at startup.



regards

Cornelius

[corn11]

I've tried a few other things but the situation is the same as before 
Some days ago I've written a mail to Agilent but no response yet.

Does anybody have another idea what might be the culprit?

I would be glad if someone can provide me a dump of the main eprom.

Any other help would be much appreciated!


Thanks

Cornelius

[Orange]

I had a 34401A on which the flat-cable connector between the display board and the main board had issues. I tried to replace it with a standard 0.1'' connector, but HP decided that this connector needed to be a an odd value pitch (i think it was 2 mm) Anyhow. I removed the connector, and soldered the cable directly on the board. Problem solved.

Bad construction of this cheap connector.

This is probably not your problem, but it's worth a try, to rule out the connector.

[corn11]

Thank you for the tip! I'll try it tomorrow and let you know. 
Do you remember whether the meter booted up correctly without the front panel (except for the front panel error code) ?

[corn11]

Unfortunately you were right, it wasn't the cable

[tszaboo]

I'm not sure if this is helping, but: You can find a fully detailed schematic flying around on the web and service guide for the 34401A on their website. You should read both first.

[vtp]

Hello,

Did you ever sort this out?

I have about the same age unit from late 1999 and front panel appears not to be communicating properly with the In Guard MCU. At power up the meter beeps twice. All segments on the VFD light up when powering the meter and then turn off. Shift-key works or at least illuminates shift-indicator on the VFD. I guess this is the only function handled locally by the FP MCU.

Later when debugging the front panel I noticed that if I cycle the power fast it beeps only once. However, I now have the VFD removed so I cannot determine (well, could possibly with GPIB) if the meter works with warmish boot. This could indicate something wrong in power up of the FP MCU but then again, reset appears to work just fine when scoping it.

I have scoped the level shifters and all other components on the signal chain and they work perfectly. As good are all the voltages on the FP board. IG-MCU is mostly sending 0x00 to FP and FP is almost always replying with 0xDD. HC299 load appears to work ok too.

I am starting to think there is something wrong internally in possibly with FPDI-input of the FP MCU or the MCU it otherwise internally corrupted.

Has anyone got dump of the FP MCU ROM contents?

The FP MCU is Intel 80C51BH (not -P) so it could be possible to run verify on the ROM and so get the data. My meter's FP is not a good canditate for this as it may be faulty.

I have tested the meter with front panel from other meter and then it worked fine. So, the fault is in the front panel. Or at least probability is highly on that side.

[corn11]

Hello,

I've solved my problem a while ago. (Sorry that I had forgotten to post it here )
My meter had a faulty SRAM chip and as I've mentioned before one faulty output pin (KEY_DRV[1] Pin 42) at the FP Controller (maybe that pin had died as a result of a latch up ).

Did you check the oscillator and also the sent and received data against the SIO(x) signals?
Maybe you should also check what 'free_electron' has suggested here:
https://www.eevblog.com/forum/projects/help-on-n80c51bh-programming/

things i know happen to these boards and are frequently the cause for thinking the board is dead or the cpu is broken ( i have never known the cpu to die )

- no clock due to bad crystal
- cpu held in reset due to broken level shifters (LM339's are used to level shift the 18 volt signals into the local 'lifted' 5 volt domain )
- absence of the 3 votl AC for the filament
- shorted 0.1 uf caps.  check if the power rail isn't shunted...
- the resistors around the level shifting network going bad. if you find brownish resistor with yellow legend : warning ! those fuckers grow dendrites and go bad. i;ve sene those go off in the ADC section of 3631 taking out the OP711 and OP706 opamps along the way.

I think with a faulty MCU (and no time ) you better should buy a new FP, replacement mcus are really hard to get because they have a masked rom as you certainly know.
Another solution would be to salvage the mcu from a FP with a dim VFD from another instrument with that same MCU on it or buy a AT89 or so and to program your own FP controller.

[vtp]

Hello,

Thanks for your update.

Did you check the oscillator and also the sent and received data against the SIO(x) signals?

I think with a faulty MCU (and no time ) you better should buy a new FP, replacement mcus are really hard to get because they have a masked rom as you certainly know.
Another solution would be to salvage the mcu from a FP with a dim VFD from another instrument with that same MCU on it or buy a AT89 or so and to program your own FP controller.

Oscillator was finely oscillating at 12 MHz. SIO[7...0] I did not check and compare against what went out of the shift register, perhaps I should have.

About faulty MCU (it is N80C51BH, 34401-88813 REV 2.0) or it's availability, I am not so sure now as I took it off and read the ROM contents. Disassembly appears to be ok but of course there could be an error in it - though it looks now unlikely. At least now I can check what is supposed to go out of FPDO line.

Perhaps the HC299 was not shifting out what is should have. Stuck key also causes front panel not to respond, I did not check key scanning lines either.

I guess I need to order some parts now.

[free_electron]

you dumped a 'c' version ? how did you do that ?
i know the trick to dump the old H by booting them from external eprom and runninx XMOV operations.

afaik that trick no longer works on the C. It will still give data but it will be garbage.

[vtp]

you dumped a 'c' version ?

I do not know what you mean with a 'c' version. But yes, I dumped something.

how did you do that ?

I was a highly technical and top secret process of removing the IC, putting it into a PLCC44 to DIP adapter, inserting the adapter on my Labtool-48UXP programmer, selecting Intel 87C51 and hitting read button.

But first, I had to RTFM and assume nothing - which are also two of the basic rules of any troubleshooting.

Let me quote Intel Embedded Microcontrollers 1995 book, page 2-42:

"The 80C51BHP is identical to the 80C51BH with the exception of the Protection Feature. To incorporate this Protection Feature, program verification has been disabled..."

Since the MCU is -BH I am not that surprised that it was directly readable.

Looking at the code, it seems to consist of setup, then main loop which is refreshing the display. Main loop contains calls to keyscanning and serial communications. It's full of stars state machines and a bit difficult to read thus.

Here's a snippet:

Code: [Select]

code:0273 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
code:0273
code:0273 ;  In-Guard transmit/receive
code:0273
code:0273 code_273:                               ; CODE XREF: code:023Ep
code:0273                 push    PSW
code:0275                 mov     PSW, #0x18
code:0278                 jb      INTMEM_21.5, code_2D7
code:027B                 jb      INTMEM_21.4, code_2AC
code:027E                 jb      INTMEM_21.3, code_2AC
code:0281                 jbc     INTMEM_21.2, code_298
code:0284                 jb      INT1, code_291  ; P3.3 - EXTERNAL INTERRUPT 1 INPUT
code:0287                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:0289                 mov     P2, #0xFF
code:028C                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:028E                 pop     PSW
code:0290                 ret
code:0291 ; ---------------------------------------------------------------------------
code:0291
code:0291 code_291:                               ; CODE XREF: code_273+11j
code:0291                 jb      INTMEM_21.3, code_2AC
code:0294                 setb    INTMEM_21.4
code:0296                 sjmp    code_2AC
code:0298 ; ---------------------------------------------------------------------------
code:0298
code:0298 code_298:                               ; CODE XREF: code_273+Ej
code:0298                 setb    INTMEM_21.3
code:029A                 mov     INTMEM_58, INTMEM_55
code:029D                 mov     INTMEM_5A, #0x77 ; 'w'
code:02A0                 jnb     INTMEM_22.5, code_2AA
code:02A3                 mov     INTMEM_5A, #0xA5 ; 'Ñ'
code:02A6                 setb    INTMEM_22.6
code:02A8                 clr     INTMEM_22.5
code:02AA
code:02AA code_2AA:                               ; CODE XREF: code_273+2Dj
code:02AA                 mov     R2, #1
code:02AC
code:02AC code_2AC:                               ; CODE XREF: code_273+8j
code:02AC                                         ; code_273+Bj ...
code:02AC                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02AE                 mov     P2, #0x7F ; ''
code:02B1                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02B3                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02B5                 mov     P2, #0xFF
code:02B8                 clr     T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02BA                 clr     EA              ; IE.7 - GLOBAL INTERRUPT ENABLE
code:02BC                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02BE                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C0                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02C2                 mov     P2, INTMEM_5A
code:02C5                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C7                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C9                 clr     T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02CB                 setb    TR0             ; TCON.4 - TIMER 0 ON/OFF CONTROL
code:02CD                 mov     P2, #0xFF
code:02D0                 setb    INTMEM_21.5
code:02D2                 setb    EA              ; IE.7 - GLOBAL INTERRUPT ENABLE
code:02D4                 pop     PSW
code:02D6                 ret
code:02D7 ; ---------------------------------------------------------------------------
code:02D7
code:02D7 code_2D7:                               ; CODE XREF: code_273+5j
code:02D7                 mov     A, TL0          ; Timer0 - Low Byte
code:02D9                 anl     A, #0xF8
code:02DB                 jz      code_2EE
code:02DD                 clr     TR0             ; TCON.4 - TIMER 0 ON/OFF CONTROL
code:02DF                 mov     TL0, #0         ; Timer0 - Low Byte
code:02E2                 mov     R3, P2
code:02E4                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02E6                 clr     INTMEM_21.5
code:02E8                 mov     DPTR, #0x2F1
code:02EB                 mov     A, R2
code:02EC                 rl      A
code:02ED                 jmp     @A+DPTR
code:02EE ; ---------------------------------------------------------------------------
code:02EE
code:02EE code_2EE:                               ; CODE XREF: code_273+68j
code:02EE                 pop     PSW
code:02F0                 ret
code:02F0 ; End of function code_273
code:02F0

At 0x02AC is shift register load and looks like two payload bytes go back to IG.

[free_electron]

aha.

i have such a labtool programmer myself.

good to know. i will dump the code. Shahriar (thesignalpath) has a power supply that killed the 8051. that way we can duplicate these.
Actually : you may want to contact him. simply flash it into a 8751 and it will work.

[vtp]

Just to provide an update on this.

Whatever I read from the old chip apparently was ok since programming it to an AT89C51RC-24JU and soldering the newly programmed chip on display board cured the meter.

So, I obviously had a broken 8051 but was lucky enough to get the firmware out of it.

[corn11]

Sounds great ! 

Unfortunately I hadn't got the time yet to try the fix on my display board but I'll let you know if it works.

Thanks for the update!


Cornelius

[bingo600]

Just to provide an update on this.

Whatever I read from the old chip apparently was ok since programming it to an AT89C51RC-24JU and soldering the newly programmed chip on display board cured the meter.

So, I obviously had a broken 8051 but was lucky enough to get the firmware out of it.

Any chance of an upload of the code , you read ?

/Bingo

[Pitsie]

I do not know what you mean with a 'c' version. But yes, I dumped something.

Hi vtp and all,
Sorry to revive such an old thread, but I have a similar problem as you had and perhaps you can help..
I have a broken display controller on an E3633A, and when reading the ROM contents it it is obvious that one bit is stuck at "1", which is probably also the reason that the display does not work, broken output driver on port 0... It would help me immensely if you could share what you read out from your 80C51. If you are not comfortable with sharing that, I actually only need the values for bit 3 .. so even your readout but everything "anded with 0x08" would be enough to get me going again.
Thanks!

[Pitsie]

Here's a snippet:

Code: [Select]

code:0273 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
code:0273
code:0273 ;  In-Guard transmit/receive
code:0273
code:0273 code_273:                               ; CODE XREF: code:023Ep
code:0273                 push    PSW
code:0275                 mov     PSW, #0x18
code:0278                 jb      INTMEM_21.5, code_2D7
code:027B                 jb      INTMEM_21.4, code_2AC
code:027E                 jb      INTMEM_21.3, code_2AC
code:0281                 jbc     INTMEM_21.2, code_298
code:0284                 jb      INT1, code_291  ; P3.3 - EXTERNAL INTERRUPT 1 INPUT
code:0287                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:0289                 mov     P2, #0xFF
code:028C                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:028E                 pop     PSW
code:0290                 ret
code:0291 ; ---------------------------------------------------------------------------
code:0291
code:0291 code_291:                               ; CODE XREF: code_273+11j
code:0291                 jb      INTMEM_21.3, code_2AC
code:0294                 setb    INTMEM_21.4
code:0296                 sjmp    code_2AC
code:0298 ; ---------------------------------------------------------------------------
code:0298
code:0298 code_298:                               ; CODE XREF: code_273+Ej
code:0298                 setb    INTMEM_21.3
code:029A                 mov     INTMEM_58, INTMEM_55
code:029D                 mov     INTMEM_5A, #0x77 ; 'w'
code:02A0                 jnb     INTMEM_22.5, code_2AA
code:02A3                 mov     INTMEM_5A, #0xA5 ; 'Ñ'
code:02A6                 setb    INTMEM_22.6
code:02A8                 clr     INTMEM_22.5
code:02AA
code:02AA code_2AA:                               ; CODE XREF: code_273+2Dj
code:02AA                 mov     R2, #1
code:02AC
code:02AC code_2AC:                               ; CODE XREF: code_273+8j
code:02AC                                         ; code_273+Bj ...
code:02AC                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02AE                 mov     P2, #0x7F ; ''
code:02B1                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02B3                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02B5                 mov     P2, #0xFF
code:02B8                 clr     T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02BA                 clr     EA              ; IE.7 - GLOBAL INTERRUPT ENABLE
code:02BC                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02BE                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C0                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02C2                 mov     P2, INTMEM_5A
code:02C5                 clr     T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C7                 setb    T0              ; P3.4 - TIMER 0 COUNT INPUT
code:02C9                 clr     T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02CB                 setb    TR0             ; TCON.4 - TIMER 0 ON/OFF CONTROL
code:02CD                 mov     P2, #0xFF
code:02D0                 setb    INTMEM_21.5
code:02D2                 setb    EA              ; IE.7 - GLOBAL INTERRUPT ENABLE
code:02D4                 pop     PSW
code:02D6                 ret
code:02D7 ; ---------------------------------------------------------------------------
code:02D7
code:02D7 code_2D7:                               ; CODE XREF: code_273+5j
code:02D7                 mov     A, TL0          ; Timer0 - Low Byte
code:02D9                 anl     A, #0xF8
code:02DB                 jz      code_2EE
code:02DD                 clr     TR0             ; TCON.4 - TIMER 0 ON/OFF CONTROL
code:02DF                 mov     TL0, #0         ; Timer0 - Low Byte
code:02E2                 mov     R3, P2
code:02E4                 setb    T1              ; P3.5 - TIMER 1 COUNT INPUT
code:02E6                 clr     INTMEM_21.5
code:02E8                 mov     DPTR, #0x2F1
code:02EB                 mov     A, R2
code:02EC                 rl      A
code:02ED                 jmp     @A+DPTR
code:02EE ; ---------------------------------------------------------------------------
code:02EE
code:02EE code_2EE:                               ; CODE XREF: code_273+68j
code:02EE                 pop     PSW
code:02F0                 ret
code:02F0 ; End of function code_273
code:02F0


Interesting though, i have the same code as you read (after fiddling the stick bit 3 obviously but at a different offset, your code:273 is 279 in mine:

Code: [Select]

code:00000279 C0 D0                       push    PSW       
code:0000027B
code:0000027B             code_27B:                             
code:0000027B 75 D0 18                    mov     PSW, #0x18
code:0000027E 20 0D 5C                    jb      RAM_21.5, code_2DD
code:00000281
code:00000281             code_281:                               ;
code:00000281 20 0C 2E                    jb      RAM_21.4, code_2B2
code:00000284
code:00000284             code_284:                               ;
code:00000284 20 0B 2B                    jb      RAM_21.3, code_2B2
code:00000287
code:00000287             code_287:                               ;
code:00000287 10 0A 1C                    jbc     RAM_21.2, code_2A5+1


[rich1]

Hello everyone,

I also have an 34401A with an defect display.
The 8051 is defect  (it is shorting the power of the display PCB), this is probably caused by shorting the main GND and (shifted) display GND.

Can anyone share the display firmware, so I can replace the broken processor?

Many thanks in advance.

[douardda]

Hi rich1, did you ever find a working and complete dump of the DP 80c51's ROM?

David

[bushjavier]

attached the firmware for the display MCU