Hacking old HP spectrum Analyzers

[MarkL]

...
Now I have to figure out what this option actually does...

You might find this enlightening: "Time-Gated Spectrum Analysis: New Measurement Fundamentals" :

  http://literature.cdn.keysight.com/litweb/pdf/5952-3685.pdf

Everything you ever wanted to know about option 105.

[Bicurico]

Thanks!

I found that, too, shortly after posting the question.

But I have a new question: obviously my unit lacks the GATE INPUT and OUTPUT connectors on the rear. Do you know if I can retrofit them? Where would I need to hook them up? I saw some empty connectors on the inside...

And where could I source appropriate connectors and cables?

Not that I need this option, but would be nice to do the upgrade properly...

Regards,
Vitor

[MarkL]

Thanks!

I found that, too, shortly after posting the question.

But I have a new question: obviously my unit lacks the GATE INPUT and OUTPUT connectors on the rear. Do you know if I can retrofit them? Where would I need to hook them up? I saw some empty connectors on the inside...

And where could I source appropriate connectors and cables?

Not that I need this option, but would be nice to do the upgrade properly...

Regards,
Vitor

Most (but not all) in this series have the GATE INPUT and GATE OUTPUT built onto the processor board.  J500 is GATE OUTPUT and J501 is GATE INPUT.  See photo for the location on the bottom of the unit.  If it's not marked, J501 is the one closer to the edge.

The two cables are part numbers 08591-60077 and 08591-60076 if you want to search around for them.  But they are just ordinary 50-ohm SMB right angle to BNC jumper cables that you can easily make yourself.

[Bicurico]

Thanks! With your part numbers I found the installation manual: http://literature.cdn.keysight.com/litweb/pdf/5967-8554.pdf

[Bicurico]

Here how to enable/disable the 001 option (75 Ohm): "Opt 001 75 W Input (HP 8590L only)"

Enabled = 75 Ohm RF Input
Disabled= 50 Ohm RF Input

I have not tested this (is not even available for my model), but got these from the Keysight forum. This is useful in case the RAM contents are lost. If you have a 75 Ohm device, it would default to 50 Ohm and CAL would fail.

Enable 75 Ohm:

Preset
Frequency -2001 Hz
Amplitude, More 1 of 2
Input Z 75-ohm
Amplitude, Scale Log Lin (Log), More 1 of 2 Amptd Units dBmV
Amplitude, Scale Log Lin (Lin), More 1 of 2 Amptd Units dBmV
Cal, More 1 of 4, More 2 of 4
Service Cal, Stor Pwr On Units

Disable 75 Ohm - enable default 50 Ohm:

Preset
Frequency, -2001 Hz
Amplitude, More 1 of 2, Input Z 50-ohm
Amplitude, Scale Log Lin (Log), More 1 of 2 Amptd Units dBm
Amplitude, Scale Log Lin (Lin), More 1 of 2 Amptd Units dBm
Cal, More 1 of 4, More 2 of 4, Service Cal, Stor Pwr On Units

Regards,
Vitor

[Bicurico]

I am now wondering if there are more "secret" key codes to activate other options...

What about firmware upgrades?

[MarkL]

I am now wondering if there are more "secret" key codes to activate other options...

What about firmware upgrades?

I'm not aware of any other hidden options like the gated analysis.

The firmware is all in EPROM.  Here's a document describing the various versions:

  http://literature.cdn.keysight.com/litweb/pdf/08590-90324.pdf

KO4BB has a good collection up to version L:

  http://www.ko4bb.com/getsimple/index.php?id=download&file=HP_Agilent/HP_859xE_859xE_series_SA_firmware_EPROM.zip

They don't have the latest version M with the Agilent logo (aawww...).

[Bicurico]

I am looking at the USER MEMORY dump I made using the USTATE? command.

I had some strange DLP's installed, which I unfortunately erased while trying to use the USTATE command to upload a backup.

Warning: using USTATE without the "?" is used to upload a user memory backup. If that fails (and it will fail in 99.9% of cases), you end up with a fresh deleted user memory.

Anyway, I think I had some calibration/support/service personality installed on my device and there are interesting passages in the DLP:

Here one program to check some fault:

Code: [Select]

IP;CF-2001HZ;CAL FREQ;
MOV S_TAT,STB?;
  IF S_TAT,GT,0,THEN
    CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
    PU;PA,100,100;TEXT%CAL. FREQ. **FAILED**%;
    PU;PA,100,90 ;TEXT%---------------------%;
    PU;PA,100,60 ;TEXT%PRESS [PRESET]       %;
    PU;PA,100,50 ;TEXT%PRESS [FREQ],-2001Hz,%;
    PU;PA,100,40 ;TEXT%& [CAL],CAL FREQ.    %;
    PU;PA,100,30 ;TEXT%...TO ISOLATE PROBLEM%;
    ABORT;
  ENDIF;
CAL AMP;
MOV S_TAT,STB?;
  IF S_TAT,GT,0,THEN
    CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
    PU;PA,100,80;TEXT%CAL. AMP. **FAILED**%;
    PU;PA,100,70;TEXT%--------------------%;
    PU;PA,100,50 ;TEXT%PRESS [PRESET]       %;
    PU;PA,100,40 ;TEXT%PRESS [FREQ],-2001Hz,%;
    PU;PA,100,30 ;TEXT%& [CAL],CAL AMP.     %;
    PU;PA,100,20 ;TEXT%...TO ISOLATE PROBLEM%;
    ABORT;
  ENDIF;
CAL STORE;

Notice the "IP;CF-2001HZ;CAL FREQ;" this must be the key sequence to do all sort of weird stuff...

Take a look at this thread, too: https://www.eevblog.com/forum/testgear/hp8590e-series-option-103-driver/

I will continue to write about hacking the device here...

Regards,
Vitor

[Bicurico]

I *think* I managed to rebuild the installed software, which I lost.

Code: [Select]

KEYDEF 101,W_ARM,%Warm Up |859x%;
KEYDEF 102,C_PU,%CPU Pre-|Test%;
KEYDEF 103,S_CAP,%Super   |Cap%;
KEYDEF 104,M_EAS,%Measure |Test%;
KEYDEF 105,I_NIT,%Init    |Test%;
KEYDEF 106,R_EVDATE,%DLP     |Revision%;

FUNCDEF S_TIME,@
I_NIT;
S_CAP;
M_EAS;
MENU 1;
@;

FUNCDEF M_EAS,@
C_HECK;
S_TIME;
E_LAPSE;
C_AL;
D_ONE;
MENU 1;
@;

FUNCDEF C_HECK,@
MOV C_LOCK,HAVE CNT;
IF C_LOCK,GT,0,THEN;
  IP;CF-2001HZ;CAL FREQ;
  MOV S_TAT,STB?;
    IF S_TAT,GT,0,THEN
      CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
      PU;PA,50,190;TEXT% PRE WARM-UP CAL. CHECK%;
      PU;PA,50,180;TEXT% ----------------------%;
      PU;PA,100,110;TEXT% --------------------- %;
      PU;PA,100,100;TEXT%|CAL. FREQ. **FAILED**|%;
      PU;PA,100,90 ;TEXT% ---------------------%;
      PU;PA,100,60 ;TEXT%PRESS [PRESET]       %;
      PU;PA,100,50 ;TEXT%PRESS [FREQ],-2001Hz,%;
      PU;PA,100,40 ;TEXT%& [CAL],CAL FREQ.    %;
      PU;PA,100,30 ;TEXT%...TO ISOLATE PROBLEM%;
      PU;PA,50,140;TEXT%$$$$ WARM-UP WAS NOT DONE $$$$%;
      ABORT;
    ENDIF;
  CAL AMP;
  MOV S_TAT,STB?;
    IF S_TAT,GT,0,THEN
      CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
      PU;PA,50,190;TEXT% PRE WARM-UP CAL. CHECK%;
      PU;PA,50,180;TEXT% ----------------------%;
      PU;PA,100,90;TEXT%  -------------------- %;
      PU;PA,100,80;TEXT%| CAL. AMP. **FAILED**|%;
      PU;PA,100,70;TEXT%  --------------------%;
      PU;PA,100,50;TEXT%PRESS [PRESET]       %;
      PU;PA,100,40;TEXT%PRESS [FREQ],-2001Hz,%;
      PU;PA,100,30;TEXT%& [CAL],CAL AMP.     %;
      PU;PA,100,20;TEXT%...TO ISOLATE PROBLEM%;
      PU;PA,50,140;TEXT%$$$$ WARM-UP WAS NOT DONE $$$$%;
      ABORT;
    ENDIF;
  CAL STORE;
ENDIF;
@;

FUNCDEF C_AL,@
IP;CF-2001HZ;CAL FREQ;
MOV S_TAT,STB?;
  IF S_TAT,GT,0,THEN
    CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
    PU;PA,100,100;TEXT%CAL. FREQ. **FAILED**%;
    PU;PA,100,90 ;TEXT%---------------------%;
    PU;PA,100,60 ;TEXT%PRESS [PRESET]       %;
    PU;PA,100,50 ;TEXT%PRESS [FREQ],-2001Hz,%;
    PU;PA,100,40 ;TEXT%& [CAL],CAL FREQ.    %;
    PU;PA,100,30 ;TEXT%...TO ISOLATE PROBLEM%;
    ABORT;
  ENDIF;
CAL AMP;
MOV S_TAT,STB?;
  IF S_TAT,GT,0,THEN
    CLRDSP;BLANK TRA;GRAT OFF;ANNOT OFF;MENU 0;
    PU;PA,100,80;TEXT%CAL. AMP. **FAILED**%;
    PU;PA,100,70;TEXT%--------------------%;
    PU;PA,100,50 ;TEXT%PRESS [PRESET]       %;
    PU;PA,100,40 ;TEXT%PRESS [FREQ],-2001Hz,%;
    PU;PA,100,30 ;TEXT%& [CAL],CAL AMP.     %;
    PU;PA,100,20 ;TEXT%...TO ISOLATE PROBLEM%;
    ABORT;
  ENDIF;
CAL STORE;
@;

FUNCDEF E_LAPSE,@
MENU 0;
REPEAT
  MOV T_REG,TIMEDATE;
  MOV T_IME,T_REG;
  DIV T_IME,T_IME,10000000000;
  MOV Y_EAR,T_IME;
  INT Y_EAR,Y_EAR;
  MOV T_IME,T_REG;
  DIV T_IME,T_IME,100000000;
  MOV M_ONTHS,T_IME;
  MPY Y_EAR,Y_EAR,100;
  SUB M_ONTHS,M_ONTHS,Y_EAR;
  INT M_ONTHS,M_ONTHS;
  MOV T_IME,T_REG;
  DIV T_IME,T_IME,1000000;
  MOV D_AYS,T_IME;
  MPY Y_EAR,Y_EAR,100
  MPY M_ONTHS,M_ONTHS,100;
  ADD T_EMP,M_ONTHS,Y_EAR;
  SUB D_AYS,D_AYS,T_EMP;
  INT D_AYS,D_AYS;
  MOV T_IME,T_REG;
  DIV T_IME,T_IME,10000;
  MOV H_OUR,T_IME;
  MPY Y_EAR,Y_EAR,100
  MPY M_ONTHS,M_ONTHS,100;
  MPY D_AYS,D_AYS,100;
  ADD T_EMP,M_ONTHS,Y_EAR;
  ADD T_EMP,D_AYS,T_EMP;
  SUB H_OUR,H_OUR,T_EMP;
  INT H_OUR,H_OUR;
  MOV H_REG,H_OUR;
  MOV T_IME,T_REG;
  DIV T_IME,T_IME,100;
  MOV M_IN,T_IME;
  MPY Y_EAR,Y_EAR,100
  MPY M_ONTHS,M_ONTHS,100;
  MPY D_AYS,D_AYS,100;
  MPY H_REG,H_REG,100;
  ADD T_EMP,M_ONTHS,Y_EAR;
  ADD T_EMP,D_AYS,T_EMP;
  ADD T_EMP,H_REG,T_EMP;
  SUB M_IN,M_IN,T_EMP;
  INT M_IN,M_IN;
  MOV T_IME,T_REG;
  MOV S_EC,T_IME;
  MPY Y_EAR,Y_EAR,100
  MPY M_ONTHS,M_ONTHS,100;
  MPY D_AYS,D_AYS,100;
  MPY H_REG,H_REG,100;
  MPY M_IN,M_IN,100;
  ADD T_EMP,M_ONTHS,Y_EAR;
  ADD T_EMP,D_AYS,T_EMP;
  ADD T_EMP,H_REG,T_EMP;
  ADD T_EMP,M_IN,T_EMP;
  SUB S_EC,S_EC,T_EMP;
  INT S_EC,S_EC;
    IF I_NDEX,EQ,0 THEN
      MOV S_REG,S_EC;
      PU;PA,95,40;TEXT%ELAPSE=   %;PA,175,40;TEXT% MINUTES%;
      PU;PA,135,30;TEXT%&   %;PA,175,30;TEXT% SECONDS%;
      MOV S_aveDa,DA;
      PU;PA,158,40;
      DSPLY,M_CNT,2.0;
      PU;PA,158,30;
      DSPLY,S_CNT,2.0;
      ADD I_NDEX,I_NDEX,1;
    ENDIF;
    IF S_REG,NE,S_EC THEN
      ADD S_CNT,S_CNT,1;
      MOV S_REG,S_EC;
    ENDIF;
    IF S_CNT,EQ,60,THEN
      SUB S_CNT,S_CNT,60;
      ADD M_CNT,M_CNT,1;
    ENDIF;
  MOV L_astDa,DA;
  MOV DA,S_aveDa;
  PU;PA,158,40;
  DSPLY,M_CNT,2.0;
  PU;PA,158,30;
  DSPLY,S_CNT,2.0;
  MOV DA,L_astDa;
{ds_sync()};
UNTIL (M_CNT >= W_RMUP);
CLRDSP;
@;

FUNCDEF I_NIT,@
IP;CF-2001HZ;CAL INIT;CAL FETCH;CAL STORE;TS;
BAUDRATE9600;KSP18;PLOTADRS5;
PSTATE0;PREFX%%;VARDEF _PRT;VARDEF _CLR;PRNTADRS1;PLT0;
CRTVPOS20;CRTHPOS8;KS<0;IP;
POWERON IP;
IP;CF-2001HZ;INZ 50;AUNITS DBM;LN;AUNITS V;LG;CAL UNITS;TS;
CF-2001HZ;CAL TIMEBASE 128;
CF-2001HZ;CALATNDATA 0,0,0,0,0,
PREAMPG 0;
AMPCOR 30GHZ, 0DB;AMPCOR OFF;
GRAT OFF;ANNOT OFF;BLANK TRA;MENU 0;
PU;PA 100,115;TEXT%  INITIALIZATION COMPLETE       %;
PU;PA 100,105;TEXT%============================%;
PU;PA 100,95;TEXT%- DEFAULT CAL DATA LOADED       %;
PU;PA 100,85;TEXT%- TIMEBASE DEFAULTED TO 128      %;
PU;PA 100,75;TEXT%- CAL ATTEN DEFAULTED TO 0'S     %;
PU;PA 100,65;TEXT%- PRE-AMP GAIN DEFAULTED TO 0'S   %;
PU;PA 100,55;TEXT%- AMP CORRECTION DEFAULTED TO 0'S  %;
WAIT 2;IP;MENU 1;
@;

FUNCDEF R_EVDATE,@
GRAT OFF;ANNOT OFF;BLANK TRA;MENU 0;
PU;PA 50 185;TEXT%      LASTEST DLP REV. DATE: 01/12/97%;
PU;PA 50,60;TEXT%          PRESS ENTER AFTER VIEWING%;
HD;EP;MPRST;
MN1;
@;

FUNCDEF S_CAP,@
$;ANNOT OFF;GRAT OFF;BLANK TRA;CLRDSP;MN0;CSIZE 1,1;PU;PA; 200, 50;PD;PR;110,70;90,0;0,-70;-25,0;0,-15;25,0;0,-40;-200,0;0;55;PU;10,-50;TEXT%o%;PU;150,100;TEXT%o%;DRAWBOX  250, 35, 265, 25,5,5;CSIZE;PU;PA; 125, 135;PD;PR;55,0;70,-100;4,10;-4,-10;-15,5;PU;PA;120,200;TEXT%Verify Super-Cap Voltage%;PU;PA;120,190;TEXT%========================%;PU;PA;-10,170;TEXT%- Lift the edge of the shield on%;
PU;PA;-10,160;TEXT%  the memory board.%;
PU;PA;-10,150;TEXT%- Touch the test fixture probe to%;
PU;PA;-10,140;TEXT%  the square pad of C1 on the%;
PU;PA;-10,130;TEXT%  memory board.%;
PU;PA;-10,120;TEXT%- The LED in the%;
PU;PA;-10,110;TEXT%  test fixture must%;
PU;PA;-10,100;TEXT%  light for the board%;PU;PA;-10,90;TEXT%  to PASS.%;PU;PA;-10,80;TEXT%- Press ENTER when done.%;HD;EP;MPRST;MN1;
@;

FUNCDEF D_ONE,@
MENU 0;
BLANK TRA;ANNOT OFF;GRAT OFF;CLRDSP;
PU;PA,100,150;TEXT%WARM-UP DONE%;
PU;PA,160,120;TEXT%CAL. FREQ/AMP DONE%;
PU;PA,250,25;TEXT%PRESS ENTER TO EXIT%;
PU;
PA;100,100;PD 100,150;
150,150;100,100,100;
150,150;100,100,100;
150,150;150,100,100,100;
PU;
EP;IP;MENU 1;
ANNOT ON;
TITLE%WARM-UP DONE%;
ERASE;
@;

FUNCDEF C_PU,@
VARDEF F_FLAG,0;
TRDEF TRA_A,401;
VARDEF ADC_LO,0;
VARDEF ADC_HI,8000;
VARDEF F_HI,0;
VARDEF F_LO,0;
DET GND;TS;MOV ADC_LO,MEAN TRD;PU;PA 150,45;
TEXT%ADC GND=%;PU;PA 250,45;DSPLY ADC_LO,5.0;
PU;PA300,45;IF ADC_LO,GT,135 THEN TEXT%FAILED%;
MOV F_FLAG,1;MOV F_LO,1;ENDIF;
PU;PA300,45;IF ADC_LO,LT,45 THEN TEXT%FAILED%;
MOV F_FLAG,1;MOV F_LO,1;ENDIF;
IF F_LO,EQ,0 THEN TEXT%ok%;ENDIF;
DET REF;TS;MOV ADC_HI,MEAN TRD;PU;PA 150,35;
TEXT%ADC 2V =%;PU;PA 250,35;DSPLY ADC_HI,5.0;
PU;PA 300,35;IF ADC_HI,LT,3430;THEN TEXT%FAILED%;
MOV F_FLAG,1;MOV F_HI,1;ENDIF;
PU;PA 300,35;IF ADC_HI,GT,3630;THEN TEXT%FAILED%;
MOV F_FLAG,1;MOV F_HI,1;ENDIF;
IF F_HI,EQ,0 THEN TEXT%ok%;ENDIF;
GRAT OFF;BLANK TRA;MENU 0;
PU;PA 150,25;TEXT%ENTER DATE:%;DATEMODE MDY;
TIMEDSP ON;SETDATE EP;PU;PA 260,25;TEXT%Done%;
PU;PA 150,15;TEXT%ENTER TIME:%;
SETTIME EP;PU;PA 260,15;TEXT%Done%;
IF F_FLAG,EQ,0 THEN
IP;
GRAT OFF;ANNOT OFF;BLANK TRA;MENU 0;
PU;PA 50,175;TEXT% ******* CPU PRETEST PASSED ******** %;
PU;PA 50,135;TEXT%           CYCLE THE POWER           %;
PU;PA 50,115;TEXT%      TO ENSURE THE CPU COMES UP     %;
PU;PA 50,95;TEXT%       WITH THE CORRECT DISPLAY       %;
ELSE
IP;
GRAT OFF;ANNOT OFF;BLANK TRA;MENU 0;
PU;PA 50,185;TEXT%      FAILED .................       %;
PU;PA 50,175;TEXT%      ............FIX & RETEST       %;
PU;PA 50,155;TEXT%      PRESS ENTER TO EXIT SCREEN     %;
ENDIF;EP;IP;MENU 1;
@;

FUNCDEF W_ARM,@
GRAT OFF;ANNOT OFF;BLANK TRA;
CLRDSP;
PU;PA,15,190;TEXT%********** WARM-UP DLP ************%;
MOV T_REG,TIMEDATE;
MOV T_IME,T_REG;
DIV T_IME,T_IME,10000000000;
MOV Y_EAR,T_IME;
INT Y_EAR,Y_EAR;
PU;PA,45,130;TEXT%START TIME= 19%DSPLY Y_EAR,2.0;TEXT% YEAR%;
MOV T_IME,T_REG;
DIV T_IME,T_IME,100000000;
MOV M_ONTHS,T_IME;
MPY Y_EAR,Y_EAR,100;
SUB M_ONTHS,M_ONTHS,Y_EAR;
INT M_ONTHS,M_ONTHS;
PU;PA,157,120;DSPLY M_ONTHS,2.0;TEXT% MONTH%;
MOV T_IME,T_REG;
DIV T_IME,T_IME,1000000;
MOV D_AYS,T_IME;
MPY Y_EAR,Y_EAR,100
MPY M_ONTHS,M_ONTHS,100;
ADD T_EMP,M_ONTHS,Y_EAR;
SUB D_AYS,D_AYS,T_EMP;
INT D_AYS,D_AYS;
PU;PA,157,110;DSPLY D_AYS,2.0;TEXT% DAY%;
MOV T_IME,T_REG;
DIV T_IME,T_IME,10000;
MOV H_OUR,T_IME;
MPY Y_EAR,Y_EAR,100
MPY M_ONTHS,M_ONTHS,100;
MPY D_AYS,D_AYS,100;
ADD T_EMP,M_ONTHS,Y_EAR;
ADD T_EMP,D_AYS,T_EMP;
SUB H_OUR,H_OUR,T_EMP;
INT H_OUR,H_OUR;
MOV H_REG,H_OUR;
 IF H_OUR,LT,1 THEN
   ADD H_OUR,H_OUR,12;
   SUB A_MPM,A_MPM,1;
 ENDIF;
 IF H_OUR,EQ,12 THEN
   ADD A_MPM,A_MPM,1;
 ENDIF;
 IF H_OUR,GT,12 THEN
   SUB H_OUR,H_OUR,12;
   ADD A_MPM,A_MPM,1;
 ENDIF;
 IF A_MPM,EQ,-1 THEN
   PU;PA,157,100;DSPLY H_OUR,2.0;TEXT% AM%;
 ENDIF;
 IF A_MPM,EQ,0 THEN
   PU;PA,157,100;DSPLY H_OUR,2.0;TEXT% AM%;
 ENDIF;
 IF A_MPM,EQ,1 THEN
   PU;PA,157,100;DSPLY H_OUR,2.0;TEXT% PM%;
 ENDIF;
MOV T_IME,T_REG;
DIV T_IME,T_IME,100;
MOV M_IN,T_IME;
MPY Y_EAR,Y_EAR,100
MPY M_ONTHS,M_ONTHS,100;
MPY D_AYS,D_AYS,100;
MPY H_REG,H_REG,100;
ADD T_EMP,M_ONTHS,Y_EAR;
ADD T_EMP,D_AYS,T_EMP;
ADD T_EMP,H_REG,T_EMP;
SUB M_IN,M_IN,T_EMP;
INT M_IN,M_IN;
MOV M_REG,M_IN;
PU;PA,157,90;DSPLY M_IN,2.0;TEXT% MINUTES%;
MOV T_IME,T_REG;
MOV S_EC,T_IME;
MPY Y_EAR,Y_EAR,100
MPY M_ONTHS,M_ONTHS,100;
MPY D_AYS,D_AYS,100;
MPY H_REG,H_REG,100;
MPY M_IN,M_IN,100;
ADD T_EMP,M_ONTHS,Y_EAR;
ADD T_EMP,D_AYS,T_EMP;
ADD T_EMP,H_REG,T_EMP;
ADD T_EMP,M_IN,T_EMP;
SUB S_EC,S_EC,T_EMP;
INT S_EC,S_EC;
MOV S_REG,S_EC;
PU;PA,157,80;DSPLY S_EC,2.0;TEXT% SECONDS%;
@;


Sending this up through GPIB will create the menu entries and DLP.

I think this is some service/diagnose personality.

This shows that one can rebuild most of the stuff from the USTATE? dump. The difficult part is to actually guess the filenames!

I'm pretty happy that I got this back to work - for no particular reason.

My only doubt is if some DLP or commands within require variables I have not created.

I would like to suggest to describe personalities like the above code, as it can be sent to the device with great ease - I think I could use Keysight Interactive IO and just do a COPY&PASTE and it would work.

Regards,
Vitor

[Bicurico]

https://vma-satellite.blogspot.com/2019/03/vma-simple-spectrum-analyser-hpagilent.html

[xwarp]

Here how to enable/disable the 001 option (75 Ohm): "Opt 001 75 W Input (HP 8590L only)"

Enabled = 75 Ohm RF Input
Disabled= 50 Ohm RF Input

I thought that I had read somewhere that there were some components that had to be changed out for the 75 ohm to 50 ohm use.

[kawal]

nice software.
I just got a broken 8591A which I managed to repair (power switch was defective). I will try the  software you provided. I assume this is over GPIB  ?

[Bicurico]

Yes. And you need to install Keysight Connection Expert 2018.

Regards
Vitor

[kawal]

do i need to register the software anywhere ?  Tried it and asking for a code.

[the Chris]

The two cables are part numbers 08591-60077 and 08591-60076 if you want to search around for them.  But they are just ordinary 50-ohm SMB right angle to BNC jumper cables that you can easily make yourself.

I just did the upgrade with third-party cables but could not find any info about the required length so after some guesswork, I ordered a pair of 20cm and 30cm.

It turns out, the 20cm will only fit if you take the shortest route from BNC through holes on the backplate to the terminals on the board. While this works with maybe the slightest squash, it kind of feels wrong.

Taking the intended route where all other cables are going will require the 30cm cables and they fit just fine with maybe 2cm of reserve which helps in sorting their position in the passage.

The amount of space available for the rear end assembly of the BNC terminals is limited and while the ones I bought work fine, it looks wrong so opt for short versions if available.

Hope this helps those that seek to implement ready-made cables.

[hp3310a]

I'll point out there is a command call "USTATE?" which appears to dump everything in the SA, including what was loaded by the card.  In theory I think it can be used to transplant the personality, but I couldn't get it to work.  I think something was wrong with the format of the dump I captured.  Pushing it into the target always failed.  Perhaps someone else can try with better luck.

What is the expected size of the blob returned by "USTATE?"? I was kind of expecting 512KBytes, but I only get 4810 bytes back?

I know this is an old thread but what can I do, this all is new to me.

[MarkL]

USTATE doesn't dump the whole raw SRAM.  The size depends on what's loaded and is supposed to be all the data structures necessary to fully restore the unit's operational state to the time of the USTATE snapshot.

After doing a "ERASE MEM ALL", "USTATE?" returns 7008 bytes on my 8595E.  This includes 4 bytes of "A#" header and a CR/LF at the end (although I think my utility is adding the CR/LF).  The size of the data block, indicated by the two bytes after "A#" in big-endian format, is 7002 bytes.  When I have the EMC personality loaded, the total size returned is 53962 bytes (actual data block size is 53956).

Check the "A#" header to make sure your GPIB interface didn't eat any bytes somewhere, but I wouldn't be surprised if it was different on different models.

If you want to dump the raw SRAM, you'll need to use the undocumented MRDB command (equivalent of peek).

[hp3310a]

Check the "A#" header to make sure your GPIB interface didn't eat any bytes somewhere, but I wouldn't be surprised if it was different on different models.

Ah, OK, thanks! My output is 4810 bytes and the header is saying 4804, I too have a 0D0A at the end. Maybe the length is excluding header and final CRLF (4+2)?

All in all, seems to be working OK then, thanks a lot for the info. I wish I had done this before installing the new firmware.

If you want to dump the raw SRAM, you'll need to use the undocumented MRDB command (equivalent of peek).

I just tried

MBRD 16252928 524288

and it worked without throwing errors. However, the binary I get is just 32771 bytes instead of 512K. The dump has a #A header like for USTATE which states 0x7FFF/32767 size (again 4 less than the blob's size). The contents is just one endless sequence of 0x51 0xC8 two bytes over and over again. Only the last byte is different at 0x4E (*). That doesn't look like it worked.

(*) It does not have 0x0D0A at the end, so the that in USTATE might come from the analyzer.

[MarkL]

The MBRD command has a bug in it (and possibly other memory commands as well), that it can't return more than 32768-1 = 32767 bytes per data block.  This was discussed somewhere, maybe on the HPAK groups.io.

You have the starting address right.  To keep things simple, you can retrieve 16384 bytes at a time, 32 times, and then concatenate the results.  When I tried this some years ago, it almost worked.  The very last block at address 16760832 failed and never returned.  Retrieving smaller chunks, like 256 bytes at a time, for the very last block worked fine for most of the chunks, but some chunks would never return, and others would either lock up the SA or reboot it.  And with some chunks, I could hear the attenuator clicking.  I highly suspect that the last block, 0xffc000 thru 0xffffff, overlaps with some I/O, but I never dug far enough to prove it.   I couldn't think of any other reason why a passive SRAM read would cause that kind of trouble.  Others reported some of the same issues using MBRD on high memory.

If you try it, let us know how it behaves for you.

[hp3310a]

The MBRD command has a bug in it (and possibly other memory commands as well), that it can't return more than 32768-1 = 32767 bytes per data block.  This was discussed somewhere, maybe on the HPAK groups.io.

Many thanks, that makes total sense. The length is only 2 bytes, so it's probably not designed to deliver more.

I put this into a little script and about half of the memory gets read up to the first crash at 0xfbc600. Starting at this section of memory reading does weird stuff to the SA, including clicking attenuators and a display that doesn't make sense. From 0xfbe000 to 0xffc400 it worked, but then started crashing again. That's the last portion you described as "difficult". I noted the hairy parts down in the script.

I couldn't get through any of the "crash sites", even with 16-byte or 1-byte chunks. Restarted 512 bytes after, then it worked again for a bit.

Certainly interesting to be able to read the memory, utility is probably not great.

Code: [Select]

#!/usr/local/bin/python3

# Reads the memory of a 8590E series spectrum analyzer
# and if successful stores it in a file called "readram859xE.bin"
# Development made possible by helpful tips from MarkL
# [url]https://www.eevblog.com/forum/testgear/hacking-old-hp-spectrum-analyzers/msg6161061/#msg6161061[/url]

import pyvisa
import sys

rm = pyvisa.ResourceManager()

# address of the spectrum analyzer
inst = rm.open_resource('TCPIP::10.0.0.150::gpib,18::INSTR')
inst.read_timeout = 10000;

chunksize=1024
start=16252928 # 0xF80000
totalsize=524288 #0x80000

# reading will fail or will cause the SA to do really weird things at
# various address blocks, on mine they are:
#
# 0xfbc600 / 512
# 0xfbd600 / 512
# 0xfbe600 / 512
# 0xfbf600 / 512
# 0xfbc600 / 512

# 0xffc400 / 512
# 0xffd400 / 512
# 0xffe400 / 512
# 0xfff400 ...

address=start

totalMem = bytearray()
mem = bytearray()
readfailed = False

# "MBRD <start_address> <length>"
# "MBRD 16252928 524288"

while (address < (start + totalsize)):
    print(f"Reading {address:x} {chunksize:x} ... ", end='')

    inst.write(f"MBRD {address} {chunksize}")
    mem=inst.read_raw()
   
    # the returned memory chunk comes with a 4-byte header "#Axx", xx is the chunk length
    if (len(mem) == (chunksize + 4)):
        mem = mem[-chunksize:]
        totalMem.extend(mem)
        readBytes = len(totalMem)
        print(f"read, total: {readBytes}")
        address = address + chunksize
    else:
        print("failed, aborting")
        readfailed = True;
        break
       
inst.close()

if (not readfailed):
    with open("./readmem859xE.bin", "wb") as file:
        file.write(totalMem)


[bateau020]

Got a 8594E that has a card called "option 050" installed inside (and wired up), but it doesn't show up on screen as an installed option. Is there any hack like with option 105 that will re-enable it? Or should I just ignore it? Am on FW 930506, series 3336U.

[hp3310a]

According to the "Agilent 8590 C/E/L/Q and EM Series Spectrum Analyzers and Accessories Configuration Guide", 050 is the "Improved amplitude accuracy for NADC-TDMA/PCS bands". Not that I know what that is.