HP 3468A owners UNITE: a storm is coming! But together we found the solution!

[Kjelt]

Dear HP3468A owners,

perhaps this is a bit of an extravagant topic title but at least we got your attention and that is exactly what we want and need.
Who are we? Well at least me Kjelt and Sailor and who knows how many others, that have a defective HP3468A unit. 

We have found out that there is a sleeping defect waiting to happen inside these units: the U502 ROM, which contains the program memory, is dying (losing its content).
Yes we know that this is normal for these kind of old school ROMs and can be expected after 30 years of operation.

The problem is: there is no copy of the original program code available... anywhere.

This post is first a warning call that this might happen anytime with your unit as well: it is not a question of IF but WHEN.
Second this is a request for help for anyone willing and able to read out the U502 ROM from his/her unit in order to preserve these units from the scrapyard in the future.

So if you:

- still have a 100% operating HP3468A
- have the skills to safely desolder U502
- the means to read out the ROM contents

and willing to help us and safe your own unit yourself for the near future, please do   

Kjelt and Sailor.


Previous topics:
https://www.eevblog.com/forum/testgear/hp3468a-rom-contents-of-u502/msg370690/#msg370690
https://www.eevblog.com/forum/testgear/hp-3468a-in-continual-resetinit/msg424323/#msg424323

[Deathwish]

This may be of use, I have no idea.

https://www.febo.com/pipermail/volt-nuts/2011-August/000971.html

[Sailor]

Yes, the yahoo Agilent group is very good. Unfortunately, it seems that no one has ever copied this particular ROM.

Thanks to Kjelt for starting this thread, we hope that the subject heading will attract a bit more attention than the fairly bland title on the thread that we have been pursuing for a while now.

Kjelt's technique for reading the ROM is direct and to the point. However, for those who *do* have a functioning 3468A but who may also be a little reluctant to remove the ROM from the board, there are alternatives. The first is quite straightforward; Instead of touching the ROM, remove U501 (the 8039 CPU) and instal a socket in its place. The removal can be as simple as 'clip the legs, and desolder one pin at a time'. A replacement 8039 will cost you the princely sum of $1.49 at Jameco. Then hook up an Arduino to the socket and read and dump the ROM contents. Remove the Arduino, reinstall the 8039, and you're good to go again! I used my EtherMega Arduino, but I will investigate other variants, and provide the code and any other help that I can.

Other techniques that are even less invasive only provide partial access to the ROM, although I am still pursuing them. It will be really nice if I can find a way...

Please use this thread, or PM Kjelt or me, if you can help.

Thanks, Sailor.

[PTR_1275]

I am guessing the 3478 is going to be in a similar boat? Do you know if there is any difference in the ROM from a 3468 to a 3478?

As far as I can tell the difference between the 2 is the rear terminals. Both have GPIB, is there something obvious I am missing here??

I have 2 3478s that are in good working order, both have just recently had the batteries replaced, one is definitely older than the other (It has metal vents down the side). Do you know what the issue causing the failures is, or is it just that the units are getting old and the ROM is failing?

I would love to help, however, I have no experience in getting ROM contents, I don't have any arduino experience either so may not be much help.

-Chris

[Smokey]

Ebay sold listings show they go for around 50-60 bucks pretty regularly.  (cheapest one up now is 150)  It wouldn't be too much of an investment to just get another working unit, read out the rom, post it to the interwebs, and use that to fix all the existing units.  It would be nice if someone was willing to take on the project and use the unit they already have, but for 50 bucks you can just do it yourself.  And you can add to your test equipment collection.... You can never have too many vintage multimeters, or so I hear  
(For full disclosure... My name is Smokey, and I have a vintage Keithley bench meter addiction.  If it's brown, I probably have a couple on my shelf)

[Melt-O-Tronic]

I have both a fully functional 3468A and a 3478A and the willingness to do it.  Unfortunately, a good desoldering gun and a reader/programmer like a TL866 are the next acquisitions on my list because I just dumped the budget into GPIB gear.  So I probably won't be helpful in a timely manner.     I'm with you in spirit though!   

[Sailor]

PTR_1275, you are in luck. The short answer is that ko4bb (http://www.ko4bb.com/getsimple/index.php?id=manuals&dir=01_ROM_Images_and_Drivers) has the ROM dump for the 3478 . The longer answer is that the 3478 is dramatically different inside. The 8039 is now relegated to general communication, presentation, etc, and there is a (mask-ROM'd) 8048 handling the ADC etc. The 8039 ROM is still a Mostek 36000 device. I don't think there is any way of getting to the contents of the ROM inside the 8048, so that's still a vulnerability. No, I have never seen the mechanism of the Mostek failure explained. Almost certainly (IMHO) it is related to a deficiency in the silicon fabrication process.

I'm a recent user of the Arduino - I've lived and breathed Atmel AVR for the last 20 years, so the transition from 'rolling your own' (which is what I have been doing since the '60s)  to finding ways to use a standard board wasn't too difficult. But the big attraction of Arduino is the enormous amount of software that is available. Test the water, dip your big toe in, it's really easy to get started.

If you know anyone who does have a 3468, please point them in our direction

Regards

[MadTux]

Unsoldering the ROM won't be much of an issue if a heatgun (those to remove paint) is used to evenly heat the general ROM area to solder melting point and then pulling the ROM with some tweezers. Have done it several times (also to some 40 pin CPUs), never had a problem doing it. You just have to be patient and don't heat it to quickly (be too close with the muzzle of heatgun to the board), or the board will get burned.

Note that the Mostek ROM (these fail quite often,like in HP 3456A, probably by purple pest (AuAl alloy that has no mechanic strengt), because gold bonding wires are used on aluminium pads) has different pinout (24 pin Mostek to 28pin 27C64) than classic 27C64, so you'll need to rewire or build adapter to replace that Mostek with a 27C64. Reading the Mostek on adapter as a 27C64 will probably just work fine with the usual programmers (Willem or Tl866).

Unfortunately I don't have a HP 3468A (have enought meters already  ), but if someone wants to donate me one, I would happily accept the challenge of dumping the ROM.

[Sailor]

Well, thank you Melt-O-Tronic and MadTux, it looks like community spirit is alive and well  

My concerns about removing the ROM by any method is related to the inevitable heat stress that will be placed on the device, possibly aggravating a latent problem - hence my favored method of replacing the CPU with a socket, etc etc. I would hate it if a good samaritan removed their ROM from a functioning instrument only to find that they have destroyed it in the process

I will continue to work on a less invasive method.

[Melt-O-Tronic]

Yessiree.  I too was thinking that a bulk heating method of removal could put a shaky ROM over the edge.  I don't mind trying with a vacuum gun as soon as I land one though -- I figure if I fail & destroy my ROM, someone else will succeed, then I could fix what I broke.   

I suppose that clipping on to the ROM in-circuit with the CPU also present wouldn't work, would it?

[Sailor]

I suppose that clipping on to the ROM in-circuit with the CPU also present wouldn't work, would it?

That was my first idea too. You could lift pin1 on the 'ls373 address latch and pull it high. That would tri-state its output so that you could apply A<7:0> to the ROM. A<12:8> are driven by P2 and P1 bits, which are in the 'weak pullup' state when the 8039 is held in RESET. /PSEN is also held high, but is isolated from the /CE of the ROM by a 1k resistor, so that can also be over-ridden. But unfortunately the 8039 also drives the BUS (Data<7:0>) low while in RESET. I stopped thinking about it any further at that point, but I've always intended to investigate how strong the 'low' drive is, with the idea that the ROM *may* be able to still drive the bits high enough to be at least detectable, even if not to proper logic levels. The duty cycle could be kept low. However, the ROM output drive is only rated to supply 220uA at 2.4V, and they don't specify a short-circuit current. The other aspect of this method is that it also is stressing the wire bond joint, and MadTux tells us it's that joint which is the source of the problem.

Life wasn't meant to be easy...

Edit: Of course you could always nick the D<7:0> lines, read the ROM, then bridge the lines again. But the purist in me chokes at that

[Sailor]

@MadTux

My brain has just surfaced for a reality check. If the problem was solely related to the wire bonds, then you would expect either a solid D<x> error, or addressing errors, or intermittents of either of these. But I can read the ROM in my 3468 until the cows come home, and get the same data (which is 99.9% correct) every time. So I's say there is another problem as well, at the bit level.

[Mr Simpleton]

Removing a DIL is usually just matter of using plenty of flux and a fresh bit of solder wick... and of course a really good soldering iron, i.e Metcal, Weller or JBC. I have done this numerous times, and using plenty of flux makes the difference!

Now reading this old ROM, is another story, the suggested CS866 may not be up to the task. This is a very simple device and I suggest using a reader with better track record if the CS866 fails, i.e. an old Data I/O or similar.

[sync]

But I can read the ROM in my 3468 until the cows come home, and get the same data (which is 99.9% correct) every time. So I's say there is another problem as well, at the bit level.

Is Kjelt's ROM readable too? Maybe you can compare the images and locate the rotten bits.

[MarkL]

There's a 3468A on ebay that's up in 5 days for $50 + shipping.  If no one else bids on it, I'll buy it and read the ROM.

I don't really need a 3468A, so if it checks out ok after re-assembly I'll resell it here on Buy/Sell/Wanted for what I paid.

[MadTux]

I've just opened up another bad Mk36000 from a repaired HP 3456A that I had in my parts box. Couldn't find bad wire bondings in this one (but also no obvious other faults like melted discharge spots), so this theory might be wrong. But I have opened chips from similar generation (broken HP-8165A VCA output amp), where the bonding wires just could be wiped from the surface of the chip.

Any idea what storage method is used in this one? Always thought they were mask programmed, but these storage cells don't look much like that (look quite regular to me), more like diode anti fuse?

[Sailor]

Hey, MarkL, that would be great. I've been looking at that one also, but then it more than doubles the cost to ship it to Australia.

If you can get it for that price, we'll owe you a beer... or two... or three... or... 

[Sailor]

@sync
No, unfortunately Kjelt has only been able to get 0xff out of his.

[Sailor]

@MadTux
Nice pic, what microscope do you have?

BTW, I looked at your 3456A fix. Good work, looks like you know how to get your hands dirty..

[MadTux]

High end old skool microscope I got from grandfather years ago   You just put camera in macro mode and put it where your eye is and take a picture. Works OK so far, still makes better images than most crap from china. So I'll just use that until I find myself a Zeiss Axioplan (had one at work a while back, and it was glorious) or something similar one day. Unfortunately, these things are badly expensive, even used/trashed ones on ebay.

[Deathwish]

I have camels. lots of sexy good looking camels, sell me this microscope for a camel ....

[MadTux]

Can you send camel by USPS? If so, you have a deal

[Deathwish]

Deal is done, U send scope to Nigeria yes ?.

[mikeselectricstuff]

I'm not familair with that memory device, however it can be possible to read a dying EPROM by lowering the supply voltage. The threshold of the read amps is proportional to the supply voltage, so reducing it may allow marginal data to be recovered.
(Eprom programmers typically use a similar technique, verifying at high Vcc to ensure there is some margin) The question is how low can the supply be and have the logic still work - for a device that has only just died, assuming the issue is charge leakage, then it ought to be possible to recover like this.

[lincoln]

I have an eprom burner and am willing to help if some one has a meter that is close.