Re: HP 4957A Protocol Analyzer - Option 001 High Speed Data Capture?

[ndemarco]

Hello,

I picked up the cute little HP 4957A recently for a few reverse engineering projects, and to have a little bit of fun. One of the projects runs at 115,200 baud. Unfortunately, the 4957A max speed for for bit oriented protocols is 64 kbits/sec. There is an Option 001 for high speed data capture.

From my thorough look at the internals, I'm thinking this would be either a ROM change or a software application. Does anyone know more about the High Speed Data Capture option?

Nick

[gslick]

I have an HP 4957A with Option 001. I have no idea what differs between an HP 4957A with and without Option 001.

What are the part numbers on the labels of the programmable devices on your HP 4957A?

There are some images of two different HP 4957A versions here:
https://www.curiousmarc.com/instruments/hp-4957a-protocol-analyzer

My HP 4957A is closer to the second one there, except:

• The part labeled 04957-19051 there is missing the label on mine. The label probably just fell off and got lost. Can't be sure without removing the part from mine to dump its contents to compare to the 04957-19051 dump there.
• The part labeled 04957-19049 there is labeled 04957-19052 on mine.
• The parts labeled 04957-19002 and 04957-19015 there are both labeled 04957-19062 on mine.
• The 8 way switch next to the part labeled 04957-19050 might have different settings. On mine switch 8 is to the right (away from the LEDs), switches 1 through 7 are all to the left.

I didn't take a careful look to see if there might be any other differences.

[gslick]

Just took a quick look at the HP 4957A Protocol Analyzer Operating and Reference Manual.

On Page 2-20 it says "High Speed Capture is a ROM based application that is available only in the HP 4957A with Option 001. You can capture data at speeds above 64 kbps."

So maybe it is only a firmware difference between an HP 4957A with and without Option 001.

[ndemarco]

I have exactly the same ROM part IDs as Marc's A0002 version. For reference, my serial is 3235A03736, with main board serial 0791A05804.

Nice eyeballing. I missed the narrow switch bank part. My switches are configured the same (1-7 are against the arrow, so off; where 8 is with the arrow - on?).


-19001
-19002
-19015
-19044
-19049
-19050
-19051

So it appears this is the matrix:

No option / Option 001
-19001
-19002 / 19062
-19015 / 19062
-19044
-19049 / 19052
-19050
-19051 / ?

Can we get a ROM dump from you of the ?, the 2x 19062 - interested to see if they diff at all, and 19052?

[gslick]

The 04957-xxxxx N27C010 part dump from my HP 4957A does not match Marc's 04957-19051 dump.

The two 04957-19062 M27C1001 parts in my HP 4957A read with identical binary dumps.

Attached below:
04957-19052_M27C1001.BIN
04957-19062_M27C1001.BIN
04957-xxxxx_N27C010.BIN

Mouser has a very small number of AT27C010 PLCC parts in stock at the moment, none at DigiKey. If you program some with these binary dumps and give it a try, let us know if it works for you with your 4957A.


The power supply in my HP 4957A has died since the last time I powered it on so I can't do any run time experimenting with it currently. At least one dead bootstrap power capacitor for the M51995P switching controller IC. Hope that is the only one I have to replace.

[gslick]

I have exactly the same ROM part IDs as Marc's A0002 version. For reference, my serial is 3235A03736, with main board serial 0791A05804.

Mine is 3125A00106 / 0791A06680

[ndemarco]

I've ordered a bunch of OTP EPROMS. I'd also think the 28-series EEPROM and 29F-series flash PROMs would work.

FYI, all mine are 150 ns. Some are AMD 27C010-150JC. Others are ST M27C1001-15C1.

When I can get these programmed, I'll report back.

[ndemarco]

I programmed four EPROMs, verified them, and placed them in the corresponding sockets. Unfortunately, I got the screaming beep of utter panic at power on.

I've attached a photo of the board to show where I put the EPROMs. The unmarked PROM is the XXXX one, of course.

Lastly, I re-verified the EPROMS with the TL866-II programmer. They verified correctly, and I can definitely see 8-bit text in the hex data.

I also verified some of my original EPROMs against Marc's. I'm verifying correctly.

I see no other DIP switches, and mine are configured as yours are. I do see two jumpers near the CRT section. Both of mine are closed. I've played with one, and it disables the CRT. I'd imagine it keeps the high voltage section off during development and test.

Ideas?

[gslick]

I've attached a photo of the board to show where I put the EPROMs. The unmarked PROM is the XXXX one, of course.

Photo didn't get attached?

[ndemarco]

Sheesh. You're quick!

[free_electron]

That thing is such a frankenweenie... two Z80 processors , an 68000 processor, a 80188 procesor and a 8051 ( the intel plcc with hp part number engraved is a mask 8051).

you have to be stark raving mad to develop firmware for that..

[gslick]

Is the pin 1 dimple and beveled corner on one of the 04957-19062 parts towards the CRT when they should be away from the CRT?

Hard to tell from the photo about the other 04957-19062 part. The pin 1 dimple and beveled corner should be on the right. Don't see the dimple, and can't tell which corner is beveled.

[ndemarco]

Thought I was at the age to need glasses - or not. Now I know I need the glasses.

After inserting the chips correctly, the device boots normally. Humbling.

I'll do more work with the device tomorrow, but a quick look shows nothing different for the speeds.

[ndemarco]

Success!

Option 001 High Speed Data Capture is now installed and runs. The 4957A really is an odd mashup. You must run the ROM application HS_Capture to get the higher speeds.

Note: High speed capture does not work on the RS-232 interface.

[petermesstorff]

Hello ndemarco,
I also picked up a HP 4957A  Protocol Analyzer and would like to upgrade from A0001 to A0002 version.
I would like to know which type of EPROMS you used and what programmer you can recommend (TL866-II)?

Peter

[gslick]

Hello ndemarco,
I also picked up a HP 4957A  Protocol Analyzer and would like to upgrade from A0001 to A0002 version.
I would like to know which type of EPROMS you used and what programmer you can recommend (TL866-II)?

Peter

If you want to buy current production parts from major suppliers (e.g. Mouser or Digi-Key) you are pretty much limited to Microchip AT27C010-45JU or AT27C010-70JU parts. Unfortunately they appear to be out of stock from all major suppliers, and from Microchip directly until around the end of 2023 or early 2024.

If you don't want to wait that long, you don't have too many choices other than trying you luck buying AT27C010-70JC parts on eBay and hoping that they are legitimate parts that have never been programmed. OTP parts that have already been programmed are obviously just e-waste.

I use a BP Microsystems BP-1610 myself for device programming (or a Data I/O UniSite for some ancient devices). I don't have any experience using a TL866-II.

[aeg]

Future Electronics has SST39SF020A-70-4C-PHE in stock: https://www.futureelectronics.com/p/9872987


Edit: Oh, this is PLCC? Mouser and Digi-Key both have SST39SF020A-55-4C-NHE in stock. If pin 30 is floating then you would need to add a jumper wire. Arrow has a few SST39SF010A-55-4C-NHE in stock.

I don't know if these are suitable for the 4957A.

[gslick]

Future Electronics has SST39SF020A-70-4C-PHE in stock: https://www.futureelectronics.com/p/9872987


Edit: Oh, this is PLCC? Mouser and Digi-Key both have SST39SF020A-55-4C-NHE in stock. If pin 30 is floating then you would need to add a jumper wire. Arrow has a few SST39SF010A-55-4C-NHE in stock.

I don't know if these are suitable for the 4957A.

It didn't occur to me to check for pin compatible Flash PLCC parts, I was only searching for OTP EPROM PLCC parts.

Microchip Direct currently has over 1000 PLCC 1Mb 4.5-5.5V Parallel Flash SST39SF010A-70-4I-NHE-T parts in stock for around $2 each. I'd have to take a look at the original parts in my 4957A to check the speed rating.  The 70ns SST39SF010A parts are probably fast enough. Oh, the SST39SF010A-70-4I-NHE-T parts are in tape packaging with a minimum order of 200 from Microchip Direct.

Microchip Direct currently also has around a dozen SST39SF010A-55-4C-NHE tube packaging parts in stock with no minimum order (in addition to the SST39SF010A-55-4C-NHE parts you found in stock at Arrow).

I should get around to fixing the power supply in my 4957A. Then I could try programming some SST39SF010A parts and swapping them in to verify that they work as replacements.