HP / Agilent 34401A hidden menu

[meandeev]

You cannot put/hold cpu in reset with GPIB adapter or serial port.

I used 2 mini grabbers connected with an 1k resistor.
Take a look at the picture in https://www.eevblog.com/forum/metrology/read-and-restore-calibration-constants-from-a-hp-34401a/msg1743833/#msg1743833
there you can see which cpu pins have to be connected to hold it in reset mode.

[dimmog]

Just found a YouTube video that proves the "TEMP MENU" exists in the real instrument!

https://youtu.be/lOqVhv5Ca08?t=49

[meandeev]

I was able to decompile the cal-message, here you can find my result of the gambling with bits and bytes ~2 years ago. I put it in something that looks roughly like a C program-file.
But it´s rather useless, because it fits only the 05-01-01 firmware and without the crc-routine one cannot change anything without an error.

Thats why I suggested to decompile the firmware ROM.

[meandeev]

 
No compressor, I used yesterday a fresh downloaded Version of Pelles-C, compiled it with full debugging Info.
But you can compile it by yourself, source code is included.

My local Windows defender is fine, Virustotal says 4/68 detected 

[coromonadalix]

doesnt want to run on my win 10 too   even defender disabled

 
Im gonna take the 34401a  who served as a guinea pig  for the  34401a  oled display variant thread,    but t will take a few days to test the poke command and grab the changes int the eeprom ... i do lots of overtime  

Dmm has the 07 05 02 fw too

[ch_scr]

This "Memory Information and Procedures" also clearly states that ALL non volatile storage is in the eeprom.
https://www.keysight.com/upload/cmc_upload/All/34401A_Mem_external.pdf

[iMo]

fyi - the above calmsg.zip downloads and builds here (Win10).
My HP's rev fw is 10-05-02 and no menu 9 and above.
Would be great to enhance the fw (without deleting cal constants).

PS: the doc above says the operating system is in an OTP ROM (one time programmable), but the service manual (Agilent) shows in the schematics AM27C020 which is an EPROM.
Below the BOM from the same service manual - the U502 is an M27C2001 "2Mbit OTP ROM" (aka 34401-88806). But the M27C2001 is an EPROM afaik.. 
It could be the older - pre 1999 "HP" models - are using OTP ROM there, later models (Agilent, KS) have replaced it with an EPROM..
The CAL constants and a few other I/O parameters are stored in an EEPROM (U505).

[jogri]

Those menu items look awfully similar to the ones on my (HP) 34970A, a DMM that's also made by HP/Agilent and that's basically a 34401A with a multiplexer connected to it. Wouldn't surprise me if they use the same firmware and just added the capability to switch between different channels for the 34970A (the 34401A already kinda has that with its 4 wire measurements). In a 34970A, the store state/recall state options are to save different channel configurations and the power on option configures if the DMM should continue scanning its channels after a blackout or abort the scan. Also, it definitely has a TEMP menu, but i can't recall the exact names of the options there, but there are quite a lot (types, temp units, int/ex ref (and the temp of the ext reference), etc).

So it could be the case that some 34401A are running on software designed for the 34970A...

[gslick]

PS: the doc above says the operating system is in an OTP ROM (one time programmable), but the service manual (Agilent) shows in the schematics AM27C020 which is an EPROM.
Below the BOM from the same service manual - the U502 is an M27C2001 "2Mbit OTP ROM" (aka 34401-88806). But the M27C2001 is an EPROM afaik.. 
It could be the older - pre 1999 "HP" models - are using OTP ROM there, later models (Agilent, KS) have replaced it with an EPROM..

An EPROM in a plastic package as used in the 34401A instead of a ceramic windowed package is an OTP part. Can't reprogram it if there is no way to erase it.

[coromonadalix]

Those menu items look awfully similar to the ones on my (HP) 34970A, a DMM that's also made by HP/Agilent and that's basically a 34401A with a multiplexer connected to it. Wouldn't surprise me if they use the same firmware and just added the capability to switch between different channels for the 34970A (the 34401A already kinda has that with its 4 wire measurements). In a 34970A, the store state/recall state options are to save different channel configurations and the power on option configures if the DMM should continue scanning its channels after a blackout or abort the scan. Also, it definitely has a TEMP menu, but i can't recall the exact names of the options there, but there are quite a lot (types, temp units, int/ex ref (and the temp of the ext reference), etc).

So it could be the case that some 34401A are running on software designed for the 34970A...

Could be it,  the 34970  has the same asics,  and go up to 300v not 1kv ....   never saw any leaked eeprom / roms / firmwares ?

[jogri]

The missing 1 kV spec is probably due to the fact that designing a board with screw terminals for 40 individual channels that has to withstand 1 kV between two screw terminals would be a nightmare (and those 40 wires would be running through a 1 cm^2 opening)... And since not that many people need to monitor multiple 1 kV lines simultaneously they just went with 300 V max instead. Also, it only goes up to 1A, probably for a similar reason.

Btw, i just checked the service manual for parts numbers and i found this entry for what seems to be the main IC on the DMM board: "U102 CUST R NET PKG,  REPLACES 34401-67901"

I have the EEPROM for the chip with the calibration constants if you want it, but i doubt that it'll be usefull in this case.

[ch_scr]

The missing 1 kV spec is probably due to the fact that designing a board with screw terminals for 40 individual channels that has to withstand 1 kV between two screw terminals would be a nightmare (and those 40 wires would be running through a 1 cm^2 opening)... And since not that many people need to monitor multiple 1 kV lines simultaneously they just went with 300 V max instead. Also, it only goes up to 1A, probably for a similar reason.

Btw, i just checked the service manual for parts numbers and i found this entry for what seems to be the main IC on the DMM board: "U102 CUST R NET PKG,  REPLACES 34401-67901"

I have the EEPROM for the chip with the calibration constants if you want it, but i doubt that it'll be usefull in this case.

If you have a eeprom dump please post it, and your firmware revision.

[jogri]

If you have a eeprom dump please post it, and your firmware revision.

As i've said i only have the EEPROM dump of the F-RAMs that contain useless stuff... The 34970 has its DMM on a separate module, and that module alone contains at least two ICs plus one FRAM for the cal. constants, and another FRAM on the main board that keeps track of the power cycles. Since none of those ICs are socketed i really don't want to screw around with them.

I've attached the fram dumps (had that because the one in my unit died and i couldn't format those chips via GPIB). The DMM is from the fram on the DMM module, but i wouldn't count on it being correct since one bit toggled between two states every time i read the chip... The other dump is from the fram on the main board that contains god knows what (number of power cycles+ other stuff).

Firmware rev? Can check that when i get my 34970A out of its natural habitat in a test rig where it's sitting as a rather overqualified temperature logger (i "definitely" need a 6.5 digit DMM to measure 3 digit values...)

[ch_scr]

Murphy says it's propably the one you left out, what you posted looks nothing like the 34401A one's as well. 

[ian.ameline]

Reading the scpi manuals for other HP products, DIAG:PEEK takes an address and a number of bits to read. I bet we can dump the non volatile memory by peeking addresses 0 through 512. The docs were clear that PEEK is a read-only operation.

It would be interesting to see if the data produced by that matches what people have grabbed directly off the eeprom chip. If it does match, then we could experiment with poking around near address 25 to see if we can enable the temp menu and other hidden functionality without clobbering calibration values in the 512 bytes of non volatile storage.

[ian.ameline]

In fact it's likely that the number at that address is an 8 bit control "register" other bits in it may control other capabilities... Just peeking around in that byte only may yield some answers without endangering other data stored

[ian.ameline]

Hmmmmm -- DIAG:PEEK? seems to work strangely on the 34401A - it wants 3 numeric parameters -- DIAG:PEEK? 25, 0, 0 results in the same output as *IDN? -- weird, right?

Other values produce what look to be 32 bit numbers. DOcs for other HP devices say that there are 2 paramters to PEEK? and they are address and bit_width -- the latter which must be 8 or 16. The 34401A does not seem to work like that at all.

Has anyone else tried DIAG:PEEK on a 34401A? Anyone? Buehler?

[ian.ameline]

A little googling found this; http://instructor.physics.lsa.umich.edu/adv-labs/Tools_Resources/HP%2034401A%20quick%20start%20guide.pdf

Node that the "hidden" menu items are documented here -- including the G: TEMP MENU!

[dimmog]

yep. we already discussed this on the first page.

A little googling found this; http://instructor.physics.lsa.umich.edu/adv-labs/Tools_Resources/HP%2034401A%20quick%20start%20guide.pdf

Node that the "hidden" menu items are documented here -- including the G: TEMP MENU!

[syzygy]

excuse my ignorance - is there a logfile or equivalent that describes the features, or even dates, of the revisions?
my 34401A is Rev 08-05-02 - I don't see that f/w listed anywhere?

[giacomo]

excuse my ignorance - is there a logfile or equivalent that describes the features, or even dates, of the revisions?
my 34401A is Rev 08-05-02 - I don't see that f/w listed anywhere?

Take a look at the redme.txt file

https://xdevs.com/doc/HP_Agilent_Keysight/34401A/fw/

I believe they have summarized the information available from the various manuals

"The EEPROM structure looks the same from 07-05-02 to 11-05-02, so no calibration seems to be necessary when upgrading FW from 07-05-02 to 11-05-02."

You can upgrade if you want

[syzygy]

Thanks - I just read the txt file - but although it says I can upgrade, I don't see any info on what an 'upgrade' changes?  The list at the top focuses on the physical things - color of buttons, banana jacks, board S/N, etc. - None of that can be changed by 'upgrading' to 10-05-02, or 11-05-02, etc.?

I'm lost as to how the f/w revs differ, and also my rev (08-05-02) never seems to be listed?

Thanks

[coromonadalix]

the upgrade problem is ;  the mcu is under the vfd display,  you have to put a new ic there

I could be wrong  since i always mistake the display  fw and the main fw  version

[Hydron]

Thought I'd update this somewhat dormant thread with a little more info.

Background is that I recently got a 34401a in decent condition/calibration (factory cal from 2007, but a few spot checks still look good), and the hidden menu looked like a nice thing to have, plus I wanted a backup of my EEPROM anyway, so I had a play:

- On boot the meter reads the first 211 16-bit words (up to word address 0xD2) of the EEPROM in order (looks like the rest is just blank and never used, so can be ignored)
- This is a nice and easy way to get a backup using a scope or LA without any EEPROM flash tools. Was a lot easier than the last time I did this with a 16-bit parallel EEPROM in a Keithley 236!
- Needs a bit of care with bus decode setup - it's not normal SPI, though my scope (RTB2k) was happy when I set it up as a 27-bit (!!) SPI bus and the correct polarity of chip select, clock (appears to be opposite for data in vs out) etc. Only the last 2 bytes of data output on each read will be valid (and the first ~10 bits will depend on the 100k pullup and your probe impedance and threshold, as it's Hi-Z for that period)

Once I had my backup, I had a bit of play with POKE commands, as per my rough notes (attached). Note that addresses listed in them are word addresses in hex, I was too lazy to append 0x most of the time.
Unfortunately I didn't have much luck finding anything useful, other than if you hate someone you should send DIAG:POKE 0,0,0 to their meter.

I then needed to restore my original backup, so I first had a crack programming the 34401a-save-state-menu.BIN previously posted into my EEPROM. Sadly my meter (on 11-05-02) didn't like this at all, throwing a number of 74x errors on boot, and no new menus appeared.

My original EEPROM dump works fine when programmed back into my meter, so I'm not sure what is the issue is with dimmog's .BIN given the previously reported success swapping the EEPROM (and activated hidden menu) into a 10-05-02 meter. Not a lot more that I think I can do now, though I'm open to suggestions while my meter is still opened up on the bench

[tv84]

Interesting theme... 

I will have a peek to see if I can add something to this quest.

@Hydron, can you share your original dump? Your checksums offsets should be dump-dependent.