Products > Test Equipment
HP / Agilent 34401A hidden menu
<< < (11/36) > >>
Hydron:
Yeah the hope was that it is something that can be enabled via an undocumented poke like the 10mA AC range.

Seeing as I had a memory dump and the thing all wired up already to allow EEPROM access (for both write and monitoring), I thought I'd have a crack with some other POKE commands. I tried everything up to the mid 30s at least with x,0,0 without result other than what I wrote in my notes. This post suggests that other poke commands can be used to do some other tricks though, but annoyingly HPAK didn't elaborate any further: https://www.eevblog.com/forum/testgear/agilent-34401a-hidden-10ma-ac-current-range/msg400451/#msg400451

Edit:
A little more info - I tried again with dimmog's .BIN, but only writing up to 0x30 (the first checksum). Gave errors 740 747 and 748, i.e. Cal secure, GPIB addr. and "internal data" checksum errors, no other errors suggest that the other calibration info is stored after that point (as suspected). After changing a setting (triggering a re-write of at least the checksum) it's reset all the stuff I wrote from the .BIN to nearly what was originally there, suggesting it's back to defaults. No hidden menu enable still  :'(

Edit 2:
...just realised this might be a little/big endian issue with the byte order, which would explain the total lack of success with dimmog's .BIN. Will try again with the bytes in each word swapped!
dimmog:
I'm not a programmer but I think 11-05-02 has a different EEPROM structure. The 07-05-02 and 10-05-02 have almost the same data up to 0x60 and 11-05-02 looks completely different.
Hydron:
Success!

Looks like the EEPROM structure is still compatible between versions 07 10 and 11.

Fixing the byte order worked, and I was able to load your .BIN up to word 0x30 (i.e. up to byte 0x61), which is the section that contains the magic incantation to enable the hidden menus.

It looks like my calibration (and count, message etc) is untouched, and I have the new save/recall/power-on menus, though I have not tested them in anger yet. Applying the AC 10mA range tweak also works - while the value at the address it changes is now non-zero to begin with, it only modifies one bit from 0 to 1, leaving the rest the same (via a read-modify-write cycle I guess).

Edit:
A quick test with the saved state resulted in being able to set the default number of digits on boot to 6 :)

Edit2:
- Found the byte that does it, by changing the second byte at word 0x09 (i.e. byte 0x13) from 0x98 to 0x8C (and updating the checksum at word 0x30 by subtracting the difference, i.e. 0x0C, from it) it enables the hidden menu. There aren't that many changed bytes between my original and dimmog's file (at least before the 0x30 checksum word), so it only took 2 attempts to find it!
* Update: 0x9C works too, so it's just the 4s bit in the second nibble

Also see attached the byte swapped version of the .bin that dimmog originally posted.

Anyone want to have a crack at guessing bytes to get the temperature menu working? :P
tv84:

--- Quote from: dimmog on September 24, 2022, 08:02:51 pm ---I'm not a programmer but I think 11-05-02 has a different EEPROM structure. The 07-05-02 and 10-05-02 have almost the same data up to 0x60 and 11-05-02 looks completely different.

--- End quote ---

As Hydron mentioned the endianness of the 11-05-02 version is wrong (probably a mistake from the dumper).

Hydron:
...and more notes:
Using the save settings option with fast 6-digit mode selected (otherwise power-on-defaults) changes words:
- 0x0C from C0D1 to C0E1
- 0x1D from 0000 to 8000
- 0x1E from 0000 to 0232
- 0x2A from 0000 to FC00
- 0x2B from 0000 to 0001
- the checksum at 0x30

This accounts for all but three bytes of the differences between my firmware dump and dimmog's (remaining differences are at words 0x08 and 0x20)

Turning on the option to recall settings on boot modifies word 0x08 from 1000 to 3000 (probably would be 0000 to 2000 without the bit being set for AC 10mA range enable)

If anyone has a 34401A with a temperature menu present, please pipe up (and even better still, supply an EEPROM dump!)
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod