| Products > Test Equipment |
| HP / Agilent 34401A hidden menu |
| << < (18/36) > >> |
| Hydron:
--- Quote from: tv84 on September 27, 2022, 09:48:14 am ---What are the addresses that you used (could use) to dump the EEPROM via PEEK -1 ? --- End quote --- --- Quote from: Hydron on September 25, 2022, 11:58:50 am ---DIAG:PEEK? -1,x,0 where x is a decimal number will read the EEPROM word at address x, answer comes back in decimal again. This is a closed-case EEPROM backup enabler :) --- End quote --- Basically run it 211 times, with x = 0 to 210, record the answers and you have an EEPROM dump once you convert to hex. After 210 you just read the 0xFFFF padding until the end of the EEPROM, then it wraps back around. FW pre 07-xx-yy might give different results I guess? |
| manupthehills:
I'm interested in the SCALE option but, reading again and again this thread, I can't figure out if it can be activated with DIAG:POKE command, like the 10mA AC range, or it requires to physically access the EEPROM |
| Hydron:
Currently it needs physical access. Use a SO-8 test clip or something, plus a couple of mini grabbers to put the processor into reset (see service manual for pinouts). If someone wanted to try and get it working without physical access by blindly testing more POKE commands (or better still by reverse engineering the firmware to try and find them) then that would be great though! (Best to backup the existing eeprom contents first though, at least we can now do that using the PEEK command instead of opening the case) |
| alan.bain:
I landed upon this thread and thought it might be useful to leave this here from my file of useful(?) information: With the 7-5-2 firmware in a 34401A DIAG:POKE -2,4667,1 DIAG:POKE -2,4607,1 DIAG:POKE -2,4610,1 DIAG:POKE -2,4608,1 DIAG:POKE 25,0,1 (first is recall, second temp, third save state, fourth SCALE menus) The last instruction is vital even if you already have 10mA current enabled. This should turn on TEMP, SAVE State, RECALL state and 10mA current. I am not sure how stable over firmware versions it is though but it's easy to check as the EEPROM format is stored in a table at the end of the 02xxxx region in ROM. The format is a bit strange, but is specified in terms of bit groups and the memory address where they are mapped (along with a ROM address for a default). In writing to the EEPROM each new group of bits is added to the left of the stream with LSB on right always. E.g. [F6.1 F6.0 F5.0 F4.0 F3.2 F3.1 F3.0 F2.4 ] [F2.3 F2.2 F2.1 F2.1 F1.2 F1.1 F1.0 F0.0 ] Shows fields of length 1,3,5,3,1,1,2 (imaginary example) bits in a field. Here FX.Y is Yth bit of field X. This shows the first two bytes in an example byte1 on left byte0 on right. So basically once you think of always adding on the left it sort of makes sense. A few useful commands are: (all addr, data are base10). Words in memory are little-endian. POKE -3,addr,word writes word to RAM POKE -2,addr,byte writes byte to RAM PEEK 0,addr,0 reads a RAM addr (word) PEEK -1,addr,0 reads a EEPROM addr (the EEPROM is not mapped into main memory) POKE 25,0,1 turns on 10mA current by setting the RAM byte for the range and then doing a write to the lower part of the EEPROM of any changed data. This also picks up other RAM flag changes and saves them to EEPROM. Someday I should look at the firmware and see if there were a more stable way to do this which might be stable over firmware versions. Not sure if this is all the SCALE options - they seem to be in RAMat 4608/9 but the menus appear under MATH with just 4608 set to 1. Now I need a temperature probe to test it..... Thankfully 80196 code is much easier to read than Fairchild F8.... If anyone tries this I'd be interested to know how you get on; but see advice earlier about a backup before starting; PEEK -1 is your friend here. |
| razvan784:
Unfortunately those POKEs probably won't work on other firmware versions, because the RAM layout would be different. In version 10 (and maybe others) there are dedicated POKEs that enable the hidden functions: POKE 28,0,1191 math menu -> min-max: enable sdev, pp POKE 30,0,1191 temp menu, scpi commands POKE 31,0,1191 menu -> scale, calc:scale POKE 32,0,1191 resolution menu -> custom aperture POKE 33,0,1191 system menu -> store state, recall state To disable, poke with something other than 1191, e.g. 0 To check if a function is enabled, use PEEK -10,index,0 where index is 1 sdev, pp 2 temp 3 scale 4 custom aperture 5 save recall |
| Navigation |
| Message Index |
| Next page |
| Previous page |