Author Topic: HP856xE hackers' corner  (Read 9994 times)

0 Members and 1 Guest are viewing this topic.

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
HP856xE hackers' corner
« on: September 03, 2018, 01:35:43 pm »
I took a look inside the HP856xE firmware files recently and found some interesting stuff I'd like to share.
Another reason for this thread is that I can't find any DLP script examples apart from the original HP856X/HP859X documentation.
So I'm going to post my own DLPs and invite others to share their scripts.

Let me start from C code snippet to join two eeprom images into a "readable" one.
Code: [Select]
#include <stdio.h>

char a[262144];
char b[262144];

main(int argc, char **argv)
{
 int i;
 FILE *f = fopen(argv[1], "r");
 fread(a, sizeof(a), 1, f);
 fclose(f);
 f = fopen(argv[2], "r");
 fread(b, sizeof(b), 1, f);
 for(i=0; i < sizeof(a); i++) {
  fwrite(a+i, 1, 1, stdout);
  fwrite(b+i, 1, 1, stdout);
 }
}
 
The following users thanked this post: bitseeker

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #1 on: September 03, 2018, 01:38:07 pm »
Code: [Select]
          ** THE CREATORS **
Tom Anderson         Ron Barnett
Chuck Bigelis        Richard Chan
Bill Coppel          Will Cramer
David Del Castillo   Antonio Dicolen
Grant Doering        Jim Goodenough
Cherie Gannon-Taylor Joe Gorin
John Grubb           Gordon Guthrie
Ed Hamilton          Tom Jerse
Bill Katz            Ken Lange
Rod Larrick          Brian LeMay
Caroline Lucas       Manuel Marroquin
Gary Miller          Rex Musgrave
Dan Needham          Eddy Ng
Dan Osborn           Sue Palm
Jon Powell           Don Prescott
Tony Reis            Chien-Fu Shih
Roger Stancliff      Jim Stimple
Kenn Wildnauer       Udom Vanich
Steven Warwick       Craig Wheeler
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #2 on: September 03, 2018, 01:50:20 pm »
There are some undocumented GPIB commands.
The most useful ones I found for now are ZRDWR and ZSETADDR. They allow to read analyser memory.
ZSETADDR sets the address in decimal (0 to 0xffffff)
ZRDWR? returns a single byte in decimal.
I'm yet to figure out the memory map. But it seems to be possible to read all RAM, ROM and device registers (ouch!) without restrictions.
« Last Edit: September 03, 2018, 01:52:34 pm by kirill_ka »
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #3 on: September 04, 2018, 11:45:07 am »
Here's the memory map I got so far.
000000-17FFFF Main ROM    This range can be used to extract the firmware.
First 4 bytes of firmware contain the address of initial stack pointer. Next 4 bytes are the entry point.
Higher addresses of this range also contain code for HP85620 and TAM modules.
FF0000-FF2000 Config EEPROM  This address range contains the serial number, options and calibration constants (amplitude calibration, preselector calibration, etc.)
I'm not absolutely sure if those addresses are direct EEPROM addresses or just a RAM copy. Anyway, it's a good idea to save a dump of this area before attempting to calibrate the analyser.  Flatness data stored as 24bit values. The first byte seems to identify the band, the remaining two bytes are the value entered during calibration. Since my HP8561E has two bands, I see 0x00 prefix for the lower band and 0x80 for the higher.  The unused portion looks like this: 800800800800800800800800
FE0000-FE7FFF Mass memory module's RAM/card window.
FE8000-FEFFFF Mass memory module's registers.
FD0000-FDFFFF Mass memory module's ROM. It starts from the signature "...Z..HP85620B..880120" The module has 256K of ROM, so this might be also used to access other ROM pages. It's worth checking schematics of the module to get the idea of the mapping.

update: fixed flatness data format
update: fixed mass memory module's RAM location
update: updated mass memory information
« Last Edit: August 21, 2020, 08:34:08 am by kirill_ka »
 
The following users thanked this post: Tony_G

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 9057
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: HP856xE hackers' corner
« Reply #4 on: September 05, 2018, 05:02:15 am »
Interesting stuff. Following along.
TEA is the way. | TEA Time channel
 
The following users thanked this post: kirill_ka

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #5 on: September 05, 2018, 01:07:44 pm »
FC0000-FCFFFF This seems to be the Mass memory module's RAM again. I don't know why it's not continuous.
That's wrong. I think the remaining 64k of module's RAM are just shadowed by other stuff in FF0000-FFFFFF range. And Mass memory module should be accessed from lower addresses. I'll update my post once I check this.

I got a gift yesterday. I found a copy of calibration consts which I had lost previously. They were somewhere in the RAM.
It makes me wonder, does it retain all of it's RAM while powered off?
By the way, don't forget to replace the calibration jumper as I did.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #6 on: September 05, 2018, 01:31:58 pm »
A DLP example. I did this to quickly check how harmonics are affecting the wideband power measurement.
The analyser should be set up so the signal and it's harmonics are visible in a single sweep. The DLP takes power of the highest peak (HIPK), then it adds power of all harmonics above 26 dBc. Then it reports the difference between HIPK and the summed power.
Code: [Select]
FUNCDEF THD_DB,@
 LCLVAR NP,0 ;; number of peaks
 LCLVAR HIPK,0 ;; highest peak amplitude
 LCLVAR I,0 ;; peak number
 LCLVAR P,0
 LCLVAR P1,0
 LCLVAR YPOS,700 ;; current vertical display position
 LCLVAR PWR,0 ;; total power
 LCLVAR FFR,0 ;; fundamental frequency in display units
 SNGLS
 EM
 TS
 MKPK
 MOV HIPK,MKA
 SUB MKPT,HIPK,26 ;; harmonic level > 26dBc increases total power by more than 0.01dB
 MOV MKPX,3
 HD
 MOV NP,PEAKS TRB,TRA,AMP
 PA 100,YPOS
 IF NP,GE,25;THEN
  TEXT %TOO MANY PEAKS: %
  DSPLY NP,3,0
  ABORT
 ENDIF
 IF NP,EQ,0;THEN
  TEXT %NO PEAKS FOUND%
  ABORT
 ENDIF
 SUB FFR,TRB[1],1
 TEXT %NPEAKS = %
 DSPLY NP,2,0
 SUB YPOS,YPOS,40
 REPEAT
  ADD I,I,1
  MOV P,TRB[I]
  SUB P1,P,2
  IF TRA[P],GE,TRA[P1];THEN
   ADD P1,P,2
   IF TRA[P],GT,TRA[P1];THEN
    IF P,LT,FFR;THEN
     TEXT %NON HARMONIC PEAK: %
     DSPLY P,3,0
     ABORT
    ENDIF
    SUB P,TRA[P],600
    MPY P,P,LG
    DIV P,P,60.0
    ADD P,RL,P
    IF I,LE,12;THEN
     PA 150,YPOS
     SUB P1,P1,3
     DIV P1,P1,600.0
     MPY P1,P1,SP
     ADD P1,FA,P1
     DIV P1,P1,1E6
     DSPLY P1,4,0
     TEXT %MHz = %
     DSPLY P,5,2
     SUB YPOS,YPOS,40
    ENDIF
    EXP P,P,10
    ADD PWR,PWR,P
   ENDIF
  ENDIF
 UNTIL I,GE,NP
 LOG PWR,PWR,10
 PA 100,YPOS
 TEXT %SUM POWER = %
 DSPLY PWR,5,2
 SUB YPOS,YPOS,40
 SUB PWR,PWR,HIPK
 PA 100,YPOS
 TEXT %DISTORTION = %
 DSPLY PWR,5,2
 TEXT %dB%
@

DLPs do not allow comments. ";;" comments are removed by the script I use for uploading.
 
The following users thanked this post: bitseeker

Offline Drewbie

  • Contributor
  • Posts: 48
  • Country: nz
  • Certifiable HP Nutter.
Re: HP856xE hackers' corner
« Reply #7 on: September 06, 2018, 06:48:51 am »

Just to be clear, when you say HP856xE, you're talking about the 8566/7/8 A/B ?
 

Offline hendorog

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: nz
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #9 on: September 06, 2018, 09:09:06 am »
Pretty sure its the 8562E and 8563E he is working on.
I have 8561E. AFAIK 8560E, 8561E, 8562E 8563E, 8564E, 8565E are using the same firmware.  EC models should be pretty much the same. From the documentation the "DLP" command set is very similar to 859XE series. 8566/8568 series are further away.
 

Offline Berni

  • Super Contributor
  • ***
  • Posts: 4924
  • Country: si
Re: HP856xE hackers' corner
« Reply #10 on: September 06, 2018, 09:50:18 am »
Im going to keep my eye on here since i have a HP 8566B

What sort of things do you expect to get it to do?
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #11 on: September 06, 2018, 11:07:35 am »
What sort of things do you expect to get it to do?
Probably the main reason I'm looking inside the firmware is that I don't feel comfortable using black box software. Maybe it's an evolved way of disassembling a toy to see what's inside.
Then, as I know how it works, I would not hesitate to upgrade the firmware. Also I think to make an attachment for RF Explorer generator to be used as a tracking generator for HP.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #12 on: September 07, 2018, 09:28:44 am »
Is it a good idea to use a digitally controlled signal generator as a tracking generator for the HP?
I mean the generator is not continuously tuned, but it advances in discrete steps. Time gating can be used to avoid switching artefacts.
 

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 9057
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: HP856xE hackers' corner
« Reply #13 on: September 07, 2018, 11:50:18 pm »
I'm not sure about the consequences of the frequency steps. I guess it depends on how big the steps are. However, if I remember correctly, the RF Explorer doesn't filter its output, which would make for a tracking gen with lots of harmonics.
TEA is the way. | TEA Time channel
 

Offline hendorog

  • Super Contributor
  • ***
  • Posts: 1617
  • Country: nz
Re: HP856xE hackers' corner
« Reply #14 on: September 08, 2018, 12:10:59 am »
I'm not sure about the consequences of the frequency steps. I guess it depends on how big the steps are. However, if I remember correctly, the RF Explorer doesn't filter its output, which would make for a tracking gen with lots of harmonics.

Which shouldnt matter much in most cases, as the SA does the filtering.
 

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 9057
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: HP856xE hackers' corner
« Reply #15 on: September 08, 2018, 01:41:06 am »
Right, as long as whatever you're running the signal through on the way to the SA is OK with it as well.
TEA is the way. | TEA Time channel
 

Offline Berni

  • Super Contributor
  • ***
  • Posts: 4924
  • Country: si
Re: HP856xE hackers' corner
« Reply #16 on: September 08, 2018, 09:30:17 am »
I made by own tracking generator for my HP 8566 using a mixer.

You can take the 1st LO output from the 8566 and feed it into the LO input of the mixer, then use a RF signal generator to create a fixed CW tone at just the right frequency (3.6214 GHz for the 8566) and put that into the RF input on the mixer. The IF port on the mixer then outputs your tracking generator signal. Tho its also a good idea to put a circulator between the mixer and the LO port on your SA so prevent the tracking signal leaking back and degrading the noise floor.

This only works on the 0-2.5GHz band tho. For the higher bands you need to use more than one mixer in series to get the frequencies to work out right and you need mixers and signal sources that work at such high frequencies.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #17 on: September 10, 2018, 09:06:52 am »
Thank you all for your replies. I think, I'll try it.

You can take the 1st LO output from the 8566 and feed it into the LO input of the mixer, then use a RF signal generator to create a fixed CW tone at just the right frequency (3.6214 GHz for the 8566) and put that into the RF input on the mixer.
Yes, I'm aware of this approach. Since my main job is software engineering, I lean towards digital solutions  ;)

However, if I remember correctly, the RF Explorer doesn't filter its output, which would make for a tracking gen with lots of harmonics.
Yes, you are right. It also has quite poor close to the carrier performance. So the RBW would be limited to about 10 kHz. Anyway it should work much better than the native RFexlorer-RFexlorer combination.
But I also think of this approach in general. Maybe I can use Arb generator for lower frequencies and Signal Hound for RF. Having harmonics has a questionable advantage of being able to sweep higher frequencies.

I checked the RF Explorer's frequency stepping performance. It looks promising.
Below is the waveform I captured from video output connector (zero span, 10kHz RBW (if I remember correctly), 1ms/1kHz frequency steps). 1ms is not exact due to software delays.

 

Offline Berni

  • Super Contributor
  • ***
  • Posts: 4924
  • Country: si
Re: HP856xE hackers' corner
« Reply #18 on: September 10, 2018, 09:20:58 am »
You actually want the RBW to be more on the wide side to compensate for the tracking signal not being spot on in frequency. You can still get a sharp response on a wide RBW, just that it will also be picking up more noise so your dynamic range is not as good. (Your DUT is creating that sharp response, the SA is simply looking at a wider range where it finds only one sharp tone anyway)

The way i did a tracking generator for higher bands is i set my SA to do max hold and set the RF generator to do the sweep very slowly so that the SA had time to sweep past for each point before moving on. It works pretty well but its really really slow. Takes over a minute to do a full sweep. I could get thing to go faster by replacing the SA with a RF detector instead and feeding that into my scope, but then i have to manually undo the transfer function of that detector to get back to dB.
« Last Edit: September 10, 2018, 09:23:15 am by Berni »
 
The following users thanked this post: kirill_ka

Offline hwalker

  • Contributor
  • Posts: 45
  • Country: us
Re: HP856xE hackers' corner
« Reply #19 on: September 10, 2018, 06:32:22 pm »
The native RF Explorer spectrum analyzer and generator combination uses discrete steps to implement a sudo-tracking generator function.  It does a fairly good job as long as you keep the signal level around -30 dBm.  The combination of the HP analyzer and RF Explorer should perform better if you reduce the span of the spectrum analyzer to half of the center frequency or less, so that harmonics do not muddy the measurements.

The stepping algorithm would be:

1. Set the center frequency of the HP spectrum analyzer to the start frequency.
2. Set the frequency span of the HP spectrum analyzer to center frequency divided by 2.
3. Set the bandwidth of the HP spectrum analyzer as appropriate for the center frequency and frequency span.
4. Set the RF explorer generator to the start frequency.
5. Set the level of the RF explorer generator.
6. Turn the output of the RF explorer generator on.
7. Wait the RF explorer generator output level to settle
8. Do a peak search on the HP spectrum analyzer.
9. Read the marker signal level and store it.
10. Increment the HP spectrum analyzer and repeat 2 -10 until the stop frequency is reached.


You would probably want to setup the reference level based on the signal generator level.  The set output level of the RF explorer generator is not constant over its entire range but is repeatable.  You will need to perform a normalization run as the RF explorer tracking generator application does.  I don't have a nice spectrum analyzer that I can control like you have.  I have tried something similar with a RF explorer generator and rf powermeter but got inconsistent results because power meter was measuring the generator output and all its harmonics.  I'd like to try something similar with the RF Explorer spectrum analyzer and generator combination that has finer control than the native tracking generator application, but I have not got the hang of controlling both devices at the same time.

- Herb
 
The following users thanked this post: kirill_ka

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 9057
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: HP856xE hackers' corner
« Reply #20 on: September 10, 2018, 11:01:10 pm »
Lots of good tips. Looking forward to seeing how they perform together.
TEA is the way. | TEA Time channel
 

Offline Berni

  • Super Contributor
  • ***
  • Posts: 4924
  • Country: si
Re: HP856xE hackers' corner
« Reply #21 on: September 11, 2018, 05:11:23 am »
That sounds like it would work. basically using the SA as a selective power meter.

Also most RF sources can't do a smooth sweep. The Gigatronics boat anchor of a RF synthesizer needs 100ms to go to a new output frequency, but at least it mutes itself during the transition so the jump causes no junk across the spectrum (Apart from the modulation sidelobes caused by the sharp turn off and turn on of the carrier) and since its a proper synthesizer there is basically no harmonics at all.

I have been looking for a synthesizer that can do real analog sweeps but its very difficult to find one cheap.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #22 on: September 11, 2018, 10:02:02 am »
The stepping algorithm would be:
Well, I've already tried a similar thing. I'm going to publish a Tcl script for that. Instead of peak search I used zero span and the RF explorer is accurate enough to align with HP within 30kHz or even 10kHz BW. And yes, it works pretty good. The limitation of that approach is the requirement to do a sweep for each frequency point. What I'm trying to do now is to gather all measurements in one SA sweep.
You would probably want to setup the reference level based on the signal generator level.  The set output level of the RF explorer generator is not constant over its entire range but is repeatable.  You will need to perform a normalization run as the RF explorer tracking generator application does.
Yes, I did this with native normalization function of the HP.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #23 on: September 11, 2018, 10:08:42 am »
Also most RF sources can't do a smooth sweep. The Gigatronics boat anchor of a RF synthesizer needs 100ms to go to a new output frequency, but at least it mutes itself during the transition so the jump causes no junk across the spectrum (Apart from the modulation sidelobes caused by the sharp turn off and turn on of the carrier) and since its a proper synthesizer there is basically no harmonics at all.
The idea is to avoid those transition intervals using the "time gating" feature. It seems to be specifically designed for that.
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #24 on: September 17, 2018, 12:51:40 pm »
List of undocumented commands
ACPRTS It is present in firmware 990108, but it's missing from my 960401. No idea what it does.
HARDON Power on reset. Works similar to power cycling the analyser.
ZDISPACP  No idea what it does.
ZENTID It should be able change the model number and options. I didn't try it.
ZENTSER  It should be able change the serial number.  I didn't try it.
ZET Does something to the EEPROM. I didn't try it with the jumper which enables EEPROM writes.
ZGLOBAL No idea what it does.
ZIFDATA Sends some binary data over GPIB. I don't know what.
ZNEGFLAG No idea what it does.
ZRAPIDACP, ZRAPIDADJ, ZRAPIDALT, ZRAPIDCON No idea what they do.
ZRDWR ZRDWR? reads the memory address specified by ZSETADDR and increments the address. ZRDWR writes a byte. It knows eeprom addresses and has a special code for writing it.
ZRFCAL  No idea what it does. ZRFCAL? always reads 17.
ZSETADDR Sets the address for ZRDWR. The address is specified as decimal argument to the command.
ZSHKDBG Sets the debug flags specified as 16-bit integer argument. For example, ZSHKDBG 8 starts displaying some internal state names on the screen.
ZTC No idea what it does.
ZZTD No idea what it does.
ZSAVE Saves current trace to the module's memory.
WHILE/ENDWHILE This looks like "while" loop construction. The command is accepted, but doesn't seem to work.
ARDLP Requires a memory card.
There are a few other module commands I didn't check if they even exist.
KEYACTIVE KEYFLASH KEYUSCOR LIMIMKR LIMTSP MENULIM PWRBW

Commands which seem to be missing (unimplemented?)
FORMAT
LB
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #25 on: December 04, 2018, 11:09:11 am »
The stepping algorithm would be:
Well, I've already tried a similar thing. I'm going to publish a Tcl script for that. Instead of peak search I used zero span and the RF explorer is accurate enough to align with HP within 30kHz or even 10kHz BW. And yes, it works pretty good. The limitation of that approach is the requirement to do a sweep for each frequency point. What I'm trying to do now is to gather all measurements in one SA sweep.
You would probably want to setup the reference level based on the signal generator level.  The set output level of the RF explorer generator is not constant over its entire range but is repeatable.  You will need to perform a normalization run as the RF explorer tracking generator application does.
Yes, I did this with native normalization function of the HP.

Here's the script:
https://github.com/KIrill-ka/hp3478ext/tree/master/tcl

I cross checked it's performance with my E7495A. The results are identical.
The device under test is a -20dB 4-8 Ghz directional coupler.
Code: [Select]
# THRU connected
./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300 -n
# COUPLER connected
./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #26 on: June 04, 2020, 08:37:29 am »
List of undocumented commands
ACPRTS It is present in firmware 990108, but it's missing from my 960401. No idea what it does.
HARDON Power on reset. Works similar to power cycling the analyser.
ZDISPACP  No idea what it does.
ZENTID It should be able change the model number and options. I didn't try it.
ZENTSER  It should be able change the serial number.  I didn't try it.
ZET Does something to the EEPROM. I didn't try it with the jumper which enables EEPROM writes.
ZGLOBAL No idea what it does.
ZIFDATA Sends some binary data over GPIB. I don't know what.
ZNEGFLAG No idea what it does.
ZRAPIDACP, ZRAPIDADJ, ZRAPIDALT, ZRAPIDCON No idea what they do.
ZRDWR ZRDWR? reads the memory address specified by ZSETADDR and increments the address. ZRDWR writes a byte. It knows eeprom addresses and has a special code for writing it.
ZRFCAL  No idea what it does. ZRFCAL? always reads 17.
ZSETADDR Sets the address for ZRDWR. The address is specified as decimal argument to the command.
ZSHKDBG Sets the debug flags specified as 16-bit integer argument. For example, ZSHKDBG 8 starts displaying some internal state names on the screen.
ZTC No idea what it does.
ZZTD No idea what it does.
ZSAVE Saves current trace to the module's memory.
WHILE/ENDWHILE This looks like "while" loop construction. The command is accepted, but doesn't seem to work.
ARDLP Requires a memory card.
There are a few other module commands I didn't check if they even exist.
KEYACTIVE KEYFLASH KEYUSCOR LIMIMKR LIMTSP MENULIM PWRBW

Commands which seem to be missing (unimplemented?)
FORMAT
LB

Hello,  looking for bin files (EPROM) for 990108, any clue where to find? thanks
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #27 on: June 04, 2020, 02:05:20 pm »
Hello,  looking for bin files (EPROM) for 990108, any clue where to find? thanks

http://ftb.ko4bb.com/getsimple/index.php?id=download&file=01_ROM_Images_and_Drivers/HP_8560E_Series_Firmware_Ver990108.zip

As I remember, there may be some compatibility issues if the CPU board is too old.
The images linked above worked for me.
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #28 on: June 05, 2020, 10:07:09 am »
Thank you so much :)
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #29 on: August 12, 2020, 02:17:00 pm »
FC0000-FCFFFF This seems to be the Mass memory module's RAM again. I don't know why it's not continuous.
That's wrong. I think the remaining 64k of module's RAM are just shadowed by other stuff in FF0000-FFFFFF range. And Mass memory module should be accessed from lower addresses. I'll update my post once I check this.

I got a gift yesterday. I found a copy of calibration consts which I had lost previously. They were somewhere in the RAM.
It makes me wonder, does it retain all of it's RAM while powered off?
By the way, don't forget to replace the calibration jumper as I did.

Hello, have you figured out the correct location addresses of the memory module?  thnks!
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #30 on: August 12, 2020, 05:01:01 pm »
Hello, have you figured out the correct location addresses of the memory module?  thnks!

Well, I can't tell for sure. But as I updated my post, it should be like this:
FE0000-FEFFFF Mass memory module's RAM.
9E0000-9EFFFF The other part of module's RAM.

Do you have something interesting hiding in your module?
« Last Edit: August 12, 2020, 05:02:37 pm by kirill_ka »
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #31 on: August 21, 2020, 09:01:55 am »
Hello, have you figured out the correct location addresses of the memory module?  thnks!

Well, I can't tell for sure. But as I updated my post, it should be like this:
FE0000-FEFFFF Mass memory module's RAM.
9E0000-9EFFFF The other part of module's RAM.

After some experimenting, the above information appears to be incorrect.
1. The ranges FEXXXX and 9EXXXX map to the same RAM area.
2. The module's RAM and RAM card are accessed through the 32k window located at FE0000-FE7FFF.
3. The RAM pages can be switched by selecting different objects in the directory (MODULE/UTILITY).
4. I was able to switch the pages by reading some locations at FE8000-FEFFFF area, but I didn't take time to find out an exact address which causes the switch.

Post #3 updated.
 

Offline specter

  • Newbie
  • Posts: 1
  • Country: no
Re: HP856xE hackers' corner
« Reply #32 on: June 23, 2021, 01:54:03 pm »
FF0000-FF2000 Config EEPROM  This address range contains the serial number, options and calibration constants (amplitude calibration, preselector calibration, etc.)
I'm not absolutely sure if those addresses are direct EEPROM addresses or just a RAM copy. Anyway, it's a good idea to save a dump of this area before attempting to calibrate the analyser.  Flatness data stored as 24bit values. The first byte seems to identify the band, the remaining two bytes are the value entered during calibration. Since my HP8561E has two bands, I see 0x00 prefix for the lower band and 0x80 for the higher.  The unused portion looks like this: 800800800800800800800800

Hi kirill_ka, have you been able to calibrate your analyser by changing the calibration constants in the EEPROM?
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #33 on: June 23, 2021, 03:06:18 pm »
Hi kirill_ka, have you been able to calibrate your analyser by changing the calibration constats in the EEPROM?

Hi,
No, I didn't try that. However I used a dump to restore the calibration using the normal (manual) procedure.
 
The following users thanked this post: specter


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf