Author Topic: HP856xE hackers' corner  (Read 9990 times)

0 Members and 1 Guest are viewing this topic.

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #25 on: December 04, 2018, 11:09:11 am »
The stepping algorithm would be:
Well, I've already tried a similar thing. I'm going to publish a Tcl script for that. Instead of peak search I used zero span and the RF explorer is accurate enough to align with HP within 30kHz or even 10kHz BW. And yes, it works pretty good. The limitation of that approach is the requirement to do a sweep for each frequency point. What I'm trying to do now is to gather all measurements in one SA sweep.
You would probably want to setup the reference level based on the signal generator level.  The set output level of the RF explorer generator is not constant over its entire range but is repeatable.  You will need to perform a normalization run as the RF explorer tracking generator application does.
Yes, I did this with native normalization function of the HP.

Here's the script:
https://github.com/KIrill-ka/hp3478ext/tree/master/tcl

I cross checked it's performance with my E7495A. The results are identical.
The device under test is a -20dB 4-8 Ghz directional coupler.
Code: [Select]
# THRU connected
./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300 -n
# COUPLER connected
./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #26 on: June 04, 2020, 08:37:29 am »
List of undocumented commands
ACPRTS It is present in firmware 990108, but it's missing from my 960401. No idea what it does.
HARDON Power on reset. Works similar to power cycling the analyser.
ZDISPACP  No idea what it does.
ZENTID It should be able change the model number and options. I didn't try it.
ZENTSER  It should be able change the serial number.  I didn't try it.
ZET Does something to the EEPROM. I didn't try it with the jumper which enables EEPROM writes.
ZGLOBAL No idea what it does.
ZIFDATA Sends some binary data over GPIB. I don't know what.
ZNEGFLAG No idea what it does.
ZRAPIDACP, ZRAPIDADJ, ZRAPIDALT, ZRAPIDCON No idea what they do.
ZRDWR ZRDWR? reads the memory address specified by ZSETADDR and increments the address. ZRDWR writes a byte. It knows eeprom addresses and has a special code for writing it.
ZRFCAL  No idea what it does. ZRFCAL? always reads 17.
ZSETADDR Sets the address for ZRDWR. The address is specified as decimal argument to the command.
ZSHKDBG Sets the debug flags specified as 16-bit integer argument. For example, ZSHKDBG 8 starts displaying some internal state names on the screen.
ZTC No idea what it does.
ZZTD No idea what it does.
ZSAVE Saves current trace to the module's memory.
WHILE/ENDWHILE This looks like "while" loop construction. The command is accepted, but doesn't seem to work.
ARDLP Requires a memory card.
There are a few other module commands I didn't check if they even exist.
KEYACTIVE KEYFLASH KEYUSCOR LIMIMKR LIMTSP MENULIM PWRBW

Commands which seem to be missing (unimplemented?)
FORMAT
LB

Hello,  looking for bin files (EPROM) for 990108, any clue where to find? thanks
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #27 on: June 04, 2020, 02:05:20 pm »
Hello,  looking for bin files (EPROM) for 990108, any clue where to find? thanks

http://ftb.ko4bb.com/getsimple/index.php?id=download&file=01_ROM_Images_and_Drivers/HP_8560E_Series_Firmware_Ver990108.zip

As I remember, there may be some compatibility issues if the CPU board is too old.
The images linked above worked for me.
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #28 on: June 05, 2020, 10:07:09 am »
Thank you so much :)
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 117
  • Country: se
Re: HP856xE hackers' corner
« Reply #29 on: August 12, 2020, 02:17:00 pm »
FC0000-FCFFFF This seems to be the Mass memory module's RAM again. I don't know why it's not continuous.
That's wrong. I think the remaining 64k of module's RAM are just shadowed by other stuff in FF0000-FFFFFF range. And Mass memory module should be accessed from lower addresses. I'll update my post once I check this.

I got a gift yesterday. I found a copy of calibration consts which I had lost previously. They were somewhere in the RAM.
It makes me wonder, does it retain all of it's RAM while powered off?
By the way, don't forget to replace the calibration jumper as I did.

Hello, have you figured out the correct location addresses of the memory module?  thnks!
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #30 on: August 12, 2020, 05:01:01 pm »
Hello, have you figured out the correct location addresses of the memory module?  thnks!

Well, I can't tell for sure. But as I updated my post, it should be like this:
FE0000-FEFFFF Mass memory module's RAM.
9E0000-9EFFFF The other part of module's RAM.

Do you have something interesting hiding in your module?
« Last Edit: August 12, 2020, 05:02:37 pm by kirill_ka »
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #31 on: August 21, 2020, 09:01:55 am »
Hello, have you figured out the correct location addresses of the memory module?  thnks!

Well, I can't tell for sure. But as I updated my post, it should be like this:
FE0000-FEFFFF Mass memory module's RAM.
9E0000-9EFFFF The other part of module's RAM.

After some experimenting, the above information appears to be incorrect.
1. The ranges FEXXXX and 9EXXXX map to the same RAM area.
2. The module's RAM and RAM card are accessed through the 32k window located at FE0000-FE7FFF.
3. The RAM pages can be switched by selecting different objects in the directory (MODULE/UTILITY).
4. I was able to switch the pages by reading some locations at FE8000-FEFFFF area, but I didn't take time to find out an exact address which causes the switch.

Post #3 updated.
 

Offline specter

  • Newbie
  • Posts: 1
  • Country: no
Re: HP856xE hackers' corner
« Reply #32 on: June 23, 2021, 01:54:03 pm »
FF0000-FF2000 Config EEPROM  This address range contains the serial number, options and calibration constants (amplitude calibration, preselector calibration, etc.)
I'm not absolutely sure if those addresses are direct EEPROM addresses or just a RAM copy. Anyway, it's a good idea to save a dump of this area before attempting to calibrate the analyser.  Flatness data stored as 24bit values. The first byte seems to identify the band, the remaining two bytes are the value entered during calibration. Since my HP8561E has two bands, I see 0x00 prefix for the lower band and 0x80 for the higher.  The unused portion looks like this: 800800800800800800800800

Hi kirill_ka, have you been able to calibrate your analyser by changing the calibration constants in the EEPROM?
 

Offline kirill_kaTopic starter

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: HP856xE hackers' corner
« Reply #33 on: June 23, 2021, 03:06:18 pm »
Hi kirill_ka, have you been able to calibrate your analyser by changing the calibration constats in the EEPROM?

Hi,
No, I didn't try that. However I used a dump to restore the calibration using the normal (manual) procedure.
 
The following users thanked this post: specter


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf