is there an e2prom ? 93cxx or 24cxx style ? dump it. you may learn something. same for the regular LCR meter.
most machines of that era are 68K based
most machines of that era are 68K based
Is there any other memory in there, perhaps a small 8 pin eeprom as was already suggested?
OK, so it isn't really a 27C1024 as the file name suggests then I suppose.
There must be some main memory, likely a 28 or 29 series device.
hmm. whats under the flatcable ? you are looking for a 4 pin or 14 pin device 93cxx series , most likely national semi
hmm. whats under the flatcable ? you are looking for a 4 pin or 14 pin device 93cxx series , most likely national semi
I have read the service manual and it says that the calibration/configuration data are stored in the flash memory.
So there are no other memories to look for.
The temporary data is stored in the two SRAMs, probably powered by the Supercap near the 10MHz TXCO.
The code that allows you to update the firmware (instrument side) is found in the BootRom AM27C1024. This code takes care of loading the firmware into RAM via GPIB (I suppose in more steps since the ram is smaller than the Flash), erase the flash and rewrite it.
One could study the code contained in the BootRom to write a Python program that does this job on modern computer.
Always reading the manual, I read that the original program only runs on the VEE 3.21 version, therefore an additional complication.
If you want to read the contents of the Flash memories without unsoldering them, you could try to keep the cpu in reset state and read the memories
connecting to the data/address buses as long as the hardware configuration allows it (CS/WR/OE signals should also go IDLE).
For the options, what about those small switches at the top and bottom of your picture?
You could check where they connect to and try the different positions, only 256 combinations to do :-DD
Best regards
since this is the same lineage of the LCR bridge most likely it is simply a flag in the flash. you don't need the code or the key generation , simply set the flag.
I think I should be able to read the flash memory directly... But I like the path of trying to find the commands for upgrading the unit through GPIB itself. But even then, the actual code would need to be discovered which is a function of the serial number...
Hello,
I've had a look around the archive.org "ftp site boneyard" filelistings for ftp.keysight.com 2015-04-04
https://archive.org/download/ftp.keysight.com/
https://ia600504.us.archive.org/28/items/ftp.keysight.com/2015.03.ftp.keysight.com.tar.txt
And ftp.agilent.com 2014-06-15
https://archive.org/download/ftp.agilent.com
https://archive.org/download/ftp.agilent.com/2014.06.ftp.agilent.com.tar.txt
searching for "E4915_16.exe" mentioned in the service manual, as well as other keywords I could think of. No luck.
The archives are >2010 so about ten years too recent
Best regards,
i have an older archive from the FTP site when they still were HP. found the harddisk yesterday. will check.
Could you try querying ":TEST:INSTR:INFO:DATA?" over GPIB and see what comes back?
Excellent, thanks, that's the result I was hoping for :)
In theory, you should be able to send back ":TEST:INSTR:INFO:DATA E4916A,JP1KD00868,010,000,000,000" (ie: just swapping the first 000 to 010) to enable the LCR option.
A few caveats:
I'm basing this on reverse engineering the v2.13 firmware linked above. It's unlikely, but your version could behave differently.
The firmware does a bunch of checks on the string sent to verify the option strings, however it does let you overwrite the model (to either "E4916A" or "E4915A") and the serial number so type carefully.
There could be side effects I haven't noticed, so it's probably best to have a backup of any flash in there for minimal risk.
:TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,000"Hmm, I guess the value might need to be in quotes, so:Code: [Select]:TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,000"
I tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error". :-//
:TEST:INSTR:INFO:DATA "E4916A","JP1KD00868","010","000","000","000"I tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error". :-//
Ah, OK, thanks for trying it.
I had a closer look and it seems to be treating them all as separate arguments, so quoting each individually might work:Code: [Select]:TEST:INSTR:INFO:DATA "E4916A","JP1KD00868","010","000","000","000"
Nice! Glad I could help :)
@Miek: what did you use for the reengineering? disassembler?