HP/Agilent E8285A: How to "Upgrade" to A.02.04 FW (PCMCIA Card)

[RaymondMack]

I have an HP E8285A with opts 013 (C-message weighting audio filter), 102 (spectrum analyzer) and A.05.09 FW from a lot of gear in an auction about six months ago. It wasn't until yesterday that I got around to playing around with the unit. After looking around online, I found out that these can be used as a "poor man's" spectrum analyzer (with tracking generator) from 0.4 to 1000 MHz and 1700 to 2000 MHz:

https://www.amtronix.com/e8285a.htm
https://www.amtronix.com/diff.htm
https://www.amtronix.com/e8285a_setup.htm

However, this is only true for FW versions <= A.02.04, anything newer is limited to 800-1000 MHz and 1700-2000 MHz! And of course, my unit has the wrong FW! But, that just means I get to have more fun playing around with old tech. Literally: PCMCIA / "PC Card" memory. Hello 1989 solid-state memory. The E8285A says it has a PCMCIA Type-II slot--slightly thicker than Type-I--which is important to know since most cards are Type-II. The datasheet says the E8285A can read SRAM and ROM cards, which makes finding an appropriate card difficult.

PCMCIA History and context:
https://www.hpcfactor.com/support/cesd/200194/understanding_pc_card_pcmcia_cardbus_16-bit_32-bit

Some helpful technical info and types of memory used:
https://www.amtron.com/reader/pciecb110.htm

But first we need firmware! And thankfully cat87 has uploaded it along with the RF Tools test programs:

https://www.eevblog.com/forum/testgear/looking-for-a-02-04-firmware-update-for-e8285a/msg3598821/#msg3598821

The files provided by cat87 are binary files -- direct bit-for-bit copies of the original PCMCIA memory cards that seem to have been "enlarged" to fit a larger memory card by something like elan's Memory Card Explorer. Cool. But can we just copy the data off them without all this binary file stuff (these should be equivalent to disk images)? Apparently yes. At least for the RF Tools binary.

Extracting the "RF Tools.zip" file we get "rf_tools.bin". Opening this bin file in ImHex, and searching for ASCII strings shows "FAT12" and "MSDOS". So FAT12. Neat. FAT12 is pretty damn old and supports 16 MiB (with 4KiB clusters) or 32MiB (with 8KiB clusters) disks.

https://en.wikipedia.org/wiki/File_Allocation_Table#FAT12

Regardless, we'll just mount the binary as an image and copy the contents. Renaming the extension to .img and mounting with Gnome Disks (as a loop device), we can quickly access the contents of the provided image file.

First let's look at what we are working with:

Code: [Select]

# sudo fdisk /dev/loop0 -l

Disk /dev/loop0: 24 MiB, 25165824 bytes, 49152 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6b736964

# df -h

Filesystem   Size   Used   Avail   Use%    Mounted on
/dev/loop0   366K   304K     62K    84%   /run/media/mack/6784-18BE

# sudo file -sL /dev/loop0

/dev/loop0: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "*63hlIHC" cached by Windows 9M, sectors/cluster 4, root entries 512, sectors 768 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 1, sectors/track 63, heads 255, serial number 0x678418be, label: "IBASIC     ", FAT (12 bit)
Some quick math says that

768 sectors x 512 bytes / 1024 = 384KiB

original disk size with 366KiB usable for the filesystem and placed on a 24MiB disk. Cool.

Anyways, there are 18 files, 16 with 28-05-1999 date and 2 with 04-03-2010 date (dd-mm-yyyy) for a total of 288.8KiB. The two newer files, SMWHP.PLT and TEST.PLT, show "Return Loss" and "Average Loss" in ASCII when viewing with ImHex. So these must be helpful extras that some kind soul tacked on. As for "programs" (.PGM extension) we have FIELD_S, INTRMOD, RFTOOLS, SAVRCL, and SCANNER. All of which look interesting to have.

At 43:30 in the HP 8920A RF Communications Set product video an HP rep. goes over how to use IBASIC test programs that were sold as options via PCMCIA cards:

http://www.fathermulcahy.net/HP8924C/

The firmware binaries, on the other hand, do not appear to have any discernible standard file system. Each starts with the ASCII string "FirmwareUpgrade_E6380-87006_B.01.00" and will require being copied directly to a compatible PCMCIA card bit-for-bit. Using ImHex, we can see that the payloads end at 0x3FFFFF and 0x3D7458 which translates to 4MiB and 3.84MiB. So...seeing how these much, much smaller payloads are placed into 24MiB binaries, we can conclude HP likely used 4MiB SRAM or ROM linear flash PCMCIA cards for the A.02.04 FW. And apparently, the E8285A can read at least 24MiB size cards.

Which brings me to my actual questions: Does anyone know if the E8285A can read CompactFlash cards in a PCMCIA CF adapter? CF is supposed to be directly compatible with PCMCIA spec. and was intended to be a very literal "compact" version for storage (requiring only 50 pins instead of 68). And what is the maximum disk size supported? From the bin files, I think 24MiB is possible, why else would someone upload them sized as they are? And if true, then Intel's NOR based flash should be compatible, and not just SRAM and ROM.

[squadchannel]

The history of PCMCIA and PC Cards is a complex and bizarre one.
PCMCIA was first developed in Japan and standardized by JEIDA. In the early days, there were SRAM and DRAM cards.
Later, in the early 90's, it was established as an international standard, PCMCIA 1.0, by JEIDA ver 4.0.

PC Card is a 32-bit version of PCMCIA.

I am not sure whether the E8285A is a PCMCIA or JEIDA card, but I think it is a PCMCIA card based on its age.
CF cards are basically an extended version of the PCMCIA standard. Therefore, it should work.

MOD:
107 page in repaie manual:

PCMCIA_CARD_READER_KIT E6380-61803

Definitely PCMCIA. The smaller the capacity, the better. No need for unnecessary capacity.

I don't know how the firmware binaries were dumped, but I assume that there is no such thing as a file system and that they are used like ROMs.
If that is the case, I think you can write it back to the CF card using the DD command.

[Wallace Gasiewicz]

I have an HP 8935 and an Hp 8922 and Agilent E7495  Service Monitors.   

These definitely use PCMCIA Cards, there is a lot of trouble getting any Compact Flash to actually work in these units.  I suggest you join this group:   

https://groups.io/g/HP8924-Family-Spectrum-Analyzers/topics   

And search for Flash Cards
Here is a quote from one post, I believe it sums up the situation:    I think it also applies to the 8285A.

1/ As others have said the 8924C (and 8920B) use PCMCIA cards, NOT the Epson cards. 2/ The cards are accessed in "linear" mode ie addressed like RAM or ROM.
3/ They will READ any type of PCMCIA card, but will only WRITE to RAM or SRAM cards.
4/ PCMCIA to SD card adaptors WILL NOT WORK
 5/ SOME PCMCIA to CF Adaptors will work but not many. They need to support linear mode, most only work in IDE mode i.e. like  HDD not ROM.

[RaymondMack]

Okay, I spent a good while doing research on this subject and have learned a great deal about the early history of solid state memory.

An excellent timeline is provided here (1989 to 1997, is the key area):

https://www.semianalysis.com/p/the-history-and-timeline-of-flash

Wikipedia also has good coverage of NOR and NAND:

https://en.wikipedia.org/wiki/Flash_memory

Basically, Intel's NOR was first to be used commercially in PCMCIA cards and operates similar to SRAM and PROM with "execute in place". Unlike SRAM, NOR does not need a battery to retain data, but early NOR required higher write voltage like PROM. AMD produced a NOR process that could write at 5V. This is likely what is needed for the E8285A to be able to write to linear flash based cards. Otherwise a toggle switch would need to be used to set the programming voltage to 12V.

So basically we have cards with ROM (rare), SRAM (less rare), "linear flash" (NOR) (somewhat common) and ATA flash (NAND) (extremely common).

A way to delineate ATA flash from linear flash based cards is that linear flash cards have an EEPROM that stores the card information structure or CIS.

Interestingly, very early CompactFlash cards from SunDisk/SanDisk were based on NOR. A CF to PCMCIA adapter is not keyed or wired for ATA or linear flash use, as far as I can tell. However, I have two books all about PCMCIA that I need to skim before I can say for certain. So if anyone got a CF card to work, it was likely with a very early card and not a lucky CF to PC Card adapter.

While we now know that "linear flash" can be read, we still don't know how large of card is supported. The HP FW binary data tops out at 4MiB, so clearly, at least 4MiB can be read. The fact that FAT12 supports up to 16MiB (4KiB cluster) and 32MiB (8KiB cluser) drives suggests that the E8285A can likely read 16MiB cards. And finally, cat87 (or whoever he got the FW from) likely used MCE or possibly CardWare 7.0 to place the bins on 24MiB cards. So 24MiB looks like the max anecdotal sized card that can be read by the E8285A.

That now leaves writing to the linear flash media. Thankfully the Tech2WIKI has a list of known laptops that work with MCE for writing to linear flash cards:

https://tech2wiki.com/content/tech2_pcmcia/pcmcia_slot_compatibility/working_hardware_configurations.html

These old HP and Dell computers are cheap and plentiful. But if you already have an old XP era PC, then Rioch based cards look like they can be used as well:

https://www.amtron.com/reader/pcdrp101cs.htm

And finally, calibration of the E8285A after the FW downgrade: HP units *should* have the full 0.4 to 1000 MHz range cal data stored. HP specifically lists the specs for it in the datasheet. Updating the FW should only have "hidden" the full capability of the instrument. Agilent, on the other hand, used a new datasheet with lesser specs. So these units likely don't have the full cal data and will need to be recalibrated after being flashed. I plan to copy the cal data off of my unit for backup and it would be nice to compare with another HP unit that never had FW greater than A.02.04. And if we can get an Agilent unit's cal data, we could likely work out the cal points and provide a manual calibration procedure for these units.

A basic temporary calibration can be done as shown in the attached .pdf--showing how badly the calibration can be off after downgrading the FW. The second .pdf shows where the cal data is stored.

[TheSteve]

To update the firmware on my 8920B I used linear flash cards written with Memory Card explorer. The laptop I used with MCE didn't have the 12 volt line needed for writing to the cards so I cut that trace behind the PCMCIA socket and added a toggle switch which allowed me to apply 12 volts manually.