Solving the HP16500 Compact Flash card mystery

[av500]

The HP16500 series of logic analyzers comes in three versions: the HP16500A which only runs from LIF formatted floppies and the HP16500B and HP16500C which also incorporate an IDE hard drive, can use MSDOS formatted floppies and where the HP16500C has the most powerful CPU, supports the most memory (mine runs with 64MB now) and has added networking capabilities out of the box.

By now all the original IDE drives are either failing after such a long time or they make rather strange sounds indicating that their end is rather near too. The immediate idea is to replace them with solid state storage, either in the form of an IDE SSD or using compact flash cards which have an electrical interface that is compatible to IDE/ATA.

IDE SSD are rare and/or expensive and you need to take into account that the HP16500B/C operating system only supports FAT12 or FAT16 formatted drives and is thus limited to a drive size of 2GB.

So the easiest way to replace the aging spinning disks is to use a 40-pin IDE to CF adapter and a compact flash card. Sadly a quirk in the 16500 OS makes this not such an easy task.

Many users have found out that the 16500 are very picky about which CF cards actually work, some are rejected outright and the unit does not even boot, others can seemingly be formatted but then no files can be written to the cards. Some people assume it’s due to the specific brand of the IDE to CF adapter, others think that the 16500 issues some special IDE commands that certain cards don’t support. The real reason is much simpler and unfortunately makes finding a supported card a real game of trial and error.

Out of the whole IDE/ATA specification, the HP16500B/C only uses three commands, namely Read Sector (20h), Write Sector (30h) and Identify Drive (ECh). The Identify Drive command returns information about the drive parameters, like model name and serial number but most importantly the drive size and geometry. Amongst the data returned is also one field named “Number of unformatted bytes per sector” which has been present in the earliest versions of the ATA specifications that I could find but for which there was never given any explanation is to what it actually means.

At the time the HP16500B/C were made all hard drives had a sector size of 512 bytes and this number is mentioned explicitly in the specifications several times, without referring to “Number of unformatted bytes per sector”. This field is present up to the official ATA-1 specification but was then quickly retired in the ATA-2 spec of 1996 marking it as “Vendor specific (obsolete)”

When the HP16500B came out in 1994, I assume all hard drives would report the “number of unformatted bytes per sector” as 512 and so the 16500 OS uses that number in order to format and operate the connected hard disk (or SSD or CF card)

Sadly old and current compact flash cards report all kinds of sector sizes. Out of the random collection of cards I acquired over the years or bought specifically in the past weeks, I have seen sizes of 512 (correct), 64, 528, 576 and even 0. For some cards I could find the data sheets and confirm these number there too.

The 16500 dutifully tries to create a FAT16 filesystem using the number as reported by the card but then fails to create a file. Only if the card reports a correct sector size of 512 the card will work.

I have also tried to outsmart the 16500 by using SD cards and an SD to CF adapter of which I have two, one bought in the early 2000s for which I can find no reference on the net and one acquired recently and which uses the common FC1307A chip inside. The early SD to CF adaptor gives a sector size of 512 for all SD cards and works, the newer model sadly always reports 576 and thus cannot be used either.

here are all the cards and adapters I tried:

old SD to CF adapter:

• 32 MB SD Sandisk: works
  
• 512 MB MMC extrememory: works
  
• 1 GB SD Sandisk: works
  
• 4 GB SD: not recognized due to 2GB limit
  

new SD to CF adapter: reports 576, does not work with any SD card

• 16 MB CF Canon: works
  
• 32 MB CF Unknown: works
  
• 64 MB CF HITACHI: works
  
• 64 MB CF extrememory: reports 0, unit does not boot
  
• 256 MB CF DANE-ELEC: reports 528, does not work
  
• 256 MB CF Sandisk: reports 576, does not work
  
• 512 MB CF Sandisk: reports 576, does not work
  
• 1 GB CF iCF4000 Innodisk (bought in 2025): reports 512, works
  
• 1 GB CF MemoryPartner (AliExpress, 2025): reports 512, works
  
• 2 GB CF MemoryPartner (AliExpress, 2025): reports 64, does not work
  
• 4 GB CF MemoryPartner (AliExpress, 2025): reports 512, but is larger than 2 GB so does not work
  

As the Innodisk iCF4000 has been reported to work by others before, is reasonably sized and seems to be easily available at the time of writing, it’s the card I would recommend to get and use with the HP16500B/C. I got a few of them recently and paid ~$7 per card

[aeg]

Thank you for the great work in solving the mystery!

You may be aware that there is a list of compatible cards on KO4BB's Wiki: https://www.ko4bb.com/doku2015/doku.php?id=test_equipment:hard_drive_conversion_to_cf_for_hp16500

I added your information to the Wiki page.

Could this also be why Quantum is the only brand of spindle drive that works in the 16500?

Someone once said they saw a 16500 sending vendor specific commands to a drive, but it could have been a mistake.

Now that we know the secret, it might be possible to patch the 16500's system software to always substitute 512 into the Identify Drive response.

[av500]

You may be aware that there is a list of compatible cards on KO4BB's Wiki: https://www.ko4bb.com/doku2015/doku.php?id=test_equipment:hard_drive_conversion_to_cf_for_hp16500

I added your information to the Wiki page.

thanks for that, I applied to get a login there, but you did it for me! 

[44kgk1lkf6u]

When the device doesn't like some flash card or hard drive, it may help to create a filesystem using a computer.

My 16500C came with a 4 303 756 800 byte hard drive.  I don't know whether it is the original or if the previous owner replaced it.  I tried to save the configuration (stuff such as what the signals were called).  It said there was not enough space on the disk.  It said the file system only had about 8 MiB of space in total.  That was barely enough for the required files.  I zeroed the drive using a computer.  Then I used the logic analyzer to format the drive.  It still only created a FAT12 file system that was only about 8 MiB in size.  I created a 128 MiB FAT16 file system using the computer.  I put the files inside using the computer.  The device could load the files.  It showed that there was 128 MiB of space.  The link contains some information about the format.  Though not everything seems to apply to my case.  It says that the device uses a sector size of 32768 bytes.  But in my case it only created a FAT12 file system that had sectors of 512 bytes.  Maybe there are different versions of the firmware.  When I created the file system using the computer, I did not bother to use large sectors in order to use the entire 4 GiB of space.  128 MiB was enough.  I only had to swap the byte order using dd conv=swab.

https://opengpib.sourceforge.net/HP16500CHardDriveNotes.html

[av500]

It still only created a FAT12 file system that was only about 8 MiB in size ... It says that the device uses a sector size of 32768 bytes.  But in my case it only created a FAT12 file system that had sectors of 512 bytes.  Maybe there are different versions of the firmware. 

this looks more like an overflow error in the firmware to me, where it sees a 4GB drive but thinks its a small drive with <=16MB and thus formats it in FAT12...

[Astralix]

Creating the file system on a computer will not alter the return of the PATA command for the unformatted sector size.

I wonder if it would be possible to just modify the BIOS to use an alternative and supported value field for the sector size, or if we can modify the code to return 512 at any times?

Is there a BIOS dump somewhere? I do own a 16000 unit, but I have no idea if it is B or C...

[av500]

I always wanted to pull the BIOS ROM/EPROM from my 16500C, but it's a PLCC part and I don't have the adapter for it for my EPROM reader... Also I have not yet figured out what actual part it is, so that I could buy a spare one for "experiments"...

[gslick]

Is there a BIOS dump somewhere? I do own a 16000 unit, but I have no idea if it is B or C...

I always wanted to pull the BIOS ROM/EPROM from my 16500C, but it's a PLCC part and I don't have the adapter for it for my EPROM reader... Also I have not yet figured out what actual part it is, so that I could buy a spare one for "experiments"...

16500B firmware in four 32KB 32-pin PLCC packages, 128KB total:
http://www.bitsavers.org/bits/HP/16500/16500B/firmware/

16500C firmware in a single 128KB 32-pin PLCC package:
http://www.bitsavers.org/bits/HP/16500/16500C/

[av500]

Creating the file system on a computer will not alter the return of the PATA command for the unformatted sector size.

I wonder if it would be possible to just modify the BIOS to use an alternative and supported value field for the sector size, or if we can modify the code to return 512 at any times?

Is there a BIOS dump somewhere? I do own a 16000 unit, but I have no idea if it is B or C...

here you go, for the 16500C:

Code: [Select]

address   old  new
000184C9  6E   7C
000184CA  FF   02
000184CB  A2   00

this is untested - as said, I don't have the PLCC adapter for my EPROM reader, but now I have to get/make one

[av500]

and for the 16500B:

Code: [Select]

address  old  new
0001705F  6E  7C
00017060  FF  02
00017061  A2  00

this is for the "merged" 128k file, you need to see what individual EPROM that's in

[kmoonwalker]

from old days we had various issued with car diagnostic testers having CF cards and there was at some point a big problem with testers not booting etc and it went out after investigation that only some Transcend cards were working properly and my very fast and expensive card for DSLR also worked (but costed like 30x other cards).

[av500]

hold your horses, there seems to be a ROM checksum at the end, so that needs to be updated too.

UPDATE:

the last 4 bytes at the end of the file are the 32 bit sum of all bytes up to there

I patched the ROM file and updated the sum but so far it did not boot  but then I only have a 512k FLASH and not a 128k one. I ordered one, so will take a few days....

[av500]

YAY  

ok, so the ROM checksum is not the issue, it then just displays a failed ROM test at boot but otherwise the system works

the problem with my 512k flash chip was that the upper 2 address lines (not used for 128k) are not 00, so the system accessed a higher region of the flash. I have now copied the 128k image 4 times into the 512k and with that my modified ROM boots

and I tried 2 of the CF cards that did not work before and they do work now will test with more cards soon...

[av500]

ok, did a few more tests with some cards and adapters:

• new (bought 2025) SD to CF adapter: reports 576, works now
• 256 MB CF DANE-ELEC: reports 528, works now
• 256/512 MB CF Sandisk: report 576, work now
• 2 GB CF MemoryPartner (AliExpress, 2025): reports 64, works now

so with the patched BIOS, all CF cards up to 2GB (and SD cards using adapters) should work out of the box

[Astralix]

I didn't expect that my thrown in 5 cents of an idea just would be transformed into a solution that fast! As my lab is still in boxes I wouldn't have been able to do it myself.
Nice to see it work and a lot of thanks to @av500 to going at it and making it work!

[av500]

thanks @Astralix for the bitsavers link

the modified ROM file for the HP16500C is attached

[aeg]

the modified ROM file for the HP16500C is attached

That's great work!

I see that this file also patches the checksum 008de29b -> 008de10a, does it pass the ROM test now?

[gslick]

Creating the file system on a computer will not alter the return of the PATA command for the unformatted sector size.

I wonder if it would be possible to just modify the BIOS to use an alternative and supported value field for the sector size, or if we can modify the code to return 512 at any times?

Is there a BIOS dump somewhere? I do own a 16000 unit, but I have no idea if it is B or C...

here you go, for the 16500C:

Code: [Select]

address   old  new
000184C9  6E   7C
000184CA  FF   02
000184CB  A2   00

this is untested - as said, I don't have the PLCC adapter for my EPROM reader, but now I have to get/make one

How did you come up with this patch? Did you use something like IDA Pro or Ghidra to analyze the firmware binary to find where it appeared to be requesting the sector size information from the drive and processing the returned value?

[Astralix]

How did you come up with this patch? Did you use something like IDA Pro or Ghidra to analyze the firmware binary to find where it appeared to be requesting the sector size information from the drive and processing the returned value?

I can't answer that question. Sometimes you are lucky to have thing in close proximity, like an ATA command and a compare or a sub and jump on zero. Sometimes it is the only 0x0200 around.
However, I just had the idea of how to get around the issue, @av500 did all the work.

But that way to solve the issue may enable HDD replacements for a lot of other units from that era in time and not only HP but many other manufacturers.

Edit:
It was actually av500 himself who traced the IDE bus to track down the ATA command sequences in https://www.eevblog.com/forum/testgear/some-questions-about-the-hp-1670g-logic-analyzer/ post.

[av500]

Yes, I used ghidra to reverse engineer enough of the BIOS to find the ATA Identity Drive command and replace the sector size with a fixed value of 512. And now I know much more about 68000 assembler than I ever wanted to 

[44kgk1lkf6u]

The patch was posted less than a day after the original binary.  You could not even test the patch back then.  It is amazing that you figured out how the program worked so fast.

[av500]

I just checked the HP167xE ROM, that one simply hard codes the sector size to 512 instead of reading it from the drive and they also limit the number of cylinders to 4096, I guess by the time that came out drives had gotten bigger