The cmp file is compressed, if I remember correctly it's a scheme similar to LZ77 or LZSS. I ended up desoldering the eeprom used for the bootloader (there's a 17th one off to the side of the main grid of 16) & dumped that, reverse engineered the scheme, and wrote a tool to decompress it:
On Tue, 18 Jan 2022 at 07:52, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote:
Great job!? What is that cmp file format - uncompresed from firmware release for 54750 unit ? Is it some sort of disk image ? can't open it by Ghidra, code analysis doesn't show anything for mc68k my guesse is that it's kind of compresed ? I havn't open my scope yet, didn't know that there is so many eeproms. Currently im trygin to read eproms from my plugins, i will probably do some tries at evenign after work.?
W wtorek, 18 stycznia 2022, 06:39:03 UTC, Mike Walters < mike@...> napisa?(-a):
Basically just from spending lots of time staring at the disassembly in Ghidra and making educated guesses about what the code is doing.
I've attached a screenshot of the relevant parts of the code. In it there's a function that updates the serial number of a plug-in module - it checks that the module is present & unprotected, updates the serial number field in a struct in RAM, calls a function to re-calculate the checksum, then wakes the module interface task to do the write. The checksum calculation function sets the byte at 0x48 to 0 & sets the byte at 0x49 to 1 (because it's accessed as a uint16), sums up all the bytes, then writes the negation of the sum to 0x48 (making everything add to 0).
It would be great to get a firmware copy from the eeprom, but it may be too much hassle. In my machine the firmware is spread across 16 eeproms that are all soldered down and I think the 54720 uses the same mainboard.
Another option could be dumping it via GPIB - there are some undocumented memory peek/poke commands so with a bit of scripting they can be used to dump the whole flash.
On Mon, 17 Jan 2022 at 16:22, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote:
Mike, could you explain how did you figure out that checksum bytes are at 0x48 and 0x7a ? Do you have any knowledge what thay represent ? Im preparing HW to get flash content from my 75412A and 75421A plugins to make sure that the patterns are correct. If that would be usefull for you, i could also try to get firmware directly from mainframe eeprom/flash, it would be good for me also to have backup because i don't have instalation disk. About serial bit at 0x07 byte, in 54721A it's 0x0c, which represents last two digits of model number - maybe that's the pattern ?. I will verify when i will have 54721 firmware image.??
Thanks Arek
W poniedzia?ek, 10 stycznia 2022, 09:49:07 UTC, Mike Walters < mike@...> napisa?(-a):
Yeah, it would be helpful to compare the EEPROM image from two units. Though I was thinking more about the actual firmware that runs on the mainframe, I could reverse engineer that and figure it out. I do have a firmware image from my 83480A (aka 54750A) which I expect to be very similar and I've worked out the EEPROM format/checksums that it uses: The first two bytes are a (big-endian) uint16 denoting the total length of the data. The first checksum is verified by summing the first 0x7A bytes and checking that the result is zero, and the checksum byte itself is at 0x48 The second checksum is verified by summing bytes over the whole image (using the length field), and that checksum byte is at 0x7A. Both of these schemes validate correctly on the 54712A image posted above. Another thing to note is that the byte at 0x07 is a sort-of model ID and it needs to match what the firmware expects for the model string just after. Without a 54720 firmware image I can't tell what it's supposed to be, though it could be guessed in maybe 10-20 tries if someone's keen to do a bit of tedious work? :) Cheers, Mike On Wed, 5 Jan 2022 at 15:44, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote: > > I was thinking about exactly the same. Do you want to compare to see where the check sume is stored ? > > W ?roda, 5 stycznia 2022, 03:26:37 UTC, Mike Walters < mike@...> napisa?(-a): > > > Does anyone have a copy of the 54720 or 54710 firmware disk? If I > could take a look at that, I can probably figure out how to make a > 54717a eeprom image for you. > > On Tue, 4 Jan 2022 at 16:55, Arkadiusz Gibes via > <arkadiusz.gibes= [email protected]> wrote: > > > > I already found the 54712 eeprom image that you shared. Do you have any possibility, to download same firmware from the other unit ? I would like to compare. I have one 54712 unit, but still don't have programmer. > > > > W wtorek, 4 stycznia 2022, 16:46:54 UTC, Ovidiu Popa [Business] < ovidiu.popa@...> napisa?(-a): > > > > > > Sorry, no, I gave up and wrote off the 54720D. I have too many scopes anyway, from 100MHz to 50GHz, not enough incentive to spend more time on this. Meantime, watching for a 54717A, ideally someone owning one could dump the EEPROM. I know if I'd get one, this would be the first thing I'd do, this HP money grabbing calibration abomination has to end. > > > > If someone wants to pick up, I can forward the 54712A EEPROM binary. > > > > > > > >
|
Re: HP 8566B repair: -10V rail went down
I have seen the power rail pass transistors fail - they are actually socketed to the motherboard with copper rivets. Failure mode: sometimes corrosion (copper oxide) between the motherboard and the rivet, sometimes the solder joint joint between the rivet and motherboard breaks. Troubleshooting: tap on the motherboard near the failing rail pass transistor while monitoring the power rail. Solution or fix: clean the rivet to motherboard connection then solder the transistor lead to the motherboard - beyond the rivet connection.
Don Bitters
|
Great job!? What is that cmp file format - uncompresed from firmware release for 54750 unit ? Is it some sort of disk image ? can't open it by Ghidra, code analysis doesn't show anything for mc68k my guesse is that it's kind of compresed ? I havn't open my scope yet, didn't know that there is so many eeproms. Currently im trygin to read eproms from my plugins, i will probably do some tries at evenign after work.?
W wtorek, 18 stycznia 2022, 06:39:03 UTC, Mike Walters <mike@...> napisa?(-a):
Basically just from spending lots of time staring at the disassembly in Ghidra and making educated guesses about what the code is doing.
I've attached a screenshot of the relevant parts of the code. In it there's a function that updates the serial number of a plug-in module - it checks that the module is present & unprotected, updates the serial number field in a struct in RAM, calls a function to re-calculate the checksum, then wakes the module interface task to do the write. The checksum calculation function sets the byte at 0x48 to 0 & sets the byte at 0x49 to 1 (because it's accessed as a uint16), sums up all the bytes, then writes the negation of the sum to 0x48 (making everything add to 0).
It would be great to get a firmware copy from the eeprom, but it may be too much hassle. In my machine the firmware is spread across 16 eeproms that are all soldered down and I think the 54720 uses the same mainboard.
Another option could be dumping it via GPIB - there are some undocumented memory peek/poke commands so with a bit of scripting they can be used to dump the whole flash.
On Mon, 17 Jan 2022 at 16:22, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote:
Mike, could you explain how did you figure out that checksum bytes are at 0x48 and 0x7a ? Do you have any knowledge what thay represent ? Im preparing HW to get flash content from my 75412A and 75421A plugins to make sure that the patterns are correct. If that would be usefull for you, i could also try to get firmware directly from mainframe eeprom/flash, it would be good for me also to have backup because i don't have instalation disk. About serial bit at 0x07 byte, in 54721A it's 0x0c, which represents last two digits of model number - maybe that's the pattern ?. I will verify when i will have 54721 firmware image.??
Thanks Arek
W poniedzia?ek, 10 stycznia 2022, 09:49:07 UTC, Mike Walters < mike@...> napisa?(-a):
Yeah, it would be helpful to compare the EEPROM image from two units. Though I was thinking more about the actual firmware that runs on the mainframe, I could reverse engineer that and figure it out. I do have a firmware image from my 83480A (aka 54750A) which I expect to be very similar and I've worked out the EEPROM format/checksums that it uses: The first two bytes are a (big-endian) uint16 denoting the total length of the data. The first checksum is verified by summing the first 0x7A bytes and checking that the result is zero, and the checksum byte itself is at 0x48 The second checksum is verified by summing bytes over the whole image (using the length field), and that checksum byte is at 0x7A. Both of these schemes validate correctly on the 54712A image posted above. Another thing to note is that the byte at 0x07 is a sort-of model ID and it needs to match what the firmware expects for the model string just after. Without a 54720 firmware image I can't tell what it's supposed to be, though it could be guessed in maybe 10-20 tries if someone's keen to do a bit of tedious work? :) Cheers, Mike On Wed, 5 Jan 2022 at 15:44, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote: > > I was thinking about exactly the same. Do you want to compare to see where the check sume is stored ? > > W ?roda, 5 stycznia 2022, 03:26:37 UTC, Mike Walters < mike@...> napisa?(-a): > > > Does anyone have a copy of the 54720 or 54710 firmware disk? If I > could take a look at that, I can probably figure out how to make a > 54717a eeprom image for you. > > On Tue, 4 Jan 2022 at 16:55, Arkadiusz Gibes via > <arkadiusz.gibes= [email protected]> wrote: > > > > I already found the 54712 eeprom image that you shared. Do you have any possibility, to download same firmware from the other unit ? I would like to compare. I have one 54712 unit, but still don't have programmer. > > > > W wtorek, 4 stycznia 2022, 16:46:54 UTC, Ovidiu Popa [Business] < ovidiu.popa@...> napisa?(-a): > > > > > > Sorry, no, I gave up and wrote off the 54720D. I have too many scopes anyway, from 100MHz to 50GHz, not enough incentive to spend more time on this. Meantime, watching for a 54717A, ideally someone owning one could dump the EEPROM. I know if I'd get one, this would be the first thing I'd do, this HP money grabbing calibration abomination has to end. > > > > If someone wants to pick up, I can forward the 54712A EEPROM binary. > > > > > > > >
|
Basically just from spending lots of time staring at the disassembly in Ghidra and making educated guesses about what the code is doing.
I've attached a screenshot of the relevant parts of the code. In it there's a function that updates the serial number of a plug-in module - it checks that the module is present & unprotected, updates the serial number field in a struct in RAM, calls a function to re-calculate the checksum, then wakes the module interface task to do the write. The checksum calculation function sets the byte at 0x48 to 0 & sets the byte at 0x49 to 1 (because it's accessed as a uint16), sums up all the bytes, then writes the negation of the sum to 0x48 (making everything add to 0).
It would be great to get a firmware copy from the eeprom, but it may be too much hassle. In my machine the firmware is spread across 16 eeproms that are all soldered down and I think the 54720 uses the same mainboard.
Another option could be dumping it via GPIB - there are some undocumented memory peek/poke commands so with a bit of scripting they can be used to dump the whole flash.
On Mon, 17 Jan 2022 at 16:22, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote:
Mike, could you explain how did you figure out that checksum bytes are at 0x48 and 0x7a ? Do you have any knowledge what thay represent ? Im preparing HW to get flash content from my 75412A and 75421A plugins to make sure that the patterns are correct. If that would be usefull for you, i could also try to get firmware directly from mainframe eeprom/flash, it would be good for me also to have backup because i don't have instalation disk. About serial bit at 0x07 byte, in 54721A it's 0x0c, which represents last two digits of model number - maybe that's the pattern ?. I will verify when i will have 54721 firmware image.??
Thanks Arek
W poniedzia?ek, 10 stycznia 2022, 09:49:07 UTC, Mike Walters < mike@...> napisa?(-a):
Yeah, it would be helpful to compare the EEPROM image from two units. Though I was thinking more about the actual firmware that runs on the mainframe, I could reverse engineer that and figure it out. I do have a firmware image from my 83480A (aka 54750A) which I expect to be very similar and I've worked out the EEPROM format/checksums that it uses: The first two bytes are a (big-endian) uint16 denoting the total length of the data. The first checksum is verified by summing the first 0x7A bytes and checking that the result is zero, and the checksum byte itself is at 0x48 The second checksum is verified by summing bytes over the whole image (using the length field), and that checksum byte is at 0x7A. Both of these schemes validate correctly on the 54712A image posted above. Another thing to note is that the byte at 0x07 is a sort-of model ID and it needs to match what the firmware expects for the model string just after. Without a 54720 firmware image I can't tell what it's supposed to be, though it could be guessed in maybe 10-20 tries if someone's keen to do a bit of tedious work? :) Cheers, Mike On Wed, 5 Jan 2022 at 15:44, Arkadiusz Gibes via <arkadiusz.gibes= [email protected]> wrote: > > I was thinking about exactly the same. Do you want to compare to see where the check sume is stored ? > > W ?roda, 5 stycznia 2022, 03:26:37 UTC, Mike Walters < mike@...> napisa?(-a): > > > Does anyone have a copy of the 54720 or 54710 firmware disk? If I > could take a look at that, I can probably figure out how to make a > 54717a eeprom image for you. > > On Tue, 4 Jan 2022 at 16:55, Arkadiusz Gibes via > <arkadiusz.gibes= [email protected]> wrote: > > > > I already found the 54712 eeprom image that you shared. Do you have any possibility, to download same firmware from the other unit ? I would like to compare. I have one 54712 unit, but still don't have programmer. > > > > W wtorek, 4 stycznia 2022, 16:46:54 UTC, Ovidiu Popa [Business] < ovidiu.popa@...> napisa?(-a): > > > > > > Sorry, no, I gave up and wrote off the 54720D. I have too many scopes anyway, from 100MHz to 50GHz, not enough incentive to spend more time on this. Meantime, watching for a 54717A, ideally someone owning one could dump the EEPROM. I know if I'd get one, this would be the first thing I'd do, this HP money grabbing calibration abomination has to end. > > > > If someone wants to pick up, I can forward the 54712A EEPROM binary. > > > > > > > >
|
"I'm not rich enough to use cheap tools"
-Dave
toggle quoted message
Show quoted text
On 1/17/22 9:54 PM, Jim Ford wrote: Right about HP; one of my former colleagues said it stood for "High Prices"!
Jim Ford
------ Original Message ------
From: "Tom Lee" <tomlee@... <mailto:tomlee@...>>
To: [email protected] <mailto:[email protected]>
Sent: 1/17/2022 8:23:05 PM
Subject: Re: [HP-Agilent-Keysight-equipment] HP Diode ID Help
Hi Greg,
Thanks for that -- I would've guessed that they would shoot for deltas of 10% or so, and those numbers are within ~2x of that guess, so 20mV and 0.2pF seem perfectly reasonable. In sampling bridges, I'd like those to be a little better matched, but I don't know if HP went to the trouble of tightening the matching criteria for that case. It certainly would have driven up the cost (although HP was never too shy of pricing the components appropriately).
Thanks again for the data (and the correction), Greg. I do appreciate it.
--Cheers
Tom
--
Prof. Thomas H. Lee
Allen Ctr., Rm. 205
350 Jane Stanford Way
Stanford University
Stanford, CA 94305-4070
On 1/17/2022 17:32, Greg Muir via groups.io wrote:
Tom,
Thanks for pointing this out.I was on the way out the door when I wrote the post and overlooked some details.
From what I can gather from the scatty information I have it appears that they are trying to match the diodes with a maximum delta V_f of 20 mV and a maximum delta C_o of 0.2 pF.It doesn¡¯t appear that there are actual hard values for both of those parameters but, instead simply trying to match the two diodes as close as possible to each other no matter where the values fall.
What bothers me a bit is that the probe schematic shows a quad set of diodes.A pair would only serve to replace half of the quad.HP did sell a matched quad set of this particular diode under part number 5082-2370.Any thoughts on this one?
Greg
--
Dave McGuire, AK4HZ
New Kensington, PA
|
Re: HP 8566B repair: -10V rail went down
"Bill Martin" <wwm@...> writes: Perhaps try sniffing through a latex or some other very flexible hose
that can get you smell samples from close to the pcb? Sort of like the
old mechanics "stethoscope" noise finder... Interesting idea, I hadn't thought of that. Thanks Bill! On Mon, Jan 17, 2022 at 6:56 PM Bill Martin <wwm@...> wrote:
Perhaps try sniffing through a latex or some other very flexible hose
that can get you smell samples from close to the pcb? Sort of like the
old mechanics "stethoscope" noise finder...
Bill
On 1/17/22 6:48 PM, Matt Huszagh wrote:
"Bruce" <bruce@...> writes:
Yes, I understand, just be sure you look wherever you can see them.
Can you get any sense of where the smell came from? Did you see any
smoke? That would be a good place to look. Burned resistors are
sometimes hard to spot because they don't "carbonize" they just get a
little bit darker. I did see a little smoke. Unfortunately, I wasn't expecting it and was
more preoccupied with turning the unit off, so I didn't get a clear idea
of the origin. I tried to track the smell but it wasn't easy. And I
wasn't eager to reproduce the experiment to make it easier to locate the
source. The burned smell (which is still noticible when turn the unit
on) seems to be coming from near the RF module. However, if the fan is
pulling air into the instrument from the back (I should have checked
this) it might appear as if it's coming from here even if it's further
back.
Matt
|
Right about HP; one of my former colleagues said it stood for "High Prices"!
Jim Ford
------ Original Message ------
Sent: 1/17/2022 8:23:05 PM
Subject: Re: [HP-Agilent-Keysight-equipment] HP Diode ID Help
Hi Greg,
Thanks for that -- I would've guessed that they would shoot for
deltas of 10% or so, and those numbers are within ~2x of that guess,
so 20mV and 0.2pF seem perfectly reasonable. In sampling bridges,
I'd like those to be a little better matched, but I don't know if HP
went to the trouble of tightening the matching criteria for that
case. It certainly would have driven up the cost (although HP was
never too shy of pricing the components appropriately).
Thanks again for the data (and the correction), Greg. I do
appreciate it.
--Cheers
Tom
--
Prof. Thomas H. Lee
Allen Ctr., Rm. 205
350 Jane Stanford Way
Stanford University
Stanford, CA 94305-4070
On 1/17/2022 17:32, Greg Muir via
groups.io wrote:
Tom,
?
Thanks for
pointing this out.? I
was on the way out the door when I wrote the post and overlooked
some details.
?
From what I can
gather from the scatty information I have it appears that they
are trying to match the diodes with a maximum delta Vf of
20 mV and a maximum delta Co of 0.2 pF.? It doesn¡¯t appear that
there are actual hard values for both of those parameters but,
instead simply trying to match the two diodes as close as
possible to each other no matter where the values fall.
?
What bothers me a
bit is that the probe schematic shows a quad set of diodes.? A pair would only serve
to replace half of the quad.? HP
did sell a matched quad set of this particular diode under part
number 5082-2370.? Any
thoughts on this one?
?
Greg
|
Re: HP 8566B repair: -10V rail went down
Perhaps try sniffing through a latex or some other very flexible hose that can get you smell samples from close to the pcb? Sort of like the old mechanics "stethoscope" noise finder...
Bill
toggle quoted message
Show quoted text
On 1/17/22 6:48 PM, Matt Huszagh wrote: "Bruce" <bruce@...> writes:
Yes, I understand, just be sure you look wherever you can see them.
Can you get any sense of where the smell came from? Did you see any
smoke? That would be a good place to look. Burned resistors are
sometimes hard to spot because they don't "carbonize" they just get a
little bit darker. I did see a little smoke. Unfortunately, I wasn't expecting it and was
more preoccupied with turning the unit off, so I didn't get a clear idea
of the origin. I tried to track the smell but it wasn't easy. And I
wasn't eager to reproduce the experiment to make it easier to locate the
source. The burned smell (which is still noticible when turn the unit
on) seems to be coming from near the RF module. However, if the fan is
pulling air into the instrument from the back (I should have checked
this) it might appear as if it's coming from here even if it's further
back.
Matt
|
Re: HP 8566B repair: -10V rail went down
A good place to check for burned smell would be the RIFA capacitors on the power input.? They're filters, and fail (especially often) in 240 volt land.
The equipment will work without them, but they have a very distinctive (and lingering) smell.
They fail, but less often, in 120 volt land.
Harvey
toggle quoted message
Show quoted text
On 1/17/2022 9:48 PM, Matt Huszagh wrote: "Bruce" <bruce@...> writes:
Yes, I understand, just be sure you look wherever you can see them.
Can you get any sense of where the smell came from? Did you see any
smoke? That would be a good place to look. Burned resistors are
sometimes hard to spot because they don't "carbonize" they just get a
little bit darker. I did see a little smoke. Unfortunately, I wasn't expecting it and was
more preoccupied with turning the unit off, so I didn't get a clear idea
of the origin. I tried to track the smell but it wasn't easy. And I
wasn't eager to reproduce the experiment to make it easier to locate the
source. The burned smell (which is still noticible when turn the unit
on) seems to be coming from near the RF module. However, if the fan is
pulling air into the instrument from the back (I should have checked
this) it might appear as if it's coming from here even if it's further
back.
Matt
|
Re: HP 8566B repair: -10V rail went down
"Bruce" <bruce@...> writes: Yes, I understand, just be sure you look wherever you can see them.
Can you get any sense of where the smell came from? Did you see any
smoke? That would be a good place to look. Burned resistors are
sometimes hard to spot because they don't "carbonize" they just get a
little bit darker. I did see a little smoke. Unfortunately, I wasn't expecting it and was more preoccupied with turning the unit off, so I didn't get a clear idea of the origin. I tried to track the smell but it wasn't easy. And I wasn't eager to reproduce the experiment to make it easier to locate the source. The burned smell (which is still noticible when turn the unit on) seems to be coming from near the RF module. However, if the fan is pulling air into the instrument from the back (I should have checked this) it might appear as if it's coming from here even if it's further back. Matt
|
Hi Greg,
Thanks for that -- I would've guessed that they would shoot for
deltas of 10% or so, and those numbers are within ~2x of that guess,
so 20mV and 0.2pF seem perfectly reasonable. In sampling bridges,
I'd like those to be a little better matched, but I don't know if HP
went to the trouble of tightening the matching criteria for that
case. It certainly would have driven up the cost (although HP was
never too shy of pricing the components appropriately).
Thanks again for the data (and the correction), Greg. I do
appreciate it.
--Cheers
Tom
--
Prof. Thomas H. Lee
Allen Ctr., Rm. 205
350 Jane Stanford Way
Stanford University
Stanford, CA 94305-4070
On 1/17/2022 17:32, Greg Muir via
groups.io wrote:
toggle quoted message
Show quoted text
Tom,
?
Thanks for
pointing this out.? I
was on the way out the door when I wrote the post and overlooked
some details.
?
From what I can
gather from the scatty information I have it appears that they
are trying to match the diodes with a maximum delta Vf of
20 mV and a maximum delta Co of 0.2 pF.? It doesn¡¯t appear that
there are actual hard values for both of those parameters but,
instead simply trying to match the two diodes as close as
possible to each other no matter where the values fall.
?
What bothers me a
bit is that the probe schematic shows a quad set of diodes.? A pair would only serve
to replace half of the quad.? HP
did sell a matched quad set of this particular diode under part
number 5082-2370.? Any
thoughts on this one?
?
Greg
|
Re: HP 8566B repair: -10V rail went down
"Harvey White" <madyn@...> writes: Thinking of fuses, a 1 amp fuse doesn't blow at 1.1 amps.
Certainly Chemical fuses (resettable) say may blow in 30 seconds at 2
amps, maybe 5 seconds at 4 amps, and almost immediately at 10 amps.
Since regular fuses may well behave similarly, that 5 amps may be an OMG
rating, (if it was the correct fuse in the first place). Interesting. Why wouldn't the designers use a fuse closer to the max current draw? FYI it is the right fuse, I'm just taking the value from the manual. With a current limited supply (highly recommended), I'd have started out
at, say 100ma, then gone up by increasing the current limit.? Note that
you can thoroughly confuse some of the circuitry by doing this, so it's
a bit iffy.
Otherwise, say setting it an an amp, then two amps, etc, may give you a
better idea of how the circuit is behaving.
All a bit dicey, though, depending on the equipment. Yeah, lesson learned I guess. Matt
|
Tom,
?
Thanks for pointing this out.? I was on the way out the door when I wrote the post and overlooked some details.
?
From what I can gather from the scatty information I have it appears that they are trying to match the diodes with a maximum delta Vf of 20 mV and a maximum delta Co of 0.2 pF.? It doesn¡¯t appear that there are actual hard values for both of those parameters but, instead simply trying to match the two diodes as close as possible to each other no matter where the values fall.
?
What bothers me a bit is that the probe schematic shows a quad set of diodes.? A pair would only serve to replace half of the quad.? HP did sell a matched quad set of this particular diode under part number 5082-2370.? Any thoughts on this one?
?
Greg
|
[Troubleshoot] HP 08590-60352 / A-3202-53 narrow band IF card Option 130 with HP 8594E
Hi, following the other topic that I started but then closed, I am now facing what I think is the real issue.
Without the card, the CAL is successful.
However, when the card is installed, it fails at different tests depending if I run a second CAL right after a failure or not.
The failing error messages are when the card is installed are :
CAL : GAIN FAIL <-- This one is usually the first to appear
CAL : NBW gain failed
CAL : NBW 200hz notch failed (I see the notch, but the marker is not in it and I see the Freq drifting when stopped)
What would be the first steps to troubleshoot this ?
Thank you.
|
Or look for an avionics shop that might be interested in it, and then get something you might use more regularly.?
toggle quoted message
Show quoted text
On Jan 17, 2022, at 6:32 PM, Stevegibson@... wrote:
?Hi
Yep, got a sensor, although privacy not going to be measuring many pulse signals.
Probably need to experiment to see what uses I can find for it
Steve
|
Re: HP 8566B repair: -10V rail went down
Yes, I understand, just be sure you look wherever you can see them. Can you get any sense of where the smell came from? Did you see any smoke? That would be a good place to look. Burned resistors are sometimes hard to spot because they don't "carbonize" they just get a little bit darker.
The comment about cards shifting in their sockets causing the problem is a possibility, but probably a lower probability event if everything was screwed down.
The obvious approach it to look at all cards that use the -10v supply.
Cheers!
Bruce
Quoting Matt Huszagh <huszaghmatt@...>:
toggle quoted message
Show quoted text
"Bruce" <bruce@...> writes:
Be sure to examine the motherboard for burned traces. I didn't notice any burned motherboard traces when viewing the bottom of
the unit. Unfortunately, viewing motherboard traces from the top is a
bit tricky.
Matt
|
Re: HP 8566B repair: -10V rail went down
Thinking of fuses, a 1 amp fuse doesn't blow at 1.1 amps.
Certainly Chemical fuses (resettable) say may blow in 30 seconds at 2 amps, maybe 5 seconds at 4 amps, and almost immediately at 10 amps.
Since regular fuses may well behave similarly, that 5 amps may be an OMG rating, (if it was the correct fuse in the first place).
With a current limited supply (highly recommended), I'd have started out at, say 100ma, then gone up by increasing the current limit.? Note that you can thoroughly confuse some of the circuitry by doing this, so it's a bit iffy.
Otherwise, say setting it an an amp, then two amps, etc, may give you a better idea of how the circuit is behaving.
All a bit dicey, though, depending on the equipment.
Harvey
toggle quoted message
Show quoted text
On 1/17/2022 6:15 PM, Matt Huszagh wrote: "Radu Bogdan Dicher" <vondicher@...> writes:
That said, I find an intermittent header contact - or any other contacts -
much more likely a source of intermittent behaviors of the circuit. I'd
typically clean up such things with 99.99% pure IPA, and then apply a
conservative amount of deoxit for contact conditioning (most contacts
benefit from this). But be careful near plastic, as it can affect it
negatively in time.
Radu. That's what I'm thinking too. It seems possible it's a failing cap, but
it's going to be really hard to track down unless it gives me a
consistent error to diagnose, especially since the -10V rail feeds so
much downstream circuitry, and a lot of it like the YTO loop and RF
module are hard to get at.
It also seems really possible (and maybe more likely, as you mention)
that some board wasn't properly seated, or a connector was loose, or
similar, especially since it demonstrated the error after spending some
time in the trunk of a car. I did pull out and reseat a number of cards
while troubleshooting, so it's possible I inadvertently fixed the
problem. Still, I don't totally understand why this would cause the -10V
rail to disappear.
If there was a failing cap on the -10V rail I think I'd see some
ripple. But I didn't measure any.
Since I'm not inclined to pull apart the entire instrument looking for a
problem that will be hard to recognize when I see it, I think I'll
probably put the instrument back and wait for the problem to reappear to
troubleshoot. If anyone thinks this is a bad idea, please let me know.
FWIW, my supply is current-limited but I set the limit to the current
rating of the -10V fuse (i.e., 5A). I did quadruple check that I got
polarity right, so I don't think that was the problem (and my supply is
floating). I probably should have set the limit lower, but I had trouble
finding how much current that regulator should supply under normal
conditions. I'm now measuring a current draw of about 1.5A.
Matt
|
Re: HP 8566B repair: -10V rail went down
"Bruce" <bruce@...> writes: Be sure to examine the motherboard for burned traces. I didn't notice any burned motherboard traces when viewing the bottom of the unit. Unfortunately, viewing motherboard traces from the top is a bit tricky. Matt
|
Re: HP 8566B repair: -10V rail went down
Be sure to examine the motherboard for burned traces.
Quoting Matt Huszagh <huszaghmatt@...>:
toggle quoted message
Show quoted text
Update:
I plugged in the instrument and left it long enough for the oven to warm
up. I then powered it on. No error messages appeared and the instrument
sweeps fine. I provided a few test signals to the input and they all
look good. 5 GHz, 10 GHz and 15 GHz at 0 dBm all appear as they should.
There's obviously still a problem, but it no longer sounds like my
blunder caused serious damage. I'll keep searching downstream of the -10
and -5.2V rails.
Matt
|
Hi
Yep, got a sensor, although privacy not going to be measuring many pulse signals.
Probably need to experiment to see what uses I can find for it
Steve
|
Dave McGuire