The video is as great as every other on this channel, but I'd really have liked to see how you repaired the lifted solder pad on the VFD controller. You might think that this is boring for your viewers, but at least for me it isn't.
Random question. I really like your screwdriver and pliers sets that appear in the video. Were these purchased as sets or built up from individual units? As well, where did you get the pliers holder from?
They are Wiha products. The plier set is custom put together of the ones I thought would be most useful to me. The screwdriver set exists but has missing parts so I added what was missing to the set. But I have to warn you, the screwdriver + the plier set will set you back about a grand... :( Everything is ESD safe.
If it were me, as soon as I saw those cooked chips, I would have given up on that board and tried to replace it with an Arduino Nano based functional equivalent, with an LCD or OLED display rather than VFD. Using the Arduino/display for debugging, and driving the unit through GPIB, it should not be too hard to unravel the protocol from the main board, though coming up with the responses back to it could be a little more tricky. (Access to a working unit would be a huge help here) I think such an exercise would be more fun (and cheaper) than fixing the damaged board, and the result could be a much cooler (and longer lived) display.
We were using the E3648 and E3649 PSUs in production environment. To be honest I wasn't really amazed by them. I can remember two cases when they've failed. One case it randomly restarted and of course ruined the current testing. Actually it did it quite often. It turned out that the display connector was loose. Okay, it might be a manufacturing error. Happens even at the best places. The other case made me really questioning the quality of them. Sometimes it stopped to response to the control PC. It was controlled via GPIB. In that models the GPIB/serial control board is over the heatsink but so close it touched it occasionally and shorted something. It did not work until restarting the unit. Maybe some spacer was missing but I think the PCB was simply too close to the heatsink. I've got schematic for this unit. If you want it I can send it to you. Actually it wont't help in this case.
Well, It turned my world view upside down to such a degree that I just had to measure it and well, those that I measured weren't connected(!).. That could also explain why the voltage you measured was so of... ;)
@@NerdNordic Yeah, I was a bit surprised by that assumption. At RF frequencies it is probably fine but for DC it is rather wishful thinking even if you have found it to be the case for some manufacturers.
I have a complete working display for this unit. In fact I have an entire unit. The PSU itself has some issues but display and control panel are fully responsive. Let me know if you are wanting it still.
There should be an Agilent order number on the dead 80C51 as well. Like "1805-2207" or so. They are always 4 digits, a dash and 4 digits. I could look through my box with HP/Agilent leftovers and see if I can find something.
Well, you could build a controller that communicates trough the GPIB interface, controls the VFD driver chip and scans the buttons. That would be a lot of work, but hey, it's a option... :)
I know these videos take a lot of time on your part. This one was not cheap, either. I appreciate the effort you go through. I still enjoyed the repair attempt. I don't have that meter, so no part is on hand.
Good video as always. I was thinking when the video jumped to you having the parts and I saw those digi key bags and the micros NOT in a digi key bag that you somehow got originals from Keysight ... Then.. oops! Since you do a lot of reviews for manufacturers do you have any contacts at Keysight perhaps that can possibly help?
Excellent video - very interesting. Why not try contacting Agilent, explain your problem and point them at this video. They may send you a board, a part or just mail you the code for the processor. Nothing to lose in trying ...
Great video, thanks. Have you thought about just using this as a headless unit through software? Perhaps there is a potential use in your lab for something like that, or maybe a long-term experiment that needs a power supply. Also, have you heard of or used Chip Quik? It makes removing surface mount ICs so much easier.
Any chance reverse engineering a functional unit, and write up some code for the IC? I know that probably the time and effort not worth, but for educational (for viewers) value is incontestable, i think.
I like the shelving system you have for stacking test equipment on the bench. Seems very versatile. I've been thinking of doing something similar. Is that something you bought or is it something custom you put together yourself?
I don't know much about the 8051 series. If we had a working unit, can the rom image be extracted? Or could such code only come from Agilent/Keysight? I have one at work.
They did have some code protection and companies using mark ROM versions would normally enable the code protection to prevent readout with an external programmer. Vulnerabilities for many chips have been developed over the years but doing so in many regions would cause you to run afoul of DMCA laws or similar. Reverse engineering the protocol and the VFD and keyboard layout will be a lot of unpaid work but should allow a competent programmer to replicate the code unless it makes use of fringe processor features that have to be just so that are difficult to detect form the external signals that might cause slight timing differences and let the main board think the display was malfunctioning.
I am myself in the process of "fixing" the front panel display of a 349701A and I'm facing the same problem of a dead 87C51 without having it's firmware. Hopefully a nice EEVBlog's forum member will try to retrieve the fw from the microcontroller (I'm slowly describing the process on my humble blog whatever.sdfa3.org/hp-34970a-data-acquisition-unit.html ) Have you finally had the opportunity to find the firmware for this device?
Another great video, thanks. A real shame about the mask ROM CPU. It seems to me like massive overkill to have a processor on what is, after all, a basic keyboard/display board. Or at least it would have been had they not stuffed a processor on it too!
The Signal Path www.ebay.de/itm/192183286857 This is one of the several examples that are out there. But it's tempting to not buy an Adapter. Some on the EEV Forum bought one and they are working . Not talking about the speed and signal integrity. www.eevblog.com/forum/testgear/flood-of-new-agilent-82357b-gpib-usb-adaptors-on-ebay-the-real-deal/75/ What do you think? Of course, only if you have time for it.
Great video. Good to see that even experienced engineers fail sometimes:) ----------- Maybe if the Maskrom part of the die survived you can still find some live ports and read the MROM?
There are some crazy chip reverse engineer types who will decap a mask or fuse ROM IC and then use a microscope to read the metal mask and decode the program. It would be interesting to establish the communications protocol between the main board and the display. It is likely similar on a lot of HP gear from that era and might be possible to write new code as it is likely pretty crude, display the following number and turn on the following annunciators and report any key presses if the display unit has the same part number across a range of units it might make the range of donor machines wider. The code might even be common across other similar units with more or less buttons. A schematic for the PSU does exist out there as someone above offered it and writing a program is doable.
I got a couple of those lying around (80C51) but as you said it contains the OTP rom on it and without that it will be useless, you can turn a 80c51 to 80c31 (no internal rom) and attach a ROM to it, but again you need the firmware of that IC. if you want I can send you one.
First I was super jealous when the problem was just a bad front display, but then that front display became a very expensive (near impossible) fix. I never get to buy faulty equipment with easy fixes.
Have you managed to obtain the firmware in the meantime? If not, look what FeedbackLoop has done. He managed to get the firmware and programmed an Atmel 8051 with it: th-cam.com/video/E3F59nj6Fho/w-d-xo.html
Here it is 2019, and judging from the video list and comments, this never got fixed. I don't know much about it, but it seems somebody would have solved the reverse engineering of masked IC's by now. Maybe it is copyright thing.
Company lobbies resisting right to repair have managed to get corrupt governments to enact DMCA and similar laws the CRIMINALISE the extraction of copy protected data from stuff you own. The world is in a very dark place right now and the last 4 years have shown just how complicit in all the suffering politicians, governments, mainstream media and (medical) industry are. The useful idiots have also been helpful minions in cancelling dissenting voices and spreading patent untruths while parroting the totally captured health care departments. Another comment mentioned that decapping and microphotography services are easily available and geared exactly for this purpose. There are many legitimate reasons to recover data from an IC but people have been programmed to fear the process because you might download a car while watching bad old movies online.
Great Videos....it's funny how people on comment when they want something :-) I am also short three of the push button tops from the other unit you mention. Have you a link / part number of where to purchase them. I am surprised key-sight don't stock them as spares!
Well if you dont get a replacement, it is beyond economic repair i think. But if you dont care about that, and want to go for hardcore style points you could get the dead chip decapped and delayered, then image it with a SEM, and try to read the mask ROM from the gate pattern. The ROM might be FUBAR inside, so its possible that the code could not be recovered. Another option would be to reverse the bus protocol that the main board uses to talk to the display board, figure out how to drive the VFD and write your own code for the eeprom based pincompatibe micro. This may also require reversing parts of the mainboard firmware to figure out the protocol. And a really drastic hack would be to just remove the mainboard micro and wire all the pads to something like an Arduino Mega. This way you could avoid having to reverse the protocol, but you would have to write firmware both for the hack-board and the display board. All of these would be a lot of time and effort, but option 2 would be rather elegant and cool.
Another company that does not provide parts or diagrams? I used to work in a repair shop and that was a big problem for us. Some companies just want you to box up the item and send it to them for repair.
Hi Signal Path, as I mention in a lot of your videos, You are quite good at what you do and I admire that about you. I have a request and I don't know if you would grant me this but I would like to learn how to Identify and test those small SMD capacitor with no markings on them (The little Brown ones). Can you do a video on how to check and identify there values? Thanks for a great video.
Apparently the original Intel 80C51 CISC Micro controller had a security bit to allow ROM protection. Even if you have access to another fully functional unit, I bet the damn security bit is set by Agilent to protect their code. Hope someone within Keysight would provide the ROM binaries. Otherwise, the only practical solutions would be mixing parts from two broken units or using it via GPIO as a headless unit (which is nice). No one would be crazy enough to to take a logic analyzer and reverse engineer communication protocol between main board and display board on a fully functional unit. Or maybe I am wrong, who knows?
The video is as great as every other on this channel, but I'd really have liked to see how you repaired the lifted solder pad on the VFD controller. You might think that this is boring for your viewers, but at least for me it isn't.
I was glad to learn that I wasn't the only one who wanted to see the solder pad repaired. :-)
What a shame. You did so much work on it. Fascinating episode however kept me riveted all through. Thank you.
Random question. I really like your screwdriver and pliers sets that appear in the video. Were these purchased as sets or built up from individual units? As well, where did you get the pliers holder from?
They are Wiha products. The plier set is custom put together of the ones I thought would be most useful to me. The screwdriver set exists but has missing parts so I added what was missing to the set. But I have to warn you, the screwdriver + the plier set will set you back about a grand... :( Everything is ESD safe.
+The Signal Path Blog you are worthy of such tools, don't feel bad, not even for one moment.
Another awesome video - Thanks Shahriar - I can't get enough of your repairs - I learn so much by watching you work. Cheers!!
If it were me, as soon as I saw those cooked chips, I would have given up on that board and tried to replace it with an Arduino Nano based functional equivalent, with an LCD or OLED display rather than VFD.
Using the Arduino/display for debugging, and driving the unit through GPIB, it should not be too hard to unravel the protocol from the main board, though coming up with the responses back to it could be a little more tricky. (Access to a working unit would be a huge help here)
I think such an exercise would be more fun (and cheaper) than fixing the damaged board, and the result could be a much cooler (and longer lived) display.
Great video as always, Good luck finding the part, I've my fingers crossed somebody watching this has a spare one.
Gelukkig nieuwjaar.
Bedankt voor de film en uitleg op youtube
'73
Henk
We were using the E3648 and E3649 PSUs in production environment. To be honest I wasn't really amazed by them. I can remember two cases when they've failed.
One case it randomly restarted and of course ruined the current testing. Actually it did it quite often. It turned out that the display connector was loose. Okay, it might be a manufacturing error. Happens even at the best places.
The other case made me really questioning the quality of them. Sometimes it stopped to response to the control PC. It was controlled via GPIB. In that models the GPIB/serial control board is over the heatsink but so close it touched it occasionally and shorted something. It did not work until restarting the unit. Maybe some spacer was missing but I think the PCB was simply too close to the heatsink.
I've got schematic for this unit. If you want it I can send it to you. Actually it wont't help in this case.
@bálint vörös, még mindig rendelkezésre állnak a menetrendek? Érdekel, hogy megkapjam. üdvözlettel Theo.
I didn't know that capacitors cases were connected to the negative terminal. I learned something! :)
Well, It turned my world view upside down to such a degree that I just had to measure it and well, those that I measured weren't connected(!).. That could also explain why the voltage you measured was so of... ;)
@@NerdNordic Yeah, I was a bit surprised by that assumption. At RF frequencies it is probably fine but for DC it is rather wishful thinking even if you have found it to be the case for some manufacturers.
Very cool! Shahriar, I'm always breaking pads when desoldering ic's, I would love to see a video on properly repairing them.
Great work! The debugging process is very enjoyable!
I have a complete working display for this unit. In fact I have an entire unit. The PSU itself has some issues but display and control panel are fully responsive. Let me know if you are wanting it still.
I cannot explain how amazing these videos are. They really go into the debugging/troubleshooting process. Invaluable.
Thank you!
There should be an Agilent order number on the dead 80C51 as well. Like "1805-2207" or so. They are always 4 digits, a dash and 4 digits. I could look through my box with HP/Agilent leftovers and see if I can find something.
At 1:04 in the video you state that it is a 3632A. A little mistake on your part. It is a 3642A
Very well stepped through and explained, Thanks for showing!
Great video, hope to see this one fixed too!
Well, you could build a controller that communicates trough the GPIB interface, controls the VFD driver chip and scans the buttons. That would be a lot of work, but hey, it's a option... :)
Great video! Maybe you can just find another display unit as a whole.
Great video Shahriar!
I know these videos take a lot of time on your part. This one was not cheap, either. I appreciate the effort you go through. I still enjoyed the repair attempt.
I don't have that meter, so no part is on hand.
Good video as always.
I was thinking when the video jumped to you having the parts and I saw those digi key bags and the micros NOT in a digi key bag that you somehow got originals from Keysight ... Then.. oops!
Since you do a lot of reviews for manufacturers do you have any contacts at Keysight perhaps that can possibly help?
Excellent video - very interesting.
Why not try contacting Agilent, explain your problem and point them at this video.
They may send you a board, a part or just mail you the code for the processor.
Nothing to lose in trying ...
Everything is loose!
There are de-capping labs in china these days that will decap and provide you high zoom mask photos for not much money
How you can probe this small SMD pads without shorting them ? And even not looking on it closely and not special probes. :)
Great video, thanks. Have you thought about just using this as a headless unit through software? Perhaps there is a potential use in your lab for something like that, or maybe a long-term experiment that needs a power supply. Also, have you heard of or used Chip Quik? It makes removing surface mount ICs so much easier.
Didn't Dave Jones do one of these models with the same problem?
Any chance reverse engineering a functional unit, and write up some code for the IC?
I know that probably the time and effort not worth, but for educational (for viewers) value is incontestable, i think.
I like the shelving system you have for stacking test equipment on the bench. Seems very versatile. I've been thinking of doing something similar. Is that something you bought or is it something custom you put together yourself?
I don't know much about the 8051 series. If we had a working unit, can the rom image be extracted? Or could such code only come from Agilent/Keysight? I have one at work.
They did have some code protection and companies using mark ROM versions would normally enable the code protection to prevent readout with an external programmer. Vulnerabilities for many chips have been developed over the years but doing so in many regions would cause you to run afoul of DMCA laws or similar. Reverse engineering the protocol and the VFD and keyboard layout will be a lot of unpaid work but should allow a competent programmer to replicate the code unless it makes use of fringe processor features that have to be just so that are difficult to detect form the external signals that might cause slight timing differences and let the main board think the display was malfunctioning.
A great video. Lots to learn from it.
Thank you for another great video.
As for replacement do you think P87C51RD2BA could be a good replacement ?
The issue is that it needs the original mask ROM from Agilent.
I am myself in the process of "fixing" the front panel display of a 349701A and I'm facing the same problem of a dead 87C51 without having it's firmware. Hopefully a nice EEVBlog's forum member will try to retrieve the fw from the microcontroller (I'm slowly describing the process on my humble blog whatever.sdfa3.org/hp-34970a-data-acquisition-unit.html )
Have you finally had the opportunity to find the firmware for this device?
Still an hour well spent viewing, regardless of the outcome. I'd be trying Agilent to see if they'd give/sell you a replacement.
But where is fun in that. :)
A similar repair video with the schematic and firmware for the front panel processor.
"#57 - Agilent E3641A power supply repair
FeedbackLoop"
well, look on the bright side, as least you have the signed cookies to eat. Very nice video indeed, please continue to produce more. thanks.
I would loved to have u seen repairing that trace.
Was that a HP logo on the VFD PCB?
Another great video, thanks. A real shame about the mask ROM CPU. It seems to me like massive overkill to have a processor on what is, after all, a basic keyboard/display board. Or at least it would have been had they not stuffed a processor on it too!
Hi, I've got question on the Agilent GPIB Adapter. Is this an original one or is it a counterfeited one?
It is an original one.
The Signal Path www.ebay.de/itm/192183286857 This is one of the several examples that are out there. But it's tempting to not buy an Adapter. Some on the EEV Forum bought one and they are working . Not talking about the speed and signal integrity. www.eevblog.com/forum/testgear/flood-of-new-agilent-82357b-gpib-usb-adaptors-on-ebay-the-real-deal/75/
What do you think? Of course, only if you have time for it.
Very interesting video, thanks! Also enjoyed your recent interview on the Amp Hour podcast :-)
Great video. Good to see that even experienced engineers fail sometimes:)
-----------
Maybe if the Maskrom part of the die survived you can still find some live ports and read the MROM?
Sadly, it is all dead. But I might be able to get a replacement from someone. :)
There are some crazy chip reverse engineer types who will decap a mask or fuse ROM IC and then use a microscope to read the metal mask and decode the program. It would be interesting to establish the communications protocol between the main board and the display. It is likely similar on a lot of HP gear from that era and might be possible to write new code as it is likely pretty crude, display the following number and turn on the following annunciators and report any key presses if the display unit has the same part number across a range of units it might make the range of donor machines wider. The code might even be common across other similar units with more or less buttons. A schematic for the PSU does exist out there as someone above offered it and writing a program is doable.
I studied the 8051 back in engineering school (digital systems 2 or something) .... Around 1997.... Feeling old yet?
Does the unit still beep twice and give the same GPIB 601 error with no display connected?
Yes.
What about display can by bought for reasonable price?
Another mega interesting video, you are the absolute TOP 1 on YT!!!... Please make more repair vidio`s for us..
I got a couple of those lying around (80C51) but as you said it contains the OTP rom on it and without that it will be useless, you can turn a 80c51 to 80c31 (no internal rom) and attach a ROM to it, but again you need the firmware of that IC. if you want I can send you one.
درود به شهریارعزیز
The best repair I've seen in the YT.
Hope you find the proper code for the chip.
خیلی مخلصیم
Great video and the explanations are very helpful :) Keep up the good work!
The cookies are amazing!) Thank you for another amazing episode. As always I learned a lot!
Did you ever find that part?
First I was super jealous when the problem was just a bad front display, but then that front display became a very expensive (near impossible) fix.
I never get to buy faulty equipment with easy fixes.
Wow, this is amazing!
Have you managed to obtain the firmware in the meantime? If not, look what FeedbackLoop has done. He managed to get the firmware and programmed an Atmel 8051 with it: th-cam.com/video/E3F59nj6Fho/w-d-xo.html
Here it is 2019, and judging from the video list and comments, this never got fixed.
I don't know much about it, but it seems somebody would have solved the reverse engineering of masked IC's by now. Maybe it is copyright thing.
Company lobbies resisting right to repair have managed to get corrupt governments to enact DMCA and similar laws the CRIMINALISE the extraction of copy protected data from stuff you own. The world is in a very dark place right now and the last 4 years have shown just how complicit in all the suffering politicians, governments, mainstream media and (medical) industry are. The useful idiots have also been helpful minions in cancelling dissenting voices and spreading patent untruths while parroting the totally captured health care departments.
Another comment mentioned that decapping and microphotography services are easily available and geared exactly for this purpose.
There are many legitimate reasons to recover data from an IC but people have been programmed to fear the process because you might download a car while watching bad old movies online.
When i saw the beginning of video, the first thing what came through my mind was "display board is faulty".
Love your videos!
Great Videos....it's funny how people on comment when they want something :-) I am also short three of the push button tops from the other unit you mention. Have you a link / part number of where to purchase them. I am surprised key-sight don't stock them as spares!
Well if you dont get a replacement, it is beyond economic repair i think. But if you dont care about that, and want to go for hardcore style points you could get the dead chip decapped and delayered, then image it with a SEM, and try to read the mask ROM from the gate pattern. The ROM might be FUBAR inside, so its possible that the code could not be recovered.
Another option would be to reverse the bus protocol that the main board uses to talk to the display board, figure out how to drive the VFD and write your own code for the eeprom based pincompatibe micro. This may also require reversing parts of the mainboard firmware to figure out the protocol.
And a really drastic hack would be to just remove the mainboard micro and wire all the pads to something like an Arduino Mega. This way you could avoid having to reverse the protocol, but you would have to write firmware both for the hack-board and the display board.
All of these would be a lot of time and effort, but option 2 would be rather elegant and cool.
That's what I am doing for my 34970A, see whatever.sdfa3.org/hp-34970a-data-acquisition-unit.html
awsume thanks for the learning experience.
as always great video. good use of my time.
Another company that does not provide parts or diagrams? I used to work in a repair shop and that was a big problem for us. Some companies just want you to box up the item and send it to them for repair.
Hi Signal Path, as I mention in a lot of your videos, You are quite good at what you do and I admire that about you. I have a request and I don't know if you would grant me this but I would like to learn how to Identify and test those small SMD capacitor with no markings on them (The little Brown ones). Can you do a video on how to check and identify there values? Thanks for a great video.
Apparently the original Intel 80C51 CISC Micro controller had a security bit to allow ROM protection. Even if you have access to another fully functional unit, I bet the damn security bit is set by Agilent to protect their code. Hope someone within Keysight would provide the ROM binaries. Otherwise, the only practical solutions would be mixing parts from two broken units or using it via GPIO as a headless unit (which is nice).
No one would be crazy enough to to take a logic analyzer and reverse engineer communication protocol between main board and display board on a fully functional unit. Or maybe I am wrong, who knows?
+Ali Mirjamali I would be surprised if there isn't an exploit that allows you to read the rom from outside.
It might be unnecessary as I am almost certain that he received a replacement part from someone else's broken unit and repaired this unit. ;-)
you can ask Agilent for binary. and keep it secret or make reverse engineering and publish the source code. they will send the binary
👍👍
Nice video. I hope someone can help. If not, try contacting Agilent.
\o/ LOL .... "tek cookies" ... if you chew it ... do you have to spit out the knobs like "grape seeds" ? :P