Advantest R6581 DMM - Bugs and features thread - Page 1
Forum section: electronics / general

author: Mickle T.
author_rank: Frequent Contributor
timestamp: January 09, 2025, 06:09:11 am
content: Thanks to the inside information of Alexey, a member of the Ru Cal Club, we were able to analyze the latest (as I believe) version of the firmware for the ADCMT 6581 multimeter - A04.As in previous cases, the changes are only in the EPROM U102 (27C4096) chip. The contents of the second EPROM U103 (27C1024) chip remained the same. As the analysis showed, the changes concern only the AC module control procedures and are aimed at ensuring reliability, since the new firmware version increases the duration of the latching relay control signals to 30 milliseconds.Thus, switching to the new firmware makes sense only for owners of the full version of the multimeter equipped with an AC module.

author: Mickle T.
author_rank: Frequent Contributor
timestamp: January 09, 2025, 02:37:55 pm
content: While figuring out the ACV artifact calibration code, I unexpectedly made another discoveryI noticed that the calculation of the ACV scale factors is divided into two branches, depending on a certain flag, which I called "AC_Present_Flag", the value of which is set in the self-test procedure of the multimeter when power is turned on:Code:tst.w (AC_Present_Flag).l ; 2 (NOT present), 1 (Averaging), 0 (TrueRMS)bne.s loc_3038Cpea (2).w ; = (source dataset step - 1)pea (6).w ; number of ACV ranges (10/100/1000 mV, 10/100/750 V)move.l a4_RAM_AC_data,-(sp)pea $120(a4_RAM_AC_data) ; destination dataset (6 consecutive cells)pea $90(a4_RAM_AC_data) ; source dataset (6 cells with a step of 3)jsr Calc_ACV_Ranges_TrueRMS ; Gain calculation ror TrueRMS-type AC modulelea $14(sp),spbra.s loc_303A6loc_3038C:pea (2).w ; = (source dataset step - 1)pea (6).w ; number of ACV ranges (10/100/1000 mV, 10/100/750 V)move.l a4_RAM_AC_data,-(sp)pea $120(a4_RAM_AC_data) ; destination dataset (6 consecutive cells)pea $90(a4_RAM_AC_data) ; source dataset (6 cells with a step of 3)jsr Calc_ACV_Ranges_Averaging ; Gain calculation for averaging-type AC modulelea $14(sp),sploc_303A6:move.l a5,(sp)pea (2).wmove.l #table_ACV_Cal,-(sp)jsr Int_Cal_by_List ; Temperature and Date/Time settingsaddq.l #8,spmove.l err_code(a6),d7loc_303BE:movem.l (sp)+,d0/d5/a3_RAM_INT_OHM_data-a5unlk a6rts; End of function Int_ACV_Cal_subDuring self-testing, "AC_Present_Flag" takes values ​​not 1 or 0 (AC module is present or not), as I thought earlier, but 0, 1 or 2, where: 2 - module is not installed, 0 and 1 - module is found, but of different types.Software detection of the presence and type of AC module is implemented as a request to the analog board with the code 5D00h and analysis of the response. If the value 0C00h is received in response, then a standard AC module is installed. If 800h is received, a special AC module is installed. If any other value is received, then there is no AC module.Code:...loc_825E: ; CODE XREF: AC_Present_Check_sub+44↑jmovea.l (Addr_FPGA_Tx_Buffer).l,a1move.w #$5D00,(a1) ; AC module identification commandbra.s loc_8220loc_826A:movea.l (Addr_FPGA_Rx_Buffer).l,a1move.w (a1),var_2(a6)andi.w #$C00,var_2(a6)moveq #0,d7move.w var_2(a6),d7cmpi.l #$C00,d7 ; 0C00h = TrueRMS AC module foundbne.s loc_8290clr.w (AC_Present_Flag).l ; 2 (NOT present), 1 (Averaging), 0 (TrueRMS)bra.s loc_82B0loc_8290:moveq #0,d7move.w var_2(a6),d7cmpi.l #$800,d7 ; 0800h = averaging AC module foundbne.s loc_82A8move.w #1,(AC_Present_Flag).l ; 2 (NOT present), 1 (Averaging), 0 (TrueRMS)bra.s loc_82B0loc_82A8:move.w #2,(AC_Present_Flag).l ; 2 (NOT present), 1 (Averaging), 0 (TrueRMS)loc_82B0:unlk a6rts; End of function AC_Present_Check_subThe presence and type of the AC module is determined by the logic level on pins A2 and A3 of the J301(J500) connector, which depend on the state of jumper JP502 on the module's printed circuit board.Based on the analysis of the calculation branches performed during the ACV artifact calibration, it was easy to guess that a special type of AC module (or more precisely, the configuration of the standard AC module) is designed to calculate averaging RMS. It is difficult to say for what purpose support for this mode is included in the hardware and firmware of the multimeter. Perhaps this is a requirement of the military customer (as was the case with the Keithley 2001-M). I can only say that this mode was never completed, since I discovered (and corrected) an elementary arithmetic error in the calculation sequence: instead of dividing by the Pi/sqrt( 8 ) form factor, multiplication was performed, and for this reason the multimeter readings were underestimated on all ranges by about 23%.Since I was interested in accessing the averaging RMS mode without unsoldering the jumper and installing any switches in the multimeter, I started looking for free space in the firmware to inject code that changes the state of the AC_Present_Flag variable by pressing a button on the front panel or by an SCPI command. Unfortunately, there was no free space in the U102 firmware even for a hundred bytes.Therefore, I decided to go another way: slightly change the keyboard polling algorithm in the existing procedure for entering the factory diagnostic mode by pressing HOME + POWER.Code:Kbd_is_HOME_pressed: ; CODE XREF: QuickSelfTest+7C^pvar_2 EQU -2arg_0 EQU 8link a6,#-2move.l a5,-(sp)movea.l arg_0(a6),a5 ; Keyboard key-state array addr.move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)tst.w var_2(a6)beq.s loc_7C7BAmoveq #0,d7bra.s loc_7C816loc_7C7BA:addq.l #2,a5move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)tst.w var_2(a6)beq.s loc_7C7D0moveq #0,d7bra.s loc_7C816loc_7C7D0:addq.l #2,a5move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)tst.w var_2(a6)beq.s loc_7C7E6moveq #0,d7bra.s loc_7C816loc_7C7E6:addq.l #2,a5move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)tst.w var_2(a6)beq.s loc_7C7FCmoveq #0,d7bra.s loc_7C816loc_7C7FC:addq.l #2,a5move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)btst #0,var_2+1(a6) ; HOME bit flagbeq.s loc_7C814moveq #1,d7bra.s loc_7C816loc_7C814:moveq #0,d7loc_7C816:movea.l (sp)+,a5unlk a6rts; End of function Kbd_is_HOME_pressedWhat's going on there? The state of all the buttons on the front panel of the multimeter is a bit matrix divided into 5 bytes (by the way, this matrix is ​​physically located in the video memoryThe standard polling procedure analyzes all 5 bytes and sets the diagnostic mode permission flag only when the HOME button is pressed and all the others are not pressed (except for EXIT, FRONT-REAR and LO-G, the state of which does not affect). In the new polling procedure, I simplified the condition for entering the diagnostic mode, leaving only the requirement to press HOME. But in the freed space, I managed to inject code that changes the AC_Present_Flag variable when the EXIT button is pressed, thus activating the averaging RMS mode. Since the display does not indicate the transition to this mode in any way, I added a short beep sound at the moment EXIT is pressed. All that remains after activating the averaging RMS mode is to perform an internal calibration.Code:Kbd_is_HOME_hacked:var_2 EQU -2arg_0 EQU 8AC_Present_Flag EQU $239800Beep EQU $28ED6link a6,#-2move.l a5,-(sp)movea.l arg_0(a6),a5 ; Keyboard key-state array addr.addq.l #8,a5move.w (a5),d7andi.w #$FF,d7move.w d7,var_2(a6)cmpi.w #2,(AC_Present_Flag).lbeq.s loc_test_HOME ; do nothing without AC boardbtst #1,var_2+1(a6) ; EXIT key bit flagbeq.s loc_test_HOMEmove.w #1,(AC_Present_Flag).ljsr Beeploc_test_HOME:moveq #0,d7btst #0,var_2+1(a6) ; HOME bit flag testingbeq.s loc_endmoveq #1,d7loc_endmovea.l (sp)+,a5unlk a6rtsPersonally, I doubt the practical usefulness of this AC module mode. Although testing showed higher amplitude linearity (due to the exclusion of AD637), at the same time the frequency linearity and scale error worsened. Although it is quite possible that these errors could be minimized in the factory service mode. Attached is a modified M04 firmware with Averaging RMS support and, as a bonus, with a normally functioning display shutdown commandP.S. Special thanks to serg-el for providing UV EPROM 27C4096.

author: Mickle T.
author_rank: Frequent Contributor
timestamp: January 10, 2025, 05:43:45 am
content: I found this bug with "overheating" of relay K006 a long time ago. But only now it became clear to me that the reason is a programmer's error when writing the header file C with the description of control bits.Thus, there are two possible solutions:1) Resolder one wire from the relay coil.2) In the multimeter firmware, swap the control commands in 16 places

author: Mickle T.
author_rank: Frequent Contributor
timestamp: January 10, 2025, 06:26:00 am
content: Few people know about the following two bugs, which are related to an incorrect method of limiting the amplitude of the amplifier's output signal by reducing the supply voltage of the output stage on the U105 op-amp.1)In early versions of the multimeter, up to about 2002, the positive supply of U105 LT1220 was limited to two diodes and a ballast resistor R155 with a resistance of 10 Ohms. At the same time, if the input voltage of the multimeter exceeded +13.3 V for some reason (for example, at the moment of transition to the next range), the ADC could not complete the conversion due to a convergence error, and after about a second of waiting for a response, the multimeter displayed the message: "Please power off", +400, "A/D error".Since 2003, the developers have fixed this bug by further reducing the supply voltage of the U105 op-amp by replacing the R155 resistor with a 22 Ohm resistor. I personally encountered this kind of incorrect behavior in one of my R6581s, especially often in hot weather. Changing the resistor value completely eliminated the occurrence of the +400 error.2)The second bug is also related to the amplifier output stage. Since the U105 op-amp is not Rail-to-Rail, with a positive supply of +13.3 V and an output voltage in the range of approximately +11 V to +12 V, the stability of the amplifier as a whole is lost and self-excitation occurs with a frequency of up to several hundred kHz. From the point of view of a multimeter user, this is expressed in a sharp local increase in nonlinearity of readings by tens to hundreds of ppm.This bug appears on all multimeters available to me. It was completely eliminated only by installing an additional capacitor with a capacity of approximately 10 pF at the amplifier input after the U001 multiplexer.