HP856xE hackers' corner - Page 1
Forum section: electronics / testgear

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 03, 2018, 01:35:43 pm
content: I took a look inside the HP856xE firmware files recently and found some interesting stuff I'd like to share.Another reason for this thread is that I can't find any DLP script examples apart from the original HP856X/HP859X documentation.So I'm going to post my own DLPs and invite others to share their scripts.Let me start from C code snippet to join two eeprom images into a "readable" one.Code:#include <stdio.h>char a;char b;main(int argc, char **argv){int i;FILE *f = fopen(argv, "r");fread(a, sizeof(a), 1, f);fclose(f);f = fopen(argv, "r");fread(b, sizeof(b), 1, f);for(i=0; i < sizeof(a); i++) {fwrite(a+i, 1, 1, stdout);fwrite(b+i, 1, 1, stdout);}}

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 03, 2018, 01:38:07 pm
content: Code:** THE CREATORS **Tom Anderson Ron BarnettChuck Bigelis Richard ChanBill Coppel Will CramerDavid Del Castillo Antonio DicolenGrant Doering Jim GoodenoughCherie Gannon-Taylor Joe GorinJohn Grubb Gordon GuthrieEd Hamilton Tom JerseBill Katz Ken LangeRod Larrick Brian LeMayCaroline Lucas Manuel MarroquinGary Miller Rex MusgraveDan Needham Eddy NgDan Osborn Sue PalmJon Powell Don PrescottTony Reis Chien-Fu ShihRoger Stancliff Jim StimpleKenn Wildnauer Udom VanichSteven Warwick Craig Wheeler

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 03, 2018, 01:50:20 pm
content: There are some undocumented GPIB commands.The most useful ones I found for now are ZRDWR and ZSETADDR. They allow to read analyser memory.ZSETADDR sets the address in decimal (0 to 0xffffff)ZRDWR? returns a single byte in decimal.I'm yet to figure out the memory map. But it seems to be possible to read all RAM, ROM and device registers (ouch!) without restrictions.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 04, 2018, 11:45:07 am
content: Here's the memory map I got so far.000000-17FFFFMain ROM This range can be used to extract the firmware.First 4 bytes of firmware contain the address of initial stack pointer. Next 4 bytes are the entry point.Higher addresses of this range also contain code for HP85620 and TAM modules.FF0000-FF2000Config EEPROM This address range contains the serial number, options and calibration constants (amplitude calibration, preselector calibration, etc.)I'm not absolutely sure if those addresses are direct EEPROM addresses or just a RAM copy. Anyway, it's a good idea to save a dump of this area before attempting to calibrate the analyser. Flatness data stored as 24bit values. The first byte seems to identify the band, the remaining two bytes are the value entered during calibration. Since my HP8561E has two bands, I see 0x00 prefix for the lower band and 0x80 for the higher. The unused portion looks like this: 800800800800800800800800FE0000-FE7FFFMass memory module's RAM/card window.FE8000-FEFFFFMass memory module's registers.FD0000-FDFFFFMass memory module's ROM. It starts from the signature "...Z..HP85620B..880120" The module has 256K of ROM, so this might be also used to access other ROM pages. It's worth checking schematics of the module to get the idea of the mapping.update: fixed flatness data formatupdate: fixed mass memory module's RAM locationupdate: updated mass memory information

author: bitseeker
author_rank: Super Contributor
timestamp: September 05, 2018, 05:02:15 am
content: Interesting stuff. Following along.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 05, 2018, 01:07:44 pm
content: Quote from: kirill_ka on September 04, 2018, 11:45:07 amThat's wrong. I think the remaining 64k of module's RAM are just shadowed by other stuff in FF0000-FFFFFF range. And Mass memory module should be accessed from lower addresses. I'll update my post once I check this.I got a gift yesterday. I found a copy of calibration consts which I had lost previously. They were somewhere in the RAM.It makes me wonder, does it retain all of it's RAM while powered off?By the way, don't forget to replace the calibration jumper as I did.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 05, 2018, 01:31:58 pm
content: A DLP example. I did this to quickly check how harmonics are affecting the wideband power measurement.The analyser should be set up so the signal and it's harmonics are visible in a single sweep. The DLP takes power of the highest peak (HIPK), then it adds power of all harmonics above 26 dBc. Then it reports the difference between HIPK and the summed power.Code:FUNCDEF THD_DB,@LCLVAR NP,0;; number of peaksLCLVAR HIPK,0;; highest peak amplitudeLCLVAR I,0;; peak numberLCLVAR P,0LCLVAR P1,0LCLVAR YPOS,700;; current vertical display positionLCLVAR PWR,0;; total powerLCLVAR FFR,0;; fundamental frequency in display unitsSNGLSEMTSMKPKMOV HIPK,MKASUB MKPT,HIPK,26;; harmonic level > 26dBc increases total power by more than 0.01dBMOV MKPX,3HDMOV NP,PEAKS TRB,TRA,AMPPA 100,YPOSIF NP,GE,25;THENTEXT %TOO MANY PEAKS: %DSPLY NP,3,0ABORTENDIFIF NP,EQ,0;THENTEXT %NO PEAKS FOUND%ABORTENDIFSUB FFR,TRB,1TEXT %NPEAKS = %DSPLY NP,2,0SUB YPOS,YPOS,40REPEATADD I,I,1MOV P,TRBSUB P1,P,2IF TRA,GE,TRA;THENADD P1,P,2IF TRA,GT,TRA;THENIF P,LT,FFR;THENTEXT %NON HARMONIC PEAK: %DSPLY P,3,0ABORTENDIFSUB P,TRA,600MPY P,P,LGDIV P,P,60.0ADD P,RL,PIF I,LE,12;THENPA 150,YPOSSUB P1,P1,3DIV P1,P1,600.0MPY P1,P1,SPADD P1,FA,P1DIV P1,P1,1E6DSPLY P1,4,0TEXT %MHz = %DSPLY P,5,2SUB YPOS,YPOS,40ENDIFEXP P,P,10ADD PWR,PWR,PENDIFENDIFUNTIL I,GE,NPLOG PWR,PWR,10PA 100,YPOSTEXT %SUM POWER = %DSPLY PWR,5,2SUB YPOS,YPOS,40SUB PWR,PWR,HIPKPA 100,YPOSTEXT %DISTORTION = %DSPLY PWR,5,2TEXT %dB%@DLPs do not allow comments. ";;" comments are removed by the script I use for uploading.

author: Drewbie
author_rank: Contributor
timestamp: September 06, 2018, 06:48:51 am
content: Just to be clear, when you say HP856xE, you're talking about the 8566/7/8 A/B ?

author: hendorog
author_rank: Super Contributor
timestamp: September 06, 2018, 07:27:21 am
content: Pretty sure its the 8562E and 8563E he is working on.i.e.https://www.ebay.com/itm/HP-Agilent-8562E-to-8563e-Conversion-upgrade-ONLY-to-26-9-ghz-not-an-analyzer/252514466400?hash=item3acb08fa60:g:CoQAAOxy~iJQ~jgH

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 06, 2018, 09:09:06 am
content: Quote from: hendorog on September 06, 2018, 07:27:21 amI have 8561E. AFAIK 8560E, 8561E, 8562E 8563E, 8564E, 8565E are using the same firmware. EC models should be pretty much the same. From the documentation the "DLP" command set is very similar to 859XE series. 8566/8568 series are further away.

author: Berni
author_rank: Super Contributor
timestamp: September 06, 2018, 09:50:18 am
content: Im going to keep my eye on here since i have a HP 8566BWhat sort of things do you expect to get it to do?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 06, 2018, 11:07:35 am
content: Quote from: Berni on September 06, 2018, 09:50:18 amProbably the main reason I'm looking inside the firmware is that I don't feel comfortable using black box software. Maybe it's an evolved way of disassembling a toy to see what's inside.Then, as I know how it works, I would not hesitate to upgrade the firmware. Also I think to make an attachment for RF Explorer generator to be used as a tracking generator for HP.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 07, 2018, 09:28:44 am
content: Is it a good idea to use a digitally controlled signal generator as a tracking generator for the HP?I mean the generator is not continuously tuned, but it advances in discrete steps. Time gating can be used to avoid switching artefacts.

author: bitseeker
author_rank: Super Contributor
timestamp: September 07, 2018, 11:50:18 pm
content: I'm not sure about the consequences of the frequency steps. I guess it depends on how big the steps are. However, if I remember correctly, the RF Explorer doesn't filter its output, which would make for a tracking gen with lots of harmonics.

author: hendorog
author_rank: Super Contributor
timestamp: September 08, 2018, 12:10:59 am
content: Quote from: bitseeker on September 07, 2018, 11:50:18 pmWhich shouldnt matter much in most cases, as the SA does the filtering.

author: bitseeker
author_rank: Super Contributor
timestamp: September 08, 2018, 01:41:06 am
content: Right, as long as whatever you're running the signal through on the way to the SA is OK with it as well.

author: Berni
author_rank: Super Contributor
timestamp: September 08, 2018, 09:30:17 am
content: I made by own tracking generator for my HP 8566 using a mixer.You can take the 1st LO output from the 8566 and feed it into the LO input of the mixer, then use a RF signal generator to create a fixed CW tone at just the right frequency (3.6214 GHz for the 8566) and put that into the RF input on the mixer. The IF port on the mixer then outputs your tracking generator signal. Tho its also a good idea to put a circulator between the mixer and the LO port on your SA so prevent the tracking signal leaking back and degrading the noise floor.This only works on the 0-2.5GHz band tho. For the higher bands you need to use more than one mixer in series to get the frequencies to work out right and you need mixers and signal sources that work at such high frequencies.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 10, 2018, 09:06:52 am
content: Thank you all for your replies. I think, I'll try it.Quote from: Berni on September 08, 2018, 09:30:17 amYes, I'm aware of this approach. Since my main job is software engineering, I lean towards digital solutionsQuote from: bitseeker on September 07, 2018, 11:50:18 pmYes, you are right. It also has quite poor close to the carrier performance. So the RBW would be limited to about 10 kHz. Anyway it should work much better than the native RFexlorer-RFexlorer combination.But I also think of this approach in general. Maybe I can use Arb generator for lower frequencies and Signal Hound for RF. Having harmonics has a questionable advantage of being able to sweep higher frequencies.I checked the RF Explorer's frequency stepping performance. It looks promising.Below is the waveform I captured from video output connector (zero span, 10kHz RBW (if I remember correctly), 1ms/1kHz frequency steps). 1ms is not exact due to software delays.

author: Berni
author_rank: Super Contributor
timestamp: September 10, 2018, 09:20:58 am
content: You actually want the RBW to be more on the wide side to compensate for the tracking signal not being spot on in frequency. You can still get a sharp response on a wide RBW, just that it will also be picking up more noise so your dynamic range is not as good. (Your DUT is creating that sharp response, the SA is simply looking at a wider range where it finds only one sharp tone anyway)The way i did a tracking generator for higher bands is i set my SA to do max hold and set the RF generator to do the sweep very slowly so that the SA had time to sweep past for each point before moving on. It works pretty well but its really really slow. Takes over a minute to do a full sweep. I could get thing to go faster by replacing the SA with a RF detector instead and feeding that into my scope, but then i have to manually undo the transfer function of that detector to get back to dB.

author: hwalker
author_rank: Contributor
timestamp: September 10, 2018, 06:32:22 pm
content: The native RF Explorer spectrum analyzer and generator combination uses discrete steps to implement a sudo-tracking generator function. It does a fairly good job as long as you keep the signal level around -30 dBm. The combination of the HP analyzer and RF Explorer should perform better if you reduce the span of the spectrum analyzer to half of the center frequency or less, so that harmonics do not muddy the measurements.The stepping algorithm would be:1. Set the center frequency of the HP spectrum analyzer to the start frequency.2. Set the frequency span of the HP spectrum analyzer to center frequency divided by 2.3. Set the bandwidth of the HP spectrum analyzer as appropriate for the center frequency and frequency span.4. Set the RF explorer generator to the start frequency.5. Set the level of the RF explorer generator.6. Turn the output of the RF explorer generator on.7. Wait the RF explorer generator output level to settle8. Do a peak search on the HP spectrum analyzer.9. Read the marker signal level and store it.10. Increment the HP spectrum analyzer and repeat 2 -10 until the stop frequency is reached.You would probably want to setup the reference level based on the signal generator level. The set output level of the RF explorer generator is not constant over its entire range but is repeatable. You will need to perform a normalization run as the RF explorer tracking generator application does. I don't have a nice spectrum analyzer that I can control like you have. I have tried something similar with a RF explorer generator and rf powermeter but got inconsistent results because power meter was measuring the generator output and all its harmonics. I'd like to try something similar with the RF Explorer spectrum analyzer and generator combination that has finer control than the native tracking generator application, but I have not got the hang of controlling both devices at the same time.- Herb

author: bitseeker
author_rank: Super Contributor
timestamp: September 10, 2018, 11:01:10 pm
content: Lots of good tips. Looking forward to seeing how they perform together.

author: Berni
author_rank: Super Contributor
timestamp: September 11, 2018, 05:11:23 am
content: That sounds like it would work. basically using the SA as a selective power meter.Also most RF sources can't do a smooth sweep. The Gigatronics boat anchor of a RF synthesizer needs 100ms to go to a new output frequency, but at least it mutes itself during the transition so the jump causes no junk across the spectrum (Apart from the modulation sidelobes caused by the sharp turn off and turn on of the carrier) and since its a proper synthesizer there is basically no harmonics at all.I have been looking for a synthesizer that can do real analog sweeps but its very difficult to find one cheap.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 11, 2018, 10:02:02 am
content: Quote from: hwalker on September 10, 2018, 06:32:22 pmWell, I've already tried a similar thing. I'm going to publish a Tcl script for that. Instead of peak search I used zero span and the RF explorer is accurate enough to align with HP within 30kHz or even 10kHz BW. And yes, it works pretty good. The limitation of that approach is the requirement to do a sweep for each frequency point. What I'm trying to do now is to gather all measurements in one SA sweep.Quote from: hwalker on September 10, 2018, 06:32:22 pmYes, I did this with native normalization function of the HP.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 11, 2018, 10:08:42 am
content: Quote from: Berni on September 11, 2018, 05:11:23 amThe idea is to avoid those transition intervals using the "time gating" feature. It seems to be specifically designed for that.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 17, 2018, 12:51:40 pm
content: List of undocumented commandsACPRTSIt is present in firmware 990108, but it's missing from my 960401. No idea what it does.HARDONPower on reset. Works similar to power cycling the analyser.ZDISPACPNo idea what it does.ZENTIDIt should be able change the model number and options. I didn't try it.ZENTSERIt should be able change the serial number. I didn't try it.ZETDoes something to the EEPROM. I didn't try it with the jumper which enables EEPROM writes.ZGLOBALNo idea what it does.ZIFDATASends some binary data over GPIB. I don't know what.ZNEGFLAGNo idea what it does.ZRAPIDACP, ZRAPIDADJ, ZRAPIDALT, ZRAPIDCONNo idea what they do.ZRDWRZRDWR? reads the memory address specified by ZSETADDR and increments the address. ZRDWR writes a byte. It knows eeprom addresses and has a special code for writing it.ZRFCALNo idea what it does. ZRFCAL? always reads 17.ZSETADDRSets the address for ZRDWR. The address is specified as decimal argument to the command.ZSHKDBGSets the debug flags specified as 16-bit integer argument. For example, ZSHKDBG 8 starts displaying some internal state names on the screen.ZTCNo idea what it does.ZZTDNo idea what it does.ZSAVESaves current trace to the module's memory.WHILE/ENDWHILEThis looks like "while" loop construction. The command is accepted, but doesn't seem to work.ARDLPRequires a memory card.There are a few other module commands I didn't check if they even exist.KEYACTIVE KEYFLASH KEYUSCOR LIMIMKR LIMTSP MENULIM PWRBWCommands which seem to be missing (unimplemented?)FORMATLB

author: kirill_ka
author_rank: Frequent Contributor
timestamp: December 04, 2018, 11:09:11 am
content: Quote from: kirill_ka on September 11, 2018, 10:02:02 amHere's the script:https://github.com/KIrill-ka/hp3478ext/tree/master/tclI cross checked it's performance with my E7495A. The results are identical.The device under test is a -20dB 4-8 Ghz directional coupler.Code:# THRU connected./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300 -n# COUPLER connected./HP856x-sweep.tcl -f 375mhz-2500mhz -l 6 -p 300

author: hafrse
author_rank: Regular Contributor
timestamp: June 04, 2020, 08:37:29 am
content: Quote from: kirill_ka on September 17, 2018, 12:51:40 pmHello, looking for bin files (EPROM) for 990108, any clue where to find? thanks

author: kirill_ka
author_rank: Frequent Contributor
timestamp: June 04, 2020, 02:05:20 pm
content: Quote from: hafrse on June 04, 2020, 08:37:29 amhttp://ftb.ko4bb.com/getsimple/index.php?id=download&file=01_ROM_Images_and_Drivers/HP_8560E_Series_Firmware_Ver990108.zipAs I remember, there may be some compatibility issues if the CPU board is too old.The images linked above worked for me.

author: hafrse
author_rank: Regular Contributor
timestamp: June 05, 2020, 10:07:09 am
content: Thank you so much

author: hafrse
author_rank: Regular Contributor
timestamp: August 12, 2020, 02:17:00 pm
content: Quote from: kirill_ka on September 05, 2018, 01:07:44 pmHello, have you figured out the correct location addresses of the memory module? thnks!

author: kirill_ka
author_rank: Frequent Contributor
timestamp: August 12, 2020, 05:01:01 pm
content: Quote from: hafrse on August 12, 2020, 02:17:00 pmWell, I can't tell for sure. But as I updated my post, it should be like this:Quote from: kirill_ka on September 04, 2018, 11:45:07 amDo you have something interesting hiding in your module?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: August 21, 2020, 09:01:55 am
content: Quote from: kirill_ka on August 12, 2020, 05:01:01 pmAfter some experimenting, the above information appears to be incorrect.1. The ranges FEXXXX and 9EXXXX map to the same RAM area.2. The module's RAM and RAM card are accessed through the 32k window located at FE0000-FE7FFF.3. The RAM pages can be switched by selecting different objects in the directory (MODULE/UTILITY).4. I was able to switch the pages by reading some locations at FE8000-FEFFFF area, but I didn't take time to find out an exact address which causes the switch.Post #3 updated.

author: specter
author_rank: Newbie
timestamp: June 23, 2021, 01:54:03 pm
content: Quote from: kirill_ka on September 04, 2018, 11:45:07 amHi kirill_ka, have you been able to calibrate your analyser by changing the calibration constants in the EEPROM?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: June 23, 2021, 03:06:18 pm
content: Quote from: specter on June 23, 2021, 01:54:03 pmHi,No, I didn't try that. However I used a dump to restore the calibration using the normal (manual) procedure.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 05, 2025, 02:27:56 am
content: Im going to hack the software options on HP 85620A for Agilent 8563EC, and get all the options installed on my SA.Anyone have any idea how can I start this?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 05, 2025, 04:18:23 pm
content: Theoretically you can install a couple of "software packages" on the 85620A. Not sure what do you mean by options.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 11, 2025, 12:18:09 pm
content: thanks for ur reply kirill_kayea, I mean software options like 85671A install on 85620A.I have them originally install on my 85620A. but I can only use it for 20times and the system will delet it automaticly bcuz its a hp provided demo, and I already loss the phase noise option I need, how can I get them back.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 14, 2025, 04:55:53 am
content: Can anyone help me?I really need these software options.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 14, 2025, 09:13:12 am
content: Unfortunately there's no step by step instructions and the original "distribution" cards are rare.There is a SRAM dump containing those utilities:http://www.ko4bb.com/getsimple/index.php?id=manuals&dir=HP_Agilent_Keysight/HP_85620AIf you are desperate enough, you can clone the sram image to your module.Also there's a software way. The "utilities" are stored as a set of text scripts (DLPs).They can be extracted from the image and then written using the documented GPIB command "FUNCDEF".Note that both data and address lines of the SRAM are not in order, so the image needs to be bit-shuffled before you get to the text.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 16, 2025, 03:12:10 am
content: some code used to read instrument memory its really slow but able to use

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 16, 2025, 03:34:40 am
content: Hi kirill_ka, how to use the high speed GPIB? The gpib or the pyvisa is so slow I need around 6 days to dump the whole mem.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 16, 2025, 05:37:35 am
content: Im going to hack the memory

author: Tony_G
author_rank: Super Contributor
timestamp: July 16, 2025, 01:57:04 pm
content: Quote from: kirill_ka on July 14, 2025, 09:13:12 amHey Kirill_ka,Can you expand a bit on the shuffling? I let the battery expire on my module so I've lost the utilities.Thanks,TonyG

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 16, 2025, 02:34:50 pm
content: I managed to hack it. Everything works fine.I used the original memory to hack it. The trick is to add the voltage during transfer.

author: JoeyDeng
author_rank: Regular Contributor
timestamp: July 16, 2025, 02:56:32 pm
content: QuoteHe provided the demo u can try to extract the code from theQuoteand add the program to the module.I'd like to try that when I have time

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 16, 2025, 03:21:07 pm
content: Quote from: Tony_G on July 16, 2025, 01:57:04 pmHere's the tcl script, so you get the idea. The bit ordering I got from the schematics of the module. That's not needed if you are writing the sram image directly.

author: Tony_G
author_rank: Super Contributor
timestamp: July 16, 2025, 03:42:42 pm
content: Thanks Kirill_ka,Before I start to pull the DLPs out of the BIN, I should ask, "Is there a way to just write the original undecoded BIN to the mass memory module via GPIB?"Thanks again,TonyG

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 16, 2025, 04:12:50 pm
content: Quote from: Tony_G on July 16, 2025, 03:42:42 pmNo, those bit permutations are done on the module's PCB. They can't be "viewed" from the outside. To make things worse, the module's memory is not accessible all at once. So in theory writing raw memory might be possible, but writing DLPs is a lot safer and easier.

author: Tony_G
author_rank: Super Contributor
timestamp: July 16, 2025, 06:00:58 pm
content: Thank Kirill_ka,If people are interested, I created a small console app that uses Kirill's decode on the KO4BB image and then pushes the DLPs via GPIB to the SA.https://github.com/TGoodhew/DLPBitsYou need to follow the PDFs for the DLPs to get the final install and keydefs working.TonyG

author: Tony_G
author_rank: Super Contributor
timestamp: September 17, 2025, 04:27:45 pm
content: Shameless self-promotion time - I did a video on actually using DLPBits to push the DLPs to my 8563E - Thanks again to Kirill for all the help:TonyG