Reward $50 for HP/Agilent E4916A Upgrade/Firmware/Software - Page 1
Forum section: electronics / testgear

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 28, 2022, 11:30:00 pm
content: Does anyone know where I can get the software and LCR option upgrade for the HP E4916A? If you have it or can point me to where I can get it, I will send you $50!

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 29, 2022, 03:16:55 pm
content: Anyone?

author: gslick
author_rank: Frequent Contributor
timestamp: July 29, 2022, 05:51:15 pm
content: I assume you already have the firmware file, and you need the "E4915A/E4916A Adjustment/Performance Test Program"? Was the Agilent Technologies Kobe Instrument Division somewhat of a black hole for trying to find information on instruments that originated there?https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/e4916a-crystal-impedance-meter--lcr-meter-firmware-update-1469077.htmlRelease Date Version Version Description2001-07-01 2.13 E4915A/E4916A Firmware Revision 2.13https://www.keysight.com/us/en/assets/ndx/9018-33747/miscellaneous/fw-0213.mWhat does the instrument use for the main microprocessor? I wonder if someone could do some R-E work on the firmware image to figure out how options are enabled.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 29, 2022, 06:16:48 pm
content: Yes, I have the firmware. But the software is no where to be found.

author: free_electron
author_rank: Super Contributor
timestamp: July 29, 2022, 07:21:27 pm
content: is there an e2prom ? 93cxx or 24cxx style ? dump it. you may learn something. same for the regular LCR meter.most machines of that era are 68K based

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 29, 2022, 07:44:05 pm
content: Quote from: free_electron on July 29, 2022, 07:21:27 pmI intend to do a teardown of the unit and I will check for the EEPROM and report back.

author: gslick
author_rank: Frequent Contributor
timestamp: July 29, 2022, 07:52:31 pm
content: Quote from: free_electron on July 29, 2022, 07:21:27 pmMust be 68K based from these exception text strings in the fw-0213.m firmware file:BUS ErrorAddress ErrorIllegal Instruction; PC:Zero Divide; PC:CHK Instruction; PC:TRAPV Instruction; PC:Privilege Violation; PC:Trace Exception; PC:Line 1010 Emulator; PC:Line 1111 Emulator; PC:Maybe someone could analyze the 68K code and figure out what triggers these messages, in particular the "Bad LCR Option" message, and do something interesting with that code path.Error: Bad Model No !Error: Bad Serial No Length !Error: E4915A not support Opt.%sError: Bad LCR Option No (opt.%s) !Error: E4916A not support Opt.%sError: Bad EM Option No (opt.%s) !Error: Bad Power Range Option No (opt.%s) !Error: Flash memcpy write error !Error: Fail Flash memcpy !

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 03:43:39 am
content: Here is the main firmware bin file grabbed from the internal EEPROM.

author: TheSteve
author_rank: Unknown
timestamp: July 30, 2022, 04:09:31 am
content: Is there any other memory in there, perhaps a small 8 pin eeprom as was already suggested?

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 04:13:08 am
content: Quote from: TheSteve on July 30, 2022, 04:09:31 amThe bin file that I posted is from an EEPROM which is in a socket. This is probably where everything is stored.

author: TheSteve
author_rank: Unknown
timestamp: July 30, 2022, 04:27:54 am
content: OK, so it isn't really a 27C1024 as the file name suggests then I suppose.There must be some main memory, likely a 28 or 29 series device.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 04:40:50 am
content: Quote from: TheSteve on July 30, 2022, 04:27:54 amHi Steve,It is a 27C1024 EEPROM. The file (.BIN) is what is stored in it.

author: picburner
author_rank: Frequent Contributor
timestamp: July 30, 2022, 05:03:34 am
content: The file you posted (Main_Firmware_AM27C1024.zip) is that of the bootrom which then passes control to the firmware contained in the Flash memory.AM27C1024 is an Eprom not an Eeprom.As TheSteve told you there should also be an eeprom somewhere (or a NVRAM?) as well as a Flash memory of course.I converted the file you posted in Little Endian format so the text it contains is readable.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 05:06:49 am
content: You are right. I didn’t pay enough attention, this is an EPROM. I will look on the board more.Thank you both for pointing it out.

author: Daruosha
author_rank: Regular Contributor
timestamp: July 30, 2022, 12:20:41 pm
content: Hi Shahriar,I'm not sure if this is what you are looking for (at least the latest firmware file):https://www.keysight.com/us/en/support/E4916A/crystal-impedance-lcr-meter.html#driversHave you tried contacting HPAK support?

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 02:08:36 pm
content: So, Keysight support has no info on this instrument anymore...Here is the photo of the board. The file I posted earlier is the content of the EPROM which is missing from the board right now (the PLCC socket). That is the bootloader as pointed out earlier.There are 4 FLASH ICs also on the board, plus two SRAMs. But I could not find any other memory. Perhaps the options and firmware are stored in the FLASH memory together?If anyone can crack this bad boy, I will include the instructions in the video about the unit and of course send you $50.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 30, 2022, 03:02:03 pm
content: A few additional points:There is a VEE software which is used for upgrading the firmware, configuration and (I assume) applying options, like Option 010 which is the LCR mode. However, that software is nowhere to be found. It uses the GPIB port.But it should be possible in theory to upgrade the unit through the GPIB port...

author: Hugoneus
author_rank: Frequent Contributor
timestamp: July 31, 2022, 05:50:05 pm
content: I bought some sockets to look at the data through the flash memory and maybe download the content.Has anyone had any luck with this?

author: picburner
author_rank: Frequent Contributor
timestamp: August 01, 2022, 12:36:44 am
content: I have read the service manual and it says that the calibration/configuration data are stored in the flash memory.So there are no other memories to look for.The temporary data is stored in the two SRAMs, probably powered by the Supercap near the 10MHz TXCO.The code that allows you to update the firmware (instrument side) is found in the BootRom AM27C1024. This code takes care of loading the firmware into RAM via GPIB (I suppose in more steps since the ram is smaller than the Flash), erase the flash and rewrite it.One could study the code contained in the BootRom to write a Python program that does this job on modern computer.Always reading the manual, I read that the original program only runs on the VEE 3.21 version, therefore an additional complication.If you want to read the contents of the Flash memories without unsoldering them, you could try to keep the cpu in reset state and read the memoriesconnecting to the data/address buses as long as the hardware configuration allows it (CS/WR/OE signals should also go IDLE).

author: free_electron
author_rank: Super Contributor
timestamp: August 01, 2022, 12:56:22 am
content: if it as a VEE program tht will be hard to find. you will either need a 9000 series computer running hp/ux or a windows NT 3.51 , maybe a windows 2000 box . good luck finding the vee runtime.i scanned all the backups i have from the old FTP site and website and could not find anything for those machines (15 and 16).

author: free_electron
author_rank: Super Contributor
timestamp: August 01, 2022, 01:01:29 am
content: hmm. whats under the flatcable ? you are looking for a 4 pin or 14 pin device 93cxx series , most likely national semi

author: gamalot
author_rank: Super Contributor
timestamp: August 01, 2022, 02:00:26 am
content: Quote from: free_electron on August 01, 2022, 01:01:29 amFull of 78L/79L regulators in SOP8 package.---I've double checked and didn't find any EEPROM chips, at least not on the top side of the PCB.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 01, 2022, 02:56:13 am
content: Quote from: free_electron on August 01, 2022, 01:01:29 amNo luck. The configuration is likely in the Flash memories.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 01, 2022, 02:57:28 am
content: Quote from: picburner on August 01, 2022, 12:36:44 amI think I should be able to read the flash memory directly... But I like the path of trying to find the commands for upgrading the unit through GPIB itself. But even then, the actual code would need to be discovered which is a function of the serial number...

author: Aiy
author_rank: Regular Contributor
timestamp: August 01, 2022, 09:26:53 pm
content: For the options, what about those small switches at the top and bottom of your picture?You could check where they connect to and try the different positions, only 256 combinations to doBest regards

author: gamalot
author_rank: Super Contributor
timestamp: August 01, 2022, 09:42:03 pm
content: Quote from: Aiy on August 01, 2022, 09:26:53 pmThe service manual says there are no jumpers or switches that depend on any options.

author: free_electron
author_rank: Super Contributor
timestamp: August 02, 2022, 02:27:21 pm
content: Quote from: Hugoneus on August 01, 2022, 02:57:28 amsince this is the same lineage of the LCR bridge most likely it is simply a flag in the flash. you don't need the code or the key generation , simply set the flag.in the lcr bridge there is no "key check" , only a flag check.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 02, 2022, 02:28:58 pm
content: First step would be to get the Flash from the instrument.I’ll try it.

author: Aiy
author_rank: Regular Contributor
timestamp: August 05, 2022, 07:28:13 am
content: Hello,I've had a look around the archive.org "ftp site boneyard" filelistings for ftp.keysight.com 2015-04-04https://archive.org/download/ftp.keysight.com/https://ia600504.us.archive.org/28/items/ftp.keysight.com/2015.03.ftp.keysight.com.tar.txtAnd ftp.agilent.com 2014-06-15https://archive.org/download/ftp.agilent.comhttps://archive.org/download/ftp.agilent.com/2014.06.ftp.agilent.com.tar.txtsearching for "E4915_16.exe" mentioned in the service manual, as well as other keywords I could think of. No luck.The archives are >2010 so about ten years too recentBest regards,

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 17, 2022, 11:27:54 pm
content: Quote from: Aiy on August 05, 2022, 07:28:13 amThank you for trying... Still no luck.

author: free_electron
author_rank: Super Contributor
timestamp: August 18, 2022, 05:14:42 pm
content: i have an older archive from the FTP site when they still were HP. found the harddisk yesterday. will check.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 18, 2022, 05:48:37 pm
content: Quote from: free_electron on August 18, 2022, 05:14:42 pmThanks!

author: vaualbus
author_rank: Frequent Contributor
timestamp: August 27, 2022, 09:58:16 pm
content: Could you put that too on archive.org is a too bad job to upload what I imagine is a big HDD of data?

author: Miek
author_rank: Regular Contributor
timestamp: August 28, 2022, 01:00:20 am
content: Could you try querying ":TEST:INSTR:INFO:DATA?" over GPIB and see what comes back?

author: gamalot
author_rank: Super Contributor
timestamp: August 28, 2022, 04:53:49 am
content: Quote from: Miek on August 28, 2022, 01:00:20 amHere is mine, nothing but the model number, serial number, and zeros.

author: Miek
author_rank: Regular Contributor
timestamp: August 28, 2022, 05:37:07 am
content: Excellent, thanks, that's the result I was hoping forIn theory, you should be able to send back ":TEST:INSTR:INFO:DATA E4916A,JP1KD00868,010,000,000,000" (ie: just swapping the first 000 to 010) to enable the LCR option.A few caveats:I'm basing this on reverse engineering the v2.13 firmware linked above. It's unlikely, but your version could behave differently.The firmware does a bunch of checks on the string sent to verify the option strings, however it does let you overwrite the model (to either "E4916A" or "E4915A") and the serial number so type carefully.There could be side effects I haven't noticed, so it's probably best to have a backup of any flash in there for minimal risk.

author: gamalot
author_rank: Super Contributor
timestamp: August 28, 2022, 05:59:08 am
content: Quote from: Miek on August 28, 2022, 05:37:07 amThank you very much!Looks like this command doesn't work here, it beeps and shows "GPIB ERROR: -148" every time I send it to my E4916A.

author: Miek
author_rank: Regular Contributor
timestamp: August 28, 2022, 06:06:12 am
content: Hmm, I guess the value might need to be in quotes, so:Code::TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,000"

author: gamalot
author_rank: Super Contributor
timestamp: August 28, 2022, 06:24:16 am
content: Quote from: Miek on August 28, 2022, 06:06:12 amI tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error".

author: Miek
author_rank: Regular Contributor
timestamp: August 28, 2022, 06:36:59 am
content: Quote from: gamalot on August 28, 2022, 06:24:16 amAh, OK, thanks for trying it.I had a closer look and it seems to be treating them all as separate arguments, so quoting each individually might work:Code::TEST:INSTR:INFO:DATA "E4916A","JP1KD00868","010","000","000","000"

author: gamalot
author_rank: Super Contributor
timestamp: August 28, 2022, 06:53:21 am
content: Quote from: Miek on August 28, 2022, 06:36:59 amTHANK YOU !!! IT WORKS!!!

author: Miek
author_rank: Regular Contributor
timestamp: August 28, 2022, 07:27:53 am
content: Nice! Glad I could help

author: picburner
author_rank: Frequent Contributor
timestamp: August 28, 2022, 07:28:28 am
content: Well done! Now all that remains is to be able to update to firmware Rev.02.13

author: TheSteve
author_rank: Unknown
timestamp: August 28, 2022, 06:30:33 pm
content: Quote from: Miek on August 28, 2022, 07:27:53 amAbsolutely fantastic work!

author: RolandK
author_rank: Regular Contributor
timestamp: August 29, 2022, 02:58:34 pm
content: This is really great. Just tried the command on a 4263b to get options 001 and 002, but it doesn't seem to work.The 4263b has the hex-code read out in this thread:https://www.eevblog.com/forum/testgear/i_ve-got-a-hacking-challenge-for-you-guys!/There they just copy the content of the eeprom to get the options, but overwrite the serial number.@Miek: what did you use for the reengineering? disassembler?

author: Miek
author_rank: Regular Contributor
timestamp: August 29, 2022, 03:38:32 pm
content: Quote from: RolandK on August 29, 2022, 02:58:34 pmYep,Ghidraspecifically.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: September 04, 2022, 08:56:14 pm
content: Thank you everyone! Awesome work.Someone sent me the commands for enabling the LCR meter but they didn't want a $50. So I donated it instead.

author: TERRA Operative
author_rank: Super Contributor
timestamp: June 05, 2025, 06:36:08 am
content: I just picked up an E4916A with firmware 2.02. Did anyone figure out how to upgrade to the latest version in the end?Or is there a way to get a v2.13 firmware dump that I can upload into my instrument?My unit had option S01, but I can't find any info on this option. Does anyone know what this is?Quote from: Miek on August 28, 2022, 06:06:12 amI ran the above command to enable the LCR option which worked, but it erased option S01, so I used the following modified command to give me option S01 back:Code::TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,S01"It seems there might be some shared firmware between different instruments, as the second and third options of the 4 available in the above command appear to be E01 (EM Option) that throws an error that it isn't supported by the E4916A, and P01 (Power Range Option) that throws no errors when enabled, but does throw an E16 (Previous settings Lost) on boot, I assume because of a lack of compatibility.Strangely, if I deliberately make an error with the S01 option command, it just says E01 is not compatible instead, so no clue there what S01 actually is. I found the firmware dump earlier in this thread, somehow I missed it. Now to convince my programmer to write to 27C1024 chips. I think I need a new adapter...I also got a reply from Keysight about the software and option info.They basically just gave me a big fat Fk you, 'no support, go buy the latest model'.... As usual...

author: TERRA Operative
author_rank: Super Contributor
timestamp: June 12, 2025, 01:21:35 pm
content: I managed to get a good flash of firmware v2.13 onto a fresh 27C1024, but when I try to turn the instrument on, it seems to hang during the RAM test..Unfortunately it seems the original 27C1024 with firmware v2.02 is dead, but luckily not before I took a copy. I'll have to go get a UV erasable 27C1024 from Akihabara, unless I can find a reliable source for a 29C1024 Flash or equivalent..Does anyone else have an instrument with firmware v2.13 they can copy out, just so I can double check things here?

author: Miek
author_rank: Regular Contributor
timestamp: June 13, 2025, 10:07:10 am
content: Quote from: TERRA Operative on June 05, 2025, 06:36:08 amI can't see anything in the firmware that actually does anything with that S01 option, all I see is code that sets it or reads it back.So maybe it was a hardware change, included accessory, or different calibration? Or just nothing at all

author: TERRA Operative
author_rank: Super Contributor
timestamp: June 14, 2025, 11:05:43 am
content: Yeah, it's weird. The option is definitelysomething, my unit has a sticker on the back announcing it and all, but besides that, it doesn't seem to exist anywhere in any literature I've seen anywhere.

author: TERRA Operative
author_rank: Super Contributor
timestamp: June 28, 2025, 02:14:32 pm
content: So I read the thread closer and realised that the 27C1024 is just the bootloader, and the firmware is held in the two 29F010 and/or two 29F040A chips soldered to the motherboard.So either they need to be extracted and manually reprogrammed (or reprogrammed in place with a clip) or a way figured out to upload the firmware update file available on the Keysight website into the instrument via GPIB unless the official software is found.Does anyone have any ideas?Also, my 27C1024 chip has a sticker with part number E4915-85011 on it, does anyone have a later part number they can upload here? I don't know if there is a later version, but if there is, I wants it.

author: picburner
author_rank: Frequent Contributor
timestamp: July 01, 2025, 06:33:12 am
content: The commands to update the firmware via gpib most likely reside in the Boot Rom.You can see the header search text (DOWNLOAD-CALGAMO-REV01.00) of the file inside the Boot Rom.The same text is at the beginning of the firmware.I assume that you have to turn on the instrument with some keys pressed to enter boot-loader mode then a program on the PC will have to give the commands to the instrument and load the file.It seems simple enough, but it would take someone good with 68K software to figure out the right commands.