HP 3468A owners UNITE: a storm is coming! But together we found the solution! - Page 1
Forum section: electronics / testgear

author: Kjelt
author_rank: Super Contributor
timestamp: June 04, 2015, 07:39:45 pm
content: Dear HP3468A owners,perhaps this is a bit of an extravagant topic title but at least we got your attention and that is exactly what we want and need.Who are we? Well at least meKjeltandSailorand who knows how many others, that have a defective HP3468A unit.We have found out that there is a sleeping defect waiting to happen inside these units: the U502 ROM, which contains the program memory, is dying (losing its content).Yes we know that this is normal for these kind of old school ROMs and can be expected after 30 years of operation.The problem is: there is no copy of the original program code available... anywhere.This post is first a warning call that this might happen anytime with your unit as well: it is not a question of IF but WHEN.Second this is a request for help for anyone willing and able to read out the U502 ROM from his/her unit in order to preserve these units from the scrapyard in the future.So if you:- still have a 100% operating HP3468A- have the skills to safely desolder U502- the means to read out the ROM contentsand willing to help us and safe your own unit yourself for the near future, please doKjelt and Sailor.Previous topics:https://www.eevblog.com/forum/testgear/hp3468a-rom-contents-of-u502/msg370690/#msg370690https://www.eevblog.com/forum/testgear/hp-3468a-in-continual-resetinit/msg424323/#msg424323

author: Deathwish
author_rank: Unknown
timestamp: June 04, 2015, 07:53:40 pm
content: This may be of use, I have no idea.https://www.febo.com/pipermail/volt-nuts/2011-August/000971.html

author: Sailor
author_rank: Regular Contributor
timestamp: June 04, 2015, 11:39:12 pm
content: Yes, the yahoo Agilent group is very good. Unfortunately, it seems that no one has ever copied this particular ROM.Thanks to Kjelt for starting this thread, we hope that the subject heading will attract a bit more attention than the fairly bland title on the thread that we have been pursuing for a while now.Kjelt's technique for reading the ROM is direct and to the point. However, for those who *do* have a functioning 3468A but who may also be a little reluctant to remove the ROM from the board, there are alternatives. The first is quite straightforward; Instead of touching the ROM, remove U501 (the 8039 CPU) and instal a socket in its place. The removal can be as simple as 'clip the legs, and desolder one pin at a time'. A replacement 8039 will cost you the princely sum of $1.49 at Jameco. Then hook up an Arduino to the socket and read and dump the ROM contents. Remove the Arduino, reinstall the 8039, and you're good to go again! I used my EtherMega Arduino, but I will investigate other variants, and provide the code and any other help that I can.Other techniques that are even less invasive only provide partial access to the ROM, although I am still pursuing them. It will be really nice if I can find a way...Please use this thread, or PM Kjelt or me, if you can help.Thanks, Sailor.

author: PTR_1275
author_rank: Frequent Contributor
timestamp: June 05, 2015, 12:02:41 am
content: I am guessing the 3478 is going to be in a similar boat? Do you know if there is any difference in the ROM from a 3468 to a 3478?As far as I can tell the difference between the 2 is the rear terminals. Both have GPIB, is there something obvious I am missing here??I have 2 3478s that are in good working order, both have just recently had the batteries replaced, one is definitely older than the other (It has metal vents down the side). Do you know what the issue causing the failures is, or is it just that the units are getting old and the ROM is failing?I would love to help, however, I have no experience in getting ROM contents, I don't have any arduino experience either so may not be much help.-Chris

author: Smokey
author_rank: Super Contributor
timestamp: June 05, 2015, 12:15:41 am
content: Ebay sold listings show they go for around 50-60 bucks pretty regularly. (cheapest one up now is 150) It wouldn't be too much of an investment to just get another working unit, read out the rom, post it to the interwebs, and use that to fix all the existing units. It would be nice if someone was willing to take on the project and use the unit they already have, but for 50 bucks you can just do it yourself. And you can add to your test equipment collection.... You can never have too many vintage multimeters, or so I hear(For full disclosure... My name is Smokey, and I have a vintage Keithley bench meter addiction. If it's brown, I probably have a couple on my shelf)

author: Melt-O-Tronic
author_rank: Frequent Contributor
timestamp: June 05, 2015, 12:26:11 am
content: I have both a fully functional 3468A and a 3478A and the willingness to do it. Unfortunately, a good desoldering gun and a reader/programmer like a TL866 are thenextacquisitions on my list because I just dumped the budget into GPIB gear. So I probably won't be helpful in a timely manner.I'm with you in spirit though!

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 12:33:19 am
content: PTR_1275, you are in luck. The short answer is that ko4bb (http://www.ko4bb.com/getsimple/index.php?id=manuals&dir=01_ROM_Images_and_Drivers) has the ROM dump for the 3478. The longer answer is that the 3478 is dramatically different inside. The 8039 is now relegated to general communication, presentation, etc, and there is a (mask-ROM'd) 8048 handling the ADC etc. The 8039 ROM is still a Mostek 36000 device. I don't think there is any way of getting to the contents of the ROM inside the 8048, so that's still a vulnerability. No, I have never seen the mechanism of the Mostek failure explained. Almost certainly (IMHO) it is related to a deficiency in the silicon fabrication process.I'm a recent user of the Arduino - I've lived and breathed Atmel AVR for the last 20 years, so the transition from 'rolling your own' (which is what I have been doing since the '60s) to finding ways to use a standard board wasn't too difficult. But the big attraction of Arduino is the enormous amount of software that is available. Test the water, dip your big toe in, it's really easy to get started.If you know anyone who does have a 3468, please point them in our directionRegards

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2015, 12:33:53 am
content: Unsoldering the ROM won't be much of an issue if a heatgun (those to remove paint) is used to evenly heat the general ROM area to solder melting point and then pulling the ROM with some tweezers. Have done it several times (also to some 40 pin CPUs), never had a problem doing it. You just have to be patient and don't heat it to quickly (be too close with the muzzle of heatgun to the board), or the board will get burned.Note that the Mostek ROM (these fail quite often,like in HP 3456A, probably by purple pest (AuAl alloy that has no mechanic strengt), because gold bonding wires are used on aluminium pads) has different pinout (24 pin Mostek to 28pin 27C64) than classic 27C64, so you'll need to rewire or build adapter to replace that Mostek with a 27C64. Reading the Mostek on adapter as a 27C64 will probably just work fine with the usual programmers (Willem or Tl866).Unfortunately I don't have a HP 3468A (have enought meters already), but if someone wants to donate me one, I would happily accept the challenge of dumping the ROM.

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 12:47:13 am
content: Well, thank you Melt-O-Tronic and MadTux, it looks like community spirit is alive and wellMy concerns about removing the ROM by any method is related to the inevitable heat stress that will be placed on the device, possibly aggravating a latent problem - hence my favored method of replacing the CPU with a socket, etc etc. I would hate it if a good samaritan removed their ROM from a functioning instrument only to find that they have destroyed it in the processI will continue to work on a less invasive method.

author: Melt-O-Tronic
author_rank: Frequent Contributor
timestamp: June 05, 2015, 12:56:02 am
content: Yessiree. I too was thinking that a bulk heating method of removal could put a shaky ROM over the edge. I don't mind trying with a vacuum gun as soon as I land one though -- I figure if I fail & destroy my ROM, someone else will succeed, then I could fix what I broke.I suppose that clipping on to the ROM in-circuit with the CPU also present wouldn't work, would it?

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 06:04:00 am
content: Quote from: Melt-O-Tronic on June 05, 2015, 12:56:02 amThat was my first idea too. You could lift pin1 on the 'ls373 address latch and pull it high. That would tri-state its output so that you could apply A<7:0> to the ROM. A<12:8> are driven by P2 and P1 bits, which are in the 'weak pullup' state when the 8039 is held in RESET. /PSEN is also held high, but is isolated from the /CE of the ROM by a 1k resistor, so that can also be over-ridden. But unfortunately the 8039 also drives the BUS (Data<7:0>) low while in RESET. I stopped thinking about it any further at that point, but I've always intended to investigate how strong the 'low' drive is, with the idea that the ROM *may* be able to still drive the bits high enough to be at least detectable, even if not to proper logic levels. The duty cycle could be kept low. However, the ROM output drive is only rated to supply 220uA at 2.4V, and they don't specify a short-circuit current. The other aspect of this method is that it also is stressing the wire bond joint, and MadTux tells us it's that joint which is the source of the problem.Life wasn't meant to be easy...Edit: Of course you could always nick the D<7:0> lines, read the ROM, then bridge the lines again. But the purist in me chokes at that

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 06:46:14 am
content: @MadTuxMy brain has just surfaced for a reality check. If the problem was solely related to the wire bonds, then you would expect either a solid D<x> error, or addressing errors, or intermittents of either of these. But I can read the ROM in my 3468 until the cows come home, and get the same data (which is 99.9% correct) every time. So I's say there is another problem as well, at the bit level.

author: Mr Simpleton
author_rank: Unknown
timestamp: June 05, 2015, 09:21:21 am
content: Removing a DIL is usually just matter of using plenty of flux and a fresh bit of solder wick... and of course a really good soldering iron, i.e Metcal, Weller or JBC. I have done this numerous times, and using plenty of flux makes the difference!Now reading this old ROM, is another story, the suggested CS866 may not be up to the task. This is a very simple device and I suggest using a reader with better track record if the CS866 fails, i.e. an old Data I/O or similar.

author: sync
author_rank: Frequent Contributor
timestamp: June 05, 2015, 11:36:47 am
content: Quote from: Sailor on June 05, 2015, 06:46:14 amIs Kjelt's ROM readable too? Maybe you can compare the images and locate the rotten bits.

author: MarkL
author_rank: Unknown
timestamp: June 05, 2015, 11:38:36 am
content: There's a 3468A on ebay that's up in 5 days for $50 + shipping. If no one else bids on it, I'll buy it and read the ROM.I don't really need a 3468A, so if it checks out ok after re-assembly I'll resell it here on Buy/Sell/Wanted for what I paid.

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2015, 12:01:06 pm
content: I've just opened up another bad Mk36000 from a repaired HP 3456A that I had in my parts box. Couldn't find bad wire bondings in this one (but also no obvious other faults like melted discharge spots), so this theory might be wrong. But I have opened chips from similar generation (broken HP-8165A VCA output amp), where the bonding wires just could be wiped from the surface of the chip.Any idea what storage method is used in this one? Always thought they were mask programmed, but these storage cells don't look much like that (look quite regular to me), more like diode anti fuse?

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 12:13:23 pm
content: Hey, MarkL, that would be great. I've been looking at that one also, but then it more than doubles the cost to ship it to Australia.If you can get it for that price, we'll owe you a beer... or two... or three... or...

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 12:42:18 pm
content: @syncNo, unfortunately Kjelt has only been able to get 0xff out of his.

author: Sailor
author_rank: Regular Contributor
timestamp: June 05, 2015, 12:51:22 pm
content: @MadTuxNice pic, what microscope do you have?BTW, I looked at your 3456A fix. Good work, looks like you know how to get your hands dirty..

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2015, 01:40:44 pm
content: High end old skool microscope I got from grandfather years agoYou just put camera in macro mode and put it where your eye is and take a picture. Works OK so far, still makes better images than most crap from china. So I'll just use that until I find myself a Zeiss Axioplan (had one at work a while back, and it was glorious) or something similar one day. Unfortunately, these things are badly expensive, even used/trashed ones on ebay.

author: Deathwish
author_rank: Unknown
timestamp: June 05, 2015, 01:48:12 pm
content: I have camels. lots of sexy good looking camels, sell me this microscope for a camel ....

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2015, 01:50:54 pm
content: Can you send camel by USPS? If so, you have a deal

author: Deathwish
author_rank: Unknown
timestamp: June 05, 2015, 01:52:37 pm
content: Deal is done, U send scope to Nigeria yes ?.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 05, 2015, 02:43:10 pm
content: I'm not familair with that memory device, however it can be possible to read a dying EPROM by lowering the supply voltage. The threshold of the read amps is proportional to the supply voltage, so reducing it may allow marginal data to be recovered.(Eprom programmers typically use a similar technique, verifying at high Vcc to ensure there is some margin) The question is how low can the supply be and have the logic still work - for a device that has only just died, assuming the issue is charge leakage, then it ought to be possible to recover like this.

author: lincoln
author_rank: Regular Contributor
timestamp: June 05, 2015, 05:17:16 pm
content: I have an eprom burner and am willing to help if some one has a meter that is close.

author: Kjelt
author_rank: Super Contributor
timestamp: June 05, 2015, 09:06:32 pm
content: Quote from: lincoln on June 05, 2015, 05:17:16 pmCan it read the Mostek 36000 series? If so what is the brand and modelnr?

author: Deathwish
author_rank: Unknown
timestamp: June 05, 2015, 09:16:59 pm
content: http://bee.mif.pg.gda.pl/ciasteczkowypotwor/Tek/7854/hp3456.txtAlsohttp://www.ezoflash.com/willem_info/forum.php?show=topic&topic=1135797601I have a PCB3 version of the Willem Programmer, made by MCUMALL. It works great on regular 2764 Eproms. I'm using software version 0.97ja.By: jrseattle - 2006-01-12 08:30:57Success! I have read several Mostek MK36XXX succesfully.The original DOS version WILEPR99.EXE was built with Turbo Cpp 1.01 and used the HUGE memory model.Once I had that working I could modify the source. I needed to turn S6 HIGH, then LOW (each followed by a minimal delay) after sending the address but before reading the data byte, to be able to read the Mostel 36XXX roms using a special adapter (which uses an LS245 and an LS123). As speculated, these Roms require the use of the OE line.Thanks everyone for listening.

author: lincoln
author_rank: Regular Contributor
timestamp: June 05, 2015, 11:04:19 pm
content: Quote from: Kjelt on June 05, 2015, 09:06:32 pmNot directly, need to make an adapter board but it should read them. Phyton ChipProg-48

author: Deathwish
author_rank: Unknown
timestamp: June 05, 2015, 11:27:25 pm
content: Hope this is of use, if so go fill your boots as we say.page 49 in my chrome sidebarhttp://bitsavers.trailing-edge.com/pdf/mostek/_dataBooks/1977_Mostek_Memory_Products.pdfpage 60 as abovehttp://bitsavers.trailing-edge.com/pdf/mostek/_dataBooks/1979_Mostek_Memory_Data_Book_and_Designers_Guide_Mar79.pdfI just pinched all their books. from here:http://bitsavers.trailing-edge.com/pdf/mostek/_dataBooks/I also know the dataman programmers will read and programme these too

author: Sailor
author_rank: Regular Contributor
timestamp: June 06, 2015, 09:53:26 am
content: Quote from: mikeselectricstuff on June 05, 2015, 02:43:10 pmYeah, it was worth a try.. In my 3468 I lifted the jumper that conveys the 5V regulator output to the rest of the instrument, and hooked up a bench supply. I read the ROM (using my Arduino / CPU replacement arrangement - see Reply #2) with various voltages.I first went downwards, getting as low as 3.75V without any differences from the reading at 5V. Going below that started to bring in a couple of errors, but even down to 3.25V (which was as low as I went) the few errors that did occur were more likely due to the /CE (/PSEN in the 3468) not being long enough for the low voltage. The Atmega in the Arduino can only insert a maximum of 2 wait-states during external accesses, which is what I have used right from the start (note that I have also set the system prescaler to drop the effective clock speed down to 4MHz, so the /CE to the ROM is 750ns wide).I then went upwards, to 5.5V, then 5.75V and finally 6.0V. All reads were the same as @5V. I didn't feel comfortable going higher than that, without knowing *exactly* where else on the board it went.Deathwish's links to the Mostek catalogues are good - they're fully OCR'd so can be searched. The second link he provided (http://bitsavers.trailing-edge.com/pdf/mostek/_dataBooks/1979_Mostek_Memory_Data_Book_and_Designers_Guide_Mar79.pdf) has an interesting app note about threshold voltages etc - see printed page #361 (it becomes 362 in Foxit reader).Edit: Added note about the system prescaler.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 06, 2015, 01:01:37 pm
content: If it's marginal as opposed to just plain dead, it might be worth trying at different temperatures

author: Sailor
author_rank: Regular Contributor
timestamp: June 06, 2015, 01:32:27 pm
content: Already tried that - very crudely. I heated the ROM gradually, and tried a few voltages. But the general result was the same. I also reduced the Arduino system clock to 1MHz while at normal temperature (so /CE was then 3us wide), but it made no discernible difference. It seems to want to work all the way down to well under 4V, and when the readout does start to differ from 'standard conditions' values, the one bit that I *absolutely know* is bad, doesn't change, even down at 3.25V.I'm really looking forward to seeing a 'good' ROM !

author: Kjelt
author_rank: Super Contributor
timestamp: June 06, 2015, 01:58:38 pm
content: Some of the topics in deathwish links confirm what I already feared, if the Mosteks are really dead they give out the same value for every address.The other topics that said to read it out as a 27C64 with the /OE connected to the 36k /CE I tried that and same result, all 0xFF.Quote from: Sailor on June 06, 2015, 01:32:27 pmOr one that has different bit failures so you can merge the two together to a working ROM

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 04:15:32 pm
content: From what I have found out the software for this was written by a Norm Dillman at HP. I have tracked someone down who may know how to contact him and ask for a copy of the firmware if he ever kept a copy. I have also emailed someone called Bob Smithers who may have it. Meantime I have 3 machines searching for firmware for it. I have nothing else to do so why not.Just do NOT expect a result or hold your breath on it.

author: Noise Floor
author_rank: Regular Contributor
timestamp: June 06, 2015, 04:24:28 pm
content: Great detective work. I was going to ask if you had tried contactingHP, Agilent,Keysight for help. Long shot I'm sure.

author: Stray Electron
author_rank: Super Contributor
timestamp: June 06, 2015, 04:28:57 pm
content: Go dig up the HP Journal(s) that had any articles about this meter and look at the list of authors/contributors to the articles and try to contact them. They're the people that are the most knowledgeable about that product. Also the Journal articles are usefully VERY helpful about explaining how a product works and why it was designed and built the way that was.PS: Five HP 3468s here and all are working fine.

author: Kjelt
author_rank: Super Contributor
timestamp: June 06, 2015, 05:26:42 pm
content: Quote from: Stray Electron on June 06, 2015, 04:28:57 pmI would have higher regards for HP if they also would have kept a database with their old software ROMs instead of only their paper journalsQuoteThe clock is ticking and time is running out, but at least now you know.You can do something about it by contributing, if you have 5 working devices you could surely risk one ?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 06, 2015, 05:46:28 pm
content: If nobody's already done it, it can be worth posting on Agilent's forum - I've seen a few requests for info produce results from long-term employees that happened to have something in the back of drawer....

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: June 06, 2015, 06:07:06 pm
content: Thanks for this thread, as a matter of fact I have a 3468A, but it's rarely used.I hope a modern (P)ROM replacement can be arranged if bit rot happens.

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 06:09:40 pm
content: I already have the HP journals , a complete set, I borrowed them from their site via flashfxp a while back, I also have the 3468A product notes that have a shed load of code in the rear but it means nothing to me as i am not a programmer as such, I have only dabbled with a couple of pic chips. I also have a large file called ALLROMS.zip from HP and also what i believe to be the firmware for the 3478A but that is not the 3468a is it so onwards and upwards as they say

author: dom0
author_rank: Super Contributor
timestamp: June 06, 2015, 06:15:54 pm
content: Quote from: Deathwish on June 06, 2015, 04:15:32 pmThis Norm Dillman?

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 06:21:15 pm
content: looks like it. Steve did say he may of kicked the bucket but he would try have a word as he used to work for HP before going to IBM northern cross in Basingstoke a multitude of years back, looks like that is out the window then.

author: bson
author_rank: Unknown
timestamp: June 06, 2015, 08:01:25 pm
content: Quote from: Sailor on June 06, 2015, 01:32:27 pmEven if it's another bad ROM, as long as your bad bit is good...Wait a second, if it's only one bit, the good value is opposite of the bad value. Just flip it! :p

author: Kjelt
author_rank: Super Contributor
timestamp: June 06, 2015, 09:34:21 pm
content: Quote from: bson on June 06, 2015, 08:01:25 pmYeah you just have to try 65536 possibilities then to find out there were probably two or more bad bits

author: Kjelt
author_rank: Super Contributor
timestamp: June 06, 2015, 09:35:10 pm
content: Quote from: Deathwish on June 06, 2015, 06:09:40 pmSounds good, what is in it, can you give a listing as a text file and attach it here?

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 10:00:52 pm
content: Yeah sure, but looking at them i think its some users personal rom collection or such and not HP ones, I dont know. I just grabbed everything in the directory I ended up in. Although the modgen.txt ( i renamed it after copying it so i could read it )when opened says it is something to do with v41 and HP. you tell me cos I am lost with it.

author: Kjelt
author_rank: Super Contributor
timestamp: June 06, 2015, 10:05:42 pm
content: Look like these are ROMs for a HP calculator or computer that uses rom cartridges, something like that not for test equipment. But thanks anyway.

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 10:10:04 pm
content: your welcome, like I said I have no idea what half of it is I borrowed, I just set the boxes up to hunt for *.rom , *.firmware and *.bin / hex and told them to download it all. I ended up with a shed load of manuals and other stuff too. If anyone needs this ROM - HP 3478A OTP 64Kbit U502 (Program Rom) , its here.

author: Sailor
author_rank: Regular Contributor
timestamp: June 06, 2015, 11:05:45 pm
content: Quote from: bson on June 06, 2015, 08:01:25 pmThat would be great if it was the *only* bad bit. Unfortunately, it's the *only* bad bit that I can identify for certain. I know what it is, and I know what it should be. However, there are lots more bad bits in there, as evidenced by the checksum that I derived, and as implied by visually observing spots of slightly corrupted code in my disassembly of the ROM. Theoretically, and even possibly in practice, it could be possible to deduce what the corrupted code should be, but I could easily see a year or more of concentrated effort. I won't even start to enumerate the difficulties, suffice to say that the ramifications of even a single bit corruption in a routine may possibly not even be apparent (in the form of a disassembly failure, a bad jump or call destination, etc, etc) until some number of instructions *past* the failure. That leads the need to conduct 'what if' examinations over segments of code, and the time involved becomes too great. Ideally, it's the sort of thing that could be handled by an automated algorithm, but just designing the algorithm would be a hell of a task in itself...@Deathwish thanks for your interest / efforts. Do you know if any of the info that you obtained has a description of the 'starburst' display module that was used in the 3468, and maybe other instruments (besides the 3478)?

author: Deathwish
author_rank: Unknown
timestamp: June 06, 2015, 11:31:51 pm
content: Not offhand but I havent been looking or info on those, however this "HP fourteen-segment display" in google threw up a few things, if I knew what it was you actually wanted to know I can look.

author: Sailor
author_rank: Regular Contributor
timestamp: June 07, 2015, 12:00:36 am
content: I'd like to know how it's driven, it would help me deciphering the code. The cable connecting the display to the main board has 16 conductors. Even disallowing power, ground, unused etc, there are still six signals that are actively driven. They are: Phi1, phi2 (two clocks), PW0, INA, ISA, and SYNC. The 3468 / 78 manuals are pretty sketchy when it comes to the display. The inference is that data and commands are on two different lines, with a 'Command-framing' signal on the SYNC line. Perhaps the two clocks are used separately for command and data. Some timing waveforms would be nice. And a list of commands. And a segment decode table. and ... you get the idea.Thanks.

author: Deathwish
author_rank: Unknown
timestamp: June 07, 2015, 12:08:01 am
content: Ok,. will get onto that, If I can find anything I will post it here.

author: Deathwish
author_rank: Unknown
timestamp: June 07, 2015, 12:46:31 am
content: something here.http://hparchive.com/hp_PARTS.htmthis looks interesting ( hp parts in general ) including roms.http://www.sphere.bc.ca/test/hp-parts/hpparts3.html

author: free_electron
author_rank: Super Contributor
timestamp: June 07, 2015, 12:57:03 am
content: a bit of information about this rom ( you may or may not have this bit of information )this is a SYNCHRONOUS rom !!! meaning you need to toggle the OE for the data to change !!!!reading the romapply addressmake OE low : the rom latches in the addresswait a momentread bytemake OE highapply next address.the eprom verson of these things is the motorola 68766 BUT it does NOT have the latches on the address lines.i do not know if it will work for this machine.

author: Sailor
author_rank: Regular Contributor
timestamp: June 07, 2015, 08:06:06 am
content: Thanks, Deathwish. That sphere site looks like a keeper, I've entered it in my website lists.@free_electronYes, we are aware, thanks.

author: all_repair
author_rank: Frequent Contributor
timestamp: June 07, 2015, 08:59:54 am
content: I have 2 running sets that are used daily, the tool and the skill to desolder. What is the chip to replace the ROM, and what is the tool to read out the ROM? (Unlikely my readers can read this chip, I shall check later and report back if I got a positive)

author: nuno
author_rank: Frequent Contributor
timestamp: June 07, 2015, 12:39:28 pm
content: If you have only small portions of corrupted data, a less invasive method could be to connect a logic analyzer capturing all memory accesses on a good unit, luckily you'll eventually capture the data of interest by exercising the device.

author: Deathwish
author_rank: Unknown
timestamp: June 07, 2015, 01:41:06 pm
content: God my brain is fried, what with reading about having to latch this or that and all the other stuff on these 36xxx devices !. anyway, apart from the dataman programmers being able to read them these programmers also popped up on my radar.http://www.elnec.com/device/Mostek/MK36000/http://www.minato.co.jp/jp/dpexralist/M1883dlist_150429/M1883dev/mostek_dev.htm

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 07, 2015, 01:47:43 pm
content: Quote from: nuno on June 07, 2015, 12:39:28 pmIf it does a checksum you may find it runs through all addresses on startup.

author: Sailor
author_rank: Regular Contributor
timestamp: June 07, 2015, 02:31:41 pm
content: Quote from: mikeselectricstuff on June 07, 2015, 01:47:43 pmYes, it does, sort-of. The checksum routine only runs through the upper 4k of the ROM. There is no checksum code in the lower 4k, and no way for code executing in the upper 4k to simultaneously read data from the lower 4k - well, no way that I know of, given my understanding of the 8039. Granted, it was a long time ago (nearly 40 years), but I did write a fair amount of 8038 - 8048 assembler for some laboratory equipment that I designed. That said, however, the SA1 test routine claims to check the ROM, yet it is constrained by the setting of switch S501-6 (which grounds P14 (address<12>)) to only execute in the lower 4k

author: Sailor
author_rank: Regular Contributor
timestamp: June 07, 2015, 02:44:50 pm
content: @all_repairThank you for your generous offer. Unfortunately we don't have a turn-key solution at the moment (Kjelt, MarkL, et al, please double-check me on this), as I believe the others are still searching for a commercial programmer that is qualified to read the Mostek 36000. There are two considerations that must be kept in mind, firstly, that the Mostek device has only 24 pins, whereas most other 8KB devices are in 28-pin packages. Making an adapter is simple, and has been done by Kjelt. The second consideration is that the Mostek device latches the address inputs on the falling edge of /CE, which is also used to enable its output buffers. This means that /CE must be cycled back 'high' and then 'low' with new address values in order to read successive locations. It is possible, perhaps even likely, that programmers would cycle the chip-select, output-enable, etc when reading a device, but it probably isn't something that is specified. It may, or may not, be relevant to note that Kjelt was unable to get anything other than 0xff from his ROM when using the adapter. It may be simply because his ROM is completely dead, or it may be related to the access protocol of the programmer he used. I have successfully read my ROM in-situ by replacing the 8039 micro with an Arduino hookup, described elsewhere. Of course, it would be simple enough to make an adapter board that accepted the de-soldered ROM and which plugged directly into an Arduino.So, reading the ROM isn't a two-minute job, at least not at the moment.Now, about the replacement device for the ROM. We have blithely assumed that we would use an MCM68764 or MCM68766 EPROM, because it is directly pin-compatible with the MK36000, and there are undoubtedly a number of programmers around that will handle those devices e.g. an old Sunshine EXPRO-60 of mine has them listed.However,Kjelt, MarkL, and anyone else reading this / contemplating replacing their ROM, please check my reasoning and understanding of the 8039 in the following paragraph.I had unconsciously considered the 8039/ROM implementation in the 3468 as (to me, anyway) a standard external memory system using a multiplexed data/address bus, where the lower 8 bits of address need to be latched, and the higher address bits are provided statically from other pins on the microprocessor. The 3468 provides the necessary latch (U504) and address bits <12:8> come from P14 and P2<3:0>, so I didn't see any reason why the non-latching MCM68764/6 shouldn't drop straight in. It was only this evening that I realized there are no timing specs associated with P2<3:0> when it is used to provide the higher-order address bits for external memory access. For those unfamiliar with the 8039 series, P2<3:0> can be used as normal I/O bits, but during external program memory access they will be replaced by address<11:8> for the access, then restored automatically. The exact words from the MCS-48 manual are:'... the I/O information previously latched will be automatically removed temporarily while address is present then restored when the fetch is complete'I would like to hope that this means that those address bits will be present right through to the end of the /PSEN signal, which would then mean that there is no problem with us using the MCM68764/6 ROMS which don't latch any of the address lines. However, the fact remains that the MK36000 latches *all* address lines at the leading edge of /PSEN, and so it doesn't care what happens to them after that.Adding to my concern is that all the example / system block diagrams for 8039 expansions show the use of the Intel 8355/8755 Peripheral_IO/ROMs which latch all address bits, or show generic EPROMs with an address bus latch (width unspecified).It should be noted that in the 3468 the outputs of P2<3:0> are latched (into two separate 4-bit latches) for use driving the keypad and the display, although I am not inclined to read too much into that.Tomorrow I will get the scope hooked up and see if I can resolve it. But until I do, it may be prudent to wait until there is a definitive answer.As a further thought, it might be worth foregoing the convenience of the MCM pin-compatability, and use a more modern/common EPROM which will also run cooler (the MCMs draw 85mA, vs ~20mA for a 27C64A). The necessary adapter could also carry a high-order address latch, if it turns out to be necessary.

author: amyk
author_rank: Super Contributor
timestamp: June 07, 2015, 03:03:53 pm
content: Quote from: MadTux on June 05, 2015, 12:01:06 pmA clear, focused image of the ROM area itself would help identify exactly what type of mask ROM it is (and could give hints as to the failure mode); there are several types and not all of them have visible bits:https://siliconpr0n.org/wiki/doku.php?id=rom:mask

author: Deathwish
author_rank: Unknown
timestamp: June 07, 2015, 03:32:55 pm
content: at the risk of adding nothing more new or unknown, I spotted this in a longer convo than i found before. I have attached the convo and << the bit I found of interest and might be of use.I tried to read the MK36xxx's as a MCM68766 on my Data I/O 29B, but it did notwork. I guess the Data I/O does not strobe the /CE pin between addresses.All the data was a duplicate of the first location. The latch had "latched". <<<<<<<<<<<<<<<I guess I will still need to use the adapter (it's already built). Someprogrammers may be able to read them if they strobe the /CE line. It's hit ormiss, I guess.I am on my way to pick up a bunch of `766's, and I will let you all know if theywork in the instruments. I do not think there should be a problem.Thanks for the tip. You were right!Cheers,Paul Grohe

author: Deathwish
author_rank: Unknown
timestamp: June 07, 2015, 04:08:55 pm
content: Kjelt. I have had a reply from Walter in the states, he wants to know if the ROM you have is socketed ?. Can you confirm it is or not.to meGarry,by any miracle, is it socketed in the instrument?w.Walter Shawlee 2, PresidentSphere Research Corporation

author: MarkL
author_rank: Unknown
timestamp: June 07, 2015, 05:33:34 pm
content: Sailor:Here's at least one commercial programmer that can read MK36000:http://www.elnec.com/sw/dev_html/mostek_dev.htmBut given this only needs to be a one-time shot, it's not terribly difficult to do it on a Arduino, like you have, either in or out of circuit. And use a scope to make sure all the MK36000 min/max timing requirements are met.I think your concern about P2<3:0> staying valid through the end of the instruction fetch is well founded. I couldn't find any information either on the timing of /PSEN with respect to P2<3:0> specifically for the read of the instruction byte on the bus. I was assuming it works the way you would want it (which is not a good engineering principle).I've attached the Fujitsu 8039 datasheet which has a timing diagram on 2-40 which says P2<3:0> is held until /PSEN goes high. There's also a block diagram on 2-36 that shows an address latch only being used on DB<7:0>, and P2<3:0> flowing through to what is labeled "Expansion ROM". Both of these would imply it's ok to do it without a latch.Of course, there's nothing better than actually looking with a scope.If it turns out a latch is needed, that dictates use of an adapter anyway, so I would try to use a 28-pin 87C64 which has an integral latch.BTW: The MCM68766 draws a continuous 85mA max, while the MCM68764 has a 20mA standby mode. That's the only difference I could find between the two. But what's a few milliamps on this power-hungry old gear anyway.All: Anyone trying to read a MK36000 could try reading it as a 87C64, with of course a pin-mapping adapter. This will force the programmer to properly sequence the /CE and address lines for the integral latch.(Seems that we're reliving the other thread a bit here... But the extra help and attention is appreciated!)EDIT: Fixed typo.

author: Kjelt
author_rank: Super Contributor
timestamp: June 07, 2015, 05:42:32 pm
content: Quote from: Deathwish on June 07, 2015, 04:08:55 pmNo it is soldered to the PCB but can be desoldered as I did. So my ROM is now outside the instrument.Concerning a socket, there is unfortunately not enough room for a socket since the plastick extension to operate the powerswitch is directly above it.

author: Kjelt
author_rank: Super Contributor
timestamp: June 07, 2015, 05:51:39 pm
content: Quote from: Sailor on June 07, 2015, 02:44:50 pmI share your concern and think it might be valid. I also think that this will be step2 and that there will always be a solution for this step.Step 1 is getting the original ROM contents which is the biggest challenge.Step 2 is replacing the original ROM with a replacement IC or even a new smd PCB with a modern small cpld/fpga or microcontroller that simulates the original ROM.The ROM is 350ns that is less than 3MHz, surely we have something in 2015 that can replicate a ROM from the 70's ?

author: iDevice
author_rank: Regular Contributor
timestamp: June 07, 2015, 05:53:00 pm
content: I have restored a few T&M devices with Mostek MK36k ROMs in the last few years, notably 3 Tek 468.I didn't remember having had any trouble reading them nor programming replacement EPROMs.Granted, at first, I didn't need to read them as the files were available on the net.So I just had to make 28>24 adapters and program 27C64 with the files.At some point I bought a 468 which was defective but still booting, meaning working roms and even if I had the files, I was too curious not to try to read and compare them to the downloaded files, just for fun, so I made a 24>28 adapter and read them without any problem.So when reading this thread, I didn't understand the difficulty some of you experienced trying to read.But about an hour ago I remembered that at that time I used my old Hi-Lo GANG-08 programmer.So I was wondering if the programmer really could make the difference.A few minutes ago, I pulled my MiniPro from the drawer, found my adapter and some MK36k I didn't trash and tried to read them as INTEL 2764A and succeeded without any problem.So I guess if someone encounters some difficulty, it should come from the adapter or procedure.That said, my 3468B is still working perfectly and I didn't know it was one of those dreaded Mostek again, so I guess I'm in the same boat now...I teared it down a long time ago, so someone can tell me if there is enough room to allow an support + adapter stack ?

author: Kjelt
author_rank: Super Contributor
timestamp: June 07, 2015, 06:00:36 pm
content: Quote from: iDevice on June 07, 2015, 05:53:00 pmThat is me, I only get 0xFF from all adresses with a Batronix 40-II which reads a 2764A and 87C64 without problem. So I am now almost sure it is totally dead (the ROM that is).QuoteNot much room above U502, the plastick mains power extension bar runs over it. Ofcourse for debugging etc. you can remove it but for permanent solution not much room.If you however desolder the ROM you could use a flatband cable to bring an adapter board to the side.

author: iDevice
author_rank: Regular Contributor
timestamp: June 07, 2015, 06:12:52 pm
content: Quote from: Kjelt on June 07, 2015, 05:42:32 pmOk, I found some pictureshereand indeed the plastic extender is an issue.As I have no time to disassemble mine right now, could you check how much clearance there is between the rom and the plastic thingy ?I was thinking about some sidecar assembly or two of those old DIP24 flat cable connectors and a short run of flat cable to move the rom to the side.I don't think the added wire length would be a concern in such low speed environment.

author: MarkL
author_rank: Unknown
timestamp: June 07, 2015, 08:21:51 pm
content: I said:Quote from: MarkL on June 07, 2015, 05:33:34 pmOk, brain loses another race versus keyboard...Again on the Fujitsu datasheet, on the previous page 2-39, it shows the relationship between /PSEN and the data bus when reading the instruction byte. Looking at just 2-40 you can't conclude it's ok, but it is of course the same /PSEN on 2-39.So combining these two timing diagrams, it should be fine without a latch. 2-40 shows P2<3:0> being held to PCH during /PSEN low, and 2-39 shows the instruction on DB<7:0> being latched on the rising edge of /PSEN.

author: Kjelt
author_rank: Super Contributor
timestamp: June 07, 2015, 09:15:37 pm
content: Quote from: iDevice on June 07, 2015, 06:12:52 pmI have to assemble mine again since it is fully disassembledWill try to make some time somewhere this week.

author: Sailor
author_rank: Regular Contributor
timestamp: June 07, 2015, 11:45:08 pm
content: Quote from: MarkL on June 07, 2015, 08:21:51 pmThanks for the Fujitsu spec, I only had the Intel and the Toshiba sheets. The Fujitsu is more comprehensively spec'd, and I believe that you're right - it *should* be ok, if you read between the lines. It's just that the min and max values on a couple of the specs don't actually tie it down. In any case, I'll be looking at it today.Quote from: Kjelt on June 07, 2015, 05:51:39 pmThe reason that I was looking so closely at the P2 timing last night was because I'm working on getting my Arduino to act as a memory server i.e. I will disable the 3468 ROM (with a jumper on /PSEN as per SA0) and have the Arduino respond in its place. I intend this to run in real-time, but the anti-metastable synchronizers on the Atmega input pins makes the timing of the address latching a bit tight. If we're right about the P2<3:0> timing being held throughout /PSEN, then it makes life a lot easier.Quote from: MarkL on June 07, 2015, 05:33:34 pmAbsolutely! The new voices have been most welcome

author: MarkL
author_rank: Unknown
timestamp: June 08, 2015, 01:27:21 am
content: There's another good write-up on the MK36xxx and substitution strategies on the BAMA site. Seems that the 3456A uses these Mostek ROMs too.http://bama.edebris.com/manuals/hp/3456a/I have a 3456A but at least the contents are available. Tick... tick... tick...

author: all_repair
author_rank: Frequent Contributor
timestamp: June 08, 2015, 01:54:45 am
content: Give me a day or few, or stop me if an image is found. I shall read mine out as 2764 format and try it out before I post the captured. Please be patient with me, you guys are too fast for me.-----After hooking up an MK36000t-2764 adapter , I found the U-502 was too big for the 24pin socket, and it was a 28pin chip. The version I have turn up to be a NS27C64, eprom dated: 9313A. Top numbering (maybe a part number) is 03468-65501.Attached are the readout by a minipro v6.1 TL866 programmer. checksum 0x0010 28c8

author: iDevice
author_rank: Regular Contributor
timestamp: June 08, 2015, 10:31:37 am
content: Looking back at the pictures I found and referenced in one of my previous post, I was a bit puzzled to see that it was not a Mostek rom.So your discovery adds another layer of uncertainity.I didn't have time yet to open mine, but I wouldnt be too surprized if it wasn't a Mostek either...So the plague could not be as widespread as we may have though in the first place.

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 11:01:42 am
content: Quote from: iDevice on June 08, 2015, 10:31:37 amThat would be good news, also if the rest of the hardware is the same (latching etc.) so we can substitute the Mostek with a normal 27C64.

author: Sailor
author_rank: Regular Contributor
timestamp: June 08, 2015, 11:14:45 am
content: Yes, that part number is (or was) the replacement part number for the Mostek device (1818-1753). I don't know who the manufacturer is, but maybe HP got wind of the problem very early, and changed.Edit: Maybe it's Signetics - I was initially looking at it as SKK

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 12:02:15 pm
content: @All_repair . Can you put a text file in that zip file to say what the contents are and from please. it gets harder 6 months later when you have a shed load of rom files but no idea what they are from.

author: amyk
author_rank: Super Contributor
timestamp: June 08, 2015, 01:49:03 pm
content: Quote from: Kjelt on June 08, 2015, 11:01:42 amThe latched version of the 27C64 is the 87C64, andyou can still get 87C64s.

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 02:04:13 pm
content: I think all_repair has solved it for you all. a search on the number he provided as a part number 03468-65501 throws this uphttp://bbs.38hot.net/thread-7294-1-1.htmlTranslated to english it says thisPosted on 2011-3-4 05:18:19 | This AuthorI have ROM program.HP3468A-ROM (03468-65501-DC-8817) .rar (7 KB, downloads: 82)I have attached The rom from that site to this.also there is thishttp://hl2kvx.tistory.com/4421

author: ivan747
author_rank: Super Contributor
timestamp: June 08, 2015, 02:16:06 pm
content: Now we only need somebody who reads chinese? I'm gonna try registering to reupload that here.Registering is proving difficult for me.

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 02:19:41 pm
content: Already done my friend, I just uploaded it and edited my post prior to this one.

author: ivan747
author_rank: Super Contributor
timestamp: June 08, 2015, 02:25:19 pm
content: Haha, you gotta look at the registration email... I understand absolutely nothingThanks for that

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 03:24:13 pm
content: Quote from: Deathwish on June 08, 2015, 02:04:13 pmThat would be great, I have done a short comparison to Sailors binary, unfortunately his binary data is in some sort of s19 format and can't be directly compared to the rom you posted, however on first sight there are a lot of similarities and also a lot of differences. The differences are mainly bits that went from 0 to 1, this is just a very short first glance and comparison of a few strings in the first 4k. Perhaps Sailor can provide a comparable binary formatted file so we can do a 1 on 1 comparison.It looks promising

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 03:47:45 pm
content: Think I fell in love with that Chinese site ... Just got a shed load of UNI-T schematics for the DMM range....

author: MarkL
author_rank: Unknown
timestamp: June 08, 2015, 03:49:43 pm
content: Quote from: Kjelt on June 08, 2015, 03:24:13 pmIf you have a linux box, there's a utility called "srecord" which can read and write many different kinds of EPROM file formats. It can convert to binary so you can do a direct comparison.Maybe available for windows too, dunno.

author: dom0
author_rank: Super Contributor
timestamp: June 08, 2015, 04:28:43 pm
content: Quote from: Kjelt on June 08, 2015, 03:24:13 pmsrecord is be able to convert it. Or upload it here and let someone else do it for you

author: all_repair
author_rank: Frequent Contributor
timestamp: June 08, 2015, 04:31:17 pm
content: Quote from: Kjelt on June 08, 2015, 03:24:13 pmI have both bin and intel hex format of my rom in my attachment. You may see if it has the same format aa sailor. I can't verify the chinese site rom and my captured bin now. Anyone can verify?

author: dom0
author_rank: Super Contributor
timestamp: June 08, 2015, 04:37:05 pm
content: They are bit-for-bit identical. Looks good.% sha1sum U502_NS27C64.BIN HP3468A-ROM\(03468-65501-DC-8817\).BIN1d670ee57e72a318a93e7a70037c89e17755d3ff U502_NS27C64.BIN1d670ee57e72a318a93e7a70037c89e17755d3ff HP3468A-ROM(03468-65501-DC-8817).BIN

author: MarkL
author_rank: Unknown
timestamp: June 08, 2015, 04:51:34 pm
content: Here's the explanation for the two different pin count ROMs being used in the 3468A.If you look in the more recent service manual, 03468-90008 (Sept88):http://literature.cdn.keysight.com/litweb/pdf/03468-90008.pdfIt shows in the parts list a change to the ROM 03468-65501 (the 28-pin one) for a specific revision of the motherboard. Snippet below.What may be of further interest, is that in schematic 7-G-12, it shows the 28-pin ROM *without* any additional latching. And from all_repair, this is a 27C64.I think what's still not known is if there's any hardware changes associated with the 28-pin motherboard that would not allow that image to run in the older 24-pin motherboard.In other words, do we still need a the 24-pin ROM image (1818-1753 or 1818-3123)?

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 05:00:45 pm
content: I am going to give it a try, don't know if I have enough time to get so far but will try a building a small converter pcb and a 27C64 in the actual device.Now the question is does it matter if I connect the original /CE of the MK36000 to the 27C64 /CE or /OE they both have the same function as far as I can tell in a short glance on the datasheet?

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 05:07:03 pm
content: Quote from: all_repair on June 08, 2015, 04:31:17 pmAh thanks it was a hex file Sailor made. So here is comparison screenshot and I attach the file. It looks like there is a lot of similarity (black) and a lot of damaged pieces (red). Now the question is if all the reds are 0's gone to 1's that would make sense, the other way round would make no sense unless it is a different program.

author: all_repair
author_rank: Frequent Contributor
timestamp: June 08, 2015, 05:09:37 pm
content: Quote from: Kjelt on June 08, 2015, 05:00:45 pmI think *CE of 27C64 should be grounded, and *OE to *E of MK36000 signal.

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 05:27:01 pm
content: Just looked more on the comparison and the upper4k from Sailor is almost identical will attach also. The lower 4k is very different also with a lot of 1s going to 0s which is not what I expected.

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 05:28:15 pm
content: Learning Chinglish is fun, no wonder the Chinese hate the Japanese .... its something to do with a jap oscilloscope.Japanese did not die, which addresses the boss sent overOh well.

author: iDevice
author_rank: Regular Contributor
timestamp: June 08, 2015, 07:04:16 pm
content: Ok, I had time to open mine a few minutes ago and... damned, I have the Mostek version.Strange enough, my serial indicates a 1982 model but most chips inside have a 84 date code.So that means I have a new time-bomb I didn't know about in the lab.I thought I got rid of all those DALLAS NVRAM and Mostek plague already, but no, so time for unsolder gun again...Now, I checked the clearance between the top of the chip and the power switch rod and it is about 2mm on mine, so no way to put a socket and certainly not an adapter.So it's either a sidecar or a Moto EPROM, but none of my programmers supports the old Moto chip and the minipro doesn't support the 25V prog voltage anyway, so even if some are still available on ebay, I'm stuck regarding this option...Unless someone is able to program them ?

author: MarkL
author_rank: Unknown
timestamp: June 08, 2015, 07:15:31 pm
content: After looking at the 03468-90008 service manual a bit, I noticed there's no new signature analysis numbers listed for the 28-pin ROM 03468-65501, even though that's the default ROM listed in the parts list.The signature numbers listed, and the pinout, are for the 24-pin ROM, 1818-3123.Unless someone forgot to update the signature numbers, it could mean 1818-3123 and 03468-65501 have the same binary image. I also can't see any differences in the schematics between the two motherboards (24-pin vs 28-pin).Not conclusive, but just sayin' it looks promising.The older 24-pin ROM, 1818-1753, has a completely different set of signature numbers. So if Sailor has that ROM, it's not going to match images from either 1818-3123 or 03468-65501.Quote from: all_repair on June 08, 2015, 05:09:37 pmThe schematic for the 28-pin ROM motherboard has /CE and /OE connected together which then goes to /PSEN (would be the MK36000 /CE, pin 20).EDIT: Clarification: No differences in the motherboards *besides* the 24-pin vs. 28-pin.

author: Deathwish
author_rank: Unknown
timestamp: June 08, 2015, 07:36:16 pm
content: its going to be no help but it did say this on the chinese postRemember ROM model is 27C64, 27C128 substitution I had, feet are compatible, multi-wire grounded out to one address.could the multi wire grounded to one post be .. the reason.

author: iDevice
author_rank: Regular Contributor
timestamp: June 08, 2015, 07:37:02 pm
content: My '84 model has the 1818-3123 version.

author: iDevice
author_rank: Regular Contributor
timestamp: June 08, 2015, 07:47:07 pm
content: BTW, I forgot a third solution beside the sidecar and Moto EPROM, and it's something I already did several times...doh.Just solder the 27C64 with several pins lifted and reroute via patch wires.This should fit under the plastic rod easily, although not as nice to the eyes than the Moto but much better than the piggyback adapter.

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 08:01:12 pm
content: So I created a temporary very crude converter pcb (rush job) and soldered it to the main pcb. I put the /OE and /CE on jumpers so I could easily play with them, first try /CE low and /OE to /CE.Burned the 27C64 placed it in the converter, out on the mains power and........................LADIES AND GENTLEMEN................. IT IS ALIVE!!!!!

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 08:03:04 pm
content: Thanks everybody for this great effortSuch a shame that Sailor is not online at the moment he is missing out on all the action.

author: dom0
author_rank: Super Contributor
timestamp: June 08, 2015, 08:07:50 pm
content: One of these should fit under the plastic rod:(Given you find one with 24, not 28, pins)

author: iDevice
author_rank: Regular Contributor
timestamp: June 08, 2015, 08:38:52 pm
content: Yes that's what I was talking about in a previous post but the connector must be very flat because of the 2mm clearance on top of the original ROM and the type you show is already too thick for instance.I guess, eventually, the semi-dead cockroach approach I was referring to in my previous post is probably the easiest in this particular circumstance.

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 08:45:56 pm
content: Quote from: iDevice on June 08, 2015, 07:04:16 pmWell at least you are warned on forehandAnd a solution has been found.QuoteWe are working on that. I am trying to acquire an old school programmer but it is still unsure if the other party wants to sell it or accept my trade.If it works out and I also can get it operational again (need to find the software and it requires a win98 OS with parallel port pc) it most probably would be able to program those chips (the successor can).BTW can you elaborate (maybe in a seperate topic) how you got rid of those DALLAS NVRAM/RTC chips? I bought NOS but the same problem is probably occurring again in 10 yearsPlayed around a bit with my working HP3468A and DC Voltage is within few mV same as my Keithley 2000 and the 4 wire ohms measurement within a mOhm so I am pretty happy with that.

author: tautech
author_rank: Super Contributor
timestamp: June 08, 2015, 08:48:11 pm
content: Is it possible to mod the push rod, maybe strap/join another to it to form a offset/crank over the ROM IC?How stiff is the switch, how much force must it withstand?Anybody with a donor unit want to explore this?

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 09:15:31 pm
content: Quote from: tautech on June 08, 2015, 08:48:11 pmYes could be possible maybe 3D print it, but then you also need to take away the aluminum side.

author: tautech
author_rank: Super Contributor
timestamp: June 08, 2015, 09:24:09 pm
content: Quote from: Kjelt on June 08, 2015, 09:15:31 pmIt's a shame it has a crank in it already, but if the crank was closer to the switch.....you'd have no problem.Engineer a new rod from aluminium and sleeve it for insulation? 1/4" rod?

author: Kjelt
author_rank: Super Contributor
timestamp: June 08, 2015, 09:47:57 pm
content: The picture is a bit misleading since the rod is too far to the left.If you make the crank later on near the switch you do have to take out the aluminium side because that is blocking the way. But an aluminium rod is a good idea it can be made much thinner.

author: MarkL
author_rank: Unknown
timestamp: June 08, 2015, 11:12:49 pm
content: Fantastic, Kjelt! I'm glad the 03468-65501 image works!I guess I don't need to buy that unit on ebay now to read the ROM.In terms of mounting, is there any room underneath the main board?

author: Sailor
author_rank: Regular Contributor
timestamp: June 08, 2015, 11:20:11 pm
content: Damn, that's what happens when you take time off to get some sleepBut seriously, all hail Deathwish / all_repair.I've just skimmed through all of the action from the last few hours. Sounds great, I'll start looking at that ROM image. Nevertheless, all differences aside,Quote from: Kjelt on June 08, 2015, 08:01:12 pmWords fail me. Just think what the world (or our world, at least) would be like without EEVblog and all the people who contribute

author: all_repair
author_rank: Frequent Contributor
timestamp: June 08, 2015, 11:24:05 pm
content: I was thinking to make the 24pin legs taller than the rod, and the adapter PCB sit just above the rod on the 24pin legs. But I got lucky so no way to test if it is a feasible modification.

author: free_electron
author_rank: Super Contributor
timestamp: June 08, 2015, 11:51:58 pm
content: simply make a small pcb with pins on the bottom and a plcc 27c128 on top.(plastic pack ) done. it'll fit nicely mechanically.

author: Deathwish
author_rank: Unknown
timestamp: June 09, 2015, 12:36:06 am
content: I only have a few observations to make.1. This is why you have to tell the other half it is very important that you MUST keep all that old tech you have hanging about in order to repair other old tech, and you are not obsessed as claimed.2. The Chinese liberated this years ago, now we have in some small measure liberated it back.3. all_repair is the one who took the chance and read his ROM, I merely followed clues and serial numbers, he alone deserves cred for taking his unit apart as such to post the contents of the ROM. I did however have much fun "liberating" all the manuals, books, schematics, ROM contents and the other 80Gig ( no exaggeration C:\Downloads\electronics, 10,277 Files, 192 Folders,81.8 GB 87,874,098,268 bytes ) of stuff from other sites in this journey, any visitors will have pockets checked, its mine and Gollum is not getting it back.4 Must go buy a MiniPro just in case.5. Erm what pins are used and what not on your repair ?.

author: Sailor
author_rank: Regular Contributor
timestamp: June 09, 2015, 12:49:55 am
content: Ive just run the new image through my Matlab script - the upper 4k checksum is 0The lower 4k shows 255 - I'll look at it later, but it might just be a 'hanging' carry at the end of the image In any case, greatThere was a shedload of errors in the upper 4k of my image, recovering it would have been essentially impossible, but tracking through it, it is apparent that the new (good) image is created by the exact same source code as for the original ROM.The lower 4k (good) image shows how truly corrupted my ROM is. Nevertheless, there are still many valid routines in my (bad) image that are absolutely identical to those in the good image, but the addresses shift slightly, with the changes varying as you progress through the image. It is clear that the new image is the product of minutely altered source code.

author: ivan747
author_rank: Super Contributor
timestamp: June 09, 2015, 12:53:09 am
content: Quote from: tautech on June 08, 2015, 09:24:09 pmThat is all too complicated, in my opinion. Is there space on the bottom of the PCB? You could use a flat flex cable as it was mentioned, but this time, attached to the bottom of the pcb.

author: Sailor
author_rank: Regular Contributor
timestamp: June 09, 2015, 12:53:58 am
content: Quote from: Deathwish on June 09, 2015, 12:36:06 amThe trouble is, she speaks a totally different language

author: ivan747
author_rank: Super Contributor
timestamp: June 09, 2015, 12:55:49 am
content: Quote from: free_electron on June 08, 2015, 11:51:58 pmYep, but the PLCC socket must be out of the way of the pushrod, of course. You could get creative with the breakouts.

author: ivan747
author_rank: Super Contributor
timestamp: June 09, 2015, 12:58:14 am
content: Quote from: all_repair on June 08, 2015, 11:24:05 pmProbably something like this + the adapter board:https://www.sparkfun.com/products/retired/8119But if you're skilled you could do it free electron style.

author: Deathwish
author_rank: Unknown
timestamp: June 09, 2015, 12:58:27 am
content: Why not just make a L shaped fitting and put the chip on the riser side fitted to the left of the push rod.

author: ivan747
author_rank: Super Contributor
timestamp: June 09, 2015, 01:02:03 am
content: Quote from: Deathwish on June 09, 2015, 12:58:27 amYup, that's what I'm talking about.

author: Sailor
author_rank: Regular Contributor
timestamp: June 09, 2015, 01:03:32 am
content: Quote from: ivan747 on June 09, 2015, 12:53:09 amYes, from the underside of the pcb to the metal shield there is ~10.3mm on my 3468. It's not a tightly controlled dimension, however, so I wouldn't design for anything more than ~9mm.

author: tautech
author_rank: Super Contributor
timestamp: June 09, 2015, 01:16:46 am
content: Why not double or triple stack turned pins strips and fit ROMabovethe rod?http://www.ebay.com/itm/3pcs-Strip-Tin-PCB-Female-IC-Breakable-40pin-Single-Row-Round-Header-Socket-/271423555498?pt=LH_DefaultDomain_0&hash=item3f321ac7aa

author: all_repair
author_rank: Frequent Contributor
timestamp: June 09, 2015, 01:25:36 am
content: Quote from: Deathwish on June 09, 2015, 12:36:06 amAny chance we can find a torrent seed of your harvest?

author: Deathwish
author_rank: Unknown
timestamp: June 09, 2015, 01:32:31 am
content: Quote from: all_repair on June 09, 2015, 01:25:36 amYour having a Giraffe !, seed that lot ?, I would be in my grave before it finished or even started. Being serious, give me some time to sort it out and remove duplicates , then I would be happy to "store" it somewhere for you all.

author: tautech
author_rank: Super Contributor
timestamp: June 09, 2015, 01:34:38 am
content: http://www.ko4bb.com/manuals/Is my favorite.

author: Deathwish
author_rank: Unknown
timestamp: June 09, 2015, 01:36:36 am
content: been there

author: free_electron
author_rank: Super Contributor
timestamp: June 09, 2015, 03:25:11 pm
content: Quote from: ivan747 on June 09, 2015, 12:55:49 amwho said anything about a socket ?a plcc body soldered on a 0.32 or 0.16 thcik board is thinner than that cerdil package of the mostek chip.iteadstudio can make 0.16 boards. for 2$ a piece you can have a a circuit board.

author: macboy
author_rank: Super Contributor
timestamp: June 09, 2015, 06:22:07 pm
content: Maybe you could use a zero-profile socket? They look like machine pin sockets (without the plastic part), except that the entire body of the receptacles is inserted into the PCB holes so that the IC sits as flush as if soldered. If the pads are big enough and it is only a two layer board, then the holes could even be drilled out a little as long as the socket pins are carefully soldered top and bottom to reconnect the layers.edit:example

author: iDevice
author_rank: Regular Contributor
timestamp: June 09, 2015, 07:23:01 pm
content: But... what's wrong with soldering the 27C64 directly to the PCB like I suggested and do rerouting the VCC, A12 and OE via patch or wirewrap wires ?I've done it several times in similar context, like many other did.The wire is so thin that you even can conceal it under the chip, in this case the clearance is sufficient.

author: Kjelt
author_rank: Super Contributor
timestamp: June 09, 2015, 08:14:47 pm
content: Quote from: iDevice on June 09, 2015, 07:23:01 pmNothing wrong AFAICS esp. compared to the other solutions.The nicest would be to have a pincompatible replacement that can be reprogrammed every 20 years like the Motorola chip Sailor advised, but then who knows if those chips will stay alive all those years.

author: ivan747
author_rank: Super Contributor
timestamp: June 09, 2015, 10:59:54 pm
content: Quote from: free_electron on June 09, 2015, 03:25:11 pmWill the PLCC fit inside the area of the original dip package?

author: free_electron
author_rank: Super Contributor
timestamp: June 10, 2015, 12:15:30 am
content: Quote from: ivan747 on June 09, 2015, 10:59:54 pmyes

author: iDevice
author_rank: Regular Contributor
timestamp: June 10, 2015, 09:12:04 pm
content: Quote from: Kjelt on June 08, 2015, 08:45:56 pmI didn't get rid of them unfortunately, I just bought new chips and replaced the old ones after having stored the content for eternity...Based on my experience, it should last at least 20 more years unles LiIon battery technology has regressed.So I guess it will be a problem for the next generation collector EE.Obviously, the best solution would have been the FRAM route with the SMT to DIP adapter board, but I was too lazy...

author: Melt-O-Tronic
author_rank: Frequent Contributor
timestamp: June 10, 2015, 09:29:56 pm
content: You guys are frikkin' awesome!

author: bronson
author_rank: Regular Contributor
timestamp: June 10, 2015, 09:48:03 pm
content: Quote from: free_electron on June 08, 2015, 11:51:58 pmAre you talking about those exotic rivet-looking PCB pins?Otherwise, doesn't this fix suffer the problem of pins dropping out when the solder melts? (Years ago I did this to implement poor-man's vias. Yuk.)Or, is there an easy way to join boards with pins that I don't know about?

author: Kjelt
author_rank: Super Contributor
timestamp: June 14, 2015, 10:04:44 am
content: Sailor: does your unit also pass the selftest now?

author: Sailor
author_rank: Regular Contributor
timestamp: June 14, 2015, 11:26:51 am
content: Hi Kjelt, I've been meaning to PM you, but ....The short answer is 'almost'. I lashed up a 27C64 (*very* ugly) and it initializes ok, although I get an ERROR 1 (Calibration RAM error). But ignoring that for the moment, yes, it works fine thanksJust running some quick'n'dirty voltage and resistance comparisons against a Fluke handheld only shows minute differences - who knows, even without the calibration coefficients the 3468A may be more accurate than the Fluke. I haven't yet followed up on the tests in 7-D-14 (a), because I am an the verge of testing my 'ROM server' code (my Arduino replacing the ROM in the 3468 (running at its standard 6MHz)) which I find more interesting at the moment. I expect to have a result on that tomorrow morningOne thing that I notice, and I can't remember if it was always like this or not - if I power it on and leave it with the inputs open, the displayed voltage creeps up... and up... and up... Placing any sort of rational (well, I only tried up to 10Mohm) resistance across the input stops that entirely, and it registers 0.00000V. I believe this is a common occurrence, but, as I say, I can't remember if mine used to do that or not. It would be interesting to know if it is related to leakage somewhere, and if anything can be done to minimize it. In the meantime I'll just leave my leads shorted.

author: dom0
author_rank: Super Contributor
timestamp: June 14, 2015, 12:52:09 pm
content: The 3478A has a few giga Ohms input resistance in 3 Volts and lower ranges, so it's quite normal to drift happily around if an open is connected. I must admit I often find myself using it on the 30 V range, because then I rarely need to switch ranges, if ever. The resolution even in 4 1/2 digit mode is enough to cover most everything occuring in a circuit ... probably the prime reason why these vintage 5 1/2 digit meters continue to be so popular ... we're all just lazy

author: Kjelt
author_rank: Super Contributor
timestamp: June 14, 2015, 07:37:31 pm
content: Quote from: Sailor on June 14, 2015, 11:26:51 amOuch did you replace the lithium cell , can you measure the voltage on the cell? Probably past dueI ordered a replacement battery last week, hope to receive it tomorrow, and then I will do the procedure ala MrModemHead on the internet. Hopefully it i will work well.Anyone know how to read out the RAM safely and back it up and did it?QuoteQuoteYeah mine does to, incredible input resistance as dom0 mentioned

author: MarkL
author_rank: Unknown
timestamp: June 14, 2015, 10:50:41 pm
content: Quote from: Kjelt on June 14, 2015, 07:37:31 pmIf you have a logic analyzer, one trick is to attach it to the CMOS RAM and capture the checksum sequence on boot up. The processor will cycle through all the calibration data stored in the RAM that it cares about and now you will have a copy of it.Getting the data back in there if you lose it is another matter, but at least you have a backup.

author: Sailor
author_rank: Regular Contributor
timestamp: June 14, 2015, 11:04:19 pm
content: Quote from: Kjelt on June 14, 2015, 07:37:31 pmNo I haven't replaced the cell because it reads 3.0V, I figured it was still ok, although I really was surprised, it's more than 30 years old.Quote from: Kjelt on June 14, 2015, 07:37:31 pmOnce again, my mighty Arduino arisesA couple of weeks ago when I was getting my ROM dump going, I also dumped the RAM. However, not knowing what form the data should take means that I can't make any statement about it's validity, and now that the ROM is functioning and generates an ERROR 1 at startup throws even more doubt on the data. I've attached the dump, standard InteHex format. The RAM is only 4 bits wide, the top nibble of each byte (0xF) in the dump is simply the bus pullups.If anyone needs help to do this with their own Arduino, just ask...

author: Sailor
author_rank: Regular Contributor
timestamp: June 14, 2015, 11:19:13 pm
content: Quote from: MarkL on June 14, 2015, 10:50:41 pmYes, very non-invasiveQuote from: MarkL on June 14, 2015, 10:50:41 pmYou will recall that the first thing I did when I embarked on this journey was to replace the 8039 with a socket. That not only allowed me to read out the ROM (and the RAM) very simply, but it will also allow RAM data to be written. Sockets, one of the great inventions... and a great source of problems when they get old.

author: Kjelt
author_rank: Super Contributor
timestamp: June 15, 2015, 07:39:55 am
content: Quote from: MarkL on June 14, 2015, 10:50:41 pmNice one, thanksNow I need to find the right clip with pin headers to attach the logic analyzer pins

author: Sailor
author_rank: Regular Contributor
timestamp: June 15, 2015, 08:35:15 am
content: Hi Kjelt,That RAM is a bit awkward to connect to, and rather than trying to find a 0.4" clip, I would use a 16-pin 0.3" clip on U505 and a 40-pin clip on the processor. And really, you don't even need a clip for U505, because it's only one signal (CE1) from that chip that is needed to qualify your data capture - I would just tack a bit of wire to the pin, or use a grabber like thesehttp://www.ebay.com/itm/Pack-of-20-New-HP-Agilent-5090-4833-5090-4356-SMD-Mini-Grabbers-/171741734361?pt=LH_DefaultDomain_0&hash=item27fc9ae5d9I'm looking forward to seeing what your data looks like.

author: Kjelt
author_rank: Super Contributor
timestamp: June 16, 2015, 07:27:06 pm
content: Quote from: Kjelt on June 08, 2015, 08:45:56 pmWell yesterday I could make a deal, it cost me more than expected but things like this don't come round easy and on Ebay they go for more then triple for what I paid.So I am now the lucky owner of a BP Microsystems 1600 and getting it up and running was easy because the latest software wanted WinXP which I had installed on an old P4 in the garage.I played around a bit with a 27C256 eprom reading and burning and after I got the hang of the software I selected the Mostek 36000 series and read the HP ROM out.As expected all 0xFF's so no surprises there, that ROM was dead as could be, that case is now definitely closed.

author: amyk
author_rank: Super Contributor
timestamp: June 17, 2015, 04:08:52 am
content: You could open it up and take some high-res die photos...

author: Kjelt
author_rank: Super Contributor
timestamp: June 17, 2015, 05:46:12 am
content: How do you get the lid off with the least mess?

author: Stray Electron
author_rank: Super Contributor
timestamp: June 26, 2015, 02:50:31 am
content: Quote from: Sailor on June 14, 2015, 11:19:13 pmI'm not familiar with the 8039 other than i know that it's one of the 8048 family. But I was wondering if it would be possible to examine/save/print the RAM contents using a Fluke 9100A troubleshooter. I THINK Fluke made a pod for the 8048 but I'm not sure if it can be used with the 8039. Is anyone here well versed in 9100 use?

author: Stray Electron
author_rank: Super Contributor
timestamp: June 26, 2015, 02:53:55 am
content: Quote from: Sailor on June 14, 2015, 11:26:51 amYes, it's normal for the 3468 display to creep up when nothing is connected to their inputs. I have several and I KNOW that several of them do that. But can't recall if they all do since I haven't used a couple of them in a long while.

author: iDevice
author_rank: Regular Contributor
timestamp: June 26, 2015, 08:52:49 pm
content: As far as I remember, the two lowest ranges are >10G input impedance, then it goes down to 10M, so accumulated gate charge is to be expected.