Learning to use a Logic Analyzer (16700) - Page 1
Forum section: electronics / testgear

author: perdrix
author_rank: Frequent Contributor
timestamp: February 08, 2018, 02:17:25 pm
content: I have an HP 16700 LA which is probably way more powerful than I need and definitely consumes more electricity than ideal.I've used it a few times in anger and have always got where I wanted in the end, but not for anything remotely complex. I am sure that I'm missing a lot of really useful stuff.I have read the 16700-97021 Training Kit manual ("Making Basic Measurements") and it really doesn't help a great deal. I get the firm impression that driving these beasts falls in the "black art" category. With that in mind are there any good books, manuals, app. notes or what have you that will at least get me to "apprentice wizard" level, rather than "has no clue".Thanks a lotDave

author: tggzzz
author_rank: Super Contributor
timestamp: February 08, 2018, 03:32:46 pm
content: It would help if you indicated what you have understood and what you wish to understand.Having said that, just take things methodically as you would with a DSO, and I would expect you to get there in the end.The principal choices you have to make are state-based vs timing-based acquisition, triggering, input and display.Input is trivial: threshold voltages, signal names and active high/low, etc. Display is trivial: analogous to the format specifiers in printf statements.Timing-based acquisition is like a multi-channel scope and is available on very simple LAs. You see everything, even signal artifacts that will be ignored by your circuit.State-based acquisition is useful for clocked systems, since it enables you to captureonlysignals that are relevant to your circuit, i.e. at clock transitions and/or when some signals are active. It enables far longer traces to be captured within the buffer. It also reduces the maximum signal frequency that can be acquired, since each state requires one input (the designated clock) to go hi then low. For example, my HP1682 captures timing-based information at 800MHz/1.25ns intervals, but state based information at "only" 400MHz/2.5ns.Triggering is where LAs shine, but it is also the most complex and variable across different LAs. Triggering can be based on a wholesequenceof conditions involving the inputs and internal timers etc. Ultimately those trigger conditions are converted into an FSM "hidden" inside the LA, whose sole purpose is to monitor the inputs and interpret whether or not the acquisition buffer should start/stop acquiring inputs. Since the FSM is implemented in the same logic as the acquisition logic (usually an FPGA), it will run several times slower than inputs can be acquired (maybe 4-8 times slower), which limits how close together it will respond to successive input conditions.Sorting out an appropriate trigger can be a real pig. Fortunately my 1682 has a "wizard" mode containing many templates for common use-cases. It also shows how those easy-to-understand templates are converted into the FSM "code"; it is easy to imagine how such code is implemented in hardware.In a recentsimplecase I wanted to find the maximum interval between successive occurrances of a signal going high. The signal indicated the start of my software capture-analyse cycle; the IDE stated my software would complete in a maximum of 980ns, just under the 1024ns cycle time. I wanted to verify there were no infelicities, and to determine the cause if there were any (there weren't; the IDE was accurate:) ). The trigger wizards indicated there might be several ways I could "think" about triggering (and capturing) only if that 980ns was violated. I needed trial and error to determine the best way; apparently that isn't uncommon.

author: MarkL
author_rank: Unknown
timestamp: February 08, 2018, 03:33:56 pm
content: The 167xx series is old but good for debugging and analyzing systems with exposed parallel buses and in some cases FPGA designs. It's not so good in more modern systems where there's mostly serial buses and on-chip peripherals. (Although, there is a rudimentary serial decode software option - seen it but have not used it.)What debugging or analysis tasks do you want to learn about? Do you have a target system in mind?Or do you know all this and you're looking for more fancy stuff like inverse assemblers, custom protocol decoding, processor emulation modules, etc.?

author: perdrix
author_rank: Frequent Contributor
timestamp: February 08, 2018, 05:42:24 pm
content: I'll try to answer both to some degree. I found that defining a trigger setup on the 16700A less than simple to use let's say. Certainly a "wizard or six hundred" would help!Trying to analyse a simple data four wire signalling scheme using the serial decode software was hard, and ran out of memory when nothing much happened for a while. It worked fine for short message bursts where I could trigger on the first message of interest, but was clumsy to use and rather simple minded IMHO.I managed pretty much OK with sequential logic and a flip-flop or several.I'd definitely like to be able to look at I2C and similar, also to be able to hook up to a ROM or RAM chip and read its contents would be great. I suspect that hooking up to (e.g. a 6809 or 8502) and watching it execute code is asking too much - I guess JTAG rules OK with modern stuff.>looking for more fancy stuff like inverse assemblers, custom protocol decoding, processor emulation modulesBring that stuff on!!!I'm all ears.Dave

author: helius
author_rank: Super Contributor
timestamp: February 08, 2018, 05:54:20 pm
content: Quote from: perdrix on February 08, 2018, 05:42:24 pmExactly backwards: logic analyzers are very good at watching CPU busses, and very bad at all serial protocols. The main way that LAs are used with serial signals is to use hardware formatters that pull out framing and data onto separate wires.See mysummary, here.

author: tggzzz
author_rank: Super Contributor
timestamp: February 08, 2018, 07:28:47 pm
content: Quote from: perdrix on February 08, 2018, 05:42:24 pmThat doesn't surprise me. LAs are designed to examine parallel bits, whereas you are describing examining the contents of messages. Such protocol analysis is better done in software and printf statements, or with a dedicated protocol analyser.If an LA was the only option and software wasn't possible, I'd consider building a hardware decoder that captured sequences of message bytes (if that's the appropriate width), and then use the LA to capture and trigger on sequences of bytes. Note that since an LA's trigger FSM runs in hardware at "full" bitrate, there is usually a limited number of FSM states, thus limiting the available trigger sequence.QuoteBack in the 80s I very successfully used LAs to capture sequences of logic states on CPU busses (6502, Z80, 68000), using state-based analysis to ensure it only captured valid addresses/data/instructions, and addresses/data as a trigger. Some of them could also do disassembly, but In Circuit Emulators were better for that.But nowadays most of that info is buried within the device and not visible externally, and JTAG is the best option to control whatever buried hardware the manufacture has thought to include.Summary:use a scope to ensure that the analogue waveforms can be correctly interpreted as bitsuse a logic analyser to ensure that the bits can be correctly interpreted as messagesuse a protocol analyser to ensure that the messages are correct

author: perdrix
author_rank: Frequent Contributor
timestamp: February 09, 2018, 10:19:19 am
content: Yes I totally get that an LA is better at parallel bus stuff than serial - I was acknowledging that in one of my earlier posts.I'd still like to find some documentation that will help me get a lot more out of what I have than I have so far managed.ThanksDavid

author: MarkL
author_rank: Unknown
timestamp: February 09, 2018, 03:49:19 pm
content: If you didn't like the learning kit, I don't think you're going to like the other documentation that's out there on these logic analyzers.The documentation is a bit scattered on Keysight's web site and you have to look under ALL the 167xx models. Most of it is how to set up XYZ on these analyzers, and not so much why you'd want to do XYZ or in what situations. And some of the functionality is dependent on the module(s) you have installed and you'll find that in the module documentation under Help on the system.Actually, there's a lot of info under Help on all aspects of the system. I'd encourage spending some time walking the Help pages. You can also find PDF versions of the help pages at keysight.com on the various 167xx pages.You'll probably want to be running the latest software, and the last for these models, 2.90. And if you don't have them, you'll also want to install the license keys for the software options which are available in the HP Equipment Yahoo group (free for non-commercial use). But if you've already done serial decoding, you might already have them.A good place to start is with some of the marketing docs. They at least describe what's possible and some of the hardware and software options you'll need to do it. It's all obsolete, of course, so good hunting if you see something you want.16700 Series Logic Analysis System:http://literature.cdn.keysight.com/litweb/pdf/5968-9661E.pdfPost Processing Tools:http://literature.cdn.keysight.com/litweb/pdf/5966-3147E.pdfProcessor and Bus Support (I can't find this on Keysight's site):http://homepages.cae.wisc.edu/~ece554/website/ToolDoc/Logic_Analyzer/Processor%20and%20Bus%20Support.pdfSome other stuff:Remote Programming Interface - It's conceivable someone could develop an interface into sigrok - then you would get all your protocol decodes:http://literature.cdn.keysight.com/litweb/pdf/5988-6223EN.pdfTool Development Kit - Write your own protocol decoders that run directly on the analyzer:http://literature.cdn.keysight.com/litweb/pdf/B4605-97006.pdfVers 2.90 ISO CD:https://archive.org/details/B37601424316700A.02.90.00Quote from: perdrix on February 08, 2018, 05:42:24 pmOne feature that might help you with memory depletion is Transitional Timing mode. In this mode the analyzer only stores changes along with a time tag of when the data changed. After the capture is done the waveform is reconstructed. This mode is good for sparse or bursty data. But it may dependent on the module you have installed. At least all the 167xx modules appear to have it. There are some tradeoffs to be considered when turning it on; details are in the Help pages for the modules.

author: tggzzz
author_rank: Super Contributor
timestamp: February 09, 2018, 05:20:03 pm
content: Quote from: MarkL on February 09, 2018, 03:49:19 pmInteresting; where? I'd like to find similar for my hp1682.

author: MarkL
author_rank: Unknown
timestamp: February 09, 2018, 06:47:55 pm
content: Quote from: tggzzz on February 09, 2018, 05:20:03 pmPM sent. I didn't want to re-post a message sent on non-public group.I'm not sure they would work on a 1682, but give it a shot and let us know.There's also a purportedly a way to generate the keys using the FlexLM tool provided on the analyzer. It's usually called lmcrypt, but appears to be renamed to /usr/sprockets/bin/tp_license. I only located the binary; I haven't played with it. Yet, anyway.

author: PaulAm
author_rank: Frequent Contributor
timestamp: February 09, 2018, 06:53:02 pm
content: Here's an interesting page on the 16700:http://tech.mattmillman.com/16702b/There's an i2c decoder for use with the tool development product available on githubhttps://github.com/racingmars/hp16700-i2c/blob/master/i2c-tdk.cI haven't tried this yet.I have a 16702a and I replaced the internal drive with a larger, faster drive I had lying around. I had quite a bit of trouble finding a compatible SCSI CD reader that worked. You might be able to replace the hard drive with a solid state device, but SCSI adapters are getting scarce and expensive these days.This is an HPUX 10.x system, which means that you can actually add HPUX executables to make the system more useable (things like bash, gcc, ssh, perl etc). There used to be an online repository but that aged out and is no longer available. You can still pull them back from archive.org though. I have captured the entire hpux 10.x repository that was there and plan to host it on my website. I just haven't had time to clean it up and demand is quite low. If anyone's interested, let me know and I'll dig up the old URL so you can go searching.Edit: Had a window open on it:http://web.archive.org/web/20170215150207/http://mirrors.develooper.com/hpux/downloads.htmlThe default root password is well known and keys are available for noncommercial use of the optional products (which all can be loaded from the iso image).

author: MarkL
author_rank: Unknown
timestamp: February 09, 2018, 07:23:36 pm
content: Quote from: PaulAm on February 09, 2018, 06:53:02 pmWow... actual TDK source. I'll have to try that.I tried a SCSI to SD adapter drive from these guys (version 5):https://www.itead.cc/scsi2sd.htmlIt worked, but was actually slower than the original hard drive. If your hard drive dies it might be a good option. Their new version 6 did not work. I ended up with an Acard ARS-2000SUP SATA to SCSI adapter. It was expensive and worked, but was only marginally faster than the hard drive. I was hoping for a big improvement in the 3 minute boot time but it only reduced it by about 20 seconds.Here's the 10.20 HP-UX sites that I used:http://ftp.kspei.com/pub/steve/hp/10.20/http://mirrors.develooper.com/hpux/downloads.htmlhttp://www.hpux.ws/merijn/downloads.htmlI think the develooper was the one that was down. It seems to be back now. If you use Linux, bash can add a lot of sanity to your life on HP-UX.And the root password is posted here, along with some other fun info:https://www.eevblog.com/forum/testgear/hp-agilent-16700a-16700b-16702a-16702b-root-password/msg835398/#msg835398I find that remoting the X window clients work a lot better than VNC.The above post also makes reference to a site,http://www.perdrix.co.uk/hp16700.Is that you, eevblog user "perdrix", or just a coincidence?

author: PaulAm
author_rank: Frequent Contributor
timestamp: February 09, 2018, 08:01:23 pm
content: For a while, the Merjin archive had removed the 10.2 executables. Nice to see them back up.That's a good eevblog thread. The perdrix site is not me, although I've found his site to be very useful.Given the limited memory and processor speed on the 16700, using VNC and the bloated VUE session manager just drags performance down. Running the app bare can make a significant improvement for remote access on a local net.It is also useful to load in ssh so you have access to scp as an easy way to copy files in and out.For me, it's more useful to have a computer running an LA app, rather than an LA that happens to run on a computer and I've mangled the environment on mine to suit

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: February 09, 2018, 08:58:07 pm
content: As Mark L mentioned, there's actually a lot of helpful info in the help menus.This is going way back, but I did find a "back to basics" slideset from a seminar in 2008:https://www.dropbox.com/s/kkahdekcuqa9s8f/Digital%20Back%20to%20Basics%20Seminar_2008.ppt?dl=0It doesn't have usability stuff written out, though, it's more just fundamentals and capabilities.FWIW, the Keysight technical call center folks are also super helpful and the interface is still roughly the same as our newer LAs.