HP 8720C VNA - Has option 010 (time domain) on rear sticker - not in menus

[John_ITIC]

Hello, my HP 8720C network analyzer has options 001 (1Hz frequency resolution) and 010 (time domain) per the rear sticker. However, the SYSTEM menu is lacking the TRANSFORM menu. The SYSTEM / FIRMWARE REVISION display only lists the (matching) serial number and option 001.

The service manual states that option 010 can be retrofitted but it does not mention whether option 010 is a software option or whether there is some hardware that needs to be added. So, I assume either my system has "forgotten" (via some lost SW setting) that option 010 is installed. Or, someone has removed the option 010 (or it is malfunctioning, somehow). I, however, don't see any missing boards as the system seems fully populated. Can anyone give some insight?

Also. the service manual talks about  "options numbers correction constant" where some string can be entered and saved in EEPROM. However, I have no idea whether such data entered has anything to do with option 010 or what sort of data should be entered as the service manual gives no example.

Thanks!
/John.

[SQ9MT_PL]

Probably the casing is from a different one, and this is a folding box or the firmware was replaced and the option ceased to exist. 

[John_ITIC]

No, I think this is the original case as the unit looks completely original and the sticker serial number matches that in the firmware. I think it is more likely that the CPU board has been swapped out. The options are enabled via settings in the EEPROM on the CPU board.

I have found the option 010 upgrade procedure. At least for the 8753. It contains some magic keyword that needs to match the serial number.
https://xdevs.com/doc/HP_Agilent_Keysight/8753ES_8753ET/8753ES_Option_010_TDR_Upgrade_Kit_Installation_Note.pdf

It is probably some simple encoding as some people are apparently able to generate such option keys. Or at least for the 8753:
https://www.kirkbymicrowave.co.uk/Everything-you-wanted-to-know-about-the-HP-8753-VNA/

I'll send an email to the person mentioned in that last article. Perhaps he can generate my 010 option magic unlock key. It's worth a try.

Edit: I suspect that the EEPROM contains the options, similar to the 8753 hack mentioned here. So, it could be that my EEPROM has lost some bits over time. http://www.ko4bb.com/doku2015/doku.php?id=test_equipment:restore_eeprom_of_hp_8753

Thanks
/John.

[Wallace Gasiewicz]

All Options are contained on the EEPROM, you just have to enable them. Requires writing over the EEPOM just a little
I think you will find it;
Otherwise I can look it up
Need a EEPROM writer however

[John_ITIC]

Yes, I saw that the EEPROM values can be changed to enable these options. The EEPROM is a XICOR X2816CP-20 and it can be had for a few dollars on Ebay. I was however hoping that I would not have to desolder, buy EEPROM programmer and adapter, read out, tweak, reprogram, solder in DIP socket etc. when the instrument has the software update feature via the front panel entry. If I'm not able to get my hands on the proper option 010 unlock code, I may have to go down that route though.

On the other hand, if the 010 option was lost due to the EEPROM having lost some bits, it may be a good idea to read out its content and store for safe keeping.

Thanks,
/John.

[max-bit]

The eeprom (etc) programmer will definitely come in handy This is one of the basic tools in an electronics workshop.

[John_ITIC]

I do have an old EPROM programmer but I will have to check whether it supports this particular EEPROM. I'll order the chip and a socket on Ebay so I can do this investigation in case I cannot find the proper programming code. I have asked a Keysight engineer and he would ask around. Perhaps I get lucky...

Thanks,
/John.

[Wallace Gasiewicz]

I think your chip is an EEPROM  EE meaning electronically erasable and programmable. In other words, you do not have to remove the chip and give it a suntan under a UV light. .The lines of code just really disable the option. What you do is just eliminate the lines of code that "disable the option"  eg put FF in.
I bought the TL Chinese programmer and it works fine. It can connect to the pins on the board also, although I have not done this.
I would copy the EEPROM first however.
Aren't the EEPROMs already in sockets???

[Wallace Gasiewicz]

I have not used that chip.
Does the board have connections for an ISCP controller?
Look at  the schematic. This let you program the chip in place.

[John_ITIC]

Yes, the Xicor chip is an EEPROM but i still need to desolder it to read out and program via my programmer. I also want to preserve the original EEPROM content so better to program a new one in the programmer and put into a socket on the CPU board for easier future replacement. It would be more complicated to try to power up the CPU board and try to access it from an external programmer via wires as the 68000 CPU would cause contention on the buses.

The 8720C does not have any service manual schematics. EEPROMs and sockets are on order...

Thanks,
/John.

[Wallace Gasiewicz]

Service Manual

https://www.keysight.com/us/en/assets/9018-01572/service-manuals/9018-01572.pdf?success=true

But you are correct, I don't see any schematics

You can make a backup disc if you have a floppy drive,Apparently you can do this right from the HPIB port
I think that you could modify this disc and then use it to update the EEPROM.

[John_ITIC]

Thank you. I already have the service manual and other documentation as I've spend several weeks trouble-shooting the unit already. The original  GPIB floppy disk is too expensive but i have found an emulator that might work:

https://www.ebay.com/itm/393274483322
https://www.hp9845.net/9845/projects/hpdrive/

It is a good idea to try to pull out, modify and restore the EEPROM via the GPIB. I found the instructions in the service manual (attached). I will attempt this before going down the path of soldering, programming etc.

Thanks,
/John.

[John_ITIC]

Here's an update on my attempts to read out the EEPROM via GPIB.

1) I set up an external PC with a PCI GPIB card. The PC is running the HP 9122 drive emulator via the HPDrive software (linked to above).
2) I (from the 8720C) saved the instrument state as well as the EEPROM content to file via HPDrive.
3) I extracted six files via the HPDir utility (on same site as HPDrive). Five them are instrument state files.
4) The sixth file (N00916E.bdat) has suffix 'E' so I suspect that's the EEPROM image. However, I can't see my serial number in that file so it is possibly encoded/encrypted before saved to file. Perhaps as an attempt by HP engineers to obfuscate the options codes etc.
5) The N00916E.bdat file is also more than twice the size (4,352 bytes) of the EEPROM (2,048 bytes).

So, I will instead attempt my approach to desolder the EEPROM and read out its content via a programmer. Others have had success that way.

Thanks
/John.

[mankan]

Please note that my experience is from HP8753D and on that options and serial number data is not in the EEPROM backup file. It skips the first 16 words. See this for EEPROM memory map of the HP8753D. So I can just confirm that desoldering and readout via programmer is the way forward. I never got the unlock codes nor the factory reset codes to work. Good luck.

Regarding file size mismatch, IIRC its due to EEPROM is being read as 16bit words but only contains 8bit words. Or at least something along those lines. I made some simple conversion programs between backup file and EEPROM programmer image.

[John_ITIC]

Thanks. My EEPROM file read from GPIB mostly contains zeroes, except for the data in the two attached files. I will put this on ice until my replacement EEPROMs and sockets arrive from China.

/John.

[John_ITIC]

My X2816CPI-20 replacement EEPROMs arrived. I could read out the old content okay but my Top 2004 programmer was unable to properly erase and set all data to FF. The EEPROM ended up with all 00's so it seems I have to buy a new programmer.

The Top 2004 software was unable to self-identify the X2816CPI-20 so I  tried the X2816, X2816A and X2816B device type. I'm not sure what the differences are but this chip only has asynchronous 5V strobed I/Os and no elevated programming voltage so I think differences may be more advanced command protocol for some faster programming cycle. So, I would think all A, B, C models are backwards compatible with the plain X2816.

I saw the 80-page thread on the MiniPro TL866 below. Is that the go-to programmer is is there a more professional / higher quality alternative?
https://www.eevblog.com/forum/blog/eevblog-411-minipro-tl866-universal-programmer-review/

Thanks
/John.

[Hamelec]

Hi John,
my TL866 was working fine for reading and programming the X2816C.
The other possibility is that you got counterfeit parts from China..
Regards
Manfred

[John_ITIC]

Thanks Manfred. I ordered a TL866-II plus and I will receive it tomorrow. I'll then make another attempt.

https://www.amazon.com/gp/product/B0859YRVM3

/John.

[John_ITIC]

Success! My 8720C again has option 010 and the time-domain features are enabled.

It turned out that my old Top2004 programmer also worked but I had to select a x28C16, to make it operate on my X2816CP-20. Just to be safe, I used the new TL866II PLus programmer as it had a X2816C, which is closer to my EEPROM.

As the attached images show, the option codes are at the very end of the EEPROM in the 8720C units. I changed the three F2 F2 F2 before the serial number to F3 F3 F3, per the hint i got from this information: http://www.ko4bb.com/doku2015/doku.php?id=test_equipment:restore_eeprom_of_hp_8753.

I think the loss of option 010 was due to replacement of the CPU board by a prior owner.

Thanks,
/John.

[mankan]

Well done, good to know its stored at the end on previous models. I hope the picture on the EEPROM is a before image and you mounted a socket for future servicing.

[John_ITIC]

I was asked to provide the before/after EEPROM dumps via PM. As we can't attach files to PMs, I'm attaching them here.