19 Feb
2011
19 Feb
'11
10:15 a.m.
Hi guys,
Does anyone have a HP 16500B logic analyser with a 16500L LAN card
installed?
The EEPROM on my card seems to have been hosed, and now the analyser is
refusing to boot, instead opting to display the message "Corrupted LAN
Board! LAN not functional".
The chip is a Samsung KM28C16, PLCC packaged, sitting next to the I/O
connector on the LAN card.
If anyone has an EPROM programmer kicking around, I could really use a
dump of a known-good EEPROM, or alternatively a replacement 16500H or
16500L LAN card if someone has one in a parts-mule 16500A or 16500B
mainframe.
Thanks,
--
Phil.
classiccmp at philpem.me.uk
http://www.philpem.me.uk/
19 Feb
19 Feb
10:52 a.m.
On Sat, Feb 19, 2011 at 10:15 AM, Philip Pemberton
<classiccmp at philpem.me.uk> wrote:
The chip is a Samsung KM28C16, PLCC packaged, sitting next to the I/O
connector on the LAN card.
If anyone has an EPROM programmer kicking around, I could really use a dump
of a known-good EEPROM, or alternatively a replacement 16500H or 16500L LAN
card if someone has one in a parts-mule 16500A or 16500B mainframe.
Is it in a PLCC socket, or soldered down? If it's in a socket I
should be able to extract one from a 16500L sometime later today and
dump its contents, after unstacking some equipment to get to it.
(The 16500H and 16500L are 16500B only, you can't find one in a 16500A).
-Glen
11:56 a.m.
On 19/02/11 18:52, Glen Slick wrote:
Is it in a PLCC socket, or soldered down? If it's
in a socket I
should be able to extract one from a 16500L sometime later today and
dump its contents, after unstacking some equipment to get to it.
It's soldered down in mine. If the machine has been back to HP with this
fault, it may have been replaced with a socketed part.
ChipQuik removes it fairly easily though, with zero damage to chip or
board. Just takes a minute or two with desolder wick to clean up the board.
I tried reading it in-circuit, but that failed -- the readback was all
zeroes. I suspect either the address decoder for the EEPROM is on the
LAN board, or the EPROM programmer was trying to power the entire LAN
board through the EEPROM Vcc pin... Probably both.
Reading out-of-circuit got me a fairly sane looking dump which ties in
with what the analyser shows on the status screen:
philpem at cheetah:~/16500b$ hexdump -C EEPROM\ hosed\
MACaddr_00-00-00-00-00-00.bin
00000000 00 00 00 00 00 00 c0 00 02 e6 00 00 00 00 00 00 |................|
00000010 00 00 00 00 41 6e 61 6c 79 7a 65 72 20 31 00 00 |....Analyzer 1..|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 2d 05 00 |.............-..|
00000030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000040 00 00 ff ff ff 00 00 ff ff ff ff ff ff ff ff ff |................|
00000050 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
000002a0 ff ff ff ff ff ff ff ff ff ff aa ff ff ff ff ff |................|
000002b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000400 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000410 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000550 ff ff ff ff ff 55 ff ff ff ff ff ff ff ff ff ff |.....U..........|
00000560 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000800
For reference, the LA tells me:
LAN Address 000000000000
IP Address 192.0.2.230
No idea what the default gateway is set to -- that's on the Advanced
Options screen, which I can't get to because the LAN card is hosed.
Same story for the data transfer timeout
I can't change any of these settings... that is, I can change them, but
they don't persist across a power cycle.
So we have:
A 0xAA at 0x2AA (funny, 0x2AA is 0xAAA ANDed with 0x7FF, the
eeprom's max address)
A 0x55 at 0x555
The analyser name (used by XWin) from 0x014 to 0x02C (24 characters
plus trailing null)
The IP address at 0x006 to 0x009 (192.0.2.230 -- this seemed to be a
random choice by the machine, because my LAN is 10.x.y.z). Subnet is
determined on-the-fly by sending an ICMP request to the default gateway...
Questions remaining to be answered:
Where does the MAC address go?
Is there a checksum? If so, how is it calculated and where does it go?
For #1, I'm reasonably sure the answer is "in the first six bytes". The
actual byte order will need to be determined...
As for the checksum, the answer is "no bloody clue".... That 2D:05 at
the end looks damn suspicious, though.....
Without a known good EEPROM image, I'm flying blind :(
--
Phil.
classiccmp at philpem.me.uk
http://www.philpem.me.uk/
20 Feb
20 Feb
7:05 a.m.
On 19/02/11 18:52, Glen Slick wrote:
Is it in a PLCC socket, or soldered down? If it's
in a socket I
should be able to extract one from a 16500L sometime later today and
dump its contents, after unstacking some equipment to get to it.
Glen -- don't worry about it, I've fixed it.
What you do is desolder the old EEPROM (Chipquik to the rescue!), and
set the first six bytes to the MAC address from the barcoded "LNC"
sticker on the bottom of the card. Basically, if the sticker says:
LNC: 1234567890AB
You set bytes 0 through 5 (inclusive) to:
12 34 56 78 90 AB
There isn't a checksum on the MAC address. I guess it just makes sure
the assignee ID ties in with one of Hewlett-Packard's ID codes, and that
the MAC address isn't filled with zeroes or ones...
Still, at least it works now :)
--
Phil.
classiccmp at philpem.me.uk
http://www.philpem.me.uk/
5054
days inactive
5055
days old
3 comments
2 participants
participants (2)
-
classiccmp＠philpem.me.uk -
glen.slick＠gmail.com