HP 3560A Handheld Dynamic Signal (FFT Spectrum) Analyzer Teardown (A2 board)

I was repairing a HP 3560A that does not start up at all. The system is very modular that there are only 3 main units: LCD/keyboard/DSP board (A1), Main Processor board (A2) which manages power sources and contains the backlight inverter as well, and the analog section (A3).

Obviously the first thing to look for is where the power is managed, which is the main processor board (A2). I bought another unit (with a different defect, i.e. it boots) hoping to use it as a reference but to my surprise, the A2 board is slightly different! In fact, the LT1120 voltage regulator that I’m seeing unusual pulses in V_out pin (should be flat) is not even there!

I’ll save the repair story for another post, but for information preservation purposes, I took pictures of the two different revisions of the A2 assembly from 3 units, shown below:

  • New: 03569-66502 Rev B
  • Old: 03560-66502 Rev B, Rev C

The top part of the board is essentially the same. The new board uses Toshiba TC551001CP-85L while the old board uses Sony CXK581001P-70L for Static RAM. They are likely pin compatible and it’s just availability differences. (Ignore the randomly placed caps at the bottom of the new A2 board. I desoldered them to test if they are good).

If you pay close attention, at the top of the new revision board, it has an unpopulated DIP-8 socket and an extra 74HC174N chip, and an extra digital I/O port at the mid-bottom left edge below the SRAM. They are reserved for 3569A (a better version with a noise tracking generator) as it uses the same board. The old revision A2 board works for 3560A only. It’s a topic for another post.

The bottom part is quite different. The classical 4-diode full-bridge rectifier on the new board is not shown at the main side of the circuit board for the old A2 assembly. The new board looked much denser.

Most importantly, the old board uses MAX666 as the 5V voltage regulator while the new board uses LT1120. The pinouts are different and chip features varies a little bit, so the power management section is not topologically identical.

There are no components on the back side of the new revision A2 board (they are both supposed to be single sided PCBs), but two diodes are squeezed in at the back of the old revision A2 board, and there’s an extra resistor flyover:

My suspicion is that the diodes are intentional as there are specific through-holes for them (most like they other half of the bridge rectifier), but the resistor is an after-spin rework.

Finally, for information preservation, I also took pictures of the old A2 board (03560-66502 Rev B) from another unit I have:

If you consider the relative ease of use for less computer savvy people, 3560A/3569A is versatile yet designed specifically for the most commonly used measurements in acoustic and mechanical vibrations. It’s still excellent value for what it offers despite it’s a made decades ago since it doesn’t overwhelm you with convoluted choices so you can gets the job done once you’ve setup your recipe.

HP has designed the unit very well, with the exception of the LCD screen which cannot be found on earth, all through-hole components on single layer board and well organized structure and silkscreen makes servicing a pleasure.

I can repair and rebuild 3560A / 3569A with new battery pack and clock battery. The hardest problem to track down is no-boot, and the hardest surgery to make is the backlight. I also know how to talk to the unit from modern computers as well, so data capture is not a problem. Call me at 949-682-8145 for  consultation.

71 total views, no views today

HP 3560A Battery Pack 1420-0584

If you have an original HP 3560A sitting for years and haven’t changed the battery pack yet, it’s guaranted to be dead. Here’s the shell of the battery pack 1420-0584:

Just to give you no hope attempting to reused the battery pack, I dissected one of them and show you how much of a disaster inside it:

This pack has been sitting for so long that the cathode (+) wire is severely corroded (not all of them are like this). Even the connector turned green. I cut open the wires and gave it a tap, and a bunch of copper oxide bits falls off.

Now that I acquired the tools, parts and practice to make one from scratch (I used to need the old battery pack). It’s not cheap (given the tools, research effort, and most importantly, small quantity), but I can custom build them for you if you don’t want to deal with the hassle and steep learning curve.

The first pack is the most expensive, additional ones are much cheaper because of the reduced overhead. Lead time is around 1~2 weeks unless you pay extra for me to express order the ingredients.

You can call me at 949-682-8145 or just go to humgar.com.


45 total views, 2 views today

xkcd 666 Timer IC: Maxim makes a MAX666

One of the most memorable things about xkcd’s (in)famous circuit diagram is the 666 timer (at the top right corner of the comic), a parody of the famous 555 timer:

Today I was analyzing the logic board for HP 3560A and noticed some batches uses a MAX666 chip and it immediately reminded me of this xkcd joke. Turns out Maxim Integrated makes a voltage regulator with a cool part number! I bet the engineers back in the days must have started with 666, giggling uncontrollably, and added 665 and 664 to see if it can get past the regulators or the censors (puns intended for both).


141 total views, 1 views today

Agilent N9304B Handheld Spectrum Analyzer Repair and Teardown

I received an Agilent N9340B 3Ghz Handheld Spectrum Analyzer with a note that it passes all self-tests but does not respond to input signals. I took the gamble that it’s the RF input connector got disconnected somehow.

I opened up the case and noticed that the 40Mhz cable was unplugged, so I was half-correct. I connected it and got a signal at the precise frequency, but the amplitude doesn’t look quite right. It’s around -20dB off. When I scanned it across the full 3GHz band, I noticed the amplitude roll-off when I scan below 800Mhz, and I got very little signal left when I get to somewhere near 10Mhz.

I tried running a user calibration with a 50Mhz CW source but it failed amplitude calibration. Apparently the unit is not fully working. No self-test errors though.

So I opened up the unit and the RF section. The front side of the board doesn’t have any visible signs or unusual smells, so I suspected the improper gains is caused by the input attenuator HMC307:

I was about to order the chip, but because of the lead time, I decided to just take a picture of everything and analyze it off-line:

After removing the screws holding the N-type terminal so I can get to the back side of the board for taking pictures, I noticed the RF out connector just fell off the board with the pad:

That means the RF out is not touching the board. I never would have suspected that it’s the problem, since this unit does not have the tracking generator option enabled and hence the RF out port is pointless. But for the sake of completeness, I resoldered the connection after I put the board and the connectors back to the RF module slab. It’s ready to be stowed away for another day when the attenuator chip arrive.

Guess what? Once I put unit back together, I turned it on again and everything works perfectly! The power level is flat and within 1dB of what my 8648C pumps out. I did the user amplitude calibration again, it passed, and everything was spot on!

My suspicion is that the path gap created a capacitor between the board and the type-N terminal, which messes up the termination and created reflections. The bottom section of this picture is where RF out meets RF in:

I didn’t study RF as my EE speciality, so if you are a RF design expert, please let me know what you think the reason might be in the comments section.

257 total views, no views today






143 total views, no views today

Tektronix TDS 500~800 series Color CRT adjustments

For TDS 500~800 series, a batch of CRT driver boards, color and mono, regardless of how heavily they are used, have bad flyback transformers. After turning the unit on continuously for half a day, the screen might stretch and disappear.

If you have a matching CRT driver board with a CRT tube, I recommend instead of swapping the CRT driver (seemed more straightforward), extract the flyback transformer from the donor board instead. The reason is that the adjustments needed from replacing the flyback transformer is far less than re-tuning a different CRT driver board to match the tube.

It’s impossible to tune the CRT driver board while it is in the case, since the processor board covers it during operation (unless you have special cables for the Acq/Proc interface to replace the interconnect PCB card), it’s done ex-vivo like this:

I bought a ribbon cable extender and built a 2-pin jumper extender by salvaging them from CRT driver boards with toasted flyback transformers:

The first thing to check for is the +21V which is used to generate many voltages across the board (pun intended here): it affects brightness, scale, offset and linearity everywhere. If there’s any adjustments to be made, this need to be done first.

This voltage can be tapped by hooking the positive (red) lead to the center (output) pin of LM317 (3-pin linear regulator) at U90. If you have an alligator clip instead of a grabber, you can also hook it up to ‘pin 4’, which is the body of the regulator.

You can pick many spots for the ground pin. Since I’m using a grabber, I’d pick another big 3-pin IC sitting on a heatsink for the ground lead. In this case, it’s Q10, the transistor that drives the flyback transformer. It’s the pin nearest to the short edge of the board (behind the red lead, sorry):

Here’s a picture of blank board showing how many trimpots are there:

Only the brightness and contrast dials are documented in the service manual. The rest, I had to locate them in the schematic one by one.  Before that, I kind of figured out most of them by trial-and-error but had a few of them wrong, especially the voltages (there are three: +21V, screen and HV adj.): they all have the same effect. There are also some more obscure trims like center focus and horizontal focus (variable inductor). Now I know exactly what each dial does.

It’s hell of a lot of work to figure this out. I have some new old stock CRT straight from Tektronix at Beaverton, and it’s the reserve to support customers who bought color TDS 500~800 units from me. Almost all used units out there have problems (or going to have problems soon), and so far I’m the only one selling units with 1 year warranty (extendable to 3 years for extra).

If your unit is not under warranty included when you bought from me, and want one of these new color CRT tubes with shutter, I’ll almost require you to send your unit to me for installation unless you can guarantee that you can figure it out without my help. It’s $500 full-service with the tube included. Call me at 949-682-8145.


118 total views, no views today

Switching oscilloscope attenuator relays with H-bridge driver IC

One day I was working on an old first generation Agilent Infiniium oscilloscope (namely 54810A) while I was too tired and rushed, I accidentally short-circuited the main acquisition board because I forgot to reconnect the probe-compensation port pin back to the acquisition board after taking out the front-panel and putting it back: the jumper with exposed metal (the heat-shrink over it was a little short the way Agilent manufactured them) swiped over something and I heard a loud bang, the scope shuts off, and I smelled the magic smoke.

My heart sank. Just saving a few extra minutes being careful checking everything (despite I opened and closed those front panel ten dozen times) I thought I lost an expensive PCB that’s almost the cost of the whole oscilloscope, and even if I can fix it, it might drain me at least a week.

Given that I know a short fried something (there’s a bad smell). I didn’t even bother to turn the unit on again until I’ve located what fried. Turning something that you know it’s fried on again just risks further damage as it can load other parts of circuits.

Following the smell, I found a burnt IC on the other side of the board (needs to be painfully disassembled as the front panel /w BNC nuts needs to be taken out all over again), and I looked up the part number: ST L6201. It’s sitting on Channel 1’s front end section between the attenuator relay block and the ADC hybrid and there are 2 of them per channel.

Given the location of the component, it’s clearly the L6201 populated at Ch3’s slot is not used since it’s a 2 channel oscilloscope. So I transferred the chips to replace the broken ones at Ch1:

What is an H-bridge driver (L6201), that’s supposed to control motors, doing in an oscilloscope, especially the front-end section? I googled “H-bridge driver in oscilloscope” and nothing relevant turned up. Then I went back and read a little more on how an H-bridge driver is really used. L6201 is a DMOS Full Bridge Driver with four power MOSFETs (switches) that basically sends current through an inductive load (typically motor) that might have stored energy (momentum) that might need to be drained (brake) to stop faster.

Turns out it’s a slick way to drive mechanical relays in the input attenuator given the amount of due care needed to accurately manage the current demand and switch transitions. There are 3 relays in the attenuator module. I suspect up to two relays can be switched with each L6201 by placing a diode in serial with with a relay coil, and repeat it (in parallel) with the diode reversed in the other branch. Is it an overkill? Let me know in the comments section.

I also noticed, while dealing with the main acquisition board for 54615B/54616B, there is a L293D chip under the attenuator block shield for each channel. It’s a 4 channel driver with half-bridge, also intended to drive inductive loads. This one is more explicit about being used to drive relay solenoids as well as motors. So this is nothing new; It’s just not too many people talked about using it on oscilloscope architectures.


134 total views, 1 views today

MSI-based installer silent install summary

Recently I need to reorder the pre-req installation for a InstallShield installer package that has pre-reqs and MSI inside it. That means I’ll have to extract all the pre-req EXE and MSI files and write batch files to call them, then the installer again for the core software, all done silently.

I learned:

  • Administrative install (/a switch) only extracts the core firmware, not the pre-req files
  • /b”<target-folder>” extracts the pre-reqs as .prq files
  • Need to steal the extracted .exe files by monitoring temporary folder as they go
  • /s doesn’t always silent installs. Some with MSI packed inside the .exe files requires the ‘silent’ request passed to the MSI by adding /v/qn (/v passes the switch to the MSI, which is /qn, which means silent in this case)
  • .NET before v2.0 requires different switches to install without prompting for license agreement, namely
    /q:a /c:"install /q"



79 total views, no views today

Remove McAfee Enterprise Antivirus from Windows

I was asked to install McAfee Enterprise Antivirus v8.8 as a favor to somebody else’s client, turns out this piece of 5h1t is a nightmare.

After I installed the agent, the main software won’t proceed to install. I looked up error code 1603 in the MSI log and upgraded a fresh Windows XP to SP3 and updated Windows Installer to 4.5, set the time back (somebody suggested potential certificate problem) and it still fails.

Without being compensated for my time, I gave up and tried to uninstall it through Add/Remove programs. Now the uninstaller complained that the program cannot be uninstalled in managed mode. Normally, I’m quite understanding towards programmers since their job is wrestling complexities, but this time there is no excuse: if you add an item in Add/Remove programs, people are expected to be able to uninstall it directly from there by definition!

After some digging, being unable to uninstall McAfee is a known common problem. The IT-crowd at University of Oregon has written an article with the solution. It boils down to running:

C:\Program Files (x86)\McAfee\Common Framework\frminst.exe /remove=agent

I bet even stoners are more competent packaging the software for release! How much productivity across the world they have drained by shipping out an incompetent software bad as malware!

Stay away from McAfee. Won’t install it even if they pay me $8k. Refuse to service anything McAfee without charging an exorbitant sum, or you won’t make your lost time back.


77 total views, no views today