I Got a Logic Analyzer, woot!

Yep, after waiting awhile, I got an HP16700B logic analyzer. I decided I needed one to help me efficiently reverse engineer stuff. I can stuff a bunch of pins onto some chip leads on a PCB and then connect the probes and go to town. This particular unit I got has three acquisition cards in it. These babies have 2 sockets on each card which connects to a cable that ends with two cables for connection to the probe pods. Each pod has 17 inputs on it, so that means across the three cards I can monitor up to 204 signals at once! (3 cards * 2 plugs each * 2 cables per plug * 17 signals per cable). I seriously doubt I will ever need this much, but if I do I am set.

This bad boy can record signals up to 667MHz and apparently do some very complicated state based capturing, though this is slower, around 150MHz or so. Since I am only going to be reverse engineering things like videogame systems with it, this should be more than plenty. After seeing what’s inside I feel kinda guilty too. This will be like swatting a fly with an ICBM.

I have yet to turn it on or hook it up but I just HAD to open it up and poke around inside to see what makes it tick. As such, I took a bunch of pictures…. Sooo here it is!



Here’s the beast with the cover off.  I have already removed the harddrive at this point, a 9.1GB ultra 3 SCSI drive.  The date on the drive is July 2000.  I like the cable routing on here- everything is extremely well laid out and the cables are all nicely bent at 90 degree angles to take up the slack.


The riser boards have been removed, showing the CPU board and the interface board.

hp16700_cpu_top hp16700_cpu_bot

The CPU board is pretty interesting.  That HP branded ASIC in the corner is actually a ceramic QFP.  You don’t see very many of those.  Also interesting to note is this DOES have GPIB; it’s on the header in the upper left corner, but it does not get connected.  The GPIB chips can be seen on the bottom (right top corner on the bottom).  There’s a piece of black tape on the PCB where the square cutout is for the ethernet jack (to the right of the GPIB connector).  I couldn’t quite figure this out at first- the magnetics are present for this phantom ethernet port as is the PHY and stuff.  I’m guessing on-board ethernet is 10 base-t.  Mine has a riser with 10/100 base-t on it, so I guess they didn’t want the metal part of the jack on the riser to touch it and short it out.  The small heatsunk chip is the video controller, and there’s 2 QFP RAMs under it on the bottom side for it.  The backup battery is kinda lame, it’s a BR2325 which is a crappy size and worse capacity than the more common CR2032.  I am going to just stuff a CR2032 in there since it has more ma/h too!  240mah  for the CR2032 vs. 165mah for the br2325.


hp16700_options_bot hp16700_options_top

These are the three option boards.  There’s an ethernet board, extra RAM (they call this “option 003” which is the top left board, and then the smaller board is either cache RAM or more video memory.  I am not sure which.  These just simply plug in the top and use some plastic pegs along with the connectors for support.


hp16700_scsi_top hp16700_scsi_bot

This is the SCSI controller.  It’s a pretty impressive board, with two Xilinx FPGAs and an Altera one.  I wonder if the FPGAs fight, being from different makers and all?  There’s a ceramic PLCC on here which is pretty rare, too (a non-windowed one that is) and a PCI chip.   There’s two threaded standoffs mounted on the interface board and this board plugs in and screws down.  When I got it, the standoff was the wrong size and it had been cranked down, which bent the corner of the board about 2-3mm.  I hope this didn’t break anything.  It appears to have been done at the factory though, so I assume it’s fine.

hp16700_interface_bot hp16700_interface_top

This is the interface board.  It connects the card board to the CPU board and various other things.  There’s another FPGA on here and some random TI chips and various buffer chips, too.  There’s also a round blue piezo feeper.  The bottom of the board had some flux or something on it which looked kinda nasty, on that silver pad area, so I cleaned it off with some alcohol.  It appears to have been flux from where those two through hole diodes were soldered on.


hp16700_chassis_bottom hp16700_bottom_top hp16700_bottom_bot

Here’s the bottom.  There’s two .025″ pitch ribbon cables connecting it to the interface board.  I really liked the copper thieving on this board.  This is the little rectangles on the board.  These are used to equalize copper usage so that when the board is made it is less likely to warp or delaminate during soldering, because the copper area vs. etched areas are equalized.   The other interesting thing is there are spark gaps built onto the board, too!  These are probably hard to see in the picture, but are on the connector connections on the bottom.  very small traces next to each other with the mask pulled back.


hp16700_slot_top hp16700_slot_bot

Here’s the slot board.  Not much going on here, though those three huge diodes are kinda neat.  I dunno why they have these here, they are reverse biased in normal operation, guess they wanted to check possible negative excursions on power.   The copper thieving is again evident on here.  The pattern isn’t very regular either.   The three large white minifit jr. plugs connect to the power supply.



HP16715A Acquisition card.  This is the beast that does the digital damage.  The specs are:

167MHz state667MHz timing

2Msample/channel depth

68 channels,  or 34 channels with 4M/channel depth.

Up to 5 of these cards can be cascaded for 340 channels!!!  Oh, and if that is not enough, you can get an HP16701 expansion chassis, for a total of 780 channels.  Sheesh.  I wonder what you’d need that many for.   To be fair though, you can get other types of cards to plug into this beast-  2 channel oscilloscope, function/waveform generator and I’m sure others.  There’s also some much faster cards which most likely use ECL devices.

Looking at the board, it’s got a metric assload of SOIC RAM chips on here… 34 to be exact.  There’s two HP ASICs with heatsinks, an Actel FPGA and four HP level comparator chips on the inputs to detect logic levels.  The little QFP near the bottom middle is an octal voltage DAC, doubtlessly being used to set the threshold voltage.  I looked it up and that’s a $50 part.  (sorry, can’t remember the part number.  It’s made by Analog Devices.  I would check but I slid the cards back in already).

Two of the cards were ganged when I got it.  This is how that works:

hp16700_acq_connect hp16700_connector hp16700_acq_connected

There’s two little flex cables that connect near the ASICs… there’s a connector on both the top and bottom, and 5 ribbon cable slots on each board.  What happens is you can connect up to 5 boards daisy chain fashion using the flex cables, then run the ribbon cables- 2 from the top 2 boards, 2 from the bottom 2 boards and connect them to the middle board which is then the master.

It’s a right pain to insert two of these together into the analyzer, I’d like to see the contortions needed to do all five!  Those connectors are BGA also, so I wouldn’t want to break them.

hp16700_psmounted hp16700_supply_nameplate


Last up is the power supply.  This supply is an absolute thing of beauty.  It’s also an insane power beast capable of up to 700W.  This is pretty surprising for something made in 2000.  I am guessing that most of this power is for the cards, however.  There’s no less than two 120mm fans blowing directly on the sides of the card cages, and a third 120mm fan to cool the rest of the guts (and two little fans on the supply).  The supply is also a modular one…

hp16700_supply_open hp16700_supplies_end

Removing the top cover reveals that it’s what amounts to a voltage doubler/rectifier and what appears to be a power factor corrector.  Everything in this supply is absolutely top notch quality.  All Panasonic caps, FR4 PCB, excellent heatsinks and magnetics… the works!  I like the little connector PCB on the end.

hp16700_supply_mainframe hp16700_supply_units

The supplies simply drop onto the mainframe and screw down, connecting with .1″ headers… which are carrying 360V.  The supplies are connected to give out 5.1V at 35A, -5.2V at 35A, 3.3V at 70A, -3.3V at 35A, 12V at 5A and -12V at 5A.  This is a lot of power.  I was kinda amused to see that they wired up some of those supplies “backwards” to get the negative voltages- I guess they are isolated output, so why not?  Each supply has a pot to tweak the voltage, and two of the 3.3V supplies are tied together with a short jumper, presumably because both of their outputs are connected together.  This should allow them to load share properly.  Each supply (except the 12/-12V one) has a separate 2 pin connector coming off of it for what I assume is a power good signal.  There’s a 4 pin rainbow ribbon that comes off the mainframe board which I believe controls soft power.  There’s no “hard” AC power switch on this, the little rocker on the front panel for power is low current.

And finally, the back panel. Sorry quality isn’t the greatest but it’s all I got.

hp16700_back hp16700_empty_chassis

In the next post, I will show off the cables and test pods and maybe some software things.  I need to hack it first before I can use it, because there’s a password on it.  This should be fairly easy to get rid of, however.  I am going to clone the drive before I start dorking with it, in case there’s anything useful or interesting on it.  I managed to get the install CD for it so I will most likely start with a clean install before I start using it.