Last spring (2014) I came across what seemed to be an amazing deal at the MIT Swapfest. It was a HP 54845A digital oscilloscope, which, although over 15 years old, was still a pretty impressive beast being four channels, 1.5GHz, 8Gs/s! The only problem was it didn’t work. In fast the seller was letting it go cheap at the end of the meet because someone had bought it earlier in the day and then insisted on returning it again after they saw that all four channels appeared to be bad. Seeing that it was worth over $500 on eBay broken, I handed over my $240 and took it home figuring I had nothing to loose.

My HP 54845A Infinium (or is that Infiniium???) after I had cleaned it up some.

When I got home play with it a bit, it quickly became clear that the previous buyer was correct. Although the oscilloscope booted fine (it runs Windows 98), all four channels were railed high and the traces could not be brought onto the screen using the offset controls or by applying a reasonable negative voltage to the input. The behaviour was the same in 1M and 50-Ohm modes. Running the self-test showed numerous errors. Specifically:
-A to D converter
-FISO
-Offset Dac
-Gain
-Trigger level
-Pattern trigger
-State trigger

At this point, I took the unit apart and started checking for anything obvious. The voltage outputs from the power supply were marked and all checked fine for voltage and ripple and the computer motherboard and special video card seemed to be working fine since the thing booted, so that meant that the problem was on the acquisition board.

I downloaded a copy of the service manual from Agilent (now KeySight) but it is only an assembly level manual and doesn’t provide much more then a brief theory of operation on the acquisition system, so I figured I would have to figure it out myself.

Looking at the manual and the acquisition board it was pretty clear that each channel of the acquisition system has two main components – an attenuator / pre-amplifier assembly to precondition the signal by amplifying / attenuating it to a known level and an analog-to-digital (ADC) hybird to convert the conditioned signal to digital. See the photo below.

Photo of the acquisition system components. Note that each attenuator / preamp assembly handles two of the four channels. This is so that two of the ADCs can be interleaved to achieve the highest 8Gs/s sampling rate.

Understanding this, it was pretty obvious what the next test should be: to see if the problem was due to the attenuator / preamp assemblies or the acquisition hybrids, I disconnected the semi-rigied coax connecting them and injected a small signal directly into each of the acquisition hybrids. Under this condition, I got a nice clean trace on each channel, proving that the acquisition hybrids are still good. Furthermore, when I re-ran the self-test with the attenuator assembles disconnected, the A to D converter and FISO tests passed! Measuring the voltage on the output from the attenuator / preamp assembles, I see about 1.7V DC, which is consistent with the symptoms. With some more careful examination I was able to identify the trigger signal out pin on the attenuator module and when I injected into this, the trace could be triggered!

This was very good news – the ADC hybrids, triggering system, and digital systems all worked. ‘All’ I had to do was figure out why the outputs from the attenuator modules were stuck high. There were two basic possibilities. Either there was something on the acquisition board, in common with all four channels which was wrong (such as a supply rail) or else both attenuator modules were blown. It was not obvious which of these was true. On one side, it seemed quite improbable that all four channels would be blown out in exactly the same way, but, there was quite a bit of evidence on the other side as well. First, two channels go into each attenuator module, so it seemed that if one channel was blown it might take out the other one as well. All four attenuators looked like they were blown – putting out an unchanging DC voltage with no input. Furthermore, it was clear that I was not the first one to have worked on this. One of the attenuator modules was marked with an ‘X’ and while it was labeled as being for the channel 3 & 4 it was installed in the channel 1 & 2. It was even missing a small surface mount transistor and showed other signs of rework (more on this later). This seemed to indicate to me that someone might have tried to fix a blown attenuator and failed and then when the second one blew out the scope was scrapped. Finally, being that I work with students a lot I am used to seeing equipment blown in stupid ways. Students do odd things like connect a circuit to a scope channel and if nothing shows up, try the next channel, and the next…

Determined the figure out if there was something wrong in common with all the channels, I went to work reverse-engineering the pinout of the connectors which attach the attenuators to the acquisition board looking to see if I could identify a missing negative supply rail. I did this by measuring the voltages and waveforms at each pin with the attenuator module installed or removed. I made some progress but couldn’t identify any obvious missing power supplies. My progress was hindered by two things. First, HP used many odd-value voltage supplies (3.1, 6.3, etc.) which were hard to know if they were correct or not. Second, I couldn’t see the circuitry on the attenuator modules because of the soldered-on metal shields which also prevented me from probing the pins with the attenuator installed unless I held the entire acquisition board up on end hanging out of the side of the oscilloscope. Finally, some voltages seemed to change depending if the attenuator was installed or not and I couldn’t figure out if this was right or not. In short, the attenuator modules seemed to be getting +5V and -5V, so I was getting more and more convinced that they were probably blown.

I also tried measuring the outputs from the numerous small regulators scattered over the acquisition board, but all the ones from fixed regulators for which I could easily determine the correct output voltage seemed reasonable. The photo below shows the voltages I measured on these (all readings here were verified to be correct after the scope was fixed):

Output voltages of regulators on the acquisition board (not comprehensive).

At this point, having found no smoking gun, I pretty much gave up for the time being. I tried asking on the HP / Agilent Yahoo group here hoping someone else had already measured the voltages on the attenuator module connectors so I could compare mine, but no one had. I figured that I might be able to find another broken scope to compare with on eBay, so the project sat for a year while I waited for one to come along at a reasonable price.

When, after a year, I hadn’t seen one sell for less then $700, I decided to give mine another look. This time, I would take the rather drastic step of removing the soldered-on metal shields from one of the attenuators in the hopes that that would reveal enough about its circuitry to see if I could understand its pinout and determine, once and for all, if a supply rail was missing.

Removing the shields was tricky but not as bad as I thought. By using my Hakko 472 vacuum de-soldering station to remove most of the solder and then gently prying to crack free what was left, I was able to remove the shields from the attenuator which showed previous signs of rework without significant damage to the attenuator or shields. With them off the attenuator board was exposed. See the photos below.

Attenuator module without shields. Note the heavy rework on the top of the attenuator (top photo) and the missing transistors (Q2) (bottom photo). The two SMD capacitors taped on with Kapton fell out when I removed the shield. There are none missing, so whoever did the rework apparently accidentally left these inside!

With the shields off, I was surprised at how simple the device is. There are only three ICs in the attenuators – an HP custom preamp hybird, P/N 1NB7-8372, and two Burr-Brown BUF601 50-ohm buffers for the 1M path (the datasheet for the BUF601 can be found here). There are also four relays per channel. K2/K6 (datasheet) are for switching the signal path between the 1M and 50-ohm paths, K2/K7 (datasheet) are x10 50-ohm attenuators, K4/K8 (datasheet) are x5 50-ohm attenuators, and K1/K5 (datasheet) are relays for x10 1M attenuators. I even tracked down the datasheets for all of the individual smd transistors and diodes, both to help me understand the circuit and to be able to replace the missing Q2. Most were pretty easy with the help of smdcode.com, but the one I really needed, Q2, was tricky. The part is marked ‘117’ but it turns out that the ‘7’ is a lot/date number of some kind and the part designation is ’11’. Once I figured that out, it was clear that the part is an MRF9511LT1 and was able to order one on eBay. See the photo below for the part numbers of the other discrete semiconductors.

This closeup shows both the heavy rework (not by me) present on the attenuator as well as the part numbers of the discrete semiconductors. The device on the far left is a BAV99 ultrafast diode marked ‘A7T’. Next is a BRF92 NPN microwave amplifier transistor marked ‘P1p’. On the right is the impedance converter FET used to connect the 1M path to the 50-ohm path. It is of type 2SK501-52 and is marked ‘K52’.

With the basic structure and function of the attenuator module figured out, I went to work trying to see about the power supplies. I noticed right off that there six tantalum capacitors connected near the hybird – clearly power supply bypass capacitors! A bit of tracing and measuring the voltages on the header in the scope revealed that two are for the +5V / -5V supplies for the BUF601 chips and one is a digital +5V supply for the internal offset DAC in the hybrid. That left three capacitors for the hybrid analog rails. With the attenuator installed in the scope, these measured +6.3V, +3.9V, and +0.8V! There was no working negative supply! I could tell that the +0.8V one was the problem as its capacitor was connected with the correct polarity for a negative voltage. Removing both attenuator modules and remeasuring showed this supply at a much more reasonable -3.1V. If either attenuator was installed, though, the supply went back to 0.8V. This left two possibilities. Either the attenuators were something wrong with the supply so that it couldn’t source sufficient current, or both attenuators were blown and shorted, loading down the supply

To figure out which it was, I connected the attenuator to the oscilloscope on extension cables. I used 52 of the little jumper wires that I sell with my EPROM Programmer Universal Adapter plugged into pieces of header and two SMA extension cables to do this. This allowed me to connect an external lab supply to the supply rail in question on the attenuator without risking damage by applying power backwards to the regulator on the acquisition board. At this point I didn’t know what voltage that rail was supposed to be, so I figured that I would turn on the oscilloscope and then very slowly turn up the lab supply while watching the current carefully to see if I could bring the trace back onto the screen. This procedure worked, but seemed to reveal that the hybrids were in fact blown – the trace could be brought onto the screen, but its offset was extremely unstable and it would only pass a very distorted signal per the photo below.

Photo showing the extension cables connecting the hybrid to the oscilloscope and the very distorted trace.

I was about to give up – both hybrids were presumably blown, when I figured I would try one other experiment. I set the supply to the full -3.1V which I had observed on the rail with the attenuators disconnected before starting up the oscilloscope. Amazingly, when I did this, it resulted in a clean, clear, stable, triggered trace! It worked! Better still when I tried the other attenuator module, it worked too! A bit more experimentation revealed what had happened. It turns out that this beast has automatic offset correction of some kind. It appears that when the oscilloscope is first turned on the offset in each channel is measured and used to program the offset DACs in the hybrids to correct for it. Thus, when I was turning on the oscilloscope with no -3.1V supply, this algorithm was railing the offset correction. My externally supplied voltage, set to produce zero offset, was then wrong in the other direction to correct for the railed DAC, resulting in a very weirdly biased amplifier and the distorted signal. The photo below shows the oscilloscope when it first worked for me!

Photo showing the oscilloscope working with a nice clean trace. Hurray the hybrids are good!

Now knowing that the problem was with the -3.1V supply, I set about trying to figure out what, exactly, was wrong with it – the behaviour was really quite odd. When the oscilloscope was turned on with no connections to the -3.1V rail, the rail shows -3.1V. However, if any significant load (more then a few 10’s of mA) was drawn from the -3.1V rail, it would suddenly switch to being positive and would stay that way until the oscilloscope was power cycled – even if the load was removed. Some quick work with an ohm meter showed that the supply was fed from U38, an L2726 dual-output high output current opamp under a soldered-on heatsink. I removed the heatsink with a hot-air gun and started trying to trace out the circuit for the supply. U38 was just wired as a buffer, and when the supply would go positive after having been loaded, the non-inverting input to U38 would be at -10.5V, below its -5V negative rail. Thus, I wasn’t sure if the problem was with it, or with the circuitry driving it. I was suspicious that the supply, which has some kind of current monitoring, was shutting itself off due to a perceived overcurrent fault. Thus, I traced out the circuit and created the partial-schematic shown below. Note that this shows only the main regulation loop for the supply, not the current monitoring (or anything else that might be going on).

Partial Schematic of the -3.1V supply on the acquisition board of the HP 54845A oscilloscope.

From this schematic, it became obvious that the L2726 had an extra, unused opsmp in it of the same type as the questionable one. This enabled me to do a bit of quick-and-dirty solder work to swap them electrically. When I tested the supply with the unused section connected, it could deliver a full amp without sagging or going positive! After all that, the problem was just a bad opamp! The photo below shows the jumper wires used to connect the extra section.

Failed U38 opamp with the good ‘spare’ section wired in place of the bad one.

The reason that the supply would get ‘stuck’ positive after being loaded was as follows. With U38 being wired as a buffer, its only function is to supply current. The supply regulation is accomplished by U30, an LM324. When U38 failed, it did not do so completely, rather, probably due to electromigration, its output devices stopped being able to supply more then a few mA of current. Thus, when it was loaded its output would start to droop. When this occurred U30 would pull the non-inverting input of U38 more negative to try and compensate. However, with U38 totally unable to supply any more current, this did nothing, so U30 continued to drive U38’s non-inverting input negative until U30 railed at ~-10.5V. The problem, though, is that this is more negative then the -5V negative rail of U38! When an opamps inputs are driven beyond the rails the behaviour is unpredictable (it depends on the details of the specific opamp being used) and in this case it causes U38 to try to drive its output POSITIVE! Thus, a positive feedback loop is established where U30 tries to drive U38 negative and by doing so actually drives it positive, thus latching the system until the power is cycled. In short, replacing U38 totally solved the problem.

Replacement U38 (L2726 opamp) installed, but before the heatsink was reinstalled.

At this point, I was able to reinstall both attenuator assemblies without any extension cables and verify that all functions of the oscilloscope worked correctly and that it would pass its self test, which it did.

All that was left to do, then, was to give the whole thing a good cleaning, lubricate the noisy CPU fan (if you take the sticker off the back of a noisy computer fan and apply a drop of synthetic motor oil to the bearings they usually work fine again), reinstall the missing Q2 in the dismantled attenuator assembly, and put the shields back on. Before I did this last item, though, I spent some time finishing my reverse-engineering of the attenuator connector pinouts. Hopefully this information will help the next person who runs into some similar problem on one of these beasts!

Left connector when looking at front of scope, J7 on attenuator module, J7 or J9 on acquisition board:

Right connector when looking at front of scope, J8 on attenuator module, J6 or J8 on acquisition board:

Note 1: Except for power supplies and digital, all signals are for one channel (1/2 or 3/4) only.
Note 2: All supplies are stable and accurate with the attenuator modules removed except for the +3.9V supply.
Note 3: The 1M path is weird in that the high frequency signal components are amplified in the attenuator module, but the low frequency components are amplified on the main board in a circuit which also handles AC coupling and offset. See page 8-7 of the service manual. The DC bias of both the low frequency components in and out pins varies with the offset control. With the attenuator module removed, the ‘out’ pin will clamp at either ~-9V and ~+9V depending on the polarity of the offset. The ‘in’ pin various smoothly with the control independent of whether the module is installed.

After getting it all cleaned put back together, I ran the self test again. It passed! Then I verified the bandwidth (as best I could with the equipment I had) for both the 50-ohm and the 1M paths. Good again. Then I ran the self calibration, and wala! It passed that too. Wow! it Looks like I have a working 1.5GHz oscilloscope!

It passed its self test!

And it passed its self calibration!

Finally, here it is with the correct miniature keyboard and new HP branded 1161A probe I bought for it. I was even able to find a power cord in my collection with a hang-tag indicating that it was an official HP one of the correct part number for this scope! I am still looking for three more HP branded 1161As to complete the set, but other then that I am pretty happy to day that I have a ~$2000 oscilloscope for $240 (plus countless hours of my time, but, oh well, it was fun!)

Here it is – all set up and working.

That’s all folks!

-Matthew D’Asaro