Adventures in Retrocomputing: hacking a 7.5 digit HP 3456A

[TimInCanada]

There was a discussion a couple months ago in the Metrology section about the 3456A actually measures 7.5 digits but only outputs 6.5.  So how can you get that extra digit?  Not knowing any better, I thought "How hard can it be?" 

Here's the result.  The exponent digit has been hijacked to display the extra digit:



And, on startup:



Just to let you know you don't just have an ordinary 3456A...

The attached zip file has the details.  It contains:

• HP3456A_Firmware_Notes.docx, with details of the relevant code changes and resources
• u7.bin, the original firmware image
• u7.sym, the symbol file for the disassembler
• u7disassembled.asm, the original firmware disassembled
• u7commented.asm, the firmware with comments added and a lot of unnecessary jumps and branches removed
• u7modded.asm, above with modifications for 7.5 digit output
• u7modded.bin, assembled version of the above

The Outguard microprocessor does most of the work and is a Motorola 68A00, a 1.5 MHz version of the 6800.  The firmware is about 22KB of code and 2KB of data.  The code certainly appears to be the output of a compiler, and in the day HP had the 64000 Logic Development System that had available Pascal and C compilers for the 6800.  I took out right about 1000 bytes of unnecessary jumps and branches in an attempt to untangle the code and make it more readable.  I broke something in the Auto Range that causes the display to freeze under certain conditions.  Not much other testing has been done, so there could be other problems.

The Inguard and Outguard processors communicate through two, one-way serial links.  Here's a breakdown:





The Outgard sets the measurement mode by sending four bytes to the Inguard.  It looks like these bytes provide low-level details to the Inguard such as FET switch settings and such, but I haven't decoded those commands.

To replace the firmware I used a SST39SF010A 128Kx8 flash ROM.  It's four times the needed capacity, but the smallest 5V DIP that Digikey stocks.  I did an adaptor board that's a little different than solutions I've seen elsewhere:



Most of the signals are taken directly from the unstuffed U2 position.  A12,13,14 are taken from jumper positions 6,4,8, respectively.  The ROM Select signal is taken from pin4 of U6.  On this adapter, A15 and A16 are tied to ground, but I realized later that a switch could be added to +5V, both original and modified firmware could be put in the ROM, selectable by the switch position.  When trying code modifications there was often the question of whether the meter was acting normally.  Flipping a switch would have saved time over switching ROMs.

Here's the results from letting it run overnight measuring a lithium coin cell.  Readings were taken at about 10 second intervals.  Temperature came from a LM35 placed on the bench under the 3456A, read by another meter.



I have no idea what happened in the middle of the night.  Air Conditioning was off, there are no other fans running, nothing else was powered.  My best guess is something suddenly caused the 3456A to emit less heat.  It's a unit I bought non-functioning, so it very well could have other problems to sort out.

Anyway, here's the middle data on an expanded scale:



Set to 10 PLC integration, here are the results from 1000 consecutive readings:



This particular meter is moving around quite a bit, so it will take some more work to figure out if this extra digit provides any additional information.  This scatter does look promising, though.

I've got a bunch of other things on the To Do list that need to be done before I can descend into volt-nuttery, so though I'd put this out in case anyone else needs some "fun".    One idea I'm wondering about is if the 3458A's multislope ADC algorithm is different than the 3456A's.  There will be differences in the analog circuitry, but we now have the potential to change the operation of the digital control.

Tim

[chickenHeadKnob]

Dude! you really went to town. That is a lot of hard work. 

One idea I'm wondering about is if the 3458A's multislope ADC algorithm is different than the 3456A's.  There will be differences in the analog circuitry, but we now have the potential to change the operation of the digital control.
 Tim

As far as I know the 3458 is much more elaborate, so unfortunately not much will carry over.

[TiN]

Amazing.

How I'd wish you have 3458A, so we can add few functions to it as well (like show 8.5digit resolution in all OHM ranges, support external preamp for DCV to make <100mV ranges)

[bitseeker]

Very cool hack, Tim. I like the "HP 3456+" message. Nice touch.

[AG7CK]

Very impressive.

I am old and fearful and have decided that I only want to spy on the data. That means U22? Digital ground and a single pin? If so, which pin?

Can I hook a MSP430 with level shifter or an Arduino directly to U22, or do I need a buffer?

I have bought 8pcs 4inches tall common anode 7-segment displays for an external display similar to those HP sold in the 1970s or so. I will need to use an external power supply, so may be it would be better for me to sniff U22 isolated with opto-couplers.

How would you go about for a minimum intrusion reading only of the inguard data stream?

Thanks.

[Kean]

Brilliant work Tim!  Wish I had a 3456A to try it.

Not that it helps, but I still have an HP 64000 Logic Development System in storage.  It is only 33 years old, and apparently I've had it for 16 of those years. 
Last time I powered it up, it worked fine except for one of the four floppy drives, but that was probably about 10 years ago!

I have the master workstation, a slave workstation, the 7911P HP-IB CS/80 28MB hard drive, and emulation pods for 8051, 8085, 8086, Z80, and I think TMS 32010.  Plus a huge amount of documentation (6ft of shelf space).  Unfortunately no 6800 stuff from memory.

The hard disk is so loud you need to wear ear muffs when it is powered on (not quite angle grinder level), has a max transfer rate of 35 kB/s, and it alone weighs about 85kg.  It has a 14" platter.

Of course when I needed to do some similar dissassembly and commenting of some 8051 code a few months ago, I didn't even contemplate using the 64000.  I just did it only my PC like any sane person.   

[chickenHeadKnob]

.....
Not that it helps, but I still have an HP 64000 Logic Development System in storage.  It is only 33 years old, and apparently I've had it for 16 of those years. 
Last time I powered it up, it worked fine except for one of the four floppy drives, but that was probably about 10 years ago!

I have the master workstation, a slave workstation, the 7911P HP-IB CS/80 28MB hard drive, and emulation pods for 8051, 8085, 8086, Z80, and I think TMS 32010.  Plus a huge amount of documentation (6ft of shelf space).  Unfortunately no 6800 stuff from memory.

The hard disk is so loud you need to wear ear muffs when it is powered on (not quite angle grinder level), has a max transfer rate of 35 kB/s, and it alone weighs about 85kg.  It has a 14" platter.
.....

Is that the hard drive the size of a filing cabinet? We put those in a separate storage room back to back with the 64000 with the cable going through the wall for sanity. One day a tech discovered that if you wrote a simple macro which called itself the whole drive would start to shake in self resonance as the head was hammering back and forth, almost to the point of walking across the floor. He amused himself with this until the drive crashed

[cellularmitosis]

https://www.themarysue.com/ibm-black-team/ . 

"The Black Team had found the fundamental frequency at which the cabinet would rock, and had programmed the tape to resonate. In mounting horror, matching the mounting amplitude, the programmer watch as the cabinet at first subtly, then clearly, and finally unmistakably began rocking ever more violently, until finally, inevitably, it fell over."

Edit: excellent work, by the way, TimInCanada!

[Kean]

Is that the hard drive the size of a filing cabinet?

Yes, a small filing cabinet.
It is the one to the right of the picture here, under the fancy touch-tone phone.  I can understand putting it in another room.
http://www.hpmuseum.net/display_item.php?hw=412

The 7911 was also introduced in 1981. It was priced at $12,500 and offered a hard disc capacity of 28.1 MB.

[Kleinstein]

The ADC in the 3458 is working a little different, though there is some similarity. One big difference is that the 3458 and most modern DMMs use a numerical cal adjustment, while the 3456 still uses pots and the ADC's output directly corresponds to the displayed digits, though there might be numerical corrections, especially for the offset.

Changing a 22 k disassembled program is quite an effort - it would get even mode difficult and lengthy with longer code in the 3458, though at least 68000 K assembler is usually relatively well readable.

[TimInCanada]

Hey, thanks for the comments, guys. Certainly appreciated. 

How I'd wish you have 3458A, so we can add few functions to it as well (like show 8.5digit resolution in all OHM ranges, support external preamp for DCV to make <100mV ranges)

I kind of wish I had a 3458A, too, but I'm also afraid of what might happen if I got one. 

Actually, getting the extra resolution can be a fairly simple add-on.  The HP Journal article, page 37 says:

Once the instrument has been configured and triggered, a measurement is taken by the ADC and transmitted through the fiber optic link to the outguard processor. The format for this reading is either a 16-bit or a 32-bit two's complement result with the range offset subtracted.

The '56A uses a factor of 10 between the integration slopes and the Inguard outputs 10's compliment BCD digits.  The '58A uses a factor of 4 between slopes, so the Inguard is probably outputting straight binary.  The fiber optic receiver output could be picked up and decoded for a separate display.  Not very elegant for the long term, but the '58A is also measuring internally to 9.5 digits and these could be seen.

[TimInCanada]

Very impressive.

I am old and fearful and have decided that I only want to spy on the data. That means U22? Digital ground and a single pin? If so, which pin?

Can I hook a MSP430 with level shifter or an Arduino directly to U22, or do I need a buffer?

I have bought 8pcs 4inches tall common anode 7-segment displays for an external display similar to those HP sold in the 1970s or so. I will need to use an external power supply, so may be it would be better for me to sniff U22 isolated with opto-couplers.

How would you go about for a minimum intrusion reading only of the inguard data stream?

Thanks.

Here's the relevant bit of schematic sheet 12:



I was using a logic analyzer and picked off the two lines going into the shift register U22 to see what the serial protocol was.  To make the display a little easier to program, I think I would pick up the parallel data between U20 and U22.  The enable line on U22 (active low) is strobed when a byte of data is ready, so it could trigger an interrupt input on the microcontroller board.  There will have to be some logic to decide between the handshaking bytes and data bytes. 

These microcontrollers have quite high input impedance on the digital inputs, so they wouldn't load the circuits in the 3456A.  A level shifter for the MSP430 probably wouldn't cause significant loading, but it would be something to check.  As long as the ground of the new display power supply is tied to the digital ground in the meter, optoisolators wouldn't be needed.

One issue for a display is that the decimal position, exponent and exponent sign aren't given in the Inguard data.  I believe they are inferred from the measurement mode the meter is in.  I think the easiest way to get these would be to pick off the signals going to the meter's display. 

Four inch digits?  Wow!  Please post some pictures when it's going.

Tim

[bitseeker]

the '58A is also measuring internally to 9.5 digits and these could be seen.

Oh, my. That sounds like a project begging to happen.

[AG7CK]

Four inch digits?  Wow!  Please post some pictures when it's going.

Tim

Thank you very much for the explanation in your post. I know about the 9 digits - it is mentioned in the manual. They are however not readings - they are only intermediate math variables. The ADC samples a maximum of 7.5 digits and only when in 10NPLC mode. But when logging a stable voltage reference, I can present 8.5 digits for fun. The last digit will come from numerical averaging only.

I will only log 10v DC, so my scanning auto-"parser" is only : Am I looking at readings and if so: Are they +9.x or +10.x? I have done the same for a HP 34401A, and the format is fixed by the sign/exponent part. Easy to subtract the readings.

Nobody knows when the display will run. So I show the LEDs now. When finished they will be framed by 4 or 6 or 8x 1602 LCD displays showing No. of Readings, Min, Max, Average, StdDev, Moving Average, Percentiles 50, 75 and whatever. All this will be real time (using 2 or more uCs) and can be checked relative to the static Math function in the instrument (if one is disciplined with the same dataset being used for the calculations). A graphical display can also be added on top.

Thanks again. Seriously good stuff.

EDIT: Just checked them - they are 3 inches tall, not 4. My mistake.

[bitseeker]

EDIT: Just checked them - they are 3 inches tall, not 4. My mistake.

I don't think that'll be any less awesome looking.

[TimInCanada]

Brilliant work Tim!  Wish I had a 3456A to try it.

Not that it helps, but I still have an HP 64000 Logic Development System in storage.  It is only 33 years old, and apparently I've had it for 16 of those years. 
Last time I powered it up, it worked fine except for one of the four floppy drives, but that was probably about 10 years ago!

Thanks Kean.  I bought a box lot of test leads a while ago and in the box was a PROM module for the 64100A.   The one that plugs in beside the keyboard.  Now I just need every other piece of the system to fit it.  Sort of an extra sad case of ESD: "Empty Slot Disorder - Refers to mainframe types of test equipment that have slots for functional modules or cards. Any empty slot must be filled by acquiring modules or cards, which leads to ESI."  Got the module, now just need the mainframe and all the cards, probes, cables, software....

Tim

[TimInCanada]

Nobody knows when the display will run. So I show the LEDs now. When finished they will be framed by 4 or 6 or 8x 1602 LCD displays showing No. of Readings, Min, Max, Average, StdDev, Moving Average, Percentiles 50, 75 and whatever. All this will be real time (using 2 or more uCs) and can be checked relative to the static Math function in the instrument (if one is disciplined with the same dataset being used for the calculations). A graphical display can also be added on top.

That sounds like a very interesting project.  I'm glad that info is helpful.  If any problems come up working with the meter, please let me know.

Tim

PS: I agree, those digits are very impressive, even if they are "only" three inches.

[bitseeker]

PS: I agree, those digits are very impressive, even if they are "only" three inches.

Yeah, no need for a wireless remote display when the digits are large enough to read from the neighbor's house.

[AG7CK]

The enable line on U22 (active low) is strobed when a byte of data is ready, so it could trigger an interrupt input on the microcontroller board.

Thanks again Tim, and Thanks to bitseeker for nice words

I am not sure I understand this. U22 is a SN74LS164 and has only clock 8 and reset 9.

In https://archive.org/stream/hp_3456A/3456A_djvu.txt it reads:

Code: [Select]

8-262. Receiver. The serial data received from the In-
guard Logic through transformer T2 consists of a group
of 9 bits with the first bit always a "one”. The receiver
uses this first bit to generate Byte Available. Clock and
data are derived from the serial data by U21, a tran-
sistor array circuit. This clock is used to shift the data
into U22, a serial to parallel shift register, and is also
used by the Byte Available flip-flop U17b. The Q output
of U 1 7b goes high on the clock pulse following the shif-
ting of bit “one” to pin 13 of U22/pin 11 of U17b. This
high is used to tell the Outguard fiV that a data byte is
available on the data bus. The first bit is then shifted out
of U22 (overflow) leaving the eight-bit data byte on the
parallel output of U22.

8-263. The Byte Available pulse from U17b goes to
A3U16, pin 18 (data line D7, see Schematic 13, HP-IB
Logic). The Byte Available pulse is transferred through
U16 to the Outguard ^tP when the ASE enable line (pins
1 and 19 ) goes low. An enable on the ASE line occurs
when the scans U9 via the A0-A2 address lines.
When the mP receives the Byte Available pulse, the
following sequential events take place; (1) the DBE
(Data Bus Enable) line goes high which clears flip-flop
Ulla; (2) the Read line goes high and the Isolation
Logic Strobe line goes low. The Read signal (inverted by
U2a) and the Isolation Strobe pulse are applied to AND
gate U13a, The output of Ul 3a is used as an enabling
level for tri-state buffer U20, a clock for flip-flop Ulla,
and a clear for flip-flop U 17b. The 8-bit byte is transfer-
red from buffer U20 to the fiP and the U22 shift register
is cleared at this time.
This means imo that when the first of the 9 bits - the "always 1" bit indicating data available - reaches pin 13, i.e. when 8 bits have been shifted into U22, then on the next (9th) clock pulse which is synchronous with the 9th and last bit in the 9-bit block ( i.e. data bit no. 8 ) - U17b goes high signaling data available (the "1" bit is shifted out, and the 9th bit which is the 8th data bit is now on pin 3 U22).

So imo all I have to do is poll (or use interrupt) U17b pin 9 Q, and when it goes high, all 8 data bits in a byte will be available on U22 pin 13, 12, 11, 10, 6, 5, 4, 3. Is this correct?

Edit: Writing mistakes

[TimInCanada]

Yes, I think you've got it.  That first bit gets clocked all the way through and out of the shift register leaving the 8 bits of the Inguard data byte on pins 3,4,5,6,10,11,12,13.  U17b pin 9 is polled by the 6800, and when it sees a high level, it triggers the U20 buffer to put the data byte onto the data bus.

[rigrunner]

I hacked a parts 3456a with Tim's rom a little while ago. I recently hooked it up with gpib and scanned for a while on the 10V range with a short. One reading every minute 100NPLC.


Thanks Tim 

[coromonadalix]

Woah   you want to have an 3inch high display connected to the 3456 ?  an frankenmeter of some sort,  nice job understanding and decompiling the firmware ...

[simon51]

Hi,Tim,After your 3456+ firmware is shared, My friend Mr.Tang designed ltz1000 ref board for 3456+. He do some test for it, the result is very nice, look attach file Pls. I also make a rom pcb for 3456+(3rom version), so can easy use your 7.5 firmware. We also find some bugs as you say in your doc. Now, I want to modify your u7modded.asm file, But it is not exist in you package file, can you share it, Thank you very much.

[borghese]

Hi Simon
Can you share your board drawings or Gerber files?

[simon51]

Hi Simon
Can you share your board drawings or Gerber files?

Gerber files already Attached