DIY scan card for Keysight 34970A

[voltsandjolts]

I've never tried, but the Chinese clone 34901A uses their own firmware, so I'd bet the original is locked and unreadable.

Anyway, I don't want to fraudulently use their copyrighted firmware. Honest open firmware is better, even if it has some foibles.

[free_electron]

I've never tried, but the Chinese clone 34901A uses their own firmware, so I'd bet the original is locked and unreadable.

Anyway, I don't want to fraudulently use their copyrighted firmware. Honest open firmware is better, even if it has some foibles.

you don't have to use it. simply decompile it. it's 4kilobyte...

[strawberry]

when in scan mode card sends channel status open/close ?

I guess Chinese dont have thing like copyright
Agilent/Keysight... maybe still hold copyright back to 70's. Service manuals containing schematics are edited out on their website.

[Kleinstein]

The copyright for the old HP code still holds, however this only covers the direct copy of the code, not the functionality.
As from international treaties the copyrights also applies in China - they just don't enforce it as strict.
AFAIK it's for a minimum of 75 years. So not much computer code were the copyright has expired yet.

As the function is relatively simple, there is no big issue in reprogramming it. This gives the freedom in using a difference µC type or just different pins and for te DIY version maybe alternative functions.

[voltsandjolts]

I've never tried, but the Chinese clone 34901A uses their own firmware, so I'd bet the original is locked and unreadable.

Anyway, I don't want to fraudulently use their copyrighted firmware. Honest open firmware is better, even if it has some foibles.

you don't have to use it. simply decompile it. it's 4kilobyte...

Sure, but then you are 'tainted' having seen the proprietary code, and you can no longer be part of any 'cleanroom' open source firmware effort.
Whereas, observing the functionality of the device is legal.

[strawberry]

copyright is for exact binary copy? does it apply for communication protocol as well. considering limitations it is possible to come up with same code or even better

[free_electron]

I've never tried, but the Chinese clone 34901A uses their own firmware, so I'd bet the original is locked and unreadable.

Anyway, I don't want to fraudulently use their copyrighted firmware. Honest open firmware is better, even if it has some foibles.

you don't have to use it. simply decompile it. it's 4kilobyte...

Sure, but then you are 'tainted' having seen the proprietary code, and you can no longer be part of any 'cleanroom' open source firmware effort.
Whereas, observing the functionality of the device is legal.

you've seen assembly for an 8051. study the protocol and then rewrite it in  different language for a different micro.

[voltsandjolts]

Erm, I'm pretty sure that still referred to as 'copying'.

[free_electron]

Erm, I'm pretty sure that still referred to as 'copying'.

you are not copying code. you looked at the code to derive the protocol. that protocol is then translated into a new program

that's how they did the IBM PC Bios. one group disassembled it , created a document detailing the API , tossed that document over the wall to another group of people that re implemented the API group 2 had never seen disassembly, only protocol spec.

[razvan784]

that's how they did the IBM PC Bios. one group disassembled it , created a document detailing the API , tossed that document over the wall to another group of people that re implemented the API group 2 had never seen disassembly, only protocol spec.

Yeah, that's the whole point, two different teams. To eliminate any reasonable suspicion of copying, it cannot be done by the same person. The procedure goes by the name "clean room reverse engineering".

[H.O]

Regarding

Code: [Select]

#define CMD_CHAN_SCAN1  (0xD8 >> 3) // TODO don't understand this yet, scan channel list maybe?When using the front panel you can close more than one channel at the same time (depending on type of card). However, my guess is that the above command means "Open all closed channels, then close channel nn (followed by channel number)).

Code: [Select]

#define CMD_CHAN_SCAN2  (0x08 >> 3) // TODO don't understand this yetDon't think I've seen this one yet...what did you do to make the DAQ send that one?

Am I correct that the cold junction reference temperatur is returned in units of 0.00390625°C per LSB? The DS75s datasheet says 12bits resoultion but I'm guessing the card CPU is doing some oversampling and is providing a psuedo 16bit result

[voltsandjolts]

Regarding

Code: [Select]

#define CMD_CHAN_SCAN1  (0xD8 >> 3) // TODO don't understand this yet, scan channel list maybe?When using the front panel you can close more than one channel at the same time (depending on type of card). However, my guess is that the above command means "Open all closed channels, then close channel nn (followed by channel number)).

Agree. When scanning a list of channels like:
print(inst.query('MEAS:VOLT:DC? 10,(@101:112)'))
The 0xD8 command is used like 'close ch1' then 'close ch2'...etc without any 'open' command.
So yes, it opens the closed channels, then closes requested channel(s).
There is also 0x1E1 0FF which seems to mean 'open all relays', including measurement bus relays and channel relays.

Code: [Select]

#define CMD_CHAN_SCAN2  (0x08 >> 3) // TODO don't understand this yetDon't think I've seen this one yet...what did you do to make the DAQ send that one?

My bad ignore that..its dupilcate...thats the 0x08 CMD_QUERY_BUSY command.

Am I correct that the cold junction reference temperatur is returned in units of 0.00390625°C per LSB? The DS75s datasheet says 12bits resoultion but I'm guessing the card CPU is doing some oversampling and is providing a psuedo 16bit result

The DS75s are used in 12bit mode (config byte is written at startup).
They are sampled continuously (600ms interval alternatively).
I haven't looked at what the scaling is, yes, maybe some averaging done there.

Edit:
I had expected the scaling to match the DS75 datasheet, but it's not quite the same.
Examples of hex values I returned from my card and the resulting temperature (as read by Python script):

Code: [Select]

0x0000 ==  -9.012 (expected 0.0 degC)
0x0873 ==   0.003
0x1910 ==  24.352 (expected 25.0625 degC)
0x7D00 == 124.290 (expected 125.0 degC)
It's like the dmm is applying some additional calibration but I haven't seen values read from the card that look like calibration data.

[voltsandjolts]

My interpretation of commands so far:

Code: [Select]

// Commands are shifted down 3 bits to remove the address bits and thus
// allow the compiler to make a jump table with 32 entries for command decoding.
#define CMD_IDENTIFY    (0x18 >> 3) // response is 0x101-0x108 for 34901A-34908A cards respectively
#define CMD_SRQ_CLEAR   (0x20 >> 3) // card holds SRQ low after power on, this cmd de-asserts it then responds with 0x121
#define CMD_POWEROFF    (0x40 >> 3) // see this 200ms before power off, address bits all zero i.e. 0x140 (broadcast addr?), no response required
#define CMD_UNKNOWN     (0xB8 >> 3) // 0x1B0 000 000 000 010 seen at power on, excercising or opening relays
#define CMD_UNKNOWN2    (0xC0 >> 3) // seen at power on, no response so doesn't need implemented or mimicked
#define CMD_QUERY_BUSY  (0x08 >> 3) // response is either 0x100,0x101,0x120 (all busy in some way) or 0x121 (idle)
#define CMD_QUERY_DATA  (0x48 >> 3) // read data from the transmit buffer, byte at a time, last byte available has 9th bit set
#define CMD_REFJUNC     (0xC8 >> 3) // get reference junction temperatures (read from DS75 i2c temperature sensors)
#define CMD_EXECUTE     (0x68 >> 3) // begin read of firmware version, relay cycle counts and other unknown stuff
#define CMD_CHAN_CLOSE  (0xD8 >> 3) // close measurement bus and channel relays
#define CMD_CHAN_OPEN   (0xE0 >> 3) // 1E1 0FF seems to be "open all relays" for channels and measurement bus


[voltsandjolts]

If you use python for instrument control, here is the scrappy script I am using for experiments:

Code: [Select]

import pyvisa as visa
import time,sys

#py -m pip install -U pyvisa
#py -m pip install -U pyvisa-py     (for the pure python backend)
#py -m pip install -U pyserial

#https://pyvisa.readthedocs.io/en/latest/index.html

#How do I know if PyVISA-py is properly installed? Get info about PyVISA, the installed backends and their options:
# python -m visa info

#On Windows, you may have to uninstall the USBTMC specific driver installed by Windows and re-install a generic driver.
#https://pyvisa.readthedocs.io/en/latest/introduction/configuring.html
#rm = visa.ResourceManager('@py')  # Use pure python backend
#rm = visa.ResourceManager('@ivi') # Use IVI-VISA backend
rm = visa.ResourceManager() # default backend

#print('Available devices: ', rm.list_resources()) # Will show async serial devices (comports) as e.g. ASRL16::INSTR for COM16

print('\nOpening device:')
inst = rm.open_resource('USB0::0x0957::0x2007::MY57007585::INSTR') #For the 34972A on USB
#inst = rm.open_resource("ASRL3::INSTR", baud_rate = 115200) #For the 34970A on RS232 (need to edit port number appropriately 'ASRL?' and check instrument baud setting)

#reading and writing values:
#https://pyvisa.readthedocs.io/en/latest/introduction/rvalues.html

#inst.write('*rst; *cls') #reset to power on state, clear status
# After *rst we now have these settings:
# 1PLC,  5½ digits resolution
# scaling is OFF and scale values are cleared
# sets the scan interval to immediate (0 seconds) and the scan count to 1 sweep.

DEFAULT_TIMEOUT = 5000 # default timeout is 5 seconds
inst.timeout = DEFAULT_TIMEOUT


#print(inst.query('*IDN?'))
#print('Slot 1 card type:')
#print(inst.query(':SYST:CTYPE? 100'))
#print('Slot 2 card type:')
#print(inst.query(':SYST:CTYPE? 200'))
#print('Slot 3 card type:')
#print(inst.query(':SYST:CTYPE? 300'))


#print('Internal relay cycle count:')
#print(inst.query('DIAG:DMM:CYCLES?'))


#print(inst.query('CAL:SEC:STAT?'))
#inst.write('CAL:SEC:STAT OFF,HP034970') #unsecure the instrument
#print(inst.query('CAL:SEC:STAT?'))
#inst.write('DIAG:REL:CYCL:CLE (@118)') #clears the relay cycle count on channel 18 in card slot 100
#inst.write('DIAG:REL:CYCL:CLE (@118)') #clears the relay cycle count on channel 18 in slot 100
#inst.write('DIAGnostic:DMM:CYCLes:CLEar 1') #clear internal DMM relay cycle count K102
#inst.write('DIAGnostic:DMM:CYCLes:CLEar 2') #clear internal DMM relay cycle count K103
#inst.write('DIAGnostic:DMM:CYCLes:CLEar 3') #clear internal DMM relay cycle count K104
#inst.write('CAL:SEC:STAT ON,HP034970') #secure the instrument


#inst.write("DISP:TEXT 'HELLO'")
#time.sleep(1)
#inst.write('DISPLAY:TEXT:CLEAR')
#time.sleep(1)
#inst.write('DISPLAY OFF') # Avoid screen burn on the VFD display by switching it off
#time.sleep(1)


#######################  20 Channel Card  #####################
# Assume this card is in slot 1, channels addresses are in 0x100 range

# MEASure is equivalent to CONFigure followed by a READ?
# These are the basic commands required
# MEASure:VOLTage:DC? [{<range>|AUTO|MIN|MAX|DEF}[,{<resolution>|MIN|MAX|DEF}],] (@<scan_list>)
# MEASure:RESistance? [{<range>|AUTO|MIN|MAX|DEF}[,{<resolution>|MIN|MAX|DEF}],] (@<scan_list>)
# MEASure:FRESistance? [{<range>|AUTO|MIN|MAX|DEF}[,{<resolution>|MIN|MAX|DEF}],] (@<scan_list>)
# MEASure:FREQuency? [{<range>|AUTO|MIN|MAX|DEF}[,{<resolution>|MIN|MAX|DEF}],] (@<scan_list>)


#print('Slot1 relay cycle count:')
#print(inst.query('DIAG:RELAY:CYCLES? (@101:120)')) # The relay cycle count from the chinese clone cards is always zero!!


#print(inst.query('MEAS:VOLT:DC? 10,(@112:115)')) #10VDC range, default resolution

#print(inst.query('MEAS:FRES? (@104)')) # 4W channels are paired. Specify channel 1 to 10, which is paired with 11 to 20.

print(inst.query('MEAS:CURR:DC? 1,(@121:122)')) #1A range, default resolution

#time.sleep(1) #1sec delay


exit()

# temperature stuff
#inst.query('SENS:TEMP:TRAN:TC:TYPE K,(@101)')
#inst.query('SENS:TEMP:TRAN:TC:RJUN:TYPE FIXED,(@101)')
#print(inst.query('SENS:TEMP:RJUN? (@102)')) #read the internal ref junction temp for bank1 ch01-10 (from DS75 U152)
#print(inst.query('SENS:TEMP:RJUN? (@118)')) #read the internal ref junction temp for bank1 ch11-20 (from DS75 U151)

print(inst.query('MEAS:CURR:DC? 1,MAX,(@121)')) #1A DC range, 6½ digits of resolution

print('\n---Measuring Examples---')

print('Measure one channel:')
print(inst.query('MEAS:VOLT:DC? 100,MAX,(@101)')) #100VDC range, 6½ digits of resolution

print('Measure one channel:')
print(inst.query('MEAS:VOLT:DC? 10,(@112)')) #10VDC range, default resolution

exit()

print('Measure several sequential channels:')
voltages = inst.query('MEAS:VOLT:DC? (@101:104)') #Auto ranging, default resolution
print(voltages)

print('Measure random channels:')
inst.timeout = 20000 # 15 sec timeout for this longer operation
print(inst.query('MEAS:VOLT:DC? (@101:110,115,120)'))
inst.timeout = DEFAULT_TIMEOUT

print('Measure 2W resistance:')
print(inst.query('MEAS:RES? (@118)'))
print(inst.query('MEAS:RES? (@101)'))
print(inst.query('MEAS:RES? (@102)'))

print('Measure 4W resistance:')
print(inst.query('MEAS:FRES? (@109)')) # 4W channels are paired. Specify channel 1 to 10, which is paired with 11 to 20.


[H.O]

Code: [Select]

#define CMD_QUERY_BUSY  (0x08 >> 3) // response is either 0x100,0x101,0x120 (all busy in some way) or 0x121 (idle)

Hmmm...my impression is that 0x101, like 0x121, means confirmed/done/ready/idle - not busy.

The scaling for the reference juctions is weird. It's not the 12bit format shown in the datasheet because the card returned values where the low 4 bits are not all zeros. My initial value of 125/32000 does not quite match, neither does 125/32768. My (genuine) card returns 0x17E4 for a reported temperature of 23.0156°C but the above scale factors eqauls 23.89 or 23.33. Like you say, there does not seem to be any calibration data transfered from the card.

[voltsandjolts]

The 34970A service guide has some theory of operation explanation for the 34901A. It says the FRAM "provides data storage of the calibration constants for the analog output channels" which means the CJ temperature measurement. There is a calibration procedure for those also.

But if the cal is in the FRAM, and I don't see it transferred to the DMM, it must be applied by the 8052 mcu. But then the scale for the CJ temperature values transferred to the meter doesn't make much sense either.

I think I'll park this CJ stuff for now and just focus on relay channel stuff.

[voltsandjolts]

Code: [Select]

#define CMD_QUERY_BUSY  (0x08 >> 3) // response is either 0x100,0x101,0x120 (all busy in some way) or 0x121 (idle)

Hmmm...my impression is that 0x101, like 0x121, means confirmed/done/ready/idle - not busy.

Ah, yeh, your right.
After the open all command 1E1 0FF, status returns 0x100...0x120....0x121
Close ch1 and status returns 0x100...0x101
(where ... means lots of repeats)

[voltsandjolts]

OK, I think I have enough understanding to carry on and make something kinda functional.
Did I miss any commands?

Code: [Select]

// Commands are shifted down 3 bits to remove the address bits and thus
// allow the compiler to make a jump table with 32 entries for command decoding.
#define CMD_IDENTIFY    (0x18 >> 3) // response is 0x101-0x108 for 34901A-34908A cards respectively
#define CMD_SRQ_CLEAR   (0x20 >> 3) // card holds SRQ low after power on, this cmd de-asserts it then responds with 0x121
#define CMD_POWEROFF    (0x40 >> 3) // seen 200ms before power off, address bits all zero i.e. 0x140 (broadcast addr?), no response required
#define CMD_UNKNOWN     (0xB8 >> 3) // 0x1B0 000 000 000 010 seen at power on, excercising (?) and opening relays, takes about 1.8sec
#define CMD_POWERON     (0xC0 >> 3) // seen at power on, no response required
#define CMD_QUERY_BUSY  (0x08 >> 3) // response for close cmd is 0x100...0x101 (idle), and for open cmd 0x100...0x120...0x121 (idle)
#define CMD_QUERY_DATA  (0x48 >> 3) // read data from the transmit buffer, byte at a time, last byte available has 9th bit set
#define CMD_REFJUNC     (0xC8 >> 3) // get reference junction temperatures (read from DS75 i2c temperature sensors)
#define CMD_EXECUTE     (0x68 >> 3) // begin read of firmware version, relay cycle counts and unknown (0x169, 0x030, 0x000/0x001)
#define CMD_CHAN_OPEN   (0xE0 >> 3) // open a channel, or 1E1 0FF to "open all relays" for channels and measurement bus
#define CMD_CHAN_CLOSE1 (0xD8 >> 3) // scan mode, open all channels then close one channel relay and measure bus relays
#define CMD_CHAN_CLOSE  (0xE8 >> 3) // non-scan mode, allow multiple closed channels

// The open and close commands are two characters long, the second specifies the channel:
//           0x40-0x49 for channels 1 to 10
//           0x80-0x89 for channels 11 to 20
//           0x15-0x16 for channels 21 to 22 (current measurement only)
//           0xC0-0xC9 for channels 1 to 10 in 4W resistance mode (paired with channels 11-20)
// Additionally, the open command with "channel" 0xff means open all relays


[strawberry]

08A 40ch card

[voltsandjolts]

I'm gonna focus on my 20 channel card, since I have a 34901A 20ch to study.
I don't have a 34908A 40ch card, donations welcome!

[strawberry]

I have 3 empty slots

[voltsandjolts]

OK, my SSR scan card seems to be working nicely, for 2w and 4w measurements.
I'll add some comments to the code and tidy the schematic.

Note that the 34901A card allows multiple channels to be closed at the same time, my card doesn't support that mode.
In 2w mode, only one of the 20 channels can be closed at any one time.
In 4w mode, the channel pairing works as it should, so one channel from each 'bank' is closed.

Note also my card doesn't have hardware implemented for ch21/ch22 current measurement.
Neither does it have the cold junction tempertaure sensors, but you can use an RTD instead (see 34970A manual), although that uses up one channel.
Scaling for the CJ measurements sent to the dmm is not yet fully understood.

I think this is the first 3rd party card for the 34970A/34972A.
Since the dmm and cards are obsolete, this might breathe a little more life into them.
The card is SSR so nice and quiet but with the protocol documented its easy enough to make your own custom card if you prefer armature, or want to add any of the missing features.

Thank you for your help H.O.

[voltsandjolts]

The scaling for the reference juctions is weird. It's not the 12bit format shown in the datasheet because the card returned values where the low 4 bits are not all zeros. My initial value of 125/32000 does not quite match, neither does 125/32768. My (genuine) card returns 0x17E4 for a reported temperature of 23.0156°C but the above scale factors eqauls 23.89 or 23.33. Like you say, there does not seem to be any calibration data transfered from the card.

I programmed my card to return that same value 0x17E4 and expected to see the same temperature reading as you. Nope! 
I got 16.464°C from my 34972A

I am confused about this, it's as if the calibration is somehow transferred to the dmm, but I still have not seen that on the uart bus.

Edit:
I am reading CJ temperature using these remote commands:
inst.query('SENS:TEMP:RJUN? (@305)')   #bank1 CJ
inst.query('SENS:TEMP:RJUN? (@315)')   #bank2 CJ

How are you reading the CJ?
Maybe you're shorting the channel input and reading temperture from the channel?

[strawberry]

''These adjustments are plug-in module specific and only affect thermocouple
measurements. The calibration constants created by these
adjustments are stored in non-volatile memory on the plug-in module.''
p112-113
could see eeprom cal data while requesting temp
DS75 max 2degC error

[voltsandjolts]

could see eeprom cal data while requesting temp

I thought that any cal data would get read at power-on but don't see it there.
Maybe I'll try a long one minute capture just to be sure.

I also looked for it upon the first CJ reading after power-on but again I didn't see anything.

But yeh, it must be there somewhere, I just need some more time on it but can't right now.