HP 3457A 8051 A/D controller replaced - Page 1
Forum section: electronics / repair

author: tppc
author_rank: Regular Contributor
timestamp: May 04, 2018, 08:39:03 am
content: Hi all,I salvaged a nice clean Hp3457A from destruction.The bad news is that the A/D hybrid U511 seems to be destroyed. (voltage at pin 1 never crosses 0).All other signals on U511 pins seem to be OK, including slope selection and RUNUP signals at pins 6,7,8,9.Yesterday, while probing with an oscilloscope, the A/D controler U501 started overheating.I probably destroyed it by making accidental unwanted short.So now, the question is : does anyone know where to find the following parts at reasonable price :- 1QF6-0066 A/D hybrid (A2 U511)salvaged one from a HP 44701A PCB-1820-3549 P8051 MASKED (A2 U501)Replaced with AT89C51 + reverse XTAL1 & XTAL2pins (see last post)or-03457-66502 PCB Analog assembly (used)Thanks for your helpKind regards

author: tautech
author_rank: Super Contributor
timestamp: May 05, 2018, 01:07:02 pm
content: Place a listing for those bits here too:https://www.eevblog.com/forum/buysellwanted/

author: Jwalling
author_rank: Unknown
timestamp: May 05, 2018, 03:35:12 pm
content: Quote from: tautech on May 05, 2018, 01:07:02 pmThat might be considered double posting...

author: ch_scr
author_rank: Frequent Contributor
timestamp: May 05, 2018, 04:07:11 pm
content: The HP44701A uses the same A/D hybrid 1QF6-066. These HP44701 show up from time to time cheap on Ebay. The P8051 is called 1820-4881 in my unit.

author: tppc
author_rank: Regular Contributor
timestamp: May 05, 2018, 10:07:28 pm
content: Hi all,thanks for your answers. As suggested by tautech, I placed a post in the Buy/Sell forum.@ ch_scr, thanks for this valuable information. I knew the 1QF6-0066 A/D hybrid was used in the 3457A, 3468 and 3478 but I didn't know it was used in the HP44701 too.This is very good news since these HP44701 seem to be very cheap on eBay.Again, thanks for this information.As for the P8051 used in the HP44701 I am not sure it uses the same mask ROM program as the one in the 3457a.can anyone confirm this last point?Thank you very much.

author: ch_scr
author_rank: Frequent Contributor
timestamp: May 06, 2018, 06:59:00 am
content: Well, information on the HP44701A is very sparse, if I did not have a picture from the inside of mine handy, i would have not been able to tell. Would love a component level service information on that one. I checked the SM of the 3457A, 3468A & 3478A.3468A seems to use a ins8039n with external eeprom; all floating, interface, display and all.3478A uses the 1820-2726 with transformer coupling, one TX and RX channel to the ground referenced side.3457A uses the 1820-3549 with optocouplers, one TX and RX channel to the ground referenced side.44701A uses the 1820-4881 with 4 Optocouplers, there is some kind of convoluted logic on the other side to make it into a parallel bus communication.I believe it is safe to assume it would not be compatibleI suspect they all use the same P8051 but different masked rom.

author: tppc
author_rank: Regular Contributor
timestamp: May 06, 2018, 07:43:57 am
content: I didn't find any schematics for the 44701A either.Well at least you found me a cheap source for the 1QF6-0066 A/D hybridhopefully I'll find a source for this P8051 tooKind Regards

author: tppc
author_rank: Regular Contributor
timestamp: April 06, 2019, 01:25:04 pm
content: Hi all,I am still fighting to revive my second HP3457aAs suggested here, I bought a used 44701a board and salvaged the A/D converter 1QF6-0066.Unfortunately, this didn't help, since the A/D controller (A2 U501) seems to be faulty.When I power it up, it shows :ADDRESS-22and immediately after, it showsFAILEDit does not beep and the keyboard does not respond except theRESETkey.If I press RESET, it beeps and restarts but does exactly the same thing.The main controller board (03457-66511) works fine, I tested it on my other HP3457a.I also suspected the communication between the main controller A11 U601 and the A/D controller, replaced optocouplers A2 U509 + A2 U510 +A2 Q501 + A2 U502, it did'nt help.As far as I know, A2U501 is a masked ROM P8051.Is this something that could be "cloned" ?I mean, somehow read the program from a good one, buy a blank programmable one and somehow flash it ?Thanks for your helpKind regard

author: coromonadalix
author_rank: Super Contributor
timestamp: April 06, 2019, 06:41:29 pm
content: It could be read if there is no security bits involved

author: picburner
author_rank: Frequent Contributor
timestamp: April 07, 2019, 05:34:31 am
content: If you can read the p8051 rom then you could use an AT89S51 that is pin to pin compatible and has a flash instead of a mask rom (if the code is equal or lower than 4K, naturally).

author: tppc
author_rank: Regular Contributor
timestamp: April 07, 2019, 09:02:28 pm
content: Hi all,thanks for this information. I have very limited knowledge about microcontrollers.What hardware and software do I need to program an AT89S51?Kind Regards

author: feedback.loop
author_rank: Frequent Contributor
timestamp: April 08, 2019, 01:40:07 am
content: For instance, cheap TL866 programmer can do it. They are sold all over eBay, but with different sets of adapters. Make sure you have 44PLCC adapter.However, if yours is dead, I would not hope to be able to read it. Even if it were alive, it might have had a special read protection mode enabled. I would suggest to find the ROM dump (if they exist at all) before you spend money on a programmer.

author: coromonadalix
author_rank: Super Contributor
timestamp: April 08, 2019, 10:31:53 am
content: buy the old tl866 version not the "plus" for future usage, the newest model "plus" goes up to 18volts not 21 as the old model.

author: tppc
author_rank: Regular Contributor
timestamp: April 09, 2019, 05:10:53 pm
content: Hi guys,thanks for your answers.Well, it looks like I won't need to buy any programmer, since the security bits are most likely set.I have a second 3457a in good working condition.Maybe some day, I'll take time to desolder both controllers and try to swap them... I don't know yet.Kind regards

author: tppc
author_rank: Regular Contributor
timestamp: April 13, 2019, 12:24:33 pm
content: Hi guys,I suggested I could desolder the A/D controllers from my HP2457A DMMs… and so I did!Here is the result :The known good DMM equiped with the suspected bad A/D controller reacts exactly as the bad one.ADDRESS-22FAILEDI didn't try the known good controller in the bad meter (too scared to burn the good controller).Well, at least, now I know for sure that the A/D controller (A2U501) is dead.Now, the question is :- If I buy the TL866 programmer, how do I know if the lock bits are set? and is there a risk that I screw up the good P8051 while trying to read it on the TL866?Regards.

author: coromonadalix
author_rank: Super Contributor
timestamp: April 13, 2019, 12:37:57 pm
content: well if the bits are set normally you wont be able to read it, and put it back in the meter it should still work okay, but if you desolder it or simply remove it from a socket, take anti static precautions.

author: tppc
author_rank: Regular Contributor
timestamp: April 13, 2019, 01:01:58 pm
content: I already desoldered it and installed a socket in the meter. This allows me to swap the controllers.To be honnest, I Don't have anti static straps, but you are right, I will get one and use it on my next experiments.Thanks for your help.

author: Kleinstein
author_rank: Super Contributor
timestamp: April 13, 2019, 01:09:22 pm
content: With a new programmer, a first thing would be to test it with some less critical parts.The main danger to the chip would be from ESD and wrong connection / setting at the programmer (e.g. wrong supply).If it is an really old chip chances are there may not even be protection bits on the chip available.

author: tautech
author_rank: Super Contributor
timestamp: April 13, 2019, 01:17:26 pm
content: Quote from: tppc on April 13, 2019, 01:01:58 pmA little guidance from Defpom about how he reprogrammed an HP chip:Programmer:https://youtu.be/VDg1dgE4AFk?t=390The doing:https://youtu.be/xhbnW1zHTX8?t=1169

author: tppc
author_rank: Regular Contributor
timestamp: April 13, 2019, 01:50:22 pm
content: Quote from: Kleinstein on April 13, 2019, 01:09:22 pmHere is a picture of the good controller installed back in the good meter with a socket.Is it old enough to be sure no protection bits involved?@Tautech,thanks for the links, I will watch the videos.Regards

author: tppc
author_rank: Regular Contributor
timestamp: April 28, 2019, 12:17:44 pm
content: Hi all,I found what seems to be a backup of 3457A A/D controller binaries.http://bbs.38hot.net/thread-756595-1-1.htmlUnfortunately, it is on a Chinese Website and I can't download it.Even with Google translate I can't find out how to subscribe and how to gain access to this file.Can anyone help?(please see attached screenshot)Thanks for your help.

author: picburner
author_rank: Frequent Contributor
timestamp: April 28, 2019, 01:22:42 pm
content: Here are the two files from the posted link:

author: tppc
author_rank: Regular Contributor
timestamp: April 28, 2019, 01:36:38 pm
content: oh waaaaouh! That was fast!Thanks very much.Hope it is the actual program and not a fakeAnyway, Iwilldidorder the TL866 programmer andan5AT89S51 today.I will let you know if it works when I receive my programmer.Again, thank you very much!

author: picburner
author_rank: Frequent Contributor
timestamp: April 28, 2019, 01:56:33 pm
content: I notice now that the file (...p8051.zip) is more than 8KBytes long while the AT89S51 cpu has a Flash memory of 4KBytes only.The content of this file from 1000h to 203Fh is all 0FFh, you probably need to reduce the file size when loading it intothe eprom-programmer.

author: tppc
author_rank: Regular Contributor
timestamp: May 04, 2019, 06:54:21 pm
content: Hi there,I received my TL866 programmer today.Unfortunately the µC's AT89S51 didn't arrive yet.Anyway, I couldn't wait any longer, so I played with the TL866...Tried to read the fried 8051AH ->FAILED"OverCurrent Protection! External short or IC reverse or incorrect package!"Tried to read a C8751H (UV ROM) pulled from my 44701A ->FAILED"OverCurrent Protection! External short or IC reverse or incorrect package!"Tried to read the 8051H extracted from my other HP3457A (in good working condition) and guess what…the dump is identical to the backup I found on the Chinese site (once again, thanks topicburner).Looks like I will revive my second HP3457ABy the way, will the AT89S51 work exactly as the P8051AH?I mean, is there any chance that the meter somehow reads the chip ID? (which may differ from the 8051AH)Regards.

author: Kleinstein
author_rank: Super Contributor
timestamp: May 04, 2019, 06:59:29 pm
content: I would not expect the meter software to read the chip ID. At the time the meter was build, there where little alternatives to the Intel original and clones where not that much of a problem. So I see no real sense in checking the chip ID. There are more useful things to do with the limited code memory of the 8051.

author: tppc
author_rank: Regular Contributor
timestamp: May 04, 2019, 07:50:12 pm
content: OK, that makes sense.I hope I will receive the AT89S51 in the next days. I will let you know if it works.To be honnest, I was convinced that the lock bits were set and therefore it would be impossible to dump the code.Can't wait to receive the new chips!

author: picburner
author_rank: Frequent Contributor
timestamp: May 05, 2019, 09:05:13 am
content: The AT89S51 has been used successfully to replace the P8051AH of the display/keyboard controller in the HP 34401A DMM also, so you should have no problems.

author: tppc
author_rank: Regular Contributor
timestamp: May 05, 2019, 09:36:24 am
content: Thanks for this information.I am more than confident since I dumped the code from my working P8051AH and found it to be identical to the backup you uploaded for me.I played with the programmer and it automaticaly trims the excess bytes, anything over 0FFFh is ignored.I also tried to burn this code to an old 2864 EEPROM I had in my old parts tray with no problems at all.Thanks for your help, I will search the topic you mentioned about the AT89S51 used in a HP 34401A.This might be an interesting reading for meRegards.

author: tppc
author_rank: Regular Contributor
timestamp: May 08, 2019, 12:16:46 am
content: Hi guys,today I received my AT89S51's, burnt 1 with my dump an 1 with the Chinese site dowloaded backup and guess what, it does NOT work!I mean, I can program the chips, but they don't work in the DMM.I tried them in both my 3457A's with the same result :ADDRESS-22FAILEDI found some information in an Intel document called "8051, 8052 and 80C51 Hardware Description" about encrypted Verify and lock bits...(Please see attached Screenshot)It looks like HP used the Encrypt ArrayI am not an expert, but I tried to disassemble the dump using larry2917's8051DisassemblerWin10and the result doesn't make any sense to me…maybe due to the fact that the dump actually IS encrypted, but again, I am not an expert in assembly.At this point, I think that it is hopeless!What dou you think?

author: lordium
author_rank: Regular Contributor
timestamp: May 08, 2019, 01:12:14 am
content: The "failed" message suggest that it is either the master processor, slave processor or communication isolation circuitry (service manual section 3-6).Have you checked the optos?

author: tppc
author_rank: Regular Contributor
timestamp: May 08, 2019, 07:22:28 am
content: yes, I did check the optos. I did even swap the boards with my second unit.The master processor board is OK.The problem comes from the slave processor not responding as expected.

author: tppc
author_rank: Regular Contributor
timestamp: May 10, 2019, 05:58:22 am
content: Hi guys,To make a long story short, we have :- 1 original P8051 working (programmed with encryption table)- No idea of the encryption table content (not possible to read)- The dump of the code area (encrypted)Is there a chance to duplicate this 8051 or is it definitelyGAME OVER?Regards.

author: Ordinaryman1971
author_rank: Frequent Contributor
timestamp: May 10, 2019, 02:53:06 pm
content: With TL866 I think there is an option to ignore... or not read the chip id so you should be fine.

author: picburner
author_rank: Frequent Contributor
timestamp: May 10, 2019, 04:12:42 pm
content: I disassembled the code posted with IDA Pro and looking at the disassembled code list (the attached file) it seems to me that the code is not encrypted.From what I understand encryption would prevent reading through an external program.If the p8051bh lock bits were set you could not read the contents of the MCU internal ROM.Where did you buy the at89s51?Do you have the chance to try it in another circuit?

author: tppc
author_rank: Regular Contributor
timestamp: May 10, 2019, 06:07:54 pm
content: Quote from: picburner on May 10, 2019, 04:12:42 pmOk, thanks for the effortQuoteNot the encryption, butLB1(if programmed)QuoteCorrect, but (as I understood), the Encryption array (32 bytes), if set to anything else than 0xFFs will produce an encrypted dump independently from the Lock BitsQuoteI bought them from Reichelt :https://www.reichelt.com/fr/fr/index.html?ACTION=446&LA=446&q=89s51It is the DIL40 version. I have 5 of themQuoteI think not, unfortunately, I don't have any other piece of equipment using an 8051.Thanks for your help.

author: picburner
author_rank: Frequent Contributor
timestamp: May 10, 2019, 06:50:04 pm
content: QuoteQuoteI didn't intend read the mcu rom with an eprom-programmer, but through the processor itself.Through a debug code in an external ROM and some hardware you can try to read step by step the contents of the internal ROM, in my opinion the encryption serves to avoid this.

author: tppc
author_rank: Regular Contributor
timestamp: May 10, 2019, 08:52:30 pm
content: OK, now it's clear.I did some tests with the TL866 and a spare AT89s51 :- with LB1 programmed, I can still read the code area (with the programmer)- with LB1 + LB2, I can read, but it shows all FF FF.....Unfortunately, the AT89S51 does not seem to offer the Encrypt Array functionality (the Encrypt tab does not show in the XGpro interface)-> I can not test encryption.

author: lordium
author_rank: Regular Contributor
timestamp: May 11, 2019, 05:56:44 am
content: The AT89s51 does have an watchdog enabled by default which the original p8051bh does not. Did you disable this function?"4.7 RSTReset input. A high on this pin for two machine cycles while the oscillator is running resetsthe device. This pin drives High for 98 oscillator periods after the Watchdog times out. The DISRTO bit in SFR AUXR (address 8EH) can be used to disable this feature. In the default state ofbit DISRTO, the RESET HIGH out feature is enabled."

author: tppc
author_rank: Regular Contributor
timestamp: May 11, 2019, 08:03:46 am
content: Hum, that's a very good point!On the other hand, as I understood, the WDT default is Disabled (not sure I got it right)"7.Watchdog Timer (One-time Enabled with Reset-out)[...]The WDT is defaulted to disable from exiting reset. To enable the WDT, a usermust write 01EH and 0E1H in sequence to the WDTRST register (SFR location 0A6H)."I just flashed the 8051 dump "as is" to the AT89S51 without changing anything.In fact I don't have any assembly programming software.I will Google it and try to figure out how I can change this code to disable the reset out feature.I may as well order a 89C51 which does not have built-in WDT.Thanks for this hint

author: tppc
author_rank: Regular Contributor
timestamp: May 29, 2019, 08:28:11 pm
content: Hi guys,today I received 5 Atmel AT89C51-24PI ordered 3 weeks ago from the bay.This version does not have built-in WDT.I immediately burnt 1 with the same dump.No success!I tried it on both my 3457 units, still the same result :ADDRESS-22FAILEDThis makes me believe that the dump actually is encrypted.I think there is nothing more I can do.GAME OVER!Regards.

author: tppc
author_rank: Regular Contributor
timestamp: May 31, 2019, 12:17:25 pm
content: Hi there,I have to confess that I have a hard time accepting the idea of throwing away a great multimeter just because a $1 8051 controller is unobtainium!So, I took some time to probe every pin of the 89C51 (programmed with the dump from my other 3457A).Except XTAL2 pin 18 (12MHz), all other pins are static!Even ALE (pin 30) which is supposed to be 1/6th of the osc clock -> 2MHz is constant 0V.RESET (pin 8 ) is low (constant 0V)RXD (pin 10) receives data from the main controller (normal 0v - 5V)TXD (pin 11) is high (constant 5V).It looks like the program in the 89C51 does absolutely nothing.And, yes, I tried it on my working unit, -> same result.Does anyone have a suggestion before I definetely close the cover of this defective 3457A unit?Regards.

author: coromonadalix
author_rank: Super Contributor
timestamp: May 31, 2019, 02:23:33 pm
content: I dont think your programmer tl 866 if i recall did a good job ? It may simply not adequate for the jobIf you did a good dump with the same config bits, and reprogrammed a good one, it should work, unless with more recent c51 model(s) you have to adjust some config bitsfor the 8051ah, im gona check, i think we used theses cpu longtime ago, we may have some left ...

author: MadTux
author_rank: Frequent Contributor
timestamp: May 31, 2019, 02:44:11 pm
content: If you send me one of those 89C51s to Switzerland, I could try if I get it programmed/working in one of my 3457A. Probably have to put the 3457A inguard uC onto a socket, since it's soldered.I have accumulated a few oldish programmers, like some Willem programmers and GALEP3, one of them should probably do the job.

author: coromonadalix
author_rank: Super Contributor
timestamp: May 31, 2019, 04:48:11 pm
content: Nope sorry, we have only 80c31 leftGonna check at home if i have a few somewhere else ... i have a huge box full of old parts stuff

author: tppc
author_rank: Regular Contributor
timestamp: June 01, 2019, 12:37:29 am
content: Hi guys,First of all, thanks for your help !I am not sure that the problem is in the programming with the TL866, for the Following reasons :1. I can read the good 8051AH and the dump is identical to the one found on a Chinese forum.(Verified with the TL866 XGPro software and also with the compare plugin in Notepad++)2. When I program an 89C51 and then compare it with the 8051AH on the TL866, it says they are identical.Also the dump of the 89C51 matches the dump of the 8051AH.My feeling is that HP used the encryption table built in the 8051AH.(please note this extract of the 8051 user manual)Encryption Arraw Within the EPROM is an array of encryption bytes that are initially unprogrammed(all 1s). The user can program the array to encrypt the code bytes during EPROM verification. The verification procedure sequentially XNORS each code byte with one of the key bytes. When the last keybyte in the array is reached, the verify routine starts over with thefirst byte of the array for the next code byte. If the key bytes are unprogrammed, the XNOR process leaves the code byte unchanged. With the key bytes programmed, the codebytes are encrypted and can be read correctlyonly if the key bytes are known in their proper order.If this is the case, it means that each byte in the dump of the 8051AH is encrypted (XNORed with a byte of the key array).To retrieve the real program code actually executed by the 8051AH, we should XNOR the first byte of the dump with the first byte of the key table, 2nd byte of the dump with the 2nd byte of the key table and so on.The problem is that we don't have the content of the key bytes and it is not possible to read it by no means.This said, I might be wrong, and I agree to test with older parts or programmers.I can also send you a 89C51 and a 89S51 if you are willing to do some tests as suggested.Thank you guys!

author: LateLesley
author_rank: Frequent Contributor
timestamp: June 01, 2019, 01:07:57 am
content: In case it is helpful, before I realised you'd got the files, I did a bit of googling, and found this -https://doc.xdevs.com/article/hp-agilent-keysight-tm/I'm just posting it, in case it is helpful to anyone.

author: GregDunn
author_rank: Frequent Contributor
timestamp: June 01, 2019, 02:34:02 am
content: I recommend visiting the HP support group onhttps://groups.io/g/HP-Agilent-Keysight-equipment/topics.Among the members of the group are some former HP design engineers and a lot of people experienced in working with these older meters. If no one on that group can help you, then it truly is a lost cause.

author: picburner
author_rank: Frequent Contributor
timestamp: June 01, 2019, 08:23:17 am
content: Quote from: tppc on May 31, 2019, 12:17:25 pmThis is a signal that there is another problem upstream that does not depend on the code.Even with a virgin processor (not programmed) on the ALE pin you must have the clock/6, in your case 2MHz.

author: picburner
author_rank: Frequent Contributor
timestamp: June 01, 2019, 09:16:03 am
content: From a check I made:With reset activated (pin 9 to Vcc) ALE go to Vcc (it actually goes Hiz, but there is an internal pull-up), so this is not the case.The only case (apart from a broken processor or a short to GND) in which ALE=0V (GND) is if the 5Vcc to the processor is missing.Even for an 8031 romless without connecting an external rom ALE works like this.I imagine you removed the original processor and inserted a socket.Isn't it by chance that you pulled away a pcb metalization of a pin and you miss a link now?

author: tppc
author_rank: Regular Contributor
timestamp: June 01, 2019, 05:51:38 pm
content: Hi there,Thanks for your replies, sorry for the delay, it took time to do some more probing. For the 100th time, (probably more) I opened the cover of the good 3457A just to make sure there is not another problem upstream as suggested bypicburner.From the 589C51I received,- All are markedAtmel AT89C51 24PI 1802Aon topOn the underside :- #1 is marked8H0918-19651H 1KOREA-H 8H9852- #2 is marked8H1902-19651H 1KOREA-H 8H9852- #3 is marked1G4884-19651L 1-J 1G0147 CHINA- #4 is marked2H1 243-19651L 1-J 2H0236 CHINA- #5 is marked4H2299-19651P 1-P0443 TAIWANQuote from: picburner on June 01, 2019, 08:23:17 amAll following tests were done on the good meter :- With chip #1 Erased (and verified blank), RESET is maintained high and ALE is always low (constant 0V)- With chip #2 Erased (and verified blank), RESET stays low and ALE is always low (constant 0V)- With chip #3 Erased (and verified blank), RESET is maintained high and ALE is randomly constant 0, or constant 1 (I power cycled it many times)- With chip #4 Erased (and verified blank), RESET is maintained high and ALE is always 1- With chip #5 Erased (and verified blank), RESET is maintained high and ALE is randomly constant 0 or constant 1 (I power cycled it many times)- With chip #1 programmed (and verified), RESET stays low and ALE is always low (constant 0V)- With chip #2 programmed (and verified), RESET stays low and ALE is always low (constant 0V)- With chip #3 programmed (and verified), RESET is maintained high and ALE is randomly constant 0 or constant 1- With chip #4 programmed (and verified), RESET is maintained high and ALE is always 1- With chip #5 programmed (and verified), RESET is maintained high and ALE is randomly constant 0 or constant 1None of these tests showed a 2MHz signal on ALE.I think RESET is maintained high by the main controller because it does not receive any byte on the serial input port (89C51 not responding)(see attachments 1 & 2)I do not understand why this is not the case with chips#1and#2since none of the 5 chips does send anything on TXD pin (verified with oscilloscope)Quote from: picburner on June 01, 2019, 09:16:03 amI found this in the 89C51 dtatasheet :"If desired, ALE operation can be disabled by setting bit 0 of SFR location 8EH. With the bit set, ALE is active only during a MOVX or MOVC instruction."...Yes, I did install a 40 pin socket on both my meters.The original processors were carefully desoldered with a JBC vaccum desoldering station.None of the connections were damaged. I double checked the Vcc on pin 40, no problems at all.Quote from: LateLesley on June 01, 2019, 01:07:57 amHi LateLesley,thanks for the link, they don't have the binaries for the 3457A yet...maybe some day...Quote from: GregDunn on June 01, 2019, 02:34:02 amI had a quick look at the link, didn't have time to post a message there, but I certainly will.Thanks for this information.And finally, I wanted to share an old trick with you.Printing a sticker with pin numbers and signal names helps probing.No more need to count the pins(please see last attachment)

author: picburner
author_rank: Frequent Contributor
timestamp: June 02, 2019, 08:25:53 am
content: QuoteTrue, I didn't consider this hypothesis because in the HP3457A schematic the 2MHz are there.I did this test also using both an AT89C52 (I don't have AT89C51 available) and a SC87C51CCF40 mounted on a development board (I don't have an HP 3457A):applying a pulse train on pin 10 (RXd) pin 2 changes from state H to state L and remains in this state until a reset.On pin 11 (TXd) I get a train of pulses in response to what I send on pin 10 (RXd).Apparently the code would seem to work because I repeated the test several times switching the system off and back on and gettingalways the same result.To make a more serious test I should connect my TLA 715 but I would need the HP3457A alsoP.S. Nice idea the label on the processor.

author: tppc
author_rank: Regular Contributor
timestamp: June 02, 2019, 08:59:47 am
content: Humm,looks like I will prepare to visit Italy with my 3457A Under one arm... and a french baguette under the second armQuote from: picburner on June 02, 2019, 08:25:53 amVery interseting! I wonder why I dont get any response on pin 11 (TXD).BTW, I ordered 2 UVPROM 87C51...Thanks very much for all your efforts

author: picburner
author_rank: Frequent Contributor
timestamp: June 02, 2019, 09:02:33 am
content: If you want I can send you these two processors, these at least give some signs of life.

author: tppc
author_rank: Regular Contributor
timestamp: June 02, 2019, 09:29:13 am
content: thanks for the proposal, I will wait to receive the 87C51.I think I know why I don't get the same results :it is probably due to U502 constantly resetting the 89C51.Also, I had a look at the disassembled code and didn't find much consistent use of the SBUF register.Also the SCON register is only used once and loaded with 0x92 I didn't find out yet if this corresponds to the desired mode and baudrate (187k).If not, then in my opinion, it would indicate that the dump is encrypted.Regards.

author: picburner
author_rank: Frequent Contributor
timestamp: June 02, 2019, 09:46:29 am
content: If you order an 87C51, however, take the FA or FB version those with an eprom > 4KBytes.I would not like, at this point, that the strange size of the original code (8,256KBytes) had a particular reason.

author: tppc
author_rank: Regular Contributor
timestamp: June 02, 2019, 10:42:02 am
content: The 8K of the chinese dump are not a problem at all.When I dumped my functional 8051AH controller, I also got a file with 64 bytes over address 0xFFF (all FFs).All bytes are identical to the chinese dump except that mine stops at address 0x103F which is already over the 4K area.(see attached Screenshot)Anyway, when you load the dump, the programmer ignores anything over 0xFFF.(see 2nd Screenshot)BTW, I ordered yesterday : 1 SC87C51CCF40 + 1 SC87C51CBF40, but I can also order an FA or FB version, they don't cost that much.Regards

author: picburner
author_rank: Frequent Contributor
timestamp: June 04, 2019, 09:10:30 pm
content: Quote from: tppc on June 02, 2019, 09:29:13 amFrom a check I made in the asm-list previously posted I found 12 instances of SCON and 4 of SBUF.I didn't understand why but Ida Pro, although I specified 8051 as a processor, it used an 80C517 that has two serial ports.So SCON became S0CON and SBUF became S0BUF.However the "mov SCON, #0x92" instruction configures the serial port in MODE 2 and with a clock/64 the baud rate is just 187,5K!The code is perfectly unencrypted!

author: tppc
author_rank: Regular Contributor
timestamp: June 04, 2019, 11:33:24 pm
content: Hi there,Quote from: picburner on June 04, 2019, 09:10:30 pmYes, you are absolutely right!As suggested here, I had a talk on the same subject on the HP-Agilent-Keysight group and we came up with the following :Encryption array was implemented only on the EPROM versions 8751 - 87C51 not on the masked ROM 8051AH.I found out that on CMOS versions 87C51, 89C51, ... when using an external oscillator, it must be wired to XTAL1 while XTAL2 is left unconnected.It happens that the 3457A as it was designed to use an 8051AH has the external oscillator connected to XTAL2 while XTAL1 is grounded!I did a quick dirty little mod to swap XTAL1 & XTAL2 and Tadaaaa...My meter works with an AT89C51!It took me 2 months to reverse 2 pins!Thanks to all contributors for your help.

author: coromonadalix
author_rank: Super Contributor
timestamp: June 05, 2019, 01:46:20 am
content: congrats, this thread may help others ...

author: tppc
author_rank: Regular Contributor
timestamp: June 05, 2019, 07:04:28 am
content: Hi there,when I get home tonight, I will try with an AT89S51 version just to make sure there is no Watch Dog Timer issue as suspected in earlier posts.When I finaly had the meter working yesterday, it was much too late (or too early this morning) to test the S version.I will let you know if it works.I now have 10 controllers + 2 UV EPROM version (not delivered yet) and no idea of what to do with themRegards.

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2019, 10:43:57 am
content: Lol and congratulations for not giving up and getting it working evenually.It's mostly such small things that are totally evil and hard to find.

author: tppc
author_rank: Regular Contributor
timestamp: June 05, 2019, 07:51:31 pm
content: Yep, it works with the AT89S51 too.Regards.

author: MadTux
author_rank: Frequent Contributor
timestamp: June 05, 2019, 08:45:20 pm
content: Quote from: tppc on June 05, 2019, 07:04:28 amYou could program them for the HP3457A and sell them as programmed and tested 3457A replacement parts on ebay.Might require a bit of patience/waiting, but might get you the most money out of them.

author: wiesl
author_rank: Contributor
timestamp: May 24, 2020, 06:31:36 pm
content: Quote from: tppc on June 04, 2019, 11:33:24 pmI think i can clarify the behaviour:With HMOS process (8051AH):- HMOS process (High density short channel MOS (nMOS) process)- Datasheet:- XTAL1: Input to the inverting oscillator amplifier- XTAL2: Output from the inverting oscillator amplifier, internal clock source- XTAL1 Pin 19: GND => Inverter => XTAL2 is open Drain, so XTAL2 is pulled up which is ok and original circuit works well- XTAL2 Pin 18: Oscillator output => Input oscillator pulled up by internal inverter and connected to internal clock source- since XTAL2 is only pulled up by the nMOS process the schematic works well (but is not recommended to do it in that way)With CMOS processes (AT89C51/AT89S51):- Datasheet:- XTAL1: Input to the inverting oscillator amplifier, internal clock source- XTAL2: Output from the inverting oscillator amplifier- XTAL1 Pin 19: GND => Inverter => XTAL2 is pulled up hard by pMOS transitor, so input clock from oscillator will be killed by 2 driving forcing working against ...- XTAL2 Pin 18: Oscillator output => Input oscillator pulled up hard and therefore input clock will be killed while connected to internal clock sourcePage 30/31 discusses it in detail.http://newit.gsu.by/resources/CPUs/i8051/Describe/270252.PDFVery unclear that the changed the internal clock source in the CMOS version without preserving backward compatibility ...wiesl

author: wiesl
author_rank: Contributor
timestamp: March 16, 2021, 02:14:15 pm
content: Anyone made some experiences here?