Adventures in Retrocomputing: hacking a 7.5 digit HP 3456A - Page 1
Forum section: electronics / testgear

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 01, 2018, 10:47:45 pm
content: There was a discussion a couple months ago in the Metrology section about the 3456A actually measures 7.5 digits but only outputs 6.5. So how can you get that extra digit? Not knowing any better, I thought "How hard can it be?"Here's the result. The exponent digit has been hijacked to display the extra digit:And, on startup:Just to let you know you don't just have an ordinary 3456A...Theattached zip filehas the details. It contains:HP3456A_Firmware_Notes.docx, with details of the relevant code changes and resourcesu7.bin, the original firmware imageu7.sym, the symbol file for the disassembleru7disassembled.asm, the original firmware disassembledu7commented.asm, the firmware with comments added and a lot of unnecessary jumps and branches removedu7modded.asm, above with modifications for 7.5 digit outputu7modded.bin, assembled version of the aboveThe Outguard microprocessor does most of the work and is a Motorola 68A00, a 1.5 MHz version of the 6800. The firmware is about 22KB of code and 2KB of data. The code certainly appears to be the output of a compiler, and in the day HP had the 64000 Logic Development System that had available Pascal and C compilers for the 6800. I took out right about 1000 bytes of unnecessary jumps and branches in an attempt to untangle the code and make it more readable. I broke something in the Auto Range that causes the display to freeze under certain conditions. Not much other testing has been done, so there could be other problems.The Inguard and Outguard processors communicate through two, one-way serial links. Here's a breakdown:The Outgard sets the measurement mode by sending four bytes to the Inguard. It looks like these bytes provide low-level details to the Inguard such as FET switch settings and such, but I haven't decoded those commands.To replace the firmware I used a SST39SF010A 128Kx8 flash ROM. It's four times the needed capacity, but the smallest 5V DIP that Digikey stocks. I did an adaptor board that's a little different than solutions I've seen elsewhere:Most of the signals are taken directly from the unstuffed U2 position. A12,13,14 are taken from jumper positions 6,4,8, respectively. The ROM Select signal is taken from pin4 of U6. On this adapter, A15 and A16 are tied to ground, but I realized later that a switch could be added to +5V, both original and modified firmware could be put in the ROM, selectable by the switch position. When trying code modifications there was often the question of whether the meter was acting normally. Flipping a switch would have saved time over switching ROMs.Here's the results from letting it run overnight measuring a lithium coin cell. Readings were taken at about 10 second intervals. Temperature came from a LM35 placed on the bench under the 3456A, read by another meter.I have no idea what happened in the middle of the night. Air Conditioning was off, there are no other fans running, nothing else was powered. My best guess is something suddenly caused the 3456A to emit less heat. It's a unit I bought non-functioning, so it very well could have other problems to sort out.Anyway, here's the middle data on an expanded scale:Set to 10 PLC integration, here are the results from 1000 consecutive readings:This particular meter is moving around quite a bit, so it will take some more work to figure out if this extra digit provides any additional information. This scatter does look promising, though.I've got a bunch of other things on the To Do list that need to be done before I can descend into volt-nuttery, so though I'd put this out in case anyone else needs some "fun".One idea I'm wondering about is if the 3458A's multislope ADC algorithm is different than the 3456A's. There will be differences in the analog circuitry, but we now have the potential to change the operation of the digital control.Tim

author: chickenHeadKnob
author_rank: Super Contributor
timestamp: July 02, 2018, 02:57:22 am
content: Dude! you really went to town. That is a lot of hard work.QuoteAs far as I know the 3458 is much more elaborate, so unfortunately not much will carry over.

author: TiN
author_rank: Super Contributor
timestamp: July 02, 2018, 04:12:29 am
content: Amazing.How I'd wish you have 3458A, so we can add few functions to it as well (like show 8.5digit resolution in all OHM ranges, support external preamp for DCV to make <100mV ranges)

author: bitseeker
author_rank: Super Contributor
timestamp: July 02, 2018, 06:33:32 am
content: Very cool hack, Tim. I like the "HP 3456+" message. Nice touch.

author: AG7CK
author_rank: Regular Contributor
timestamp: July 02, 2018, 10:43:16 am
content: Very impressive.I am old and fearful and have decided that I only want to spy on the data. That means U22? Digital ground and a single pin? If so, which pin?Can I hook a MSP430 with level shifter or an Arduino directly to U22, or do I need a buffer?I have bought 8pcs 4inches tall common anode 7-segment displays for an external display similar to those HP sold in the 1970s or so. I will need to use an external power supply, so may be it would be better for me to sniff U22 isolated with opto-couplers.How would you go about for a minimum intrusion reading only of the inguard data stream?Thanks.

author: Kean
author_rank: Unknown
timestamp: July 02, 2018, 12:13:53 pm
content: Brilliant work Tim! Wish I had a 3456A to try it.Not that it helps, but I still have an HP 64000 Logic Development System in storage. It is only 33 years old, and apparently I've had it for 16 of those years.Last time I powered it up, it worked fine except for one of the four floppy drives, but that was probably about 10 years ago!I have the master workstation, a slave workstation, the 7911P HP-IB CS/80 28MB hard drive, and emulation pods for 8051, 8085, 8086, Z80, and I think TMS 32010. Plus a huge amount of documentation (6ft of shelf space). Unfortunately no 6800 stuff from memory.The hard disk is so loud you need to wear ear muffs when it is powered on (not quite angle grinder level), has a max transfer rate of 35 kB/s, and it alone weighs about 85kg. It has a 14" platter.Of course when I needed to do some similar dissassembly and commenting of some 8051 code a few months ago, I didn't even contemplate using the 64000. I just did it only my PC like any sane person.

author: chickenHeadKnob
author_rank: Super Contributor
timestamp: July 02, 2018, 04:38:57 pm
content: Quote from: Kean on July 02, 2018, 12:13:53 pmIs that the hard drive the size of a filing cabinet? We put those in a separate storage room back to back with the 64000 with the cable going through the wall for sanity. One day a tech discovered that if you wrote a simple macro which called itself the whole drive would start to shake in self resonance as the head was hammering back and forth, almost to the point of walking across the floor. He amused himself with this until the drive crashed

author: cellularmitosis
author_rank: Unknown
timestamp: July 02, 2018, 04:44:02 pm
content: https://www.themarysue.com/ibm-black-team/."The Black Team had found the fundamental frequency at which the cabinet would rock, and had programmed the tape to resonate. In mounting horror, matching the mounting amplitude, the programmer watch as the cabinet at first subtly, then clearly, and finally unmistakably began rocking ever more violently, until finally, inevitably, it fell over."Edit: excellent work, by the way, TimInCanada!

author: Kean
author_rank: Unknown
timestamp: July 02, 2018, 05:17:58 pm
content: Quote from: chickenHeadKnob on July 02, 2018, 04:38:57 pmYes, a small filing cabinet.It is the one to the right of the picture here, under the fancy touch-tone phone. I can understand putting it in another room.http://www.hpmuseum.net/display_item.php?hw=412Quote

author: Kleinstein
author_rank: Super Contributor
timestamp: July 02, 2018, 06:12:09 pm
content: The ADC in the 3458 is working a little different, though there is some similarity. One big difference is that the 3458 and most modern DMMs use a numerical cal adjustment, while the 3456 still uses pots and the ADC's output directly corresponds to the displayed digits, though there might be numerical corrections, especially for the offset.Changing a 22 k disassembled program is quite an effort - it would get even mode difficult and lengthy with longer code in the 3458, though at least 68000 K assembler is usually relatively well readable.

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 02, 2018, 06:48:48 pm
content: Hey, thanks for the comments, guys. Certainly appreciated.Quote from: TiN on July 02, 2018, 04:12:29 amI kind of wish I had a 3458A, too, but I'm alsoafraidof what might happen if I got one.Actually, getting the extra resolution can be a fairly simple add-on. The HP Journal article, page 37 says:QuoteThe '56A uses a factor of 10 between the integration slopes and the Inguard outputs 10's compliment BCD digits. The '58A uses a factor of 4 between slopes, so the Inguard is probably outputting straight binary. The fiber optic receiver output could be picked up and decoded for a separate display. Not very elegant for the long term, but the '58A is also measuring internally to 9.5 digits and these could be seen.

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 02, 2018, 07:21:40 pm
content: Quote from: AG7CK on July 02, 2018, 10:43:16 amHere's the relevant bit of schematic sheet 12:I was using a logic analyzer and picked off the two lines going into the shift register U22 to see what the serial protocol was. To make the display a little easier to program, I think I would pick up the parallel data between U20 and U22. The enable line on U22 (active low) is strobed when a byte of data is ready, so it could trigger an interrupt input on the microcontroller board. There will have to be some logic to decide between the handshaking bytes and data bytes.These microcontrollers have quite high input impedance on the digital inputs, so they wouldn't load the circuits in the 3456A. A level shifter for the MSP430 probably wouldn't cause significant loading, but it would be something to check. As long as the ground of the new display power supply is tied to the digital ground in the meter, optoisolators wouldn't be needed.One issue for a display is that the decimal position, exponent and exponent sign aren't given in the Inguard data. I believe they are inferred from the measurement mode the meter is in. I think the easiest way to get these would be to pick off the signals going to the meter's display.Four inch digits? Wow! Please post some pictures when it's going.Tim

author: bitseeker
author_rank: Super Contributor
timestamp: July 02, 2018, 11:46:16 pm
content: Quote from: TimInCanada on July 02, 2018, 06:48:48 pmOh, my. That sounds like a project begging to happen.

author: AG7CK
author_rank: Regular Contributor
timestamp: July 03, 2018, 01:54:31 am
content: Quote from: TimInCanada on July 02, 2018, 07:21:40 pmThank you very much for the explanation in your post. I know about the 9 digits - it is mentioned in the manual. They are however not readings - they are only intermediate math variables. The ADC samples a maximum of 7.5 digits and only when in 10NPLC mode. But when logging a stable voltage reference, I can present 8.5 digits for fun. The last digit will come from numerical averaging only.I will only log 10v DC, so my scanning auto-"parser" is only : Am I looking at readings and if so: Are they +9.x or +10.x? I have done the same for a HP 34401A, and the format is fixed by the sign/exponent part. Easy to subtract the readings.Nobody knows when the display will run. So I show the LEDs now. When finished they will be framed by 4 or 6 or 8x 1602 LCD displays showing No. of Readings, Min, Max, Average, StdDev, Moving Average, Percentiles 50, 75 and whatever. All this will be real time (using 2 or more uCs) and can be checked relative to the static Math function in the instrument (if one is disciplined with the same dataset being used for the calculations). A graphical display can also be added on top.Thanks again. Seriously good stuff.EDIT: Just checked them - they are 3 inches tall, not 4. My mistake.

author: bitseeker
author_rank: Super Contributor
timestamp: July 03, 2018, 03:57:39 am
content: Quote from: AG7CK on July 03, 2018, 01:54:31 amI don't think that'll be any less awesome looking.

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 04, 2018, 12:09:12 am
content: Quote from: Kean on July 02, 2018, 12:13:53 pmThanks Kean. I bought a box lot of test leads a while ago and in the box was a PROM module for the 64100A. The one that plugs in beside the keyboard. Now I just need every other piece of the system to fit it. Sort of an extra sad case of ESD: "Empty Slot Disorder - Refers to mainframe types of test equipment that have slots for functional modules or cards. Any empty slot must be filled by acquiring modules or cards, which leads to ESI." Got the module, now just need the mainframe and all the cards, probes, cables, software....Tim

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 04, 2018, 12:15:03 am
content: Quote from: AG7CK on July 03, 2018, 01:54:31 amThat sounds like a very interesting project. I'm glad that info is helpful. If any problems come up working with the meter, please let me know.TimPS: I agree, those digits are very impressive, even if they are "only" three inches.

author: bitseeker
author_rank: Super Contributor
timestamp: July 04, 2018, 12:26:18 am
content: Quote from: TimInCanada on July 04, 2018, 12:15:03 amYeah, no need for a wireless remote display when the digits are large enough to read from the neighbor's house.

author: AG7CK
author_rank: Regular Contributor
timestamp: July 04, 2018, 03:51:13 am
content: Quote from: TimInCanadaThanks again Tim, and Thanks to bitseeker for nice wordsI am not sure I understand this. U22 is a SN74LS164 and has only clock 8 and reset 9.Inhttps://archive.org/stream/hp_3456A/3456A_djvu.txtit reads:Code:8-262. Receiver. The serial data received from the In-guard Logic through transformer T2 consists of a groupof 9 bits with the first bit always a "one”. The receiveruses this first bit to generate Byte Available. Clock anddata are derived from the serial data by U21, a tran-sistor array circuit. This clock is used to shift the datainto U22, a serial to parallel shift register, and is alsoused by the Byte Available flip-flop U17b. The Q outputof U 1 7b goes high on the clock pulse following the shif-ting of bit “one” to pin 13 of U22/pin 11 of U17b. Thishigh is used to tell the Outguard fiV that a data byte isavailable on the data bus. The first bit is then shifted outof U22 (overflow) leaving the eight-bit data byte on theparallel output of U22.8-263. The Byte Available pulse from U17b goes toA3U16, pin 18 (data line D7, see Schematic 13, HP-IBLogic). The Byte Available pulse is transferred throughU16 to the Outguard ^tP when the ASE enable line (pins1 and 19 ) goes low. An enable on the ASE line occurswhen the scans U9 via the A0-A2 address lines.When the mP receives the Byte Available pulse, thefollowing sequential events take place; (1) the DBE(Data Bus Enable) line goes high which clears flip-flopUlla; (2) the Read line goes high and the IsolationLogic Strobe line goes low. The Read signal (inverted byU2a) and the Isolation Strobe pulse are applied to ANDgate U13a, The output of Ul 3a is used as an enablinglevel for tri-state buffer U20, a clock for flip-flop Ulla,and a clear for flip-flop U 17b. The 8-bit byte is transfer-red from buffer U20 to the fiP and the U22 shift registeris cleared at this time.This means imo that when the first of the 9 bits - the "always 1" bit indicating data available - reaches pin 13, i.e. when 8 bits have been shifted into U22, then on the next (9th) clock pulse which is synchronous with the 9th and last bit in the 9-bit block ( i.e. data bit no. 8 ) - U17b goes high signaling data available (the "1" bit is shifted out, and the 9th bit which is the 8th data bit is now on pin 3 U22).So imo all I have to do is poll (or use interrupt) U17b pin 9 Q, and when it goes high, all 8 data bits in a byte will be available on U22 pin 13, 12, 11, 10, 6, 5, 4, 3. Is this correct?Edit: Writing mistakes

author: TimInCanada
author_rank: Regular Contributor
timestamp: July 05, 2018, 03:11:16 am
content: Yes, I think you've got it. That first bit gets clocked all the way through and out of the shift register leaving the 8 bits of the Inguard data byte on pins 3,4,5,6,10,11,12,13. U17b pin 9 is polled by the 6800, and when it sees a high level, it triggers the U20 buffer to put the data byte onto the data bus.

author: rigrunner
author_rank: Frequent Contributor
timestamp: August 02, 2018, 06:57:02 pm
content: I hacked a parts 3456a with Tim's rom a little while ago. I recently hooked it up with gpib and scanned for a while on the 10V range with a short. One reading every minute 100NPLC.Thanks Tim

author: coromonadalix
author_rank: Super Contributor
timestamp: August 02, 2018, 08:34:10 pm
content: Woah you want to have an 3inch high display connected to the 3456? an frankenmeter of some sort, nice job understanding and decompiling the firmware ...

author: simon51
author_rank: Newbie
timestamp: August 28, 2018, 12:17:15 pm
content: Hi,Tim,After your 3456+ firmware is shared, My friend Mr.Tang designed ltz1000 ref board for 3456+. He do some test for it, the result is very nice, look attach file Pls. I also make a rom pcb for 3456+(3rom version), so can easy use your 7.5 firmware. We also find some bugs as you say in your doc. Now, I want to modify your u7modded.asm file, But it is not exist in you package file, can you share it, Thank you very much.

author: borghese
author_rank: Regular Contributor
timestamp: September 28, 2018, 12:15:46 pm
content: Hi SimonCan you share your board drawings or Gerber files?

author: simon51
author_rank: Newbie
timestamp: October 01, 2018, 07:21:55 am
content: Quote from: borghese on September 28, 2018, 12:15:46 pmGerber files already Attached

author: borghese
author_rank: Regular Contributor
timestamp: October 01, 2018, 11:58:21 am
content: Hi SimonIs there a possibility to also have the Gerber files of the CS with LTZ1000?

author: Silicium81
author_rank: Regular Contributor
timestamp: January 03, 2022, 03:55:33 pm
content: I testing the firmware for 7.5 digit on my 3456A, it's work fine, thank's . To choose the firmware, I used the lsb of the GPIB address to select A16 from the daughter board. Thus, for even addresses, the original firmware is accessed, otherwise it is the 7.5-digit firmware.I still have a few boards ... (21) If you want one, it's free for the board and 3 € for shipping cost international.https://youtu.be/_LAhAGpToPYMore informations:https://vae-tech.forumactif.org/t259-remise-en-fonctionnement-d-un-multimetre-65-digits-hp3456a#2295The file for programming an 27C010 (128kb memory) and memory adress plan is added in attachements

author: bsdphk
author_rank: Regular Contributor
timestamp: January 03, 2022, 06:20:21 pm
content: Quote from: bitseeker on July 02, 2018, 11:46:16 pmYou do not need to do anything special, just configure your HP3458A with OFORMAT DREAL and you will get everything it's got.As for disassembling the HP3458 firmware: I've done it, but I'm not sharing because it is a live product. Stay away from the HP-IB parser and you'll be fine.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 03, 2022, 06:42:40 pm
content: Pimp the processor section with an raspi and a touch screen lollGood work guys, impressiveFor the 3458, once the 9th digit is set, does it stay set upon power off and power on again ? does it flick like crazy ??