HP 4957A

PROTOCOL ANALYZER

HP 4957A

The HP 4957A is a serial protocol analyzer. It is the third generation of similar looking machines, starting with the 4951A in 1985, then the 4952A in 1988, and finally the 4957A in 1992. They are all neat, but the 57 is my favorite of the series, because it has the integrated RS-232 test pod and the full 80 column VT100 emulation. However it is much harder to repair since it is undocumented and full of Xilinx FPGAs. The earlier machines are partially documented and have mostly standard logic.

This machine harks back to the pre-Ethernet era when data networks used serial links with packet-oriented protocols, like SDLC, HDLC or BiSync. It is a data network analyzer for such protocols. But it also supports basic serial RS-232 links with character-oriented protocols (ASCII, Baudot and IBM EBCDIC) , and thus is very helpful today for serial link debugging. In particular, it can detect the bit rate and character length on its own, emulate a DTE or DCE, show the status of all the control lines, and sniff characters in a link. On top of that, it has a fully integrated patch panel that allows you to connect pretty much any line to any pin, has convenient +12V and -12V pins to bring any line to a level, and even tells you the voltage level (mark or space) on any line via a patchable LED. It's the serial protocol hackers' dream machine.

Another great capability is the full VT100 emulation. Unfortunately, that's what was broken on our unit (in addition to the power supply and the backup battery), but we went around it with a ROM swap, see video. By contrast, the terminal emulation in the 4951 or 4952 only does 40 columns, and is not resident in ROM: a diskette program must be loaded. And the diskette is copy protected, but instructions to defeat that are provided below.

And let's not forget, it is very cute.

Inside, it's processor's galore; there are no less than 5 microprocessors! And from each major manufacturer: Motorola, Z80 and Intel. What gives? Some people have taken advantage of that to try to hack the 495X and run CP/M or BASIC or Tetris on it.

HP 4957A Videos

In this video, we repair the power supply, build a battery replacement, and fix the VT100 emulation high resolution screen glitch with a ROM swap.

Documentation

ROMs

Our two units had different ROMs. One was the A0001 version, dated 1991, which had the low resolution (40 columns) VT100 emulation. The other had the A0002 version, dated 1993, which had the high resolution (80 columns) VT 100 emulation. We dumped the 5 ROMs that differed of each machine. A picture of where they go in the board is also provided.

The ROMs in the A0001 version were AM27C010.

The ROMs in the A0002 version were a combo of one AM27C010 and three ST M27C1001. The type is indicated in the title of the dump files.

Finally, a viewer sent me his A0002-Opt001 ROMs. Option 001 adds the 115 kbauds "high-speed" data capture capability (see EEVblog thread here: https://www.eevblog.com/forum/testgear/hp-4957a-add-option-001-high-speed-data-capture/ ).

An even faster decoding rate (1.544 Mb/s) is achievable with the HP 18282A ISDN / T1 interface pod and its accompanying diskettes, as documented below.

Board with A0001 ROMs (40 column VT100 emulation)

Board with A0002 ROMs (80 Column VT100 emulation)

ROM dumps

HP 495X Application Diskettes

Important: HP 495X diskette set recreation and copy protection

The HP 4957A comes with a set of diskettes with some applications, simulation menus and example data on 3.5" diskettes, which considerably expand the capability of the machine. But these are not regular PC formatted diskettes: they are HP LIF formatted, and therefore not simply copyable on a modern PC. To make things worse, HP implemented a copy protection scheme that is specific to the HP 495X series. You can only copy the HP 495X diskettes using an HP 495X, at least in theory.

In practice, to go around the non-PC format and HP 495X copy protection, use the method below to recreate working HP 495X diskettes from the .imd files I provide.

1- Format a 3.5" low density diskette in the HP 495X.

2. Use the ImageDisk software on a vintage DOS machine with a 3.5" drive (USB drives on a modern OS won't work) to write the diskette you formatted in step one from the image files below. Make sure "double step" option is off in the ImageDisk settings, or it will complain.

3- This does not apply to the 495X PC Utils diskettes which are standard PC diskettes, containing utility .EXE programs that run under DOS. You can skip the formatting and recreate them straight from ImageDisk onto blank diskettes.

HP 4957A Standard Diskette Set

HP 495X Optional Application Diskettes

HP 4951C Terminal Emulator Application

In the HP 4951C, the VT100 terminal emulation is an external application you have to load from this diskette. This app is not compatible with the HP 4957A, which instead has it available for loading directly from ROM, and has full 80 character per line resolution (at least in the later revision of the ROMs, as we learned in our video).

HP 18282A ISDN/T1 1.544 Mb/s Interface Pod

The HP 18282A interface pod added the option to decode ISDN and T1 lines to 1.544 Mb/s, and could be used with the HP 4952A or the HP 4957A. It came with three diskettes, which were provided to me by a generous viewer. You will find them archived below. Use the same procedure as outlined at the top of this section to recreate the original diskettes.

Hacking the HP 495X!

Some really clever chaps have figured out how to partially reverse engineer the HP 495X and write new applications that work on it. They managed to get Z80 Basic kinda-sorta working and to write the "Snek" game! See video and links below. I have not dwelved into this yet.

YouTuber asr33 wrote a game for the HP495X!

His source code repository is here:

https://github.com/hughpyle/HP4952A/tree/master/snek

He based his work on the discoveries of David Kuder, see below.

Asr33 is also the author of the mind-blowing awesome ASR33 emulator software, the best thing besides owning a real ASR33:

https://youtu.be/jd5oomwEBb0

David Kuder is the one that first figured out how to hack the HP 4952. Here is the project on Hackaday.io

https://hackaday.io/project/162448-hacking-the-4952

His repository is at:

https://github.com/dkgrizzly/4952oss

Hacking the 4952When someone gives you a piece of 1980's test equipment, what better thing to do than to hack it? The HP 4952A was preceded by the 4951A (which used tape storage) and 4951C (which brought the adoption of floppy storage) and eventually replaced with models such as the 4957A which had a higher text resolution and more embedded applications in ROM. The HP 495x series protocol analyzers all share a common heart, the National Semiconductor NS800 - a Zilog Z80 based CPU. There are many other peripheral MCUs in the 4952A (seriously what the heck HP, two 80c51's, an 80c88, and a 68008?) We won't touch them much, but instead rely upon the factory firmware to do it's job where peripherals are concerned.

And Trevor Jahanssen Aase is trying to port CP/M to the HP 4952, a work in progress at this point:

https://hackaday.io/project/163027-hp-4952a-turned-general-purpose-cpm-machine