“All this gear … and I still can’t get to your heart.”
Welcome back to the salvage season series of posts. Lame joke aside, this post will be about a Fisher-Rosemount Systems Model 275 HART Communicator. So … what is it?
HART Communication Protocol
HART stands for Highway Addressable Remote Transducer Protocol, which is a protocol developed by Rosemount Inc based around Bell 202 modulation to inject additional digital data over legacy 4-20mA current loop signalling systems. In 1986, it became an open protocol with many manufacturers producing compatible sensors.
The signalling is packet based, featuring up to a length of 255 data bytes plus overhead of up to 32 bytes for a total length of 287 bytes. Other details are somewhat scant because the full specifications do not seem to be openly available, although some documentation is.
The Model 275 Communicator
The Fisher-Rosemount Systems Model 275 HART Communicator is a handheld device used to configure, test, diagnose and work with HART transcievers and networks. The unit has a multi-line matrix LCD display with a number of plastic bubble membrane keypad buttons on the front. The rear houses the battery pack, secured with torx screws and other modules. Surprisingly, the manual is still available from Emerson.
The rear has banana connectors for connecting to the signalling loop, a retention/grounding tab, and a serial port for interfacing to a computer possibly to use the communicator as a HART modem. The battery pack seems to have a cut-out for a possible charging port that was not equipped.
A number of battery packs must have been available, with this being the most basic adapter for five AA cells. The rear does have a warning to use only Varta or Duracell batteries, so I’m definitely “breaking the rules” here. The PCB seems to have positions for charging circuitry. The battery terminals were a little weak and dirty, so the unit didn’t work until they were cleaned up. There are screws holding the unit together internally which are a mixture of Philips, flat-blade and torx. More interesting still, the screws were a mixture of steel and nylon. The unit is made in the UK. Rather than get straight into the operation, lets go for a full teardown.
Just under the battery compartment, the module has a slot for a memory expansion plug-in which was not fitted.
I found that the whole rear module could be removed, although one of the nylon screws were already stripped necessitating some creativity with a junior hacksaw.
As it turns out, the rear module assembly can be removed, and this assembly claims to be Made in USA on the lower label, and Made in UK on the upper label.
The module assembly seems to contain the brains of the unit. Two Intel StrataFlash E28F320J5 4MiB Flash memory chips can be seen on this side. There seems to be a Lattice PLD or similar with a label on it, a CSI CAT28C16AN-20 2KiB EEPROM, a Motorola MC68331CFC16 16Mhz 32-bit microcontroller accompanied by two Toshiba TC554001AF-70L 512kiB SRAM chips and an On semiconductor HC00A NAND gate package.
The underside adds another 4MiB of flash memory. There is a chance that this particular board or module might have been a newer unit that was paired onto the remainder of the unit, as the dates on the chips seem to place it in around 1999.
Removing the shield on the keyboard assembly reveals no components on that side. The PCB can be carefully pried out, although a few components do like to “fall out” if you do so without care.
The keyboard flex has been removed, and the LCD has been unplugged and removed as well. This side of the board has a very glossy appearance and seems to suggest there has been some conformal coating put on to improve its reliability. The date codes on these chips imply a 1992-1994 time frame of manufacture.
Removing the label on the chip, we see the main chip is a socketed Motorola XC68HC705C9FN, which appears to be an OTP microcontroller.
Here, we see the matrix keypad ribbon, red in colour with a blue connector. One must take care with these connectors as they could get quite brittle and fragile.
There’s also the LCD module, with a piece of bakelite or similar material adhered on the rear for insulation.
When the unit is started up, the first thing it does is a self-test and print the firmware and module revision. Then, it scans the HART bus for devices, emitting these noises as recorded by connecting the unit to my Zoom H1 handy recorder. As there are no devices, and indeed no live bus to work with, it complains there is no devices. After pressing a key, we are dumped to the main menu. The menus don’t operate quite instantaneously – sometimes you press a key and wait a bit before anything happens. Text entry can be done through the keypad by using the bottom row to select left, middle or right letter, then the number key with the corresponding letter above it. The top row is a soft-key row.
The Offline menu allows you to build configurations for devices using a blank template for later configuring a sensor or testing it. The unit also offers limited “online” help in its menus.
Scrolling through the list of manufacturers which are supported by this Model 275 reveals a staggering array of manufacturers which make HART devices and which this communicator can configure.
Underneath each manufacturer is a list of supported devices … and then under each device, there’s a list of device revisions as well. I get a sense of just how expensive this piece of equipment must have been brand new, simply because it’s so sophisticated and would have saved so much time in looking up datasheets and manually working out the configuration bytes that need to be sent to achieve a given configuration.
The configuration can be generated, then the variables of data that the sensor can report can be individually edited and marked for sending or not sending over the HART bus. The configuration can be saved to the internal EEPROM or memory expansion.
The next menu is the utility menu where a number of things can be configured and tested.
It confirms the size of the flash and the binary sizes – about 10MiB for the binary in a 12MiB flash with 1617 bytes of the 2048 byte EEPROM free for profile storage. The PC communication mode leaves the unit in the latter screen.
The simulation mode allows us to see what would happen if diagnosing a device – we can use it to display the live data from the sensor, modify the setup similar to building a profile, set tags/identifiers with text values, and perform diagnostics.
The unit also has a self-test menu where an extensive checksum of the binary code within the unit is performed which takes about a minute.
Salvages are often a surprise, but they’re also quite educational. In this case, I was made aware of a protocol I never even knew existed. We also got the chance to take a look inside what would have been a very expensive piece of diagnostic equipment in the early-mid 90’s. The design of the unit is very much a delight to behold – modularity everywhere, allowing for easy servicing and replacement. The number of manufacturers making HART devices which were supported by this unit was quite extensive. I’m sure there’s probably still plenty of 4-20mA out there in industrial settings, and possibly still a bit of HART out there too.
Will this be the last post in the series? Maybe not … I do still have a box in the corner with other salvage stuff I haven’t even looked at. Maybe that will be the final post of the series.