Or, how do we see what's going on with this blasted thing??
Introduction
As a few of you may know, I volunteer at The National Museum of Computing working on the Bombe as part of the Turing Welchmann Bombe Rebuild Trust. The machine itself is very old-skool having been designed and built in 1939/1940 in order to decrypt German Enigma codes, although the technology used is based on punch card machine and pre-dates even that time period (note that the machine in the museum is a period-accurate rebuild, not an original). It runs at around 200V DC (+100V to -100V) and I say “around” because we typically measure up to 216V and 230V. Obviously, this isn’t very safe and we’ve had to put in place some non-period safety features such as a power supply that will immediately trip if any discrepancy in the ground potential is detected. Which is highly praised, as we’ve all felt “the tingle” at some point - I'm amazed any of the Wrens who operated these survived the war!
{gallery}Various Images of The Bombe - all copyright TWBRT |
---|
IMAGE TITLE: Front of the Bombe with one bank populated with drums. Each column of 3 drums represents 1 3-rotor Enigma so the Bombe can work across 36 Enigmas simultaneously, with 3 different attack configurations. |
IMAGE TITLE: Around the back with the gate open (on the right). The business side. |
IMAGE TITLE: Front of the gate showing a load of resistors and relays involved in the circuit |
IMAGE TITLE: The other side of the gate used to wire up a menu to test (actually, 3 in this image) - an assumption of what part of an encrypted message maps to equivalent decrypted text. |
It’s important to clarify that the Bombe isn’t a computer, it’s just “the world’s fanciest circuit tester”. The most simplest explanation, that will explain nothing really, is that a signal is allowed to circulate across 12 miles of (red) wiring, various mechanical relays, cams and commutators and up to 3 banks of 12 drums with each drum being a 26-point commutator (each point representing a letter of the alphabet) and The Bombe is looking for an open circuit. This occurs when the setup (or programme created from plug-in wiring) detects that the letter combinations that were plugged together in the programme are found simultaneously across a set of drums for a given input letter. This has potentially identified the plug-board settings of the Enigma used to send the message (and thus ALL Enigmas on the same network) which cuts the potential combinations from just under 159 quintillion (159,000,000,000,000,000,000) to a much more manageable 26x26x26 = 17576. Actually, without going into detail, it’s really only 26x25x26 and in practice 26x25 because the start point of one of the Enigma wheels is discoverable very quickly at this point.
Basically, I can’t explain this stuff in a blog and it’s not really relevant for what follows - even the description at the TWBRT site linked above was written by someone too close to the machine. You can read Sir Dermot Turing’s excellent book on the subject, or visit the museum where it can be explained more easily.
What’s the Problem with Debugging The Bombe?
How do we measure what’s actually happening when something goes wrong? Recently we had a problem where the Bombe was stopping unexpectedly, indicating a stop that it should not have done so. It was generally-but-not-always-repeatable and we were pretty sure it was a timing issue but where? The issue we have is that if we attach an oscilloscope directly to the Bombe, the difference in ground potentials immediately trips the power supply. In other words, we can’t directly scope the signals in the circuit because the Bombe just won’t run.
One solution is to cut the Earth lead on the scope - less said about that the better (don’t do it at home folks) A better alternative is to buy a handheld scope that, effectively, is isolated. TBH, that’s actually the best solution but apparently “is no fun” and I’d have to agree. So we needed to provide a means of connecting the scope that wouldn't trip the power supply - in other words, keep the Bombe and scope isolated.
In the following, it’s definitely worth noting that the Bombe produces pulses (or should do!) and not varying waveforms. In an ideal and perfect world, those pulses would be perfectly shaped rectangles but in reality this is an electrically noisy machine full of mechanical relays opening and closing, timing cams that connect and disconnect, commutators that direct the circuit, all of which chatter when they do so.
Isolator Board Version 1
This was created early on during the rebuild (before my time) and has proved very useful:
Version 1 of the isolator board allowed for 8 inputs with a common reference point: each input was connected to a point in the circuit and the reference to the ground point. Each incoming signal is dropped to a 0-5V range and passed into an opto isolator. The other side of the isolation barrier is connected to a transistor which raises a signal on the relevant output pin when voltage is detected. Powered from a 5V wall wart.
A very simple solution but the astute amongst you will immediately see the limitation. An analog signal is injected from the Bombe but in the process of crossing the isolation barrier (OptoIsolators) is, essentially, turned into a digital signal (on or off). The measured output is either 0V or 5V and nothing in-between. In other words, we only see the pulse start once the voltage has reached a level that turns the transistor on at which point the scope shows an immediate rise to 5V; concomitantly we see that 5V until the voltage falls low enough to turn the transistor off at which point the scope shows an immediate fall to 0V. Additionally, we only see noise/glitches when they reach a measurable voltage level and then only at a full 5V
Despite this limitation, it has been a useful debug tool. Whilst we can’t see a true representation of the pulse shape, we can see the pulses in relation to each other across the circuit and thus we can see if a pulse is too long or too short or if its timing in relation to other pulses is off. It’s what we used to track down the timing issue mentioned earlier, which was eventually traced to slightly worn brushes on a commutator throwing the timing off, on occasion. We could compare pulse timings against images taken whilst the machine was being built to see the changes that had occurred.
One of my colleagues asked if we couldn’t do better and having discussed it, I thought we could because I could use the knowledge I’d worked through on an on-going personal project.
Isolation Board Version 2
I wanted a way to actually scope the waveform of the pulses as well as glitches and significant noise. It was still necessary to maintain the isolation barrier and I came up with the following design, extended across 4-channels of input.
Focus on one channel (all are the same)
Undoubtedly more components than V1, but in practice not actually that more complicated. The Bombe input signal is routed through an LED which will flash in-sync with a voltage appearing on the connector and also through a voltage divider which brings it down to under 5V (approx 4.7V - importantly, given the somewhat varying voltage level, it must stay below 5V but the actual level isn't too important.) The signal is routed into an 8-bit ADC and is clocked-in for conversion by a 7555 timer once every 1.5uS (actually measured at just under 2uS in practice.) This converts the signal into its 8-bits which are passed across a digital isolator (actually, 2, 4-bit isolators as the 8-bit ones were very expensive and harder to solder) and into an 8-bit DAC which has been configured to output the appropriate analog to an output pin.
Power is supplied by a 5V wall wart and passed into a 5V isolated DC-DC convertor to power the components on the other side of the isolation barrier.
The circuit was prototyped initially using opto isolators instead of the digital isolators. In practice, the ones we used (which were to hand and the same as V1) were too slow: in order to get a large enough signal across the isolation barrier for the DAC to register as a '1', large value resistors and capacitors had to be used which slowed them down to the point bits were being lost or carried forward and the 'shape' was recognisable but full of odd peaks and troughs (sorry no images of this.)
Note that the Bombe signal is jumpered into the ADC. This allowed me to test the board at home, without access to the Bombe, as I could use my AWG to inject a signal into the ADC.
Now we have a board that can actually track the pulse shapes as they develop and fall. We can actually see glitches that would otherwise not be visible or correctly measurable on the old board. It’s also possible to view the spikes generated by noise in order to see their impact as well as ignore them by setting the scope trigger parameters appropriately, which was quite difficult on V1.
I tested this at home with my AWG and could map input to output with a sine wave, triangle wave and arbitrary waveform successfully.
The unpopulated through-holes on channel 4 are test points. We're in the process of building a case and cover for it: no one wants to be accidentally sticking their fingers onto those Bombe inputs when it's live!
Output Images
Unfortunately, I don’t have scope images from the V1 board to use as comparison, but the following show the measurable waveform shapes we wouldn’t have previously been able to capture. Interestingly, we saw a strange occurrence on sampling pulses being alternately different durations which wasn’t identifiable previously because the duration difference wasn’t large enough to show. That will need investigation but doesn't seem to be causing a problem.
Apologies that these are photos of the scope screen: it's nearly as old technology as The Bombe and images can only be captured via floppy disk!!
Here, we see sample pulses and a carry pulse. Sample pulses are a lot shorter than the carry pulse and it's possible to see that the timing is good - carry should happen after 26 sample pulses (only 18 shown.) We can see that the voltage levels of the sample pulses are varying somewhat, plenty of noise and also a glitch pulse at the end and start of the sequence.
This next image is showing a Gate pulse (long duration, actually as long as a sequence of 26 sample pulses) and one full sample pulse. Note that we can now see the waveform shape of the sample pulse. We've put a bandwidth limit on the scope to remove some of the noise.
Here's the sample pulse at a smaller timebase and the waveform shape and noise are clear to see.
And just to further prove a point, here we can see a pulse tail-off as a capacitor discharges.
Summary
It has been difficult in the past to trace what is happening as the machine runs because of the need to isolate the Bombe and a scope. V1 of the board was useful, but it could often be a case of trial-and-error in pressing STOP/RUN at the right time as we couldn't always set the right trigger options nor was it always possible to differentiate glitches/noise from a pulse except by duration - anything that "looked too short" was deemed not-relevant: not very scientific!
I'm very pleased with the way the board worked. The Bombe isn't a fast machine so clocking at around 1.5uS to 2uS is more than sufficient for measuring and it looks like we can get some useful information out of it. Ultimately, the best solution would have been to lump out for a handheld scope, but this was way more adventurous and fun to do.