Clone t`engineering

Part 3: continued from Cloning for fun or profit

Copying this card is not enough, were we to make a profitable version it would need to be cheaper, and if we were reviving this product its replacement will need to be better.

To pursue both of these an understanding of the originals function, and how it functions is essential.

Schematic of the original

A quick survey of the original we see:

ICs1-1662_1024128K × 8 Static RAM
IC 1727_256256 K (32K × 8) CMOS EPROM
IC 1874_5738-bit D latch BUS DRIVER; 3-state
IC 1974_5908-bit BINARY COUNTER
with output register
IC 2374_1544-line to 16-line data SELECTOR/MULTIPLEXER
ICs24,2574_5748-bit D type FLIP FLOP bus driver; 3-state
IC 2674_1383-line to 8-line DECODER/DEMULTIPLEXER
IC 27MAX690WATCHDOG / Supervisory Circuit
IC 2874_08Quad 2-input AND gate
IC 2974_32Quadruple 2-input OR

8-BIT IBM/ISA Card Edge

The most ovbious parts to save to save money on are ICs1-16.

The cheapest 0.1" pitch DIP package with 128K×8 (at the time of this article) is Digikey.com:BQ4013YMA that hit our 4.5-5.5 VCC sweet spot, is Non-Volatile (NV) SRAM eliminating the need for IC 27 and a battery, and at $25.94 per IC, it would cost $415.04 before applying the new HST and Eco taxes for enough capacity.

If we were to move to a surface mount 0.05" pitch SOP package such as the Digikey.com:IS62C1024AL with 2.0 V data retention threshold and the same VCC, it would cost $4.23 per IC, $67.68 for all sixteen.

Buying Sixteen 128K×8 ICs is silly when we could subsititute a single 2048×8 IC for ICs1-16 and IC 23. Reducing our component count and board size by more than half, while remaining software compatible with the original.

ICs1-16 can only accept address lines 0-16, but each can be individually addressed, therefore IC 23 decodes address lines 17-20 and individually addresses ICs1-16. If there is only one SRAM IC then a decoder is unnecessary and can be eliminated while leaving the original software completely unaltered.

Illustration of difference in complexity between using a single surface mount IC w/ an unused or gate from the original, and the orignial's 17 ICs. Additional power circuitry required.

A single 2048K×8 DIP such as the Digikey:BQ4017M would set us back $107.84. Or a 0.0315" pitch TSOP like the $44.44 Digikey:CY7C1069AV33. Both of which are a king's ransom compared to a $7.22 Digikey:NAND512W3A2DN6E 512MB Flash 48-TSOP-II, or a modest $1.07 Digikey:SST25VF040B 4MB Flash 8-SOIC, both of which would require the use of different hardware and software.

I should be able to learn enough from reverse engineering this hardware to better understand how it works and where we might find areas of improvement.

When (IOSel=0 and Reset=0) IC26 decodes (AD0-2,CO,RST)
When IC28D(IORd=1 and IOWr=1) if [(SA3-9 is (ID0,ID1,00011)) and (AEN=1)] then IC22 sets (IOSel=0)
When (MemRD=0) if [(SA13-19 is 0011011) and (Reset=0)] then IC21 sets (MemSel=0)

When (MelSel=0) IC17 decodes (D0-7) by (SA0-12,ID0,ID1)
When IC28B(MemSel=0 OR IOSel=0)
IC28C will turn off D1 sinking current to drive LED.
Also, If (IORd=1 and MemRd=1) IC20 loads D0-7 onto SD0-7
ElseIf (IORd=0 OR MemRd=0) IC20 loads SD0-7 onto D0-7

When (AD0=0 and IOWR=0) IC29A sets WE=0, else WE=1

When (AD0=0 and CS=0) IC23 decodes A17-20 and activates the correct CS1-16 for the SRAM array, else they are all disabled.

When AD0 rises IC19 increments its register;
When system CLK rises IC19 outputs its register to A0-7 // if system CLK does not cycle after AD0 then an address is skipped!
When RST=0 IC19 resets its register

When CO=0 IC18 loads K1 onto D0-7 // external input/jumper config

When AD1 rises D0-7 is loaded onto A8-15
When AD2 rises
D0-4 is loaded onto A16-20
D5 is loaded onto CS
D6-7 is loaded for no apparent reason // load balancing for lower quality components? to make routing the wires more difficult? To avoid colleagues complaining about not having all lines of the databus connected?

JA3-4 pull ID0-1 to 0 when set

The SSD's address without jumpers is 318H, with JA3 is 10H, JA4 is 306H, JA3,4:300H .


D 8-9 3-F 0-1 0-F
ID 1101100___11000xxyyy
SA 3210fedcba9876543210

b 1100000000

b 1100011000

Assuming both jumpers are set we have a IO base address (BA) of 0x300, then
BA+0 is AD0
BA+1 is CO

An IOread to 0x__302 would activate CO and IC18 would load K1 onto the system databus via IC20.
An IOwrite to 0x__302 would also activate C0, but, but IC20 would change direction and 'fight' it potentially damaging the chips - This would be bad.
Make a note that 0x__302 should be treated as read only,
Similarly any read or write to 0x__304 where bit D5 is set, activating CS, should not be followed by an instruction that makes use of the SSD's databus except to access SRAM- this would also be bad.

Our ROM base address is 0xD8___.

A quick peek into the image reveals
seg000:002Adb'Yatronic Silicon-Disk V2.0 (c) 1992'
seg000:6800 db '                '
seg000:6810 db ' COPYRIGHT Uitg.'
seg000:6820 db ' ELEKTUUR B.V.  '
seg000:6830 db '      BEEK      '
seg000:6840 db ' The Netherlands'
seg000:6850 db '      1994      '
seg000:6860 db '                '
seg000:6870 db 'Author: B. Yahya'
seg000:6880 db '                '

Disassembly to follow.

No comments:

Post a Comment