Clone t`engineering

Part 3: continued from Cloning for fun or profit

Copying this card is not enough, were we to make a profitable version it would need to be cheaper, and if we were reviving this product its replacement will need to be better.

To pursue both of these an understanding of the originals function, and how it functions is essential.

Schematic of the original

A quick survey of the original we see:

ICs1-16	62_1024	128K × 8 Static RAM
IC 17	27_256	256 K (32K × 8) CMOS EPROM
IC 18	74_573	8-bit D latch BUS DRIVER; 3-state
IC 19	74_590	8-bit BINARY COUNTER with output register
IC 20	74_245	Octal BUS TRANSCEIVER
ICs21,22	74_688	8-bit MAGNITUDE/IDENTITY COMPARATOR
IC 23	74_154	4-line to 16-line data SELECTOR/MULTIPLEXER
ICs24,25	74_574	8-bit D type FLIP FLOP bus driver; 3-state
IC 26	74_138	3-line to 8-line DECODER/DEMULTIPLEXER
IC 27	MAX690	WATCHDOG / Supervisory Circuit
IC 28	74_08	Quad 2-input AND gate
IC 29	74_32	Quadruple 2-input OR
		8-BIT IBM/ISA Card Edge

The most ovbious parts to save to save money on are ICs1-16.

The cheapest 0.1" pitch DIP package with 128K×8 (at the time of this article) is Digikey.com:BQ4013YMA that hit our 4.5-5.5 VCC sweet spot, is Non-Volatile (NV) SRAM eliminating the need for IC 27 and a battery, and at $25.94 per IC, it would cost $415.04 before applying the new HST and Eco taxes for enough capacity.

If we were to move to a surface mount 0.05" pitch SOP package such as the Digikey.com:IS62C1024AL with 2.0 V data retention threshold and the same VCC, it would cost $4.23 per IC, $67.68 for all sixteen.

However;
Buying Sixteen 128K×8 ICs is silly when we could subsititute a single 2048×8 IC for ICs1-16 and IC 23. Reducing our component count and board size by more than half, while remaining software compatible with the original.

ICs1-16 can only accept address lines 0-16, but each can be individually addressed, therefore IC 23 decodes address lines 17-20 and individually addresses ICs1-16. If there is only one SRAM IC then a decoder is unnecessary and can be eliminated while leaving the original software completely unaltered.


Illustration of difference in complexity between using a single surface mount IC w/ an unused or gate from the original, and the orignial's 17 ICs. Additional power circuitry required.

A single 2048K×8 DIP such as the Digikey:BQ4017M would set us back $107.84. Or a 0.0315" pitch TSOP like the $44.44 Digikey:CY7C1069AV33. Both of which are a king's ransom compared to a $7.22 Digikey:NAND512W3A2DN6E 512MB Flash 48-TSOP-II, or a modest $1.07 Digikey:SST25VF040B 4MB Flash 8-SOIC, both of which would require the use of different hardware and software.

I should be able to learn enough from reverse engineering this hardware to better understand how it works and where we might find areas of improvement.



When (IOSel=0 and Reset=0) IC26 decodes (AD_0-2,CO,RST)
When ^IC28D(IORd=1 and IOWr=1) if [(SA_3-9 is (ID₀,ID₁,00011)) and (AEN=1)] then IC22 sets (IOSel=0)
When (MemRD=0) if [(SA_13-19 is 0011011) and (Reset=0)] then IC21 sets (MemSel=0)

When (MelSel=0) IC17 decodes (D_0-7) by (SA_0-12,ID₀,ID₁)
When ^IC28B(MemSel=0 OR IOSel=0)
IC28C will turn off D1 sinking current to drive LED.
Also, If (IORd=1 and MemRd=1) IC20 loads D_0-7 onto SD_0-7
ElseIf (IORd=0 OR MemRd=0) IC20 loads SD_0-7 onto D_0-7

When (AD₀=0 and IOWR=0) IC29A sets WE=0, else WE=1

When (AD₀=0 and CS=0) IC23 decodes A_17-20 and activates the correct CS_1-16 for the SRAM array, else they are all disabled.

When AD₀ rises IC19 increments its register;
When system CLK rises IC19 outputs its register to A_0-7 // if system CLK does not cycle after AD₀ then an address is skipped!
When RST=0 IC19 resets its register

When CO=0 IC18 loads K1 onto D_0-7 // external input/jumper config

When AD₁ rises D_0-7 is loaded onto A_8-15
When AD₂ rises
D_0-4 is loaded onto A_16-20
D₅ is loaded onto CS
D_6-7 is loaded for no apparent reason // load balancing for lower quality components? to make routing the wires more difficult? To avoid colleagues complaining about not having all lines of the databus connected?

JA_3-4 pull ID_0-1 to 0 when set

The SSD's address without jumpers is 318H, with JA₃ is 10H, JA₄ is 306H, JA_3,4:300H .

	IC21		IC	28		IC26
	D	8-9	3-F	0-1	0	-F
ID	1101	100_	__11	000x	x	yyy
SA	3210	fedc	ba98	7654	3	210
0x300			b 11	0000	0	000
0x318			b 11	0001	1	000

Assuming both jumpers are set we have a IO base address (BA) of 0x300, then
BA+0 is AD₀
BA+1 is CO
BA+2:RST
BA+3:AD₁
BA+4:AD₂
(+5,+6,+7)

An IOread to 0x__302 would activate CO and IC18 would load K1 onto the system databus via IC20.
An IOwrite to 0x__302 would also activate C0, but, but IC20 would change direction and 'fight' it potentially damaging the chips - This would be bad.
Make a note that 0x__302 should be treated as read only,
Similarly any read or write to 0x__304 where bit D₅ is set, activating CS, should not be followed by an instruction that makes use of the SSD's databus except to access SRAM- this would also be bad.

Our ROM base address is 0xD8___.

A quick peek into the image reveals

seg000:002A	db	'Yatronic Silicon-Disk V2.0 (c) 1992'
seg000:004D	db	0
	...
seg000:6800	db	'                '
seg000:6810	db	' COPYRIGHT Uitg.'
seg000:6820	db	' ELEKTUUR B.V.  '
seg000:6830	db	'      BEEK      '
seg000:6840	db	' The Netherlands'
seg000:6850	db	'      1994      '
seg000:6860	db	'                '
seg000:6870	db	'Author: B. Yahya'
seg000:6880	db	'                '

Disassembly to follow.

Cloning for fun or profit

Cloning a piece of hardware is an excelent way to learn about how it is designed, and how it works. This is often viewed as a seedy trade inwhich people bastardise the hard-work of honest engineers and other designers to produce the same product without the overhead cost of design and marketing.

Unfortunately in my experience design documentation is almost always lost and the only way to recover (or sometime resume production of) a product is to clone it and there is little discussion on techiques for achieving this.

Generally when I 'clone' a product, I build an exact replica (in so far as component layout and electrical connections). Then I go looking for what can be made cheaper. Then better. Then the maintence cycle begins.

I like to use high-resolution photography and logic probes to start with; however grainy photographed pages from a foreign trade magazine from a random website is more than enough to clone a product and start development.

Take for example the Solid State Diskdrive for the IBM XT featured on K. Giannopoulos' website (microwave.gr:Build your own Vintage PC-XT Computer). From these massive bitmaps, and roms we can produce plans for a clone and then some.

Step 1: Preparing the reference material
To obtain the reference board art start by tracing the bitmaps with Inkscape. This allows evaluation the quality of the reference material and gives me a reference for the wiring of the first clone.

Next using the outside corners as reference points calculate how much to rotate these layers to align their edges horizontally.

Top layer

• (1463.789,5.971)
  0.233716199°
• (1468.760,3.486)
  0.135987303°
0.184851751°

Bottom layer

• (1464.944,2.279)
  0.089134448°
• (1468.780,9.950)
  0.388134564°
0.238634506°

Okay;
In this example because the bottom layer is clearly out of square as the angle does not match, this could be because of perspective, a transform can fix that if it is flat. There is also noticable distortion bacause the pages were not pressed flat when the picture was taken, but maybe I will get lucky and manage to align it anyways.

Nope.

The red top layer does not completely align with the blue bottom layer. There are also a number of 'broken' traces where the line did not render very well. Even if this image was rescaled a pcb made precisely to this image the pcb would require significant repairs where the components do not fit, where the layers do not connect and where the wires are disconnected. Fixing this would be quite difficult.

If it were in alignment we could then replace the polygons with wires and convert this into gerber format using a script. But it's not so I will be drafting the board art manually. Fortunately this website also posted a schematic and parts list.


Step 2: Using the reference material.
Add all of the parts necessary to a new Eagle schematic. I found that I needed to add two 'new' comonents to the library: the three lead capacitor and the DIP32 RAM.

Working from one corner to the other recreate populate the schematic and board with approximately the same layout. Once populated wire the schematic and board as close to the original as is practical. The reference art can be coloured to track progress and distinguish different signals easier.

I think lavender is a fine colour for the data bus.

While I was doing this I made a few interesting discoveries: most significantly was the omission of CLK from the cardedge to IC19 on the original schematic, without this a clone card made only from the schematic would not work.

The secret CLK.

The Address and Data lines were also shuffled around by the orignal designer to help with board layout. This is good since even with the bits shuffled around each address is still unique and the data (provided it is always stored in the same order) will still read back correctly.
As evidenced by the vias inside the array of memorychips the previous designer got bored and used the autorouter resulting in some spectacularly stupid wiring.
I've duplicated most of the 'stupid' so that my colleagues will not harass me about differing from the original "too much", though while linking the data and address lines from the memory chips I made a hash of it since I intend to design that out entirely.

And here is the result of eleven hours of unpaid work: a clone of the original board, minus some stupid, plus some sloppyness when I got bored.


Now that we have a hardware/software compatible clone we can make it cheaper by substituting components.

Part3: to be continued


Note: I was unable to upload the PDF, SVG, brd, sch and lbr files I had intended to illustrate this post with. I am also disinclined to seekout a file host for these if nobody asks for them.

Edit: I have been contacted, links to follow.

Edit: Build your own Vintage PC-XT Computer files are availble in the Solid state disk section.

What?

Adding symbol GND to F09-S would exceed the minimum number of pads (11) availble in package variant V

This is a device I copied directly from Eagle 5.7.0's library (con-subd.lbr) because in my design only one of the two shield lugs were being wired. I was only conecting to 10/11 pads, but adding annother GND symbol increasing the symbol count to 11 actually exceeded the pad limit of 11.



The connect window shows that there are infact 11 pins already defined, including G1 and G2. Typing show G1 in the command line is unsuccessful, therefore these pins must be defined within a symbol.



A look at the symbol (GND.sym) appears to illustrate a single pin, right clicking and selecting properties reveals G1, a wire and a circle. G2 must be nearby, and show G2 in the command line reveals that it is hidden under G1, backwards!



So in the schematic editor by using the wire tool and clicking on the GND symbol only the top pin was engaged. Had I run Eagle's Electrical Rule Check it would have produced a warning that would have confused me and prompted the same response.



The workaround:

This is a common symbol in Eagle's library, let's hope that 5.9.0 has it documented.

EDIT: typo, G2 and G1 transposed.

Aww ----

Exepcting my travelling companion to stir up shit I decided to remove all CAD programs from my laptop before travelling to the states to avoid accusations of illegally exporting technology in addition other technological activities which are legal where I am now, but not in the states.

Upon returning I recieved notice that one of my major projects was due and I being the dubious bastard I am, was waiting for the request before submiting. (Also the design was still a bit rough.) I was surprised that the Eagle link was still in my startmenu; However, this link was broken as Eagle's uninstaller had neglected to remove the links and associations from my system.

Undetered I downloaded the new version from their homepage and after installing it was surprised that it was requesting the My Documents/Eagle be created. Figuring that I deleted it I clicked no and started to browse for my not in a default location projects folder on my C: drive. It was not there. Neither was the copy of an old backup on my desktop that I had included in Eagle's directory config. And my backup drive is nowhere close to up to date as I had to use that cable for my network printer.

So now a major project is due and the best backup I have is eight months old.

"...."

Edit: Language