Clone t`engineering

Part 3: continued from Cloning for fun or profit

Copying this card is not enough, were we to make a profitable version it would need to be cheaper, and if we were reviving this product its replacement will need to be better.

To pursue both of these an understanding of the originals function, and how it functions is essential.

Schematic of the original

A quick survey of the original we see:

ICs1-16	62_1024	128K × 8 Static RAM
IC 17	27_256	256 K (32K × 8) CMOS EPROM
IC 18	74_573	8-bit D latch BUS DRIVER; 3-state
IC 19	74_590	8-bit BINARY COUNTER with output register
IC 20	74_245	Octal BUS TRANSCEIVER
ICs21,22	74_688	8-bit MAGNITUDE/IDENTITY COMPARATOR
IC 23	74_154	4-line to 16-line data SELECTOR/MULTIPLEXER
ICs24,25	74_574	8-bit D type FLIP FLOP bus driver; 3-state
IC 26	74_138	3-line to 8-line DECODER/DEMULTIPLEXER
IC 27	MAX690	WATCHDOG / Supervisory Circuit
IC 28	74_08	Quad 2-input AND gate
IC 29	74_32	Quadruple 2-input OR
		8-BIT IBM/ISA Card Edge

The most ovbious parts to save to save money on are ICs1-16.

The cheapest 0.1" pitch DIP package with 128K×8 (at the time of this article) is Digikey.com:BQ4013YMA that hit our 4.5-5.5 VCC sweet spot, is Non-Volatile (NV) SRAM eliminating the need for IC 27 and a battery, and at $25.94 per IC, it would cost $415.04 before applying the new HST and Eco taxes for enough capacity.

If we were to move to a surface mount 0.05" pitch SOP package such as the Digikey.com:IS62C1024AL with 2.0 V data retention threshold and the same VCC, it would cost $4.23 per IC, $67.68 for all sixteen.

However;
Buying Sixteen 128K×8 ICs is silly when we could subsititute a single 2048×8 IC for ICs1-16 and IC 23. Reducing our component count and board size by more than half, while remaining software compatible with the original.

ICs1-16 can only accept address lines 0-16, but each can be individually addressed, therefore IC 23 decodes address lines 17-20 and individually addresses ICs1-16. If there is only one SRAM IC then a decoder is unnecessary and can be eliminated while leaving the original software completely unaltered.


Illustration of difference in complexity between using a single surface mount IC w/ an unused or gate from the original, and the orignial's 17 ICs. Additional power circuitry required.

A single 2048K×8 DIP such as the Digikey:BQ4017M would set us back $107.84. Or a 0.0315" pitch TSOP like the $44.44 Digikey:CY7C1069AV33. Both of which are a king's ransom compared to a $7.22 Digikey:NAND512W3A2DN6E 512MB Flash 48-TSOP-II, or a modest $1.07 Digikey:SST25VF040B 4MB Flash 8-SOIC, both of which would require the use of different hardware and software.

I should be able to learn enough from reverse engineering this hardware to better understand how it works and where we might find areas of improvement.



When (IOSel=0 and Reset=0) IC26 decodes (AD_0-2,CO,RST)
When ^IC28D(IORd=1 and IOWr=1) if [(SA_3-9 is (ID₀,ID₁,00011)) and (AEN=1)] then IC22 sets (IOSel=0)
When (MemRD=0) if [(SA_13-19 is 0011011) and (Reset=0)] then IC21 sets (MemSel=0)

When (MelSel=0) IC17 decodes (D_0-7) by (SA_0-12,ID₀,ID₁)
When ^IC28B(MemSel=0 OR IOSel=0)
IC28C will turn off D1 sinking current to drive LED.
Also, If (IORd=1 and MemRd=1) IC20 loads D_0-7 onto SD_0-7
ElseIf (IORd=0 OR MemRd=0) IC20 loads SD_0-7 onto D_0-7

When (AD₀=0 and IOWR=0) IC29A sets WE=0, else WE=1

When (AD₀=0 and CS=0) IC23 decodes A_17-20 and activates the correct CS_1-16 for the SRAM array, else they are all disabled.

When AD₀ rises IC19 increments its register;
When system CLK rises IC19 outputs its register to A_0-7 // if system CLK does not cycle after AD₀ then an address is skipped!
When RST=0 IC19 resets its register

When CO=0 IC18 loads K1 onto D_0-7 // external input/jumper config

When AD₁ rises D_0-7 is loaded onto A_8-15
When AD₂ rises
D_0-4 is loaded onto A_16-20
D₅ is loaded onto CS
D_6-7 is loaded for no apparent reason // load balancing for lower quality components? to make routing the wires more difficult? To avoid colleagues complaining about not having all lines of the databus connected?

JA_3-4 pull ID_0-1 to 0 when set

The SSD's address without jumpers is 318H, with JA₃ is 10H, JA₄ is 306H, JA_3,4:300H .

	IC21		IC	28		IC26
	D	8-9	3-F	0-1	0	-F
ID	1101	100_	__11	000x	x	yyy
SA	3210	fedc	ba98	7654	3	210
0x300			b 11	0000	0	000
0x318			b 11	0001	1	000

Assuming both jumpers are set we have a IO base address (BA) of 0x300, then
BA+0 is AD₀
BA+1 is CO
BA+2:RST
BA+3:AD₁
BA+4:AD₂
(+5,+6,+7)

An IOread to 0x__302 would activate CO and IC18 would load K1 onto the system databus via IC20.
An IOwrite to 0x__302 would also activate C0, but, but IC20 would change direction and 'fight' it potentially damaging the chips - This would be bad.
Make a note that 0x__302 should be treated as read only,
Similarly any read or write to 0x__304 where bit D₅ is set, activating CS, should not be followed by an instruction that makes use of the SSD's databus except to access SRAM- this would also be bad.

Our ROM base address is 0xD8___.

A quick peek into the image reveals

seg000:002A	db	'Yatronic Silicon-Disk V2.0 (c) 1992'
seg000:004D	db	0
	...
seg000:6800	db	'                '
seg000:6810	db	' COPYRIGHT Uitg.'
seg000:6820	db	' ELEKTUUR B.V.  '
seg000:6830	db	'      BEEK      '
seg000:6840	db	' The Netherlands'
seg000:6850	db	'      1994      '
seg000:6860	db	'                '
seg000:6870	db	'Author: B. Yahya'
seg000:6880	db	'                '

Disassembly to follow.