Showing posts with label SSD Clone. Show all posts
Showing posts with label SSD Clone. Show all posts

2010-07-17

Card shuffle.


This is an alternative Clone t`engineering design using the NV SRAM. It is approximately half the size of the original though most of the space is wasted. It uses less than half the components though only the SRAM array and power circuitry has been concatenated. And it is a quarter of the cost though it still is using DIP packaging. And all of this without a radical departure from B. Yahya's original design! (Yay progress!)

A casual glance at the schematic shows I have opted not to wire the address lines in normal order; this shuffling of the address lines creates new problems when programming this board. Including having to make an adapter for your logic analyser/bus sniffer if it has a hardwired hat. Needing to store the ROM image in that peculiar byte order. Debugging if it was a programming or image processing error causing a software malfunction. Having your most fastidious colleagues complain* that you badly screwed up the design of the project citing the prefered logical order for the ICs in question, shouting that it can't possibly work.

However, this approach has strong advantages over fixed logical ordering. First: it eliminates the need for vias to satisfy an artifical ordering requirement. Second: if a competitor dumps the ROM without reverse engineering the board the image will appear corrupted. Third: Gives you something to write about. Fourth: the satisfaction of saying "I told you it would work" to you colleagues after a job well done.

Shuffling, not to be confused with stacking:
VPP27256VDD
A12A14
A7A13
A6A8
A5A9
A4A11
A3OE
A2A10
A1CE
A0D7
D0D6
D1D5
D2D4
VSSD3
VPPmutantVDD
A0A1
A2A13
A3A4
A14A5
A6A7
A8OE
A9A10
A11CE
A12D7
D0D6
D1D5
D2D4
VSSD3
Difficult hardware, hard software.


From the above we see that the address line order {A0-20} is now
{12,11,9,8,6,14,3,2,4,5,10,7,0,13,1}. We can reason that the value stored in 0x0000 is now read from 0x0000, but the value in 0x0001 is now read from 0x0004, 0x0002 is now read from 0x0001, 0x0004 from 0x01000, etc.

The ROM chip is read externally out of order while internally the image is stored sequentially {00, 01, 02...}. The image must be distorted/mutated to match the read order else it won't be read back correctly. One method is to build an adapter for our programmer that would shuffle the address lines for us; however some ROMs do not behave well if written to non-sequentially and every design would require a different adapter. Making this a physical hardware adapter would either exaust our resources, or require constant reconfiguration, leading to inevitable calamity from loose/misplaced connections.

//Advanced Hex Editor script, does not work!

//address[write]=2^[read]
a[0]=2^12;
a[1]=2^11;
a[2]=2^9;
a[3]=2^8;
a[4]=2^6;
a[5]=2^14;
a[6]=2^3;
a[7]=2^2;
a[8]=2^4;
a[9]=2^5;
a[10]=2^10;
a[11]=2^7;
a[12]=2^0;
a[13]=2^13;
a[14]=2^1;
// base betweeen iterations, avoids an inner loop/summation.
B[0]=0;
B[14]=0;
ii=0; //because I don't feel like calculating an index for a sequential read.
D[0]=0; //Image holder.
D[32767]=0;

for(i[0]=0;i[0]<a[0];i[0]+=a[0])
 {B[0]=i[0];
 for(i[1]=0;i[1]<a[1];i[1]+=a[1])
  {B[1]=B[0]+i[1];
  for(i[2]=0;i[2]<a[2];i[2]+=a[2])
   {B[2]=B[1]+i[2];
   for(i[3]=0;i[3]<a[3];i[3]+=a[3])
    {B[3]=B[2]+i[3];
    for(i[4]=0;i[4]<a[4];i[4]+=a[4])
     {B[4]=B[3]+i[4];
     for(i[5]=0;i[5]<a[5];i[5]+=a[5])
      {B[5]=B[4]+i[5];
      for(i[6]=0;i[6]<a[6];i[6]+=a[6])
       {B[6]=B[5]+i[6];
       for(i[7]=0;i[7]<a[7];i[7]+=a[7])
        {B[7]=B[6]+i[7];
        for(i[8]=0;i[8]<a[8];i[8]+=a[8])
         {B[8]=B[7]+i[8];
         for(i[9]=0;i[9]<a[9];i[9]+=a[9])
          {B[9]=B[8]+i[9];
          for(i[10]=0;i[10]<a[10];i[10]+=a[10])
           {B[10]=B[9]+i[10];
           for(i[11]=0;i[11]<a[11];i[11]+=a[11])
            {B[11]=B[10]+i[11];
            for(i[12]=0;i[12]<a[12];i[12]+=a[12])
             {B[12]=B[11]+i[12];
             for(i[13]=0;i[13]<a[13];i[13]+=a[13])
              {B[13]=B[12]+i[13];
              for(i[14]=0;i[14]<a[14];i[14]+=a[14])
               {B[14]=B[13]+i[14];
                D[ii]=get1u(B[14]); //Gets 1-byte unsigned value at offset
                ii+=1;
               }
              }
             }
            }
           }
          }
         }
        }
       }
      }
     }
    }
   }
  }
 }
for(ii=0;ii<32767;ii+=1)
 {set1u(ii,D[ii]);}//overwrite original.


The above script uses nested loops to represent each bit of the address line. It sequentially reads the bit and stores it in the correct 'shuffled' location.

I acknowledge that there are some operands not represented in Kahei or C that would allow for a more efficient program. And that using a matrix would be far faster and more efficient. However such an approach would be far less flexible and difficult to understand. And the effort required to build one I cannot justify especially for a program that would normally only be used once. But I am a hardware guy, an expert programmer may not have the same difficulty.


Before I get complaints that I am being unfair to the original designer let me point out that there has been 18 years of technological development since it was created; B. Yahya had the courage (and ethic) to publish this design at a time when many companies were terrified to; The original design itself was so well done that unaltered it is possible, though not commercially viable to produce it today; And the autorouter jab is fair game as vias should not be inside an array, except where lines cannot run parallel or for thermal reasons; Also, the original was a success; wasn't it?

2010-07-15

Clone t`engineering

Part 3: continued from Cloning for fun or profit

Copying this card is not enough, were we to make a profitable version it would need to be cheaper, and if we were reviving this product its replacement will need to be better.

To pursue both of these an understanding of the originals function, and how it functions is essential.

Schematic of the original


A quick survey of the original we see:

ICs1-1662_1024128K × 8 Static RAM
IC 1727_256256 K (32K × 8) CMOS EPROM
IC 1874_5738-bit D latch BUS DRIVER; 3-state
IC 1974_5908-bit BINARY COUNTER
with output register
IC 2074_245Octal BUS TRANSCEIVER
ICs21,2274_6888-bit MAGNITUDE/IDENTITY COMPARATOR
IC 2374_1544-line to 16-line data SELECTOR/MULTIPLEXER
ICs24,2574_5748-bit D type FLIP FLOP bus driver; 3-state
IC 2674_1383-line to 8-line DECODER/DEMULTIPLEXER
IC 27MAX690WATCHDOG / Supervisory Circuit
IC 2874_08Quad 2-input AND gate
IC 2974_32Quadruple 2-input OR


8-BIT IBM/ISA Card Edge

The most ovbious parts to save to save money on are ICs1-16.

The cheapest 0.1" pitch DIP package with 128K×8 (at the time of this article) is Digikey.com:BQ4013YMA that hit our 4.5-5.5 VCC sweet spot, is Non-Volatile (NV) SRAM eliminating the need for IC 27 and a battery, and at $25.94 per IC, it would cost $415.04 before applying the new HST and Eco taxes for enough capacity.

If we were to move to a surface mount 0.05" pitch SOP package such as the Digikey.com:IS62C1024AL with 2.0 V data retention threshold and the same VCC, it would cost $4.23 per IC, $67.68 for all sixteen.

However;
Buying Sixteen 128K×8 ICs is silly when we could subsititute a single 2048×8 IC for ICs1-16 and IC 23. Reducing our component count and board size by more than half, while remaining software compatible with the original.

ICs1-16 can only accept address lines 0-16, but each can be individually addressed, therefore IC 23 decodes address lines 17-20 and individually addresses ICs1-16. If there is only one SRAM IC then a decoder is unnecessary and can be eliminated while leaving the original software completely unaltered.


Illustration of difference in complexity between using a single surface mount IC w/ an unused or gate from the original, and the orignial's 17 ICs. Additional power circuitry required.

A single 2048K×8 DIP such as the Digikey:BQ4017M would set us back $107.84. Or a 0.0315" pitch TSOP like the $44.44 Digikey:CY7C1069AV33. Both of which are a king's ransom compared to a $7.22 Digikey:NAND512W3A2DN6E 512MB Flash 48-TSOP-II, or a modest $1.07 Digikey:SST25VF040B 4MB Flash 8-SOIC, both of which would require the use of different hardware and software.

I should be able to learn enough from reverse engineering this hardware to better understand how it works and where we might find areas of improvement.



When (IOSel=0 and Reset=0) IC26 decodes (AD0-2,CO,RST)
When IC28D(IORd=1 and IOWr=1) if [(SA3-9 is (ID0,ID1,00011)) and (AEN=1)] then IC22 sets (IOSel=0)
When (MemRD=0) if [(SA13-19 is 0011011) and (Reset=0)] then IC21 sets (MemSel=0)

When (MelSel=0) IC17 decodes (D0-7) by (SA0-12,ID0,ID1)
When IC28B(MemSel=0 OR IOSel=0)
IC28C will turn off D1 sinking current to drive LED.
Also, If (IORd=1 and MemRd=1) IC20 loads D0-7 onto SD0-7
ElseIf (IORd=0 OR MemRd=0) IC20 loads SD0-7 onto D0-7

When (AD0=0 and IOWR=0) IC29A sets WE=0, else WE=1

When (AD0=0 and CS=0) IC23 decodes A17-20 and activates the correct CS1-16 for the SRAM array, else they are all disabled.

When AD0 rises IC19 increments its register;
When system CLK rises IC19 outputs its register to A0-7 // if system CLK does not cycle after AD0 then an address is skipped!
When RST=0 IC19 resets its register

When CO=0 IC18 loads K1 onto D0-7 // external input/jumper config

When AD1 rises D0-7 is loaded onto A8-15
When AD2 rises
D0-4 is loaded onto A16-20
D5 is loaded onto CS
D6-7 is loaded for no apparent reason // load balancing for lower quality components? to make routing the wires more difficult? To avoid colleagues complaining about not having all lines of the databus connected?

JA3-4 pull ID0-1 to 0 when set

The SSD's address without jumpers is 318H, with JA3 is 10H, JA4 is 306H, JA3,4:300H .

IC21
IC28
IC26

D 8-9 3-F 0-1 0-F
ID 1101100___11000xxyyy
SA 3210fedcba9876543210
0x300

b 1100000000
0x318

b 1100011000


Assuming both jumpers are set we have a IO base address (BA) of 0x300, then
BA+0 is AD0
BA+1 is CO
BA+2:RST
BA+3:AD1
BA+4:AD2
(+5,+6,+7)

An IOread to 0x__302 would activate CO and IC18 would load K1 onto the system databus via IC20.
An IOwrite to 0x__302 would also activate C0, but, but IC20 would change direction and 'fight' it potentially damaging the chips - This would be bad.
Make a note that 0x__302 should be treated as read only,
Similarly any read or write to 0x__304 where bit D5 is set, activating CS, should not be followed by an instruction that makes use of the SSD's databus except to access SRAM- this would also be bad.

Our ROM base address is 0xD8___.

A quick peek into the image reveals
seg000:002Adb'Yatronic Silicon-Disk V2.0 (c) 1992'
seg000:004Ddb0
...
seg000:6800 db '                '
seg000:6810 db ' COPYRIGHT Uitg.'
seg000:6820 db ' ELEKTUUR B.V.  '
seg000:6830 db '      BEEK      '
seg000:6840 db ' The Netherlands'
seg000:6850 db '      1994      '
seg000:6860 db '                '
seg000:6870 db 'Author: B. Yahya'
seg000:6880 db '                '



Disassembly to follow.


2010-07-08

Cloning for fun or profit

Cloning a piece of hardware is an excelent way to learn about how it is designed, and how it works. This is often viewed as a seedy trade inwhich people bastardise the hard-work of honest engineers and other designers to produce the same product without the overhead cost of design and marketing.

Unfortunately in my experience design documentation is almost always lost and the only way to recover (or sometime resume production of) a product is to clone it and there is little discussion on techiques for achieving this.

Generally when I 'clone' a product, I build an exact replica (in so far as component layout and electrical connections). Then I go looking for what can be made cheaper. Then better. Then the maintence cycle begins.

I like to use high-resolution photography and logic probes to start with; however grainy photographed pages from a foreign trade magazine from a random website is more than enough to clone a product and start development.

Take for example the Solid State Diskdrive for the IBM XT featured on K. Giannopoulos' website (microwave.gr:Build your own Vintage PC-XT Computer). From these massive bitmaps, and roms we can produce plans for a clone and then some.

Step 1: Preparing the reference material
To obtain the reference board art start by tracing the bitmaps with Inkscape. This allows evaluation the quality of the reference material and gives me a reference for the wiring of the first clone.

Next using the outside corners as reference points calculate how much to rotate these layers to align their edges horizontally.

Top layer
  • (1463.789,5.971)
    0.233716199°
  • (1468.760,3.486)
    0.135987303°
  • 0.184851751°

Bottom layer
  • (1464.944,2.279)
    0.089134448°
  • (1468.780,9.950)
    0.388134564°
  • 0.238634506°


Okay;
In this example because the bottom layer is clearly out of square as the angle does not match, this could be because of perspective, a transform can fix that if it is flat. There is also noticable distortion bacause the pages were not pressed flat when the picture was taken, but maybe I will get lucky and manage to align it anyways.

Nope.



The red top layer does not completely align with the blue bottom layer. There are also a number of 'broken' traces where the line did not render very well. Even if this image was rescaled a pcb made precisely to this image the pcb would require significant repairs where the components do not fit, where the layers do not connect and where the wires are disconnected. Fixing this would be quite difficult.

If it were in alignment we could then replace the polygons with wires and convert this into gerber format using a script. But it's not so I will be drafting the board art manually. Fortunately this website also posted a schematic and parts list.


Step 2: Using the reference material.
Add all of the parts necessary to a new Eagle schematic. I found that I needed to add two 'new' comonents to the library: the three lead capacitor and the DIP32 RAM.

Working from one corner to the other recreate populate the schematic and board with approximately the same layout. Once populated wire the schematic and board as close to the original as is practical. The reference art can be coloured to track progress and distinguish different signals easier.

I think lavender is a fine colour for the data bus.


While I was doing this I made a few interesting discoveries: most significantly was the omission of CLK from the cardedge to IC19 on the original schematic, without this a clone card made only from the schematic would not work.

The secret CLK.


The Address and Data lines were also shuffled around by the orignal designer to help with board layout. This is good since even with the bits shuffled around each address is still unique and the data (provided it is always stored in the same order) will still read back correctly.
As evidenced by the vias inside the array of memorychips the previous designer got bored and used the autorouter resulting in some spectacularly stupid wiring.
I've duplicated most of the 'stupid' so that my colleagues will not harass me about differing from the original "too much", though while linking the data and address lines from the memory chips I made a hash of it since I intend to design that out entirely.

And here is the result of eleven hours of unpaid work: a clone of the original board, minus some stupid, plus some sloppyness when I got bored.


Now that we have a hardware/software compatible clone we can make it cheaper by substituting components.

Part3: to be continued


Note: I was unable to upload the PDF, SVG, brd, sch and lbr files I had intended to illustrate this post with. I am also disinclined to seekout a file host for these if nobody asks for them.

Edit: I have been contacted, links to follow.

Edit: Build your own Vintage PC-XT Computer files are availble in the Solid state disk section.