• Updated 2023-07-12: Hello, Guest! Welcome back, and be sure to check out this follow-up post about our outage a week or so ago.

Reverse Engineering the MacSnap SCSI

demik

Well-known member
Hello,

Noticed a few month ago that the 53C80 SCSI Chip is in life production by Zilog, available new :

Mouser link : https://www.mouser.fr/ProductDetail/692-Z53C8003VSG/

COVID helping, I bough a broken MacSnap SCSI on eBay and started to reverse it. I though it will be cool to gave a schematic and understand a little bit how it was done. 

Managed to buzz almost everything and new PCB is almost done (and converted for use with a PLCC SCSI chip).

The board consist of :

- 53C80 SCSI chip

- Custom timer circuit to reset the 53C80

- two PALs

You can find a good article written by @Dog Cow on his blog here :

https://macgui.com/news/article.php?t=471

Here is the reversed schematic :



Currently I've got a few issues :

Resistor Packs

The original board got three resistors packs (~ 150Ω each) wired to each output of the 53C80 chip to the ground. I double checked with the MacPlus diagrams and the Mac Classic Ones, and neither of them have those resistors ladders. Any ideas what they are for ?

PAL

What is going on with the two PALs ?

The left PAL looks to be used as an address decoder to generate  /IOR /IOW /DACK and /CS lines and a few other stuff. 

The right one is especially weird. I cannot understand why it's wired that way... It has freaking data lines ! This is straight dark voodoo stuff. Only possibility I came to is that it's used to "live" patch the Mac ROM while running. Is that even possible ?

You can read on the PCB "128k ROM ONLY", so that could be it... 128k ROM as "Mac 128k" or 128k sized ROM (MacPlus) ?

Here is a picture of the board :

original_front.jpeg


I will get a PAL Dumper soon, but my hopes aren't high...

Would creating a new custom PAL be a better idea ? I think creating only /IOR /IOW /DACK and /CS lines should be enough. But we have a limited number of address lines though the ROM socket so that will be tricky.

- /ROMCE should be good for 0x40 0000 to 0x5F FFFF which include SCSI space (0x58 0000 to 0x5F FFFF)

- /CS should need A19:A23 but we only got access to A1:A17

- /DACK don't understand very well what's its for. Looking at the Datasheet, it's used for DMA purposes, but from what I remember, neither the Mac 512k / Plus / SE support DMA.

- A9 + /ROMCE can be used to generate ~IOR and ~IOS, but what about the other ones ?

Let's say ROM data is between 0x40000 and 0x42000, so generate /CS between 0x58 0000 to 0x5F FFFF when /ROMCE is low ?

Other informations

Does anyone have a manual for this board ?

Thanks for your help or input.

 
Last edited by a moderator:

CC_333

Well-known member
Very neat indeed!

If 2020, an otherwise miserable year, brought us anything good, it's a plethora of newly reverse-engineered clones of these otherwise hard to find and very desirable upgrades!

c

 

demik

Well-known member
Ok, some progress:

- after a few lectures, 128k ROM means MacPlus ROM.

- double checked the PALs and there is no clock line, so 90% sure they are combinational. 

- got the Z53C80

- made "new" ROMs using AT27C512R, they works fine : https://www.mouser.fr/ProductDetail/Microchip-Technology-Atmel/AT27C512R-70PU/?qs=lURXKZrvvXfxaNMm462qBA%3D%3D

- since one of the PALs got 14 inputs, I need a logic analyser or two and some other stuff. Bough two of them, waiting for delivery.

- everything is on GitHub now : https://github.com/demik/oldworld/tree/master/EDA/MacSnap SCSI

- PCB is finished, I will probably need to check if everything is routed properly and send them for production afterwards.

routing_v05.png


MacSnap%20SCSI.jpg


Todo :

- need to check caps calues. Some caps value seems weird, others seems dead. I will probably 

- The reset timer circuit is strange, not sure if a replacement will be needed or not yet.

Otherwise, I'm stuck waiting for hardware (PAL DUMPER on the way, LA, etc…)

 

maceffects

Well-known member
@demik wow! Very nice work, I’m impressed. Looks like you’re pretty much ready for prototyping. I don’t think clearance will be a problem because the MacSnap processor upgrade was taller IIRC. If you get this working and want to work together on making it a complete set, I can injection mold this plastic part. 

20D47A25-C557-47E3-B700-DB1645122E7E.jpeg

 

trag

Well-known member
128K ROM only because the early Mac ROM (64K) did not contain firmware to support SCSI.

IIRC, and I don't remember enough detail, the Mac Plus and previous models, use D1 and D2 in a strange way.  I can't remember what specifically they're used for.    That's probably why the other PAL touches those two.   Unless I'm confusing them with A1 and A2....

 

sutekh

Well-known member
This is awesome! I'm anxious to be one of your first customers or help beta test if desired. My 512K has a MacSnap 548E and Plus ROMs, but I've never been able to track down a real MacSnap SCSI to go with it.

 

History_SE30_Dude

Well-known member
Those resister packs judging by their location are internal termination, this was common to see on early SCSI cards and would be installed if you were not using an internal drive. 

 

demik

Well-known member
Have you verified clearance, that is, head height for the populated board?


Didn't think of that. I will do a dummy PCB to check this, thanks !

@demik wow! Very nice work, I’m impressed. Looks like you’re pretty much ready for prototyping. I don’t think clearance will be a problem because the MacSnap processor upgrade was taller IIRC. If you get this working and want to work together on making it a complete set, I can injection mold this plastic part. 

View attachment 39779


Thanks ! I'm missing the PALs equations for now, and I'm not as skilled with PALs as some other folks around there.

Anyway, I made a few changes to the PCB:

- There is now Internal terminaison power (for SCSI2SD)

- I put a 26 pin IDC header wired to use a LPT header. They are avaible on eBay or Aliexpress for like $3 or $4 bucks. The only thing missing would be the plastic part. Will get back to you when everything is working.

Those resister packs judging by their location are internal termination, this was common to see on early SCSI cards and would be installed if you were not using an internal drive. 


it makes sense, thanks. Would that make sense on the new board ? Does something like SCSI2SD provide termination ?

I would like to offer the option to enable or disable the termination. Resistors are ~ 143Ω each to ground. Is there something to improve here ?

 

History_SE30_Dude

Well-known member
The scsi2sd has termination that can be enabled or disabled in software. I’ve seen it cause issues and I’ve seen it not. If the intent is to have an internal drive then no problem but if you don’t it could cause problems. 

 

maceffects

Well-known member
@demik I ordered some of @Kai Robinson 's PAL dump boards and I'll be assembling them soon.  If you want me to send you one let me know.  It seems like if that is the only thing stopping the project, that can be easily solved. 

 

demik

Well-known member
@demik I ordered some of @Kai Robinson 's PAL dump boards and I'll be assembling them soon.  If you want me to send you one let me know.  It seems like if that is the only thing stopping the project, that can be easily solved. 


Thanks ! I've already got two on the way. But the thing is on the MacSnap, one PAL has an output used as an input and the other one has like 14 inputs. Kai's boards only works with 16L8 PALs (8 inputs only)

I will need to build a custom PAL dumper for this... And yeah it's the only thing that's is difficult really

The scsi2sd has termination that can be enabled or disabled in software. I’ve seen it cause issues and I’ve seen it not. If the intent is to have an internal drive then no problem but if you don’t it could cause problems. 


Nice! With a BlueSCSI (arduiscsino) you could probably fit everything right on top (or maybe even on the same board, haha!). I'm interested in trying one out for my 512k.


Thanks both of you for your feedback. I've looked around SCSI specs this week-end and choose this set up :

- the board will provide both active termination and termination power for SCSI2SD and alike. Each one can be disabled if needed.

- to prevent damage to the logic board, termination power will be limited to 5W

The active terminaison should consume less power than the actual passive one, so in theory this should works. I'm still trying to figure which termination power regulator to get as I want to use only new parts on the kit.

There is one (MC34268) still produced, but the current stocks are empty. It's in SOIC-8 format, I plan to put it on a DIP-8 socket adapter so it can be removed if needed.

This one is cool because it was built especially for SCSI terminaison, has short circuit protection, and cost less than $1

 
Last edited by a moderator:

demik

Well-known member
one-year-later.jpg


... some progress was made. This post is long and technical, hope you will enjoy it. This is a summary of the lost notes during the great forum crash as well.

Progress was not easy, considering my PAL knowledge was very low last year. I also destroyed some critical components while working on this and had to source/repair one of the PALs, which took a while. Add that the current chip shortage and here we are.

Note to myself: don't put chips backwards, they do funny sounds that way.

Reversing PLDs
We worked on reversing the PLDs, which is the hardest part of this SCSI card. The PLDs have been dumped and the JEDEC dump is available here :

Unfortunately, the original design used EP320s which is a CPLD with advanced features. As this chip is Unobtainium now, the design had to switch to ATF16V8Bs, which is the closest PLD in production today.

The reverse process was hard, and I almost gave up but @Bolle saved this project by having a rare programmer that could read this specific chips

dump.jpeg


After having the fuse map, we converted it to a fuse map usable by ATF16V8Bs. (The EP320 is using a specific fuse map)

Some stuff didn't work after converting the PLD equations from EP320s to ATFs, so we had to change the pinout a little bit and add external components to fight data corruption, but last week, we finally had a system install + SCSI boot using ATFs

ATFs_boot.jpeg


How does it work
If you look at the schematics on the first post, you will notice that this board cannot replicate a functional Mac Plus SCSI section. The board is only connected using some address lines and data lines. There isn't any A0, /UDS or /LDS lines either, which are needed for SCSI.

On a Mac Plus, SCSI base address is located at 0x580000, and you use even addresses for write operations (base write address is 0x580001).

All of this is working using clever hacks (kudos to the DOVE engineers !)
First, there is another RESET circuit on the board that reset all of this on power on.
Then, there is theses PLDs, but how do they work ?

- first PLD (aka DOV1, Near C6) is mostly a line decoder. It will generate /IOR /IOW /CS /DACK and similar control lines used by the SCSI chip.
- second PLD (aka DOV2, Near C7) is ... mostly a ROM patcher.
- both of them combined are a state machine

ROM patching

The board is patching two sections of the Mac Plus ROM. Thanks to @bigmessowires work (see here), figuring out that was easy.
Here is a diff of a 512ke without and with a MacSnap SCSI installed.

Diff:
--- 512ke.hex    2021-06-01 22:58:25.524067729 +0200
+++ macsnap.hex    2021-06-01 22:58:41.980248114 +0200
@@ -60,7 +60,7 @@
 000003b0  02 8e 21 fc 00 40 00 00  02 ae 97 cb 20 38 01 08  |..!..@...... 8..|
 000003c0  e2 88 2c 40 2e 40 9e fc  04 00 42 b8 02 ba 21 fc  |..,@.@....B...!.|
 000003d0  00 01 00 01 0a 02 70 ff  21 c0 0a 06 31 c0 03 f6  |......p.!...1...|
-000003e0  42 78 0b 22 20 39 00 42  00 00 b0 b9 00 44 00 00  |Bx." 9.B.....D..|
+000003e0  42 78 0b 22 20 39 00 42  00 02 b0 b9 00 40 00 00  |Bx." 9.B.....@..|
 000003f0  67 06 11 fc 00 c0 0b 22  42 b8 01 3e 21 fc 00 ef  |g......"B..>!...|
 00000400  e1 fe 01 d4 21 fc 00 df  e1 ff 01 e0 41 fa 1c 22  |....!.......A.."|
 00000410  43 f8 08 f4 72 02 61 00  04 46 50 f8 0a 58 42 b8  |C...r.a..FP..XB.|
@@ -5925,7 +5925,7 @@
 00017270  02 f6 bc b8 01 6a 6f 14  60 e6 22 6e 00 10 32 82  |.....jo.`."n..2.|
 00017280  61 00 02 18 66 06 22 6e  00 0c 32 82 3d 40 00 14  |a...f."n..2.=@..|
 00017290  70 0c 60 1c 20 5f 4e 56  00 00 48 e7 3f 38 26 7c  |p.`. _NV..H.?8&||
-000172a0  00 58 00 00 28 7c 00 58  00 01 7e 00 78 00 4e d0  |.X..(|.X..~.x.N.|
+000172a0  00 58 00 00 28 7c 00 58  00 03 7e 00 78 00 4e d0  |.X..(|.X..~.x.N.|
 000172b0  4c df 1c fc 4e 5e 20 5f  de c0 4e d0 18 bc 00 80  |L...N^ _..N.....|
 000172c0  19 7c 00 01 00 20 08 2b  00 06 00 10 67 00 00 2e  |.|... .+....g...|
 000172d0  61 00 02 0c 08 2b 00 05  00 10 66 00 00 20 70 00  |a....+....f.. p.|

First patched offset changes this
Code:
Cmp.L     ($440000), D0
to this
Code:
Cmp.L     ($400000), D0

This makes the ROM mirroring check fail, which is used to detect if the board is a 512ke or a Mac Plus one (the Mac Plus has the CAS chip which split the ROM address between ROM and the SCSI chip). It basically fakes a Mac Plus board.

Second patched offset changed this
Code:
Move.L    #$580001, A4
to this
Code:
Move.L    #$580003, A4

There the base write address is moved from 0x580001 to 0x580003 so it can be detected by the state machine using address line A1.
And the state machine does the rest of the black magic.

That's a very clever design !

Clearance issue
There is a clearance issue with the IDC50 connector, so it will probably be removed from the final design. @cheesestraws confirmed this with its board as well. There is no way to use a standard SCSI cable where the SCSI card is located inside a plus/512Ke.
Dove removed it for a reason.

This is not a real problem, as one could use an "external" BlueSCSI/SCSI2SD inside a 512ke as the replica board will provide SCSI power.

Next
Now I have to check all the caps values by desoldering them, and do a prototype board. Should be good this year ! Maybe improve the reset reset circuit.
 

dhamultun

New member
I’ve got a Mac 512 that has both the MacSnap SCSI and a memory upgrade. ROMs must have been changed as well since it show up as a Mac Plus. Seems to be working reasonably well until I decided to boot from my BlueSCSI ver 1.1-a. Boots fine and is ok until it needs to write to the disc. Maybe the chipset is not compatible with BlueSCSI? Same BlueSCSI works flawlessly with my actual Mac Plus. ideas?
 

Attachments

  • IMG_8015.jpeg
    IMG_8015.jpeg
    1.7 MB · Views: 15
  • IMG_8017.jpeg
    IMG_8017.jpeg
    2 MB · Views: 15
  • IMG_8022.jpeg
    IMG_8022.jpeg
    2.5 MB · Views: 23
  • IMG_8023.jpeg
    IMG_8023.jpeg
    2.5 MB · Views: 22
Top