Fadal CNC Reverse Engineering

This article originally appeared in My little (home) shop thread on Practical Machinist.

Just to be clear, the control and electronics work fine on my Fadal at present, it was the iron that needed major help.

The process of reverse engineering the control started with researching the history of the Fadal control. On the VMC Electric website they give a few pieces of information about the process of creating the control.

They said they used an Imsai 8080 to develop the NC executive. If you read closely you’ll see they used the NC software to process G-code into NC tapes for their other machines. This specifically includes applying cutter radius compensation and other stuff that old NC systems couldn’t do.

Well, the Imsai 8080 was a clone computer of the MITS Altair 8800. The Altair used a bus comprised of 100 connections on a card edge, derived from a bunch of surplus mil-spec connectors they were able to obtain.

The S100 bus name came from the clone market being tired of referring to the Altair bus because Altair was a competitor. Later the S100 bus became standard IEEE-696, which was only retired a short while back.

Looking at the card cage in the Fadal control, it’s obvious they based their design on the S100 bus, which was popular back before the IBM PC came out. Prior to the PC many computers that hobbyists and enthusiasts used were based on the S100 bus design. This allowed you to separate the functionality of each subsystem into a separate card.

Fadal didn’t adhere to the S100 bus specification much, they mapped signals roughly into the same locations, but they went significantly off book. The power distribution is simplified and many of the S100 signals are not implemented.

The process of reverse engineering the cards done thus far (video and CPU) starts with Eagle CAD and the background investigation I did above. I used information from S100computers.com to make a custom part in Eagle which represents the S100 card edge and pinout. I also created several parts for the special Intel chips used for interfacing to the S100 bus and Intel CPU. All of the datasheets for the components are available online, you just have to search and follow the rabbit hole.

Once I had the components defined, I placed them in an empty schematic sheet roughly in the same location as they appear on the boards. Generally speaking, chips that are close to eachother on boards are functionally grouped, due to the routing requirements.

The Fadal boards are comprised of 2 layers, a top and bottom, this makes them easier to reverse engineer because I can follow the path through the boards. The top layer (component side) is generally devoted to traces (wires) that run horizontally between components. The bottom layer (solder side) is devoted to traces that run vertically.

The logic behind how the boards are layed out is based on standards for generating printed circuit boards. You find the east-west, north-south routing commonly on 80’s vintage stuff because they didn’t have sophisticated auto routers. It’s similar to the difference between a zig-zag toolpath and the tool paths generated by the new fancy HSM CAM tools.

The process of tracing each connection involves using a mechanical pencil as a pointer, a flashlight to see traces that go under chips, and a Fluke DMM in beep continuity mode. From that point it’s a matter of picking an interesting looking portion of the board and tracing the connections to the bigger chips. Then I work on bus interface chips and finally all the little logic chips spread around the board.

The boards are comprised of logic chips that implement one of the following types of operations: count, de-multiplex, boolean logic, and flip-flop. There are specialist chips that do very one dimensional tasks, like combine separate read/write lines into a single read and write bus.

Once you map out some of the signals, you can make inferences about what other signals are and avoid actually tracing those. For example, if you have a latch that has AD0 on one pin and A0 on the corresponding latched pin, then it’s safe to assume that AD1 is A1 and so forth. There are several chips like this, though you have to be careful because Fadal swapped some pin assignments to make board routing easier. This is a dead giveaway that a human spent considerable time looking over the layout and hand routing some, or many, of the signals.

Reading the datasheet and understanding what each pin does on a chip and how the chip functions, that allows you to perform a sanity check on the schematic and detect errors. There were several errors I made due to reading the wrong pin number (looking at the mirror image of a chip can cause these errors), etc. If you spend some time trying to understand what the designer was doing, you can use that understanding to validate the schematic and check it against the real board with a DMM.

Once I had the boards mapped out I could then go back to the software, which is straight machine code. Looking through the machine code I can search for addresses derived from the board logic, such as video display writes.

I discovered that Fadal put a secret diagnostic routine into the system ROM that causes the machine to self-test the keyboard, ROMs, and RAM. The diagnostic mode is triggered by inserting a jumper block into J2 of the video card, this is read at startup and if inserted it will go into diagnostic mode.

It displays this menu:

T1 = KEYBOARD TEST VER 1.6 
T2 = VERIFY EPROMS
T3 = RAM TEST
T4 = RAM EXPANSION TEST
T5 = EPROM CHECKSUM
TX = JUMP TO CNC

I’ve also learned that there is some peripheral in the 0x1000 segment that the control talks to a lot, and since I know RAM is at 0x6800, I know it’s not memory.

Looking at pictures on Ebay of memory cards, I see that the external memory cards can live at the following addresses:

6XXXX 
7XXXX
8XXXX
9XXXX
AXXXX

But since 6XXXX is taken by the on-board memory, only segments 7-A can be used, limiting the control to 256KB of additional memory (two of the 128K cards). The 128K cards have 2 jumper wires on J5 that select the segments they belong in.

Now that I’ve learned this information, I can go back and search the code more. But based on my research yesterday, it may not be possible to run the original ROMs on a faster processor because there are delay loops that seem to depend on the speed of the processor. For example, fetching a key from the keyboard seems to involve some hard coded delays.

Anyway, this was all more for my understanding than any sort of commercial endeavor. The machine works as is, but I may use this information to increase the amount of memory in the system or make my own video card.

I can go to Digikey right now and pick up a 512KB ram chip for $6.44, that’s a heck of a lot easier to interface than 16 separate chips.

Leave a Reply

Your email address will not be published. Required fields are marked *