This article originally appeared in My little (home) shop thread on Practical Machinist.
Just to be clear, the control and electronics work fine on my Fadal at present, it was the iron that needed major help.
The process of reverse engineering the control started with researching the history of the Fadal control. On the VMC Electric website they give a few pieces of information about the process of creating the control.
They said they used an Imsai 8080 to develop the NC executive. If you read closely you’ll see they used the NC software to process G-code into NC tapes for their other machines. This specifically includes applying cutter radius compensation and other stuff that old NC systems couldn’t do.
Well, the Imsai 8080 was a clone computer of the MITS Altair 8800. The Altair used a bus comprised of 100 connections on a card edge, derived from a bunch of surplus mil-spec connectors they were able to obtain.
The S100 bus name came from the clone market being tired of referring to the Altair bus because Altair was a competitor. Later the S100 bus became standard IEEE-696, which was only retired a short while back.
Looking at the card cage in the Fadal control, it’s obvious they based their design on the S100 bus, which was popular back before the IBM PC came out. Prior to the PC many computers that hobbyists and enthusiasts used were based on the S100 bus design. This allowed you to separate the functionality of each subsystem into a separate card.
Fadal didn’t adhere to the S100 bus specification much, they mapped signals roughly into the same locations, but they went significantly off book. The power distribution is simplified and many of the S100 signals are not implemented.
The process of reverse engineering the cards done thus far (video and CPU) starts with Eagle CAD and the background investigation I did above. I used information from S100computers.com to make a custom part in Eagle which represents the S100 card edge and pinout. I also created several parts for the special Intel chips used for interfacing to the S100 bus and Intel CPU. All of the datasheets for the components are available online, you just have to search and follow the rabbit hole.
Once I had the components defined, I placed them in an empty schematic sheet roughly in the same location as they appear on the boards. Generally speaking, chips that are close to eachother on boards are functionally grouped, due to the routing requirements.
The Fadal boards are comprised of 2 layers, a top and bottom, this makes them easier to reverse engineer because I can follow the path through the boards. The top layer (component side) is generally devoted to traces (wires) that run horizontally between components. The bottom layer (solder side) is devoted to traces that run vertically.
The logic behind how the boards are layed out is based on standards for generating printed circuit boards. You find the east-west, north-south routing commonly on 80’s vintage stuff because they didn’t have sophisticated auto routers. It’s similar to the difference between a zig-zag toolpath and the tool paths generated by the new fancy HSM CAM tools.
The process of tracing each connection involves using a mechanical pencil as a pointer, a flashlight to see traces that go under chips, and a Fluke DMM in beep continuity mode. From that point it’s a matter of picking an interesting looking portion of the board and tracing the connections to the bigger chips. Then I work on bus interface chips and finally all the little logic chips spread around the board.
The boards are comprised of logic chips that implement one of the following types of operations: count, de-multiplex, boolean logic, and flip-flop. There are specialist chips that do very one dimensional tasks, like combine separate read/write lines into a single read and write bus.
Once you map out some of the signals, you can make inferences about what other signals are and avoid actually tracing those. For example, if you have a latch that has AD0 on one pin and A0 on the corresponding latched pin, then it’s safe to assume that AD1 is A1 and so forth. There are several chips like this, though you have to be careful because Fadal swapped some pin assignments to make board routing easier. This is a dead giveaway that a human spent considerable time looking over the layout and hand routing some, or many, of the signals.
Reading the datasheet and understanding what each pin does on a chip and how the chip functions, that allows you to perform a sanity check on the schematic and detect errors. There were several errors I made due to reading the wrong pin number (looking at the mirror image of a chip can cause these errors), etc. If you spend some time trying to understand what the designer was doing, you can use that understanding to validate the schematic and check it against the real board with a DMM.
Once I had the boards mapped out I could then go back to the software, which is straight machine code. Looking through the machine code I can search for addresses derived from the board logic, such as video display writes.
I discovered that Fadal put a secret diagnostic routine into the system ROM that causes the machine to self-test the keyboard, ROMs, and RAM. The diagnostic mode is triggered by inserting a jumper block into J2 of the video card, this is read at startup and if inserted it will go into diagnostic mode.
It displays this menu:
T1 = KEYBOARD TEST VER 1.6
T2 = VERIFY EPROMS
T3 = RAM TEST
T4 = RAM EXPANSION TEST
T5 = EPROM CHECKSUM
TX = JUMP TO CNC
I’ve also learned that there is some peripheral in the 0x1000 segment that the control talks to a lot, and since I know RAM is at 0x6800, I know it’s not memory.
Looking at pictures on Ebay of memory cards, I see that the external memory cards can live at the following addresses:
6XXXX
7XXXX
8XXXX
9XXXX
AXXXX
But since 6XXXX is taken by the on-board memory, only segments 7-A can be used, limiting the control to 256KB of additional memory (two of the 128K cards). The 128K cards have 2 jumper wires on J5 that select the segments they belong in.
Now that I’ve learned this information, I can go back and search the code more. But based on my research yesterday, it may not be possible to run the original ROMs on a faster processor because there are delay loops that seem to depend on the speed of the processor. For example, fetching a key from the keyboard seems to involve some hard coded delays.
Anyway, this was all more for my understanding than any sort of commercial endeavor. The machine works as is, but I may use this information to increase the amount of memory in the system or make my own video card.
I can go to Digikey right now and pick up a 512KB ram chip for $6.44, that’s a heck of a lot easier to interface than 16 separate chips.
Nice articles on the fadal stuff! Very interesting – I’m a software engineer with an interest in electrical engineering and I also just bought a fadal 3016 with the 1400-2 control. Memory upgrades have been on my mind as DNC feeding is limited to 9600 baud on this machine and really causing me issues. Sure, I can upgrade the control but the idea of building my own memory expansion has been floating around in my brain lately. Even if you duplicated the original memory expansion board, the cost would be way less than buying one or two used. I’m curious if you made any progress with the memory expansion? I conceptually understand this type of stuff but i simply don’t have enough EE background to design something myself (I work in higher level languages for a day job). Thanks for any info!
-Jordan
I haven’t reverse engineered the memory board yet. AFAICT, there are jumpers/switches on the board for mapping each memory board into different memory segments. The memory boards hold 128KB of RAM, so that’s 2 segments. I think a max of 3 memory boards was supported, but it’s been a while since I looked at it. One of the challenges is that because the Fadal is S100 it uses special bus driver chips that are harder to find. It might make more sense to make a daughter board that goes under the CPU, like what memory add-ons for the PCjr did. You could get a single 512K SRAM chip and put it on an interposer that maps the maximum contiguous block of system memory to the CPU. Intel chips are designed with the reset vector at Fxxx so 0000 is where program memory/interrupt vectors start. I seem to recall the max for older Fadal controls was 422KB, but they count the video memory and memory on the axis controllers as part of the memory size (artificially inflated for marketing I’m guessing). The CPU has 32KB on board, plus 384KB in expansion, that’s 416KB, plus the 5 axis controllers, plus 1KB video memory makes 422KB. The video memory is mapped at 0xFBC00. The only other thing you’d need is a battery backup for the SRAM. Fadal used a simple transistor circuit so when the machine is powered on, RAM is powered by the mains and when turned off the RAM is powered by the lithium battery. I haven’t reverse engineered their power switching circuit, but you could probably find some more modern battery backup designs. A super capacitor would be worthwhile, but you have to isolate the RAM/capacitor from the main power supply when mains disappears. A super-cap combined with a Lithium cell would be belt and suspenders.