Reversing a PCI interface without blowing up my LA

[keitheevblog]

I'm reverse engineering a 32-bit 5v PCI interface from a proprietary industrial-motherboard-like computer from the circa-late 90s. It has a non-standard connector Hirose FX2 on it. I'm planning on using a custom PCB of my design to wire that interface to connectors appropriate for my logic analyzer, so that I can confirm pinouts, observe the PCI data/transactions, and just generally mess around.

How can I avoid accidentally blowing up my logic analyzer and/or the DUT, due to improper wiring on the conversion PCB? What's my biggest risk here?

I've got a pretty good idea about the majority of the mapping of the pins, from proprietary to standard PCI names. This has been quite a bit of work so far, in the absence of proper schematics of my computer and the single compatible card that I have.

Using a scope, I've broken the pins down into a few different categories:

• Static voltage +3.6v to +3.8v: This seems too high to be 3.3v, even unloaded. I don't intend on using these pins in the final application, but do want to wire them to the LA for further scrutiny.
• Static voltage +5.3v to +5.5v: Appears to be 5v supply lines, I'm a little bit surprised to see them quite that high?
• Data/control pins: visible transitions happening during a transfer
• Ground pins: Always observed at 0v.

Since there's no voltages beyond ~5.5v, I don't think there's a risk to connecting any pins to data-input-pins on the logic analyzer.

My largest worry is that I'll accidentally connect an output-from-mobo data pin to ground, thereby shorting out the DUT.

If I can confirm at least one ground pin, and then verify that all the other pins I've identified as ground have low-resistance paths to that pin, is that sufficient? With both the DUT and the card, done separately, ensure that all supposed ground pins are connected together? What's the maximum resistance I should be seeing between directly connected grounds?

Can I employ some type of protection between the FX2 port and the logic analyzer in terms of port protection? The LA configuration does include a 100k ohm termination adapter, which is a 100k and 250 ohm in-line resistor with 4pf and 8pf  capacitors on either side of the 250ohm one for each pin.

What other risks am I not seeing?

Thanks

[nctnico]

I wouldn't worry too much. As long as you don't connect 3.3V I/O lines to 5V you can't really break anything.

[RoGeorge]

With those Hirose FX2 connectors, are you sure it's a PCI and not a SCSI interface?

[keitheevblog]

With those Hirose FX2 connectors, are you sure it's a PCI and not a SCSI interface?

Thanks for the reply!

Yes, the only compatible card I have has a PCI MatchMaker S5933QE chip wired directly to that FX2 interface. The motherboard, which is loosely based on an HP Visualize B132/B160L workstation, has a GSC-bus to PCI-bus converter chip called DINO very close in proximity(nearby underneath) of the FX2's. There are other compatible cards, including a fast ethernet card. It has a Intel 21143PD chip --- which also only speaks PCI.

By using the datasheet of both chips, some physical RE'ing of determining which FX2 pin connects to which pin on the S5933QE, I'm able to determine which pin is which.

[thm_w]

• Static voltage +5.3v to +5.5v: Appears to be 5v supply lines, I'm a little bit surprised to see them quite that high?

Sometimes thats normal so when the supply rail is heavily loaded when operating, it will drop to ~5V at the chip.

If I can confirm at least one ground pin, and then verify that all the other pins I've identified as ground have low-resistance paths to that pin, is that sufficient? With both the DUT and the card, done separately, ensure that all supposed ground pins are connected together? What's the maximum resistance I should be seeing between directly connected grounds?

Correct, should be <1 ohm.
Look for large capacitors on the card, negative would almost certainly be ground. Then you can continuity check those to the pins to ground.

[gslick]

By using the datasheet of both chips, some physical RE'ing of determining which FX2 pin connects to which pin on the S5933QE, I'm able to determine which pin is which.

This is what I have so far on the PCI board J5 FX2 connector.  Compare this against what you have found. If there are any differences I can go back and check again. From a quick look it appears that the PCI board draws power from the J6 FX2 connector, although I am not sure about that (the J9 FX2 connector is not populated on the 16600A version of the PCI board so power isn't coming from there).

Code: [Select]

         1   51
         2   52
   CLK   3   53
Ground   4   54  Ground
         5   55
  RST#   6   56  INTA#
         7   57  LOCK#
  REQ#   8   58
Ground   9   59  GNT#
FRAME#  10   60  PERR#
        11   61  TRDY#
   PAR  12   62  Ground
C/BE0#  13   63  C/BE1#
Ground  14   64  C/BE2#
C/BE3#  15   65
  AD31  16   66  AD30
        17   67  AD29
  AD28  18   68  Ground
  AD27  19   69  AD26
Ground  20   70  AD25
  AD24  21   71
  AD23  22   72  AD22
        23   73  AD21
  AD20  24   74  Ground
  AD19  25   75  AD18
Ground  26   76  AD17
  AD16  27   77
  AD15  28   78  AD14
        29   79  AD13
  AD12  30   80  Ground
  AD11  31   81  AD10
Ground  32   82  AD09
  AD08  33   83
  AD07  34   84  AD06
        35   85  AD05
  AD04  36   86  Ground
  AD03  37   87  AD02
Ground  38   88  AD01
  AD00  39   89
 STOP#  40   90  SERR#
        41   91
 IRDY#  42   92  DEVSEL#
Ground  43   93  Ground
        44   94
        45   95
Ground  46   96
        47   97
 IDSEL  48   98
        49   99
        50  100

[keitheevblog]

Thanks for doing this.

I agree about power coming from somewhere else. I also traced FX2-95 to U32, that inverter. I think that might feed some other master reset controller that then in turn feeds S5933-139.

Your pinout matches mine bang on!! Perfect, except for these two, which I'm still undecided, but this is how I'm leaning.

I think FX2-95 is RST# and FX2-6 is a PCI-PRSNT# because:

* My FX2-6 tied to ground through a 21.5kohm resistor to FX2-4, which is a ground pin. (see attached photo) If RST# is an active low signal, shouldn't it be pulled up to +5v?
* The PCI standard for PRSNT# signals is active low so being permanently tied to ground makes sense.
* Pin FX2-95 on the fast ethernet card gets routed across the board, and then on the other side makes its way very close to LXT970A-16, which is an active low reset signal(!!)
* Pin FX2-95 is held high to +5.5v normal active use. With FX2-6 being ground, ofc.

Is your pin FX2-4 and FX-6 strapped together like that? Wouldn't that config keep the PCI interface in permanent reset if RST# was pin 6?

Thanks again
Keith

P.S. Sorry lots of edits.....

[gslick]

On the 16600A version of the PCI board that I have pulled out for probing I measure around 0.2 Ohm between the S5933 RST# Pin 139 (if I have counted the pins correctly) and the J5 FX2 connector Pin 6 using my handheld DMM.

On that 16600A (1997) version of the PCI board, and on one 16700A (1998) and one 16700B (2000) version for which I took photos in the past there is no resistor added between the J5 FX2 connector Pins 4 and 6.

On another 16700A (1999) version of the PCI board I do see a resistor added between J5 FX2 connector Pins 4 and 6 now that I took a look at the photo I have for that one. From the straight on angle of that photo I can't see the markings on the side of that component.

Curious, I wonder what might be going on there.

----------

Another unrelated thing I noticed while looking at the PCI board photos is that there appears to be a set of configuration resistors connecting two pins of the Altera EPM7032 CPLD U14 (the part with the 16600-89006 sticker) to either ground or +5V. Those two pins are set differently between the 16600A, the 16700A, and the 16700B versions. That isn't surprising to see something like that as the three versions are populated differently.

The 16600A version is missing the U5 AMI 1821-0482 and U6 AMCC 1820-0020A gate arrays / ASICs, and the U9 Xilinx XC4010E FPGA. It is also missing the J9 FX2 connector, but the J8 connector is populated, that is where the PS/2 ports are connected to the rear panel in the 16600A.

The 16700B version is missing the J4 10B2 Ethernet BNC connector, the U4 1820-7730 PHY, and the U3 S553-1006-AE isolation transformer.

[gslick]

Here is an updated list of the FX2 connector pins with the +5V pins added. This list of +5V pins was determined by checking continuity between the +5V rail on the CPU board and the pins of one of the FX2 connectors on the CPU board. The CPU board was removed from the analyzer and not connected to anything else at the time.

From a quick look at the PCI board none of these +5V pins appear to be connected to each other or anything else on the PCI board, it is powered from a different connector.

Code: [Select]

         1   51
   +5V   2   52  +5V
   CLK   3   53
Ground   4   54  Ground
         5   55
  RST#   6   56  INTA#
   +5V   7   57  LOCK#
  REQ#   8   58  +5V
Ground   9   59  GNT#
FRAME#  10   60  PERR#
   +5V  11   61  TRDY#
   PAR  12   62  Ground
C/BE0#  13   63  C/BE1#
Ground  14   64  C/BE2#
C/BE3#  15   65  +5V
  AD31  16   66  AD30
   +5V  17   67  AD29
  AD28  18   68  Ground
  AD27  19   69  AD26
Ground  20   70  AD25
  AD24  21   71  +5V
  AD23  22   72  AD22
   +5V  23   73  AD21
  AD20  24   74  Ground
  AD19  25   75  AD18
Ground  26   76  AD17
  AD16  27   77  +5V
  AD15  28   78  AD14
   +5V  29   79  AD13
  AD12  30   80  Ground
  AD11  31   81  AD10
Ground  32   82  AD09
  AD08  33   83  +5V
  AD07  34   84  AD06
   +5V  35   85  AD05
  AD04  36   86  Ground
  AD03  37   87  AD02
Ground  38   88  AD01
  AD00  39   89  +5V
 STOP#  40   90  SERR#
   +5V  41   91
 IRDY#  42   92  DEVSEL#
Ground  43   93  Ground
        44   94
        45   95
Ground  46   96
        47   97
 IDSEL  48   98
        49   99
        50  100

[keitheevblog]

Thanks for the update.

I'm guessing you didn't see +5v on 1, 51, or 53? I'm measuring +5.5V on those during active use......

I'm also seeing +3.6-3.8v on 5, 44, 47, 94, and 97. Many of your missing pins is this lower voltage (rail?)

Perhaps it's the closet romantic in me coming out in old age, but isn't the layout of this FX2 pinning absolutely beautiful? So perfectly ordered? Especially the section of pins between 11 and 89 on both sides of the connector?

You get groups of 6

+5v, data, data, gnd, data, data.
+5v, data, data, gnd, data, data.
..... and so on....like 10 or 12 groups like that

and the data/address bus going in order from AD31 down to AD0, alternating sides. 30,29, other side 28,27, other side 26,25, other side 24,23. So cool!@!@#

The layout almost is in itself built in documentation, like XML almost, that the form of it ensures the correctness. I know there are rules about evenly laying out grounds to prevent "charge dumping" (just heard this term) and similar ideas for the power rails.

It only gets messy at the ends of the connector, where there's more variability and less grouping/structure.

[gslick]

I'm guessing you didn't see +5v on 1, 51, or 53? I'm measuring +5.5V on those during active use......

I'm also seeing +3.6-3.8v on 5, 44, 47, 94, and 97. Many of your missing pins is this lower voltage (rail?)

I should have checked for the +3.4V rail (as labeled on the 16600A power supply, not measured) before you asked. I went back and did that.  Again this was checking for continuity from the power supply output to the FX2 pins. I first traced from the power supply outputs to the power supply connector on the 16600A acquisition board, then through the acquisition board to the connectors where the CPU board plugs into the acquisition board. The +5.1V rail feeds through connector J3 and inductor L4 on the CPU board, the +3.4V rail feeds through connector J3 and inductor L3 on the CPU board. Note that this was on the layout of the CPU board with L1, L2, L3, L4 in a single row. I didn't check on the version of the CPU board with L1, L2, L3, L4 in a 2x2 layout.

With the CPU board not connected to anything else I found continuity between the +3.4V rail at inductor L3 on the CPU board and pins 5, 55, 44, 94, 47, 97, 49, 99 of the FX2 connector on the CPU board.

I also found continuity between ground and pins 50 and 100 of the FX2 connector on the CPU board but not on the PCI board.

I haven't checked any of the FX2 pins while the analyzer was powered up and don't know anything about pins 1, 51, 53 yet.

Code: [Select]

         1   51
   +5V   2   52  +5V
   CLK   3   53
Ground   4   54  Ground
 +3.4V   5   55  +3.4V
  RST#   6   56  INTA#
   +5V   7   57  LOCK#
  REQ#   8   58  +5V
Ground   9   59  GNT#
FRAME#  10   60  PERR#
   +5V  11   61  TRDY#
   PAR  12   62  Ground
C/BE0#  13   63  C/BE1#
Ground  14   64  C/BE2#
C/BE3#  15   65  +5V
  AD31  16   66  AD30
   +5V  17   67  AD29
  AD28  18   68  Ground
  AD27  19   69  AD26
Ground  20   70  AD25
  AD24  21   71  +5V
  AD23  22   72  AD22
   +5V  23   73  AD21
  AD20  24   74  Ground
  AD19  25   75  AD18
Ground  26   76  AD17
  AD16  27   77  +5V
  AD15  28   78  AD14
   +5V  29   79  AD13
  AD12  30   80  Ground
  AD11  31   81  AD10
Ground  32   82  AD09
  AD08  33   83  +5V
  AD07  34   84  AD06
   +5V  35   85  AD05
  AD04  36   86  Ground
  AD03  37   87  AD02
Ground  38   88  AD01
  AD00  39   89  +5V
 STOP#  40   90  SERR#
   +5V  41   91
 IRDY#  42   92  DEVSEL#
Ground  43   93  Ground
 +3.4V  44   94  +3.4V
        45   95
Ground  46   96
 +3.4V  47   97  +3.4V
 IDSEL  48   98
 +3.4V  49   99  +3.4V
Ground  50  100  Ground

[keitheevblog]

I wanted to provide everyone an update on how this is going! 

https://www.gerblook.org/pcb/ACqzxyHRrQxrpfGTqXF5MS 

Here is a prototype circuit board design that will allow the HP 40-pin logic analyzer connections to connect, through the 100k ohm termination adapter to 20-pin, to connect to the 100-pin TE/AMP CHAMP 050 series connectors.

This will allow me to connect my 16900 to the PCI connectors of my 16700. So that I can logic analyze my logic analyzer! And eventually use off-the-shelf PCI cards in my 16700.....

Ordering soon.....fingers crossed I don't blow anything up!

If it's not obvious, Glen Slick has been super helpful during this process! Thanks Glen! If you're not getting my emails, please let me know!

[gslick]

How does your adapter board map the PCI bus signals to the 01650-63203 termination adapter signals?

Are you mapping AD[15::0] to channels 15:0 of one pod, and AD[31:16] to channels 15:0 of another pod?

How about the rest of the PCI bus signals? If the rest of the PCI bus signals could be mapped in the same order as the FuturePlus FS2000 PCI bus probe maps them for the STAT label maybe the IA for the FS2000 could be used for your adapter board.

[keitheevblog]

How does your adapter board map the PCI bus signals to the 01650-63203 termination adapter signals?

In probably a much more simple way than you're imagining.

I route some of the grounds to a large ground zone fill, and to pin 20 on those adapters.
I route the clock signal to pin 3 on those adapters.
I map all of the remaining signals, in order, from 1-100 (excluding the used ground pins) to the data pins on the adapters in order.

Are you mapping AD[15::0] to channels 15:0 of one pod, and AD[31:16] to channels 15:0 of another pod?

I really didn't do any logical grouping. I can rename/relabel/regroup the pins in software after the fact.

How about the rest of the PCI bus signals? If the rest of the PCI bus signals could be mapped in the same order as the FuturePlus FS2000 PCI bus probe maps them for the STAT label maybe the IA for the FS2000 could be used for your adapter board.

While using the FuturePlus sounds enticing, I was trying to keep this design simple and straight forward. If I have to do manual PCI bus decoding, maybe it's not the end of the world. I didn't want to start down the path of FuturePlus without information, an IA, software, and so on.....

Did you see my previous emails?

[gslick]

As long as the PCI clock is routed to the Pin 3 - Clock pin of the 01650-63203 termination adapter I suppose everything else could be configured appropriately with label channel assignments in the logic analyzer configuration.

Prior to the 16700 series I don't think there is a way to reorder the channels assigned to a label. The value of the label is always interpreted in binary from the least significant channel assigned from least significant pod up through most significant channel assigned from most significant pod.

Without double checking, if I remember correctly on the 16700 and the 1680/1690/16800/16900 series the channels assigned to a label can be rearranged in any order. In that case you would be fine using either your 16700 or 16900 series.

[keitheevblog]

Yeah the clock is routed to 3. Although I don't think that's even strictly necessary --- except for a couple "features" that can ignored or just not used. Most of my experience is on the 16700, and when you define a new label, you give it a set of signals, and those signals can be in any order, from any pod. I forget the exact verbiage/convention they use, but you can do cross-pod labeling where a bus shares signals from multiple pods, or even cross multiple cards. There are some limitations in terms of what you trigger on, and how complex those triggers can be when you cross like that, but overall I just get the signal into the LA, and deal with it later....

Thanks again for the input!