Snagging I2C disk drive parameters
Sometimes when repairing a disk drive (here we are talking about physical drive repair rather than basic sector editors), there is a requirement to transfer drive specific information that is contained in one of the onboard I2C chips.
There are a number of methods to accomplish this goal:
A. Via the Disk drive connector and vendor specific commands.(only if the PCB is functional)
B. Physical removal of the actual I2C chip, followed by a transplant to the refurbished drive.
Option B is fairly common, however it suffers from a number of possible caveats:
1. There are risks that the removal of the I2C chip, may break the legs
2. Risks that the removal may damage one or both of the PCB’s
3. The method precludes a ‘backup’ being taken, unless you invest in an I2C chip reader.
4. If you should need to return it back to the manufacturer,It is very difficult to make the modified board look exactly like a new product.
Just like your very first date… it is difficult to get your hair exactly right. The same can be said for re-worked SMT, usually there is colour variation on the solder and the exact re-alignment of the parts requires a great deal of work, especially when a hot air rework pencil is used.
Therefore we propose a system consisting of Hardware and custom software that allows:
1. The contents of a the I2C chip to be extracted without the removal of the chip
2. Security/validity checksum of the contents.
3. Saving of the extracted file, so that an analysis can be performed against other I2C chip images taken from donor drives.
Stage 1 Connection
We have an old SCSI disk drive PCB from about 1997 (Quantum Phoenix Rev A), to this we have added a SMT chip probe connector, and ensured we have a good strong connection to the legs of the I2C IC.
This particular I2C chip is identified as a CSI24WC64J, which is a 64k 8 bit CMOS EEPROM, a quick check of the data sheet says that it is good for supply rails of +1.8v to +5.5v
Currently the I2C lines (WP/A0/A1) are left unconnected.
On modern CMOS chips reverse biasing the gates can cause destructive currents to flow between the substrate and transistors that are located within the IC’s , this is called Reverse current SCR latch up, if the current is not limited the current flow continues to increase destroying the chip.
Since we are ‘injecting’ charge into the I2C SCL/SDA connections as well as supplying power into Vcc, there is a chance we could may be reverse biasing the controller IC’s that connect to the I2C flash chip. So during the experiment we will also monitor the temperature of the other IC’s and the overall current requirements.
Stage 2 Software
We will now outline the functionality of the software:
Stage 3 Results
After spending a bit of time on the custom software , we have some preliminary results.
The main issue with the I2C bus is that it is a serial system with a maximum throughput of about 400Khz, in the case of this particular I2C chip we need to pull 8k of data over the wires, as a result obtaining the chips content can take several tens of seconds.
Additionally the chip needs to take part in protocol hand shaking between the Slave (chip) and the Master (our reader).
We start off by instructing the I2C chip which address to start reading at, then we read a byte, acknowledge the byte, then get another.
Failure to send an acknowledge in time and the I2C chip drops out of send mode, but more critically engaging in handshaking already reduces the data rate by a factor of at least two.