Since getting my first Amiga 500 in the late 80s I was always interested in Amiga copy protection and disk reading/recording in general. Around 1990 I got myself a copy of “The Principles of Computer Hardware” by Alan Clements (ISBN 0-19-853703-4). A pretty geeky book for a 15 year old kid. This is where I learnt about FM/MFM encoding techniques. Just checked Amazon there and noticed that it’s now in its third edition….£5.33 for a second hand copy delivered to my door…add to basket!
Having seen some great devices on the net such as this Floppy Disk Emulator I wanted to do some tinkering myself (having said that this product is on my wish list for sure). So this week I bought myself a logic analyser from Saleae. What a fantastic little gadget. Cost something like £110 delivered by 24/48 hour courier. My oscilloscope was useless since the data on the read line is not consistent and it’s not a storage scope.
Within minutes of unpacking the device I was capturing data. Brilliant.
In this picture you can see the logic analyser in the bottom right-hand corner. The drive is a Sony MFP920-Z/131. The IC on the breadboard is a Microchip PIC18F2525 which I am using to control the drive (such as select, motor control, head seeking, read/write control. etc). In the top right is the excellent Real Ice in-circuit emulator.
And here is a screen grab of the capture. It clearly showed me 4us, 6us and 8us periods (give or take a few nanoseconds). The 2 million samples at 8Mhz allowed me to capture just over 250 milliseconds of data, starting from INDEX being asserted. The disk rotates at 300RPM so the track can be read in 200ms.
The program at this point is pretty useless to me so I did a binary export (2,100,000 bytes). One byte per 125ns sample window.
I knocked up a quick piece of C# code to analyse the data. To cut a long story short the code looks for the 4, 6 and 8us pulses. There is a 64bit int which I’m using as a shift register. If a 4us pulse is found then 10 is written to the register. If a 6us pulse is found then 100 is written to the register. If an 8us pulse if found then 1000 is written. The windows do vary so the code is tolerant to about 5% at the moment – this seems to work OK for the disk under test. The timing is reset with every flux transition detected so this avoids any accumulative errors.
With every bit placed into the shift register it is checked for the special MFM sync word (0x4489) and my breakpoint is hit.
Wow. It worked first time – I did not expect that for a second! (ok, first signs are good; don’t get too excited just yet).
private static void PushBit(ref UInt64 sync, int p)
{
sync <<= 1;
if (p == 1) sync |= 1;
if ((sync & 0xFFFFFFFF) == 0x44894489)
{
Console.WriteLine("Sync Marker found");
}
}
This breakpoint was hit 14 times, which by my calculations is about right. We expect 11 sectors per track, so with 250ms read that’s about 1.25 tracks. 11 x 1.25 = 13.75…
A point worth noting is that when the full 64bits are inspected I am getting 2 different values:
0x2aaaaaaa44894489 and
0xaaaaaaaa44894489
I think this is correct since the first part of bits depend on previous bits.
Next steps… convert the MFM data into real bits and see if the block checksum computes.