Baggage x-ray machine teardown - Page 1
Forum section: electronics / general

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 06, 2012, 09:23:04 am
content: There it is! But I'm saving this one for tonight, with popcorn and a drink

author: firewalker
author_rank: Super Contributor
timestamp: October 06, 2012, 10:34:01 am
content: No HD version for this one?Alexander.

author: muvideo
author_rank: Frequent Contributor
timestamp: October 06, 2012, 10:54:22 am
content: Now I have to find where is that damn hdmi cable to connect the pc to TVFabio.

author: Psi
author_rank: Super Contributor
timestamp: October 06, 2012, 12:41:05 pm
content: The desiccant bags are there to keep the opamps and related circuitry dry. They're gain needs to be high and exact across all sensors. They tend to drift a lot with moisture so it's critical to keep them dry.Here's an array board from a rapiscan, they do it a better way by encapsulated the opamp circuitry in a moisture proof coating.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 06, 2012, 12:48:30 pm
content: Quote from: firewalker on October 06, 2012, 10:34:01 amThe HD render from vegas came out as garbage - maybe as it was >2gb. 640x480 was the only setting that worked.

author: Unknown
author_rank: Unknown
timestamp: October 06, 2012, 04:08:09 pm
content: Great teardown Mike!I hope you get it working soon.

author: tom66
author_rank: Super Contributor
timestamp: October 06, 2012, 04:43:16 pm
content: So when you had it working on the defibrillator teardown video that was before you fiddled with the DIP switches?It's not just a cold joint around those DIP switches?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 06, 2012, 05:28:36 pm
content: Quote from: tom66 on October 06, 2012, 04:43:16 pmYesQuoteThere's definitely something around there, flexing the board can make it crash, but the problem is the damage is done in terms of corrupting the config info. Could be coincidence and there's a DIP setting that factory-resets the NVR

author: tom66
author_rank: Super Contributor
timestamp: October 06, 2012, 05:34:26 pm
content: My bet would be some kind of MLCC intermittently shorting or perhaps a PCB problem :/. Or could be like that ferrite bead on the thermal camera.I hope you can get it fixed, as it looks like an awesome bit of kit - would you keep it or does it take up too much space? Maybe it's possible to shorten the belt and take off one of the input/output conveyors.

author: SeanB
author_rank: Super Contributor
timestamp: October 06, 2012, 05:40:47 pm
content: If you tear it down pop that driveroll off to me, I can use one.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 06, 2012, 06:12:17 pm
content: Quote from: tom66 on October 06, 2012, 05:34:26 pmToo big to keep. I do however have another smaller x-ray, although not quite as powerful

author: SeanB
author_rank: Super Contributor
timestamp: October 06, 2012, 06:17:50 pm
content: I wonder if that is lead, or depleted uranium. DU is actually not really radioactive, and is a better shielding material than lead, it will eventually decay into lead, though continental drift and the sun going nova is the timescale involved.

author: tom66
author_rank: Super Contributor
timestamp: October 06, 2012, 07:29:36 pm
content: Quote from: mikeselectricstuff on October 06, 2012, 06:12:17 pmTeardown! Teardown!

author: firewalker
author_rank: Super Contributor
timestamp: October 06, 2012, 08:05:27 pm
content: What was the cost of the machine?Alexander.

author: free_electron
author_rank: Super Contributor
timestamp: October 07, 2012, 12:54:46 am
content: Wafers Scale Integration ( WSI ) was indeed 'borged' by ST. Actually WSI never had their own fabs and the chips were always run in St's fabs ...The PSD devices were around until about 2008 at which point the last were discontinued. The last generatgion (PSD800) had 16 bit databuses en up to 4 megs of flash and 512k of ram. those were intended for 80188 style cpu's. there was even a uPSD3000 familiy that had the 8051 core on board.I salvaged a truckload of those development systems when we pulled the plug. Each had a 2x16 lcd display and a battery backed sram , rotary encoder and some other goodies. Let's say i'm set for life on the 2x16 char lcd frontI have a pile of the PSD's as well including the programmers for it. I kept a few tubes per type just in case i eve rneed one to do a repair.

author: EEVblog
author_rank: Unknown
timestamp: October 07, 2012, 03:15:17 am
content: Quote from: free_electron on October 07, 2012, 12:54:46 amI still have maybe 350-400 2x16's under the bench!I had over 1200 at one stage!Dave.

author: firewalker
author_rank: Super Contributor
timestamp: October 07, 2012, 08:23:05 am
content: Quote from: EEVblog on October 07, 2012, 03:15:17 amMake the packets available to international buyers! Problem solved.Alexander.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: October 07, 2012, 11:30:11 am
content: Quote from: HAL-42b on October 06, 2012, 04:08:09 pmWhat he said.

author: nukie
author_rank: Frequent Contributor
timestamp: October 07, 2012, 12:09:39 pm
content: Serious spools of enamel wire lurking at the back

author: amyk
author_rank: Super Contributor
timestamp: October 07, 2012, 12:31:47 pm
content: That 344 that's mentioned as the password is definitely in the firmware at address 7e50, but maybe it's the default when no other password (which would probably be in the NVRAM) is set.3a1c4 "INVALID PASSWORD ERROR, MINIMUM RANGE > 255" referenced at 35404, 35438, 3882c, 391583a8d1 "'0' CAN NOT BE IN PASSWORD"referenced at 349b43ca80 "YOU MUST ENTER THE EG&G PASSWORD TO USE THIS OPTION" referenced at 522f44c8f8 "YOU MUST ENTER THE USER" referenced at 494d44c910 "YOU MUST ENTER THE EG&G" referenced at 495284cf7a "INVALID PASSWORD" referenced at 478e8, 47c2c, 48088, 49584, 495b8, 4aad4The stuff around 478e8 (first invalid password error) isCode:ldib0x0080aab1,r4cmpibne.f0,r4,0x00000010b0x00000020lda0x0004c949,g0 <--- "CANCELLED"call0xfffffffffffd8be0b0x00000264ldos0x0080ab72,r4cmpibe.f0,r4,0x00000030b0x00000040lda0x0004c949,g0 <--- "CANCELLED"call0xfffffffffffd8be0b0x00000264lda0x0080ab88,g0lda0x00809462,g1call0xfffffffffffdea80shlo24,g0,r4shri24,r4,r4cmpibne.f0,r4,0x00000074 <--- ***b0x00000064lda0x0004cf7a,g0 <--- "INVALID PASSWORD"call0xfffffffffffd8be0b0x00000264I'm not familiar with i960 but I see the pattern where it checks and then shows the message, so you could try changing the conditional jumps to go the other way and writing the firmware back to see if it'll then accept any password.QuoteThat is of course assuming they can find out who he is, or unless there are only a very small number of people who know.

author: M. András
author_rank: Super Contributor
timestamp: October 07, 2012, 03:58:38 pm
content: Quote from: nukie on October 07, 2012, 12:09:39 pmi wondered whats the size of those? 5-10kilos? the only spools i can get originally here according to few different transformer makers are 25-50kg spools. or those 500g ones from few electronic stores which 3 times the price of the 25kg spool divided down to 500g. so Mike if you care to share your sources for it im happy to hear it

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 07, 2012, 04:02:30 pm
content: It looks like 344 is the standard password, but you need to enter it when it is requested in a menu option, and since you don't have the menu...Code:ROM:00005FC8 00 30 80 8C+ lda unk_809442, g0ROM:00005FD0 00 30 88 8C+ lda a344, g1 # "344"ROM:00005FD8 68 EA 01 09 call sub_24A40A lot of options, including if the menu is available to the operator, is set in a DWORD at 0x70-0X73 in the Dallas chip:Code:0x000x01RIGHT/LEFT0x02Pseudo color0x030x040x05ATA0x06ATA Area/Density0x070x080x09SLA0x0A0x0B0x0C0x0D0x0E0x0FDate format0x10Date Format0x110x12Operator can adjust ATA threshold0x13Date display0x14Bad diode skip0x15Menu available0x16Logging0x17Normalize between bags0x180x19Zoom lock0x1AOperator Assist0x1BImage Archiving0x1CHost0x1DTIP0x1EXRAY Rampup0x1FHIP DisplaySo if you can find a way to write the Dallas setting bit 0x15 should restore your menu key. I'm still chasing the location where the user PW is stored.Paul

author: SeanB
author_rank: Super Contributor
timestamp: October 07, 2012, 04:07:31 pm
content: Mike buys it on eBay............

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 07, 2012, 08:37:22 pm
content: I started to look at the disassembly, and tracing back from the invalid password message, but then realised there's a simpler way that trying to figure out what it's testing for - just patch out the tests.I've ordered some flash chips to replace the OTP eproms.Stay tuned...BTW rom dumps, disassembly etc. atwww.electricstuff.co.uk/xray

author: tesla500
author_rank: Regular Contributor
timestamp: October 08, 2012, 03:59:09 am
content: If the password is only 3 digits, it's quite practical to manually brute force it. If you could try 1 every 3.6 seconds, that's only 1 hour...

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 08, 2012, 04:47:49 am
content: Quote from: tesla500 on October 08, 2012, 03:59:09 amI did think that, but the keypad is worn and flaky, and needs very hard presses.

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 08, 2012, 07:28:24 am
content: I think that the password(s) stored in the nvram are wiped by Mike's action, most likely there is something in there that you can't enter via the keyboard. However, the 344 should get you to a point where you can enter a new user password.Did you ever get to a point where you had to enter the EG&G password on PCB1 or 2?

author: amyk
author_rank: Super Contributor
timestamp: October 08, 2012, 09:16:44 am
content: The "> 255" and no-zeros-allowed error, plus 4 or 5 digit limit, suggest the password is stored as an integer in the NVRAM, likely 2 bytes (0-65535).Looking forward to the next part...

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 20, 2012, 09:12:42 am
content: Part Two

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: October 20, 2012, 10:13:48 am
content: Oh well. I still enjoyed the asm hack part of the video, Mike.Probably more fun to play with assembly than it would have been to try and learn Chilean.Got to be close to twenty years since I saw a disassembly listing. Could still follow along perfectly. (I only knew x86 and 6510 tho)Random question about those rom chips. If you, just for the sake of argument, had to do some serious debugging on that machine..I wonder would you still be able to get new pair of blank roms for it if you had to?

author: Rerouter
author_rank: Super Contributor
timestamp: October 20, 2012, 11:45:47 am
content: while the x-ray scanner interests me, i would be far more captivated if one of the dissasembly guys raised there hand and did a video on there methods, its an area of electronics few of us understand and could use some light shed upon :/

author: Psi
author_rank: Super Contributor
timestamp: October 20, 2012, 11:50:07 am
content: Do you mean the methods as in the approach to solving problems?

author: Rerouter
author_rank: Super Contributor
timestamp: October 20, 2012, 11:51:39 am
content: on the dissasembly,

author: Psi
author_rank: Super Contributor
timestamp: October 20, 2012, 11:53:45 am
content: oh, i get ya, dissasembly as in decompiling code.It's pretty much the same as reading normal code, you just need some background in assembly to understand what you're looking at.It all follows the same programming rules, just at a more basic level.

author: SeanB
author_rank: Super Contributor
timestamp: October 20, 2012, 01:48:20 pm
content: Blanks will probably be available. I know they are still in the current RS cat, as new stock. As Mike used a compatiable flash device there is no reason not to just use the flash over the OTP, only time will be if there is a built in programming system with a method to connect Vpp to the device under program control. This would be a system that has a lot of spare place in the prom and uses it to store calibration data detecting blank areas by checking they are FF and then writing the block and reading by reading through the block of data and using the last valid data block as the latest one.As to dissembly, the code is readable, but the comments are no longer visible, which helps a lot with seeing exactly why a thing was done. Things like " I have no idea why this works but it does, don't touch it" and " horrible kluge to get around XYZ hardware that is totally brain dead".

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 20, 2012, 04:24:35 pm
content: Although the original Atmel chips are available, the flash ones are a lot cheaper (£1.20 vs. £3.20) - haven't compared access times though.

author: amyk
author_rank: Super Contributor
timestamp: October 21, 2012, 05:33:56 am
content: Thanks Mike, great video once again!Something I've noticed in general is that people with a hardware background seem to be much better at giving clear explanations about both hardware and software than software people are with hardware or even software.Quote from: mikeselectricstuff on October 20, 2012, 04:24:35 pmProbably economy of scale. Until a few years ago (when they switched to serial) the PLCC flashes were used in many, many PC motherboards for BIOS storage.

author: firewalker
author_rank: Super Contributor
timestamp: October 21, 2012, 05:44:24 am
content: The programing was every other byte. Why? What dictates that? Is a common thing, or the designers o this equipment wanted so?Alexander.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: October 21, 2012, 06:20:39 am
content: Quote from: mikeselectricstuff on October 20, 2012, 04:24:35 pmThanks Mike, seanb

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: October 21, 2012, 06:23:10 am
content: Quote from: firewalker on October 21, 2012, 05:44:24 am16 bit input on the cpu? There are two memory chips, spilt the 16 bits from 2 8-bit chips. Is that right Mike?

author: SeanB
author_rank: Super Contributor
timestamp: October 21, 2012, 07:08:40 am
content: That is done because the processor is a 16 bit device, and wants data in 16 bit chunks. The proms are 8 bits wide, so then you put 2 decoding the same address, but with one driving D0-D7 and the other driving D8-D15. The one driving D0-D7 is called the low/even and the other is the high/odd prom. The sockets will be labelled as such. Thus when the processor ask for a 16 bit byte it gets the 2 8 bit ones at the same time, in the correct order.

author: firewalker
author_rank: Super Contributor
timestamp: October 21, 2012, 08:53:26 am
content: Thanks m8.Alexander.

author: amyk
author_rank: Super Contributor
timestamp: October 21, 2012, 12:39:54 pm
content: Also found the password (911, 8F 03) stored as a 16-bit integer at address 34 and 35 of the NVRAM. It might be a default one since you note that it's rewritten there on startup.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 13, 2012, 06:05:21 pm
content: Part 3Part 4

author: cybergibbons
author_rank: Frequent Contributor
timestamp: December 13, 2012, 06:22:19 pm
content: Nice - what did you need to do to get it working?

author: cybergibbons
author_rank: Frequent Contributor
timestamp: December 13, 2012, 06:23:30 pm
content: Ah, they show up as photos on tapatalk. I guess I will watch the video and find out!

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: December 13, 2012, 06:56:38 pm
content: Quote from: mikeselectricstuff on December 13, 2012, 06:05:21 pmI've got to go off to work for the day. Have to watch it tonight.

author: marmad
author_rank: Super Contributor
timestamp: December 13, 2012, 07:27:47 pm
content: Great stuff, Mike - very interesting. Thanks.

author: Psi
author_rank: Super Contributor
timestamp: December 13, 2012, 11:29:53 pm
content: Rapiscan xrays also have the diode skipping option.They call it remapping, where you say.. Ignore this diode and 'map' the adjacent diode onto it.Otherwise one dead channel causes a line over the whole picture.The diode sensors themselves don't seem to fail but, as i said a few pages ago, the high gain amplifiers on each diode are really prone to moisture and drift out of spec sometimes. So the remapping is normally used to bypass a bad amp.Rapiscan machines also have the requirement to slowly ramp up the tube voltage if the tube hasn't been used for a month.I don't have access to the service manual at the moment but next time i do i'll see if it says why you do it.One thing that maybe causing your random bad channels.I know with the rapiscan units that if you try and play around with lots of panels missing light can find it's way inside and upset the calibration.

author: BravoV
author_rank: Super Contributor
timestamp: December 14, 2012, 02:39:56 am
content: Thanks Mike, great series and very informative as always.This reminds me of an interesting app note from Intersil that I read while ago here ->X-Ray Effects on Intersil FGA ReferencesIf you had a chance and not bored yet, please do more experiments on floated silicon like buried zener voltage reference, eeprom, flash memory to see how nasty it will affect them.Apart from the disadvantages from x-ray exposure, I'm thinking the possibilities or advantages if this method could be used to sort of micro trimming/adjusting electronic stuff, maybe at ppm level say like an extra treatment at a well cooked buried zener voltage reference to get a really high accuracy at it's absolute value.

author: Psi
author_rank: Super Contributor
timestamp: December 14, 2012, 02:59:41 am
content: Quote from: BravoV on December 14, 2012, 02:39:56 amWe did some test with flash memory (CF and SD) sitting stationary in the airport xray beam for a few minutes.The section of the flash memory that was exposed got the equivalent dose of around 8000 runs through the machine.We couldn't fault it afterwards. The data was byte for byte accurate and we could write/read new data fine.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 29, 2012, 11:34:37 pm
content: Part 5 :

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 30, 2012, 12:55:17 am
content: Quote from: Psi on December 14, 2012, 02:59:41 amI was going to do a vid testing a variety of memory devices - I got as far as exposing a couple of eproms for a minute (no effect) then my temporary keypad repair started going flaky (water based conductive ink in damp garage) & I couldn't be bothered fixing it to continue.

author: HardBoot
author_rank: Regular Contributor
timestamp: December 30, 2012, 02:19:51 am
content: You need pretty high energy particles to nuke data, although x-ray does damage undeveloped film, since it is high energy light in a way.

author: peter.mitchell
author_rank: Super Contributor
timestamp: December 30, 2012, 04:48:48 am
content: Reminds me of air travel, having my rolls of film in a big ziplock bag for carry on that I had to specify not to be x-rayed

author: EEVblog
author_rank: Unknown
timestamp: December 30, 2012, 05:12:51 am
content: Awesome.Wasn't worth anything on ebay?Dave.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 30, 2012, 10:58:47 am
content: Quote from: EEVblog on December 30, 2012, 05:12:51 amIt had failed to sell a couple of times in the past at £100. Needs some serious transportation - we only got it into a 3.5 tonne box van by taking one of the conveyor arms off so it would get onto the tail-lift and then swing round into the van.The seller was also struggling to sell a fully working one at £800.I suspect the end of the Olympics might have helped flood the used x-ray. market.I'll probably try ebaying a few oddments like the conveyor motor and detector boards.

author: EEVblog
author_rank: Unknown
timestamp: December 30, 2012, 11:05:38 am
content: Quote from: mikeselectricstuff on December 30, 2012, 10:58:47 amThat makes sense.We had a big auction here in Oz in 2000 after our Olympics. Huge ticket items like hundreds of cars used to transport everyone, and even the big opening ceremony parade floats!Not sure if there was any tech gear in all that, probably was and I missed it.Dave.

author: SeanB
author_rank: Super Contributor
timestamp: December 30, 2012, 11:12:13 am
content: The buses from the Beijing Olympics ended up here in Durban as public transport. Saw one with the sign at the original default setting of Chinese with the english underneath saying Olympic Stadium.

author: firewalker
author_rank: Super Contributor
timestamp: December 30, 2012, 11:12:33 am
content: You can always sell the lead. ~1,5 €/kilo ?Alexander.

author: SeanB
author_rank: Super Contributor
timestamp: December 30, 2012, 11:15:22 am
content: More money in the aluminium than the lead, Steel is almost the same price as lead. Aluminium is about 4 times the price.Mike should send one of those to Dave as a wall decoration......

author: EEVblog
author_rank: Unknown
timestamp: December 30, 2012, 11:24:19 am
content: Quote from: SeanB on December 30, 2012, 11:15:22 amThere is something in my massively overflowing mailbag from Mike. Pretty sure I know what it is.Wait till you see his return address...Dave.

author: peter.mitchell
author_rank: Super Contributor
timestamp: December 30, 2012, 11:43:10 am
content: Quote from: EEVblog on December 30, 2012, 11:24:19 amIf it's legit, i might send mailbag stuff to him too!

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 01:56:26 am
content: Quote from: SeanB on December 30, 2012, 11:15:22 amThere's actually hardly any aluminium. pretty much all lead & steel.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 01:56:53 am
content: Quote from: EEVblog on December 30, 2012, 11:24:19 amThat was quick....

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 01:58:25 am
content: Part 6 - inside the black box

author: tom66
author_rank: Super Contributor
timestamp: January 01, 2013, 12:41:03 pm
content: You say ferrite core... does this mean it's like an SMPS? Or is it simply running at mains frequency?

author: SeanB
author_rank: Super Contributor
timestamp: January 01, 2013, 01:03:51 pm
content: Probably running at 15kHz or so, those look like old LOPT cores, and they work well at that frequency. Might be higher, up to 30kHz, but those multipliers use high voltage diodes and they generally are not going to be terribly fast switches, they generally have a max frequency limit of around 25kHz. The capacitors inside are likely to be hundreds of picofarads at around 20kV each, thus the big potted assembly, to keep the oil from damaging them.there must be a driver with a push pull output in the controller driving them, likely running off a power rail of around 150VDC or so, at a current of around 5A peak.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 01:37:44 pm
content: Quote from: SeanB on January 01, 2013, 01:03:51 pmI forgot to wave a scope probe near the driver when running to check the frequency. I did however work out all the pins on the control connector, just in case..!15K is a reasonable compromise between not being audible and high-frequency losses - loading due to stray capacitance can become a major problem in high frequency HV supplies.QuoteThe control box runs off 110VAC, so 150VDC is probably about right for the drive.Details of this are at around 36:00 in part 1.

author: SeanB
author_rank: Super Contributor
timestamp: January 01, 2013, 02:12:45 pm
content: 150VDC is pretty common for old TV sets as line drive, What devices are they using in the driver, probably BU208/508D.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 03:27:31 pm
content: Quote from: SeanB on January 01, 2013, 02:12:45 pmit's not that old - probably MOSFETs.

author: SeanB
author_rank: Super Contributor
timestamp: January 01, 2013, 04:24:00 pm
content: Bipolars are more common there, especially if you want to have the output devices survive flashovers that often crisp the mosfets. 50 years of designing TV line devices is still valid, and there is no real power saving of mosfet and bipolar in this application, drive power is still pretty much the same, just one has high current low voltage and the other higher voltage lower current. You can use IGBT's but they would be expensive compared to a cheap high SOA bipolar.

author: G7PSK
author_rank: Super Contributor
timestamp: January 01, 2013, 04:44:58 pm
content: If that is too hard for lead it is either a lead zinc alloy or depleted uranium or alloy of.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2013, 09:41:58 pm
content: Quote from: SeanB on January 01, 2013, 04:24:00 pmJust looked and it uses two IRF630 MOSFETs.You'd want to be protecting things inside the oil can (as they have done), not relying on the drivers to maybe survive any nasties that might emerge.