Wednesday, 7 March 2018

Hacking A Quantel Dylan Disk Array

I have recently been working on a Quantel HAL video compositing system as featured on my last post.

While i have been trying to diagnose all it's faults i discovered a rather annoying feature of the Dylan disk array that stores the video clips.

The array is a 6U chassis that contains three PCBs with a controller CPU and 20 SCSI disk controllers to operate the 20 Fujitsu hard disks.

During my work the Dylan flagged up one of the disks had failed but continued to work, shortly after it then flagged another and disabled video from the array.

Once this happened i tried replacing a disk only to be met with a 'disk serial changed' message, i tried swapping the replacement disk into one of the slots for a working disk which generated another disk serial changed error and the array now had three drives that were not working.

At this point i realised that either the host system (Quantel HAL) or the array was keeping a track of the disk drive serial numbers and preventing replacement of the disks. After some investigation i found no details of the disk serial numbers within the HAL operating system so looked at the array itself.

The CPU on the array is an Inmos / ST Micro IMST425-G25. This is a 25mhz Inmos 'Transputer', further examination of the control board didn't show up any EPROM for holding the program for this CPU but it did show up an Inmos link IC. The link IC allows a host to load CPU code over a serial link through the CPU to RAM and then start the CPU. Basically meaning the code is loaded remotely by the HAL.

So there was no EPROM or battery backed SRAM on the controller, the task now was to find where the serial numbers were stored.

After careful examination of the board i found a Atmel 24C02 serial EEPROM. This was de-soldered using hot-air, mounted into a test clip and read out using a TL866 EPROM reader/programmer.

Immediately it was clear it contained the serial numbers of the disk drives with three of them containing zeroed serial numbers, very likely the three drives that had been flagged up previously. The remaining serial numbers were exact matches for the serial numbers printed on the physical disks.

From here it was a simple task to add the missing and new serial numbers into the EEPROM and reprogram it. I also added a plug in board to allow this to be done easier next time.

It's highly likely that Quantel engineers had a tool to program in new serial numbers into the array through a 10 pin header located on the PCB.