Wednesday, 7 March 2018

Hacking A Quantel Dylan Disk Array

I have recently been working on a Quantel HAL video compositing system as featured on my last post.

While i have been trying to diagnose all it's faults i discovered a rather annoying feature of the Dylan disk array that stores the video clips.

The array is a 6U chassis that contains three PCBs with a controller CPU and 20 SCSI disk controllers to operate the 20 Fujitsu hard disks.

During my work the Dylan flagged up one of the disks had failed but continued to work, shortly after it then flagged another and disabled video from the array.

Once this happened i tried replacing a disk only to be met with a 'disk serial changed' message, i tried swapping the replacement disk into one of the slots for a working disk which generated another disk serial changed error and the array now had three drives that were not working.

At this point i realised that either the host system (Quantel HAL) or the array was keeping a track of the disk drive serial numbers and preventing replacement of the disks. After some investigation i found no details of the disk serial numbers within the HAL operating system so looked at the array itself.

The CPU on the array is an Inmos / ST Micro IMST425-G25. This is a 25mhz Inmos 'Transputer', further examination of the control board didn't show up any EPROM for holding the program for this CPU but it did show up an Inmos link IC. The link IC allows a host to load CPU code over a serial link through the CPU to RAM and then start the CPU. Basically meaning the code is loaded remotely by the HAL.

So there was no EPROM or battery backed SRAM on the controller, the task now was to find where the serial numbers were stored.

After careful examination of the board i found a Atmel 24C02 serial EEPROM. This was de-soldered using hot-air, mounted into a test clip and read out using a TL866 EPROM reader/programmer.



Immediately it was clear it contained the serial numbers of the disk drives with three of them containing zeroed serial numbers, very likely the three drives that had been flagged up previously. The remaining serial numbers were exact matches for the serial numbers printed on the physical disks.

From here it was a simple task to add the missing and new serial numbers into the EEPROM and reprogram it. I also added a plug in board to allow this to be done easier next time.



It's highly likely that Quantel engineers had a tool to program in new serial numbers into the array through a 10 pin header located on the PCB.

Quantel HAL Video Compositing System - Introduction

The Quantel HAL is an evolution of the V-Series architecture that Quantel introduced in the late 1980s as used originally on the 2nd generation Paintbox, it expands on it with upto 18 plugin expansion cards on it's expanded backplane (Hiway as Quantel call it) housed in a 6U chassis.

The Quantel HAL system is a video compositing system that can composite upto 99 'layers' in a single pass. Layers would be static images, video clips or stencils (masks) that can all be manipulated in a 3d space along with various effects that can be applied. Video storage is on a separate 'Dylan' disk array connected via a proprietary interface and contains 24gb of disk storage to give a total of 15 minutes of uncompressed standard def PAL/NTSC video.

In many ways it's similar to the Quantel Harriet, which is a combination of a Paintbox and Ramcorder. The Harriet is designed for compositing static pictures and animation on top of video and is limited to 323 frames in the Ramcorder. The HAL differs in it has far greater storage and can composite video on video with key (stencil) channels on any of the 99 layers.

The user places video clips, pictures and stencils onto a keyframe timeline to create a sequence of effects which are then rendered out to a new clip or composited over the top of an existing clip.

The main chassis contains two hard disks, a system boot disk and a shared disk. The boot disk contains all the software and local files, the shared disk contains all the network shared files. This setup is exactly the same as the Paintbox. There are 4 SDI video inputs and outputs, 1 (stereo) digital audio input and 2 outputs along with an analog 'broadcast standard' video in/out.


Side View of the HAL showing all the cards.
The PSU and two hard disks are mounted in the top.


The Dylan disk array contains 20 fujitsu 1.2gb 3.5" SCSI disks each with it's own SCSI controller a lot of logic and a small Inmos/ST transputer CPU to look after the array. There is no CPU code stored on the array as it's loaded over a dedicated 'inmos link' when the main system boots. The array CPU simply looks after errors from the disks. From what i understand the HAL writes video round-robin to the disks. There is ECC so the data on a failed drive can be rebuilt once it's replaced. The array also stores the disk serial numbers of the drives in an EEPROM to prevent user-replacement of the disks. If a disk is changed the system will flag the disk and stop using it. Once two disks are either flagged as serial number changed or have found to be faulty the array will go offline and the user is unable to have access to video on the HAL. The capacity of the array is determined by the software keys on the HAL system, so probably all disk arrays had 24gb but depending on how much ££ you paid quantel you could have access to 5, 10 or 15 minutes of video.


Top view of the Dylan 2 disk array. The Inmos CPU is in the top left corner, PSU in the middle and the SCSI controllers around the edge with the cables running to the disks.


HAL System cards:
The HAL contains the usual 3 cards found in any v-series system. CPU, Mainstore, Diskstore and some kind of image processing card like is found in a Paintbox. So this could be Size, Rotation, Perspective, CAP (Contour and Perspective) or Image. With Image being the most advanced.

CPU: Quantel's standard CPU42 board with 64mb RAM & 68040 CPU.


Netcomm: Quantel's standard netcom board, 68000 based network interface.


Input Select: Analog video input processing card and digital video input (the actual digital input decoding is processed on a smaller board located in the top of the chassis).


APE: Audio processing card.


Image: Essentially a software CPU / processing engine based on a large quantity of altera CPLDs and an Inmos/ST Transputer CPU, provides all the processing for image transforms (size, rotation, 3d effects etc).


Diskstore: Regular diskstore card.


Mainstore: Regular mainstore card.


Output Select: Analog video output processing & digital video output (the actual digital output decoding is processed on a smaller board located in the top of the chassis).


Mux: interface to the dylan disk array.


Disk Link: I think more disk array interface stuff.


Router: I think this does some switching of video to/from the disk array.


Key 2: lots of logical processing on this card, going by it's name it must be something with video keying.


Vid Proc 2: like Key 2 this has lots of 'bit-twiddling' ICs for image processing.