Categories

Site Sponsors

Who's Online

  • 0 Members.
  • 6 Guests.

ZeroPlus Logic Cube – Review and Teardown

11,368 views

Once you’ve gotten the case off, you can see the LAP-C is a single-board device centered around a big old custom ASIC.   We’re not sure if it’s truly custom but since there’s no platform flash nearby it’s not a repackaged Xilinx.   Anyway, we trust ZP to be able to make an ASIC and have no need to decap this one, so this chip stays unmolested.

As we said before, we bought the cheapest one (LAPC 16032, 16 channel, 32k RAM) in hopes that we could hack it up.   Keep that in mind when reviewing the pix.


Photo of the front of the LAP-C PCB

Fig 3 – Top of the LAP-C PCB


We’ll give a quick rundown of the operation.   USB comes in on a Genesys Logic GL-660 old-school USB->IEEE1284 controller, which must have been a legacy design as the 660 is all but dead as far as we can tell.   Here’s a GL-660USB Datasheet that really gives very little information.   We’re trying to determine if the 660 can write his own serial eeprom over USB, so if you know either way – plz contact us!

The GL660 interfaces directly to the ASIC, so let’s go there next.   It’s a ZeroPlus custom as we said before, marked ZP322MB-5.   Let’s inspect that again.   ZP 32 2MB -5.   Uh, looks like our chip is actually a 32 channel, 2MB RAM device.   Well that’s the top of the line analyzer there, buddy.   How’d we get that top-of-the-line chip in our crappy little 16032?

Economies of scale!   It’s way cheaper to make two of the same chip than one each of two types, so the standard practice is to make one full-featured IC and disable features for the peons who can’t afford those features.   It’s great for the manufacturer, and the loss due to nerds like us hacking in those missing features is still less than the cost of running two sets of wafers.   Now is that a bad thing to do?   Are we subverting something we shouldn’t?   What are the ethics of “hacking in” features.

We think of it like this: If you buy a Honda Civic, nobody would think twice about you ripping open the engine and installing a turbo or something.   Now you’ve added $5k to the value of the car for the few hundred bucks the turbo hardware would cost.   It’s the same thing here – we’re like mechanics for electronics.   We have the expertise, and enjoy the challenge so we will add, subtract, cut, patch, solder, and reflash whatever we can in order to soup up our toys..

So we know the main IC probably has the capability to do more than what the label says.   Let’s keep going.   The RAM chip just north of the ASIC is a Cypress CY7C1347G, which is a 4Mbit (128k x 36) pipelined synchronous ram (that means fast, and does stuff on clock edge only in order to be fast).   We make the guess that the width of 36 is probably used for 32 channels, so our installed RAM is 128k, not 32k!

That’s kind of weird – economies of scale don’t really apply to things like RAM because the “feature” is directly proportional to die size.   Cutting the ram in half requires just over half the silicon (fixed overhead for address decoder and sense amps, but half the cells) so the cost is nearly linear.   Cypress must have a SIGNIFICANT volume discount for buying multiple chips of one type   instead of fewer chips of multiple types.   In other words – Cypress is gouging the small customers, and it’s cheaper to buy 128k   and disable most of it than it is to buy a smaller RAM chip.   Our guess is due to the fixed package cost outweighing the silicon cost.

Good for us because we have a nice big chunk of memory on hand, and a master processor that can handle it.   Just in case you’re wondering – Replacing the 128k chip with a 2M chip is insanity without a hot air rework station, so don’t get greedy and start thinking that you can get the 322000 in a simple hack.   But a something-128 might be possible..   ;)

All the way south on the PCB sits another ZeroPlus custom chip (DV4128B) and an LM348 quad 741 op-amp.   The ZP chip is a 3.3v Serial DAC, and with the op-amps is used to generate buffer voltages to adjust the trigger points for each of the 4 “ports”, where one port is 8 bits or 8 logic analyzer inputs. We really liked the clever design of the buffer, whereby adjusting the voltage at the top of a resistor divider sets up a fixed 1.67v trigger so a super cheap 74xx series buffer can be used as combination input level shifter and logic buffer.   More on that in a future article.

And last but not least, we have the 74LVT16245B 16-channel transceiver and it’s accompanying 16 R divider+RC arrays that is used in conjunction with the buffer voltage to translate various input levels to a fixed 3.3v logic level for the ASIC.   Again, this is a really elegant design and we’re glad to have been able to see it – Thanks, ZP!
Now you can take a look at the back of the board, which is mostly ground plane and routing except for 16 empty resistor padstacks for the unused channels that have inherent shorts to ground.   Guess it’s cheaper to draw a pcb trace than to pull the unused channels to GND with a resistor.   No argument there!


Back of the LAP-C PCB

Fig 4 – Bottom of the LAP-C PCB

We’d better end the article here before we end up giving away too many secrets, but be sure to stay tuned for the next installment where we get buck nasty with the LAP-C.

As always, thanks for taking this little walk with us through a very cool device.   We hope your brains are already buzzing with ideas on possible hacks.

For those who’d like a higher-res photo of the front of the PCB, you can get it below or search around on the interwebs for some other really nice teardown pix.


Large Size photo of the ZeroPlus LAP-C PCB

Fig 5 – Higher Resolution PCB Pic


Cheers!

Openschemes

Pages: 1 2

8 comments to ZeroPlus Logic Cube – Review and Teardown

  • ame

    So this looks like a great hack. I happen to have a circa Sep-09 Saelig ByteMaster which is just a rebranded zeroplus in an aluminum enclosure instead of plastic. The one i have is the LAP-D 16128 so I may give this a go. I haven’t yet figured out how to open the chassis though. It appears to be a clamshell with no screws, but there must be some sort of latch to get it open. Anybody seen one or have any ideas how to open the case? (Yes, I know this article is old).

    • openschemes

      Wow, we had no idea! If the device is really this old, then there is a good chance it’s hackable. We’d be very interested in seeing a pic of the mainboard if you want to email it to admin at openschemes..

      As far as opening the case, be sure to feel all the stickers and overlays to see if there are possibly hidden screws. Otherwise, there’s a chance that the sides just snap in and the PCB is hard mounted to one of them. You would need to compare the two sides to see if one of them looks like there is play between the connectors and the side plate. Then, try to get in at the edge with a jewler’s screwdriver or something and see if the side plate pops out. It would be surprising (and mechanically astounding) if both side plates were sealed hard unless some sort of glue were used.

      Dunno how you feel about a half-damaged device, but it’s probably not necessary to have a side plate on the USB side – that side is usually pointing away from you! :)

  • George

    I have a LAP-16128U bought many years ago. I was never really sutisfied by its capabilities. But lately I tried to make some Logic Analysis to a PCB on which the GND was connected to Power Earth. This is common to many PCBs for safety reasons. From that time-on the LAP-16128U is not working well. I checked the USB GND (from PC side) and I discovered that is not connected to GND point that goes to the PCB. So forcing the two GNDs toghether made a problem. It is pitty because in the manual does not mention that the PCB GND shoud be isolated from EARTH GND.
    Do you have any idea what part may be distroyed?

    • openschemes

      If there was an AC difference between USB GND and PCB GND, then it could conceivably damage the device. But if the two grounds were connected together, then it should be OK and not damage the LAP. What symptom are you seeing? Some channels not working, or no response from LAP at all? If the input buffers (the likely spot to fail) were damaged then they are an easy replacement.

  • George

    The symptom is that I collect a lot of garbage instead of clear signals as I did before. If I can send the files just tell me an e-mail.

  • sargon

    is this still hackable with the current model i have oct 2011 , believe issues with new asic being grounded internal , also 4 pins on my unit 16032 have been cut flush on asic , may be solder able again but its not easy to do by looks and if its required ?

    any input from someone who has a recent batch would be good

  • sargon

    cant do that till the cuts are made on the underside of pcb , as i understand it

Leave a Reply

 

 

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>