Personal tools

Hardware

From Wij vertrouwen stemcomputers niet

Jump to: navigation, search

This page is meant for a description of the pure, raw hardware. Everything related specifically to ES3B's use of the hardware should probably go on the software page

This picture shows the mainboard from the reader/writer unit, simply because it was easiest to remove and photograph up-close. Except for processor and a few well-understood large peripheral chips, everything is discrete logic. The yellow DIL-packages are actually resistor banks. On the actual voting computer many (but not all) of the missing parts are installed (more discrete logic and resistor packs), except it only has one voting-memory-module socket. The various flat cable connectors on the silk screen indicate connectors used in the voting machine for connections to the keyboard, screen, staff console, printer, etc.

The one flat cable connector that is on this reader-writer board (top right) had the exterior serial cable plugged into it.

Contents

[edit] The mainboard

M68000 pinout
M68000 pinout
  • 68HC000P8 CPU at 8 MHz(?)
  • 256 kB EPROM as two 27C010 chips (odd and even)
  • 16 kB RAM as two Hyundai HY6264A chips
  • One (reader-writer) or two (voting computer) EF6850P serial ports
  • 8 kB Xicor X28HC64P-15 EEPROM
    • No indication that the device has state. Serial number only?
    • the es3a has a X2864BP-15 EEPROM, which is a slightly older version, with 32 byte page size, instead of 64 byte page size, and it does not have the toggle bit that the 28hc64 has.
  • the service switch ( next to the power connector )
  • On voting machine only:
    • one main power switch operated with a key.
    • Operator console with display, two buttons and a key-operated switch
      • these buttons are named 'vrijgave 1', 'vrijgave 2', and the key, 'stem sleutel'
    • "Stem slot" key-operated switch on voting computer itself
    • 36 colums x 30 rows foil keyboard for parties and candidates
    • 16 key keyboard under flap
      • containing the 'a', 'b', 'c', and 'd' soft-keys, for selecting menu items, and digits 0-9, '*', and '#'
    • 'Herstel' and 'Blanco' buttons, on same physical foil keypad as 16 key keypad
    • the big red 'stem' button, with a light behind it.
    • 4 x 40 character backlit LCD display


partnr not in
rwunit 		type descrption
ic01 [74hct4040n] 12 stage counter
ic02 [adm233ljm] rs232 drivers
ic03 [74hct273N] 8 * flipflop
ic04 * [74hct273n] 8 * flipflop
ic05 * * *
ic06 * [74hct374n] 8 * flipflop
ic07 * [74hct273n] 8 * flipflop
ic08 [74hct273n] 8 * flipflop
ic09 * * *
ic10 * * *
ic11 [74hct273n] 8 * flipflop
ic12 * [74hct374n] 8 * flipflop
ic13 * [74hct374n] 8 * flipflop
ic14 * [74hct374n] 8 * flipflop
ic15 * [74hct374n] 8 * flipflop
ic16 * [74hct374n] 8 * flipflop
ic17 [74hct373n] 8 * latch
ic18 [74hct373n] 8 * latch
ic19 [74hct373n] 8 * latch
ic20 * [74f154n] 4 to 16 line decoder
ic21 [74hct4075N] 3 * 3 input or
ic22 * [74hct373n] 8 * latch
ic23 * [74hct373n] 8 * latch
ic24 * [74hct373n] 8 * latch
ic25 * [74hct373n] 8 * latch
ic26 * [74hct373n] 8 * latch
ic27 [74hct373n] 8 * latch
ic28 [lm324n] 4 * opamp
ic29 * * *
ic30 [ef6850p] uart
ic31 [74f154n] 4 to 16 line decoder
ic32 [74f154n] 4 to 16 line decoder
ic33 [74hct4075N] 3 * 3 input or
ic34 [tl7705acp] supply voltage regulator
ic35 [74hct4040n] 12 stage counter
ic36 [74hct4040n] 12 stage counter
ic37 * [ef6850p] uart
ic38 [74hct00n] 4 * 2 input nand
ic39 [lt1072] switching regulator
ic40 [74f11n] 3* 3input and
ic41 [74f138n] 3 to 8 line decoder
ic42 [74f138n] 3 to 8 line decoder
ic43 [74f11n] 3* 3input and
ic44 [74f11n] 3* 3input and
ic45 [74f08n] 4 * 2 input and
ic46 [74f02n] 4 * 2 input nor
ic47 [74hct32n] 4 * 2 input or
ic48 [74hct4075N] 3 * 3 input or
ic49 [74hct27n] 3* 3input-nor
ic50 [74hct32n] 4 * 2 input or
ic51 [74hct08n] 4 * 2 input and
ic52 [74hct04n] 6 * invertor
ic53 [74hct245n] 8 * bus transceiver
ic54 [74hct245n] 8 * bus transceiver
ic55 [74hct245n] 8 * bus transceiver
ic56  ? eprom
ic57 [x28hc64p-15] 8kbyte eeprom
ic58 [hy6264A LP-70] 8kbyte ram
ic59 [mc68hc000p8] 2e72n CPU
ic60 [74hct534n] 8 * flipflop
ic61 [74hct10n] 3* 3input nand
ic62 [74hct4040n] 12 stage counter
ic63 [74hct00n] 4 * 2 input nand
ic64 [74hct245n] 8 * bus transceiver
ic65 [74hdc05n] 6 * inverter
ic66 [74hct147n] 10 to 4 line priority encoder
this chip is used to encode interrupt priorities
ic67 [74hct374n] 8 * flipflop
ic68 [74hct00n] 4 * 2 input nand
ic69 [74hct245n] 8 * bus transceiver
ic70 8.0Mhz crystal
ic71  ? eprom
ic72 [hy6264a lp-70] 8kbyte ram
ic73 [74hct245n] 8 * bus transceiver
ic74 [74hct245n] 8 * bus transceiver
ic75 [74hct245n] 8 * bus transceiver
ic76 [74hct4060n] 14 stage counter
ic77 * [74hct00n] 4 * 2 input nand

[edit] the connectors

k01 manager display
k02  ? voter display
k03 voting keyboard?
k04 printer
k05  ?
k06 pc serial port
k07 modem serial port
k08 printer port 2
k09 power supply
k10  ?
k11 voting keyboard?
k12 voting keyboard?
k13 voting keyboard?
k14 programmeer slot
k15 stem slot
k16 voting keyboard?

[edit] Memory Map 

0x000000-0x03ffff ROM (256 k, about half actually used)
0x3c0000-0x3fffff Memory Module 1 - "Programming" (256 k) 
0x404000-0x407fff RAM (16 k) 
0x7c0000-0x7fffff Memory Module 2 - "Voting machine" / "Reading" (256 k)
0x800000-0x803fff Configuration EEPROM (8 k, byte-wide, on even addresses)
0xbc0000-0xbc000f peripheral, keyboard and lpt2
    0xbc0000 - keyboard input line 0
    0xbc0001 - keyboard output line 0
    0xbc0002 - keyboard input line 1
    0xbc0003 - keyboard output line 1
    0xbc0004 - keyboard input line 2
    0xbc0005 - keyboard output line 2
    0xbc0006 - keyboard input line 3
    0xbc0007 - keyboard output line 3
    0xbc0008 - keyboard input line 4
    0xbc0009 - keyboard output line 4
        bit7 - votebutton light
    0xbc000c - various switches and keys
        bit0 - stemsleutel   
        bit1 - vrijgave2     
        bit2 - vrijgave1     
        bit3 -
        bit4 - progsleutel   
        bit5 - functiesleutel
        bit76 - board level
    0xbc000e printer2 control
        bit1 - ? error 4003
        bit2 - error 4001 - paper out
        bit3 - printer not available
        bit4 - ? error 4002
        bit5 - error 18002 of device 14
        bit6 - error 18001 of device 14
    0xbc000f printer2 data
0xbffff0-0xbfffff several devices, including
    0xbffff1 printer2 control
        bit0 = lpt2 data strobe
    0xbffff3 watchdog line
    0xbffff5 eeprom control
    0xbffff8 LCD status register
    0xbffff9 LCD data / instruction register
    0xbffffb LCD control
        bit0 = r/w ( 1=read, 0=write)
        bit1 = register select
        bit2 = operator display select
        bit3 = voter display top section
        bit4 = voter display bottom section
        bit5 = voter lcd backlight
    0xbffffc printer1 control
        bit0 - lpt1 available
        bit1 - ? error 3003
        bit2 - error 3001 - paper out
        bit3
        bit4 - ? error 3002
        bit6 - system power status
        bit7 - service switch
    0xbffffd printer1 data port
    0xbfffff irq enable, beeper
        bit0 = modem uart high-baudrate (0 : 1200/4800, 1 : 2400/9600)
        bit1 = pc uart high-baudrate (0 : 1200/4800, 1 : 2400/9600)
        bit2 = beeper
        bit3 = lpt irq enable
        bit4 = ?
        bit5 = ?
        bit6 = lpt1 data strobe
        bit7 = ?
0xfc0000-0xfc000f uarts
    0xfc0001  modem uart data
    0xfc0003  modem uart control
    0xfc0005  pc uart data
    0xfc0007  pc uart control
        write
         bit10  = divisor: /1,/16,/64,reset
         bit432 = framing: 7e2,7o2,7e1,7o1,8n2,8n1,8e1,8o1
         bit65  = rts control: low,low+irq,high,break
         bit7   = recv irq enable
        read
         bit0   rxdata register full
         bit1   txdata register empty
         bit2   data carrier detect
         bit3   clear to send
         bit4   framing error
         bit5   receiver overrun
         bit6   parity error
         bit7   interrupt request

[edit] memory mirrors

00000000-0003ffff 00000000-003bffff 15 times the rom
003c0000-003fffff 1 image of program module
00400000-00407fff 00400000-007bffff 120 times the ram
007c0000-007fffff 1 image of vote module
00800000-00803fff 00800000-00bbffff 240 times the eeprom
00bc0000-00bc000f 00bc0000-00bfffef 16383 times the keybd io
00bffff0-00bfffff 1 times the display / printer io
00c00000-00fbffff not used - free for us
00fc0000-00fc000f 00fc0000-00ffffff 16384 times uart io

this 16M block is repeated 256 times in the whole 4G memory space.


Schematic
Schematic

[edit] The memory module


ic01 [p28f010-120] 1Mbit flash chip
ic02 [p28f010-120] 1Mbit flash chip
ic03 [74hct04n] 6 * inverter
ic04 [74hct04n] 6 * inverter


Looks like Nedap wanted an even more redundant design and then gave up when they got to the motherboard... All lines to the two chips are separate, only to be connected when the cartridge is inserted in the motherboard (except part of the data bus). Nedap might have a reader that keeps all lines separate, to be used in case of a hard short on the lines of/to one of the memory chips.

The data bus lines may not be in the order shown: it doesn't matter. Actually it does matter when data is to be written to the flash memory. There's a weird pull-down resistor on one of the data bus lines. Maybe this line is/was not connected on some (older, or experimental) motherboard versions?

see Module memory usage for a description of the module contents

[edit] The printer control board

ic01 d721100, [m50734sp], 6461 8bit cpu
ic02  ? eprom
ic03 [6264blp10l] 8kbyte ram
ic04 [74hc373ap] 8 * latch
ic05 [74hc138ap] 3 to 8 line decoder
ic06 6f2a,[ha13007] 8 * linedriver
ic07 [c393c], 9708l20 2 * voltage comperator
ic08  ?
ic09 [74ls07n] 6 * buffer
ic10 [74hc04ap] 6 * invertor
ic11 [74hc08ap] 4 * 2 input and

[edit] The displays

the operator display contains an optrex [dmc40202a] containing these chips:

The voter display contains probably an optrex [dmc40457], which is essentially the same but with 2 of the hitachi lcd controller chips 

0x00BFFFF8 = the display read data 
  reading the instruction register returns the busy flag ( bit 7 ), 
  and the current address counter
0x00BFFFF9 = the display write data / instructions
0x00BFFFFB = the display control lines
   bit0 = 0=write, 1=read
   bit1 = hitachi register select (0=data,1=instruction)
   bit2 = operator display select
   bit3 = voter top display select
   bit4 = voter bottom display select
   bit5 = voter lcd backlight

You can upload 8 user defined 8*5 bitmaps for characters.

Instruction set:

0x01 clear screen
0x02 return home
0x04 bit 0: displayshift on write
bit 1: cursor direction (1=increment)
0x08 bit 0: blink-on
bit 1: cursor-on
bit 2: display-on
0x10 bit 2,3: cursor/display shift control
0x20 bit 4: datalength (1=8 bits, 0=4 bits)
bit 3: 1=2 lines, 0=1 line
bit 2: font, 1=5x10, 0=5x8
0x40 set chargen-ram address (6 address bits, 8 chars, each 8 lines )
0x80 set displaydata-ram address (7 bits), 1st-line=0-0x27, 2nd-line=0x40-0x67

[edit] the keyboard

inlines 0x00 .. 0x23 and outlines 0x00 .. 0x1e map to the large voter keyboard, outlines for the y-coords, inline registers and there contents can be translated into x-positions.

The rows on the voter keyboard roughly are represented by outlines 1:1, only for the left area (see map) all outlines > 0x0e are flipped from 0x1e down to 0x0f. So use: 

if( (iline <= 2) && (oline>0x0e)) oline = 0x2d - oline;

The columns are connected in blocks of 9 each: the mapping in the following diagram is lsb last and inline:bit 

[ Block1 ] [ Block2 ] [ Block3 ] [ Block4 ]

Block1: [ 1:1 1:0 0:7 0:6 0:5 0:4 0:3 0:2 0:1 ]
Block2: [ 1:3 1:4 1:5 1:6 1:7 2:0 2:1 2:2 2:3 ]
Block3: [ 4:7 4:6 4:5 4:4 4:3 4:2 4:1 4:0 3:7 ]
Block4: [ 2:5 2:6 2:7 3:0 3:1 3:2 3:3 3:4 3:5 ]

So mapping the position the correct x-position is done by: ( this is the table at 0x1FC94 in the 2.12 rom ) 

unsigned char x_mapping[]
 = { 0x27, // does not happen on this pad
     0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
     0x26, // does not happen on this pad
     0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
     0x25, // does not happen on this pad
     0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
     0x24, // does not happen on this pad
     0x1a, 0x19, 0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12,
};

key_code = x_mapping[inline*8+bit];

outlines 0x1f, 0x24..0x27 seem to be unused.
line 0x27 is pulsed in the subroutine at 0x13640, this is to blink the (hardly visible) light behind the 'vote' button.

the numeric keypad and voting keys are connected as follows: 

   in\|     out
     \|20 21 22 23
   ---+-----------
   12 |#  7  4  1
   13 |0  8  5  2
   14 |*  9  6  3
   15 |A  B  C  D
   16 |A  B  C  D
   17 |   BL HR ST
      |
   1e |   BL HR ST
   1f |A  B  C  D
   20 |A  B  C  D
   21 |*  9  6  3
   22 |0  8  5  2
   23 |#  7  4  1

there are apparently 2 ways of connecting them. ... this is selected in the service menu.

[edit] the UARTs

there are 2 UARTs in the system, one for directly communicating with a pc, and one for communicating over a modem.

Retrieved from "http://wijvertrouwenstemcomputersniet.nl/Hardware"