Dangerous Prototypes

In development => Project logs => Topic started by: hak8or on April 20, 2012, 07:29:38 am

Title: Xray machine tear down (56k no no) 4-29-12
Post by: hak8or on April 20, 2012, 07:29:38 am
I was on my way to get food for my girlfriend and myself, chicken over rice with pee-ta bread in this case, while she was busy doing work for college, which meant I could walk alone and, low and behold, it was garbage day! Good thing she was not with me, or else she would wear gloves around me and have barrels of anti bacterial soap after she saw the things I lug back. :P Anyways, I was walking, enjoying the potential finds on every tinkerers (who does not mind dirty stuff) weekly holiday, in the states at least. This big shiny object catches my eye, so I walk closer, and it has a lever, and some lights. Big, shiny, lights, and a lever, good enough for me! So I haul it back to my house after checking for any liquids and stuff like that, set it down in a place no one will fall over it, and go make a dash for the food, as maybe twenty minutes passed already.

Well, that was two days ago, and just today I had some free time to take a closer look at it. I took apart best I can for now, and will continue later, but in the meantime I took a huge amount of pictures, so I have to sift through all of them now, and I got a few ideas on a new way of showing the pictures for you guys, all of which will take a while to turn into a real thing instead of just an idea in my head. So, for now, I will provide a little teaser for you guys in case you read this far and are still interested. Feel free to guess what it may be!

Title: Re: Mystery Tear down
Post by: Fractal on April 21, 2012, 11:17:41 pm
Hmm, a mystery indeed!
So, a keyswitch, probably for power. Possibly a neon light for power indication - in which case this thing plugs into the mains.
Far object? Maybe a fuse, but the text says "____ ENABLE" Light enable?
What things need a keyswitch, a lever, some lights, and mains voltage?
A mystery...
Title: Re: Mystery Tear down
Post by: hak8or on April 23, 2012, 08:03:55 am
So I have spent most of the time trying to get a new gallery working using webgl and three.js, but three.js puts a limit on texturing an object, that the texture image has to be in a power of two, so 512 pixels, 1024 pixels, or 2048 pixels. I would then have to work with webkit itself instead of a nice framework like three.js, so I will probably do that later over summer. Currently the gallery begins to slow down drastically when there are too much images (20+). So unless I am able to optimize the super sized gallery for more images (I think I can try to cache the images), I will have to work with what I have now.

Anyways, here are two more pictures so you guys can at least find out what it is that I found. I took it apart much more, but I did not get to the actual Xray head as I am not familiar enough with this xray head to feel that I can safely take it apart without risk of potentially dangerous items inside. Though, I am thinking that there is not anything dangerous in it when powered off, as it it is probably just an Xray tube, but I will ask on http://http://4HV.org later to check. More pictures to come later! :)


Title: Re: Xray machine tear down (56k no no)
Post by: hak8or on April 30, 2012, 01:50:04 am
The unit takes two X-ray images of the finger, each with varying strength. At first I would expect it to just vary the strength by changing the voltage to the X-ray head, but I am guessing that instead it was cheaper to just put some metal between the X-ray head and the finger. There is a linear actuator which pushes a lever that the metal disk is attached to, pushing the disk out of the way of the X-ray head. This is explained more on the AccuDexa site in the user manual. The two rods that stick out above the finger are what hold the finger down to prevent movement when taking the X-ray, and the big lever seen earlier is attached to them.

At first thought, I would expect this unit to just deliver the X-ray, and for the doctor to put in the X-ray plate under the finger to capture the image. When looking at the pack and the user manual, it turns out I was wrong, it does even more. At first, you would probably think, why is there a floppy disk thing in the back? Machines that just send X-rays are not that complex, there would not be a need for a floppy disk in such a machine, especially if it already has a screen on it. It actually has an X-ray camera built in, under the finger. The floppy disk is for storing the "report" which includes the X-ray image and some patient information.

The machine does give you information such as bone thickness and other stuff, all of which is not that relevant to us, but now we know that it has to have a processor capable of analyzing the X-ray image. Not to mention that if it saves a report to a floppy disk which is going to be opened on another computer, it has to have file system drivers. The connector on the back is for connecting to a printer which works with a normal computer using a parallel port, so it also has to have drivers for that. This does not seem like a task for a MCU, but instead for a more full fledged system. So, just from looking at the back of the unit and the user manual, we now know that it has a high voltage supply for the X-ray head, a touchscreen LCD, a floppy disk for storing documents, and probably running an OS of sorts. 

The user interface for the unit are the big lever for the rods to prevent the finger from moving during the X-ray, the touchscreen, a power enable light, an X-ray enable light, and uh oh. A keyed switch to turn the unit on. Plugging in the machine does nothing, expected since the key lock is turned to the off position. Since I sadly do not know how to pick such locks yet, and a screw driver is not able to make it turn, time to take it apart and bypass it.
The big lever can be taken off by just unscrewing it, and the screws for the unit are luckily not some security ones. Now, this is surprising. At first glance you can spot the power supply on the top left, two huge capacitors, the big white cylindrical X-ray head, and a hard drive with an IDE cable and a molex power connector. I am starting to think that they just shoved an entire computer into here. But I will restrain myself from pulling it apart even more and instead focus on getting it to power on first.
And here is the front of the unit. A small overview of what is what from first glance. The top right square is the slot to put the patients hand into, the slot next to it is where the big lever went. Under that is a rectangular PCB, which is the CCFL driver for the light to the right of it. It takes the low voltage (12v probably) and using a transformer generates hundreds of volts to ignite the CCFL, and then steps to a lower voltage to drive the CCFL. The PCB under the CCFL driver is a very simple one sided board, no silkscreen or solder mask even, and it has two triacs, though I do not know what it is for, my best guess is contrast and brightness adjustment for the LCD. The very large board under the simple rectangular board is the touchscreen driver, with what I am guessing is a parallel data cable. The cylinder on the right of the touchscreen board is the X-ray indicator, then the power indicator, and lastly the key power switch.
A closer look at the power switch reveals some identifiers of the key, and that it has four wires. Since they are colored black and white, and seem to have thick insulation, I am guessing that it is carrying mains, not to mention the heat shrink over the connectors to the key switch. A look at the datasheet (http://http://www.goo.gl/8Thrd) of the switch gives us some good information, though I was unable to find the same model as the one in front of me. Since I was unable to find the pin out, and I do not have any heat shrink on hand, I decided to try and just take it apart, forcing it into the on position, motivated by the data sheet saying "Switch installation is permanent. Switch cannot be removed from lock after assembly."

After some mucking around, I managed to force open the switch assembly, and turn the switch into the "on" position. Now, to put it back together …

It works! Awesome! Nothing seems to be melting, smoking, or catching fire, which is all very good news! Looking at some of the files it is checking, I am guessing it runs MS-DOS or windows CE or something of the sort. Though, look at the date! 1998! This machine is extremely old, probably cost a fortune back then.

Ah, I knew everything was going too well. The temperature in the basement is indeed within the specified temperature range given on the screen, but it does not seem to matter for the machine. The manual says to let the machine sit in the correct temperature range for a few hours before turning on, and the machine has been in that room for nearly a full 24 hours, so I am guessing it was thrown out for a few reasons, including that the temperature sensor does not work, not to mention how old the unit it. I would hope that there have been some advances in medical X-ray technology in the past 14 years to warrant the purchase of a new machine. Oh well, time to take it apart and find the sensor.

A quick google does not give me anything on either of those two stickers, but there is not much to see on such an LCD controller board. It probably has a few chips to drive the screen itself, then the main controller that handles the data going in and out, some RAM for the screen, and a flash storage chip for containing the different characters and images. To get a good write up of such a board it would warrant another tear down just for itself. The wire going to the middle of the board that looks glued on is from the very simple rectangular PCB earlier, so I think I am right in thinking that the function of it is for contrast and brightness.

Close up of the super simple rectangular board.

And here is where it gets interesting. What you are seeing is the power modules for the entire xray machine. The blue cylinders on the bottom are what I am guessing, smoothing capacitors for the AC to DC rectification. When current demands rise in a rectified load, you need larger smoothing capacitors so when the current is drawn towards the end or beginning of the cycle, it comes from the capacitors which stored current from the middle-ish of the cycle. If you want to learn more, google "smoothing capacitors" for a better explanation, as I know mine sucks quite bad. The cable I am holding goes from somewhere behind the X-ray head to the touchscreen in the front panel.
Another angle of the power section of the unit. In the left most side of the picture, you can spot the white and black cables seen earlier, a fuse, and an EMI filter of sorts. These guys are all between the mains and the rectification, always, and since this is a unit that draws so much power (700 watts I believe), the diode bridge must be on some large heat sink for sorts, unless it is attached to the case, which is very dangerous to do.

Here is one of the boards seen within the power section of the unit. We see a trimmer potentiometer, a relay rated for 2A at 30V (these boxes shaped like this on a board are almost always relays), and some ICs. They are photodarlingtons, otherwise known as opto-isolators, usually used for isolation between high voltage (mains or primary side of step down power supply), with a line under them indicating the separation of the high voltage and low voltage sides of the board. In this case there is no such line drawn, but usually there is. They are 4N33 made in the year 1997, in the eight week and 42nd week, as shown by the date code 9708 and 9742.

Bottom of the PCB

The component side of another board, this one being directly connected to one of the power supply boards. It has some really cool test points, with the colors and plastic covers. I wonder why they did it like that and not just what you see today, which is a tiny copper pad used with a "bed of nails", which I think they should have had back then. Also, notice that one of the traces are a right angle instead of thhe usual 45 degree bends we see nowadays. From what I understand, it is due to manufacturing that the bends are like that, specifically with how the enchant eats away at the copper, and if you have such a 90 degree bends the chances of the etching process going bad at the bend are rather high. If interested, here are some Full size closeups of the board, component side.
Picture 1 (http://http://www.archive.hak8or.com/pictures/Xray_Teardown/P1260147.JPG)
Picture 2 (http://http://www.archive.hak8or.com/pictures/Xray_Teardown/P1260148.JPG)
Picture 3 (http://http://www.archive.hak8or.com/pictures/Xray_Teardown/P1260149.JPG)
Back of the board.

Here is what the machine looks like so far. Time to take the huge X-ray head off!

The X-ray head is attached the machine using a hex screw, and I only have the long hex screwdrivers, so after quite a bit of mucking around trying to unscrew them in such a small space, I managed to take off the X-ray head. I have to say, the X-ray head is rather heavy, and when you knock on it then it sounds "full". One of my possible explanations, is that in the user manual it says that the X-ray head is oil cooled, with a maximum anode power of 700 watts, so I guess that the X-ray head is an enclosed system, including the liquid cooling, voltage multiplier, and the high voltage transformer. There is a lack of any fins, so I am guessing that the outer metal is a "shell", with the oil flowing near the surface, allowing heat to be released that way. There are no heavily insulated wires, and no tubes going to the X-ray head, so I am guessing that this is the case. My other idea is that it is just really thick metal, but it may be both.

The only identification marks I can find on the X-ray head. A short google sadly does not find me anything.

Taking off the black metal surrounding the X-ray "area" gives me this. I am guessing the black metal acts as shielding, but I am not sure. Here you can spot the place to put the hand, the finger, and a board with some wires. This is where the X-ray camera resides.

A closer look reveals a few logic chips, such as the MM74HC157M, a multiplexor, a MACH211SP, which is a programable logic device, and a LTC1415CSW, which is a 12 bit, 1.25 MSPS ADC, with a parallel data output.

And this is the back of that board.

After taking off the X-ray "camera", the plate that provides calibration and testing for the X-ray according to the user manual can now be seen. From what I understand, it provides very good contrast against the bone of the finger.

The X-ray sensor seems rather simple, but I cannot seem to open it, even after unscrewing the screws holding it together. I am thinking that inside there may be another gas or something like that, hence them gluing it shut after screwing it shut, so before going any further I will ask the awesome people at 4HV for any ideas, and if there is anything dangerous possibly lurking there.

And this is the back of that board.

After a while it looks like they just put in an entire computer, but to get to out I have to get through this ISA card. Some chips on it that I see are the IDT72403L35SO, a FIFO, a MACH5 CPLD, some relays, a buzzer, speaker, and some logic ICs. The board is attached to the motherboard of the computer with some screws, one of which was behind the speaker, which was attached to the PCB way off center.
Off center screw (http://http://www.archive.hak8or.com/pictures/Xray_Teardown/P1260191.JPG)

And here is most of the computer, excluding the card I took out earlier. It has a blazing fast Pentium 2 with no thermal paste, a whopping 64MB of ram it seems, and about a 2GB HDD.

The bottom power board.

Part of the top power board, specifically the maker of the board.

The wiring from the xray head, with some sort of potting material. I would really want to check out the xray head, especially the high voltage components, but before I try to disassemble the X-ray head, I will ask the community at 4hv if there is anything that might pose a risk to anyone.

Inside the X-ray head.

And a final picture showing an idea of the size of the X-ray head.

Off topic: My website is now on github! In case anyone wants to use the same website, but for their own projects, feel free! :)
I am going to put all my pictures under a  Creative Commons Attribution-ShareAlike 3.0 Unported License, so you are free to do anything you want with them as long as you put them under the same license and credit me as the original author. At least, that is how I understand it works. I also added in descriptions into the supersized jquery plugin, and the ability to move the box around so it does not block stuff of interest behind it, just have to find out why it is very slow when the image is on a big res screen. The code contents will probably be put under the GPL license.

Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: ian on May 01, 2012, 08:40:22 am
Nice job. I was expecting an 8088 clone and MS/PC DOS, interesting to see a pentium. This was probably a very expensive machine back in the day, I bet the temperature sensor would have been a pretty easy fix, probably a SOT23 part on the main board.

Also interesting to see the PCB routing. It looks like it could have been done by hand with a ruler. DP would never put out a board with such ugly routing ;)
Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: hak8or on May 02, 2012, 06:19:44 am
If it was really designed in the late 90's then I think that back then the super nice CAD packages like altium or even eagle were not the norm, so maybe it was still designed by hand? I don't know though, as the late 90's are not really THAT long ago, and I think that if not eagle then other CAD software existed out there for PCB stuff. It is unclear though what chip is delivering the temperature sensor on the motherboard, for all I know it could be the northbridge or southbridge, or indeed a nice and east SOT23 ic. My main thing now though is to dump the HDD contents and put it online (copyright be damned), and find out some more about the sensor and xray scanner.

http://4hv.org/e107_plugins/forum/forum ... php?137815 (http://4hv.org/e107_plugins/forum/forum_viewtopic.php?137815) <-- thread on 4hv
http://archive.hak8or.com/projects/Xray_Teardown/ (http://archive.hak8or.com/projects/Xray_Teardown/) <-- gallery of the pictures

As I am learning how to use github, I am doing lots of updates on the site and my productivity has really shot up! Github is awesome :)
Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: AdShea on May 03, 2012, 01:28:17 am
Looks like the voltage multiplier and the like are inside the tube.  Personally I'd say see if you can fix the thermal sensor and try to make it run.

Then use a logic sniffer and figure out how to run the thing, give it a new controller, and use it for PCB inspection.
Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: hak8or on May 03, 2012, 03:26:20 am
Agreed, but as said in the thread on 4hv, taking it apart will likely spew mineral oil everywhere. :P And I don't feel like I know enough about Xray to put it back together properly without posing a risk when turning it on again later.

But yeah, my end idea is to use this for BGA ic's, or just anything else which comes to mind that I could use Xray for. All I really need to do at the end is turn on the xray head and control the strength, and how to fetch data off the sensor. If it really is just a fluorescent screen on top of a normal CCD or CMOS sensor, then I can stick a normal camera under there, or with a mirror so I don't wreck it, and get the image that way.

Also, Ian, feel free to change the name of the post from SMD to BMD. I might have typed SMD in my post somewhere by accident, in which case my apologies.
Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: Kasilas on May 03, 2012, 12:46:44 pm
(Tried to post this on 4hv but their current registration process proved slightly too much of an effort hurdle) 

The X-ray window will likely be a thin aluminium or beryllium sheet. Beryllium can be nasty but its fine provided it is intact. This window will also be a vacuum seal for the x-ray tube. It's very fragile and if you break that it is game over for the tube. There is quite a chance that the vacuum in the tube has degenerated with age and that the tube might arc over and not run at it's stated voltage.

Last thing to point out is that the fluorescent signal will be very weak and emitted isotropically so even with a very fast lens and decent modern sensor if you move further away the signal will go down. This is the main reason the fluorescent/scintillating screen is bonded to the sensor.

Hope it's some help.
Title: Re: Xray machine tear down (56k no no) 4-29-12
Post by: hak8or on May 05, 2012, 06:43:30 pm
Thanks for the heads up, Kasilas! :)

It totally popped out of my head that it could be Beryllium, but it does make sense for it to be used here. If the vacuum really did drop, then I doubt I will be able to fix that as I do not have a proper vacuum pump with an oil diffusion pump or turbo pump. (always looking on ebay though)

Instead of capturing it with a camera from a distance, or gutting the camera and sticking the camera sensor right under the fluorescent screen, maybe somehow get a scanner under it and disable the lighting? First thing I want to do though is get the Xray head to actually generate Xrays, and then see if the sensor is still working. If not, then I will work with what I have and think of some other use of this guy. If the Xray head is dead, then you can expect a messy tear down of that too. :)