Reverse-Engineering

of an X-ray Imaging Device

In September of 2012, I got my hands on a used Faxitron MX-20 small-sample x-ray imaging device equipped with a Bioptics DC-44 x-ray camera. It was a second-hand purchase, and fairly low-priced, considering normal costs of x-ray equipment. The only downside: it came without the computer. So I knew from the get-go that I had to do some reverse-engineering to get the DC-44 imaging chip to operate. This is actually not fully undesirable (despite the time investment) due to the black-box nature of the imaging software that comes with any new device.

I tried a bit of a short-cut and contacted Faxitron's technical support. Initially helpful, they explained to me that second-hand sales without the computer are normal, because the computer contains confidential information. Moreover, the DC-44 imaging chip is no longer supported, and they would not be able to equip a computer.

Fine. I did not want a computer to begin with. I wanted information. Of course, Faxitron technical support became really tight-lipped when they realized the depth of my questions. Had they been willing to help me, I might even have signed a NDA, which would have stopped me from sharing this information. However, since the device is outdated and no longer supported, sharing my insights should not be a problem.

I think there are probably many MX-20 out there, sold without computer for an outrageouly low price. I hope this article may help others to put their Faxitron back in operation.

DISCLAIMER

This article may contain elements that may not work for you. Anything you attempt to do as presented in this article WILL void your warranty. Chances are good that you also destroy your imaging device.

USE OF ANY INFORMATION PRESENTED IN THIS ARTICLE IS ENTIRELY AT YOUR OWN RISK.

Any information presented on this web site is provided "AS IS," without warranties of any kind. The Author expressly disclaims any representations and warranties, including without limitation, the implied warranties of merchantability and fitness for a particular purpose. The Author shall have absolutely no liability in connection with the services including without limitation, any liability for damage to your computer hardware, x-ray hardware, camera hardware, and any connected hardware, data, information, Materials and business resulting from the Information or the lack of information available on this Web site. The Author shall have no liability for:

The Author makes no warranty, representation or guaranty as to the content, sequence, accuracy, timeliness or completeness of the Information or that the Information may be relied upon for any reason. The Author makes no warranty, representation or guaranty that the Information will be uninterrupted or error free or that any defects can be corrected. For purposes of this section, "The Author" shall include Mark A. Haidekker and his employees, partners, principals, agents and representatives, and any third-party providers or sources of information or data.

CONTENTS

This report is split into several sections to keep their length resonable:
Part 1: Introduction (this part)
Part 2: The Rad-Eye Imaging Module
Part 3: Inside the Faxitron MX-20
Part 4: Solution Design, Parts A and B
Part 5: Details of the Sensor Control Circuit

FIRST ITERATION: DISASSEMBLY

Extracting the imaging device reveals a large module covered with a brown, fiberglass-like plate (Figure 1). Removing the fiberglass cover reveals some electronics and another fiberglass-covered module (Figure 2). The fiberglass plate itself has a label on it that says Vermont Composites and has a date (March 2004) and a serial number, 1297-00-0070. Could this be an x-ray anti-scatter grid? Needless to say, Vermont Composites never responded to my inquiry.

Figure 1: The extracted imaging module. At one side is a connector for the 5V power supply and a connector that looks like a 68-pin VHDCI SCSI-5 connector. The entire thing is covered with a brown fiberglass plate.

Figure 2: Removal of the fiberglass cover reveals some control electronics and another fiberglass-covered module. Clearly, whatever is underneath the second fiberglass cover is the actual imaging unit.

For the time being, I left the second module unopened, because I cannot know how sensitive the elements underneath are. I expect at least the actual image sensors and the scintillation layer are inside that module, and I don't want to damage the scintillation layer.

At this point, it is probably a good idea to take stock of the obvious integrated circuits to make a guess how the device works. Prominently, a MC68HC908 microcontroller (Figure 2, bottom right) can be seen. It is clocked with less than 5MHz, so this can't be the "heavy lifter".

Here is more:
DS90C31 quad line drivers (5)
DS90C32 quad line receivers (4)
AD9240 parallel ADC, 14-bit (4)
AD462 quad high-speed op-amp (4)
MAX4616 quad analog switches (8)
CY7C4235V FIFOs, 2kB (8)
Xilinx XC95216 CPLD (1)

The differential line drivers and receivers tell the interface story: Not SCSI, but proprietary. 20 outputs (40 differential lines) and 12 inputs (24 differential lines) for a total of 64 differential signal lines. This leaves 4 more lines for Ground and power, which explains the VHDCI connector.

Figure 3: Close-up of the 68-pin VHDCI interface connector. The nearby differential line driver chips indicate that there are 20 outputs from the module and 12 inputs, of yet unknown function. Clearly, this is not a SCSI-5 interface. Too bad, actually.

Furthermore, we find four 14-bit ADCs and a number of analog switches. Based on the general layout, there are probably eight sensor segments, two of each are serviced by one ADC.

The real shocker, however, is found on the solder side of the PCB: A XILINX CPLD. CPLD stands for Complex Programmable Logic Device. The presence of such a device ends this avenue of reverse engineering, because there is no way to access its internal program.

No reason to give up, though. Click to continue.