heads for WD5000AAVS

[Old Tech]

I have done a fair amount of searching through the site on the Western Digital WD5000AAVS-00ZT8 Caviar, which is in a MyBook case. I know it's not the USB - SATA electronics interface since I have plugged the drive straight into the SATA port on a known good port of a desktop.

The drive is clicking and not seen by the system (Win 7). I am talking to someone about a donor drive and there are quite a few reasonably priced WD drives available locally.

What would be most helpful to me right now is someone explaining what heads in similar drives can be swapped with the WD5000AAVS-00ZT8. I see many drives advertised for sale, like the WD5000AAKS.

Are the heads typical over a certain generation of drives for a 500 GB drive or is the manufacturing date important?

Before anyone starts lecturing me on tampering with HDs, let me assure you that I have had decades of experience working with electronics and computers. I know all about clean rooms and the dangers of taking the cover off a hard drive. I know that swapping a PCB will require swapping the ROM data.

Recovering the data from this drive is not critical, it would only be convenient. I have much of it backed up to DVDs and other external drives. I just want to play with it and learn something and it would be a bonus if I got it working well enough to retrieve the data. Whereas most of it is backed up elsewhere I want to review that.

If I retrieve the data, I won't be using the drive anymore.

[mr_spokk]

First thing to try is to replace Pcb...look at the number etched on the Pcb, like: 2060-701640-001.
Find same Pcb and swap it's ROM located on U12 (if present)...if not present, things get harder for you.
Headswap is the last tryout.

[Old Tech]

mr_spokk...thanks for reply.

I have been keeping an eye out for an exact match for the PCB but it's not clear if I need an exact match. Some people are suggesting that one board will fit various machines if the model is in the ballpark. My board is a 2061-701444-J00-AB. I have heard that the AB on the end is important.

I was playing with wdr demo version and it would not work on straight XP. However, it works on Hiren's. It does not see my drive but then again it doesn't see one of the working SATA drives either, It sees two of them but not the third so I wonder how reliable it is.

If it was just my bad drive it was not seeing I could presume I have a PCB problem since even if the heads are bad, it should at least see the ATA electronics. Then again, the drive won't even initialize with the SATA cable pulled and the drive powered. If the drive can't get through is own initialization procedure, the ATA chip is likely not available. It seems to power off after seeking for a bit, with the SATA cable unplugged.

I can hear it seeking (with SATA disconnected), and the the motor speed is varying. That sounds like it may be a head issue but it could also be a PCB issue if the motor controller is messed up.

[mr_spokk]

That PCB number is the one you should look for 2060-701444, and then change ROM. This PCB is know'n for head failure mimic, so hopefully it's just a faulty Pcb

[fzabkar]

The first thing to try is cleaning the HDA contacts on the PCB with a soft pencil eraser.

viewtopic.php?t=20859
viewtopic.php?t=32273

[Old Tech]

That PCB number is the one you should look for 2060-701444, and then change ROM. This PCB is know'n for head failure mimic, so hopefully it's just a faulty Pcb

Thanks. Appreciate the response.

[Old Tech]

The first thing to try is cleaning the HDA contacts on the PCB with a soft pencil eraser.

Thanks fzabkar. BTW...I came across one of your old sites where I found data sheets for my PCB, or close to the chips I have. Thanks for posting them.

I did clean the pads on the PCB for the motor and the head pins coming through from the sealed area. However, when I looked more closely with a more powerful magnifier there are still black spots where the head pins make contact. I am working on cleaning those while being careful not to wear the pads too much.

The head pins seem to be made of spring steel while the pads are probably gold or platinum coated. I don't imagine steel against those surfaces works too well. There are very black dots where the head pins make contact. With +5 volts that would not be as much of an issue, I don't know how much the head voltages are amplified before being transmitted through the pins to the PCB.

Have you tried to measuring the head signal or looking at it with an oscilloscope? I have an old scope with a 10 Mhz bandwidth which would likely not sync up with the head data but it might show a rough frequency and amplitude.

When the problem started, the heads would click then suddenly read. Once they started reading they were perfect. I thought it was a cable problem at first because touching the SATA cable caused the drive to work intermittently. At that time, I did not realize there was a USB-SATA interface between the cable and the board, but wiggling the cable may have been moving the board and transmitting it to the main PCB.

[Old Tech]

That PCB number is the one you should look for 2060-701444...

Just curious...would a PCB from the WD5000 series with a similar manufacturing date and the same chipset work? I have the Marvel 88i6745, the Smooth L6284, and the Hynix HY57V641620FTP-6 memory chip.

[fzabkar]

The data rate when reading from the platters would be around 100MB/s. That's around 1Gbps. A 10MHz scope would probably only see DC.

A straight PCB swap without firmware transfer would most probably fail, but you could be lucky.

This person was very lucky:
http://www.hddoracle.com/viewtopic.php? ... 181#p10181

[Old Tech]

The data rate when reading from the platters would be around 100MB/s. That's around 1Gbps. A 10MHz scope would probably only see DC.

A straight PCB swap without firmware transfer would most probably fail, but you could be lucky.

This person was very lucky:
http://www.hddoracle.com/viewtopic.php? ... 181#p10181

Thanks for link fzabkar. I wasn't as worried about seeing a clear head signal as I was in seeing that it was pulses rather than DC and in comparing amplitudes. With really high frequency signals there is still variations on top of the apparent DC that indicates it's an AC signal. Straight DC would show as just a line. Also, the lack of sync makes it vary horizontally in waves.

Of course, I don't know at this point whether the signal would be multiplexed or whether the individual head signals would be brought out through the pins to the PCB. Getting at the pins without a breakout device would be another matter.

I am still curious as to the difference in WD PCBs between the different versions of the WD5000 series. If the hardware chips are the same, what could possibly differ drastically between boards except minor differences in ROM code? If the motors run at the same RPM one would think the motor control signals would be similar.

I think I talked to you before about building my own board to interface an OS to a drive. At this point, I'm wondering exactly what purpose the interface board serves on the PC3000. Someone has gone so far as to claim it's acting more as a dongle to protect the software. I realize it likely has more functions than that but the only thing I can think of is to act as a breakout device to isolate signals in the ATA signal chain. A further function would be as a buffer between the OS and the HDD.

Windows intentionally obfuscates interrupts and the I/O system. Windows interferes with access to ports and HDDs. A program written in the Assembly language should interface directly with both interrupts and the I/O ports, negating the need for an interface board.

In another post, someone pointed out while using WDR that an OS can try to access the drive while you are using it. That's built into a message-based OS like Windows, which runs in a software loop and is forever doing housekeeping, but if you wrote your own code in Assembly and ran it under DOS, there's no need to worry about that. I think as a requirement of running under Windows that PC3000 requires an interface board to isolate the HDD from Windows or another high-level OS like Linux.

I am currently interested in the following two articles. The first is from this site by _dex_ where he figures out the JTAG configuration on a WD PCB so he can interrogate the Marvel chip's ROM. I should be more specific since a ROM or a PROM cannot be erased and re-written, so it must be an EEPROM.

http://forum.hddguru.com/viewtopic.php?t=20324&start=

Although this article is impressive the following article is even more impressive since the guy reverse engineers the SATA data stream, injecting his own code. He was initially interested in the ARM features of the Marvel 88i9146, but when he started playing with JTAG he discovered 4 ARM processes in the chip, 3 of which handled the SATA interface and other read/write I/O. He did not identify what the 4th one did.

http://spritesmods.com/?art=hddhack&page=1

In the post to which I referred earlier in which i talked about building my own interface, someone argued that I was being arrogant and that it required brilliant Russian engineers to create the PC3000 system. If that critic had experience the sheer brilliance I have encountered from advanced reverse engineers, he might not be so skeptical.

The article above by Chen suggests he is an advanced reverse engineer but I can follow him step for step. He is not using a proprietary board as in the PC3000, he is using an inexpensive USB to RS-232 converter with breakout facilities and he is tapping the signal to feed a JTAG device that can interrogate ROMs and the chips holding them.

I was reading another article where a reverse engineer explained how to use JTAG to hack a ROM using techniques similar to what hackers use. I am not condoning illegal activity but I know there are ways to interrogate a ROM device, even one that is contained in another device for which the pinout is not known.

HDD manufacturers can take steps to prevent you accessing the ROM data but according to the aforementioned reverser, there are ways using JTAG and other techniques to bypass that kind of protection. IF WD and other manufacturers allow HDD firmware upgrades using an EEPROM programmer there has to be back doors into the chips. According to Chen, WD has taken no steps to obfuscate the code inside the ROM.

What it comes down to is human ingenuity. That means ignoring anyone who claims it cannot be done and finding a way to do it. It's a lot harder with hardware than with software and hardware dongles were thought to be the ultimate in software protection till someone, using ingenuity, found a way to bypass them.

[Old Tech]

@Old Tech It looks to me that you are making matters look way worse then they are in reality.

I appreciate your reply and you observation, Spildit. Please understand that I am approaching the problem as someone with a background in electronics and computers who would like to bring some order to troubleshooting a HDD. Please don't take that as arrogance, I mean it in a purely technical manner.

I hate working in the dark and the practice of troubleshooting by the shotgun method, where you change every part till the trouble goes away is bothersome to me. Of course, I need to be practical as well. If swapping a board does the job, why not?

I would like to have a circuit diagram and hopefully an explanation of the circuit. Back in the 1950s, the North American television manufacturers got together and agreed to share information between themselves and the public. That spread to other manufacturers of most electronic products, even in Asia.

Today, it chagrins me to see HDD manufacturers guarding their secrets. Why has Marvell not released datasheets for their products? It's really petty and small-minded. It won't stop anyone who is intent on discovering what each pin on the chip does and laying out a facsimile of the actual chip.

Granted your advice is well taken with regard to making a mountain out of a molehill.

You can just pick up something like WDMarvel or WDR and reverse it and you will get the VSC to access the firmware. If you use TREX or MHDD scripts you will be under pure DOS so you will be ok.

Also search the net. There are a considerable amount of VSC already posted somewhere ....

Thanks for that. I tried the demo of WDR but it would not run on Win XP with SP3. Under options you could select Primary, Secondary, or Custom. Under Custom, the bottom part of the screen with the "OK" button is missing.

I got it going on Hiren's 15.2 mini Win XP. It was stable but one of my drives does not show up under the Custom selection window. Furthermore, if you continue to select from the Custom menu it begins showing certain drives attached to every port.

Under Options, Port, Custom, I get the following ports:

4480/44A6 - Int ATA: Intel Id 29B6*
4478/44A2 - Int ATA: Intel Id 29B6*
4468/449E - Int ATA: Intel 82801IR/IO/IH (ICH9R/DO/DH) 4 port SATA IDE
4460/449A - Int ATA: Intel 82801IR/IO/IH (ICH9R/DO/DH) 4 port SATA IDE
4458/4496 - Int ATA: Intel 82801I (ICH9 Family) 2 port SATA IDE
4450/4492 - Int ATA: Intel 82801I (ICH9 Family) 2 port SATA IDE
2018/2026 - Int ATA: Marvell 88SE6101 single-port PATA133
2010/2022 - Int ATA: Marvell 88SE6101 single-port PATA133

I don't know what the top two ports are. Windows seems to have added a generic driver over top of the Intel drivers, represented by the next 4 ports. The bottom 2 ports is a PATA port for the older parallel HDDs.

It's a pure Intel board and I have no idea why it's referred to as Marvell. There is a reference in Hiren's drivers to Marvell.

Anyway, under the first two ports WD-ROYL returns garbage.
Under the first SATA RAID ports it returns my WD5000AAKX drive (on SATA port 0) from the family STG_Aris. That's my XP drive in a dual boot system'
Under the second SATA Raid port it returns my Toshiba 500 Gig drive (on SATA port 1) which is my Win 7 drive.
Under the 2 port SATA ports #1 and #2 it returns the Toshiba again.

Oddly, under the PATA port it returns garbage with the family = Hercules SAE.

A third 250 Gig drive is not even listed even though it's plugged into SATA port 2 and working. It's listed in both Device Manager and Disk Management.

Maybe I am using it wrongly but it doesn't give me much faith in the product. Since you claim it's OK I'll look into it further, maybe deeper than most.

[Old Tech]

- Does your drive have an external ROM chip ? If so just swap it to the new PCB and/or read and write it with external programmer.

Thanks for info Spildit. No...the ROM is in the Marvell 88i6745

I picked up two used drives the other day that are identical, both WD5000AAKX. They both have the Marvell chip but it is an 88i9045 and the motor/head driver is a Smooth L7251 as opposed to the Smooth L6284 on my bad HDD. The newer drives are dated Jan 2011 and Feb 2012 while the bad drive is dated 2008. I am picking up another HDD today dated 2007 and I am hoping it may use the same Marvell chip as mine.

I don't think swapping boards between the WD5000AAKX and the WD5000AAVS would provide any benefit for purposes of eliminating whether the clicking is board related or head related. I am reluctant to experiment in case I blow something like the motor or a controller in the board, although the board layout in both is identical.

Any advice on that?

- Does the drive still clicks with new PCB + ROM transference ? If so then most likely at least one head is gone and you will need a head stack replacement to get to all the data, unless some heads are still working and you just want a partial recovery.

Have not located the same board yet. I am looking locally before checking sources on the Net.

I am wondering about the possibility of swapping heads between the 2011 version of the WD5000AAKS and the 2008 WD5000AAVS. I am guessing they are both two platter devices but whether the head electronics of the newer WD5000 boards would interface with the older Marvell chip is the question. Or whether the physical geometry of the newer heads would allow a fit in the older WD5000 drives.

- To read ROM if it's embeded on the MCU and the PCB it's still working at a minimal check here - http://www.hddoracle.com/viewtopic.php?f=86&t=1127

The drive won't finish it's initialization and cannot be contacted by the OS. Is there a way to bypass it's initialization so the PCB electronics/ROM is available?

I have heard of PUIS but I have no idea what that means at this stage. So much to investigate. With the older Maxtor 80 Gig drive you could jumper it in another mode.

- If you have something like WDMarvel you can do some testing with the new PCB if the drive is still clicking like this - http://www.hddoracle.com/viewtopic.php?f=86&t=1498

I tried but could not download the audio for that thread, even on Wayback.

- All the rest like creating your own board to interact with the drive is a waste of time for your case unless you want to create a comercial tool to sell.

I appreciate what you are saying but I have been highly trained in electronics and I have put very little of the more technical stuff to use. I really enjoyed projects in school where we wired up processors and programmed them to do things. If I do this it will be purely for self-interest, nothing else.

I certainly would not waste my time on it just to get an HDD working again.

[Old Tech]

Test your drive in KERNEL MODE - http://www.hddoracle.com/viewtopic.php?f=86&t=1523.

thanks...that's what I was looking for. Three jumpers and isolate motor contacts.

Mind you, my SATA PCB looks a lot different than the older one in your example and I hope it works. I'll get back to you and keep looking for an exact replacement PCB.

[Old Tech]

Test your drive in KERNEL MODE - http://www.hddoracle.com/viewtopic.php?f=86&t=1523

Sorry...have been busy with other stuff recently and have not tried your kernel mode solution yet. Will likely do it today.

Just wondering...you have isolated the motor feeds to prevent the motor spinning up. However, the heads are still connected and it's not clear if the servomotor that positions the heads is connected. When the motor does not spin up is the head positioner locked out?

Secondly, Is it possible to do the kernel mode solution with just the board plugged into SATA power and the SATA signal cable? Or is their a signal in the head pin connector that senses the heads are disconnected and shuts the board down? Or do the jumpers allow the board to be operated without the initialization procedure?

I'm asking because I'd like to check signals on the chip side of the board while it is hot with a SATA signal applied.

[fzabkar]

Secondly, Is it possible to do the kernel mode solution with just the board plugged into SATA power and the SATA signal cable?

Quoting from Spildit's tutorial ...

Sometimes there will be the need to READ ROM on a PCB without having the entire drive with you or WRITE that ROM back to the PCB without the rest of the drive assembly as well.

On my example I'm going to use a WD3200BEVT 2.5 drive and because of that I'm going to connect the PCB directly to the firmware tool, in my case my HRT card without the rest of the drive assembly.

[Old Tech]

Quoting from Spildit's tutorial ...

On my example I'm going to use a WD3200BEVT 2.5 drive and because of that I'm going to connect the PCB directly to the firmware tool, in my case my HRT card without the rest of the drive assembly.

Fzabkar...thanks for the quote. I have been distracted the past few days and tended to skim the tutorial when time permitted. Still, your reply does not answer the technical questions I posed.

I am wondering why Spildit isolated the motor contacts and not the head connector. Theoretically, if the motor is stopped and the OS sends a seek command, you would not want the heads flying out over a stopped platter. There must be a safety device built into the system to prevent that with the head connector connected and the motor connector isolated.

I was also curious as to what the three jumpers do. Kernel mode does not describe the function of the jumpers. On the Windows OS, kernel mode is a reference to the Windows subsystem that cannot be accessed directly by user code. There really isn't a kernel on an HDD therefore the term 'kernel mode' does not explain what is going on other than an oblique reference to the ability to access the service area.

Can you use that mode with the three jumpers for other functions such as accessing the non-user area?

Actually, a question I posed earlier was related. I asked if it was possible to bypass the HDD initialization routine. That seems to be what is preventing a troubleshooter from accessing ROM when the drive cannot read and do its initialization. Based on my understanding the OS cannot send commands till the HDD completes it's initialization.

[Old Tech]

Get something like WDR DEMO as well and make it work on a win XP 32 bit system.
Test your drive in KERNEL MODE...Then READ ROM with WDR DEMO.

Fired up WDR in Hiren's and managed to dump a bin file. It's 192 Kb in size and it is titled 5C34.bin. There is another file called id.bin as well.

The 5C34.bin file looks legit. The first character is ASCII Z and at first I thought the 5A 04 was an MZ header from an executable file. However, there are what appears to be headers with FF FF FF FF at offsets 0x34, 0x54, 0x74, 0x94, etc.

I recognize assembly code in places and there's a large block of FFs at 0x2737D extending to 0x2D000. That's followed by what appears to be code and I will run it through a disassembler tomorrow to confirm. Not that it's important now, but I'd like to see what they are doing.

After another block of FFs, there is a section beginning at 0x2F276 with the header ROYL. That block contains the ASCII 005C0034 from which the bin file gets it's name. According to another WDR screen, which was mainly garbage, that maybe the firmware version...5.34.

A series of small blocks follows that right to the end, all with header ROYL. Another such block at 0x2F6F8 also reference that number 5C34.

I'll get into it more tomorrow but I also want to check another board I got that is close and from the same era (2007/2008). It's a 2060-701477-900-AD and I need a 2060-701444-J00-AB. I have read that it doesn't work but I'd like to dump the ROM and see how they compare.

Both boards above use exactly the same chips.

[Old Tech]

This will confirm if ROM is OK.

Thanks for help Spildit...much appreciated.

ROM checked OK on Fzabkars tester. Thanks Fzabkar.

Wondering about small file WDR creates along with ROM file. It's called ID.bin and it's size is 1 Kb. Is this file only for WDR or will it be required when writing ROM?

[Old Tech]

DO NOT WRITE THE ID.BIN TO THE DRIVE ROM, You will brick the PCB ...

Thanks for info, Spildit. I had not planned to write ID.bin to the ROM I just wanted clarification of what purpose it served.

I was planning to use the 192Kb bin file only but wondered if WDR might require the ID.bin file at some point. I'll leave it in the directory but I will point to the 192Kb file in the write dialog.

[Old Tech]

To Write ROM you just need the binary ROM file.

Success!!! Wrote ROM back to donor board and the drive was revived.

Donor board was not the same model as original. Original was 2061-701444-J00-AB (from WD5000AAVS-00ZT8) and donor was 2061-701477-900-AD (from WD5000AAKS-00YGA0). They had the same chips and were within a year of each other (Jan 2008/Dec 2007).

Got lucky. I have my drive partitioned into a FAT and NTFS partition and I am getting a few (not a lot) CRC errors. So far they are only in the FAT partition and only in large files. Wonder if that could indicate an error in the SA files or maybe the head touched down when the drive was clicking.

Anyway, I have transferred all the good files off the drive.

Thanks to you Spildit and Fzabkar for advice. Invaluable information.