Reverse Engineering the ThunderScan

The ThunderScan was a device that famously turned an Apple ImageWriter into a monochrome scanner. The hardware consists of three boxes connected by cables; the “cartridge”, an “adapter box” and a “power converter”.

First some history. The original Macintosh used a DE-9 connector for its serial port, but it was not a standard RS-232 port. Apple used RS-422, which employed differential signaling, so the TX and RX lines each used two wires. They included one handshake/clock pin, and also provided +5 and +12 volt outputs for powering peripherals. Quite handy.

Then along came the Macintosh Plus. Maybe because the SCSI port robbed the rear panel of room for connectors, maybe because making something that wasn't an RS-232 port look like an RS-232 port was a bad idea, or maybe for other reasons, but regardless Apple change the serial ports to Mini DIN 8 connectors. They added a handshake output and a general purpose input, but removed both power pins. But what if your company had developed a piece of hardware that required power from the serial port?

Well, that's where the "power converter" comes in. This box contained +12V and +5V regulators, and its output connector matched the pinout of the original 512/128 serial port. The input was also a DE-9, but an adapter cable could be used to connect the power converter to a Macintosh Plus or later. And for no good reason, the power input was centre negative.

The next box in the electronic centipede was the "adapter box". This had a little pigtail connector that could either connect directly to a 512/128 mac's printer port, or to a later mac through the "power converter". It had a DE-9 connector for the ImageWriter II to plug in to, it included a switch to switch between print and scan modes, and it was attached to the ThunderScan "cartridge" through a long thin black cable.

And this is where things get interesting. The "adapter box" contains no active electronics. And even weirder, the RS-422 transmit/receive pairs pass through the box untouched. The ThunderScan doesn't connect to them at all. And the cable to the ThunderScan? Only 3 of the 4 wires are used. Subtracting two for power, that leaves only one wire. Somehow the ThunderScan connects to the mac through a single wire. And what is that wire is connected to? The serial port's handshake/ext clock pin. Whaaat?

Okay, so let's look at the "cartridge", that will answer all the mysteries. Maybe there is a microcontroller with some firmware we can dump to help decode the mystery. The front of the case near the sensor was glued shut, so after carefully prying it open, this is what I found:

It would appear that there are no digital electronics in this thing at all. Unsurprisingly, the part numbers were scrubbed from two critical components. The optical sensor, and a 10 pin TO-97 or TO-100 can. I happened to stumble across the optical sensor on Digikey (discontinued, obsolete), it's an HP HEDS-1500. When the ThunderScan was new, It was probably worth more than all of the rest of the hardware combined.

That left the TO-100 package. Luckily it tuns out that very few products used that package. In fact I was only able to find one: an Analog Devices voltage to frequency converter. This is a handy device generates a square wave with a frequency that varies depending on a voltage input. And then it all started to make sense.

So here's what's going on: the signal from the optical sensor goes through an op-amp, then it is fed into the V-to-F converter. The output from that converter is then fed directly into the clock in pin on the serial port. I'm assuming the software switches the SCC to async mode, and sends commands to the printer to start the carriage moving. Then it reconfigures the port into sync mode, disables interrupts and polls the "Rx Character Available" flag on the SCC...

It doesn't care about the data, it cares about timing. In my tests, the ThunderScan outputs a 2.6 KHz for black, 500 Hz for white. If the SCC were configured in sync mode with a synchronization character of all zeros, then that rate at which "characters" became available would vary depending on what the scanner was seeing. With 5 bit sync and data bits, black would generate a character every 3.8 ms, while white would produce a character every 20ms. Greys would be all the values in between.

What's crazy about the ThunderScan is that it is a purely analog device. It is completely dumb, the moment the switch is set to "scan", it starts sending a square wave. The rest of the magic is done in software, which I'm hoping to get to next.

That's it for now!