6561 Die Shot Reversing Explorations

Modding and Technical Issues

Moderator: Moderators

Post Reply
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

6561 Die Shot Reversing Explorations

Post by lance.ewing »

I thought I might start a new topic to continue the 6561 die shot reversing that I began last year. Recently I started looking at this again, and rather than continuing from where I got to last time, I have decided to look at a different part of the chip, this time the Y decoder. The Y decoder is in the part of the chip highlighted below:
y_decoder_highlighted.jpg
The Y decoder is responsible for generating various signals in response to the current value of the vertical counter (the counter is in the area below the highlighted area). The Y decoder has as part of its input 10-bits from the vertical counter, the bottom bit of which is, as far as I can tell, ignored by the Y decoder (and it also isn't stored in the read-only raster line control registers). The Y decoder also has the interlace bit as input, but we'll come on to that in a later post.

This evening I will start with looking at the generation of the vertical blanking signal. In a subsequent post we'll look at the other vertical signals and then the horizontal signals. It's a bit later in the evening than I intended, so I'm going to cut straight to the logic diagram and will fill in the details of how I arrived at this diagram in my next post.

Here it is:
v_blank_logisim.png
For those that were following my posts last year, this decoder is very similar to what we saw with the colour decoder. This diagram was built in logisim. On the left hand side we have a logisim counter that represents the 10-bit vertical counter. Also on the left is the value of the interlace bit. I've included this because its there, even though it doesn't affect vertical blanking.

So what we have is the 10 bits from the vertical counter, and the inverse of each of these 10 bits, and then the interlace bit and its inverse, all entering the Y decoder on the left. So 22 inputs in total coming in on the left hand side. At the top of the diagram, we have two pull ups. Logisim provides a pull up resistor that functions in the way that the depletion mode transistor pull up in the 6561 functions, so I chose this to model that pull up. Within the Y decoder we've got transistors at various points that pull down to ground. The placement of these transistors is what determines where blanking starts and where it stops. One of the vertical lines controls where it starts and the other where it stops. You'll then notice that the bottom of these two lines connects to an SR latch flip flop. What happens is that one of those vertical lines turns the flip flop output on and the other will turn it off. The output of this flip flop is the vertical blanking signal. The flip flop holds the vertical blanking signal on until the vertical counter reaches the line that it should turn off.

From simulating this, I can tell you that vertical blanking is on from a counter value of 2 up to and including a counter value of 19. Please note that this would be line 1 to 9 (inclusive) in the value that is stored in the raster line control register. I've clocked it round a few times and every time the first two lines are still off and its only when it gets to line 2 (or line 1 in the raster control register) does it turn on vertical blanking. I've also double checked the point at which it turns off and this is at line 20 (or line 10 as we would see in in the raster control register).

In the next post I'll show the silicon and explain how I arrived at the diagram.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

The following image shows a close up of the section of the Y decoder that controls the vertical blanking signal:
vertical_blank_die_shot.jpg
The above version has no labels or coloured lines to identify the various parts. Below is an image of the same area that has all the diffusion areas identified with green borders, the metal to diffusion contacts as white circles, some of the polysilicon lines with red borders (I didn't draw around all of the polysilicon because it is actually fairly easy to see in this image, i.e. all those brown vertical lines), the buried contacts between polysilicon and diffusion with blue borders, and a few pink labels showing what various contacts are.
vertical_blank_die_shot_labelled.jpg
You can click on the images to see a larger, hopefully readable, version. Ignore the contacts that say H.BLANK and CLR BRST for now. Those are signals from the X decoder that just happen to be passing through this area. They have no effect on the Y decoder.

When compared with the logic diagram in the previous post, the logic diagram is rotated 90 degrees to the right with regards to the layout. So in the above images we have the pull ups on the left hand side. These are the squarish shaped red polysilicon areas with the blue buried contact to the right and a diffusion path to VDD to the left. These are depletion mode transistors and act as pull ups when their gate is connected to their source in this way (via that blue buried contact). We can ignore the bottom pull up. It appears to have no function as far as I can tell. It connects to a small length of diffusion, then to a smaller line of polysilicon, and then to a metal line. It doesn't matter how long I stare at that one, it doesn't appear to have any output. It would be a big NOR gate like the two above it, if only there was an output, and at least two pull downs, but I can't see any of that with regards to this one. It is almost as if it was put in the design for some purpose but not required.

But this is irrelevant to the discussion with regards to the vertical blanking. It is the two other pull ups that are related to that. In both of their cases, they connect to a metal line, each of which has nine pull downs, i.e. nine input NOR gates. Those nine pull downs are the nine transistors shown on each of the vertical lines in the logic diagram from the first post. A transistor is formed whenever polysilicon crosses over diffusion, so in all those places where the brown lines (three of which I traced around in red) cross over the green, it forms a transistor, and in these cases they're all enhancement mode and all with their source connected to VSS and therefore pull downs.

At the far right are the two outputs for these large NOR gates. which are the two polysilicon lines leaving the image. Those two lines lead in to the inputs of the SR latch flip flop. We'll take a look at that in the next post.

The nine inputs to the NOR gates are certain values of nine of the counter bits, i.e. the top nine (the bottom bit is ignored; no transistors formed to either the true or false case for that bit). In each case they represent a 9-bit number, i.e. the line at which vertical blanking turns on, and the line at which it turns off. I've tried to label each of those polysilicon lines but it is quite hard to read. It matches the logical diagram though.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

As mentioned in the previous post, the two outputs on the far right of the image enter an SR latch. Below we see the unlabelled section of the die shot image where this SR latch lives:
vblank_flip_flop_die_shot.jpg
And below we have the same image showing the labels, diffusion (green), polysilicon (red), and contacts:
vblank_flip_flop_labelled.jpg
If we then identify each of the transistors (where polysilicon crosses over diffusion), and their type (those that are wider with a blue buried contact are depletion mode pull ups), and then lay them out in roughly the same layout shown in the die shot images above, we get a circuit looking like the following:
SR_latch_layout.png
If we now pull things around a bit, and lay it out so it is easier to see what is going on, we arrive at the following:
SR_latch.png
These are two cross coupled NOR gates. We can tell that they are NOR gates because the two pull down transistors in each case are parallel to each other. If they were in series then it would be a NAND gate. Two cross coupled NOR gates like this form an SR latch.

So now that we have identified the logic gates, we finally arrive at the SR latch as shown at the bottom of the logic diagram in the first post, i.e.:
SR_latch_logisim.png
SR_latch_logisim.png (4.17 KiB) Viewed 17947 times
The above sequence of steps shown in this post is a good description of exactly the steps I go through as I reverse each part of the die shot, so hopefully this will help others to give it a go. For more detailed tips on how to identify the different types of material in the die shot, take a look at my site below:

https://sites.google.com/site/mos6561vic/

It's still a work in progress, but there's already quite a bit there to get people going.
norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

Are you compiling this info to build a circuit diagram for some sort of reproduction? Would this be applicable to the 6560 also?
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

I'm mainly just curious how it is implemented at the silicon level. The 6560 would be similar but obviously a bit different. There isn't a die shot for the 6560 as fas as I know. I've been tempted to buy one and donate it to one of these projects like visual6502. Also the 6561-101 might be different internally from the 6561E. I'm curious about that as well but there isn't a die shot yet for that one either. We can make a few assumptions about the 6560. The input clock is a different frequency, so the logic that splits that up in to all the different frequencies used internally would be different from the 6561, so might take up more or less room and could potentially cause other things to move around. But I'd assume that they had both PAL and NTSC in mind when they designed it and would have allowed space for such differences and therefore perhaps most things are in the same place. I guess we won't know until we see the 6560 die shot.

Another place where it will differ is with regards to the Y & X decoders that I'm currently looking at. The line values will be different for blanking & sync, and for the horizontal the points at which things like horizontal blanking start and stop will be different. And then there is the number at which the vertical & horizontal counters reset back to zero that will be different. But looking at how these decoders are designed, it would be simply a matter of changing the placement of a bit of diffusion here and there to match the numbers required for NTSC. The decoder itself could remain largely where and how it is. I can see evidence of redundant things in the 6561E die shot that make me wonder if they're there to support NTSC, but it could be that they just decided they didn't need it.

Perhaps someone can use what I've done to reproduce it at some point but they'll be waiting a few more years if I'm the only one reversing it. This is another reason I'm doing this, and why I'm explaining a bit of what I'm doing as I go. I'm hoping to attract the attention of others who have an interest in this and to show them that reversing from the die shot isn't as difficult as it seems at first. If an amateur like me can do it then anyone can.
norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

The 6560 die has pretty large features, I wonder if it is possible to use a cheap microscope camera and stitch it together. It doesn't look like the visual6502 project is going to get to it anytime soon. I bet it can be de-capped with a hot rosin treatment. hmmm.
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

In this post I'll be looking at the part of the Y decoder that determines what lines the vertical sync is active for. What I've done is to extend the logic diagram shown in the first post of this topic so that it now includes the transistors used for identifying the start and end lines for the vertical sync:
vblank_vsync_logisim.png
The transistors are placed such that the latch at the bottom turns on when the counter is at 8 (or raster line 4 in the control register) and turns off when the counter is at 14 (or raster line 7 in the control register).

You'll notice that there is an AND gate above the latch in this case. So turning on the latch is not as simple as for the vertical blanking. There appears to be a signal that comes in from elsewhere on the chip that must also be at a certain level for it to turn on. At this point I haven't tracked this back to see where it is coming from.

There are two more lines of transistors in the Y decoder. I will be showing these in the next post.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

I have now completed the logisim diagram for the Y decoder, as shown below:
vblank_vsync_max_logisim.png
I realised that my earlier diagrams had twice as many VSS lines as what there really are in the die shot. So I've removed the ones that aren't there so that it more accurately reflects what is on the chip. I have also added the completely unused line that I mentioned in an earlier post, i.e. the one shown third from the right that doesn't have any pull down transistors and no output. It's just a pull up connected to a metal line and that's it. No connection to anything else.

What we're mainly interested in though are the two new lines on the left. The second from the left has the nine pull down transistors that we've seen with the vertical sync and vertical blanking. It does indeed turn on for a given 9-bit value of the counter bits. The 9-bit value is 311 (or when the 10 bit counter hits 622). At first I thought that the output for this one wasn't connected to anything, but now that I've seen where the output is, it is kind of obvious! The metal line that the nine pull down transistors are connected to continues out one end, i.e. the end where the pull up is, to another part of the die shot. Really obvious. I haven't yet tracked it through to see what it connects to but it must be something to do with the last line.

The left most line is different from the others in that it has 11 pull down transistors rather than 9. It is the only one that has connections to the interlace inputs. This line has an output that connects off to another part of the die shot, so on face value it looks like it is doing something important. In reality though it never turns on. This is because of the two transistors that connect to the interlace bits. It has a transistor that pulls down when the interlace bit is low and a transistor that pulls down when the interlace bit is high. What this means is that no matter what the interlace bit is set to, the output of this line will always be 0. It doesn't matter that the bottom 9 transistors match a value of 312 (or when the 10 bit counter hits 624). The matching with this value of 312 becomes redundant due to the connections to both interlace bit values.

It would be very interesting to see the die shot of the 6560 NTSC chip. At this point in time, we can only guess that the 6561 PAL chip might be a modified version of the NTSC chip, with a few things changed here and there, and things like the left most line in the Y decoder discussed above disabled. Given that the interlace bit is involved, I would assume that on a chip that supports the interlaced mode, that the two lines on the left would be part of that functionality. But in the 6561 chip we know that this bit does nothing, and what we're seeing above in the Y decoder is potentially the reason. The unused line third from the right in the diagram above might also have a purpose in the 6560 chip. If only we had a die shot to look at.

Next I'll be taking a look at the X decoder.

Edit: I have made a couple of changes to the original posted version of the above. At the time that I posted it, I hadn't spotted a connection to the output of the line that matches a value of 311. I have now seen this and have updated both the text and diagram above to reflect this. I also took the opportunity to further tweak some of the layout to more accurately match the die shot layout. So, for example, we have the interlace line coming in at the top part way along from the right. This is where it actually does enter the Y decoder. And I now have the output of the two left most lines coming out near the top left, which is where they are on the die shot. Hopefully this will be easier for someone to follow when comparing it to the die shot at some point in the future. Just remember that everything shown in the diagram is rotated 90 degrees clockwise when compared with the die shot image.
Last edited by lance.ewing on Sun Oct 29, 2017 10:52 am, edited 4 times in total.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

norm8332 wrote:The 6560 die has pretty large features, I wonder if it is possible to use a cheap microscope camera and stitch it together. It doesn't look like the visual6502 project is going to get to it anytime soon. I bet it can be de-capped with a hot rosin treatment. hmmm.
Would be great if you think you can do it. A non-functioning 6560 would be just as interesting to see I would imagine. It's quite expensive to source a working one and would be a shame to destroy it. But I've certainly been tempted to buy one online simply so I can donate it to one of these projects that specialise in taking die shots. I've got nine 6561 chips (some not working) but no 6560s.

I noticed that John McMaster made a start on reversing the 6522 die shot, but that effort is now marked as abandoned.

https://siliconpr0n.org/archive/doku.php?id=digitized

Who knows. If I eventually finish the 6561, I might take a look at the 6522 if no one has completed what John started:

https://github.com/JohnDMcMaster/pr0nto ... _polys.svg
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

I have started looking at the X decoder. The die shot diagram below shows the X decoder highlighted with the green box. It also shows its position in relation to the Y decoder highlighted in yellow:
x_decoder_highlighted.jpg
I have finished tracing the diffusion areas. There are 18 inputs in to the X decoder. Sixteen of these are the 8 bits from the X counter, and their inverse value. The other two inputs are the phase 1 and phase 2 clock signals. There are 13 lines (i.e. 13 large NOR gates) with outputs, so 13 X counter values that are matched for various reasons. I have been through all 13 and worked out what X counter value is being matched in each case:

11 (end of colour burst)
7 (start of colour burst)
12 (end of horizontal blanking)
70 (start of horizontal blanking)
35 (unknown at this stage)
0 (unknown at this stage)
1 (start of horizontal sync)
6 (end of horizontal sync)
70 (unknown at this stage)
41 (unknown at this stage)
6 (unknown at this stage)
2 (unknown at this stage)
38 (unknown at this stage)

From looking at the colour burst, horizontal blanking, and horizontal sync values, it is clear that the X counter value entering the X decoder is actually the 6561 output clock cycle count for the current line. 71 cycles per line, so 70 is the max value, which is when horizontal blanking starts. It ends when the counter gets back to 12 on the next line.

I compared these numbers for the horizontal blanking, horizontal sync, and colour burst with some Picoscope captures from the 6561 and they appear to match, i.e. if I say the distance between the start of one line and the next is 71, then the width of the horizontal blanking and sync pulse are indeed as shown above, e.g. 5 for the horizontal sync pulse. It is also worth mentioning that I've tracked the output of the horizontal blanking, horizontal sync, and colour burst signals through to the chrominance and luminance generation part of the die shot, so I know that these signals have been correctly identified. Measuring and comparing against the Picoscope captures was an additional way of validating this.

I wasn't initially expecting this particular X counter value to be the output clock cycle value though. But it only has 8 bits coming in, and 71 x 4 = 284 dots is obviously too big for 8 bits, so it makes sense now. What it means though is that the top bit of this X counter is not used by the X decoder (well it is used but is redundant really, as it always matches the same value).

Interesting. My efforts now are going to be focusing on identifying what the values I've marked above as unknown are used for. I can't think at the moment what values like 35, 38, and 41 might be used for.

I will be building a logisim diagram for the X decoder, but thought I'd do it all in one go this time. I seem to be progressing through this one a bit quicker.
User avatar
beamrider
Vic 20 Scientist
Posts: 1447
Joined: Sun Oct 17, 2010 2:28 pm
Location: UK

Re: 6561 Die Shot Reversing Explorations

Post by beamrider »

I'm watching this thread with interest and find it very impressive. Thanks!

What is the end goal? Are you aiming to get to a position (eventually) where new 6561s can be fabricated?
User avatar
eslapion
ultimate expander
Posts: 5458
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Post by eslapion »

lance.ewing wrote:...
I have finished tracing the diffusion areas. There are 18 inputs in to the X decoder. Sixteen of these are the 8 bits from the X counter, and their inverse value. The other two inputs are the phase 1 and phase 2 clock signals. There are 13 lines (i.e. 13 large NOR gates) with outputs, so 13 X counter values that are matched for various reasons. I have been through all 13 and worked out what X counter value is being matched in each case:

11 (end of colour burst)
7 (start of colour burst)
12 (end of horizontal blanking)
70 (start of horizontal blanking)
35 (unknown at this stage)
0 (unknown at this stage)
1 (start of horizontal sync)
6 (end of horizontal sync)
70 (unknown at this stage)
41 (unknown at this stage)
6 (unknown at this stage)
2 (unknown at this stage)
38 (unknown at this stage)

From looking at the colour burst, horizontal blanking, and horizontal sync values, it is clear that the X counter value entering the X decoder is actually the 6561 output clock cycle count for the current line. 71 cycles per line, so 70 is the max value, which is when horizontal blanking starts. It ends when the counter gets back to 12 on the next line.

I compared these numbers for the horizontal blanking, horizontal sync, and colour burst with some Picoscope captures from the 6561 and they appear to match, i.e. if I say the distance between the start of one line and the next is 71, then the width of the horizontal blanking and sync pulse are indeed as shown above, e.g. 5 for the horizontal sync pulse. It is also worth mentioning that I've tracked the output of the horizontal blanking, horizontal sync, and colour burst signals through to the chrominance and luminance generation part of the die shot, so I know that these signals have been correctly identified. Measuring and comparing against the Picoscope captures was an additional way of validating this.
I suspect these counter's top possible values are pretty much the only thing different between the 6560 and the 6561.

I Was saying to RadicalBrad on another thread, I suspected the number of cycles per scanline on the 6560 is 65 or 66. If it is 71 on the PAL 6561 then the result is (17.7344MHz/(16x71) = 15.611.3kHz for the horizontal scanlines rate. Makes sense to me.
Be normal.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

beamrider wrote:I'm watching this thread with interest and find it very impressive. Thanks!

What is the end goal? Are you aiming to get to a position (eventually) where new 6561s can be fabricated?
The end seems so far away at the moment that I'm sure the goal will change a few times along the way. At the moment it is mainly to satisfy curiosity. If I do end up reversing most of the chip then perhaps it will be useful for someone thinking about creating a compatible chip. For me though I'm just enjoying it at the moment. That might sound strange, but I actually enjoy working out what the various logic gates are, regardless of how much time I seem to be sinking in to it, and I'm certainly learning a lot as I progress, so that's a good outcome.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

lance.ewing wrote: 41 (unknown at this stage)
6 (unknown at this stage)
2 (unknown at this stage)
38 (unknown at this stage)
A small update on identifying what the last four values are for. All four signals enter the same logic gate, which is formed from two cross coupled 3-input NOR gates. So it's another latch but this time with two inputs that can set it to ON and another two inputs that can set it to OFF. The "2" and "38" are connected to one of the NOR gates and the "6" and "41" to the other.
x_2_38_6_41_latch.png
x_2_38_6_41_latch.png (3.2 KiB) Viewed 17813 times
So what we're saying then is that when the X counter value hits 2, this latch toggles, then when it hits 6 it toggles again, and then again at 38, and again at 41. Quite clearly these four are closely related then. I've started wondering now whether this might be associated with the vertical sync pulses but I have yet to confirm this. Just a suspicion at the moment, but I mean what else could be toggling like that at those points along the line (remembering a whole line is 71)?
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

lance.ewing wrote: So what we're saying then is that when the X counter value hits 2, this latch toggles, then when it hits 6 it toggles again, and then again at 38, and again at 41. Quite clearly these four are closely related then. I've started wondering now whether this might be associated with the vertical sync pulses but I have yet to confirm this. Just a suspicion at the moment, but I mean what else could be toggling like that at those points along the line (remembering a whole line is 71)?
Nice and clear mapping!

My thought was that this latch had something to do with prefetch of first character column bits(e.g. screen read and character map read), but it doesn't make sense with the 38&41 trigger (which are essencially mid-screen). Unless its some kind of reset for the prefetch.
Post Reply