6561 Die Shot Reversing Explorations

Modding and Technical Issues

Moderator: Moderators

Post Reply
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

lance.ewing wrote:Any ideas what Data Catalog this 6562 document came from? http://archive.6502.org/datasheets/mos_ ... 63_vic.pdf
It is a different version than what is in the 1981 Component Data Catalog for the 6562, which contains a much fuller version.

Yeah, I'm aware of that. I was thinking of doing exactly that if I ever happen to attempt building an Attack UFO clone in hardware using the VIC 20 version of the 6560. The problem is that the game is putting a 1 in the colour RAM bit 3 for at least two of the colours used on the screen. If it is doing that for specific characters on screen, then it is highly likely that that colour data line is wired up in the original Attack UFO machine. The screenshots of the MAME emulation suggest that there are two different shades of blue, i.e. the darker blue of one set of UFOs and lighter blue of the barriers at the bottom. Those lighter blue barriers are using one of the colours where there is a 1 in bit 3 of the colour RAM.

My assumption is that the ROM images available online are the unmodified ROM data. There is no reason I can think of for the MAME team to have modified the ROMs. Isn't it their goal to build an emulator to run the unmodified ROMs? It's the code of their emulator that they change to make it run a new set of game ROMs, usually by building a driver that specifies what chips are used by that machine. In the case of Attack UFO, they had to alter their 6560 chip emulation so that it didn't support multi colour mode or the reverse mode when running Attack UFO. If altering the ROMs was an option for them, then they wouldn't have needed to add Attack UFO specific customisations to their 6560 emulation. So I think those would be the original ROMs.
Never looked at the 6562 before, but from the spec it looks like they simply doubled the pixel clock, changed the horizontal counter and left most of the remaining part to itself. From a development point of view, I would think that the 6560 was finished by the time they started on it.

I was under the impression that the ROM had been fiddled with, but you may be right that its only the MAME part that has been changed. Who knows.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Please reread my post on the 16th December below:

http://sleepingelephant.com/ipw-web/bul ... 851#p97851

I have made a few corrections as mentioned in the Edit section at the bottom of the post. In summary, I identified another inverter I didn't have in my logisim diagram. This has made it clear that what I had previously called the NEXT CELL' output actually stays low for the duration whenever the X/Y position is within the video matrix. So I've now renamed that output WITHIN MATRIX'. I now understand that the INCREMENT inputs to these counters that I have been showing is more of an INCREMENT ENABLE and that the counters are actually counting clock cycles. In some cases the INCREMENT ENABLE is enabled only for one clock cycle anyway, but in the case of the horizontal cell counter (and video matrix counter), it appears that increment enable is enabled for the whole width of the video matrix.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Let's start looking at the address computation quadrant of the die shot by looking at another counter. This time it is the video matrix counter, the biggest and most functional counter of them all. The following die shot image shows the video matrix counter highlighted with a pink box:
video_matrix_counter_highlighted.jpg
As you can see, there is a pink line towards the bottom that splits this box into two. The bit above the line is a counter of basically the same design as all the other counters that we've seen in the 6561. The bit below the line is a set of 12 register cells for storing and restoring the counter value. I believe that this 12-bit register is what Mike referred to as the "start of current text row" latch.

I've reversed the logic and produced the following logisim diagram:
video_matrix_counter_logisim.png
You will definitely need to open that in another tab, and this time you'll need to click on the image loaded in the tab to zoom in.

So what we're looking at is a 12-bit counter. Everything above the INCREMENT input on the right is the counter. The design is the same as all the other counters. The bit below the counter is the 12-bit register or latch. As you can see if you zoom in on the right, there is a LOAD CNTR input and a STORE CNTR input. The STORE CNTR controls a pass transistor that takes the current counter value and stores it in the register. The LOAD CNTR input takes what is in the register and loads that value into the counter. As noted in my previous post, the INCREMENT' input is actually an increment enable input. When it goes low, and stays low, the counter will increment on each clock cycle. The other input of note to mention is the VSYNC input. This input clears the value stored in the register/latch. As the name implies, this happens during the vertical sync. The next time that the register is loaded into the counter, it will be back to zero.

One thing to realise is that a cycle (i.e. the 1.1 MHz VIC 20 cycle) is actually twice as fast as what the counter is interested in. So the first bit of this counter is basically ignored. It's value isn't used by anything other than to increment the second bit. The second bit of the counter toggles on every video matrix cell.

In a later post we'll look a bit closer at when the LOAD CNTR and STORE CNTR happens, but for now we'll say that it is related to the Cell Depth Counter and START OF NEW LINE signal.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

I have been looking through the 1983 Commodore german promotion video which shows some interesting instruments. I am quite certain that we see two early steppers at 4:02, maybe the Perkin Elmer Microalign. Amazing machines that enabled 70%+ yield and the expansion up to 100mm wafers over time.

Many things are manual work and not much automation seems to have been used in the 1983 factory. This was normal at the time as can be seen from this Intel factory around 1980. A industry report from 1987 shows alot of interesting data, especially that standard fab resolution around 1980 was 5um, while thight resolution at the same time was around 2um. In 1975 a $9M USD factory has a 3-6um linewidth, which is around the time MOS started making 6502 (and the original 6560 was developed). Due to the expense of memory, there was no contrain on VIC-I (or VIC-II) linewidth or process requirement in the start of the 1980-ies, and MOS could probably make most of the ICs without investing in new equipment.
Later, around 1985, a 1.5-3um linewidth fab would cost closer to $100M, which shows how well the 1970-ies MOS fab fit for making low-cost ICs to Vic-20 and C-64 (given a good yield!!). It also shows how ill situated CSG was to start making the larger next generation ICs for Amiga: Such a 100mm fab can't make money with large chips until it goes to 150mm wafers. They may have spent alot of money for new equipment to get there and make the larger chips profitable (+smaller linewidths = smaller IC's). We know that the IC's from CSG that were found in November last year were 100mm wafers and that contained 8563 with yield around 60-70% (IC's are around 4.3x4.9mm):
8563-wafer.jpg
At the same time we also know (at the time of C128, which used the 8563) that Commodore began having problems with huge expenses, which lead to the cancelling of the portable Commodore LCD. So maybe they never went to 150mm, which meant that their IC production was slowly bleeding out the company (look in the industry report linked above for an explanation).

Anyway, going back to the Commodore Germany promotion video, we can also see some really large terminal-like screens (at 3:56) with keyboards. A short picture right after shows a plot which looks like some really large transistor plots. In fact, around 6:20 you see the same design plot with a zoom-out showing more of the IC. With even parts of the IC shown on the terminal screen for the next minute (interesting enough you can also see the IC name "7520R1" for one frame). Thus, it looks like the MOS/CSG fab had fully digitized designs around 1983. It was probably combined with a laser writer to easily make new masks.
Last edited by Kakemoms on Tue Jan 02, 2018 2:47 pm, edited 2 times in total.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Today we'll take a look at part of the die shot that best matches what the block diagram in the datasheet calls "CELL INDEX":
cell_index_block_diagram.png
The following image of the die shot shows this area highlighted with two pink boxes:
cell_index_highlighted.jpg
For this post I'm going to zoom in on these boxes and show those sections of the die shot image with the diffusion, polysilicon and contacts traced around.

Top box:
cell_index_top_part.jpg
Lower box:
cell_index_lower_part.jpg
In this lower image, we can see the eight data bus lines coming in at the bottom and a long horizontal polysilicon line across all eight lines that acts as a pass transistor at each point that it crosses a diffusion line. It is this polysilicon line that controls when the data line values are loaded into this cell index area. At the top of the lower image, we can see eight lines coming out of this area and heading up.

My logisim diagram for both parts is as follows:
cell_index_logisim.png
The interesting parts of this diagram are the NOR gate on the left, and the pass transistors in the centre of the image that are controlled by the value of D (i.e. the Double height character bit). At the centre top of the diagram we have nine output lines that I have named BM3 to BM11. The main reason for naming them like this is because they align with what Segher Boessenkool named them in the reversing work that he did a few years back. I'm not certain what the BM would mean, but it is related to forming the address of the character data, so perhaps it means BitMap? Not sure. I'm going to leave it as this for now so that anyone looking at Segher's diagram can relate it back to the above.

I've also shown on the right three lines that start off as CDC0 to CDC2 and become BM0 to BM2 at the top. This is to show that the lower three bits of the Cell Depth Counter become the lower three bits of this "BM" value, which is used in creating that character bitmap address.

We can see at the bottom to the right of the data lines the D and CDC3 lines. If D=1, then CDC3 gets used for the BM3 value and the data line values all get shifted to the left. But if D=0, then the data line values are used for BM3-10 and a value of 0 is hardwired for BM11.

That leaves the 3-input NOR gate. As you can see, the three inputs have been named F2, HCC0 and MEM CLK. The F2 is the phase 2 clock, the HCC0 is bit 0 of the Horizontal Cell Counter, and MEM CLK is the inverse of the signal that would come out of the Memory Clock option pin (if you happened to have a 6561 with that option, which I don't think anyone in the world would). I've decided to call it MEM CLK for that reason and it seems a reasonable enough name for how it is used. I've created the following timing diagram to show how these three signals work together with the NOR gate to control the pass transistors that load the data lines into this cell index area:
cell_index_load_timing.png
cell_index_load_timing.png (6.85 KiB) Viewed 1357 times
What we can see in the above is pretty much what I think we would expect given the diagrams shown in the datasheet. It shows that the cell index data is loaded during the second half of phase 1, but only on every second cycle. The other cycle is when it would be fetching the character bitmap data.
Last edited by lance.ewing on Tue Jan 02, 2018 5:38 pm, edited 2 times in total.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

I am having a hard time agreeing to the structures you draw for the upper/Top box. The general impression is that the logic you get out of it is correct, but I can't see what the upper red areas (beneath the grounded metal) are connected to. I mean, one part seems to be connected to the first NOT gate, but the other part seems floating? What am I missing here.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:I am having a hard time agreeing to the structures you draw for the upper/Top box. The general impression is that the logic you get out of it is correct, but I can't see what the upper red areas (beneath the grounded metal) are connected to. I mean, one part seems to be connected to the first NOT gate, but the other part seems floating? What am I missing here.
I think I've understood the bit you're referring to, but correct me if I'm wrong. So those larger polysilicon areas that cross over the diffusion, and are immediately beside VDD, and are connected to the diffusion on the other side of VDD using a buried contact (i.e. blue box), are the depletion mode pull up transistors. There are a few different ways that I've seen them use the output of an inverter or other logic gate. The simple case is to take it from the diffusion between the pull up and the pull down enhancement mode transistor (the thinner transistor), but since the depletion mode pull up transistor's gate is connected to its source (the source of the pull up being where the output is), then they often instead take the output value from the polysilicon used to form the pull up transistor. This is what is happening in that area that you are referring to. The output of the first inverter is being used as the input to the next by taking a line of polysilicon from the depletion mode pull up out and then crossing over the lower part of the next inverter to form an enhancement mode pull down transistor. The output of that second inverter is being taken once again from the polysilicon used for the pull up and is connecting in most cases to a metal line.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Here is an image of a close up that shows a bit clearer what I was referring to in my previous post:
two_inverters.jpg
I've put some black borders around the two inverters. At the bottom we have the input value coming in, which I've arbitrarily called IN for this discussion. The pink arrow shows it entering the input of the first inverter. That value connects to the gate of the pull down enhancement mode transistor (with red border). As you know, an inverter is simply a pull down transistor with some sort of pull up. A resistor is often used, but in this kind of NMOS technology, a resistor takes up too much space, so they use a depletion mode transistor instead. The output comes from the source of the pull up transistor. This is shown in these diagrams from the Mead/Conway Introduction to VLSI Systems book:
inverter_diagrams.png
The diagram shows that the output A' often comes from the diffusion area between the lower/thinner enhancement mode pull down transistor and upper wider depletion mode transistor. But as I mentioned in my previous post, since the source of the depletion mode transistor is connected to the gate, the output is also quite often taken from the polysilicon that is used for the gate.

So going back to the first image above, the bottom inverter (i.e. the area within the first polygon with the black border) has the IN input coming in a the bottom. We can see VSS, i.e. GND, to the left, and some diffusion (with green border) to the right that goes up and meets a buried contact (blue box), which is a connection between the diffusion and the polysilicon. This is the connection between the gate and source of the pull up transistor. Above the pull up transistor we can see VDD. To the left of the pull up transistor we can see a thinner red polysilicon line coming off the gate. This is the output of the inverter in this case. I've labelled it IN' to show it is the inverse of the input. It then crosses over some diffusion, which we can see has VSS (i.e. GND) to the left. This is the pull down transistor for the second inverter. To the right of this is some diffusion that has a buried contact above it that connects to the pull up transistor of the second inverter. Above that pull up transistor we can see a line of diffusion that goes up then to the right and then down to VDD. To the left of the pull up we can see that the polysilicon extends out to a poly to metal contact. This is the output of the second inverter that is labelled IN to indicate that it has the same value as the input to the first inverter because it has been inverted twice.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

Ok. I think what is confusing me is that you draw the diffusion areas as contineous green areas even beneath the polysilicon. I see now that in your third post to this tread, you actually stated this: "If we then identify each of the transistors (where polysilicon crosses over diffusion)".

Normally you don't have diffusion beneath the polysilicon if the structure is to act as a transistor:
MOSFET_functioning_body.png
MOSFET_functioning_body.png (8.23 KiB) Viewed 1308 times
(stolen from wikipedia)
The depletion region is due to the gate field, which is what conducts the electrons (if its ON).

Well, this is probably based on how you like to draw it, but a more correct interpretation (from my perspective) would be:
nmos-diffusion.png
Am I right or wrong? At least in my head it makes more sense like this.. :lol:

PS: The 6560 got its last acid bath today and is now completely clean. I will image it quite soon.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Am I right or wrong? At least in my head it makes more sense like this.. :lol:
Yes, you are exactly right. Sorry for the confusion. I've picked up the habit of describing it like that from reading the Carver Mead/Lynn Conway book where they often talk about the polysilicon crossing over the diffusion. In fact they say this on the very first page: "An MOS transistor will be produced on the integrated system chip wherever a polysilicon path crosses a diffusion path", but they then on the second page explain that what is actually happening is as you've described. From memory they then tend to refer to it as polysilicon crossing over diffusion, I guess with the understanding that they've already explained to the reader that it doesn't actually do that in reality.

I did a similar thing on my MOS 6561 VIC website, i.e. describe it as polysilicon crossing diffusion, then putting in brackets immediately afterwards that it doesn't actually do this:

https://sites.google.com/site/mos6561vi ... hot/basics
https://sites.google.com/site/mos6561vic/home/die-shot/basics wrote:A MOS transistor is formed wherever a polysilicon path crosses over a diffusion area (actually, it only appears that the polysilicon passes over a diffusion line; there is never any diffusion under a transistor gate, but rather the diffusion comes up to each side of the gate. Only oxide and the substrate exists under the gate).
From above, when looking down on the die shot, it appears to do this, but in reality the diffusion stops as you've described.
Kakemoms wrote:Well, this is probably based on how you like to draw it
Yeah, I guess I like thinking about it that way, and it certainly saves time when I'm drawing all those polygons. :D
Kakemoms wrote:PS: The 6560 got its last acid bath today and is now completely clean. I will image it quite soon.
Really looking forward to seeing this.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

This evening I'm going to take a look at one of the clock generation sections of the die shot. This follows on nicely from the use of both the MEM CLK and F2 clocks mentioned in my post on the cell index section. Let's look at an image that shows highlighted with pink boxes where this section lives:
clock_generation_highlighted.jpg
The box on the left is the bit that generates the F1 and F2 clock signals. This box is immediately beside the bonding pads for the phase 1 and phase 2 outputs, i.e. the pads that are connected to pins 35 and 36. It also provides the same F1 and F2 clock signals to most parts of the internal logic of the chip. Many of the diagrams I have posted previously have had both F1 and F2 labels on them.

The box on the right is the bit that generates the MEM CLK signal, and part of it is what drives the Memory Clock bonding pad intended for the option pin 37 for the 6561-001, which I doubt actually exists these days (maybe Commodore themselves had a few samples, but who knows where those might be now). Despite it being connected to an unused bonding pad, the signal is also used internally for a few things, which as we saw in my post on the cell index includes the logic used to determine when to load that cell index value.

Below is my logisim diagram for the areas within these two pink boxes:
clock_generation_logisim.png
You will need to click on that image to see the detail. So on the right near the middle, we have the phase 1 input signal coming in. This input comes from pin 39 of the 6561, so is a roughly 4.43 MHz input clock. It then enters what is a pretty standard circuit for generating a two phase non-overlapping clock. The outputs are those two horizontal lines that nearly go the whole way across the middle of the image. They are used by a number of pass transistors in the centre of the image.

Below the phase 1 4.43 MHz input clock we can see an output that I haven't yet labelled. This is mainly because I haven't had a close look to see where it goes. From simulating it in logisim, it appears to be the inverse of that phase 1 4.43 MHz clock.

An interesting observation I'd like to make at this point is that the phase 2 4.43 MHz clock bonding pad doesn't appear to be connected to anything in the die shot. I found this quite surprising and suspect that there is something more to it that I haven't picked up on yet. But having observed this, I tried using a 6561 on a breadboard without the phase 2 input connected. The outcome was quite unexpected. The output clocks (both pins) appeared normal for the first 10 seconds or so, but only for those first 10 seconds. After that one of the pins went flat. I'll have to repeat this exercise because I'm struggling to remember how it looked now. I'll see if I can post an image from my Picoscope.

Still not sure why the two output clocks didn't continue to look normal, because if we look at the logisim diagram above, it is only the phase 1 input clock that is used to generate both the phase 1 and phase 2 output clocks. I started wondering whether the 6561-101 chip that I was using is different internally from the 6561E that the die shot is of. This made me think that perhaps it is worthwhile getting a 6561-101 decapped and images taken. I certainly have a spare one of those I could donate to the cause.

Back to the logisim diagram, in the middle we have some logic that generates both a 2.2 MHz signal (i.e. the input divided by 2) and a 1.1 MHz signal (divided by 2 again). The 2.2 MHz signal enters another two-phase non-overlapping clock generator, but only one of the outputs of that is actually used.

The 1.1 MHz signal enters another two-phase non-overlapping clock generator on the left, which takes that 1.1 MHz signal and generates the F1 and F2 output signals.

The other part to note is the use of the EXT RESET (i.e. external reset). This comes from one of the option pins, which isn't used in the 6561-101 and 6561E, so doesn't affect anything in the VIC 20. If someone had a 6561-201 or 6560-201, then these clocks would stop when the external reset is happening.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

Ok. I have taken the pictures and they look ok except for some dust/remaining polymer. If its dust, then I wasn't able to remove it with ultrasonic bath, wich means its permanently stuck to the surface.

I will stitch the pictures together and try to find a way to put it out here (its extremely large). Here is a sample:
MOS6560R0_X1Y1.jpg
Originally 16.4MB (it usually shrinks when put here).

As you can see its a revision 0 chip.. Wonder what the original 6560 was called then..
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Ok. I have taken the pictures and they look ok except for some dust/remaining polymer. If its dust, then I wasn't able to remove it with ultrasonic bath, wich means its permanently stuck to the surface.
Yeah, it seems like there is a coating of something still over the whole surface, even in the cleaner parts. I can recognise a lot of the same structures from the 6561, but it is virtually impossible to recognise the transistors. I wonder what they did to get the surface looking so clear with the 6561E die shot? I don't know much about the process they go through.
Kakemoms wrote:I will stitch the pictures together and try to find a way to put it out here (its extremely large).
That would be great. Even like this, it will be possible to spot where the differences are, which will be interesting. I'm happy to see that the part of the die that is scratched in the 6561 image is intact in your image. So that might help me to verify some of the assumptions I made about what was under that big scratch in the 6561.
User avatar
pixel
Vic 20 Scientist
Posts: 1329
Joined: Fri Feb 28, 2014 3:56 am
Website: http://hugbox.org/
Location: Berlin, Germany
Occupation: Pan–galactic shaman

Re: 6561 Die Shot Reversing Explorations

Post by pixel »

lance.ewing wrote:I can recognise a lot of the same structures from the 6561, but it is virtually impossible to recognise the transistors. I wonder what they did to get the surface looking so clear with the 6561E die shot? I don't know much about the process they go through.
Perhaps they took an infrared image or something like that? Just my two cents. Am deeply impressed.
A man without talent or ambition is most easily pleased. Others set his path and he is content.
https://github.com/SvenMichaelKlose
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

lance.ewing wrote: Yeah, it seems like there is a coating of something still over the whole surface, even in the cleaner parts. I can recognise a lot of the same structures from the 6561, but it is virtually impossible to recognise the transistors. I wonder what they did to get the surface looking so clear with the 6561E die shot? I don't know much about the process they go through.

That would be great. Even like this, it will be possible to spot where the differences are, which will be interesting. I'm happy to see that the part of the die that is scratched in the 6561 image is intact in your image. So that might help me to verify some of the assumptions I made about what was under that big scratch in the 6561.
I used a nitric acid+sulphuric acid mix at 120C which prevents the removal of metal. The 6561 pictures had been taken with an optical microscope, while these are imaged with an electron microscope. I could try to take some optical pictures to get "through" the insulation/passivation that covers most of the chip. Its usually just glass on old ICs, so its possible to see through it (but not the metal lines).

If I need to remove metal to make a composite picture, then that can be done with chemicals.
Post Reply