6561 Die Shot Reversing Explorations

Modding and Technical Issues

Moderator: Moderators

User avatar
Mike
Herr VC
Posts: 3017
Joined: Wed Dec 01, 2004 1:57 pm
Location: Munich, Germany
Occupation: electrical engineer

Re: 6561 Die Shot Reversing Explorations

Postby Mike » Fri Nov 03, 2017 11:46 am

Kakemoms wrote:I can't remember if its possible to change a character halfway through it, e.g. changing the color byte. Obviously the Character RAM won't be fetched twice as there is no time for it, but the color RAM could. Anyone knows (or has experimented) around this?

tokra wrote:I have experimented with this and don't think it is possible to change a colour-RAM-location mid-character. At least in my experiments I was unable to achieve that result.

During the two relevant half-cycles (screen fetch and character data fetch) VIC-I addresses the colour RAM "in parallel" to the screen RAM by letting them share the lower 10 address bits. During character data fetch an essential random address for the colour RAM is put on the VA bus. There would be no way to ensure a sensible data value from colour RAM, so any 'half-byte colouring' is ruled out by what happens on the busses.

VIC-I does re-read the colour RAM info in each raster though, and that is what's put to use in tokra's and mine FLI modes, pioneered much earlier by Imagic in Dragonfire, and making a reappearance in VICtragic's implementation of Pitfall!. :D

eslapion
ultimate expander
Posts: 4331
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Postby eslapion » Fri Nov 03, 2017 11:52 am

tokra wrote:I have experimented with this and don't think it is possible to change a colour-RAM-location mid-character. At least in my experiments I was unable to achieve that result.

Vertically, yes, horizontally, no.

Added edit:
I just noticed Mike's post which says the same thing with more details.
No one can do everything. Everyone can do something.

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Fri Nov 03, 2017 2:37 pm

Mike wrote:During the two relevant half-cycles (screen fetch and character data fetch) VIC-I addresses the colour RAM "in parallel" to the screen RAM by letting them share the lower 10 address bits. During character data fetch an essential random address for the colour RAM is put on the VA bus. There would be no way to ensure a sensible data value from colour RAM, so any 'half-byte colouring' is ruled out by what happens on the busses.

Yeah, I'd certainly agree with that in the case of the colour RAM.

What if we extended Kakemoms question to the other three colours? They all come from control registers. Has anyone tried changing those mid character? I'm guessing someone has. In the die shot, they look like they're read from the control registers on every pixel. Obviously that is happening 4 times as fast as what you could write to the control register though.

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Fri Nov 03, 2017 3:38 pm

lance.ewing wrote:What is interesting is what the diagram shows for the equalization pulse lines. The shape of the output is basically the reverse of that for the vertical sync area. It is highly likely then that the vertical pulse latch output controls both of these. What I'm assuming now is that somewhere else on the chip, probably nearby, it puts this all together, and inverts the vertical sync pulses for the area of the vertical blanking that is not within the vertical sync area.

I have now located and reversed the logic hinted at above, where the vertical blank, vertical sync, and the vertical sync pulse signals are used together to generate the equalization pulses and vertical sync pulses.

combined_sync_logisim.png
combined_sync_logisim.png (4.83 KiB) Viewed 227 times

The HSYNC is the horizontal sync signal coming out of the X decoder, the VBLANK is the vertical blanking signal coming out of the Y decoder, the VBLANKPULSE is the signal coming out of what I previously called the vsync pulse latch, and VSYNC is the vertical sync signal coming out of the Y decoder. The SYNC is the combined sync signal that heads off to the luminance/sync generating part of the die shot.

The VBLANKPULSE signal I decided to rename since I was originally calling it the VSYNCPULSE signal. It actually controls the pulses throughout the whole of the vertical blanking, not just when VSYNC is ON, so this new name seemed more appropriate.

Looking up at the diagram, is we start with HSYNC at the top, we can see that if this turns ON, then the SYNC output will turn on, but only if VBLANK is not ON. Obviously it doesn't want to generate horizontal sync pulses during vertical blanking.

Next we come down to VBLANK and VBLANKPULSE. These work together so that when vertical blanking is active, the VBLANKPULSE level will directly control the SYNC output and SYNC will follow the same level as VBLANKPULSE. This is assuming VSYNC is OFF. When VSYNC is ON, then the SYNC output will be the inverse of VBLANKPULSE. So this is how it generates the equalisation pulses and vertical sync pulses, the latter being the inverse of the former.

User avatar
Mike
Herr VC
Posts: 3017
Joined: Wed Dec 01, 2004 1:57 pm
Location: Munich, Germany
Occupation: electrical engineer

Re: 6561 Die Shot Reversing Explorations

Postby Mike » Sat Nov 04, 2017 1:04 am

lance.ewing wrote:What if we extended Kakemoms question to the other three colours? They all come from control registers. Has anyone tried changing those mid character? I'm guessing someone has.

Has been done, yes, and works ...

In the die shot, they look like they're read from the control registers on every pixel. Obviously that is happening 4 times as fast as what you could write to the control register though.

... except changes to the colour registers take effect on the output 1 hires pixel late with respect to char- and half-char boundaries (and a change to the reverse bit in $900F takes effect 3 hires pixels late). A multi-colour pixel is split in half and shows both colours (before and after change).

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Fri Nov 10, 2017 5:10 pm

If we look back at the list of 13 values that were matched by the X decoder, we still haven't explored what the 0, 35, and 70 values are used for. To properly determine this, I will need to reverse both the vertical and horizontal counters, and a section of logic that sits between the two. I decided to begin with the vertical counter and that is what has been keeping me busy over the past week. The following diagram shows where the vertical counter is on the die shot. It is highlighted with a pink box, shown below where I had previously highlighted the Y decoder in yellow:

vertical_counter_highlighted.jpg

The following is the diagram I created and simulated in logisim for it after reversing the various logic gates and pass transistors:

vertical_counter_logisim_3.png

You will have to click on it to get a good look. I had to create my own custom "Pass Transistor" component within logisim to simulate a pass transistor in the way in which it is used within this counter. Pass Transistors are quite often used to temporarily isolate a charge on the inputs of a logic gate, i.e. the pass transistor turns on, the logic level that is being let through the pass transistor builds up on the inputs of the logic gate and then the pass transistor turns off. The logic gate still retains those input levels for a while and therefore the output of the logic gate remains as it was when the pass transistor was on. This is a simple but temporary form of memory and usually the pass transistor is controlled by a clock signal so that the input level is regularly applied (this is discussed in the section entitled "Implementing Dynamic Registers" in chapter 3 of the Mead and Conway book). Trying to simulate this behaviour with the transistor that comes by default with logisim wasn't possible, which is why I created my own custom logisim transistor with internal memory of what was on its output when it was on. It seems to do the job for the purposes of this simulation.

There are a number of interesting things to observe about the vertical counter. We can see that it appears to have 10 bits, which is what I had previously assumed when looking at what was entering the Y decoder. We can see that after every four bits there is a 4-input NOR gate that acts as a carry in to the next set of bits. At first glance, the first bit (on the left) does look like it was meant to be part of the first set of 4 bits. But if you take a closer look, you'll notice that it doesn't actually link through to the second bit and it takes a different input, an input that goes low whenever the X counter value is 0 or 35. So it would seem that this bit toggles it's 1-bit value at X=0 and X=35. I can imagine that if this bit had been wired up to the other bits in the vertical counter then the overall counter would basically be counting half lines. That is why I've put the labels 1/2 LINE and 1/2 LINE' as the two outputs out of this first bit. But since it isn't connected, it doesn't actually form a part of the vertical counter. Instead it would seem that this first bit was intended to be part of the interlaced feature. As already noted in an earlier post about the Y decoder, the outputs of this lowest bit of what was being called the vertical counter at the time of that post didn't have any use within the Y decoder and was completely ignored. But I would guess that if the 6561 had been wired up for the interlaced feature, then it would have involved the output of this bit that toggles on X=0 and X=35. As it is though, this first bit in the logisim diagram is completely redundant within the 6561. It would be very interesting to look at this within the 6560.

If we now ignore that first bit and look at the other 9-bits as being the vertical counter, we see that there is an input at the bottom left that I have labelled X=0. It is the input to the vertical counter that makes it increment by 1. This line goes high whenever X=0, i.e. whenever the horizontal counter has counted up to 70 and then resets back to 0. Makes sense. We also have an input on the left called RESET. This will make each of the bits go back to 0. Since each bit of the vertical counter alternates the logic gate combination used to implement that bit of the counter (2 NANDs and an OR in some, 2 NORs and an AND in others), it means that the point at which the RESET signal connects to each bit of the counter needs to sometimes pull the value down and sometimes pull it up, depending on the design used for that bit. This part of the logisim diagram is going to be a bit confusing because I had to add a couple of extra inputs to my customer "pass transistor" component to support clearing and presetting the internal memory I talked about earlier on in this post, and connection space around this custom component was at a bit of a premium, so I basically just added them where I could. I was more concerned with getting the simulation working. What the reset actually does in the die shot is to form another transistor (not shown in the diagram) for each of the bits that either pulls down to VSS or pulls up to VDD. I might produce another diagram at some point that shows this.

The F1 and F2 inputs are the phase 1 and phase 2 clock signals. I simulated the F2 as the inverse of F1 so that I could simply click on the F1 input to toggle both for the purposes of the simulation. The end result is that this logisim simulation does in fact count every time the X=0 input goes high, assuming you also toggle the clock inputs a couple of times. The outputs along the top are 20 of the 22 inputs in to the Y decoder.

We now know at least some of the uses of the X=0 and X=35 outputs of the X decoder. The X=0 output is quite important, but the X=35 is probably completely redundant. It is used in one other place, which we're going to look at next. And in the process we'll also see what triggers the vertical counter RESET.

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Wed Nov 15, 2017 5:29 pm

lance.ewing wrote:...the X=35 is probably completely redundant. It is used in one other place, which we're going to look at next. And in the process we'll also see what triggers the vertical counter RESET.

...but not quite yet. I still haven't completely worked out what is going on in the vertical counter reset logic. What I have so far isn't making sense compared with what I think I know about how it should work. So I'll let that one simmer for a while while I look at other areas nearby, the first of those being the horizontal counter.

Over the weekend, I traced around the biggest bit of diffusion I have traced around to date. The completed polygon path has 1230 nodes. Not certain exactly how long I was clicking away in Inkscape for that one, but it must have been over an hour, maybe close to two. That was all part of reversing the horizontal counter, which happened to be connected to a rather large bit of diffusion that was involved in various other non-related things. Diffusion areas connected to VSS or VDD quite often end up being connected to many different logic gates and therefore the polygons get quite large when tracing them.

The horizontal counter is located in the area of the die shot shown highlighted below with the light blue (I will at some point produce a black and white labelled functional block diagram):

horiz_cnt_reset_lp_logic_highlighted.jpg

You will notice that I highlighted an additional three areas in this diagram. I thought I would include them since I've already worked out what they do. The red is the horizontal counter reset logic, the purple the vertical counter reset logic, and the darker green the logic for controlling when to latch the light pen latches. The topic of this post is the horizontal counter though. The logisim diagram below is the end result of reversing the horizontal counter:

horizontal_counter_actual_logisim.png

No surprises that it looks very similar to the vertical counter. The logic gate design for the individual bits is exactly the same as for the vertical counter, and I wouldn't be surprised that the same design will be used for the other counters when I eventually locate them. The horizontal counter is a bit simpler than the vertical counter. It has only the 8 bits, and there isn't a separate input to trigger the increment by one. Instead this is triggered simply by clocking the circuit with the phase 1 and phase 2 clock signals. The version of the logisim diagram above is as the circuit actually is on the die shot. So for the reset input, it shows the transistors that either pull up or pull down for each bit when the reset goes high. The diagram in my previous post of the vertical counter didn't show these transistors because as I mentioned in that post, I had to create a custom component to simulate the behaviour of that reset line. I did the same thing for the horizontal counter, and confirmed that it counts up through the bits as I toggle the F1 clock input, but I also produced a version that shows the actual circuit with the reset pull up and pull down transistors, which is what I'm showing above.

The outputs at the top of the diagram are obviously what goes on as inputs in to the X decoder. They also go up to the horizontal light pen latch and to a comparator that compares the counter value with the screen origin X value.

Although not shown in this diagram (since it is part of the horizontal reset logic), I can tell you that the reset goes high when either the value 70 is matched by the X decoder, or when the external reset pin is used. The external reset pin is one of the three options that the 6561 had. Obviously in the VIC 20 the option used is the light pen input, but the die shot still has the bonding pads for the other two options, and all the logic for implementing those options. The "option" is basically just choosing what bonding pad to connect the pin to. But given that in the VIC 20 the 6561 doesn't support the external reset, then the only time that the horizontal counter resets is when it gets to 70. So now we know what that 70 output from the X decoder controls, which probably isn't a surprise to anyone.

No idea why this is an 8-bit counter when all it needs is seven bits (...unless their design was putting things in place for the 6562/3?). The 8th bit seems completely redundant for the 6561. It is present, and it goes as an input to the X decoder, but is basically ignored by the X decoder since there are no horizontal counter values above 70. The 8th bit does not go anywhere else, i.e. it is not latched by the light pen latch and it is not used by the comparator that compares the horizontal counter with the screen origin X value in CR0.

It is worth noting that those F1 (phase 1) and F2 (phase 2) inputs are at the frequency of the 6561's output clock pins and that this counter counts up with each cycle of that clock, i.e. the same as what drives the rest of the VIC 20.

One other thing to mention is that pull down at the left end of the F1 and F2 lines. It seems that when F2 is high, this transistor pulls down the F1 line, which is kind of interesting. They're already meant to be non-overlapping signals, so not sure why that is needed. I did notice, however, that a capacitor is connected to the pass transistor that controls F1's access through to the F1 line shown in the diagram. When F2 is high, this capacitor appears to get charged (as long as horizontal reset is not high), then when F2 goes low, this capacitor keeps the pass transistor active for a while to let F1 through. I don't understand the reason for this, but I'm sure it must be important to the design of the chip. I'm thinking mainly at a logical level, so that's why I've simplified the diagram to show simply F1 as an input.

norm8332
Vic 20 Enthusiast
Posts: 164
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Postby norm8332 » Thu Nov 16, 2017 8:45 pm

I'm still following this intently...I got that low price PC microscope I mentioned earlier and although I think it was well worth the price, it just doesn't have the zoom and clarity for getting anything useful out of chips. I guess the 6560 will have to wait. See the pics for an example of a couple of EPROMs from the era. That was looking through the quartz window, It would be slightly clearer and the focus more uniform (instead of just the center) with the bare chip, but not good enough I'm afraid.
Attachments
vlcsnap-2017-11-13-21h24m49s391.png
vlcsnap-2017-11-13-22h34m59s063.png

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Sun Nov 19, 2017 9:15 am

norm8332 wrote:It would be slightly clearer and the focus more uniform (instead of just the center) with the bare chip, but not good enough I'm afraid.

Oh well, that's a shame. If you're interested, I noticed today that John McMaster had some thoughts below on what to look for when getting a microscope for this kind of work:

https://siliconpr0n.org/wiki/doku.php?i ... cope:start

I'm tempted but I think I will leave it to the experts. John McMaster tweeted today that he does take on work for other people and his commissioning policy is here:

https://siliconpr0n.org/archive/doku.ph ... missioning

I'm even more tempted to go down that route for the 6560. He has a big backlog already, but the wait would hopefully be worth it. The end result by someone that has done many chips should be just what we want. I don't think we need the delaying work done since the 6561 didn't have that done, and it seems to still be possible to see everything even with the metal layer still on top. I haven't yet come across a part of the chip that has been impossible to reverse as a result of it not being delayered. The only part of the die shot that is very hard to reverse are the bits that are damaged, like that big scar right through the light pen latching logic and horizontal reset logic. I haven't fully reversed those bits because of this, and in the end I think it is going to be a bit of guesswork based on what it most likely would have been. A shame the scar wasn't a bit further up, i.e. right through the horizontal counter, because that repeats layout patterns and therefore it would be easy to work out what was in the damaged parts.

User avatar
Kakemoms
Vic 20 Afficionado
Posts: 488
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Postby Kakemoms » Sun Nov 19, 2017 2:43 pm

Hmm.. We have a microscope in the lab with good optics. Only thing is that I don't have a spare 6560 to strip.

norm8332
Vic 20 Enthusiast
Posts: 164
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Postby norm8332 » Sun Nov 19, 2017 6:19 pm

Kakemoms wrote:Hmm.. We have a microscope in the lab with good optics. Only thing is that I don't have a spare 6560 to strip.


One of the issues it that the chip has to be de-layered as well. Most of the circuitry is obscured by a top metal layer.. After reading up on it from the provided link above, I dont want to mess with the chemicals etc...Decapping with rosin is one thing, nitric acid is another.

norm8332
Vic 20 Enthusiast
Posts: 164
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Postby norm8332 » Sun Nov 19, 2017 6:19 pm

norm8332 wrote:
Kakemoms wrote:Hmm.. We have a microscope in the lab with good optics. Only thing is that I don't have a spare 6560 to strip.


One of the issues it that the chip has to be de-layered as well. Most of the circuitry is obscured by a top metal layer.. After reading up on it from the provided link above, I dont want to mess with the chemicals etc...Decapping with rosin is one thing, nitric acid is another.

User avatar
lance.ewing
Vic 20 Devotee
Posts: 264
Joined: Sat Nov 10, 2012 3:19 pm

Re: 6561 Die Shot Reversing Explorations

Postby lance.ewing » Mon Nov 20, 2017 4:47 am

Kakemoms wrote:Hmm.. We have a microscope in the lab with good optics. Only thing is that I don't have a spare 6560 to strip.

@Kakemoms, regarding what @norm8332 said about the difficulty of decapping, do you think you'd be geared up to be able to do the decapping as well (assuming I could source a 6560 for you)?

User avatar
Kakemoms
Vic 20 Afficionado
Posts: 488
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Postby Kakemoms » Mon Nov 20, 2017 6:30 am

lance.ewing wrote:
Kakemoms wrote:Hmm.. We have a microscope in the lab with good optics. Only thing is that I don't have a spare 6560 to strip.

@Kakemoms, regarding what @norm8332 said about the difficulty of decapping, do you think you'd be geared up to be able to do the decapping as well (assuming I could source a 6560 for you)?


Shouldn't be a problem. I work with boiling nitric acid in the lab regularly, and we have standard fume hoods and lab ware. I may find myself in a changed job situation after Xmas, so you should be quick if you want me to try.

norm8332
Vic 20 Enthusiast
Posts: 164
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Postby norm8332 » Mon Nov 20, 2017 8:06 am

I also have a non-working 6560 I could part with if that would work.


Return to “Hardware and Tech”

Who is online

Users browsing this forum: No registered users and 2 guests