6561 Die Shot Reversing Explorations

[Mike]

were you able to prove that when you read the POT values outside of the text window, that the jitter was not present?

For the big spikes, their duty time is more or less exactly the same time no DMA is done. If they were coupled to the VBLANK period, they'd only be half as wide. If I find time next week, I can re-check on real h/w that these spikes exactly correspond to the non-DMA time.

Here we go:

A sample output of Paddlescope on POTY: You can clearly see the downward spikes/glitches, which are roughly one character wide. The gap in the middle of the screen comes from the update cycle. Some other noise that's also present has a peak-peak value of around 4..6 pixels, but those spikes "jump" by roughly 16 pixels, or even more!



To see the coupling of those spikes with the screen DMA, I typed in a small program into the monitor:



The program shifts the paddle value by 5 bits to the right, ORs in #$18 (white background, non-inverted) and writes the result into the border/background colour register. It's quite easy to find paddle positions, where the border colour differs between DMA and non-DMA parts of the screen:



As you found out, the paddle value is indeed latched on each 8th raster. The first text line has the "non-DMA value" because its "measurement" took place while the DMA was off. Same applies to the 8 rasters below the text window, where the "DMA value" is readable in POT% for 8 rasters after screen DMA end.

Finally, cross-check with a shortened text screen:



My proposition holds - with two results:

1. There are extra glitches most promiment on POTY, that are definitely coupled to the non-DMA ./. DMA time of screen display.

2. (not shown:) The "minor" noise on POTX has roughly *twice* the peak-peak value compared to POTY, but doesn't show those glitches as prominently. That corresponds well with the geometry/length of the BIAS interconnect!

Greetings,

Michael

P.S. sorry for the fuzzy photos. This time I only had my mobile phone handy.

[lance.ewing]

The program shifts the paddle value by 5 bits to the right, ORs in #$18 (white background, non-inverted) and writes the result into the border/background colour register. It's quite easy to find paddle positions, where the border colour differs between DMA and non-DMA parts of the screen:

This is quite interesting, and the output of that program makes it really clear that there is something going on during the DMA. We'll have to try to work out where that is happening. So what we're looking for is something that would make the counter-to-register load/latch trigger happen too early I guess, and that something has to be related to the DMA.

I wonder what is happening on the POTY pin while this is going on. I guess we have to assume (I mean the whole thing is based on this assumption) that it would be hitting, let's say, 2.5V at the same time after the discharge regardless of what part of the screen is being rendered. Surely that has to be consistent. Just wondering if there is any external influence in relation to the DMA.

As you found out, the paddle value is indeed latched on each 8th raster. The first text line has the "non-DMA value" because its "measurement" took place while the DMA was off. Same applies to the 8 rasters below the text window, where the "DMA value" is readable in POT% for 8 rasters after screen DMA end.

It is great to see that validated so visually.

My proposition holds - with two results:

1. There are extra glitches most promiment on POTY, that are definitely coupled to the non-DMA ./. DMA time of screen display.

Agreed.

2. (not shown:) The "minor" noise on POTX has roughly *twice* the peak-peak value compared to POTY, but doesn't show those glitches as prominently. That corresponds well with the geometry/length of the BIAS interconnect!

I guess that this minor noise is not related to any specific activity happening within the 6561, but to general noise. Or could it be from something happening close to that BIAS interconnect?

[Mike]

My proposition holds - with two results:

1. There are extra glitches most promiment on POTY, that are definitely coupled to the non-DMA ./. DMA time of screen display.

Agreed.

There comes an extra twist: I arranged the display of Paddlescope, so that higher values in the POT registers also actually show up with a "higher" position on screen (not lower as would be the case with a left-handed graphic co-ordinate system with the origin in the top-left corner).

That means, the downward glitches of the non-DMA parts of the screen on *my* VIC-20 have *negative* polarity.

Now for the funny part: the same glitches on tokra's VIC-20 show *positive* polarity (see here) and they're also there (with +ve polarity) on POTX.

I guess that this minor noise is not related to any specific activity happening within the 6561, but to general noise. Or could it be from something happening close to that BIAS interconnect?

I'd think the doubled length of the BIAS interconnect until it reaches common FETs of the POTX differential amplifiers is in a good part responsible for the doubled noise amplitude.

Whatever couples in the big glitches must be something else - but, as I wrote - it must be a switched signal that changes between the non-DMA ./. DMA portions of the screen in near vicinity to the comparators. And, whatever you find also needs to take into account the possibility of a different polarity of those glitches. Up to the point, that a few selected VICs won't show these glitches at all - as it's nearly the case with POTX on my VIC-20.

...

What we now need is a more profound statistic of the polarity of these glitches, and more people actually posting their results when they try out Paddlescope. And not just download it with no response at all.

[lance.ewing]

The main thing I wanted to draw your attention to in the above image though are the contacts I have labelled 1, 2, 3 and 4. I have assumed that they are redundant and have no purpose, but this seems a little strange to me. Why should they be there if they are redundant? The reason I assume they are redundant is because they connect circuit points to metal and then that metal goes nowhere. It is just a small rectangle of metal in each case that has no other connection to it. I'm not really sure what purpose this would serve. We don't see this type of thing in the digital parts of the circuit, but perhaps it serves a purpose in these analog parts of the circuit. Any thoughts on what that might be?

I have been discussing these POT comparator parts of the die shot with Segher Boessenkool, who has quite a bit of experience of working out the behaviour and logic of various Commodore chips. Here is what he had to say about these seemingly redundant metal squares:

The metal "islands" are probe points. It is helpful to note them on your schematics: if they were useful to measure, they probably are interesting
points

Let's call them NW, NW2, NE, SE, C for the northernmost north-west one, the other NW one, etc. (C is centre; SE is some other circuit).

NE is "ref", which is 2.5V, made via a chain of two equal diode-connected FETs.

(The "ref" and "bias" caps are the same size afaics; the area that matters is where there are two plates opposite, i.e. where the poly overlaps the
diff. The actual values are highly variable, just like with resistors, but a) often it does not matter much for caps, and b) when it does, it is ratios that matter).

NW2 is about 2.2V, made with a diode chain where the bottom FET has about 1.5 wider gate.

The other two chains are set up as a current mirror. One chain has NW, "bias", as the midpoint; the other chain has two pulldowns in series, the first gate by ref, the other by bias; between those two is testpoint C.

Looks like a Wilson current mirror.

Regarding his thoughts on what might be causing the paddle jitter, he said this:

It is comparing the voltage of the pot cap to the reference voltage. One of those isn't stable (and yup, that is likely caused by crosstalk).

Or, this may be caused by the body effect. The diode chain is famously affected by that, and we are close to the A0 drivers here, which may explain why it happens mostly while the VIC is doing memory accesses.

This second suggestion is in reference to the "chain of two equal diode-connected FETs" that provide the 2.5V reference voltage. I had thought that such a set up would be stable, but I didn't realise that the diode chain is infamously affected by the body effect. To be honest, I was struggling to find something within the vicinity of the POT comparators that had some connection to the DMA. That area is mostly surrounded by the sound circuitry. The A0 drivers might actually be the closest thing related to DMA, but I thought even that looked to be too far away. I don't really know much about the body effect though.

I guess we'll probably never know for certain what is causing the jitter.

[Kakemoms]

I have been trying to find a wafer of 6560 or 6561 chips. Haven't had much luck with that yet, but I managed to buy a 6569 wafer:

The 6560/6561 would have been produced on the same type of wafers. The VIC-II is fairly large at about 5.8mm (almost square) with around 200 chips per wafer. 5 smaller test chips can also be seen. The wafer is 4 inc in diameter.

[Kakemoms]

Well, I have located a wafer of 6561, but its very expensive. I don’t know how much such a wafer should be worth either, so its basically not a sound investment..

Anyway, I’m trying to get more information from the seller as for revision, wafer size and so on..

[lance.ewing]

How expensive is very expensive? Where would the seller have got this from?

[Kakemoms]

Bad news, it wasn’t a 6561 after all.

Its hard to find such old wafers. Most MOS wafers I locate are 4inch and newer. Price varies alot.

[nippur72]

has anyone figured out the internals of the noise generator?

[lance.ewing]

Not completely. I was partway into the sound generation a few years ago but didn't complete it. But its now the largest of the remaining parts of the chip to look at, so it will probably be the next thing I look at.

[nippur72]

great, that would be a great advancement for emulators and FPGA implementations!

It is speculated that noise is generated with a LFSR shift register, presumably similar to that of the VIC-II (which has been reverse engineered). If that is the case, we would like to know:

1) the number of bits of the LFSR
2) which bits are used for the feedback loop
3) which bits are used to generate the output
4) the reset value of the LFSR

The VIC-II in the C64 has a 23 bit shift register, with initial value $7ffff8 and with this feedback formula after shift: bit0 = bit22 xor bit17. The output is an 8-bit value made out of bits n. 22,20,16,13,11,7,4 and 2. But in the 6561 it is more likely that the output is 1-bit only.

If you are able to locate the logic gates on the die shot (which looks like pure wizardry to me), I guess you should be able to see the following elements:

For each of the 4 voices:
- the clock divider (div64, div32, div16, div?)
- the register itself: 7 bit (freq) + 1 bit (on/off)
- the frequency counter (7 bit) incremented by one, counting up to all "1"

For the 3 sound voices only:
- the 8 bit LFSR that generates the square wave. Formula after shift: bit0 = not bit7 and voiceon. Output is bit0.

There is also the mixing circuitry that works according this logic:

IF voice1 is disabled THEN output half volume ELSE output bit0 * full_volume
IF voice2 is disabled THEN output half volume ELSE output bit0 * full_volume
IF voice3 is disabled THEN output half volume ELSE output bit0 * full_volume
IF noise is disabled THEN output previous_noise_value * full_volume ELSE output current_noise_value * full_volume

they are mixed (summed) together and there might be a clipping effect due to the size of the sum circuit as found by @rga24 in this thread.

[lance.ewing]

I already know where the four control registers are, and I'm pretty sure I've just found a 16 bit shift register next to the control register for the noise voice. I'm still reversing the logic at the moment, but it is definitely a shift register, and I can also see a bit of feedback going on. So I think we're looking in the right place. I'll hopefully report back more on this in a day or two.

[lance.ewing]

I thought I'd post an image showing where the sound generating parts of the 6561 are located:

The light blue boxes are the four control registers for the four voices, with CR-C the left most, then CR-B, CR-A and then CR-D (i.e. the noise register) being the right most.

The pink boxes I haven't yet confirmed the exact functions of, but it is clear from their appearance that the four blocks are very similar to each other, so I believe that they would serve a function that is common to each voice. They might be the common parts that nippur72 listed for each voice. I'll leave those bits for investigation at a later time.

The boxes we're mainly interested in at the moment, and that I've been looking at over the past few days, are the red boxes. As you can see, these red boxes are immediately to the right of the noise related "blue" and "pink" boxes. This is the area where the noise LFSR lives. The longer/larger red box in the middle is the 16 bit shift register. The red box at the top, and half of the red box at the bottom, form a 4-input XOR gate where the four inputs are four taps from bits of the shift register.

The output of the feedback XOR gate shifts in to the shift register at the top, which I guess we'll call the first bit. So assuming we call that top bit the first, and the bottom bit the 16th bit, then the tap bits are the 4th, 13th, 15th, and 16th. The output bit is the first bit, and it is a single bit as nippur72 proposed. From what I can see on the die shot, it appears to be exactly as shown by the diagram of a 16 bit maximal length LFSR on the following web site:

http://www.tikalon.com/blog/blog.php?ar ... generators

which I have also included below:

In the 6561 die shot, it actually appears like this, with some kind of enable/disable input added in:

noise_lfsr_feedback_xor.png (4.62 KiB) Viewed 5101 times

(Note: the labels I've used here, e.g. NSR03, stand for Noise Shift Register (NSR) and the numbering begins at 0, as in bit 0, so NSR03 is the 4th bit)

I haven't yet tracked that additional unlabelled input to its origin, but from simulating this, it is clear that when it is in one state, the feedback is ignored, but when it is in the other state, the output of the NAND gate directly reflects the inverse of the feedback.

Movement/shifting within the shift register is controlled by three separate signals. The logic of how those three signals are generated will probably be the topic of my next post. It is unclear to me at the moment how it gets a seed value into the SR. There is certainly something going on with an input of some kind coming from about the middle of the "pink" box, and then F1 and F2 also used. These three inputs are used to produce the three SR controlling signals.

Update: The unlabelled input in the diagram above is the inverse of the 8th bit of the noise control register, i.e. the enable bit of the noise register. So when that bit is set to 0, then the feedback is ignored.

[nippur72]

WOW, this is jaw dropping cool!!!

I might have an explanation for the unlabeled bit in your diagram.

Looking at the pink boxes I think I can see the 8-bit shift register used to generate the square waves (it should be the horizontal thing just above the middle of the box). Well, if that is the case, it means an important thing: such 8-bit LFSR is also present in the noise generator (pink boxes are almost identical to my eyes).

Now my guess is that the output of this 8-bit LFSR goes NAND with the 16-LFSR. This would form a sort of "noisy square wave"? Just my guess, I don't know if that makes sense.

[lance.ewing]

I did start to look at the area inside the pink box for the noise voice a few years ago. That discussion starts with the following post on a separate thread:

http://sleepingelephant.com/ipw-web/bul ... 561#p88380

When I wrote the posts on that thread, I hadn't at that point reversed any other counters on the 6561, but in the current "6561 Die Shot Reversing Explorations" thread, I've been working my way through 6 or 7 different counters, including the horizontal counter, vertical counter, cell depth counter, etc. So looking back at the earlier thread linked to above, I now recognise that the diagram of the "thing" I was reversing towards the end of that thread is indeed a 7 bit counter as tlr suggested in one of the last posts to that thread:

http://sleepingelephant.com/ipw-web/bul ... 210#p88873

I'm going to look over that section of the die shot again to confirm this, but at the moment I think we can say that part of the bottom half of the pink box is the 7 bit counter.