6522 VIA Die Shot Reversing Explorations

[lance.ewing]

In the case of the 6522, we're fortunate to have access to two die shots, one with the metal layer still on, and one with the metal removed. Makes it a lot easier. And it will be purely digital.

I have decided to create a topic to talk about reversing the 6522. Not sure how much time I'll dedicate to it, but the temptation was too much to avoid having a look. In the quote above from another topic, I mentioned that we have access to two die shots for the 6522. I thought I would begin this topic by presenting the information that is already available on the Internet with regards to the 6522. When people think of die shots, they probably think firstly of the visual6502.org website, which does indeed have a page for the 6522:

http://www.visual6502.org/images/pages/MOS_6522.html

I think it would be possible to reverse the 6522 schematic from that diagram, but it would be hard going. Unlike the 6561, the diffusion and polysilicon are not so different from each other when under the metal. But luckily for us, there is another dieshot available that has the metal layer removed, and with this one it is very easy to see the difference between the polysilicon and diffusion:

http://siliconpr0n.org/map/mos/6522/dly ... y=3948&z=1

https://sourceforge.net/p/pr0ntrace/cod ... /6522/img/

The dlyr1.jpg image is very clear, and as I said, the polysilicon and diffusion (aka. "active") is easy to see:

https://siliconpr0n.org/wiki/doku.php?id=fet#mos_6522

But without the metal layer, it is impossible to see how things are connected up. So the original image with the metal layer is still very important.

As with most things, we stand on the shoulders of giants. John McMaster has produced an SVG image of the complete metal layer of the 6522:

https://github.com/JohnDMcMaster/pr0nto ... _rects.svg

And he did start to trace around the polysilicon as well, but appears to have abandoned it before he got far into it.

My approach to beginning a reversing exploration into the 6522 die shot is to use the dlyr1.jpg image (i.e. without the metal layer) with John McMaster's 6522_rect.svg file (metal layer) transparently superimposed on top. I have done this by loading both images into Inkscape as separate layers. The transparency of the SVG metal layer is such that it can be seen but doesn't obscure the detail of the dlyr1.jpg image (diffusion and poly). The end result is very easy to work with:

We can see that not only is the diffusion a plain light orange, and the polysilicon a speckled yellow, but the black border around the diffusion is much thicker than the black border around the polysilicon.

An NMOS chip like the 6522 only has those three layers, i.e. metal, polysilicon and diffusion, so once you're able to recognise those, it becomes a matter of identifying what all of those contacts are. The circles will be either metal to diffusion contacts, or metal to polysilicon contacts. The buried contacts (between polysilicon and diffusion) are surrounded by a rectangular "shadow". We then need to know which of these contacts are VSS (GND), which are VDD (+5V), which are clock signals (PHI1 and PHI2), and which are inputs to or outputs from a logic gate (and we need to know how to identify a logic gate).

[lance.ewing]

When starting out with reversing a die shot, the first step is to identify what pins each of the bonding pads were connected to. The easiest bonding pads to identify are VDD and VSS. When viewing the metal layer, VSS/GND is connected to the metal around the edge of the chip. Looking at the 6522 die shot, there is unsurprisingly only one bonding pad that is connected to the metal on the edge of the chip and that will be VSS:

The two power lines VDD/+5V and VSS/GND are both quite thick metal lines that go around the edges of the core part of the chip. If a bonding pad connects to a thick metal line that isn't connected to the VSS bonding pad that we've already identified, then that bonding pad is almost certainly for VDD. So if we look at the 6522 die shot, there is another bonding pad pretty much directly opposite the VSS bonding pad that is connected to a thick metal line that surrounds most of the chip. This is the VDD/+5V (pin 20) bonding pad.

Having identified VSS and VDD, it is now trivial to identify the rest of the bonding pads. Going around the chip in clockwise order, they follow the same order as the pins on the 6522 chip (because it doesn't make much sense for the bonding wires to cross over each other).

6522_pins.png (58.71 KiB) Viewed 3452 times

If we now put the labels onto each of the bonding pads using the same order as the chip pinout, then we arrive at the following:

(I've decided to label RS0 to RS3 as A0 to A3 instead)

[fhw72]

In order to dig a little deeper into the 6522R0 die I've realigned both layers:

https://is.gd/tUuv2B

[fhw72]

Some progress....

[fhw72]

Just for fun:

https://cdn.knightlab.com/libs/juxtapos ... a7ff2ee17c