6561 Die Shot Reversing Explorations

Modding and Technical Issues

Moderator: Moderators

norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

Looks very cool so far. Optical would definitely show more since like you said, there is some transparency.
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:The 6561 pictures had been taken with an optical microscope, while these are imaged with an electron microscope. I could try to take some optical pictures to get "through" the insulation/passivation that covers most of the chip. Its usually just glass on old ICs, so its possible to see through it (but not the metal lines).
Would certainly be worth trying optical. In the 6561 image, the detail can still be seen under the metal, but its much less clear.
Kakemoms wrote:If I need to remove metal to make a composite picture, then that can be done with chemicals.
Probably not strictly required, but would certainly be nice. In most cases I can make out what is under the metal in the 6561 images, but not having the metal there in a set of images would make life a lot easier.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

lance.ewing wrote:Would certainly be worth trying optical. In the 6561 image, the detail can still be seen under the metal, but its much less clear

Probably not strictly required, but would certainly be nice. In most cases I can make out what is under the metal in the 6561 images, but not having the metal there in a set of images would make life a lot easier.
If you look at http://visual6502.org/wiki/index.php?ti ... _MOS_6502D it sounds like I have to strip the metal and polysilicon(or oxide maybe) to get the diffusion layer showing. In that case, optical won't show it very well, so electron microscopy is actually better. Given that I can imagine the whole chip with 12 pictures (compared to 200 optical), its also slightly faster. I will take a couple of optical pictures and upload to demonstrate the difference.

I want pictures to be less "dusty" though, so I will try another round of nitric&sulphuric before doing more imaging.
User avatar
pixel
Vic 20 Scientist
Posts: 1329
Joined: Fri Feb 28, 2014 3:56 am
Website: http://hugbox.org/
Location: Berlin, Germany
Occupation: Pan–galactic shaman

Re: 6561 Die Shot Reversing Explorations

Post by pixel »

Just to sport the infrared idea I'm wondering what kind of movie you'd get if you'd heat the chip up very slowly.
A man without talent or ambition is most easily pleased. Others set his path and he is content.
https://github.com/SvenMichaelKlose
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Ok. I think what is confusing me is that you draw the diffusion areas as contineous green areas even beneath the polysilicon.
I've been thinking more about this and suspect that before it can be useful to someone else, I'll have to go back through the SVG that I've been slowly putting together in Inkscape over the past couple of years and convert those bits of diffusion underneath the polysilicon to something else. At the very least introduce the gap in the diffusion, but perhaps also a polygon of another colour to represent the thin gate oxide. I'm not sure whether to simply have it so that when diffusion is immediately beside polysilicon on either side that the thin gate oxide is implied under the polysilicon, or whether it should show this thin oxide visually. The design rules state that there needs to be at least 1 λ between a parallel diffusion and polysilicon edge (when those edges are unrelated, i.e. not used in a transistor or connected together with a buried contact), so it seems that we could leave it out and let it be implied. Any thoughts?
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

lance.ewing wrote:
Kakemoms wrote:Ok. I think what is confusing me is that you draw the diffusion areas as contineous green areas even beneath the polysilicon.
I've been thinking more about this and suspect that before it can be useful to someone else, I'll have to go back through the SVG that I've been slowly putting together in Inkscape over the past couple of years and convert those bits of diffusion underneath the polysilicon to something else. At the very least introduce the gap in the diffusion, but perhaps also a polygon of another colour to represent the thin gate oxide. I'm not sure whether to simply have it so that when diffusion is immediately beside polysilicon on either side that the thin gate oxide is implied under the polysilicon, or whether it should show this thin oxide visually. The design rules state that there needs to be at least 1 λ between a parallel diffusion and polysilicon edge (when those edges are unrelated, i.e. not used in a transistor or connected together with a buried contact), so it seems that we could leave it out and let it be implied. Any thoughts?
Well, as I said its mostly personal preference and as you said, its easy to spot the transistors and know were the diffusion is absent. I am not so shure about the pullup-resistor though: Will there be a diffusion layer beneath it or is the polysilicon depletion what gives a long channel (of higher resistivity)? I would think its only the polysilicon that defines a larger resistivity value (by being longer), but I don't really know. One should be able to see that from the 6502 reconstruction on visual6502.

Anyway, here is the full 6560R0 chip from my electron microscopy session. Its not perfect with polymer or dust in several areas, but you can at least trace all metal lines (and most polysilicon lines). Since its 160 Megapixel, I put it on a googledrive share:

MOS6560R0_small.png
MOS6560R0_small.png (174.01 KiB) Viewed 3059 times
[/url]
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

pixel wrote:Just to sport the infrared idea I'm wondering what kind of movie you'd get if you'd heat the chip up very slowly.
Well, not much would happend until you melt Aluminium at 660C. Since the buried doped layers are not visible until one strips away the top metal and oxide, you wouldn't see the change in carrier concentration either. Anyway, it would be barely visible in an electron microscope, so not much action there either..
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Anyway, here is the full 6560R0 chip from my electron microscopy session. Its not perfect with polymer or dust in several areas, but you can at least trace all metal lines (and most polysilicon lines).
Yeah, this is great! I started by rotating it 90 degrees to the right so that it matches what I am familiar with from staring at the 6561 image for so long. It is clear that the 6560 and 6561 designs are predominantly the same. The interesting bits will be trying to spot the differences. So who is good at that game? How many differences can we spot? :D

Already I have seen something in relation to one of my recent posts, where I said that the phase 2 input pad appears not to be connected to anything in the case of the 6561. Well that isn't the case in the 6560. Take a look at the following two images, the first from the 6561 and the second from the 6560:
phase_2_input_6561.jpg
phase_2_input_6560.jpg
If we look up towards the top of the first image, we can see a diffusion to metal contact that is connecting to a metal square that is only as big as the contact itself. Below this is a metal line, but there appears to be a deliberate disconnect between the metal contact and the metal line. I've seen plenty of places on the 6561 die shot where the metal has come off unintentionally as part of the decapping process, but always in those cases there are the telltale signs that the metal was there. The example in the first image appears never to had any metal between where the metal contact is and the metal line. The gap is completely clean, which leads me to believe this is deliberate.

If we look at the second image from the 6560, the metal line is clearly connected to the contact.

I have seen other completely clean "cuts" like this on the 6561 die shot that are not present on the 6560. There are another two that are both related to phase 2. If we trace where phase 2 would have gone had it been connected, then we end up in an area of logic whose output has a similar deliberately "cut" metal wire. It's another deactivated part of the chip.
User avatar
eslapion
ultimate expander
Posts: 5458
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Post by eslapion »

lance.ewing wrote:... I can recognise a lot of the same structures from the 6561, but it is virtually impossible to recognise the transistors. I wonder what they did to get the surface looking so clear with the 6561E die shot? I don't know much about the process they go through.
It seems to me Kakemoms took images using an electron microscope for the 6560.

The die shots of the 6561 are from an optical system.
Be normal.
norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

eslapion wrote: It seems to me Kakemoms took images using an electron microscope for the 6560.

The die shots of the 6561 are from an optical system.
I think he said he will try optical next. One thing I like about the electron microscope is that it seems to show a 3-d effect.
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Before the weekend ends, I'm going to take a look at the following part of the die shot highlighted with a pink (or is it peach) box:
vmc_store_load_incr_highlighted.jpg
As you can see, it sits below the video matrix counter and its latch, and above the cell index boxes. This pink box contains the logic for controlling the video matrix counter and its latch. It generates the signals to store, load and increment the counter. For this discussion I'm going to present the logisim diagram first, discuss it a bit, and then show a closeup of the die shot. There is a big omission from the logisim diagram that I can't really simulate in logisim because it is a purely logic simulator. I'll discuss that omission after showing the close up of the die shot.

Firstly the logisim diagram:
video_matrix_counter_load_store_incr.png
video_matrix_counter_load_store_incr.png (6.98 KiB) Viewed 3036 times
There are four inputs and three outputs. Two of the inputs are F1 and F2. The other two are of more interest. The first is START NEW LINE', which is normally HIGH when it isn't the start of a new line and goes LOW when it is the start of a new line. It controls the first two outputs. The first output (F1) INCR CNTR appears to mirror F1 as long as it isn't the start of a new line. If it is the start of a new line, then it remains LOW even when F1 goes HIGH. This (F1) INCR CNTR output connects to the video matrix counter input that I previously called F1 (NO LOAD) in my post on the video matrix counter. This was meant to convey that it mirrors F1 as long as the counter is not loading. The reason I called it that in the video matrix counter is because of the LOAD CNTR output shown in the logisim diagram above (as discussed a bit below, if the LOAD CNTR output goes HIGH, then (F1) INCR CNTR will not go HIGH, because they trigger on different values of START NEW LINE'). I'm still undecided on a final name for that video matrix counter input, but (F1) INCR CNTR is meant to convey that it controls the incrementing of the counter, which is really its main function.

The LOAD CNTR output goes HIGH on F1 when START NEW LINE' goes LOW, i.e. at the start of a new line it goes HIGH when F1 goes HIGH. This causes the video matrix to load what is stored in the latch back in to the counter. The LOAD CNTR and (F1) INCR CNTR outputs are kind of the opposite of each other. LOAD CNTR mirrors F1 when it is the start of the line and (F1) INCR CNTR mirrors F1 when it isn't the start of the line.

The third output, STORE CNTR, is not controlled by START NEW LINE'. Instead it is controlled by CDC LAST VALUE'. This signal is HIGH while the Cell Depth Counter is counting up from zero. When it reaches the final value, CDC LAST VALUE' goes LOW. When this happens, STORE CNTR goes HIGH on F1 going high. This causes the latch to store the current value from the counter.

There are probably some subtleties to the timing that is difficult to reverse from the die shot, but the above seems to be roughly how it works.

Now to look at the close up of this section of the die shot:
video_matrix_counter_load_store_incr_die_shot.jpg
You will need to click on the image to get a close look. The contacts are all labelled and things are roughly in the same place as shown in the logisim diagram. It won't take you long to spot those three strange square shaped polysilicon areas with the F1 diffusion in the middle. This is the part that I haven't included in the logisim diagram, and as far as I can tell, it doesn't seem to have much of an impact on the logic I've reversed (although I certainly could be wrong about that). It is a rather unusual structure. There are similar structures to these three squares in other places on the die shot, but not quite like these ones. My guess is that this is a capacitor. A MOS transistor is after all also a MOS capacitor. This structure isn't a transistor though, because this isn't the standard case where diffusion comes up to either side of a polysilicon line and the polysilicon line (or gate) controls the signal passing from one side to the other. To be honest, I'm finding it hard to visualise what is actually going on. I'm not sure what the F1 metal contact in the middle is doing. My assumption though is that the F2 pass transistor is letting through a signal that charges up a capacitor, then when F2 goes LOW, that charge then controls the pass transistor that lets F1 through at the other side of this square structure (i.e. not the F1 contact in the middle but the F1 on the other side of the output of this square structure). As mentioned in some of the recent posts between Kakemoms and myself, where I show the diffusion in the middle of the square overlapping the polysilicon, this isn't actually what is happening. Instead that overlap is where the polysilicon is on top of the thin gate oxide and not diffusion.

I may be completely wrong about how those squares work, so certainly open to other suggestions about what this might be. The F1 contact in the middle is one part that has me a bit stumped.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

norm8332 wrote:One thing I like about the electron microscope is that it seems to show a 3-d effect.
Yeah, I love that as well. The surface actually is 3D like this, so I assume the 3D effect we are seeing is how it really is. I think if someone were to try to reverse the logic from this diagram, then determining what side the light and dark edges are on would reveal whether it is diffusion or polysilicon. One goes down and the other goes up, which seems to give a different shade on the equivalent edge. When there is a lot of polysilicon and diffusion edges close to each other, it becomes quite difficult though. That is where the optical colours would be very useful.
User avatar
eslapion
ultimate expander
Posts: 5458
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Post by eslapion »

norm8332 wrote:
eslapion wrote: It seems to me Kakemoms took images using an electron microscope for the 6560.

The die shots of the 6561 are from an optical system.
I think he said he will try optical next. One thing I like about the electron microscope is that it seems to show a 3-d effect.
Makes perfect sense. The electron microscope acts like a super accurate sonar revealing only the surface. The optical microscope works by reflection and transparency but you can't tell what's in front and what's behind. Silicon being the main ingredient of glass, the layers are semi-transparent.
Be normal.
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

Here is a snapshot of one of the corners. As I expected, you don't see any color were there is metal.
SNAP-095928-0028.jpg
It requires about 25 pictures to cover the whole chip at this resolution.

I think the best way is to remove the metal & oxide.
User avatar
mingle
Vic 20 Dabbler
Posts: 89
Joined: Sun Sep 25, 2016 2:38 am
Location: Melbourne, Australia

Re: 6561 Die Shot Reversing Explorations

Post by mingle »

I have no experience in this area, but I find it fascinating.

With optical and electron imaging, what are your chances of being able to 'decode' the entire chip?

Cheers,

Mike.
Post Reply