6561 Die Shot Reversing Explorations

Modding and Technical Issues

Moderator: Moderators

norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

Kakemoms wrote:Here is a snapshot of one of the corners. As I expected, you don't see any color were there is metal.
SNAP-095928-0028.jpg
It requires about 25 pictures to cover the whole chip at this resolution.

I think the best way is to remove the metal & oxide.
I think that is still a useful Image IMO. I'd image the whole chip like this before removing the metal. More data is always better IMO. Very cool :D
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Here is a snapshot of one of the corners. As I expected, you don't see any color were there is metal.

It requires about 25 pictures to cover the whole chip at this resolution.
For comparison, would you be able to get a closer optical image of one part of the chip, perhaps as close as what the 6561 die shot shows?
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

Ok. Here is a couple of samples with 200X nominal optical magnification:
SNAP-120840-0047.jpg
SNAP-120936-0051.jpg
The extra cleaning in acid has stripped some metal here and there, but not enough to make a difference (you can still see were the edges have been). The color in the picture is very dependent on focus, and the depth of focus is very narrow at these magnifications. So there is a slight defocus on either left or right part of the picture.

Here is a link to all the 37 pictures sofar (!! 117MB). These are 3 stripes of about 12 pictures each; e.g. about 25% of the chip. The rest I will have to do later as I am going on travel now.

If you/anyone wants to mount these pictures together into a larger one, we would all be very happy. :wink:
User avatar
eslapion
ultimate expander
Posts: 5458
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Post by eslapion »

Kakemoms wrote:The extra cleaning in acid has stripped some metal here and there, but not enough to make a difference (you can still see were the edges have been). The color in the picture is very dependent on focus, and the depth of focus is very narrow at these magnifications. So there is a slight defocus on either left or right part of the picture.
I am on my knees in awe and admiration! What you are doing will help keep the VIC-20 alive for decades to come.

Sidenote: I was once told using very strong lighting with low sensitivity film (or digital simulation thereof with modern digital cameras) can greatly increase depth of focus.
Be normal.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

mingle wrote:I have no experience in this area, but I find it fascinating.

With optical and electron imaging, what are your chances of being able to 'decode' the entire chip?
I think we're already quite a way towards achieving this for the 6561, much further than I thought we'd be at this point in time. Looking at my Inkscape svg file overlaid on top of the die shot image, I'd say I'm already quite a bit past half way tracing around the various structures, and I usually stop after tracing around a section to work out what the logic is. Once I've finished tracing around everything, and working out what the logic gates are, it will still take quite some time after that to work out things like the proper timing. It probably relies on propagation delay in various places. That gets into the non-logical side of things. I would probably then start out with a proper tool for capturing the schematic. Logisim is nice for working things out for small sections, but to build up the whole chip in one schematic, I think we'll need something else. Suggestions welcome for suitable tools.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:The extra cleaning in acid has stripped some metal here and there, but not enough to make a difference (you can still see were the edges have been). The color in the picture is very dependent on focus, and the depth of focus is very narrow at these magnifications. So there is a slight defocus on either left or right part of the picture.
A great set of pictures! :D I see that it covers some interesting parts of the X and Y decoder, so I might be able to start looking at how they differ. I agree having seen these images that for this 6560, we're probably going to get a better picture with the metal fully removed. Not sure why the diffusion and polysilicon are not showing up under the metal as clearly as they do in the 6561 die shot.

Regarding the colour, I've read in a few places that these colours are produced by thin film effects, like on the surface of a bubble. Certainly you can see in these 6560 images quite an "oily" appearance. I'm still a bit amazed at how the guys that produced the 6561 image managed to get the colours showing up like they did. Somehow they managed to get the diffusion mostly with a green tint and the polysilicon mostly with a red or brown tint. This makes things a lot easier.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

I've created this side-by-side comparison of the same section of the 6560 and 6561 die shot:
6560_6561_die_shot_comparison.jpg
Click on the image to get a bit closer. The main differences I am seeing is the distinction between the polysilicon and diffusion when not under metal. The polysilicon is quite reddish-brown and the diffusion grey in the 6561 image on the left. Even under the metal, the polysilicon is easier to see in the 6561, where it is usually a light pink. If you look at the depletion mode pull up transistor towards the top right, in both cases we can see the buried contact, but the shape of the polysilicon gate is much clearer with the reddish-brown shade in the image on the left, whereas its all greenish on the right. If we look at the same pull up transistor for the cell one below, it is under the metal and not really possible to see in the 6561 image, but is pink in the 6561. Luckily the 6561 die shot is almost the same as the 6560 one, so comparing the same sections of the two die shots side by side would help a lot.

Do you know what would really help with the 6560 image? If there was some way of combining the 3D nature of the electron microscope image with the optical image. So a coloured 3D terrain. That would make the transistors stand out a bit more. Not sure how we'd go about combining the images in that way though.
User avatar
eslapion
ultimate expander
Posts: 5458
Joined: Fri Jun 23, 2006 7:50 pm
Location: Canada
Occupation: 8bit addict

Re: 6561 Die Shot Reversing Explorations

Post by eslapion »

lance.ewing wrote:Do you know what would really help with the 6560 image? If there was some way of combining the 3D nature of the electron microscope image with the optical image. So a coloured 3D terrain. That would make the transistors stand out a bit more. Not sure how we'd go about combining the images in that way though.
Some software from the movie industry could help and I know exactly who to ask for that.
Be normal.
norm8332
Vic 20 Nerd
Posts: 626
Joined: Sun Nov 13, 2016 11:04 am
Location: USA

Re: 6561 Die Shot Reversing Explorations

Post by norm8332 »

The two images could be blended with Gimp, but it may take some manipulation to ensure they line up across the whole image.
“In religion and politics people’s beliefs and convictions are in almost every case gotten at second-hand, and without examination... whose opinions about them were not worth a brass farthing.”

-Autobiography of Mark Twain
Kakemoms
Vic 20 Nerd
Posts: 740
Joined: Sun Feb 15, 2015 8:45 am

Re: 6561 Die Shot Reversing Explorations

Post by Kakemoms »

eslapion wrote:
lance.ewing wrote:Do you know what would really help with the 6560 image? If there was some way of combining the 3D nature of the electron microscope image with the optical image. So a coloured 3D terrain. That would make the transistors stand out a bit more. Not sure how we'd go about combining the images in that way though.
Some software from the movie industry could help and I know exactly who to ask for that.
Now, that would be really interesting!

Lance, as for the "blurriness", these two ICs have been made with different equipment at different sites. Most of the 6560 is covered with oxide, even the metal lines (that became apparent from a "normal" electron microscope picture). So the oxide over the polysilicon is rather thick. Once we remove the oxide it will be much more clear and well-defined.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Kakemoms wrote:Lance, as for the "blurriness", these two ICs have been made with different equipment at different sites. Most of the 6560 is covered with oxide, even the metal lines (that became apparent from a "normal" electron microscope picture). So the oxide over the polysilicon is rather thick. Once we remove the oxide it will be much more clear and well-defined.
It will be really great to see that. As I've mentioned a couple of times already, it appears that a lot of the chip is the same as the 6561, but I have noticed a few areas that are different (ignoring for now the X and Y decoders, which will obviously be different). The colour generation section is a bit different. For example, the sine and cosine generator section has different structures. They probably do the same thing, but for whatever reason, they changed the layout in the 6561. It looks like the resistors below the sine and cosine generator section are in a different layout as well.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

Today I'm posting some details about the base address computation section of the 6561, i.e. the bit that calculates the output values for address lines A9 to A13. It is highlighted with a pink box in the following die shot image:
base_address_calculation_highlighted.jpg
As you can see, it is a rather large area below the video matrix counter and latch, and to the left of the cell index logic. The following image shows a close up of that section of the die shot with the diffusion, polysilicon, and contacts identified:
base_address_calculation_dieshot.jpg
Unfortunately it is so large that it is difficult to see most of the labels. The eight lines coming in from the bottom edge of the image towards the bottom right corner are the eight bits of the base address control register, i.e. CR5. They are not in numerical order though. To better support the layout of this section of the die shot, the 8 bits of that control register are stored in order from left to right: BC12, BV11, BC11, BV10, BC10, BC13, BV12, BV13 (i.e. in bit order 2, 5, 1, 4, 0, 3, 6, 7). The other base address value, BV9 from bit 7 of CR2, is coming in on a metal line partway up on the right edge.

Further up on the right hand edge, we have BM9, BM10, and BM11 that are from the cell index logic that we looked at a few posts ago. These three values are used in the computation of the values for address lines A9 to A13.

From the top edge and towards the top left corner, we having coming down on two metal lines VMC10 and VMC11. These are bits 10 and 11 of the video matrix counter. These values are also used in the calculation of the values for address lines A9 to A13.

In the bottom left corner are the outputs from this base address computation section, i.e. the inverse of the values intended for address pins A9 to A13. Although I haven't checked this yet, I think they're the inverse values because the output sections of the relevant bonding pads will probably inverse the values again prior to leaving the chip.

The rest of this section of the die shot is made up of adders and pass transistor logic. The HCC0 signal and its inverse HCC0' are used to control the pass transistors. We can see HCC0 coming in at the bottom right corner, where it is inversed, then both HCC0 and HCC0' weave left almost the whole way across the image, and then head upwards, and they connect to many pass transistors along their path.

Having said all the above, let's take a look at the logisim diagram:
base_address_calculation_logisim.png
As is normally the case, you will certainly need to click on the image to get a better look. At the top we have five adders. I have numbered them from 1 to 5, with the main logic gates used in each adder being labelled with the relevant number. I have labelled them in their sequence order, i.e. the carry output from adder 1 is an input to adder 2, the carry from adder 2 an input to adder 3, and so on. I have placed the adders in the logisim diagram in the same order as they appear on the die shot. As you can see from this, they are not laid out in numerical order. Adder 1 is in the middle, adder 2 on the far left, etc. This is probably because of where the corresponding inputs are coming from.

Let's take a closer look at the adders. Four of the five adders are actually half adders. Only adder 2 is a Full Adder. If you look at the inputs to the other four adders, you'll notice that they only have two inputs. For adder 1, there is obviously no carry input but instead two data inputs. For adder 3 there is a carry input (coming from adder 2) and a single data input. For adder 4 there is a carry input (coming from adder 3) and a single data input. And finally for adder 5, there is a carry input (coming from adder 4) and a single data input.

Now many of you might be thinking "Hang on a second, there's actually a lot more data inputs than what was mentioned in the above". This is true, but this is where the pass transistors come into the picture. Remember that the VIC chip takes turn about fetching cell index data from the video matrix memory and then character data. So sometimes it is using the base address for the video memory and sometimes it is using the base address of the character memory. Which one it is currently using is determined by the value of HCC0 (i.e. bit 0 of the Horizontal Cell Counter). When HCC0 is LOW, it is fetching from the video matrix memory, and when HCC0 is HIGH, it is fetching from the character memory. So all those pass transistors across the middle of the logisim image above that are controlled by HCC0 and HCC0' are what let in either the base video matrix address or the base character memory address. So although adder 1 (for example) appears to have four data inputs, only two of them are actually passing through at any one time.

Something similar is happening for the sum outputs of the adders. You will see that each adder sum output (except for adder 5) connects to two different address lines... but not directly. Instead they connect to the two different address lines via two different pass transistors, where one pass transistor is controlled by HCC0 and the other by HCC0'. What this means is that when HCC0 is LOW, the output of the adder connects to one address line, and when it is HIGH, it connects to another address line.

"Why is it doing this?" you may be wondering. At first it doesn't make a lot of sense. The reason can be explained by looking at adder 2 and thinking a bit about why there is only one Full Adder and four half adders. Adder 5 isn't actually doing anything of use when HCC0 is HIGH. The base address value, i.e. the character base address, is only four bits, so to those four bits it needs to add the values of BM10 and BM11. The value of BM9 passes straight through to the inverter immediately before the A9' output and isn't used in any of the adders. The sum outputs of adders 1 to 4 then go to A10' to A13'. In this case, i.e. when HCC0 is HIGH, adder 2 has three inputs, which are the two data inputs (BC11 and BM11) and the carry from adder 1. It is the only adder than has three inputs in this case.

Now let's look at what happens when HCC0 is LOW. All five adders are in use. BV9 is added to VMC10. That is two inputs for adder 1. The carry from adder 1, BV10, and VMC11 are then added together in adder 2. That is once again three inputs for adder 2. But now if we look at adders 3, 4, and 5, they only have two inputs. For adder 3, the inputs are the carry from adder 2 and BV11. For adder 4, the inputs are the carry from adder 3 and BV12. And finally for adder 5, the inputs are the carry from adder 4 and BV13.

When HCC0 is LOW, adder 2 (the Full Adder) is calculating bit 10 of the address line output, and when HCC0 is HIGH, adder 2 is calculating bit 11 of the address line output. It is only in those two cases where a full adder is required. So it seems to be that in order to save space, and to require only one Full Adder, they've made use of these pass transistors so that BV10 goes into adder 2 when HCC0 is LOW, but BC11 goes into adder 2 when HCC0 is HIGH, and the other inputs shift one way or the other as appropriate.
Last edited by lance.ewing on Sat Jan 13, 2018 12:30 pm, edited 1 time in total.
User avatar
MCes
Vic 20 Afficionado
Posts: 457
Joined: Fri Jul 24, 2015 1:19 am
Location: Italy

Re: 6561 Die Shot Reversing Explorations

Post by MCes »

lance.ewing wrote:An interesting observation I'd like to make at this point is that the phase 2 4.43 MHz clock bonding pad doesn't appear to be connected to anything in the die shot. I found this quite surprising and suspect that there is something more to it that I haven't picked up on yet.
Also I found always strange that on old PAL motherboards that use a 8,86MHz quartz only Fi1 (pin 39) is correctly feeded with a 4,43 MHz clock ( Fi2 pin38 is feeded with 8,86 MHz...).
VICpal8m.JPG
Also I found a working VIC20 with one of the two clock line was not feeded (pin 38? I don't remember, but it sound good....) because during production a pin of 7402 was bended between the chip body and the PCB.....
Before I never understood how it could was working!
"Two things are infinite, the universe and human stupidity, and I am not yet completely sure about the universe." (Albert Einstein)
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

lance.ewing wrote:In the bottom left corner are the outputs from this base address computation section, i.e. the inverse of the values intended for address pins A9 to A13. Although I haven't checked this yet, I think they're the inverse values because the output sections of the relevant bonding pads will probably inverse the values again prior to leaving the chip.
I have now verified this, in fact I've been meaning to take a look at the output driver for the address line pads for a while. In summary, they're pretty much identical to the diagram shown on page 46 of skoe's "The C64 PLA Dissected" document, i.e. Figure 4.24:

http://www.zimmers.net/anonftp/pub/cbm/ ... sected.pdf

The only difference is that the first inverter shown on the left is a simple inverter in the case of the 6561 address pad output driver but is an inverting super buffer in the case of the C64 PLA Dissected Figure 4.24. I've checked and everything else is the same. Logically they're equivalent.

So this confirms that the address line output values coming into the output drivers for the address pads are the inverse value (e.g. #F0 as shown in that figure 4.24 in the C64 PLA doc) and is inverted in the process, so that the pin has the non-inverted value (e.g. F0 in that C64 PLA doc).
Last edited by lance.ewing on Sun Jan 14, 2018 4:58 pm, edited 1 time in total.
lance.ewing
Vic 20 Afficionado
Posts: 413
Joined: Sat Nov 10, 2012 3:19 pm
Website: https://sites.google.com/site/mos6561vic/

Re: 6561 Die Shot Reversing Explorations

Post by lance.ewing »

The following post is taking a look at what is pretty much the final part of the address calculation section of the die shot (everything beyond that is just connecting lines, bonding pads and their drivers). The part we are taking a look at is highlighted with a pink box in the following image of the die shot:
address_out_a0_to_a8_highlighted.jpg
It is the area immediately above the video matrix counter. There isn't much point putting a close up image of the die shot for this section because its really just a bunch of pass transistors controlled by HCC0 and HCC0' that determine what values to output on address lines A0 to A8. The following is the logisim diagram:
address_out_a0_to_a8_logisim.png
address_out_a0_to_a8_logisim.png (7.28 KiB) Viewed 3124 times
At the bottom, we have all 12 bits of the video matrix counter from VMC0 (bit 0) on the right to VMC11 on the left. You will notice that I don't show VMC0, VMC10 and VMC11 connected to anything in this diagram. This is because they are not used for determining the values of address lines A0 to A8, which is the subject of this post. In fact in the case of VMC0, it isn't connected to anything else in the die shot other than to obviously incrementing VMC1 via its carry as would normally happen within a counter. In the case of VMC10 and VMC11, we've already seen in my post yesterday on the base address calculation that those two top bits of the video matrix counter are used as part of the calculation of the A9 to A13 address output values.

So that leaves VMC1 to VMC9 that are of interest to the current post. The diagram speaks for itself really. There are nine outputs at the top, i.e. the inverse values of A0 to A8. The pass transistors below those inverters act as a 9-bit multiplexer with HCC0 as the select input, BM0-BM8 as one set of data inputs and VMC1-VMC9 as the other set of data inputs. When HCC0 is LOW, it is the current values of VMC1-VMC9 that are let through to the A0 to A8 pins, and when HCC0 is HIGH, it is the current values of BM0-BM8 that are let through to the A0 to A8 pins.

Notice that I've put two names for BM0-BM2. They're actually the bottom three bits of the Cell Depth Counter. When double height characters are disabled, then BM3-BM8 come from the bottom six bits of the cell index value fetched from the video matrix memory (the top two bits of the cell index value are used in the base address calculation). When double height characters are enabled, BM3 will be the top bit of the Cell Depth Counter, and the cell index value gets shifted up, so BM4-BM8 come from the bottom five bits of the cell index value (the top three bits of the cell index value are used in the base address calculation in this case).
Post Reply