News:

Printed Amstrad Addict magazine announced, check it out here!

Main Menu
avatar_robcfg

Gate array decapped!

Started by robcfg, 16:54, 12 April 16

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

TotO

Quote from: Gryzor on 07:28, 13 April 16
Crowdfunding? :D
Those seven 40008 IC are on ebay months after months and nobody buy them for this price...
I suggest to contact the seller and ask him a more afortable price with shipping to the decapper address.
"You make one mistake in your life and the internet will never let you live it down" (Keith Goodyer)

Munchausen

Quote from: Octoate on 07:50, 13 April 16
You can use Degate (Reverse engineering integrated circuits with degate - Home). Btw, a nice tutorial on how to reverse engineer ICs can be found here.

Cool software!

Is this image high resolution enough? The screenshots on the Degate page look like they show more detail.

arnoldemu

I have some 40010 and 40007 here that I was going to send to visual6502 for decapping but never did.
I will check if I have a 40008 (unlikely, but I will check).

My games. My Games
My website with coding examples: Unofficial Amstrad WWW Resource

dragon

#28
Quote from: Octoate on 07:50, 13 April 16
You can use Degate (Reverse engineering integrated circuits with degate - Home). Btw, a nice tutorial on how to reverse engineer ICs can be found here.

I read the tutorial, i understand the logic behind it +-, but i no view how applied it to this gate array.

The horizontal metal layers are vcc and ground(is vcc the up or the down?). A connected vcc or ground can be easly view because the horizontal metal layers in each vertical line have intermediate vertical lines (comparing the free  cells in the left upper corner, with full). But i dont understand the vertical pads  crossing the cell , because they have wires connected. I spected the wires be connect to.the red substrate, and vertical pads are the red in the tutorial,
If i supposed the 6 vertical barsin  one cell of the gate array. Are the red in the tutorial ,I little lost :-)

Is the down wire vcc and upper ground?

robcfg

Good morning!


I just received the picture of the 40226 PreASIC metal layer, you'll find it along the 40010 pictures in the Gate Array page.


Sean tells me that he removed the passivation layer and the top metal layer from both chips and will be taking a new set of pictures shortly.


Unfortunately the 40007 broke because of thermal stress, so we'll have to get another one.


Have a nice day!

TotO

#30
Quote from: robcfgUnfortunately the 40007 broke because of thermal stress, so we'll have to get another one.
I have some 40007 in stock. I can ship him one of them.

"You make one mistake in your life and the internet will never let you live it down" (Keith Goodyer)

Cpcmaniaco

Now. I get 1 40008 from ebay, for this experiment.

Cpcmaniaco

@TotO   I will bay you 2 40007, 1 for the experiment and 1 for me to replace the other.

TotO

I have expected that you will require a replacement part too.  ;)
I will provide you free parts and ship them this afternoon!  8)
"You make one mistake in your life and the internet will never let you live it down" (Keith Goodyer)

dragon

#34
Pre asic =lsi compact gate array. Sea of gates. It appear amstrad have pass in this life with all stages of new technology in gate arrays. It have reference books published.

Thats remember me. Also the acid is reverse enginered. What about sending one to complete the album of pictures of custom ic?

Hi found this curse, i think it can help to undersantd how works the logic of the 40010
https://www.google.es/url?sa=t&source=web&rct=j&url=http://www.csit-sun.pub.ro/courses/vlsi/VLSI_Darmstad/www.microelectronic.e-technik.tu-darmstadt.de/lectures/winter/vlsi/vorlesung_pdf/chap13.pdf&ved=0ahUKEwimjNbxy4vMAhVG1hQKHaHFD2sQFgg4MAk&usg=AFQjCNFARYhNwBskHOmvbPyYVAah9qc9WA&sig2=Gm_oFlQcbWiW22ptFgRHIw

TotO

Quote from: Cpcmaniaco on 10:14, 13 April 16
@TotO   I will bay you 2 40007, 1 for the experiment and 1 for me to replace the other.
Just sent!  ;)
"You make one mistake in your life and the internet will never let you live it down" (Keith Goodyer)

gerald

Quote from: dragon on 11:01, 13 April 16
Pre asic =lsi compact gate array. Sea of gates. It appear amstrad have pass in this life with all stages of new technology in gate arrays. It have reference books published.

Thats remember me. Also the acid is reverse enginered. What about sending one to complete the album of pictures of custom ic?

Hi found this curse, i think it can help to undersantd how works the logic of the 40010
https://www.google.es/url?sa=t&source=web&rct=j&url=http://www.csit-sun.pub.ro/courses/vlsi/VLSI_Darmstad/www.microelectronic.e-technik.tu-darmstadt.de/lectures/winter/vlsi/vorlesung_pdf/chap13.pdf&ved=0ahUKEwimjNbxy4vMAhVG1hQKHaHFD2sQFgg4MAk&usg=AFQjCNFARYhNwBskHOmvbPyYVAah9qc9WA&sig2=Gm_oFlQcbWiW22ptFgRHIw
Gate array was usually cheaper than an ASIC if you could get your logic in it. I would not be surprised that the plus Asic is also a gate array.

arnoldemu

Quote from: arnoldemu on 09:09, 13 April 16
I have some 40010 and 40007 here that I was going to send to visual6502 for decapping but never did.
I will check if I have a 40008 (unlikely, but I will check).
I don't have a 40008.

If the 40007 that is being sent also fails to be decapped then I have another we can send and try.
My games. My Games
My website with coding examples: Unofficial Amstrad WWW Resource

dragon

#38
And probably made by sgs logic corporation :) .


Investigating I found a a free book about the history of lsi coporation.Curiosity the company begin in 1980.First copy(licensed) the standar Robert Lipp cell design in the 80 for cmos gate array, and later around 1982, they made a joint with thosiba  to desning an asic. They made a vdsli aplication using diferenten licenses.

The question is around 1983 (The c year in the gate array die). They finish with thosiba the LL5000 series gate array. Searching their datasheet  in LL5000 series, it said sgs is a second source with other company.

I autothinking if you are a second source company. And you want your product not have the original code of original manfacturer.But its a second source. Then you use the original number name, but your changue first original name.

So i search  lsi logic corp LL3000 array.

And i found a datasheet of a lsi LL3000 series. And it have and interesting table wihth all submodels.

And two of the submodel in the table are "misteriusly" LL3130 and LL3170 Remember the name of 40008 and 40010 in the service manuals? HSG3130 and HSG3170

As the datasheet says is a "H-CMOS Silicon Gate-Logic array"  HGS=abreviature of H-cmos Silicon Gate logic array ? :)

LL3250 ... - Datasheet Search Engine Download


Pd: We need this book:


Databook and design manual : HCMOS macrocells, macrofunctions (Book, 1986)

pelrun

Looking at the patents a bunch of them have a diagram and description of the basic P/N transistor cell that you can see repeated in our GA. This one has it as Fig. 1:



http://www.google.com/patents/US5079614


One square each of P and N doped diffusion, overlaid by two strips of polysilicon to form transistors, and crossed by VDD and VSS power lines. On our GA there are only minor differences; the second cell has a crossover between the two wells, and the power lines are in the metal layer on top.

dragon

The big problem as people say earlier, is its lack resolution, i can't watch really where are connected the cables :s.

Maybe is best make an alternative approach.

Take the base cell, and drawn in a paper the basic logicall cells, and,or,nand,nor, etc. Theoricall connected with the base cells.

And then try find these  "figures" in the picture. Then at least is posible find the basic gates, search the wires between cells is more easy. To form macrofunctions

Gryzor

Can you circle, on the photo, where the problem lies? I'll see if it's on the original image...

pelrun

#42
I disagree about the resolution; I don't have any problem seeing where the metal traces are joined to the silicon layers, either in the large bus bars or in the finer interconnects. There's very rarely a join in the middle of a track, anyway (they branch off into a stub if there's room) - and even those are distinguishable.


Edit: only talking about the original GA here; the Pre-ASIC is much denser.

dragon

#43
Quoteauthor=Gryzor link=topic=11888.msg124813#msg124813 date=1460725733]
Can you circle, on the photo, where the problem lies? I'll see if it's on the original image...

Oh i think its not necessary, i can't simply interpret the pass from theory to the picture.


Quote from: pelrun on 14:21, 15 April 16
I disagree about the resolution; I don't have any problem seeing where the metal traces are joined to the silicon layers, either in the large bus bars or in the finer interconnects. There's very rarely a join in the middle of a track, anyway (they branch off into a stub if there's room) - and even those are distinguishable.


Edit: only talking about the original GA here; the Pre-ASIC is much denser.

If you can make an example with one of the cells of the picture. And a equivalence with the therory in paper. I (and others i suppuse :) be grateful, for example who do you distinghs where are connectwd vcc with the vertical lines in the power metal bars.

Why the vertical bar  in the middle are less fat that the other?

Where is connected the wires to the metal bars or transistors when they are in the bars
In the theory the vertical bars have  connections in the two sides around the power bars, but it have in these gate array?. I don't have view a wire connected  in the upper part of vcc vertical bar.

I mean i understand the theory in paper. But i can't interpret how is connected the cells, because i can't view the transistors where they are connected to compare the cell structure with the paper theory structure.

I'm sure bryce,gerald and you and other people  not have problems to figure how is connected, but i non an expert in hardware  at this level sorry :) i only try to learn about it.

pelrun

#44
You get one transistor everywhere there is a thin red line crossing one of the green squares - either an N-fet or a P-fet depending on how the square is doped. That gives you two transistors per square, sharing one pin. The red line is the gate, and the green areas to the sides are the source/drain (the fets are symmetrical, it doesn't matter which you call source or drain.) The red 'wire' is thinner in the transistor area because that affects the properties of the transistor; it's larger elsewhere to provide enough area to attach wires to. If you read the start of the patent I posted earlier, it describes this in a fairly straightforward manner.


As you've guessed, where the vcc/gnd bus bars are connected to the transistors shows up as vertical edges - there's an insulating layer between the top metal layer and the polysilicon below, and there are holes in this layer to allow the metal and polysilicon to touch. You're literally seeing the edges of the holes, as the metal layer drops into the hole and back up the other side.

gerald

A good picture is better than thousand words :
Here is a inverter, implemented in the gate array. This is the 1st one on the 16MHz input clock path
[attach=2]
The metal on the left of the output is the input going somewhere else.

||C|-|E||

It is extremely interesting, for somebody like me, too see these kind of jobs done and interpreted. A great, great opportunity to learn a lot  :-*

robcfg

This is top notch stuff! Thanks @gerald !


Is it safe to assume that every other inverter on the gate array should look exactly the same as this one?

||C|-|E||

It should be possible, once characterized the main functional units, to create a program to annotate all of them, right? You would probably need to "teach" it with a few examples, but it should work, since it is essentially the same I do to create a 3D structure from 2D projections of a particular protein complex. Although the reallity is more complicate in my case (you select a bunch of 2D projections rotated in different angles, then a 2D fourier transform is computed for all the projections, the you group them in class averages based on their fourier transform, and then you reconstruct the 3D model in the fourier space) a similar approach would probably work here, specially considering that we do not have different rotations but always the same view, something that simplifies the process a lot. I am the biologist in my lab, I work in the biochemical part preparing the samples and not coding the software, but I am convinced that it should really work. On the other hand, maybe there is something like this already, I do not know about reverse reverse engineering. In any case, if somebody would like to implement something like this I can submit you guys a tons of paper discussing the algorithms, everything is open source.


gerald

Quote from: robcfg on 19:18, 16 April 16
Is it safe to assume that every other inverter on the gate array should look exactly the same as this one?
More or less  ;D
- The connection of the input / output port can change.
- There is also a strong inverter (made of 2 GA cells)


Powered by SMFPacks Menu Editor Mod