Backstory and first attempts

As I mentioned in my last post I’ve been working on reverse engineering the PLA chip in the C128. I’m now mostly done with this process so I think it’s time to share some of the findings.

This has been a very interesting project as I did not really know much about semiconductor design and manufacturing. My existing knowledge extended to having seen some die shots and admiring the pretty looking pictures.

It all started with me buying a cheap microscope to help with soldering surface mount components.

Some time later I ended up watching a video on youtube showing a simpler way of getting silicon dies out of the packaging.

This looked simple enough to try at home as I already had all the equipment needed. Decapping an IC usually involves heated sulphuric acid or other similar nasty chemicals which I do not really want to play with at home. So I dug out a couple of broken MOS chips I had lying around (never throw things away, could come in handy). After fiddling around a bit I ended up with two 8521R0 dies and one 8721 PLA. The first real photo was the one show in the last post.

Better microscope

While this was a success I quickly realised that this microscope did not have enough resolution for me to be able to capture images of high enough quality. The maximum magnification is 90x, when using a 2x barlow lens. Additionally it does not have a stage so I had to place the die on a table and then move the whole microscope, which is very unstable and makes it hard to capture the bits you want to see.

As such a better microscope was sourced and purchased, still within reasonable money.

This proved to be much better at taking pictures of decent quality, I was however not happy with the camera I bought with it. It’s a cheap camera with no capability for me to manage it remotely except using the AmScope application. Around this time, the Raspberry Pi foundation released the new High Quality camera for the Raspberry Pi. This camera has a C-mount on it which matches the microscope so I quickly bought one and put in on the microscope. This camera is fantastic for this job, full control of the whole process from the comfort of linux.

All in all a vast improvement to the previous setup. With the higher resolution I started needing to stitch the photos together to make larger pictures. This sounded simple at the start and ended up being (as you can probably guess) not very easy at all. I’m still struggling with the stitching, but slowly improving. One of the key things for a successful panorama stitch is to have consistent photos when it comes to panning, focus, white balance etc. etc. The more even the photos, the easier and better the stitching becomes.

Motorizing

This led me to start working on motorizing the table. It was getting really tiresome having to manually move the table around and the photos ended up being moved in multiple axis etc.

Lots of design work, 3D printing and research into CNC firmwares later I ended up with the following setup:

Going from the top we have a Raspberry 7" display, with a Raspberry Pi4 mounted on the back. Not see is also the RPi HiQ camera mounted on the microscope. The RPi takes photos, displays previews on the display and also runs the python code that controls the CNC board.

The stage and the levelling table is motorized with 28BYJ-48 steppers controlled using a small board with an ESP32 running Grbl_Esp32 and four AD4498 stepper motor controllers.

This whole setup has some issues both in software and hardware but it works well enough for now to enable me to do some work.

Putting chips in reverse

With the logistics now sorted out I returned to the work of reverse engineering the chip itself. My initial focus was on the PLA chip as this should be one of the simpler ones to figure out. PLA stands for Programmable Logic Array and is a very common structure in designs from this era.

Looking at the schematic diagram from wikipedia we should expect to see two main arrays, AND and OR. Inputs are connected to AND and outputs from the OR array.

Going back to the previous die shot with can improve it with some annotations for the pins and the general areas of the chip. Once we have established the pins we can see that all the inputs are connected to one array and all the outputs to the other array, just as expected. This also helps us establish which array is which.

Here we see the I/O pins marked up with how they are connected to the lead frame and the pins on the DIP itself. We can also see the two main areas that make up a PLA structure, the AND array and the OR array. Additionally there is some extra logic at the bottom marked with a question mark. The function of this was unknown to me but as all the output pins are passing through it I was guessing that it was an output stage of some kind.

AND array

So, if we take a closer look at the AND matrix to start with we will see the following. The colours are a bit off as this was still done using the AmScope camera and I didn’t figure out how to set the white balance on it.

This was not very helpful to understand what was going on as all the interesting bits are covered up by the top-most metal layer. This was early on when I was still learning a lot so to remove the metal I took a very brute force approach. I use heavy mechanical scrubbing to remove the metal which I also learned once I put it back in the microscope had removed everything but the substrate itself. Oops.

Fortunately, the details that I needed were in the diffusion embedded into the substrate:

Looking closely at this image we can see little squiggly lines where a transistor is located to create a connection within the matrix.

OR array

Moving on to the OR array we see the exact same pattern. Hard to tell with the metal layer in place, though easier compared to the AND matrix. Much easier with just the substrate and diffusion left.

Full matrix decode

Armed with this knowledge we can now proceed with extracting the full PLA logic matrix from the images.

I marked all transistors in each matrix with a dot and got the following picture:

All inputs are horizontal in the AND matrix, with each line having a normal and an inverted signal being fed in. All outputs are horizontal in the OR matrix and they are connected with vertical lines called product terms.

By looking at the dots, we can decode the product terms by doing logic and for all vertical lines in the AND matrix, for example

    p0 = CHAREN & HIRAM & BA & !MS3 & GAME & RW & AEC & A12 & !A13 & A14 & A15

For the outputs we instead look horizontal for each output and combine with or, for example

    SDEN = p42 | p43 | p66 | p69

So now we have the entire set of logic equations. Hooray!

Output stage

Going back to the full die picture, we now have everything but the box marked with a question mark in the output path.

Looking at higher resolution photos of this we can see similar structures for each output. In all cases except two the structure is bypassed and the output from the OR matrix goes directly to the output pin. This is however not the case for the two pins DWE and CASENB.

DWE is the Write Enable signal going to the main system DRAM chips, CASENB is gating the CAS signal towards the RAM. These two signals are processed in some form using these output gate structures, so I had to reverse engineer this block.

After quite some time reading up on silicon chip design and manufacturing and a lot of attempts I managed to come up with a schematic for this that makes sense. I’m not going to go into the whole process here but I will document and post it later. Here I would also like to thank Frank Wolf for his help, please support his project if you can!

Going a bit further, the way this is used in the DWE and CASENB outputs makes it a normal D-latch. The latch enable for this also comes for the PLA matrix in a pair of lines in the OR matrix.

Result

So as a final result we can now write down the full HDL code for the C128 PLA chip. I’m using verilog for this. Mind you this is the first verilog I’ve ever written so it’s probably suboptimal. Using a D-latch for the output in verilog is normally seen as a bad thing, however in this case I am doing it to replicate the logic and function of the existing chip.

I have validated this to the best of my knowledge, but if I’ve missed anything please let me know!

In difference to the C64 PLA the C128 PLA can not be replaced with just an EPROM or similar due to the presence of the output latches.

Edit: I’ve removed the verilog source from here. You can now find it on github.

What’s next

Next chip to be processed is the C128 MMU chip, this will be a lot more work as it’s not a nice regular PLA.

<< Previous Next >>