Integrated Circuit Reverse Engineering, 1970s Style

We are used to stories about reverse engineering integrated circuits, in these pages. Some fascinating exposés of classic chips have been produced by people such as the ever-hard-working [Ken Shirriff].

You might think that this practice would be something new, confined only to those interested in the workings of now-obsolete silicon. But the secrets of these chips were closely guarded commercial intelligence back in the day, and there was a small industry of experts whose living came from unlocking them.

Electron micrograph of a wire bond to the Z80 CTC die
Electron micrograph of a wire bond to the Z80 CTC die

Integrated Circuit Engineering Corporation were a Scottsdale, Arizona based company who specialised in semiconductor industry data. They have long since been swallowed up in a series of corporate takeovers, but we have a fascinating window into their activities because their archive is preserved by the Smithsonian Institution. They reverse engineered integrated circuits to produce reports containing detailed information about their mechanical properties as well as their operation, and just such a report is our subject today. Their 1979 examination of the Zilog Z80 CTC (PDF) starts with an examination of the package, in this case the more expensive ceramic variant, then looks in detail at the internal construction of the die itself, and its bonding wires. We are then taken in its typewritten pages through an extensive analysis of the circuitry on the die, with gate-level circuits to explain the operation of each part.

The detail contained in this report is extraordinary, it is clear that a huge amount of work went into its production and it would have been of huge value to certain of Zilog’s customers and competitors. At the time this would have been extremely commercially sensitive information, even if it now seems like a historical curiosity.

The Z80 CTC is a 4-channel counter/timer peripheral chip for the wildly succesful Z80 8-bit microprocessor, in a 28-pin dual-in-line package. We were surprised to find from a quick search that you can still buy this chip from some of the usual suppliers rather than the surplus houses, so it may even still be in production.

If IC reverse engineering takes your fancy, take a look at our archive of [Ken Shirriff] posts.

Thanks [fortytwo] for the tip.

Building an OBD Speed Pulse: Behold the ICE

I am a crappy software coder when it comes down to it. I didn’t pay attention when everything went object oriented and my roots were always assembly language and Real Time Operating Systems (RTOS) anyways.

So it only natural that I would reach for a true In-Circuit-Emulator (ICE) to finish of my little OBDII bus to speed pulse generator widget. ICE is a hardware device used to debug embedded systems. It communicates with the microcontroller on your board, allowing you to view what is going on by pausing execution and inspecting or changing values in the hardware registers. If you want to be great at embedded development you need to be great at using in-circuit emulation.

Not only do I get to watch my mistakes in near real time, I get to make a video about it.

Getting Data Out of a Vehicle

I’ve been working on a small board which will plug into my car and give direct access to speed reported on the Controller Area Network (CAN bus).

To back up a bit, my last video post was about my inane desire to make a small assembly that could plug into the OBDII port on my truck and create a series of pulses representing the speed of the vehicle for my GPS to function much more accurately. While there was a wire buried deep in the multiple bundles of wires connected to the vehicle’s Engine Control Module, I have decided for numerous reasons to create my own signal source.

At the heart of my project is the need to convert the OBDII port and the underlying CAN protocol to a simple variable representing the speed, and to then covert that value to a pulse stream where the frequency varied based on speed. The OBDII/CAN Protocol is handled by the STN1110 chip and converted to ASCII, and I am using an ATmega328 like found on a multitude of Arduino’ish boards for the ASCII to pulse conversion. I’m using hardware interrupts to control the signal output for rock-solid, jitter-free timing.

Walk through the process of using an In-Circuit Emulator in the video below, and join me after the break for a few more details on the process.

Continue reading “Building an OBD Speed Pulse: Behold the ICE”

Heat Pump Gets Brain Transplant; Such is Life in Latvia

If you buy a used heat pump that was made in China and try to use it in Northern Europe, there are bound to be issues. If said heat pump ends up encased in a block of ice that renders it ineffective, you’ve got two choices: give up and buy a proper heater, or hack a new ice-busting brain board into the heat pump and get back to life.

A little too icy.

[Evalds] chose the latter course, obviously, and in the process he gives us a pretty good look at how heat pumps work and how to overcome their deficiencies. In [Evalds]’ Latvia, winters can be both cold and humid, which can worsen an inherent problem with air-coupled heat pumps: they tend to ice up. As the outside coil is cooled to pick up as much heat as possible from the outside air, water vapor condenses out on the coils and freezes. Most heat pumps account for this by occasionally running in reverse, heating the outdoor coils to clear the ice buildup. [Evalds]’  had nothing more than a simple timer to kick off the defrost cycle, and it wasn’t keeping up with the Latvian winter. An Arduino replaced the OEM controller, and wired up to temperature sensors and an IR sensor that watches for ice buildup on the lower part of the coil, the heat pump is now much better behaved.

Of course it wasn’t as smooth as all that — [Evalds] has some hoops to jump through, including EMI problems and a dodgy Arduino clone. But he stuck with it and brought the heat pump back online, likely at far less expense than HVAC techs would charge for a service call.

Continue reading “Heat Pump Gets Brain Transplant; Such is Life in Latvia”

Ice, Ice, Radio Uses FPGA

Building a software defined radio (SDR) involves many trades offs. But one of the most fundamental is should you use an FPGA or a CPU to do the processing. Of course, if you are piping data to a PC, the answer is probably a CPU. But if you are doing the whole system, it is a vexing choice. The FPGA can handle lots of data all at one time but is somewhat more difficult to develop and modify. CPUs using software are flexible–especially for coding user interfaces, networking connections, and the like) but don’t always have enough horsepower to cope with signal processing tasks (and, yes, it depends on the CPU).

[Eric Brombaugh] sidestepped that trade off. He used a board with both an ARM processor and an ICE FPGA at the heart of his SDR design. He uses three custom boards: one is the CPU/FPGA board, another is a 10-bit converter that can sample at 40 MSPS (sufficient to decode to 20 MHz), and an I2S DAC to produce audio. Each board has its own page linked from the main project.

Continue reading “Ice, Ice, Radio Uses FPGA”

Binary Clock Fit For Queen Elsa’s Ice palace

When life gives you lemons, you make lemonade. When life gives you freezing cold temperatures and a yard full of snow, you make binary clocks out of ice. At least that’s what [Dennis] does, anyway.

[Dennis’] clock is made from several cylindrical blocks of ice stacked on top of one another. There are six columns of ice blocks. The blocks were made by pouring water into empty margarine containers and freezing them. Once they were frozen, [Dennis] bore a 5/16″ hole into the bottom of each block to house an LED. Wires ran from the LEDs back into the drainage port of a cooler.

The cooler housed the main electronics. The LED controller board is of [Dennis’] own design. It contains six TLC59282 chips allowing for control of up to 96 LEDs. Each chip has its output lines running to two RJ45 connectors. [Dennis] couldn’t just use one because one of the eight wires in the connector was used as a common power line. The main CPU is an Arduino. It’s hooked up to a DS3234 Real Time Clock in order to keep accurate time. The oscillator monitors temperature in order to keep accurate time even in the dead of winter. Continue reading “Binary Clock Fit For Queen Elsa’s Ice palace”

Ice record single needs six hours in the deep freeze before you can listen


This delightful marketing ploy requires the listener to fabricate their own record out of ice. The band Shout Out Louds wanted to make a splash with their newest single. So they figured out how to make a playable record out of ice. The main problem with this is the grooves start to degrade immediately when the ice begins to melt. So they shipped a mold of the record and a bottle of water to a select few listeners (just ten in all). Hear the result in the video after the break.

Now if you want to make something like this for yourself we can help you out just a bit. The mold is made of silicone and it wasn’t so long ago that we saw a guide for those new to mold making. The raw material isn’t that hard to find either. The project above tried several different approaches and found the best results can be attained with plain old distilled water. No, the one hard part is figuring out how to make your own master. If you’ve got a way of doing this in the home lab, please tells us about it!

Continue reading “Ice record single needs six hours in the deep freeze before you can listen”

How NOT to make ground-hugging fog

Poor [Todd Harrison] spent all of Saturday and Sunday trying to make some ground-hugging fog for his Halloween decor. His fog machine hack turned out to be an utter failure. But he admits it and reports that he still had a lot of fun. Don’t feel bad [Todd], this happens to everyone from time to time. And anyone that has doubts about [Todd’s] skills need not look very far to find out that he does know what he’s doing.

The project started off with a theater-style fog machine. The problem is that this fills a room with a thin foggy-haze that doesn’t take shape outdoors. He wanted that ankle-deep graveyard effect and had seen several examples online that use a fog-machine with a bucked of dry ice. He though he’d just use his own bucket full of regular ice and salt water. Inside the bucket seen above there is a 15′ coil of copper tubing through which the fog machine’s output is passed. On the other side of the bucket there’s a plastic tube that goes to a sheet of plastic meant to distribute the cooled fog.

The problem here is that the fog machine puts out a hot mist. When it hits the ice bath the mist condenses into liquid form and that’s the end of the fog. As he attests in the video after the break, the dry-ice fog hack isn’t pumping out fog. It’s just using the heated steam to pump out carbon-dioxide vapor boiling off of the dry ice.

Continue reading “How NOT to make ground-hugging fog”