We always look forward to a new blog post by [Ken Shirriff] and this latest one didn’t cure us of that. His topic this time? Comparing two Game Boy audio chips. People have noticed before that the Game Boy Color sounds very different than a classic Game Boy, and he wanted to find out why. If you know his work, you won’t be surprised to find out the comparison included stripping the die out of the IC packaging.
[Ken’s] explanation of how transistors, resistors, and capacitors appear on the die are helpfully illustrated with photomicrographs. He points out how resistors are notoriously hard to build accurately on a production IC. Many differences can affect the absolute value, so designs try not to count on exact values or, if they do, resort to things like laser trimming or other tricks.
Capacitors, however, are different. The exact value of a capacitor may be hard to guess beforehand, but the ratio of two or more capacitor values on the same chip will be very precise. This is because the dielectric — the oxide layer of the chip — will be very uniform and the photographic process controls the planar area of the capacitor plates with great precision.
We’ve decapsulated chips before, and we have to say that if you are just starting to look at chips at the die level, these big chips with bipolar transistors are much easier to deal with than the fine and dense geometries you’d find even in something like a CPU from the 1980s.
Longtime followers of [Ken Shirriff’s] work are accustomed to say asking “Where does he get such wonderful toys?”. This time around he’s laid bare the guidance computer from a Titan missile. To be specific, this is the computer that would have been found in the Titan II, an intercontinental ballistic missile that you may remember as a key part of the plot of the classic film WarGames. Yeah, those siloed nukes.
Amazingly these computers were composed of all digital logic, no centralized controller chip in this baby. That explains the need for the seven circuit boards which host a legion of logic chips, all slotting into a backplane.
But it’s not the logic that’s mind-blowing, it’s the memory. Those dark rectangles on almost every board in the image at the top of the article are impressively-dense patches of magnetic core memory. That fanout is one of two core memory modules that are found in this computer. With twelve plates per module (each hosting two bits) plus a parity bit on an additional plate, words were composed of 25-bits and the computer’s two memory modules could store a total of 16k words.
This is 1970’s tech and it’s incredible to think that when connected to the accelerometers and gyros that made up the IMU this could use dead reckoning to travel to the other side of the globe. As always, [Ken] has done an incredible job of walking through all parts of the hardware during his teardown. He even includes the contextual elements of his analysis by sharing details of this moment in history near the end of his article.
Today, most of what we think of as a computer uses digital technology. But that wasn’t always the case. From slide rules to mechanical fire solution computers to electronic analog computers, there have been plenty of computers that don’t work on 1s and 0s, but on analog quantities such as angle or voltage. [Ken Shirriff] is working to restore an analog computer from around 1969 provided by [CuriousMarc]. He’ll probably write a few posts, but this month’s one focuses on the op-amps.
For an electronic analog computer, the op-amp was the main processing element. You could feed multiple voltages in to do addition, and gain works for multiplication. If you add a capacitor, you can do integration. But there’s a problem.
When it comes to reverse engineering silicon, there’s no better person to ask than Ken Shirriff. He’s the expert at teasing the meaning out of layers of polysilicon and metal. He’s reverse engineered the ubiquitous 555 timer, he’s taken a look at the inside of old-school audio chips, and he’s found butterflies in his op-amp. Where there’s a crazy jumble of microscopic wires and layers of silicon, Ken’s there, ready to do the teardown.
For this year’s talk at the Hackaday Superconference, Ken walked everyone through the techniques for reverse engineering silicon. Surprisingly, this isn’t as hard as it sounds. Yes, you’ll still need to drop acid to get to the guts of an IC (of course, you could always find a 555 stuck in a metal can, but then you can’t say ‘dropping acid’), but even the most complex devices on the planet are still made of a few basic components. You’ve got n-doped silicon, p-doped silicon, and some metal. That’s it, and if you know what you’re looking for — like Ken does — you have all the tools you need to figure out how these integrated circuits are made.
Reverse engineering silicon is a dark art, and when you’re just starting off it’s best to stick to the lesser incantations, curses, and hexes. Hackaday caught up with Ken Shirriff at last year’s Supercon for a chat about the chip decapping and reverse engineering scene. His suggestion is to start with an old friend: the 555 timer.
Ken is well-known for his work photographing the silicon die at the heart of an Integrated Circuit (IC) and mapping out the structures to create a schematic of the circuit. We’re looking forward to Ken’s talk in just a few weeks at the Hackaday Superconference. Get a taste of it in the interview video below.
The IBM 1401 is a classic computer which IBM marketed throughout the 1960s, late enough for it to have used transistors rather than vacuum tubes, which is probably a good thing for this story. For small businesses, it was often used as their main data processing machine along with the 1403 printer. For larger businesses with mainframes, the 1401 was used to handle the slower peripherals such as that 1403 printer as well as card readers.
The Computer History Museum in Mountain View, CA has two working 1401s as well as at least one 1403 printer, and recently whenever the printer printed out a line, the computer would report a “print check” error. [Ken Shirriff] was among those who found and fixed the problem and he wrote up a detailed blog entry which takes us from the first test done to narrow down the problem, through IBM’s original logic diagrams, until finally yanking out the suspect board and finding the culprit, a germanium transistor which likely failed due to corrosion and an emitter wire that doesn’t look solidly connected. How do they know that? In the typical [Ken]-and-company style which we love, they opened up the transistor and looked at it under a microscope. We get the feeling that if they could have dug even deeper then they would have.
Most of us have been there. You build a device but realize you need two or more voltages. You could hook up multiple power supplies but that can be inconvenient and just not elegant. Alternatively, you can do something in the device itself to create the extra voltages starting with just one. When [Ken Shirriff] decapped an 8087 coprocessor to begin exploring it, he found it had that very problem. It needed: +5 V, a ground, and an additional -5 V.
His exploration starts with a smoking gun. After decapping the chip and counting out all the bond wires going to the various pads, he saw there was one too many. It wasn’t hard to see that the extra wire went to the chip’s substrate itself. This was for providing a negative bias to the substrate, something done in some high-performance chips to get increased speed, a more predictable transistor threshold voltage, and to reduce leakage current. Examining where the bond wire went to in the circuitry he found the two charge pump circuits shown in the banner image. Those worked in alternating fashion to supply a -5 V bias to the substrate, or rather around -3 V when you take into account voltage drops. Of course, he also explains the circuits and dives in deeper, including showing how the oscillations are provided to make the charge pumps work.