Inside An Oscillator With [Ken Shirriff]

February 21, 2021 by Al Williams 13 Comments

We are always glad to see [Ken Shirriff] tear into something new and this month he’s looking inside a quartz oscillator module. Offhand, you’d think there’s not much to these. A slab of quartz and some sort of inverter, right? But as [Ken] mentions, “There’s more happening in the module than I expected…”

If you’ve ever wanted to decap devices, big hybrid modules like these are a good way to get started since you don’t need exotic chemicals to get at the insides. [Ken] managed to break the fragile crystal wafer on the way in. Inside was also a small CMOS IC die. Time to get out the microscope.

If you follow [Ken’s] blog, you know he’s no stranger to analyzing IC dice. The oscillator IC is a pretty standard Colpitts oscillator but it also provides a programmable divider and output drive.

The circuit uses some unusually configured capacitors. [Ken] takes the time to point out CMOS logic structures throughout. If you haven’t seen one of [Ken’s] deep dives before, before, it’s a great introduction.

You can learn more about crystal oscillator theory. We used some test equipment to characterize a crystal a few years ago.

Reverse Engineering Silicon From The First Pocket Calculator

December 29, 2020 by Jenny List 4 Comments

We’ve seen so many explorations of older semiconductors at the hands of [Ken Shirriff], that we know enough to expect a good read when he releases a new one. His latest doesn’t disappoint, as he delves into the workings of one of the first hand-held electronic calculators. The Sharp EL-8 from 1969 had five MOS ICs at its heart, and among them the NRD2256 keyboard/display chip is getting the [Shirriff] treatment with a decapping and thorough reverse engineering.

The basic functions of the chip are explained more easily than might be expected since this is a relatively simple device by later standards. The fascinating part of the dissection comes in the explanation of the technology, first in introducing the reader to PMOS FETs which required a relatively high negative voltage to operate, and then in explaining its use of four-phase logic. We’re used to static logic that holds a state depending upon its inputs, but the technologies of the day all called for an output transistor that would pull unacceptable current for a calculator. Four phase logic solved this by creating dynamic gates using a four-phase clock signal, relying on the an output capacitor in the gate to hold the value. It’s a technology that lose out in the 1970s as later TTL and CMOS variants arrived that did not have the output current drain. Fascinating stuff!

[Ken] gave a talk at the Hackaday Superconference a couple of years ago, if you’ve not seen it then it’s worth a watch.

What’s Inside An FPGA? Ken Shirriff Has (Again) The Answer

September 21, 2020 by Sven Gregori 13 Comments

FPGAs are somewhat the IPv6 of integrated circuits — they’ve been around longer than you might think, they let you do awesome things that people are intrigued by initially, but they’ve never really broke out of their niches until rather recently. There’s still a bit of a myth and mystery surrounding them, and as with any technology that has grown vastly in complexity over the years, it’s sometimes best to go back to its very beginning in order to understand it. Well, who’d be better at taking an extra close look at a chip than [Ken Shirriff], so in his latest endeavor, he reverse engineered the very first FPGA known to the world: the Xilinx XC2064.

If you ever wished for a breadboard-friendly FPGA, the XC2064 can scratch that itch, although with its modest 64 configurable logic blocks, there isn’t all that much else it can do — certainly not compared to even the smallest and cheapest of its modern successors. And that’s the beauty of this chip as a reverse engineering target, there’s nothing else than the core essence of an FPGA. After introducing the general concepts of FPGAs, [Ken] (who isn’t known to be too shy to decap a chip in order to look inside) continued in known manner with die pictures in order to map the internal components’ schematics to the actual silicon and to make sense of it all. His ultimate goal: to fully understand and dissect the XC2064’s bitstream.

Of course, reverse engineering FPGA bitstreams isn’t new, and with little doubt, building a toolchain based on its results helped to put Lattice on the map in the maker community (which they didn’t seem to value at first, but still soon enough). We probably won’t see the same happening for Xilinx, but who knows what [Ken]’s up to next, and what others will make of this.

Comparing Bare Silicon On Two Game Boy Audio Chips

June 27, 2020 by Al Williams 2 Comments

We always look forward to a new blog post by [Ken Shirriff] and this latest one didn’t cure us of that. His topic this time? Comparing two Game Boy audio chips. People have noticed before that the Game Boy Color sounds very different than a classic Game Boy, and he wanted to find out why. If you know his work, you won’t be surprised to find out the comparison included stripping the die out of the IC packaging.

[Ken’s] explanation of how transistors, resistors, and capacitors appear on the die are helpfully illustrated with photomicrographs. He points out how resistors are notoriously hard to build accurately on a production IC. Many differences can affect the absolute value, so designs try not to count on exact values or, if they do, resort to things like laser trimming or other tricks.

Capacitors, however, are different. The exact value of a capacitor may be hard to guess beforehand, but the ratio of two or more capacitor values on the same chip will be very precise. This is because the dielectric — the oxide layer of the chip — will be very uniform and the photographic process controls the planar area of the capacitor plates with great precision.

We’ve decapsulated chips before, and we have to say that if you are just starting to look at chips at the die level, these big chips with bipolar transistors are much easier to deal with than the fine and dense geometries you’d find even in something like a CPU from the 1980s.

We always enjoy checking in with [Ken]. Sometime’s he’s taking apart nuclear missiles. Sometimes he is repairing an old computer. But it is always interesting.

Ken Shirriff Unfolds A Nuclear Missile Guidance Computer With Impressive Memory

March 25, 2020 by Mike Szczys 13 Comments

Longtime followers of [Ken Shirriff’s] work are accustomed to say asking “Where does he get such wonderful toys?”. This time around he’s laid bare the guidance computer from a Titan missile. To be specific, this is the computer that would have been found in the Titan II, an intercontinental ballistic missile that you may remember as a key part of the plot of the classic film WarGames. Yeah, those siloed nukes.

Amazingly these computers were composed of all digital logic, no centralized controller chip in this baby. That explains the need for the seven circuit boards which host a legion of logic chips, all slotting into a backplane.

But it’s not the logic that’s mind-blowing, it’s the memory. Those dark rectangles on almost every board in the image at the top of the article are impressively-dense patches of magnetic core memory. That fanout is one of two core memory modules that are found in this computer. With twelve plates per module (each hosting two bits) plus a parity bit on an additional plate, words were composed of 25-bits and the computer’s two memory modules could store a total of 16k words.

This is 1970’s tech and it’s incredible to think that when connected to the accelerometers and gyros that made up the IMU this could use dead reckoning to travel to the other side of the globe. As always, [Ken] has done an incredible job of walking through all parts of the hardware during his teardown. He even includes the contextual elements of his analysis by sharing details of this moment in history near the end of his article.

If you want to geek out a little bit more about memory storage of yore, you can get a handle on core, drum, delay lines, and more in Al Williams’ primer.

Secrets From A 1969 Analog Computer

September 23, 2019 by Al Williams 12 Comments

Today, most of what we think of as a computer uses digital technology. But that wasn’t always the case. From slide rules to mechanical fire solution computers to electronic analog computers, there have been plenty of computers that don’t work on 1s and 0s, but on analog quantities such as angle or voltage. [Ken Shirriff] is working to restore an analog computer from around 1969 provided by [CuriousMarc]. He’ll probably write a few posts, but this month’s one focuses on the op-amps.

For an electronic analog computer, the op-amp was the main processing element. You could feed multiple voltages in to do addition, and gain works for multiplication. If you add a capacitor, you can do integration. But there’s a problem.

Continue reading “Secrets From A 1969 Analog Computer” →

Ken Shirriff Explains His Techniques For Reverse Engineering Silicon

December 5, 2018 by Brian Benchoff 8 Comments

When it comes to reverse engineering silicon, there’s no better person to ask than Ken Shirriff. He’s the expert at teasing the meaning out of layers of polysilicon and metal. He’s reverse engineered the ubiquitous 555 timer, he’s taken a look at the inside of old-school audio chips, and he’s found butterflies in his op-amp. Where there’s a crazy jumble of microscopic wires and layers of silicon, Ken’s there, ready to do the teardown.

For this year’s talk at the Hackaday Superconference, Ken walked everyone through the techniques for reverse engineering silicon. Surprisingly, this isn’t as hard as it sounds. Yes, you’ll still need to drop acid to get to the guts of an IC (of course, you could always find a 555 stuck in a metal can, but then you can’t say ‘dropping acid’), but even the most complex devices on the planet are still made of a few basic components. You’ve got n-doped silicon, p-doped silicon, and some metal. That’s it, and if you know what you’re looking for — like Ken does — you have all the tools you need to figure out how these integrated circuits are made.