Logic gates extraction

The technology

We need to set the stage first for this post. The VLM5030 is built from depletion-load NMOS logic. This means there are basically two types of devices:

  • Enhancement-mode NMOS transistors for shorting a node to GND (or forwarding voltage between two nodes)
  • Depletion-mode NMOS transistors to act as pull-ups to VDD

In addition, there are a total of three layers to connect devices in decreasing order or conductivity:

  • Metal (red) for general signal routing and VDD & GND distribution
  • Polysilicon (orange) for general signal routing and transistor gates
  • Diffusion (transparent) for routing over small distances or of uncritical signals

Layers are interconnected with vias:

  • Metal to polysilicon
  • Metal to diffusion

A remarkable item is that the VLM5030 doesn’t connect polysilicon directly to diffusion. Consequently, whenever a signal needs to change from polysilicon to diffusion or vice versa, there’s first a via from polysilicon to metal and next to it a second via connecting metal to diffusion. Other chips like the MOS6502 solve this with buried contacts that allow direct connections between polysilicon and diffusion. So Sanyo used a less advanced technology, probably to save on cost per wafer. But it actually helps the tracing task since the layer change is pretty obvious this way.

Basic logic gates

To understand which kind of logic gate is built by a particular group of transistors, apply the following basic tracing procedure:

  1. Start from the GND metal
  2. Follow the path(s) along the enhancement-mode transistors
  3. Stop at the pull-up transistor
Basic logic gates NOT, NAND, NOR, XOR. Layout and schematic

Tracing procedure applied to basic logic gates

The pull-up transistor acts as termination, so there must always exist one in a gate; not zero, not two, exactly one. It corresponds to the gate’s dot.

This aspect is important for tracing – the logic gate is incomplete without a pull-up.

Randomness on a microscopic level

Quite a couple of Konami cores use the VLM5030 chip to generate human-like speech for in-game effects. While the replacement design created for the replay library does its job, it still falls behind the audio of an original chip. This is mainly due to the fact that the design was built based on MAME’s C model without detailed information of the chip’s (micro) architecture.

One of the obvious omissions is the random source that adds noise for unvoiced samples. It’s a TODO in the MAME driver and for the replacement design I went for an off-the-shelf LFSR, but it was a kludge from day 1.

Fortunately, the VLM5030 went through decapping and photographing at siliconpr0n in the past. Much of the analysis went into the MAME driver, except for the random source obviously. Thus I headed on to retrieve this bit from the design as well. Reading anything out of the die shot was hard in the beginning – the days when I worked on chip layouts are long gone and much is forgotten. As memory slowly came back, things went smoother day by day and I was able trace & capture some of the low hanging fruits for starters. E.g the central clock generation and some data path blocks.

Finding the random source was a bit like searching for the needle in a haystack since many counters and FSM state registers are actually implemented as LFSRs in the chip. Observing that LFSRs are very common in full-custom design style of that era was an interesting piece in the puzzle. Nowadays, such circuits are modeled with HDLs that automatically select implementation styles and state encodings. But using LFSRs instead of plain registers with a combinatorial fan-in cone keeps the gate count low. That’s especially nice if you have to design and layout each gate manually with little CAD support (I guess).

Long story short – probably the 4th or 5th LFSR turned out to be the one that generates randomness. It’s built from the cells inside the shaded area:

The 10 regular patterns on the left side are positive-edge-triggered D flip-flops forming the shift register chain. The 4 logic cells on the bottom right generate clock, reset and the feedback function.

Register 2 and 9 are tapped for the XOR and a 1 is forced in case all shift positions except 9 are 0:

    +->|0|-->|1|-->|2|-+>|3|-->|4|-->|5|-->|6|-->|7|-->|8|-->|9|-+-->  "random bit"
    |                  |                                         |
    |           /--|---+                                         |
    |   /--|---|XOR|                                             |
    +--|OR |    \--|---------------------------------------------+
        \--|--- "bits 0 to 8 are 0"

NOTE: Active RST shifts 0 into the LFSR.


It’s-a me, Mario!

Nintendo entertainment system console with controller

Nintendo Entertainment System – Evan Amos

There has been quite a lot of work going on in the background with the FPGA Arcade project, not the least of which is a host of new core releases.

As you may have guessed from the image, the NES is now available for the Replay and MKR Vidor4000 platforms. This version of the NES core includes a transistor net-list based 6502 by Andrew Holme.

For FPGA capacity reasons, the Vidor4000 release of the NES has been split into 3 separate cores by mapper: MMC, VRC and Others, with PAL and NTSC versions for each. R1 users can enjoy all the mappers in a single core.

There’s also been a number of new Arcade cores released including Track&Field and its sequel Hypersports; Tutankham, Time Pilot, Donkey Kong and more…

Further information can be found in the FAQ section. All the latest stable core releases for supported platforms are available for download from the releases site and if you’re the adventurous sort, continuous development builds via the CI build server.

There’s also a number of further exciting developments to share, but that’s for a future post.

Acorn Electron Core

A little over 34 years ago, Acorn Computers Ltd released a budget version of the BBC Micro, the Acorn Electron. For a time it was apparently the best selling Micro in the United Kingdom, although in more recent years the Electron seems to be overshadowed by its big brother the BBC Micro.

Acorn Electron Elite

Elite running on the acorn electron core.

This often overlooked Micro is now available as a core for the Replay. The core is fully functional allowing hundreds of games and applications to be loaded from "cassette" including the revolutionary Elite, the game that for many changed everything. Development work is on-going to improve accuracy.

Download: BinarySource