TL;DR: [GitHub project] with PDF schematic, datasheet, and KiCad schematic.
I was inspired by Ken Shirriff's 2016 Hackaday Superconference talk [video] [Hackaday write-up] to try to reverse engineer a chip from its die photo. Ken recommended going to Zeptobars, downloading a die image, and diving right in, so I did.
I chose a digital chip that wasn't too complicated, and a BCD-to-7 segment decoder seemed ideal, and the [datasheet] already gives the pinout and function, so I wouldn't have to start from zero.
To give you an idea of what it was like when I started, here's a low-resolution image of the die (high resolution at the above Zeptobars link):
Here's a small part of it.
What is that? The shiny stuff on the top is metal, but what are these different colors? I had no idea what I was looking at.
I stared at a pin:
Why's it blue when all the other pins are purple? What's that track running around the outside of the chip? What's that line going around it? If this is a ground, why isn't there a huge metal network coming from it?
Clearly I knew nothing.
Searching the web for VLSI tutorials didn't give me any good starting point. I just couldn't connect the textbook diagrams to what I was seeing:
I finally stumbled upon Silicon Pr0n's wiki site, which had a good, if terse and disheartening "fixme", [tutorial]. I started with the pinout section, which said that pin 1 usually had a different shape from the other pins.
Pin 1! It had a different shape from all the other pins!
So since the pins on the die have to go in the same direction as the pins on the package, I could identify the pin above it with those huge metal wings as VDD.
Excellent! Now, the datasheet showed an input equivalent circuit:
And here was an input:
I got stuck again. There's a metal contact in the middle upper part, but what's that rectangle it contacts? Why's there another small rectangle inside the larger one? And there's a kind of pinkish rectangle around the contact in the upper right, what's that all about?
I checked the tutorial again, which didn't really help. The [section on I/O] did talk about diodes on the inputs, but the image I was looking at looked nothing like the image in the tutorial.
Further on in the tutorial, it said that any pin with a pad going right to a fat transistor, but not connected to its gate, is probably an output.
Great! There's a fat transistor, two of them, both connected to the pad. A transistor, specifically a MOSFET, has its terminals connected to source and drain, and the middle terminal between them is the gate. This one has each fat transistor kind of made up of two transistors paralleled. The middle contact is the output, the inverted U-shape is the gate, and the outsides must be connected to power!
Indeed, the bottom transistor's rightmost metal bit connects to the ring around the outside of the transistor, which is also connected to the VDD pin. So this had to be a PMOS transistor. That would make the other one an NMOS transistor, forming the typical inverter-driver.
Then I tried to trace the gate back further. The only connection it made was to this structure:
And I remembered that wires in chips are not only metal, but can also be polysilicon or diffusion. Polysilicon and diffusion can also be used as resistors. Here's another output gate wire connection:
You can actually see a thin line going underneath the metal, where the rectangular area ends. Since this was much smaller than the other one, I felt pretty confident that this was just a wire, and any resistance it had was not important.
So okay, if this was a wire, let's trace it back even further.
There's another wire thing, but the gate of the driver (the metal contact on the bottom) goes right through the middle of two structures. Those must also be transistors. The top one has two gates that don't connect, while the bottom one seems to have a gate on the right and maybe a gate on the left? But the structure seems to just end at that point, so where's the corresponding other terminal?
I couldn't make any progress, so I switched back to an input.
Ignoring the fact that I couldn't figure out the diodes, I treated the input structure as a wire and moved on. This goes into two fat transistors. Clue 1 was that one of the terminals on the top one went to VDD, so that must be PMOS. Clue 2 is that PMOS transistors are usually bigger than NMOS for the same driving capacity, and this is certainly bigger than its friend on the bottom.
That meant the bottom NMOS would be connected somehow to ground. Sure enough, I traced the contact on the left of the NMOS all the way across the chip to the VSS pin.
The path jumped across this wire-jumper-looking thing and then right to the pin.
So I had identified an inverter-driver connected to an input, pin 1, which was the STROBE input. But from there the trace went all over the chip. Instead, I concentrated on pin 2, a BCD input.
I stared at this for hours. I couldn't make any sense out of it. Why did it look like the little transistors on the left had their rightmost terminals not connected to anything? Why did the bottom middle and top right transistors have gates on the end?
It occurred to me to look at the datasheet's block diagram. Of course, the datasheet didn't help with its input equivalent circuit, but I was out of ideas and the web wasn't yielding any more information.
So the inputs all had to go to a latch, latched by the strobe line. I looked online for example CMOS D-latches, and I found this:
Hmm, not a lot of help there. Then I came up with a hypothesis. Maybe the line going horizontally through the transistors was a wire. And maybe the slight overlap of the top transistors' unconnected metal actually connected to that wire. And maybe that wire connected up to VSS.
That would make the top transistors NMOS, and the bottom complementary transistors PMOS.
The next leap of faith was that the gates floating there on the ends of the transistor were really not on the ends of the transistor, but the transistor kept going. When I drew out the connections thus made, I had this:
Then I rearranged to make things look nice. This took a couple of tries.
This looked almost exactly like the D-latch, except that the input wasn't inverted first. That also fixed the connection I couldn't make out. It also meant that I now knew what OUT1 and OUT2 were: OUT1 is the input, and OUT2 is the inverted input.
With that done, it just took a few more hours (okay, a few more days) to work out the rest of the circuit and create the [schematic].
I still have open questions:
- Where are the input diodes?
- What exactly are the non-metallic wires made of?
- How could I have found that missing connection in the input latch from the die?
- How are the connections from the transistors to VCC made?
- What are those purple patches under the contacts on the wires?
- Why are VSS and VEE blue and the rest of the pins purple?
- How do the transistors that appear to have gates at their end actually connect to each other?
My next project is going to involve sending some [Unisonic 21 calculator/game] CPU ICs to Zeptobars for decapping and photographing, and then reverse engineering that. These chips are from 1978, so they might be CMOS.