A while ago I stopped working on reverse engineering the Unisonic 21. I think I was toddling after a shiny balloon. Anyway, I was recently talking with one of the creators of the MOnSter 6502 [see also Evil Mad Scientist's blog post] who mentioned he was looking for another chip to dis-integrate. I thought the Unisonic 21 CPU would make a nice target! But it needs to be fully reverse-engineered first. So, here we go again.
When we last left our reluctant hero, we had just seen a complicated circuit whose purpose was to provide a lot of oomph to create a high-powered clock driver.
Here is the full circuit:
It's pretty huge, but we already know that all that capacitor stuff in the middle of each section is just there to drive the transistors hard. Let's remove all that clutter, and also replace the other bootstrap loads with plain old resistors and see what we're left with.
OK, it's still a little cluttered. First, notice at the top that I've renamed the incoming clock signals according to the phases they are active in. This might help later.
Notice that Q16 is immediately recognizable as an inverter. That means the signal coming out of it is just P0_P1_P2: the other three of the six clock phases.
Now let's split the circuit down the middle and analyze the right half:
If we take a look at the top half, we see that P3_P4_P5 feeds the gate of Q1. Q1 is on if its gate is low, which means during P0_P1_P2. This means the signal X1 is pulled high during P0_P1_P2.
What about Q2? It is pulled high if Q11 is on, which happens when the gate of Q11 is low, which is during P0_P1_P2. But there's that pesky Q13 in there which could modify the behavior at the gate of Q2. So let's take a look at the bottom half.
The P1_P4 signal is gated at Q22 by P0_P1_P2. It will only pass if P0_P1_P2 is low, or if P3_P4_P5 is high. So the other side of Q22 is essentially P3_P4_P5 AND P1_P4, which is just P4. This is the signal Y-, which gets inverted at Q6 to form P0_P1_P2_P3_P5 at output Y1.
Now, P4 gets inverted at the gate of Q24, and then push-pull buffered at Q23/Q19, and low-buffered again at Q5. So this is still P0_P1_P2_P3_P5 at output Y1. So far, so good.
So the gate of Q13 is what comes out of Q24, which is P0_P1_P2_P3_P5. Q13 will only be on if its gate is low, which means P4.
Now look at Q11 again. It is on only if its gate is low, which means P0_P1_P2. So the signal X+ is pulled high if Q11 is on (P0_P1_P2) and low if Q13 is on (P4). The rest of the time it appears to just be floating.
However! Because Q13 has intrinsic capacitance, it will not immediately stop conducting. It will probably keep its state until some other thing drains it. So we can probably say Q13 is on, pulling the signal X+ low, during P3_P4_P5.
From this, we can talk about Q2. Q2 is on if its gate is low, which only happens on P3_P4_P5. And from before, Q1 is on if its gate is low, which means during P0_P1_P2. So in the end, we definitely have Q1/Q2 being a push-pull buffer for P0_P1_P2.
So why Q13 and not just an active load? Maybe because that would require essentially duplicating the circuit below, which requires four transistors aside from the push/pull output. The top circuit only needs two transistors.
Okay, we have reasoned out what this circuit should do. The conclusion is that signal X1 is P0_P1_P2 and signal Y1 is P0_P1_P2_P3_P5 (or /P4).
Is it what it really does? I'm dealing with unfamiliar PMOS territory here, and that appeal to Q13 retaining its state through two clock periods fills me with unease. One step to take is to actually build this circuit and see what happens. But that will be another blog post.
In the meantime, there's the left half of the circuit to deal with. It is nearly the same thing:
We can proceed in the same way, except we've already done most of this work. This circuit is identical to the right half, except that the signal feeding Q25's gate is P3_P4_P5 and the signal at X- is P0_P1_P2. But we will go through the exercise again. We start with the bottom half.
Q25 is on only if P1_P4 is high and if P3_P4_P5 is low (i.e. P0_P1_P2 is high). This means Q25 is on during P0_P1_P2 AND P1_P4, which is P1. This is signal Y-.
This is inverted by Q27, so Q27's output is /P1. Q30 is on only if /P1 is low, or during P1. And Q37 is on when Y- is low, which is during /P1, so Q30/Q37 is a push-pull buffer for /P1. This is signal Y+.
So, Q41/Q42 thus form a push-pull buffer for /P1. This is signal Y2. Note that signal Y1 was /P4.
Signal X- is low during P3_P4_P5, which pulls signal X2 high via Q44.
Q43 is on when signal X+ is low. This happens when Q29 is on, which happens when Q27 is off. This is during P1.
Q31, however, is on, pulling signal X+ high, when signal X- is low. This is during P3_P4_P5. Again, from the same reasoning, we can consider Q29 on, pulling X+ low during all other phases (especially P1 of course).
Q43 is on, pulling signal X2 low, when signal X+ is low, which is during P0_P1_P2. Q44 is on, pulling signal X2 high, when signal X- is low, which is during P3_P4_P5.
So we see that Q43/Q44 forms a push-pull buffer for P3_P4_P5. This is signal X2. Note that signal X1 was P0_P1_P2.
X1 is the opposite of X2, Y1 is a negative pulse in the middle of /X1, and Y2 is a negative pulse in the middle of /X2.
At least, this is what we hope it is. We'll just have to build the circuit and see.