Gregory's ServerThis Soviet CMOS chip is a 4-bit counter, a copy of the Motorola MC14516B. I'll use it as an example of how to reverse engineer CMOS chips. 1/20
 29 comments
Here's how PMOS and NMOS transistors look in this chip. The colors conveniently distinguish the N-type silicon (reddish) and P-type silicon (greenish). The transistor gates can be recognized as larger metal rectangles. 3/20 The basic CMOS circuit is the inverter, constructed from two transistors. A 1 input turns on the NMOS transistor, pulling the output low. A 0 input turns on the PMOS transistor, pulling the output high. Thus, the input is inverted. 4/20 Here's how an inverter looks on the die. The input is connected to the two gates. An unusual feature in this chip: power and ground come from connections to the substrate. 5/20 The chip often combines two inverters for more output current. The resulting inverter is essentially two mirrored copies of the previous inverter. 6/20 The outputs use much larger inverters for high current. The transistors have a serpentine arrangement so a wide transistor can fit into the available space. The square bond pad provides the connection to the outside world, once a tiny bond wire is connected to it. 7/20 A NOR gate is similar to an inverter but uses more transistors: PMOS transistors in series and NMOS transistors in parallel. Here's 3-input NOR gate schematic and how it appears on the die. 8/20 NAND gates are similar but put the PMOS transistors in parallel and the NMOS transistors in series. 9/20 Complex gates such as AND-NOR can be easily constructed in CMOS. Here's one from the chip. Confusingly, another gate is interleaved between the NMOS and PMOS transistors of this gate. 10/20 Another important circuit is the transmission gate, essentially a switch that can let a signal through. It's built from two transistors. 11/20 From two transmission gates, you can build a multiplexer. This circuit selects one of the two inputs. 12/20 The chip has a bunch of multiplexers squished together. It looks like a mess, but you can trace them out. 13/20 The multiplexers and gates form a toggle flip-flop. The details are a bit much to explain here so see my blog post at https://www.righto.com/2024/01/reverse-engineering-cmos.html 14/20 This old chip has a single metal layer and no polysilicon. Thus, it is tricky to route signals so they don't cross. If two signals need to cross, one goes down into the silicon layer and under the metal layer of the other signal. Photos show three examples. 15/20 I think the chip is a 1970s Soviet design, but I'm not sure. The wafer may be from Ukrainian manufacturing scrap. The die has a mysterious symbol that may indicate the manufacturer, but nobody could identify it. The chip's part number is К561ИЕ11. Soviet ICs have a rational numbering system. 61 indicates a clone of 4000-series CMOS. И is digital, while ИЕ is a counter. So you know from the part number that the chip is a CMOS counter. Here's a schematic of the chip from the Motorola datasheet. The four toggle flip-flops (red) count the 4 bits. To count up, toggle if a carry; toggle if a borrow to count down. The blue gates compute carry/borrow if all 1's or 0's below as appropriate, causing a toggle. 18/20 This diagram shows the chip with functional blocks labeled. The four bits are arranged roughly symmetrically. The toggle logic and carry-out logic are squeezed into available space. 19/20  @kenshirriff this reminded me of an old Zachtronics Flash game, "KOHCTPYKTOP: ENGINEER OF THE PEOPLE," which was all about putting together CMOS logic on a layered grid of pixels. I never made it very far in.  @kenshirriff my wife has just drawn me this because I'm colourblind and I genuinely can't tell the difference between the red and green sections in the original. I thought there were two colours in the whole image, but she tells me there's three @kenshirriff oh no, please don't apologise. I love your threads (which seem to be posting sequentially properly for me now). I understand that's how it looks. I just didn't know if you were aware @bastelwombat The oxide layer is much, much thicker for the wire crossing than for the gate. @kenshirriff I'm guessing that's a challenge when reverse engineering such a chip. What tricks are there, to overcome this? @bastelwombat It's not too difficult to distinguish the wire crossings from the transistor gates. In this chip, the gates are considerably wider. |
Since the chip is CMOS, it contains two complementary types of transistors—NMOS and PMOS—working together. They are built by doping silicon to form N and P regions. The NMOS transistors are constructed in a "well" of P-type silicon. 2/20