Email or username:

Password:

Forgot your password?
Ken Shirriff

This Soviet CMOS chip is a 4-bit counter, a copy of the Motorola MC14516B. I'll use it as an example of how to reverse engineer CMOS chips. 1/20

29 comments
Ken Shirriff

Since the chip is CMOS, it contains two complementary types of transistors—NMOS and PMOS—working together. They are built by doping silicon to form N and P regions. The NMOS transistors are constructed in a "well" of P-type silicon. 2/20

Ken Shirriff

Here's how PMOS and NMOS transistors look in this chip. The colors conveniently distinguish the N-type silicon (reddish) and P-type silicon (greenish). The transistor gates can be recognized as larger metal rectangles. 3/20

Ken Shirriff

The basic CMOS circuit is the inverter, constructed from two transistors. A 1 input turns on the NMOS transistor, pulling the output low. A 0 input turns on the PMOS transistor, pulling the output high. Thus, the input is inverted. 4/20

Ken Shirriff

Here's how an inverter looks on the die. The input is connected to the two gates. An unusual feature in this chip: power and ground come from connections to the substrate. 5/20

Ken Shirriff

The chip often combines two inverters for more output current. The resulting inverter is essentially two mirrored copies of the previous inverter. 6/20

Ken Shirriff

The outputs use much larger inverters for high current. The transistors have a serpentine arrangement so a wide transistor can fit into the available space. The square bond pad provides the connection to the outside world, once a tiny bond wire is connected to it. 7/20

Ken Shirriff

A NOR gate is similar to an inverter but uses more transistors: PMOS transistors in series and NMOS transistors in parallel. Here's 3-input NOR gate schematic and how it appears on the die. 8/20

Ken Shirriff

NAND gates are similar but put the PMOS transistors in parallel and the NMOS transistors in series. 9/20

Ken Shirriff

Complex gates such as AND-NOR can be easily constructed in CMOS. Here's one from the chip. Confusingly, another gate is interleaved between the NMOS and PMOS transistors of this gate. 10/20

Ken Shirriff

Another important circuit is the transmission gate, essentially a switch that can let a signal through. It's built from two transistors. 11/20

Ken Shirriff replied to Ken

From two transmission gates, you can build a multiplexer. This circuit selects one of the two inputs. 12/20

Ken Shirriff replied to Ken

The chip has a bunch of multiplexers squished together. It looks like a mess, but you can trace them out. 13/20

Ken Shirriff replied to Ken

The multiplexers and gates form a toggle flip-flop. The details are a bit much to explain here so see my blog post at righto.com/2024/01/reverse-eng 14/20

Ken Shirriff replied to Ken

This old chip has a single metal layer and no polysilicon. Thus, it is tricky to route signals so they don't cross. If two signals need to cross, one goes down into the silicon layer and under the metal layer of the other signal. Photos show three examples. 15/20

Ken Shirriff replied to Ken

I think the chip is a 1970s Soviet design, but I'm not sure. The wafer may be from Ukrainian manufacturing scrap. The die has a mysterious symbol that may indicate the manufacturer, but nobody could identify it.
twitter.com/kenshirriff/status 16/20

Ken Shirriff replied to Ken

The chip's part number is К561ИЕ11. Soviet ICs have a rational numbering system. 61 indicates a clone of 4000-series CMOS. И is digital, while ИЕ is a counter. So you know from the part number that the chip is a CMOS counter.
en.wikipedia.org/wiki/Soviet_i 17/20

Ken Shirriff replied to Ken

Here's a schematic of the chip from the Motorola datasheet. The four toggle flip-flops (red) count the 4 bits. To count up, toggle if a carry; toggle if a borrow to count down. The blue gates compute carry/borrow if all 1's or 0's below as appropriate, causing a toggle. 18/20

Ken Shirriff replied to Ken

This diagram shows the chip with functional blocks labeled. The four bits are arranged roughly symmetrically. The toggle logic and carry-out logic are squeezed into available space. 19/20

Ken Shirriff replied to Ken

Credit: die photo provided by Martin Evtimov. 20/20

Erin replied to Ken

@kenshirriff this reminded me of an old Zachtronics Flash game, "KOHCTPYKTOP: ENGINEER OF THE PEOPLE," which was all about putting together CMOS logic on a layered grid of pixels. I never made it very far in.
Game website zachtronics.com/kohctpyktop-en
Tutorial video for those who want to see it without trying to get Flash working youtube.com/watch?v=-7Wf7h5QlU

KCRouth 🍻

@kenshirriff - great thread, so fun to read. I so enjoy your postings!

Anthony, of course

@kenshirriff my wife has just drawn me this because I'm colourblind and I genuinely can't tell the difference between the red and green sections in the original. I thought there were two colours in the whole image, but she tells me there's three

Ken Shirriff

@anthony Sorry, unfortunately that's the way the chip looks under the microscope.

Anthony, of course

@kenshirriff oh no, please don't apologise. I love your threads (which seem to be posting sequentially properly for me now). I understand that's how it looks. I just didn't know if you were aware

Bastelwombat

@kenshirriff How come the "wire" over the channel doesn't act as a second gate?

Ken Shirriff

@bastelwombat The oxide layer is much, much thicker for the wire crossing than for the gate.

Bastelwombat

@kenshirriff I'm guessing that's a challenge when reverse engineering such a chip. What tricks are there, to overcome this?

Ken Shirriff

@bastelwombat It's not too difficult to distinguish the wire crossings from the transistor gates. In this chip, the gates are considerably wider.

Go Up