HP-35 chip images and schematics

[Peter Monta]

After seeing the nice work from the Visual 6502 people (http://visual6502.org/) and the 4004 project (http://www.4004.com/), I thought it would be interesting to do something similar for the HP-35 chips. While emulators at the instruction-set level work fine, simulating the original implementation at the transistor level has a number of advantages:

- makes no assumptions about the microarchitecture---guaranteed to be bit-exact to the hardware

- can be used for cross-testing against other emulators and against the hardware

- provides complete, unambiguous documentation of the original implementation

- the derived masks can be used to make new chips

- the circuits can be automatically translated to switch-level HDL and run on FPGAs

So far I've got images of two chips (the A&R chip and one of the ROMs) and a schematic of one stage of the ROM address shift register. This is only a tiny part of the required work, but I thought I'd at least get the images out there so that anyone else who's interested can extract transistor netlists for other parts of the chips. Thumbnails of the chip images, an annotated closeup of the shift-register circuit, and the corresponding schematic are shown below.

A&R chip (AMI 1820-0848):

ROM chip (AMI 1818-0006):

ROM shift register closeup:

Schematic of the chip fragment above:

The full, high-resolution images can be found here:

http://pmonta.com/calculators/hp-35/chips/

My uplink is a DSL line, so it may be slow.

For the imaging workflow, very modest equipment was used (which was part of the fun): a $160 beginner's microscope with a generic 10x achromat objective, a hacked-up epi illuminator, an afocally-coupled Canon point-and-shoot camera running the free CHDK firmware, and hugin for image processing.

The images have some places where the focus is less than perfect. I hope to fix that in future by taking a focus series at each subimage ("focus stacking") before assembling the panorama.

[bill platt]

I learn all sorts of fantastic esoterica around here.

This one is almost postmodern art, title, "Brain Scan."

[sylvandb]

Quote:

---

So far I've got images of two chips (the A&R chip and one of the ROMs)

The full, high-resolution images can be found here:

---

Wow! Thanks! That is cool.

Here is a mirror (also on a dsl 1Mbit line).

sdb

Edited: 27 Oct 2010, 11:53 p.m.

[Ed Spittles]

Hi Peter, everyone,

nice pictures! It might be worth trying to capture the layout using the degate software: http://www.degate.org/status.html - it's actively developed so you may well want to work with the author.

As you may know, Greg James deprocessed the 6502 for visual6502 and photographed the substrate separately. So it was probably easier for him to extract the buried contacts and identify the depletion implants than it will be for you. But your pictures look very clear to me so I think you have a good chance. Although it's PMOS not NMOS, the circuit style looks comparable.

In the event, I believe automatic vectorisation wasn't up to the task for the 6502.

Let me know if you need any help with the simulator: I've become moderately familiar with the javascript - it's not big or complex, just needs some data to describe the chip. It's MIT-licensed and it's on github.

(I became involved with visual6502 at a late stage, but am spending a lot of time on it, mostly tweaking the interface, and of course studying the chip.)

(My connection with HP calculators is limited to being very impressed by an HP-16c I had briefly at work many years ago. Also had a quick play with a 15c around the same time. And at one time a colleague had a 28 which I admired from afar.)

Cheers
Ed

[Peter Monta]

Yes, I've had a look at degate. It seems like a good solution for standard-cell chips, but unfortunately there doesn't seem to be a way to extract low-level things like transistors (but I could have missed this, since I ran it for only a few minutes to get the general feel). Degate looks very good for wiring though.

So instead I've been rolling my own small tools starting from raster images. Gimp, the image editor, is convenient for editing multilayer rasters (Photoshop would probably be fine too). The original chip photo serves as background, and then I sketch in the metal, diffusion, gate, contact, etc. layers by hand as semi-opaque regions with the image underneath as a reference. Once each layer bitmap is exported to a separate file (using a Gimp script), an extractor tool extracts a netlist, then crunches on the netlist to extract transistors, gates, latches, and finally exports a Verilog netlist.

I considered using a layout editor like Magic to help with extraction, but it was just too tough to teach it about silicon-gate PMOS and deal with the geometry file-format issues.

Quote:

---

So it was probably easier for him to extract the buried contacts and identify the depletion implants than it will be for you.

---

Yes, correctly inferring all the layers from just one image is a problem. I'd prefer not to etch or mechanically delayer the chip if at all possible, and while the unetched images seem like they have a full view of everything for this technology, there are some small areas where ambiguity is possible. The layout is quite idiosyncratic in places, too: isolated areas of metal, gates with no diffusion, etc. Some areas are visibly hacked up to remove design-rule violations. Clearly a hand-drawn design.

The HP-35 ROM I'm using as a test case is silicon-gate PMOS with depletion loads. You mention identifying depletion implants: I can't see any way to do this for this chip except by context (looking for transistors with gate connected to source). There is no sign of an implant mask under the microscope, even with a 100x high-dry objective I recently got on eBay. Fortunately there are no buried contacts, since there is no poly, but even so it's sometimes tough to distinguish a contact from a gate.

Automatic vectorization is a worthy goal, but the high image quality needed for reliability is beyond my setup, I think, especially with the uncertainty and curve-balls of full custom.

Quote:

---

Although it's PMOS not NMOS, the circuit style looks comparable.

---

Fortunately the circuit style is conservative: two-phase latches and NOR gates only. (So far.)

Quote:

---

Let me know if you need any help with the simulator

---

The visual simulators are cool, but I think I'll stick with verilog for the moment. Since I'm extracting gates and latches I can live with iverilog, but if there were structures that required switch-level simulation I'd have to look at something like IRSIM or another (commercial?) Verilog simulator: iverilog, which is otherwise very good, doesn't support trireg, so the two-phase latches don't work. The latches on this chip are always phi1-inverter-phi2, so I export that whole chunk as a Verilog flip-flop.

I'll certainly keep an eye on visual6502 and the 4004 people---are there any other projects of this general type? It would be nice to have a forum for tools and data; maybe visual6502 will turn into that sort of resource, though last I checked they haven't released their low-level data yet. The existing Web resources on reverse engineering are mostly devoted to failure analysis, understandably enough, and not to recovering and running entire designs of historical interest in totally obsolete IC processes. (Step 3: profit!)

Cheers,
Peter

[Ed Spittles]

Hi Peter
I'm not aware of active reverse-engineering forums but I'm sure there are small groups here and there.

I hadn't noticed the simple nature of this process: no poly, no self-aligned gates. Only metal and diffusion for connectivity. Wow. For anyone not familiar, there's a process cross-section on this page:
http://www.david-brenner.net/2009/12/a-year-of-projects/ (see also http://www.google.co.uk/images?q=RIT+Metal+Gate+PMOS+process)

I've now tried degate, and indeed it seems to be aimed at capturing inter-cell connectivity, and only some abstraction of the cells themselves. For the 6502, a lot of the logic is free-form with not a cell in sight. I'm not sure if it's worth capturing the wiring if for some extra effort one could capture the geometry (and then extract the wiring.) The effort might be double, but that would be OK.

In passing, although visual6502 is on the face of it a visual simulator, note that there's a more conventional textual mode on a sub-page, and also that the simulation is switch-level and handles bidirectional pass gates, shared busses, and charge storage. I suppose IRSIM does too, but I'm not sure about verilog.

I think visual6502 will release more data and tools in due course.

As for the difficulty of getting accurate extracted data, Greg's approach was to simulate what he had as he progressed: if the simulation works that's a positive sign (although not a proof.)

Cheers
Ed