mmc3c decap and trace
Moderator: Moderators
-
- Posts: 260
- Joined: Mon Jan 23, 2012 11:27 pm
mmc3c decap and trace
https://twitter.com/furrtek/status/1341 ... 93442?s=19
Furrtek on twitter had decapped and traced an mmc3 and shared his work. Thought it would be of interest around here.
Furrtek on twitter had decapped and traced an mmc3 and shared his work. Thought it would be of interest around here.
-
- Posts: 1510
- Joined: Thu May 19, 2005 11:30 am
Re: mmc3c decap and trace
Very cool. I am not on Twitter, so if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?
Heh:
"M2 (Phi2) cleaning is a mess. Lots of delay cells involved."
Heh:
"M2 (Phi2) cleaning is a mess. Lots of delay cells involved."
Re: mmc3c decap and trace
What I find interesting is that the schematic, with those paths and regular grid, makes me think of modern FPGAs with their fabric.
Was the MMC3 just a ULA that they turned into a mask?
Was the MMC3 just a ULA that they turned into a mask?
Re: mmc3c decap and trace
I'd actually be interested to see the die picture, assuming it's available anywhere - regardless of how "very large and ugly" it might be belived to be, I have a feeling I'd be able to make more sense of it than the "wiring" SVG.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.
Re: mmc3c decap and trace
You rather see RAMBO-1 than MMC5A??NewRisingSun wrote: ↑Mon Dec 21, 2020 1:32 pm Very cool. I am not on Twitter, so if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?
Heh:
"M2 (Phi2) cleaning is a mess. Lots of delay cells involved."
What about it intrigues you? The built-in fraudulent CIC? The strange scanline counter?
-
- Posts: 1510
- Joined: Thu May 19, 2005 11:30 am
Re: mmc3c decap and trace
Strange scanline counter, yes. There is something new to be found out about its behavior, whereas the MMC5 (thanks to your efforts) is fully-understood, as far as I am aware.
Re: mmc3c decap and trace
The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
Re: mmc3c decap and trace
Yes and there are also some pins that have internal connections but completely unknown what they might do. Even big picture stuff like if there is more RAM in there than we know about, and then how to access it, etc.Fiskbit wrote: ↑Tue Dec 22, 2020 4:16 pm The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
-
- Posts: 1565
- Joined: Tue Feb 07, 2017 2:03 am
Re: mmc3c decap and trace
I suck at sharing things on forums, sorry about that.
However if some are willing to do the die analysis themselves, I can do plastic package decaps easily for almost no $.
Imaging of dies smaller than 5x5mm is also possible but will take longer.
My setup doesn't provide the best image quality so don't expect anything useful for finer processes (say below 800nm) or large chips with analog stuff. The easiest are ULAs / gate arrays, and old standard cell based chips.
Can't do delayering either, so forget about chips with more than 2 metal layers.
Did you see https://github.com/furrtek/VGChips/blob ... matics.PDF ?
Can't guarantee that it's error-free, but everything seems to match the register descriptions on the wiki at least.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.
I've already got several dozen small to medium dies ready for tracing, so I'd rather not add more to the list right now.NewRisingSun wrote: ↑Mon Dec 21, 2020 1:32 pm ...if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?
However if some are willing to do the die analysis themselves, I can do plastic package decaps easily for almost no $.
Imaging of dies smaller than 5x5mm is also possible but will take longer.
My setup doesn't provide the best image quality so don't expect anything useful for finer processes (say below 800nm) or large chips with analog stuff. The easiest are ULAs / gate arrays, and old standard cell based chips.
Can't do delayering either, so forget about chips with more than 2 metal layers.
It's literally an ULA. It partially matches some parts from the NEC uPD65000 series.
The svg file isn't very useful without the die pic indeed. I'll try to get a stitch done next week.
Did you see https://github.com/furrtek/VGChips/blob ... matics.PDF ?
Can't guarantee that it's error-free, but everything seems to match the register descriptions on the wiki at least.
@muramasa_ninja on Twatter offered to send an MMC5, if taking a peek in it would be useful.Fiskbit wrote: ↑Tue Dec 22, 2020 4:16 pm The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.
Re: mmc3c decap and trace
I'm fine with doing the tracing+analysis myself - I've done the RP2A03G and RP2C02G already, and I can't imagine most NES mappers being anywhere near that complex.furrtek wrote: ↑Wed Dec 30, 2020 2:22 pm However if some are willing to do the die analysis themselves, I can do plastic package decaps easily for almost no $.
Imaging of dies smaller than 5x5mm is also possible but will take longer.
My setup doesn't provide the best image quality so don't expect anything useful for finer processes (say below 800nm) or large chips with analog stuff. The easiest are ULAs / gate arrays, and old standard cell based chips.
Granted, I've only ever done NMOS chips - CMOS is a totally different beast, and I haven't yet learned how to read such circuits.
What about chips with just 1 metal layer? Can you still remove that without destroying the polysilicon underneath?
About 9 years ago, we had a pretty good idea of how the NES CPU and PPU worked, but I didn't let that stop me from making the Visual 2A03 and Visual 2C02, and we certainly discovered quite a few interesting things from them that we probably never would've figured out otherwise.
Most emulator developers are content with being able to emulate all existing games enough to be playable, but some of us actually want to know exactly how they work.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.
-
- Posts: 1510
- Joined: Thu May 19, 2005 11:30 am
Re: mmc3c decap and trace
How difficult is it to decap and analyse a globtop-only ASIC, such as J.Y. Company's ASIC?
Re: mmc3c decap and trace
You make a great point Quietust. Even considering MMC3, we already know enough to have good emulation of this chip but seeing a decap is super valuable to finally solve some mysteries and confirm any and all assumptions we have made. It basically improves our understanding and makes everything better.Quietust wrote: ↑Wed Dec 30, 2020 3:20 pm About 9 years ago, we had a pretty good idea of how the NES CPU and PPU worked, but I didn't let that stop me from making the Visual 2A03 and Visual 2C02, and we certainly discovered quite a few interesting things from them that we probably never would've figured out otherwise.
Most emulator developers are content with being able to emulate all existing games enough to be playable, but some of us actually want to know exactly how they work.
I think it would be really cool to see MMC5, especially MMC5A. There are so many curiosities with that chip. I don't really know what I am looking at when I look at decap photos but I will learn and help with it.furrtek wrote: ↑Wed Dec 30, 2020 2:22 pm@muramasa_ninja on Twatter offered to send an MMC5, if taking a peek in it would be useful.Fiskbit wrote: ↑Tue Dec 22, 2020 4:16 pm The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.
Re: mmc3c decap and trace
I'd be interested to know what the date code was on that MMC3C, since this new picture from furrtek's GitHub repo pretty conclusively illustrates that the MMC3C was CMOS (with 2 metal layers, no less), and the MMC3's been around for a lot longer than the MMC5 (which lidnariq seemed convinced was NMOS).
If we do want to decap an MMC5, we should probably use an older one (e.g. with a 1989 date code), otherwise we might end up with a multi-metal-layer CMOS chip that'd be very difficult to analyze; I also very strongly suspect the MMC5A would fall into that category and might not be worth attempting.
It might also be interesting to decap an MMC3A and/or MMC3B - I'm guessing the MMC3A was NMOS and that the conversion to CMOS is what caused the IRQ counter's "zero" behavior to change (from a single interrupt total to one interrupt per scanline).
If we do want to decap an MMC5, we should probably use an older one (e.g. with a 1989 date code), otherwise we might end up with a multi-metal-layer CMOS chip that'd be very difficult to analyze; I also very strongly suspect the MMC5A would fall into that category and might not be worth attempting.
It might also be interesting to decap an MMC3A and/or MMC3B - I'm guessing the MMC3A was NMOS and that the conversion to CMOS is what caused the IRQ counter's "zero" behavior to change (from a single interrupt total to one interrupt per scanline).
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.