mmc3c decap and trace

Discuss emulation of the Nintendo Entertainment System and Famicom.

Moderator: Moderators

Post Reply
FrankWDoom
Posts: 252
Joined: Mon Jan 23, 2012 11:27 pm

mmc3c decap and trace

Post by FrankWDoom » Mon Dec 21, 2020 1:10 pm

https://twitter.com/furrtek/status/1341 ... 93442?s=19

Furrtek on twitter had decapped and traced an mmc3 and shared his work. Thought it would be of interest around here.

NewRisingSun
Posts: 1287
Joined: Thu May 19, 2005 11:30 am

Re: mmc3c decap and trace

Post by NewRisingSun » Mon Dec 21, 2020 1:32 pm

Very cool. I am not on Twitter, so if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?

Heh:
"M2 (Phi2) cleaning is a mess. Lots of delay cells involved."

lidnariq
Posts: 10273
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: mmc3c decap and trace

Post by lidnariq » Mon Dec 21, 2020 2:07 pm

What I find interesting is that the schematic, with those paths and regular grid, makes me think of modern FPGAs with their fabric.

Was the MMC3 just a ULA that they turned into a mask?

User avatar
Quietust
Posts: 1687
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Re: mmc3c decap and trace

Post by Quietust » Mon Dec 21, 2020 3:18 pm

I'd actually be interested to see the die picture, assuming it's available anywhere - regardless of how "very large and ugly" it might be belived to be, I have a feeling I'd be able to make more sense of it than the "wiring" SVG.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.

User avatar
Ben Boldt
Posts: 755
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: mmc3c decap and trace

Post by Ben Boldt » Mon Dec 21, 2020 11:07 pm

NewRisingSun wrote:
Mon Dec 21, 2020 1:32 pm
Very cool. I am not on Twitter, so if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?

Heh:
"M2 (Phi2) cleaning is a mess. Lots of delay cells involved."
You rather see RAMBO-1 than MMC5A?? :shock:

What about it intrigues you? The built-in fraudulent CIC? The strange scanline counter?

NewRisingSun
Posts: 1287
Joined: Thu May 19, 2005 11:30 am

Re: mmc3c decap and trace

Post by NewRisingSun » Tue Dec 22, 2020 12:38 am

Strange scanline counter, yes. There is something new to be found out about its behavior, whereas the MMC5 (thanks to your efforts) is fully-understood, as far as I am aware.

Fiskbit
Posts: 259
Joined: Sat Nov 18, 2017 9:15 pm

Re: mmc3c decap and trace

Post by Fiskbit » Tue Dec 22, 2020 4:16 pm

The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.

User avatar
Ben Boldt
Posts: 755
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: mmc3c decap and trace

Post by Ben Boldt » Tue Dec 22, 2020 8:08 pm

Fiskbit wrote:
Tue Dec 22, 2020 4:16 pm
The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
Yes and there are also some pins that have internal connections but completely unknown what they might do. Even big picture stuff like if there is more RAM in there than we know about, and then how to access it, etc.

Oziphantom
Posts: 1080
Joined: Tue Feb 07, 2017 2:03 am

Re: mmc3c decap and trace

Post by Oziphantom » Tue Dec 22, 2020 10:24 pm

lidnariq wrote:
Mon Dec 21, 2020 2:07 pm
What I find interesting is that the schematic, with those paths and regular grid, makes me think of modern FPGAs with their fabric.

Was the MMC3 just a ULA that they turned into a mask?
Looks like a ULA.

furrtek
Posts: 1
Joined: Sat Dec 26, 2020 2:36 pm

Re: mmc3c decap and trace

Post by furrtek » Wed Dec 30, 2020 2:22 pm

I suck at sharing things on forums, sorry about that.
NewRisingSun wrote:
Mon Dec 21, 2020 1:32 pm
...if he takes suggestions on what chip to decap next, might somebody suggest to him to decap the Tengen RAMBO-1 next?
I've already got several dozen small to medium dies ready for tracing, so I'd rather not add more to the list right now.

However if some are willing to do the die analysis themselves, I can do plastic package decaps easily for almost no $.
Imaging of dies smaller than 5x5mm is also possible but will take longer.
My setup doesn't provide the best image quality so don't expect anything useful for finer processes (say below 800nm) or large chips with analog stuff. The easiest are ULAs / gate arrays, and old standard cell based chips.
Can't do delayering either, so forget about chips with more than 2 metal layers.
lidnariq wrote:
Mon Dec 21, 2020 2:07 pm
Was the MMC3 just a ULA that they turned into a mask?
It's literally an ULA. It partially matches some parts from the NEC uPD65000 series.
Quietust wrote:
Mon Dec 21, 2020 3:18 pm
I'd actually be interested to see the die picture, assuming it's available anywhere - regardless of how "very large and ugly" it might be belived to be, I have a feeling I'd be able to make more sense of it than the "wiring" SVG.
The svg file isn't very useful without the die pic indeed. I'll try to get a stitch done next week.
Did you see https://github.com/furrtek/VGChips/blob ... matics.PDF ?
Can't guarantee that it's error-free, but everything seems to match the register descriptions on the wiki at least.
Fiskbit wrote:
Tue Dec 22, 2020 4:16 pm
The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
@muramasa_ninja on Twatter offered to send an MMC5, if taking a peek in it would be useful.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.

User avatar
Quietust
Posts: 1687
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Re: mmc3c decap and trace

Post by Quietust » Wed Dec 30, 2020 3:20 pm

furrtek wrote:
Wed Dec 30, 2020 2:22 pm
However if some are willing to do the die analysis themselves, I can do plastic package decaps easily for almost no $.
Imaging of dies smaller than 5x5mm is also possible but will take longer.
My setup doesn't provide the best image quality so don't expect anything useful for finer processes (say below 800nm) or large chips with analog stuff. The easiest are ULAs / gate arrays, and old standard cell based chips.
I'm fine with doing the tracing+analysis myself - I've done the RP2A03G and RP2C02G already, and I can't imagine most NES mappers being anywhere near that complex.

Granted, I've only ever done NMOS chips - CMOS is a totally different beast, and I haven't yet learned how to read such circuits.
furrtek wrote:
Wed Dec 30, 2020 2:22 pm
Can't do delayering either, so forget about chips with more than 2 metal layers.
What about chips with just 1 metal layer? Can you still remove that without destroying the polysilicon underneath?
furrtek wrote:
Wed Dec 30, 2020 2:22 pm
@muramasa_ninja on Twatter offered to send an MMC5, if taking a peek in it would be useful.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.
About 9 years ago, we had a pretty good idea of how the NES CPU and PPU worked, but I didn't let that stop me from making the Visual 2A03 and Visual 2C02, and we certainly discovered quite a few interesting things from them that we probably never would've figured out otherwise.

Most emulator developers are content with being able to emulate all existing games enough to be playable, but some of us actually want to know exactly how they work.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.

NewRisingSun
Posts: 1287
Joined: Thu May 19, 2005 11:30 am

Re: mmc3c decap and trace

Post by NewRisingSun » Wed Dec 30, 2020 3:30 pm

How difficult is it to decap and analyse a globtop-only ASIC, such as J.Y. Company's ASIC?

User avatar
Ben Boldt
Posts: 755
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: mmc3c decap and trace

Post by Ben Boldt » Thu Dec 31, 2020 11:44 am

Quietust wrote:
Wed Dec 30, 2020 3:20 pm
About 9 years ago, we had a pretty good idea of how the NES CPU and PPU worked, but I didn't let that stop me from making the Visual 2A03 and Visual 2C02, and we certainly discovered quite a few interesting things from them that we probably never would've figured out otherwise.

Most emulator developers are content with being able to emulate all existing games enough to be playable, but some of us actually want to know exactly how they work.
You make a great point Quietust. Even considering MMC3, we already know enough to have good emulation of this chip but seeing a decap is super valuable to finally solve some mysteries and confirm any and all assumptions we have made. It basically improves our understanding and makes everything better.
furrtek wrote:
Wed Dec 30, 2020 2:22 pm
Fiskbit wrote:
Tue Dec 22, 2020 4:16 pm
The reason for MMC5's snooping on accesses to $2002, $2005, $2006 (MMC5A), and $4014 isn't known, and MMC5A appears to respond to writes to $5800-5BFF for unknown reasons. Definitely still some mysteries, though nothing that likely matters for existing games.
@muramasa_ninja on Twatter offered to send an MMC5, if taking a peek in it would be useful.
If it's just out of curiosity and doesn't solve any emulation problems, then it might not be a great idea to spend hundreds of hours on it.
I think it would be really cool to see MMC5, especially MMC5A. There are so many curiosities with that chip. I don't really know what I am looking at when I look at decap photos but I will learn and help with it.

User avatar
Quietust
Posts: 1687
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Re: mmc3c decap and trace

Post by Quietust » Thu Dec 31, 2020 12:31 pm

I'd be interested to know what the date code was on that MMC3C, since this new picture from furrtek's GitHub repo pretty conclusively illustrates that the MMC3C was CMOS (with 2 metal layers, no less), and the MMC3's been around for a lot longer than the MMC5 (which lidnariq seemed convinced was NMOS).

If we do want to decap an MMC5, we should probably use an older one (e.g. with a 1989 date code), otherwise we might end up with a multi-metal-layer CMOS chip that'd be very difficult to analyze; I also very strongly suspect the MMC5A would fall into that category and might not be worth attempting.

It might also be interesting to decap an MMC3A and/or MMC3B - I'm guessing the MMC3A was NMOS and that the conversion to CMOS is what caused the IRQ counter's "zero" behavior to change (from a single interrupt total to one interrupt per scanline).
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.

Post Reply