4 ms·

I have the advantage that I'm just reverse engineering the circuit to understand it; I'm not trying to re-create it. So I can just ignore transistor size, layou

by kens 10y ago

I have the advantage that I'm just reverse engineering the circuit to understand it; I'm not trying to re-create it. So I can just ignore transistor size, layout, etc :-)

nom 10y ago
Honestly, after reading the title I was hoping for an article describing a full reverse engineering :(. Still very interesting nonetheless, good work!
sillysaurus3 10y ago
I wonder how difficult it would be to re-create it in software? It'd be cool to emulate it similar to tlb's XAnalogTV. https://github.com/katahiromz/XScreenSaverWin/blob/master/non-wgl/analogtv.c https://github.com/katahiromz/XScreenSaverWin/blob/master/no... https://www.youtube.com/watch?v=_ODQ_lHRMXo https://www.youtube.com/watch?v=_ODQ_lHRMXo
- khedoros1 10y ago
  MAME's implementation shows 5 contributors. Maybe you could ask them? https://github.com/mamedev/mame/blob/master/src/devices/sound/sn76477.cpp https://github.com/mamedev/mame/blob/master/src/devices/soun... https://github.com/mamedev/mame/blob/master/src/devices/sound/sn76477.h https://github.com/mamedev/mame/blob/master/src/devices/soun...
  - buzzybee 10y ago
    AFAIK MAME's accuracy leaves a lot to be desired with respect to anything involving analog signal paths. For example, the sound system used in the Sente SAC-1 hardware is based on the CEM3394 chip, also seen in several pro synths of the era. The emulation does play sound, but last I checked, there wasn't any filter emulation, so it poorly represents the audio of those games. Edit: And I wouldn't expect the situation to change soon. Accurate analog emulation is something commercial VST plugin makers have been working on for years, and they've come "close enough for most people", but the time spent on algorithm development and optimizing CPU usage is quite high.
- squarefoot 10y ago
  Not easy, as would be even recreating it in hardware. This is the analog world where tolerances, stray capacitance and unpredictable small differences in gain or frequency response make every circuit behaviour slightly different even though it uses the same exact parts and layout. A good enough digital recreation of that circuit would be possible only if it could sample the imperfections of a real chip, and to be believable it should probably analyze a hundred chips to get what parameters are changed during production and how much.
- femto 10y ago
  That was my first thought too. My second thought was that the most effective recreation would be to build a SPICE model [1], and whether that SPICE model could run in near real time on a modern CPU. A simple SPICE model should be straightforward based on the circuits in the article. From memory, the SPICE transistor models take things such as transistor feature sizes as parameters, so it might be possible to get a surprisingly accurate model from the die photo? [1] https://en.wikipedia.org/wiki/SPICE https://en.wikipedia.org/wiki/SPICE
crb3 10y ago
Did you happen to notice how many shift-register stages made up the PRNG for the white-noise output? I'm sure I've got one of the chips on hand, so (eventually) I can 'scope the output for a good guess, but it'd be good to have a more immediate eyewitness report.
- kens 10y ago
  I figured out the shift-register circuit, but decided to write up the digital logic separately since the blog post was already very long. It's a 32-stage nonlinear feedback shift register. The sequence repeats after 56883 steps, which is a lot less than 2^32, so it seems to me they aren't making good use of the stages. The output takes a while to get going: it is high for 30 clocks and low for 31 locks before oscillating. I don't like to criticize, but it doesn't really look like a good design to me. The digital mixer is also pointlessly complex.
  - Cyph0n 10y ago
    How is it non-linear? Is it basically addition of combinational logic at feedback inputs?
    - kens 10y ago
      With a linear feedback shift register, the input is the XOR of some stage outputs. (XOR is linear when considered mathematically since it's basically bitwise addition.) If you use other logic functions, then it's nonlinear. The 76477 uses a combination of XOR and NAND, making it nonlinear. The disadvantage of a linear feedback shift register is it can get stuck at all zeros. But the 76477's shift register gets set by the inhibit line, so it couldn't get stuck. So I really don't know why they used a nonlinear circuit. As far as I can tell, it just makes the performance worse.
      - Cyph0n 10y ago
        I see, that's pretty interesting. They could have gotten a much better period had they just used a standard primitive polynomial for a 32-bit LFSR.
MegaDeKay 10y ago
Great writeup! Is there any way to determine the values of the resistors and capacitors on the die based on their geometry, or would someone have to build up a standalone circuit and experiment until coming up with something that sounded similar? Can a person at least infer one value from another by the ratio of the geometries, like one resistor being 2x another if it were twice as long? BTW, I built up a perfboard with this chip and a pile of resistors, capacitors, and potentiometers many moons ago. Just tore it down a short while ago. 76477 was also my Automated Teller Machine password for a lot of years.
- kens 10y ago
  The resistance is proportional to the length/width ratio as you suspect. You can find resistance numbers for doped silicon, but the value depends on the doping level. So you can get a rough idea. Because resistances can vary 20% from chip to chip, analog circuits generally are designed so the ratio of two resistances controls things, rather than the absolute resistance. So you probably don't need to figure out the absolute resistance.
colanderman 10y ago
Well… you can't really ignore sizes, with mixed-signal ICs. Transistor sizes determine current flow, which will ultimately determine things like pitch, duty cycle, etc. You at least need to know in differential pairs and current mirrors the ratio between the involved transistors…

by kens 10y ago

I have the advantage that I'm just reverse engineering the circuit to understand it; I'm not trying to re-create it. So I can just ignore transistor size, layout, etc :-)

nom 10y ago

Honestly, after reading the title I was hoping for an article describing a full reverse engineering :(. Still very interesting nonetheless, good work!

sillysaurus3 10y ago

I wonder how difficult it would be to re-create it in software? It'd be cool to emulate it similar to tlb's XAnalogTV. https://github.com/katahiromz/XScreenSaverWin/blob/master/non-wgl/analogtv.c https://github.com/katahiromz/XScreenSaverWin/blob/master/no... https://www.youtube.com/watch?v=_ODQ_lHRMXo https://www.youtube.com/watch?v=_ODQ_lHRMXo

khedoros1 10y ago
MAME's implementation shows 5 contributors. Maybe you could ask them? https://github.com/mamedev/mame/blob/master/src/devices/sound/sn76477.cpp https://github.com/mamedev/mame/blob/master/src/devices/soun... https://github.com/mamedev/mame/blob/master/src/devices/sound/sn76477.h https://github.com/mamedev/mame/blob/master/src/devices/soun...
- buzzybee 10y ago
  AFAIK MAME's accuracy leaves a lot to be desired with respect to anything involving analog signal paths. For example, the sound system used in the Sente SAC-1 hardware is based on the CEM3394 chip, also seen in several pro synths of the era. The emulation does play sound, but last I checked, there wasn't any filter emulation, so it poorly represents the audio of those games. Edit: And I wouldn't expect the situation to change soon. Accurate analog emulation is something commercial VST plugin makers have been working on for years, and they've come "close enough for most people", but the time spent on algorithm development and optimizing CPU usage is quite high.
squarefoot 10y ago
Not easy, as would be even recreating it in hardware. This is the analog world where tolerances, stray capacitance and unpredictable small differences in gain or frequency response make every circuit behaviour slightly different even though it uses the same exact parts and layout. A good enough digital recreation of that circuit would be possible only if it could sample the imperfections of a real chip, and to be believable it should probably analyze a hundred chips to get what parameters are changed during production and how much.
femto 10y ago
That was my first thought too. My second thought was that the most effective recreation would be to build a SPICE model [1], and whether that SPICE model could run in near real time on a modern CPU. A simple SPICE model should be straightforward based on the circuits in the article. From memory, the SPICE transistor models take things such as transistor feature sizes as parameters, so it might be possible to get a surprisingly accurate model from the die photo? [1] https://en.wikipedia.org/wiki/SPICE https://en.wikipedia.org/wiki/SPICE

crb3 10y ago

Did you happen to notice how many shift-register stages made up the PRNG for the white-noise output? I'm sure I've got one of the chips on hand, so (eventually) I can 'scope the output for a good guess, but it'd be good to have a more immediate eyewitness report.

kens 10y ago
I figured out the shift-register circuit, but decided to write up the digital logic separately since the blog post was already very long. It's a 32-stage nonlinear feedback shift register. The sequence repeats after 56883 steps, which is a lot less than 2^32, so it seems to me they aren't making good use of the stages. The output takes a while to get going: it is high for 30 clocks and low for 31 locks before oscillating. I don't like to criticize, but it doesn't really look like a good design to me. The digital mixer is also pointlessly complex.
- Cyph0n 10y ago
  How is it non-linear? Is it basically addition of combinational logic at feedback inputs?
  - kens 10y ago
    With a linear feedback shift register, the input is the XOR of some stage outputs. (XOR is linear when considered mathematically since it's basically bitwise addition.) If you use other logic functions, then it's nonlinear. The 76477 uses a combination of XOR and NAND, making it nonlinear. The disadvantage of a linear feedback shift register is it can get stuck at all zeros. But the 76477's shift register gets set by the inhibit line, so it couldn't get stuck. So I really don't know why they used a nonlinear circuit. As far as I can tell, it just makes the performance worse.
    - Cyph0n 10y ago
      I see, that's pretty interesting. They could have gotten a much better period had they just used a standard primitive polynomial for a 32-bit LFSR.

MegaDeKay 10y ago

Great writeup! Is there any way to determine the values of the resistors and capacitors on the die based on their geometry, or would someone have to build up a standalone circuit and experiment until coming up with something that sounded similar? Can a person at least infer one value from another by the ratio of the geometries, like one resistor being 2x another if it were twice as long? BTW, I built up a perfboard with this chip and a pile of resistors, capacitors, and potentiometers many moons ago. Just tore it down a short while ago. 76477 was also my Automated Teller Machine password for a lot of years.

kens 10y ago
The resistance is proportional to the length/width ratio as you suspect. You can find resistance numbers for doped silicon, but the value depends on the doping level. So you can get a rough idea. Because resistances can vary 20% from chip to chip, analog circuits generally are designed so the ratio of two resistances controls things, rather than the absolute resistance. So you probably don't need to figure out the absolute resistance.

colanderman 10y ago

Well… you can't really ignore sizes, with mixed-signal ICs. Transistor sizes determine current flow, which will ultimately determine things like pitch, duty cycle, etc. You at least need to know in differential pairs and current mirrors the ratio between the involved transistors…