6 ms·

Reverse Engineering the PLA Chip in the Commodore 128

171 points by segfaultbuserr 6y ago

tyingq 6y ago
Nice work. These things, and also PAL and/or GAL chips are in a lot of older computers, and have to be cannibalized from another computer to replace. For the PAL/GAL chips, an automated "fuzzer" type rig to reverse engineer them would be nice to have.
ohazi 6y ago
Are there no flip-flops in this design? It looks small enough that you might be able to brute-force every possible input.
- kevin_thibedeau 6y ago
  The Verilog suggests it has latches. Some of the Signetics parts in this databook have latches: http://www.bitsavers.org/components/signetics/_dataBooks/1981_Integrated_Fuse_Logic.pdf.pdf http://www.bitsavers.org/components/signetics/_dataBooks/198...
- diydsp 6y ago
  appear to be two latches from the RTL. at first i was uninterested in this project since the function of the PLA is expected to be very well known. to write an emulator or do intense programming one needs to know this and I expect most of the info to do it is made available by Commodore. but then i viewed the project more deeply and realized it's more about the project as a whole, how the author made the dieshots
- tyingq 6y ago
  For some applications you also have to replicate the propagation delay accurately. A general purpose brute force rig would be useful though.
userbinator 6y ago
After quite some time reading up on silicon chip design and manufacturing and a lot of attempts I managed to come up with a schematic for this that makes sense. For those who are interested in REading IC layouts from pictures, Ken Shirriff (kens, righto.com) has a lot of great articles on his site about the process as applied to other vintage ICs: http://www.righto.com/search/label/reverse-engineering http://www.righto.com/search/label/reverse-engineering I don't read ICs much in my line of work, but the basics are very easy to understand and much of the effort involved is "mental floodfilling", whose speed varies between individuals --- even after lots of practice it takes me a bit of time to find all the edges, but I know someone who can read a die photo faster than she can draw a schematic of the area.
vaxman 6y ago
I went from "Why!!!!!?????!!!!!" when I read the headline to holy crap this is awesome when I read the article!
jcun4128 6y ago
Oh man that setup is cool the steppers moving the slide/tied to ESP Does that HDL part mean it can be fed into an FPGA?
- herio 6y ago
  Yes, I'm currently working on implementing this using a Lattice iCE40 FPGA. Not the largest or most powerful of devices but I don't need much for this and it does have a fully open source pipeline available. The other part of reverse engineering something like this is to figure out the other parameters of the chip, e.g. propagation delay, slew rate, output voltage profile etc. etc.
  - jcun4128 6y ago
    Well, it's amazing, the time focus, tracing the paths haha, the automation things sounds interesting regarding the screenshots/stepper controls, assuming that just means it moves/pans around to get all the pictures for a big stitch? Anyway it's really cool.
rwmj 6y ago
What was the PLA used for? From the scant information (and obviously the name) it seems to have been a general purpose logic array. Was it programmable at run time or factory-programmed for a single purpose like the ULA in the Sinclair ZX81?
- herio 6y ago
  Author here. The PLA in both the C64 and the C128 are primarily used to generate chip select signals for the chips that are connected on the system buses. On the C128 it is also involved in the DRAM refresh handling. The C64 PLA was originally a programmable device, the Signetics 82S100. Later version were MOS/CSG copies of the same device but programmed with changes to the manufacturing masks instead, similar to the difference between an EPROM and a Mask ROM. For a lot more detail and background, I can recommend reading Thomas Giesels excellent paper on the C64 PLA, found at http://skoe.de/docs/c64-dissected/pla/c64_pla_dissected_a4ds.pdf http://skoe.de/docs/c64-dissected/pla/c64_pla_dissected_a4ds...
  - rwmj 6y ago
    Why did they design a PLA and then use it like this rather than going a bit further and designing an ASIC? I guess because MOS sold the same PLA to other people?
    - herio 6y ago
      The C128 PLA chip is in essence an ASIC. It's using a PLA design but it's only programmable during the mask creation. Using a PLA logic array is just a very efficient way of achieving the design that they wanted. I don't think they sold them to other companies, MOS was at this stage fully part of Commodore. Commodore was really big on vertical integration, they didn't like buying components from other companies if they could help it. They even manufactured a few 74xx logic chips sometimes used in their 8-bit computers.
    - segfaultbuserr 6y ago
      It is an ASIC. > A gate array is an approach to the design and manufacture of application-specific integrated circuits (ASICs) using a prefabricated chip with components that are later interconnected into logic devices (e.g. NAND gates, flip-flops, etc.) according to a custom order by adding metal interconnect layers in the factory. https://en.wikipedia.org/wiki/Gate_array https://en.wikipedia.org/wiki/Gate_array PLA's job is simple: it basically contains a lot of combinational logic, transforming some inputs to some outputs. It generates a CS output based on a memory address and bus signals, it's just an address decoder, you can build the decoder using a large number of logic gates, but it gets messy and expensive. You can build a full-custom ASIC for it, but it's expensive and unnecessary. The point of PLA is allowing one to create a custom logic circuit to replace combinational logic by burning the logic on a general template, it was the right tool for the job. Even today, modern equivalents of PLAs are still used. Some companies provide FPGA-to-ASIC conversion service using mask-programmable array, it allows you to burn your FPGA design to the silicon for a moderate performance boost, without the complication of ASIC redesign.
Jaruzel 6y ago
The C64 retro market is well catered for, and there are already C64 PLA replacement options available. However, the C128 market is no where near as popular, so it's really nice to see it be given some love by this project. As someone who recently had to purchase a couple of PLAs for a C128 that I'm trying to fix, I can only applaud this effort!
nic_wilson 6y ago
Was confused at first what a People's Liberation Army chip was doing in the C128. (https://en.wikipedia.org/wiki/People%27s_Liberation_Army https://en.wikipedia.org/wiki/People%27s_Liberation_Army) I always admire folks who can dive deep on something obscure like this.
- MaxBarraclough 6y ago
  Same here. In this context of course it's Programmable Logic Array.
sedatk 6y ago
Did they reverse engineer SID yet?

Nice work. These things, and also PAL and/or GAL chips are in a lot of older computers, and have to be cannibalized from another computer to replace. For the PAL/GAL chips, an automated "fuzzer" type rig to reverse engineer them would be nice to have.

ohazi 6y ago

Are there no flip-flops in this design? It looks small enough that you might be able to brute-force every possible input.

kevin_thibedeau 6y ago
The Verilog suggests it has latches. Some of the Signetics parts in this databook have latches: http://www.bitsavers.org/components/signetics/_dataBooks/1981_Integrated_Fuse_Logic.pdf.pdf http://www.bitsavers.org/components/signetics/_dataBooks/198...
diydsp 6y ago
appear to be two latches from the RTL. at first i was uninterested in this project since the function of the PLA is expected to be very well known. to write an emulator or do intense programming one needs to know this and I expect most of the info to do it is made available by Commodore. but then i viewed the project more deeply and realized it's more about the project as a whole, how the author made the dieshots
tyingq 6y ago
For some applications you also have to replicate the propagation delay accurately. A general purpose brute force rig would be useful though.

userbinator 6y ago

After quite some time reading up on silicon chip design and manufacturing and a lot of attempts I managed to come up with a schematic for this that makes sense. For those who are interested in REading IC layouts from pictures, Ken Shirriff (kens, righto.com) has a lot of great articles on his site about the process as applied to other vintage ICs: http://www.righto.com/search/label/reverse-engineering http://www.righto.com/search/label/reverse-engineering I don't read ICs much in my line of work, but the basics are very easy to understand and much of the effort involved is "mental floodfilling", whose speed varies between individuals --- even after lots of practice it takes me a bit of time to find all the edges, but I know someone who can read a die photo faster than she can draw a schematic of the area.

vaxman 6y ago

I went from "Why!!!!!?????!!!!!" when I read the headline to holy crap this is awesome when I read the article!

jcun4128 6y ago

Oh man that setup is cool the steppers moving the slide/tied to ESP Does that HDL part mean it can be fed into an FPGA?

herio 6y ago
Yes, I'm currently working on implementing this using a Lattice iCE40 FPGA. Not the largest or most powerful of devices but I don't need much for this and it does have a fully open source pipeline available. The other part of reverse engineering something like this is to figure out the other parameters of the chip, e.g. propagation delay, slew rate, output voltage profile etc. etc.
- jcun4128 6y ago
  Well, it's amazing, the time focus, tracing the paths haha, the automation things sounds interesting regarding the screenshots/stepper controls, assuming that just means it moves/pans around to get all the pictures for a big stitch? Anyway it's really cool.

rwmj 6y ago

What was the PLA used for? From the scant information (and obviously the name) it seems to have been a general purpose logic array. Was it programmable at run time or factory-programmed for a single purpose like the ULA in the Sinclair ZX81?

herio 6y ago
Author here. The PLA in both the C64 and the C128 are primarily used to generate chip select signals for the chips that are connected on the system buses. On the C128 it is also involved in the DRAM refresh handling. The C64 PLA was originally a programmable device, the Signetics 82S100. Later version were MOS/CSG copies of the same device but programmed with changes to the manufacturing masks instead, similar to the difference between an EPROM and a Mask ROM. For a lot more detail and background, I can recommend reading Thomas Giesels excellent paper on the C64 PLA, found at http://skoe.de/docs/c64-dissected/pla/c64_pla_dissected_a4ds.pdf http://skoe.de/docs/c64-dissected/pla/c64_pla_dissected_a4ds...
- rwmj 6y ago
  Why did they design a PLA and then use it like this rather than going a bit further and designing an ASIC? I guess because MOS sold the same PLA to other people?
  - herio 6y ago
    The C128 PLA chip is in essence an ASIC. It's using a PLA design but it's only programmable during the mask creation. Using a PLA logic array is just a very efficient way of achieving the design that they wanted. I don't think they sold them to other companies, MOS was at this stage fully part of Commodore. Commodore was really big on vertical integration, they didn't like buying components from other companies if they could help it. They even manufactured a few 74xx logic chips sometimes used in their 8-bit computers.
  - segfaultbuserr 6y ago
    It is an ASIC. > A gate array is an approach to the design and manufacture of application-specific integrated circuits (ASICs) using a prefabricated chip with components that are later interconnected into logic devices (e.g. NAND gates, flip-flops, etc.) according to a custom order by adding metal interconnect layers in the factory. https://en.wikipedia.org/wiki/Gate_array https://en.wikipedia.org/wiki/Gate_array PLA's job is simple: it basically contains a lot of combinational logic, transforming some inputs to some outputs. It generates a CS output based on a memory address and bus signals, it's just an address decoder, you can build the decoder using a large number of logic gates, but it gets messy and expensive. You can build a full-custom ASIC for it, but it's expensive and unnecessary. The point of PLA is allowing one to create a custom logic circuit to replace combinational logic by burning the logic on a general template, it was the right tool for the job. Even today, modern equivalents of PLAs are still used. Some companies provide FPGA-to-ASIC conversion service using mask-programmable array, it allows you to burn your FPGA design to the silicon for a moderate performance boost, without the complication of ASIC redesign.

Jaruzel 6y ago

The C64 retro market is well catered for, and there are already C64 PLA replacement options available. However, the C128 market is no where near as popular, so it's really nice to see it be given some love by this project. As someone who recently had to purchase a couple of PLAs for a C128 that I'm trying to fix, I can only applaud this effort!

nic_wilson 6y ago

Was confused at first what a People's Liberation Army chip was doing in the C128. (https://en.wikipedia.org/wiki/People%27s_Liberation_Army https://en.wikipedia.org/wiki/People%27s_Liberation_Army) I always admire folks who can dive deep on something obscure like this.

MaxBarraclough 6y ago
Same here. In this context of course it's Programmable Logic Array.

sedatk 6y ago

Did they reverse engineer SID yet?