Sjaak writes, “It has been a while before I posted something useful. On my search for obscure chips, I came around another interesting Chinese chip (which I don’t reveal yet). The chip was advertised as a cheap drop-in replacement for a American IC so I suspected it would be a clone. I wanted to look inside the chip to check if that is true.”
The 8087 chip provided fast floating point arithmetic for the original IBM PC and became part of the x86 architecture used today. One unusual feature of the 8087 is it contained a multi-level ROM (Read-Only Memory) that stored two bits per transistor, twice as dense as a normal ROM. Instead of storing binary data, each cell in the 8087’s ROM stored one of four different values, which were then decoded into two bits. Because the 8087 required a large ROM for microcode1 and the chip was pushing the limits of how many transistors could fit on a chip, Intel used this special technique to make the ROM fit. In this article, I explain how Intel implemented this multi-level ROM.
An excellent in-depth look at theTL084 op amp by Ken Shirriff:
Some integrated circuits have very interesting dies under a microscope, like the chip below with designs that look kind of like butterflies. These patterns are special JFET input transistors that improved the chip’s performance. This chip is a Texas Instruments TL084 quad op amp and the symmetry of the four op amps is visible in the photo. (You can also see four big irregular rectangular regions; these are capacitors to stabilize the op amps.) In this article, I describe these components and the other circuitry in the chip and explain how it works. This article also includes an interactive chip explorer that shows each schematic component on the die and explains what it does.
Last October, Next Thing Co., makers of the popular C.H.I.P. platform unleashed the C.H.I.P. Pro, a very capable Linux system on a tiny board. The goal of the C.H.I.P. Pro is to be the brains of a project or product, similar to the Gumstix boards from an ancient era long before the Raspberry Pi.
Introduced alongside the C.H.I.P. Pro was a fantastic little device. The GR8 module is a complete Linux system on a chip, with an ARM Cortex-A8 processor and 256 MB of RAM, all on a relatively small BGA chip. This is a drop-in part that gives any piece of hardware a Linux brain.
There was a datasheet at the time the C.H.I.P. Pro and GR8 module were released, but a datasheet can only go so far. What you really need to use a Linux system on a module is a massive tome filled with descriptions of registers and all the hardware nooks and crannies needed to get the part working. At CES this week, Next Thing Co. brought what everyone has been asking for: an NDA-free complete register documentation for the core they’re using on the GR8 module. This is 400 pages of spiral-bound goodness that will tell you how to do everything with this chip.
Using the C.H.I.P. for products
When the C.H.I.P. was first released, it was easy to write it off as a board glomming on to the popularity of the Raspberry Pi. However, Next Thing Co. didn’t start with the C.H.I.P. – they started with Otto, an animated gif camera built around the Raspberry Pi compute module. The Otto was successful, but the compute module is a little expensive, so Next Thing Co. turned their attention to building a modern, inexpensive version of the old Gumstix boards.
The C.H.I.P. Pro and GR8 is the culmination of this work, and already a few companies have used it in production. At the Next Thing Co. suite, they showed off a new version of the Outernet base station powered by the C.H.I.P. Pro, and the TRNTBL, a wireless, Bluetooth, Airplay, and Spotify-connected turntable.
To illustrate how easy using the C.H.I.P. Pro in a product is, the guys at Next Thing Co. removed the Pi-powered guts of an Otto and replaced it with a C.H.I.P. Pro. There wasn’t much inside – just a battery, camera module, and a few bits and bobs. That’s great for anyone who wants to build a product that needs a relatively fast chip running Linux, and the stuff from Next Thing Co. makes it easy.
[Ken Shirriff] has seen the insides of more integrated circuits than most people have seen bellybuttons. (This is an exaggeration.) But the point is, where we see a crazy jumble of circuitry, [Ken] sees a riddle to be solved, and he’s got a method that guides him through the madness.
In his talk at the 2016 Hackaday SuperConference, [Ken] stepped the audience through a number of famous chips, showing how he approaches them and how you could do the same if you wanted to, or needed to. Reading an IC from a photo is not for the faint of heart, but with a little perseverance, it can give you the keys to the kingdom. We’re stoked that [Ken] shared his methods with us, and gave us some deeper insight into a handful of classic silicon, from the Z80 processor to the 555 timer and LM7805 voltage regulator, and beyond.
Dive In: The Z80
[Ken] wastes no time and dives straight into a die shot of the Z80 8-bit CPU. He starts out by labeling the landing pads that connect to external pins by cross-referencing them with the datasheet. That tells you a lot — you know what the pins have to do, so it makes guessing use for each clusters of transistors a lot easier.
When you see a bunch of repeated tiny circuits, you’re probably looking at memory. Since the Z80 has sixteen registers in its CPU, [Ken] goes looking for sixteen repeating blocks of storage, and finds ’em (lower-left). Since they’re connected up to the address lines on the pin-pads, he’s doubly-confirming his hunch. The other side of the registers heads off to a data bus, another giveaway.
The command decoder turns out to be a programmable logic array (PLA) that takes a bit pattern in across horizontal wires, matches it, and then sends a logic high down a vertical line that leads to the Arithmetic-Logic Unit (ALU). Particular to the Z80, [Ken] notes that although it takes eight-bit instructions, it’s only four bits wide. It turns out the CPU memory-speed constrained, so they saved space (and money) by using a four-bit ALU. Sneaky!
Once he’s figured out the broad outlines of the chip, it’s time to dig down into the transistors. After a brief intro to designing logic circuits out of transistors, he takes us into the actual fabric of the IC. As if things weren’t confusing enough with simple logic gates like NAND and NOR, it turns out that the designers of the Z80 used a few “crazy gates” that efficiently compute particular operations that they needed.
The ALU is the heart of a chip, and it’s highly optimized. For instance, the Z80’s ALU is “totally different” from the 6502. An adder is not just an adder. And it’s here in the ALU that you’ll find crazy gates and chip-specific implementations. Figuring out how all that works is the next level up for budding chip-reading detectives. [Ken] has a lot more on the Z80 on his website.
Clever Calculators and Forgotten Memories
The Sinclair Scientific Calculator from 1974 was a small marvel: it took a TI chip from a simple calculator “that could barely multiply” and added on logs and trig functions. How did Sinclair do it? [Ken] wanted to find out — we still hold this as one of our most favorite hacks.
Starting off again with the pinout, [Ken] finds his way to the instruction ROM. He built a software simulator for what he found, and got to reverse-engineering. Again, if you’re into clever space-saving algorithms, head on over to his website.
In 1970, RAM storage was incredibly expensive. Intel came out with “shift-register” memory, and indeed, it’s just a 512-bit-long shift register. How does random access work in this context? You wait until your bit comes around like you would on a baggage carousel — leading to slow and random random-access times. Cool. But we can also see why they went out of favor.
Analog ICs: the 555 timer, the LM741, and the LM7805
Have you ever used a 555 timer? Want to see how it works? First, you’ll have to understand the implementation details of the bipolar-junction transistors (BJTs). Although BJTs are laid-out in many more different topologies than their FET cousins, analog circuits are often smaller and easier to get your head around. [Ken] gives you a good head start, and then starts off reversing two iconic chips: the 555 timer and the LM741 op-amp.
The 741 IC is dominated by an in-silicon capacitor, which really is a silly idea, but since “engineers are lazy” and this means that they have one less piece to lay out, it turned out to be worth its weight in gold and the LM741 sold bazillions. On the other hand, it’s got current mirrors spread around everywhere, which are used to replace resistors in silicon. And it’s got some strange transistors, one of which has six (!) collectors because the designers needed six current mirrors in one place.
Finally, [Ken] takes apart the LM7805 voltage regulator. The output transistor is (not surprisingly) about half of the IC die — the 7805 needs to push some current. The coolest part of the chip is a variable resistor that sets the output voltage. It’s a simple trick that makes the difference between an LM7812 and an LM7805 no more than the value of the resistor inside, leveraging the same design for different operating voltages.
How Does He Do It?
[Ken] uses a metallurgical microscope that shines its light from above, rather than through the sample. He got his for a few hundred dollars on eBay. He then takes multiple images from different locations all around the chip, with significant overlap, and lets the Hugin software stitch it all back together for him.
“The experts” decap their chips using boiling sulfuric or nitric acid. [Ken] doesn’t need a Superfund site, so he often leaves the die photos to someone else. Sites like zeptobars.com, visual6502, and siliconpr0n have a ton of chips that are just waiting for you to start decoding, with no chemistry degree needed.
For chips that aren’t in epoxy, [Ken] opens them by himself either by hitting them with a chisel or cutting open with a saw. He’s just now started up on the 8008 CPU. Between this talk and the resources on [Ken]’s website, you’ve got a good head start. All that’s left to do is the good, hard, fun work of puzzling out a few ICs on your own.
NextThingCo, makers of the very popular C.H.I.P. single board Linux computer, have released the latest iteration of their hardware. It’s the C.H.I.P. Pro, an SBC designed to be the embedded brains of your next great project, product, or Internet of Things thing.
The C.H.I.P. Pro features an Allwinner R8 ARMv7 Cortex-A8 running at 1 GHz, a MALI-400 GPU, and either 256 MB or 512 MB of NAND Flash. The Pro also features 802.11 b/g/n WiFi, Bluetooth 4.2, and is fully certified by the FCC. This board will be available in December at supposedly any quantity for $16.
The design of the C.H.I.P. Pro is a mix between a module designed to be installed in a product and a single board computer designed for a breadboard. It features castellated edges like hundreds of other modules, but the design means that assembly won’t be as simple as throwing down some paste and reflowing everything. The C.H.I.P. Pro features parts on two sides, making reflow questionable and either 0.1″ headers or a cutout on a PCB necessary. As a single board computer, this thing is small, powerful, and a worthy competitor to the Raspberry Pi Zero. A C.H.I.P. Pro development kit, consisting of two C.H.I.P. Pro units, a ‘debug’ board, and headers for breadboarding, is available for $49, with an estimated ship date in December.
A $16 Linux module with WiFi, Bluetooth, and no NDA is neat, but perhaps a more interesting announcement is that NextThingCo will also be selling the module that powers the C.H.I.P. Pro.
The GR8 module includes an Allwinner R8 ARMv7 Cortex-A8 running at 1 GHz, a MALI-400 GPU, and 256 MB of DDR3 SDRAM. Peripherals include TWI, two UARTS, SPI (SD cards support is hacked onto this), two PWM outputs, a single 6-bit ADC, I2S audio, S/PDIF, one USB 2.0 Host and one USB 2.0 OTG, and a parallel camera interface. This isn’t really a chip meant for video out, but it does support TV out and a parallel LCD interface. A limited datasheet for the GR8 is available on the NextThingCo GitHub.
Putting an entire Linux system on a single BGA module must draw comparisons to the recent release of the Octavo Systems OSD355X family, best known to the Hackaday audiences as the Beaglebone on a chip. Mechanically, the Octavo chip will be a bit easier to solder. Even though it has almost twice as many balls as the GR8, 400 on the Octavo and 252 on the GR8, the Octavo has a much wider pitch between the balls, making escape routing much easier.
Comparing peripherals between the OSD355X and GR8, it’s a bit of a wash, with the OSD coming out slightly ahead with Ethernet, more RAM and fancy TI PRUs. Concerning pricing, the GR8 wins hands down at $6 per chip in any quantity. That’s significantly less than the OSD355X.
The original C.H.I.P. has been exceptionally well received by the community NextThingCo is marketing to, despite the community’s distaste for Allwinner CPUs, cringeworthy PR, and questions concerning the true price of the C.H.I.P.. The C.H.I.P. Pro will surely see more than a few uses, but the GR8 is the real story here. A jellybean part that contains an entire Linux system has been the fevered dream of a madman for years now. The GR8 makes putting the power of open software into any project much easier, and we can’t wait to see the applications it allows.