Added cm401 and wile posts

content/posts/cm401-01.md

@@ -0,0 +1,33 @@
++++
+title = "CM401 IC Reverse Engineering – Part 1"
+date = 2022-11-10
+tags = ["reverse engineering", "IC", "ALU", "NMOS"]
++++
+
+Not very long ago I stumbled upon [this](https://www.reddit.com/r/chipdesign/comments/yhy0yx/ussr_cm401_alu/) reddit post in r/chipdesign which showed a die image of a USSR era Bulgarian 4-bit (?) ALU created on an NMOS process made by Ryan Cornateanu (the pictures are posted on his [twitter](https://twitter.com/ringoware) as well). As a long time lurker on this subreddit and have seen some nice die pictures come by I thought let’s give reverse engineering a try! How hard can it be….
+
+Another kind redditor let the world know this IC was used in the Elka-50M calculator and provided a [link](https://electronicsdeli.net/2021/08/09/elka50m-refurbish/) which shows the calculator and contains some PCB shots. From these photo’s we can conclude that the output of the ALU is NOT plain binary since the output pins are directly connected to 13 7-segment displays so we can expect 13 display select outputs and at least 7 segment outputs. Looking at the die image we can find 21 beefy output transistors at the top half directly connected to the pads suggesting we indeed have 13 select lines and 7+1 segment outputs. Taking an even closer look we can find that the leftmost 13 ouput transistors are interconnected with some logic as are the other 8, suggesting that the leftmost 13 are the select line outputs.
+
+![topleft](/images/blog/cm401/topleft.jpg)
+![topleft_layersonly](/images/blog/cm401/topleft_layersonly.jpg)
+
+Okay… we know this, and now? This being my first full IC to reverse engineer I just opened up Inkscape and KiCad next to eachoter and just started tracing. Since the top left part had the 13 select lines it seemed like a nice place to start. I quickly found the GND and VCC pads and traced them over the full die and there I went, tracing the metal layer and the underlying 2 other layers (the red and green ones in the die picture as is shown on the left).
+
+Tracing the shapes we can see is all nice and dandy but the goal is of course to find the transisors themselves and create a schematic from the image. Having seen other NMOS IC’s I was expecting to see polysilicon gates, thus a coloured area with a strip in between forming the transistor. After looking around a bit I just could find areas which looked like via’s inbetween two red areas so the conclusion quickly landed on: that is a transistor! The last unidentified things were the long green snake-like traces and they could just be one thing: resistors. And looking to where these traces connect it actually makes sense (most, if not all, are connected at one side to the VCC or GND traces thus acting as pull up or pull down resistors which are required in NMOS logic).
+
+Giving the metal layer a blue colour (with GND a dark teal and VCC a light teal colour), the aluminium on top of the N+ regions (or something alike… To be honest I am not exacly sure how the layer stack is created but this layer acts as routing traces AND source and drain of the transistors) are coloured red and as last the resistor lines are coloured green (again I am not sure of what material this is…).
+
+![topleft_transistors](/images/blog/cm401/topleft_transistors.jpg)
+![topleft_all](/images/blog/cm401/topleft_all.jpg)
+
+Then I gave all the via’s a black square and all the via-like structures inbetween two red areas a yellow square indicating a transistor (which got a square around them). Up until now it was a very relaxing and quite doable job. Not much thinking was required. Some music, some coffee and go! In fact, this was so relaxing and fun to do that at the time of writing roughly a third of the IC is fully traced…
+
+![schem_01](/images/blog/cm401/schem_01.png)
+
+Then the more difficult and involving task started… Numbering the transistors and resistors and creating a schematic. With a pencil and a notebook next to me I numbered each transistor, put it in my notebook and followed the traces to the next transistor (and ignoring the repetitive part in the center for now since I suspected this was some kind of PAL/PLA structure (as did Ryan as well looking at his twitter posts about this IC). After finding out a good way to order everything I transfered it to KiCad and went to town on placing a lot of mosfets.
+
+After 130-ish named mosfets (and the bunch in the PAL/PLA structure which stayed unnamed) and around 60 resistors a full schematic of the top left quadrant of the IC is created. It is far from done! Not only the rest of the IC must be done this way but interpreting the schematic would be a massive task as well (alas a fun one!).
+
+This was part one! Probably more parts will come with interpretation of specific parts. No real conclusions can be made up untill this point except for that reverse engineering this IC is not only possible but quite doable. I put up this post mostly to document the workflow I used and a little bit to pressure myself in trying to finish this project. The github repository linked at the top and bottom contains the traced silicon and the schematics.
+
+In [part 2](/posts/cm401-02) I take a look at the schematics of the part shown in the images.