Hacker News Reader

Comment by userbinator | Hacker News Reader

Interesting article. AFAIK reverse-engineering mixed-signal or analog ICs is far less common and more difficult than digital ones, since the transistor sizes and shapes are more critical in analog parts as are the resistors and other passives; there isn't much in the way of standard cells (which can be easily reverse-engineered using something like http://www.degate.org/ ) and the layout is more critical so it is often done with less automation assistance.

View on HN

I have the advantage that I'm just reverse engineering the circuit to understand it; I'm not trying to re-create it. So I can just ignore transistor size, layout, etc :-)

Great writeup!

Is there any way to determine the values of the resistors and capacitors on the die based on their geometry, or would someone have to build up a standalone circuit and experiment until coming up with something that sounded similar? Can a person at least infer one value from another by the ratio of the geometries, like one resistor being 2x another if it were twice as long?

BTW, I built up a perfboard with this chip and a pile of resistors, capacitors, and potentiometers many moons ago. Just tore it down a short while ago. 76477 was also my Automated Teller Machine password for a lot of years.

The resistance is proportional to the length/width ratio as you suspect. You can find resistance numbers for doped silicon, but the value depends on the doping level. So you can get a rough idea.

Because resistances can vary 20% from chip to chip, analog circuits generally are designed so the ratio of two resistances controls things, rather than the absolute resistance. So you probably don't need to figure out the absolute resistance.

Well… you can't really ignore sizes, with mixed-signal ICs. Transistor sizes determine current flow, which will ultimately determine things like pitch, duty cycle, etc. You at least need to know in differential pairs and current mirrors the ratio between the involved transistors…

Did you happen to notice how many shift-register stages made up the PRNG for the white-noise output? I'm sure I've got one of the chips on hand, so (eventually) I can 'scope the output for a good guess, but it'd be good to have a more immediate eyewitness report.

I figured out the shift-register circuit, but decided to write up the digital logic separately since the blog post was already very long. It's a 32-stage nonlinear feedback shift register. The sequence repeats after 56883 steps, which is a lot less than 2^32, so it seems to me they aren't making good use of the stages. The output takes a while to get going: it is high for 30 clocks and low for 31 locks before oscillating. I don't like to criticize, but it doesn't really look like a good design to me. The digital mixer is also pointlessly complex.

> it is high for 30 clocks and low for 31 locks before oscillating.

That's bad if you want white noise, but maybe the transients were put there intentionally? They could have a musical purpose.

EDIT: This is assuming the white noise generator resets for every sound. Is that the case?

How is it non-linear? Is it basically addition of combinational logic at feedback inputs?

With a linear feedback shift register, the input is the XOR of some stage outputs. (XOR is linear when considered mathematically since it's basically bitwise addition.) If you use other logic functions, then it's nonlinear. The 76477 uses a combination of XOR and NAND, making it nonlinear. The disadvantage of a linear feedback shift register is it can get stuck at all zeros. But the 76477's shift register gets set by the inhibit line, so it couldn't get stuck. So I really don't know why they used a nonlinear circuit. As far as I can tell, it just makes the performance worse.

I see, that's pretty interesting. They could have gotten a much better period had they just used a standard primitive polynomial for a 32-bit LFSR.

They could have made the chip a lot smaller (= cheaper to produce). For the period they actually achieved, they could have gotten away with a 16-bit LFSR, requiring half the die area for that function (which looks like it was quite significant).

16 isn't a good size according to the Rosenberg paper (http://www.cs.miami.edu/~burt/learning/Csc609.022/random_num...) but 15 and 17 are sizes you could program an ATtiny45 to generate if you just wanted that quality of noise. I'm going to be real interested in trying out the actual noise-generator logic in the follow-up article to see if I can hear any useful tonal difference. Maybe they were just frustrated by hardware that kept drifting into the forbidden state and brute-forced it until it couldn't; I've had that happen with PRNGs I built with series-4000 CMOS logic and xgates. Stay tuned, I guess.

This isn't crypyography; probably the listener won't notice the difference.

What I'm talking about would need almost zero extra work.

Honestly, after reading the title I was hoping for an article describing a full reverse engineering :(. Still very interesting nonetheless, good work!

I wonder how difficult it would be to re-create it in software? It'd be cool to emulate it similar to tlb's XAnalogTV.

https://github.com/katahiromz/XScreenSaverWin/blob/master/no...

https://www.youtube.com/watch?v=_ODQ_lHRMXo

MAME's implementation shows 5 contributors. Maybe you could ask them? https://github.com/mamedev/mame/blob/master/src/devices/soun... https://github.com/mamedev/mame/blob/master/src/devices/soun...

AFAIK MAME's accuracy leaves a lot to be desired with respect to anything involving analog signal paths. For example, the sound system used in the Sente SAC-1 hardware is based on the CEM3394 chip, also seen in several pro synths of the era. The emulation does play sound, but last I checked, there wasn't any filter emulation, so it poorly represents the audio of those games.

Edit: And I wouldn't expect the situation to change soon. Accurate analog emulation is something commercial VST plugin makers have been working on for years, and they've come "close enough for most people", but the time spent on algorithm development and optimizing CPU usage is quite high.

That was my first thought too. My second thought was that the most effective recreation would be to build a SPICE model [1], and whether that SPICE model could run in near real time on a modern CPU. A simple SPICE model should be straightforward based on the circuits in the article.

From memory, the SPICE transistor models take things such as transistor feature sizes as parameters, so it might be possible to get a surprisingly accurate model from the die photo?

[1] https://en.wikipedia.org/wiki/SPICE

Not easy, as would be even recreating it in hardware. This is the analog world where tolerances, stray capacitance and unpredictable small differences in gain or frequency response make every circuit behaviour slightly different even though it uses the same exact parts and layout. A good enough digital recreation of that circuit would be possible only if it could sample the imperfections of a real chip, and to be believable it should probably analyze a hundred chips to get what parameters are changed during production and how much.

Reply on news.ycombinator.com