Reverse Engineering the PLA Chip in the Commodore 128 | Hacker News Reader

Reverse Engineering the PLA Chip in the Commodore 128

c128.se

171 pointssegfaultbuserr26 comments

After quite some time reading up on silicon chip design and manufacturing and a lot of attempts I managed to come up with a schematic for this that makes sense.

For those who are interested in REading IC layouts from pictures, Ken Shirriff (kens, righto.com) has a lot of great articles on his site about the process as applied to other vintage ICs:

http://www.righto.com/search/label/reverse-engineering

I don't read ICs much in my line of work, but the basics are very easy to understand and much of the effort involved is "mental floodfilling", whose speed varies between individuals --- even after lots of practice it takes me a bit of time to find all the edges, but I know someone who can read a die photo faster than she can draw a schematic of the area.

Nice work. These things, and also PAL and/or GAL chips are in a lot of older computers, and have to be cannibalized from another computer to replace. For the PAL/GAL chips, an automated "fuzzer" type rig to reverse engineer them would be nice to have.

The C64 retro market is well catered for, and there are already C64 PLA replacement options available. However, the C128 market is no where near as popular, so it's really nice to see it be given some love by this project. As someone who recently had to purchase a couple of PLAs for a C128 that I'm trying to fix, I can only applaud this effort!

What was the PLA used for? From the scant information (and obviously the name) it seems to have been a general purpose logic array. Was it programmable at run time or factory-programmed for a single purpose like the ULA in the Sinclair ZX81?

Author here. The PLA in both the C64 and the C128 are primarily used to generate chip select signals for the chips that are connected on the system buses.

On the C128 it is also involved in the DRAM refresh handling.

The C64 PLA was originally a programmable device, the Signetics 82S100. Later version were MOS/CSG copies of the same device but programmed with changes to the manufacturing masks instead, similar to the difference between an EPROM and a Mask ROM.

For a lot more detail and background, I can recommend reading Thomas Giesels excellent paper on the C64 PLA, found at http://skoe.de/docs/c64-dissected/pla/c64_pla_dissected_a4ds...

Why did they design a PLA and then use it like this rather than going a bit further and designing an ASIC? I guess because MOS sold the same PLA to other people?

The C128 PLA chip is in essence an ASIC. It's using a PLA design but it's only programmable during the mask creation. Using a PLA logic array is just a very efficient way of achieving the design that they wanted.

I don't think they sold them to other companies, MOS was at this stage fully part of Commodore. Commodore was really big on vertical integration, they didn't like buying components from other companies if they could help it. They even manufactured a few 74xx logic chips sometimes used in their 8-bit computers.

It is an ASIC.

> A gate array is an approach to the design and manufacture of application-specific integrated circuits (ASICs) using a prefabricated chip with components that are later interconnected into logic devices (e.g. NAND gates, flip-flops, etc.) according to a custom order by adding metal interconnect layers in the factory.

https://en.wikipedia.org/wiki/Gate_array

PLA's job is simple: it basically contains a lot of combinational logic, transforming some inputs to some outputs. It generates a CS output based on a memory address and bus signals, it's just an address decoder, you can build the decoder using a large number of logic gates, but it gets messy and expensive. You can build a full-custom ASIC for it, but it's expensive and unnecessary. The point of PLA is allowing one to create a custom logic circuit to replace combinational logic by burning the logic on a general template, it was the right tool for the job.

Even today, modern equivalents of PLAs are still used. Some companies provide FPGA-to-ASIC conversion service using mask-programmable array, it allows you to burn your FPGA design to the silicon for a moderate performance boost, without the complication of ASIC redesign.

Not programable at run-time, it was factory programmed and part of the main logic for the processor accessing RAM/CIA/VIA/SID/etc. Im no expert but I think it was mainly memory address decoding etc.

It's not programmable in the sense of a ((E)E)PROM; it is "programmed" in the design of the silicon logic, not programmed in the sense of putting it in a socket and (re)programming with the data you want.

PLAs have a few benefits over ROMs in that it can represent a subsection of a logic space and can also handle custom inputs / outputs like "Don't Care" or "High Impedance" / "Z state" / "Disabled" which a ROM can't do.

Main benefit of PLAs over ROM is that for many "useful" logic designs the resulting array is significantly smaller. In fact, ROM is simply an degenerate PLA where the AND array is fixed and only the OR array is programmable.

The smaller size was what I was getting to with the subsection, I should have been more explicit.

One of the simplest tasks for example is decoding addresses to route data to and from specific chips. Say 0xFF00 goes to the sound chip, 0xE045 goes to the serial port or whatever, others go to RAM or ROM.

On the ZX Spectrum iirc it implemented the entire display.

The Spectrum had a different design; there was main memory, and the ULA chip (Uncomitted Logic Array) Would read it or it’s own time and generate the display (it had priority over the CPU as was usual those days of single port memory if you didnt want static like noise).

The sound, and just about everything else, was not mapped to memory but through an I/O address space which the Z80 and 8080 (and 80x86 and even AMD64 still have.

This address space, pins, chip select, etc were all distinct from main memory - unlike the C64 where everything was memory mapped.

Yes iirc the Z80 had io-specific instruction which allowed accessing (some) peripherals without memory mapping. But the ULA still had to decode addresses to target RAM vs ROM.

I went from "Why!!!!!?????!!!!!" when I read the headline to holy crap this is awesome when I read the article!

Oh man that setup is cool the steppers moving the slide/tied to ESP

Does that HDL part mean it can be fed into an FPGA?

Yes, I'm currently working on implementing this using a Lattice iCE40 FPGA. Not the largest or most powerful of devices but I don't need much for this and it does have a fully open source pipeline available.

The other part of reverse engineering something like this is to figure out the other parameters of the chip, e.g. propagation delay, slew rate, output voltage profile etc. etc.

Well, it's amazing, the time focus, tracing the paths haha, the automation things sounds interesting regarding the screenshots/stepper controls, assuming that just means it moves/pans around to get all the pictures for a big stitch? Anyway it's really cool.

Was confused at first what a People's Liberation Army chip was doing in the C128. (https://en.wikipedia.org/wiki/People%27s_Liberation_Army)

I always admire folks who can dive deep on something obscure like this.

Same here. In this context of course it's Programmable Logic Array.

Are there no flip-flops in this design? It looks small enough that you might be able to brute-force every possible input.

For some applications you also have to replicate the propagation delay accurately. A general purpose brute force rig would be useful though.

The Verilog suggests it has latches.

Some of the Signetics parts in this databook have latches:

http://www.bitsavers.org/components/signetics/_dataBooks/198...

appear to be two latches from the RTL.

at first i was uninterested in this project since the function of the PLA is expected to be very well known. to write an emulator or do intense programming one needs to know this and I expect most of the info to do it is made available by Commodore.

but then i viewed the project more deeply and realized it's more about the project as a whole, how the author made the dieshots

Did they reverse engineer SID yet?

Reply on news.ycombinator.com