This page serves as a repository for chip images I have traced and analyzed.
If you'd like to contact me, email quietust at either @qmtpro.com or @gmail.com. I can also be found in the #nesdev IRC channel on EFnet.
Over the past several months, numerous improvements have been made to the Visual 2C02, the latest of which involved a low-level change to the simulator itself - in particular, determining node values now considers the surface area of each node in the group to decide whether floating charges should propagate outwards or be drained away.
All chip images posted below are divided into several different layers. For ideal analysis, all of the images should be loaded as separate layers within a single master image using your graphics editor of choice, preferably making the Metal and Polysilicon layers partially transparent.
The layer descriptions below currently apply only to the chip images currently posted here, which all use depletion-load NMOS logic.
- Labels
- Not an actual layer on the chip, this simply serves to assign names to various signals for reference purposes.
- Regions
- Not an actual layer on the chip, this serves to group together certain parts of the chip according to their functionality for reference purposes.
- Metal
- This layer serves to connect different parts of the chip together, though older chips also use them to form the gates of transistors (instead of polysilicon). Newer chips often use multiple metal layers in order to save space.
- In my images, red-colored metal is connected to VCC (+5V), green-colored metal is connected to GND (ground), and blue-colored metal forms interconnects.
- Vias
- Much like those found on printed circuit boards, vias form connections between layers. In this case, they connect the Metal layer to the Polysilicon and Diffusion layers.
- In my images, vias are black.
- Polysilicon
- When a Polysilicon trace passes directly between and thus connects two Diffusion regions, it forms the gate of a transistor. Polysilicon can also be used to form wires which connect sections of the chip to each other, mainly to route Metal interconnects underneath each other. In some cases, polysilicon can also be used to form capacitors and resistors.
- In my images, polysilicon traces are purple.
- Buried Contacts
- Buried Contacts are just like Vias, except they cover larger areas and are used to form direct connections between Polysilicon and Diffusion without making transistors, thus avoiding the need to jump through Vias to the Metal layer and back.
- In my images, buried contacts are light pink.
- Transistors
- Transistors are one of the elementary components of electronics. Each transistor has 3 terminals - source, gate, and drain. The voltage applied to the gate determines the amount of resistance between the source and drain - low voltage results in high resistance (an open switch, "off"), and high voltage results in low resistance (a closed switch, "on"). The source and drain terminals of transistors are formed from the Diffusion layer, while the gate is usually made of polysilicon (though some older chips use metal gates). In depletion-load NMOS logic, certain transistors are depletion-mode - on by default, and generally used as pull-up resistors. Some chips also use depletion-mode transistors for design simplification (by allowing polysilicon to cross diffusion without forming transistors) or even to thwart reverse-engineering attempts (by creating fake transistors which don't actually do anything).
- In my images, transistors are cyan.
- Diffusion
- Diffusion consists of conductive areas of silicon. Used alone, they can be used to form short interconnects or resistors, but their main purpose is to be used in pairs (along with Polysilicon traces running directly between them) to form the source and drain terminals of transistors. In some cases, diffusion can also be used to form capacitors and resistors.
- In my images, red-colored diffusion is connected to VCC (+5V), green-colored diffusion is connected to GND (ground), and yellow-colored diffusion floats to whatever voltage is applied to it.
Each image is also timestamped in the tables below - since I trace the individual layers manually (as opposed to using sophisticated image analysis tools), I occasionally upload new versions whenever I find errors.
The RP2A03 is the NTSC version of the NES CPU; this particular chip is revision G. It contains 5 sound channels and a slightly modified (to remove decimal mode) MOS 6502. The 6502 itself is not included in the following layer images, mainly due to its complexity (and the fact that the Visual6502 project has already traced a real 6502).
The lack of decimal mode was seemingly intentional - 5 transistors (t1329, t2202, t2556, t2750, and t3212) were removed with surgical precision (one of which resulted in a strange "via to nowhere" observed at the very center of the following 2 images: 1, 2), the result being that the 6502's ALU no longer operates in decimal mode when the status register flag is set.
The Diffusion layer image is not 100% correct, as it was traced using the assumption that all intersections with Polysilicon formed enhancement-mode transistors (excluding the depletion-mode transistors which form pull-up resistors recognizeable both visually and programmatically). This assumption has already been proven false by the barrel shifters and full adders used in the frequency sweep logic for the 2 square wave channels - the layer image was updated to take this into account, but other similar instances may yet be lurking within the chip.
Using several special tools (and the Visual 6502 chip simulator and data), these layer images have been successfully combined to form The Visual 2A03.
Using the experience I've gathered from tracing this RP2A03, I'd eventually like to trace another one with the 6502 included, though I'll only do it if I can get better quality photographs (higher resolution, cleaner, and better focus), ideally from a fresh chip.
Errors found and fixed since making the simulator:
- Sprite DMA: 1 short (between APU clock and CPU /RDY control, prevented the 6502 from actually working)
- Square channel 0: 4 shorts (between output bits and debug readback logic)
- Square channel 1: 1 missing transistor in sweep unit high-frequency threshold detection
- Square channel 0/1 duty cycle generators: 2 bad interconnects (for duty cycle mode 01)
- Frame timer: 1 bad interconnect (in LFSR's XOR gate)
- DPCM: 4 missing transistors in timer LFSR, 1 missing via in DMA logic, 1 missing transistor in address counter, 1 missing via in length counter, 1 missing transistor elsewhere
- Noise: 1 missing via in LFSR feedback mode register
Known issues:
- The 6502 CPU was copied directly from The Visual 6502, edited to disable decimal mode, and linked to the rest of the RP2A03 using permanently-activated transistors.
- Certain parts of the chip do not function 100% correctly due to the order in which the transistors are processed in the simulator. I have attempted to fix as many of these as possible, though some may still remain.
Interesting bus names to monitor (using "Trace these too"):
- (sq0/sq1/tri/noi/pcm/frm)_(name) - registers specific to various sound channels (e.g. "sq0_len" or "tri_lc")
- envp (sq0/sq1/noi) - envelope period / volume output ($4000/$4004/$400C)
- envt (sq0/sq1/noi) - envelope timer
- envc (sq0/sq1/noi) - envelope counter (volume output)
- len (all) - length counter
- out (all) - current output bits
- p (sq0/sq1/tri) - duty cycle period ($4002-$4003, $4006-$4007, $400A-$400B)
- t (all) - duty cycle timer (noi/pcm use an LFSR)
- c (sq0/sq1/tri) - duty cycle counter (phase)
- c (noi) - random number generator (LFSR)
- swpb (sq0/sq1) - sweep bit shift count ($4001/$4005)
- swpp (sq0/sq1) - sweep period ($4001/$4005)
- swpt (sq0/sq1) - sweep timer
- lc (tri) - linear counter timer
- en (all) - channel enable (write $4015)
- t (frm) - frame timer (LFSR)
- on (all) - channel active (read $4015)
| Last Updated | Size | Layer |
|---|---|---|
| Sat, 07 May 2011 03:13:35 +0000 | 25,993 bytes | Labels |
| Wed, 08 Jun 2011 00:27:13 +0000 | 70,564 bytes | Regions |
| Thu, 23 Jun 2011 19:51:18 +0000 | 78,070 bytes | Metal |
| Tue, 05 May 2020 23:41:54 +0000 | 64,764 bytes | Vias |
| Sat, 25 Jun 2011 00:39:15 +0000 | 122,666 bytes | Polysilicon |
| Fri, 24 Jun 2011 03:45:42 +0000 | 36,056 bytes | Buried Contacts |
| Tue, 05 May 2020 18:39:38 +0000 | 54,567 bytes | Transistors |
| Wed, 27 Jul 2011 02:45:46 +0000 | 147,997 bytes | Diffusion |
The RP2C02 is the NTSC version of the NES PPU. Much of its behavior has been determined via "black box" reverse engineering, but the actual implementation of said functionality remains unknown.
The NESdev community donated several of these chips to the Visual6502 project, and several were depackaged, delayered, and photographed in order to produce the layer images below.
Several minor tweaks need to be made to these layer images for proper simulation:
- The long twisty transistor immediately to the right of the clock pin must be deleted (after subtracting it from the diffusion layer) - logically it is a resistor, and leaving it in would cause the clock pin to be ANDed with its inverse and thus not work.
- The video DAC needs to be disconnected from VCC by removing the vias immediately to the right of the clock input pin - this is simply a resistor with various taps along its length, and leaving it connected will register as a short between VCC and GND.
- Part of the sprite RAM bus precharge circuitry needs to be disconnected (specifically, the part that connects pairs of word lines to each other) by deleting the transistors from the input data - in ChipSim, minor timing glitches result in these transistors destroying the contents of sprite RAM.
- The resulting transdefs.js must be edited to reorder groups of transistors to properly simulate signal propagation direction - due to the way JSSim was written, the order in which transistors are defined affects the order in which they switch on/off, potentially resulting in incorrect simulation.
Take a look at nodenames.js for a complete list of all interesting signals to use in "Trace these too" - as with the Visual 2A03, you can specify either individual nodes or entire buses (by omitting the number from the end).
The chip simulator currently resets at the very beginning of the pre-render scanline; otherwise, writes to certain registers would have no effect until after simulating an entire frame (which takes over 30 minutes).
| Last Updated | Size | Layer |
|---|---|---|
| Thu, 11 Aug 2011 01:36:00 +0000 | 28,519 bytes | Labels |
| Sat, 14 Jul 2012 16:55:28 +0000 | 72,132 bytes | Regions |
| Sun, 14 Aug 2011 03:27:00 +0000 | 144,338 bytes | Metal |
| Sun, 18 Nov 2012 03:11:25 +0000 | 97,053 bytes | Vias |
| Wed, 19 Jun 2013 22:37:43 +0000 | 222,712 bytes | Polysilicon |
| Tue, 26 Mar 2013 00:36:29 +0000 | 43,213 bytes | Buried Contacts |
| Tue, 26 Mar 2013 00:35:25 +0000 | 126,370 bytes | Transistors |
| Wed, 31 Oct 2012 19:00:41 +0000 | 138,517 bytes | Diffusion |
The RP2A07 is the PAL version of the NES CPU. The only known differences from the RP2A03 are the clock divider (divide by 16 instead of divide by 12) and several timer lookup values (noise, DPCM, and the frame timer).
No die shots of this chip are yet available.
The Visual6502 project claims to have one of these chips depackaged, but no plans to delayer or photograph it have been announced.
The RP2C07 is the PAL version of the NES PPU. The only known differences from the RP2C02 are the number of scanlines per frame, various timing details, and a different means of producing the video signal.
The Visual6502 project claims to have one of these chips depackaged and photographed, but no images have been made available.
The 68000 is a CPU designed by Motorola, used in numerous computers including the classic Apple Macintosh and the Commodore Amiga. See Wikipedia for more information.
The layer image below was traced directly from the 10000x11299 die shots available here.
Olivier Galibert was able to produce a full transistor-level schematic of the 68000, partially assisted by this metal layer image (and some corrections).
| Last Updated | Size | Layer |
|---|---|---|
| Wed, 28 Sep 2011 00:14:06 +0000 | 291,949 bytes | Metal |
The RP2C33 is the control chip used in Nintendo's Famicom Disk System, and it is responsible for controlling the disk drive, managing interrupts, and even playing sound.
The layer image below was traced from die shots acquired from Siliconpr0n, but it is not known whether it will ever be delayered.
| Last Updated | Size | Layer |
|---|---|---|
| Sun, 15 Feb 2015 18:42:42 +0000 | 63,357 bytes | Labels |
| Mon, 22 Aug 2022 01:01:47 +0000 | 282,750 bytes | Metal |
| Mon, 22 Aug 2022 01:24:30 +0000 | 121,275 bytes | Vias |
The Konami VRC-VII is a support chip used in two Famicom game cartridges: Tiny Toon Adventures 2 and Lagrange Point.
The latter is best known for making use of the chip's expansion sound capabilities, which consists of 6-channel FM synthesis.
The chip also provides support for PRG and CHR bank switching, as well as a scanline-based interrupt counter.
The layer image below was traced from die shots acquired from Siliconpr0n, but it is not known whether it will ever be delayered.
ScottySR (who goes by the name "SCSR" on the NESdev Discord server) also independently traced all of the chip's layers (from the same source image I used); with those images (and some corrections), I was able to produce a visual chip simulator.
| Last Updated | Size | Layer |
|---|---|---|
| Fri, 19 Feb 2021 02:17:34 +0000 | 47,297 bytes | Labels |
| Fri, 19 Feb 2021 02:16:26 +0000 | 82,770 bytes | Regions |
| Fri, 19 Feb 2021 02:26:08 +0000 | 321,268 bytes | Metal |
| Fri, 19 Feb 2021 02:25:17 +0000 | 125,796 bytes | Vias |
Head over to my chipsim-tools GitHub repository for the tools I used to make the Visual 2A03. They may not be fully versatile and efficient, but they get the job done.
