New Documentation: An authoritative reference on the YM2612

[Sauraen]

Given that the discrete YM3438 has different behavior than the ASIC one, and the ASIC one is further different from the YM3438 design, are we sure the ASIC one isn't actually a Sega fixed-and-improved YM2612 core?

The YM2612 is implemented in depletion-mode NMOS ratioed logic with dynamic gates. It's an old process that is cheaper to fabricate (though more difficult to design), but it has a static power consumption--if the chip is running and you stop the clock, it will still draw a significant amount of power. I haven't checked myself, but based on others' info the YM3438 is probably implemented in CMOS with dynamic gates, which is roughly the same process used in modern digital logic (CPUs, etc.). It has extremely low static power consumption, and hence a lower overall power consumption.

I would be extremely surprised if the VDP was implemented in the power-hungry NMOS process, simply because it would get too hot. So unless Sega designed a custom YMXXXX chip that emulated the two Yamaha chips--instead of licensing the YM3438 design--what's in the VDP is basically a YM3438. However, there's no reason Sega couldn't have modified it, especially "outer" things like the way the address/data bus works.

I will be testing discrete YM2612 and discrete YM3438 in my synth.

[Sik]

I thought the ASIC variant was somewhere between the YM2612 and YM3438 (since it has quirks from both).

[mikejmoffitt]

Well, given the nature of NMOS devices and static power consumption, that's actually what led me to wonder if it was a 2612 in the VDP in the first place. My CDX's VDP gets pretty warm just from regular use. Nothing wrong with the 5V rail, it's steady at 5V. Even still, if Sega's diagrams say it's a YM3438 then I'd be inclined to believe it's a 3438, or a Sega variant.

It is very strange that the Sega-YM3438 would behave so differently compared to the discrete one. It's not impossible for Sega to have re-implemented the YM2612 in a CMOS process, realize that they've made something much like the YM3438, and call it the YM3438 in a logic diagram as a result. That's a bit outlandish, but it's just so weird to have it not be quite one chip and not quite the other.

[TmEE co.(TM)]

The VDP should be NMOS, and it does get hot, hotter than the NMOS 68K CPU in the machine. I even put a heatsink on it.
The ASIC in MD only gets warm, and it has a bunch of stuff packed in.

[Sauraen]

Well, given the nature of NMOS devices and static power consumption, that's actually what led me to wonder if it was a 2612 in the VDP in the first place.

The VDP should be NMOS, and it does get hot, hotter than the NMOS 68K CPU in the machine.

Well then... Maybe what's going on is that they put a YM2612 in there, but messed with the I/O bus to integrate it with the bus arbiter and everything else in that chip. And of course then they slightly changed some timing thing, and voila.

But if someone would just decap the VDP already, we would know for sure! We wouldn't even need ultra-high-res photography--just enough to pick out the OPN2 block and match it to one or the other.

[Sauraen]

Potentially good news!

As a graduate student in electrical engineering at a major research university in the US, I know people with access to some pretty good equipment. I'm actually getting independent study research credit for my work with the YM2612, so I can get access to a micron-level optical microscope used by the semiconductor light source group. I asked about decapsulation and the professor who'd give me access said I can use the microscope, but there's no way I'll be able to get access to the chemicals needed to eat away the plastic.

However, I have a buddy in the department who has a lot of cool toys, including a CO2 laser which he says can be theoretically used for decapsulation (especially if the chip doesn't have to work afterwards). He's going to test this on a few other chips, and then we'll test this on a VDP ASIC (I have a broken US Genesis II VA1.8 with the chip 315-5660-02).

If this works well and we get some nice pictures, I'd be happy to decap chips for other people for free if they send them to me. Of course the chips will be destroyed and you won't get them back.

[Nemesis]

Wow, seriously awesome work Sauraen! I'm especially excited by the work you did figuring out the test register, being able to read the digital output of individual operators is absolutely golden. I'm going to be spending hours going over your notes and pictures with interpreting the die shots too, this is something I seriously want to learn how to do.

If you can find it somewhere on the die, see if you can figure out what data tables/process is involved in the FM modulation feature. There are still unknowns in that process.

In terms of the decapping, yes please! I was actually starting up my own "at home" decapping lab, and I've got the fuming nitric acid in the garage which can attest to it. I had some success and was working out the right process (and trying to take it slow so I didn't kill myself), but in the end I had to shelve it due to lack of time, but if you have access to professional gear, the work you could do on this could open up a lot of possibilities. I'm happy to supply hardware, and the VDP would be on the top of the list, followed closely by the I/O and bus arbiter chips. There's a few extra chips for other systems I'd like to slip your way too if you get this working . The SVP processor in Virtua Racing is a must, but so are the DSP chips on the Sega Model 1 arcade hardware, which to this day have critical, undumped embedded ROM data. And there's the MegaCD, and the Sega Saturn.... I know I know, that's a lot of chips and a year of photography work, but one can dream.

[Eke]

I was actually starting up my own "at home" decapping lab, and I've got the fuming nitric acid in the garage which can attest to it

[Stef]

Haha, when i read this i internally had the same reaction / feeling, crazy guy ! But that is how we progress

[Sauraen]

Wow, seriously awesome work Sauraen!

Thanks! I was hoping to see you here at some point! And I will thank you in return for the years of work on this chip--I wouldn't have known where to begin with the die, nor frankly would have had the interest, without your wonderful details.

I'm especially excited by the work you did figuring out the test register, being able to read the digital output of individual operators is absolutely golden.

I thought you'd be excited by some of this stuff! But there's still bits I haven't fully explained; some of them are going to take quite a while.

I'm going to be spending hours going over your notes and pictures with interpreting the die shots too, this is something I seriously want to learn how to do.

I can write a little tutorial, but the biggest help while I've been doing the operator unit recently is that I'm actually reading the YM2203 die, and cross-checking things with the YM2612. I can actually read all the layers off the former, but in the latter I really can't see the diffusion when there's metal and poly on top of it. As I mentioned above, blocks from the YM2203 were copied-and-pasted onto the YM2612; other chips, for instance the YM3438, are a complete reimplementation (in that case, in a different technology).

If you can find it somewhere on the die, see if you can figure out what data tables/process is involved in the FM modulation feature. There are still unknowns in that process.

You mean how the outputs of operators are summed and fed back to modulate the phase of another operator in the operator unit? Or the LFO modulating the frequency of a voice (which is actually the only true FM the chip can do)? If you're talking about the operator unit, I'm in the process of making a complete VHDL equivalent description of the unit, that will work in YM2203 or YM2612 depending on a generic value (number of voices, which just changes the length of the shift registers). This will directly correspond with the chip at the sub-module level, including all internal I/O lines from other modules. This is the best way to document the chip at this level.

The only thing that's different between what I'm doing and what's in the original chip is that in the chip, they use latches gated by both clock phases, rather than edge-triggered flip-flops in FPGAs. For instance, what I was working on last night: the circuit taking the outputs of the operator previous-value registers and summing two of them to produce the feedback value (before the shifter controlled by the FEEDBACK register). This is done in two stages. The values that go into the section (from the registers or current operator output) are gated by one phase of the clock (let's call this "low"). There's logic to select among them and produce two values which are going to be added; the two results here are gated by the "high" phase. The results of that go through a standard adder, and the result is gated by the "low" phase. Instead, what I'm doing in VHDL is that both the selection logic and the adder are in one "section" with no latch between them, but there's a flip-flop that stores the output of the whole thing once per clock cycle (on the rising edge). These two approaches are equivalent ASSUMING there's no timing stuff that depends on one phase or the other; if I find that there is, I'll have to change my approach in the VHDL.

One tidbit I've found so far here: the two selection outputs are sign-extended to 15 (from 14) bits before being added (just means the MSB is copied to the new MSB); the 15-bit result is sent to the shifter; and the carry-out of the last bit is discarded. The carry-in is fixed to zero. The shifter is next on my list to do.

I was actually starting up my own "at home" decapping lab, and I've got the fuming nitric acid in the garage which can attest to it

Yeah, basically. The professor told me access to those chemicals was severely restricted due to safety concerns, and I shouldn't even try to get some. We'll see how the laser method goes. Let me see how it goes with this chip before you get too excited about future ones! But if all goes well, that won't be a year of work; the laser should be quick, and the photography shouldn't be that bad. If some of these chips are in unusual packages, what would help to maximize the chances of success would be if you could also send a random different chip that happens to be in the same package--that way we would get two chances to get the laser depth right.

Keep in mind that reading this logic takes a long time, and reading ROMs isn't terribly easy either, depending on the photo quality and lighting as well as the chip process.

[mikejmoffitt]

If you can read the digital output of an operator, it would be very productive to dump with a logic analyzer the output of the carrier with TL at max, with all modulators silenced, to get a decent dump of the sine table used internally.

[Sauraen]

If you can read the digital output of an operator, it would be very productive to dump with a logic analyzer the output of the carrier with TL at max, with all modulators silenced, to get a decent dump of the sine table used internally.

That won't be necessary. Nemesis probably already has it 100% correct, and I can read it from the die shot just fine. When I release the VHDL equivalent description of the operator unit, that will include the table exactly as it is in the chip, with the additional logic that modifies its output to produce the value that an emulator would likely have.

[Nemesis]

I was actually starting up my own "at home" decapping lab, and I've got the fuming nitric acid in the garage which can attest to it

Yeah, basically. The professor told me access to those chemicals was severely restricted due to safety concerns, and I shouldn't even try to get some.

Haha, when i read this i internally had the same reaction / feeling, crazy guy ! But that is how we progress

Yeah, you need the right balance of crazy and cautious to attempt this I think. Hopefully I've got that balance right . I actually exaggerate slightly, because technically my nitric acid isn't "fuming" nitric acid, it's reagent grade 70%, and Wikipedia tells me that in order to be classified as "fuming" nitric acid, it needs to be 90%. I still call it fuming though, because call me silly, but my definition of fuming is "gives off fumes", and I can tell you, 70% nitric acid does that plenty well at room temperature thank you very much.

I could of course distill this 70% solution to increase the concentration, but I actually don't see the need. The reactivity of the nitric acid can be increased by raising the temperature. Rather than heating the acid, I got myself an old electric fry pan, and placed a block of offcut marble from a benchtop in it, to give me a good thermal mass and something I could chemically abuse without worry. This is all wired up to a temperature controller to keep a stable temperature, and I then just stick the chip on the marble block to heat it up. I was experimenting with 70-80 degrees celcius. I then use one drop of acid at a time directly on to the chip package. With the chip so hot, it heats the acid on contact and causes a strong reaction, and after a second or two, I flush with a little acetone and repeat. This seems to work well. It's much better to have the slightly less nasty 70% nitric in storage than true fuming nitric too. I still get paranoid about this acid, and check on the bottles from time to time, just in case. They're stored in an old, thick wooden cabinet at ground level, with a magnetic lock that can only be opened by placing a magnet at the right magic place on the front door. The acid bottles are in tern surrounded by several large plastic containers of deionized water, with the theory that if it somehow escapes and starts eating away at anything, the plastic bottles will break and flood the area, diluting the acid to a harmless concentration.

I'm actually not just using nitric acid through, I'm using a nitric+sulpheric acid mix. I came across a paper that talked about mixing sulpheric acid with nitric acid, to create a "buffer" which should apparently protect the metal layer, for the first few seconds of contact anyway, which I want to do at least for the initial decapping, so I'm trying a mix of 3 parts nitric (70%) to 1 part sulpheric (98%). The original paper called for 2 parts nitric to 1 part sulpheric, but they were using fuming nitric, so I've adjusted the quantities. Still yet to verify the results.

Finding nitric acid was hard though, and laws vary between countries. I live in Australia, and while it's not illegal to buy or possess nitric acid in high concentrations, it's still tough to find any companies which will supply it retail to an individual, and just as tough to ship it. With how good it is at building things that go boom, and how hazardous it is to transport and store, this isn't surprising. I found a single supplier in the country where I could get it, and had it personally couriered to my door by a chemical courier company. I'm probably on some kind of terrorist watchlist now after making the purchase, but so be it. Fortunately the prices weren't too bad. In the end, this was the smallest cost though, the cash starts adding up quick when you realize all the other equipment you need in order to, you know, not die. Storing this mix is a real pain. Nitric+sulpheric acid reacts with just about everything. A lot of standard lab equipment, and basically all the standard lab safety gear, can't handle this kind of acid. You can't use any plastic, it's glassware throughout, and the fact it fumes means you can't keep it in anything with a rubber dropper or the like very long, because it'll rise up and start eating it. Made that mistake with my first attempt. Came back in the shed and found it had eaten its way out of my vials and started stripping the paint off the workbench. Makes very good paintstripper. For storage, you're basically limited to glass and teflon. Protective gear also needs to be neoprene. And then there's the fumes. That's the last barrier I had to properly address. I could mix the acids safely enough in open air, but when it comes to the actual decapping, the fumes are simply to hazardous, even with my kit that makes me look like I walked off the set of breaking bad. The vapour from this stuff can turn your lungs to soup, and outdoors is simply too uncontrolled an environment to work in for long.

I ended up getting an old industrial fume cabinet off ebay for $1, just needed to set it up in an area and have another go. Haven't had a chance to get back to it since then though, and right now my garage is full of parts from my truck, the engine for which I'm rebuilding, so that's the project that needs to be finished first before I get back to this again. Still, I managed to get about halfway to the die of the chip I was testing on last time before I had to stop due to the fumes, and that only took a minute or so, so I'm hopeful with the fume cabinet, I can decap chips quickly and easily. Then it'd be on to the photography issue. I've picked up a really high-end Nikon 20x Plan microscope objective (http://www.nikoninstruments.com/index.p ... -VC-Series), and under tests with an adapter for a telephoto lens on a digital camera, I believe it will work well. I was inspired by examples I've seen of this online, such as here: http://www.photomacrography.net/forum/v ... php?t=9664. I still need to pick up the actual camera I'm planning to use (waiting on the right price), but with the complete setup, I should be able to capture 18 megapixel (or whatever the camera I get supports) pictures at 20x zoom, which based on research, I believe will be enough detail. My lighting solution should work, and I've got an X/Y table thingy from an old microscope to address the stability issue for taking the pictures, which is critical, because the focal depth of a microscope objective is insanely small. Apart from the camera, I'm pretty sure I have everything now to make this work, just need the time to work on it again.

We'll see how the laser method goes. Let me see how it goes with this chip before you get too excited about future ones! But if all goes well, that won't be a year of work; the laser should be quick, and the photography shouldn't be that bad. If some of these chips are in unusual packages, what would help to maximize the chances of success would be if you could also send a random different chip that happens to be in the same package--that way we would get two chances to get the laser depth right.

Cool, can't wait to hear how it goes! My backyard setup would be handy for the long term, and hell it's just plain fun to try, but I have a feeling you'll be able to turn around a result quicker than I'll be able to get my rig up and running, especially with how little time I've had this last year.

Keep in mind that reading this logic takes a long time, and reading ROMs isn't terribly easy either, depending on the photo quality and lighting as well as the chip process.

Yep, no illusions about that, but even without much analysis, some things can be determined very quickly that otherwise are very hard to know. IE, is that unused pin actually connected to something internally? What might those "test" lines be wired up to? Longer term, it also serves as an indisputable, absolute reference on what's really inside a chip. After research, like the kind you're doing, we can know for certain what the internal operation of the chip is. Combining decap analysis with physical system tests, everything should be possible to reveal. The problem with system tests alone is you've still essentially got a black box, so you don't know for sure if you're missing something. Decapping can highlight things that have been missed in system testing. Into the future, a delayered die-shot will be the most important resource for emulating old hardware. Things need to start with logical documentation, either official or reverse engineered, but they can't truly be completed for any reasonably complex chip without decapping IMO.

[Sauraen]

Cool, can't wait to hear how it goes! My backyard setup would be handy for the long term, and hell it's just plain fun to try, but I have a feeling you'll be able to turn around a result quicker than I'll be able to get my rig up and running, especially with how little time I've had this last year.

Well, we did get results quickly, but they weren't good ones. Turns out the "plastic" packages are actually glass-epoxy; the laser vaporizes the epoxy and fuses the glass, so you get a nice ugly layer of SiO2 over the chip and it's impossible to see. My buddy is going to try a few more techniques with the laser before giving up, but it's not looking good.

This is a dumb question, but wouldn't less-concentrated acid still work, just take longer? I'm sure I can get ahold of some 10% nitric acid, what if I leave that on the chip overnight?

I know there was talk of getting photos of the chips with and without the metal layer, but if you can only choose one, with the metal is MUCH more helpful. For these old chips there's only one metal layer; for chips with several, you'd have to selectively eat away one at a time and take pictures between each one.

Would it be possible for you to decap some of these chips, take some initial photos, and then ship them to me and I'll use the university's microscope to take the final ones? The equipment here is for looking at experimental LEDs at micron resolution, so it should be better than any consumer camera jerryrigged to a microscope.

[Nemesis]

Well, we did get results quickly, but they weren't good ones. Turns out the "plastic" packages are actually glass-epoxy; the laser vaporizes the epoxy and fuses the glass, so you get a nice ugly layer of SiO2 over the chip and it's impossible to see. My buddy is going to try a few more techniques with the laser before giving up, but it's not looking good.

Yep, these packages are nasty little things. Not much works well for them. I'm only aware of two methods that are known to work reliably, with the right setup. The first one is of course nitric acid decapsulation. The second approach is manual drilling of the package down to the die. With xray equipment to work out the precise depth and size of the embedded die, and with an extremely precise milling machine setup, you can drill down to the die surface, or a fraction of a mm above it, then gently split the remaining tiny layer from the die surface. That said, acid decapsulation seems easier and less error prone, if not a little more risky to your health.

There is a simpler, more brutal decapsulation method I've seen used. I've seen lots of examples, but there's a good description here:
http://www.t4f.org/articles/ultra-low-c ... psulation/
The method is basically to heat up a beaker of nitric acid and dunk an IC in, and let it totally eat away everything but the die. I believe this is slightly safer on average in the sense that you actually handle and deal with the acid less. You don't need to actually dropper it bit by bit on the chip and stand next to it while it's fuming, but at the same time, you have to use a larger quantity of acid, and you have to heat that entire volume of acid at once, which in my mind means the "worst case" scenarios are a bit worse with this method. 100ml of boiling nitric acid sitting on a hotplate in a glass beaker? Yeah, not fun. It's much cheaper to setup and simpler on the whole though. I didn't go with this method however, because I wanted to preserve the outer package as much as possible, and more significantly, this approach doesn't give you any option to preserve the metal layer, which I wanted to be able to do. Still, I'll throw it out there as an option.

This is a dumb question, but wouldn't less-concentrated acid still work, just take longer? I'm sure I can get ahold of some 10% nitric acid, what if I leave that on the chip overnight?

I am by no means a chemist (in fact, I hated chemistry), but my understanding is that without concentrated enough acid, or sufficient temperature, the reaction won't even begin. A 10% solution is so weak, I don't think it'll do anything. The article I linked above says as much for the 60% acid they used, so 10% would certainly be much, much worse than that. You might have to check what you can easily source in your area. The guy who wrote that article is obviously in Europe, but it seems he could buy 1 litre of 60% nitric in a bottle locally for around 30 euro. You can't buy anything like that here in Australia, no stores I found even stock nitric acid in any concentration. Maybe you can find something like that in the US though? Still I totally understand if you don't want to even investigate this option yourself. If you have access to a proper chemistry lab, or a friend who does, with all the right lab equipment and a proper fume cabinet, it should be really easy to make an attempt yourself. Pretty much all you're doing is mixing two acids together (in the right order! Pour the strong into the weak), heating up the chip, and droppering the acid mix onto the chip until you reach the die. That part is easy. 90% of the difficulty is in setting up the environment properly with the right equipment, but a proper lab should have everything ready to go. If you don't have any of that though, it's a long, expensive, hazardous road to get setup, I can tell you.

Would it be possible for you to decap some of these chips, take some initial photos, and then ship them to me and I'll use the university's microscope to take the final ones? The equipment here is for looking at experimental LEDs at micron resolution, so it should be better than any consumer camera jerryrigged to a microscope.

What's the timeframe here? I'm really, really busy with work and life right now. I'm flying over to Denver this Saturday for a couple of weeks for work, then Adelaide shortly after I get back. I've got kids and a pregnant wife back home, and we've been moving house, with all my gear in storage. What's not in storage is in the old garage, as I said with a disassembled engine taking up most of my work area. It's really unlikely I'll be able to do anything more on this stuff until next year. I will get back to it, but obviously you won't have access to that gear forever. It's very hard for me to predict when I'll have enough time to work on this again, so you might need another option rather than waiting for me.

If you can put a couple of dollars into this, it might be worth looking at commercial decapping labs. There was a place in the US called MEFAS that would do decapping for very good prices. I made an inquiry back in 2008, at that time it was $75 per chip, but unfortunately they would only FedEx post out of the US, which was $150 and made it too expensive for me. Still, you're US based, so the postage will be cheap. MEFAS would even guarantee the chip would still be operational after decapping. They were happy to deal with individuals, and didn't care what they were decapping (IE, you didn't have to be a company, or the creator of the IC). Google tells me they've since been bought out by a place called "Evans Analytical Group". Here's the page:
http://www.eag.com/mte/failure-analysis-services.html
You'll have to make an inquiry to find out about price, but hopefully they're still reasonable. Since you wouldn't need any photography, they should be able to offer a really cheap price. All they need to do is stick your chip in their automated decapping machine for 5 minutes. This should be a very cost effective option for a few chips. I was looking at my own at-home decapping lab because I wanted to be able to do a LOT of chips, but for a small number, this could actually be the cheapest, simplest option, and the turnaround time should be really quick.