Date   : Thu, 28 Oct 2010 07:56:43 +0100
From   : percy.p.person@... (Ed Spittles)
Subject: Reversing the Tube ULA (destructively)

Hi Theo

On 28/10/2010, Theo Markettos
<list-a_cloud9.bbc-micro@...> wrote:
> A cautionary note.  I assume these ULAs have a single metal layer which
> constitutes the user-defined connections.  Do you have access to any data on
> the 'blank' layout that lives underneath?  There will be some NMOS dopant
> (and PMOS too if it's a CMOS device), some polysilicon gates, and then the
> metal layer(s) on top.  Polysilicon is typically used as wiring, so the
> metal mask doesn't tell you enough information to reconstruct the chip
> unless you know the areas of dopant and the polysilicon.

Yes, I found some interesting info by searching for
http://www.google.co.uk/search?q=ferranti+c-series+ula+(uncommited+logic+array)+ula2c000
which returned a file 04.asic.pdf
On page 19 (of 36) there's info about the basic cell which is a pair
of 2-input NOR gates.

I'm pretty sure the story with ULAs was a simple repeated pattern of
cells with the active and poly layers fixed, and customisation was
just the metal layer (not sure about contacts)

So, we would need to read the metal, and the contacts, which are both
easy from a good photo, and we'd have to peer past that to the active
layers, which for a simple repeated structure will also be possible, I
think.

> There are imaging and etching techiques to strip off the layers one by one,
> but they require a lot of trial and error... and there aren't plenty of
> samples to test on.

Indeed, but I don't think we'll need to do that.  Even for the 6502, a
single strip of the (single) metal layer was enough to get all the
info.   As an when we get to a chip with two metal layers, it does get
much harder.  I think abrasion rather than etching might be the answer
- it's been done, for chip+pin investigations.

> (Though my experience is on chips about 20 years younger than these, so I
> might be wrong in my understanding of old chip fabrication technologies)

The older ones are the easiest!  I gather there are 40 mask layers in
a modern chip. Plus or minus 10, probably.

Cheers
Ed