Date   : Sat, 30 Oct 2010 10:42:05 +0100
From   : percy.p.person@... (Ed Spittles)
Subject: Reversing the Tube ULA (destructively)

Hi Theo

On 29 October 2010 18:21, Theo Markettos <
list-a_cloud9.bbc-micro@...> wrote:

> I've had a chat with Sergei Skorobogatov (keeper of the microscopes) and I
> can use one when I have a chip to play with.
>

Excellent!


> Some questions:
>
> Do we know what technology they're in?  1um? 5um?
>

Sorry, no.  There's a picture of someone inspecting 250x artwork in the
sample chapter of the Sinclair ULA book.  I reckon a bit under 35 metal
pitches in 10cm, which makes it about a 12-micron pitch, so perhaps a
5-micron process.


> He says that on 100x lens you get 20um x 20um photos, and on 20x you get
> 100x100um.  Do we know what sort of die size we're looking at?  At 5mm x
> 5mm
> and 100x that's 2500 photos.
>

Greg James tells me that 20x is best. (He was looking at 6502)  I've seen an
image reduced to 1500pixels across, and that would be just adequate. 3000
pixels would be comfortable, I think.



> What tools do you plan to use for analysis?  Stitching and track following
> isn't going to be doable by hand with 2500 pictures each 2000x3000 (I have
> a
> 6 megapixel camera).  I found: http://www.degate.org/


Greg tells us that Christian Sattler "has an excellent automated system for
stitching images"



> > > Whilst it's not the Tube ULA, the Electron one is much easier to
> open...
> > >
> > > http://retroclinic.com/misc/12c021.jpg
> > >
> > > Gives an idea of what they look like inside, albeit this one is larger,
> 12
> > > cell instead of 9.
>
> How many gates are we expecting?
>

Don't know for sure, but the 5000 series is described as having approx 700
logic gate capacity. Sophie says that the Tube ULA was packed full, and
that's a 9000 series so we're probably not over 2000 logic gates.  In
transistor count, we're probably talking 900 matrix cells each with 4
pulldowns and a dual current source (I could be confused) which is 4000-6000
transistors depending on what you're counting.


> > BTW, I mentioned earlier abrasion for chip+pin, and in fact I was
> thinking
> > of Nohl and Evans and the Mifare/Oyster work:
> > http://www.usenix.org/events/sec08/tech/nohl.html
> > "Once we had isolated the silicon
> > chips, we removed each successive layer through me-
> > chanical polishing, which we found easier to control than
> > chemical etching. Simple polishing emulsion or sandpa-
> > per with very ?ne grading of 0.04?m suf?ces to take off
> > micrometer-thick layers within minutes."
>
> If the cell structure is known, that shouldn't be necessary since the metal
> layer is visible from the top of the die.
>

Agreed!

Cheers
Ed