Reverse-engineering the standard-cell logic inside a vintage IBM chip

Integrated circuits are often built from standard-cell logic, constructed from standardized building blocks such as NAND gates. Since I've been looking at a chip that uses standard-cell logic, I figured it was a good opportunity to examine standard-cell logic closely by reverse-engineering a simple block of logic on the chip. (It turned out to be a divide-by-16 module.) The diagram below shows the die from an IBM token ring chip from 1993. The chip contains a block of analog network circuitry, but curiously the analog block contains some standard-cell digital logic. Finally, zooming in shows one NAND gate in the logic.

Standard cells let automated tools design a complex integrated circuit from a description in a language such as Verilog. These tools select the appropriate cells from a cell library, place them in rows, and route the wiring between the cells to create the desired logic. This is much easier than a fully-custom design with each individual transistor arranged on the die.1 Vendors supply a library of standard cells2 as well as software to create the design.3 While a library may contain hundreds of different types of cells, the circuit I examined only uses five different cell types, which I will explain below.

Zooming in on the die, the analog block, its standard-cell logic, and finally a single gate. Click this photo (or any other) for a larger version.

The chip

I'll give a brief overview of the chip first, before I scare everyone off with CMOS circuit diagrams. The chip is the large (1.5") square integrated circuit on the board below, packaged in IBM's unusual shiny aluminum can. This chip is the controller for this token ring network board. (I recently wrote about a different token ring IC; the current post describes an older (but related) IC on a different token ring board.)

The IBM 4/16 ISA token ring board. The metal-can IC has part number 63F7704.

Removing the metal lid from the IC exposes the silicon die inside. The die is mounted upside-down on a ceramic substrate, connected to 175 pins by thin traces on the substrate. Instead of bond wires, the die is attached by solder balls on its surface.

The die is mounted upside down on the ceramic substrate.

The photo below shows the die under the microscope. The black circles are the solder balls. They form two rows around the perimeter of the die, but there are also rows of solder balls throughout the chip, distributing power and ground.

Die photo of the chip. (Click for a larger version.)

The chip has two layers of metal wiring: thicker yellowish wires on top and thinner gray wires underneath. The underlying silicon appears pinkish in this photo. Brownish polysilicon wiring is also visible on top of the silicon. Most of the chip consists of rows of standard-cell logic, about 24,000 gates.4 The chip contains a custom microprocessor in the upper left corner. In the lower-left is an analog block that interfaces to the network.5 This block contains a small amount of digital standard-cell logic, which is what I'll describe below.

How CMOS logic is implemented

The chip is built with CMOS logic (complementary MOS), which uses two types of transistors, NMOS and PMOS, working together. The diagram below shows how an NMOS transistor is constructed. The transistor can be considered a switch between the source and drain, controlled by the gate. The source and drain (gray) consist of regions of silicon doped with impurities to change its semiconductor properties and called N+ silicon. The gate consists of a special type of silicon called polysilicon, separated from the underlying silicon by a very thin insulating oxide layer. The NMOS transistor turns on when the gate is pulled high.

Structure of an NMOS transistor. A PMOS transistor has the same structure, but with N-type and P-type silicon reversed.

A PMOS transistor has the opposite construction from NMOS: the source and drain consist of P+ silicon embedded in a substrate of N silicon. The operation of a PMOS transistor is also opposite from the NMOS transistor: it turns on when the gate is pulled low. Typically PMOS transistors pull the drain (output) high, while NMOS transistors pull the drain low. In CMOS, the transistors act in a complementary fashion, pulling the output high or low as needed.

A NAND gate implemented in CMOS.

The diagram above illustrates how a CMOS NAND gate works. The gate consists of two PMOS transistors at the top and two NMOS transistors at the bottom. The first case shows what happens when an input is 0. The corresponding PMOS transistor turns on, pulling the output high. In the second case, both inputs are 1. The NMOS transistors turn on, pulling the output to ground, creating a 0 output. Thus, the circuit implements the NAND function.

By removing one input and the corresponding pair of transistors, this circuit becomes an inverter. By adding additional inputs and pairs of transistors, this circuit can be extended to create a NAND gate with 3 or more inputs. Note that the PMOS transistors (on top) are wired in parallel, while the NMOS transistors (on the bottom) are wired in series; this will be important for the standard cell layout.

The standard cell circuits

The circuit block that I'm examining uses five different types of standard cells (out of the hundreds in the library). In this section, I'll show the construction of each cell type, starting with the 2-input NAND gate, and then the more complex cells. Each cell is constructed as a rectangle that fits between the power rails, with inputs and outputs in a line at the bottom. This standard cell layout allows the gates to be arranged into rows without worrying about the internal construction of the cells. The cells can then be wired together, using the chip's two layers of metal wiring.

NAND

I'll start by examining a 2-input NAND gate cell that implements the NAND circuit described earlier. The photo on the left shows how this NAND gate looks on the die, and the diagram on the right explains the key components. Starting at the bottom, the two inputs are connected to polysilicon wires (red). When these wires cross the N-type silicon (turquoise) at the bottom, they form NMOS transistors. These transistors are connected together by sharing silicon. At the top, when the polysilicon wires cross the P-type silicon (yellow), they form PMOS transistors.6 These transistors are wired in parallel, with one end connected to +5 volts. The metal wire in the middle connects the PMOS transistors to the second NMOS transistor and the output.

A 2-input NAND gate implemented as a standard cell. The photo on the left shows how it appears on the die, while the diagram on the right explains the construction of the cell.

The schematic below shows the transistors arranged to match their physical layout in the cell. If you trace out the paths, this circuit is the same as the NAND circuit described earlier. The structure of the gate is harder to follow in this schematic because the layout is constrained by the needs of the standard cell.

Schematic of a 2-input NAND gate; the schematic layout matches the physical layout.

Once we have determined the structure of the NAND gate cell, we can find all the instances of this cell. The diagram below shows a detail of the chip with four NAND gates marked. The gates are identical, except the gates in the top row are flipped because the power wire for them is on the bottom, not the top. (Two other gates in this photo don't match the NAND cell; they will be described below.) Note the two inputs and the output for each of these gates.

Part of the circuit, with four NAND gates labeled.

The cells are connected together by metal wiring. The chip has two layers of metal. The bottom metal layer is used for the thick horizontal power and ground wiring, the wiring inside each cell, and horizontal wiring between cells. The second metal layer is used for vertical wiring. Much of this vertical wiring passes over cells; because it uses a different layer than the wiring inside the cell, there is no conflict.

3-input NAND

The circuit also uses 3-input NAND gates. The construction is similar to the smaller NAND gate, except there is another PMOS transistor in parallel on top and another NMOS transistor in series on the bottom. While the NMOS transistors are in a nice row, the PMOS transistors require an additional metal wire to connect them in parallel. (The two thick vertical metal wires are not part of the cell.) The schematic is in a footnote for reference.7

Structure of the 3-input NAND gate.

4-input AND

The next gate is more complex: a 4-input AND gate. An AND gate can't be built directly because a CMOS gate requires inversion (because a 1 to the NMOS transistor pulls the output low). Instead, an AND gate is built by inverting the output of a NAND gate, as shown below. In other words, this cell contains two gates.

A 4-input AND gate, created from a NAND gate and inverter.

A second complication is that this gate is constructed to output twice the standard current. It is implemented by using pairs of transistors in parallel in the inverter: two NMOS transistors and two PMOS transistors.8

The result of those factors is the 4-input AND gate cell below. On the right side of the cell is a 4-input NAND gate. It is similar to the earlier NAND gates, but with the inputs connected to four PMOS transistors on top wired in parallel and four NMOS transistors on the bottom wired in series. The series transistors are packed together in a tight row, but the parallel PMOS transistors have a more complex layout due to the +5 connections and the wiring to connect them together. On the left is the inverter, driven by the NAND gate's output. The inverter has two pairs of transistors to provide the high-current output. For details, see the schematic in the footnote.9

Schematic of the 4-input AND gate. The black dot in the middle indicates the connection between the NAND gate's output (metal) and the inverter's input (polysilicon).

Buffer

Next is a non-inverting buffer with triple-current output, using principles similar to the AND gate. The non-inverting action is achieved by putting the output of an inverter through a second inverter, yielding the original value. The first inverter is on the right, constructed from a PMOS transistor and an NMOS transistor. The output inverter on the left has 3 pairs of transistors to provide high-current output. The H-shaped metal wiring collects the output from the six transistors. The schematic is in the footnote.10

Layout of a non-inverting buffer.

Inverter/driver

The final cell type is an inverter with triple-current output. This could be implemented with a single inverter, but the cell uses three inverters in series. The input goes into the inverter on the left, which is connected to a second inverter in the middle. This drives the inverter on the right, which has three pairs of transistors.11

Layout of the standard-cell inverter/driver.

Reverse-engineering the circuit

After determining this set of standard cells, each cell on the chip can be labeled with its function, as in the diagram below. Next, tracing out the wiring between the cells reveals how the circuitry is connected. I noticed a repeated motif of six NAND gates connected as cross-coupled latches; these groups are outlined in black.

The circuit with the cells labeled. The four flip-flops are outlined in black.

The schematic below shows how these 6-cell blocks are wired. After puzzling over this a while, I realized that this circuit was a standard edge-triggered flip-flop. The idea behind an edge-triggered flip-flop is that when the clock signal goes from 0 to 1, the flip-flop latches the value on the data input and holds it until the next clock transition. In this way, flip-flops provide synchronization and a form of memory and are very useful in many applications. The flip-flop outputs the stored value as Q, and the complement of this value as Q.

An edge-triggered flip-flop built from 6 NAND gates. It is wired as a toggle flip-flop

In this circuit, the inverted output Q is connected back to the data input, so every clock pulse will cause the flip-flop to toggle between 0 and 1. Since two clock pulses will cause a single 0→1→0 cycle on the output, this flip-flop divides the clock frequency by 2.

With the flip-flops recognized, I could create the schematic for the complete block of logic. The four flip-flops are arranged in sequence to divide the input clock by 16. The four flip-flops are also fed into the 4-input AND gate, which creates a pulse once every 16 clock cycles.12

Schematic of the divide-by-16 circuit.

Conclusion

Standard-cell logic is the mainstream methodology for designing digital logic. In this post, I've reverse-engineered some of the cells used in a vintage IBM chip and determined the circuit implemented by the cells. Although this specific circuit is not very complex, it's interesting to see how standard cells are constructed and how they are used in a real chip. (Although vendors publish specifications of their libraries, it's hard to find details on the physical implementation of the cells.) The chip I examined is from 1993, so its 1µm technology is obsolete compared to modern standard cell libraries that go down to 7 nm and have many layers of metal wiring, but the principles remain the same.

I announce my latest blog posts on Twitter, so follow me @kenshirriff. I also have an RSS feed.

Notes and references

1. You might think that the standard cell layout is not that different from a custom layout. However, a custom layout can be very tightly packed, with transistors winding all over the place. As an example, the photo below shows part of the 8086 processor. Note that the metal lines on top almost completely occupy the available space. The transistors underneath wind around in complex patterns. In addition, the sizes of the transistors are carefully optimized for their role. This is in contrast to standard-cell logic where transistors have a few, fixed sizes. The point is that a custom, optimized layout may be very complicated to achieve as much density as possible.

   

   A closeup of the Intel 8086 die.

    ↩

2. For examples of commercial standard-cell libraries, see AMI's databook (1996) or a Samsung library (2000). ↩

3. IBM's software for synthesizing Boolean logic was called BoolDozer. Papers on it are here and here. ↩

4. One unusual thing about this integrated circuit is that the CPU, the analog block, and the general logic all use standard cells, but they use different standard cell libraries with completely different layout styles, as shown below. The CPU's standard cells appear to be the densest, with cells between power and ground lines. Horizontal and vertical routing takes place over the cells. The general logic, on the other hand, has larger cells. Wide horizontal bands are used for routing, so only 1/3 of the space contains cells. The logic in the analog block is the least dense. The cells resemble the general logic cells, but larger. The routing wiring is thicker and less dense, looking like little optimization was performed. It's a surprise to find such a variety of standard cell implementations on one chip.

   

   Comparison of standard cells in the CPU, general logic, and the analog block.

    ↩

5. The chip contains a block of analog circuitry implemented in CMOS. This circuitry "performs signal conversion and clock recovery functions as well as detecting and compensating for line impairments". This circuitry includes resistors, capacitors, MOS transistors with special properties, and other components. The analog block uses a variety of circuits such as op-amps, switched-capacitor amplifiers, voltage references, peak detectors, a charge pump, voltage-controlled-oscillator, and phase-locked loop. ↩

6. The PMOS transistors must be embedded in an N-type substrate, while the NMOS transistors must be embedded in a P-type substrate. I suspect that the chip as a whole has a P-type substrate, while the NMOS transistors are in a "tub" of N-type silicon. The substrate doping isn't visible under the microscope, so it could be the other way around. I'm ignoring the substrates in the diagrams. ↩

7. The schematic below shows how the transistors are connected in the 3-input NAND cell. The layout of the schematic matches the physical layout of the cell to make comparison easier. You can verify that the PMOS transistors (top) are in parallel, while the NMOS transistors (bottom) are in series.

   

   Schematic of the 3-input NAND gate.

    ↩

8. Standard-cell libraries typically contain versions of gates with multiple output current levels. A "×2" gate doubles the output transistors, while a ×3 gate has triple output transistors and so forth. Although the different sizes provide flexibility, custom circuitry gives you much more control since transistors can have arbitrary sizes, exactly matching the circuit's need. Typically a gate with higher current output is used if it's driving a long wire or multiple loads. But you don't want to use larger gates unnecessarily, since they have more capacitance and typically take longer to switch. So there are tradeoffs involved. ↩

9. Schematic of the 4-input AND gate with double output drive. It is constructed from a 4-input NAND gate on the right, and an inverter/driver on the left.

   

   Schematic of the 4-input AND.

    ↩

10. The schematic below shows the construction of the non-inverting buffer with triple-current output. It is constructed from an inverter (on the right) feeding a triple-current inverter.

    

    Buffer schematic.

     ↩

11. It may seem strange to use three inverters in series when one inverter has the same logical function, but I think there's an explanation. The triple-current inverter has about three times the input capacitance because of its multiple transistors. Driving this inverter directly would put more load on the gate connected to the input, potentially slowing it down. Adding the two-inverter buffer in front ensures that the cell can be driven with a relatively weak signal.

    ↩

    Schematic of the inverter with ×3 output.

12. Interestingly, this divide-by-16 circuit has four outputs, but only two are used. My first thought was that the others are for testing (since they are connected to internal pads). However, these outputs are simply the complements of the other outputs, so they wouldn't provide any testing benefit. The other possibility is that the whole divide-by-16 circuit is a standardized block, used in other applications. ↩

Germanium transistors: logic circuits in the IBM 1401 computer

How did computers implement logic gates in the 1950s? Computers were moving into the transistor age, but transistors were expensive so circuits were optimized to minimize the transistor count. At the time, they didn't even use silicon transistors; germanium transistors were used instead. In this blog post, I'll describe one way that logic gates were implemented back then: diode-transistor logic.

The IBM 1401 computer, showing some of the cards inside. (Click any image for a larger version.)

The IBM 1401 computer, above, was introduced in 1959 and became the most popular computer of the early 1960s, with more than 10,000 in operation. It was constructed from thousands of circuit cards, each implementing a function such as a few logic gates. The logic gates in the IBM 1401 use (for the most part) a simple form of logic called CTDL (Complemented Transistor Diode Logic) by IBM and DTL (Diode-Transistor Logic) by the rest of the world. As the names suggested, these gates are built from diodes in conjunction with a transistor.1

This SMS card (type CHWW) implements three NAND gates so there are three transistors.

These cards are about the size of a playing card and called SMS cards, Standard Modular System.32 Each type of card has a code, typically four letters. The card above is a "CHWW" card, implementing three NAND gates. It contains a handful of components: transistors, diodes, resistors, and inductors. One unusual component is the jumper bar in the middle, called a "program cap". Breaking off tabs from this bar allowed the functionality of the card to be changed slightly so one card could fill multiple roles. The back of the card (below) shows the traces of the printed circuit board as well as the connector with 16 gold-plated contacts. More details of the CHWW card are in my SMS card database.

The back of the card has the PCB traces and the gold-plated edge connector.

Logic circuit implementation

The CHWW card contains three NAND gates. The schematic below, from IBM's 1959 documentation, shows one of these gates. Note IBM's unusual symbol for a transistor, showing the N-P-N structure explicitly, with an external arrow for the emitter.

Schematic of a NAND logic circuit built from a type 83 transistor. From Standard Modular System Component Circuits, p43.

I've redrawn the schematic below using modern symbols. The arrows show (qualitatively) what happens when the gate has two high inputs. The left arrow indicates the current through the resistor and the transistor's base. This base current turns the transistor on, connecting the output to -6 volts, and producing a low output.

If both inputs are high, the output of the gate is low.

If there are one (or two) low inputs, however, the resistor's current flows out through the diode, rather than through the transistor. With the transistor off, the output is pulled high by the pull-up resistor. The result is a NAND gate: the output is low only if both inputs are high. In this circuit, the diodes are the components that compute the logic function.4 The transistor amplifies (and inverts) the result.5

If an input is low, the output of the gate is high.

There's a problem with this gate though. The output voltages are approximately +6 volts for a high signal and -6 volts for a low signal. You'd like the gate to switch when an input is roughly in the middle of this range. Unfortunately, the transistor in this circuit will switch when the input is around -6 volts. Thus, the input voltage and output voltage levels are incompatible and you can't connect two gates together.

There are several solutions to this problem. The first solution is to use additional diodes and transistors to shift the voltage levels to be compatible. Fairchild used this approach in their popular Micrologic line of DTL integrated circuits in the 1960s.9 The second solution (used in IBM's SDTDL circuits) is to shift the voltage levels by using additional resistors.

The 1401's gates, instead, uses a surprising solution that avoided extra components. In the gate above, the output voltage levels are raised up compared to the input. But a similar gate with PNP transistors instead of NPN transistors will have the opposite property: the output levels will be lowered. So IBM's solution was to alternate gates built with NPN transistors with gates built with PNP transistors. The first gate raises the voltage level up, and the second gate lowers it back down. You have twice as many types of gates, and it's more complex to design, but you avoid the expense of additional components.

The photo below shows the PNP-based NAND gate card. It is almost identical to the previous NPN card, except the transistors are PNP instead of NPN. The other difference is that it is powered with -12V and 0V instead of -6V and 6V.6

The CGWW NAND card is built with PNP transistors.

In more detail, for the NPN gate we first examined, the input switches around -6 volts, and the output is about -6 volts or 6 volts. In the corresponding PNP gate, the input switches around 0 volts, and the output is -12 volts or 0 volts. IBM called the -6V/6V levels type "T" and the 0V/12V levels type "U", so an NPN gate has a U input and a T output, while a PNP gate has a T input and a U output.7 By alternating NPN gates and PNP gates, you have T outputs going to T inputs and U outputs going to U inputs, and everything works.8

The diagram below shows part of the logic diagram from the 1401's adder, heavily simplified. Two type U signals go into the first CHWW gate, which outputs a T signal. The 4JMX gate is a PNP NAND gate that takes T inputs and outputs a U. The CRZV is an NPN buffer that converts U to T. Finally, CNWT is an NPN driver that amplifies a T signal, in this case a binary carry-out signal. Note how the signals alternate between T and U (except for the last special driver).

Simplified excerpt from an IBM ALD logic diagram, page 34.32.16.2.

Wired-OR

There's one more interesting trick with these logic gates: wired-OR. The idea is that you can wire the outputs of several NAND gates together. If any gate outputs a logical 0, that gate will pull the output low. If all gates output a logical 1, the output will be pulled high by the pull-up resistor. The resulting circuit implements an AND-OR-Invert gate. The diagram below illustrates how the NAND gates are wired together and how the circuit behaves logically. Wired-OR circuits are widely used in the 1401 because you get the OR gate "for free", minimizing circuitry.

An AND-OR-Invert gate. This shows two NAND gates but more can be connected.

There's one minor issue with wired-OR: if you wire standard NAND gates together, you end up with multiple pull-up resistors in parallel, which will affect the gate behavior. The solution is to use gates without pull-up resistors, except for one gate that has the pull-up resistor. For example, the 4JMX card has the pull-up resistor (called a "collector load"), while the 3JMX card lacks it. Thus, a wired-OR could use one 4JMX card and the rest would be 3JMX. (This is one reason why there are so many different types of SMS cards.)

Since each card only implements a small amount of logic, the IBM 1401 computer requires thousands of cards. The photo below shows how they are mounted inside the computer. I won't go into more detail here about how SMS cards are combined to create functional units, but I've written about the circuitry in the 1401's adder if you want to learn more.

SMS cards installed in the IBM 1401 computer. The fan at the left keeps the cards cool.

The transistors

These gates use bipolar NPN and PNP transistors, types of transistors that are still used today. But the germanium alloy-junction transistors were completely different from modern silicon planar transistors. The photo below shows the construction of an NPN alloy transistor, It consists of a P-type germanium crystal base with tin/antimony beads fused on either side to form the emitter and collector. The regions of germanium-antimony alloy form the "N" regions. The resulting N-P-N layers form the NPN transistor. (A PNP transistor is formed similarly, using indium for the alloy.)10 In the photo, the vertical metal plate is the base contact with the tiny germanium disk in the circular hole. Copper wires are connected to the indium beads on either side of the germanium disk.

Inside a germanium alloy-junction transistor used in the IBM 1401 computer. This is an IBM type 083 NPN transistor. Photo from IBM 1401 restoration team

The 1950s were a time of rapid change in transistor technology. The transistor was invented at Bell Labs in 1947. General Electric invented the alloy junction transistor (used in the 1401) in 1950. In 1953, the drift transistor was created, faster because of its doping gradient. IBM used drift transistors in the Saturated Drift Transistor Diode Logic (SDTDL) family. The first silicon transistors were introduced in 1954. The wafer-based mesa transistor was invented in 1958, followed by the modern planar transistor in 1959. Thus, transistors were undergoing radical changes in the 1950s and IBM introduced new logic families to take advantage of these new transistor types.

Conclusion

Diode-transistor logic was a key part of IBM's early computers such as the IBM 1401. In 1964, IBM introduced the groundbreaking System/360 line of mainframes. These computers still used diode-transistor logic, but instead of SMS cards with discrete components, the logic was encapsulated in small SLT modules (below) that contained tiny silicon transistors and diodes. An SLT module was roughly equivalent to an SMS card but just half an inch on a side and almost 100 times as reliable. The density, low cost, and reliability of SLT modules were important to the success of the System/360 line.

A board with 24 SLT modules on it, probably from the System/360. The 361453 modules implement AND-OR-Invert.

In the 1960s, diode-transistor logic integrated circuits were introduced. But DTL was soon eclipsed by the rise of TTL (transistor-transistor logic) in the late 1960s. In the 1970s, integrated circuits with MOS transistor logic became common, especially for microprocessors. CMOS logic took over in the 1980s and it's still the most popular logic family. Thanks to Moore's Law, technology has progressed from the IBM 1401 era with a few transistors on a board to modern microprocessors with billions of transistors on a chip.

The Computer History Museum in Mountain View, CA has two working 1401 computers, so stop by for a demo (once the pandemic is over). Thanks to bogomipz for suggesting this topic. Thanks to Randall Neff and Henk Stegeman for SMS card photos. I announce my latest blog posts on Twitter, so follow me @kenshirriff. I also have an RSS feed.

Notes and references

1. IBM used a dizzying assortment of logic families in that era. Even the 1401 used multiple families (mostly the CTDL discussed above but also current-mode and STDTL in the TAU tape controller, and occasional SDTRL).

   The table below from 1963 summarizes IBM's numerous logic families. CTRL (Complemented Transistor Resistor Logic) used alloy-junction transistors. It was slow, operating below 200 kilohertz. CTDL (Complemented Transistor Diode Logic) also used alloy-junction transistors but operated up to 250 kilohertz. (The Complemented families alternate NPN and PNP circuits.) Current mode (similar to emitter-coupled logic) was much faster as transistors weren't saturated and the voltage swings were small (±.4V). It operated at 1 megahertz with alloy-junction transistors, and 7 megahertz with diffused junction transistors.

   

   IBM's logic families from DDTL Component Circuits, 1963, p5.

   For more discussion, see Transistor Component Circuits and Logic families in the 1401. There's an interesting discussion in Wikipedia's DTL talk page by William Crouse, who designed many of the SDTDL circuits at IBM. ↩

2. IBM also offered SMS cards as components for other companies to use in products. The announcement below is from Datamation in 1966.

   

   A product announcement for SMS cards from Datamation, 1966.

    ↩

3. The idea behind Standard Module System cards was that IBM could manufacture a small number of standardized cards and build systems from them. Unfortunately, standardization worked better in theory than in practice and IBM ended up with thousands of different card types. As well as logic functions, SMS cards had a wide variety of roles including oscillators, printer drivers, core memory arrays, sense amplifiers, power supply regulation, and tape preamps. ↩

4. Many vacuum tube computers used semiconductor diodes as a key part of their logic gates. I think that diodes don't get the recognition they deserve; computer generations are divided into tube versus transistor, without recognizing the gradual introduction of semiconductors in the form of diodes. ↩

5. Note the inductor connected to the output of the gate. The inductor increases the speed when pulling the output high. The problem is that the output is pulled high through a resistor, so any capacitance on the output wire results in a delay as it is charged. The inductor counteracts this capacitance. To handwave, once the resistor starts pulling the signal up, the inductor keeps the current flowing. More discussion of the peaking coil here. ↩

6. Here's the schematic of the PNP-based NAND gate used in the CGWW card. It is similar to the NPN-based gate, except the circuit is flipped and runs off -12 volts.

   

   Schematic of a CGWW logic circuit. From Standard Modular System Component Circuits, p42.

    ↩

7. IBM used a remarkable number of different voltage levels for its logic families. The CTDL gates described in this article used the "T" and "U" levels. The table below gives the others.

   

   IBM's logic families used numerous incompatible voltage levels. From the IBM 1401 Pocket Reference.

    ↩

8. I should point out that having two sets of voltage levels makes debugging the 1401 system very confusing. If you measure -3 volts, for instance, this is a logical low for a T signal and a logical high for a U signal. The wired-OR gates also make debugging inconvenient. If the output is low, you can't easily tell which NAND gate is pulling the output low, and these NAND gates may be on different cards with many different inputs. ↩

9. The schematic below shows the implementation of a NAND gate in the Fairchild Micrologic family of integrated circuits. This circuit uses an additional transistor and diode to shift the voltage levels. This was practical in an integrated circuit because the additional components had minimal cost. This circuit wouldn't have worked well in the IBM 1401 because the 1401's germanium components provided a much smaller voltage shift than the silicon components in the Fairchild IC.

   

   Schematic of a Fairchild Micrologic DTL gate from the databook.

    ↩

10. The periodic table shows why elements such as indium were used in the alloy transistors. Note that the semiconductor germanium is in the same column as silicon, which later replaced it. Indium and gallium are in the column to the left, so they have one fewer valence electron. Thus, adding them to the semiconductor makes it more positive (P-type), since electrons are negative. Antimony is to the right; its additional valence electron makes the semiconductor negative (N-type). Tin, in the same column as germanium, was used in the alloy but has no effect on the semiconductor properties.

    

    This excerpt of the periodic table shows key elements in transistor construction. Source: NCBI.

     ↩

Strange chip: Teardown of a vintage IBM token ring controller

IBM used some unusual techniques in its integrated circuits, and one of the most visible is packaging them in square metal cans. I've been studying these chips recently, since there's not a lot of information about them. I opened up the large metal chip—1.5" on a side—from the token ring network board below. This chip turned out to be stranger and more interesting than I expected, combining analog circuitry, a custom microprocessor, and complex logic. The internal packaging was also unconventional: instead of the bond wires used by most manufacturers to connect the silicon die, IBM used a "flip-chip" technique, soldering the die upside down onto a ceramic substrate. Instead of pads, the chip had solder balls across its surface, giving it an unexpected layout and appearance. In the blog post, I discuss this chip in detail.

The IBM 4/16 ISA token ring board. Click this photo (or any other) for a larger version.

The token ring network was introduced by IBM in 1985,1 a local-area network technology that competed with Ethernet and other network systems. In a token ring network, the computers are wired in a ring, with each computer receiving packets from the previous computer and transmitting them to the next computer in the loop. To give a computer access to the network, a special three-byte token circulates in the ring. When a computer receives the token, it can transmit a network packet to the next computer in the ring. The packet travels around the ring until it comes back to the original computer. That computer discards the packet and sends out the token in its place, giving another computer a chance to transmit data. In comparison, an Ethernet network lets computers transmit at any time; if two transmit at the same time, the collision is detected and they try again a bit later. A token ring network had the advantage of avoiding collision, making it more deterministic and fair and providing better performance on a congested network.

IBM's use of square metal cans goes back to the early 1960s with IBM's SLT modules (Solid Logic Technology). Because IBM didn't think integrated circuits were mature enough at the time, they used small hybrid modules with a few transistors, diodes, and resistors mounted on a ceramic substrate. These half-inch-square SLT modules were packaged in an aluminum can for protection, giving IBM circuit boards a unique appearance. In the late 1960s, IBM moved to integrated circuits2 but they kept the ½" metal cans instead of the rectangular ceramic or epoxy packages used by other manufacturers. As integrated circuits required more pins, IBM increased the package size, leading to the bulky 1.5" package that I examined.

To examine the integrated circuit, I removed it from the board with a hot air gun. In the photo below, you can see the grid of pins underneath the chip. The chip is labeled with the part number is 50G6144. The "ESD" suffix indicates an electrostatic-sensitive device that can be damaged by static electricity and requires special handling. The next line, IBM 9352PQ, is a code for the manufacturing site. The final line, 194390074M, shows that the chip was manufactured in 1994 during the 39th week of the year.

The integrated circuit is packaged in a square aluminum can, 1.5" on a side.

Cutting off the aluminum lid reveals the silicon die inside. The chip is mounted upside down as a flip chip, soldered directly to the connections on the ceramic substrate. Thus, you can't see the chip's circuitry, just the underside of the silicon die. IBM called this mounting technology controlled collapse chip connection or C4.3 (In comparison, most manufacturers mounted a silicon die right side up and connected it to the pins with tiny bond wires.) Tiny printed-circuit traces connect the module's 175 pins to the die.

The integrated circuit with the metal lid removed, showing the silicon die on the ceramic substrate.

I removed the die from the substrate with the hot-air gun and then dissolved the solder balls with a mixture of hydrogen peroxide and vinegar. By taking numerous photos with a metallurgical microscope, I created the die photo below. The black circles on the die are the positions of the solder balls, more irregular than you might expect. They are not around the edge of the die (as with bond pads), but overlap the circuitry. The chip is fairly large, about 9×7.9 mm, with features of about 1µm. Note the horizontal rows of circuitry; these are standard cells, which I will discuss below.

Die photo of the chip. Click this (or any other) image for a larger version.

The pattern of solder balls is more visible in Antoine Bercovici's photo below. There are rows three-deep of solder balls along the four sides, as well as rows through the middle of the chip and more in the corners. Roughly speaking, the solder balls around the edges are for signals, while the solder balls in the middle distribute power and ground. Note the tangled metal wiring on top of the chip that connects the solder balls to the underlying circuitry.4

Die photo showing the solder balls and upper metal clearly. Courtesy of Antoine Bercovici.

The photo below shows a closeup of the ceramic substrate that holds the die; compare the pattern to the die above.5 The die was soldered to the rectangular array of contacts in the middle, while the large circles around the edge of the photo are the pins of the chip. Note the dense, complex wiring pattern between the pins and the tiny contacts. The wiring traces are extremely thin (about 30µm), with thicker traces from power and ground. The contacts form a complex pattern. most are in a rectangular array, three deep. However, there are also rows of contacts through the center of the chip, connected alternately to power and ground by the thick traces inside the rectangle, and a few scattered contacts. The contact pattern on the substrate was optimized for the layout of this particular chip. Power distribution was a particular concern.

A closeup of the ceramic substrate showing where the die is mounted.

It's interesting to consider the hierarchy of connections between the coarse 0.1" grid of the chip's pins and the tiny 1µm features on the chip. At the top level, the pin spacing is 0.1" in a 14×14 grid. The solder balls have a spacing of 0.01", so the ceramic substrate reduces the spacing by a factor of 10. The solder balls are connected to the wiring on top of the die, spaced at 0.001", increasing the density by another factor of 10. The top wiring is connected to the underlying wiring on the chip, with a spacing of 0.0001", another factor of 10. Finally, the feature size on the die is about 1µm, another factor of 2.

With this type of packaging, you can visualize the die position by looking at the underside of the IC (below). Because the chip is soldered directly to the substrate, there are no pins where the chip is attached. Thus, the spot with no pins indicates the position of the die.

Underside of the package.

Inside the chip

The die photo below shows the chip with most of the metal layers dissolved, making the transistor structure underneath visible. The chip has three main components: a 16-bit microprocessor CPU, an analog front end for the network signals, and 24,000 logic gates for the main functionality. The chip also has some buffer RAM at the left, and I/O drivers in the middle and bottom. (IBM originally implemented the token ring interface with six analog and digital chips. To decrease cost, they put all the functionality onto a single chip, resulting in the combination of analog and digital circuitry.)

The die with major components labeled. The metal layer has been removed to show the circuitry underneath.

The block diagram below shows the complex functionality of the chip. Starting in the upper right, the analog front end circuitry communicates with the ring. The analog front end extracts the clock and data from the network signals. The protocol handler implements the low-level token ring protocol: it decodes data, breaks packets into frames and performs error checking. Network data is moved between on-chip buffers and the external RAM by the shared RAM control. Finally, a custom 16-bit microprocessor implements the data link layer protocols and controls the chip.

Block diagram of the chip, from IBM's paper.

Standard-cell logic

The chip's logic is implemented with a CMOS standard cell library and consists of about 24,000 gates. The idea of standard-cell logic is that each function (such as a NAND gate or latch) has a standard layout. These cells can then be combined by automated design tools to create the desired logic. (This is in contrast to older methodologies, where the designer would lay out each transistor individually, either on paper or using design software.) Standard cells make chip design much easier, since software can do the circuit synthesis, layout, and routing, However, the design isn't as flexible or optimized as a fully-custom circuit.

The standard cell layout is visible on the chip, with the cells arranged in uniform rows, connected by horizontal and vertical wiring. The diagram below magnifies the die to zoom in on five rows of standard-cell logic, and then a single row, to show how small the cells are on the die.

Zooming in on the die shows rows of standard cell logic. Another zoom shows the details of the logic.

The standard cell below implements a 3-input NAND gate, and I'll explain how it is constructed.6 There are 6 PMOS transistors on top and 6 NMOS transistors on the bottom. The transistors are formed from a region of doped silicon at the top and another at the bottom. Vertical lines of polysilicon, a special type of silicon, form the transistor gates. Polysilicon is also used for vertical wiring inside the cell. The chip has three layers of metal: the bottom layer is used for horizontal wiring, the middle layer is used for vertical wiring, and the top layer connects to the solder balls. Horizontal metal wiring connects the transistors inside the cell and connects the cell to other cells. The two thick horizontal metal wires provide power and ground for the cell. The second, vertical metal layer provides vertical wiring across and between cells. This layer also implements the power connections between the solder balls and the horizontal power wiring visible here. The round dots are connections between layers (silicon, polysilicon, or metal). The schematic on the right matches the layout of the cell.

Closeup of a cell that implements a NAND gate.

In the schematic below, I've removed the redundant transistors and rearranged the layout to make the NAND circuit more clear. If all inputs are 1, the NMOS transistors at the bottom turn on, pulling the output low. If any input is 0, a PMOS transistor turns on, pulling the output high. Thus, the circuit implements a NAND gate.

Schematic of the 3-input NAND gate.

To summarize, standard-cell logic provides a convenient, automated way of implementing logic. A small number of standardized cells implement the basic logic functions. These cells are arranged in rows and wired together to create the desired logic. (From the teardown perspective, standard-cell logic is somewhat disappointing, since the high-level structure is not visible; it's just a bunch of uniform cells.)

The logic circuitry includes some static RAM buffers to hold network data. These were custom-implemented (as were the I/O drivers) instead of using standard cells. The photo below shows a block of RAM cells.

One of the RAM buffers on the chip.

Inside the CPU

The chip contains a 16-bit CMOS control microprocessor that was custom-designed by IBM7 and contains about 10,000 gates. This processor handles the network protocol, controls transmit and receive operations, and manages the shared memory. It runs at 5.34 megahertz and performs about 3 MIPS (million instructions per second). The microprocessor runs code from an EPROM on the board. IBM calls this "microcode", but it's unclear if this is microcode in the usual sense or just firmware instructions.

The CPU, with main functional blocks labeled. The metal layer has been removed.

The CPU is built with standard-cell logic (except for the RAM and ALU), but curiously the cell layout is entirely different from the rest of the chip, presumably because it had different designers. The photo below compares the CPU's logic (left) with the other logic (right). The CPU fits 7 rows of logic in the same vertical space that holds 4 rows of the regular logic. On the other hand, the logic on the right appears to be much dense horizontally.

Comparison of the CPU's standard-cell logic (left) with the rest of the chip (right), at the same scale.

One design feature of the CPU that's visible on the die is its use of multiple PLAs (programmable logic arrays) for instruction decode and control. (Looking at the photo, I count nine small PLAs and a large PLA in the corner.) A PLA provides a structured and dense way of implementing logic (typically AND-OR logic). More importantly, PLAs also provided flexibility and the ability to easily change the design. In the PLA below, 12 signals enter at the lower left. The matrix above converts these to 11 signals that pass to the right. The second matrix generates 8 outputs. The contents of the PLA are visible as the pattern in the metal layer. Since the PLA could be modified by changing the chip's metal layer, bug fixes could even be done after the silicon had been etched.

One of the many PLAs in the CPU.

The CPU contains memory cells for register storage (which they call a 16×16 cache). This RAM design is different from the RAM design in the logic circuitry.

Memory cells in the CPU.

Analog circuitry

The chip contains a block of analog circuitry implemented in CMOS. This circuitry "performs signal conversion and clock recovery functions as well as detecting and compensating for line impairments". This circuitry includes resistors, capacitors, MOS transistors with special properties, and other components.8 The analog block uses a variety of circuits such as op-amps, switched-capacitor amplifiers, voltage references, peak detectors, a charge pump, voltage-controlled-oscillator, and phase-locked loop.

Die photo showing part of the analog circuitry.

One challenge in the design was to minimize "jitter" in the clock signal extracted from the network data. Because each node retransmitted the data, jitter would accumulate as a packet traversed the ring, so each node had to be accurate. They used a variety of techniques to keep noise out of the signal such as providing separate power and ground for the analog circuitry, using differential signals in the circuitry, and keeping logic signals away from the analog circuitry.

The analog circuitry made the chip much more complex to manufacture and test.9 The capacitors and special transistors required special process steps during manufacturing. Manufacturing tolerances were also much tighter since process variations could change the electrical characteristics enough to make the analog circuitry stop performing. Some of the analog circuitry was too sensitive to be tested on the wafer and couldn't be tested until the chip was packaged, making failed chips much more costly. Even so, IBM found it worthwhile to put the analog circuitry on the chip.

Shrinking the chip

IBM originally made the token ring chip in 1988. The chip I examined is a smaller version from 1994. The photo below compares the two chips on a 1 mm grid; the older, larger chip is on the left. Note that both chips have the same microprocessor block (upper left corner) and the same analog block (lower left / upper right corner). The height of the standard cell logic rows is much smaller in the newer chip, probably how they shrunk the logic. The solder balls on the left connect to the underlying circuitry, while the solder balls on the right are routed all over the chip by a third layer of metal.

Comparison of the two chips. Photo courtesy of Antoine Bercovici.

The analog section from the old chip was copied to the new chip unchanged, but the connections to solder balls are very different, showing the change in wiring techniques. In the old chip (left), the solder balls are on top of metal pads that are connected to the circuitry. The layout is similar to integrated circuits that use wire bonding and bond pads. In the old chip (right), the solder ball grid is not anchored to the underlying chip architecture, but follows its own constraints. A new layer of metal connects the solder balls to the pads. The pads remain in their atavistic positions, despite being unused in the new chip.

Comparison of the analog section of the old chip and the new chip. The color of the chips is different due to lighting.

The token ring board

I'll just say a bit about the token ring board that contains this chip. The board is an ISA card from 1994. The IBM chip dominates the board, but there are also numerous other chips, largely 74F-series TTL. There's also a square (and curiously thick) Lattice chip, probably a GAL (Generic Array Logic). A GAL is a programmable logic chip, combining AND/OR logic with flip-flops. A Signetics chip with an IBM label on top is probably a field-programmable logic array (FPLA). Despite all the complexity of the IBM chip, the board requires a lot of programmable logic and simple logic ICs, mostly to interface to the computer's ISA bus. The board has 64 kilobytes of RAM to store network data, two Toshiba TC55329 32K×9 bit static RAM chips. This RAM is accessible both by the network card and by the host PC. The code for the internal microprocessor is contained in an EPROM chip on the board, an AMD 27C1024 chip holding 128 kilobytes as 16-bit words. The EPROM chip has an adhesive label on it with the IBM part number 73G2042, indicating the microcode version.

The token ring board plugs into a PC's ISA slot.

The right side of the board holds the analog circuitry to interface with the network. Five pulse transformers provide electrical isolation between the interface board and the potentially-dangerous voltages of the network. Two bypass relays disconnect the card from the ring when not in use, preserving the ring's connectivity. There are also two transistor arrays along with resistors and capacitors to condition the network signals before passing them to the token ring chip. The card connects to the network via an RJ-45 connector that can be used with unshielded twisted-pair (UTP) cable. It also has a DB-9 connector on the back that can be used with shielded twisted-pair (STP).11

In the 1980s, many different local area networking standards were competing including Ethernet, Token Ring, Datapoint's ARCnet, Apple's LocalTalk, Omninet, and Econet. By the early 1990s, Ethernet won due to a combination of factors: much lower cost (about 1/5 the cost of Token Ring), less complexity leading to faster technological improvement (such as 100 Mb/s Ethernet and switched Ethernet), and a wider ecosystem than IBM provided.10 The complexity of the chip reflects the complexity of Token Ring and illustrates that IBM's technological edge in the 1980s was a double-edged sword: although it initially gave Token Ring a large performance advantage, the simpler technology of Ethernet eventually won.12

The IBM logo is in the lower-left corner of the die, along with the mysterious codename "PINEGR SH".

Thanks to Antoine Bercovici for die photos and information. Thanks to my Twitter readers for discussion. I announce my latest blog posts on Twitter, so follow me @kenshirriff. I also have an RSS feed.

Notes and references

1. IBM's token ring network was inspired by ring network research from the 1970s, such as the Cambridge Ring. ↩

2. IBM called their integrated circuits MST, Monolithic System Technology. ↩

3. The diagram below illustrates the complex construction of a solder ball on the die. Thin layers of aluminum, chromium, copper, and gold are put on the silicon to obtain the necessary properties, followed by a layer of lead-tin solder, which is reflowed to form the balls. The chromium bonds to the oxide layer, while the copper provides solderability and the gold protects the copper from oxidizing.

   

   Diagram of a solder pad, from this paper.

    ↩

4. The metal wiring on the top layer of the chip looks like a mess, but there is some structure behind it. The diagram below shows a small section of this wiring, colored to show the structure. The solder balls are shown in yellow. The red and blue traces transmit power and ground from the solder balls across the chip. These traces connect with the vertical strips of metal wiring that transmit power and ground throughout the chip. The other wiring connects the signal solder balls to the I/O drivers, converging in a narrow band in groups of four. Most of the solder balls are positioned with little regard for the underlying circuitry; the top metal layer provides the "glue" between them and the integrated circuit itself. The result is the peculiar metal pattern visible on top of the chip.

   

   The colored lines show how the top layer of metal wiring connects the solder balls to the chip.

   In most integrated circuits, the I/O drivers are around the edges of the chip next to the bond pads. However, in this chip, most of the I/O drivers stretch in a line across the middle of the chip (indicated above). More I/O drivers are at the bottom of the chip next to the CPU, probably connected to it directly.

   The photo below shows three I/O drivers, side by side. The metal layers have been mostly removed to reveal the silicon underneath. These drivers are fairly complex. The top half contains large drive transistors to provide relatively high-current outputs, along with smaller control transistors. The lower half contains reddish serpentine resistors made out of polysilicon. These resistors help protect the sensitive gates of the input transistors from static discharges. For output pins, these resistors are disconnected. The middle resistor, however, is connected to the input transistor near the bottom.

   

   Die photo of three I/O drivers.

    ↩

5. The die is flipped over when soldered to the substrate. This needs to be kept in mind when comparing the die and the substrate. For instance, the two extra power connections for the CPU are in the lower right of the die but the lower left of the substrate. (Just a note to avoid potential confusion.) ↩

6. I'm not sure which transistors are NMOS and which are PMOS in the gate. I'm assuming the PMOS are on top and it's a NAND gate, but it could be the other way around, in which case it's a NOR gate. ↩

7. The processor is described as using IBM's "universal controller (UC) architecture" but there's very little information about this architecture. Wikipedia claims this architecture consisted of UC0 (8-bit), UC.5 (16-bit), and U1 (32-bit), with upwards compatibility. An alt.folklore.computers thread and this page provide a bit more information. ↩

8. The analog circuitry contains small loops of various sizes that I was unable to identify. They are only connected on one end and have nothing underneath, so they don't seem to be inductors. Twitter readers suggested probe points, disconnected circuitry, or reflective delay lines, but their function remains unclear.

   

   Three of the loops on the die.

    ↩

9. The designers were very proud of the testability of the chip, writing a paper about the testing methodology, and a second paper about testing the analog circuitry. The chip includes a boundary scan feature (kind of like JTAG) and built-in self-test features, as well as mechanisms to isolate the analog block and the CPU for separate testing. ↩

10. Much of the information about this chip comes from A 16-Mbit/s adapter chip for the IBM token-ring local area network. That article describes an earlier version of the chip, so I can't be sure everything is accurate when applied to this chip. (It appears to me that the chips are the same apart from the smaller size of the newer chip.) One source says the two chips are compatible. The older chip has part number 51F1439 while the chip I examined is 50G6144.

    For information on Token Ring, the book The Triumph of Ethernet: Technological Communities and the Battle for the LAN Standard discusses the competition between network protocols in great detail. You might also like Foone's Twitter thread on Token Ring. Interestingly, one of the original "ENIAC Women", Jean Bartik, wrote a 1984 article on Token Rings—"IBM's Token Ring: Have the Pieces Finally Come Together?"—but unfortunately I haven't been able to locate a copy. ↩

11. Token Ring cables could be joined using the "IBM Data Connector", a curious type of connector. The connectors are known as hermaphroditic because two connectors can be joined without worrying about male and female ends. The connectors were nicknamed "Boy George" connectors after the androgynous singer, which seems questionable by current standards. (The nickname may also be motivated by the BOGR text on the connector, which I think indicates the black, orange, green, and red wires.)

    

    IBM Data Connector. Photo from Redgrittybrick, (CC BY-SA 3.0).

     ↩

12. The book The Innovator's Dilemma describes how a low-end but innovating technology can defeat an advanced, entrenched technology. I haven't investigated Token Ring versus Ethernet enough to be sure this model applies, so consider it a hypothesis. ↩