Cette page a au moins 6 ans !
This page is at least 6 years old !

Fujitsu CG10 Gate Array reverse-engineering

These pages are being written in parallel of my NeoGeo preservation project as an organized and publicly available (even if incomplete) reference for reverse-engineering Fujitsu CG10 series gate array chips by visually identifying cells and tracing connections from the bare die.

The layout of the CG10 cells may be identical to those of other series of the same period, like UHB and CG24.

Fujitsu databook cover Legal info: Fujitsu owns patents regarding the master slice structure of their gate arrays. The cell layouts don't seem to be subject to patents but they might be copyrighted as regular mask work. If formally requested, I will take down proprietary information. The present data isn't guaranteed to be fully exact as most of it doesn't come from Fujitsu but from error prone reverse-engineering work. Use at your own risk.

Cell pictures were cropped from the NeoGeo's main graphics chip LSPC2-A2 die, which was imaged by John McMaster (siliconpr0n.org).


Pretty useful files

The CG10 part of the Fujitsu Databook (PDF)
A sorted list of all the available cells with their size and I/O count (ODS)


CG10 are 0.8µm CMOS channelled gate arrays with dual columns. This means the whole structure is made of alternating transistor-filled and empty columns for routing. Each transistor column is made of many rows of two Basic Cells ("BC", a group of 4 transistors) set side by side.

For example, LSPC2-A2 uses the CG10103 master slice, which is one of the largest in the series. It has 21 columns and 291 rows of BC pairs, so 12222 BCs in total. Fujitsu gives a maximum of 11080 usable gates as an estimation for a real, functional design.

The databook explains the architecture clearly:

Fujitsu CG10 gate array structure

The raw master slice doesn't do anything as the BCs aren't interconnected at all. Customization is done by placing pre-designed Unit Cells and connecting them together. Note that a unit cell is made of one or multiple Basic Cells.
Placement of unit cells is done by connecting BCs with a pre-designed metal layout, forming a tightly routed block somewhere in a column. Similarly to a regular integrated circuit, the unit cell has inputs and outputs "pins" to which more metal traces will be routed to connect to other unit cells.

Luckily, there aren't that many different unit cells. This means that most of the time, it's not necessary to go down to the transistor level to figure out what they do. Also, once a unit cell is identified, it can quickly be matched with others visually by looking for similar metal patterns and I/O connections. It seems like unit cells can be turned 180° but are never seen mirrored.


The CG10 Basic Cell

Here's an empty CG10 Basic Cell:

Fujitsu CG10 basic cell


Loading Units

The databook mentions Loading Units ("lu"). These values indicate how many are used per input, and how many are available per output.
Think about TTL fanout. One output will only have enough "strength" to drive so many inputs.

For example, a 18lu output will be able to drive eighteen 1lu inputs. Or nine 2lu inputs... You get the idea.

Most of the CG10 unit cells inputs are 1 or 2lu, and the outputs seem to go from 6 up to 36. It all depends on how Fujitsu engineers designed them. Some unit cells provide the exact same logic function but are declined in multiple drive capabilities, to allow tradeoffs between BC usage (area) and output strength.

How many lu an input uses can be known by finding how many gates it drives. A pair of transistors will require 1lu.
If the input doesn't go to gates only, it can get a bit more complex.

How many lu an output allows can be known in a similar manner, by finding how many transistors drive it in parallel.


Gathering clues for identification


Identifying a simple cell

Here's a simple unit cell using only 1 BC. See how metal (white traces) was added on top of the empty BC:

V2B Cell photo

With a bit of imagination and the help of diagrams from the databook and patents, a layer decomposition can be drawn:

V2B Cell decomposition

Black dots are vias ("nails" going through layers, like on PCBs).
Light grey is Metal 1 (M1), dark grey is Metal 2 (M2).
Orange is Polysilicon, the gate of the transistors.
Green is Diffusion.

First of all, just by knowing that the cell is only 1 BC in size, we know it won't be doing something complicated like arithmetic and that the function will only need 4 transistors at most.

The Fujitsu databooks lists only 5 cells which are 1 BC in size, so elimination can be a quick process.

Spreadsheet screenshot

By looking at the layers, we can see that there are only two "outside" connections: one horizontal trace on M1 going out the right side, and another one on M2 right below, at the bottom right.
Note the "ear" on M2 at the bottom left. That shape is part of the cell's layout and means a connection could have been done there.
For some reason, there are no such shapes at the top, even if they would connect to the same net.

Now we know that there are only 2 connections. This gets rid of the cells having 3 (N2N and R2N), leaving 3 possibilities:

Let's look at the data pages for those:

By looking at the layers, we can see that the input is connected to both polysilicon zones, meaning it drives 2 pairs of transistors. It's a 2lu input.
We can also see that the output is connected to both diffusion zones, meaning it's driven by 2 pairs of transistors. It's a 9*2*2 = 36lu output.

Only one unit cell matches these characteristics: V2B ! It's a simple inverter.
"Power" just means that there's also another similar cell with less drive capability (in this case it's V1N, which only gives 18lu).

Without going down to trace the schematic at the transistor level, it was possible to identify the unit cell and its I/O locations.


Blind vias

Here's another V2B unit cell. This time it's turned around so that the input "ears" are at the top.

V2B Cell with blind vias

The input contact is at the top left. The output is still the center horizontal line, going out the left side this time.

See how the input metal trace runs over the vertical power supply traces.
The power supply vias circled in black are still visible through it, but they only connect M2 to the diffusion areas below.
They aren't connected to the input trace (otherwise it would connect it to VCC and GND !).


Understanding a larger cell

For a few cells, characteristics given by the databook are all identical. Therefore it is necessary to look at what the transistors are really doing to differentiate them.

For example, here's a unit cell 3 BC in size:

3BC cell

The databook lists 16 (!) cells having the same size.

There are 3 traces going directly to polysilicon, one coming from the right and two from the left. Those are 3 inputs.
There's one trace leaving to the left, coming from the middle of BCs. That's probably an output.

Knowing that, the list is cut down to only 6 cells.

Each of the 3 inputs only connect to a single polysilicon zone, so they're 1lu inputs.
The output drive is quite difficult to see, as the output trace goes over a lot of stuff.

In the list, only 4 cells have 1lu inputs:

Having no other criteria to shorten the list, let's trace the schematic. Here are the layers and annotations for inputs, outputs, power supplies and transistor numbers I used:

3BC cell decomposition

Admittedly, this can require some eye squinting and multiple tries. If power supplies end up being shorted, you know that something's wrong.

Apart from the M1/M2 confusion, another source of mistakes can be blind vias.
For example, the pair of vias just below the "Q1" text connects M2 with the diffusion zone only, it does not connect to M1 (the IN1 trace) !
I didn't find a viable way of knowing which layers a via goes through except by guessing from the overall structure. Again, this process can take a few tries before obtaining a schematic that makes sense.

Simply put, transistors are formed when polysilicon goes over diffusion. Those green zones are actually cut beneath the orange ones. When the transistor is turned off, no current flows because of the cut. When the transistor is on, current flows "over" the cut thanks to the voltage applied to the polysilicon (and physics principles I don't really understand...).

Here's the schematic of this mysterious unit cell:

3BC cell schematic

As observed earlier, each of the 3 inputs go to a pair of transistors.
Q1, Q3 and Q7 are wired in parallel to VCC. Q2, Q4 and Q8 are wired in series to GND.
Both of those groups are wired together to a common net, which finally drives Q5, Q6, Q9 and Q10.

For that net to be connected to VCC (binary 1), any of the Q1, Q3 or Q5 transistors must be on. So any of the inputs must be binary 0.
For the same net to be connected to GND (binary 0), each of Q2, Q4 and Q8 must be on at the same time. So all the inputs must be binary 1.

If this unit cell was only made of those 6 transistors, it would be a 3-input NAND gate !
But it doesn't stop there, the net continues to two identical pairs of transistors (Q5/Q6 and Q9/Q10) forming two inverters wired in parallel, which gives the cell's final output. Invert the output of a NAND gate and you get an AND gate.

This cell is N3P: Power 3-input AND ! How cute is that ?

3 input AND N3P symbol

Note how they call it a "power" gate also, as the output uses 2 pairs of transistors for a higher driving capability.

This sort of parallel/series topology can help identify simple gates:

Luckily, the bigger cells have unique data so identifying them doesn't require doing that for hundreds of transistors.
To trace out LSPC2, the biggest cell which required that kind of work was only 8 BC in size.


Visual cell library

Work in progress, come back for more pictures ! Red are inputs, Green are outputs.

Name Description Size Inputs Outputs Mugshot
A4H 4-bit Binary Full Adder with Fast Carry 48 9 5  
B1N True Buffer 1 1 1  
BD3 True Delay Buffer (>5ns) 5 1 1 N2K Cell
BD5 True Delay Buffer (>10ns) 9 1 1 N2K Cell
C43 Non-SCAN 4-bit Binary Synchronous Up Counter 48 9 5 N2K Cell
D24 2-wide 2-AND 4-input AOI 2 4 2 N2K Cell
FD2 Non-SCAN Power DFF 7 2 2 N2K Cell
FDM Non-SCAN DFF 6 2 2 N2K Cell
FDP Non-SCAN DFF with Set and Reset 8 4 2 N2K Cell
FDR Non-SCAN 4-bit DFF with CLEAR 26 6 5  
FDS Non-SCAN 4-bit DF 20 5 4 N2K Cell
FS1 4-bit Serial-in Parallel-out Shift Register 18 2 4  
FS2 4-bit Shift Register with Synchronous Load 30 7 4  
I2B Input buffer 4 1 1 N2K Cell
N2B Power 2-input NAND 3 2 1  
N2K Fast Power 2-input NAND 2 2 1 N2K Cell
N2P Power 2-input AND 2 2 1 N2K Cell
N3K Power 3-input NAND 3 3 1 N2K Cell
N3P Power 3-input AND 3 3 1 N2K Cell
N4K Power 4-input NAND 4 4 1 N2K Cell
N4P Power 4-input AND 3 4 1 N2K Cell
O2B Output Buffer 2 1 2 N2K Cell
O4TF 3-state Output Buffer 4 2 2 N2K Cell
R2K Power 2-input NOR 2 2 1 N2K Cell
R2P Power 2-input OR 2 2 1 N2K Cell
R3K Power 3-input NOR 3 3 1 N2K Cell
T2B 2:1 Selector 2 4 1 N2K Cell
T2E Dual 2:1 Selector 5 5 2 N2K Cell
T5A 4:1 Selector 5 10 1 N2K Cell
T44 Power 4-AND 4-wide Multiplexer 11 16 1  
V2B Power Inverter 1 1 1 N2K Cell
X1B Power Exclusive NOR 4 2 1 N2K Cell
X2B Power Exclusive OR 4 2 1 N2K Cell
symbol symbol symbol symbol symbol