Thursday, October 25, 2018

RetroChallenge 2018 wrap up... and whats next

Retrochallenge wrap up

Retrochallenge 2018/9 is officially over, and judging was completed a few days ago. I'm proud of the amount of progre- Wait I won? I won! I won!!

Ok, I'm a little excited, I went in not expecting to end up in a top spot, being a rookie and all. Big thanks to John Linville and Michai Ramakers for hosting and judging the competition. Also huge thanks to all of the other contenders. As I said before, following along their diverse set of projects while my own progressed was the best part of the whole thing.

The sheer variety of projects really surprised me, with submissions that ranged from dealing with 1960s era "portable" computers, to 1990s era obscure gambling on the Super Famicom. Some mostly dealt with hardware, while others were entirely software (like Forth-ception) and some involved both. A few dealt with RE-engineering antiquated  tech, some involved building new-old software and hardware. A few had a history lesson mixed in (mine included.)

So what's next for the projects I've been working on? I started this blog to document reverse-engineering of the AY-3-8500, and most of it's circuits have been explained so far. Because of this, I'm moving REing it to a back burner in favor of a longer-term project. The chip simulation is very accurate emulation except for one major flaw, it runs at less than 1% of the actual hardware's speed. I considered making a simulation of it based on the datasheets, however this isn't true historically-accurate emulation, and the process wouldn't be easily repeatable with similar chips that are less thoroughly documented in datasheets.

The only way to accurately re-create some of these dedicated game chips is digitize the logic/schematic from die photos. Transistor level simulation unfortunately, is way too slow to be playable. One way to increase speed would be to implement the simulation in a faster language such as C++, the visual6502 team apparently tried this but didn't reach real-time speeds.

Last month I realized that the circuitry could be greatly simplified and still function the same way. Why say, simulate the dozens of transistors which make up a counter when you could emulate a counter with a few lines of code? Since the beginning of October, I've been working on a program called DLAET or Digital Logic Abstraction and Emulation Tool (pronounced "delete" or "dah-leet"). It works like a logic synthesizer in reverse, once done it will automatically convert low-level transistor netlists into more abstract logic, such as gates, counters, PLA, signal dividers, etc...
A debug image from DLAET. The green, red, and yellow wires are redundant,
and have been logically combined with the blue ones

The high level netlists will be converted in to high speed C code, which will emulate the logic in software. DLAET is not an emulator, it's a tool to create emulators from schematics/netlists. The chip I'm using for the initial testing is a >2000 transistor, 2Mhz chip (aka the AY-3-8500). I did some back-of-the-napkin speed calculations, which suggest that a modern CPU should be able to run the test chip at or above real time speed. I also put some thought into what emulation back-end the output code should be tailored for, and decided on MAME. I'll make a fork of it as soon as DLAET spits out some working C code.

The idea of an automatic logic abstracter has some other possibilities. Along with these discrete game chips, many ASICs in home computers and arcade machines. With moderate additions to the code, the digital portions of discrete game boards could be optimized to run much faster, or be emulated in the first place. The output code could also be modified to produce VHDL/Verilog descriptions of the chips put into them instead of C, allowing a physical emulation of the hardware.

Speaking of processing programs, I wrote a program to process image files into netlists back in spring. A cleaned up version of it will be put online, along with the source images for these various projects, to help anyone crazy enough to aid in digitizing these old chips. I stumbled across some similar programs online recently such as Oliver Gailbert's dietools. If only I found that back in February, I may have not created my own program from scratch, or at the very least; not name it "ChipTools" which sounds like a cheap knock-off.

Along with that project, I've worked a little on the SP0256 simulation since the end of September. Unfortunately its slow going, with no schematics, correcting errors involves finding something that isn't working as it should, then tracing the signals to suspicious looking areas. Whenever I make decent progress, I'll update it and post about improvements.

Looks like I've got no shortage of things to work on! I plan on posting updates every few weeks, so stay tuned. Along with these projects, there are one or two side projects that are unrelated to 1970s microchips I might end up posting about as well In the meantime, if you have questions or suggestions, hit that "comment" button below.

Sunday, September 30, 2018

Shifting bits: How a PONG chip generates on-screen scores

In this episode of my ongoing Pong-chip saga, we'll look into the circuitry that tracks and displays the scores on the screen. For those that haven't been following along, I made a simulation of the AY-3-8500 Pong clone chip in order to reverse-engineer and analyse its inner workings. If you haven't been following along I recommend you at least reading the post about the control signals. Oh! I have a little challenge for anyone capable: try to figure out where the score registers/decoding circuitry is in the simulation before scrolling down. (hint: the two players each can have a score from 0-15) Anyway, lets begin!

The part about history

The ability to track and display the scores on the screen was a big selling point for any consoles made with the chip (and thus the chip itself.) Prior to it's release, digital scoring was difficult to implement from a price/complexity standpoint. Arcade machines have a bigger component budget than home consoles, so they generated their on-screen scores with a handful of standard logic chips (e.g. 7400-series or CMOS equivalent), which made up a board containing dozens of chips. Early home consoles could only contain small numbers of chips or discrete transistors (the Magnavox Odyssey had 37 transistors and no ICs) to be competitively priced, so they didn't include features such as digital ball motion, multiple paddles, play-fields, and of course on-screen scoring. Many consoles instead had plastic sliders on them to keep track of scores, or had a simpler circuit in which every scored point moved a square across the screen.
The inside of the VideoSport MK II, showing standard
discrete system innards (photo: Andy Lewis)

Very few systems, such as URL's VA2 systems had these features, because they contained a real arcade circuit board re-purposed for home use. Most people probably did not want to pay 500$ for one of these systems though (2018 price: ~$2,300 or ~1765₤ or ~1979€ aka "very expensive" according to online calculators.) Electronics simply cost too much to allow home systems to play anything more than primitive analog Pong.

Technology was steadily improving however, by 1975 it was possible to fit thousands of transistors onto a single chip. Atari was the first to create and use a custom chip, allowing their systems to have on-screen scoring, color, sound, and digital ball motion at a very competitive price. They kept the chip to themselves though, giving them an edge over other home systems. General Instruments, a big semiconductor company, knew that the many companies that cloned the arcade PONG would want to follow Atari to the home market, so they designed a capable PONG (clone) and sold it to anyone. Thus the AY-3-8500 was born.
Circuit board of the Binatone TV master, a standard AY-3-8500 based system.
The circuit board is sparsely populated, yet it has many more features then the system above.
(From Dave Curran's blog post)
This chip began a family of LSI (Large Scale Integration) dedicated video game chips from GI and other manufactures. Now much more advanced game logic (such as on-screen scoring) was economically possible for home systems. Dedicated game chips were rendered obsolete the 2nd generation microprocessor-based consoles which hit the USA in ~1977. In many other parts of the world though, more advanced dedicated consoles were common into the early 1980s.

The score registers

The scores are stored in two 4-bit ripple counters, allowing scores from 0-15. Those with a good eye may have spotted them on the right side of the chip. Confusingly, the left counter holds the right player's score and vice-versa. I'm referring to these as "registers" even though they are not software-accessible CPU registers (the chip is in no way a microprocessor.)
The two score "ripple" counters

This  "ripple counter" isn't built like a standard ripple counter. In a normal ripple counter, each unit is made of a JK flip-flop connected to it's neighbors which serves as a divide/2 circuit. Each pulse will make the counter advance in binary order. This strange circuit also counts in binary order, it's wired a bit differently however. First, each unit is a little more complex, with multiple SR latches in them. This may make them behave more like JK Master-Slave flip flops (JK-MS flip flops exist where race conditions may be a threat to logic integrity.) Second, the increment signal is connected to every unit, and serves to disable their advance by grounding their carry signals. Because of this, only the top (LSB) counter will advance when the increment single is turned on, when it turns off the next bit is allowed to advance.

This pattern continues down the chain: Each unit is prevented from carrying unless all the units above (less significant) are in a "1" state. You can see this in the picture to the left, the vertical wires in the middle are the increment and output wires (A "1" = grounded) which are each connected through a green transistor to the lower (more significant) bits.

These 8 bits continue on to the decoding circuity. One last note, the registers will roll over to zero once a 1 is added to 15. A NOR gate below the registers will activate when all bits hold 1s, this prevents the score from "increasing" any farther, locking it at 15.


The multiplexer

The 8 output wires from the score counters travel to the left in a "U" shape. These connections end in a multiplexer which selects which player's score is fed into the decoder. The multiplexer is a set of 8 NAND gates, four are powered by either the drawLeftScore or drawRightScore at any one time. The NAND gates are very simple, instead of a transistor with one side connected to ground, its side is connected to another transistor with it's other side connected to ground. Both transistors must be on to ground the output, making a NAND gate.

Following drawLeftScore leads to a flip flop controlled by horizontal control lines 6 & 12 (these are triggered at the center and left walls respectively.) The drawRightScore node is the opposite state of this. If you run the simulation, you should be able to see that the value going into the decoding circuitry will be switched to the other player's score at these points.

Above the multiplexer is a binary decoder (see below). One 4-bit value goes in, one of the 16 (24) output lines is activated (this is called one-hot as only one is active at a time.) To accomplish this the 4-bit value is inverted to make a total of 8 inputs, these much match up with the transistors to allow the output to be pulled high. At the top of the decoder are three transistors connected to the most, second most, and third most significant inputs. These transistors build a (bit3 AND (bit1 OR bit2)) gate. Numerically, this functions as a >9 check for 4-bit numbers, indicating if the circuitry should draw a "1" in front of the digit. We'll see where this "draw 1" signal leads to in a moment.

First part of the decoding circuitry. The decoder (right) turns a 4-bit number into one of 16 outputs (light blue)
These can trigger one of 10 inputs (yellow) into the encoder (left)

Some of the 16 possible outputs are ORed into 10 output lines as they travel to the left (with a NOT+NOR circuit) as the circuitry only needs to know the other digit. 13 and 3 are ORed onto the "3" signal, 12 and 2 onto the "2" etc. 6 is not ORed as there is no output 16. These 10 signals go into an encoder (left) indicating which 10 segments of the digit should be drawn.

Parts of the digits

The simplest way to turn a small binary number into a digit is to use a BCD (Binary-Coded Decimal) to 7-segment converter chip. This won't work in this case, as instead of sending seven signals to different lights, the circuit must turn a single signal on and off at specific times to draw a digit on a screen (plus BCD only goes up to 9.) There are probably many different ways to implement this, the AY-3-8500 achieves it by splitting the digit into five rows and three columns.
The different segments of the score, and their names.
The above diagram shows how the digits are split. I decided naming them with directions would make this easiest to follow. Note that the two red boxes are always on for any possible digit, and that the SW corner segment is controlled by the south segment, as it doesn't need to operate independently.

One thing that made me scratch my head for a while is the fact that the scores are not symmetrical, the rightmost side looks cut-off. This wasn't due to a bug by me as I found out, but by the chip's design. Looking closely at some footage (skip to 4:13 and look at the "11"s) I found that this exists in real chips, at least some revision of them.

Vertical score position tracking
Circuitry to track the current row being drawn is above the encoder to the left. The HsyncNOT_ON2 signal, which is toggled once per scanline, goes into a 2-segment shift register which functions as a one-quarter signal divider. Each scanline * 4 * 2 (due to interlacing) = 8 scanlines, thus each row is 8
scanlines high. This divided signal advances the 3-bit linear feedback shift register (LFSR) on the right, which keeps track of the raster beam's vertical position. This counter is normally kept at 0 unless the currently drawn spot is between vertical signal 7 (below sideline) and 8 (below score) due to a latch. This latch also directly disables the score output.

The 3 pairs of signals from the LFSR counter travel into a decoder where they activate from top to bottom (on the chip), the Top, Bottom, Middle, Upper, Lower, and Disable row signals (see picture). These five signals travel rightward into a matrix of specialized logic which compare them with the ten possible score-based signals to generate the right side, middle, and left side of the digit.

The logic matrix. The disable signal is present when none of the other vertical signals are.

This logic matrix is above, note that the right, middle, and left signals are active low. You can see how the constant segments are implemented, the two red transistors (connected to Vcc) force the upper and lower middle segments off, creating the holes in the digit "8" and every other digit. The right-side bottom and middle segments are grounded by the blue transistors and thus always on. The wide transistor t the left of the "Bottom" label controls both the left and middle segments, making the "South" signal affect both. Smart tricks like these reduce the number of transistors and die space needed to implement the circuitry, as both were at a premium in the mid-1970s.

The shift register

The last component in this chain of score circuitry converts the four segment draw signals (right, middle, left, and "1") into a single, timed signal. The chip uses a shift register to do this. Unlike the previous shift registers, this one takes in a parallel input and shifts it out serially. This shift register is located directly below the encoder and the encoder's inputs. Also unlike the previous shift registers, this one does not have an orderly repeating structure. Another interesting thing about it is that there are some "missing" transistors, spots where they look like they should be but aren't. It's possible that the designers changed the circuit after drawing part of it, and didn't remove the old traces from the layout.

A diagram for the score shift register
The shifter's operation is fairly straightforward, 10 wires with no pullup transistors function as capacitors. A load signal called at the left side of each score fills every other capacitor with the four possible values, plus one which is always low to create a gap between the 1 and the digit on the screen. The two clock signals alternate on and off during the width of the score at half the normal clock rate, first green on red off, then red on green off. Each toggle of the clock will cause half of the capacitors to override the capacitor to the right (with an inverted value). The bits travel from left to right so the "1" signal is output first, and the digit's right side last.

These bits control a large transistor (in the lower right in the screenshot above) which drives a wire leading towards the lower-left corner of the chip. Two other signals may disable the score output wire, the latch from the vertical circuitry, and a circuit that serves to hide the scores during some parts of the rifle games. The score output intersects with the field generation circuitry and goes to the score/field output pin. Outside the chip it is mixed with the other outputs and possibly given color, creating a viewable television signal. ...And thus, as advertised, digital on-screen scoring! (the '70s were a whole different time...)

And that's all folks! I'm glad I managed to get in a last-minute post before the RetroChallenge ended. I'm wondering how many others had 11th hour sprints... Looking ahead I've got some ideas for both a small and large project which I'll describe in a little more detail soon. For now, thanks for reading, and I hope you all had a wonderful September!

Thursday, September 20, 2018

A visual simulation of the SP0256 (beta)

Well... I got a little distracted over the weekend. For those that haven't been following me, I built a transistor level simulation of the AY-3-8500 Pong-clone System-on-Chip over the course of several months. For this September's RetroChallenge, I've been reverse-engineering chunks of it and posting my findings here. I'm sorry to say that I haven't worked on it at all since my last post, because instead of that I built a new simulation of a entirely different (and much more complex!) microchip; the SP0256.
The chip is HUGE! This is less than an eighth of it's surface

Well, its been a productive few days, here's what happened.

Along with the AY-3-8500, there are a slew of other antique chips I was interested in (e.g the AY-3-8600 series, the MPS7600, etc) and reading about, the SP0256 included. The SP0256 is an fascinating piece of circuitry, in short; its a speech decompression/synthesis chip. It was used in countless classic computer expansion cards, expansions modules for video game consoles, and an untold number of hobbyist projects. This particular one came from the Intellivoice expansion for the Mattel Intellivision. You can listen some sounds from it in the video below.

I would've love to mess around with transistor-level emulation of this chip, however the process of marking the components can take several months of work, and I think that I've done enough highlighting (for the AY-3-8500) already in 2018.

Then last Thursday I stumbled across this thread on AtariAge, where, lo-and behold another retro-geek had highlighted and cleaned up the entire SP0256 chip! Several months of work, already done, just ready to be turned into a simulation, thanks very much John PCAE! After finishing my last post on Friday I started creating a python script to remove curves in the image, which was partly unnecessary as it turned out. By Saturday afternoon I put the image into the image processor I built to process the AY-3-8500 (which I still need to clean up and release...), and after several errors were fixed, the program spat out segment and transistor definition files, which were actually larger than the source image.

Very late Saturday I put those files into a copy of my previous simulation code and turned the clock on and off. It didn't do very much at first. Toggle buttons and output displays tailored for the chip were added into the simulation. The next four days were filled with finding and fixing the bugs/errors in the source image, my python script, my image processor, and the simulation itself as well as learning more about the chip and the way it generates the sound.

And here it is, a (partially working) transistor-level emulation of the SP0256. Note the word "beta" at the top, there's definitely more work to be done. There are still plenty of bugs to iron out, chiefly the chip will not disable the instruction decoder while shifting a new byte in, resulting in several spurious instructions being (partly?) executed for every real one. Chances are that some wire didn't get overlain or processed correctly, I just need to find it (I've already managed to fix many other errors.)
You probably will have no idea whats going on (don't worry that's normal) I'll explain the workings more in-depth eventually, for now there are a few points of interest you can look at.

1. That big rectangle on the right is a 2 Kilobyte ROM containing a program to generate the generic phrases used by the Intellivoice, like "Mattel Electronics Presents". The chip supports internal and external ROM chips, such as game-specific ones inside the cartridges. The active selection column will change as the program progresses.
2. Here is a counter + decoder which generates multiple low level timing signals. If you let the chip go the control lines coming out to the right will pulse at regular intervals. Interestingly the lowest and third lowest signals are not connected to anything. The signal generator works almost exactly the same as the ones in the AY-3-8500.
3. The instruction decoder is here. Thanks to intvnut for figuring out which lines mean what opcodes, they are now named accordingly. The instruction set is listed on this page.
4. The clock circuitry is here, if not disabled by a low standby reset pin, it will advance the internal circuitry, as well as external circuitry through the ROM clock pin (lower left)
5. The chip outputs an analog sound waveform through a digital PWM pin (Pulse Width Modulation.) On the right hand side is a virtual oscilloscope trace of it, which currently only generates a repeating pattern due to stated bugs. Once the output starts working I'll add in a simulated analog waveform tracker, and possibly a way to export this sound to a file.

You may notice the simulation runs a little slower than the AY-3-8500 simulation, its a bigger chip (at least in complexity, not necessarily physical size.) A little comparison table is below
Logic Transistor Count
Physical Size
~31.36 mm2
Die Photo Size (pixels)
Clock Rate
Introduction Year

Early 1980s

Wow, I'm amazed I got this all done in less than a week! I'll admit it's not as polished due to the rush, that will be fixed eventually. Next I need to get all the errors ironed out so the virtual chip can actually produce a waveform. I'm still going to work on the AY-3-8500 sim and talk about it, specifically the score circuitry next. Lets see what I can do in the next 1.5 weeks!
In the meantime, comment or ask questions below (come on, at least something went over your head.) I'm announcing my posts on twitter so give me an upvote! (Oops, wrong site.) If you want to see someone sail a sailboat while using an Apple ][ to obtain GPS coordinates or something along those lines, head to the RetroChallenge entrants list. And now to end this post with a few words of wisdom...

Friday, September 14, 2018

Games and Field Generation in the AY-3-8500

The AY-3-8500 system on a chip powered millions of PONG clone consoles made during the later 1970s. It's internal circuitry is made up of over 2000 transistors, all on an area smaller than a fingernail. A few days ago I reverse-engineered the game select and field generation logic, and found a few interesting things to share. Lets have a look inside this antique circuit.

To recap, the AY-3-8500 was first made by General Instruments (now defunct) in 1975 to allow anyone to make a cheap PONG clone console. The chip has no ROM or micro-controller, it contains specialized circuitry that allows it to play five variants of PONG at multiple difficulty levels. In 2017 Sean Riddle decapped a specimen with acid and photographed the interior. Over this year, I built an online simulation of it based on the work of the Visual6502 team, which I released about a month ago. Now I'm analyzing the components to figure out what makes this thing tick.

The Telstar Ranger, a standard system made with the chip. Image used with permission from PONGstory

Above is a quick video showing all the games (except Handicap) running on an original console called the Telstar Ranger. Coleco's Telstar series of 1st generation consoles made use of high-integration game chips in its many incarnations. In the console, selecting different games changes the internal logic, turning game field elements on or off to create a (then) realistic play field. We'll be looking at just how this process is carried out. If you want to, you can follow along in the simulation. I've updated it since my last post.1

Games on the System

As the chip has no ROM, different games are achieved by turning parts of the circuitry on and off, according to the game select logic. All video games systems prior to Fairchild's channel F had "canned" specialized circuitry and sometimes interchangeable cartridges containing additional circuitry. The AY-3-8500's design allows it to play five variants of PONG-like games; plus two light-gun shooting games. The light-gun games were only possible with a gun peripheral and supporting circuitry. In addition to the games, there were three difficulty switches which could change the paddle size, along with the ball speed and rebound angle. Many consoles made with the chip didn't support all the available games or difficulty settings, possibly to force consumers to buy multiple systems.

The datasheet describes six of the games. First game on the system is Tennis, which is a standard two-paddle game of PONG. Soccer, which features a narrower goal and forward paddles. That's american soccer which most of the world would call football. The manuals I found refer to it as Soccer, so I'll use I'll call it that from now on. Its also been referred to as "Hockey", on some consoles. Next up is Handicap, an undocumented form of Soccer where the right player has another defensive paddle. Squash, (sometimes called Ali-je) where players take turns bouncing the ball against a wall, and last of the ball games; practice, a one-player variant of Squash. Rifle game 1 involves a shooting target bouncing around the screen, each hit and miss is counted. Rifle game 2 is similar, but the ball/target travels from left to right and must be shot before leaving the screen.

List of system game variants (Pong Story)
Each game has a pin dedicated to it, which, when connected to ground, selects the game.2 The hidden Handicap mode is triggered when no games are selected. Most consoles built with the chip used a slider or rotating switch to select which game is played. I wondered what would happen if you selected multiple games at once. Lets look inside to find out!

Selection Logic

Game select pads (blue) and
score/field output (red)

The six game select pins are connected to six pads in the lower left corner of the chip's die. If you're following along with the simulation, you can use the game select check-boxes on the control panel to turn the pins on or off. The pins are active-low, so they will become dark/grounded when activated. The pads have thin traces connecting them to game select logic. These traces go pass a special transistor (green) called a ggNMOS to protect the circuits from ESD.

The game select logic is in the lower left corner. In the center is a simple binary decoder fed with inverted (active high) game select signals as inputs. By default, the "tennis" wire should be lit up (this is not pinTennis) Seven control signals leave the decoder and travel upward. A transistor connecting a game select and control line will activate that control line.

Output signals from left to right; disableGoalPaddles, leftWallDisable, disableP2Forward (which also disables the goal walls), isRifleGame, disableP1Squash, disableP2Squash, and lastly closedGoals. The names are pretty self explanatory, these signals serve to disable internal circuit's based on the selected games. The Practice, Squash, and Rifle2 game signals also directly disable some components. For example, the "practice" signal alone grounds the 5th horizontal control signal, which normally would trigger the drawing of player 2's score. If your wondering how the horizontal and vertical signals are generated you can read my last post.

Game combinations

A generated frame of Handicap

The simulation allows us to see exactly what happens when we trigger a combination of pins. Since all the control signals act as inhibitors, not activating any game results in a game with every element except the full left wall. This is the undocumented "handicap" game. Player 2's extra defensive paddle is his/her own squash paddle, no longer disabled by an active soccer pin.

Squash directly activates a total of six transistors in various parts of the chip, for currently unknown reasons. Whatever effect this has on the game, you can experience in single-player mode by also triggering Practice. If you activate Squash or Practice along with Tennis, the game will "play" with no paddles or vertical lines.

Most combinations with soccer activated play regular soccer as the internal soccer signal forces the all the other internal signals off. There are three exceptions to this which are generated by a pair of AND gates to the left of the decoder (see picture above.) If soccer and squash are activated, the bottom AND gate activates the disable node, which freezes much of the chip's circuitry in place. This may function as a (no display) pause feature. Two things about this combination puzzle me, some (ball related?) circuitry still advances when this combination is activated. Also, in the manual's sample schematic, diodes connect these two pins to the reset pin, which means this "game" should trigger when a reset button is pressed for some reason.
Two diodes connecting squash and soccer games to reset

The top AND gate creates unique behavior for a soccer-practice combination, the aptly named soccerPractice node activates two transistors here in the ball circuitry while playing a regular two-player soccer game. I haven't analyzed the ball circuitry yet, so what exactly this does will remain a mystery for now.

The last game combination is Rifle2 and Soccer, which, once again plays a variant of soccer. The "r2andSoccer" node will ground the Tennis and Rifle1 input pins during certain parts of the screen drawing. This may seem pointless, but the AY-3-8500 (game logic) and AY-3-8515 (color adder) chips share game select inputs.3 If connected to color circuits, the color palette may change mid-screen, as seen on this trace below.

Yellow = Rifle1 grounded. Green = Tennis grounded. Blue = both grounded.
Every other line has been made normal for viewing purposes

Play field generation

The video signal of the AY-3-8500 comes out of five different pins. Each pin is dedicated to drawing a portion of the game (Score/Field, Left Player, Right Player, Ball, and Sync.) This allows each to be assigned a different brightness value with a resistor, or a color with a support chip. The score/field out pin receives it's signal from four internal circuits, the score-drawing, side-lines, the middle line, and goal wall circuits. Each component has been given a different color in the output below. Notice that the play-field is not symmetrical (look closely at the corners) due to the exact timing of the control signals.

Below is a schematic I made of the field generation circuitry. It may seem a little confusing as almost every gate has an inverted output (this is the nature of MOS.) Lets work our way in from the output pin. The schematic has a lot of NOR gates, because multiple input NOR gates are very easy to implement in MOS logic. In NMOS chips, NOR gates are achieved by having a pullup transistor which defaults the output to high, and any number of input transistors which may ground it. The majority of the NOR gates actually function as AND gates with inverted inputs. If every input of a NOR is low, then the gate outputs a logical 1. The circuitry is constructed NOR (yellow inputs) -> inverted AND (grey inputs) -> NOR -> inverted AND, so few additional inverter gates are necessary.

We can find the output pad in the lower right of the chip and the diagram. A large "J" shaped transistor inverts and drives the output. This driver transistor connects to a pair of large transistors over to the left. The lower of these two transistors connects to the score generation. The score circuitry is complex (it takes up about 1/8th of the die surface) and will be covered in its own post. For now we'll focus on the top transistor, which connects to the play-field circuits. The isRifleGame signal grounds the node powering this transistor, preventing the field from being drawn during rifle games. Importantly though, the walls and sidelines still exist. They're just invisible, and they control the target's behavior during the rifle games.

NOR SR latch
The sidelines, middle line, and goal wall circuits converge on a single NOR gate above here. Off to the right (in both the chip and diagram) is the sideline generation circuitry. The sidelines are simple, two dotted lines at the top and bottom of the screen. Vertical control signals 4 OR 9 must be active to enable drawing, and the "halfClock" signal must also be, which causes the lines to be dotted instead of solid. Lastly, a SR latch prevents the sidelines from being drawn, unless the electron gun is inside the play-field.

This SR latch is shown on the right,
in a powered state. This latch is a bistable flip-flop, meaning it has two stable states. Hrz. control 4 (left of play-field) sets the latch into a set state. Hrz. control 9 (right of play-field) resets the latch. One fundemental problem with a basic SR-latch is that if set and reset are triggered at the same time, the flip-flop will enter a random state. A basic SR latch is fine here, as the two control signals should never activate at the same time. The end result of these circuits? Two dotted horizontal lines at locations specified by the control signals.

Middle and Goal walls

The middle wall output is based on three conditions. First, horizontal control signal 6 (middle wall) must be present to draw the middle wall. Next, the middle wall will be disabled if the "disableGoalPaddles" signal is triggered by a game of squash or practice. The last bit of circuitry limits it's height to that of the play-field. Another SR flip-flop, (controlled by vertical signals 3 & 9) restricts it to between the two sidelines. This is important, as drawing anything for the entire height of the screen would interfere with the vertical sync signals, possibly making the video output unwatchable.

Last up are the goal walls. As seen in the video and pictures above, both walls are partially closed during a soccer or practice game, making it harder to score (the forward paddles balance this out.) The left wall is fully closed during squash or practice, while the right wall is entirely open.

For the walls to display, the electron gun has to be in the correct vertical range just like the middle wall (it shares this circuit.) To dot the walls, the everyOtherScanline signal is factored in (this signal is already generated by the vertical circuitry.) However the screen is drawn twice due to interlacing, because of this, every other pair of scanlines is drawn.

From here the two walls are generated by separate gates, each with their own inputs. The insideGoal signal must be off for either of these to draw. This is set and reset by vertical signals 6 & 5, goal start and goal end respectively. The closedGoal game control signal disables vertical signal 6, preventing the goals from ever starting. Each wall will be drawn in full, unless one of them is disabled (as in Squash and Practice.) The inside goal tracking flip-flop happens to always start in the state inside the simulation, causing the first field to be shaped in an anchor pattern. All of the field generation flip-flops are not reset by the reset signal, which means the first field after a reset may be drawn incorrectly.
Rifle game 1 ball trap

To detect a collision off of the sidelines, the ball circuitry uses the direct signal from vertical control 3 & 9, as the sidelines are always present. There is no circuitry to detect a middle wall collision, as the ball can never collide with the middle wall. The goal walls have multiple possible configurations, so their output also feeds into the collision circuitry (as indicated by the arrows in the schematic), even when the play-field is hidden during a rifle game. An interesting thing I found is that the right wall is closed during the 1st rifle game to trap the target inside, as seen trace of the fieldOut signal. In rifle game 2, the walls are open, allowing the ball to "escape" after about a second.

Wrap Up

Using the horizontal + vertical control signals and game inputs, the AY-8500 uses binary logic to decide when/where to draw the play-field. The game select logic revealed possible additional game variants, which might be playable on real hardware. Next time I plan to write about the score circuitry, which  is fairly large and takes up about 1/8th of the chip's surface.

Feel free to leave any questions or comments below. If your here from the RetroChallenge (9/2018) you can check out the other participant's projects here. If your not, why not check them out anyway?


1. The simulation has a few new features since the original upload. It will now display the paddles (green and blue) at the scanline set by the two text fields next to the score input. You can also toggle the four setting pins as well. I've labeled over 100 nodes while reverse-engineering this, and the node names file has been updated. Oh and one or two bugs have been squashed, which probably created a dozen more ;/

2. While doing a little research I found a few references to a Russian (Soviet) clone of the AY-3-8500 called the K145IK17. It apparently had an internal counter and de-bounce circuit so a single button could rotate through all (7) games. Not much about this, or most Soviet gaming systems for that matter, is documented online. The AY-3-8500 was also cloned into the TMS1965NLA by the guys on the opposite side of the world

3. While grounding the Tennis select pin may change the game's colors, the AY-3-8515 color chip does not use Rifle1's signal, which appears to only change outside of the visible screen. Also, Tennis signal is not grounded (green) during the right goal walls. There may be a small delay in the color chip which compensates for this. 

Sunday, September 2, 2018

Entering the Retrochallenge! (09/2018)

I decided to partake in this September's Retrochallenge! I learned of it's existence a few weeks ago, and as I'm already doing an old-tech related project, I decided to sign up. The 22 other entrants and I will be put onto platforms in a closed arena. Once the signal sounds, we have to run/hide/fight and gather old computers in a battle to the death!! May the odds of hardware failure be forever in your favor!

Just kidding! That's the hunger games. Everyone should (hopefully) come out of this challenge alive on October 1st.

For those who aren't coming from the challenge page, the Retrochallenge is "a loosely disorganised gathering of RetroComputing enthusiasts who collectively do stuff with old computers for a month." Its been going on for a few years (with no recorded fatalities.) The other entrants have a slew of interesting projects, ranging from an emulation of a 1960's "portable" computer, to building a KCS tape decoder out of discrete components, to homebrewing games for classic microcomputers. Following their projects will be half the fun! Good luck guys.

And now for my project (this will be familiar to anyone who has been following me along.) Over the course of this year I turned a set of die photos into a transistor-level simulation of the AY-3-8500-1 PONG-clone chip (see my first post if you have no clue what that is.) Over the course of this challenge, I'm going to be reverse-engineering the circuits that make this chip tick. I'll also make a few improvements to the simulator along the way. I don't have any particular goals planned for this subset of the project.

The other part of the project has a clearly defined goal, to build a playable simulation of the chip that remains as faithful to the original as possible. I haven't even decided on a programming language/environment to use yet so there is plenty of work to be done. If all goes well, I should have a playable version and a few posts about the internal circuitry by the end of the challenge.

Well, better get started! Anything of significance to the project will be posted on this blog. You can also follow the overall challenge's progress at Wish me luck!

Sunday, August 26, 2018

Control and Sync Generation in the AY-3-8500

In my last post I showed off a virtual tangle of spaghetti circuit map called the AY-3-8500. I've been looking close at the circuits to understand it, and I'm sharing anything I find on this blog. Lets start with the control signals and sync generation circuitry.

To recap, the GI AY-3-8500 was a PONG clone chip produced from the late '70s to early '80s. When connected to controls, support circuitry, and a television, it could play several variants of PONG plus two shooting games in black and white. That's all. Millions of them were produced and used in first-generation video game consoles. More on the history in my first post.

Sean Riddle decapped and photographed a specimen from his own Hanimex 777 last year. I decided to undertake reverse-engineering it's internal circuitry, and build an online virtual simulation of it in the process.
The simulation allows the user to step through individual clock cycles and view the transistors as they turn on and off. You can find the chip simulation here, and some information about it in my last post. You can follow along with it by clicking the link above, or the links to specific areas throughout the article.

MOSFET mechanics

An explanation of how the internal electronics work is necessary. The chip contains 23531 transistors which act as tiny switches, all in an area smaller than a fingernail. All of the transistors in this chip are NMOS transistors, short for n-channel MOSFET (Metal Oxide Semiconductor Field Effect Transistor). MOS technology allows the creation of smaller transistors than other semiconductor processes, resulting in chips containing tens of thousands of transistors by 1980, and billions today. The 'N' stands for n-channel, transistors made this way will open when their gate voltage is high, also known as enhancement mode transistors. NMOS technology allowed for the fastest compact MOS transistors, before more advanced CMOS technology became widespread in the 1980s.

Above is a side view of an NMOS transistor, along with a top view of some transistors in the simulation. Each transistor has three connections, the gate, the source, and the drain. A layer of oxide (green) crosses the source and drain (blue lines). When the wire (grey) connected to it's gate is powered the source and drain become electronically connected. From only transistors and wires, logic gates, adders, and entire microprocessors can be built.

The chip has four important layers.2 The transistors (green), the metal traces (grey), the diffusion areas (blue) and vias (light blue). Diffusion can only form the source/drain of transistors, metal can only form gates. For diffusion and metal to connect, they need to travel over a via, which functions as a square hole in the insulating layer.

The clock circuitry

According to the datasheet, in a normal configuration, the chip uses a standalone 2.012Mhz oscillator. Sometimes the chip may be wired to the AY-3-8515 color adding chip, which outputs a 2Mhz clock signal from its own oscillator (the majority of systems made with the chip stuck to black and white.) This signal is wired to pin 17 (clock in). In a real chip, thin gold bond wires attach the pin to a pad on the die surface. In the simulation, the clock pad is the third from the bottom on the left hand side. When you start it, the support code should quickly switch the clock pad on and off, simulating an external clock.

The clock pad
The pad is connected to a L-shaped transistor through a layer of diffusion. When the clock pin is powered, this transistor grounds a node named "internal_clock". A node is the collection of all wires connected to one another. Their are a few things that need explaining. First, below the L-shaped transistor is a rectangular transistor powered by ... the ground node? This is a gate grounded NMOS, a form of ESD (ElectroStatic Discharge) protection. All input pins on the chip utilize them to help protect the delicate internal circuits. Second, above the L-shaped transistor is an unseen pull-up transistor. These will "pullup" the node into a high voltage state, unless any part of the node is grounded. The chip has a lot of them (860 to be exact) all lined up next to the Vcc (power) conduits. In a pullup transistor, the connected node both controls the gate of the pull-up and connects to the drain of the transistor, reducing leaked current. One last note, the internal clock's signal will be inverted from the one coming in. This doesn't matter in the case of the clock input, just remember that most of the input pins are also inverted.

A total of five pullup-transistors (white) near the clock pin (Courtesy of Sean Riddle)

The internal clock line goes two ways. Following it up a little ways upward leads to circuitry that generates a two alternating clock signals. The circuitry has four nodes running vertically, labeled here as 1,2,3, and 4. There are two other important nodes, lets call them linger and disable. The metal in linger functions as a (very weak) capacitor. Clicking on it will display the words "NO_PULL" in the upper-right. Because it has no pullup transistor, it's state will "linger" from what it was last. Nodes without pullup transistors will eventually leak, this is why DRAM needs to be refreshed every few milliseconds. On this chip however, these little capacitors never go more than a few microseconds holding charge, so leakage is not a problem.  The disable node serves to freeze this circuitry whenever an invalid game combination is detected.

At the beginning of it's cycle, 1 and 4 are the only high nodes. Advancing the chip shows that as the (internal) clock line goes high, 1 goes low as linger goes high. As the clock goes low again, node 2 is now not grounded by either node 1 or the clock line. 2 is pulled high, and grounds 4, which allows 3 to be pulled high.
Another advance will make the clock active once again, grounding node 2, and connecting linger to the grounded node 4. Once the clock falls again, node 1 is not grounded by lingering and will ground 2 and 3, allowing 4 to become high once again. This only works because the linger node does not have a pullup transistor, and thus will not return to a high state once no longer grounded. The end result of this circuitry is two alternating clock signals coming out of 3 & 4, with half the frequency of the original.

Because it changes at only half the clock's frequency, the clock signals coming out of this circuitry only allow half the horizontal resolution of the 2Mhz signal. To display thinner areas, such as the paddles, the original internal_clock signal is ANDed with various control circuits.

The horizontal counter

The shift register (top) and part of the decoder (bottom)
To the right of the clock circuitry is a counter which tracks the horizontal position of the electron gun. The chip designers didn't use a normal binary counter, instead they used a linear feedback shift register (LFSR.) A LFSR is a simple shift register with its input based on state of the current bits. It uses less die space and transistors than an ordinary counter, at the expense of not counting in normal binary order. The shift register is made of seven chained counting units, each with a flip-flop circuit. Each bit has a wire pair traveling downward, one matches the bit's state and the other is the opposite of the current state. The shift register's units are actually identical to the previously described clock circuitry, except that the linger node is set to the state of the previous counter, rather than to its own state.

The XNOR gate

The counter advances every time the "hrz_shifter" node goes low. The input line (normally pulled high) is grounded if either the bit 0 signal and bit 6's inverted signal are both high, or if bit 0's inverted signal and bit 6's signal is high. In simpler terms the input is an inverted exclusive-or (XNOR) of the end bits. The shift register will begin with 0000000 and, as the end bits match it will become  1000000, followed by 0100000 (0, as the end bits don't match), 1010000, 0101000 etc...

The horizontal counter's value goes into a textbook binary decoder.3 Fourteen control signals pass through it from left to right. The control signals will always be grounded by at least one transistor, unless the number in the counter matches the (opposite) of the transistors in the row. When it matches, the control line is allowed to be pulled high.

I wrote a quick python program to find out when/where the control signals are triggered based on the decoder's structure. Remember that the counter advances at half of the divided clock rate, or every microsecond.

Signal 12: 11μs (left wall)
Signal 10: 14μs (player 1 goalkeeper)
Signal 11: 22μs (player 2 forward)
Signal 8: 24μs (player 1 score start)
Signal 7: 29μs (player 1 score end)
Signal 6: 31μs (center line/wall)
Signal 5: 33μs (player 2 score start)
Signal 4: 38μs (player 2 score end)
Signal 3: 39μs (player 2 squash paddle)
Signal 2: 40μs (player 1 squash/forward paddle)
Signal 1: 48μs (player 2 goalkeeper)
Signal 9: 49μs (right wall)
Signal 13: 60μs (sync start)
Signal 14: 64μs (sync end)

Analog TV and sync signals.

A little background on the working of analog TV is necessary before we cover the next part. (NTSC) analog TV is generated from a continuous signal that varies between a black voltage (~0.3V) and a white voltage (1V), the exact voltage determining the strength of the electron gun's beam. The electron gun scans across the screen like an (English) book, left to right. In an old-fashioned television camera, the same thing would be simultaneously happening with some sort of scanning tube.

To synchronize a camera and a receiving television set, sync signals are mixed in with the sensor. A sync signal is indicated by 0V, "blacker than black." The camera will create a short sync pulse of a few microseconds at the end of every scanline, the receiver set filters this out and will trigger a horizontal sync, sending the beam back to the left and a line lower then before. Once the beam gets to the bottom of the screen, a much longer sync pulse triggers the vertical sync, sending the beam back to the top, to draw another field.4  This will repeat about 60 times a second for NTSC television. PAL television, used in most of Europe and the world, is incompatible with NTSC (mostly in North America) and SECAM. Because of this, there are at least two variations of the AY-3-8500 chip, the original (PAL) and the 8500-1 version (NTSC.) I don't know if a SECAM version was ever made.

The different standard's signals are quite similar, when you don't take color or sound into account.5 One import difference is the framerate. PAL draws fields at 50hz (except in Brazil) because of 50hz power standards. As the chip updates ball movement every field (I'll get to how this works eventually), this means the NTSC version (probally) plays faster.

The AY-3-8500 uses a separate pin to generate the sync signals. In a normal console setup, the sync line merges with the other video output pins onto the output line. The output line travels into a RF modulator inside the console, which puts the game signal onto channel 3 or 4, then into the television.6 The sync signal travels through a 510Ω resistor, and a 220Ω resistor pulls the output line low. Because of this, when the sync pin is pulled low by the chip, it's 0.3V (black) signal turns into a 0V signal (sync). Lets look at what that sync pin is hooked up to internally.

The horizontal sync

The sync logic is actually very simple, it's just horizontal control lines #13 and #14 connected to a simple SR latch, on the chip here. Two nodes, that I creatively named hsyncON and hsyncNOT_ON, invert the other, making a stable latch as shown on the right. Control line 13 grounds hsyncNOT_ON, allowing hsyncON to go high. Control line 14 does the opposite. When powered, hysyncON grounds the node labeled to_sync, outputting a sync signal instead of black (remember low=sync.) Control line #13 is triggered after 60 increments of the counter, line #14 after 64, resulting in a 4μs sync pulse at the end of every 64μs scanline

Another important node is hsyncNOT_ON2, this one branches into six different circuits across the chip, presumably updating logic that needs to be updated every scanline.

One other thing of importance, when the final control signal triggers (#14) it will activate the hrz_reset line here, resetting the horizontal counter to state 0. This tripped me up for a few minutes, as control signal 14 never seemed to go high. In reality, it does, it just forces itself off before the clock fully rises.

The vertical circuity

The hsyncNOT_ON2 wire leads to a small circuit near the clock pin. This is a signal divider (by 2), identical to the clock halfer. Instead of advancing the horizontal counter, this one's output advances the vertical counter. The vertical counter is almost identical to the horizontal counter, its just another LFSR. This one is 8 bits long instead of 7 and the feedback results from the XNOR of bit 4 and 7 (4th to right and rightmost). You can see the vertical counter advance by clicking the "one line" button in the upper right (2nd from right.)

The matching decoder circuitry (above the counter) has smaller transistors and outputs only 10 control signals. The smaller transistors are due to the vertical counter being advanced at a much lower frequency than the horizontal counter. The horizontal counter and other high-frequency components use larger/higher current transistors to change state faster.

Once again, this counter doesn't count in normal binary order so I modified my last program to figure out when the control signals are activated. Note that the vertical counter only advances every 4th line because the counter advance signal's frequency is halfed, and every other line is skipped due to interlacing. Once again, this resolution limitation is overcome by connecting the slow control circuitry and faster signals with an AND gate.

Signal 10: Line 80 ?
Signal 9: Line 84 (sidelines)
Signal 8: Line 88 (score start)
Signal 7: Line 136 (score end)
Signal 6: Line 164 (goal wall end)
Signal 5: Line 384 (goal wall start)
Signal 4: Line 464 (sidelines)
Signal 3: Line 468 ?
Signal 1: Line 516 (vsync start)
Signal 2: Line 524 (vsync end)

Just like before, the vertical sync latch (to the right of the horizontal latch) is a SR flip flop controlled by the top two vertical control signals. Control line 1 will flip the latch of vsyncON and vsyncNOT_ON, allowing vsyncON to ground the to_sync wire. Once control line 2 is triggered, both the flip-flop and vertical counter are reset. As each horizontal line takes 64μs to scan, the vertical sync lasts for the last 256μs of a   16768μs long field.
All the control signals overlaid on the game screen

Wrap up

With nothing but an alternating clock waveform, the AY-3-8500 generates a complete television picture, along with a set of control pulses which trigger display of most of the game elements. In my next post, I'll cover the circuitry behind the either the field, scores, or paddles. In the meantime, feel free to comment and ask any questions below.


1. I got that number from processing the image files. Along with the 2353 switching transistors, there are 860 pullup transistors, 973 electrically unique nodes, for a total of 10327 polygons. 

2. If you look at the original die photo (with the top layer removed) you can see a purple protection layer around the pads, possibly p-type diffusion. This doesn't affect the chips logic, so I left it out. 

3. This decoder has two minor differences than a regular decoder First, a node named "half_clock" forces all lines low while the shift register updates (so the control signals activate for only one clock cycle.) Second, decoders require one inverter for each input. As the shift register's design contains a pair of inverted nodes, an extra inverter is not needed. 

4. A field is one-half of a full frame. Back the 1930's television designers found that (then) high-definition systems would take so long to draw that major flicker would be present. The solution was interlacing, drawing half resolution pictures 60 times per second (known as fields, as the electron beam creates rows like a field of crops). Every other field was drawn in-between the lines of the previous one, resulting in a full image 30 times a second. Analog TVs definitely did flicker, but at a manageable amount. Digital TV is not limited to refreshing a single point on the screen at once, which allows it to display much larger screens with no flicker. For example: 8K UHD, the highest resolution standard available, has about 97 times as many pixels as NTSC television (if sampled at a normal 4/3 aspect ratio.) 

5. PAL has 625 total lines of resolution VS NTSC's 525. There are some other variations in sync times and voltage levels, but these changes are easy to account for by changing the values in the control signals. 

6. Many 1st and 2nd generation consoles use a RF modulator to put the signal onto channel 3 or 4, as well as an antenna/game switch-box to choose between the game or the antenna. This was necessary before composite-compatible TVs became widespread. Composite connections don't need to modulate then demodulate the signal, resulting in better video quality, and no need to add modulators to the console.