Showing posts with label teardown. Show all posts
Showing posts with label teardown. Show all posts

Two dies in one package: Teardown of a vintage ROM with double the storage

In 1971, semiconductor memory was still a new development so chips couldn't hold a lot of data. To double the storage capacity, IBM used the brute-force approach of putting two silicon dies into a 1-inch square package.1 The photo below shows a module with two face-down silicon dies, storing 4 kilobytes of data. In this blog post, I look inside this package, examine the dies, and explain how this ROM (read-only memory) was implemented. Although I expected the circuitry to be straightforward, the primitive MOS transistors of the time made the circuitry more complicated in several ways.

This IBM integrated circuit contains two silicon dies mounted on a ceramic substrate. Wiring printed on the substrate connects the dies to the pins underneath.

This IBM integrated circuit contains two silicon dies mounted on a ceramic substrate. Wiring printed on the substrate connects the dies to the pins underneath.

The photo below shows one of the silicon dies under the microscope. The white lines are the chip's metal layer, the wiring that connects the components together. The silicon underneath appears gray. Around the perimeter of the die, the dark circles are the solder balls that connect the die to the ceramic substrate. (Although other manufacturers typically attached tiny bond wires to pads on ICs, IBM soldered the die directly onto the substrate upside down in "flip-chip" style.) The solder balls provide the address lines, output data, and other connections. With 18 output connections, each die stores 1024 words of 18 bits: 9 on the left and 9 on the right. (18 bits may seem like a strange size, but it's a 16-bit word with a parity bit for each byte.2) The data is stored in a matrix of tiny transistors: 128 wide by 144 tall. This matrix is surrounded by the circuitry that selects a particular column and set of rows based on the address, outputting the desired 18 bits.

Die photo of one of the ROM dies. Click this image (or any other) for a larger version.

Die photo of one of the ROM dies. Click this image (or any other) for a larger version.

The integrated circuit is packaged in IBM's characteristic square metal can, below. These metal cans have their roots in the IBM System/360, a groundbreaking computer line introduced in 1964. Because IBM didn't consider the technology of integrated circuits to be mature enough at the time, IBM built these computers from hybrid modules called SLT (Solid Logic Technology). These thumbnail-sided modules consisted of individual transistors, diodes, and resistors encased in a square aluminum can. In 1968, IBM moved to integrated circuits (which they called Monolithic System Technology or MST), but kept the metal-can packaging. These packages gives vintage IBM boards a unique look, unlike the rectangular black epoxy integrated circuits used by most manufacturers.

The integrated circuit with the metal package, part number 5864741. The black clip next to the package holds the die, but I don't know if this was for shipping or during use.

The integrated circuit with the metal package, part number 5864741. The black clip next to the package holds the die, but I don't know if this was for shipping or during use.

To get inside the package, I removed the metal lid from the package with a hacksaw, exposing the two dies inside. To loosen the dies from the substrate, I used a butane torch to melt the solder connections.3 The photo below shows the dies next to the substrate. As you can see, the varnish on the substrate got a bit toasty during the removal process.

The ceramic substrate with the dies removed.

The ceramic substrate with the dies removed.

Looking at the substrate closely shows the complex wiring between the pins and the dies. The two chips are wired in parallel, with the substrate wiring connecting corresponding pins on the two dies. The exception is the three pins on the left side of each die near the bottom; they are wired separately to the two dies so one die can be selected.4 You can also see the tiny pads where the solder balls on the dies were attached.

This closeup of the substrate shows how the two dies are wired together, mostly in parallel, by wiring underneath the dies.

This closeup of the substrate shows how the two dies are wired together, mostly in parallel, by wiring underneath the dies.

Transistors in the chip

Next, I'll explain the construction of the chip, starting with the transistors that form its circuitry. The dies use metal-gate MOS transistors, an early type of MOS transistor that was largely replaced by silicon-gate transistors in the 1970s. The diagram below shows the construction of a metal-gate NMOS transistor. At the bottom, two regions of silicon (dark gray) are doped to make them conductive, forming the source and drain of the transistor. The gate is formed by a metal strip between the silicon regions, separated from the silicon by a thin layer of insulating oxide. (These layers—Metal, Oxide, Semiconductor—give the MOS transistor its name.) The transistor can be considered a switch between the source and drain, controlled by the gate. To simplify the behavior, the transistor turns on when the gate is pulled positive, and turns off when the gate is at 0 volts.5

Structure of a metal-gate MOSFET.

Structure of a metal-gate MOSFET.

In the closeup of the ROM below, you can see the individual bits. Each oval-shaped "bubble" is a transistor, representing a 1 bit. The vertical white stripes are the metal layer. The faint horizontal stripes are doped silicon. A "bubble" is formed by a thin spot in the oxide where the metal is close enough to the silicon to form a transistor gate. (Elsewhere, the thicker oxide layer separates the metal from the silicon so it doesn't have any effect.) These different layers were created by photolithography, projecting light through a patterned mask and then treating the silicon wafer with chemicals. The contents of the chip are fixed during manufacturing and cannot be changed. Since the mask defines the contents of the ROM, it is called a "mask ROM".

A closeup of the ROM showing some of the bits.

A closeup of the ROM showing some of the bits.

The diagram below explains the structure of the ROM. Each vertical metal line selects a column of transistors; there are 128 vertical lines in total. The ovals indicate transistors: each transistor is between a power line and a bit output line, and its gate is formed by the metal column select line above it. To read the ROM, one column is activated by pulling it high (yellow). This turns on the transistors (red) in that column. An activated transistor connects the corresponding bit output line to power, pulling it high.

Diagram showing operation of the ROM matrix.

Diagram showing operation of the ROM matrix.

The matrix produces 144 bits of output on each side of the chip. To select the desired 9 bits, a circuit called a "16-to-1 multiplexer" selects one bit out of each group of 16. To summarize, part of the address fed into the chip is used to select a column, and part of the address is used to select the output bits. Together, the address selects one of the 1024 words stored on the die.

Construction of an inverter

Next, I'll explain some of the logic circuitry. An inverter is the simplest logic gate, used in several places in the chip. The diagram below shows how a basic inverter appears on the die. The metal wiring (white) covers the silicon underneath. The middle diagram shows the conductive silicon in blue, while the transistors are colored green. The inverter is formed from two transistors: a pull-up transistor and a transistor I'll call the inverter transistor. These transistors are controlled by the metal wiring on top of them, which forms the gate.

Implementation of an inverter. At the left is the inverter on the die (somewhat simplified).
The middle diagram shows doped silicon in blue, with the transistor channel in green.
The schematic on the right shows the wiring of the inverter.

Implementation of an inverter. At the left is the inverter on the die (somewhat simplified). The middle diagram shows doped silicon in blue, with the transistor channel in green. The schematic on the right shows the wiring of the inverter.

The diagram below shows how the inverter operates. When the input is low (left), the pull-up transistor provides a weak current to pull the output high. (Because the transistor is long and narrow, its current is weak.) When the input is high (right), the lower transistor turns on, connecting the output to ground, resulting in a 0 output. Since this circuit produces a 1 output for a 0 input and vice versa, it acts as an inverter.

Simplified diagram of an inverter. With a 0 input, the pull-up transistor pulls the output high. With a 1 input, the lower transistor pulls the output to ground.

Simplified diagram of an inverter. With a 0 input, the pull-up transistor pulls the output high. With a 1 input, the lower transistor pulls the output to ground.

This inverter doesn't perform very well because these early metal-gate transistors had difficulty pulling the output high. The problem is that the transistor produces an output voltage that is 4 volts lower than the gate voltage due to the properties of the transistor. Thus, if the inverter above is powered with 10 volts, the output voltage will be just 6 volts, not 10.

The solution was the "bootstrap load" shown below: adding a capacitor and a third transistor to the inverter.6 The capacitor acted as a charge pump, boosting the voltage across the gate and thus the output voltage. The circuit is a bit tricky, but I'll try to explain it. In the first panel, a 1 input turns on the lower transistor, producing a 0 output as before. However, the upper transistor will charge the capacitor with 6 volts, which will be important in the next step.

Illustration of how the bootstrap load works.

Illustration of how the bootstrap load works.

Next, suppose we input a 0 to the inverter (middle panel). The pull-up transistor on the right will pull the output to 6 volts, as in the simple inverter. But here's the trick: the capacitor was previously charged to 6 volts, so if we raise the lower side of the capacitor to 6 volts, the high side now rises to 12 volts (because of the 6 volts stored in the capacitor). With 12 volts on the gate, the output transistor can produce 8 volts of output. This extra 2 volts will raise the capacitor even higher, giving more output voltage. This feedback loop continues, until the capacitor reaches 16 volts and the output reaches 10 volts. (The output can't get any higher than the 10 volts supplied to the transistor.) Thus, the output transistor has "pulled itself up by its bootstraps", reaching a nice 10-volt output, rather than the weak 6-volt output from the simpler inverter.

The diagram below shows an inverter on the die, with 5 transistors and a capacitor. This inverter has a bootstrap load, along with two output transistors to boost the current.7 The capacitor is constructed from a large region of metal over silicon: the metal and silicon form the two plates of the capacitor and hold the charge. Note the large size of the capacitor compared to the transistors. This diagram illustrates that even an inverter required a lot of circuitry when using the primitive transistors of 1971.

An inverter, built from 5 transistors and a capacitor.

An inverter, built from 5 transistors and a capacitor.

Column address decoding

The next circuit I'll describe is the address decoder, which selects the desired column of the ROM based on the input address. Specifically, 6 bits of the address are used to select one of 64 columns. The decoder takes up a fair amount of area on the die, with half the decoder above the ROM matrix and half below. The interesting thing about the decoder is that you can see its binary structure, with two rows of transistors that alternate, then two rows that alternate in groups of 2, groups of 4, and so on.8

Part of the column decoding circuitry. Ground lines are colored blue and output lines are colored green.

Part of the column decoding circuitry. Ground lines are colored blue and output lines are colored green.

Each vertical green line above is one decoder output, corresponding to one particular address. Electrically, each decoder line is wired as a NOR gate: if the line to any transistor is high, the transistor turns on, connecting that output line (green) to ground (blue), pulling it low. If all the corresponding address lines are low, the transistors will remain off, and that column will be activated. Each column of the decoder matches one address bit pattern, so each address selects the desired column.

Each horizontal line (and complement) that are fed into the decoder are driven from one of the address inputs. Next to each address input is the circuit below that drives these lines, as shown below. I won't go into details, but it's essentially a latch driven by the address input, outputting the value and its complement.

The circuitry for each address input.

The circuitry for each address input.

Row multiplexer circuit

While you might expect each column of the ROM to store one word, the result would be a very tall and skinny ROM that wouldn't fit on the IC die. Instead, each column of the ROM holds 16 words, making the ROM a more efficient rectangle. These 16 words are grouped by bit: the 16 values for bit 0 at the top, followed by the 16 values for bit 1, and so forth. Each output bit has a multiplexer circuit that selects one of these 16 values based on four bits of the address.

Each multiplexer circuit consists of 16 transistors, shown below: one row-select line is activated, turning on the appropriate transistor and connecting that ROM line to the multiplexer output, and thus the output pin. (The row select lines come from a decoder circuit similar to the column address decoder described earlier.) The output driver circuit amplifies the ROM output. Note the large output transistor below the solder ball. Its multiple vertical stripes are multiple gates, allowing it to produce more current for the external signal.

Diagram showing the multiplexer and output circuit.

Diagram showing the multiplexer and output circuit.

The substrate bias generator

To improve the performance of the transistors, many chips applied a negative "bias" voltage to the silicon die's substrate. The straightforward way to obtain this bias voltage was through an external pin, but this inconveniently required an additional power supply. The IBM ROM chip, instead, has a circuit to generate the negative bias voltage internally, avoiding the extra power supply.9

This substrate bias generator circuit uses a charge pump to create the negative bias voltage from the positive supply voltage, which is a neat trick. The idea is to "pump" electric charge in and out of a capacitor, analogous to a water pump, making the substrate negative. First, the capacitor is charged with 10 volts. Next, the upper side of the capacitor is grounded to 0 volts. Since the capacitor still holds a charge of 10 volts, the lower side of the capacitor must be at -10 volts, producing the desired negative voltage. This cycle is repeated at high speed, driven by an oscillator.

Operation of the charge pump. By grounding alternate sides of the capacitor, a negative voltage is created.

Operation of the charge pump. By grounding alternate sides of the capacitor, a negative voltage is created.

In more detail, the diagram above shows the charge pump driven by a pulse signal and its complement. In the first stage, the two smaller transistors are turned on, charging the capacitor to +10 volts. In the second state, the large lower transistor is turned on, grounding the left side of the capacitor. This forces the right side of the capacitor to -10 volts, pulling the substrate negative. The diode prevents current from flowing back into the substrate during the first stage.

The circuitry that drives the charge pump is shown below. Five inverters are connected into a ring, forming a ring oscillator. If the first inverter has a 1 input, it outputs a 0, so the second outputs a 1, and so forth, until the final inverter outputs a 0. This goes back into the first inverter, flipping its output to 1, and so forth, until the final inverter flips to a 1 output. The process repeats, causing an oscillation. The pulse generator circuit uses these oscillations to drive the charge pump. It also takes a feedback signal from the substrate, stopping the charge pump when the substrate is sufficiently negative.

The circuitry that drives the charge pump.

The circuitry that drives the charge pump.

The diagram below shows how the substrate bias generator is implemented on the die. The five inverters are on the right, while the charge pump circuitry is on the left. (These inverters are implemented using the inverter circuit described earlier.) The large capacitor, transistor, and diode for the charge pump are the most visible features.

A closeup of the substrate bias circuitry. It is in the lower-right corner of the die.

A closeup of the substrate bias circuitry. It is in the lower-right corner of the die.

Optional circuitry

One interesting characteristic of the chip is that some transistors are not implemented and some wiring connections are omitted. In the diagram below, the metal wire on the left has a contact with the silicon, but the metal wire on the right doesn't have a contact; it just overlaps. With a small change to the mask during manufacturing, the contact can be switched to the other wire. This swaps the function of the two inputs in the upper right corner of the chip, strobe and address. (I'm not sure why this is useful, though. Maybe backward compatibility with two different chips?)

A closeup of contacts that allow the wiring to be customized.

A closeup of contacts that allow the wiring to be customized.

To support that functionality swap, the chip also has unimplemented transistors, as shown below. The upper block has the "bubbles" that indicate working gates. The lower block has the silicon and metal layout of a transistor, but without the gates this circuitry is inert. With a small mask change, the chip can be manufactured with transistors in the lower block and the upper block unused. The point is that the chip was designed so different versions of the chip could easily be manufactured.

Transistors and omitted transistors. The upper rectangular block consists of transistors, while the lower rectangular block has no function.

Transistors and omitted transistors. The upper rectangular block consists of transistors, while the lower rectangular block has no function.

Conclusion

The 1970s were a time of great change for integrated circuits. Chips based on MOS transistors were rapidly growing in capability, leading to the rise of microprocessors, semiconductor storage, and other applications. But in 1971, the performance of these transistors was still limited, requiring inconvenient workarounds such as capacitors for bootstrap loads. The density of chips was also limited, causing IBM to put multiple dies in one package to store enough data.

Looking at this package, both dies are the same, except for the data stored on them. The photo below shows the other die that was in the package. The black globs are some sort of varnish that covered the dies and leaked in around the edges. I couldn't find anything that dissolved the varnish, so I ended up tediously chipping it off under a microscope. (This is why the cleaned die photo at the beginning of the post has some scratches.)

The second ROM die in the package. This photo shows the die after removal from the substrate, with varnish around the edges. Click for full size.

The second ROM die in the package. This photo shows the die after removal from the substrate, with varnish around the edges. Click for full size.

What does the ROM hold? Unfortunately, I don't know. I'm told that it comes from some type of IBM printer so it's probably some sort of interface firmware.

I announce my latest blog posts on Twitter, so follow me @kenshirriff. I also have an RSS feed.

Notes and references

  1. IBM often put multiple silicon dies in a single package, especially to increase memory density. Since the capacity of a single die was limited by the silicon technology at the time, packaging multiple dies together was a straightforward way to increase density. The memory module below shows four silicon RAM dies mounted on two layers of ceramic.

    An 8-kilobit IBM memory module containing four 2-kilobit chips on two levels. More details here.

    An 8-kilobit IBM memory module containing four 2-kilobit chips on two levels. More details here.

     

  2. I checked some of the data in the ROM to verify that the "extra" bits were parity. I confirmed that each 9-bit chunk had odd parity, an odd number of 1 bits. 

  3. I have disassembled several IBM modules. In most cases, heating the ceramic substrate with a heat gun is sufficient to melt the solder and release the dies. However, the ROM dies were apparently covered with varnish that held them securely, and the heat gun was not sufficient to remove them. Lacking a propane torch, I used a crème brûlée torch which provided enough heat to get the chips off the substrate. The substrate ended up blackened and started smoking in the process, however. At least I didn't need to barbecue the module. 

  4. Each die has 34 solder balls, while the package has 36 pins (4 rows of 9), so I'll explain how the math works out. Most of the pins are connected in parallel to each die. Ground, however, is connected twice to each die. Each die also has 3 pins that are connected separately, allowing the die to be addressed individually. Thus, the package has 30 pins that are shared across the die, and 6 pins that are connected 3 to each die. 

  5. Since I have no information about this chip, everything is from reverse-engineering and I had to make some guesses. I want to be honest about what parts are speculative, so I'll summarize in this footnote. I don't know if the chip uses NMOS or PMOS transistors since they look the same under the microscope. Given the early date of this chip, it's very possible that it used PMOS transistors. If so, the explanation of the chip is essentially the same, except the voltage levels are reversed and negative. I illustrate many of the circuits with a supply voltage of 10 volts; I don't know the actual voltage used by these chips. Likewise, the 4-volt threshold voltage is an assumption. The output labels 0-17 are arbitrary since I can't tell what order the bits are in. The labels on the address bits are based on the decoder patterns but I don't know if data was stored row-first or column-first. I'm speculating that a transistor in the ROM indicates a 1 bit, but it could indicate a 0 bit. The explanation of the strobe and enable inputs is based on examining the circuit, but could be wrong. 

  6. The transistor's output voltage is lower than desired due to the large "threshold voltage" of early metal-gate transistors. The transistor turns on when the gate voltage is sufficiently higher than the drain (output) voltage. This voltage difference is the threshold voltage, which could be several volts. The workaround is to raise the gate voltage a few volts higher to overcome the threshold voltage. I've written about the bootstrap load in the Intel 8008 processor (link) if you want more information about bootstrap loads. 

  7. The bootstrap load produces a higher-voltage output than can be obtained directly. The higher voltage can be traded off to obtain a high-current output. The trick is to use two more transistors to produce the final output, as shown below. The upper transistor, fed by the inverter, pulls the output high, while the lower transistor, fed by the original input, pulls the output low. The point of this is it takes five transistors and a capacitor to produce a good inverter. In comparison, just a couple of years later, semiconductor technology had advanced so only two transistors were required.

    Adding two output transistors provides a higher-current output for the inverter.

    Adding two output transistors provides a higher-current output for the inverter.

     

  8. A few things to note about the column decoders. First, half the decoders are at the top of the ROM and half are at the bottom of the ROM. This is because the decoders are about twice as wide as a ROM cell so they wouldn't all fit on one side of the ROM. Second, the decoders are duplicated for the left and right sides of the ROM since the left and right sides provide two bytes for the same address. (It was more space-efficient to duplicate the decoders than to use one set of decoders with 64 wires between the two sides of the ROM.) Third, if you look carefully, the first rows of transistors don't alternate in the pattern "ABAB ABAB" (as you'd expect for binary), but instead alternate "ABBA ABBA". Thus, the columns are accessed in the order 0, 1, 3, 2, and so forth, instead of the order 0, 1, 2, 3. This is invisible to the user of the ROM, as long as the columns are shuffled appropriately when the ROM is programmed. 

  9. Curiously, the IBM ROM chip has a pin that appears to be tied to the substrate to provide bias, as well as an on-chip bias generator I don't know why the chip would have both. If you want more information about substrate bias generators, I've written about the substrate bias generators in the 8086 and 8087.

    The bias voltage of the Hewlett-Packard Nanoprocessor was unusual. Due to variability in the manufacturing process, the bias voltage varied from chip to chip. During production, each chip was tested and the proper bias voltage was hand-written on the chip. Each circuit board had to be adjusted to provide the necessary bias voltage.

    The HP Nanoprocessor. Note the hand-written voltage "-2.5 V". The last digit (1) of the part number is also hand-written, indicating the speed of the chip. Photo courtesy of Marc Verdiell.

    The HP Nanoprocessor. Note the hand-written voltage "-2.5 V". The last digit (1) of the part number is also hand-written, indicating the speed of the chip. Photo courtesy of Marc Verdiell.

     

Strange chip: Teardown of a vintage IBM token ring controller

IBM used some unusual techniques in its integrated circuits, and one of the most visible is packaging them in square metal cans. I've been studying these chips recently, since there's not a lot of information about them. I opened up the large metal chip—1.5" on a side—from the token ring network board below. This chip turned out to be stranger and more interesting than I expected, combining analog circuitry, a custom microprocessor, and complex logic. The internal packaging was also unconventional: instead of the bond wires used by most manufacturers to connect the silicon die, IBM used a "flip-chip" technique, soldering the die upside down onto a ceramic substrate. Instead of pads, the chip had solder balls across its surface, giving it an unexpected layout and appearance. In the blog post, I discuss this chip in detail.

The IBM 4/16 ISA token ring board. Click this photo (or any other) for a larger version.

The IBM 4/16 ISA token ring board. Click this photo (or any other) for a larger version.

The token ring network was introduced by IBM in 1985,1 a local-area network technology that competed with Ethernet and other network systems. In a token ring network, the computers are wired in a ring, with each computer receiving packets from the previous computer and transmitting them to the next computer in the loop. To give a computer access to the network, a special three-byte token circulates in the ring. When a computer receives the token, it can transmit a network packet to the next computer in the ring. The packet travels around the ring until it comes back to the original computer. That computer discards the packet and sends out the token in its place, giving another computer a chance to transmit data. In comparison, an Ethernet network lets computers transmit at any time; if two transmit at the same time, the collision is detected and they try again a bit later. A token ring network had the advantage of avoiding collision, making it more deterministic and fair and providing better performance on a congested network.

IBM's use of square metal cans goes back to the early 1960s with IBM's SLT modules (Solid Logic Technology). Because IBM didn't think integrated circuits were mature enough at the time, they used small hybrid modules with a few transistors, diodes, and resistors mounted on a ceramic substrate. These half-inch-square SLT modules were packaged in an aluminum can for protection, giving IBM circuit boards a unique appearance. In the late 1960s, IBM moved to integrated circuits2 but they kept the ½" metal cans instead of the rectangular ceramic or epoxy packages used by other manufacturers. As integrated circuits required more pins, IBM increased the package size, leading to the bulky 1.5" package that I examined.

To examine the integrated circuit, I removed it from the board with a hot air gun. In the photo below, you can see the grid of pins underneath the chip. The chip is labeled with the part number is 50G6144. The "ESD" suffix indicates an electrostatic-sensitive device that can be damaged by static electricity and requires special handling. The next line, IBM 9352PQ, is a code for the manufacturing site. The final line, 194390074M, shows that the chip was manufactured in 1994 during the 39th week of the year.

The integrated circuit is packaged in a square aluminum can, 1.5" on a side.

The integrated circuit is packaged in a square aluminum can, 1.5" on a side.

Cutting off the aluminum lid reveals the silicon die inside. The chip is mounted upside down as a flip chip, soldered directly to the connections on the ceramic substrate. Thus, you can't see the chip's circuitry, just the underside of the silicon die. IBM called this mounting technology controlled collapse chip connection or C4.3 (In comparison, most manufacturers mounted a silicon die right side up and connected it to the pins with tiny bond wires.) Tiny printed-circuit traces connect the module's 175 pins to the die.

The integrated circuit with the metal lid removed, showing the silicon die on the ceramic substrate.

The integrated circuit with the metal lid removed, showing the silicon die on the ceramic substrate.

I removed the die from the substrate with the hot-air gun and then dissolved the solder balls with a mixture of hydrogen peroxide and vinegar. By taking numerous photos with a metallurgical microscope, I created the die photo below. The black circles on the die are the positions of the solder balls, more irregular than you might expect. They are not around the edge of the die (as with bond pads), but overlap the circuitry. The chip is fairly large, about 9×7.9 mm, with features of about 1µm. Note the horizontal rows of circuitry; these are standard cells, which I will discuss below.

Die photo of the chip. Click this (or any other) image for a larger version.

Die photo of the chip. Click this (or any other) image for a larger version.

The pattern of solder balls is more visible in Antoine Bercovici's photo below. There are rows three-deep of solder balls along the four sides, as well as rows through the middle of the chip and more in the corners. Roughly speaking, the solder balls around the edges are for signals, while the solder balls in the middle distribute power and ground. Note the tangled metal wiring on top of the chip that connects the solder balls to the underlying circuitry.4

Die photo showing the solder balls and upper metal clearly. Courtesy of Antoine Bercovici.

Die photo showing the solder balls and upper metal clearly. Courtesy of Antoine Bercovici.

The photo below shows a closeup of the ceramic substrate that holds the die; compare the pattern to the die above.5 The die was soldered to the rectangular array of contacts in the middle, while the large circles around the edge of the photo are the pins of the chip. Note the dense, complex wiring pattern between the pins and the tiny contacts. The wiring traces are extremely thin (about 30µm), with thicker traces from power and ground. The contacts form a complex pattern. most are in a rectangular array, three deep. However, there are also rows of contacts through the center of the chip, connected alternately to power and ground by the thick traces inside the rectangle, and a few scattered contacts. The contact pattern on the substrate was optimized for the layout of this particular chip. Power distribution was a particular concern.

A closeup of the ceramic substrate showing where the die is mounted.

A closeup of the ceramic substrate showing where the die is mounted.

It's interesting to consider the hierarchy of connections between the coarse 0.1" grid of the chip's pins and the tiny 1µm features on the chip. At the top level, the pin spacing is 0.1" in a 14×14 grid. The solder balls have a spacing of 0.01", so the ceramic substrate reduces the spacing by a factor of 10. The solder balls are connected to the wiring on top of the die, spaced at 0.001", increasing the density by another factor of 10. The top wiring is connected to the underlying wiring on the chip, with a spacing of 0.0001", another factor of 10. Finally, the feature size on the die is about 1µm, another factor of 2.

With this type of packaging, you can visualize the die position by looking at the underside of the IC (below). Because the chip is soldered directly to the substrate, there are no pins where the chip is attached. Thus, the spot with no pins indicates the position of the die.

Underside of the package.

Underside of the package.

Inside the chip

The die photo below shows the chip with most of the metal layers dissolved, making the transistor structure underneath visible. The chip has three main components: a 16-bit microprocessor CPU, an analog front end for the network signals, and 24,000 logic gates for the main functionality. The chip also has some buffer RAM at the left, and I/O drivers in the middle and bottom. (IBM originally implemented the token ring interface with six analog and digital chips. To decrease cost, they put all the functionality onto a single chip, resulting in the combination of analog and digital circuitry.)

The die with major components labeled. The metal layer has been removed to show the circuitry underneath.

The die with major components labeled. The metal layer has been removed to show the circuitry underneath.

The block diagram below shows the complex functionality of the chip. Starting in the upper right, the analog front end circuitry communicates with the ring. The analog front end extracts the clock and data from the network signals. The protocol handler implements the low-level token ring protocol: it decodes data, breaks packets into frames and performs error checking. Network data is moved between on-chip buffers and the external RAM by the shared RAM control. Finally, a custom 16-bit microprocessor implements the data link layer protocols and controls the chip.

Block diagram of the chip, from IBM's paper.

Block diagram of the chip, from IBM's paper.

Standard-cell logic

The chip's logic is implemented with a CMOS standard cell library and consists of about 24,000 gates. The idea of standard-cell logic is that each function (such as a NAND gate or latch) has a standard layout. These cells can then be combined by automated design tools to create the desired logic. (This is in contrast to older methodologies, where the designer would lay out each transistor individually, either on paper or using design software.) Standard cells make chip design much easier, since software can do the circuit synthesis, layout, and routing, However, the design isn't as flexible or optimized as a fully-custom circuit.

The standard cell layout is visible on the chip, with the cells arranged in uniform rows, connected by horizontal and vertical wiring. The diagram below magnifies the die to zoom in on five rows of standard-cell logic, and then a single row, to show how small the cells are on the die.

Zooming in on the die shows rows of standard cell logic. Another zoom shows the details of the logic.

Zooming in on the die shows rows of standard cell logic. Another zoom shows the details of the logic.

The standard cell below implements a 3-input NAND gate, and I'll explain how it is constructed.6 There are 6 PMOS transistors on top and 6 NMOS transistors on the bottom. The transistors are formed from a region of doped silicon at the top and another at the bottom. Vertical lines of polysilicon, a special type of silicon, form the transistor gates. Polysilicon is also used for vertical wiring inside the cell. The chip has three layers of metal: the bottom layer is used for horizontal wiring, the middle layer is used for vertical wiring, and the top layer connects to the solder balls. Horizontal metal wiring connects the transistors inside the cell and connects the cell to other cells. The two thick horizontal metal wires provide power and ground for the cell. The second, vertical metal layer provides vertical wiring across and between cells. This layer also implements the power connections between the solder balls and the horizontal power wiring visible here. The round dots are connections between layers (silicon, polysilicon, or metal). The schematic on the right matches the layout of the cell.

Closeup of a cell that implements a NAND gate.

Closeup of a cell that implements a NAND gate.

In the schematic below, I've removed the redundant transistors and rearranged the layout to make the NAND circuit more clear. If all inputs are 1, the NMOS transistors at the bottom turn on, pulling the output low. If any input is 0, a PMOS transistor turns on, pulling the output high. Thus, the circuit implements a NAND gate.

Schematic of the 3-input NAND gate.

Schematic of the 3-input NAND gate.

To summarize, standard-cell logic provides a convenient, automated way of implementing logic. A small number of standardized cells implement the basic logic functions. These cells are arranged in rows and wired together to create the desired logic. (From the teardown perspective, standard-cell logic is somewhat disappointing, since the high-level structure is not visible; it's just a bunch of uniform cells.)

The logic circuitry includes some static RAM buffers to hold network data. These were custom-implemented (as were the I/O drivers) instead of using standard cells. The photo below shows a block of RAM cells.

One of the RAM buffers on the chip.

One of the RAM buffers on the chip.

Inside the CPU

The chip contains a 16-bit CMOS control microprocessor that was custom-designed by IBM7 and contains about 10,000 gates. This processor handles the network protocol, controls transmit and receive operations, and manages the shared memory. It runs at 5.34 megahertz and performs about 3 MIPS (million instructions per second). The microprocessor runs code from an EPROM on the board. IBM calls this "microcode", but it's unclear if this is microcode in the usual sense or just firmware instructions.

The CPU, with main functional blocks labeled. The metal layer has been removed.

The CPU, with main functional blocks labeled. The metal layer has been removed.

The CPU is built with standard-cell logic (except for the RAM and ALU), but curiously the cell layout is entirely different from the rest of the chip, presumably because it had different designers. The photo below compares the CPU's logic (left) with the other logic (right). The CPU fits 7 rows of logic in the same vertical space that holds 4 rows of the regular logic. On the other hand, the logic on the right appears to be much dense horizontally.

Comparison of the CPU's standard-cell logic (left) with the rest of the chip (right), at the same scale.

Comparison of the CPU's standard-cell logic (left) with the rest of the chip (right), at the same scale.

One design feature of the CPU that's visible on the die is its use of multiple PLAs (programmable logic arrays) for instruction decode and control. (Looking at the photo, I count nine small PLAs and a large PLA in the corner.) A PLA provides a structured and dense way of implementing logic (typically AND-OR logic). More importantly, PLAs also provided flexibility and the ability to easily change the design. In the PLA below, 12 signals enter at the lower left. The matrix above converts these to 11 signals that pass to the right. The second matrix generates 8 outputs. The contents of the PLA are visible as the pattern in the metal layer. Since the PLA could be modified by changing the chip's metal layer, bug fixes could even be done after the silicon had been etched.

One of the many PLAs in the CPU.

One of the many PLAs in the CPU.

The CPU contains memory cells for register storage (which they call a 16×16 cache). This RAM design is different from the RAM design in the logic circuitry.

Memory cells in the CPU.

Memory cells in the CPU.

Analog circuitry

The chip contains a block of analog circuitry implemented in CMOS. This circuitry "performs signal conversion and clock recovery functions as well as detecting and compensating for line impairments". This circuitry includes resistors, capacitors, MOS transistors with special properties, and other components.8 The analog block uses a variety of circuits such as op-amps, switched-capacitor amplifiers, voltage references, peak detectors, a charge pump, voltage-controlled-oscillator, and phase-locked loop.

Die photo showing part of the analog circuitry.

Die photo showing part of the analog circuitry.

One challenge in the design was to minimize "jitter" in the clock signal extracted from the network data. Because each node retransmitted the data, jitter would accumulate as a packet traversed the ring, so each node had to be accurate. They used a variety of techniques to keep noise out of the signal such as providing separate power and ground for the analog circuitry, using differential signals in the circuitry, and keeping logic signals away from the analog circuitry.

The analog circuitry made the chip much more complex to manufacture and test.9 The capacitors and special transistors required special process steps during manufacturing. Manufacturing tolerances were also much tighter since process variations could change the electrical characteristics enough to make the analog circuitry stop performing. Some of the analog circuitry was too sensitive to be tested on the wafer and couldn't be tested until the chip was packaged, making failed chips much more costly. Even so, IBM found it worthwhile to put the analog circuitry on the chip.

Shrinking the chip

IBM originally made the token ring chip in 1988. The chip I examined is a smaller version from 1994. The photo below compares the two chips on a 1 mm grid; the older, larger chip is on the left. Note that both chips have the same microprocessor block (upper left corner) and the same analog block (lower left / upper right corner). The height of the standard cell logic rows is much smaller in the newer chip, probably how they shrunk the logic. The solder balls on the left connect to the underlying circuitry, while the solder balls on the right are routed all over the chip by a third layer of metal.

Comparison of the two chips. Photo courtesy of Antoine Bercovici.

Comparison of the two chips. Photo courtesy of Antoine Bercovici.

The analog section from the old chip was copied to the new chip unchanged, but the connections to solder balls are very different, showing the change in wiring techniques. In the old chip (left), the solder balls are on top of metal pads that are connected to the circuitry. The layout is similar to integrated circuits that use wire bonding and bond pads. In the old chip (right), the solder ball grid is not anchored to the underlying chip architecture, but follows its own constraints. A new layer of metal connects the solder balls to the pads. The pads remain in their atavistic positions, despite being unused in the new chip.

Comparison of the analog section of the old chip and the new chip. The color of the chips is different due to lighting.

Comparison of the analog section of the old chip and the new chip. The color of the chips is different due to lighting.

The token ring board

I'll just say a bit about the token ring board that contains this chip. The board is an ISA card from 1994. The IBM chip dominates the board, but there are also numerous other chips, largely 74F-series TTL. There's also a square (and curiously thick) Lattice chip, probably a GAL (Generic Array Logic). A GAL is a programmable logic chip, combining AND/OR logic with flip-flops. A Signetics chip with an IBM label on top is probably a field-programmable logic array (FPLA). Despite all the complexity of the IBM chip, the board requires a lot of programmable logic and simple logic ICs, mostly to interface to the computer's ISA bus. The board has 64 kilobytes of RAM to store network data, two Toshiba TC55329 32K×9 bit static RAM chips. This RAM is accessible both by the network card and by the host PC. The code for the internal microprocessor is contained in an EPROM chip on the board, an AMD 27C1024 chip holding 128 kilobytes as 16-bit words. The EPROM chip has an adhesive label on it with the IBM part number 73G2042, indicating the microcode version.

The token ring board plugs into a PC's ISA slot.

The token ring board plugs into a PC's ISA slot.

The right side of the board holds the analog circuitry to interface with the network. Five pulse transformers provide electrical isolation between the interface board and the potentially-dangerous voltages of the network. Two bypass relays disconnect the card from the ring when not in use, preserving the ring's connectivity. There are also two transistor arrays along with resistors and capacitors to condition the network signals before passing them to the token ring chip. The card connects to the network via an RJ-45 connector that can be used with unshielded twisted-pair (UTP) cable. It also has a DB-9 connector on the back that can be used with shielded twisted-pair (STP).11

In the 1980s, many different local area networking standards were competing including Ethernet, Token Ring, Datapoint's ARCnet, Apple's LocalTalk, Omninet, and Econet. By the early 1990s, Ethernet won due to a combination of factors: much lower cost (about 1/5 the cost of Token Ring), less complexity leading to faster technological improvement (such as 100 Mb/s Ethernet and switched Ethernet), and a wider ecosystem than IBM provided.10 The complexity of the chip reflects the complexity of Token Ring and illustrates that IBM's technological edge in the 1980s was a double-edged sword: although it initially gave Token Ring a large performance advantage, the simpler technology of Ethernet eventually won.12

The IBM logo is in the lower-left corner of the die, along with the mysterious codename "PINEGR SH".

The IBM logo is in the lower-left corner of the die, along with the mysterious codename "PINEGR SH".

Thanks to Antoine Bercovici for die photos and information. Thanks to my Twitter readers for discussion. I announce my latest blog posts on Twitter, so follow me @kenshirriff. I also have an RSS feed.

Notes and references

  1. IBM's token ring network was inspired by ring network research from the 1970s, such as the Cambridge Ring

  2. IBM called their integrated circuits MST, Monolithic System Technology. 

  3. The diagram below illustrates the complex construction of a solder ball on the die. Thin layers of aluminum, chromium, copper, and gold are put on the silicon to obtain the necessary properties, followed by a layer of lead-tin solder, which is reflowed to form the balls. The chromium bonds to the oxide layer, while the copper provides solderability and the gold protects the copper from oxidizing.

    Diagram of a solder pad, from this paper.

    Diagram of a solder pad, from this paper.

     

  4. The metal wiring on the top layer of the chip looks like a mess, but there is some structure behind it. The diagram below shows a small section of this wiring, colored to show the structure. The solder balls are shown in yellow. The red and blue traces transmit power and ground from the solder balls across the chip. These traces connect with the vertical strips of metal wiring that transmit power and ground throughout the chip. The other wiring connects the signal solder balls to the I/O drivers, converging in a narrow band in groups of four. Most of the solder balls are positioned with little regard for the underlying circuitry; the top metal layer provides the "glue" between them and the integrated circuit itself. The result is the peculiar metal pattern visible on top of the chip.

    The colored lines show how the top layer of metal wiring connects the solder balls to the chip.

    The colored lines show how the top layer of metal wiring connects the solder balls to the chip.

    In most integrated circuits, the I/O drivers are around the edges of the chip next to the bond pads. However, in this chip, most of the I/O drivers stretch in a line across the middle of the chip (indicated above). More I/O drivers are at the bottom of the chip next to the CPU, probably connected to it directly.

    The photo below shows three I/O drivers, side by side. The metal layers have been mostly removed to reveal the silicon underneath. These drivers are fairly complex. The top half contains large drive transistors to provide relatively high-current outputs, along with smaller control transistors. The lower half contains reddish serpentine resistors made out of polysilicon. These resistors help protect the sensitive gates of the input transistors from static discharges. For output pins, these resistors are disconnected. The middle resistor, however, is connected to the input transistor near the bottom.

    Die photo of three I/O drivers.

    Die photo of three I/O drivers.

     

  5. The die is flipped over when soldered to the substrate. This needs to be kept in mind when comparing the die and the substrate. For instance, the two extra power connections for the CPU are in the lower right of the die but the lower left of the substrate. (Just a note to avoid potential confusion.) 

  6. I'm not sure which transistors are NMOS and which are PMOS in the gate. I'm assuming the PMOS are on top and it's a NAND gate, but it could be the other way around, in which case it's a NOR gate. 

  7. The processor is described as using IBM's "universal controller (UC) architecture" but there's very little information about this architecture. Wikipedia claims this architecture consisted of UC0 (8-bit), UC.5 (16-bit), and U1 (32-bit), with upwards compatibility. An alt.folklore.computers thread and this page provide a bit more information. 

  8. The analog circuitry contains small loops of various sizes that I was unable to identify. They are only connected on one end and have nothing underneath, so they don't seem to be inductors. Twitter readers suggested probe points, disconnected circuitry, or reflective delay lines, but their function remains unclear.

    Three of the loops on the die.

    Three of the loops on the die.

     

  9. The designers were very proud of the testability of the chip, writing a paper about the testing methodology, and a second paper about testing the analog circuitry. The chip includes a boundary scan feature (kind of like JTAG) and built-in self-test features, as well as mechanisms to isolate the analog block and the CPU for separate testing. 

  10. Much of the information about this chip comes from A 16-Mbit/s adapter chip for the IBM token-ring local area network. That article describes an earlier version of the chip, so I can't be sure everything is accurate when applied to this chip. (It appears to me that the chips are the same apart from the smaller size of the newer chip.) One source says the two chips are compatible. The older chip has part number 51F1439 while the chip I examined is 50G6144.

    For information on Token Ring, the book The Triumph of Ethernet: Technological Communities and the Battle for the LAN Standard discusses the competition between network protocols in great detail. You might also like Foone's Twitter thread on Token Ring. Interestingly, one of the original "ENIAC Women", Jean Bartik, wrote a 1984 article on Token Rings—"IBM's Token Ring: Have the Pieces Finally Come Together?"—but unfortunately I haven't been able to locate a copy. 

  11. Token Ring cables could be joined using the "IBM Data Connector", a curious type of connector. The connectors are known as hermaphroditic because two connectors can be joined without worrying about male and female ends. The connectors were nicknamed "Boy George" connectors after the androgynous singer, which seems questionable by current standards. (The nickname may also be motivated by the BOGR text on the connector, which I think indicates the black, orange, green, and red wires.)

    IBM Data Connector. Photo from Redgrittybrick, (CC BY-SA 3.0).

    IBM Data Connector. Photo from Redgrittybrick, (CC BY-SA 3.0).

     

  12. The book The Innovator's Dilemma describes how a low-end but innovating technology can defeat an advanced, entrenched technology. I haven't investigated Token Ring versus Ethernet enough to be sure this model applies, so consider it a hypothesis.