Hello, Guest the thread was called1k times and contains 51 replays

last post from androSID at the

REU Controller 8726R1 dissection...

  • 1st the usual disclaimer:


    ttlworks once again joined and took over the majority of documentation work which I'm proud to reproduce here.

    Without his tremendous collaboration this would not have been possible anytime soon!


    And as in previous dissections I just copy&paste the text written by Dieter/ttlworks... which should not confuse

    anyone if he speaks of himself... so here we go:


    ================================================================================================

    //Previous thread: MOS6530 (MCS6530-004 aka TIM) dissected


    This thread is about a transistor level dissection of the 8726 REC (RAM Expansion Controller),

    brought to you by Frank Wolf and ttlworks.


    8726 was used in the Commodore REU (RAM Expansion Unit),

    a cartridge to be plugged into the C64 and C128 expansion port.


    Basically, the 8726 is a DMA\DRAM controller.

    It's not possible to access the REU DRAM from the C64\C128 directly,

    it's only possible to move/swap/verify blocks of data between REU DRAM and C64\C128 memory.


    There were three models of the REU:

    1700 (128kB of DRAM), 1750 (512kB of DRAM), 1764 (256kB of DRAM).

    8726 came in DIP64 and PLCC68 package.


    8726 was designed by Victor F. Andrade, who also did the 65CE02,

    and later went to AMD for working on the K7.

    And from what's in the chip, I have to say that he is very good at logic design.


    ;---


    Some more links:


    codebase64: Commodore REU

    codebase64: description of the REU registers

    pokefinder: 1750\1764 REU service manual


    ;---


    I have to say, that me and Frank had greatly underestimated size/complexity of the circuitry within the 8726,

    because half of the chip space is empty (I think that the amount of pads didn't allow for a smaller chip size).


    The previous dissection was about the 6530, a manually routed design from 1975.

    8726 is a CAD routed design from 1985, and to me it's a bit scary to see how the game of routing chip layouts

    had changed within only 10 years.


    Sometimes I had bumped into the size limitations when drawing schematics with the Eagle full version during this dissection,

    so I started to wonder what CAD software and what workstation Victor Andrade had used there,

    and how expensive CAD software plus workstation had been back in 1985.


    Some of our readers are familiar with the game, when you need a PCB done fast.

    You spend some time with drawing the schematics, then you throw the components from the schematics into a PCB,

    and try to arrange them until the airwires between said components don't look too scary anymore.

    And from there, it's autorouter plus some hand optimization.

    To me, the 8726 chip layout has that particular smell.


    Note:

    For consistence with Frank's notation, low_active signals are named foo#, not /foo.


    Orientation for all the chip pictures: RES# pad is North.

  • Eagle 6.4 schematics for my schematic pictures in this thread,

    just in case if somebody needs them.


    Note: KiCad is supposed to be able to import these schematics,

    unfortunately it doesn't seem to be possible to disable the layers 'name' and 'value' in KiCad schematics,

    so making my schematics look nice and clean in KiCad will require some work, sorry.


    8726r1_dissection_schematics.zip

  • 1) DMA# pad, located North West on the chip.


    //Since the chip has a lot of pads, I had decided to go through them clockwise, starting with DMA#.


    The low_active DMAo# signal [generated in "31) tapeworm from hell"] is sampled by a transparent latch

    controlled by DMA1 [generated in "21) RAS_CAS_logic" from PHI1 and DotCLk].


    The output of said transparent latch plus DMAo# go into a NAND with push_pull output.

    The NAND feeds an inverting and a non_inverting super buffer,

    which control the driver FETs for the DMA# pad.


    ;---


    Basically, what we have on the DMA# pad is DMAo# AND (DMAo# latched by DMA1).


    DMA# stops the 6510 CPU in the C64\C128 by pulling RDY low, when the 8726 takes over the bus.

    For more details, see "2) BA".




  • 2) BA


    BA is a signal generated by the VIC-II inside the C64\C128.


    If the VIC-II needs the bus during PHI2 when handling badlines or sprites,

    BA low stops the 6510 CPU by pulling its RDY input to low.


    For details, please see:

    C64 schematics, part 1.

    C64 schematics, part 2.

    6567 VIC-II preliminary datasheet, PDF page 19.

    VIC-II article by Christian Bauer, 2.4.3 Memory access of the 6510 and VIC


    BA changes during PHI1.

    BA1 is BA sampled during PHI1 by a transparent latch.

    BA2# goes high after BA was low for three cycles, indicating that the VIC-II took over the C64\C128 bus completely.


    If the C64\C128 bus is available, if a DMA access to C64\C128 memory is active (indicated by DMAo# is low),

    OE_RW enables the driver for the R/W# pad [plus the A0..15 bus drivers, see "16) A0"].

    during PHI1=low (what is different from PHI2_in=high).


    //From the looks of the propagation delays which were intentionally built into the circuitry,

    //to me it looks like the 8726 timing was a bit tricky on the C64\C128 side.



  • 3) CS#


    When the C64\C128 reads/writes 8726 registers, it does by pulling the low_active chip select CS# low.


    CS# (low active) goes throug an inverting super buffer, then through an inverter, and becomes CSi# (low active).


    Later in "5) rw", two control signals are generated from CSi#, R/W# and PHI1:

    When CS2R# (low active) is low, the 6510 does a 8726 register read during PHI1 low (what is different from PHI2_in is high).

    When CS2W# (low active) is low, the 6510 does a 8726 register write during PHI1 low (what is different from PHI2_in is high).


    ;---


    There are two control signals for D0..D7 pad drivers\buffers, see "18) D0".

    OE_D (high active): D0io..D7io > D0..7.

    OE_DI# (active low): D0..D7 > D0io..7io.

    ;

    D0..7 is the external data bus of the C64\C128.

    D0io..7io (bidirectional) is the internal data bus of the 8726.


    Just describing the simplified concept of the circuitry which generates OE_D and OE_DI# here:


    Inverted CS2R# and OED go into an OR gate.

    The output of the OR gate is sampled by a transparent latch controlled by OED_GATE.

    If the output of the OR and the latch are high, OED is high: D0io..D7io > D0..7.

    ;

    OED (high active) is generated in "31) tapeworm from hell" during DMA when the 8726 writes C64\C128 memory.

    OED_GATE is generated in "21) RAS_CAS_logic" from PHI1 and DotClk.


    CS2W# and inverted OEDI go into an AND gate, which generates OE_DI#.

    If CS2W# is low, or OEDI is high: D0..D7 > D0io..7io.

    ;

    OEDI (high active) is generated in "31) tapeworm from hell" during DMA when the 8726 reads C64\C128 memory.


    And yes, timing on the C64\C128 side of things in the 8726 still looks a bit tricky...




    ;---


    Side note:


    Imagine, you want to delay a signal, and all you have is 7405 type open collector inverters with pullup resistors at the output.

    Adding a capacitor to GND at the output will delay the signal, but delays for the high_to_low edge and low_to_high edge would be different.


    That's because the pullup resistor between output and VCC will have a higher impedance than the output transistor in the inverter

    which switches the output to GND (if they would have the same impedance, the voltage at the output won't go below logic HIGH level).


    So if you want to have identical delays for high_to_low edge and low_to_high edge when resorting to 7405 plus pullup resistor plus capacitor,

    the trick is to send the signal through _two_ 7405 type inverters, by using identical pullup resistors to VCC and identical capacitors to GND.


    The 8726 just uses FETs instead of pullup resistors to VCC and bipolar transistors switching to GND.

  • 4) PHI


    The PHI2_in clock signal generated by the VIC-II inside the C64\C128 goes through an inverting super buffer,

    then clears/sets a RS flipflop which is built from two NOR gates (gate outputs are boosted by non_inverting super buffers).


    The outputs of the non_inverting super buffers then give us the two non_overlapping clock signals PHI1 and PHI2.


    Nothing unusual here, it's pretty much standard.




  • 5) rw


    R/W# is the read/write control signal from/to the C64\C128, and yes:

    since the 8726 needs to be able to write C64\C128 memory, it's bidirectional.

    High=read, low=write.


    ;---


    On the input side, R/Wi# just is the buffered R/W# signal.


    CS2R# (low_active) enables 8726 register reads and goes low

    when R/W# is high AND CS# is low (6510 read access)

    AND PHI1 is low (what is different from PHI2_in is high).


    CS2W# (low active) enables 8726 register writes and goes low

    when R/W# is low AND CS# is low (6510 write access)

    AND PHI1 is low (what is different from PHI2_in is high).


    ;---


    On the output side, basically we have a non_inverting buffer,

    fed by (low active) R/Wo#, enabled with (high_active) OE_RW.


    During DMA for C64\C128 memory writes (DMAo# is low):

    R/Wo# is generated in "31) tapeworm from hell",

    OE_RW is generated in "2) BA".


    The unusual thing about the non_inverting buffer is,

    that the output transistors do non_overlapping switching to GND\VCC,

    and we are going to see that sort of circuitry quite often in the 8726

    when it comes to bus drivers.


    We have two NANDs, one fed by R/Wo# and OE_RW, the other fed by inverted R/Wo# and OE_RW.

    The outputs of the NANDs fed the R and S input of a RS flipflop built from two NOR gates.

    The outputs of the RS flipflop then control the output driver FETs, switching R/W# to GND\VCC.


    If OE_RW is low, the outputs of both NANDs are high,

    so the (high active) R and S inputs are both high,

    what forces both outputs of the RS flipflops to low and disables the output driver FETs.


    Point is, that we already had a RS flipflop with buffered outputs in "4) PHI",

    and from the logic design point of view the non_inverting buffer driving R/W#

    to me somehow looks like a modified PHI1\PHI2 clock generator with output enable.



  • 6) DotClk


    DotClk is the dot clock from inside the C64\C128.


    //Frequency is 8* PHI2_in, PHI2_in is supposed to change with the rising edge of DotClk.


    DotClk (high active) goes through an inverting super buffer and becomes DotClk# (low active).


    DotClk# then goes into the Dot/Dot# clock generator inside "21) RAS_CAS_logic".




  • 7) IRQ#


    IRQ (high active) is a 8726 internal interrupt signal,

    it is generated in "30) Register $00".


    IRQ goes into an inverting super buffer,

    which controls the driver FETs pulling the external IRQ# signal low if IRQ is high.


    Inside the C64\C128, IRQ# (low active) goes to the IRQ# pin of the 6510,

    and something like a 3.3kOhm pullup resistor is supposed to be between IRQ# and VCC.




  • 9) BS


    BS (high active) goes through an inverting super buffer and becomes BS# (low active).


    It defines the size of the two DRAM banks attached to the 8726 inside the REU,

    see "26) AM16..18 address counter, bank select logic".


    BS=low (BS#=high): two banks with 256kB of DRAM each.

    BS=high (BS#=low): two banks with 64kB of DRAM each.


    Note, that we are just talking about the configuration of the 8726 bank select logic here,

    not about the _real_ size of a DRAM bank which physically is attached to the 8726.




  • 11) DWE#


    DWE# (low active) is the write enable output signal for the DRAMs attached to the 8726.


    Basically, we have an inverting driver which turns DWE (high active) into DWE#.


    The inverting DWE# driver driver is just a variation of the non_inverting "11) CAS1#" driver:

    the output FETs driving the DWE# pad to GND\VCC are swapped to make it inverting.




  • 12) DD0


    DD0..DD7 are the data inputs/outputs of the DRAMs attached to the 8726.


    DD0io..DD7io is the bidirectional data bus inside the 8726 related to DD0..7.


    DD0..7 drivers\buffers have identical chip layout, so we just focus on DD0.


    ;---


    On the input side, DD0 is sampled with a transparent latch during PHI1,

    what indicates that the 8726 does DMA data access to the DRAM banks during PHI1.


    The output of the latch is placed on the DD0io bus by a non_inverting buffer

    controlled by DDRD (high active), which is generated in "31) tapeworm from hell".


    ;---


    On the output side, we have a non_inverting driver fed by DD0io, driving DD0,

    controlled by DWE (high active).


    As mentioned in "11) DWE#",

    DWE (high active) is the write enable signal for the DRAMs,

    generated in "31) tapeworm from hell".


    Drivers have output FETs switching non_overlapping to GND\VCC

    it's a variation of the driver we already had in "5) rw",

    making creative use of a RS flipflop built from two NOR gates.




  • 13) MA8


    MA0..8 is the (multiplexed) address bus from the 8726 to the DRAMs.


    MA0..8 drivers have identical chip layout, so we just focus on MA8.


    Drivers have output FETs switching non_overlapping to GND\VCC

    it's a variation of the driver we already had in "5) rw" (no output enable),

    making creative use of a RS flipflop built from two NOR gates.


    ;---


    At the inputs of the MA8 driver, we have three switches.

    MA_lo (high active) controls the switch which places AM16 on MA8 during DRAM RAS.

    MA_hi (active high) cotrols the switch which places AM17 on MA8 during DRAM CAS.

    MA_refresh just places high on MA8 during DRAM refresh, because the refresh counter has only 8 Bits.


    MA0..7 also have three switches each at the inputs:

    MA_lo controls the switches which place AM0..7 on MA0..7, the low part of the address during DRAM RAS.

    MA_hi controls the switches which place AM8..15 on MA8..15, the high part of the address during DRAM CAS.

    MA_refresh controls the switches which place the refresh counter outputs RA0..7 on MA0..7 during DRAM refresh.


    MA_lo, MA_hi, MA_refresh are generated in "21 RAS_CAS_logic".


    ;---


    //Side note: AM0..8 is "multiplexed address", MA0..18 is "address to be multiplexed", don't mix that up.




  • 14) TEST#


    When TEST# is low, the refresh counter and the prescaler for the refresh counter are cleared,

    maybe for testing the chip at the factory.


    The TEST# pad has a nice ca. 4kOhm pullup resistor (FET) to VCC attached to it.


    TEST# (low active) goes through an inverting super buffer and becomes TEST (high active),

    then goes to "22) refresh counter".




  • 15) ROMSEL#


    ROMSEL# (low active) is an output signal for selecting an external ROM.


    ;---


    Short story:


    ROMSEL# = ROMH# AND ROML#.


    ;---


    Long story:


    ROMH# and ROML# go through inverting super buffers into a NOR gate.

    The output of the NOR gate controls a non_inverting driver and becomes ROMSEL#.


    //Hint: when inverting inputs and output of an OR gate, it becomes an AND gate.




  • 16) A0


    Address bus A0..4 between C64\C128 and 8726 is bidirectional.


    A0..4 drivers\buffers have identical chip layout, so we just focus on A0.


    ;---


    On the input side:

    A0 (high active) goes through two inverting super buffers, and becomes A0i (high active).

    A0 (high active) also goes through an inverting and a non_inverting super buffer, and becomes A0i# (low active).


    A0i and A0i# are feeding the NOR gates which do the address recoding for reading/writing the 8726 registers,

    same thing for A1i..A4i and A1i#..A4i#.


    We have a big 16 input NOR gate (checking the C64\C128 address bus for $FF00) which consists of a pullup FET to VCC,

    and a metal trace which passes by all of the A0..15 drivers\buffers.

    The A0 driver\buffer has a FET which switches said metal trace to GND if A0i is high, same thing for A1..4.


    For more details about $FF00 detection, see "20) A0..15 NOR".


    ;---


    On the output side, we have a non_inverting driver, fed by A0o, controlled by OE_RW (high active).

    Drivers have output FETs switching non_overlapping to GND\VCC, making creative use of a RS flipflop built from two NOR gates.

    The circuitry is a variation of the R/W# driver we already had in "5) rw".


    OE_RW is generated in "2) BA".


    A0o is generated in "24) A0..15 address couter", that's the DMA address when the 8726 reads/writes C64\C128 memory.





  • 17a) A5


    Pretty much like what we had in "16) A0",

    except that the input side is less circuitry:


    A5 goes through two inverting super buffers,

    then drives a FET which switches the metal trace of the A0..15 NOR to GND if A5 is high.


    A5..7 drivers\buffers have identical chip layout.


    ;===


    17b) A8


    Pretty much like what we had in "17a) A5",

    except that the input side is a little bit different:


    A8 only goes through _one_ inverting super buffer,

    then drives a FET which switches the metal trace of the A0..15 NOR to GND if A5 is low.


    A8..15 drivers\buffers have identical chip layout.