/cpu11

Revengineered ancient PDP-11 CPUs, originals and clones

Primary LanguageVerilogOtherNOASSERTION

Abstract

This CPU11 repository contains the results of historical PDP-11 microprocessors reverse engineering.

Typically the results include:

  • high-resolution photos of decapsulated crystals, both for top metal and diffusion layers
  • restored crystal topology in Sprint Layout 6.0 format, can be easily exported to Gerber
  • restored topology in PCAD format
  • restored gate-level schematics in PCAD and pdf formats
  • original asynchronous Verilog-HDL model of processor
  • refactoring original Verilog-HDL model to synchronous one to run on real FPGA

There are a few words regarding the reverse engineering process stages:

  • sample decapsulating, milling die from the plastic package with CNC, then etching with 104 percents boiling oleum
  • serialized photographing of die with a motorized metallurgical microscope, hundreds of shots
  • shot stitching, getting the resulting high-resolution panoramic shot
  • removing the top metal layer with a polishing
  • getting the high-resolution panoramic shot of the diffusion layer
  • manual images vectorization - traces, vias, pads, etc.
  • gate recognition
  • transferring vectorized images to PCB CAD system
  • schematic restoration using PCB CAD back annotation
  • manual schematic refactoring into human-readable form
  • writing the original asynchronous Verilog HDL model, with all schematics specifics
  • simulating and debug the original Verilog HDL model, running PDP-11 factory test software on the model
  • Verilog HDL model refactoring to get synchronous model, running on real FPGA
  • transforming processor-specific bus to standard Wishbone master interface to integrate into SoC

Processors

  • 1801BM1 - USSR microprocessor, no DEC prototype, proprietary die design
  • 1801BM2 - USSR microprocessor, no DEC prototype, proprietary die design
  • 1801BM3 - USSR microprocessor, no DEC prototype, proprietary die design
  • LSI-11 - Soviet 581-series, DEC LSI-11 clone, Western Digital MCP-1600 chipset
  • M4 - Soviet replica of military LSI-11M, AMD Am2900 bit-slices

PI-test perfromance

The 1000 signs of Pi calculation test is based on spigot algorithm. The digits are the times in 50Hz ticks. All models were Wishbone-compatible and run on the DE0 board with the same system configurations, software was placed into static memory with zero wait states. LSI-11 was running at 80MHz and results are multiplied by 0.8 to match with other ones. M4 was running at 50MHz and results are multiplied by 0.5. There are three variants of the test with various combinations of supported EIS instructions.

Model Frequency no EIS MUL only MUL/DIV
LSI-11 100MHz(80MHz) 746 422 284
1801BM1A 100MHz 586 --- ---
1801BM1Г 100MHz 588 458 ---
M4 100MHz(50MHz) 532 275 154
1801BM2 100MHz 340 190 123

Supported FPGA development boards

The synchronous models are planned to be run (and appropriate sample projects to be included in repo) on the following Development Kits: