As you may have seen in my previous blog post, I like arcade boards, trying to understand how they behave and sometimes fixing them. A year ago, I had my hands on a “Street Fighter II New Challengers” CPS2 game board, but it had graphic glitches as you can see below.

Vintage game and computer collectors are no stranger to these problems. Because of corrosion, component degradation, battery leaks or other issues, those boards eventually break in various ways. In order to fix them, either you are encountering a recurring and documented issue, or you need to actually probe your board to see if each part is working as expected.

You might wonder: how do you do that? Well, usually you use schematics of how the board is structured and try to see if there are things that you can expect. For instance, if you know that the graphics data goes through a specific set of wires, you can test each of those to see if they have activity, if not you have a starting point to figure out what’s wrong and fix it. Of course, this requires skills and knowledge to do it well, but what I would like to emphasise is the need for schematics.

A CPS2 game board, about a thousand wires to test.

In my case, experience tells me that the issue I had felt like it was a broken trace, one line was cut somewhere and couldn’t transmit its data… but where? Sadly, the schematics for the CPS2 board are unknown. Like most of the boards of this era, if the original schematics are not leaked, the entire knowledge of the board is based on a community effort. I wanted to do my part and started painstakingly tracing all wires of this board and hoped to find my issue. Eventually, after weeks of work, I found the broken trace, patched it, and it worked! Because I had traced most of the wires, I launched myself head-first into a new mad initiative: recreate the complete schematics for the CPS2.

Side note: I stress on the fact that schematics are useful in repairing systems, but it is also useful for the emulation community whose aim is to simulate how game boards work in order to play those games on modern hardware. The CPS2 has decent software emulation programs but these are not 100% accurate and lately, people are performing more and more hardware emulation which would definitely require schematics.

A custom chip specifically made for this board.

Unfortunately, on this board, Capcom chose to use five custom-made integrated circuits. On older arcade boards, you often have well-known core components (processor, memory, sound…) bundled with a lot of very well-known basic chips, all wired together to create the final board. However, having custom chips allows more compact designs, and also allows to obfuscate and add security measures to avoid counterfeits and bootleg copies of the game. This was actually proven to be effective as no bootleg boards of CPS2 games have been created. But, this makes the process of understanding the board more complex because obviously, no datasheet exists for those custom chips.

This will be our goal in this article. We are going to try to understand what does one of the chips, the DL-1827 portrayed in the picture above, by looking at its internals and analysing how it is structured.

How custom chips are created?

The die at the middle of a package

There are plenty of ways to create an integrated circuit and technology evolves a lot in this domain. But we’re just going to focus on the global idea. At the core of every integrated circuit, you have what is called a “die”. This is what implements the behaviour of your chip, the rest is just plastic or ceramic packaging and connecting pins to the die.

3D view of a small part of a die with 3 layers of metal in yellow

In order to create the die, the process is split into two parts. The first one aims to create a silicon base called the “wafer” where all the main components will be engraved on (transistors, resistors, capacitors…). The second part will create multiple layers of metal wires in order to connect the components together.

As you may imagine, creating a new chip is a costly process. Moreover, it requires skills and knowledge that will not be part of game companies like Capcom filled at the time with programmers and electronics engineers. So, manufacturers came up with a way to develop application-specific custom chips: gate arrays.

The idea behind gate arrays is simple: instead of creating everything from scratch, you start with a common wafer that contains a regular grid of transistors. And because all logic processing functions can be built using transistors and wires: you can recreate all the necessary building blocks that electronics engineers are used to (logic gates, latches etc…). The manufacturer can design those building blocks, called “standard cells”, by preparing the wiring and the engineers can now create their own circuit in this miniature technology.

As an example, I want to build a 3 input NAND gate (e.g. output will be LOW only if the three inputs are all HIGH). To build it, I have an 8x5 grid of transistors and my standard cells are: a “AND” cell which uses 2x3 transistors and a “NOT” cell which uses 1x2 transistors. Therefore, I can create a working design like this:

A 3 input NAND gate built out of 2 AND cells and a NOT cell on an 8x5 grid.

Obviously, this is a very simplified example with simple building blocs but the idea is there. Engineers have a library of hundreds of standard cells to use, a large grid to place them, and multiple additional layers of metal wires where they can route signals between the cells. Once this is prepared, the manufacturer can just take one of the prepared wafers, apply the metal layers for the cells, apply the metal layers for the inter-cell connectivity and embed the newly created die the final package.

Now that we have understood how the idea of gate arrays work as a whole, we can look at the chip that we want to understand, see in detail how its gate array is structured and try to recreate the cells map.

A first look at the chip

Die shot of the DL-1827 found on the CPS2

As Eduardo Cruz demonstrated in his blog posts detailing his work on the CPS2 security, in our case most the chips found on the game board are based on Fujitsu CG24 gate arrays. To kickstart my journey, Eduardo and John McMaster graciously gave me access to hi-res pictures of the custom chip dies. Creating these pictures is a process that requires skills and materials that I definitely don’t have. The basic idea is to dissolve the package of the chip in acid, then put the extracted die in a microscope and take hundreds of photos that will be stitched on to create a very large picture.

Let’s now look at how Fujitsu created their gate array. If you look at the die shot, you can see the grid of the same pattern repeating over and over. Here is a 2x4 part of this grid. Those blocks are called “basic cells”

View of the basic cells grid, basic cells are highlighted in black on the right

If we consult the datasheet of the Fujitsu Gate Array, we can understand better how the basic cell is structured on the wafer. If you ignore the vertical white bars, those are metal wires delivering power if needed, you can extract the following abstraction.

Fujitsu CG series basic cell abstraction

A-B-C-D-E-F-X-Y are all contact points. The blue layer with A-B-C represents P-tubs, the green layer with D-E-F represents N-tubs, and the orange layer with X-Y represents polysilicon layers. Together, they form 2 PMOS transistors (P1, P2) and 2 NMOS transistors (N1, N2) with prepared wiring as shown. If you are like me, you barely remember how these works. Let’s simplify and imagine these transistors as switches, P1 is closed only if X has low voltage, conversely, N1 is closed only if X has a high voltage. This will be our main unit and all contact points will be used using metal conductors to connect things together. Now let’s analyse our first standard cell.

Analysis of the “V2B” cell

This first standard cell is composed of one basic cell with plenty of wires. Remember that we are only seeing a top-level view and metal wires are arranged in layers at different heights as we have seen previously, this requires some experience to distinguish between layers. The black dots are “nails” or “vias” that cross between different layers. It becomes a game of connect-the-dots using the previous transistor schematic. After some work, we get the schematic on the right. If you have played with logic gates as transistors, you will recognize that this is two “NOT” gates in parallel. If IN is low, P1 and P2 are active, N1 and N2 are not, therefore OUT is connected to Vcc so it’s high. Conversely, if IN is high, P1 and P2 are inactive, N1 and N2 are, therefore OUT is connected to ground so it’s low.

You might ask, why two in parallel? Well, one transistor is only able to provide a limited amount of power, so having some in parallel will provide twice the capacity. In the datasheet, this is referred to as a load unit (lu), using X or Y requires 1lu, and a transistor pair P-N can provide 18lu. Having two in parallel consumes 2lu as input, and provides 36lu as output.

A much more complex cell. This is a D latch with reset. Don’t be fooled, this took me hours to understand and identify with absolute certainty.

This is only one type of standard cell, and the datasheet provides around 200 possible cells. So the first task that we have to address is: identify all the cells that are used on this die. If you are interested in that, please consult the additional resources at the bottom of this article but here’s a list of criteria that help to narrow down the list of candidates without doing the tedious process of retracing all metal wires to each transistors:

Number of input/outputs

Size of the cell (in “basic cells”)

The load of each input and output (in “load unit”)

Presence of subparts like simple “NOT” and “AND” gates

In total, after a lot of struggles, I have found and identified 35 types of standard cells. Hopefully, the next time I try to understand another Fujitsu gate array of the same period, there is a high chance that the standard cells will be similar and I will not need to do this again.

Making the process tool-assisted

Let’s recap, I have a ~16000x16000 image and hundreds of standard cells in it. The usual way of analysing the gate array starting from now is to open your die shot in a software like Inkscape (vector graphics editor) and draw each wire, each cell and try your way up from here.