How were Western computer chips reverse-engineered in USSR?

Question

The British ZX Spectrum computer had many clones in the Eastern Bloc. It seems many of them were built using Russian-made chips from the Angstrem factory in Zelenograd in/near Moscow. The Russian Wikipedia mentions the КР1858ВМ3 which is a Z80 clone, and the Т34ВГ1, which is the same thing as a ZX Spectrum ULA.

How were these chips made? Could they have possibly taken a Western chip and taken it apart somehow, to manually build a netlist, as was recently done to the 6502? Or was someone able to procure the masks from Zilog's and Sinclair's engineers?

Answer 1

Little is known about how these computers and chips were made, because their development was top secret in the Soviet Union.

As far as I know, Soviet Western-compatible ICs were made by copying masks used in fabrication or by buying manufactured products under fake identities and smuggling them back into Socialist countries where they were reverse-engineered either at function, or silicon level.

This is a quick sum-up of when I had a similar question, searched around Russian sites and asked older professors at my university. Some more data for comparison can be obtained by reverse-engineering the soviet chips and comparing them to decaps of their Western counterparts.

I have a document somewhere with more stories, comparisons and links to some other decaps of Soviet chips, but I can't find it right away. I will update this answer with relevant information when (if) I find that document.

КР1858ВМ1 and Т34ВМ1 (clones of Z80), according to the Zeptobars company, were based on copied masks. Compare: die shot of КР1858ВМ1 and die shot of authentic Z80. Also: die shot of Т34ВМ1 and die shot of Z0840004PSC. КР1858ВМ3 is an improved version of the same chip, however it is almost certain that little was changed from КР1858ВМ1. Another interesting thing is the U880/6 on the crystal of the chip. This is the name of German version of Z80, meaning that the masks they used originated in Germany. The updated (CMOS) version КР1858ВМ3 does not have this marking and looks quite different in general both from its predecessor and Z84C00 (CMOS version of Z80).

Т34ВГ1 was not decapped as far as I know, however there are two theories on what's inside them (Russian source):

• Independently designed functionally compatible circuit;
• Gate-array programmed to imitate the original ULA.

Answer 2

It seems to be pretty much accepted wisdom that the Soviets completely cloned the Western chips and did not simply develop reimplementations of the same instruction sets. Since at the time it was pretty important to have the impression of having own developments, the copying was obviously not admitted publicly so not much is known about how exactly the copying was done, but the prevailing opinion seems to be that they were delayered mechanically by shaving off thin layers of silicon from the top and chip layouts were copied from the microscope photos. Apparently at some point things got so bad that Digital had to add some bad Russian onto their die (I doubt it helped).

Edit: due to cruder capabilities of the Soviet production lines (see below) the chips were apparently not always copied 1-to-1 but sometimes had to be adapted to the available process, which required some understanding of how they worked and re-doing the layout.

There are some interesting discussions on the topic on the IXBT forum: 1, 2, 3 (in Russian). Due to the nature of the forum you have to of course take everything said with a pinch of salt but there is still some useful information. For fun I translated a post by the user Felid who seems to be quite informed. Note that some of the text is replies to earlier posts in the thread and is not directly related to the topic of cloning. URLs are mostly dead since the post is from 2007 but some got saved by the Internet Archive.

Felid (08.09.2007 17:24)

In short: yes, we shamelessly ripped off everything except for the MIPS R3000 which was licensed and produced as Л1876ВМ1 etc. running at 25Mhz (in reality <15) - officially licensed, with complete documentation for production. People tried to adapt it to Angstrem's production line, but until 2003 processor could not reach 40Mhz (to which the original could be overclocked because it used 1.2 µm and Angstrem only had 2µm (and 1.5 metal layers). Still, for the aviation industry (airplane navigation) it seems they managed to make a 100Mhz version (works at 80) - was announced a couple months ago (see Angstrem's site). Looks believable especially if you read this: http://www.terralab.ru/print/system/275141. In reality this is the sole more or less modern design which exists now but it's being squeezed dry.

Of our own single-chip microprocessors, not a single one reached mass production.

There were only two options: a full clone or an improved/reworked copy.

Т34ВМ1 is not a Z80 but a single-chip PDP-11 CMOS version LSI-11/23. After entering production, it got an added clock generator, simple power and interrupt controller, RAM selector and data bus multiplexer and got renamed into 1013ВМ1 - that's what inside the microcomputers Электроника МК-85(М,С). By the way, one of the best designs and a really successful model. I could have been used to create an amazing machine for its time. But...

We had no clones of MС68xxx, except for 1843ВМ2(Integral's copy of MC68C881) but I don't know where it was used.

Regarding pipelines: the first time some kind of pipeline appeared was back in MOS 6502.

Among the strictly PC-range CPUs - in '86, where reading of the next instruction happened during execution of the current one.

So which pipeline was "first" is a tricky question.

1810вм89 is not a processor but the 8289 bus master.

When you copy layer-by-layer you don't have to understand how it works. Important thing is to keep the scale(?) and to not scramble the order of layer shots

This works only up to the '286. Once you get to 134000 transistors - while turns out that it can be copied (1847ВМ286, if you can imagine), to achieve more than one percent yield for such a chip was nearly impossible. And USSR ended by that time so it was easier to buy the ready-made ones. So it didn't go anywhere. Here's some reading for you: http://www.electronics.ru/93.html, http://live.cnews.ru/forum/index.php?showtopic=29546 and especially http://electronix.ru/forum/lofiversion/index.php/t30576.html. After this the blind faith into the soviet/Russian electronics will fade by itself. Especially the bit about 580ВГ75 (CGA controller of the first PCs) and 1% yield after one year in production.

Regarding backdoors and self-destructing mechanisms - this ancient myth still doesn't want to die.

There were no backdoors, it's all paranoia. You can't backdoor without it being visible undert microscope, and they would affect legitimate functions. Real cases of backdoors in IC chips were never discovered, but the myth lives on.

About the trinary Setun and the "ruined" advanced performance - read here: http://dirty.ru/comments/219957

added 08.09.2007 18:12:

abc777

Who and how copied:

At first the top-secret "boxes" and numbered no-name research institutes. Afterwards even students started being involved. In Leningrad, at least. With the obvious productivity and results.

Documentation and samples were acquired who knows where, but closer to 80s were received from the Soviet diplomats in the West via missions (not directly of course but under strict and constant control of you know who).

Some even managed to get documentation for photolithography machines. Well, and also subscriptions for western magazines like Scientific American.

As a rule, nothing was released until understood how it worked. About fixing errors I'm not sure but those that happened (tons...) were caused by production issues, since completely good and bugless chips did exist.

Western companies knew all about it but since USSR did not plan to complete in the same markets, kept their silence.

Although, I've heard this story about DEC experts who came to check if we really copied the PDP-11.

And reportedly said, "Fine, keep it up but don't try to sell to the West". Could be made-up though.

By the way, electronics for cars in USSR/Russia existed and exists: it's called МСУАД(MSUAD): Micropocessor system for contolling the automobile engine Various controllers and stuff are being released for it.

The closest "public evidence" of cloning would probably be the books like "Integrated circuits produced in USSR and their foreign analogs(sic)" which were published in the 90s and, for example, listed "Z80" for КР1858ВМ1.

As for Т34ВГ1, according to this page it was not a simple copy, but a custom chip developed for the Czechoslovakia's Spectrum clone "Didaktik Gama". In one version it replaced "15 separate chips", and in another the official Ferranti ULA (possibly because it was too expensive). Apparently it was not completely compatible leading to issues with some games.

Answer 3

This answer is written from memory, corrections may be made later if I remember/research more details. It starts with historical background to put things into perspective. This answer is specifically about Soviet ZX Spectrum clones, for other stuff read other answers, or for example this https://www.glaver.org/blog/?p=959 (Yes, Soviets were copying everything they could with total disregard for IP laws, and were pirating all the software, most soviets electronic components are clones of corresponding western ones)

First of all, USSR economy was not consumer-oriented. Vast majority of resources, most talent was was allocated to military and internal security. Soviet electronics industry consisted of many factories, using mostly imported outdated equipment and plenty of manual labor. Communication between these factories was limited due to secrecy and big distances. Non-military projects were frequently seen as means to utilize poor quality surplus components and sometimes grew out from personal projects done by one of the engineers working there. Beyond some highly classified military projects, soviet industry was blindly chasing after the western one by following news, bringing some random specimens from abroad and trying to copy them, typically lagging behind by 10 years and never able to match production volumes and efficiency. Developing something original was seen too risky by soviet bureaucratic management, versus stealing finished, well debugged western software or hardware product. Usually biggest changes were made to accommodate inferior production technologies, materials and components. I could explain further how dysfunctional soviet economy was, how different ministries tried to one up each other, but the answer is already much bigger than it should be.

There was no interest on the state level to replicate ZX Spectrum and various other Z80 and 6502-based home PCs, but there was interest in micros for industrial automation, office work and especially education. The situation only changed in late 80s, when factories were asked to actually earn money to support themselves by selling consumer products. However, USSR ignored, did not copy and could not produce 6502 and Z80, until, probably, the last year of its existence. Due to fragmented nature of the Soviet electronics industry there were more than 6 competing networked school micro/mini computers, with ZX Spectrum not being one of them. Only one of those was Z80-based, but it wasn't actually produced in USSR. Yamaha MSX. Another, Agat, was Apple II semi-clone, but used either imported 6502, or bitslice re-implementation of it. The rest used domestically-produced 8080/8080A, 8086 and LSI-11 copies, able to run western software&operating systems, modified to support Cyrillic fonts. MSX brought videogames to USSR and many MSX games were (unofficially) ported to nearly every other USSR/exUSSR hobbyist PC. There were many of those in the late 80 and early 90s, usually 8080A-based. They, of course, could not compete with huge library of quality software available for Spectrum, so it became a natural winner despite problems with sourcing enough Z80s.

Majority of Soviet ZX Spectrum clones weren't using copies of Z80 and/or ULA. More often, they used imported Z80 and replicated ULA functionality by using a bunch of discrete logic chips (logic gates, triggers, counters, multiplexers) and a few lookup tables burned into several small ROMs. Many did not replicate ULA timings and quirks exactly, or instead added extra functionality/performance improvements, used various tricks to cut down component count and production costs. I believe, first designs were produced by a few bored engineers, who somehow obtained a Speccy, brought it to work and poked it with logic analyzers and oscilloscopes and then tried to devise an implementation that doesn't use custom chips. This was done independently in several places, with some designs used for factory mass production and other used by hobbyist/small enterprises. Typically, factory-made designs are a bit overengineered, have Russian character sets and additional software/hardware features(Byte, Delta-S, Santaka, etc.), while DIY designs were more elegant, but frequently sacrificed some compatibility for simplicity and used unchanged Speccy ROMs except, maybe, changed copyrights.

Factory designs were usually produced as complete boxed products, a futile attempt of post-soviet industry to survive impending doom of 90s economic collapse while supplying impoverished masses with only home PC they could afford. To save costs, later versions of those used one of several available ASIC ULA reimplementations and Т34ВМ1/U880 Z80 clones that were slightly less compatible than originals.

DIY ones were made by small entrepreneurs frequently as a kit, with cases, keyboards, PSUs, expansions etc. being optional. They were gradually improved with more and more features, including RAM expansions, floppy, mouse and hard drive controllers, audio & graphics cards, modems etc.

P.S. My english isn't very good, corrections are welcome.

Answer 4

You could reverse-engineer those early CPUs by grinding or etching away the top (plastic) layer of the chips down to the silicon die and examine the chip structures on an (optical) microscope.

(Picture of a real Z80 die, from Wikipedia, Von Pauli Rautakorpi - Eigenes Werk, CC BY 3.0, https://commons.wikimedia.org/w/index.php?curid=30690133)

The Z80 had, like all earlier CPUs up to maybe the 8086 such large structures that optical reverse-engineering was perfectly possible. A well-trained eye could easily recognize structures like flip-flops, registers, counters and latches.

Answer 5

Computer development wasn't necessarily "top secret" as is commonly said about anything that has to do with the Soviet Union. The engineers there used the same methods as other companies in Taiwan. Z80 is probably the most cloned CPU, because of its popularity and therefore wide compatibility.

Access to these computers weren't limited to "spies who purchased them under a false identity, and smuggled them into the socialist bloc", western computers, radios/media players, instruments... were purchasable, and often officially, in the USSR. In the 70's, schools had computer classes that taught IBM technology, and ones that taught domestic computer technology. This cooperation was paused in 1979 during the Afghan war, and resumed in the 80's focused on the IBM PC.

There was a surprisingly abundant number of computer engineers back then who worked on developing microprocessors and microcontrollers. The hardware would be cloned, and later improved and modified for specific needs like the ability to work under extreme temperatures, or the introduction of other unusual hardware to communicate with those microprocessors/controllers.

Generally the hardware scene was not suffering in terms of being able to keep up with needs, it's the software that suffered. Homemade "moderate" OS's were built by the users, but MS-DOS was a very desired product back then. This made the 8086 clone (KR1810VM86) CPU a valuable item. Afterall, software is easier to import than hardware.

I think the Soviet computer scene gets a lot less credit than it deserves. Their clones were a very efficient way to incorporate computers into homes, schools, and job related needs like military, communications, and of course space, and with less evidence; hospitals and banking.

I own a working "-Sintez-" computer, made in the Signal factory, Moldovan SSR 1989. Some of them came with a KR1858VM1 (z80 clone) cpu, some with the German UA 880, but my father also installed a KR580VM80A (i8080A clone) and the computer is able to use both. The consumer tech was usually easily customizable, and hobbyists knew what they were doing (overclocking, installing disk drives, more ram).

A couple of interesting reads:

List of Soviet Microprocessors (Wikipedia)

Nomenclature for the CPU names (the long Kx000yy00 names, and what they mean)

Museum of Soviet digital tech (very impressive collection, almost everything I know I am able to find here, as well as specs and origin)

-Sintez- the computer I mentioned, but different colors

Answer 6

How were these chips made? Could they have possibly taken a Western chip and taken it apart somehow, to manually build a netlist, as was recently done to the 6502? Or was someone able to procure the masks from Zilog's and Sinclair's engineers?

Yes, yes and yes.

It's been a rather complex mixture of spying, buying and hard core reverse engineering. Also, there where, much like in the West, many different groups trying to push their design. Not only between the states (*1) but also within.

I do not have any reliable informations about Russia, but at least their Z80 was build with masks developed in East Germany. Which is good for us, as not only the people involved still can be interviewed, but most non technical issues are well documented and open by now. Often even available as books.

The start of the Z80 development included even a little game FEW engineers played with the MEE (Ministerium für Elektrotechnik und Elektronik). The initial order was rather clear: Build an 8080 clone. Just the engineers rather wanted to do the Z80. So the MfS HVA section A XIV, responsible for gathering information about electronic technologies was bombarded with a series of requests for 8080 information, reasoned by 'still unclear details and huge problems in decoding the chip' while at the same time internal reports toward the responsible secretary of state for electronics, Karl Nendel, did state that the Z80 was not more complex than the 8080 while at the same time more powerful and less hard to understand. So in the end (as always in realistic stories) the engineers did win and got the permission to clone the Z80 instead.

The cloning itself didn't use any sophisticated process, but microscopic photographies of genuine Zilog chips. Engineers did sit down for several weeks and described every connection and detail they could describe onto audio tape, which would be transcribed into computer readable lists, which again where made into netlists. These netlists where put into a first simulation system - also developed for the project - for validation.

In a next step the layout was made, much like the Z80, so major parts can be found at similar places, but differed in detail. This stage was a combination of hand made design - literally drawn on millimeter paper - and later digitalised into routing data. Now it was simulated again, found to be working and put into production.

Russian Z80 clones where not developed in Russia, but produced with masks delivered by East Germany.

The process of reverse engineering instead of line by line cloning while sticking to the official documentation also resulted in a notable difference that can be used to detect a U880 from a (pre 1992) Z80. On a Z80a one byte OUTI with a source address of FFFFh does affect the carry, while the manual describes it as unaffected. The U880 works as describes - now you know another Z80 coding trick :))

Oh, and the whole production wasn't exactly secret. About a dozen theses have been written by students of the universities of Dresden and Ilmenau who have taken part in the process.

---

Most of above knowledge is from various speeches and private talks to people involved. For the spying part, two readings can be suggested:

• Die Industriespionage der DDR: Die wissenschaftlich-technische Aufklärung der HVA, and
• General der Mikroelektronik: Autobiographie

Sorry, both are only available in German - and both should be taken with more than just a grain of salt, as they are written by the former spies/apparatchiks. Still, they reveal quite a lot about the inner workings of the ways the East did acquire technology.

---

Here is a nice Example of a US company reverse engineering a Zilog Z80 CTC. The East Germans might have worked much the same way.

---

*1 - For example, the GDR did select the Z8000 as 16-bit family, but when x86 machines became more and more successful, they had to import 8086 CPUs from the SU. At the time a switch to 286 systems was desirable, the SU could not come up with a reliable and fast enough version, so Karl Nendel, eventually the most important person at Ministerium für Elektrotechnik und Elektronik, did decide that Robotron had to develop their own 80286 clone. Making it the fifth CPU locally developed in East Germany, after 8008, Z80, 8048 and Z8000 - a microVAX implementation was the last one done before it ended.

Answer 7

1. The Soviet system was a system of administrative competition. What and how to copy, was decided during the interaction of groups of influence.
2. Personal factor mattered. The x86 and Zilog architectures did not have significant support in Moscow (where they loved PDP-11) and were copied out of need and a residual principle.
3. There were several ministries (prone to autarky within themselves, up to and including NIH syndrome) dealing with microprocessors and electronics in general.
4. 8080 and 8085 processors copied primarily in Kiev.

Answer 8

One method I'd been told about is the use of an electron microscope to scan the layers.

Another engineer told me around 1990 that he'd seen this being done. Sorry I can't elaborate more but there's text on the interweb.