I've been reverse-engineering the Intel 386 processor (from 1985), and I've come across some interesting circuits for the chip's input/output (I/O) pins. Since these pins communicate with the outside world, they face special dangers: static electricity and latchup can destroy the chip, while metastability can cause serious malfunctions. These I/O circuits are completely different from the logic circuits in the 386, and I've come across a previously-undescribed flip-flop circuit, so I'm venturing into uncharted territory. In this article, I take a close look at how the I/O circuitry protects the 386 from the "dragons" that can destroy it.

The photo above shows the die of the 386 under a microscope. The dark, complex patterns arranged in rectangular regions arise from the two layers of metal that connect the circuits on the 386 chip. Not visible are the transistors, formed from silicon and polysilicon and hidden beneath the metal. Around the perimeter of this fingernail-sized silicon die, 141 square bond pads provide the connections between the chip and the outside world; tiny gold bond wires connect the bond pads to the package. Next to each I/O pad, specialized circuitry provides the electrical interface between the chip and the external components while protecting the chip. I've zoomed in on three groups of these bond pads along with the associated I/O circuits. The circuits at the top (for data pins) and the left (for address pins) are completely different from the control pin circuits at the bottom, showing how the circuitry varies with the pin's function.

Static electricity

The first dragon that threatens the 386 is static electricity, able to burn a hole in the chip. MOS transistors are constructed with a thin insulating oxide layer underneath the transistor's gate. In the 386, this fragile, glass-like oxide layer is just 250 nm thick, the thickness of a virus. Static electricity, even a small amount, can blow a hole through this oxide layer and destroy the chip. If you've ever walked across a carpet and felt a spark when you touch a doorknob, you've generated at least 3000 volts of chip-destroying static electricity. Intel recommends an anti-static mat and a grounding wrist strap when installing a processor to avoid the danger of static electricity, also known as Electrostatic Discharge or ESD.1

To reduce the risk of ESD damage, chips have protection diodes and other components in their I/O circuitry. The schematic below shows the circuit for a typical 386 input. The goal is to prevent static discharge from reaching the inverter, where it could destroy the inverter's transistors. The diodes next to the pad provide the first layer of protection; they redirect excess voltage to the +5 rail or ground. Next, the resistor reduces the current that can reach the inverter. The third diode provides a final layer of protection. (One unusual feature of this input—unrelated to ESD—is that the input has a pull-up, which is implemented with a transistor that acts like a 20kΩ resistor.2)

The image below shows how this circuit appears on the die. For this photo, I dissolved the metal layers with acids, stripping the die down to the silicon to make the transistors visible. The diodes and pull-up resistor are implemented with transistors.3 Large grids of transistors form the pad-side diodes, while the third diode is above. The current-limiting protection resistor is implemented with polysilicon, which provides higher resistance than metal wiring. The capacitor is implemented with a plate of polysilicon over silicon, separated by a thin oxide layer. As you can see, the protection circuitry occupies much more area than the inverters that process the signal.

Latchup

The transistors in the 386 are created by doping silicon with impurities to change its properties, creating regions of "N-type" and "P-type" silicon. The 386 chip, like most processors, is built from CMOS technology, so it uses two types of transistors: NMOS and PMOS. The 386 starts from a wafer of N-type silicon and PMOS transistors are formed by doping tiny regions to form P-type silicon embedded in the underlying N-type silicon. NMOS transistors are the opposite, with N-type silicon embedded in P-type silicon. To hold the NMOS transistors, "wells" of P-type silicon are formed, as shown in the cross-section diagram below. Thus, the 386 chip contains complex patterns of P-type and N-type silicon that form its 285,000 transistors.

But something dangerous lurks below the surface, the fire-breathing dragon of latchup waiting to burn up the chip. The problem is that these regions of N-type and P-type silicon form unwanted, "parasitic" transistors underneath the desired transistors. In normal circumstances, these parasitic NPN and PNP transistors are inactive and can be ignored. But if a current flows beneath the surface, through the silicon substrate, it can turn on a parasitic transistor and awaken the dreaded latchup.4 The parasitic transistors form a feedback loop, so if one transistor starts to turn on, it turns on the other transistor, and so forth, until both transistors are fully on, a state called latchup.5 Moreover, the feedback loop will maintain latchup until the chip's power is removed.6 During latchup, the chip's power and ground are shorted through the parasitic transistors, causing high current flow that can destroy the chip by overheating it or even melting bond wires.

Latchup can be triggered in many ways, from power supply overvoltage to radiation, but a chip's I/O pins are the primary risk because signals from the outside world are unpredictable. For instance, suppose a floppy drive is connected to the 386 and the drive sends a signal with a voltage higher than the 386's 5-volt supply. (This could happen due to a voltage surge in the drive, reflection in a signal line, or even connecting a cable.) Current will flow through the 386's protection diodes, the diodes that were described in the previous section.7 If this current flows through the chip's silicon substrate, it can trigger latchup and destroy the processor.

Because of this danger, the 386's I/O pads are designed to prevent latchup. One solution is to block the unwanted currents through the substrate, essentially putting fences around the transistors to keep malicious currents from escaping into the substrate. In the 386, this fence consists of "guard rings" around the I/O transistors and diodes. These rings prevent latchup by blocking unwanted current flow and safely redirecting it to power or ground.

The diagram above shows the double guard rings for a typical I/O pad.8 Separate guard rings protect the NMOS transistors and the PMOS transistors. The NMOS transistors have an inner guard ring of P-type silicon connected to ground (blue) and an outer guard ring of N-type silicon connected to +5 (red). The rings are reversed for the PMOS transistors. The guard rings take up significant space on the die, but this space isn't wasted since the rings protect the chip from latchup.

Metastability

The final dragon is metastability: it (probably) won't destroy the chip, but it can cause serious malfunctions.9 Metastability is a peculiar problem where a digital signal can take an unbounded amount of time to settle into a zero or a one. In other words, the circuit temporarily refuses to act digitally and shows its underlying analog nature.10 Metastability was controversial in the 1960s and the 1970s, with many electrical engineers not believing it existed or considering it irrelevant. Nowadays, metastability is well understood, with special circuits to prevent it, but metastability can never be completely eliminated.

In a processor, everything is synchronized to its clock. While a modern processor has a clock speed of several gigahertz, the 386's clock ran at 12 to 33 megahertz. Inside the processor, signals are carefully organized to change according to the clock—that's why your computer runs faster with a higher clock speed. The problem is that external signals may be independent of the CPU's clock. For instance, a disk drive could send an interrupt to the computer when data is ready, which depends on the timing of the spinning disk. If this interrupt arrives at just the wrong time, it can trigger metastability.

In more detail, processors use flip-flops to hold signals under the control of the clock. An "edge-triggered" flip-flop grabs its input at the moment the clock goes high (the "rising edge") and holds this value until the next clock cycle. Everything is fine if the value is stable when the clock changes: if the input signal switches from low to high before the clock edge, the flip-flop will hold this high value. And if the input signal switches from low to high after the clock edge, the flip-flop will hold the low value, since the input was low at the clock edge. But what happens if the input changes from low to high at the exact time that the clock switches? Usually, the flip-flop will pick either low or high. But very rarely, maybe a few times out of a billion, the flip-flop will hesitate in between, neither low nor high. The flip-flop may take a few nanoseconds before it "decides" on a low or high value, and the value will be intermediate until then.

The photo above illustrates a metastable signal, spending an unpredictable time between zero and one before settling on a value. The situation is similar to a ball balanced on top of a hill, a point of unstable equilibrium.11 The smallest perturbation will knock the ball down one of the two stable positions at the bottom of the hill, but you don't know which way it will go or how long it will take.

Metastability is serious because if a digital signal has a value that is neither 0 nor 1 then downstream circuitry may get confused. For instance, if part of the processor thinks that it received an interrupt and other parts of the processor think that no interrupt happened, chaos will reign as the processor takes contradictory actions. Moreover, waiting a few nanoseconds isn't a cure because the duration of metastability can be arbitrarily long. Waiting helps, since the chance of metastability decreases exponentially with time, but there is no guarantee.12

The obvious solution is to never change an input exactly when the clock changes. The processor is designed so that internal signals are stable when the clock changes, avoiding metastability. Specifically, the designer of a flip-flop specifies the setup time—how long the signal must be stable before the clock edge—and the hold time—how long the signal must be stable after the clock edge. As long as the input satisfies these conditions, typically a few picoseconds long, the flip-flop will function without metastability.

Unfortunately, the setup and hold times can't be guaranteed when the processor receives an external signal that isn't synchronized to its clock, known as an asynchronous signal. For instance, a processor receives interrupt signals when an I/O device has data, but the timing is unpredictable because it depends on mechanical factors such as a keypress or a spinning floppy disk. Most of the time, everything will work fine, but what about the one-in-a-billion case where the timing of the signal is unlucky? (Since modern processors run at multi-gigahertz, one-in-a-billion events are not rare; they can happen multiple times per second.)

One solution is a circuit called a synchronizer that takes an asynchronous signal and synchronizes it to the clock. A synchronizer can be implemented with two flip-flops in series: even if the first flip-flop has a metastable output, chances are that it will resolve to 0 or 1 before the second flip-flop stores the value. Each flip-flop provides an exponential reduction in the chance of metastability, so using two flip-flops drastically reduces the risk. In other words, the circuit will still fail occasionally, but if the mean time between failures (MTBF) is long enough (say, decades instead of seconds), then the risk is acceptable.

The schematic above shows how the 386 uses two flip-flops to minimize metastability. The first flip-flop is a special flip-flop that is based on a sense amplifier. It is much more complicated than a regular flip-flop, but it responds faster, reducing the chance of metastability. It is built from two of the sense-amplifier latches below, which I haven't seen described anywhere. In a DRAM memory chip, a sense amplifier takes a weak signal from a memory cell and rapidly amplifies it into a solid 0 or 1. In this flip-flop, the sense amplifier takes a potentially ambiguous signal and rapidly amplifies it into a 0 or 1. By amplifying the signal quickly, the flip-flop reduces metastability. (See the footnote for details.14)

The die photo below shows how this circuitry looks on the die. Each flip-flop is built from two latches; note that the sense-amp latches are larger than the standard latches. As before, the pad has protection diodes inside guard rings. For some reason, however, these diodes have a different structure from the transistor-based diodes described earlier. The 386 has five inputs that use this circuitry to protect against metastability.13 These inputs are all located together at the bottom of the die—it probably makes the layout more compact when neighboring pad circuits are all the same size.

In summary, the 386's I/O circuits are interesting because they are completely different from the chip's regular logic circuitry. In these circuits, the border between digital and analog breaks down; these circuits handle binary signals, but analog issues dominate the design. Moreover, hidden parasitic transistors play key roles; what you don't see can be more important than what you see. These circuits defend against three dangerous "dragons": static electricity, latchup, and metastability. Intel succeeded in warding off these dragons and the 386 was a success.

For more on the 386 and other chips, follow me on Mastodon (@kenshirriff@oldbytes.space), Bluesky (@righto.com), or RSS. (I've given up on Twitter.) If you want to read more about 386 input circuits, I wrote about the clock pin here

Notes and references

Have you ever wanted to reverse engineer an analog chip from a die photo? Wanted to understand what's inside the "black box" of an integrated circuit? In this article, I explain my reverse engineering process, using the Philips TDA7000 FM radio receiver chip as an example. This chip was the first FM radio receiver on a chip.1 It was designed in 1977—an era of large transistors and a single layer of metal—so it is much easier to examine than modern chips. Nonetheless, the TDA7000 is a non-trivial chip with over 100 transistors. It includes common analog circuits such as differential amplifiers and current mirrors, along with more obscure circuits such as Gilbert cell mixers.

The die photo above shows the silicon die of the TDA7000; I've labeled the main functional blocks and some interesting components. Arranged around the border of the chip are 18 bond pads: the pads are connected by thin gold bond wires to the pins of the integrated circuit package. In this chip, the silicon appears greenish, with slightly different colors—gray, pink, and yellow-green—where the silicon has been "doped" with impurities to change its properties. Carefully examining the doping patterns will reveal the transistors, resistors, and other microscopic components that make up the chip.

The most visible part of the die is the metal wiring, the speckled white lines that connect the silicon structures. The metal layer is separated from the silicon underneath by an insulating oxide layer, allowing metal lines to pass over other circuitry without problem. Where a metal wire connects to the underlying silicon, a small white square is visible; this square is a hole in the oxide layer, allowing the metal to contact the silicon.

This chip has a single layer of metal, so it is much easier to examine than modern chips with a dozen or more layers of metal. However, the single layer of metal made it much more difficult for the designers to route the wiring while avoiding crossing wires. In the die photo above, you can see how the wiring meanders around the circuitry in the middle, going the long way since the direct route is blocked. Later, I'll discuss some of the tricks that the designers used to make the layout successful.

NPN transistors

Transistors are the key components in a chip, acting as switches, amplifiers, and other active devices. While modern integrated circuits are fabricated from MOS transistors, earlier chips such as the TDA7000 were constructed from bipolar transistors: NPN and PNP transistors. The photo below shows an NPN transistor in the TDA7000 as it appears on the chip. The different shades are regions of silicon that have been doped with various impurities, forming N and P regions with different electrical properties. The white lines are the metal wiring connected to the transistor's collector (C), emitter (E), and base (B). Below the die photo, the cross-section diagram shows how the transistor is constructed. The region underneath the emitter forms the N-P-N sandwich that defines the NPN transistor.

The parts of an NPN transistor can be identified by their appearance. The emitter is a compact spot, surrounded by the gray silicon of the base region. The collector is larger and separated from the emitter and base, sometimes separated by a significant distance. The colors may appear different in other chips, but the physical structures are similar. Note that although the base is in the middle conceptually, it is often not in the middle of the physical layout.

The transistor is surrounded by a yellowish-green border of P+ silicon; this border is an important part of the structure because it isolates the transistor from neighboring transistors.2 The isolation border is helpful for reverse-engineering because it indicates the boundaries between transistors.

PNP transistors

You might expect PNP transistors to be similar to NPN transistors, just swapping the roles of N and P silicon. But for a variety of reasons, PNP transistors have an entirely different construction. They consist of a circular emitter (P), surrounded by a ring-shaped base (N), which is surrounded by the collector (P). This forms a P-N-P sandwich horizontally (laterally), unlike the vertical structure of an NPN transistor. In most chips, distinguishing NPN and PNP transistors is straightforward because NPN transistors are rectangular while PNP transistors are circular.

The diagram above shows one of the PNP transistors in the TDA7000. As with the NPN transistor, the emitter is a compact spot. The collector consists of gray P-type silicon; in contrast, the base of an NPN transistor consists of gray P-type silicon. Moreover, unlike the NPN transistor, the base contact of the PNP transistor is at a distance, while the collector contact is closer. (This is because most of the silicon inside the isolation boundary is N-type silicon. In a PNP transistor, this region is connected to the base, while in an NPN transistor, this region is connected to the collector.)

It turns out that PNP transistors have poorer performance than NPN transistors for semiconductor reasons3, so most analog circuits use NPN transistors except when PNP transistors are necessary. For instance, the TDA7000 has over 100 NPN transistors but just nine PNP transistors. Accordingly, I'll focus my discussion on NPN transistors.

Resistors

Resistors are a key component of analog chips. The photo below shows a zig-zagging resistor in the TDA7000, formed from gray P-type silicon. The resistance is proportional to the length,4 so large-valued resistors snake back and forth to fit into the available space. The two red arrows indicate the contacts between the ends of the resistor and the metal wiring. Note the isolation region around the resistor, the yellowish border. Without this isolation, two resistors (formed of P-silicon) embedded in N-silicon could form an unintentional PNP transistor.

Unfortunately, resistors in ICs are very inaccurate; the resistances can vary by 50% from chip to chip. As a result, analog circuits are typically designed to depend on the ratio of resistor values, which is fairly constant within a chip. Moreover, high-value resistors are inconveniently large. We'll see below some techniques to reduce the need for large resistances.

Capacitors

Capacitors are another important component in analog circuits. The capacitor below is a "junction capacitor", which uses a very large reverse-biased diode as a capacitor. The pink "fingers" are N-doped regions, embedded in the gray P-doped silicon. The fingers form a "comb capacitor"; this layout maximizes the perimeter area and thus increases the capacitance. To produce the reverse bias, the N-silicon fingers are connected to the positive voltage supply through the upper metal strip. The P silicon is connected to the circuit through the lower metal strip.

How does a diode junction form a capacitor? When a diode is reverse-biased, the contact region between N and P silicon becomes "depleted", forming a thin insulating region between the two conductive silicon regions. Since an insulator between two conducting surfaces forms a capacitor, the diode acts as a capacitor. One problem with a diode capacitor is that the capacitance varies with the voltage because the thickness of the depletion region changes with voltage. But as we'll see later, the TDA7000's tuning circuit turns this disadvantage into a feature.

Other chips often create a capacitor with a plate of metal over silicon, separated by a thin layer of oxide or other dielectric. However, the manufacturing process for bipolar chips generally doesn't provide thin oxide, so junction capacitors are a common alternative.5 On-chip capacitors take up a lot of space and have relatively small capacitance, so IC designers try to avoid capacitors. The TDA7000 has seven on-chip capacitors but most of the capacitors in this design are larger, external capacitors: the chip uses 12 of its 18 pins just to connect external capacitors to the necessary points in the internal circuitry.

Important analog circuits

A few circuits are very common in analog chips. In this section, I'll explain some of these circuits, but first, I'll give a highly simplified explanation of an NPN transistor, the minimum you should know for reverse engineering. (PNP transistors are similar, except the polarities of the voltages and currents are reversed. Since PNP transistors are rare in the TDA7000, I won't go into details.)

In a transistor, the base controls the current between the collector and the emitter, allowing the transistor to operate as a switch or an amplifier. Specifically, if a small current flows from the base of an NPN transistor to the emitter, a much larger current can flow from the collector to the emitter, larger, perhaps, by a factor of 100.6 To get a current to flow, the base must be about 0.6 volts higher than the emitter. As the base voltage continues to increase, the base-emitter current increases exponentially, causing the collector-emitter current to increase. (Normally, a resistor will ensure that the base doesn't get much more than 0.6V above the emitter, so the currents stay reasonable.)

NPN transistor circuits have some general characteristics. When there is no base current, the transistor is off: the collector is high and the emitter is low. When the transistor turns on, the current through the transistor pulls the collector voltage lower and the emitter voltage higher. Thus, in a rough sense, the emitter is the non-inverting output and the collector is the inverting output.

The complete behavior of transistors is much more complicated. The nice thing about reverse engineering is that I can assume that the circuit works: the designers needed to consider factors such as the Early effect, capacitance, and beta, but I can ignore them.

Emitter follower

One of the simplest transistor circuits is the emitter follower. In this circuit, the emitter voltage follows the base voltage, staying about 0.6 volts below the base. (The 0.6 volt drop is also called a "diode drop" because the base-emitter junction acts like a diode.)

This behavior can be explained by a feedback loop. If the emitter voltage is too high, the current from the base to the emitter drops, so the current through the collector drops due to the transistor's amplification. Less current through the resistor reduces the voltage across the resistor (from Ohm's Law), so the emitter voltage goes down. Conversely, if the emitter voltage is too low, the base-emitter current increases, increasing the collector current. This increases the voltage across the resistor, and the emitter voltage goes up. Thus, the emitter voltage adjusts until the circuit is stable; at this point, the emitter is 0.6 volts below the base.

You might wonder why an emitter follower is useful. Although the output voltage is lower, the transistor can supply a much higher current. That is, the emitter follower amplifies a weak input current into a stronger output current. Moreover, the circuitry on the input side is isolated from the circuitry on the output side, preventing distortion or feedback.

Current mirror

Most analog chips make extensive use of a circuit called a current mirror. The idea is you start with one known current, and then you can "clone" multiple copies of the current with a simple transistor circuit, the current mirror.

In the following circuit, a current mirror is implemented with two identical PNP transistors. A reference current passes through the transistor on the right. (In this case, the current is set by the resistor.) Since both transistors have the same emitter voltage and base voltage, they source the same current, so the current on the left matches the reference current (more or less).7

A common use of a current mirror is to replace resistors. As mentioned earlier, resistors inside ICs are inconveniently large. It saves space to use a current mirror instead of multiple resistors whenever possible. Moreover, the current mirror is relatively insensitive to the voltages on the different branches, unlike resistors. Finally, by changing the size of the transistors (or using multiple collectors of different sizes), a current mirror can provide different currents.

The TDA7000 doesn't use current mirrors as much as I'd expect, but it has a few. The die photo above shows one of its current mirrors, constructed from PNP transistors with their distinctive round appearance. Two important features will help you recognize a current mirror. First, one transistor has its base and collector connected; this is the transistor that controls the current. In the photo, the transistor on the right has this connection. Second, the bases of the two transistors are connected. This isn't obvious above because the connection is through the silicon, rather than in the metal. The trick is that these PNP transistors are inside the same isolation region. If you look at the earlier cross-section of a PNP transistor, the whole N-silicon region is connected to the base. Thus, two PNP transistors in the same isolation region have their bases invisibly linked, even though there is just one base contact from the metal layer.

Current sources and sinks

Analog circuits frequently need a constant current. A straightforward approach is to use a resistor; if a constant voltage is applied, the resistor will produce a constant current. One disadvantage is that circuits can cause the voltage to vary, generating unwanted current fluctuations. Moreover, to produce a small current (and minimize power consumption), the resistor may need to be inconveniently large. Instead, chips often use a simple circuit to control the current: this circuit is called a "current sink" if the current flows into it and a "current source" if the current flows out of it.

Many chips use a current mirror as a current source or sink instead. However, the TDA7000 uses a different approach: a transistor, a resistor, and a reference voltage.8 The transistor acts like an emitter follower, causing a fixed voltage across the resistor. By Ohm's Law, this yields a fixed current. Thus, the circuit sinks a fixed current, controlled by the reference voltage and the size of the resistor. By using a low reference voltage, the resistor can be kept small.

Differential pair amplifier

If you see two transistors with the emitters connected, chances are that it is a differential amplifier: the most common two-transistor subcircuit used in analog ICs.9 The idea of a differential amplifier is that it takes the difference of two inputs and amplifies the result. The differential amplifier is the basis of the operational amplifier (op amp), the comparator, and other circuits. The TDA7000 uses multiple differential pairs for amplification. For filtering, the TDA7000 uses op-amps, formed from differential amplifiers.10

The schematic below shows a simple differential pair. The current sink at the bottom provides a fixed current I, which is split between the two input transistors. If the input voltages are equal, the current will be split equally into the two branches (I1 and I2). But if one of the input voltages is a bit higher than the other, the corresponding transistor will conduct more current, so that branch gets more current and the other branch gets less. The resistors in each branch convert the current to a voltage; either side can provide the output. A small difference in the input voltages results in a large output voltage, providing the amplification. (Alternatively, both sides can be used as a differential output, which can be fed into a second differential amplifier stage to provide more amplification. Note that the two branches have opposite polarity: when one goes up, the other goes down.)

The diagram below shows the locations of differential amps, voltage references, mixers, and current mirrors. As you can see, these circuits are extensively used in the TDA7000.

Tips on tracing out circuitry

Over the years, I've found various techniques helpful for tracing out the circuitry in an IC. In this section, I'll describe some of those techniques.

First, take a look at the datasheet if available. In the case of the TDA7000, the datasheet and application note provide a detailed block diagram and a description of the functionality.21 Sometimes datasheets include a schematic of the chip, but don't be too trusting: datasheet schematics are often simplified. Moreover, different manufacturers may use wildly different implementations for the same part number. Patents can also be helpful, but they may be significantly different from the product.

Mapping the pinout in the datasheet to the pads on the die will make reverse engineering much easier. The power and ground pads are usually distinctive, with thick traces that go to all parts of the chip, as shown in the photo below. Once you have identified the power and ground pads, you can assign the other pads in sequence from the datasheet. Make sure that these pad assignments make sense. For instance, the TDA7000 datasheet shows special circuitry between pads 5 and 6 and between pads 13 and 14; the corresponding tuning diodes and RF transistors are visible on the die. In most chips, you can distinguish output pins by the large driver transistors next to the pad, but this turns out not to help with the TDA7000. Finally, note that chips sometimes have test pads that don't show up in the datasheet. For instance, the TDA7000 has a test pad, shown below; you can tell that it is a test pad because it doesn't have a bond wire.

Once I've determined the power and ground pads, I trace out all the power and ground connections on the die. This makes it much easier to understand the circuits and also avoids the annoyance of following a highly-used signal around the chip only to discover that it is simply ground. Note that NPN transistors will have many collectors connected to power and emitters connected to ground, perhaps through resistors. If you find the opposite situation, you probably have power and ground reversed.

For a small chip, a sheet of paper works fine for sketching out the transistors and their connections. But with a larger chip, I find that more structure is necessary to avoid getting mixed up in a maze of twisty little wires, all alike. My solution is to number each component and color each wire as I trace it out, as shown below. I use the program KiCad to draw the schematic, using the same transistor numbering. (The big advantage of KiCad over paper is that I can move circuits around to get a nicer layout.)

It works better to trace out the circuitry one area at a time, rather than chasing signals all over the chip. Chips are usually designed with locality, so try to avoid following signals for long distances until you've finished up one block. A transistor circuit normally needs to be connected to power (if you follow the collectors) and ground (if you follow the emitters).11 Completing the circuit between power and ground is more likely to give you a useful functional block than randomly tracing out a chain of transistors. (In other words, follow the bases last.)

Finally, I find that a circuit simulator such as LTspice is handy when trying to understand the behavior of mysterious transistor circuits. I'll often whip up a simulation of a small sub-circuit if its behavior is unclear.

How FM radio and the TDA7000 work

Before I explain how the TDA7000 chip works, I'll give some background on FM (Frequency Modulation). Suppose you're listening to a rock song on 97.3 FM. The number means that the radio station is transmitting at a carrier frequency of 97.3 megahertz. The signal, perhaps a Beyoncé song, is encoded by slightly varying the frequency, increasing the frequency when the signal is positive and decreasing the frequency when the signal is negative. The diagram below illustrates frequency modulation; the input signal (red) modulates the output. Keep in mind that the modulation is highly exaggerated in the diagram; the modulation would be invisible in an accurate diagram since a radio broadcast changes the frequency by at most ±75 kHz, less than 0.1% of the carrier frequency.

FM radio's historical competitor is AM (Amplitude Modulation), which varies the height of the signal (the amplitude) rather than the frequency.12 One advantage of FM is that it is more resistant to noise than AM; an event such as lightning will interfere with the signal amplitude but will not change the frequency. Moreover, FM radio provides stereo, while AM radio is mono, but this is due to the implementation of radio stations, not a fundamental characteristic of FM versus AM. (The TDA7000 chip doesn't implement stereo.13) Due to various factors, FM stations require more bandwidth than AM, so FM stations are spaced 200 kHz apart while AM stations are just 10 kHz apart.

An FM receiver such as the TDA7000 must demodulate the radio signal to recover the transmitted audio, converting the changing frequency into a changing signal level. FM is more difficult to demodulate than AM, which can literally be done with a piece of rock: lead sulfide in a crystal detector. There are several ways to implement an FM demodulator; this chip uses a technique called a quadrature detector. The key to a quadrature detector is a circuit that shifts the phase, with the amount of phase shift depending on the frequency. The detector shifts the signal by approximately 90º, multiplies it by the original signal, and then smooths it out with a low-pass filter. If you do this with a sine wave and a 90º phase shift, the result turns out to be 0. But since the phase shift depends on the frequency, a higher frequency gets shifted by more than 90º while a lower frequency gets shifted by less than 90º. The final result turns out to be approximately linear with the frequency, positive for higher frequencies and negative for lower frequencies. Thus, the FM signal is converted into the desired audio signal.

Like most radios, the TDA7000 uses a technique called superheterodyning that was invented around 1917. The problem is that FM radio stations use frequencies from 88.0 MHz to 108.0 MHz. These frequencies are too high to conveniently handle on a chip. Moreover, it is difficult to design a system that can process a wide range of frequencies. The solution is to shift the desired radio station's signal to a frequency that is fixed and much lower. This frequency is called the intermediate frequency. Although FM radios commonly use an intermediate frequency of 10.7 MHz, this was still too high for the TDA7000, so the designers used an intermediate frequency of just 70 kilohertz. This frequency shift is accomplished through superheterodyning.

For example, suppose you want to listen to the radio station at 97.3 MHz. When you tune to this station, you are actually tuning the local oscillator to a frequency that is 70 kHz lower, 97.23 MHz in this case. The local oscillator signal and the radio signal are mixed by multiplying them. If you multiply two sine waves, you get one sine wave at the difference of the frequencies and another sine wave at the sum of the frequencies. In this case, the two signals are at 70 kHz and 194.53 MHz. A low-pass filter (the IF filter) discards everything above 70 kHz, leaving just the desired radio station, now at a fixed and conveniently low frequency. The rest of the radio can then be optimized to work at 70 kHz.

The Gilbert cell multiplier

But how do you multiply two signals? This is accomplished with a circuit called a Gilbert cell.14 This circuit takes two differential inputs, multiplies them, and produces a differential output. The Gilbert cell is a bit tricky to understand,15 but you can think of it as a stack of differential amplifiers, with the current directed along one of four paths, depending on which transistors turn on. For instance, if the A and B inputs are both positive, current will flow through the leftmost transistor, labeled "pos×pos". Likewise, if the A and B inputs are both negative, current flows through the rightmost transistor, labeled "neg×neg". The outputs from both transistors are connected, so both cases produce a positive output. Conversely, if one input is positive and the other is negative, current flows through one of the middle transistors, producing a negative output. Since the multiplier handles all four cases of positive and negative inputs, it is called a "four-quadrant" multiplier.

Although the Gilbert cell is an uncommon circuit in general, the TDA7000 uses it in multiple places. The first mixer implements the superheterodyning. A second mixer provides the FM demodulation, multiplying signals in the quadrature detector described earlier. The TDA7000 also uses a mixer for its correlator, which determines if the chip is tuned to a station or not.16 Finally, a Gilbert cell switches the audio off when the radio is not properly tuned. On the die, the Gilbert cell has a nice symmetry that reflects the schematic.

The voltage-controlled oscillator

One of the trickiest parts of the TDA7000 design is how it manages to use an intermediate frequency of just 70 kilohertz. The problem is that broadcast FM has a "modulation frequency deviation" of 75 kHz, which means that the broadcast frequency varies by up to ±75 kHz. The mixer shifts the broadcast frequency down to 70 kHz, but the shifted frequency will vary by the same amount as the received signal. How can you have a 70 kilohertz signal that varies by 75 kilohertz? What happens when the frequency goes negative?

The solution is that the local oscillator frequency (i.e., the frequency that the radio is tuned to) is continuously modified to track the variation in the broadcast frequency. Specifically, a change in the received frequency causes the local oscillator frequency to change, but only by 80% as much. For instance, if the received frequency decreases by 5 hertz, the local oscillator frequency is decreased by 4 hertz. Recall that the intermediate frequency is the difference between the two frequencies, generated by the mixer, so the intermediate frequency will decrease by just 1 hertz, not 5 hertz. The result is that as the broadcast frequency changes by ±75 kHz, the local oscillator frequency changes by just ±15 kHz, so it never goes negative.

How does the radio constantly adjust the frequency? The fundamental idea of FM is that the frequency shift corresponds to the output audio signal. Since the output signal tracks the frequency change, the output signal can be used to modify the local oscillator's frequency, using a voltage-controlled oscillator.17 Specifically, the circuit uses special "varicap" diodes that vary their capacitance based on the voltage that is applied. As described earlier, the thickness of a diode's "depletion region" depends on the voltage applied, so the diode's capacitance will vary with voltage. It's not a great capacitor, but it is good enough to adjust the frequency.

The image above shows how these diodes appear on the die. The diodes are relatively large and located between two bond pads. The two diodes have interdigitated "fingers"; this increases the capacitance as described earlier with the "comb capacitor". The slightly grayish "background" region is the P-type silicon, with a silicon control line extending to the right. (Changing the voltage on this line changes the capacitance.) Regions of N-type silicon are underneath the metal fingers, forming the PN junctions of the diodes.

Keep in mind that most of the radio tuning is performed with a variable capacitor that is external to the chip and adjusts the frequency from 88 MHz to 108 MHz. The capacitance of the diodes provides the much smaller adjustment of ±60 kHz. Thus, the diodes only need to provide a small capacitance shift.

The VCO and diodes will also adjust the frequency to lock onto the station if the tuning is off by a moderate amount, say, 100 kHz. However, if the tuning is off by a large amount, say, 200 kHz, the FM detector has a "sideband" and the VCO can erroneously lock onto this sideband. This is a problem because the sideband is weak and nonlinear so reception will be bad and will have harmonic distortion. To avoid this problem, the correlator will detect that the tuning is too far off (i.e. the local oscillator is way off from 70 kHz) and will replace the audio with white noise. Thus, the user will realize that they aren't on the station and adjust the tuning, rather than listening to distorted audio and blaming the radio.

Noise source

Where does the radio get the noise signal to replace distorted audio? The noise is generated from the circuit below, which uses the thermal noise from diodes, amplified by a differential amplifier. Specifically, each side of the differential amplifier is connected to two transistors that are wired as diodes (using the base-emitter junction). Random thermal fluctuations in the transistors will produce small voltage changes on either side of the amplifier. The amplifier boosts these fluctuations, creating the white noise output.

Layout tricks and unusual transistors

Because this chip has just one layer of metal, the designers had to go to considerable effort to connect all the components without wires crossing. One common technique to make routing easier is to separate a transistor's emitter, collector, and base, allowing wires to pass over the transistor. The transistor below is an example. Note that the collector, base, and emitter have been stretched apart, allowing one wire to pass between the collector and the base, while two more pass between the base and the emitter. Moreover, the transistor layout is flexible: this one has the base in the middle, while many others have the emitter in the middle. (Putting the collector in the middle won't work since the base needs to be next to the emitter.)

The die photo below illustrates a few more routing tricks. This photo shows one collector, three emitters, and four bases, but there are three transistors. How does that work? First, these three transistors are in the same isolation region, so they share the same "tub" of N-silicon. If you look back at the cross-section of an NPN transistor, you'll see that this tub is connected to the collector contact. Thus, all three transistors share the same collector.18 Next, the two bases on the left are connected to the same gray P-silicon. Thus, the two base contacts are connected and function as a single base. In other words, this is a trick to connect the two base wires together through the silicon, passing under the four other metal wires in the way. Finally, the two transistors on the right have the emitter and base slightly separated so a wire can pass between them. When reverse-engineering a chip, be on the lookout for unusual transistor layouts such as these.

When all else failed, the designers could use a "cross-under" to let a wire pass under other wires. The cross-under is essentially a resistor with a relatively low resistance, formed from N-type silicon (pink in the die photo below). Because silicon has much higher resistance than metal, cross-unders are avoided unless necessary. I see just two cross-unders in the TDA7000.

The circuit that caused me the most difficulty is the noise generator below. The transistor highlighted in red below looks straightforward: a resistor is connected to the collector, which is connected to the base. However, the transistor turned out to be completely different: the collector (red arrow) is on the other side of the circuit and this collector is shared with five other transistors. The structure that I thought was the collector is simply the contact at the end of the resistor, connected to the base.

Conclusions

The TDA7000 almost didn't become a product. It was invented in 1977 by two engineers at the Philips research labs in the Netherlands. Although Philips was an innovative consumer electronics company in the 1970s, the Philips radio group wasn't interested in an FM radio chip. However, a rogue factory manager built a few radios with the chips and sent them to Japanese companies. The Japanese companies loved the chip and ordered a million of them, convincing Philips to sell the chips.

The TDA7000 became a product in 1983—six years after its creation—and reportedly more than 5 billion have now been sold.19 Among other things, the chip allowed an FM radio to be built into a wristwatch, with the headphone serving as an antenna. Since the TDA7000 vastly simplified the construction of a radio, the chip was also popular with electronics hobbyists. Hobbyist magazines provided plans and the chip could be obtained from Radio Shack.20

Why reverse engineer a chip such as the TDA7000? In this case, I was answering some questions for the IEEE microchips exhibit, but even when reverse engineering isn't particularly useful, I enjoy discovering the logic behind the mysterious patterns on the die. Moreover, the TDA7000 is a nice chip for reverse engineering because it has large features that are easy to follow, but it also has many different circuits. Since the chip has over 100 transistors, you might want to start with a simpler chip, but the TDA7000 is a good exercise if you want to increase your reverse-engineering skills. If you want to check your results, my schematic of the TDA7000 is here; I don't guarantee 100% accuracy :-) In any case, I hope you have enjoyed this look at reverse engineering.

Follow me on Bluesky (@righto.com), Mastodon (@kenshirriff@oldbytes.space), or RSS. (I've given up on Twitter.) Thanks to Daniel Mitchell for asking me about the TDA7000 and providing the die photo; be sure to check out the IEEE Chip Hall of Fame's TDA7000 article.

Notes and references

In the 1950s, many fighter planes used the Bendix Central Air Data Computer (CADC) to compute airspeed, Mach number, and other "air data". The CADC is an analog computer, using tiny gears and specially-machined cams for its mathematics. In this article, part 4 of my series,1 I reverse engineer the Mach section of the CADC and explain its calculations. (In the photo below, the Mach section is the middle section of the CADC.)

Aircraft have determined airspeed from air pressure for over a century. A port in the side of the plane provides the static air pressure,2 the air pressure outside the aircraft. A pitot tube points forward and receives the "total" air pressure, a higher pressure due to the air forced into the tube by the speed of the airplane. The airspeed can be determined from the ratio of these two pressures, while the altitude can be determined from the static pressure.

But as you approach the speed of sound, the fluid dynamics of air change and the calculations become very complicated. With the development of supersonic fighter planes in the 1950s, simple mechanical instruments were no longer sufficient. Instead, an analog computer calculated the "air data" (airspeed, air density, Mach number, and so forth) from the pressure measurements. This computer then transmitted the air data electrically to the systems that needed it: instruments, weapons targeting, engine control, and so forth. Since the computer was centralized, the system was called a Central Air Data Computer or CADC, manufactured by Bendix and other companies.

Each value in the Bendix CADC is indicated by the rotational position of a shaft. Compact electric motors rotate the shafts, controlled by the pressure inputs. Gears, cams, and differentials perform computations, with the results indicated by more rotations. Devices called synchros converted the rotations to electrical outputs that are connected to other aircraft systems. The CADC is said to contain 46 synchros, 511 gears, 820 ball bearings, and a total of 2,781 major parts (but I haven't counted). These components are crammed into a compact cylinder: just 15 inches long and weighing 28.7 pounds.

The equations computed by the CADC are impressively complicated. For instance, one equation is:

\[~~~\frac{P_t}{P_s} = \frac{166.9215M^7}{( 7M^2-1)^{2.5}}\]

It seems incredible that these functions could be computed mechanically, but three techniques make this possible. The fundamental mechanism is the differential gear, which adds or subtracts values. Second, logarithms are used extensively, so multiplications and divisions are implemented by additions and subtractions performed by a differential, while square roots are calculated by gearing down by a factor of 2. Finally, specially-shaped cams implement functions: logarithm, exponential, and application-specific functions. By combining these mechanisms, complicated functions can be computed mechanically, as I will explain below.

The differential

The differential gear assembly is the mathematical component of the CADC, as it performs addition or subtraction.3 The differential takes two input rotations and produces an output rotation that is the sum or difference of these rotations.4 Since most values in the CADC are expressed logarithmically, the differential computes multiplication and division when it adds or subtracts its inputs.

While the differential functions like the differential in a car, it is constructed differently, with a spur-gear design. This compact arrangement of gears is about 1 cm thick and 3 cm in diameter. The differential is mounted on a shaft along with three co-axial gears: two gears provide the inputs to the differential and the third provides the output. In the photo, the gears above and below the differential are the input gears. The entire differential body rotates with the sum, connected to the output gear at the top through a concentric shaft. (In practice, any of the three gears can be used as the output.) The two thick gears inside the differential body are part of the mechanism.

The cams

The CADC uses cams to implement various functions. Most importantly, cams compute logarithms and exponentials. Cams also implement complicated functions of one variable such as ${M}/{\sqrt{1 + .2 M^2}}$. The function is encoded into the cam's shape during manufacturing, so a hard-to-compute nonlinear function isn't a problem for the CADC. The photo below shows a cam with the follower arm in front. As the cam rotates, the follower moves in and out according to the cam's radius.

However, the shape of the cam doesn't provide the function directly, as you might expect. The main problem with the straightforward approach is the discontinuity when the cam wraps around. For example, if the cam implemented an exponential directly, its radius would spiral exponentially and there would be a jump back to the starting value when it wraps around. Instead, the CADC uses a clever patented method: the cam encodes the difference between the desired function and a straight line. For example, an exponential curve is shown below (blue), with a line (red) between the endpoints. The height of the gray segment, the difference, specifies the radius of the cam (added to the cam's fixed minimum radius). The point is that this difference goes to 0 at the extremes, so the cam will no longer have a discontinuity when it wraps around. Moreover, this technique significantly reduces the size of the value (i.e. the height of the gray region is smaller than the height of the blue line), increasing the cam's accuracy.5

To make this work, the cam position must be added to the linear value to yield the result. This is implemented by combining each cam with a differential gear; watch for the paired cams and differentials below. As the diagram below shows, the input (23) drives the cam (30) and the differential (25, 37-41). The follower (32) tracks the cam and provides a second input (35) to the differential. The sum from the differential produces the desired function (26).

The synchro outputs

A synchro is an interesting device that can transmit a rotational position electrically over three wires. In appearance, a synchro is similar to an electric motor, but its internal construction is different, as shown below. Before digital systems, synchros were very popular for transmitting signals electrically through an aircraft. For instance, a synchro could transmit an altitude reading to a cockpit display or a targeting system. Two synchros at different locations have their stator windings connected together, while the rotor windings are driven with AC. Rotating the shaft of one synchro causes the other to rotate to the same position.6

For the CADC, most of the outputs are synchro signals, using compact synchros that are about 3 cm in length. For improved resolution, many of the CADC outputs use two synchros: a coarse synchro and a fine synchro. The two synchros are typically geared in an 11:1 ratio, so the fine synchro rotates 11 times as fast as the coarse synchro. Over the output range, the coarse synchro may turn 180°, providing the approximate output unambiguously, while the fine synchro spins multiple times to provide more accuracy.

Examining the Mach section of the CADC

The Bendix CADC is constructed from modular sections. In this blog post, I'm focusing on the middle section, called the "Mach section" and indicated by the arrow above. This section computes log static pressure, impact pressure, pressure ratio, and Mach number and provides these outputs electrically as synchro signals. It also provides the log pressure ratio and log static pressure to the rest of the CADC as shaft rotations. The left section of the CADC computes values related to airspeed, air density, and temperature.7 The right section has the pressure sensors (the black domes), along with the servo mechanisms that control them.

I had feared that any attempt at disassembly would result in tiny gears flying in every direction, but the CADC was designed to be taken apart for maintenance. Thus, I could remove the left section of the CADC for analysis. Unfortunately, we lost the gear alignment between the sections and don't have the calibration instructions, so the CADC no longer produces accurate results.

The diagram below shows the internal components of the Mach section after disassembly. The synchros are in pairs to generate coarse and fine outputs; the coarse synchros can be distinguished because they have spiral anti-backlash springs installed. These springs prevent wobble in the synchro and gear train as the gears change direction. The gears and differentials are not visible from this angle as they are underneath the metal plate. The Pressure Error Correction (PEC) subsystem has a motor to drive the shaft and a control transformer for feedback. The Mach section has two D-sub connectors. The one on the right links the Mach section and pressure section to the front section of the CADC. The Position Error Correction (PEC) servo amplifier board plugs into the left connector. The static pressure and total pressure input lines have fittings so the lines can be disconnected from the lines from the front of the CADC.8

The photo below shows the left section of the CADC. This section meshes with the Mach section shown above. The two sections have parts at various heights, so they join in a complicated way. Two gears receive the pressure signals \( log ~ P_t / P_s \) and \( log ~ P_s \) from the Mach section. The third gear sends the log total temperature to the rest of the CADC. The electrical connector (a standard 37-pin D-sub) supplies 120 V 400 Hz power to the Mach section and pressure transducers and passes synchro signals to the output connectors.

The position error correction servo loop

The CADC receives two pressure inputs and two pressure transducers convert the pressures into rotational positions, providing the indicated static pressure \( P_{si} \) and the total pressure \( P_t \) as shaft rotations to the rest of the CADC. (I explained the pressure transducers in detail in the previous article.)

There's one complication though. The static pressure \( P_s \) is the atmospheric pressure outside the aircraft. The problem is that the static pressure measurement is perturbed by the airflow around the aircraft, so the measured pressure (called the indicated static pressure \( P_{si} \)) doesn't match the real pressure. This is bad because a "static-pressure error manifests itself as errors in indicated airspeed, altitude, and Mach number to the pilot."9

The solution is a correction factor called the Position Error Correction. This factor gives the ratio between the real pressure \( P_s \) and the measured pressure \( P_{si} \). By applying this correction factor to the indicated (i.e. measured) pressure, the true pressure can be obtained. Since this correction factor depends on the shape of the aircraft, it is generated outside the CADC by a separate cylindrical unit called the Compensator, customized to the aircraft type. The position error computation depends on two parameters: the Mach number provided by the CADC and the angle of attack provided by an aircraft sensor. The compensator determines the correction factor by using a three-dimensional cam. The vintage photo below shows the components inside the compensator.

The correction factor is transmitted from the compensator to the CADC as a synchro signal over three wires. To use this value, the CADC must convert the synchro signal to a shaft rotation. The CADC uses a motorized servo loop that rotates the shaft until the shaft position matches the angle specified by the synchro input.

The key to the servo loop is a control transformer. This device looks like a synchro and has five wires like a synchro, but its function is different. Like the synchro motor, the control transformer has three stator wires that provide the angle input. Unlike the synchro, the control transformer also uses the shaft position as an input, while the rotor winding generates an output voltage indicating the error. This output voltage indicates the error between the control transformer's shaft position and the three-wire angle input. The control transformer provides its error signal as a 400 Hz sine wave, with a larger signal indicating more error.10

The amplifier board (below) drives the motor in the appropriate direction to cancel out the error. The power transformer in the upper left is the largest component, powering the amplifier board from the CADC's 115-volt, 400 Hertz aviation power. Below it are two transformer-like components; these are the magnetic amplifiers. The relay in the lower-right corner switches the amplifier into test mode. The rest of the circuitry consists of transistors, resistors, capacitors, and diodes. The construction is completely different from modern printed circuit boards. Instead, the amplifier uses point-to-point wiring between plastic-insulated metal pegs. Both sides of the board have components, with connections between the sides through the metal pegs.

The amplifier board is implemented with a transistor amplifier driving two magnetic amplifiers, which control the motor.11 (Magnetic amplifiers are an old technology that can amplify AC signals, allowing the relatively weak transistor output to control a larger AC output.12) The motor is a "Motor / Tachometer Generator" unit that also generates a voltage based on the motor's speed. This speed signal provides negative feedback, limiting the motor speed as the error becomes smaller and ensuring that the feedback loop doesn't overshoot. The photo below shows how the amplifier board is mounted in the middle of the CADC, behind the static pressure tubing.

The equations

Although the CADC looks like an inscrutable conglomeration of tiny gears, it is possible to trace out the gearing and see exactly how it computes the air data functions. With considerable effort, I have reverse-engineered the mechanisms to create the diagram below, showing how each computation is broken down into mechanical steps. Each line indicates a particular value, specified by a shaft rotation. The ⊕ symbol indicates a differential gear, adding or subtracting its inputs to produce another value. The cam symbol indicates a cam coupled to a differential gear. Each cam computes either a specific function or an exponential, providing the value as a rotation. At the right, the outputs are either shaft rotations to the rest of the CADC or synchro outputs.

I'll go through each calculation briefly.

log static pressure

The static pressure is calculated by dividing the indicated static pressure by the pressure error correction factor. Since these values are all represented logarithmically, the division turns into a subtraction, performed by a differential gear. The output goes to two synchros, geared to provide coarse and fine outputs.13

\[log ~ P_s = log ~ P_{si} - log ~ P_{si} / P_s \]

Impact pressure

The impact pressure is the pressure due to the aircraft's speed, the difference between the total pressure and the static pressure. To compute the impact pressure, the log pressure values are first converted to linear values by exponentiation, performed by cams. The linear pressure values are then subtracted by a differential gear. Finally, the impact pressure is output through two synchros, coarse and fine in an 11:1 ratio.

\[ P_t - P_s = exp(log ~ P_t) - exp(log ~ P_s) \]

log pressure ratio

The log pressure ratio \( P_t/P_s \) is the ratio of total pressure to static pressure. This value is important because it is used to compute the Mach number, true airspeed, and log free air temperature. The Mach number is computed in the Mach section as described below. The true airspeed and log free air temperature are computed in the left section. The left section receives the log pressure ratio as a rotation. Since the left section and Mach section can be separated for maintenance, a direct shaft connection is not used. Instead, each section has a gear and the gears mesh when the sections are joined.

Computing the log pressure ratio is straightforward. Since the log total pressure and log static pressure are both available, subtracting the logs with a differential yields the desired value. That is,

\[log ~ P_t/P_s = log ~ P_t - log ~ P_s \]

Mach number

The Mach number is defined in terms of \(P_t/P_s \), with separate cases for subsonic and supersonic:14

\[M<1:\] \[~~~\frac{P_t}{P_s} = ( 1+.2M^2)^{3.5}\]

\[M > 1:\]

\[~~~\frac{P_t}{P_s} = \frac{166.9215M^7}{( 7M^2-1)^{2.5}}\]

Although these equations are very complicated, the solution is a function of one variable \(P_t/P_s\) so M can be computed with a single cam. In other words, the mathematics needed to be done when the CADC was manufactured, but once the cam exists, computing M is easy, using the log pressure ratio computed earlier:

\[ M = f(log ~ P_t / P_s) \]

Conclusions

The CADC performs nonlinear calculations that seem way too complicated to solve with mechanical gearing. But reverse-engineering the mechanism shows how the equations are broken down into steps that can be performed with cams and differentials, using logarithms for multiplication and division. The diagram below shows the complex gearing in the Mach section. Each differential below corresponds to a differential in the earlier equation diagram.

Follow me on Twitter @kenshirriff or RSS for more reverse engineering. I'm also on Mastodon as @oldbytes.space@kenshirriff. Thanks to Joe for providing the CADC. Thanks to Nancy Chen for obtaining a hard-to-find document for me.15 Marc Verdiell and Eric Schlaepfer are working on the CADC with me. CuriousMarc's video shows the CADC in action:

Notes and references