NEC V20 Microcode Is Being Extracted From the Silicon Die for a Cycle-Accurate Emulator

Developer GloriousCow extracts the physical microcode ROM directly from photographs of the NEC V20 processor silicon die using computer vision and CNNs to achieve cycle-accurate emulation.

A fascinating reverse-engineering project is digging beneath software and instruction sets into the physical silicon of the NEC V20 processor in an attempt to build an exceptionally accurate emulator. Hackaday highlighted the work on 9 September, detailing the effort to extract the processor's microcode ROM from a photograph of the actual chip die. The NEC V20 was designed as an Intel 8088-compatible processor and appeared in numerous PC-compatible computers during the 1980s. Reproducing its documented instructions is relatively straightforward compared with reproducing exactly how long every internal operation takes and how the processor behaves in unusual edge cases. For a genuinely cycle-accurate emulator, developer GloriousCow wants access to the V20's real microcode. That means reading information physically encoded into the silicon itself. The ROM region visible in the die image contains 29,928 individual bits. In theory a determined human could inspect every one manually, but doing so would be extremely tedious and vulnerable to errors. Travis Goodspeed's MaskRomTool was able to identify the locations of the individual cells, but contrast in the available image was not reliable enough for completely automatic determination of every bit value. The solution combines computer vision with human verification. Individual ROM cells were extracted as tiny images, producing a large dataset representing the physical bit structures. Roughly one thousand examples were manually classified and then used to train a convolutional neural network to distinguish the two possible states. Results that remained ambiguous could subsequently be checked manually rather than forcing a person to classify almost thirty thousand cells from scratch. Once reconstructed, the microcode can be studied alongside the known architecture of the processor and incorporated into emulator research. The project is a striking illustration of how retro-computing preservation has changed. Early emulator authors frequently worked from manuals, experimentation and undocumented behaviour observed while running software. Today's researchers can photograph semiconductor dies, identify microscopic ROM structures and use machine-learning techniques to reconstruct logic that manufacturers never expected end users to see. The NEC V20 is especially interesting because compatible processors were part of the competitive PC ecosystem that grew around Intel's x86 architecture. Understanding precisely how its microcode differs from Intel's equivalent chips offers historical as well as practical value. The emulator is not finished merely because the ROM bits have been identified; deciphering what the microinstructions actually do remains substantial work. Nevertheless, recovering firmware directly from the silicon provides researchers with evidence that cannot be lost through disappearing documentation or ageing development archives. In a very literal sense, this preservation project is reading computing history straight off the chip.