A Journey Into Capcom's CPS2 Silicon - Part 2

Welcome to the second post in the Capcom CPS-2 reverse engineering series, if you missed the previous post you can find it here:

• Part 1

Inside the custom chips of CPS2

Capcom's Play System 2, also known as CPS2, was a new arcade platform introduced in 1993 and a firm call on bootlegging. Featuring similar but improved specs to its predecessor CPS1, the system introduced a new security architecture that gave Capcom for the first time a piracy-free platform. A fact that remained true for its main commercial lifespan and that even prevented projects like Mame from gaining proper emulation of the system for years.


Chip Makers

Capcom's extensive use of customs in CPS2 spreads over a total 11 QFP type chips, as part of this project each of the chips were decapped and identified as follows:

A board (Base board)

DL-0311: Ricoh A5C series, standard cells. (Also found in CPS1) Datasheet
DL-0921: Ricoh A5C series, standard cells. (Also found in CPS1) Datasheet
DL-1123: Hitachi HG62F series model 22, gate array. Datasheet
DL-1425: AT&T Digital Signal Processor WEDSP16A-M14. (Also found in CPS1.5) Datasheet
DL-1625: VLSI Technology (VTI) VGT300 series model 022, gate array. Datasheet
DL-2227: Hitachi HG62E series model 08, gate array. Datasheet

CPS2 A Board 93646A-3 Custom chips highlighted

B board (Top board)

DL-1525: Motorola H4C series model 057, gate array in combination with a 68000 cpu megacell (CPM68K REV7-89). Datasheet
DL-1727: Fujitsu CG24 series model 692, gate array. *
DL-1827: Fujitsu CG24 series model 692, gate array. *
DL-1927: Fujitsu CG24 series model 512, gate array. *
DL-2027: Fujitsu CG24 series model 512, gate array. *

* No datasheet available for the Fujitsu CG24 series, please share any.

CPS2 B Board 93646B-6 Custom chips highlighted

Gate Array technology

Used in most CPS2 custom chips, a gate array circuit is a prefabricated silicon chip circuit with no defined functionality, in which transistors, standard NAND or NOR logic gates, are placed following a regular pattern and manufactured on a wafer, this half baked wafer is known as master slice.

Common advantages of Gate Arrays designs over Full-Customs according to TU Delft:

Minimization of the fabrication time: Because the chips are prefabricated (the transistors are already on the master image), the silicon foundry only processes the masks related to metal wires. As compared to full custom layout, the number of masks processed by the silicon foundry is often reduced by more than 60%.

Minimization of the design time: The time involved in designing a cell layout is reduced dramatically (as compared to full-custom) because the transistors are pre placed on the image. Typically, it takes only a few minutes to layout a flipflop or a combinatorial gate, and the designer does not need to know much about the process design rules.

Minimization of the chip cost: The layout design starts with a prefabricated master image. This is a semi-manufactured article that can be produced in large quantities. Consequently, it can be cheap.

Gate Array die size and development time compassion versus other chip design technologies

The Fujitsu gate array chips featured in CPS2's B board belong to the CG24 series and use a 0.8 micron CMOS process. Fujitsu uses a block-level placement and routing scheme commonly known as "fishbone".

Markings inside CPS2 Gate Array chip DL-2027

Unwired section of NAND sea-of-gates inside a Fujitsu CG24 chip

Logic inverter (NOT) implemented in Fujitsu's NAND sea-of-gates

Fujitsu's gate array technology is discussed in more detail in 1978 USPTO patent 4,412,237: https://docs.google.com/viewer?url=patentimages.storage.googleapis.com/pdfs/US4412237.pdf


Capcom's deep pockets

Interestingly enough, several of the B board's chips used by Capcom show a very low utilization of resources being the worst offender chip DL-2027. In IC density terms its contents could be classified as mostly empty space. 

Given the expensive nature of the end to end design and fabrication of these devices one must think that perhaps Capcom's market successes enabled the company not to spare in resources.

Highlighted in yellow: total die area utilization inside DL-2027 

The Mysterious CPU

Contrary to popular belief, Capcom's CPS-2 cpu does not reside on the A bottom board of the system, instead the cpu is found on the B board and inside the big 208 pin QFP chip labeled as DL-1525. MAME's own documentation on CPS-2 does not help this belief either as it also states the system cpu is DL-1625, an A board chip.

Capcom DL-1525 dated 1993 week 51 source id JSX02RJ524AU03

DL-1525 hosts inside a massive die measuring around 7x7mm in size featuring a majestic Motorola 68000 megacell core surrounded by a vast 3-layer gate array. This monster IC is based on the Motorola H4C gate array series and uses a gate length of 0.7 microns (700 nanometers). To date it is the smallest feature sized chip I have worked on since I began reverse engineering ICs.

DL-1525 is a Motorola H4C057 class gate array in combination with a 68k cpu core (top right)

Small section of DL-1525 captured at 50x magnification. Three routing metal layers are visible.

Cross-section view of a Motorola H4C gate array describing its composition

DL-1525 Ancestry

A newsletter from Dataquest from May 1988 traces back the origins of Motorola's blending of 68000 cores with gate arrays to the world of laser printers. An extract of such IC industry newsletter reads as follows: 

Motorola is designing gate-array-based interface chips for use in laser printers. The chips will contain a core of the 68000 microprocessor and the dedicated laser printer functions. The LPC-1 will have 5,000 gates and will be fabricated with a 2-micron CMOS technology, while the ALPC-1 will have 16,000 gates and will be the first commercial application of Motorola's HDC series of 1-micron CMOS channelless architecture gate arrays. The LPC-1 is currently available in sample quantities; samples of the ALPC-1 will be available in December, with volume production scheduled for February 1989.

In fact, additional research shows chips with similar source identification marks to Capcom's DL-1525 have been in use in commercial laser printers such as models A258/A259/A260 made by Ricoh. The following parts catalog mentions at least two relevant ICs listed as follows:

 JSC05RR519AU15   208QFP // RICOH IPU BOARD A259 5146 / A260 5146
 JSC05SV519AY17   240QFP // Ricoh main control board A258 5090

Another close brother to DL-1525 is Motorola's own MC68302 "Integrated Multiprotocol Processor" chip. This IC employs a similar gate array and embedding of a 68k cpu core inside. More details about it can be found in the following document and product manual.

MC68302 internals description found in "Image Processing For Future High Energy Physics Detectors"

Other chips from Motorola are known to exist with even closer source id numbers to Capcom's DL-1525, their purpose or end product usage are unknown: 

 JSX02RJ514AU17   208QFP // H4C057-68K 
 JSX02RJ524AU03   208QFP // Capcom CPS2 DL-1525
 JSX05PR511AW26  144QFP
 JSX05PR511AW27  No info
 JSX38PG511AJ03   No info


DL-1525 in the wild

Another interesting finding regarding DL-1525 was the availability of chip stock in Alibaba.com marketplace, during March of 2017 and to test the listing veracity I was able to successfully purchase brand new stock of JSX02RJ524AU03 from a Chinese reseller. At the time of writing of this blog post such stock seems to be still listed on sale online. This chip doesn't seem to be the only Capcom device being sold in the wild, other chip codes are available to purchase online. 

I guess this is of no commercial relevance to Capcom anymore, but overall it doesn't show great asset control practices.

Two NOS units of Capcom's DL-1525 chip sourced from China, chips dated 1998 week 24

This is all for now, I hope you have enjoyed Part 2 of the CPS2 reverse engineering series. On the next post we will explore how and where Capcom hided its CPS2 security implementation. Stay tuned.

Part 3

Capcpom CPS1 - Part 2

Welcome to the second post in the Capcom CPS1 reverse engineering series, you can find Part 1 right here.

The roots of CPS1

Everything we know has an origin and predecessors, Capcom's arcade platform CP System 1 is no exception to the rule.

For many years arcade manufacturers battled for market share in release cycles that saw games burning out of distribution in just a few months. This intense competition demanded manufacturers faster releases and better games in a never ending market race.

According to an interview by LCSM to Kouichi "Isuke" Yotsui, father of Capcom's hit title "Strider", the Capcom Play System (CPS1) was originally developed with the need to bring better and bigger graphics into new games.

Isuke: "PCBs back then did not hold an abundant amount of data for graphics. The CPS was developed to free ourselves from that."

Isuke circa 2011. Source: Striderpedia

With full 16 bits capabilities, plenty of hardware sprites, tiles and graphic layers, CPS1 extended game asset and code storage capacity beyond its lifetime needs. The largest CPS1 B board known allowed for 8.39 megabytes of graphics, 3.15 megabytes of cpu code, and 0.39 megabytes of audio code and samples. No game ever released on CPS1 used the full rom capacity found in the system, although CPS 1.5 systems expanded the audio storage capabilities via a new dedicated q sound board.

CPS1 B Board rom sections

The availability of the new system sparked the production at Capcom of a new generation of games developed almost in parallel. The three initial titles under development consisted in Daimakaimura (Ghouls'n Ghosts), Forgotten Worlds, and Strider, in that order respectively. In the end Forgotten Worlds made it first to market and got to be the first official CPS1 release title.

The Chocolate Factory. Capcom's production line, circa 1992. credit: Super Power magazine

But how did CPS1 and its specs came to be? An early 1990s interview extract from the french magazine "Super Power" seems to confirm the prevalent expert arcade community opinion: CPS1 base specs came straight from a computer commercially unknown to the western world: Sharp's X68000 a.k.a. the god computer.

Isuke: “I have participated to the development of the CP system and yes absolutely, the X68000 is the base of the CP system." (Thanks to Denis Lechevalier for the interview extract and photos)

Capcom offices. Circa 1992. credit: Super Power magazine

X68000: The God Computer

In March of 1987 Sharp released the X68000 home computer to the Japanese market, a multimedia computer so strong and powerful it had no immediate rivals. The new system wasn't even matched by the highly awarded Commodore Amiga 500 released six months later.

Sharp X68000

The X68000 featured full 16 bits capabilities thanks to its Motorola 68k cpu running at 10Mhz, came with 1 megabyte of memory upgradable to 12 megabytes, advanced sound and high resolution hardware graphics with a 65k color palette, a device better than any arcade game platform at the time. Full specs.

Personally whenever I try compare the X68000 with the humble specs of my first computer back then, the Amstrad CPC 6128, I really feel the X68000 earned its "god computer" nickname well. Indeed a device sent from the future.

With the introduction of the X68000 Sharp leapfrogged the market in such a way it remained the most capable gaming platform until the early 1990s. Even today the X68000 with its distinct double tower design is still undeniably appealing in terms of aesthetics. PS4 anyone?

With a whopping price tag of 369,000 Japanese Yens, $2,434 USD in 1987 money or more than $5000 USD in today's money, Sharp sold millions of units in the Japanese market until its final update in 1993. The reasons as to why Sharp didn't release this system outside of Japan are unknown to me, please contribute any information by commenting below.

According to what is known, Capcom used the X68000 as a benchmark for its CPS1 hardware design and also as game development workstation. Capcom wasn't the only arcade game design company known to have used the X68000 for the production of videogames, for example Toaplan used it to develop games like Outzone, Truxton, and all of their 68000 based releases.

Capcom's sound and music design team at work. X68000 compact workstation. Super Power magazine.

Thanks to its involvement in content and game creation and its strong market share, the X68000 enjoyed plenty of pixel perfect arcade ports. Titles such as Final Fight or Daimakaimura (Ghouls'n Ghosts) were released on the X68000 and are still in high demand by todays collectors. Ironically, putting your hands today on a copy of Final Fight for the X68000 will cost you twice as much as the original arcade game board.

Although commonly referred as a pixel perfect port, ports like Final Fight aren't exactly perfect. For example Final Fight for the X68000 will only display a maximum of four concurrent enemies on screen where as the arcade version will do as many as nine. This is due to CPS1 being more capable in terms of hardware sprites: 256 vs 128.

The Chocolate Factory Suppliers

Now we know how Capcom got its base specs for the development of CPS1. How about hardware suppliers?

Many companies contributed to the making and supply of CPS1 parts, although one particular company contributed the most significant number of them. Hitachi, the Japanese multinational, was the most notable supplier with multiple parts including TTL chips, memories, and the main system CPU.

Capcom's CPS1 featured the CMOS version of the Motorola 68000 CPU running at 10Mhz (later upgraded to 12Mhz). The CPU introduced in 1985 was a joint development of Motorola and Hitachi after a long term relationship between the companies.

This special relationship was recently discussed in an interview with Bill Walker, a now retired SVP at Motorola:

"Our manufacturing practices were pretty bad back then, low yields, long cycle times and poor productivity. In 1978, Motorola and Hitachi entered into a technology exchange venture. We brought a lot back and injected it into our manufacturing and it helped greatly, especially when we built our newest factory in the early eighties. That became the factory that built most of the 68K products – a new 5 inch factory, MOS-8."

The original CPS1 main cpu: Hitachi Motorola 68000 2-micron CMOS process

Other significant parts found inside CPS1 boards are the secondary cpu dedicated to running the sound program, a standard Z80 type cpu by Zilog running at a speed of 3.5Mhz, or multiple rom chips sourced from a variety of vendors such as Intel, AMD, Hitachi or Sharp.


The Graphic Customs

One of the most intriguing questions we had at the time of starting the reverse engineering effort on CPS1 was identifying who developed the two mysterious customs found on the A and C boards. None of them showed any identifiable manufacturer marks or logos besides the CAPCOM mark and production id numbers.

CPS1 custom chips, B custom on the left, A on the right.

In our mind the most probable vendor responsible for these customs could had been Hitachi, not only we knew it to be a high contributor to CPS1 parts, but also at the time of the making of CPS1 Hitachi had a good number of popular custom ASIC products in the market.

Uncovering the custom secrets and helping the arcade community overcome the popular CPS1 security issues led us to begin the reverse engineering efforts on these customs. Once digshadow got his hands on the CPS1 parts I sent him the wait to understand who was behind the customs came to an end. At his lab and with the aid of a powerful metallurgical microscope the truth got revealed: the vendor of choosing for the CPS1 custom parts was Ricoh.

Partial photo of CPS-1 custom B-21 under the microscope, credit: digshadow

This finding went against all our bets, but research revealed Ricoh was in the business of producing a range of CMOS based products including memory products and gate array or standard cell based custom chips. According to specifications found in Ricoh's 1988 product databook, both custom chips found in CPS1 belong to the RSC-15 CMOS standard cell series made with a 1.5 micron process.

[Update May/13th 2015] Thanks to everyone who pointed out Ricoh is the company behind the original Nintendo NES cpu, a variant of the popular 6502 cpu. More on this here.

Thanks to this integration effort Capcom introduced plenty of new graphic hardware functions packaged inside these customs, and managed to substantially reduce overall pcb complexity by eliminating legacy parts used in previous designs.

With them also came a number of security measures that have been a nightmare to today's arcade collectors and a barrier to fully preserve a good number of arcade titles in the CPS1 series.

This is all for now, I hope you have enjoyed Part 2 of the CPS1 reverse engineering series. On the next post we will explore custom B-21 in detail and discuss how the custom chip got dissected and analyzed. Stay tuned.

Update: Part 3 now available