542
6 Reverse Engineering of Microcircuits
annotations are connected to each other, so it is impossible to change any of these
elements without changing all three.
Now, the netlist and the scheme can be checked for presence for various violations (errors) according to other simple rules. For example, it is possible to perform
inspection for the presence of floating gates, shorted outputs, circuits without input
or output signals, and shorted circuits on power supply buses.
6.3.2.8 Electrical Circuit Analysis
This is one of the operations requiring maximum attention, since organization of the
scheme in the form of pages or according to a hierarchy goes a long way before
ultimately making the project a logically cohesive one. Devices (transistors, library
elements) that are poorly placed on a circuit or in a sophisticated hierarchy can be
the recovered design extremely difficult to understand. Therefore, this stage usually
requires participation of extremely experienced analysts.
Analysis phase can be very interactive and use many information sources. Fairly
complete technical data of devices is often publicly accessible. It can be presented as
marketing information, specifications, technical articles, or patents [9]. It can often
be useful for building the basic structure of the circuit, e.g., if block diagrams are
available. It can also help understand the internal structure of the circuit and even its
design.
Analysis can also be performed using typical chip design methods. The circuit can
be analyzed manually using the classical theory of transistor operation and the formal
logic theory. Topological structures are often recognizable, such as differential pairs,
bipolar devices for reference voltage blocks based on forbidden silicon area, etc. In
fact, ICworks can find these structures independently in the automatic mode. Sometimes, a certain hierarchy can also be observed in a circuit. If there is no hierarchy, it
is possible to create one using the classic bottom-to-top design method. After that, it
is possible to perform a detailed analysis of the functioning and dynamic parameters
with the help of modeling. As a rule, several verification methods are used at the
same time; it increases the authenticity of circuit reconstruction.
The end product of reverse engineering of a circuit can take up many forms. It can
be a complete set of hierarchy schemes. This set of schemes can be used to create
a hierarchy netlist. In order to make the report more complete, it is possible to add
modeling charts, timing clock charts, comprehensive overview of the analysis, and
circuit description equations.
Since professional RE companies analyze great numbers of quantities daily, they
can also prepare reports on their comparative analysis and analysis of global trends.
For example, such companies as Chipwork have been analyzing multiple CMOS
image sensors. Since circuit design and technology have been constantly developing,
they have been monitored and documented. Evolution can be demonstrated from the
point of view of the technological process or the circuit—it all depends on the desires
and financial capabilities of the customer.
6 Reverse Engineering of Microcircuits
annotations are connected to each other, so it is impossible to change any of these
elements without changing all three.
Now, the netlist and the scheme can be checked for presence for various violations (errors) according to other simple rules. For example, it is possible to perform
inspection for the presence of floating gates, shorted outputs, circuits without input
or output signals, and shorted circuits on power supply buses.
6.3.2.8 Electrical Circuit Analysis
This is one of the operations requiring maximum attention, since organization of the
scheme in the form of pages or according to a hierarchy goes a long way before
ultimately making the project a logically cohesive one. Devices (transistors, library
elements) that are poorly placed on a circuit or in a sophisticated hierarchy can be
the recovered design extremely difficult to understand. Therefore, this stage usually
requires participation of extremely experienced analysts.
Analysis phase can be very interactive and use many information sources. Fairly
complete technical data of devices is often publicly accessible. It can be presented as
marketing information, specifications, technical articles, or patents [9]. It can often
be useful for building the basic structure of the circuit, e.g., if block diagrams are
available. It can also help understand the internal structure of the circuit and even its
design.
Analysis can also be performed using typical chip design methods. The circuit can
be analyzed manually using the classical theory of transistor operation and the formal
logic theory. Topological structures are often recognizable, such as differential pairs,
bipolar devices for reference voltage blocks based on forbidden silicon area, etc. In
fact, ICworks can find these structures independently in the automatic mode. Sometimes, a certain hierarchy can also be observed in a circuit. If there is no hierarchy, it
is possible to create one using the classic bottom-to-top design method. After that, it
is possible to perform a detailed analysis of the functioning and dynamic parameters
with the help of modeling. As a rule, several verification methods are used at the
same time; it increases the authenticity of circuit reconstruction.
The end product of reverse engineering of a circuit can take up many forms. It can
be a complete set of hierarchy schemes. This set of schemes can be used to create
a hierarchy netlist. In order to make the report more complete, it is possible to add
modeling charts, timing clock charts, comprehensive overview of the analysis, and
circuit description equations.
Since professional RE companies analyze great numbers of quantities daily, they
can also prepare reports on their comparative analysis and analysis of global trends.
For example, such companies as Chipwork have been analyzing multiple CMOS
image sensors. Since circuit design and technology have been constantly developing,
they have been monitored and documented. Evolution can be demonstrated from the
point of view of the technological process or the circuit—it all depends on the desires
and financial capabilities of the customer.