Reverse Engineering - Netlist Extraction

Last month I discussed the process where we can de-process a chip, photographing each layer as we went along. Then the photographs are combined into a single image. Then the transistors and interconnect are extracted. This process produces a spice level netlist at the transistor level.

A transistor level netlist is a correct implementation of the circuit, but is not in a useful format. What we need is a Verilog netlist at the gate and flop-flop level, and with embedded analog blocks and digital memories. How we get there is the topic of this article.

Digital Standard Cells

Most newer circuits are implemented using standard cells. The software package we use has a built-in pattern recognition. We create a library of identified cells, and it uses that library to extract a netlist. This works reasonably well, and while it does produce an occasional error, those are usually easily identified and fixed.

Digital Hand Packed

Older chips frequently used manually created layouts. In these layouts, the transistor shapes were modified to fit in the available spaces. This results in circuits where no two gates were alike. And that kills the pattern recognition that we used on the standard cells.

We also have cases in modern circuits where later revisions have additional circuitry crammed into the layout using hand-packed techniques. And since pattern recognition doesn’t work here, we must use an alternative approach.

Extracting Gates

That approach is to extract gates directly from the transistor level netlist. This is an iterative process.

The first step is to identify cases where P transistors touch N transistors. These are the netlist nodes, with all other nodes being internal to gates.

The next step is to extract those transistors who are part of transmission gates. These are identified by finding pairs of P and N transistors who share common diffusions, but have different gates. These are then removed from the list of unidentified transistors.

Then we build a gate, where a gate is defined as a collection of transistors that connect a node with either supply. This step produces a netlist containing the basic inverters, NAND, NOR, and complex gates.

Extracting Flops and Higher Level Gates

While we now have a Verilog netlist, it does not contain flops, latches muxes, exclusive-or, and similar higher level functions. To get these, the netlist must be processed again. But this time, we look for patterns of logic gates. A 2-input NAND gate that only drives a OR-AND-Invert gate can be replaced by an exclusive-or gate.

Error Checking

Now that we have a netlist, we have to check for errors in it. Most errors are opens that resulted from errors in imaging. These can be located with Verilog netlist checking tools. And once identified, they can be corrected by examining the original database to see what node the open wire should be connected to. We also occasionally see nodes shorted to supplies, though those nodes are easily visible in a graphical analysis and are usually corrected much earlier in the conversion process.

The Next Step

Once we have a netlist, then the next step is to do logic simulations to ensure that the design will work in our modern libraries, and does not contain any race conditions. And it must be combined with any analog circuitry that may be present. But that is a topic for another article.