Using an FPGA to recreate a discontinued IC

[Legion]

If you have an old IC that is no longer manufactured, how practical would it be to emulate it with an FPGA? Is it possible to do without a schematic of the IC's internals?

Reason I ask is I saw this article about a guy who's made a high end NES clone. To ensure maximum compatibility he harvested the PPUs and CPUs from old consoles.

Since the supply of those chips will only go down, it'd be useful to have an FPGA equivalent.

Article here: http://arstechnica.com/gaming/2014/05/building-a-perfect-no-compromises-aftermarket-nes-for-500/
Product site here: http://analogueinteractive.com/

[Excavatoree]

I really shouldn't reply to this, as I know nothing about the subject at all.  I'll simply add that there's a Youtube video in which Jeri Elsworth uses an FPGA to re-create an IC for a pinball machine she was repairing.  It may offer some insight.

[Legion]

I really shouldn't reply to this, as I know nothing about the subject at all.  I'll simply add that there's a Youtube video in which Jeri Elsworth uses an FPGA to re-create an IC for a pinball machine she was repairing.  It may offer some insight.

Cool, got a link?

[Excavatoree]

Naturally, she had a datasheet.  I'll still post the link, as it is an interesting video.

[Legion]

Naturally, she had a datasheet.  I'll still post the link, as it is an interesting video.

Thanks. I hadn't heard of her before. Looks like she has some cool videos to check out.

[digsys]

In many cases I've just used an MPU to replace old / obsolete ICs. A LOT lower power, easier and cheaper to set-up.
The silabs stuff eg can do up to 12-15 mips real, and have heaps of A/D, D/A, timers, counters, etc etc, all for $2-3
If you're good with assembler, you can get quite high speeds if required.

[Legion]

In many cases I've just used an MPU to replace old / obsolete ICs. A LOT lower power, easier and cheaper to set-up.
The silabs stuff eg can do up to 12-15 mips real, and have heaps of A/D, D/A, timers, counters, etc etc, all for $2-3
If you're good with assembler, you can get quite high speeds if required.

But how do you reverse engineer the old IC without a datasheet or schematic?

[Khashoggi]

This guy implemented an entire Apple II chipset into a FPGA project.

http://www.cs.columbia.edu/~sedwards/apple2fpga/

[Khashoggi]

In many cases I've just used an MPU to replace old / obsolete ICs. A LOT lower power, easier and cheaper to set-up.
The silabs stuff eg can do up to 12-15 mips real, and have heaps of A/D, D/A, timers, counters, etc etc, all for $2-3
If you're good with assembler, you can get quite high speeds if required.

But how do you reverse engineer the old IC without a datasheet or schematic?

Nothing's impossible, but if it is a complex chip it would require resources well beyond the hobbyist.

Otherwise, if it is simple you have to reverse engineer it by testing the input/output characteristics and attempt to approximate it.

[nitro2k01]

How you would reverse engineer a certain IC depends on what is known about it. Relatively much is and was known about the NES CPU from the get-go. The CPU core is a second-sourced version of MOS Technologies' (a.k.a. Commodore's) 6502 core, with the BCD portion blocked out to prevent a patent intrusion, so you get that for free. The custom parts are the video and audio. These were described in programmers manuals, which may have been leaked. One big advantage here is that you can run your own code on the CPU, so you can hypothesize about, and test corner-cases about the various IO functionality. You can also use the game library for testing. If you want to get really serious about it, you can input all digital IO pins into to your own FPGA and xor it with the internal representation of the same pins and trigger on any difference.

Let's say you don't have this kind of prior knowledge, though. Then your first path of attack will probably be to reverse engineer the peripheral circuitry. Sometimes this can be done by logic induction, for example if the chip under reverser engineering is connected to a memory chip or other chip with a known pinout. Then you may for example hook up a logic analyzer to it to try to make sense of the signals. Then you work from there. One interesting example of this, though not made specifically for cloning the ting, is Natashenka's reverse engineering of tamagotchis, which turned out to use a 6502 clone as well, Sunplus branded.



If all else fails, you resort to nitric acid, a scanning electron microscope and and probing needles. This is what Chris Tarnovsky is doing. Again, the focus here is not to replicate the function of a chip, but it tells you a lot about the reverse engineering process. Another option at this stage is to image the chip layer by layer and simulate it to figure out something about it, or perhaps resynthesize the internal circuit for an FPGA.

[Legion]

Apparently someone else is already building an FPGA replacement for the PPU.

http://www.universalppu.com/

[Holograph]

Apparently someone else is already building an FPGA replacement for the PPU.

http://www.universalppu.com/

See also http://etim.net.au/nesrgb/

[amyk]

The NES PPU/CPU is well known, it's been reverse-engineered down to the mask level: http://www.qmtpro.com/~nes/chipimages/

There's some analog circuitry in there so an FPGA might not be ideal.

Also don't forget that tons of NES clones have existed for decades, and production is unlikely to cease anytime soon. Here's a datasheet of a single-chip NES, note how everything has been integrated onto a ~2.5 x 3.5mm die.

[FrankBuss]

I implemented the PLA of the C64 with a CPLD:

http://www.frank-buss.de/c64/pla/index.html

Usually you need some voltage level translators, because many old chips need 5V and new CPLDs and FPGAs run with 3.3V or lower, but it is not difficult, if it is only digital, because the functions of such old chips are simple compared to modern systems.

[digsys]

... But how do you reverse engineer the old IC without a datasheet or schematic?

And as others have said - there is no ONE right answer. Totally depends on what the device is !!!! Is it pure digital,
some analogue, maths, smart, dumb .... eg's
- In the field of ECUs (vehicles) - one fellow (that I know of) built a self-learning universal one with adapters to suit
whatever make / model you had. You plugged both units in, drove around for a week or two and viola - you had a
99.9% duplicate. Alarm points and conditions that you didn't duplicate while on test drive were manually added.
He just wenty through the service manuals.
- Sometimes you only need to know what function is performed. I had to replace quite complicated LED / LCD driver
ICs once, Intersil (and some other brand) etc. I didn't even bother analysing the waveforms, just laid out all my Inputs
and outputs and made a "pin compatible" version. 1-10uS timing differences were a non-issue.
- Then you get to the more serious stuff !! Reverse enineering the schematic on a multi-layer PCB etc

[miguelvp]

http://blog.visual6502.org/

Edit: oh, you gotta check these in case you can't find them from the home page:
http://www.visual6502.org/JSSim/index.html
http://www.visual6502.org/JSSim/expert-6800.html
Hmm direct links don't seem to work or their site is very slow

Try: http://www.visual6502.org/
and click on the visual sims on the left.


Also as I just mentioned on another thread, check out P.A.C.E "Programmable Arcade Circuit Emulator"
Has plenty of CPUs implemented in FPGAs.

Edit: also www.opencores.org where probably most of the soft cores in PACE came from, haven't look at all of the details on them.

[Anks]

Take a look at this guys videos on replacing namco customs.

[Legion]

Take a look at this guys videos on replacing namco customs.

That looks cool. I'd like to try doing something like that down the road.

[Legion]

Take a look at this guys videos on replacing namco customs.

The strategy this guy used to emulate these old ICs got me thinking. Could a device be made to reconfigure an FPGA to clone another chip? In the video, the guy split the input to both the original IC and the FPGA and then XOR'd the outputs to see if they were matching. I've seen a similar strategy used with a guitar amp modeler called the Kemper. It passes a known input into the guitar amp and sniffs the output signal to see how it's modified. It then creates a model of that amp's signal chain to clone the amp.

So I was thinking if you could have a device that you plug an FPGA into along with the IC to be cloned and then pass known inputs to both chips, the device would iteratively reconfigure the FPGA until the outputs match. I know very little about FPGAs but in my head this seems plausible.

[David Hess]

The strategy this guy used to emulate these old ICs got me thinking. Could a device be made to reconfigure an to clone another chip? In the video, the guy split the input to both the original IC and the FPGA and then XOR'd the outputs to see if they were matching. I've seen a similar strategy used with a guitar amp modeler called the Kemper. It passes a known input into the guitar amp and sniffs the output signal to see how it's modified. It then creates a model of that amp's signal chain to clone the amp.

So I was thinking if you could have a device that you plug an FPGA into along with the IC to be cloned and then pass known inputs to both chips, the device would iteratively reconfigure the FPGA until the outputs match. I know very little about FPGAs but in my head this seems plausible.

There is too much hidden state for that to work in this case.  XOR comparison will only be good for finding where more work is needed.

[Anks]

A massive self learning algo could be written but technology is far from that and also even this approach leaves "ifs and buts".