Chip tracing tool

Table of Contents

Abstract

Tracing integrated circuits has always been a problem with conventional tools, so I tried to create a custom software while testing it in real conditions.

I added important features during development while reverse-engineering the Coleco Adam MIOC chip as presented in this demo.

For now, this sofware has only been used for the reverse-engineering of this chip, and some complex CMOS standard cells from the SiliconZoo.

At this time (january 2023), the software is still lacking important features like undo/redo but is fully usable.
It is perfectly suited for reverse engineering of complex standard cells, but still a bit rough for complex dies.

Note: UI is practically non-existent, except for a right-click menu.
Most of the features use shortcuts directly.

Important: this software focuses only on digital MOS logic.
It is not really suited for analog circuits.

Disclaimer

The software is in beta and bugs exists.

Make backups regularly. For this see the Project section.

Downloads

Linux dependancies

sudo apt install libsdl2 libfreetype6 liblua5.1-0


Features

Edition:

  • Basic components:
    • PMOS/NMOS
    • VCC/GND
    • Pullup/Pulldown
    • Input/Output/Generic IO
  • Groups
    A components hierarchy, working like a file system folder.
    • Move inside
    • Generate I/Os
    • Change Size/Color/Icon
    • Set name (for search/verilog export)
    • Select by name
    • Find duplicates
  • Vertices
  • Segments
    Each segment connects 2 vertices.
  • Selections
    • Rectangle selection (mouse)
    • (De)Select all
    • Single selections / toggle (shift + click)
  • Transformations
    • Translation
    • Rotation
  • Refactoring
    • Split VCC/GND lines
    • Invert NMOS/PMOS logic
    • Invert VCC/GND
    • Group selected components
    • Select Channel-Connected-Components (CCC)
    • Select linked wires
  • Copy / Paste / Duplicate
  • Rename components

Tracing:

  • Trace lines
    • 2 clicks process with segment preview.
      You can cancel the placement during the preview with the right mouse button.
    • connect vertices
    • connect segments, and subdivide them if connected from the inside
  • Erase mouse-over segment/vertex with Del
  • Change segment color
  • Change vertex size
  • Dissolve vertices

Simulation:

  • Built-in mos simulator.
    Note: don’t support yet enhancement and depletion mode pull-up.
    Atm you have to replace the transistors by the associated component manually.
  • Truth table generation (don’t work if any internal state)
  • Change inputs with the keyboard and see the simulation in live
  • Context dependant simulation, if you are in a group
  • Special mode with Lua scripts to access and control the simulator.

Import/Export:

  • Json import/export
  • Verilog netlist export (experimental)

Camera:

  • Zoom / Dezoom / Translate
  • Save / Load camera position
  • Smooth transition between 2 camera positions
    Useful when recording videos.

Planned features

QoL:

  • Undo / Redo
  • Save / Load selection box, multiple projects
  • Resize window / fullscreen
  • Display components names.
    Especially useful for I/Os…
  • Option to place the selected components in a group on the fly.
  • An user interface
  • Keybinding
  • DZI support for very large images
  • Progressive JPEG support
  • Session recording
  • A file tree view for groups/components
  • Hierarchy paths for groups.
    More convenient to move to the parent groups and locate your current position in the hierarchy.

Optimizations:

  • Binary file format (lightweight)

Groups:

  • Custom icons
  • Logic gates with standard shapes

Library:

  • A standard cell library with presets

Refactoring:

  • Transistors to logic gates
    Convert automatically transistors to logic gates from the library using a pattern matching algorithm.

Import/Export:

  • Image export of the netlist
  • SVG export of the netlist
  • Bitmap circuits export / import: see example
  • Extract netlist from ‘vectorized’ layouts
  • Merge projects

Simulation:

  • (WIP) Unit tests using the built-in simulator
  • GTKWave export

Shortcuts

(Key): maintain Key
LMB: Left mouse button
RMB: Right mouse button
MW: Mouse wheel up/down (scroll)

Main:

  • F2: Toggle smooth / sharp rendering
  • F5: Save
  • F6: Load
  • Enter: Show/Hide built-in terminal/chat

View:

  • (Space) then (LMB): move view
  • Mouse wheel up/down: zoom
  • F9: Smooth transition to saved Camera 1
  • F10: Smooth transition to saved Camera 2
  • F11: Save current view to Camera 1
  • F12: Save current view to Camera 2

Tools:

  • W: Wire tool
  • C: Component tool
  • L: Edit mode
  • F1: Simulation mode
  • (Ctrl) + F1:
  • (Shift) + F1:

Wire tool:

  • LMB: Place wire
    • (Shift): Horizontal / vertical / diagonal lines
    • RMB: Cancel wire placement
  • Del: Remove highlighted vertex/segment
  • 1,2,3,4,5,6,7,8
    • Change size of the highlighted vertex
    • Change color of the highlighted segment
  • 0: Toggle hide circuits

Component tool:

  • LMB: Place component
  • MW: Change component
  • (Shift) + MW: Rotate component

Edit mode:

  • RMB: Contextual menu
    • On a group or component: different options are visible
  • (LMB): Rectangle selection
  • LMB: Select single vertex or component
  • (Shift) + LMB: Toggle selection of a vertex or component
  • A: Select all
  • (Alt) + A: Select none
  • (Ctrl) + I: Invert selection
  • G: Move selected
  • Left: Rotate CCW
  • Right: Rotate CW
  • (Shift) + D: Duplicate selected
  • Del: Delete selected
  • H: hide other colors
  • L: Group selected components

Simulation:

  • Space: Simulate the next frame
    • (Numpad 1-9): Set input 1-9 to HIGH, otherwise it will be LOW
  • LMB: Move in a group

Known bugs

Big vertices have a wrong color when something is selected. Random (depend on order of components).

Some circuits cause a non critical error when trying to export in verilog.

Usage

Note: the selection and some shortcuts are based on Blender.

In this section we will reverse a standard cell from the SiliconZoo as a demo. You can download it > here <.
Download and extract the .zip in the software folder.

Project

At the moment, your workspace consists of a single project / save file.
This is a limitation of this beta version, it will be improved later.

Saving (F5) and loading (F6) will only affect the ‘save.json’ file in the application folder.
To make backups or multiple saves, simply copy or replace this file.

At start, the file is not loaded, so be carreful and do not press F5 if you want to load (F6) a project.

Layers

Layers can be placed in the ‘layers/’ folder.
The non compressed .tga format is recommended for fast loading of large images.

To use layers you need to setup the ‘layers/config.json’.

For example, the config.json file for a two-layer project looks like this:

[
  {
    "fname":"1_metal.png",
    "alpha":0.6,
    "scale":8.0,
    "x":0,
    "y":0
  },
  {
    "fname":"2_si.png",
    "alpha":0.6,
    "scale":8.0,
    "x":16,
    "y":-16
  },
]


Important: You will need to reboot the software to load the configured layers.

In the editor, visibility of each layer can be toggled using the numpad keys, except in simulation mode.

Tutorial: Launch the software and press the numpad key 1 and 2 to see the previously downloaded standard cell.

Placing components

Press C to switch to component mode. Scroll with the mouse wheel to change the component, and (Shift) + mouse wheel to rotate the components.

When reverse-engineering a standard cell, the first step is to identify the technology, and then place the transistors and power lines.

This standard cell is clearly CMOS, but it is not simple to deduce if VCC is at the top or bottom of the image. But it doesn’t matter, because it is possible to reverse the logic later using the refactoring tools.

Place transistors


Connecting components

Press W to switch to the wire mode. Press mouse button left to create and/or connect vertices.

Connect transistors

Switch to the metal layer by pressing numpad 1 and hide the silicon layer with numpad 2.

Trace the metal layer using another color to not get confused.
Press 2 for gray.

Connect transistors

You can also enlarge vias by pressing 2 while hovering over a vertex.

Simulate to R-E components

Press F1 to start the simulation.

Simulation

Orange wires indicate HIGH, gray ones LOW.

It is possible to simulate other I/Os by pressing space and using the numpad 1-9 keys to set the desired inputs to HIGH.

On the top left position of the window you can see the current signals, and the generated truth table.

000:0
001:1
010:1
011:0
100:1
101:0
110:0
111:1
> Download Circuit <

Lua simulation mode

It is possible to configure custom simulations for unit testings or emulation with lua scripts.

See MOS digital simulations using Lua.

Refactoring

In edit mode (L) you have access to the refactoring tools in the contextual menu (MRB).

Select everything (A), open the menu, [Refactor] > [Invert transistor logic].
Do the same with [Invert VCC/GND].

Then you can simulate again and check the results.

With this circuit, unexpectedly, we obtain the same truth table.

Nice schematics

It is possible to get a nice schematics with the refactoring tools.

First use [Split GND lines] and [Split VCC lines].
Then select and [Dissolve] useless vertices.
Rearange lines and vertices… et voila.

Simulation

We can clearly see that the left and right circuit are the same, but mirrored.

> Download Circuit <

Component hierarchy

It is possible to create a component hierarchy using the group component.

They work like file system folders. You can place circuits and components in groups, without depth limit.

Note that any simulation will be exactly the same if you use groups or not. All components inside groups will be simulated, without any kind of optimizations and therefore the timing will remain the same.

Groups quickly become necessary when working on full chips, and are used to represent standard cells.

Create a group

A group can be placed from the Component mode (C). It’s the square.

Go to Edit mode (L) and right click on the group to open the contextual menu.
You can ‘open’ the group with [Move In].
You can rename it with [Selected] > [Set name].
It is also possible to change it’s size, color and icon.

Auto grouping

A powerful option is the autogrouping.

Just select a circuit part you want to group, press L, and that’s it. I/O are already connected, and it will work with the simulator right out of the box.

Note: I/O types are not yet detected automatically, and a generic I/O component will be used.

Group I/Os

Todo

Configure groups

When you work with standard cells, it is important to rename each new group created for a new cell.

This way, you will be able to select automatically the groups sharing the same name with [Select] > [Select same names].

If you forgot to rename a group, and duplicated it to place your cells, all is not lost.
Use [Select] > [Select duplicates] to select all the duplicated groups.
Then use [Selected] > [Set name] to rename them all at once.

Groups are also useful for outputing verilog. Each different group will output a different module.

WIP

Export to Verilog

Limitations:

  • The source/drain identification which only works on transistors directly connected to VCC/GND.
    For non compliant circuits it will cause a warning:
    ‘std::out_of_range => verilog export failed’.
  • Delays are not implemented and it can pose this kind of problem

Limitations will be fixed in future releases.

The verilog export will generate a module for each group, using the group names if they are defined.

It uses a mos level netlist representation.

The top level circuit will be placed in a main module and will uses input and output components as it’s I/Os.