Microscope examination of a PLD

[Grant Stockly]

Article: 77933
Subject: Re: Microscope examination of a PLD
From: Jim Granville <no.spam@designtools.co.nz>
Date: Sun, 23 Jan 2005 11:36:19 +1300
Links: << >> << T >> << A >>
logjam wrote:
> I'm probably going to attempt a distructive test on a PLD to determine
> its function. I'm wondering if anyone has tried this, and with what
> success?

I hope you have more than one

>
> I found this:
>
> "An important architectural feature that is found on virtually all PLDs
> is not shown on logic diagrams. This feature is the security fuse.
> Normally, the fuse pattern programmed into a PLD can, like a PROM, be
> read and displayed or copied by programming hardware. Devices with a
> security fuse, however, provide the ability to disable this read
> function. This allows the design to be somewhat secure from attempts to
> copy or reverse engineer it.
>
> In reality, it's relatively easy to shave the top off of a bipolar PLD
> and examine the programmed fuses with a microscope. For bipolar PLDs,
> then, would be copiers are merely inconvenienced. Erasable CMOS PLDs
> are considerably more secure, since it's very difficult, if not
> impossible, to determine their function from examination."
>
> From
> http://www.ee.cooper.edu/courses/cou...es/EE151/PLD1/
>
> Anyone here ever "shave" a chip for examination? I have access to a
> video microscope at the university. I also have a DV camcorder with DV
> in, so I could take the pictures, post them, and then beg for more
> help.
>
> Any suggestions? I would be shaving the top off of some 16R8/4 chips.
> Would heating them to around 250-300F for a while help? Shaving the
> tops down while hot?
>
> I eventually want to rewrite all of the equations for speed, but
> getting a 100% copy of the OEM work was the goal.

If that is the goal, why not simply reverse engineer the logic ?

16R8/4 devices are not complex, and if you also have the product circuit
diagram [or application circuits of the devices], you can greatly reduce
the vector-search complexity.

All you need is pencil, paper, text editor, and a PLD programmer that
can run test vectors (most can).

-jg