Using an FPGA to recreate a discontinued IC - Page 1
Forum section: electronics / general

author: Legion
author_rank: Frequent Contributor
timestamp: May 06, 2014, 01:27:37 pm
content: If you have an old IC that is no longer manufactured, how practical would it be to emulate it with an FPGA? Is it possible to do without a schematic of the IC's internals?Reason I ask is I saw this article about a guy who's made a high end NES clone. To ensure maximum compatibility he harvested the PPUs and CPUs from old consoles.Since the supply of those chips will only go down, it'd be useful to have an FPGA equivalent.Article here:http://arstechnica.com/gaming/2014/05/building-a-perfect-no-compromises-aftermarket-nes-for-500/Product site here:http://analogueinteractive.com/

author: Excavatoree
author_rank: Frequent Contributor
timestamp: May 06, 2014, 01:52:40 pm
content: I really shouldn't reply to this, as I know nothing about the subject at all. I'll simply add that there's a Youtube video in which Jeri Elsworth uses an FPGA to re-create an IC for a pinball machine she was repairing. It may offer some insight.

author: Legion
author_rank: Frequent Contributor
timestamp: May 06, 2014, 02:03:36 pm
content: Quote from: Excavatoree on May 06, 2014, 01:52:40 pmCool, got a link?

author: Excavatoree
author_rank: Frequent Contributor
timestamp: May 06, 2014, 02:18:59 pm
content: Naturally, she had a datasheet. I'll still post the link, as it is an interesting video.

author: Legion
author_rank: Frequent Contributor
timestamp: May 06, 2014, 02:28:39 pm
content: Quote from: Excavatoree on May 06, 2014, 02:18:59 pmThanks. I hadn't heard of her before. Looks like she has some cool videos to check out.

author: digsys
author_rank: Unknown
timestamp: May 06, 2014, 02:36:18 pm
content: In many cases I've just used an MPU to replace old / obsolete ICs. A LOT lower power, easier and cheaper to set-up.The silabs stuff eg can do up to 12-15 mips real, and have heaps of A/D, D/A, timers, counters, etc etc, all for $2-3If you're good with assembler, you can get quite high speeds if required.

author: Legion
author_rank: Frequent Contributor
timestamp: May 06, 2014, 02:40:15 pm
content: Quote from: digsys on May 06, 2014, 02:36:18 pmBut how do you reverse engineer the old IC without a datasheet or schematic?

author: Khashoggi
author_rank: Contributor
timestamp: May 06, 2014, 03:13:14 pm
content: This guy implemented an entire Apple II chipset into a FPGA project.http://www.cs.columbia.edu/~sedwards/apple2fpga/

author: Khashoggi
author_rank: Contributor
timestamp: May 06, 2014, 03:19:58 pm
content: Quote from: Legion on May 06, 2014, 02:40:15 pmNothing's impossible, but if it is a complex chip it would require resources well beyond the hobbyist.Otherwise, if it is simple you have to reverse engineer it by testing the input/output characteristics and attempt to approximate it.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: May 06, 2014, 03:39:13 pm
content: How you would reverse engineer a certain IC depends on what is known about it. Relatively much is and was known about the NES CPU from the get-go. The CPU core is a second-sourced version of MOS Technologies' (a.k.a. Commodore's) 6502 core, with the BCD portion blocked out to prevent a patent intrusion, so you get that for free. The custom parts are the video and audio. These were described in programmers manuals, which may have been leaked. One big advantage here is that you can run your own code on the CPU, so you can hypothesize about, and test corner-cases about the various IO functionality. You can also use the game library for testing. If you want to get really serious about it, you can input all digital IO pins into to your own FPGA and xor it with the internal representation of the same pins and trigger on any difference.Let's say you don't have this kind of prior knowledge, though. Then your first path of attack will probably be to reverse engineer the peripheral circuitry. Sometimes this can be done by logic induction, for example if the chip under reverser engineering is connected to a memory chip or other chip with a known pinout. Then you may for example hook up a logic analyzer to it to try to make sense of the signals. Then you work from there. One interesting example of this, though not made specifically for cloning the ting, is Natashenka's reverse engineering of tamagotchis, which turned out to use a 6502 clone as well, Sunplus branded.If all else fails, you resort to nitric acid, a scanning electron microscope and and probing needles. This is what Chris Tarnovsky is doing. Again, the focus here is not to replicate the function of a chip, but it tells you a lot about the reverse engineering process. Another option at this stage is to image the chip layer by layer and simulate it to figure out something about it, or perhaps resynthesize the internal circuit for an FPGA.

author: Legion
author_rank: Frequent Contributor
timestamp: May 06, 2014, 05:17:29 pm
content: Apparently someone else is already building an FPGA replacement for the PPU.http://www.universalppu.com/

author: Holograph
author_rank: Regular Contributor
timestamp: May 06, 2014, 05:44:27 pm
content: Quote from: Legion on May 06, 2014, 05:17:29 pmSee alsohttp://etim.net.au/nesrgb/

author: amyk
author_rank: Super Contributor
timestamp: May 06, 2014, 09:04:29 pm
content: The NES PPU/CPU is well known, it's been reverse-engineered down to the mask level:http://www.qmtpro.com/~nes/chipimages/There's some analog circuitry in there so an FPGA might not be ideal.Also don't forget thattons of NES cloneshave existed for decades, and production is unlikely to cease anytime soon.Here's a datasheet of a single-chip NES, note how everything has been integrated onto a ~2.5 x 3.5mm die.

author: FrankBuss
author_rank: Unknown
timestamp: May 06, 2014, 10:31:24 pm
content: I implemented the PLA of the C64 with a CPLD:http://www.frank-buss.de/c64/pla/index.htmlUsually you need some voltage level translators, because many old chips need 5V and new CPLDs and FPGAs run with 3.3V or lower, but it is not difficult, if it is only digital, because the functions of such old chips are simple compared to modern systems.

author: digsys
author_rank: Unknown
timestamp: May 07, 2014, 12:37:13 am
content: Quote from: LegionAnd as others have said - there is no ONE right answer. Totally depends on what the device is !!!! Is it pure digital,some analogue, maths, smart, dumb .... eg's- In the field of ECUs (vehicles) - one fellow (that I know of) built a self-learning universal one with adapters to suitwhatever make / model you had. You plugged both units in, drove around for a week or two and viola - you had a99.9% duplicate. Alarm points and conditions that you didn't duplicate while on test drive were manually added.He just wenty through the service manuals.- Sometimes you only need to know what function is performed. I had to replace quite complicated LED / LCD driverICs once, Intersil (and some other brand) etc. I didn't even bother analysing the waveforms, just laid out all my Inputsand outputs and made a "pin compatible" version. 1-10uS timing differences were a non-issue.- Then you get to the more serious stuff !! Reverse enineering the schematic on a multi-layer PCB etc

author: miguelvp
author_rank: Super Contributor
timestamp: May 07, 2014, 01:15:55 am
content: http://blog.visual6502.org/Edit: oh, you gotta check these in case you can't find them from the home page:http://www.visual6502.org/JSSim/index.htmlhttp://www.visual6502.org/JSSim/expert-6800.htmlHmm direct links don't seem to work or their site is very slowTry:http://www.visual6502.org/and click on the visual sims on the left.Also as I just mentioned on another thread, check out P.A.C.E "Programmable Arcade Circuit Emulator"Has plenty of CPUs implemented in FPGAs.Edit: alsowww.opencores.orgwhere probably most of the soft cores in PACE came from, haven't look at all of the details on them.

author: Anks
author_rank: Frequent Contributor
timestamp: May 08, 2014, 03:35:29 pm
content: Take a look at this guys videos on replacing namco customs.

author: Legion
author_rank: Frequent Contributor
timestamp: May 09, 2014, 04:05:12 am
content: Quote from: Anks on May 08, 2014, 03:35:29 pmThat looks cool. I'd like to try doing something like that down the road.

author: Legion
author_rank: Frequent Contributor
timestamp: May 09, 2014, 03:46:50 pm
content: Quote from: Anks on May 08, 2014, 03:35:29 pmThe strategy this guy used to emulate these old ICs got me thinking. Could a device be made to reconfigure an FPGA to clone another chip? In the video, the guy split the input to both the original IC and the FPGA and then XOR'd the outputs to see if they were matching. I've seen a similar strategy used with a guitar amp modeler called the Kemper. It passes a known input into the guitar amp and sniffs the output signal to see how it's modified. It then creates a model of that amp's signal chain to clone the amp.So I was thinking if you could have a device that you plug an FPGA into along with the IC to be cloned and then pass known inputs to both chips, the device would iteratively reconfigure the FPGA until the outputs match. I know very little about FPGAs but in my head this seems plausible.

author: David Hess
author_rank: Super Contributor
timestamp: May 09, 2014, 04:08:15 pm
content: Quote from: Legion on May 09, 2014, 03:46:50 pmThere is too much hidden state for that to work in this case. XOR comparison will only be good for finding where more work is needed.

author: Anks
author_rank: Frequent Contributor
timestamp: May 09, 2014, 09:58:16 pm
content: A massive self learning algo could be written but technology is far from that and also even this approach leaves "ifs and buts".