feature article
Subscribe Now

Dangerous Utterances

Using Chipworks to Test Them Out

I’ve always maintained that the five most dangerous words to be strung together are, “How hard can it be?” This is usually uttered in the context of a brash new idea that no one has vetted. And usually by someone with the power to browbeat a development team into submission. The cost is in over-hyped expectations, especially with customers, and a demoralized development team when it’s decided that it’s their fault the infeasible features weren’t finished.

There’s also a four-word phrase that’s almost as dangerous: “It can’t be done.” This is usually uttered either in the context of a ridiculous feature request or scheduling decree – in which case it may or may not be accurate – or a challenge to a technology leader by some brash new upstart that has the temerity to bite the ankles of the behemoth. In the latter case, it’s all too often born of supreme risk aversion or arrogance. The cost is in lost opportunity, if not lost leadership.

When it comes to scheduling in particular, these two dangerous utterances are often linked. Managers don’t trust their minions, knowing that they’ll routinely sandbag the schedule. So it’s pretty much impossible to quote an honest due date. Even if the quoted deadline is acceptable, it will be assumed that it’s conservative, and will be summarily foreshortened, just on principle. 

The conversation will go something like this: engineer proffers schedule. Manager chops by arbitrary percentage. Engineer says, “It can’t be done.” Manager replies, “How hard can it be?” And somehow a schedule gets negotiated. And then missed.

But when it comes to new product features put forth by a competitor, things get a bit murkier. It’s a pretty bold statement to declare that something someone says they’re going to do can’t be done. If we set aside the dot com bomb, a great many daring declarations of intent have been met to some degree. Enough that simply waving aside the datasheet of a new competitor is generally ill-advised. And yet it still happens. What’s almost amusing is that, when such a new product enters the market purporting to do what it promised to do, some technologists will firmly stand on their belief that “it can’t be done,” reasoning instead that it’s some kind of trick, or, “they’re lying.” 

The time to prepare for a challenge is when you know it’s coming and before it is in front of you. But if your laurels have well-defined butt-prints, and as a result you’re presented with a purported fait accompli from your competitor, you have a golden opportunity to decide once and for all if they’re doing what they said they would be doing.

This starts at first by measuring, presumably. Testing the thing out to see if, outwardly, it displays evidence of doing what can’t be done. If not, problem solved. It’s when the promised impossible behavior is demonstrated that engineering starts scratching their head, saying, “But that can’t be!”

And that’s when you’d like to go find the circuit that makes the impossible possible and learn something. 

There’s another variation on this: “It can’t be done without violating our patents.” Replay the prior scenario for this context, and it’s pretty much the same. The only real difference is, in the former case, you’re not sure what you’re looking for; in the latter case, you know exactly what you’re looking for.

In both cases, you’re tasked with taking a chip built on an aggressive technology and reverse engineering it. Not for the faint-hearted.

This is the service that Chipworks provides.

Now, if you’re like me, you look at Chipworks’ business and say, “Ah, you guys help others copy chips.” And Chipworks President Julia Elvidge will clarify that they are not aware of any direct copying that’s happened. Yes, designers use it, but to “understand the landscape, the competitive situation.” And this often consists of management challenging statements of impossibility made by their teams.

Of course, if you’re going to spend millions of dollars developing a new chip, it does seem like a legitimate activity to understand as much as possible about what you’re getting into before you launch the project. And that includes understanding how your competitors implement various critical features. That can give you insights into where their weaknesses are, how much performance is left on the table, and how they might respond to a challenge from you.

The other group that uses this is patent attorneys trying to prove infringement. Frankly, the existence of that use model makes it kind of silly to use this service for copying, since anyone else with the cash can easily find that you did it.

Chipworks has a well-established process for deconstructing chips, layer by layer, photographing and SEMing, annotating the images, and putting it all together as a schematic. They generally aren’t asked to reverse engineer entire chips, but rather specific circuits within the chip. The requests typically come from big companies that typically don’t want to advertise the fact that they’re doing this. But many of the reports become publicly available for purchase from Chipworks. For instance, if you check their FPGA reports, you can still buy a partial analysis of an Actel part from 1997. Or a Lucent Orca part. Remember them?

Meanwhile, silly though it may be to copy outright, Chipworks has made it easier to do. At their first-ever DAC appearance (after 17 years in business), they announced their new ICWorks tool. It allows Chipworks to deliver a flat schematic, which can then be re-organized into a fully hierarchical schematic, with links to images and other analysis.

There are a couple components to ICWorks. ICWorks Arranger acts like a typical schematic editor, but it has some special features intended for helping the reverse engineering process. It will let you trace signals through various layers and identify all the components that share a net. It actually has a facility for specifying a particular configuration of components, and then looking for repeated instances of that configuration (handy when looking for patent violations). ICWorks Browser lets users of the resulting schematics browse through the schematics and relate various circuits to the database of annotated pictures taken in the deconstruction process. The pictures are intended to help put some context behind the schematics, perhaps giving clues to the intent of the original designers.

The overt purpose of ICWorks is for use in “forward design.” As opposed to reverse engineering. If full-on copying isn’t the specific intent, I guess it’s sure nice to be able to start with someone else’s schematic and make changes to it rather than having to get to that point by hand. And knowing that the tool that allowed you to copy the circuit is the same one that can catch you red-handed if you do copy it is something of a self-limiter.

So in the future, before you say, “It can’t be done,” understand that, if it can be done, someone will be able to prove that it got done. And if it got done by stealing your technology, you can find that too. And if it turns out that the way it got done was through some very non-obvious clever tricks that were presumably very hard to do, then at least you’ll have a ready answer to the question, “How hard can it be?”

Leave a Reply

featured blogs
Sep 22, 2021
'μWaveRiders' 是ä¸ç³»åˆ—æ—¨å¨æŽ¢è®¨ Cadence AWR RF 产品的博客,按æˆæ›´æ–°ï¼Œå…¶å†…容涵盖 Cadence AWR Design Environment æ新的核心功能,专题视频ï¼...
Sep 22, 2021
3753 Cruithne is a Q-type, Aten asteroid in orbit around the Sun in 1:1 orbital resonance with the Earth, thereby making it a co-orbital object....
Sep 21, 2021
Learn how our high-performance FPGA prototyping tools enable RTL debug for chip validation teams, eliminating simulation/emulation during hardware debugging. The post High Debug Productivity Is the FPGA Prototyping Game Changer: Part 1 appeared first on From Silicon To Softw...
Aug 5, 2021
Megh Computing's Video Analytics Solution (VAS) portfolio implements a flexible and scalable video analytics pipeline consisting of the following elements: Video Ingestion Video Transformation Object Detection and Inference Video Analytics Visualization   Because Megh's ...

featured video

Gesture Detection for Automotive In-Cabin Applications

Sponsored by Texas Instruments

See how using 60GHz radar for automotive in-cabin gesture is ideal due to its small size and ability to sense through various materials. Applications using gesture control include changing radio stations, answering phone calls, opening windows, and more.

Click to learn more about gesture detection using 60GHz mmWave radar sensors

featured paper

IPU-Based Cloud Infrastructure: The Fulcrum for Digital Business

Sponsored by Intel

As Cloud Service Providers consider their investment strategies and technology plans for the future, learn how IPUs can offer a path to accelerate and financially optimize cloud services.

Click to read more

featured chalk talk

ROHM's KX132-1211 & KX134-1211 Accelerometers

Sponsored by Mouser Electronics and ROHM Semiconductor

Machine health monitoring is a key benefit in the Industry 4.0 revolution. Integrating data from sensors for vibration detection, motion detection, angle measurement and more can give a remarkably accurate picture of machine health, and timely warning of impending failure. In this episode of Chalk Talk, Amelia Dalton chats with Alex Chernyakov of ROHM Semiconductor about the key considerations in machine health monitoring, and how a new line of accelerometers for industrial applications can help.

Click here for more information about Kionix / ROHM Semiconductor KX134 & KX132 Tri-axis Digital Accelerometers