Micrologics Logo
Back to Blog
App DevelopmentPublished on June 27, 2026

From Silicon to HDL: A Practical Guide to Reverse Engineering Vintage Gate Arrays

Discover the rigorous engineering process behind reverse engineering vintage custom gate arrays. Learn how to transition from acid decapsulation and die photography to logic extraction and cycle-accurate Verilog emulation.

The Resurrection of Lost Silicon

In the realm of software preservation and hardware emulation, high-level behavioral simulation only gets you so far. For vintage systems utilizing proprietary, undocumented custom silicon—such as the custom gate arrays found in classic IBM MCGA/VGA systems, arcade boards, and early home computers—true accuracy requires going deeper. To achieve cycle-exact emulation, we must look at the physical silicon itself.

Reverse engineering a vintage gate array is a multidisciplinary engineering challenge. It bridges the gap between organic chemistry, optical physics, digital logic design, and hardware description languages (HDLs). This technical deep dive outlines the end-to-end pipeline of translating legacy silicon into synthesizable Verilog, allowing long-dead hardware to run natively on modern FPGAs.

Phase 1: Decapsulation and Surface Preparation

Before you can image a chip's die, you must remove its protective packaging without destroying the fragile silicon structure, bond wires, or metal layers beneath. Most legacy chips are housed in plastic dual in-line packages (DIP) or plastic quad flat packages (PQFP).

Chemical Decapsulation

Plastic packages are typically composed of an epoxy novolac resin filled with fused silica. The standard industrial method for exposing the die is chemical decapsulation using fuming nitric acid ($HNO_3$) or a mixture of sulfuric and nitric acids.

  1. Preparation: The chip is placed in a small PTFE or glass fixture. To localize the acid, some engineers mill a small cavity into the top of the plastic package directly above the die cavity.
  2. Acid Application: Red fuming nitric acid (concentration >90%) is heated to approximately 90°C to 140°C and applied to the cavity. The acid digests the epoxy resin while leaving the silicon dioxide ($SiO_2$) passivation layer and silicon substrate untouched.
  3. Rinsing: Once the die is exposed, the chip is thoroughly rinsed in ultra-pure acetone inside an ultrasonic bath to remove carbonized resin residues, followed by an isopropyl alcohol (IPA) rinse to prevent water spots.

Safety Warning: This process involves highly corrosive, toxic chemicals requiring professional fume hoods, acid-resistant personal protective equipment (PPE), and proper waste disposal protocols.

Phase 2: High-Resolution Die Microscopy and Image Stitching

Once the die is exposed, the next step is capturing high-resolution images of the silicon surface. A standard optical microscope lacks the depth of field and resolution required at high magnifications. Instead, we use a metallurgical microscope equipped with a plan-apochromatic objective lens and a high-resolution digital camera.

Grid Capture and Stitching

At 200x to 500x magnification, only a tiny fraction of the die is visible in a single frame. To capture the entire die, we must program an automated XY motorized stage to take a grid of overlapping photos (typically 10% to 20% overlap).

[ Frame 1 ] <---> [ Frame 2 ] <---> [ Frame 3 ]
    ^                 ^                 ^
    |                 |                 |
    v                 v                 v
[ Frame 4 ] <---> [ Frame 5 ] <---> [ Frame 6 ]

Once the grid is captured, stitching software (such as Hugin, ImageJ, or custom OpenCV scripts) aligns the frames. Lens distortion (chromatic aberration and radial distortion) must be mathematically corrected beforehand to prevent alignment drift across the composite image.

Here is a simple Python snippet using OpenCV to perform feature-based alignment on adjacent frames:

import cv2
import numpy as np

def align_images(img1, img2):
    # Convert to grayscale
    gray1 = cv2.cvtColor(img1, cv2.COLOR_BGR2GRAY)
    gray2 = cv2.cvtColor(img2, cv2.COLOR_BGR2GRAY)
    
    # Detect SIFT features
    sift = cv2.SIFT_create()
    kp1, des1 = sift.detectAndCompute(gray1, None)
    kp2, des2 = sift.detectAndCompute(gray2, None)
    
    # Match features
    bf = cv2.BFMatcher()
    matches = bf.knnMatch(des1, des2, k=2)
    
    # Apply ratio test
    good = []
    for m, n in matches:
        if m.distance < 0.75 * n.distance:
            good.append(m)
            
    # Extract location of good matches
    points1 = np.zeros((len(good), 2), dtype=np.float32)
    points2 = np.zeros((len(good), 2), dtype=np.float32)
    
    for i, match in enumerate(good):
        points1[i, :] = kp1[match.queryIdx].pt
        points2[i, :] = kp2[match.trainIdx].pt
        
    # Find homography matrix
    h, mask = cv2.findHomography(points1, points2, cv2.RANSAC)
    return h

Phase 3: Layer Analysis and Logic Gate Extraction

With a high-resolution, flat composite image of the die, we can begin analyzing its structure. In vintage gate arrays (such as those fabricated in 2.0-micron to 5.0-micron CMOS processes), there are typically only a few layers to trace:

  1. Metal Layer (Aluminum): Appears as bright, reflective, silvery tracks. This layer handles signal routing between gates and power distribution ($V_{CC}$ and $GND$).
  2. Polysilicon Layer: Appears as darker, colored lines beneath the metal. Polysilicon forms the gates of the MOSFETs where it crosses active diffusion areas.
  3. Diffusion Layer (Active Region): Regions doped with impurities to form N-channel and P-channel transistors.
  4. Vias / Contacts: Small square or circular holes that establish electrical connections between different layers (e.g., Metal-to-Polysilicon or Metal-to-Diffusion).

Identifying Standard Cells

Gate arrays are structured around a matrix of uniform, uncommitted transistor cells. Customization is achieved solely through the final metal routing layers. By analyzing how the metal traces connect to the underlying transistors, we can identify standard logic structures:

  • Inverter (NOT Gate): A single PMOS and NMOS pair with their gates tied together as the input, and their drains tied together as the output.
  • NAND Gate: PMOS transistors connected in parallel to $V_{CC}$; NMOS transistors connected in series to $GND$.
  • NOR Gate: PMOS transistors connected in series to $V_{CC}$; NMOS transistors connected in parallel to $GND$.
        VCC (Metal)
         │
   ┌─────┴─────┐
  ─┤  PMOS A   ├─┐
   └───────────┘ │
   ┌───────────┐ ├────── Output
  ─┤  PMOS B   ├─┘
   └─────┬─────┘
         │
   ┌─────┴─────┐
  ─┤  NMOS A   ├─
   └─────┬─────┘
   ┌─────┴─────┐
  ─┤  NMOS B   ├─
   └─────┬─────┘
         │
        GND
   (2-Input NAND Configuration)

Phase 4: Netlist Reconstruction

Once the individual logic gates are identified across the die, they must be mapped to a netlist—a structured text file detailing every gate and its corresponding interconnections.

While manual tracing is possible for simple chips containing a few hundred gates, complex gate arrays require specialized computer-aided tools like DeGate or custom computer vision pipelines. These tools allow users to define template matching algorithms for specific gate structures (e.g., finding all instances of a 3-input NAND cell) and automatically trace the metal interconnect paths.

The output of this phase is an intermediate netlist format, typically represented as an SPICE netlist or a primitive hardware description language document.

Phase 5: Translating to Synthesizable Verilog

An extracted netlist of raw gates and transistors is highly prone to subtle physical layout artifacts, propagation delays, and race conditions. To make this code usable on modern FPGAs, we must translate the structural netlist into clean, synthesizable, behavioral-structural Verilog.

Let's look at an example of translating an extracted physical D-type flip-flop structure (often constructed using cross-coupled NAND gates in vintage silicon) into an optimized, synchronous Verilog representation.

Raw Extracted Gate Representation

// Raw structural gates as extracted from physical silicon routing
module raw_d_flip_flop (
    input wire clk,
    input wire d,
    output wire q,
    output wire q_bar
);
    wire w1, w2, w3, w4;

    nand g1(w1, d, clk);
    nand g2(w2, w1, clk);
    nand g3(q, w1, q_bar);
    nand g4(q_bar, w2, q);
endmodule

While the simulation of the code above might behave correctly under ideal gate delays, synthesizing this cross-coupled loop directly on modern FPGA architectures (like AMD/Xilinx Vivado or Intel Quartus) will result in timing loops, combinatorial feedback warnings, and unpredictable hardware execution.

Optimized Synchronous Verilog

To solve this, we abstract the physical implementation of the cell back to its behavioral equivalent, ensuring it maps cleanly to the FPGA's dedicated flip-flop resources (DFFs):

// Synthesizer-friendly, cycle-accurate equivalent
module optimized_d_flip_flop (
    input wire clk,
    input wire rst_n,
    input wire d,
    output reg q,
    output wire q_bar
);
    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            q <= 1'b0;
        end else begin
            q <= d;
        end
    end

    assign q_bar = ~q;
endmodule

Phase 6: Verification and Validation

How do we guarantee that our reconstructed Verilog model behaves exactly like the original physical silicon? We use a co-simulation and physical validation pipeline.

+-----------------------+          +-----------------------+
|   Physical Chip on    |          |   Reconstructed HDL   |
|    Logic Analyzer     |          |     in Verilator      |
+-----------+-----------+          +-----------+-----------+
            |                                  |
            | (Capture Waves)                  | (Generate VCD)
            +----------------─┬────────────────+
                              v
                  +───────────────────────+
                  |   Waveform Compare    | (Python / GTKWave)
                  +───────────────────────+
  1. Logic Analyzer Captures: Connect a high-speed logic analyzer to the pins of an operating, original physical chip. Record stimulus inputs and the resulting output waveforms during actual system operation.
  2. HDL Testbenches: Feed the captured stimulus inputs into a cycle-accurate simulator (such as Verilator or ModelSim) driving your reconstructed Verilog code.
  3. Differential Analysis: Write a test runner script to compare the simulator's Value Change Dump (VCD) file with the physical logic analyzer captures. Any discrepancy in timing, state transitions, or pulse widths points to an error in the physical gate extraction or layer tracing.

Conclusion

Reverse engineering legacy gate arrays at the silicon level is the gold standard for preservation engineering. By moving from acid decapsulation to high-resolution image stitching, physical layer tracing, and finally to modern synthesizable Verilog, we preserve the precise operational characteristics of historical computing hardware. This ensures that the foundational logic of the digital age is never truly lost to time, but remains executable on the silicon of tomorrow.

#Hardware Emulation#Reverse Engineering#Verilog#Retro Tech#Embedded Systems