标签: Reverse

The field of reverse engineering (RE) and the laws that regulate it have transformed over the years, and it has become a valuable, respectable, and ethical practice helping technology companies remain competitive. This wasn't always the case. In the early years of the semiconductor industry, "chip piracy," as we call it today, became rampant. Chip piracy is "the process of copying the mask layout of another semiconductor company's product." This was only a small subset of RE activities practised 30 or 40 years ago. Reverse engineering... explained Reverse engineering is a "process of extracting the knowledge or design blueprints from anything man made." RE is intimately linked to the process of learning, and it's been used since cave-dwelling humans created primitive tools for hunting. Their descendants later invented the wheel, created horse carriages, steam engines, and—a little later—deep subµm transistors. RE was legal back then (by default), and it is legal today. That is, semiconductor companies practicing RE, and RE service companies like LTEC, must conduct their RE activity within the framework of the law. The relatively few number of litigations associated with chip piracy during the last 30 years suggests that the vast majority of these activities are compliant. However, the behaviour constituting proper and ethical business conduct in the continually evolving semiconductor industry is a far more debatable topic. Let's examine both the legality and ethics of RE from a historical perspective. The rise of second sourcing Today's definition of second source is "a company licensed to manufacture and sell components originally designed by another company (the first source)." Since a licensing agreement is implied, there is no reason to think there is anything illegal or unethical associated with such a mutually agreed upon arrangement. Even though this definition didn't exist back in the late 60s and early 70s, both second sourcing—licensed or unauthorised—and the RE associated with it were legal. In November, 1965, Fairchild Semiconductor introduced Bob Widlar's hugely successfulµA709 operational amplifier. This was an analogue IC and the first to be (later) second-sourced. Intel's 4004 microprocessor, introduced in 1971, was second-sourced by National Semiconductor three years later. The era of second-sourcing semiconductor devices was taking off. Having spent nearly forty years in the semiconductor industry, I was aware of corporate management initiating second-source projects without a licensing agreement or any other collaborative arrangement with the primary source. Sometimes, major IC customers requested second-source products to destroy a monopoly by the primary-source brand and create price pressure, to ensure uninterrupted component supply in case the primary source failed to deliver. Other times, the motivation was based upon prudent market research and ROI projections. In some cases, design flaws discovered in an otherwise popular device were the reason for creating a second source. All these approaches were perfectly legal. There was one particular practice of second sourcing that, although legal, was not necessarily ethical. The process began by taking high-resolution photographs of a competitor's semiconductor die and literally copying the mask layout of the primary source product, line-by-line, with micron or subµm precision. Figure 1 below shows the die photo of a 1980's vintage integrated circuit with its metal layer removed to expose the inner details of its components.   Figure 1. Die photo of a vintage 1980s integrated circuit with the metal layer removed. The circuit schematic was traced, and then the transistor, resistor, capacitor, and metal interconnect dimensions were measured. Finally, a suitable manufacturing process selection was made based on cross-sectional analysis of each component type. The content of the competitor's data sheet was essentially copied, and test programs were written to support the data sheet limits, followed by a qualification process and eventual product release. This allowed bypassing the expensive, time-consuming RD phase, dramatically reducing the cost of product development and the time required to produce it. Applicable laws of the era didn't provide any protection for preventing mindless copying of the layout of a competitor's product. As a result, companies aggressively pursuing second-sourcing strategies were able to gain unfair advantages as their costs of development were a fraction of those associated with the devices fabricated by the primary source. The time-to-market of these second-source products was also much shorter. By the early eighties, second sourcing was clearly being seen as unfair competition. A new standard of conduct and new rules were required. And they came! Law comes to the valley The Semiconductor Chip Protection Act (SCPA) of 1984 regulated unlicensed second-sourcing involving direct copying of the mask layout of a semiconductor device. This legal concept was quickly adopted in most industrialized countries. After 1984, direct copying of an entire IC layout for the purpose of unauthorised second sourcing was termed as "chip piracy," and the act was called "slavish copying." The practice was subsequently stopped by the new law. However, semiconductor companies were still permitted to reproduce a competitor's protected layout for the purpose of analysing it or even creating a second mask-work that had substantial similarities to the first. Dedicated RE firms appeared in the late 80s and aided semiconductor companies in generating second-source products, but they were not the ones actually doing it. Sometimes, semiconductor companies purchased analysis reports from RE firms and used the knowledge gained for the purpose of second-sourcing. On other occasions, RE service firms captured full chip schematics and other details of manufacturing technology on their own initiative. This was likely done in anticipation of a new product generating strong interest as a result of new features, functions, or applied technology. Even so, such activity could not be construed as unethical, let alone illegal, as long as the product sample was obtained legitimately and the knowledge gained from the public domain was used for the purpose of learning, within the spirit of the SCPA. Going one step further, let us assume that a circuit schematic of a semiconductor device is reverse-engineered by an RE company. Subsequently, this information is purchased by a semiconductor company. The RE firm providing the circuit is informed that the schematic diagram is being purchased to create a copy of a competitor's mask work for the purpose of study and analysis. Such analysis performed by the semiconductor company qualifies under SCPA as valid RE, not plagiarism or piracy. How then could this work, including the indirect role of the RE firm, be labelled unethical, even in this rather extreme case? While the SCPA was a major milestone in the semiconductor business, many experts in the legal field question its effectiveness based upon the very low number of litigation cases that followed in subsequent decades. They argue that, aside from the deterrence of SCPA statues, other factors contributed just as much, if not more, to the decline of chip piracy and other forms of second sourcing. Increased complexity of technology is certainly one of the prime factors. Consider a 28nm processor having a cross-section similar to the one shown in Figure 2.   Figure 2. Cross-section of a 28nm processor. Just capturing a 100µm by 100µm area of the metal interconnect layers of a 5mm x 7mm die having twelve interconnect layers in a flat GDS file format would require about three years using a single scanning electron microscope. This represents only a tiny fraction of the entire die. Pirating such products is clearly not practical. However, searching for specific patent violations associated with semiconductor devices of any complexity using RE is. Added factors diminishing the appeal of second sourcing were the availability of ample manufacturing capacity from the prime source, shorter product life cycles, and a continuously increasing level of integration of multiple circuit functions. The combined effect of all these is that RE activity related to chip piracy is no longer practised, and second-sourcing in general has gradually diminished. Reverse engineering services to the fore RE firms provide valuable and legitimate service and deserve a fair assessment. RE services are in high demand in today's fast-paced, high-tech multinational environment. Free trade and international diffusion of technology diminishes national monopolies over scientific know-how as we ship high-tech products and associated IP buried within them to various industrialized countries. Wide use of the Internet has dramatically improved worldwide access to information in science and engineering and has increased the vulnerability of intellectual property. In this highly accelerated and competitive environment, RE has become an essential aspect of both product development and IP protection. Technology developers are requiring more RE, not less. One source of negative perceptions with respect to RE as a business is the perceived lack of creative content associated with the work. True, practicing career IP analysts don't design glamorous circuits and products like smartphones and don't generate large numbers of patents. They don't write software for fashionable consumer gadgets. But they do write software for tools intended to improve the productivity of their work, hence reducing the cost of services they provide to customers. RE engineers also apply their creativity to finding patent violations in a memory cell buried deep inside a 22nm 12-layer processor having billions of transistors on a single chip. They analyse intricate structures at a nanometre scale. They're doing hard work of great value to their customers. Only a very few RE service providers offer all the requisite talents, experience, and dedicated equipment for this valuable work. Conclusion In today's complex, multinational, industrial infrastructure, technology diffusion occurs in many ways. RE service companies uncover indispensable public domain knowledge about products and technologies from the world's industrial centres. They also help protect their customers' IP in the US and elsewhere. RE helps ensure that products remain competitive worldwide in terms of both technology and time-to-market. There is no credible forward engineering advancement without the help of reverse engineering. Let's think of it in a fresh way and respect what RE brings to the game. About the author Lajos (Louis) Burgyan is Technical Adviser with LTEC-USA, the foremost and largest circuits, systems, and intellectual property analysis firm in Japan, with offices in San Jose, California.

Over the years, the field of reverse engineering (RE) and the laws that regulate it have evolved, and it has become a valuable, respectable, and ethical practice helping technology companies remain competitive. This wasn't always the case. In the early years of the semiconductor industry, "chip piracy," as we call it today, became rampant. Chip piracy is "the process of copying the mask layout of another semiconductor company's product." This was only a small subset of RE activities practised 30 or 40 years ago. Reverse engineering... explained Reverse engineering is a "process of extracting the knowledge or design blueprints from anything man made." RE is intimately linked to the process of learning, and it's been used since cave-dwelling humans created primitive tools for hunting. Their descendants later invented the wheel, created horse carriages, steam engines, and—a little later—deep subµm transistors. RE was legal back then (by default), and it is legal today. That is, semiconductor companies practicing RE, and RE service companies like LTEC, must conduct their RE activity within the framework of the law. The relatively few number of litigations associated with chip piracy during the last 30 years suggests that the vast majority of these activities are compliant. However, the behaviour constituting proper and ethical business conduct in the continually evolving semiconductor industry is a far more debatable topic. Let's examine both the legality and ethics of RE from a historical perspective. The rise of second sourcing Today's definition of second source is "a company licensed to manufacture and sell components originally designed by another company (the first source)." Since a licensing agreement is implied, there is no reason to think there is anything illegal or unethical associated with such a mutually agreed upon arrangement. Even though this definition didn't exist back in the late 60s and early 70s, both second sourcing—licensed or unauthorised—and the RE associated with it were legal. In November, 1965, Fairchild Semiconductor introduced Bob Widlar's hugely successfulµA709 operational amplifier. This was an analogue IC and the first to be (later) second-sourced. Intel's 4004 microprocessor, introduced in 1971, was second-sourced by National Semiconductor three years later. The era of second-sourcing semiconductor devices was taking off. Having spent nearly forty years in the semiconductor industry, I was aware of corporate management initiating second-source projects without a licensing agreement or any other collaborative arrangement with the primary source. Sometimes, major IC customers requested second-source products to destroy a monopoly by the primary-source brand and create price pressure, to ensure uninterrupted component supply in case the primary source failed to deliver. Other times, the motivation was based upon prudent market research and ROI projections. In some cases, design flaws discovered in an otherwise popular device were the reason for creating a second source. All these approaches were perfectly legal. There was one particular practice of second sourcing that, although legal, was not necessarily ethical. The process began by taking high-resolution photographs of a competitor's semiconductor die and literally copying the mask layout of the primary source product, line-by-line, with micron or subµm precision. Figure 1 below shows the die photo of a 1980's vintage integrated circuit with its metal layer removed to expose the inner details of its components.   Figure 1. Die photo of a vintage 1980s integrated circuit with the metal layer removed. The circuit schematic was traced, and then the transistor, resistor, capacitor, and metal interconnect dimensions were measured. Finally, a suitable manufacturing process selection was made based on cross-sectional analysis of each component type. The content of the competitor's data sheet was essentially copied, and test programs were written to support the data sheet limits, followed by a qualification process and eventual product release. This allowed bypassing the expensive, time-consuming RD phase, dramatically reducing the cost of product development and the time required to produce it. Applicable laws of the era didn't provide any protection for preventing mindless copying of the layout of a competitor's product. As a result, companies aggressively pursuing second-sourcing strategies were able to gain unfair advantages as their costs of development were a fraction of those associated with the devices fabricated by the primary source. The time-to-market of these second-source products was also much shorter. By the early eighties, second sourcing was clearly being seen as unfair competition. A new standard of conduct and new rules were required. And they came! Law comes to the valley The Semiconductor Chip Protection Act (SCPA) of 1984 regulated unlicensed second-sourcing involving direct copying of the mask layout of a semiconductor device. This legal concept was quickly adopted in most industrialized countries. After 1984, direct copying of an entire IC layout for the purpose of unauthorised second sourcing was termed as "chip piracy," and the act was called "slavish copying." The practice was subsequently stopped by the new law. However, semiconductor companies were still permitted to reproduce a competitor's protected layout for the purpose of analysing it or even creating a second mask-work that had substantial similarities to the first. Dedicated RE firms appeared in the late 80s and aided semiconductor companies in generating second-source products, but they were not the ones actually doing it. Sometimes, semiconductor companies purchased analysis reports from RE firms and used the knowledge gained for the purpose of second-sourcing. On other occasions, RE service firms captured full chip schematics and other details of manufacturing technology on their own initiative. This was likely done in anticipation of a new product generating strong interest as a result of new features, functions, or applied technology. Even so, such activity could not be construed as unethical, let alone illegal, as long as the product sample was obtained legitimately and the knowledge gained from the public domain was used for the purpose of learning, within the spirit of the SCPA. Going one step further, let us assume that a circuit schematic of a semiconductor device is reverse-engineered by an RE company. Subsequently, this information is purchased by a semiconductor company. The RE firm providing the circuit is informed that the schematic diagram is being purchased to create a copy of a competitor's mask work for the purpose of study and analysis. Such analysis performed by the semiconductor company qualifies under SCPA as valid RE, not plagiarism or piracy. How then could this work, including the indirect role of the RE firm, be labelled unethical, even in this rather extreme case? While the SCPA was a major milestone in the semiconductor business, many experts in the legal field question its effectiveness based upon the very low number of litigation cases that followed in subsequent decades. They argue that, aside from the deterrence of SCPA statues, other factors contributed just as much, if not more, to the decline of chip piracy and other forms of second sourcing. Increased complexity of technology is certainly one of the prime factors. Consider a 28nm processor having a cross-section similar to the one shown in Figure 2.   Figure 2. Cross-section of a 28nm processor. Just capturing a 100µm by 100µm area of the metal interconnect layers of a 5mm x 7mm die having twelve interconnect layers in a flat GDS file format would require about three years using a single scanning electron microscope. This represents only a tiny fraction of the entire die. Pirating such products is clearly not practical. However, searching for specific patent violations associated with semiconductor devices of any complexity using RE is. Added factors diminishing the appeal of second sourcing were the availability of ample manufacturing capacity from the prime source, shorter product life cycles, and a continuously increasing level of integration of multiple circuit functions. The combined effect of all these is that RE activity related to chip piracy is no longer practised, and second-sourcing in general has gradually diminished. Reverse engineering services to the fore RE firms provide valuable and legitimate service and deserve a fair assessment. RE services are in high demand in today's fast-paced, high-tech multinational environment. Free trade and international diffusion of technology diminishes national monopolies over scientific know-how as we ship high-tech products and associated IP buried within them to various industrialized countries. Wide use of the Internet has dramatically improved worldwide access to information in science and engineering and has increased the vulnerability of intellectual property. In this highly accelerated and competitive environment, RE has become an essential aspect of both product development and IP protection. Technology developers are requiring more RE, not less. One source of negative perceptions with respect to RE as a business is the perceived lack of creative content associated with the work. True, practicing career IP analysts don't design glamorous circuits and products like smartphones and don't generate large numbers of patents. They don't write software for fashionable consumer gadgets. But they do write software for tools intended to improve the productivity of their work, hence reducing the cost of services they provide to customers. RE engineers also apply their creativity to finding patent violations in a memory cell buried deep inside a 22nm 12-layer processor having billions of transistors on a single chip. They analyse intricate structures at a nanometre scale. They're doing hard work of great value to their customers. Only a very few RE service providers offer all the requisite talents, experience, and dedicated equipment for this valuable work. Conclusion In today's complex, multinational, industrial infrastructure, technology diffusion occurs in many ways. RE service companies uncover indispensable public domain knowledge about products and technologies from the world's industrial centres. They also help protect their customers' IP in the US and elsewhere. RE helps ensure that products remain competitive worldwide in terms of both technology and time-to-market. There is no credible forward engineering advancement without the help of reverse engineering. Let's think of it in a fresh way and respect what RE brings to the game. About the author Lajos (Louis) Burgyan is Technical Adviser with LTEC-USA, the foremost and largest circuits, systems, and intellectual property analysis firm in Japan, with offices in San Jose, California.