---
title: "Reading a radio directly from silicon"
locale: "en"
url: "https://irz.fr/en/articles/tda7000-reverse-engineering-en"
markdown_url: "https://irz.fr/en/articles/tda7000-reverse-engineering-en.md"
category: "tech"
tags: ["reverse-engineering", "electronics", "radio", "semiconductors"]
published_at: "2026-08-22T09:35:00.000Z"
author: "Camille Morel"
translation: "https://irz.fr/fr/articles/tda7000-reverse-engineering-fr.md"
---

# Reading a radio directly from silicon

Ken Shirriff reconstructed the Philips TDA7000 from a photograph of its die. His method turns patterns in silicon into transistors, then into a schematic, one functional block at a time.

At first glance, a bare chip die is hostile territory: pale metal tracks cross blocks of doped silicon, tiny bond pads ring the edge and, unless somebody has already done the work, there are no labels. Ken Shirriff took a die photograph of Philips' **TDA7000** FM receiver and treated it as a map whose legend had gone missing, then set about recovering that legend.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

Philips' internal schematic was unavailable, so the photograph had to be read alongside the datasheet, a working knowledge of analog building blocks, GIMP, KiCad, LTspice and enough patience to follow one connection at a time; together, those tools turn a microscope image into an electrical argument rather than a piece of chip photography.

## One metal layer

The TDA7000 happens to be unusually readable. Philips designed it in 1977 and sold it in the early 1980s; IEEE describes a die roughly 3.5 mm square containing most of a mono FM receiver from antenna input to audio output.[2](https://spectrum.ieee.org/chip-hall-of-fame-philips-tda7000-fm-receiver) A power source, speaker or headphones, tuning parts and other external components are still required, so “radio on a chip” was engineering shorthand rather than a claim that the package could sing by itself; even so, IEEE notes that conventional FM sets often needed ten to fourteen alignment operations in production, while a TDA7000 design could get away with one.[2](https://spectrum.ieee.org/chip-hall-of-fame-philips-tda7000-fm-receiver)

For a reverse engineer, the best feature is less glamorous: **one metal layer**. Modern chips can bury their workings under many layers of interconnect, whereas this die leaves the wiring in view, with doped regions changing color, metal contacts showing up as bright squares and long traces remaining followable across the surface.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html) The same simplicity made the original layout harder, however, because two metal wires could not casually cross; that constraint leaves some of the most revealing scars on the die.

## Start with ground

Shirriff begins with power and ground rather than the mixer or oscillator, a deliberately unglamorous choice that keeps the rest from turning into guesswork. The datasheet identifies the relevant package pins, and their pads on the die feed conspicuously heavy traces through the circuit; once those rails are marked, transistor connections become easier to sanity-check because NPN collectors often head toward the positive supply while emitters tend toward ground, sometimes through resistors.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

The rule is simple enough to reuse elsewhere: trace the infrastructure before the traffic, because a random signal wire may wander through several blocks without explaining much, while the supply rails show where a group of components begins to make electrical sense.

> **Reading the die**
> - Map pads to the datasheet: Pinout
> - Trace power and ground: Rails
> - Number transistors and resistors: Parts
> - Work one local area at a time: Blocks
> Method described by Ken Shirriff

## Paint the nets

Scale is the next enemy: the TDA7000 contains more than a hundred NPN transistors and only nine PNP devices, plus resistors, diodes and capacitors,[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html) which is far too much bookkeeping to keep reliably in your head. Shirriff's workaround is wonderfully ordinary: he numbers components, paints each electrical net a different color in GIMP, then carries the same numbering into KiCad, where the drawing can be reorganized without erasing half a page and without pretending that the software discovered the circuit for him.

> Illustration: Area of the TDA7000 die annotated with colors and component numbers to trace connections. Shirriff colors nets and numbers components before transferring them into KiCad. Credit: [Ken Shirriff](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html).

He also works locally, finishing a small area before chasing a line to the opposite side of the die; analog layouts usually place related devices near one another, and a cluster forming a plausible path between supply and ground offers a better foothold than an interesting transistor base disappearing into the distance.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

Geometry then starts doing some of the explanatory work: a resistor grows longer and may fold back on itself when more resistance is needed, differential pairs mirror one another, current mirrors repeat similar devices, and junction capacitors can resemble interlocking fingers. None of those shapes was drawn for a future historian; each one is part of the circuit itself.

## A radio emerges

Once enough small blocks are reconstructed, the familiar radio architecture starts to show through. The TDA7000 is a superheterodyne receiver: an oscillator and mixer translate the incoming station to a lower intermediate frequency. Philips chose an unusually low IF of about **70 kHz**, which allowed the design to replace conventional tuned IF stages with low-pass filtering that was much friendlier to integration.[3](https://www.cool386.com/tda7000/technical_review.pdf)

The awkward part is that broadcast FM can swing roughly ±75 kHz around the carrier, already wider than the chosen intermediate frequency, so Philips used a frequency-locked loop to compress the excursion before filtering; its technical review describes bringing the swing down to roughly ±15 kHz.[3](https://www.cool386.com/tda7000/technical_review.pdf) Integration here required the architecture itself to change around the strengths and weaknesses of the silicon process; simply shrinking a discrete radio component by component would not have produced the same result.

Some of those choices leave unmistakable physical signatures, including several **Gilbert cells** whose symmetric analog multiplier topology appears in the first mixer, the quadrature detector, a tuning correlator and the audio mute path.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html) Once the topology is familiar, its symmetry on the die becomes difficult to miss.

> Illustration: Gilbert cell visible in the silicon of the TDA7000. The symmetry of this Gilbert cell makes the circuit recognizable in the physical layout. Credit: [Ken Shirriff](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html).

## When the eye lies

The eye still gets things wrong. In the noise generator, Shirriff initially reads one structure as a transistor with collector and base tied together, but the surrounding connections refuse to cooperate; tracing farther reveals that the supposed collector is merely a resistor contact, while the actual collector sits elsewhere and is shared with five other transistors.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

That failure is useful because it strips the mystique from “reading silicon”: an interpretation has to match a real semiconductor structure, produce an electrically plausible set of connections and fit the function suggested by the datasheet, all at once. If those tests still leave doubt, Shirriff builds the small block in **LTspice** and checks how it behaves.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

Shirriff even labels his completed schematic with a warning: he does not guarantee 100 percent accuracy.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html) A reconstruction built from incomplete evidence should retain that uncertainty instead of polishing it away.

## The ugly routes

A clean schematic hides the physical compromises that made the product possible, while the die puts them back in view. With only one metal layer, crossings are expensive: tracks snake around occupied regions, some transistor geometries are stretched so a line can squeeze past, and Shirriff identifies only two “cross-unders,” short routes made through silicon rather than metal because the higher resistance makes them a poor default.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

Integrated resistors tell a similar story because they consume die area and their absolute values can vary wildly from one chip to another; ratios between nearby resistors are more dependable, so analog designers lean on matching and transistor topologies instead of assuming that a microscopic resistor will hit an exact textbook value.[1](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)

A schematic tells you what connects to what, but the die records a second layer of information: how awkward those connections were to manufacture, where area became expensive, which crossings deserved a special trick and which symmetrical blocks were worth preserving. When the paperwork disappears, the object still carries the history of its own constraints, written in geometry rather than prose.

## References

1. [Ken Shirriff, “How to reverse engineer an analog chip: the TDA7000 FM radio receiver”, August 2025](https://www.righto.com/2025/08/reverse-engineering-analog-TDA7000.html)
2. [Julianne Pepitone, “Chip Hall of Fame: Philips TDA7000 FM Receiver”, IEEE Spectrum](https://spectrum.ieee.org/chip-hall-of-fame-philips-tda7000-fm-receiver)
3. [Philips Technical Review, “FM receivers for mono and stereo on a single chip”, vol. 41, 1983/1984](https://www.cool386.com/tda7000/technical_review.pdf)