Simulator models tend to only be the explicit device
unless there is a really sophisticated layout extraction
capable of representing all the buried BJTs in the
neighborhood. As an academic exercise I have seen
this. As a real, usable CAD function, no way.
However what I do suggest is to look at any failing
("damaged") output's layout to see that (1) tap rules
are not violated and (b) that any pad connected device
employs the prescribed I/O guardring rules.
Be sure that no input is allowed to "float" to an unknown
voltage (or a voltage where the outcome is "X"). This can
also product the elevated supply current signature and
possibly corrupt signal chain all the way to an output.
Latchup is reversible, until it isn't. You can survive
"micro-latch" (single transistor or pair, that pulls less
current than the interconnect can handle long term)
but as you approach chip scale (like lighting up a
very large NWell made contiguous to hold all the
PMOS of an I/O ring) could fry traces or even bond
wires. Depending on chio design you could see a
"staircase" of local latchups, one SCR at a time. See
this at single event effects testing a lot, random ion
strike location triggering one at a time until "She canna
take any more, Captain!"
Pin induced electrical latchup is what the design rules
are meant to prevent. An input (or output) whose N+/Pepi
or P+/NWell junction goes forward biased (i.e. travels
outside the supply rails to which Pepi or NWell is tied)
injects base current to "something". If that's the shunt R
delivered by tap proximity and guardring enclosure, it
can be kept benign. But that R is finite and layout defined.
Site by site, transistor by transistor, don't miss one.
"Hot" NWells are their own special threat. Buried in the core
and escaping basic DRC rules, this presents a deep junction
which could be forward biased by circuit topology and
operation (normal or abnormal).
If you proceed in an orderly way with capturing power-up
pin activity, you might be able to deduce what has provoked
the latchup. Monitor supply current, set an intial "maximally
benign, maximally known" condition, then start working your
way toward normal operation one signal or signal-group at
a time, one load at a time, see where stuff goes nuts, follow
the thread.