Decapping ICs for investigation.

[orolo]

After spending too much time at the zeptobars site, I decided to decap some ICs on my own, to see what can be achieved with reasonable but not professional equipment. In my home lab I have good laboratory glassware, quality reactives and a decent biological microscope with a camera. The question is if that equipment can be used to solve some doubts about ICs, like general manufacture and authenticity.

For decapping, I tried to follow zeptobars' method: in a closed Erlenmeyer flask I put the chips and 98% sulfuric acid. That flask was connected to an empty buffer flask, and that one to another flask containing a saturated NaOH solution, which degassed outside. The buffer flask was there to avoid the alkaline solution from flowing into the acid flask when cooling, due to the pressure differential. The acid flask was very gently heated until the acid started to bubble, then I let it react for half an hour. A fine mist (I assume SOx) formed in the flask-- the bubbling was not violent at all and the degassing scheme worked fairly well. The whole proccess took about 45 minutes, before I stopped the heat and let the flask to slowly cool to ambient temperature. Then I transferred the tarry acid to another vessel, leaving the solid parts in the flask, then neutralized the remains and filtered them. The yield was a lot of carbonized particles, metal remains from the legs of the components, and three silicon dies. Two ICs, a TO220 and a DIP8, were not corroded thorougly and will need another cook-- zeptobars mentions that. The SOT666 and TO92 packages were either completely corroded, or corroded enough, in just one cook.

Of course, the whole proccess is dangerous, and must be made with great care and adequate equipment and protection. Dispossing safely of the remaining acid is a nontrivial part of the matter.

From the filtered remains, the dies were easy to spot. It's a bit like looking for gold: when the light hits just right, the dies shine very clearly. I was not prepared for how tiny the dies are: even a sot package is huge compared to a moderate size IC, never mind a discrete transistor.

I chose chips that were interesting for some reason or another:

A pmp2401V matched pair npn bjt from Mouser. The question was if the transistors were in one die or two dies, like the model analyzed at zeptobars. Two images, one using the back illumination by the microscope, the other using an LED, frontally.



The only fragment I recovered from this IC is a single die BJT with the same structure than the zeptobars one. So there is one die for each transistor. Wouldn't matching improve if they made them in the same die? Is there a cost/performance hit to the single die solution?

Then a 2SC3355 UHF bjt I got from ebay. Is it a real UHF transistor, or rather a lesser bjt marked as such. For this transistor the decapping was incomplete, and some carbon remained. Even so, the image reveals more or less the typical interdigitated structure of a fast transistor, so I assume it is legit.



Finally, a noname TL431 from ebay. There are many images of TL431 dies around, so I used this as a control IC. The chip was completely decapped and rescued from the carbon dust. Since there is only silicon, I used the backlight of the microscope, though frontal illumination with LED also works.



The die is similar but not exactly equal to any other I've seen. Since the silicon is translucid, I could go for more amplification than with the other pieces, and get finer details. I think there are several lateral PNPs in this capture:



With this level of resolution, it is clearly possible to discern if a chip is genuine: ICs usually have marks from the manufacturer that are difficult to fake.

So even with a modest microscope, and using lab equipment with care, ICs can be decapped and analyzed, yielding quite interesting information. My microscope technique needs a lot of improving. The pictures I got are to zeptobars ones like amateur astronomy is to the Hubble telescope, but I'm surprised my humble protozoan peeking microscope worked so well.

[BarsMonster]

For decapping, I tried to follow zeptobars' method:

Nice results, here are few points from me:

For smaller circuits I now often go for a much faster approach: put transistor or small IC in small test tube, add 0.5ml of acid and heat on open flame (on open air ). It takes 60 seconds to get the job done.

Intrinsic limitation of biological microscope is illumination - specimen should be illuminated through objective, not from the side (light from the side never hits microscope objective when reflected by flat metal traces). You can try to achieve that by shining light through one of the eyepieces (with or without eyepieces installed).

Die should lie on the table without being tilted (both for proper illumination of reflective metal tracks and maintaining focus over die area). On SMD BJT it's complicated as metal holder in SOT-23 transistor is made so that it does not lie flat, you have to straighten it with tweezers - that sometimes is tricky.

[ebclr]

Easier way to decap

[orolo]

For smaller circuits I now often go for a much faster approach: put transistor or small IC in small test tube, add 0.5ml of acid and heat on open flame (on open air ). It takes 60 seconds to get the job done.

Intrinsic limitation of biological microscope is illumination - specimen should be illuminated through objective, not from the side (light from the side never hits microscope objective when reflected by flat metal traces). You can try to achieve that by shining light through one of the eyepieces (with or without eyepieces installed).

Die should lie on the table without being tilted (both for proper illumination of reflective metal tracks and maintaining focus over die area). On SMD BJT it's complicated as metal holder in SOT-23 transistor is made so that it does not lie flat, you have to straighten it with tweezers - that sometimes is tricky.

Wow, thank you very much for the pointers! I'll try the test tube method for the the second bake, there is a half cooked eBay OP07 I really want to inspect. My scope is binocular, and I tried injecting ligth from one eyepiece, but the camera saturated instantly. Following your advice, I'll try with a PWM light source and see if the results improve. Thank you very much for all the information, I've learned a lot from your site, it's a joy to visit.

[BarsMonster]

PWM light source

This could only work with DSLRs or expensive cameras with global/mechanical shutter.

Cheaper cameras with rolling electronic shutter will show you stripes on image for PWM lighting. You need current source or even LED with a resistor :-)

[KhronX]

PWM could work too, provided you add a (large enough) cap on the output, i'd think, to average it out 

PWM light source

This could only work with DSLRs or expensive cameras with global/mechanical shutter.

Cheaper cameras with rolling electronic shutter will show you stripes on image for PWM lighting. You need current source or even LED with a resistor :-)

[bsudbrink]

Of course, with vintage components, the process is a good bit easier. <1st image>
And the result can still be an active component. <2nd image>

[danadak]

Not sure if plastic used still the same today as in the 70's but we
used to decap by taking a propane torch, going to parking lot,
and torching the part. Plastic would turn to ash and part/leadframe
could be exposed.

It was a bit of art in application as torch is capable of meting Si.


Regards, Dana.

[bktemp]

Using a propane torch still works fine for most ics: Heat the ic until it glows orange, let it cool down and now all the pastic material has turned into very brittle stuff that can be seperated easily from the leadframe and die.

[SeanB]

Of course, with vintage components, the process is a good bit easier. <1st image>
And the result can still be an active component. <2nd image>

You made a DRAM camera. How good was it, and have you any images it produced.

[bsudbrink]

Actually, it was more like static ram (AMI S4008).  I built a unit (or a replica, depending on your point of view) based on the plans and photographs in the February 1975 issue of Popular Electronics:

http://www.swtpc.com/mholley/PopularElectronics/Feb1975/PE_Feb1975.htm

I exhibited it at VCF East last year and HACKADAY did a little writeup:

http://hackaday.com/2016/04/17/building-the-first-digital-camera/

The problem with still images is that the design duty cycles the pixels but here are a couple that aren't in the HACKADAY article.  The last image is my hand, palm towards the camera, thumb up.

[orolo]

I've followed BarsMonster's suggestions and I'm very happy with the results.

First, the test tube method works, using a minimum amount of acid, leading to much easier neutralization and disposal. I baked the remains of my OP07 and a LM317. I think the LM317 die cracked; I don't know if it was overheating or the die was very low quality. The thing was a fake for sure, it had a ST marking clearly distorted. The OP07 die was cleanly extracted. It's a big die, some features like the caps can be seen without magnification.

For the frontal lighting, first I tried a miniature tungsten bulb with a constant op-amp current driver from 0 to 30mA. The filament was projected into the die, so I discarded the idea, and changed it for a white LED. Projecting the white LED through a 15x eyepiece, the results were fantastic.

Here is the whole die, at low magnification:



Here is a lame attempt to build a mosaic from two images. The OP07 marking is very clear. Above it, there seems to be a "Ti" mark. I think this chip is legit, also  .



This op amp uses zener zapping for trimming, so looking around at great magnification I found this. Is this a zener zap shunting a resistor?



Anyway, with frontal lighting the doping profiles become apparent, at least for a chip as big as this. For reverse engineering some old analog pieces, a simple binocular microscope plus a regulable LED light could be enough.

Thank you very much for all the suggestions! From now on I'll be much better prepared to spot ebay fakes, something that really bothers me. Examining the die doesn't discard products that didn't pass quality testing, but filters out the worst fakes, and it's a lot of fun. Besides, it's easy.

[T3sl4co1l]

Using the thermal method (heat the package until it's soft and pliable), I took this apart:



Sacrificed a salvaged part I'm sure never to need: an ATI Rage Theater 213RT1ZUA43 in rectangular QFP format.  It came from an old Radeon board.

I don't have much of a macro lens, let alone a microscope, so the resolution is only enough to see gross features.  Also, I scratched the die down in the middle, removing some coating or passivation on it, oops.

I wonder if it was polyimide?  It was yellowish and foggy at first.  I decided to try pyrolyzing it; it didn't evaporate at red heat though, only leaving a black coating.  I scraped this off with a stainless steel blade; it didn't exactly flake off, but didn't seem to affect the die.  The SiO2 passivation is hard, but evidently not quite strong enough to withstand my brutish hands, and this is how I scratched it.  Interestingly, I may've felt fine structures on the surface, wiring or trenching perhaps, and I definitely felt the bondwire blobs around the edges.  Impressive just how fine of structures you can feel.  Also, I nicked the die edge by gripping it with pliers, oops.

This particular chip is 2005 era I think, and I would guess looks to be a sea-of-gates ASIC, with some unused "sea" around some edges (top left, bottom left), and the topmost metal layer over it having considerable left-to-right bias.  To the eye, this area looks like a flat diffraction grating; the traces must be very consistently spaced, and very consistently horizontal.  Alternately, the top-left and bottom-left areas might be some kind of memory array, but it seems maybe more likely that's in the bottom-right if at all?  Could also be some kind of processor, although I'm not sure quite how much functionality you can get in that much area

AFAIK, this chip was probably MPEG decoding, so I don't know that it needed all that much memory.  I wonder how many DSP cells it might use, if that explains the right-hand side blocks for example, or what.  The periphery looks to be a fair width, taken up by IO cells of various sorts I suppose, and the bond pads.

Reference:



Tim