Chip Decapping Adventure #5: Removing the top metal layer

Having successfully removed the top glass layer of the die with [Armour Etch], which [Amazon] says is NOT RECOMMENDED FOR CLEANING GLASSES! I proceeded to remove the top metal layer. First, a shot of the die with the glass still intact:

Following a recipe I found in the slides of Lecture 6 [PDF] from RPI's [Hardware Reverse Engineering] course for removing copper metal, I put the chip in a teflon beaker (it was small, so I used it) and added 6 mL of 3% hydrogen peroxide and 1 mL of 32% hydrochloric acid [DudaDiesel]. I could see bubbling coming mainly from the leftover metal of the leadframe, so I figured the solution was working. I left it for 5 minutes, then removed the chip, sprayed with diluted water, and sprayed with acetone to dry.

The result:

Success! You can see that the top metal layer is gone, leaving the glass underneath it. The bottom metal layer was not touched. Maybe because it is aluminum?

Here's an interesting feature, showing where a via from top metal to bottom metal was removed, and there is some glass around where it was:

And here is something I noticed while I was taking images after I thought the chip was dry:

That is probably acetone that leaked under the glass and is slowly being pulled out by drying in atmosphere.

Here is something that I'm struggling to make sense of:

On the right is the die before the top glass and top metal was removed. On the left is the die after. We can see that in two cases, the inner rectangles have expanded, and in one case it looks like an over-etch of glass. In the expanded cases, maybe this is just an optical effect from the glass.

Anyway, the chip is quite dirty. I did not clean it in an ultrasonic bath. Also, I think to get a better picture, I should try another round of Armour Etch to get rid of the remaining glass so that the whole image is clear. Hopefully this will not damage the bottom doped layer.

Chip Decapping Adventure #4: Removing the top glass layer of the die

When we last left our bumbling idiot back in Adventure #3, I had successfully decapped a plastic-encased die with hot sulfuric acid.

Just a note on this. Prior to sticking the entire chip in the beaker, I tried using a Dremel to gently shave away at the bottom of the chip to locate the die, then to cut the chip apart to remove much of the bulk plastic, leaving a "chiplet". I tried this four times on the same type of chip (same manufacturer and date code), and each time I ended up with a cracked die.

Crack!

Crack!

Each time I tried to change a variable: heat, ultrasonic, and so forth, but nothing worked. It was only until I put the entire chip in without Dremeling that I obtained a successful, intact die. Now, the wires on this die didn't seem thin and round. They seemed flat. So my theory is that the vibration of the Dremel was transmitted strongly to the die, causing it to crack while still in the plastic.

This is why I'll now always put the entire chip in rather than risk a cracked die.

Our brave individual now stumbled on to the next leg on the journey, The Removing of the Top Glass Layer!

Here is a stitched image of a 54LS244 from a ceramic package, after it has been cleaned in the ultrasonic bath. Rather than use a test tube in the bath, I used a plastic bag so that the chip wouldn't bounce around and get damaged. When I do this with a die from a plastic package, this is also the method I'll use.

A little dark in the lower left. I'll have to adjust the camera so it doesn't change shutter speed -- I had it on aperture priority.

A little dark in the lower left. I'll have to adjust the camera so it doesn't change shutter speed -- I had it on aperture priority.

You can see that there is a thick metal layer on top that obscures a lot of the detail. For example, this image is a closeup of the middle section:

We need to remove this metal layer. But first, we need to remove the clear glass layer that is on top of it. This is traditionally done with [hydrofluoric acid], which is also known as The Devil's Piss, and not in a ha-ha this is a fun alcoholic drink sense, but in the oh shit this stuff just got on me and now I'm going to lose my finger sense. It is incredibly dangerous: if you get it on your skin, you will not notice it because it is painless. It will eat through your skin without you knowing it and settle in your bone, and will then proceed to dissolve the bone from inside.

There is a product, [Eagle One Chrome Wheel Cleaner], whose [MSDS sheet] shows that it contains 5-10% HF. Apparently this is dilute enough not to cause instant regret. Of course, it has a lot of other crap in it, too.

I was talking with Ken Shirriff, and he mentioned just using glass etchant from any old art supply store. So I found [Armour Etch], which must be spelled with the UK ou spelling. The [MSDS] shows it contains, among other things, sodium bifluorite, ammonium hydrogen difluoride and sulfuric acid. Ammonium hydrogen difluoride attacks glass, and apparently sodium bifluorite plus an acid generates hydrofluoric acid, which also attacks glass.

I think with MSDS sheets, the company lists everything that might possibly go in the product. So for example, perhaps Armour Etch sometimes contains sodium bifluorite plus sulfuric acid, and sometimes just the ammonium hydrogen difluoride, depending on what costs less at time of production.

Anyway, I donned some nitrile gloves to make me feel good, and first dipped a cotton swab into the cream. I dabbed it onto the die and then rubbed it around for 30 seconds. The cream didn't last long. I did this again three more times, then sprayed acetone on it and viewed it under the microscope.

Ugh. Clearly the etch had some effect, but it was pretty random and sparse.

That Motorola marking has a disease of some kind.

That Motorola marking has a disease of some kind.

Next, I dabbed some cream on the die and left it for three minutes. Then I used a cotton swab to rotate the cream a bit to maybe replace the attacked glass with fresh etchant. Then I left it there for another three minutes, and repeated once more. Then I sprayed distilled water on the die, and then sprayed acetone to dry it. Finally, I examined the result under the microscope.

This was much better! On the top metal layer you can see some scuff marks, probably from the first attempt when I was rubbing with the cotton swab. There's also a piece of dirt because I didn't ultrasonic clean this before popping it in the microscope.

There may even be a small bit of over-etching, as evidenced slightly to the left of the middle of the image where there's some discoloration.

This is all looking very good. The next step will be to try some hydrochloric acid to remove the top metal layer. The hope is that the bottom metal layer is still protected by glass. If not, it is probably not a big deal, since we can see the outline of the bottom metal layer through the top metal layer anyway. It's the doping areas that really need to be uncovered.

But that will have to wait for the next step of the journey, Adventure #5.

Chip Decapping Adventure #2 and 3

Having determined that decapsulating integrated circuit packages by resin works but is very time-consuming and energy-intensive, not to mention difficult to clean up after, I decided to investigate two other techniques: ceramic package decapping by heat, and plastic package decapping by hot sulfuric acid.

Also I should note that the techniques I've explored are not suitable for live die analysis. These techniques (possibly the heat decapsulation but definitely the hot sulfuric acid) break the bond wires. I am only interested in dead dies because I like to photograph and reverse-engineer them.

Adventure #2: Heat decapsulation of ceramic packages

This turned out to be almost trivially easy. I also made a video about it.

The equipment needed is:

  • A vise with no plastic or paint on it. I used a toolmaker's vise ([HFS Precision Toolmakers Vise 2-1/2"], Amazon, US $61) because I needed it for other machining projects, but you can get any cheap uncoated vise.
  • MAPP gas torch (Bernzomatic TS8000KC Premium Torch Kit, Home Depot, US $51). MAPP gas reaches 2000 deg C in air, so is beefy, and better than the crappy little propane torches I tried. The refills are also pretty cheap.
  • Pliers.
  • A piece of aluminum preferably 0.3 inches by 0.6 inches to act as a support for the chip.

Place the chip straddling the aluminum, then clamp its pins in the vise. You should be able to take the pliers and grab the top of the chip firmly. Now (taking away your pliers!) fire up the torch and using the very tip of the flame (not the hot inner part), heat the chip for 20 seconds, moving the flame around to cover the whole top. If the pins glow red, that's fine.

Now quickly turn off the torch, grab the top of the chip with the pliers and just flip it over. That's all it takes.

Note that I cut off the pins afterwards so I could photograph the die more easily.

Note that I cut off the pins afterwards so I could photograph the die more easily.

 

However, this technique does not work with plastic packages, only with ceramic packages. And, it may not work so well with packages that have windows in them, such as for EPROMs and other UV-erasable devices, since the glass may melt onto the die. In that case, you might try just whacking the seam with a chisel and hoping.

Adventure #3: Hot sulfuric acid decapsulation of plastic packages

Now, you don't have to do it the way I did. You [can do it] with just sulfuric acid, a test tube, and a heat gun.

For this, you will need:

  • The [DIY fume chamber] I posted about earlier (US $320 or so, including a fan and ducts).
  • 98% sulfuric acid (Duda Diesel, 950 mL, US $13 + 10 shipping). Order this well in advance. Because reasons, this chemical ships FedEx ground, and it took 10 days to reach me.
  • Acetone. You can pick this up at the hardware store (US $13/gallon = $3.50/L). It doesn't have to be high-quality. I bought mine from Duda Diesel (because I was buying from them anyway, $8/L 99.5% purity).
  • Some flasks and beakers of different sizes. I used a 50 mL flask, a 150 mL flask with a glass stopper, and 50, 100, and 200 mL beakers. I found a set of 5 Pyrex beakers of different sizes from eBay (US $30 shipped) and the flasks I got in a set of 5 of different sizes from Amazon ([213B2 Karter Scientific Glass Erlenmeyer Flask 5 Piece Set], US $17). The glass stopper was from a large kit, but it was a 24/40 stopper and you can get [five for US $12].
  • Two 1000mL safety wash bottles, one for distilled water, and one for acetone. ([eBay, Karter Scientific 217H1], US $6 each).
  • A bag of 3mL plastic pipettes ([eBay], US $6.50/100).
  • A laboratory hotplate capable of at least 300 deg C (eBay, US $60 shipped).
  • A glass thermometer capable of at least 250 deg C (eBay, US $40 shipped).
  • A box of disposable nitrile gloves (hardware store, US $8/25 pair).
  • Tongs for holding hot flasks. I used a test tube clamp ([Amazon], US $7) but I'd prefer something with a little more grip.
  • Tweezers.
  • Baking soda for spills.

The procedure I followed was this:

1. Put the entire chip in the 50 mL flask and place the flask in the fume chamber. Do the rest of this in the fume chamber until I tell you to stop :)

2. With a pipette, add 20 mL sulfuric acid.

3. Put the flask on the hotplate and add thermometer. Turn the hotplate on high.

4. Watch the thermometer. At around 90 deg C you will see some black come off the chip. As the temperature rises, the contents will become more and more black. At around 130 deg C you will see fumes in the flask. At this point, lift the flask with the tongs and swirl gently, then put back on the hot plate.

5. When the temperature reaches 200 deg C, lift the flask and swirl gently. Don't put the flask back on the hotplate until the temperature dips a few degrees below 200 deg C.

6. Wait for the temperature to reach 200 deg C again, and repeat for ten minutes.

7. After ten minutes of doing this, remove the flask and set it down to cool. Turn off the hotplate.

8. When the solution has cooled to around 70 deg C, remove the thermometer and slowly decant into the 50 mL beaker. The dregs left in the flask will contain metal bits (pins and lead frame) and the die.

Dregs.

Dregs.

9. Pour the contents of the 50 mL beaker into the 150 mL flask. Stopper it. This is your used acid collection. It can be used a few times.

10. Add about 20 mL of distilled water to the flask. Try to get the sides of the flask also. Swirl it around. Slowly decant into the 200 mL beaker. This is your very dilute acid collection.

11. Repeat the above step: a second washing.

12. You should now have a bunch of metal bits and a die in the flask. You can now take the flask out of the fume chamber.

Washed dregs.

Washed dregs.

13. Add about 10 mL of acetone to the flask. Try to get the sides of the flask also. Swirl it around. Slowly decant into the 100 mL beaker.

14. Repeat the above step: a second washing.

15. Pour the acetone from the 100 mL beaker back into the flask, then dump out the flask briskly back into the beaker. The die should go with it. The only reason to do this is to make it easy for you to use tweezers to pick out the die. 

There it is!

There it is!

Above is my setup in the fume chamber. Approximately from left to right: hotplate, 50 mL flask and thermometer, 150 mL flask and stopper with used acid, bottle of sulfuric acid, test tube tongs, 200 mL beaker of watery acid with some used pipettes, 50 mL transfer beaker, an aborted experiment involving a Buchner filter, wash bottle with distilled water, and baking soda for spills.

I haven't covered a few things. For example, you could put the die in an ultrasonic cleaner and clean it. That involves putting some acetone with the die in a resealable plastic bag and running the ultrasonic cleaner for a few minutes. This gets rid of dust and specks and stubborn bits of plastic.

I also haven't covered disposal. To the watery acid, you can add baking soda carefully until the pH is neutral, then pour down the sink. I'm not sure what to do with the used acid, but I am going to try to distill it back to usable acid again. The acetone can probably be diluted and poured down the drain, or just set outside to evaporate.

Where next?

Now that I have the capacity of decapping dies from both ceramic and plastic packages, I'm starting [The 54/74 Project]. This will involve collecting and decapping many different kinds of 54xx and 74xx series logic chips, and photographing and reverse engineering the dies. The project page is on the siliconpr0n site, possibly with alternate pages at the Internet Archive.