Decapping and Chip-Documentation - Howto

[magic]

Another silly experiment: synthetic candle wax

1 hour at 280°C: no effect whatsoever
5 minutes at 350°C: no effect whatsoever

Conclusions:
Chemically, synthetic wax does nothing to epoxy.
280°C isn't sufficient to cause thermal decomposition.
350°C isn't sufficient to cause quick thermal decomposition.

Now I wonder how hot I got that rosin the last time when it partly etched the surface of the package. I didn't monitor temperature

On the upside, wax doesn't stain the glassware

[Noopy]

Another silly experiment: synthetic candle wax
...

Well an attempt doesn't hurt! 

[magic]

A small update about my standard thermal decomposition process.

Shortly after my first post in this thread I bought a dedicated soldering iron heater for this duty. I chose the cheap and ubiquitous A1323 heater for Chinese 936 clones, which is similar to my iron's A1321 but with steel body and higher power.



Manually PWM-ing a 24V power supply gets boring pretty fast and I wanted better temperature repeatability too. With a bit of experimentation I found that constant 12V supply produces just about perfect temperature, which smokes the chips nicely but doesn't cause the metal layer to melt. The temperature reported by the thermocouple inside the heater is some 600~700°C, depending on ambient temperature, airflow etc.

So the complete setup is: a 12V / 1A power brick driving a cheapass auction site soldering iron heater

For DIP packages I use a two step process. First, the DIP is placed on the heater and tied with its leads to thoroughly bake the bottom. Then the bottom is crushed and the leads yanked out, leaving me with the upper half which contains the die. This is trimmed a bit and baked again, such that the die lies directly on the heater and all epoxy in contact with it gets roasted well. A few minutes suffices for each cycle. A bowl with water is placed below to catch anything falling from the heater and cool it down to safe temperature. A bit of thermal shock comes for free. Sometimes it causes spontaneous separation of the die after step 2.

[Noopy]

Looks good to me! 

[magic]

Another silly experiment: synthetic candle wax

1 hour at 280°C: no effect whatsoever
5 minutes at 350°C: no effect whatsoever

Funnily enough, this transistor still works. It has about 300 beta and over 100V Vceo (that's maximum I can test). Not bad for what the markings suggest should be a BC857.

I also performed additional testing with rosin. I boiled this no-name 78L05 for over two hours at about 270°C. To avoid messing up test tubes I used a thimble tied to my soldering iron heater with wires.

Nothing happened to the chip, only the surface got slightly matte. This chip also appeared to work afterwards, but I only tested quiescent current and output voltage under no load. Then I cracked it manually to see if it got any softer - nope, it didn't.


Conclusion: rosin really requires crazy high temperature to work and absolute maximum ratings for storage temperature are only advisory

[Mortymore]

Christopher Tarnovsky's, Flylogic Engineering website used to have the best chip photos, but they are no more. 
They were taken by IOActive

EDIT: Some info on the man: https://www.wired.com/2008/05/tarnovsky/ (watch the video)

[GeorgeOfTheJungle]

Christopher Tarnovsky's, Flylogic Engineering website used to have the best chip photos, but they are no more. 
They were taken by IOActive

EDIT: Some info on the man: https://www.wired.com/2008/05/tarnovsky/ (watch the video)

WOW ! 

[Mortymore]

I was once interested in the subject, so I'll leave some literature that I read at the time, in case someone is interested also.

From Cambridge University, Technical report 630: Semi-invasive attacks – A new approach to hardware security analysis

https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.html

[magic]

Some fun with 98% sulphuric acid.

I started safe, boiling only one drop of acid at a time An idea based on the well known nitric acid process for live analysis. However, sulphuric acid appears less suitable for that. In addition to needing higher temperature, it tends to create a dry and brittle crust on the attacked surface. This crust is still strong enough that it can't simply be washed away, but rotten enough that on the next round the acid sinks into it and creeps all over the place instead of staying where it was put and doing the work. Everything turns messy and etching rate slows down so I cheated by scratching the crust away. This of course damaged the bonding wires, but at least I got a clean die after some hour of work

The above process is a PITA and kinda pointless given the destruction of bonding wires, so I did the next chip the Zeptobars way: just dropped it in acid and boiled until everything turned into black sticky goo. This was a TO92 package and it only took a few minutes of cooking and tittle acid. I used the same thimble and soldering iron heater setup as in my previous experiments and heater power was also the same, which should yield about 270°C. I didn't measure exact temperature for lack of suitable sensor. One may think that a metal vessel would be destroyed by acid, but in practice corrosion is very low. I will see how long it lasts. At least it isn't going to crack and shatter from heat like glass could do. I placed a steel bowl below to catch spills and overflows. Overflows are possible because the reaction produces plenty of foam and bubbles.

One of the gold bonding wires survived the whole journey and somehow remained attached, but on the photo it looks like bonding pads may have been etched away by acid. I will never know for sure because I crushed the die trying to remove it from the metal carrier Admittedly I was being sloppy and used water instead of acetone for cleaning, but I'm not sure if the pads made it even to that point.

Acid also proved effective against stubborn epoxy residue on dice extracted by heating. I managed to clean up a few of those.

[Noopy]

Interesting. Thanks for sharing. 

For me that´s too messy and dangerous. 

[magic]

On the imaging front, I built a simple beam splitter to experiment with illumination through the lens. It's a small cardboard box painted black to absorb reflections with a 45° angled half-mirror inside and a hole in one wall.

The half-mirror is a piece of a "mirror" protection foil for smartphone displays. These foils are supposed to make the screen reflective when the LCD is blank but still be transparent enough for normal use. It probably isn't exactly 50% reflective and 50% transmissive, but whatever, good enough for us.



The box goes on top of the lens. Light is supplied through the hole in the side, bounces off the mirror downwards, passes through the lens back and forth and passes through the mirror to be observed from above. Half of the entering light passes through the mirror and is dumped on the wall and half of the light from the lens is reflected back towards the illumination source, but 25% efficiency is not the end of the world.

I tried it in combination with my favorite HD webcam lens, a lousy VGA webcam lens and a 10x biological microscope objective. A few sample images follow.

The webcam lenses have enough magnification that one can simply use them as a loupe and look directly into the lens. Magnification is good enough for low density analog ICs and with the HD lens and with some squinting I can even follow the super-die-shrunk Chinese LM358 chips. The first two images show how the two lenses perform on a TI NE5532 die. My camera couldn't capture the full field of view visible with naked eye and the image turned out a bit dark, but it gives a glimpse of the resolution available with the HD lens.

The third image is the same but with the 10x microscope objective. Magnification is very low. This lens could only possibly be usable for photography, i.e. projection onto a camera sensor at a sufficiently far distance, or as part of a compound microscope with an additional eyepiece lens. Go figure

[Noopy]

And again: Very interesting! 

[magic]

New version. This time with a larger box that holds a webcam sensor board to enable viewing on a computer and taking pictures.



An improvement was necessary in the way that the part of illumination stream which fails to reflect from the mirror is "wasted". The light is still projected on the rear wall, but the larger box allows this wall to be farther away and hidden from the sensor's view. The camera PCB has its original lens tube attached and the tube blocks the light scattered by the "waste wall" from reaching the sensor, except for the part which reflects back exactly towards the mirror.

Another improvement is the addition of Köhler illumination. I hoped it wouldn't be necessary but it does improve contrast considerably by reducing stray light. The lens on the illumination entrance is so-called collector lens, because it collects light from the illuminator, refracts it and projects a focused image of the illuminator straight into the aperture of the main lens. This way all of the light which reaches the entrance hole ends up where it belongs instead of bouncing around inside the box. The collector lens should be at the same distance from the mirror as the sensor, slightly larger than the sensor and its focal length must be shorter than the distance to the main lens (or it wouldn't focus properly). At least that's the theory, in practice the distance is only approximate and I adjust LED lamp position empirically for best contrast.

This setup takes some decent quality images already and is relatively reliable, main problems at this point being precision alignment of everything for uniformity of focus and illumination across the field.

By reducing the size of the light source (a 3mm LED) I got this image of the Chinese RC4558 which appears even a bit more colorful than normally. Not sure what happens here.

[GeorgeOfTheJungle]

Nice!

[Noopy]

That's a nice construction. I like getting good results out of low cost designs!
I think some 3D printed casing would improve the quality a lot.

[magic]

I think some 3D printed casing would improve the quality a lot.

For real photography time is probably better spent figuring out how to put this (or a better?) beamsplitter between a real microscope lens and a real camera.

Better construction would improve flatness of focus (I think the bottom right corner of my 5532 image is a bit soft, for example), hopefully uniformity of brightness, and maybe contrast a bit. But you are still left with a high crop, low resolution and noisy sensor, questionable demosaicing (regular dot artifacts appear in a few places on my shots) and auto white balance and sharpening that cannot be controlled. My webcam also lacks manual exposure mode so it can't even be used for panorama stitching.

I made this webcam mod to test the beamsplitter concept and for direct inspection and reverse engineering. If some corner is a bit out of focus, I will simply move the camera or tap my finger on the PCB to realign it. BTW, a big nuisance is the USB cable which pulls on the board. I tried stripping the last 10cm of external jacket and shield or using a piece of ribbon cable for the last 10cm but this breaks high speed USB.

The lens is close to its limits too. I estimate my resolution at about 0.5µm/px and an f/2 lens resolves maybe a line pair per 1.5µm so I'm already sampling at 150% Nyquist density. Maybe some minimal improvement could be gained by doubling the pixel density, but beyond that there is no hope without a better lens.

[Noopy]

I have updated the decapping part in the Howto section of my website:

https://www.richis-lab.de/Howto.htm

I won´t translate everything. To tell the truth there is not much new information. But more coming soon... 

[Noopy]

I had done some tests with DMSO to decap epoxy packages and now here we have the pictures:

 


You get DMSO quite easy.
Don´t store DMSO too cold because it gets solid at 18°C.
Above 189°C DMSO tends to decompose explosively. This temperature can be lower if it is mixed with other chemicals.




A PTC heater guarantees that the temperature doesn´t go above 150°C.




The DSMO temperature seems to be a little above 110°C. A little bit more would be nice but too much is dangerous... 




I cooked two packages for two hours but didn´t see any change. The surface didn´t get brittle or soft or whatever. They looked like new parts. 
I won´t do more tests with DMSO (right now). Cooking packages for some hours in a solvent that tends to decompose is no good if you want to decap a lot of packages.


https://www.richis-lab.de/Howto_Decap_DMSO.htm

 

[magic]

I have always been skeptical, IMO professional labs wouldn't bother with acids if it really was so simple.

A possible alterative to those PTC heaters is a small 500W electric cooking stove and a triac dimmer. That way temperature is freely adjustable, but not actively regulated of course.

Safety of "interesting" chemicals can be improved by boiling a smaller quantity, just enough for a SO8 or similar chip.

edit
BTW, using the electric cooker I tested (again ) rosin and paraffin wax at temperatures which, IIRC, exceeded 400°C for many minutes. Really no effect besides lots of smoke. I still don't know how I managed to slightly erode that SOT23 package in boiling rosin last year, but it seems like waste of time to further experiment with it.

[Noopy]

I agree with you.
Probably DMSO would do the job with smaller packages, some more heat and a lot more time but that´s no good for me.
I would have done more tests if there had been some progress but I really didn´t see any change of the material.
By contrast with my decap furnance I can decap 20 parts in one hour. There are some losses/residues but that´s ok, it´s still a hobby.

[Noopy]

I won´t play with HF, but HCL is ok. So let´s see what we can do with HCL.






We had this BUX42 with an interesting metal layer:
https://www.eevblog.com/forum/projects/transistors-die-pictures/msg3545848/#msg3545848
https://www.richis-lab.de/Bipolar50.htm
The BUX42 uses the "wide-emitter narrow-contact" technique.




HCL can´t dissolve the SiO2 protection on the die but it can dissolve the Al metal layer. I used 18% HCL.






After two hours most of the metal is still ok since it is protected by the SiO2.
In the bond area the Al partly got dissolved. The emitter metal is thicker than the base metal. 




After three days and nine hours the HCL found its way under the SiO2.
On the emitter side the HCL is faster. That´s probably because of the bigger channel the metal layer leaves after the Al got dissolved.




After twelve days and seven hours most of the Al is dissolved.




In the dark grey area the metal layer had contact to the silicon. In the greenish area the metal layer was isolated from the silicon.






Near the bond area the SiO2 surface layer is broken down at some points.






Looking at the die on a shallower angle you can see the height of the gap the metal layer left.
You can also spot the lower SiO2 layer that partly covers the emitter area.


https://www.richis-lab.de/Howto_Decap_HCL.htm

 

[Noopy]

I won´t play with HF, but HCL is ok. So let´s see what we can do with HCL.
...
https://www.richis-lab.de/Howto_Decap_HCL.htm

HCL works well to strip the metal layer. It´s quite a gentle process... ...but be careful if you have a aluminium package! With a lot of aluminium you get a lot of hydrogen and heat!

[magic]

I remember experimenting with attacking aluminium using kitchen chemistry years ago. I tried at least vinegar and citric acid, possibly with an addition of salt, and some of the combinations were effective. A piece of aluminium foil was chewed into small fragments in a few days.

Now, ceramic DIPs. A piece of clay holds everything together while the top is heated with gas flame and lifted up when the glass seal melts. I smeared some glass onto the bond wires and got a piece of clay to stick to it, but otherwise it's a job cleanly done. The dried clay is not very tough can be chipped off with a small screwdriver.

[Noopy]

Looking good!
But the die has seen a lot of temperature, right? 

[magic]

I will try to take pics later but I saw no obvious damage looking under a strong loupe.

I'm pretty sure they have to melt that glass in the factory during production, so hopefully it has reasonably low melting point. And it's the top cover which is exposed to flame and receives most of the heat. I removed it as soon as it was possible.

LOL, I may even test if it works because bond wires still appear intact. It is one of my objectives to preserve the pins and wires so I don't have to guess what was connected to where.