Thursday, September 22, 2011

Why basic logic chips are bad for beginners

For a while I was making a big push to try to decode a basic logic chip such as a CD4001 or a 7402/74HC02 sort of thing. The justification was that they would be very simple to analyze because:
  • Feature size is large
  • Simple logic function
  • Many examples of the same chip to compare
  • Inexpensive
  • Non-CMP: can help to see layers
However, I've come to the conclusion they are actually rather difficult to analyze over larger chips for the following reasons.


Highly irregular transistor size

On modern chips transistors have to be cookie cutter sized in certain processes not to mention they are often used in standard cells. Even a more custom chip like the Intel 4004 has somewhat irregular transistors but they still tend to be pretty limited in size.

Basic logic chips have irregular transistors for several reasons. First, due to low transistor count, every transistor gets loads of attention. They will be molded and shaped almost like an analog chip instead of a digital chip


Less data to work with

Having fewer logic functions that you need to figure out also means that you have fewer to use as examples. I did mitigate this a bit by decapsulating several since decapsulation time / photography time isn't too bad for SMD versions.


Use of less common technology

This isn't necessarily bad in itself as it gives you more breadth, but it can still get in the way. For example, CD4000 uses metal gate which are interesting for historical reasons but not used on typical modern chips. 7400s are similar since most modern digital chips don't use bipolar logic.

To hammer on this point a bit more, lets move on to...


Use of power transistors

This one is really the killer since it makes the chips really different. Even microcontrollers will beef up output transistors, but nothing like you'll see on these chips. Heres something more or less like a textbook MOSFET:


Metal gate which isn't quite so common, but you have a clearly visible source gate and drain. This is what I was hoping to see and to be fair I did find two chips like this (above is from a Fairchild CD4011). Heres an example of a transistor for a Texas Instruments CD4001:

Top metal:

And delayered with HF (same chip, not the same die):


I saw some structures like this and thought they might be diodes since I figured they were forming a PN junction. However, if you read this you'll see that these are probably actually power MOSFETs and in particular Vertical Diffused MOS (VDMOS / Double Diffused MOS (DMOS)).

Its also worth pointing out the first image was taken on a Unitron N + Aus Jena (Zeiss) objectives with 3.2 MP point and shoot while the latter was taken on a Mitutoyo microscope + Mitutoyo Plan Apo objectives with an 8.1 MP AmScope eyepiece camera in case you are wondering why the latter looks so much better.


Conclusions

So what would the best chip to learn on be? The Intel 4004 is a really great example since it has so much documentation and Flylogic has provided very nice images. On the downside its not something you'd want to do yourself since a 4004 might cost you $150 or more. There are plenty of similar less expensive chips of that scale though that should have similar value.

Wednesday, September 14, 2011

Understanding the Intel 4004

I have a new microscope that yields way better images than anything I had before, but, unfortunately, I'm having some difficulty getting a camera hooked up to it nicely. In the meantime since I still have images from other sources I thought I'd take some time to go through some parts of the Intel 4004. Flylogic has a similar write-up. This hopes to got a bit deeper especially showing how you can use tools to scale this up to analyze the/a full chip.

This article will use data from a variety of sources. The first is the Intel 4004 35th anniversary page which I like since it explicitly lists material as Creative Commons Attribution-Noncommercial-Share Alike 3.0 License. They also have a composite image (this is the author of the 4004 website so I presume its under the CC license?), schematics, and other assorted information. Datasheet and user manual can be found on Intel's website. I got the masks from FPGA-netlist-tools and read them in CIF format, specifically this file. if you don't want to load this up, you can find the original here. Finally, I'm also going to use a few small excerpts from the Flylogic top metal image and the Flylogic delayered image which I think should be fine under fair use but will take down if they would rather not have them here. I thought Intel had some CC or related images (had maybe even contracted the Flylogic) job) but I can't find those now. If there are no freely available images, if someone wants to donate a 4004 I could release some under a free license of your choice (or three if you have a million: one top metal, one delayered, and one for my collection!).

According to Wikipedia, the 4004 is 10 um pMOS which I was also able to verify on the datasheet ("4004 SINGLE CHIP 4-BIT P-CHANNEL MIROPROCESSOR"). This is similar to the NMOS logic I used in my JSSim inverter write-up except with the polarities reversed. Example PMOS inverter here.

However, I started getting a little confused as I started to look through things. Lajos describes pull-ups when I would expect PMOS to have pull-downs. Looking at various circuits, I also see what appears to be pull-ups. This confused me since I was thinking something along the lines of VDD = +5V, VSS = 0V with non-TTL compatible I/O (I didn't think through if the body connection is correct polarity, probably best to ignore it):


However, this doesn't really work since people would expect TTL compatible and this doesn't mask what I'm seeing in the mask as noted above. However, after looking at the user manual I found this:

Which shows that VDD = -10V and VSS = +5V which allows it to preserve TTL-compatible I/O. It was paired with this summary diagram:


The input stage shows why they want the +5V VSS: it provides the negative bias to trigger the PMOS input at 0 V while still allowing the pull-up to supply negative power for the input = 1 case. I was told that if you think of the circuit in terms of VDD, VSS, etc rather than actual voltages it should be more or less identical to NMOS logic. However, my understanding is that the depletion resistor is wired middle to bottom instead of middle to top so to speak as above. I don't have a good enough understanding of depletion modes to really know why this is the case.

That cleared up, lets see an example. I decided to look at the upper left hand corner because it was convenient. Cross referencing with the schematic a particular signal such as TEST might have been more logical if I was following the schematic rather than focusing on the masks. Here's the metal mask with VDD and VSS highlighted as well as an upper left hand corner area that I'll look at later in orange:


And a complete version also marked, but without VSS/VDD highlight:


Lets start with a theoretical closeup. Here's a dump from my CIF rendering:

The red (okay so its pink, otherwise I had opacity related rendering issues) is poly, the green is diffusion, the blue is metal (VDD), and the black are contacts. So we have two contacts tied to VDD and one going elsewhere which forms our pull-up. Note that you might have a self aligned gate for an enhancement MOSFET, but for depletion the entire area is diffused for normally on behaviour. This is what it actually looks like (Flylogic) in metal:

If the poly had blocked the diffusion we would not have seen the diffusion squiggle inside of the poly area. If they poly and diffusion masks were reversed, we could still tell that they were layered vs blocked since we can see a change on the squiggle exit rather than a solid line. And after delayering:

The poly and diffusion look almost identical. Fortunately, with whatever microscope technique they used (DIC maybe?) they get some good contrast between the traces and the background. I can't say for sure why it discolors where they meet, maybe just minor stress due to proximity.

Okay, but one transistor is the middle of nowhere is kind of hard to follow, so lets take a look at some of the nearby pins and see how it fits in. The upper left hand corner ties in the CM RAM 0-3 pins increasing clockwise starting with CM RAM 0 and 1 on the left and 2 and 3 on top:


These pins essentially provide the chip (bank) selection outputs to the RAM chips (4002). Since you can operate the system with a single 4002 this is an optional pin. Nonetheless, its fine for demonstration purposes. Lets arbitrarily focus on CM-RAM 0. Detailed picture of its layout:


The first thing I did was label all of the transistors that looked like they were involved in this input stage:


There is an identical input stage above that shares a small bit of poly with Q4 (diffusion just visible), but this does not influence us so ignore it. I then created a schematic with transistors arranged like in the above:

This is fine for layout capture, but a little ugly to read. Lets rearrange it to something a little nicer:

And then simplify by converting transistors to resistors where appropriate:

Cross referencing against Lajo's schematic:

They are equivalent. I'm particularly happy with this because this would have taken me a long time before but I got this pretty quickly and without having to fudge anything.

Okay, but that's only part 1 where we've managed to reverse the mask into the schematic. For part 2 is we need to see if we could figure this out from just the optical image. Here's top metal:



And delayered:


Which I've just roughly cut by using a box select + copy/paste from the full size images. I could of course work with the full size images, but they are large enough that they take up a significant amount of memory.

Anyway, I then imported them into Gimp by creating a new, slightly oversized canvas (700 X 700), importing them as layers, and setting their opacity each to 50%:


You'll notice the two images aren't quite aligned. This is why I wanted the oversize canvas as it allows me to move them around. Move them around until they line up. I should mention that I am by no means a Gimp expert, so don't take anything I do as to be the best was possible.

Next I created a layer for each mask. Since its difficult to tell buried contacts from contacts just by looking, I just created a single contacts layer (there there aren't any in our example). Since metal is very clear and un-ambiguous, I started with that by turning opacity back off and hiding the delayered image.

Press B to select the path tool. Click around a metal segment to form a polygon, remembering to click on the start portion to close it. You should now have a dashed line around your metal segment:


Then press shift-V to convert the path into a selection. Then press shift-B to select the fill tool and select a color (I used blue). Finally, fill the color in by clicking the mouse on the selection and then de-select your polygon by press ctrl-shift-A:


Make sure you put it on the metal layer by toggle show/hide for the metal layer. I believe this is the technique that was used to create the masks for the visual-6800 (plus a tool that converted the masks to JSSim input). A few tips:
  • You don't have to de-select the previous path. Just start working on the next one after fill and previous will automatically de-select when you convert it to a new path
  • You don't need to close the polygon. Last and first points will be assumed to be connected
One metal is done contacts are good to do next. As we saw with the original pullup, diffusion and poly can be difficult to tell apart just by looking at them. However, we know that IC designers have specific goals, so we can use those to figure out which is which. That said, some ICs are obfuscated, but we'll ignore that for now. Poly will usually cross diffusion areas. In particular look for it jutting out to complete a diffusion cut-off. That said, in the Flylogic 4004 example poly tends to get a lot of brown discolouration while the diffusion does not.

My first cut looked like this:


A few issues:
  • Need to figure out how to make level paths in Gimp so that it looks nicer. Right now it looks more like a kindergarten or abstract art drawing
  • The bit of diffusion that forms the pullup is not connected. Cross referencing with the masks, it is suppose to jut out to the side to go to a buried contact / via stack. However in the image it looks pretty clearly to NOT do that to me as I clearly the the edge of the diffusion. Maybe I'll get some feedback to clear this up
  • I also made an error with some poly to the right of this going to a buried contact, but this is visible in the images and a double check would have caught this. I also cared less since it wasn't part of the circuit I was analysing
  • What is the stuff under the pad? Maybe diffusion, but its not in those masks. There is a matching passivation mask but that should be on top and this is on the lower layers
This is close enough to the original that I think I could have derived the same schematic although maybe with low confidence on the pullup part. The rest of the chip can be decoded be continuing this exercise.

Hopefully this served to augment the Flylogic article and not just repeat it. In any case it helped me to make sure I really understood it.

Monday, August 8, 2011

Probing sneak peak

I was going to hold off on this since its a bit premature, but since Hyna wanted some details on what I was hoping to do for a probing station here is some quick info.

Since this is still just a part time hobby for me, I didn't want to spend too much on a probe station and waited patiently (course of a year or two of saved eBay searches...). I picked up several micropositioners for pretty good deal but had a much harder time finding a halfway decent probe station inexpensively. My goal was:
-Under $500, especially if it didn't have a microscope
-Have XY axis
-Have a solid platform for mounting probes
-Either have a microscope or not be too much trouble to add one

With that in mind, I eventually found this


Which was decently within budget and even had a Nikon microscope of sorts. The base is pretty solid which was the main thing I was after. The plugs (not visible) happily fit my micropositioners.

Unfortunately, the microscope is not in the best condition and not made with high quality components. However, there is a lot of mounting support and so I kept my eyes peeled on eBay for something I could replace it with. I was looking for something like a Nikon Optiphot since I knew a few people use that with good results. Eventually I found this:




the core of an Olympus BHMJ which seemed like a good match since you can mount it with a boom stand like on mine. It seems well cared for and in good condition. Before purchasing I did some measurements on my station and cross referenced some Olympus documents and was under the impression that the post was even the same diameter. Unfortunately, this turns out not to be the case, but I have access to lathes and so can make a new post without too trouble if I allocate some time for that. This is more of an industrial class microscope that I can buy numerous accessories and high quality optics for as I want to upgrade. I need to take a picture for comparison, but these are 25 mm compared to the standard ~20 mm thread RMS objectives most microscopes use.

You may have also noticed that the microscope didn't include an illuminator. However, I have one in the mail and should soon be able to do a test drive. The Nikon parts are not compatible, but the Nikon lamp setup was pretty bad anyway.

I also might want to switch out the stages for something more accurate. I use to play with lasers and so have a pile of optical quality micropositioners. On that note, you may have noticed the odd orange cord wrapped around the microscope. For some reason the camera port is loaded with a colminator with an FC fiber port + fiber. The exposed end of the fiber is in poor shape, but fiber is relatively inexpensive if I want another. I am not entirely sure what purpose it served though. I asked someone in the photonics business and he mentioned he'd used similar equipment for testing at his facility. I have some YAG lasers...maybe could be retrofitted for microsurgery?

I may look into getting a trinocular head to mount a camera. In the short term though I can put my camera in the eyepiece.

I also decapsulated a chip with some RFNA the other day with good results. For a sneak peak see https://picasaweb.google.com/JohnDMcMaster/First_rfna_decap?authuser=0&feat=directlink but otherwise I'll wait until I can try a second chip and do a more careful job (although the first chip did work, shown below "blinking" although all you can see is a solid on LED)


Edit: some more sneak peak https://picasaweb.google.com/JohnDMcMaster/Ic_live_analysis_08142011?authuser=0&feat=directlink

Sunday, July 10, 2011

A less simple experiment with JSSim

In short:

This post builds on a previous post where I described how to manually build a NMOS clock driven inverter in JSSim. It gave this (see it live):


I concluded by saying I was going to look into automating it and here's the first cut. I tried poking around for tools to automatically convert image files to JSSim files. They seem to either be not fully automated, don't exist, or are squirrelled away somewhere where I can't get to them.

The squireling possibility comes from that I would find it hard to believe that someone actually typed up all of the content in the *.js files. They are difficult to read as is (polygons are position dependent x/y coordinates in a long array) and it seems it would be error prone and tedious to generate that much data from the image files. That said, it did take them a large number of hours to complete the 6502 and it may not have been worth it.

Quietust wrote a toolchain more recently that you can find at here (my sandbox copy on Github). Since it only appeared recently it could not have been used to generate the 6502 meaning there is still a missing link even if there is an alternate route. I messed with it briefly and could not get it to parse my input SVG files. I've since learned more about SVG and probably will have a better idea of why it couldn't parse them (SVG is a huge specification, can specify a rectangle as a rectangle, polygon, patch ,etc), .

Finally, the first point that they are not fully automated comes from the fact that FPGA-netlist-tools. This toolchain is centered around producing synthesizable HDL from a variety of sources (images, JSSim). It has some good tools that pull in a lot of support from Magic VLSI, KLayout, Icarus Verilog, potrace, ImageMagick, gdspy, scipy/ndimage, and more. For example, I was impressed with how little code masks_to_netlists.py (136 lines including comments) used to create netlists from chip images. I was told that it may be possible to convert the output into JSSim files but haven't thoroughly explored it yet. It might not be too much work but I do need to learn more about various EDA CAD formats (CIF, GDS, spice, tech, etc) to figure out what I need to do.

Ultimately I decided I'd rather see how hard it is for me to do it with what I had available and then add support, rework, and integrate with the other tools as I learn more about them. I probably learned a lot more about for example, SVG format this way than I would have by blindly using the other tools/libraries.

For my test case I started by redrawing my image in Inkscape:


after deciding SVG would be easier than a raster image (ex: .tif) to parse. I tried a few conversion utilities with the following results:
  • Open .tif in Inkscape and save as .svg: .tif embedded in .svg, not useful
  • Convert using ImageMagick "convert" utility: created an element for every (non-white?) pixel. Impractical
Fortunately my chip isn't large enough where re-drawing is an issue. FPGA-netlist-tools seems to use potrace with good results for this type of conversion. I'd like to experiment with FPGA-netlist-tools and/or potrace directly in the future to see what I can leverage.

In order to convert an image into decent JSSim code you need to do the following:
  • Render polygons to screen in correct layer in correct net
  • Figure out net connections: which components are connected
  • Identify transistors
  • Identify pullup resistors
  • Identify net names for inputs (and potentially outputs too)
You should also do the following although they aren't critical:
  • Provide transistor geometry. Its used to find transistors which isn't used in main simulation
I wrote the tool in Python and somewhat arbitrarily chose "xml.parsers.expat" to parse the XML. I'm not sure if I could have leveraged anything by using a more integrated SVG parser. One thing I found I had to be careful with was how SVG / Inkscape liked to throw viewports around which led to nested coordinate corrections.

Rendering the polygons is fairly straightforward input to output conversion. After a small bit of research I decided to use Shapely's libgeos GIS library Python bindings for polygons. My simple SVG files were only rectangle, so I only had to parse rectangles. My core engine is built on polygons though and does work with them as demonstrated by the fact that I was able to merge rectangles into single polygons. However, since I drew the polygons as rectangles, I had to combine them. Otherwise you get results like this:



The alpha transparency on the metal doesn't overlay well and shows the underlying construction. I eliminated this by simply using a polygon union function on intersecting polygons on the same layer, replacing one of the polygons, and removing the other. You may also observe the image is upside down. SVG uses an upper left coordinate system and JSSim uses a lower left which means final conversion requires a horizontal flip.

Nets were decided by first assigning each node to a net. I then merged nets when one of the following happened:
  • A polygon intersected itself on the same layer
  • A via intersected diffusion, poly, or metal
Nets were then renumbered for the final output rather than trying to eliminate holes during the merge process.

I thought transistors were going to be difficult to identify but it turned out to be rather simple at least for this simple case. Transistors occur when two diffusion regions are separated by a poly gate (or metal gate for old school CMOS, but uncommon and not supported right now). I expanded each diffusion and poly polygon around its center of mass by a few pixels to find near neighbors and plotted the intersection (plotted using Tkinter):


I'm not sure how this method will scale but will see as I try it out on actual chips. In particular it will only accept the match if there are two intersections but I could easily imagine two gates being controlled by the same poly segment. I'll have to add some arbitration logic to sort out the connections if/when that becomes an issue. With two diffusion nets and a polygon net, we now have the two connections and the gate nodes respectively. I'm currently using the entire poly segment as a rough approximation of where the transistors is but maybe a better approach would be to try to protect between the two intersection polygons.

Pull-ups aren't that hard to identify once the transistors are identified. A pull-up requires the following:
  • One connection to positive voltage / VDD
  • Other two connections shorted together
Simply iterate over the transistors and mark the doubly connected net as a pull-up net.

Finally we have to identify the net names for input and output so that we can actually play with the chip. FPGA-netlist-tools specifies node names as a text file with the various coordinates and names specified in the file. However, I figured I could take advantage of SVG's being able to store text and place that information directly in the layers. From a conceptual standpoint I look for the intersection of the textbox polygon with a net and label that net which is similar to the point concept. This seems fair to do for the following reasons:
  • Most important signals are on the pads which typically don't have wires running under them in a non-flip chip padframe
  • Current chips don't have enough layers that they can't be unambiguously identified. In theory a very dense chip could have multiple metal layers that make resolving which layer we refer to ambiguous
  • Could potentially allow layer specific labels if there were collisions which would allow unambiguous identification. Alternatively could put some markup in the name such it gets identified. For example, instead of "clk0" put "metal2:clk0" to say that clk0 belongs to metal2 which would otherwise be ambiguous
Here's an example showing the text boxes (displayed using a rendering glitch in gthumb):


You have to careful though since text boxes can be much larger than the text. For example:


If this box was any bigger it would have hit diffusion and caused issues.

When the tool runs it looks for layer files in the current directory and spits out *.js. Running in JSSim (see it live):


We now have straight polygons! Mostly anyway. Zooming in:


In particular you'll notice this since it makes segdefs.js larger with the extra 2 points we added. If you look back at the non-merged metal it should be pretty obvious where this comes from. If I care to remove this I'll have to implement some sort of smoothing function to remove points close to each other.

My next step is to try to convert some of the chips in FPGA-netlist-tools into JSSim chips. I believe polygon intersection is somewhat computationally expensive and may have to implement a quadtree map for efficient large scale operation.

Until next time.

Epoxies

Plastic chips come in a variety of epoxies. Some sample chips:


Chip 1 was in acid for a short amount of time so its not a completely fair visual, but it looked about the same before going in. Anyway, In order of increasing glass content, these chips are 2, 3, 1. 3 is a PDIP-40 Microchip PIC, 2 is a TI chip, and I forget what 1 was although I'm tempted to say it was made by ST. Chip 1 decapsulates very qiuckly, 2 is what I'd call normal or a little better, and 2 is difficult. You can see what 1 looks like being in acid for a few minutes, here's what 2 looks like after sitting for a while (with 1):


It forms a hard sediment at the bottom of the beaker instead of really breaking up. There's so much epoxy that acid soaking in actually become noticeable instead of the chip breaking up like usually happens.

1's surface looks like this under a microscope (maybe 10X):

Notice all the junk in there. It makes dissolving it much easier since not only do we not have to dissolve that stuff, but it falls out, pitting the surface and making it corrode faster.

Here's the side of 2:


Interesting that the top and bottom look a little different, I'm not sure if its related to it being hard to dissolve as I haven't got a chance to compare it to similar chips.

And here's 3 (maybe 10X):

You can see some particulate in there (maybe not as apparent in this lower res picture?) and its lighter in color than the 2.

To finish off a few things not related to epoxies but came up during this. This thin package had the die close enough to the surface that it actually managed to poke through long before the package was dissolved:


Also when you do a large lot you get a pile of that junk leftover:


I use to use HNO3 to get rid of it, but it tends to dillute quickly and dilute HNO3 attacks aluminium. Fortunately its unlikely that you'll need to decap any valuable chip in volume so you can safely just pick these out with tweezers for most chips. I'm afraid of the chips scratching but the passivation is pretty strong.

Until next time.

Monday, July 4, 2011

Preparing for live analysis

I have a probing station on the way and am going to try to start learning about live analysis because it will allow me to confirm my understanding of chips. That is I'll predict the state, apply voltage, and then check the levels on the chip. Later on it will of course be useful for numerous applications (probe lines, change signals, etc).

My very first attempt was using 70 % HNO3 on a hot chip a while ago (maybe a year?). Rinse, repeat until exposed. Unfortunately, this method is very slow and takes about an hour of work for a PDIP. Even if you don't care so much about your time, so many handling cycles is dangerous for the chip (thermal stress, break bond wires, dissolve Al, etc).

My next attempt which I only partially went through with was an attempt to automate the above a little. I Dremeled a hole in the bottom of some glassware and filled a beaker with a small amount of nitric. It was then RTV'd onto the surface of a chip and the whole assembly heated. Early results were promising, but its somewhat dangerous if you run out of RTV before the chip is done. Additionally, you can't see the chip's surface so cannot gauge progress easily. I was also left with some residue on the chip. I'm not sure if it was from improper cleaning or more than usually since it was all pooling into the acid cavity.

I didn't go back to this for a while mainly because without a probing station it wasn't a good use of time when I could just throw the chip in an acid bath with much less work. I've recently been moving onto more complicated scenarios and now consider live analysis to be a key objective for the reasons stated at the beginning. However, I value my time and don't want to spend a lot of time putting drops on a sample or dealing with RFNA for assorted reasons. Professional shops use decapsulation machines that squirt acid jets. Could I do something similar?

I started to think and I decided the first thing I should try is to see if I could build an automatic decapsultion with equipment I had. I had a rusted out peristaltic pump which seemed like an okay place to started. I gave up on the motor and rigged up a flexible shaft to it. See it in operation here.

This fed an H2SO4 from the bottom of a beaker which was to squirt a chip on a raised platform in the same beaker. I knew someone that said UL would approve anything, but probably not this. The machine was flat out hazardous for the following reasons:
-Exposed spinning shaft
-Pressurized heated acid on surplus / scavenged parts
-If the acid flow was uneven it could stress the glass and break it

It also suffered from some practical problems:
-I could not get the acid hot enough. I guess a combination that the glass insulated the chip too much and the acid cooled too much (although it was still pretty hot) before it reached the chip
-My platform was just an inverted beaker (inside a larger beaker) and the chip could easily get knocked off

I'm not a man easily defeated though. I spent some time to think about what I could do better. I got some PTFE beakers which I drilled out to make PTFE baskets so that I could take chips out of acid baths easier. Probably a short post on that at some point. It got me thinking: although I couldn't machine / shape glass very easily, I could easily machine PTFE. My goal was to make an assembly that would shield the chip from the acid except for a milled out impression where I wanted it to etch. I ordered some stock, ordered some PTFE bolts, and already had a PTFE sheet.


Before chips can actually be used, its a good idea to mill out a cavity (I used 3/16" (0.1875") TiN coated endmill for 0.3" pitch) so that the die will be reached much faster. Make it less wide than your chip so that you don't collapse the lead frame from excessive etching on the sides. Professional shops x-ray the chips, but you have a few options:
  • Rule of thumb: mill halfway to the top of the leads
  • Sacrifice one to find where the bond wires are. Might be worth it if you have a pile of them, although it still will probably only be an approximation
  • Don't mill it at all if its very thin. Certainly shouldn't be your first sample though as you'll have more issues with the lead frame collapsing
  • Some professional units short all of the pins and wait for continuity to the bond wires. I tried putting some water in the cavity to help detect when they were getting close, but could not do it reliably
In any case, inspect after milling. Try adding water to make bond wires more apparent.

When I was experimenting with the continuity method I got sloppy and didn't pay attention to depth. The endmill hit the Si. While not dangerous to the user, it did ruin the tip by dulling it and taking off the TiN coating (as a reference, silicon is 7.0 Mohs hardness but even titanium is only 6.5) Afterwords packages would heat up instead of being cool to the touch. I'm also told that excessive heat can burn the epoxy and make it difficult to dissolve although I haven't seen this yet. Healthy endmill that went too far:


Dull endmill that went too far:


You can see the wires are more smeared around than cut. For example, in the first image you can make out the bond wire arc cross section but they are more scattered around in the second. Both will still feel pretty sharp to the touch so I'd reccomend you start with a new endmill or be very careful. Another problem with using a dull endmill is that it requires more pressure to start a cut. You need to take off very thin slices and a dull endmill will tend to "bite" and then take a larger slice out. I had good luck using a sharp endmill in a breadboard. The breadboard / pin contact provided a small spring factor which allowed very slow, precise cuts. Additionally, I was able to place it back into position after inspecting depth.

I assembled my piece and lowered it into a beaker after milling a small cavity into the top of a PDIP. To avoid letting the epoxy slag accumulate in the cavity, I put it into the beaker upside-down. This aspect seemed to work rather well. Unfortunately, a few things didn't. First, I misunderestimated PTFE's thermal expansion coefficient. The block expanded a fair amount and wedged itself up against the glass. I feel lucky that it didn't break. Second, related to the first point, PTFE becomes soft at higher temperatures. This had two effects: making the gasket droop down, breaking the seal, and shearing the bolts from the added stress and being softer. Another thing that I did was to tack the chip in place with RTV. Initially I used just a small amount, but I tried to fill it in after seeing the gasket wasn't going to hold the chip in place. I then went so far as the flip the assembly over, but this caused the predicted slag problem. Although there was a clear separation between the epoxy that was still part of the package and that which wasn't, it couldn't be removed without destroying the fragile bond wires. Finally, the larger volume of RTV was significant since it got attacked more readily than the epoxy.

Although it didn't work out, it was a step in the right direction. The PTFE bolts were kinda expensive though so i was a little bummed about that. What if I just made a sold piece? I could prevent circulation at the top by not filling the bath above the top of the assembly. Acid would then stay stagnant in the middle and most likely cooler. And here it is:


After adding some handles to take it out of the acid easier:


The idea worked quite well. I was able to see though that the stirbar:


wasn't knocking the bubbles out like I thought it would. I solved this in two ways. First, I filled the cavity up more carefully from the side to let the acid flow in from the side rather than letting air bubbles get trapped if the acid was just poured in. Second, I drilled two holes on the side to let air escape. While it does increase package corrosion, it didn't see to signfigantly since the acid was mostly hitting the milled out portion.

The first chip gave very good results:


Die before any cleaning:


After pressurized water (although acetone would be preferred if I was serious about keeping it alive, water is hazardous to circuits. 98% H2SO4 is hygroscopic and should not contaminate the chip):


Ultrasound would probably clean it up nicely. Beware though if the connections are weak you may knock them off. Try shielding the ultrasound / user lower power or soaking first and see if it will take it off before running at full force. On a related note, be absolutely sure that you've cleaned the chip thoroughly to eliminate acid. Use acetone, 98 % rubbing alcohol, other other things that won't add water. Put it on gentle heat after to drive out any leftover moisture and store in a sealed container away from moisture and dust. Dissicant is probably a good idea. I had a chip I just flat didn't wash after doing this to, need to take a picture of it.

I need to also test to see how much this special jig helps vs just milling and dumping in the bath. Since the acid doesn't corrode the pins very fast, it may very well be sufficient to just dump it into the bath as is.

I'd like to eliminate the RTV completely by making some PTFE spacers. They'll go on the side of the chip so that it gets held in place better and allows less acid to flow to the top.

An associate has started to experiment with making microprobes which turns out to not be that hard. I think he told me its something along the lines of put tungsten rod in 20 % w/v KOH and run some current through it with a certain polarity. I was told the other parameters but just can't remember them off of the top of my head. Hopefully he'll do a writeup on at some point or I will once I have a need to start making probes. I recently received a probing station and so this might be in the near future.

To summarize, here are the key points
  • Your first chip should be easy to handle. Try a PDIP as they are heavy duty and have lots of room for error. Whatever you chose, you'll probably want to mill it and will want a way to securely hold it
  • Start by milling out a cavity. Use something narrower than your package to avoid collapsing the lead frame. Halfway from the top to the top of the lead frame is a good rule of thumb
  • Mount the chip upside down in a acid proof jig. I used PTFE, glass would also work fine.
  • I used a stir bar to increase circulation although I have yet to prove it actually helps
  • Make sure you can take the chip out of the bath to check on it. You can't under-etch and over-etching endangers the integrity of the chip. Be aware though that thermal shock can kill the chip
  • Avoid using water when rinsing. Use hygroscopic and / or water free solvents. Use ultrasound carefully as it may knock off bond wires.
  • Gently heat dry it when done to be sure you've driven out moisture
  • Store in a dry location. I use centrifuge tubes. Desiccant is probably a good idea although probably not needed