In a recent video, [Andrew Zonenberg] takes us through the process of decapsulating a PIC12F683 to take a peek at its CMOS implementation.

This is a multipart series with five parts done and more to come. The PIC12F683 is an 8-pin flash-based, 8-bit microcontroller from Microchip. [Andrew] picked the PIC12F683 for decapsulation because back in 2011 it was the first microcontroller he broke read-protection on and he wanted to go back and revisit this chip, given particularly that his resources and skills had advanced in the intervening period.

The five videos are a tour de force. He begins by taking a package cross section, then decapsulating and delayering. He collects high-resolution photos as he goes along. In the process, he takes some time to explain the dangers of working with acid and the risk mitigations he has in place. Then he does what he calls a “floorplan analysis” which takes stock of the entire chip before taking a close look at the SRAM implementation.

If you’re interested in decapsulating integrated circuits you might want to take a look at Laser Fault Injection, Now With Optional Decapping, A Particularly Festive Chip Decapping, or even read through the transcript of the Decapping Components Hack Chat With John McMaster.

Thanks to [Peter Monta] for the tip.

[Ken Shirriff] likes to take chips apart and this time his target is an NFC chip used in Montreal transit system tickets. As you might expect, the tickets are tiny, cheap, and don’t have any batteries. So how does it work?

The chip itself is tiny at 570 µm × 485 µm. [Ken] compares it to a grain of salt. The ticket has a thin plastic core with a comparatively giant antenna onboard.

Working with such a tiny chip presented additional challenges. A few drops of boiling sulphuric acid freed the die. Then applications of phosphoric acid, Armour etch — nasty stuff, but better than hydroflouric acid — and hydrochloric acid took care of the rest.

With everything exposed, it was time to analyze the different parts. As you’d expect, the NFC tag draws power from the antenna and sends data from a EEPROM. There was some analog circuitry and also some digital gates used to control the output. But there isn’t room for much.

How are these so cheap? You can order an 8-inch wafer with 100,587 chips onboard. The price? Around $9,000 per wafer, so about nine cents per chip. Actually, you may be more because the wafer actually has 103,682 dice but a file included tells you which ones are bad. If you want to bargain shop, a 12-inch wafer is $19,000 but gives you 215,712 dice. What a steal!

Can’t get enough NFC? We understand. There are times you just want to make your own.

If you want to see inside an integrated circuit (IC), you generally have to take the die out of the package, which can be technically challenging and often destroys the device. Looking to improve the situation, [Bunnie] has been working on Infra-Red, In Situ (IRIS) inspection of silicon devices. The technique relies on the fact that newer packages expose the backside of the silicon die and that silicon is invisible to IR light. The IR reflects off the bottom metalization layer and you can get a pretty good idea of what’s going on inside the chip, under the right circumstances.

As you might expect, the resolution isn’t what you’d get from, say, a scanning electron microscope or other techniques. However, using IR is reasonably cheap and doesn’t require removal from the PCB. That means you can image exactly the part that is in the device, without removing it. Of course, you need an IR-sensitive camera, which is about any camera these days if you remove the IR filter from it. You also need an IR source which isn’t very hard to do these days, either.

Do you need the capability to peer inside your ICs? You might not. But if you do and you can live with the limitations of this method, it would be a very inexpensive way to get a glimpse behind the curtain.

If you want to try the old-fashioned way, we can help. Just don’t expect to be as good as [Ken] at doing it right away.

Decapsulating ICs used to be an exotic technique. (I should know, I did that professionally for one of the big IC vendors back in the 1980s.) These days, more and more people are learning to take apart ICs for a variety of reasons. If you are interested in doing it yourself, [Juan Carlos Jimenez] has a post you should read about using acid to remove epoxy from ICs.

[Juan Carlos] used several different techniques with varying degrees of success. Keep in mind, that using nitric acid is generally pretty nasty. You need safety equipment and be sure to plan for bad things to happen. Have eyewash ready because once you splash acid in your eye, it is too late to get that together.

We never took apart MEMS devices, so that was especially interesting. A little metal lid keeps the epoxy out of the moving parts and that turns out to be hard to remove.

We were surprised he used 69% nitric. We used to use white fuming nitric, but that may be a bit harder to get now since it is associated with explosives. Then again, you can make it yourself. We used to also use copper bars to sit between the hot plate and the device to get better heat transfer. The acid reaction is much stronger when you heat it.

By the way, if you ever wanted to actually probe the device, you’d have to remove the passivation layer which is SiO₂ glass. That takes hydrofluoric acid which is very nasty stuff, indeed. You can see the edge of the passivation around the bond pads under a microscope. You’ll notice the surface of the pad focuses differently than the edge where the thin passivation layer starts. When you can’t see that edge anymore, you’ve removed the glass.

Of course, you might not need to probe the actual circuit to get results. If you don’t care about the circuit’s survival, you can try more mechanical means.

We always look forward to a new blog post by [Ken Shirriff] and this latest one didn’t cure us of that. His topic this time? Comparing two Game Boy audio chips. People have noticed before that the Game Boy Color sounds very different than a classic Game Boy, and he wanted to find out why. If you know his work, you won’t be surprised to find out the comparison included stripping the die out of the IC packaging.

[Ken’s] explanation of how transistors, resistors, and capacitors appear on the die are helpfully illustrated with photomicrographs. He points out how resistors are notoriously hard to build accurately on a production IC. Many differences can affect the absolute value, so designs try not to count on exact values or, if they do, resort to things like laser trimming or other tricks.

Capacitors, however, are different. The exact value of a capacitor may be hard to guess beforehand, but the ratio of two or more capacitor values on the same chip will be very precise. This is because the dielectric — the oxide layer of the chip — will be very uniform and the photographic process controls the planar area of the capacitor plates with great precision.

We’ve decapsulated chips before, and we have to say that if you are just starting to look at chips at the die level, these big chips with bipolar transistors are much easier to deal with than the fine and dense geometries you’d find even in something like a CPU from the 1980s.

We always enjoy checking in with [Ken]. Sometime’s he’s taking apart nuclear missiles. Sometimes he is repairing an old computer. But it is always interesting.

We see quite a bit of work where people decapsulate ICs or other solid state devices to expose their inner workings. But how about hollow state? [Tomtektest] had a dual triode that has lost its vacuum integrity — gone to air, as he calls it — and decided to open it up to better expose its inner workings. (Video, embedded below.)

Of course, you can always see the innards through the glass, but it is interesting to have the envelope out of the way. Apparently, how you remove the glass is a bit tricky if you don’t want to damage the working bits as you remove it.

It was interesting to see that the elements of the tube were clearly separate as you might expect in a dual triode. However, one of the subtubes is much smaller than the other. [Tom] shows on the datasheet that the two triodes have very different specifications. The smaller one was typically used as an oscillator and the larger one was often used as an amplifier.

Tubes have a long history, even though we don’t use them nearly as much as we used to. There has been a resurgence in some areas, though, and some people are making their own.

ICs have certainly changed electronics, but how much do you really know about how they are built on the inside? While decapsulating and studying a modern CPU with 14 nanometer geometry is probably not a great first project, a simple 54HC00 logic gate is much larger and much easier to analyze, even at low magnification. [Robert Baruch] took a die image of the chip and worked out what was going on, and shares his analysis in a recent video. You can see that video, below.

The CMOS structures are simple because a MOSFET is so simple to make on an IC die. The single layer of aluminum conductors also makes things simple.

One disadvantage to working with a picture is you can’t etch off the passivation — the thin layer of glass over the top of the chip — and then remove the aluminum to see underneath. However, there isn’t much going on in a chip this simple and you can usually see outlines of contacts under the aluminum.

At this scale, it is possible to put the part under a microscope after removing the passivation and actually probe or even cut conductors with a very sharp probe. The probes are typically made from wire sharpened electrically using sodium hydroxide. Of course, that’s a nasty chemical and so is the hydrofluoric acid that takes off the glass.

One of the hallmarks of CMOS is that you have two transistors driving a signal. One drives it high and another drives it low. Some other logic families will only have one type of transistor, usually pulling a signal low and rely on a pull-up resistor for high outputs. This is why some logic families can “sink more than they source” and also explains higher current consumption and heating. Also, accurate resistors are not easy to make on a chip. Usually, they are made of highly-doped semiconductor material or polysilicon and the actual resistance can vary quite a bit from part to part.

If you’ve ever wondered what’s behind the curtain, [Robert’s] video is pretty lucid and easy to understand. After you watch it, we have a challenge for you: look at a relatively simple 8088 CPU die and imagine doing the exercise on that. Now, look at a really modern CPU. With practice, you can pick out zones pretty easy (registers, an ALU, and so on).

It used to be this kind of thing was what people did in reverse engineering and failure analysis labs, but we are seeing more and more of it lately. We used to decap chips with fuming nitric acid, but there are other methods. If you get the old packages with the gold lid, a hobby knife will do the trick if you are careful.