536
6 Reverse Engineering of Microcircuits
projection of the chip (top view), starting from the top-level metal. The chip could then
be placed under standard optical photographic equipment to obtain multiple images
with high magnification. The acquired photos were processed and stitched together
in a matrix to recreate the image of the chip. After that, the engineers (including one
of the authors of this book) used the crawling method (Fig. 6.7) where they annotated
(signed) all connecting buses and transistors. This was accompanied by drawing the
circuit first on paper and then in a schematic editor.
Life has changed a lot since then. Complexity of devices has been inevitably
following the Moore’s law, and RE experts now extract circuits from chips of 45 nm
or even less. Moreover, these devices today already have up to 12 metal layers and
use secret combinations of various materials to create both conductors and dielectrics
[4, 8]. Microcircuits can already have hundreds of millions of logic gates and giant
areas of analog, high-frequency, memory, and other macro-cells. Moreover, chips
are currently used for integration of such difficult-to-read elements as inductances,
microelectronic mechanical systems, and other devices.
In a general case, standard microcircuit extraction process occurs in the following
manner:
– The package is opened (this process is known in the industry as decapsulation);
– Layers are removed in sequence;
– Images of each layer are formed;
– All semiconductors and active devices are signed;
– All the received circuits are read, and then the general electrical and functional
circuits are built;
– The obtained information is carefully analyzed.
6.3.2.5 Microcircuit Package Decapsulation
Package decapsulation is perhaps the only operation of the process that still conforms
to traditional methods. Typically, the package is etched in a caustic acid solution
(Fig. 6.18). Various acids at different temperatures are used depending on a specific
package. These solutions dissolve the package material without damaging the chip.
Sealed and ceramic packages require different methods, which usually include
mechanical or thermal treatment for lid removal or separation of chips from
substrates, or even polishing for ceramic substrate.
Removal of Chip Layers
Modern chips of semiconductor devices occupy a wide range of applied design
norms—from 1.0 μm of bipolar chips with one metal through 0.35 μm of BCDMOS
chip to 45 nm microprocessors with 12 metals and everything in between.
Both copper and aluminum can be used on the same chip for metallization.
Depending on the specific analyzed generation of the process, polysilicon gates
and source/drain regions can use different silicides. Many low-K dielectrics are now
mixed with fluorosilicate glass (FSG), phosphorosilicate glass (PSG), and silicon
oxide (SiO 2 ). Layer thickness values vary within a wide range. For example, on a
6 Reverse Engineering of Microcircuits
projection of the chip (top view), starting from the top-level metal. The chip could then
be placed under standard optical photographic equipment to obtain multiple images
with high magnification. The acquired photos were processed and stitched together
in a matrix to recreate the image of the chip. After that, the engineers (including one
of the authors of this book) used the crawling method (Fig. 6.7) where they annotated
(signed) all connecting buses and transistors. This was accompanied by drawing the
circuit first on paper and then in a schematic editor.
Life has changed a lot since then. Complexity of devices has been inevitably
following the Moore’s law, and RE experts now extract circuits from chips of 45 nm
or even less. Moreover, these devices today already have up to 12 metal layers and
use secret combinations of various materials to create both conductors and dielectrics
[4, 8]. Microcircuits can already have hundreds of millions of logic gates and giant
areas of analog, high-frequency, memory, and other macro-cells. Moreover, chips
are currently used for integration of such difficult-to-read elements as inductances,
microelectronic mechanical systems, and other devices.
In a general case, standard microcircuit extraction process occurs in the following
manner:
– The package is opened (this process is known in the industry as decapsulation);
– Layers are removed in sequence;
– Images of each layer are formed;
– All semiconductors and active devices are signed;
– All the received circuits are read, and then the general electrical and functional
circuits are built;
– The obtained information is carefully analyzed.
6.3.2.5 Microcircuit Package Decapsulation
Package decapsulation is perhaps the only operation of the process that still conforms
to traditional methods. Typically, the package is etched in a caustic acid solution
(Fig. 6.18). Various acids at different temperatures are used depending on a specific
package. These solutions dissolve the package material without damaging the chip.
Sealed and ceramic packages require different methods, which usually include
mechanical or thermal treatment for lid removal or separation of chips from
substrates, or even polishing for ceramic substrate.
Removal of Chip Layers
Modern chips of semiconductor devices occupy a wide range of applied design
norms—from 1.0 μm of bipolar chips with one metal through 0.35 μm of BCDMOS
chip to 45 nm microprocessors with 12 metals and everything in between.
Both copper and aluminum can be used on the same chip for metallization.
Depending on the specific analyzed generation of the process, polysilicon gates
and source/drain regions can use different silicides. Many low-K dielectrics are now
mixed with fluorosilicate glass (FSG), phosphorosilicate glass (PSG), and silicon
oxide (SiO 2 ). Layer thickness values vary within a wide range. For example, on a