Posted on Leave a comment

IC Decap – TDA3606 Multi Regulator With Battery Sense

This is a chip aimed at the automotive market – this is a low power voltage regulator for supplying power to microcontrollers, for instance in a CD player.

TDA3606 Die
TDA3606 Die

The TDA3606 is a voltage regulator intended to supply a microprocessor (e.g. in car radio applications). Because of low voltage operation of the application, a low-voltage drop regulator is used in the TDA3606. This regulator will switch on when the supply voltage exceeds 7.5 V for the first time and will switch off again when the output voltage of the regulator drops below 2.4 V. When the regulator is switched on, the RES1  and RES2 outputs (RES2 can only be HIGH when RES1 is HIGH) will go HIGH after a fixed delay time (fixed by an external delay capacitor) to generate a reset to the microprocessor. RES1 will go HIGH by an internal pull-up resistor of 4.7 kΩ, and is used to initialize the microprocessor. RES2 is used to indicate that the regulator output voltage is within its voltage range. This start-up feature is built-in to secure a smooth start-up of the microprocessor at first connection, without uncontrolled switching of the regulator during the start-up sequence. All output pins are fully protected. The regulator is protected against load dump and short-circuit (foldback
current protection). Interfacing with the microprocessor can be accomplished by means of a battery Schmitt-trigger and output buffer (simple full/semi on/off logic applications). The battery output will go HIGH when the battery input voltage exceeds the HIGH threshold level.

Posted on Leave a comment

IC Decap – TA7291 H-Bridge DC Motor Driver

Here’s a jellybean chip – a DC motor driver. This device has all the logic to drive a small motor, such as that used to drive the tray of a CD drive in both directions. The control logic is at the bottom of the die, while the main power transistors are at the top, in H-Bridge formation.

TA7291 Die
TA7291 Die
Posted on Leave a comment

IC Decap – Genesis Logic gmZAN3L XGA LCD Controller

Here’s a very common chip used in older LCD monitors. This converts the incoming VGA signal into LVDS for the panel itself.

gmZAN3 Die
gmZAN3 Die

The gmZAN3 is a graphics processing IC for Liquid Crystal Display (LCD) monitors at XGA resolution. It provides all key IC functions required for the highest quality LCD monitors. On-chip functions include
a high-speed triple-ADC and PLL, a high quality zoom and shrink scaling engine, an on-screen display (OSD) controller and digital color controls.

Posted on Leave a comment

IC Decap – MaxLinear MXL261 DOCSIS3 Tuner / Demodulator

Time for more silicon pr0n! When Virgin Media supplied me with a new modem, they requested I “recycle” the old one, so naturally it got gutted for the component parts. This particular IC is the frontend of the RF tuner. Unfortunately no datasheet is available, but I did manage to find some info in a press release. The sections are clearly identifiable, the RF section is on the left, while the rest of the demodulating logic is hidden on the right under a metal layer.

MXL261 Die
MXL261 Die – Click to Embiggen!

The MxL261 is based on MaxLinear’s low-power, digital CMOS process RF and mixed-signal technology.  It is a single-die, global standards, digital cable front end with integrated splitter, two 100MHz wideband tuners, four QAM demodulators and a four-channel-wide IF output.

Posted on 1 Comment

IC Decap: ITE IT8712F Super I/O Controller

IT8712F Package
IT8712F Package

These chips are used on PC motherboards, to control many of the legacy peripherals & things such as temperature monitoring & fan speed control.

Here’s the block diagram from the datasheet to show all the features, this IC handles many things on a modern motherboard!

Block Diagram
Block Diagram
IT8712F Die
IT8712F Die
Posted on Leave a comment

IC Decap: Motorola XPC860PZP50D4 Communications Controller

XPC860PZP50D4 Package
XPC860PZP50D4 Package

This is a System On Chip from Motorola, designed for network routing applications. This chip contains a hell of a feature set, so I’ll just include an excerpt from the datasheet:

XPC860PZP50D4 Die
XPC860PZP50D4 Die

Posted on Leave a comment

IC Decap: Texas Instruments TMS57002 Audio DSP

TMS5007 Package
TMS5007 Package

This is an Audio DSP chip from the early 90’s, used for sound effects in audio mixing consoles. Unfortunately I couldn’t find much info on these.

TMS57002 Die
TMS57002 Die

The die is massive, 10mm square at least. Interestingly, the markings on the die indicate it’s a TMS67002, maybe there was a different internal software version for the 57002 with fewer features, that used the same Silicon? In the centre of this die, there’s an area that looks like mask ROM, with the individual memory bits visible.

ROM Closeup
ROM Closeup
Posted on Leave a comment

IC Decapping: The Process

As I’ve been posting some photos of decapped ICs lately, I thought I’d share the process I use personally for those that might want to give it a go 😉

The usual method for removing the epoxy package from the silicon is to use hot, concentrated Nitric Acid. Besides the obvious risks of having hot acids around, the decomposition products of the acid, namely NO² (Nitrogen Dioxide) & NO (Nitrogen Oxide), are toxic and corrosive. So until I can get the required fume hood together to make sure I’m not going to corrode the place away, I’ll leave this process to proper labs ;).

The method I use is heat based, using a Propane torch to destroy the epoxy package, without damaging the Silicon die too much.

TMS57002 Audio DSP
TMS57002 Audio DSP

I start off, obviously, with a desoldered IC, the one above an old audio DSP from TI. I usually desolder en-masse for this with a heat gun, stripping the entire board in one go.

FLAMES!
FLAMES!

Next is to apply the torch to the IC. A bit of practice is required here to get the heat level & time exactly right, overheating will cause the die to oxidize & blacken or residual epoxy to stick to the surface.
I usually apply the torch until the package just about stops emitting it’s own yellow flames, meaning the epoxy is almost completely burned away. I also keep the torch flame away from the centre of the IC, where the die is located.
Breathing the fumes from this process isn’t recommended, no doubt besides the obvious soot, the burning plastic will be emitting many compounds not brilliant for Human health!
Once the IC is roasted to taste, it’s quenched in cold water for a few seconds. Sometimes this causes such a high thermal shock that the leadframe cracks off the epoxy around the die perfectly.

All Your Die Belong To Us
All Your Die Belong To Us

Now that the epoxy has been destroyed, it breaks apart easily, and is picked away until I uncover the die itself. (It’s the silver bit in the middle of the left half). The heat from the torch usually destroys the Silver epoxy holding the die to the leadframe, and can be removed easily from the remaining package.

Decapped
Decapped

BGA packages are usually the easiest to decap, flip-chip packages are a total pain due to the solder balls being on the front side of the die, I haven’t managed to get a good result here yet, I’ll probably need to chemically remove the first layer of the die to get at the interesting bits 😉

Slide
Slide

Once the die has been rinsed in clean water & inspected, it’s mounted on a glass microscope slide with a small spot of Cyanoacrylate glue to make handling easier.

Some dies require some cleaning after decapping, for this I use 99% Isopropanol & 99% Acetone, on the end of a cotton bud. Any residual epoxy flakes or oxide stuck to the die can be relatively easily removed with a fingernail – turns out fingernails are hard enough to remove the contamination, but not hard enough to damage the die features.

Once cleaning is complete, the slide is marked with the die identification, and the photographing can begin.

Microscope Mods

I had bought a cheap eBay USB microscope to get started, as I can’t currently afford a proper metallurgical microscope, but I found the resolution of 640×480 very poor. Some modification was required!

Modified Microscope
Modified Microscope

I’ve removed the original sensor board from the back of the optics assembly & attached a Raspberry Pi camera board. The ring that held the original sensor board has been cut down to a minimum, as the Pi camera PCB is slightly too big to fit inside.
The stock ring of LEDs is run direct from the 3.3v power rail on the camera, through a 4.7Ω resistor, for ~80mA. I also added a 1000µF capacitor across the 3.3v supply to compensate a bit for the long cable – when a frame is captured the power draw of the camera increases & causes a bit of voltage drop.

The stock lens was removed from the Pi camera module by careful use of a razor blade – being too rough here *WILL* damage the sensor die or the gold bond wires, which are very close to the edge of the lens housing, so be gentle!

Mounting Base
Mounting Base

The existing mount for the microscope is pretty poor, so I’ve used a couple of surplus ceramic ring magnets as a better base, this also gives me the option of raising or lowering the base by adding or removing magnets.
To get more length between the Pi & the camera, I bought a 1-meter cable extension kit from Pi-Cables over at eBay, cables this long *definitely* require shielding in my space, which is a pretty aggressive RF environment, or interference appears on the display. Not surprising considering the high data rates the cable carries.
The FFC interface is hot-glued to the back of the microscope mount for stability, for handheld use the FFC is pretty flexible & doesn’t apply any force to the scope.

Die Photography

Since I modified the scope with a Raspberry Pi camera module, everything is done through the Pi itself, and the raspistill command.

Pi LCD
Pi LCD

The command I’m currently using to capture the images is:
raspistill -ex auto -awb auto -mm matrix -br 62 -q 100 -vf -hf -f -t 0 -k -v -o CHIPNAME_%03d.jpg

This command waits between each frame for the ENTER key to be pressed, allowing me to position the scope between shots. Pi control & file transfer is done via SSH, while I use the 7″ touch LCD as a viewfinder.

The direct overhead illumination provided by the stock ring of LEDs isn’t ideal for some die shots, so I’m planning on fitting some off-centre LEDs to improve the resulting images.

Image Processing

Obviously I can’t get an ultra-high resolution image with a single shot, due to the focal length, so I have to take many shots (30-180 per die), and stitch them together into a single image.
For this I use Hugin, an open-source panorama photo stitching package.

Hugin
Hugin

Here’s Hugin with the photos loaded in from the Raspberry Pi. To start with I use Hugin’s built in CPFind to process the images for control points. The trick with getting good control points is making sure the images have a high level of overlap, between 50-80%, this way the software doesn’t get confused & stick the images together incorrectly.

Optimiser
Optimiser

After the control points are generated, which for a large number of high resolution images can take some time, I run the optimiser with only Yaw & Pitch selected for all images.

Optimising
Optimising

If all goes well, the resulting optimisation will get the distance between control points to less than 0.3 pixels.

Panorama Preview
Panorama Preview

After the control points & optimisation is done, the resulting image can be previewed before generation.

Texas Instruments TMS67002
Texas Instruments TMS67002

After all the image processing, the resulting die image should look something like the above, with no noticeable gaps.

Posted on Leave a comment

IC Decap: Motorola MC68HC11E9 8-Bit Microcontroller

This particular IC came out of a very old VHF band radio, from the early 90’s. The die was encased in a custom ceramic package, like every other IC in the radio, with a custom part number. I managed to identify it from the markings on the silicon.

Motorola MC68HC11L6
Motorola MC68HC11L6

This was a pretty powerful MCU for it’s time, with 16K of onboard ROM, 512 bytes of both RAM & EEPROM, a 16-bit timer, 8-bit ADC, SPI & a MC68HC11 CPU core.