Reverse Engineering CMOS

ICs have certainly changed electronics, but how much do you really know about how they are built on the inside? While decapsulating and studying a modern CPU with 14 nanometer geometry is probably not a great first project, a simple 54HC00 logic gate is much larger and much easier to analyze, even at low magnification. [Robert Baruch] took a die image of the chip and worked out what was going on, and shares his analysis in a recent video. You can see that video, below.

The CMOS structures are simple because a MOSFET is so simple to make on an IC die. The single layer of aluminum conductors also makes things simple.

One disadvantage to working with a picture is you can’t etch off the passivation — the thin layer of glass over the top of the chip — and then remove the aluminum to see underneath. However, there isn’t much going on in a chip this simple and you can usually see outlines of contacts under the aluminum.

At this scale, it is possible to put the part under a microscope after removing the passivation and actually probe or even cut conductors with a very sharp probe. The probes are typically made from wire sharpened electrically using sodium hydroxide. Of course, that’s a nasty chemical and so is the hydrofluoric acid that takes off the glass.

One of the hallmarks of CMOS is that you have two transistors driving a signal. One drives it high and another drives it low. Some other logic families will only have one type of transistor, usually pulling a signal low and rely on a pull-up resistor for high outputs. This is why some logic families can “sink more than they source” and also explains higher current consumption and heating. Also, accurate resistors are not easy to make on a chip. Usually, they are made of highly-doped semiconductor material or polysilicon and the actual resistance can vary quite a bit from part to part.

If you’ve ever wondered what’s behind the curtain, [Robert’s] video is pretty lucid and easy to understand. After you watch it, we have a challenge for you: look at a relatively simple 8088 CPU die and imagine doing the exercise on that. Now, look at a really modern CPU. With practice, you can pick out zones pretty easy (registers, an ALU, and so on).

It used to be this kind of thing was what people did in reverse engineering and failure analysis labs, but we are seeing more and more of it lately. We used to decap chips with fuming nitric acid, but there are other methods. If you get the old packages with the gold lid, a hobby knife will do the trick if you are careful.