De-encapsulating ICs with a laser cutter

OLYMPUS DIGITAL CAMERA
Closeup of dictionary ROM

I recently found, in an old box of random electronics, a pocket dictionary of the 12-in-one spellchecker variety. The board had two large chip-on-board ICs on it, both covered with the usual black epoxy of doom. The actual traces routing between the two were relatively sparse, and I was somewhat curious what the architecture of the device actually was, so I decided I’d like to de-encapsulate the chips to see what was making it tick.

I’ve heard many times in the past that the best way to do this is by careful application of fuming nitric acid. Unfortunately, that’s somewhat controlled in the UK as it’s considered a precursor for making explosives; as a result, I didn’t have any to hand. However, I thought it might be interesting to try a different approach – a laser cutter.

40W CO2 laser cutterI have a generic 40W chinese laser cutter, of the kind you can pick up cheaply on eBay. This particular laser has been upgraded very slightly with some better stepper control electronics and an air assist nozzle for the head; however, it’s still using all the original optics and laser. The air assist is the only relevant improvement for this job.

 

I set the PCB with the COB blob up under the laser, and fed in a simple half-inch square bitmap to the laser control software to be engraved. This made the laser perform a raster pattern across the surface of the COB device, neatly etching away the epoxy. If you’re trying this yourself, I used three passes, with the laser at full power and set to 300mm/sec and air assist on.

IMG_1369.JPGA single pass yielded a noticable depth of cut into the epoxy blob, with a fairly good surface; it was a little dusty (the various unpleasant byproducts of burning epoxy tend to recondense on nearby surfaces), but the laser was clearly cutting the epoxy fine. The question was whether it would trash the silicon underneath.IMG_1367.JPG

After the third pass, the die surface started to become visible, and so I stopped and cleaned off the surface with a brush. Unfortunately, I was a little heavy-handed with the brush, and some of the gold bond wires were broken as I did – they were actually intact before. However, I managed to get a pretty good view of the chip surface, and a look at the layout. Apologies for the poor photograph quality – I was using a biological microscope not intended for top illumination, and it has bad flare problems with the reflections from the IC surface.

OLYMPUS DIGITAL CAMERA
View of the whole chip. The pinholes in the corner are from me lining the laser up with where I wanted it to start.
OLYMPUS DIGITAL CAMERA
Sanyo logo on the corner, along with some of the pin buffer structures.

From this, I think it’s pretty clear that this chip is just a ROM of some sort, and any clever behaviour is implemented on the other chip on the board, Unfortunately I managed to shatter that chip while trying a different process for removing it from the epoxy blob of doom, so I have no photographs of that to show.

I hope this helps if anyone else needs urgently to deencapsulate a chip and work out what’s inside it; it’s faster (less than 5 minutes on the laser) and simpler than the nitric acid approach, and while it doesn’t yield a perfect result, it’s good enough for basic identification. Most importantly, the laser doesn’t seem to cut any of the metal on the chip, nor the bond wires, nor the silicon itself, despite chewing rapidly through the black epoxy.

6 thoughts on “De-encapsulating ICs with a laser cutter”

  1. Hey Jamie,
    we tried your method using a couple different ICs with the same laser cutter. Either we only remove very little to no epoxy or the epoxy turned white and crackly without any dust. Any tips?
    – space

    1. Hi,
      I found it was a bit variable between different epoxy types. The biggest factor for me was air assist; using or not using it tended to make a big difference to the results.

      For one or two types of package, I found that the laser instead seemed to make the package “puff up” a little – for those, it wouldn’t remove much material itself, but it left the surface very crumbly and weak, so a stiff brush (nailbrush, toothbrush) was enough to remove a layer and then repeat with the laser again until you got down to the IC.

      Hope that’s useful; if I can do any more to help, let me know.

  2. Hi Craig,

    I am planning to decap an integrated MCU+RF IC to access the bond wires to sniff the radio config.

    Do I understand correctly that the golden bond wires are not damaged by the laser?

    Did the circuit managed to work correctly after the decapping?

    Thanks in advance!
    Miklos

    1. Hi Miklos,
      The bond wires weren’t damaged by the laser, but I didn’t try testing the device afterwards – there was too much other damage from other things I’d done to the board before that point. I think the laser either reflects off the metal of the wires, or the conductivity of the wire allows it to dissipate the heat. In any case, there was no visible damage to any metal parts.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.