Once I knew what all of the wires in the ZIA did, the next step was to plan an attack to read signals out.
I decapped an XC2C32A with concentrated sulfuric acid and soldered it to my dev board to verify that it was alive and kicking.
|Simple CR-II dev board with integrated FTDI USB-JTAG|
I figured that all of the exposed packaging would charge, so I'd need to coat the sample with something. I normally used sputtered Pt but this is almost impossible to remove after deposition so I decided to try evaporated carbon, which can be removed nicely with oxygen plasma among other things.
I suited up for the cleanroom and met David Frey, their resident SEM/FIB expert, in front of the Zeiss 1540 FIB system. He's a former Zeiss engineer who's very protective of his "baby" and since I had never used a FIB before there was no way he was going to let me touch his, so he did all of the work while I watched. (I don't really blame him... FIB chambers are pretty cramped and it's easy to cause expensive damage by smashing into something or other. Several SEMs I've used have had one detector or another go offline for repair after a more careless user broke something.)
The first step was to mill a hole through the 900 nm or so of silicon nitride overglass using the ion beam.
|Newly added via, not yet filled|
Metal deposition in a FIB is basically CVD: a precursor gas is injected into the chamber near the sample and it decomposes under the influence of beam-generated secondary electrons.
Once the via was filled we put down a large (20 μm square) square pad we could hit with an electrical probe needle.
I repeated the experiment a week or two later, this time soldering bare stub wires to the pins so I could test by plugging the chip into a breadboard directly. This failed as well, but watching my benchtop power supply gave me a critical piece of information: while VCCINT was consuming the expected power (essentially zero), VCCIO was leaking by upwards of 20 mA.
This ruled out beam-induced damage as I had not been hitting any of the I/O circuitry with the ion beam. Assuming that the carbon evaporation process was safe (it's used all the time on fragile samples, so this seemed a reasonably safe assumption for the time being), this left only the plasma clean as the potential failure point.
I realized what was going on almost instantly: the antenna effect. The bond wire and leadframe connected to each pad in the device was acting as an antenna and coupling some of the 13.56 MHz RF energy from the plasma into the input buffers, blowing out the ESD diodes and input transistors, and leaving me with a dead chip.
This left me with two possible ways to proceed: removing the coating by chemical means (a strong oxidizer could work), or not coating at all. I decided to try the latter since there were less steps to go wrong.
Somewhat surprisingly, the cleanroom staff had very limited experience working with circuit edits - almost all of their FIB work was process metrology and failure analysis rather than rework, so they usually coated the samples.
I decided to get trained on RPI's other FIB, the brand-new FEI Versa 3D. It's operated by the materials science staff, who are a bit less of the "helicopter parent" type and were actually willing to give me hands-on training.
|FEI Versa 3D SEM/FIB|
After a training session I was ready to go in for an actual circuit edit.
|FIB control panel|
Its other nice feature is the quad-image view which lets you simultaneously view an ion beam image, an e-beam image, the IR camera inside the chamber (very helpful for not crashing your sample into a $10,000 objective lens!), and a navigation camera which displays a top-down optical view of your sample.
The nav-cam has saved me a ton of time. On RPI's older JSM-6335 FESEM, the minimum magnification is fairly high so I find myself spending several minutes moving my sample around the chamber half-blind trying to get it under the beam. With the Versa's nav-cam I'm able to set up things right the first time.
I brought up both of the beams on the aluminum sample mounting stub, then blanked them to try a new idea: Move around the sample blind, using the nav-cam only, then take single images in freeze-frame mode with one beam or the other. By reducing the total energy delivered to the sample I hoped to minimize charging.
This strategy was a complete success, I had some (not too severe) charging from the e-beam but almost no visible charging in the I-beam.
The first sample I ran on the Versa was electrically functional afterwards, but the probe pad I deposited was too thin to make reliable contact with. (It was also an XC2C64A since I had run out of 32s). Although not a complete success, it did show that I had a working process for circuit edits.
After another batch of XC2C32As arrived, I went up to campus for another run. The signal of interest was FB2_5_FF: the flipflop for function block 2 macrocell 5. I chose this particular signal because it was the leftmost line in the second group from the left and thus easy to recognize without having to count lines in a bus.
The drilling went flawlessly, although it was a little tricky to tell whether I had gone all the way to the target wire or not in the SE view. Maybe I should start using the backscatter detector for this?
|Via after drilling before backfill|
|The final probe pad, SEM image|
|Probe pad at low mag, optical image|
|Probe pad at higher magnification, optical image. Note damaged CMP filler above pad.|
`timescale 1ns / 1ps module test(clk_2048khz, led); //Clock input (* LOC = "P1" *) (* IOSTANDARD = "LVCMOS33" *) input wire clk_2048khz; //LED out (* LOC = "P38" *) (* IOSTANDARD = "LVCMOS33" *) output reg led = 0; //Don't care where this is placed reg[17:0] count = 0; always @(posedge clk_2048khz) count <= count + 1; //Probe-able signal on FB2_5 FF at 2x the LED blink rate (* LOC = "FB2_5" *) reg toggle_pending = 0; always @(posedge clk_2048khz) begin if(count == 0) toggle_pending <= !toggle_pending; end //Blink the LED always @(posedge clk_2048khz) begin if(toggle_pending && (count == 0)) led <= !led; end endmodule
This is a 20-bit counter that blinks a LED at ~2 Hz from a 2048 KHz clock on the board. The second-to-last stage of the counter (so ~4 Hz) is constrained to FB2_5, the signal we're probing.
After making sure things still worked I attached the board's plastic standoffs to a 4" scrap silicon wafer with Gorilla Glue to give me a nice solid surface I could put on the prober's vacuum chuck.
|Test board on 4" wafer|
Moving carefully, I lifted the probe up from the 3.3V bond pad and landed it on my newly added probe pad.
|Landing a probe on my pad. Note speck of dirt and bent tip left by previous user. Maybe he poked himself mounting the probe?|
|Waveform sniffed from my probe pad|