While most of us are content to buy the chips we need to build our projects, there’s a small group of hackers more interested in making the chips themselves. What it takes the big guys a billion-dollar fab to accomplish, these hobbyists are doing with second-hand equipment, chemicals found in roach killers and rust removers, and a lot of determination to do what no DIYer has done before.
Sam Zeloof is one of this dedicated band, and we’ve been following his progress for years. While he was still in high school, he turned the family garage into a physics lab and turned out his first simple diodes. Later came a MOSFET, and eventually the Z1, a dual-differential amp chip that is the first IC produced by a hobbyist using photolithography.
Sam just completed his first year at Carnegie-Mellon, and he’s agreed to take some precious summer vacation time to host the Hack Chat. Join us as we learn all about the Z1, find out what improvements he’s made to his process, and see what’s next for him both at college and in his own lab.
Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io. You don’t have to wait until Wednesday; join whenever you want and you can see what the community is talking about.
In the hacker and DIY community, there are people who have exceptional knowledge and fantastic tools. These people are able to do what others could only dream about, and that others can only browse eBay looking for that one tool they need to do the job. One of these such people is [John McMaster]. He is the resident expert on looking inside integrated circuits. He drops acid on a chip, and he can tell you exactly how it works on the inside.
At the hardwear.io conference, [John] shared one of his techniques for reverse-engineering intgrated circuits. He’s doing this by simply looking at the transistors, and looking at the light they give off. He’s also looking at the wrong side of the die.
The technique [John] is using is properly called backside analysis, or looking at the infrared emissions of electron recombinations. This happens at the junction of every transistor when it’s active, and these photons are emitted at the bandgap of silicon, or about 1088 nm, far into the infrared. This sort of thing has been done before by [nedos] at CCC in 2013, but rarely have we seen a deep dive into the tools and techniques needed to look at the reverse side of an IC and see the photons coming off.
There are several tools [John] used for this work, and he actually did a good comparison of different camera technologies used to image infrared photon emissions from integrated circuits. InGaAs cameras are expensive, but they offer high sensitivity. New back-illuminated CMOS cameras and cooled CCDs normally reserved for astrophotography were also tested, and as always, you get what you pay for; the most expensive cameras worked best, but there were ways you could make the cheap ones work.
As with any camera work, preparing the lighting is of utmost importance. This includes an IR pass filter, and using only LED lighting in the lab with no sunlight, incandescent, or halogen light bulbs in the room — you don’t want any IR, after all. A NIR objective in the microscope was sourced from eBay, for about 1/10th the normal cost, because the objective had a small, insignificant scratch. Using this NIR objective made the image twice as bright as any other method. You can successfully image a chip with this, and [John] tested the setup on a resistor inside a CD4050 chip; the resistor glowed a slight purple, the color you would expect with infrared sensors. But can it work with I/O levels in a more modern chip? Also, yes. It needs some Photoshop to process, and stretching the 12-bit or 16-bit color space into an 8-bit color space, but it does work.
Finally, the supreme achievement of doing backside IR analysis. Is that possible with even this minimal setup? This requires some preparation; the silicon substrate in an IC is transparent in IR, but there is attenuation and this is especially important when the substrate is 300 um thick. This needs to be shaved down to about 25 um thick, which surprisingly is best done with fine sandpaper and a finger.
While few IR emissions were observed via backside emissions, the original plan wasn’t to completely analyze the chip, but merely to do some floor planning. For this, it worked. It’s a remarkable amount of work to see the inside of a silicon chip.
For years I’ve been trying to wrap my mind around how silicon chips actually work. How does a purposefully contaminated shard of glass wield control over electrons? Every once in a while, someone comes up with a learning aid that makes these abstract concepts really easy to understand, and this was the case with one of the booths at Maker Faire Bay Area. In addition to the insight it gave me (and hundreds of Faire-goers), here is an example of the best of what Maker Faire stands for. You’ll find a video of their presentation embedded below, along with closeup images of the props used at the booth.
The Uncovering the Silicon booth had a banner and a tablecloth, but was otherwise so unassuming that many people I spoke with missed it. Windell Oskay, Lenore Edman, Eric Schlepfer, John McMaster, and Ken Shirriff took a 50-year-old logic chip and laid it bare for anyone who cared to stop and ask what was on display. The Fairchild μL914 is a dual NOR gate, and it’s age matters because the silicon is not just simple, it’s enormous by today’s standards making it relatively easy to peer inside with tools available to the individual hacker.
The first challenge is just getting to the die itself. This is John McMaster’s specialty, and you’re likely familiar from his Silicon Pr0n website. He decapped the chip (as well as an ATmega328 which was running the Arduino blink sketch with it’s silicon exposed). Visitors to the booth could look through the microscope and see the circuit for themselves. But looking doesn’t mean understanding, and that’s where this exhibit shines.
To walk us through how this chip works, a stack-up of laser-cut acrylic demonstrates the base, emitter, and collector of a single transistor. The color coding and shape of this small model makes it easy to pick out the six transistors of the 941 on a full model of the chip. This lets you begin to trace out the function of the circuit.
For me, a real ah-ha moment was the resistors in the design. A resistive layer is produced by doping the semiconductor with impurities, making it conduct more poorly. But how do you zero-in on the desired resistance for each part? It’s not by changing the doping, that remains the same. The trick is to make the resistor itself take up a larger footprint. More physical space for the electrons to travel means a lower resistance, and in the model you can see a nice fat resistor in the lower right. The proof for these models was the final showpiece of the exhibit as the artwork of the silicon die was laid out as a circuit board with discrete transistors used to recreate the functionality of the original chip.
Windell takes us through the booth presentation in the video below. I think you’ll be impressed by the breakdown of these concepts and how well they aid in understanding. This was a brilliant concept for an exhibit; it brought together interdisciplinary experts whom I respect and whose work I follow, and sought to invite everyone to gain a better understanding of the secrets hiding in the chips that underpin this technological age. This is exactly the kind of thing I love to see at a Maker Faire.
Looks like [Sam Zeloof] got bored on his Thanksgiving break, and things got a little weird in his garage. Of course when your garage contains a scanning electron microscope, the definition of weird can include experimenting with electron-beam lithography, resulting in tiny images etched into silicon.
You’ll probably remember [Sam] from his 2018 Hackaday Superconference talk on his DIY semiconductor fab lab, which he used to create a real integrated circuit. That chip, a PMOS dual-channel differential amp, was produced by photolithography using a modified DLP projector. Photolithography imposes limits to how small a feature can be created on silicon, based on the wavelength of light.
[Sam] is now looking into using the electron beam of his SEM as a sort of CNC laser engraver to produce much finer features. The process involves spin-coating silicon wafers with SU-8, an epoxy photoresist normally used with UV light but that also turns out to be sensitive to electron beams. He had to modify his SEM to control the X- and Y-axis deflection with a 12-bit DAC and provide a custom beam blanker. With a coated wafer in the vacuum chamber, standard laser engraving software generates the G-code to trace his test images on the resist. A very quick dip in acetone develops the exposed chip.
[Sam] says these first test images are not too dainty; the bears are about 2.5 mm high, and the line width is about 10 μm. His system is currently capable of resolving down to 100 nm, while commercial electron beam lithography can get down to 5 nm or so. He says that adding a Faraday cage to the setup might help him get there. Sounds like a project for Christmas break.
A normal life in hacking, if there is such a thing, seems to follow a predictable trajectory, at least in terms of the physical space it occupies. We generally start small, working on a few simple projects on the kitchen table, or if we start young enough, perhaps on a desk in our childhood bedroom. Time passes, our skills increase, and with them the need for space. Soon we’re claiming an unused room or a corner of the basement. Skills build on skills, gear accumulates, and before you know it, the garage is no longer a place for cars but a place for pushing back the darkness of our own ignorance and expanding our horizons into parts unknown.
It appears that Sam Zeloof’s annexation of the family garage occurred fairly early in life, and to a level that’s hard to comprehend. Sam seems to have caught the hacking bug early, and by the time high school rolled around, he was building out a remarkably well-equipped semiconductor fabrication lab at home. Sam has been posting his progress regularly on his own blog and on Twitter, and he dropped by the 2018 Superconference to give everyone a lesson on semiconductor physics and how he became the first hobbyist to produce an integrated circuit using lithographic processes.
Reverse engineering silicon is a dark art, and when you’re just starting off it’s best to stick to the lesser incantations, curses, and hexes. Hackaday caught up with Ken Shirriff at last year’s Supercon for a chat about the chip decapping and reverse engineering scene. His suggestion is to start with an old friend: the 555 timer.
Ken is well-known for his work photographing the silicon die at the heart of an Integrated Circuit (IC) and mapping out the structures to create a schematic of the circuit. We’re looking forward to Ken’s talk in just a few weeks at the Hackaday Superconference. Get a taste of it in the interview video below.
A few months ago, we caught wind of an interesting project in Big-O Open silicon. It’s a chip, loaded up with the great CPU cores of yore. Now, it’s finally a project on Crowd Supply. The Retro-uC project is an Open Source microcontroller for the retro geek, with a Zilog Z80, MOS 6502, and Motorola 68000 buried in the epoxy of a single QFP package. Oh yes, custom silicon and retro goodness, what more could you want?
The Retro-uC project is part of the Chips4Makers project to develop an Open Source chip for the community. Of course, this has been done before with projects like the HiFive1 and other RISC-V implementations, but really — this is a Z80, 6502 and 68k on a single chip. Let’s not bury the lede here.
As far as the architecture and implementation of these cores go, the ‘active’ core is externally selected on reset, or can be changed through the JTAG interface. There are 72 GPIO pins that can handle 5V, with each pin mapped to the address space of the cores. So far, so good. We can make this work for some really cool stuff.
The JTAG interface is used for testing and programming, although programs can be stored on an external I2C Flash chip and booted from there. There is 4kB of on-chip RAM, and while the peripheral configuration is still being determined, there will at least be UART, I2C, and PWM peripherals. How many of each is anyone’s guess.
The Retro-uC is now a Crowd Supply project, with rewards/orders/whatever ranging from a bare Retro-uC chip for $42 USD to an Arduino Mega-ish development platform for $89, a breadboard version of the chip for $59, and a chip mounted to a Perf2+ prototyping board for $65.
While this chip hasn’t even gotten to tape-out, all the cores work on an FPGA, and there is precedent for doing Open Source, crowdfunded silicon. We’re looking at this one closely and are excited to see what everyone is going to make.