"Tearing Down the Nearly Invisible," Feature Article, August 2006

tearing down the nearly invisible

What happens when simply lifting the lid can destroy the very thing you want to inspect? Reverse engineering in the silicon world presents all sorts of unique challenges.

by Alan S. Brown, Associate Editor

for many engineers, the first taste of their chosen profession comes when they trace the cables on a bicycle to see how the gears work, or open a CD player to inspect the mechanism that moves the discs in and out. Later, they may try to repair an automobile transmission or fix an appliance. Although they endure years of class work in theory and math, most find that their profession's secrets reveal themselves by doing.

Reverse engineering—tearing down mechanical devices—is a natural way to learn how things work. Engineers have long torn apart products to seek clues for ways to make them better or cheaper, or to identify a competitor's hidden strengths and limitations, or to uncover patent violations.

Reverse engineering lies at the very heart of the profession. But what if the very act of opening a device destroys it? Suppose its details are too fine to discern with the naked eye? What happens, in other words, when you want to probe the secrets of an integrated circuit or a microelectromechanical system?

Take, for example, the ADXL330, a tiny accelerometer from Analog Devices Inc. of Norwood, Mass., that measures acceleration in three axes. How does an engineer tear down a hermetically sealed machine—and MEMS are true machines with moving parts and electronics—that is only 4 millimeters on a side and has features measured in micrometers? One false step and all those intricate parts will turn into silicon mush.

Game Changer

The ADXL330 is a case study in how semiconductor technology does more for less money. Until now, low-cost 3-axis accelerometers used at least two movable platforms called proof masses. One responded to acceleration by changing its position in the x and y axes, the second in the z axis. These proof masses often came on separate silicon dies that were then glued together, sometimes with a third die containing the device's electronics, to form a single packaged micro system.

Analog Devices does it all on a single die with one large proof mass that measures acceleration in all three dimensions. The die also includes the necessary electronics. Better yet, it is cheap. While small lots list for $5.45 per unit, larger volumes cost less than $2 apiece. Analog Devices' product roadmap calls for pushing unit prices below $1.

With its 3-axis sensing, the ADXL330 is the first step toward cheap, low-power gyroscopes. It can provide motion-sensitive flip-wrist scrolling in mobile phones or image stabilization in digital cameras. It can secure a hard drive so it survives the drop of a notebook computer or media player. Video games can use it to give players a more interactive and intuitive experience.

Today, these features reside on high-end digital devices. At less than $1 per chip, they could become ubiquitous. That makes the ADXL330 a potential game changer.

In the high stakes semiconductor industry, where inexpensive chips can turn into businesses worth hundreds of millions of dollars, the ADXL330 presents a significant competitive challenge. So where do engineers turn for the lowdown on this technology.

They might start by paging through Analog Devices' technical literature and published papers. Yet such documents tend to be maddeningly incomplete. They usually abridge proprietary information, edit out critical materials and steps, fail to discuss rationales and caveats, or describe previous generations of technology that never made it into production.

No, the only way to really probe the technology behind a breakthrough device is reverse engineering. Yet this is no ordinarily teardown. Some features are simply too small to see. Many crumble at the slightest touch. Differences in materials, an important element in any silicon design, are impossible to discern without specialized instrumentation.

It takes a specialist to do this type of work. Located thousands of miles from Silicon Valley, in Canada's capital of Ottawa, Chipworks Inc. is one of several companies that specialize in probing the nearly invisible.

Probing Semiconductors

Chipworks traces its roots back to the early days of semiconductor manufacturing, when another local company, Mosaid Technologies Inc., began looking for better ways to make the 1-kilobyte and 4-kilobyte memory chips of the era.
Terry Ludlow led Mosaid's effort. In 1985, Julia Elvidge spent her internship at the company doing reverse engineering. Mosaid eventually shut down its reverse engineering group because of a perceived conflict of interest with its design and testing operations. In 1992, Ludlow founded Chipworks and recruited Elvidge, who became president of the business in 2004.

Elvidge has seen many of the changes that have transformed reverse engineering of computer chips. "When I started at Mosaid, everything on the chips was visible," Elvidge recalled. "We'd take photographs of the chips using a 35-millimeter camera with polarizing filters attached to a microscope.

"The photographs would cover a conference table. We'd color code the layers and use a felt-tipped pen to trace and label the interconnection of the wires and transistors, then produce a hand-drawn schematic. We'd end up with piles of schematics and work our way through them to produce a report," Elvidge said.

Top: The massive proof mass of the ADSXL330 three-axis accelerator hangs suspended on four pedestals above the polysilicon substrate surrounded by system electronics. A detail of its complex structure (below) shows the air gaps and channels that enable it to respond more freely to changes in acceleration.

The system worked through most of the 1980s because chips were relatively simple. They usually consisted of two or perhaps three metal layers containing the interconnects that wired transistors and other devices to one another. Even the smallest features were several micrometers wide, large enough to remain visible under a microscope.

Starting in the late 1980s, however, semiconductor makers began to refine their manufacturing processes. Feature sizes shrank below 1 micrometer and today are measured in tens of nano- meters. Chips also began adding layers. In the 1980s, they resembled birthday cakes with only a handful of layers. Today, with seven to ten layers of metal, they more closely resemble multitiered wedding cakes.

Chipworks added technology to keep up. First came an automated microscope stage that moved the target chip a few micrometers at a time. "Before that, someone would have to sit there, take a picture, and move the stage by hand to take another picture," Elvidge said. "It was quite exhausting work. We'd have to take thousands of pictures, and humans are not very good at that type of repetitive work."

The automated stage made microphotography easier, but the number of photos continued to multiply. They surged over the conference room table and onto the carpet. Chipworks brought in contractors to trace and stitch them together. "They were retirees, art majors—a very interesting collection of people," Elvidge noted. "Some said it was better than doing a puzzle, but other people would try it once and never come back again. By the early '90s, we needed to take the photographs off the carpet."

Computerizing the information became the company's next priority. Chipworks switched to digital cameras. Elvidge led a program to develop software to blend the digital photos into three-dimensional representations of chip topology. The software used many of the techniques developed for NASA's satellite mapping programs. It eventually became sophisticated enough to help identify transistors and map their interconnections.

The company finally installed a scanning electron microscope. "When chip features started to drop below 180 nanometers, we needed to move out of optical imaging," Elvidge explained. "We were using blue light in our optical microscopes. Its wavelength was 250 nanometers, so when we tried to capture 180-nanometer feature sizes, we were pushing our limits." It takes an electron microscope three days running day and night to image a typical six-layer memory chip.

Prying Off the Lid

Like many MEMS, Analog Devices' ADXL330 has much larger features than modern integrated circuits. "The process used to make it is relatively antique," said St. John Dixon-Warren, who led Chipworks' analysis of the device. "This is the type of process used in the 1970s, with only one layer of metal."

Even so, cracking open the ADXL330 is no simple matter. It crams its moving parts and embedded electronics into a 4-millimeter-square package hermetically sealed with low melting point glass.

Removing the seal is a delicate operation. Like all good surgeons, the Chipworks team first X-rays the MEMS. This shows them the 1.75-millimeter-square die containing the proof mass. Then, a technician using a microscope applies a scalpel to the glass.

It takes several attempts to pry off the cap without damaging the interior. This exposes the proof mass, a massive plate of interconnected zigzagging channels of polycrystalline silicon (polysilicon) that covers most of the die.

The MEMS does not look like a conventional microcircuit, where layer sits atop layer like tiers in a cake. The MEMS has air gaps everywhere. The proof mass floats on four pylons suspended above the substrate like a table. The air that separates its zigzagging pathway creates spring-like structures that enhance the proof mass's flexibility so it reacts more easily to acceleration.

At the top, delicate features on the accelerometers' proof mass act as an electrode on a capacitor. Current flows across the insulating air gap to the silicon substrate below. As acceleration deforms the proof mass, it changes the gap between the two electrodes. This alters the capacitance of current moving across the air. On-board electronics measure those changes as acceleration. At center, the top of the ADXL330 accelerometer, glued on with a low-melting-point glass, ensures a hermetic seal. Bottom photo: Chipworks believes this double anchor halts the movement of the proof mass, then allows it to resume again so the MEMS can measure acceleration along a different axis. It is a key element in the ADXL330 design. The manufacturer did not comment on the report.

The proof mass is actually part of a complex capacitor. Capacitors consist of two electrically conductive plates separated by an insulator. In the ADXL330, current passes between the polysilicon proof mass and a polysilicon substrate under it. The air gap between them forms the insulator. As acceleration deforms the proof mass, changes in the air gap cause minute variations in the insulation. Chip electronics measure this as acceleration.

One of Dixon-Warren's first goals is to figure out how Analog Devices built this intricate assembly of substrates, air gaps, pylons, floating masses, electronic devices, and aluminum interconnects. Analog Devices did not comment on Chipworks' analysis.

This seems to be done through alternating deposition and etching. The ADXL330 was intriguing because the silicon layers would be deposited at 1,000°C, about 600°C higher than the temperature needed to evaporate its aluminum circuitry. Dixon-Warren takes cross-sectional slices of the MEMS, sending some of the samples out to labs that specialize in materials identification. He compares the MEMS under his microscope with published papers to work out the sequence of processing steps.

Some features are unusual. Ordinarily, MEMS have continuous metal lines running along their edges under the caps that seal them against the outside environment. This marks the lines where the MEMS are sawed into individual dies from the silicon wafer on which they were built. The metal imparts ductility, so cracks that start on the very stiff silicon do not propagate onto the die. The ADXL330 had this scribe line, but it also had an additional metal line that separated the electronic circuitry from the MEMS device in the middle of the die.

Photos surged over the conference table and onto the carpet. Chipworks brought in contractors to trace and stitch them together. Some said it was better than doing a puzzle, but others tried it once and never came back again.

Dixon-Warren also found an even more important structure that does not show up in any technical papers: a second layer of polysilicon. The first layer of polysilicon is used to form transistors and the fixed plate of the MEMS capacitor structure. It measures acceleration along the x and y axes. The second polysilicon layer senses motion only along the z axis.

"Proof mass can move in all three directions," Dixon-Warren said. "I'm speculating, based on patent searches and basic textbook physics, but they appear to have built devices under the proof mass to electrically freeze its motion. They constrain it so it moves only in the y axis, and they sense acceleration along the y axis. Then they freeze it and constrain it so it moves only along the x axis, and they measure that."

Dixon-Warren suspects that, by rapidly constraining and releasing the proof mass, Analog Devices alternately measures acceleration in all three dimensions.

There are other surprises as Dixon-Warren works his way through the chip. He points to the underside of the proof mass. Several small bumps drop down from the mass above. "Those are stiction bumps," he explained. "If the whole proof mass touched the substrate, the van der Waals electrostatic forces would lock it there and it would stop moving. The stiction bumps keep that from happening by only letting a small part of the proof mass touch the substrate."

Then he points to the springs that anchor the proof mass to the pylons on the chip. "See," he said, "Analog Devices has changed their position on the newer chips. I wonder what problem they were having that caused them to do that?"

There are ways to find out, he said. By entering the proof mass dimensions into a simulation application, he could work out its performance. "Just from knowing the mechanical properties of silicon, you could work out a lot," he said.

"That's why people buy our reports. If they have all the dimensions, they can simulate how the device works. They would begin to understand how their competitors' products would react in specific situations." That knowledge would enable companies to map out where their own products could compete on performance or on price. Chipworks sells the reports, which average about 150 pages, through its Web site.

It is clear that each new revelation delights Dixon-Warren. "An enormous effort goes into designing this type of device," he said. "A company like Analog Devices might have 100 engineers working for 10 years developing this type of device. We're just skimming the surface."

Yet the ability of Chipworks and other companies like it to probe the micro and nanoscale world of today's silicon technology does provide valuable insights. For people like Elvidge and Dixon-Warren, it also fulfills a craving to trace the cables, lift the lid, and undo those little screws on the back cover. Taking things apart to see how they work is the most natural form of engineering.