#4 is an NEC D8255A

Task is to decap and identify unknown device

Includes:

• #4: Joshi Volley Ball AA-007

Unknown device, DIP40:

Decapped:

Closer inspection:

Part identified as NEC D8255A, a variation of the well known Intel 8255A "Programmable Peripheral Interface"

Taking down #45 Tatakae Big Fighter, the Lazarus ROM

In a previous post we discussed dumping some 8751 chips.  However, #45 had a few issues.  First, it had some comments:

• "8741 in disguise as an 8751H" 
• "Pin 7 (EAn) has been cut internally to prevent read-out"
• EAn sometimes intentionally damaged to further hinder readout

So a bit of mystery on exactly what this chip was and if the silicon was functional.  But, more importantly, it was received like this:

Not only are most of the bond wires gone, but so is the surrounding leadframe.  In fact, only 13 / 40 pins are still attached.

However, close inspection revealed no physical damage: all pads were intact and no die damage (include EAn circuitry).  Given that, we theoretically could rebond and dump 45.  Inspection also verified that it really was an 8751H.

Still, things aren't looking good for #45 as about 32 / 40 connections are required to get a proper dump (port 3 is not required).  Somewhat fortunately, only 1 of the surviving pins are from port 3, meaning we have 12 / 32 and only need to fix 20 connections.  However, without a leadframe, new bonds can't be made.

This is a somewhat rare game and was requested to be repaired if possible.  Lets see what we can do.

Leadframe

Lets start by assembling a new leadframe.  First, 45 was stabilized in a socket.  During this process pin 17 (P3.7 RDn) broke, but fortunately this was the one unneeded pin.

Anyway, we had an 8751 leftover from earlier experiments which was torched to remove the pins:

Which were then placed in a stainless beaker with solid lye:

And gently boiled in molten lye to strip the glass off:

They were then washed and put into tinning solution to restore the surface:

This resulted in some uncoated areas:

Still, probably good enough, so put into a leadframe:

45 is beginning to look like an IC again!

Note that the donor 8751 was missing some pins and we came up one short.  But we don't need that pin, so no biggie (or so we thought...).

In order to bond in new wires, the leadframe must be stable.  Some options to fix the pins in place:

• Fill with glass: risk of breaking good pins, somewhat difficult to work with
• Hot glue: easy to work with, easy to fix mistakes.  Mild strength
• Epoxy: semi permament.  Very strong, heat resistant
• CA glue: easy to work with, but dissolved by cleaning solvents (ie acetone)

At first hot glue seemed like a good option:

But quickly realized was going to cause issues by bakes required in later steps.  So 45 was cleaned and the pins went through cleaning, including hot H2SO4 rinse to dissolve the hot glue:

We took this opportunity to clean the pins up proper.  So they were pickled in hydrochloric acid and re-tinned to get clean pins.  The cleaned leadframe re-assembled:

Note the black streaks and other marks are gone.

Next coated with epoxy:

Packaged discolored from briefly baking (for quicker cure) too hot (200C).  It was lowered to 150C for subsequent operations.

But oops!  We put the missing pin in the wrong side.  Instead of taking apart another 8751H, decided to just add a bodge wire:

Although not placed accurately, epoxy prevents it from shorting adjacent pins.

Mask

Just like other 8751s, security fuses were cleared using a UV opaque mask:

It was unknown if the chip was actually protected.  But, presumably it was only sent for decap work because it was protected.  While we could mask as needed later, it is lower risk to do so before the bond wires are reattached.

Bonding: R&D

The chip, as originally assembled, was wedge bonded to the ceramic carrier.  This would be the quickest way to repair the IC and certainly the recommended way.  But there were some complications.

First, can we bond gold wires to the old aluminum wires?  While several team members have friends with gold bonders, none have access to aluminum bonders.  Anyway, gold wires would probably work since pads are typically aluminum, but would need to test.

Second, bonder access, although maybe possible, was going to take a lot of coordination.

So, wedge bonding was not out of the question but was going to take a while to arrange if nothing else.

An earlier R&D project explored reviving an unrelated severely damaged chip.  This particular chip not only had the wires removed, but the pads themselves were ripped up.  Here's Vcc and Vss:

This other chip can't be wedge bonded since there's no longer a pad to bond to.  However, there's still some metal sticking out.  Theoretically we could FIB a new pad and bond it.

But FIB time is expensive.  What could we do instead?  How about some fancy glue:

Applied very carefully by hand using a microprobe (tungsten needle):

Which was able to power up the R&D chip!

This works because although its not terribly accurate, most of the chip is covered with non-conductive overglass.  So despite covering other circuits, we haven't shorted them out.

Bonding: 45

With this success in mind, we refined the process to repair 45.  Here's pins 7 - 9 under repair:

Basically, 3-4 15 um gold plated tungsten wires are soldered to the leadframe, sized to just reach the pad.  Then a silver conductive epoxy dab is placed arbitrarily on the die.  The microprobe is dipped into the epoxy and carefully shaped under the microscope.  This is then carefully applied to the wires, avoiding adjacent pads.  Finally, the assembly is baked at 150C for 30 minutes to harden the epoxy.  Rinse and repeat. 

Note that partially intact bond wires were generally bonded to instead of the pad:

This is easier, stronger, and reduces risk of shorting adjacent pads

Here's the semi-final assembly:

Excluding bake time, it took about 10 minutes per connection, so approximately 3.5 hours labor for the rebonding phase. Including bake time, this phase was about 7 hours of labwork.

Final assembly

Almost there!  We now have something that looks like a functioning chip: it has a die, bond wires, and a leadframe.  I guess sometimes we take those for granted.

However, some issues may prevent a dump.  First, soldering wires proved more difficult than anticipated.  Were all of them soldered correctly?  Second, is EAn faulty?

To address these concerns, we characterized the ground impedance of a reference 8751H and compared it to 45.  4 pins got flagged as having bad values, unfortunately, including EAn.

Pins 25 (P2.4 / A12, 4.65k ref, 80k this) and 27 (P2.6 / A14, 4.65k ref, 1M this) were suspected to be cold solder joints and indeed met tolerance (25: 4.57k, 27: 4.72k) after touchup.

Pin 23 had an obvious issue:

Somehow it got knocked off the leadframe, possibly loose before we started.  Easily fixed with conductive epoxy:

Now reading reasonably (ref: 4.65k, 45: 4.89k).

Finally onto the dreaded EAn pin.  Reference impedance was 1.63k but 45 got 29k.  Fortunately, inspection indicated it was likely a cold solder joint.  After rework, it measured 31k.  Maybe its not cold?  But persisted with another rework and got 1.61k!  This is great news as EAn is likely fully intact.

Dumping

Now with all critical pins in spec we're ready to attempt a dump.

Placed chip in the dumper and...got a partial dump!  This is great news as it indicates:

• EAn works
• Chip is powered
• Generally functioning

After rattling the chip around, it randomly started dumping good.  Possibly one of the connections is still flaky, but now thinking some hot glue got scraped off a pin.

Closing thoughts

Original sample:

 
Here's the final assembly:

Would we do this again?  Unclear.  But it was an interesting tech demo that you can do this without a FIB and/or bonding machine.  Certainly not bad for just a few wires.  Of course, the real trick is to not get into this situation in the first place.

HD647180 #19, #58, #102 the Terrific Toaplan Triplets

Includes:

• 19: Vimana HD647180 QFP80
• 58: Teki Paki HD647180X QFP80
• 102: Fire Shark HD647180X QFP80

Here's a sample package:

The HD647180X is a ZTAT microcontroller incorporating the following on a single chip: an instruction set compatible with the HD64180, 16-kbyte of programmable ROM, 512-byte of RAM, memory management unit (MMU), DMA controller, timer, asynchronous serial communication interface (ASCI), clock synchronous serial 1/0 port (CSl/O), analog comparator, and parallel 1/0 pins.

Decapping revealed an unknown film covering the die:

Sometimes chips have polymide or silicone passivation.  However, this material is white clear (not yellow polymide) and a dry film (not silicone).  While decapping did not remove the film, it did loosen it.

Several test chips were cleaned up by carefully pulling it off with tweezers.  While this works, we were ideally looking for a solution that minimized poking near fragile bond wires.

Another experiment showed that hot sulfuric acid removes the film.  As the decap solution contains some sufuric acid (mostly white fuming nitric acid with a touch of sulfuric acid), it was suspected that letting it cook a bit longer would remove the film.  This proved successful and we successfully cleaned a test die:

Now that we finally have a clean die it was imaged for analysis.  The dark area in the lower section of the die is our target: EPROM.

The die image provides a good guess as to the location of the fuse lock bits.  Upon closer inspection we learn the layout is similar to other previously deprotected Hitachi parts (not shown).  Here it is on the HD647180:

ROM is masked to protect our data, while leaving the fuse bits exposed during UV erasure:

The helpful arcade community let us know someone had previously designed a breakout PCB for experimenting with HD647180 MCU. Very helpful!

Success!  To be sure, we masked basically everything but the suspected fuse:

Which also worked.

While PLCCs are great for early development (easy swap on dev board), the real chips are QFP (we don't have a socket).  So basically went through the same decap process on QFP:

And masked it to successfully read out the chip.  After several successful QFP dumps it was time to move onto the real chips.

Here's #56 decapped and masked:

Deprotection succeeded, but the dumper hardware detected a continuity fault and the ROM was missing data bits D0, D1, and D3.  Impedance check to ground verified we had a problem on those pins: while other D's read ~20k those were open.  Closer visual inspection revealed a bond wire defect:

Some gentle probing verifies D3 is in fact broken:

After weighing options we repaired them with conductive epoxy:

Success!  We proceeded to decap and deprotect the rest of the HD647180s:

Both #19 and #58 required repair.  #102 failed continuity but dump seems okay.  Interestingly enough, while all three Toaplan samples had serious bond wire defects, none of the test PLCC nor test QFP samples did (although harmless marks are barely visible).

We suspect these defects are tooling marks from the bonding machine used to build the packages.  We have been told this MCU is commonly found failed on Toaplan games, perhaps this is the reason.

#6, 7 are ULAs

 Here's 6:

Touching up the die revealed an ID:

Here's 7:

Sea of gates, uncommitted logic array, or whatever the cool kids use these days.  See for example: http://stardot.org.uk/forums/viewtopic.php?t=8539

These will need layout extracted to emulate.  While this is doable (ex: http://visual6502.org), its a lot of work with current polygon capture tools.  Additionally, emulating the logic may require a different workflow than used by ROM emulators.