Taking down #45 Tatakae Big Fighter, the Lazarus ROM

In a previous post we discussed dumping some 8751 chips.  However, #45 had a few issues.  First, it had some comments:

• "8741 in disguise as an 8751H" 
• "Pin 7 (EAn) has been cut internally to prevent read-out"
• EAn sometimes intentionally damaged to further hinder readout

So a bit of mystery on exactly what this chip was and if the silicon was functional.  But, more importantly, it was received like this:

Not only are most of the bond wires gone, but so is the surrounding leadframe.  In fact, only 13 / 40 pins are still attached.

However, close inspection revealed no physical damage: all pads were intact and no die damage (include EAn circuitry).  Given that, we theoretically could rebond and dump 45.  Inspection also verified that it really was an 8751H.

Still, things aren't looking good for #45 as about 32 / 40 connections are required to get a proper dump (port 3 is not required).  Somewhat fortunately, only 1 of the surviving pins are from port 3, meaning we have 12 / 32 and only need to fix 20 connections.  However, without a leadframe, new bonds can't be made.

This is a somewhat rare game and was requested to be repaired if possible.  Lets see what we can do.

Leadframe

Lets start by assembling a new leadframe.  First, 45 was stabilized in a socket.  During this process pin 17 (P3.7 RDn) broke, but fortunately this was the one unneeded pin.

Anyway, we had an 8751 leftover from earlier experiments which was torched to remove the pins:

Which were then placed in a stainless beaker with solid lye:

And gently boiled in molten lye to strip the glass off:

They were then washed and put into tinning solution to restore the surface:

This resulted in some uncoated areas:

Still, probably good enough, so put into a leadframe:

45 is beginning to look like an IC again!

Note that the donor 8751 was missing some pins and we came up one short.  But we don't need that pin, so no biggie (or so we thought...).

In order to bond in new wires, the leadframe must be stable.  Some options to fix the pins in place:

• Fill with glass: risk of breaking good pins, somewhat difficult to work with
• Hot glue: easy to work with, easy to fix mistakes.  Mild strength
• Epoxy: semi permament.  Very strong, heat resistant
• CA glue: easy to work with, but dissolved by cleaning solvents (ie acetone)

At first hot glue seemed like a good option:

But quickly realized was going to cause issues by bakes required in later steps.  So 45 was cleaned and the pins went through cleaning, including hot H2SO4 rinse to dissolve the hot glue:

We took this opportunity to clean the pins up proper.  So they were pickled in hydrochloric acid and re-tinned to get clean pins.  The cleaned leadframe re-assembled:

Note the black streaks and other marks are gone.

Next coated with epoxy:

Packaged discolored from briefly baking (for quicker cure) too hot (200C).  It was lowered to 150C for subsequent operations.

But oops!  We put the missing pin in the wrong side.  Instead of taking apart another 8751H, decided to just add a bodge wire:

Although not placed accurately, epoxy prevents it from shorting adjacent pins.

Mask

Just like other 8751s, security fuses were cleared using a UV opaque mask:

It was unknown if the chip was actually protected.  But, presumably it was only sent for decap work because it was protected.  While we could mask as needed later, it is lower risk to do so before the bond wires are reattached.

Bonding: R&D

The chip, as originally assembled, was wedge bonded to the ceramic carrier.  This would be the quickest way to repair the IC and certainly the recommended way.  But there were some complications.

First, can we bond gold wires to the old aluminum wires?  While several team members have friends with gold bonders, none have access to aluminum bonders.  Anyway, gold wires would probably work since pads are typically aluminum, but would need to test.

Second, bonder access, although maybe possible, was going to take a lot of coordination.

So, wedge bonding was not out of the question but was going to take a while to arrange if nothing else.

An earlier R&D project explored reviving an unrelated severely damaged chip.  This particular chip not only had the wires removed, but the pads themselves were ripped up.  Here's Vcc and Vss:

This other chip can't be wedge bonded since there's no longer a pad to bond to.  However, there's still some metal sticking out.  Theoretically we could FIB a new pad and bond it.

But FIB time is expensive.  What could we do instead?  How about some fancy glue:

Applied very carefully by hand using a microprobe (tungsten needle):

Which was able to power up the R&D chip!

This works because although its not terribly accurate, most of the chip is covered with non-conductive overglass.  So despite covering other circuits, we haven't shorted them out.

Bonding: 45

With this success in mind, we refined the process to repair 45.  Here's pins 7 - 9 under repair:

Basically, 3-4 15 um gold plated tungsten wires are soldered to the leadframe, sized to just reach the pad.  Then a silver conductive epoxy dab is placed arbitrarily on the die.  The microprobe is dipped into the epoxy and carefully shaped under the microscope.  This is then carefully applied to the wires, avoiding adjacent pads.  Finally, the assembly is baked at 150C for 30 minutes to harden the epoxy.  Rinse and repeat. 

Note that partially intact bond wires were generally bonded to instead of the pad:

This is easier, stronger, and reduces risk of shorting adjacent pads

Here's the semi-final assembly:

Excluding bake time, it took about 10 minutes per connection, so approximately 3.5 hours labor for the rebonding phase. Including bake time, this phase was about 7 hours of labwork.

Final assembly

Almost there!  We now have something that looks like a functioning chip: it has a die, bond wires, and a leadframe.  I guess sometimes we take those for granted.

However, some issues may prevent a dump.  First, soldering wires proved more difficult than anticipated.  Were all of them soldered correctly?  Second, is EAn faulty?

To address these concerns, we characterized the ground impedance of a reference 8751H and compared it to 45.  4 pins got flagged as having bad values, unfortunately, including EAn.

Pins 25 (P2.4 / A12, 4.65k ref, 80k this) and 27 (P2.6 / A14, 4.65k ref, 1M this) were suspected to be cold solder joints and indeed met tolerance (25: 4.57k, 27: 4.72k) after touchup.

Pin 23 had an obvious issue:

Somehow it got knocked off the leadframe, possibly loose before we started.  Easily fixed with conductive epoxy:

Now reading reasonably (ref: 4.65k, 45: 4.89k).

Finally onto the dreaded EAn pin.  Reference impedance was 1.63k but 45 got 29k.  Fortunately, inspection indicated it was likely a cold solder joint.  After rework, it measured 31k.  Maybe its not cold?  But persisted with another rework and got 1.61k!  This is great news as EAn is likely fully intact.

Dumping

Now with all critical pins in spec we're ready to attempt a dump.

Placed chip in the dumper and...got a partial dump!  This is great news as it indicates:

• EAn works
• Chip is powered
• Generally functioning

After rattling the chip around, it randomly started dumping good.  Possibly one of the connections is still flaky, but now thinking some hot glue got scraped off a pin.

Closing thoughts

Original sample:

 
Here's the final assembly:

Would we do this again?  Unclear.  But it was an interesting tech demo that you can do this without a FIB and/or bonding machine.  Certainly not bad for just a few wires.  Of course, the real trick is to not get into this situation in the first place.