Thursday, January 24, 2008

ATMEGA88 Teardown

An 8k FLASH, 512 bytes EEPROM, 512 bytes SRAM CPU operating 1:1 with the external world unlike those Microchip PIC's we love to write up about :).

It's a 350 nanometer (nm), 3 metal layer device fabricated in a CMOS process.  It's beautiful to say the least;  We've torn it down and thought we'd blog about it!

[Note:  Clicking on pictures will give you a large ~13 MB file]

The process Atmel uses on their .35 micrometer (um) technology is awesome.  The picture above is 200x magnified of the die (aka the substrate).


Using a little HydroFluoric Acid (HF) and we partially removed the top metal layer (M3).  Everything is now clearly visible for our analysis.

After delaying earlier above, we can now recognize features that were otherwise hidden such as the Static RAM (SRAM) and the 32 working registers.

As we mentioned earlier, we used the word, "awesome" because check this out- It's so beautifully layed out that we can etch off just enough of the top metal layer to leave it's residue so it's still visible depending on the focal point of the microscope!  This is very important.  See the pictures below to better understand.

The pictures above and below are the same pictures with the exception that the lower picture has M3 removed but the trough in the SIO2 remains (e.g. the layer has not been completely etched off). 

Can you see why we said Atmel's process is awesome?  We removed obscuring metal but can still see where it went (woot!).


The two photos above contain two of the 30+ configuration fuses present however it makes a person wonder why did Atmel cover the floating gate of the upper fuse with a plate of metal (remember the microchip article with the plates over the floating gates?)

 We highlighted a track per fuse in the above photos.  What do you think these red tracks might represent?


  1. You guys are like a beautiful french woman.. I have no clue what you are saying but it turns me on.

  2. Thanks Tom! We love you too ;)

  3. Nice photos. I had to pull up the larger one to figure out the context of those two smaller photos of the fuses. You rotated them 90 degrees to the right. The fuse in question is the lowest left one in the area labelled "CONFIG FUSES" in the main picture. One of the two red tracks leads out of the fuse area into the logic block at far left below the SRAM and goes to the fuse that is not covered by metal. The other goes to the fuse covered with metal.

    If I were to guess, I might wonder if there's a way to tie a select line such that the non-security fuse is read instead of the security-related one.

  4. Excellent thinking Nate! We can (change the fuse outputs) but that bit whose floating-gate was covered was related to the BLB0 selection. There are 4 possibilities meaning you need 2 bits width (to offer 0..3) so there is this fuse and one other fuse to the right.

    The photo was turned to orientate the fuses in a more correct manner where-as the die shots are orientated for the nomenclature (ease of reading).

    The Bootloader bits and the code protection fuses are being hidden by metal to answer the riddle :-).

  5. I see. I wasn't familiar with Atmel lock bits. Interesting that the boot loader protection can be separate from the app protection.

  6. Total of 6 bits for lock protection-

    2 for programming mode program/verify (e.g. the lock bits)
    4 for BSL setting (used in the application if memory has been segmented into a boot area and application area).

    Flylogic's wishlist:

    Allow Oscillator selection from internal to external via a register bit
    Give us a UART on the Tiny24 type 14-pin devices


  7. Hi,
    I have a few parts (MOSFETs) that I suspect are forgeries. I'd like to take them apart and check the construction to verify.
    I've tried dipping the transistors in feCl3, to dissolve away the copper with some results. Now I want to get at the die from the other side.

    What (homebrew) approach would you recommend to remove the top plastic (or is it ceramic) ?
    (Obviously I can't afford your services - but looking on the bright side - I'm not American, so I can use any toxic/caustic chemicals that you wouldn't be able to recommend to a USian. ;-)

  8. First things first-

    Anyone reading this can see the Material Safety DataSheet (MSDS) here:

    Have you tried heating the solution and the part before?

    Is there any ceramic around the MOSFET? Perhaps a picture might be helpful of the piece.

    We would suggest heat but if you do so, do it very carefully. Good luck!

  9. Tamper-detection sense leads?

  10. You write:
    The two photos above contain two of the 30+ configuration fuses present however it makes a person wonder why did Atmel cover the floating gate of the upper fuse with a plate of metal (remember the microchip article with the plates over the floating gates?)

    The linked article did not make it entirely clear to me, but is this the answer?
    One set of structures grabbed my attention immediately: a set of metal shields over transistors, following a regular pattern that had about the right number of devices to account for all the security bits. Full metal shields covering a device is very rare in silicon, and like a big X marking the spot, it draws attention to itself as holding something very important.

  11. There is a sophisticated equipment (instrument) to depackaging chip, but what it is I do not know, if you know the part number or manufacturer please post.

  12. Ahhh the smell of HF in the morning . . .smells like . . . geekery!

  13. Great breakdown! Really helps to see all the areas of the chip explained. You have a little typo in the first sentence after the third picture.

  14. [...] lazyness back at Atmel HQ.  All we did was look for the metal plates we detailed back in our ATMEGA88 teardown last year and quickly deduced which outputs were the proper outputs in under 20 [...]

  15. Than to delete metal over the transistor? That it is possible UV light reset fuse.