modified: Wednesday 23 October 2019
Fake TL074 opamps - adventures in decapping
A few weeks ago I had an opamp that wasn't behaving as I expected. I asked for help on the EEVBlog forums and my problem was quickly solved by several helpful users, but some of them pointed out the numbers I was seeing were very wrong for my part. It should have been performing much, much better.
Here's a photo of one of the culprits: a TL074CN J-fet input opamp.
As it turns out: it's definitely not a TL074, not even close. It appears to be a LM324, ie the cheapest opamp in the multiverse. Proof includes:
- High input offset currents
- Bad bandwidth
- Crossover distortion
This last item is particularly telling. Crossover distortion molests your signal by taking a chunk out of the middle:
Crossover distortion destroys small signals in audio applications (those around 1V p-p or less) and audible distorts larger ones. Proper TL074's are internally biased to prevent this whilst LM324's are renowned for this problem.
It turns out I wasn't the first forum user to encounter these fakes.
My chips quacked like ducks, but I needed to know if they also looked like ducks.
Over the years I have read many professional decapping stories, but these typically involve fuming nitric acid and CNC mills. I generally don't have access to these things, let alone sitting in my bedroom.
Instead I did some research into other alternative methods. Interesting & useful resources:
- SiliconPr0n wiki: Lots of different methods, including cyclic thermal and rosin boiling
- Magic's method on the EEVBlog forums pure-thermal (burnination)
- Richis Lab: Pretty pictures, all in German
Filing by hand
This didn't yield much:
You can see some of the square bondpads on the square silicon chip. Perhaps if I had access to a better microscope at this point I might have seen some more interesting details.
I was amazed that most of the chip still seemed to be there at all after this harsh and imprecise process: the layers of oxides, semiconductors and metals that make up an IC nano to micron scale thin. Perhaps a layer of epoxy sheared off the top of the chip earlier than the epoxy surrounding the chip abraded away.
Boiling in Rosin
Apparently rosin gets active (acidic?) enough at high temperatures that it can eat away the black epoxy case of a chip. I have loads of solid rosin -- it's cheap from china and blocks of it are useful when soldering. I've been described as "old-school" for using it, but it's cheap, smells nice and looks nice.
I cut my chips up (to try and minimise the amount of epoxy that needed to be dissolved) and then setup a rig to try and boil them in a little glass bottle using a heatgun:
My heatgun was on max and I placed as many shielding bricks around as possible to contain the heat, but I didn't succeed at dissolving any epoxy away. I don't think I was able to get it hot enough. I did succeed at making massive amounts of stink and smoke, but I think that was from small amounts of the rosin liquid riding up the inside of the bottle walls and burning there.
This also turned the liquid rosin an almost opaque black-brown:
I gave up after running this for somewhere around half an hour. Even the writing on the chip pieces was still there, unaffected.
Thermal cycling or "thermal shock"
Whilst several people had suggested complete incineration as an option, I didn't want to have to deal with the smell or smoke. Siliconpr0n's wiki did however list a cyclic thermal method they call "heat shock" that doesn't require burning the whole package away.
In short: heat the chip in a flame until it starts to glow red (yes, the plastic). Then quickly dunk it in cold water. Repeat this several times. Eventually the epoxy becomes so brittle that you can easily crush it with your pliers. This method still burns some epoxy, but only a tiny amount. It's smelly so do it outside.
Success after about 5 cycles:
That's the bottom of the die. It took a bit more crushing to separate it, shortly followed by "oh crap where on the floor did it go" x2.
Photographing the die
I don't have any form of microscope at hand, but I do have a 13x optical zoom camera and some cheap convex glass lenses. This is the best I could get:
We are now able to see actual tracks on the chip. Most of the bondpads are visible but leftover epoxy is obscuring a couple on the lower-right.
Luckily for me I have some friends at my university with access to some very nice microscopes. The one I borrowed made me melt at the fingertips: stepper-manipulated stage (joystick!), computer vision and it weighed enough to be able to marry.
Lo and behold:
A special thankyou for EEVblog forum users exe, magic and imo for comparing this die-shot with some others and bringing their own expertise. Analysis (complete with pictures) is on the second page of the thread.
Whilst it looks like an LM324 I am still not sure of the manufacturer. This logo and part number don't seem to match up with anything online:
After these photos I tried to remove the epoxy blob on the lower-right with some fine steel tools, however I only succeeded at gouging large sections out of the IC.
I buy lots of electronics parts from greymarket sources (eBay, Aliexpress). If you know what to expect then things are fine: order 100 2N2222 NPN transistors and you are likely to get some form of similar NPN transistor; etc. I had thought cheap opamps from greymarkets sources were pretty safe options for me to buy too.
I now realise my logic was a bit circular:
- Cheap opamps are unlikely to be faked, it's not economical
- TL074 opamps are cheap on greymarket sites
- Therefore: TL074's are safe to buy from greymarket sites
An alternative explanation could be: TL074 opamps are cheap because they are widely faked.
Well, now I at least have a good source of LM324's :D