4 Metal, 350 nanometer fabrication process, EAL4+ smart card. A device fabricated in 2002 and yet, today the latest ST19W/N series only main differences are the ROM data bus output width into the decrypt block and the fabrication process (180nm and 150nm shrink).
The device was dipped into a HydroFluoric (HF) bath until the active shielding fell off. The result of this saved about 10 minutes of polishing to remove the surface oxide and Metal 4 (M4). This also helps begin the polishing process on the lower layers fairly evenly.
The oxide thickness of a layer once the passivation oxide is removed requires less than 2 minutes per layer to remove. We purposely stop just before the Metal 3 (M3) surface is exposed leaving the vias visibly clear (there are several gates tied to the ground of the mesh on Metal 4 (M4) as well as the active shield’s begin and end vias.
As Metal 3 (M3) was removed exposing the M2 layer, the device is beginning to not look so complicated.
Metal 1 (M1) shows us all the transistors. We did not polish down to the poly. Most of the gates are understandable without it for the purposes of finding the clear data bus.
Most likely, these NVM areas in Figure 7 & 8 are trimming or security violation related. No further investigation is planned on these areas (it isn’t necessary).