μblog: engineering from the trenches

This IC Friday focuses on a BlueCore4-EXT bluetooth chip from CSR. This is the first IC Friday chip that has some extraneous designs on the die featuring some sort of dinosaur and a man in a hat. If anyone has specific knowledge of what they are, please let me know.

del.icio.us | digg

I decided to upgrade my Razr V3C to a silver Motorola Q by way of Craigslist.  After activating the phone initially, I had some problems with making phone calls. I was able to browse the web using EVDO any time, but I was unable to make any outgoing or receive incoming phone calls. On the outgoing calls, I wouln’t even hear ringing. After a some times, I dialled 911 to see what would happen assuming that the phone would be designed make every possible attempt to make that call go through. Surprisingly, I heard a few rings and quickly hung up before connecting with 911. The icon at the top of the phone indicated CDMA (1X) mode and every subsequent outbound call went through without problems. I figured that the issue was with the CDMA/EVDO switching so I did some searches and used the following steps to correct the problem:

• dial ‘##073887*’ and hit the send button
• enter ‘000000′ for the security code (don’t forget to hold the shift key to enter ‘0′ instead of ‘?’)
• you are now inside the programming menu!
• go to ‘G Test Mode’
• change the status to ‘Enabled’
• hit ‘Back’ then ‘Exit’ and then you can end the call
• dial ‘##*’ and hit the send button
• you are now in the field test mode!
• select ‘B Field Test Menu’
• select ‘E HDR Preference’ and make sure that ‘Automatic’ is selected and hit back
• select ‘F HDR Hybrid’ and make sure that ‘On’ is selected

This will make sure that the phone will switch between EVDO and CDMA depending on the task at hand. Unlike the RAZR, the USB driver for the phone is Microsoft ActiveSync, so that is what needs to be installed on a Windows machine to recharge the device. I will get a few more things posted about this phone after I play with it some more.

del.icio.us | digg

This is the Wifi chip aimed at smartphones from Marvell. Not too much to see with so much metal on the top, however, there are some open areas. A small note of interest is that there are pads on the perimeter of this chip as well as on the bottom leading me to think that the layout was destined for flip-chip bonding, such as in the iPhone, or to be put in a standard package. There is also an orientation mark at the center of the chip. There is some speculation that this chip features an ARM core and given my past experience looking at CPUs, it is reasonable that it can be in there below all of that metal. Although I don’t do RF IC design, I would speculate that the open windows are the last stages of RF amplifier designs and are open to minimize parasitic capacitance. I am not sure if the coils on the surface are used for tuning purposes or in a DC/DC converter application to power the output stage of the RF generator. As always, if you have more insight on the chip, please share!

Thanks to a tip by “marius”, I have made a composite image of the 4x scans (see below) using hugin.

w8686b13-4x-stitched.jpg

del.icio.us | digg

I apologize to those who are sick of seeing iPhone related news clogging the internet. As per request, below are the scans of the two PCBs with and without the chips. It is likely that there will be a few more IC Fridays displaying iPhone chips with the hope of finding some easter eggs and then the grand finale will be my attempt at reading the 4GB flash chip. The 48 TSSOP adapter has been ordered already and with a lot of luck, I may be able to use a method that involves interfacing the flash with a SD card reader. With even more luck, the chip will not be destroyed. Finally, if the planets align, it may be possible to read the contents of the chip in a meaningful way. After that, I will look for other gadgets to dissect. Files are about 3MB each.

iphone-nometal-front256.jpg

iphone-nometal-back256.jpg

iphone-bare-w-cpu-front256.jpg

iphone-bare-w-cpu-back256.jpg

del.icio.us | digg

While looking at a Zener diode datasheet, I scrolled past a temperature coefficient plot and became puzzled for a few moments. Why was the temperature coefficient negative for low breakdown values and high for others? I then remembered that, unfortunately, the term Zener diode is used describe diodes designed to operate in the reverse breakdown region, both due to Zener and avalanche multiplication effects. For small (<5V) breakdown voltages, the Zener effect usually dominates and has a negative temperature coefficient. For larger breakdown voltages, the breakdown mechanism is typically avalanche multiplication.

(alpha is the temperature coefficient, image is from Wikipedia)

In a true Zener diode, the p-n junction is heavily doped so that the depletion region is very thin. This can cause appreciable tunneling through the depletion region barrier. The probability is inverse exponentially proportional to the square root of the effective carrier mass and the (3/2)nd power of the bandgap energy (reference). It can be shown that the effective carrier mass increases and the bandgap energy decrease with temperature (reference) is the dominant effect. The net result is a negative temperature coefficient. That is, the probability of tunneling across the depletion region energy barrier increases with an increased temperature and therefore the effective Zener breakdown voltage is made less negative.

The story is quite the oposite with avalanche multiplication breakdown. The idea behind this process is that a electron in the depletion region experiences significant acceleration due to the applied electric field accumulating enough momentum to create an electron-hole pair upon impact with an atom in the crystal lattice. The newly liberated electron then also accelerates to required velocity to liberate another electron. Now there are two electrons with the required velocity, and so the current multiplies. What started as just one electron traveling quickly has suddenly turned into an appreciable current given a strong enough applied field. This is where the name “avalanche multiplication” comes from. Typically, in order to have high electron velocity, a thick depletion region is desired so the p-n junction is relatively lightly doped. The reason that this process has a positive temperature coefficient, or the “Zener” breakdown voltage becomes more negative with increased temperature, is that the probability of an electron colliding with an atom is decreased due to the increased thermal jitter. In this sense, the atom becomes more of a moving target so a direct collision is more difficult.

Although this may seem like a trivial matter, it is important in various designs. Beyond ESD protection circuits, “Zener” diodes are frequently used as band-gap voltage references. A good voltage reference should have near-zero temperature dependance over the operating range so a single “Zener” diode may not be good enough. Aditionally, one type of breakdown may be more compatible than the other in a certain manufacturing process.

( czrf52series.pdf ) ( ds18007.pdf )

del.icio.us | digg

This is the second Apple-branded chip on the larger iPhone logic board, the other being the processor/ram combination. Various sources around the industry are speculating that Philips/NXP is responsible for the power management chip for the phone. Judging by the Philips copyright symbol, I would have to agree that it is something like an NXP PCF50626 or PCF60633. Some of the chip’s structure can be seen under the metal pattern as well as some exposed circuits. I can see what looks to be three ADCs/comparators on the right side of the chip and at least four charge pumps in the middle and left side (noted by the square capacitors and large drive transistors).

Again, great thanks to Think Secret for sending me the chips!

Update: Here is a picture of the bare PCB. The place where this chip was attached is boxed in red.

del.icio.us | digg

As promised, thanks to the guys at Think Secret, I have started imaging the chips inside the Apple iPhone. I started out with the processor and can confirm that the chip contains both the ARM CPU and the RAM, three dies to be exact. Unfortunately, there was not much to look at under the microscope. The CPU had what looked to be a model number and the RAM chips had what looked to be part of a model number on the cut-away part of the die. No visible logos or slogans on these chips. It was also unfortunate that the chips had a layer of metal on top which prevented me from seeing most of the actual circuitry. The only marginally interesting part was that under 100x magnification, it seemed that some of the perforations in the metal on the CPU may have been letters instead of square holes. You can judge for yourself.

In any case, I removed all of the chips from the iPhone using a hot plate so feel free to suggest the next chip for imaging in the comments. The FLASH was removed separately using Chipquick and will be saved for potential reading. Below are scans (~4MB each) of the two logic boards to help you make the selection.

CPU:

RAM:

del.icio.us | digg

Well, sort of. The great guys at Think Secret have sent me the logic boards from their disassembled iPhone. The hope is that I apply my skills in opening up integrated circuits to get further images of the device. I will try to uncap and image the ICs, disassemble the circuit board layer by layer (tough order, might not happen) and finally read out the flash chip (even tougher order). Hopefully, more images will start coming up at Think Secret and/or here, and then there is another IC Friday coming up.

del.icio.us | digg

While looking up a datasheet for IC Friday, I happened to come across this gem, a manual which described the troubleshooting procedures and the circuitry inside a late 1990s Sony DVD player. The manual gives a pretty decent overview of all of the optical drive subsystems which can then sometimes be generically applied to other optical drives on the market today. Furthermore, communications are described including various error codes. Unfortunately, I did not make a note of the source website for this manual to give credit, so if you know the source, please let me know.

( sony_dvd_training_manual_118.pdf )

del.icio.us | digg