al-haddad fault analyzer team - yolaelectronics4arab.yolasite.com/resources/i phone 4 study.pdf ·...
TRANSCRIPT
Al-Haddad Fault Analyzer Team
Apple iPhone 4 mainboard top
Apple iPhone 4 mainboard bottom
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
First thing is first - taking off the back
Inside we see a very large battery, a camera module, some shielding, and the antenna (which is actually the perimeter of the case).
On the board - top
First, we see a much smaller overall area than products of the previous generation. Chips appear more densely populated and we expect some consolidation into SoCs. We also see the Aprocessor (more on that later).
Additionally we can see:
• Skyworks SKY77541 GSMModule
• Skyworks SKY77542 Tx–Rx iPAC™ FEM for Dual-Band GSM/GPRS
mainboard bottom
On the board - bottom
The most obvious device is the Intel marked, 36My1EE. This is a Numonyx Nor and mobile DDR. Next to it is what looks like an Apple whiteInfineon transceiver chip. The rest of the interesting bits appear to be covered up.
ele�tr�n����ara��ya������m
taking off the back
Inside we see a very large battery, a camera module, and the antenna (which is actually
First, we see a much smaller overall area products of the previous generation. Chips
appear more densely populated and we expect some We also see the A4
GSM/GRPS Front End
Rx iPAC™ FEM for
The most obvious device is the Intel marked, Numonyx Nor and mobile DDR.
Next to it is what looks like an Apple white-labeled The rest of the interesting
Al-Haddad Fault Analyzer Team
Apple iPhone 4 mainboard bottom with cover off
Annotated die photograph of the Apple / TI Touch Screen Controller
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
mainboard bottom with cover off
Under the backside cover
Here we see the touchscreen controller with die markings 343S0499. This is the same one seen in the iTouch and Magic Mouse.
Other devices:
• Samsung K9PFG08 flash memory
• The Cirrus Logic 338S0589(Apple branded)
• The AKM8975 - newest magnetic sensor that promises to improve performance over the prior generation
• The Texas Instruments 343Screen Controller
Annotated die photograph of the Apple / TI Touch
Touch screen controller
As expected, Texas Instruments has won the touch screen controller socket with an unbranded chip marked 343S0499. Apple has followed a fairly predictable evolution in the use of controllers. The first generation of hand held products from Apple used a five-chip solution, tnext generations used a three-chip solution, and this generation uses an all-in-one chip from TI.
This device should have die markings for Texas Instruments (F761586C) and be a circuitry going across six metal layers. The device functions by measuring the changes in an electrical charge on the touch screen (in a gridthe logic on the chip is able to discern what type of multi-touch or gesture is happening. The way in which the screen itself functions is well documented.
In order to have such a powerful chip you need both the analog circuitry to drive the grids on the screen and the digital logic to quickly interpret them. This chip features close to 50% digital circuitry in the form of logic and memory, in a 90 nm process technology. The industry follows a roadmap of what is referred to as process technology generations. This 90 nm technology generation was introduced in 2004, but many devices are still made with this geometry today.processes have been subject to continuous innovation and improvement (more on the scale of a nm later).
Design Win for OmniVision
Although we have yet to completelyimage sensor module (coming very shortly), industry sources tell us that the 5 MP camerawin for OmniVision. Apple already disclosed that the sensor used backside illumination (BSI) technology and a 1.75 µm pixel. We will of coursethat once the device gets out of the teardown lab and into the chip reverse engineering lab. Chipworks has
ele�tr�n����ara��ya������m
e see the touchscreen controller with die This is the same one seen in the
flash memory
0589 audio codec
newest magnetic sensor that promises to improve performance over
343S0499 Touch
has won the touch unbranded chip
Apple has followed a fairly touch screen
The first generation of hand held chip solution, the
chip solution, and this one chip from TI.
die markings for Texas be a 3 x 3 mm die, with
six metal layers. The device ctions by measuring the changes in an electrical
charge on the touch screen (in a grid-array), hence, the logic on the chip is able to discern what type of
touch or gesture is happening. The way in is well documented.
In order to have such a powerful chip you need both the analog circuitry to drive the grids on the screen and the digital logic to quickly interpret them. This
digital circuitry in the form nm process
The industry follows a roadmap of what referred to as process technology
technology generation was devices are
with this geometry today. Of course, the processes have been subject to continuous innovation and improvement (more on the scale of a
e yet to completely tear down the image sensor module (coming very shortly), industry
MP camera is another for OmniVision. Apple already disclosed that the
sensor used backside illumination (BSI) technology l. We will of course confirm
once the device gets out of the teardown lab and into the chip reverse engineering lab. Chipworks has
Al-Haddad Fault Analyzer Team
OmniVision OV5642 die photograph with annotated pixel array
OmniVision OV5642 pixel array showing the microlens structures (similar technology in iPhone)
OmniVision OV5642 pixel circuitry the four layers) - there are five million of these (similar technology in iPhone)
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
raph with annotated
pixel array showing the microlens structures (similar technology in iPhone)
pixel circuitry (only one of five million of these
reported on a smaller-pixel 1.4 µm BSI device from OmniVision (shown at left) and we expect some similarities between the devices.
OmniVision is one of the few players to have a proven successful implementation ofart BSI process. This technology helps to maximize the ability of each pixel to collect light and deliver improved quality in a smaller sized camera. However, to focus only on the BSI would be to under sell the innovation that goes into this CMOS image sensor.
The image sensor market is one of the most hotly contested markets, with over 20 players competing for multiple applications. This competitioresulted in significant innovation intechnology, that only a few years ago was the poor sister of CCD technology. Therefore, these devices are not only interesting on a competitiveare great demonstrators of semiconductor innovation. For instance, what does it mean to fitmillion little pixels into a die area roughly the size of a pea?
It means putting in the circuitry necessary to get the signal from the sensor array, the lens for focusing the light, the color filter, the photo cathode to collect the light, and the isolation to avoid electrical noise5,000,000, 1.75µm diameter pixels
If you are interested in more details on OmniVision's technology, then you can visit our report library to learn about our full reverse engineering reports
ele�tr�n����ara��ya������m
µm BSI device from and we expect some
OmniVision is one of the few players to have a proven successful implementation of a state-of-the
helps to maximize of each pixel to collect light and
in a smaller sized However, to focus only on the BSI would be
to under sell the innovation that goes into this CMOS
The image sensor market is one of the most hotly players competing
for multiple applications. This competition has resulted in significant innovation in a CMOS-based technology, that only a few years ago was the poor sister of CCD technology. Therefore, these devices are not only interesting on a competitive basis, but are great demonstrators of semiconductor
For instance, what does it mean to fit five million little pixels into a die area roughly the size of
It means putting in the circuitry necessary to get the signal from the sensor array, the lens for focusing the
e photo cathode to collect the and the isolation to avoid electrical noise into
µm diameter pixels.
If you are interested in more details on OmniVision's our report library to
full reverse engineering reports.
Al-Haddad Fault Analyzer Team
ST three-axis accelerometer in tilt view
Broadcom BCM4329 die markings
Broadcom BCM4750
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
accelerometer in tilt view
Inertial Sensors/Movement Sensing
Microelectromechanical systems (MEMS) are used to sense the motion of the device. It is another red hot sector in the semiconductor industryrelatively recent inclusion in consumelectronics.
Based on industry sources, we believe that the AGDpart is the new three axis gyroscope designed for Apple by STMicroelectronics. These markings don't link it to the commercial version, known as the L3G4200D, and it is another piece of silicon that we will be going inside of to show the die images.
The other sensor is the STMicroelectronics STM331DLH three-axis accelerometer.
By combining the two sensor typesprovides a level of sensitivity and accuracy to translate pretty much any motion into an electrical signal. We can't wait for the "iPitch" appwill allow budding young baseball pitchers to measure the forces on their curve balls by whipping their iPhones toward home plate.
die markings
Other Networking
As expected, Broadcom won the slot for multiband low power 802.11a/b/g/n with Bluetoothamazing little chip combines several proven wireless technologies with a CMOS PA, while consuming very little power, due in part to being made in a process. Interestingly, it includes an FM radio something Apple has not yet taken advantage of.
In addition to this chip, Broadcom has also scored a win for the BCM4750 single chip GPS receiver ICfabricated at 90 nm RFCMOS.
ele�tr�n����ara��ya������m
Inertial Sensors/Movement Sensing
Microelectromechanical systems (MEMS) are used to sense the motion of the device. It is another red hot sector in the semiconductor industry fuelled by their relatively recent inclusion in consumer portable
we believe that the AGD1 three axis gyroscope designed for
Apple by STMicroelectronics. These markings don't link it to the commercial version, known as the
ce of silicon that we will be going inside of to show the die images.
The other sensor is the STMicroelectronics axis accelerometer.
By combining the two sensor types the iPhone provides a level of sensitivity and accuracy to
ty much any motion into an electrical We can't wait for the "iPitch" app which
baseball pitchers to on their curve balls by whipping
As expected, Broadcom won the slot for multiband n with Bluetooth. This
chip combines several proven wireless technologies with a CMOS PA, while consuming very
part to being made in a 65-nm process. Interestingly, it includes an FM radio - something Apple has not yet taken advantage of.
In addition to this chip, Broadcom has also scored a single chip GPS receiver IC,
Al-Haddad Fault Analyzer Team
Apple A4 microprocessor
TEM of Samsung 45 nm transistor in cross section (from Xilinx Spartan 6)
Samsung 45 nm SRAM cell and logic in topographical view
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
nm transistor in cross section
nm SRAM cell and logic in topographical
The Microprocessor
The news much of the world is waiting for is whether Apple has released yet another new microprocessor. It turns out that the A4, first seen in the iPadagain (as expected) in the iPhone 4it to be a newer 'batch' but the device remains the same, with the exception that there is double the memory. This is a package-on-package, and inside we should see a 4 Gb (512 MB) SDRAM die and the processor. Later analysis will show us whether it is one or two SDRAM dies.
Since Apple does not manufacture its own silicon,assume that they have continued tofabrication of this design to Samsunga very advanced 45 nm technologyback to our reverse engineering lab, we cannot be 100% certain either way. However, weheard about any dual-foundry strategy employed by Apple so it is a fairly safe bet to affirm our original assumption.
This chip represents the glamorous part of semiconductor technology - the smallest of the small. To understand how technology generations/shrinks are classified you need to be a semiconductor process junkie. Suffice to say, that only a few companies in the world have the R&D, manufacturing, and volume needed to manufaproducts at these very small sizes.
But what does this mean? Well, basically a transistor is logic that amplifies or switches electronic signals. An integrated circuit contains millions and millions of these. Samsung's 45 nm process was observed fully in a Xilinx Spartan 6 FPGA reverse engineering analysis we did, which showed a gate length of nm with a full transistor width of about were to say that the average a human hair is about 100 µm in diameter (100,000 nm),mean that you can fit over 2000 of these gates across it.
ele�tr�n����ara��ya������m
The news much of the world is waiting for is whether yet another new microprocessor.
first seen in the iPad, is used 4. Date codes show
it to be a newer 'batch' but the device remains the same, with the exception that there is double the
package, and inside SDRAM die and the
processor. Later analysis will show us whether it is
Since Apple does not manufacture its own silicon, we have continued to outsource the
fabrication of this design to Samsung, who are using nm technology. Until we get it
lab, we cannot be However, we have not
foundry strategy employed by Apple so it is a fairly safe bet to affirm our original
This chip represents the glamorous part of the smallest of the small.
To understand how technology generations/shrinks are classified you need to be a semiconductor process junkie. Suffice to say, that only a few companies in the world have the R&D, manufacturing, and volume needed to manufacture products at these very small sizes.
But what does this mean? Well, basically a transistor that amplifies or switches electronic signals.
An integrated circuit contains millions and millions of nm process was observed
FPGA reverse engineering showed a gate length of 47
nm with a full transistor width of about 200 nm. If we a human hair is about
, then that would of these gates
Al-Haddad Fault Analyzer Team
The 3 mm x 3 mm 33DH accelerometer and 4 mm AGD1 gyroscope on the iPhone board
STMicroelectronics LIS331DLH 3-axis accelerometer tilt-view SEM
Inside the STMicroelectronics LIS3313-axis MEMS accelerometer
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
DH accelerometer and 4 mm x
gyroscope on the iPhone board
A Closer Look at the MEMS Inertial Sensor
The accelerometer and gyroscopes are both design wins for STMicroelectronics. We have taken a closer look at each of them.
The 33DH has been identified by Chipworks as the STMicroelectronics LIS331DLH, based on the package markings. Chipworks has seen this part in an iPad.
The AGD1 appears to be essentially identical to the STMicroelectronics L3G4200D 3-axis gyroscope, based on the markings on the MEMS and ASIC dies.
axis accelerometer
331DLH
The Accelerometer
To get such a compact device, the ASIC is stacked above the MEMS structure. The MEMS structure is carefully protected in a bonded silicon lid. Cracking off the silicon lid (requiring considerable skill), we can expose the MEMS device. The top structure is the Zaxis sensor, and the bottom structure contains the X and Y sensors.
ele�tr�n����ara��ya������m
A Closer Look at the MEMS Inertial Sensor
gyroscopes are both design We have taken a closer
DH has been identified by Chipworks as the based on the package
markings. Chipworks has seen this part in an iPad.
appears to be essentially identical to the axis gyroscope, based
on the markings on the MEMS and ASIC dies.
To get such a compact device, the ASIC is stacked above the MEMS structure. The MEMS structure is carefully protected in a bonded silicon lid. Cracking off the silicon lid (requiring considerable skill), we can expose the MEMS device. The top structure is the Z-axis sensor, and the bottom structure contains the
Al-Haddad Fault Analyzer Team
STMicroelectronics LIS331DLH processing die
STMicroelectronics GK10A 3-axis gyroscope die
STMicroelectronics 3-axis gyroscopeprocessor die
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
DLH processing die
This is the ASIC die used to process the capacitive signals, and create a standard SPI/Idigital interface, and several smart features such as click and double-click recognition, wakemotion detection.
axis gyroscope die
axis gyroscope V654A ASIC
STMicroelectronics AGD1 3-Axis Gyroscope with GK10A Die Markings
This device is a new device, and is the first mm 3-axis gyroscope we have seen from STMicroelectronics. It features an integrated single silicon 3-axis sensor. Previous 3-axis gyroscopes, such as the LYPR540AH, contained silicon sensor dies.
The device appears to be essentially the same as the 3-axis L3G4200D low power digital pitch, roll, and yaw gyroscope. The L3G4200D comes packaged in a mm x 4 mm x 1 mm LGA package. AGD1 die markings are specific to the Apple iPhoneis manufactured using the same THELMA process that is used for the LIS331DH accelerometer
The L3G4200D operates as a vibrational gyroscopesense rotation of the device.
ele�tr�n����ara��ya������m
This is the ASIC die used to process the tiny capacitive signals, and create a standard SPI/I2C digital interface, and several smart features such as
click recognition, wake-up, and
Axis Gyroscope with
and is the first 4 mm x 4 axis gyroscope we have seen from
STMicroelectronics. It features an integrated single axis gyroscopes,
two separate
The device appears to be essentially the same as the low power digital pitch, roll, and
D comes packaged in a 4 . It is likely that the
die markings are specific to the Apple iPhone. It is manufactured using the same THELMA process that
DH accelerometer.
vibrational gyroscope to
Al-Haddad Fault Analyzer Team
The iPhone contains a surprising three microphones, two in the phone itself and one in the headset.
Given the orientation of the microphones in the phone, it would appear that one is for the phone and the other intended the story is never that simple, since all three microphones have different package markings.
Inside, we found thefeatured in the headset.
Knowles S1950 Package Top View
Knowles S1950 Package X-ray
Knowles S1950 ASIC Die
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
The iPhone contains a surprising three microphones, two in the phone itself and one in the headset.
Given the orientation of the microphones in the phone, it would appear that one is for the phone and the other intended for capturing video and noise cancellation. But the story is never that simple, since all three microphones have different package markings.
Inside, we found the Knowles S1950 and Infineon 1014. The Knowles Sfeatured in the headset.
Package Top View
Knowles S1950
The first of the two microphones inside the iPhone is the Knowles S1950 - found in the phone.
Knowles describes its MEMS microphones as being built with a patented CMOS/MEMS technology platform that continues to support high performance anddensity innovation in portable electronic devices. The new design variables include smaller sizes, lower profiles and mounting options, increased output capacities, new digital audio options that eliminate analog noise. For manufacturers, surface mount designs eliminate offsubassembly production costs.
Integrating the circuitry with the microphone lowers the BOM costs and simplifies manufacturing.
ele�tr�n����ara��ya������m
The iPhone contains a surprising three microphones, two in the phone itself and one
Given the orientation of the microphones in the phone, it would appear that one is for capturing video and noise cancellation. But
the story is never that simple, since all three microphones have different package
The Knowles S199 is
The first of the two microphones inside the iPhone is the
Knowles describes its MEMS microphones as being built patented CMOS/MEMS technology platform
continues to support high performance and high density innovation in portable electronic devices. The new design variables include smaller sizes, lower profiles and mounting options, increased output capacities, and new digital audio options that eliminate analog noise. For manufacturers, surface mount designs eliminate off-line
Integrating the circuitry with the microphone lowers the BOM costs and simplifies manufacturing.
Al-Haddad Fault Analyzer Team
Knowles S1950 MEMS Die
Knowles S199 Package Top View
Infineon 1014 Package Top View
Infineon 1014 Package X-ray
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
Inside the MEMS die
When looking at the MEMS die, you get a feeling of how they function. The microphone itself has a quite simple design, comprising two parallel polysilicon plates separated by a small air gap. The upper plate perforated with an array of small holes (which are needed for the MEMS release etch). A solid poly forms the bottom capacitor plate
The Knowles S199 package
The second design win for Knowles is the microphone located in the headset included with the iPhone interesting to note that the two microphonesdifferent package markings but share identical ASIC and MEMS die markings. The physical features of the locations are different, so packaging is likely a simple matter of fitting the device to the intended application.
The Infineon 1014 package
Infineon gets the design win for the second of the two microphones in the handset. Infineon is a relatively new entrant into the MEMS market (which until about a year ago was dominated by "startup" companies).
Without going into a long explanation, the industry has undergone a lot of change recently, as MEMS have gone mass market. New large device manufacturers have entered MEMS microphones and Akustica, one of the original startups, has been acquired by Bosch.
ele�tr�n����ara��ya������m
When looking at the MEMS die, you get a feeling of how The microphone itself has a quite simple
design, comprising two parallel polysilicon plates separated by a small air gap. The upper plate (poly 2) is perforated with an array of small holes (which are
A solid poly 1 plate
The second design win for Knowles is the microphone located in the headset included with the iPhone 4. It is interesting to note that the two microphones have different package markings but share identical ASIC and
physical features of the locations are different, so packaging is likely a simple matter of fitting the device to the intended application.
Infineon gets the design win for the second of the two microphones in the handset. Infineon is a relatively new
until about a year dominated by "startup" companies).
, the industry has undergone a lot of change recently, as MEMS have gone mass market. New large device manufacturers have entered MEMS microphones and Akustica, one of the
ginal startups, has been acquired by Bosch.
Al-Haddad Fault Analyzer Team
Infineon 1014 ASIC Die
Infineon 1014 MEMS Die
Haddad Fault Analyzer Team ( HFAT )
ele�tr�n����ara��ya�����
First the ASIC die
The die photo for the ASIC doesn't reveal too much about its functional layout, but we have done a full analysis on a similar device from Infineon (report list below). It could be for RF shielding, or simply to stop folks looking at the die circuitry now that teardowns are getting popular. Of course, that wouldn't deter us taking off metal layers is our bread and butter!
Now the MEMS die
This die has a similar membrane structure to the Knowles device, with a very nice artistic job done on the die markings, but they had a lot of space to work with.suppose it is the nature of the (round) beast to have a lot of wasted silicon, in an industry where shrinking a die by mere percentage points can mean the difference between profit and loss.
ele�tr�n����ara��ya������m
The die photo for the ASIC doesn't reveal too much about its functional layout, but we have done a full analysis on a similar device from Infineon (report list below). It could be for RF shielding, or simply to stop folks looking at the die circuitry now that teardowns are getting popular. Of course, that wouldn't deter us – taking off metal layers is our bread and butter!
This die has a similar membrane structure to the Knowles device, with a very nice artistic job done on the die markings, but they had a lot of space to work with. I suppose it is the nature of the (round) beast to have a
industry where shrinking a die by mere percentage points can mean the difference