Al-Haddad Fault Analyzer Team - Yolaelectronics4arab.yolasite.com/resources/i phone 4 study.pdf · Al-Haddad Fault Analyzer Team Apple iPhone 4 mainboard top Apple iPhone 4 mainboard

Al-Haddad Fault Analyzer Team

Apple iPhone 4 mainboard top

Apple iPhone 4 mainboard bottom

Haddad Fault Analyzer Team ( HFAT )

ele�tr�n��ara��ya��

First thing is first - taking off the back

Inside we see a very large battery, a camera module, some shielding, and the antenna (which is actually the perimeter of the case).

On the board - top

First, we see a much smaller overall area than products of the previous generation. Chips appear more densely populated and we expect some consolidation into SoCs. We also see the Aprocessor (more on that later).

Additionally we can see:

• Skyworks SKY77541 GSMModule

• Skyworks SKY77542 Tx–Rx iPAC™ FEM for Dual-Band GSM/GPRS

mainboard bottom

On the board - bottom

The most obvious device is the Intel marked, 36My1EE. This is a Numonyx Nor and mobile DDR. Next to it is what looks like an Apple whiteInfineon transceiver chip. The rest of the interesting bits appear to be covered up.

ele�tr�n��ara��ya��m

taking off the back

Inside we see a very large battery, a camera module, and the antenna (which is actually

First, we see a much smaller overall area products of the previous generation. Chips

appear more densely populated and we expect some We also see the A4

GSM/GRPS Front End

Rx iPAC™ FEM for

The most obvious device is the Intel marked, Numonyx Nor and mobile DDR.

Next to it is what looks like an Apple white-labeled The rest of the interesting


Apple iPhone 4 mainboard bottom with cover off

Annotated die photograph of the Apple / TI Touch Screen Controller



mainboard bottom with cover off

Under the backside cover

Here we see the touchscreen controller with die markings 343S0499. This is the same one seen in the iTouch and Magic Mouse.

Other devices:

• Samsung K9PFG08 flash memory

• The Cirrus Logic 338S0589(Apple branded)

• The AKM8975 - newest magnetic sensor that promises to improve performance over the prior generation

• The Texas Instruments 343Screen Controller

Annotated die photograph of the Apple / TI Touch

Touch screen controller

As expected, Texas Instruments has won the touch screen controller socket with an unbranded chip marked 343S0499. Apple has followed a fairly predictable evolution in the use of controllers. The first generation of hand held products from Apple used a five-chip solution, tnext generations used a three-chip solution, and this generation uses an all-in-one chip from TI.

This device should have die markings for Texas Instruments (F761586C) and be a circuitry going across six metal layers. The device functions by measuring the changes in an electrical charge on the touch screen (in a gridthe logic on the chip is able to discern what type of multi-touch or gesture is happening. The way in which the screen itself functions is well documented.

In order to have such a powerful chip you need both the analog circuitry to drive the grids on the screen and the digital logic to quickly interpret them. This chip features close to 50% digital circuitry in the form of logic and memory, in a 90 nm process technology. The industry follows a roadmap of what is referred to as process technology generations. This 90 nm technology generation was introduced in 2004, but many devices are still made with this geometry today.processes have been subject to continuous innovation and improvement (more on the scale of a nm later).

Design Win for OmniVision

Although we have yet to completelyimage sensor module (coming very shortly), industry sources tell us that the 5 MP camerawin for OmniVision. Apple already disclosed that the sensor used backside illumination (BSI) technology and a 1.75 µm pixel. We will of coursethat once the device gets out of the teardown lab and into the chip reverse engineering lab. Chipworks has


e see the touchscreen controller with die This is the same one seen in the

flash memory

0589 audio codec

newest magnetic sensor that promises to improve performance over

343S0499 Touch

has won the touch unbranded chip

Apple has followed a fairly touch screen

The first generation of hand held chip solution, the

chip solution, and this one chip from TI.

die markings for Texas be a 3 x 3 mm die, with

six metal layers. The device ctions by measuring the changes in an electrical

charge on the touch screen (in a grid-array), hence, the logic on the chip is able to discern what type of

touch or gesture is happening. The way in is well documented.

In order to have such a powerful chip you need both the analog circuitry to drive the grids on the screen and the digital logic to quickly interpret them. This

digital circuitry in the form nm process

The industry follows a roadmap of what referred to as process technology

technology generation was devices are

with this geometry today. Of course, the processes have been subject to continuous innovation and improvement (more on the scale of a

e yet to completely tear down the image sensor module (coming very shortly), industry

MP camera is another for OmniVision. Apple already disclosed that the

sensor used backside illumination (BSI) technology l. We will of course confirm

once the device gets out of the teardown lab and into the chip reverse engineering lab. Chipworks has


OmniVision OV5642 die photograph with annotated pixel array

OmniVision OV5642 pixel array showing the microlens structures (similar technology in iPhone)

OmniVision OV5642 pixel circuitry the four layers) - there are five million of these (similar technology in iPhone)



raph with annotated

pixel array showing the microlens structures (similar technology in iPhone)

pixel circuitry (only one of five million of these

reported on a smaller-pixel 1.4 µm BSI device from OmniVision (shown at left) and we expect some similarities between the devices.

OmniVision is one of the few players to have a proven successful implementation ofart BSI process. This technology helps to maximize the ability of each pixel to collect light and deliver improved quality in a smaller sized camera. However, to focus only on the BSI would be to under sell the innovation that goes into this CMOS image sensor.

The image sensor market is one of the most hotly contested markets, with over 20 players competing for multiple applications. This competitioresulted in significant innovation intechnology, that only a few years ago was the poor sister of CCD technology. Therefore, these devices are not only interesting on a competitiveare great demonstrators of semiconductor innovation. For instance, what does it mean to fitmillion little pixels into a die area roughly the size of a pea?

It means putting in the circuitry necessary to get the signal from the sensor array, the lens for focusing the light, the color filter, the photo cathode to collect the light, and the isolation to avoid electrical noise5,000,000, 1.75µm diameter pixels

If you are interested in more details on OmniVision's technology, then you can visit our report library to learn about our full reverse engineering reports


µm BSI device from and we expect some

OmniVision is one of the few players to have a proven successful implementation of a state-of-the

helps to maximize of each pixel to collect light and

in a smaller sized However, to focus only on the BSI would be

to under sell the innovation that goes into this CMOS

The image sensor market is one of the most hotly players competing

for multiple applications. This competition has resulted in significant innovation in a CMOS-based technology, that only a few years ago was the poor sister of CCD technology. Therefore, these devices are not only interesting on a competitive basis, but are great demonstrators of semiconductor

For instance, what does it mean to fit five million little pixels into a die area roughly the size of

It means putting in the circuitry necessary to get the signal from the sensor array, the lens for focusing the

e photo cathode to collect the and the isolation to avoid electrical noise into

µm diameter pixels.

If you are interested in more details on OmniVision's our report library to

full reverse engineering reports.


ST three-axis accelerometer in tilt view

Broadcom BCM4329 die markings

Broadcom BCM4750



accelerometer in tilt view

Inertial Sensors/Movement Sensing

Microelectromechanical systems (MEMS) are used to sense the motion of the device. It is another red hot sector in the semiconductor industryrelatively recent inclusion in consumelectronics.

Based on industry sources, we believe that the AGDpart is the new three axis gyroscope designed for Apple by STMicroelectronics. These markings don't link it to the commercial version, known as the L3G4200D, and it is another piece of silicon that we will be going inside of to show the die images.

The other sensor is the STMicroelectronics STM331DLH three-axis accelerometer.

By combining the two sensor typesprovides a level of sensitivity and accuracy to translate pretty much any motion into an electrical signal. We can't wait for the "iPitch" appwill allow budding young baseball pitchers to measure the forces on their curve balls by whipping their iPhones toward home plate.

die markings

Other Networking

As expected, Broadcom won the slot for multiband low power 802.11a/b/g/n with Bluetoothamazing little chip combines several proven wireless technologies with a CMOS PA, while consuming very little power, due in part to being made in a process. Interestingly, it includes an FM radio something Apple has not yet taken advantage of.

In addition to this chip, Broadcom has also scored a win for the BCM4750 single chip GPS receiver ICfabricated at 90 nm RFCMOS.


Inertial Sensors/Movement Sensing

Microelectromechanical systems (MEMS) are used to sense the motion of the device. It is another red hot sector in the semiconductor industry fuelled by their relatively recent inclusion in consumer portable

we believe that the AGD1 three axis gyroscope designed for

Apple by STMicroelectronics. These markings don't link it to the commercial version, known as the

ce of silicon that we will be going inside of to show the die images.

The other sensor is the STMicroelectronics axis accelerometer.

By combining the two sensor types the iPhone provides a level of sensitivity and accuracy to

ty much any motion into an electrical We can't wait for the "iPitch" app which

baseball pitchers to on their curve balls by whipping

As expected, Broadcom won the slot for multiband n with Bluetooth. This

chip combines several proven wireless technologies with a CMOS PA, while consuming very

part to being made in a 65-nm process. Interestingly, it includes an FM radio - something Apple has not yet taken advantage of.

In addition to this chip, Broadcom has also scored a single chip GPS receiver IC,


Apple A4 microprocessor

TEM of Samsung 45 nm transistor in cross section (from Xilinx Spartan 6)

Samsung 45 nm SRAM cell and logic in topographical view



nm transistor in cross section

nm SRAM cell and logic in topographical

The Microprocessor

The news much of the world is waiting for is whether Apple has released yet another new microprocessor. It turns out that the A4, first seen in the iPadagain (as expected) in the iPhone 4it to be a newer 'batch' but the device remains the same, with the exception that there is double the memory. This is a package-on-package, and inside we should see a 4 Gb (512 MB) SDRAM die and the processor. Later analysis will show us whether it is one or two SDRAM dies.

Since Apple does not manufacture its own silicon,assume that they have continued tofabrication of this design to Samsunga very advanced 45 nm technologyback to our reverse engineering lab, we cannot be 100% certain either way. However, weheard about any dual-foundry strategy employed by Apple so it is a fairly safe bet to affirm our original assumption.

This chip represents the glamorous part of semiconductor technology - the smallest of the small. To understand how technology generations/shrinks are classified you need to be a semiconductor process junkie. Suffice to say, that only a few companies in the world have the R&D, manufacturing, and volume needed to manufaproducts at these very small sizes.

But what does this mean? Well, basically a transistor is logic that amplifies or switches electronic signals. An integrated circuit contains millions and millions of these. Samsung's 45 nm process was observed fully in a Xilinx Spartan 6 FPGA reverse engineering analysis we did, which showed a gate length of nm with a full transistor width of about were to say that the average a human hair is about 100 µm in diameter (100,000 nm),mean that you can fit over 2000 of these gates across it.


The news much of the world is waiting for is whether yet another new microprocessor.

first seen in the iPad, is used 4. Date codes show

it to be a newer 'batch' but the device remains the same, with the exception that there is double the

package, and inside SDRAM die and the

processor. Later analysis will show us whether it is

Since Apple does not manufacture its own silicon, we have continued to outsource the

fabrication of this design to Samsung, who are using nm technology. Until we get it

lab, we cannot be However, we have not

foundry strategy employed by Apple so it is a fairly safe bet to affirm our original

This chip represents the glamorous part of the smallest of the small.

To understand how technology generations/shrinks are classified you need to be a semiconductor process junkie. Suffice to say, that only a few companies in the world have the R&D, manufacturing, and volume needed to manufacture products at these very small sizes.

But what does this mean? Well, basically a transistor that amplifies or switches electronic signals.

An integrated circuit contains millions and millions of nm process was observed

FPGA reverse engineering showed a gate length of 47

nm with a full transistor width of about 200 nm. If we a human hair is about

, then that would of these gates


The 3 mm x 3 mm 33DH accelerometer and 4 mm AGD1 gyroscope on the iPhone board

STMicroelectronics LIS331DLH 3-axis accelerometer tilt-view SEM

Inside the STMicroelectronics LIS3313-axis MEMS accelerometer



DH accelerometer and 4 mm x

gyroscope on the iPhone board

A Closer Look at the MEMS Inertial Sensor

The accelerometer and gyroscopes are both design wins for STMicroelectronics. We have taken a closer look at each of them.

The 33DH has been identified by Chipworks as the STMicroelectronics LIS331DLH, based on the package markings. Chipworks has seen this part in an iPad.

The AGD1 appears to be essentially identical to the STMicroelectronics L3G4200D 3-axis gyroscope, based on the markings on the MEMS and ASIC dies.

axis accelerometer

331DLH

The Accelerometer

To get such a compact device, the ASIC is stacked above the MEMS structure. The MEMS structure is carefully protected in a bonded silicon lid. Cracking off the silicon lid (requiring considerable skill), we can expose the MEMS device. The top structure is the Zaxis sensor, and the bottom structure contains the X and Y sensors.


A Closer Look at the MEMS Inertial Sensor

gyroscopes are both design We have taken a closer

DH has been identified by Chipworks as the based on the package

markings. Chipworks has seen this part in an iPad.

appears to be essentially identical to the axis gyroscope, based

on the markings on the MEMS and ASIC dies.

To get such a compact device, the ASIC is stacked above the MEMS structure. The MEMS structure is carefully protected in a bonded silicon lid. Cracking off the silicon lid (requiring considerable skill), we can expose the MEMS device. The top structure is the Z-axis sensor, and the bottom structure contains the


STMicroelectronics LIS331DLH processing die

STMicroelectronics GK10A 3-axis gyroscope die

STMicroelectronics 3-axis gyroscopeprocessor die



DLH processing die

This is the ASIC die used to process the capacitive signals, and create a standard SPI/Idigital interface, and several smart features such as click and double-click recognition, wakemotion detection.

axis gyroscope die

axis gyroscope V654A ASIC

STMicroelectronics AGD1 3-Axis Gyroscope with GK10A Die Markings

This device is a new device, and is the first mm 3-axis gyroscope we have seen from STMicroelectronics. It features an integrated single silicon 3-axis sensor. Previous 3-axis gyroscopes, such as the LYPR540AH, contained silicon sensor dies.

The device appears to be essentially the same as the 3-axis L3G4200D low power digital pitch, roll, and yaw gyroscope. The L3G4200D comes packaged in a mm x 4 mm x 1 mm LGA package. AGD1 die markings are specific to the Apple iPhoneis manufactured using the same THELMA process that is used for the LIS331DH accelerometer

The L3G4200D operates as a vibrational gyroscopesense rotation of the device.


This is the ASIC die used to process the tiny capacitive signals, and create a standard SPI/I2C digital interface, and several smart features such as

click recognition, wake-up, and

Axis Gyroscope with

and is the first 4 mm x 4 axis gyroscope we have seen from

STMicroelectronics. It features an integrated single axis gyroscopes,

two separate

The device appears to be essentially the same as the low power digital pitch, roll, and

D comes packaged in a 4 . It is likely that the

die markings are specific to the Apple iPhone. It is manufactured using the same THELMA process that

DH accelerometer.

vibrational gyroscope to


The iPhone contains a surprising three microphones, two in the phone itself and one in the headset.

Given the orientation of the microphones in the phone, it would appear that one is for the phone and the other intended the story is never that simple, since all three microphones have different package markings.

Inside, we found thefeatured in the headset.

Knowles S1950 Package Top View

Knowles S1950 Package X-ray

Knowles S1950 ASIC Die



The iPhone contains a surprising three microphones, two in the phone itself and one in the headset.

Given the orientation of the microphones in the phone, it would appear that one is for the phone and the other intended for capturing video and noise cancellation. But the story is never that simple, since all three microphones have different package markings.

Inside, we found the Knowles S1950 and Infineon 1014. The Knowles Sfeatured in the headset.

Package Top View

Knowles S1950

The first of the two microphones inside the iPhone is the Knowles S1950 - found in the phone.

Knowles describes its MEMS microphones as being built with a patented CMOS/MEMS technology platform that continues to support high performance anddensity innovation in portable electronic devices. The new design variables include smaller sizes, lower profiles and mounting options, increased output capacities, new digital audio options that eliminate analog noise. For manufacturers, surface mount designs eliminate offsubassembly production costs.

Integrating the circuitry with the microphone lowers the BOM costs and simplifies manufacturing.


The iPhone contains a surprising three microphones, two in the phone itself and one

Given the orientation of the microphones in the phone, it would appear that one is for capturing video and noise cancellation. But

the story is never that simple, since all three microphones have different package

The Knowles S199 is

The first of the two microphones inside the iPhone is the

Knowles describes its MEMS microphones as being built patented CMOS/MEMS technology platform

continues to support high performance and high density innovation in portable electronic devices. The new design variables include smaller sizes, lower profiles and mounting options, increased output capacities, and new digital audio options that eliminate analog noise. For manufacturers, surface mount designs eliminate off-line

Integrating the circuitry with the microphone lowers the BOM costs and simplifies manufacturing.


Knowles S1950 MEMS Die

Knowles S199 Package Top View

Infineon 1014 Package Top View

Infineon 1014 Package X-ray



Inside the MEMS die

When looking at the MEMS die, you get a feeling of how they function. The microphone itself has a quite simple design, comprising two parallel polysilicon plates separated by a small air gap. The upper plate perforated with an array of small holes (which are needed for the MEMS release etch). A solid poly forms the bottom capacitor plate

The Knowles S199 package

The second design win for Knowles is the microphone located in the headset included with the iPhone interesting to note that the two microphonesdifferent package markings but share identical ASIC and MEMS die markings. The physical features of the locations are different, so packaging is likely a simple matter of fitting the device to the intended application.

The Infineon 1014 package

Infineon gets the design win for the second of the two microphones in the handset. Infineon is a relatively new entrant into the MEMS market (which until about a year ago was dominated by "startup" companies).

Without going into a long explanation, the industry has undergone a lot of change recently, as MEMS have gone mass market. New large device manufacturers have entered MEMS microphones and Akustica, one of the original startups, has been acquired by Bosch.


When looking at the MEMS die, you get a feeling of how The microphone itself has a quite simple

design, comprising two parallel polysilicon plates separated by a small air gap. The upper plate (poly 2) is perforated with an array of small holes (which are

A solid poly 1 plate

The second design win for Knowles is the microphone located in the headset included with the iPhone 4. It is interesting to note that the two microphones have different package markings but share identical ASIC and

physical features of the locations are different, so packaging is likely a simple matter of fitting the device to the intended application.

Infineon gets the design win for the second of the two microphones in the handset. Infineon is a relatively new

until about a year dominated by "startup" companies).

, the industry has undergone a lot of change recently, as MEMS have gone mass market. New large device manufacturers have entered MEMS microphones and Akustica, one of the

ginal startups, has been acquired by Bosch.


Infineon 1014 ASIC Die

Infineon 1014 MEMS Die



First the ASIC die

The die photo for the ASIC doesn't reveal too much about its functional layout, but we have done a full analysis on a similar device from Infineon (report list below). It could be for RF shielding, or simply to stop folks looking at the die circuitry now that teardowns are getting popular. Of course, that wouldn't deter us taking off metal layers is our bread and butter!

Now the MEMS die

This die has a similar membrane structure to the Knowles device, with a very nice artistic job done on the die markings, but they had a lot of space to work with.suppose it is the nature of the (round) beast to have a lot of wasted silicon, in an industry where shrinking a die by mere percentage points can mean the difference between profit and loss.


The die photo for the ASIC doesn't reveal too much about its functional layout, but we have done a full analysis on a similar device from Infineon (report list below). It could be for RF shielding, or simply to stop folks looking at the die circuitry now that teardowns are getting popular. Of course, that wouldn't deter us – taking off metal layers is our bread and butter!

This die has a similar membrane structure to the Knowles device, with a very nice artistic job done on the die markings, but they had a lot of space to work with. I suppose it is the nature of the (round) beast to have a

industry where shrinking a die by mere percentage points can mean the difference

Al-Haddad Fault Analyzer Team - Yolaelectronics4arab.yolasite.com/resources/i phone 4 study.pdf · Al-Haddad Fault Analyzer Team Apple iPhone 4 mainboard top Apple iPhone 4 mainboard

Documents