Monday, July 23, 2012

I've joined the CMOSfold team :)

I've been added as a contributing author to CMOSfold, the "weekly centerfold" of nude semiconductors run by my friend and colleague John McMaster. It contains a large number of brief overviews and top-metal photos of various chips, without much analysis.

I'll try and do a post every week or two there on a random chip I have in my personal collection. They may later be followed by more in-depth analysis here.

Saturday, July 21, 2012

Lab Tour, part 2 - Electronics Assembly/Test

This is the second post in my "Lab Tour" series. If you haven't read the first one, it's here.

As with last time I'll begin with an overview of the work area. It consists of two back-to-back workbenches that are typically used in tandem.

Assembly and test bench
The first bench is used for component placement prior to reflow soldering, as well as testing boards after assembly. A dedicated lab computer is located here for reading schematics and datasheets while working. Unfortunately it's not fast enough to run an FPGA toolchain but I intend to replace it with something that can do so in the future.

I have a grounded mat plus a wrist strap for working at this bench, grounded through the earth terminal of my benchtop power supply.

Close-up of test equipment
My only other piece of test equipment at the moment is my Rigol DS1102D 100MHz mixed-signal oscilloscope. I'm looking into getting a function generator at some point but much of my disposable income lately has been going into FPGAs and board fab so it'll have to wait a while!

Just off the right side of the frame is my cheap 10x/30x stereo inspection microscope from Premiere. It's proved invaluable for checking the quality of component placement and looking for shorts, as well as just providing a close-up view when manually applying solder paste or placing components.

Through-hole component inventory
I keep all of my SMT components in drawers of this bench, but the through-hole parts are too big so they have to go on top. This is the oldest part of my lab by far - I've had these organizers since I was 10 or 11 years old and many of the passive components date almost that far back.

Soldering bench
The second bench is used for hand soldering through-hole components, rework, and cleaning of boards.

Soldering equipment
All of my soldering equipment is made by Aoyue, a cheap Chinese clone (right down to the model numbers!) of Hakko designs. They've worked fine for me so far.

If you look closely at the full resolution frame you can see that the left-hand iron is labeled "SAC305 ONLY" and the right hand is labeled "LEAD ALLOYS ONLY". I try to avoid mixing solder alloys when I can, and rather than swapping tips it's easier to have two identical irons. The majority of my work is lead-free but occasionally I find it necessary to rework an older board using 63/37.

The hot air pencil is absolutely indispensable for SMT soldering. It allows me to reflow a single component during rework without putting the entire board in the oven, getting much nicer looking joints than I would if I used an iron as well as taking advantage of the self-aligning properties of the reflow process. It's also about the only way to remove a large QFP intact.

Just visible at the right side of the frame is an activated-charcoal solder fume extractor. While I do work in a large room with good ventilation, it's a lot harder to replace your lungs than a TSSOP so I prefer to err on the side of caution ;)

Solvent tray
I almost always use no-clean rosin fluxes but it's still handy to have a way of removing excess from a board, or cleaning dirt off a board that's been sitting around for a while. For this I have a selection of various solvents ranging from distilled water to acetone to alcohols, as well as water-based detergents from Alconox. I don't have an ultrasonic cleaner at the moment but I plan to add one to the wet bench in a few months.

Sunday, July 15, 2012

MEMS pressure sensor teardown - part 2

The sensor I studied in my last post was delivered to me in a partially disassembled state. After returning to the e-waste dumpster we were able to find a fully intact unit.

SiliconPr0n wiki page: http://siliconpr0n.org/archive/doku.php?id=honeywell_awm2100v

The part number is clearly visible, it's a Honeywell AWM2100V airflow sensor. Some of my analysis from earlier was a bit off - it turns out that there's two ports on the device and some of the resistors on the membrane are heaters. One of the resistive elements is driven with a constant power and the resistance of the other one is measured to determine the membrane's temperature. Given the power input and the temperature increase above ambient (compared to unheated regions of the die and board) one can compute the airflow rate.

I tore this one down to the bare board but no further, die/board photos from the other unit are in part 1 of the post.

Sensor on the PCB
The original unit was a multi-board Honeywell process control module containing this sensor, a solenoid valve, and a large number of through-hole ICs including a Z88 family microprocessor (which may be covered in a future post - I want to get it decapped but haven't had time to do so yet).

I removed the sensor from the board using hot air. It's a six-pin SIL package with a plastic case snapped around the sensor board.



Packaging of sensor after removing from board

After removing the snapped-on casing we're left with the ceramic sensor board and a hose fitting on top. Under the host fitting is the actual sensor die, studied in detail in the previous post.

Fully disassembled

Saturday, July 14, 2012

MEMS pressure sensor teardown - part 1


While dumpster diving the e-waste bins on campus, one of my roommates found a control board of some sort that had an unusual sensor on it. We decided to take a closer look.

Sensor board
The board substrate is ceramic, most likely alumina. There are three electrically conductive layers visible on the board - gray (first level metalization), black (thick-film resistors), and gold (second level metalization and bond pads). A bluish dielectric separates M1 and M2 at crossing points but is not present over the remainder of the board.

The brownish reside on the top of the board is adhesive residue from the encapsulation over the sensor die.
Sensor die

The sensor die is approximately 1600μm along each side and appears to be made from a <100> oriented silicon wafer. Two metal layers are visible - one of a resistive material (most likely polysilicon) and one of gold (used for bond pads). For the sake of discussion I will define the upper center pin to be pin 1.

The die consists of six resistors and is entirely passive, with no transistors whatsoever.

The active sensing element consists of two membranes made out of what appears to be silicon nitride. The membranes are suspended over a cavity defined by an anisotropic wet etch using a KOH or related chemistry.

There are a total of three resistors between the membranes, whose values presumably change as the membrane is stressed. Pins 1 and 2, as well as 3 and 4, are connected to thin zigzag resistors on the left and right membranes respectively. Pins 7 and 8 connect to another resistor which starts on the lower left of the upper membrane, loops around at the far side, and goes back to the lower left on the lower membrane.

In addition, there are three resistors on the silicon substrate - betweens pins 8 and 9, 7 and 6, and 6 and 5. While they are all bonded out to pads and would be easy to measure, I have not yet attempted to get resistance readings.

The resistor between pins 5 and 6 has very unusual geometry and is not the typical zigzag I would expect. There is no obvious reason for this pattern.

Saturday, July 7, 2012

Lab Tour, part 1 - Metrology Bench

Several people, upon seeing some of the photos taken during my work, have asked for more information about my lab setup. I've been posting so many photos taken through my microscopes lately that I seem to have forgotten to post any of them!

This is the first post in a series of several. My lab is divided up into a series of distinct work areas and I'll be doing a post or two about each.

First off, an overview of the space:
Overview of metrology bench
The 19-inch rack at the right of the bench holds the image capture workstation (a 2U server recently removed from my GPU cluster), a Cisco 2950 switch, and a 24-port patch panel.

Moving to the left, the next notable piece of equipment is the Wentworth Labs probing station.

Probing station
The probe station is equipped with a 4-inch vacuum chuck, but I have to tape samples down at the moment due to lack of a vacuum distribution system. (This is on my longer term projects list).

The microscope is a B&L Stereozoom 4, with magnifications adjustable from 7x to 120x in full stereo. Although the images are not quite as sharp as most of my other scopes at high magnification, the addition of depth perception is extremely useful for probing and other manipulative tasks. It lacks an epi-illuminator so a fiber optic lamp is positioned to the right side of it.

I currently have three Micromanipulator 110/210 micropositioners. They're the same except one is meant to go on the left side of the chuck and one goes on the right. They're intended for large targets (20μm range, I think) such as bond pads, and are not suitable for smaller structures.

For probes, I use pieces of tungsten wire electrochemically etched to fine points. I'm still working on optimizing this process and will likely do a post on it once I get something working better.

Left side of metrology bench
The left-hand instrument in this view is an AmScope metallurgical microscope equipped with 4, 10, 40, and 100x (oil) objectives. It was my first high-power microscope and was OK but not great; the stage flexes when panning and the focuser seems to drift slightly. Some chromatic aberration is visible at higher magnifications.

The AmScope has been my main lithography tool so far; I will probably be removing it from service once my 2-inch contact aligner is finished.

The right-hand tool is an Olympus metallurgical microscope equipped with 5, 10, 20, and 40x objectives and is capable of both brightfield and darkfield illumination. It's a mix of BH and BH2 series parts scavenged from ebay.

The Olympus is my primary imaging system, its one notable deficiency is that at the moment it does not have a 100x objective. I purchased a used NeoSPlan 100x objective recently but this is infinity corrected (unlike the Neo objectives currently on the turret) so some modifications to the scope will be necessary to use it.

Off to the left side of the bench are various slides, coverslips, and sample preparation supplies.

I have several other measuring instruments that are portable and go wherever in the lab they're needed, but decided to cover them here in keeping with the general theme of metrology:

Scales and calipers
The left-hand scale has a capacity of 200g and is graduated in tens of mg; the right hand one has a capacity of 20g and is graduated in mg.

The digital caliper in the upper left is graduated in 0.001 inch increments but has a fairly large range of measurement and can do both inside and outside dimensions.

The final instrument is the Mitutoyo digital micrometer in the upper right. It only has a range of 0-1 inch but is graduated in μm. In one test I was able to easily measure the thickness of the photoresist film on top of a printed circuit board.

Tuesday, July 3, 2012

Photobit PB-0100-5 teardown

Earlier today I was cleaning out a drawer in my lab and found a broken USB webcam. Before throwing it out I decided to desolder the sensor chip and have a look.

For those of you who aren't familiar with it, my friend John and I are the driving forces between the Silicon Pr0n project - a wiki dedicated to amassing knowledge about all things related to semiconductor RE. I haven't been doing as much work on it recently due to academic obligations but figured it was about time to post some more die photos!

Wiki page: http://siliconpr0n.org/archive/doku.php?id=azonenberg:photobit:pb0100

Map: http://siliconpr0n.org/map/photobit/pb-0100-5/neo5x/ 

Package shots after removing from the board:

Top view of sensor
Bottom view
The package is a ceramic LGA using gold ball bonding. I have so far made no attempt to remove the die from the package or delayer; all images were taken through the window on the front of the package.

Without even resorting to the microscope some structure is obvious:
  • The red and green area at the upper left of the die is the pixel array.
  • The remainder of the die is covered with a transparent blue material (which upon closer inspection looks exactly like the blue color filter in the pixels) to prevent photocurrents from messing up the control logic
  • The area below the sensor has a lot of fine detail and is irregular. It's probably an array of standard logic cells controlling the sensor readout.
  • The area to the right of the sensor looks very regular and is probably addressing logic, buffers, and the ADCs.
  • Several of the pins along the top and left edge have three bond wires instead of one. They're probably power/ground.
  • Not all bond pads are broken out to pins.
I made an imaging pass over the entire die with a 5x objective. Since I haven't had time to do a CNC mod on my microscope stage like John has, I have to move the stage and snap photos by hand. This makes high-magnification full-die imaging very time consuming so if I need that I'll usually send the chip to him for processing.

Without further ado here's the full-die image. Note that this is rotated 90 degrees clockwise from the package overview image so that the vendor logo is right side up.

Full-die image
Closer inspection reveals that the standard cell area at left has large spaces between rows of logic for interconnect, suggesting that this is a 2-metal design. As typical for 1999-era technology the metal layers are not planarized. Sub-pixels look to be about 5 μm across.

Random portion of the subpixel array
The bottom right of the die has the Photobit logo and copyright notice:

Vendor logo and copyright. Note probe scrub mark from wafer test on the upper right pad.
Right above the logo there were a bunch of ID markings from the individual masks. It's immediately obvious that several masks are not visible as there are gaps in the array. These are probably the implants.

Several metal layers are visible, along with at least one polysilicon and several whose purpose is not immediately obvious.

Mask ID markings
The most interesting feature observed was at the bottom left of the die - a little doodle of a panda bear snuck in by the layout engineer.

Mask art!

Sunday, July 1, 2012

BGA process notes

I've gotten a lot of requests recently to share some details on my BGA assembly process, so without further ado here it is!

The board in this example is a test vehicle with an 11x11 0.8mm XBGA footprint on it, being mounted with a PIC32MX engineering sample chip. This is the same board I used in my 0201 process test.

I deliberately put several unfilled vias in the pads to demonstrate why this is a bad idea. Keep reading for details!

0.8mm XBGA test vehicle. Black marker lines highlight the row of balls that will be used for the cross section.
Since I don't have in-house stencil capabilities and haven't gotten around to ordering professionally made ones, I do all of my BGAs with flux only. My preferred flux for this purpose is ChipQuik SMD291NL no-clean rosin tack flux.

BGA pads covered in flux
The next step is to position the BGA on top of the footprint. Well-made footprints (such as the 256-FTBGA that I use on most of my FPGA boards) have the silkscreen outline slightly larger than the chip. Unfortunately this one is the same size as the chip so it was very difficult to align properly. I tried my best but it was still a little off.

BGA on footprint
I then ran the board through the standard reflow profile in my toaster oven. It's a cheap Proctor-Silex oven purchased at WalMart for something like $25. There is no thermocouple or feedback circuit in it (I have a 120VAC rated relay and a thermocouple but have not hooked it up yet.)
  • Set to 90C for 3 minutes to preheat
  • Set to 150C for 1 minute for thermal soak.
  • Set to 210C for 1 minute for reflow. This results in a Tal of about 15 seconds.
  • Turn off oven, open door, and cool to ambient with room air
Note that these numbers are not intended to describe the actual temperatures reached by the board or the oven - they're just the numbers on the dial of my specific oven. I know for a fact that the peak temperature reached at the 210C setting is in excess of 220C because that's the melting point of SAC305 solder.

I've also heard of people using oven thermometers to calibrate their reflow ovens. One word of caution for those doing this - if your sensor has a significantly higher thermal mass than your board (such as a big metal oven thermometer) its temperature will lag behind that of the less-massive PCB by a significant amount. I know of at least one hobbyist who reached the thermal decomposition point of FR4 Tg170 (somewhere around 300C) when his thermometer showed only 260!

The best way to tell when reflow is complete on an un-calibrated oven like mine is to watch the solder melt. My paste changes from a glossy gray (full of volatile flux compounds) to matte gray (once most of the flux has boiled off) to shiny silver (after the solder melts); BGA balls turn from a dull metallic color to shiny silver at melting; the chip also sinks slightly as the balls flatten from the weight of the IC. This YouTube video (not from my lab) shows what a properly reflowing BGA looks like.

The test vehicle in the oven. Note scrap-grade 4-inch silicon wafer being used as "cookie sheet".
Since this was a test board with no actual circuitry on it, the next step was to prepare to cross-section it and look at how well the joints turned out.

Although the flux I used is no-clean (and I normally leave it in place on most of my boards) cross sections look nicer if there isn't *too* much flux in the way. Since I don't have an ultrasonic cleaner yet (I do plan to buy one in the near future) I just let it soak in a beaker of 70% isopropyl alcohol for a few minutes, shook around a bit, and wiped it dry.

PCB sitting in beaker of IPA in my fume hood. Although IPA isn't particularly dangerous as solvents go, I have a general policy of keeping all open solvent containers in the hood whenever possible.
Once the board was dry I cut it in half between the black lines with a Dremel and a cut-off wheel. My ShopVac-based dust control system works reasonably well, but I want to get a HEPA vac for this in the future.

After the rough cut I polished with 1200 grit sandpaper and wiped away the dust with a wet cloth. Upon looking under the microscope I saw that the failure I was hoping to demonstrate had indeed occurred - one of the balls had been sucked down into an uncapped via by capillary action, resulting in a complete lack of electrical contact. The ball at far right had been partially sucked into the via but the solder mask dam was big enough to keep it from going in all the way.

Cross section of PCB and BGA. Note solder-filled via in center and missing ball. The far-right via annular ring seems to have snagged on something during the cutting process and been ripped up off the board.

Looking to one side of the board it was clear that the balls without vias under them had reflowed properly and were reasonably well aligned.

The black material between the balls is not underfill, it's a paste-like material made of residual flux, FR4/molding compound dust, and little slivers of copper that were ground off by the sanding process. It looks like my defluxing process didn't work as well as I had hoped; I'm going to need ultrasound to do the job properly.

One very interesting and unexpected result was visible in this cross section - the next row of vias were visible through the FR4 laminate.

Three well-reflowed balls. Note vias in next row visible through laminate.
Before closing up the lab for the night I decided to take one last picture to show what an ENIG-finished via looks like. Since this was a higher magnification image I followed the sandpaper polish with 3μm diamond paste to get a better finish.

The layers visible in this image from bottom to top are FR4 (grayish), 1oz/35μm copper foil(copper) and what looks like about 10μm of nickel (yellow-gray).  The gold plating is too thin to see at this magnification.

Cross section of ENIG-finished via.