Basic Functional Analysis. Sample Report Richmond Road, Suite 500, Ottawa, ON K2H 5B7 Canada Tel:

Transcription

1 Basic Functional Analysis Sample Report 3685 Richmond Road, Suite 500, Ottawa, ON K2H 5B7 Canada Tel:

2 Basic Functional Analysis Sample Report Some of the information in this report may be covered by patents, mask, and/or copyright protection. This report should not be taken as an inducement to infringe on these rights Chipworks Inc. This report is provided exclusively for the use of the purchasing organization. It can be freely copied and distributed within the purchasing organization, conditional upon the accompanying Chipworks accreditation remaining attached. Distribution of the entire report outside of the purchasing organization is strictly forbidden. The use of portions of the document for the support of the purchasing organization s corporate interest (e.g., licensing or marketing activities) is permitted, as defined by the fair use provisions of the copyright act. Accreditation to Chipworks must be attached to any portion of the reproduced information. FAR CYBT Revision 1.0 Published: July 16, 2009

3 Basic Functional Analysis Sample Report Table of Contents 1 Overview 1.1 List of Figures 1.2 List of Tables 1.3 Introduction 1.4 Device Summary 1.5 Observed Critical Dimensions 2 Device Identification 2.1 Downstream 2.2 Package 2.3 Die 3 Process 3.1 Overview 4 Functional Layout Analysis 4.1 Overview 4.2 Functional Block Measurements 5 Estimated Costing OPTIONAL SECTION 5.1 Manufacturing Cost Analysis 6 Statement of Measurement Uncertainty and Scope Variation About Chipworks

4 Overview Overview 1.1 List of Figures 2 Device Identification Wireless Router Top View Wireless Router Bottom View Wireless Router Side View Wireless Router Rear View Wireless Router Case Open View Wireless Router Main PCB Top View Wireless Router Main PCB Bottom View Package Top Package Bottom Package X-Ray Die Photograph Die Markings Die Corner Minimum Pitch Bond Pads 3 Process General Device Structure Minimum Pitch Metal Minimum Gate Length Transistor 4 Functional Layout Analysis Annotated Die Photograph Functional Blocks 1.2 List of Tables 1 Overview Device Identification Device Summary Observed Critical Dimensions 4 Functional Layout Analysis Functional Block Measurements 5 Estimated Costing OPTIONAL SECTION Manufacturing Cost Characteristics Manufacturing Costs

5 Overview Introduction This report contains the following detailed information: Downstream system images and main system PCB Package photographs, package X-ray, die markings, die photograph, and die photographs with annotated functional blocks and memories Measurements of vertical and horizontal dimensions of major microstructural features Scanning electron microscopy (SEM) cross-sectional micrographs of dielectric materials, major features, and transistors, and plan-view optical micrographs of the part delayered to metal 1 Identification of major functional blocks Estimated manufacturing cost analysis All of the analyses for this report were performed on two parts, with the following markings: Table Device Identification Device Package markings Functional analysis Die markings Functional analysis Date code Functional analysis Package markings Process analysis Die markings Process analysis Date code Process analysis Device Identification Table Device Identification

6 Overview Device Summary Table Device Summary Manufacturer Foundry Part number Type Date code Functional analysis Package markings Functional analysis Package type Package dimensions Die markings Die size (die edge seal) Process type Number of metal layers Number of poly layers Minimum transistor gate Metal 1 pitch Contacted gate pitch Process generation Feature measured to determine process generation Device Summary Single chip 5+1-port gigabit Ethernet switch controller 830 (week 30, 2008) CMOS Transistor gate length, minimum contacted gate pitch, metal 1 pitch Table Device Summary

7 Overview Observed Critical Dimensions Table Layers Observed Critical Dimensions Minimum Width (µm) Observed Critical Dimensions Minimum Space (µm) Minimum Pitch (µm) Thickness (µm) Metal Metal Metal Metal Metal Metal Metal Metal Contacts Contacted gate pitch 0.53 Polysilicon Isolation (STI) Table Observed Critical Dimensions

8 Device Identification Device Identification 2.1 Downstream Figure shows the top view of the. Figure Wireless Router Top View Figure Wireless Router Top View 50 mm Figure Wireless Router Top View Figure shows the bottom view of the. Figure Wireless Router Bottom View Figure Wireless Router Bottom View Figure Wireless Router Bottom View 50 mm

9 Device Identification 2-2 Figure and Figure show the side and rear views, respectively. Figure Wireless Router Side View Figure Wireless Router Side View 50 mm Figure Wireless Router Side View Figure Wireless Router Rear View Figure Wireless Router Rear View Figure Wireless Router Rear View 50 mm

10 Device Identification 2-3 Figure shows the dual band wireless N gigabit router with the case open. The bottom of the case is on the left, and the top on the right. The PCB is attached to the bottom of the case. Figure Wireless Router Case Open View Figure Wireless Router Case Open View 50 mm Figure Wireless Router Case Open View

11 Device Identification 2-4 Figure shows the only PCB removed from the dual band wireless N gigabit router casing. The is located just below the center of the board. Figure Wireless Router Main PCB Top View Figure Wireless Router Main PCB Top View Figure Wireless Router Main PCB Top View

12 Device Identification 2-5 Figure shows the back of the PCB. Figure Wireless Router Main PCB Bottom View Figure Wireless Router Main PCB Bottom View 20 mm Figure Wireless Router Main PCB Bottom View

13 Device Identification Package Top and bottom photographs of the package are shown in Figure and Figure 2.2.2, respectively. The 216 pin exposed pad thin plastic quad flatpack (EP-LQFP) package is 24 mm x 24 mm x 1.4 mm thick. The package bottom image shows the exposed heat slug, which is 7.6 mm square. The package markings for the device used for the functional analysis include: Figure 2.2.1Package Top Figure Package Top pin 1 identifier 5 mm Figure Package Top

14 Device Identification 2-7 Figure 2.2.2Package Bottom Figure Package Bottom heat slug 7.6 mm 7.6 mm pin 1 identifier 5 mm Figure Package Bottom

15 Device Identification 2-8 A plan-view X-ray photograph of the package is shown in Figure 2.2.3, with the location of the heat slug annotated. Bond wires connect the die to the lead frame. Figure 2.2.3Package X-Ray Figure Package X-Ray heat slug pin 1 identifier 5 mm Figure Package X-Ray

16 Device Identification Die Figure shows a photograph of the die. The die is 6.81 mm x 7.05 mm as measured from the die seals, or 6.86 mm x 7.15 mm for the whole die. This yields a die area of 48.0 mm 2 within the die seals. Bond pads are arranged around the periphery of the die, likely in a pad limited layout, given the aggressive pad pitch. Figure 2.3.1Die Photograph Figure Die Photograph Figure Die Photograph

17 Device Identification 2-10 The die markings are shown in Figure These include: Figure 2.3.2Die Markings Figure Die Markings Figure Die Markings

18 Device Identification 2-11 Figure shows an optical image of a typical die corner. A die seal is visible inside the scribe lane around the periphery of the die. Bond pads and a test pad are visible in this image. The residual scribe channel at the top of the image is 50 µm wide, while it is 25 µm wide along the left side of the image. The die mark and mask level markings are located near the corner of the die. Figure 2.3.3Die Corner Figure Die Corner scribe channel 50 µm die seal bond pad ball bond 25 µm test pad 0.1 mm Figure Die Corner

19 Device Identification 2-12 Figure is an optical image showing the aggressive 50 µm minimum pitch bond pads. The bond pads are 75 µm long by 48 µm wide. The opened windows of the bond pads are 62 µm long by 46 µm wide. Figure 2.3.4Minimum Pitch Bond Pads Figure Minimum Pitch Bond Pads die seal scribe channel 46 µm ball bond 75 µm 62 µm 48 µm bond pad 50 µm 50 µm Figure Minimum Pitch Bond Pads

20 Process Process 3.1 Overview Figure shows a cross-section SEM view of the. The device is fabricated using seven levels of copper interconnect plus an aluminum top level and bond pad metal. The via 7 is made of aluminum, while via 6 to via 1 are formed with copper. Tungsten plugs are used to contact the polysilicon and substrate. Shallow trench isolation (STI) with a liner is used for isolation. One layer of polysilicon is used to form the gates. Figure 3.1.1General Device Structure Figure General Device Structure metal 8 metal 7 via 7 passivation metal 4 via 4 metal 1 W plug via 1 STI Figure General Device Structure

21 Process 3-2 Figure shows the 0.33 µm minimum pitch metal 1. Figure 3.1.2Minimum Pitch Metal 1 Figure Minimum Pitch Metal 1 ILD µm 0.33 µm 0.36 µm metal 1 PMD poly Figure Minimum Pitch Metal 1

22 Process 3-3 Figure shows the 90 nm minimum gate length MOS transistor. The transistor is made from a 0.16 µm thick silicided polysilicon. The contacted gate pitch is 0.53 µm. Figure 3.1.3Minimum Gate Length Transistor Figure Minimum Gate Length Transistor W plug PMD poly 0.16 µm 0.53 µm 90 nm silicon substrate STI Figure Minimum Gate Length Transistor

23 Functional Layout Analysis Functional Layout Analysis 4.1 Overview Figure shows the major functional blocks, annotated on a photograph of the die, delayered to the metal 1 layer. The blocks were divided based on the physical layout features visible on the metal 1 die photograph. The functions of the blocks were estimated based on the pinout information, the formation of the I/O pads, the memories inside the functional blocks, the locations of the functional blocks on the die with regards to the locations of the external peripheral components on the main PCB board, microscopic observation, and our knowledge and experience, not through circuit extraction. Figure 4.1.1Annotated Die Photograph Functional Blocks Figure Annotated Die Photograph Functional Blocks M1 M1 M1 M1 M1 M1 M1 M1 M1 M1 M1 M1 M1 AN 5 M1 M1 M1 M4 M5 M2 M2 main logic M3 M3 M3 M3 L1 M6 M3 M3 L1 AN1 L1 M7 M7 M8 L1 M9 M10 M10 AN4 L1 AN2 AN3 I/O Figure Annotated Die Photograph Functional Blocks

24 Functional Layout Analysis Functional Block Measurements Table shows the physical measurements (length and width) of the major functional blocks analyzed in Figure 4.1.1, as well as the percentage of the total die area they occupy. The die size (die edge seal) measures 6.81 mm x 7.05 mm for an area of 48.0 mm 2. Some length and width fields are left blank due to irregular block shapes. Table Functional Block Measurements Functional Block Measurements Functional Block Type Length (mm) Width (mm) Total Area (mm2) % of Die Main logic Logic Irregular L1 (x5) (likely to be the GMAC and PCS Logic registers) AN1 (Giga-PHY analog differential interface) Analog AN2 (Giga-PHY analog differential interface) Analog AN3 (power management controller and Analog PLL) AN4 (1.25 GHz SerDes interface) Analog AN5 (test circuitry) Analog M1 (x16) (likely to be the 832Kb packet buffer Memory SRAM) M2 (x2) Memory M3 (x6) Memory M4 (x1) Memory M5 (x1) Memory M6 (x1) Memory M7 (x2) Memory M8 (x1) Memory M9 (x1) Memory M10 (x2) Memory I/O area Input/output Irregular drivers Approximate unused space in the I/O area Irregular Die size (die edge seal) Table Functional Block Measurements

25 Estimated Costing OPTIONAL SECTION Estimated Costing OPTIONAL SECTION 5.1 Manufacturing Cost Analysis A manufacturing cost analysis was carried out based on the information obtained from the process analysis of the. Some of the characteristics that were used to determine the costs are listed in Table Table Manufacturing Cost Characteristics Manufacturing Cost Characteristics Foundry Date code Package type 216 pin EP-LQFP (exposed pad thin plastic quad flatpack ) Package dimensions 24 mm x 24 mm x 1.4 mm Die size (die edge seal) 6.81 mm x 7.05 mm ( 48.0 mm 2 ) Process type CMOS Process generation 0.13 µm Number of metal layers 8 (7 damascene Cu and 1 Al top metal) Number of poly layers 1 Minimum transistor gate 90 nm Wafer size 200 mm Table Manufacturing Cost Characteristics The results of the cost analysis are given in Table Table Manufacturing Costs Final tested die Packaged die Tested packaged die Manufacturing Costs $2.21/die $2.93/packaged die $3.36/packaged die Cost Table Manufacturing Costs

26 Statement of Measurement Uncertainty and Scope Variation Statement of Measurement Uncertainty and Scope Variation Statement of Measurement Uncertainty Chipworks calibrates length measurements on its scanning electron microscopes (SEM), transmission electron microscope (TEM), and optical microscopes, using measurement standards that are traceable to the International System of Units (SI). Our SEM/TEM cross-calibration standard was calibrated at the National Physical Laboratory (NPL) in the UK (Report Reference LR0304/E /SEM4/190). This standard has a 146 ± 2 nm (± 1.4%) pitch, as certified by NPL. Chipworks regularly verifies that its SEM and TEM are calibrated to within ± 2% of this standard, over the full magnification ranges used. Fluctuations in the tool performance, coupled with variability in sample preparation, and random errors introduced during analyses of the micrographs, yield an expanded uncertainty of about ± 5%. The materials analysis reported in Chipworks reports is normally limited to approximate elemental composition, rather than stoichiometry, since calibration of our SEM and TEM based methods is not feasible. Chipworks will typically abbreviate, using only the elemental symbols, rather than full chemical formulae, usually starting with silicon or the metallic element, then in approximate order of decreasing atomic % (when known). Elemental labels on energy dispersive X-ray spectra (EDS) will be colored red for spurious peaks (elements not originally in sample). Elemental labels in blue correspond to interference from adjacent layers. Secondary ion mass spectrometry (SIMS) data may be calibrated for certain dopant elements, provided suitable standards were available. A stage micrometer, calibrated at the National Research Council of Canada (CNRC) (Report Reference LS ), is used to calibrate Chipworks optical microscopes. This standard has an expanded uncertainty of 0.3 µm for the stage micrometer s 100 µm pitch lines. Random errors, during analyses of optical micrographs, yield an expanded uncertainty of approximately ± 5% to the measurements. Statement of Scope Variation Due to the nature of reverse engineering, there is a possibility of minor content variation in Chipworks standard reports. Chipworks has a defined table of contents for each standard report type. At a minimum, the defined content will be included in the report. However, depending on the nature of the analysis, additional information may be provided in a report, as value-added material for our customers.

27 About Chipworks About Chipworks Chipworks is the recognized leader in reverse engineering and patent infringement analysis of semiconductors and electronic systems. The company s ability to analyze the circuitry and physical composition of these systems makes them a key partner in the success of the world s largest semiconductor and microelectronics companies. Intellectual property groups and their legal counsel trust Chipworks for success in patent licensing and litigation earning hundreds of millions of dollars in patent licenses, and saving as much in royalty payments. Research & Development and Product Management rely on Chipworks for success in new product design and launch, saving hundreds of millions of dollars in design, and earning even more through superior product design and faster launches. Contact Chipworks To find out more information on this report, or any other reports in our library, please contact Chipworks at Chipworks 3685 Richmond Road, Suite 500 Ottawa, Ontario K2H 5B7 Canada T F Web site: info@chipworks.com Please send any feedback to feedback@chipworks.com