In this edition of Chip Forensics, we describe a teardown of Apple’s 8GB iPhone, and the reverse engineering of a Peregrine RF switch similar to the one used by Apple within it, to look at the unusual Silicon-on-Sapphire process used for its manufacture.

The marketing power of Apple is becoming legendary. They announced the iPhone last January at the Macworld meeting, held the same week as the Consumer Electronics Show, and the associated publicity dwarfed all the other product launches made at the CES. Between then and the June 29 introduction of the device, the hype seemed to accelerate hyperbolically, and that week stories of people queuing for days beforehand entered the news around the world.

With promotion like that, how can a reverse-engineering firm like Chipworks resist doing the same, and getting hold of a couple to see what’s inside? Our US colleagues also lined up (not for days, thank goodness!), and within days we had it apart.

(As a side note, there seemed to be some sort of informal contest to be the first to tear it down – the first pictures were posted on the web less than an hour after they went on sale.)

It is no secret by now that there are no individual leading edge chips giving the iPhone its market edge, or outstanding performance as a phone – rather it is the integration of the innovative touch-screen, multiple applications, and sleek design.

Figure 2 shows the iPhone with the back cover removed – the electronics are at the top of the image above the battery, under the metal shields. The two antennas are formed on the same flex-conductor film, and we can see the coax leads linking them to the RF board at the opposite end of the device.

As we start taking the phone apart, we actually see that there are two boards – an “iPod+” board, and another dedicated to the wireless functions (Figs, 3 – 5).

On the iPod+ board (Fig. 4) we have some commonalities with the real iPod, not least the Samsung NAND flash part, exactly the same as used in the 8-GB iPod. This also used similar NXP power management and Wolfson audio codec chips. In a nice touch, back in January, The Scotsman reported “confident body language” from Wolfson management – it seems to have been justified!

One of the key features of the iPhone is the ability to change the screen from portrait to landscape mode, enabled here by the STMicroelectronics LIS302D 3-axis MEMS accelerometer. I had hoped that this would also be used to compensate for camera shake when using the Micron 2-Mp camera, but judging by my own unsteady attempts, this is not the case.

Another much-hyped feature is touch-screen input, not shown here. The touch screen and the LCD are separate items; of course that means an applications processor for the touchscreen, and more silicon for the LCD. National got the design win for the LCD at both ends (board and glass), using the low-power, low-noise Mobile Pixel Link interface. For more details, see this article on the Video/Imaging Design Line website.

Samsung also supplied the application processor, in a package-on package (PoP) configuration with 2 x 512Mbit DDR SDRAM, and Linear Tech provided the USB power manager chip. On the back of the board is a Silicon Storage Technology SST39WF800A 8 Mb multi-purpose flash, presumably for the firmware to run the whole thing.

Looking at the wireless board, Infineon is the successful vendor, with both the baseband chip and the GSM transceiver. Marvell does the WLAN transceiver, and Cambridge Silicon Radio (CSR) the Bluetooth device. At the antenna end of the board we have a Skyworks RF power amplifier module, and a multi-chip package (MCP) including a Peregrine single-pole, four-throw (SP4T) silicon-on-sapphire (SoS) RF switch. Memory is provided by an Intel MCP with 32 Mb of NOR flash and 16 Mb PSRAM.

In fact, in packaging terms the iPhone follows the cell phone trend, and is fairly replete with condensed packaging – two MCPs (the Peregrine part and Intel memory), the dual-stacked Samsung NAND flash, and the Samsung app’s processor + SDRAM PoP, and the Marvell and CSR chips are both flip-chip on board.

We said in the introduction that we would look at a Peregrine RF switch similar to the one used in the iPhone, but first some background on the company – theirs is a typical Silicon Valley story. They were founded in 1990, as a spin-off from the US Navy NELC lab, to commercialise their patented UTSi (Ultra-thin silicon) CMOS technology (originating from Hewlett Packard¹), targeted on the high-frequency RF and radiation-hard IC business.

SoS technology (Fig. 6) is inherently radiation resistant, since the silicon layer is so thin that most types of cosmic radiation passes through without generating the stray charges that can cause single-event upsets; and the probability of crystal lattice damage and the generation of recombination centres is also correspondingly reduced. In addition, the lack of parasitic capacitances and the low leakage (essentially zero, since sapphire is an insulator) allows SoS parts to run at much higher frequencies than equivalent bulk-silicon devices.

Things ticked over quietly for some years, slowly growing the business as CMOS moved into the rad-hard area. In 2000 they bought the old (1987) Quality Semiconductor fab in Sydney, Australia, which had been acquired by IDT in 1999. This was a 6”, 0.25-µm fab, and by then 6” sapphire substrates were available, so a good opportunity to go to commercial scale.

In the meantime, of course the need for low-leakage RF IC products has grown exponentially, if not hyperbolically, and it would seem that Peregrine has hit the sweet spot with the mobile/cellphone market. They have signed a volume foundry agreement with Oki semiconductor in Japan, and recently announced record production volumes. Their products have appeared in a number of phones in the last few years, and now they’ve got a socket in the most hyped phone ever.

As it happens, Chipworks looked at a Peregrine UltraCMOS™ PE4268 SP6T switch a couple of years ago, and the UTSi process is one of those interesting niche processes that we come across once in a while. The technology, at 0.5 and 0.25 µm, is not high-end in lithography terms, but growing decent quality silicon 90 – 100 nm thick on a sapphire substrate is.

Fig. 7 shows some details of their UTSi process. First, a hetero-epitaxial layer of silicon is grown on the sapphire; since the crystalline structures are not a perfect match, this is typically full of defects such as dislocations and twinning and stacking faults. However, if you grow the layer thick enough, most of the defects come to an end, and the surface layer is single-crystal silicon.

(Sapphire forms a hexagonal rhombohedral crystal structure with lattice constants of a = 4.785 Å, and C = 12.991 Å. The crystal, when cut along the diagonal, forms (in the R-plane) a body-centered, cubic-like structure with lattice constants approaching that of single crystal silicon. R-plane sapphire substrates are used for hetero-epitaxy of silicon. However, the lattice mismatch between the R-plane sapphire and silicon is rather large, being 6% and 12.5% in the two orthogonal directions)

The next step is to give the epitaxial layer a heavy implant of silicon ions to amorphize the silicon through the bulk of it, but leaving the surface region intact. The wafer is then annealed to re-crystallize the amorphous layer using the surface layer as a seed. After this it is oxidised, to remove any remaining twin defects and band gap states, since interstitial silicon atoms (i.e. atoms not part of the crystal lattice) migrate to the oxidation front, and become part of the oxide².

As we’ll see in the analysis, the SoS layer created this way is not perfect single crystal, but large-grain polycrystalline. The PE4268 SP6T switch that we looked at is a highly integrated high-isolation switch designed for RF applications, covering a broad frequency range from 100 MHz to 3 GHz. It was manufactured using a two metal, single polysilicon process, with 0.49-μm gate length, tungsten-silicided NMOS transistors in the switch arrays, formed on the 0.10μm thick epitaxial SoS active layer. In keeping with the 0.5-µm node, LOCOS isolation is used.

An NMOS transistor is shown in Figure 8. We can see the source/drain contacts and the tungsten-silicided polysilicon, and the stain indicates that the N+ source/drain diffusions are fully depleted, i.e. they use the whole depth of the epi-layer.

Figure 9 is a TEM image of the transistor, showing the grain structure of the polySi gate and the epi-layer on the sapphire, and we can see that it is not perfect single crystal. We have enlarged a section of the image to show the grain boundaries; the step in the epi was left after the sidewall spacer etch. The SoS layer is 95 – 100 nm thick.

A curious feature of the SoS processing seems to be that the surface is uneven, even under the gate edge (Figure 10); possibly a result of uneven oxidation during or after the anneal step. Strain defects at the interface are still present, since the defect reduction process can improve the silicon quality, but it cannot remove the in-built crystalline mismatch between the silicon and the sapphire.

TEM diffraction analysis of the epi-silicon on the sapphire shows that it is conventionally oriented, with a <100> surface, and <110> channel orientation.

As we said earlier, SoS parts are inherently radiation-hard. In the case of consumer products like the iPhone, it is the cost-effective RF properties of the process that is selling the chips – a benefit that the inventors at H-P in the ‘70s probably didn’t anticipate. The guys at Peregrine have evolved this bit of fairly obscure research from 30 years ago into a commercial technology with leading-edge applications. And if you do take your iPhone onto the Space Shuttle, you know that the RF-switch chip won’t fail!

References:

1. 1. United States Patent 4,177,084, “Method for Producing a Low Defect Layer of Silicon-on Sapphire Wafer”, S. Lau et al.

2. 2. United States Patent 5,600,169, “Minimum Charge FET Fabricated on an Ultrathin Silicon-on Sapphire Wafer”, M. Burgener et al.