53
CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 2: Packaging

Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Embed Size (px)

Citation preview

Page 1: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

CSCI 4974 / 6974Hardware Reverse Engineering

Lecture 2: Packaging

Page 2: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging

● Bare silicon devices are useless if you can't talk to them

● Something has to connect them to the board

● To get to the silicon, we have to know what's in the way

Page 3: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Parts of an IC

● DieThe actual silicon “chip”

● LeadframePins that are soldered to the board

● Molding compoundProtects die and wires

● Wires or bumpsElectrically connects die to leadframe

● Die attachMechanically connects die to leadframe

Page 4: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Die vs circuit thickness

Page 5: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Multi-die packages

● Several dies in one package

● FPGA + flash

– We may see one of these next Friday's lab● MEMS + ASIC

● High-density NAND/DRAM

Page 6: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Leadframe

● The actual pins which get soldered to the board

Page 7: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package classification

● Material - ceramic, plastic, etc

● Mounting type - through hole or surface mount

● Cavity direction - up/down

● Wire bond vs flip chip

● Through hole vs SMT

● Topology - linear vs area array

Page 8: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● Large, fragile devices, low logic density

● Not many pins

● Hermetically sealed packages required

● EPROM needs UV exposure

Page 9: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Ceramic Dual Inline Package (CDIP or CERDIP) w/ soldered lid

Page 10: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● CDIP with window

Page 11: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● Ceramic is expensive, can we do something cheaper?

● Plastic costs a lot less

● Ceramic is still used in rare cases (some mil-spec etc) but nearly unheard of in modern consumer devices

Page 12: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Plastic Dual Inline Package (PDIP)

Page 13: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● DIPs waste a lot of space for high-density devices

● Drilling holes requires more manufacturing time

– Surface mount technology!

Page 14: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Small Outline IC (SOIC)

● Small Outline Package (SOP)

Page 15: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● Having pins on only two sides makes for long, skinny, awkwardly shaped packages

● What if we used all four?

Page 16: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Quad Flat Pack (QFP)

Page 17: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Quad Flat No-Leads (QFN)

Page 18: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● Even higher density is required for modern electronics

● Why only use the perimeter of the package?

Page 19: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Pin-grid array (PGA)

Page 20: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Ball-grid array (BGA)

Page 21: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Column Grid Array (CGA)

Page 22: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Chip-scale BGA (CSBGA)

Page 23: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Packaging evolution

● Special needs call for special device packages

Page 24: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

Page 25: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package types

● Chip on Board (COB)

Page 26: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Hybrid circuits

● One or more dies bonded to a ceramic (usually) substrate

● Film passives printed directly on substrate, optional laser trim

Page 27: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Chip on Glass (CoG)

● Die is attached directly to glass substrate

● Mostly used for LCDs

Page 28: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Multichip module (MCM)

Page 29: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Thermally enhanced packages

● Generally meant to be used with a heatsink

● Always flip-chip packaging

● Very difficult to microprobe

– Chip will fry if not cooled● Extra care required to decap

Page 30: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Double interposers

● Die in a BGA package soldered to a larger BGA or PGA

● Very rare, I've only seen this once

Page 31: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Metal cans (TO-x)

● Often used for old discrete transistors, laser diodes

● Some military / automotive ICs

● Good thermal properties

● Glass/metal hermetic seal

● Low pin count

Page 32: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Camera sensors

● Package is optically transparent

● May not need to decap at all - just image through window

● Typically ceramic with glass lid

Page 33: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Other sensors

● Packaging varies widely depending on what's measured

● Example: MEMS mass airflow sensor

Page 34: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Potting

● Protects board from water, dirt, etc

● May also make tampering harder

● Needs to be removed to get to chips or probe board

Page 35: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Conformal coating

● Like potting, but a thin layer that doesn't fill the enclosure

● May be clear or opaque

Page 36: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

BGA underfill

● Provides mechanical stability to balls

● Improves resistance to cracking

● Makes desoldering difficult

Page 37: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Die coats

● Protection against particulates and (?) liquid ingress

● Polyimide film

● Silicone goo

Page 38: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package construction

● How is the chip connected to the leadframe?

Page 39: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Wire bonding

● Usually Au, but Al and Cu are used in special applications

● Cheapest way of connecting to leadframe

Page 40: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Concentric bond rings

● Seen in high-density devices

Page 41: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Double bonds

● Two wires from die to the same package pin

● Indicates a high-current line (often power)

Page 42: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Ball bonding

● Wire feeds through needle

● Electrically melt tip into a ball

● Press onto bond pad with needle

● Apply heat and ultrasound to weld

Page 43: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Wedge bonding

● Wire feeds through wedge-shaped nozzle

● Press onto pad

● Apply heat and ultrasound to weld

● Note probe scrub from wafer test

Page 44: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Flip chip

● Large, high-performance devices with lots of pins

● Active side of die goes down

● Solder bumps from top metal layer to interposer

● Interposer is basically a fine-pitch PCB with lots of layers

● Breaks super-fine solder bumps out to saner pitch

● Front-side attacks very hard

● Back-side attacks easier, top of die is already exposed :D

Page 45: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Carrier island / paddle

● Surface that the die rests on

● Typically connected to die substrate and electrically grounded

● Plastic packages: Cu with Sn plating

● Ceramic packages: Au plating over cofired leadframe metal

● Often fully covered by molding compound

● Exposed in QFNs for thermal reasons

Page 46: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Die attach

● Connects die to island

● Common materials:

– Silver epoxy

– Solder

– Au-Si eutectic alloy

– NanoFoil (Al-Ni + solder)

Page 47: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Package materials

● To reverse the device, we have to get the package off

● Knowing exactly what it's made of helps

Page 48: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Plastic package materials

● “Plastic” chips are not actually plastic!

● Normally a composite, glass beads in epoxy

● Wire bonds are Au / Cu

● Leadframes Sn, Cu

Page 49: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Plastic package materials

● Epoxy is a thermoset (won't melt, just burns or decomposes)

● Glass content varies greatly, but is usually fairly high (>> 50%)

– Sometimes a lot higher!

Page 50: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Ceramic package materials

● Fired ceramic clays

● Pieces often held together with glass

● Cofired packages use Mo or W interconnect

● Lids may be held on with solder or glass

● Extremely chemical resistant, very little will etch it

● Very good seals, used for high-reliability applications

● Brittle, can crack

Page 51: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Ceramic package materials

● Can be white, brown, or purple

● Al2O

3 is by far the most common ceramic

● Often mixed with SiO2

● AlN and BeO are used in some special cases, rare

● All are colorless

● Brown color comes from a few percent of MnO

Page 52: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Purple ceramic analysis

Page 53: Lecture 2: Packaging - Security Groupsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture2_Packaging.pdf · Plastic packages: Cu with Sn plating Ceramic packages: Au plating over cofired

Questions?

● TA: Andrew Zonenberg <[email protected]>

● Image credit: Some package images are CC-BY from:

– John McMaster <[email protected]>

– marshallh