Ok lets go back in time to 2005/2006 when phones were still just phones and not yet computers. Here we have a Samsung flip phone, even for 2005 this is fairly basic or middle of the road phone, no camera even.
The phone was given to me by a friend and was pretty beaten up, so it’s off for a full digital autopsy. This is the SPH-A660 and is a CDMA 800/1900MHz phone that was used on the Bell network in Canada. Bell was/is the largest network in Canada, but being a CDMA network you were sod out of luck if you travelled to Europe or pretty much anywhere else in the world which was using the more common GSM network. Interesting this phone also still supports the original (analog) AMPS cellular standard that I thought had been phased out by 2005.
The teardown itself is not that interesting, so I did not photograph the process. Here are the components laid out afterwards
Lets take a closer look at the board. The CDMA standard was pretty much owned by Qualcomm and they had a virtual monopoly on CMDA chipsets. Samsung have long history of using Qualcomm chipsets in North America (Still do) so it is no surprise to find this phone driven by Qualcomm chips.
Here is the front of the board with the different chipsets highlighted
The board layout turns out to be quite logical.
This is the MSM-6050 application processor, driving all the functionality in the phone. Fairly primitive by 2017 standards, but according to wikichip (Neat website btw) it is made on a 180nm process so likely has as many as 6-8 separate metal routing layers.
This is a Spansion 128Mb NOR Flash – The Ricoh chip beside it is however a mystery to me.
It’s surprising (to me) that the RF blocks are not encased in metal shielding which I thought was standard practice in modern phones. They have a clearly defined ground plane around them and are visible on the left and right sides of the board.
The RF receive section features a low noise amplifier L6000 (which is the only part in the Qualcomm chipset that is not branded Qualcomm). Below this are I believe 3 SAW Filters – one for each frequency (800MHz AMPS, 1900MHz CDMA, 850MHz CDMA) the middle one is labeled EPCOS 7736 which is a 1960MHz SAW filter. SAW filters are interesting things, they are very precise notch filters (If I ever can successfully decap some I will write a separate post about them.) These then connect to the RFR6000 zero intermediate frequency (ZIF) receiver die, that converts the RF to baseband frequency for the application processor.
- Both the RF transmit and RF receive sections feed into the small die mark 55 1c5 which I assume is a duplexer (Basically a fancy switch for transmit/receive. The output of the duplexer is connected to the small die 4042 before going to the antenna. I am not sure what the 4042 die is perhaps a impedance matching device.
- The section in the middle with the die labeled 1752 NC I am unsure of the function, it maybe power regulation and system clocking (The tin box below the 1752 looks like a crystal oscillator)
Something else I noted is the use of a small SMC antenna connector, the main antenna connection is the gold plated rectangular block at the very top left that press fits onto a gold plated spring clip on the antenna. Nothing is plugged into the SMC connector, so I guess it must have been added for testing the board.
The rear of the board is not very interesting. You can see an electret condenser microphone in the bottom right. Just a single microphone. Compare that to a modern smartphone which now have at least 3 or 4 MEMS based microphones.
The rest is mostly just the keypad buttons with a few small ics (Possibly LED drivers) at the top.
Most of the die have middle of 2005 die codes. The newest part I can see is the Skyworks power amp with an 0518 date code. So this places the unit as assembled after May 2005.
Lets go a bit deeper into some of the silicon. If I depot and image all the chips this post will turn into a bit of a dissertation, so lets focus on the RF section in particular the RF receive section (I would show the transmit chips, but I failed miserably to successfully depot either power amplifier).
The die is very small measuring 1.33mm x 0.96 mm. I have over cooked the depot, and you can see where the acid has not only etched out the bond pads, but wicked into the top metal patterns a fair bit (Still working on the recipe!) The package was not branded Qualcomm but the die is. Its die marked a Qualcomm HG11-V293G designed by SV, JK, TS, KC. The practice of designers putting their initials on chips is not unusual (Though a bit less common these days). Outside of Qualcomm and the wafer fab it is highly unlikely anyone will ever see these initials (Until now of course 🙂
According to Qualcomm literature the L6000 is two Low Noise Amplifiers, one cellular LNA for CDMA and one for PCS-CDMA (I guess thats the 800MHz and 1900MHz standards). You can clearly see two inductors that dominate the chip area. I believe the inductor together with a capacitor are used as a filter circuit that matches the RF input to a 50 ohm load, without it the very low power RF signal reflects and cannot be amplified.
One interesting feature is the type of capacitors used. Normally you find area plates of metal as the capacitor plates. Here they have used interdigitated metal fingers (In multiple metal layers) so the capacitance is the sum of all the fringing capacitance from the metal lines.
Qualcomm state that the RFL6000 device is fabricated using a SiGe BiCMOS process, which provides high-frequency, high-precision analog circuits as well as low-power CMOS functions. I cannot find any evidence of Bipolar transistors on this chip, but the geometries are very small. This is a section from the digital block (Upper right). There might be 6 levels of metal here and with my microscope I cannot see the transistor level.
According to Qualcomm information “The device has three mixers which, when combined with the RFL6000 device, provide full RF-to-baseband down conversion for the cellular, PCS and GPS band. The LO generation block produces all LO signals so that only one external single-band VCO is required for all CDMA frequency bands of operation. Included on chip is the GPS LNA as well as the entire GPS VCO including resonant components. ”
A good RF designer would be able to identify the blocks in that description on the die photo. I could not do that so I will let you explore the fascinating symmetries and layout without commentary.