Thursday, July 5, 2007

Inside iPhone (complete hardware analysis on progress...)

Al least, we have the iPhone, and there was several sites in the Internet opening the phone and showing photos of the boards. At the same time, other sites are already working on the firmware code.

The best hardware work was done by the guys of Semiconductor Insights. They even decap the chips to see the die markings. iFixit show more photographs of the iphone progresive teardown.
There is additional PCB and chip dies scans in Microblog, the best quality ones.

Here, as an electronics engineer, I will try to pick all this information, and make a guess of the complete iphone hardware specification. This specification will evolve with uncoming informations and hints from other people. If you have additional information or have an opinion I would like to read you in the comments of by a private e-mail to

iPhone Hardware Specs:

The main electronics are splitted into two boards.

- The main processor board:
The main processor it is a stacked die package with a processor marked as S5L8900 and two 512Mb DRAM dice (128MBytes of DRAM). This configuration is normal in a mobile. Normally the main processor has pads in the upper part of the sustrate to solder a PoP (package on package) multidie chip. The layout of the pads is a Jedec standard (JC63 and JC11) and this allows to save space but at the same time use the preferred memory supplier.The DRAM MCP (multichip package) is the K4X1G153PC-XGC3 from Samsung that, according to the Mobile DDRAM part number decoding from Samsung has the following characteristics:

DDR-SDRAM, 1Gbit, 8K blocks, 64ms, 1.8V core, 1.8V I/O, x16 bits bus, 4 banks, C generation, FBGA, Extended low temperature, speed 7.5ns@CL3.

Now the processor. This is the most difficult part. Semiconductor Insights says that the die number is S5L8900. You could even see the number 8900 in the chip marking. In the past, several Samsung chips has this kind of numbering. Last iPod processor is the S5L8701 (8701 in the marking), and in the Samsung web site you could see a ARM9 MP3 player processor named as S5L8700. I think it is clear that the processor is a Samsung part.

In Microblog, Nick Chernyy has decap the CPU chip and he has a clear photo of the die marks.

People has already found in the firmware strings, that the processor is a ARM1176. With this ARM core, Samsung has only one processor in the web site: the brand new S3C6400. I have found the S3C6400 datasheet in the Internet (it is not an easy task) and I have read it. This is the block diagram of this processor:

But I'm afraid this is not the real processor in the iphone. I think it is a propietary design for Apple. One of the reason is that the firmware interrupts (from some info found in the Internet) doesn't match with the datasheet, and the blocks declared in the firmware are similar but not identical to the S3C6400. In the firmware there is also declarations that shows that there is a PowerVR MBX 3D processor from Imagination Technologies inside the S5L8900.

I think that is a similar design, with a multiformat hardware video accelerator(MPEG4, H.264, etc.), PowerVR 2D and 3D accelerator, NAND Flash booting feature, USB OTG 2.0, and ARM1176J2F core, and no more DSP capabilities (with ARM11 cores nobody use a DSP anymore, except for video).

The third chip in this board is the NAND flash. It is a part also from Samsung: K9MCG08U5M
It is a 8GByte chip, with four 2GByte dies stacked. In the 4Gbyte iphone version, the chip is the K9MCG08U1M, that is a 4GByte, dual die part.

In the other side of the digital board there is a small integrated circuit from SST, marked as SST39WF800A. It is a 2MByte (8Mbit x 16) 1.8V NOR Flash. The processor boots from this flash memory.

The Intel NOR flash in the other board is for the baseband Infineon controller. It is not feasible to use the NOR flash through the connector between the two boards.

The fourth chip is the I2S voice codec from Wolfson: WM8758. A very good sound quality part, indeed, the same than in last iPod.

The USB battery charger, from Linear Technology LTC4066, is also a good part.

Other chip is a LVDS 24 bit driver from National (LM2512SM) to carry the signals to the display with less wires and without interference.

The remaining chip, from NXP (Philips before), I guess it is the power manager with the switching power supplies (see the coils near the chip, with capacitors and schottky diodes). In the firmware there is references to the PCF50635 power manager. Must be this part or similar.

- The radio board:
The radio board has the following circuits:

The baseband processor is an Infineon PMB8876 S-Gold multimedia engine with EDGE functionality. Comes with an Intel NOR Flash + SDRAM PF38F1030W0YTQ2 (4Mbytes NOR + 2Mbytes PSRAM) to run the baseband code (the capacities in the Semiconductor Insights article are wrong, see the datasheet link).

The RF GSM transceiver is an Infineon part, probably the M1817A11.

The bluetooth chip cames from CSR (Cambridge Silicon Radio): the Bluecore4.

The Wifi is a Marvell part: the 88W8686.

- Other parts:

The touchscreen is from German manufacturer Balda.

In the touchscreen there is a SPI multitouch controller from Broadcom, the BCM5973A.

The camera has a Micron 2Mpixel sensor, probably MT9D112D00STC.

The display is 320x480, can be a Samsung or AUO module.

The battery is a Li-IonPolymer 3.7V.

More will follow...

PD. Changes 6/7/2007: PowerVR 3D reference included, changed capacity values in Intel Flash/PSRAM.
Changes 19/7/07: Die photo of processor included.
Changes 21/7/07: Microblog scans reference added.
Changes 6/8/07: SST NOR Flash memory reference added.

No comments: