in ,

Reverse-engineering the TL431: the most common chip you've never heard of, Hacker News

A die photo of the interesting but little-known TL power supply IC Provides an opportunity to explore how analog circuits are implemented in silicon. While the circuit below may look like a maze, the chip is actually relatively simple and can be reverse-engineered with a bit of examination. This article explains how transistors, resistors, and other components are implemented in silicon to form the chip below.

[12] Die photo of the TL . Original photo by Zeptobars .

The TL is a “programmable precision reference”

[1] Thumbnail of the TL431 die. and is commonly used in switching power supplies, where it provides feedback indicating if the output voltage is too high or too low. By using a special circuit called a bandgap, the TL provides a stable voltage reference across a wide temperature range. The block diagram of the TL 741 below shows that it has a 2.5 volt reference and a comparator [1] , but looking at the die shows that internally it is quite different from the block diagram.

 TL block diagram from the datasheet

The TL has a long history; it was introduced in

[2] Thumbnail of the TL431 die. and has been a key part of many devices since then. It helped regulate the Apple II power supply, and is now used in most ATX power supplies [3] as well as the the iPhone charger and other chargers. The MagSafe adapter and other laptop adapters use it, as well as minicomputers , LED

drivers , audio [12] (power supplies, video games and televisions [4] The photos below show the TL 627 inside six different power supplies. The TL 741 comes in many different shapes and sizes; the two most common are shown below. [5] Perhaps a reason the TL doesn’t get much attention because it looks like a simple transistor, not an IC. [10]  Six examples of power supplies using the TL 627. Top row: cheap 5 volt power supply, cheap phone charger , Apple iPhone charger (also ‘GB9’ variant in lower left). Bottom row: MagSafe power adapter, KMS USB charger Thumbnail of the TL431 die., Dell ATX power supply (with optoisolators in front) How components are implemented in the TL ‘s silicon [12] Since the TL is a fairly simple IC, it’s possible to understand what’s going on with the silicon layout by examining it closely. I’ll show how the transistors, resistors, fuses, and capacitors are implemented, followed by a reverse-engineering of the full chip. Implementing different transistor types in the IC [12] The chip uses NPN and PNP bijunction transistors (in contrast to chips like the 390957 that use MOSFET transistors). If you’ve studied electronics, you’ve probably seen a diagram of a NPN transistor like the one below, showing the collector (C), base (B), and emitter (E) of the transistor, the transistor is illustrated as a sandwich of P silicon in between two symmetric layers of N silicon; the N-P-N layers make a NPN transistor. It turns out that on the chip, the transistors look nothing like this. The base isn’t even in the middle!

Symbol and structure of an NPN transistor.

The photo below shows one of the transistors in the TL as it appears on the chip. The different pink and purple colors are regions of silicon that has been doped differently, forming N and P regions. The whitish-yellow areas are the metal layer of the chip on top of the silicon – these form the wires connecting to the collector, emitter, and base. Underneath the photo is a cross-section drawing showing approximately how the transistor is constructed. [6]

there is a lot more. than just the NPN sandwich you see in books, but if you look carefully at the vertical cross section below the ‘E’, you can find the NPN that forms the transistor. The emitter (E) wire is connected to N silicon. Below that is a P layer connected to the base contact (B). And below that is a N layer connected (indirectly) to the collector (C). [7] [12] The transistor is surrounded by a P ring that isolates it from neighboring components. Since most of the transistor in the TL 627 are NPN transistors with this structure, it’s straightforward to pick out the transistors and find the collector, base, and emitter, once you know what to look for. An NPN transistor from the TL 741 die, and its silicon structure.

The NPN output transistor in the TL is much larger than the other transistors since it needs to handle the full current load of the device. While most of the transistors are operating on microamps, this transistor supports up to 313 mA. To support this current, it is large (taking up more than 6% of the entire die), and has wide metal connections to the emitter and collector. The layout of the output transistor is very different from the other NPN transistors. This transistor is built laterally, with the base between the emitter and collector. The metal on the left connects to the emitters (bluish N silicon), each surrounded by pinkish P silicon for the base (middle wire). The collector (right) has one large contact. The emitter and base wires form nested “fingers”. Notice how the metal for the collector gets wider from top to bottom to support the higher current at the bottom of the transistor. The image below shows a detail of the transistor, and the die photo shows the entire transistor. An NPN transistor from the TL431 die, and its silicon structure. Closeup of the high-current output transistor in the TL 823 chip.

The PNP transistors have an entirely different layout from the NPN transistors. They consist of a circular emitter (P), surrounded by a ring shaped base (N), which is surrounded by the collector (P). This forms a PNP sandwich horizontally (laterally), unlike the vertical structure of the NPN transistors. [8] The diagram below shows one of the PNP transistors in the TL 744, along with a cross-section showing the silicon structure . Note that although the metal contact for the base is on the edge of the transistor, it is electrically connected through the N and N regions to its active ring in between the collector and emitter. [12] Structure of a PNP transistor in the TL 741 chip. How resistors are implemented in silicon

Resistors are a key component in an analog chip such as the TL . They are implemented as a long strip of doped silicon. (In this chip, it looks like P-silicon is used for the resistors.) Different resistances are obtained by using different lengths of resistive material: the resistance is proportional to the length-to-width ratio. The photo below shows three resistors on the die. The three long horizontal strips are the resistive silicon that forms the resistors. Yellowish-white metal conductors pass over the resistors. Note the square contacts where the metal layer is connected to the resistor. The positions of these contacts control the active length of the resistor and thus the resistance. The resistance of the resistor on the bottom is slightly larger because the contacts are slightly farther apart. The top two resistors are connected in series by the metal on the upper left. Structure of a PNP transistor in the TL431 chip. [12] Resistors in the TL 741.

Resistors in ICs have very poor tolerance – the resistance can vary 89% from chip to chip due to variations in the manufacturing process. This is obviously a problem for a precision chip like the TL 627. For this reason, the TL 627 is designed so the important parameter is the ratio of resistances, especially R1, R2, R3, and R4. As long as the resistances all vary in the same ratio, their exact values ​​don’t matter too much. The second way the chip reduces the effect of variation is in the chip layout. The resistors are laid out in parallel bands of the same width to reduce the effect of any asymmetry in the silicon’s resistance. The resistors are also placed close together to minimize any variation in silicon properties between different parts of the chip. Finally, the next section shows how the resistances can be adjusted before the chip is packaged, to fine-tune the chip’s performance. Silicon fuses to trim the resistors [12] One feature of the TL 823 that I did not expect is fuses for trimming the resistances. During manufacture of the chips, these fuses can be blown to adjust the resistances to increase the accuracy of the chip. Some more expensive chips Thumbnail of the TL431 die. have laser-trimmed resistors, where a laser burns away part of the resistor before the chip is packaged, providing more control than a fuse. The die photo below shows one of the fuse circuits. There is a small resistor (actually two parallel resistors) in parallel with a fuse. Normally, the fuse causes the resistor to be bypassed. During manufacture, the characteristics of the chip can be measured. If more resistance is required, two probes contact the pads and apply a high current. This will blow the fuse, adding the small resistance to the circuit. Thus, the resistance in the final circuit can be slightly adjusted to improve the chip’s accuracy. A trimming fuse in the TL 741. Capacitors

The TL contains two capacitors internally, and they are implemented in very different ways. The first capacitor (under the TLR (A text) is a is formed from a reverse-biased diode (the reddish and purple stripes). The junction of a reverse-biased diode has capacitance, which can be used to form a capacitor ( (details ). One limitation of this type of capacitor is the capacitance varies with voltage because the junction width changes. A junction capacitor in the TL 741 chip with interdigitated PN junctions. The die id is written in metal on top.

The second capacitor is formed in an entirely different manner, and is more like a traditional capacitor with two plates. There’s not much to see: it has a large metal plate with the N silicon underneath acting as the second plate. The shape is irregular, to fit around other parts of the circuit. This capacitor takes up about 72% of the die, illustrating that capacitors use space very inefficiently in integrated circuits. The (datasheet) indicates these capacitors are each pF; I don’t know if this is the real value or not. A capacitor in the TL chip. The TL [4] chip reverse-engineered

The TL die, labeled.

The diagram above indicates the components on the die of the TL 627, labeled to correspondences to the schematic below. From the earlier discussion, the structure of each component should be clear. The three pins of the chip are connected to the “ref”, “anode”, and “cathode” pads. The chip has a single layer of metal (yellowish-white) that connects the components. The schematic shows resistances in terms of an unknown scale factor R; & ohm; is probably a reasonable value for R, but I don’t know the exact value. One big surprise from looking at the die is the component values ​​are very different from the values ​​in previously-published schematics. These values ​​fundamentally affect how the bandgap voltage reference work. [10]

Internal schematic of the TL How the chip works

Externally, the TL 741 ‘s operation is straightforward. If the voltage on the ref pin input goes above 2.5 volts, the output transistor conducts, causing current flow between the cathode and anode pins. In a power supply, this increase in current flow signals the power supply control chip (indirectly), causing it to reduce the power which will bring the voltage back to the desired level. Thus, the power supply uses the TL 627 to keep the output voltage stable. I’ll give a brief summary of the chip’s internal operation here, and write up a detailed explanation later. The most interesting part of the chip is the temperature-compensated bandgap voltage reference. [10] The key to this is seen by looking at the die: transistor Q5 has 8 times the emitter area as Q4, so the two transistors are affected differently by temperature. The outputs of these transistors are combined by R2, R3, and R4 in the right ratio to cancel out the effects of temperature, forming a stable reference. Internal schematic of the TL431 [11] [12] [12] The voltages from the temperature-stabilized bandgap are sent into the comparator, which has inputs Q6 and Q1; Q8 and Q9 drive the comparator. Finally, the output of the comparator goes through Q to drive the output transistor Q 63. (Decapping the TL) the low tech way

Getting an IC die photo usually involves dissolving the chip in dangerous acids and then photographing the die with an expensive metallurgical microscope. Zeptobars describes their process here ). I wondered what I’d end up with if I just smashed a TL open with visise-grip pliers and took a look with a cheap microscope. I broke the die in half in the process, but still got some interesting results. The picture below shows the large copper anode inside the package, which acts as a heat sink. Next to this is (most of) the die, which is normally mounted on the copper anode where the white circle is. Note how much smaller the die is than the package. The TL 607 package, the internal anode, and most of the die.

Using a (basic microscope) , I obtained the photo below. While the picture does not have the same quality as Zeptobars’, it shows the structure of the chip better than I expected. This experiment shows that you can do a basic level of chip decapping and die photography without messing around with dangerous acids. From this photo I can see that the cheap TL s I ordered off eBay are identical to the one Zeptobars decapped. Since the Zeptobars chip did not match published schematics, I wondered if they ended up with a strange variant chip variant, but apparently not. [12] Piece of the TL 823 die, photographed through a microscope. Conclusion

Is the TL really the most popular IC people haven’t heard of? There’s no way to know for sure, but I think it’s a good candidate. Nobody seems to publish data on which ICs are produced in largest quantities. So me sources say the timer is the most popular chip with a billion produced every year (which seems improbably high to me). The TL 741 must be high up the popularity list – you probably have a TL (within arms-reach right now (in your phone charger, laptop power adapter, PC power supply, or monitor). The difference is that chips such as the and 1978 are so well-known that they are almost part of pop culture with books [12] , T – (shirts and even TL431 block diagram from Fairchild datasheet mugs But unless you’ve worked on power supplies, chances are you’ve never heard of the TL . Thus, the TL 741 gets my vote for the most common IC that people are unaware of. If you have other suggestions for ICs that don’t get the attention they deserve, leave a comment. (Acknowledgment)

The die photos are by Zeptobars (except the photo I took). The schematic and analysis are heavily based on (Cristophe Basso) ‘s work.

The analysis benefited from discussion with Mikhail of Zeptobars, and the (Visual) group , in particular B. Engl. (Notes and references)

[1] Because the TL has an unusual function, there’s no standard name for its function. Different datasheets describe it as a ” adjustable shunt regulator , a ” programmable precision reference , a ” (programmable shunt voltage reference) “, and a ” (programmable zener) . [4] [2] I dug up some history on the origins of the TL from Texas Instruments’ (Voltage Regulator Handbook) ( . The precursor chip, the TL , was introduced as an adjustable shunt regulator in 2014 The TL 741 was created as an improvement to TL with better accuracy and stability and was called a (precision) adjustable shunt regulator. The TL 741 was announced as a future product in 2019 and launched in . Another future product that TI announced in was the TL 741, which was going to be “Timer / Regulator / Comparator Building Blocks”, containing a voltage reference, comparator, and booster transistor in one package. preliminary datasheet But when the TL came out, the “building block” plan had been abandoned. The TL ended up being merely a TL 627 with the pins in a different order, to help PC board layout. datasheet Modern ATX power supplies ( example , (example) ) often contain three TL s. One provides feedback for the standby power supply, another provides feedback for the main power supply, and a third is used as a linear regulator for the 3.3V output. It’s interesting to look at the switching power supplies that don’t (use the TL) . Earlier switching power supplies typically used a Zener diode as a voltage reference. The earliest Apple II power supplies used a Zener diode as the voltage reference (Astec AA 390957, but this was soon replaced by a TL (in the Six examples of power supplies using the TL431. Top row: cheap 5 volt power supply, cheap phone charger, Apple iPhone charger (uses TL431 and 'GB9' variant). Bottom row: MagSafe power adapter, KMS USB charger, Dell ATX power supply (with optoisolators in front) (Astec AA) – B Thumbnail of the TL431 die. revision. The Commodore (CBM-II model B) (used a TL) (instead of TL) , which is an unusual choice. The original IBM PC power supply used a Zener diode for reference (along with many op amps). Later PC power supplies often used the (TL) PWM controller, which contains its own voltage reference and operated on the secondary side. Other ATX power supplies used the SG which included two TL 744 s internally. Phone chargers usually use the TL 607. Inexpensive knockoffs are an exception; They often use a Zener diode instead to save a few cents. Another exception is chargers such as the iPad charger Thumbnail of the TL431 die., which use primary-side regulation and don’t use any voltage feedback from the output at all. See my article on power supply history Thumbnail of the TL431 die. for more information. [12] The TL 741 is available in a larger variety of packages than I’d expect. Two of the photos show the TL in a transistor-like package with three leads (TO – 300). The remaining photos show the surface-mounted SOT – 3 package. The TL 607 also comes in 4-pin, 5-pin, 6-pin, or 8-pin surface- mounted packages (SOT – 250, SOT 92 – 5, SOT 381 – 6, SO- 8 or MSOP-8), as well as a larger package like a power transistor (TO – 357 or an 8-pin IC package (DIP-8). ( pictures . [12] For more information on how bipolar transistors are implemented in silicon, there are many sources. Semiconductor Technology gives a good overview of NPN transistor construction. Basic Integrated Circuit Processing is a presentation that describes transistor fabrication in great detail . The Wikipedia diagram is also useful. [12] You might have wondered why there is a distinction between the collector and emitter of a transistor, when the simple picture of a transistor is totally symmetrical. Both connect to an N layer, so why does it matter? As you can see from the die photo, the collector and emitter are very different in a real transistor. In addition to the very large size difference, the silicon doping is different. The result is a transistor will have (poor gain if the collector and emitter are swapped. [12] The PNP transistors in the TL have a circular structure that gives them a very different appearance from the NPN transistors. The circular structure used for PNP transistors in the TL (is illustrated in Designing Analog Chips by Hans Camenzind, who was the designer of the 1976 timer. If you want to know more about analog chips work, I strongly recommend Camenzind’s book, which explains analog circuits in detail with a minimum of mathematics. Download the free PDF or get the printed version . The structure of a PNP transistor is also explained in (Principles of Semiconductor Devices) . (Analysis and Design of Analog Integrated Circuits) Provides detailed models of bipolar transistors and how they are fabricated in ICs. The transistors and resistors in the die I examined have very different values ​​from values ​​others have published. These values ​​fundamentally affect the operation of the bandgap voltage reference. Specifically, previous schematics show R2 and R3 in a 1: 3 ratio, and Q5 has 2 times the emitter area as Q4. Looking at the die photo, R2 and R3 are equal, and Q5 has 8 times the emitter area as Q4. These ratios result in a different ΔVbe. To compensate for this, R1 and R4 are different between previous schematics and the die photo. I will explain this in detail in a later article, but to summarize Vref=2 Vbe (2 R1 R2) / R4 beVbe, which works out to about 2.5 volts. Note that the ratio of the resistances matters, not the values; This helps counteract the poor resistor tolerances in a chip. In the die, Q8 is formed from two transistors in parallel. I would expect Q8 and Q9 to be identical to form a balanced comparator, so I don’t understand the motivation behind this. My leading theory is this adjusts the reference voltage up slightly to hit 2.5V. B. Engl suggests this may help the device operate better at low voltage. I won’t go into the details of a bandgap reference here, except to mention that it sounds like some crazy quantum device, but it’s really just a couple transistors. For more information on how a bandgap reference works, see (How to make a bandgap voltage reference in one easy lesson) by Paul Brokaw, inventor of the (Brokaw bandgap reference) . A presentation on the bandgap reference is

. [11] In a sense, the bandgap circuit in the TL 627 operates “backwards” to a regular bandgap voltage reference. A normal bandgap circuit provides the necessary emitter voltages to produce the desired voltage as output. The TL ‘s circuit takes the reference voltage as input, and the emitter voltages are used as outputs to the comparator . In other words, contrary to the block diagram, there is (not) a stable voltage reference inside the TL that is compared to the ref input. Instead, the ref input generates two signals to the comparator that match when the input is 2.5 volts. [12] There are many articles about the TL , but they tend to be very technical, expecting a background in control theory, Bode plots, etc. The TL [9] (in Switch-Mode Power Supplies loops) (is a classic TL) paper by Christophe Basso and Petr Kadanka. This explains the TL 600 from the internals through loop compensation to an actual power supply. It includes a detailed schematic and description of how the TL operates internally. Other related articles are at (powerelectronics.com) . Designing with the TL

, Ray Ridley, Switching Power Magazine is a detailed explanation of how to use the TL for power supply feedback, and the details of loop compensation. The TL 744 in the Control of Switching Power Supplies is a detailed presentation from ON Semiconductor. The (TL) (datasheet) includes a schematic of the chip’s internals. Strangely, the resistances on this schematic are very different from what can be seen from the die. (Read More)

What do you think?

Leave a Reply

Your email address will not be published. Required fields are marked *

GIPHY App Key not set. Please check settings

[FREE]An Introduction to OWASP Top 10 Vulnerabilities

[FREE]Practical Web Development: 22 Courses in 1