Difference between CC2630 and CC2650
Texas Instruments released a new family of ultra-low power wireless MCUs (CC26XX and CC1310). They come in 3 different (physical) sizes and in 5 different flavors of supported wireless protocols. There is the CC2620 which supports RF4CE, the CC2630 for Zigbee and 6LoWPAN, the CC2640 for Bluetooth Smart and the CC2650 which does all the 2.4GHz based protocols. The CC1310 takes care of all the sub-GHz protocols, so we won’t be looking at that one in this comparison.
The price difference between the different models is quite significant: the CC2630, 6LoWPAN model currently sells for an average of $11.87 while the CC2650, multi protocol version currently goes for $15.03.
So how much hardware difference is there really between these models? Do you pay for different silicon, or are these different flavors more similar than their markings let on?
Only one way to find out!
I sampled both the CC2630 and CC2650 (Thanks TI!), decapped both chips and compared the dies.
Overview of the CC26XX series by Texas Instruments
How to decap ICs:
I like to use fuming nitric acid (HNO3), the process goes pretty quick and the die comes out nice and clean, ready for the microscope.
DISCLAMER: HNO3 is extremely dangerous.
Like, really, dude.
Only replicate this if you know what you’re doing and have the right tools to handle highly corrosive acids and chemicals. This stuff will decompose your skin and flesh. Always wear gloves, eye protection, lab coat and use a fume hood.
If you’re not trying to save any of the bonding wires in the chip, the process is pretty easy. Just take some nitric acid, throw the chip in there. The acid will start reacting with the packaging and you’ll see it bubble, dissolve and delaminate. To make the process go a little faster you can add some heat to the reaction by putting the whole thing on a hot plate. Make sure you keep an eye on the die and rinse it off with acetone in time to make sure the acid doesn’t damage the die itself.
The speed of the process depends on the size of the package, the amount of metal / pins in there and of course the purity of the HNO3 and added heat. For this chip it took me about 5 to 10 minutes.
Gather all your tools and some (sampled) chips in the fume hood.
Fuming HNO3 is not the easiest to get if you’re not a chemistry- or university lab. Depending on where you live of course.
Five tries each, should do it.
CC2630 on the left, CC2650 on the right.
Submerge the chip in the HNO3.
Observe the reaction.
The metal on the chip will start gently bubbling and dissolving while the rest of the packaging starts crumbling off.
The HNO3 turns greener the further the reaction goes.
By gently heating up the HNO3 you can make the reaction go slightly faster.
The packaging will start to delaminate and the bare die will become visible. With some practice you can get the chip out just before the bonding wires dissolve.
Take the chip out of the HNO3 and clean it of with acetone.
The packaging will further crumble off.
The back of the die is now clearly visible and the packaging is almost completely dissolved.
Keep the die in the HNO3 until the packaging is completely gone.
To inspect the die itself you do need a proper microscope. The needed magnification of course depends on the scale of the manufacturing process of the die. Having a proper X-Y table will also help a lot when staring at the silicon.
I couldn’t get the camera on my microscope to properly work, because of drivers and Windows (Damn you Windows!). So the actual pictures of the die are made with the ‘point your cellphone cam through the eyepiece technique’.
Top of the die is already visible, but it needs some more time in the HNO3.
Almost there!
Close up of the die. Pretty sure this is part of the radio on the chip. I’m guessing some sort of coil? Please correct me if I’m wrong. At the top you can see the pads where the bonding wires used to be connected.
This is a die shot of the CC2630, I did get a little too rough while cleaning and made some scratches.
Next step in this comparison is to look for the die markings of both ICs and compare them.
That looks like part of the TI logo, but of course the rest of the marking broke off. I’m not sure if the die was packaged like this, or if I broke of this corner. Big chance I did though.
After decapping another CC2630 I got this result! Very clear marking on the die: 2014TI F771735
Now for the comparison I went through the whole process again with a CC2650. Which gives …
Indeed, the same F771735 marking!
Both dies next to each other on my finger for size.
So it seems that both the CC2630 and CC2650 have the same die markings and thus are identical on silicon level. I’m guessing that the CC2620 and CC2640 also have an identical die (Chipworks actually agrees with me on the CC2640). This could mean that the differences in supported protocols is purely based on which firmware TI programs into the chip. Making the CC26XX series chips a form of crippleware.
All radio tasks in the CC26XX chips are being handled by the ARM Cortex-M0 co-processor. So my best guess is that this processor just runs different firmware based on the version of the chip. Reflashing this firmware is blocked, except in the more expensive ‘multi protocol’ CC2650.
It would be interesting to see what measures TI implemented to prevent reflashing of this radio firmware in the fixed protocol models, and if there is a way to circumvent them.
But I’ll leave that as an exercise for the reader ;) (But do report here if you have some more info!)
BONUS: Some more die shots I made of a CC2531 a while ago. This die is made with a bigger scale manufacturing process, so the die itself is bigger and the pictures are a little clearer.
Comparison between the older brother, CC2531 on the left (with some bonding wires still attached) and the CC2650 on the right.
