Accessing BGA pins

[Philip] developed a method of tracking down the pins of a Ball Grid Array. He wanted to do so in order to add USB host functionality to his HP Jordan 720. The method doesn’t directly connect to the BGA but instead finds a via or other access point to serve as a solder point. He first looks up the pin in the BGA datasheet. Once located, he uses the bristle of a toothbrush (teal) to act as a backstop and feeds in some enameled wire (brown) to the appropriate ball. A multimeter is used to check connectivity between the wire and the vias around the chip.

Patience young grasshopper, this should work but it might take a while.

Comments

  1. Paul says:

    thats an awesome idea. I’ve always been interested in the Jordana PC’s and one thing that holds them back is lack of USB functionality which even my old libretto 110CT has (abeit in a base unit)

  2. samurai says:

    wow, that is brilliant. alas, BGAs still make me quiver in fear…

  3. Sprite_tm says:

    That is made of awesome and cool. I actually have located JTAG pins on BGA CPUs like this, but I always measured out the length of the wire beforehand and eyeballed where the ball must be. Using a toothbrush-bristle should make that job a bit easier.

  4. Ed says:

    I have a J720 and I have run linux on it using a HPC2000 bootloader but things in linux didn’t work too well which I guess is why he is having trouble with it.

    If I remember correctly you can get a docking cradle thing for them that gives you a USB connection for activesync (in HPC2000) so im not sure why he didn’t target those connections as they are on the bottom of the device and easily accessible but I know nothing about the hardware of these things so that might not be viable.

    I do think this would be a cool mod for mine if he gets it working as the serial only interface is a real PITA for me.

  5. rd says:

    This is awesome.

  6. d says:

    I’ve done something similar at work a number of times, if you’re feeling risky you can even heat up the other end of the wire with hopes of making a permanent connection.

  7. EquinoXe says:

    That is a great way to probe.
    Far better than sacrificing a device and remove the BGAs and other parts in order to trace the pins.

    Thanks for this simple but very useful method.

    Regards,

    EqX

  8. CircuitMage says:

    Interesting…hackaliscious

  9. blackjacksmack says:

    wow, don’t know if ill try that anytime soon but that’s really clever.

  10. tom61 says:

    Interesting, I never expected the StrongArm and/or it’s companion chips to have USB host functionality. I wonder if there is USB host functionality in Handheld PC 2000. IIRC, Pocket PC 2002 does have base USB host functionality, and the two have basically the same kernel. Trying it under Windows CE may help troubleshooting the USB, if there is capability.

    Paul: You might consider the NEC Mobile Pro 900/900c which has a faster proc and a USB host port but the same formfactor and architecture as the HP Jornada 720.

    Ed: The USB connection for ActiveSync is client mode only, you can’t connect devices to that port.

  11. Rune kyndal says:

    i have in the past just pushed the very thin wire
    all the way through under the chip.
    then bent the end of the wire on the “far end”
    towards the side of the ball row wanted .
    making sure the enamel is intact on the other
    (making sorta spring between the two ball rows)

    and then pulled it back a number of balls
    feeling the “bumps” as it passes the balls.
    (like picking a lock) till it gets to the right one.
    then a certain amount of tension is possible
    before it “bumps too far”

    fixate the wire with hotglue
    and start “beeping”

    then dubble / tripple check ;)

  12. jomei says:

    This is insane.

  13. kabukicho2001 says:

    Good mod, but if someone knows how to add an usb functionality to a wifi router.

  14. Rune kyndal says:

    yea. im also experimenting with adding usb to
    a BCM4712 based router
    but im having a hard time locating datasheet
    for it.

    and not yet 100% success with “beeping”
    a known usb enabled router.

    anybody have the real datasheet for bcm4712 ??

  15. anon says:

    @Rune kyndal

    “im having a hard time locating datasheet for it. …anybody have the real datasheet for bcm4712 ??”

    Good luck. People have been trying for years to get it and Broadcom is not budging.

  16. rd says:

    What’s with all the manual newlines? Are you writing free verse poetry?

  17. jimmys says:

    rd & Rune kyndal-
    Call that one “Bumps Too Far” and start compiling your book of technopoetry. It’s like beatnik percussive, man.

  18. Daniel Marsh says:

    It is a HP JORNADA 720 not a Jordana. I used one up until a couple years ago to be able to write lengthy emails quickly while on the run.

  19. Rune kyndal says:

    he he.. that’s funny guys.\n
    but hey Poetry or not. \n
    that way i have beeped the usb pinout of the \n
    BCM4712KFB-0445-P12 \n
    and im working on locating pads and vias for them (hopefully)\n
    as its a pain to access balls underneath a bga!\n
    \n

  20. cgmark says:

    This reminds me of when cpu were sold on cards in the slot1 format. We use to put the card , with cpu attached on a drill press and drill out the pins to the cpu to enable multiprocessor use. Drill too deep and you had a $200 piece of scrap.

    I suppose you could also use drill approach with a very very tiny drill bit to reach the via, but then you also chance hitting a trace that is routed on the inside of the board if it is 3 or 4+ layers.

  21. cgmark says:

    Datasheet from Broadcom ? LOL LOL LOL
    Sorry. Broadcom is the most hobbyist unfriendly company that exist. I have tried to get datasheets from them for products made 10 years ago and no longer used. Even if I agreed to sign an NDA they wouldn’t let me view them . That is why if I am buying hardware like a router or set top box I check to see if broadcom is involved. If they are I buy something else.

  22. samurai says:

    Hm… I have a classmate that works for broadcom… I wonder if he has datasheet access…..

  23. anon says:

    @samurai

    I don’t think he’ll risk getting fired.

  24. samurai says:

    Maybe! Its just an internship. =P

  25. Rune kyndal says:

    well.. i got the usb pins. all i need to know is if there is some pins i need to pull low/high to enable the usb. (besides software)

    dont really care for the datasheet beyond the
    usb pinout
    they can keep that Suuuuuuper secret!!!!

    Woooooh! Secret chip.

    how can secrecy help sales??
    Not a clue!

    Get in the game OPEN is the word these days!

  26. razvan784 says:

    I’m pretty sure the USB host signals are not routed at all(because there is no intended USB host functionality on the device!) thus rendering this method useless. My claim is supported by the fact that the article does not indicate the vias’ locations or whether they were found at all.
    OTOH, BGA balls (not pins!) can sometimes be accessed by scraping the solder mask off the edge of the package and probing the tiny traces there (the BGA package is actually a thin PCB with plastic on top).

  27. bothersaidpooh says:

    never underestimate the myraid uses of low melting point alloy and a 1mm syringe needle.. :)

    in this case feeding a wire with ~.5mm diameter LMP alloy ball onto the desired ball or pad and using heat applied to the needle to “weld” it in place without disrupting the rest of the joint.

    another handy trick is to preheat the section to be modded up to about 100 Celsius (use the thermal pad from a deceased plasma panel backplane for this) before doing the mod, reduces strain on the PCB.

    inspired by those 1337 folks at intel with their chip bonding machines…

  28. Rune kyndal says:

    yea usb host was not intended on the wrt54g im trying to hack. and the 4712 in this one V2.2 is the small BGA packagge so no pcb to scrape ;(

    i have traced the usb “balls” on a usb enabled router but i need to find the ball for USB_CNTRL, which needs to be pulled up to enable the usb.

    and since it just needs to be pulled up im having some difficulty locating it on the usb enabled router. and hence tracing it..

    thats where its stuck right now ;)

  29. Derek says:

    I use a method similar to Rune kyndal. I don’t just count bumps, however. I x-ray. Not everyone has such a tool, but I’m glad as hell I do.

    In my case I need it because there are times I’ll reflow the BGA with hot air to keep the wire in place. You don’t want to chance it when you could very well hose the BGA if the solder pulls to an adjacent ball when reflowed.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 96,704 other followers