Accessing BGA Pins

[Philip] developed a method of tracking down the pins of a Ball Grid Array. He wanted to do so in order to add USB host functionality to his HP Jordan 720. The method doesn’t directly connect to the BGA but instead finds a via or other access point to serve as a solder point. He first looks up the pin in the BGA datasheet. Once located, he uses the bristle of a toothbrush (teal) to act as a backstop and feeds in some enameled wire (brown) to the appropriate ball. A multimeter is used to check connectivity between the wire and the vias around the chip.

Patience young grasshopper, this should work but it might take a while.

29 thoughts on “Accessing BGA Pins

  1. thats an awesome idea. I’ve always been interested in the Jordana PC’s and one thing that holds them back is lack of USB functionality which even my old libretto 110CT has (abeit in a base unit)

  2. That is made of awesome and cool. I actually have located JTAG pins on BGA CPUs like this, but I always measured out the length of the wire beforehand and eyeballed where the ball must be. Using a toothbrush-bristle should make that job a bit easier.

  3. I have a J720 and I have run linux on it using a HPC2000 bootloader but things in linux didn’t work too well which I guess is why he is having trouble with it.

    If I remember correctly you can get a docking cradle thing for them that gives you a USB connection for activesync (in HPC2000) so im not sure why he didn’t target those connections as they are on the bottom of the device and easily accessible but I know nothing about the hardware of these things so that might not be viable.

    I do think this would be a cool mod for mine if he gets it working as the serial only interface is a real PITA for me.

  4. Interesting, I never expected the StrongArm and/or it’s companion chips to have USB host functionality. I wonder if there is USB host functionality in Handheld PC 2000. IIRC, Pocket PC 2002 does have base USB host functionality, and the two have basically the same kernel. Trying it under Windows CE may help troubleshooting the USB, if there is capability.

    Paul: You might consider the NEC Mobile Pro 900/900c which has a faster proc and a USB host port but the same formfactor and architecture as the HP Jornada 720.

    Ed: The USB connection for ActiveSync is client mode only, you can’t connect devices to that port.

  5. i have in the past just pushed the very thin wire
    all the way through under the chip.
    then bent the end of the wire on the “far end”
    towards the side of the ball row wanted .
    making sure the enamel is intact on the other
    (making sorta spring between the two ball rows)

    and then pulled it back a number of balls
    feeling the “bumps” as it passes the balls.
    (like picking a lock) till it gets to the right one.
    then a certain amount of tension is possible
    before it “bumps too far”

    fixate the wire with hotglue
    and start “beeping”

    then dubble / tripple check ;)

  6. yea. im also experimenting with adding usb to
    a BCM4712 based router
    but im having a hard time locating datasheet
    for it.

    and not yet 100% success with “beeping”
    a known usb enabled router.

    anybody have the real datasheet for bcm4712 ??

  7. @Rune kyndal

    “im having a hard time locating datasheet for it. …anybody have the real datasheet for bcm4712 ??”

    Good luck. People have been trying for years to get it and Broadcom is not budging.

  8. he he.. that’s funny guys.\n
    but hey Poetry or not. \n
    that way i have beeped the usb pinout of the \n
    BCM4712KFB-0445-P12 \n
    and im working on locating pads and vias for them (hopefully)\n
    as its a pain to access balls underneath a bga!\n

  9. This reminds me of when cpu were sold on cards in the slot1 format. We use to put the card , with cpu attached on a drill press and drill out the pins to the cpu to enable multiprocessor use. Drill too deep and you had a $200 piece of scrap.

    I suppose you could also use drill approach with a very very tiny drill bit to reach the via, but then you also chance hitting a trace that is routed on the inside of the board if it is 3 or 4+ layers.

  10. Datasheet from Broadcom ? LOL LOL LOL
    Sorry. Broadcom is the most hobbyist unfriendly company that exist. I have tried to get datasheets from them for products made 10 years ago and no longer used. Even if I agreed to sign an NDA they wouldn’t let me view them . That is why if I am buying hardware like a router or set top box I check to see if broadcom is involved. If they are I buy something else.

  11. well.. i got the usb pins. all i need to know is if there is some pins i need to pull low/high to enable the usb. (besides software)

    dont really care for the datasheet beyond the
    usb pinout
    they can keep that Suuuuuuper secret!!!!

    Woooooh! Secret chip.

    how can secrecy help sales??
    Not a clue!

    Get in the game OPEN is the word these days!

  12. I’m pretty sure the USB host signals are not routed at all(because there is no intended USB host functionality on the device!) thus rendering this method useless. My claim is supported by the fact that the article does not indicate the vias’ locations or whether they were found at all.
    OTOH, BGA balls (not pins!) can sometimes be accessed by scraping the solder mask off the edge of the package and probing the tiny traces there (the BGA package is actually a thin PCB with plastic on top).

  13. never underestimate the myraid uses of low melting point alloy and a 1mm syringe needle.. :)

    in this case feeding a wire with ~.5mm diameter LMP alloy ball onto the desired ball or pad and using heat applied to the needle to “weld” it in place without disrupting the rest of the joint.

    another handy trick is to preheat the section to be modded up to about 100 Celsius (use the thermal pad from a deceased plasma panel backplane for this) before doing the mod, reduces strain on the PCB.

    inspired by those 1337 folks at intel with their chip bonding machines…

  14. yea usb host was not intended on the wrt54g im trying to hack. and the 4712 in this one V2.2 is the small BGA packagge so no pcb to scrape ;(

    i have traced the usb “balls” on a usb enabled router but i need to find the ball for USB_CNTRL, which needs to be pulled up to enable the usb.

    and since it just needs to be pulled up im having some difficulty locating it on the usb enabled router. and hence tracing it..

    thats where its stuck right now ;)

  15. I use a method similar to Rune kyndal. I don’t just count bumps, however. I x-ray. Not everyone has such a tool, but I’m glad as hell I do.

    In my case I need it because there are times I’ll reflow the BGA with hot air to keep the wire in place. You don’t want to chance it when you could very well hose the BGA if the solder pulls to an adjacent ball when reflowed.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.