What We Discovered When Decoding a Smartphone LPDDR5x Memory Using the M7030 DDR/LPDDR Protocol Analyzer

At the Introspect R&D labs, we always love to measure live systems and understand how they operate. In this article, we asked ourselves whether we could decode a new-generation smartphone with LPDDR5x package-on-package memory. To do this, we used an integrated-tip interposer, a RSH2 active probe, and the M7030 Protocol Analyzer. Read on to see what we learned!

The Test Setup

Figure 1 shows the setup that we have used. Being a smartphone, you can see how tiny the logic board of the phone is. In the figure, the integrated-tip interposer is sitting in between the Applications Processor and the LPDDR5x memory device. The interposer allowed us to probe both the CA bus and the DQ bus. The interposer provides the probed signals through a shielded micro-coaxial cable interface, thus eliminating the need for soldering down external active probe tips.

Figure 1: Integrated-tip interposer installed on smartphone with Package-on-Package (POP) LPDDR5x memory device.

Figure 2 shows the M7030 DDR/LPDDR Protocol Analyzer. This instrument was used to decode the CA bus of the phone and uncover how the operating system programs the memory.

Figure 2: M7030 DDR/LPDDR Protocol Analyzer.

Decoding the CA Bus

Command Sequence With the Phone Unplugged From the Charger

We first measured the phone while it was operating from its own battery and while being unplugged from the charger. Figure 3 shows a typical command sequence that we observed. As can be seen, there is a variety of commands such as ACT1/ACT2, CAS, REF, and of course read and write commands. Notice, however, the two highlighted commands, which are PDE and PDX. These are power down entry and exit commands, respectively, and they control when the clock signal to the memory is completely halted.

Figure 3: M7030 Protocol Analyzer trace showing the existence of PDE and PDX commands.

So, the phone is clearly managing battery life by completely stopping accesses to the memory device. Additionally, if you look at the drop-down menu on the left hand side of Figure 3, you will see a listing (or filter) of all the commands that were received within the current trace. We noticed that the lower the battery charge was, the more PDE and PDX commands that were sent by the Applications Processor. This makes sense because the phone is trying to conserve its energy store!

Command Sequence When Plugged to the Charger

We then plugged the phone into the charger. We were curious whether the frequency of PDE and PDX commands would change or not. To our surprise, we found that the phone did not send any PDE and PDX commands at all! Figure 4 shows a trace where we highlight the list of commands that were observed in the trace. As can be seen, there are no entries for PDE and PDX. So, expect your phone to run faster when it is plugged into the charger!

Figure 4: M7030 Protocol Analyzer trace where there are no PDE and PDX commands at all.

Lots of Frequency Changes!

Finally, whether the charger was connected or not, we noticed that the phone was performing a lot of clock frequency changes on the memory. Referring to Figure 5, you will see the classic command sequence related to the frequency set point (FSP) change. You will see the MRW commands just before the frequency change, then the MRW commands just after the frequency change, and finally an MPC command. Figure 6 shows the timing diagram illustrating the instantaneous frequency change as captured by the M7030 Protocol Analyzer.

Figure 5: Frequency change command sequence.

Figure 6: Frequency change timing diagram.

Frequency changes are an especially important hallmark of modern memory interface design. Any protocol analyzer or logic analyzer must be able to react to such frequency changes and help debug them. The Introspect Technology M7030 DDR/LPDDR Protocol Analyzer has been designed specifically to handle instantaneous frequency changes, and this was illustrated in Figure 5 and Figure 6 above.

Summary

In this article, we decided to decode a modern-day smartphone by using Introspect’s integrated-tip interposer, a RSH2 active probe, and the M7030 Protocol Analyzer. What we discovered was fascinating. The phone’s operating system really changes how it treats the memory based on its different operating conditions and the amount of charge it has in the battery. For example, when plugged in, the phone will operate at maximum performance without performing power-down entry and exit commands.

Do you need to decode a live form factor with DDR or LPDDR memory? Please reach out to us at info@introspect.ca for more information and to discover how easy the M7030 is.