Decapsulating the CH32V203 Reveals a Separate Flash Die

https://cpldcpu.wordpress.com/2024/05/01/decapsulating-the-ch32v203-reveals-a-separate-flash-die/

The CH32V203 is a 32bit RISC-V microcontroller. In the produt portfolio of WCH it is the next step up from the CH32V003, sporting a much higher clock rate of 144 MHz and a more powerful RISC-V core with RV32IMAC instruction set architecture. The CH32V203 is also extremely affordable, starting at around 0.40 USD (>100 bracket), depending on configuration.

An interesting remark on twitter piqued my interest: Supposedly the listed flash memory size only refers to a fraction that can be accessed with zero waitstate, while the total flash size is even 224kb. The datasheet indeed has a footnote claiming the same. In addition, the RB variant offers the option to reconfigure between RAM and flash, which is rather odd, considering that writing to flash is usually much slower than to RAM.

Then the 224kb number is mentioned in the memory map. Besides the code flash, there is also a 28Kb boot section and additional configurable space. 224 kbyte +28 kbyte+4=256kbyte, which suggests that the total available flash is 256 kbyte and is remapped to different locations of the memory.

All of these are red flags for an architecture where a separate NOR flash die is used to store the code and the main CPU core has a small SRAM that is used as a cache. This configuration was pioneered by Gigadevice and is also famously used by the ESP32 and RP2040 more recently, although that latter two use an external NOR flash device.

Flash memory is quite different from normal CMOS devices as it requires a special gate stack, isolation and much higher voltages. Therefore, integrating flash memory into a CMOS logic die usually requires extra process steps. The added complexity increases when going to smaller technologies nodes. Separating both dies offers the option of using a high density logic process (for example 45 nm) and pairing it with a low-cost off-the-shell NOR flash die.

Decapsulation and Die Images

To confirm my suspicions I decapsulated a CH32V203C8T6 sample, shown above. I heated the package to drive out the resin and then carefully broke the, now brittle, package apart. Already after removing the lead frame, we can cleary see that it contains two dies.

The small die is around 0.5mm² in area. I wasn’t able to completely removed the remaining filler, but we can see that it is an IC with a smaller number of pads, fitting to a serial flash die.

The microcontroller die came out really well. Unfortunately, the photos below are severely limited by my low-cost USB microscope. I hope Zeptobars or others will come up with nicer images at some point.

The die size of ~1.8 mm² is surprisingly small. In fact it is even smaller than the die of the CH32V003 with a die size of ~2.0 mm² according to Zeptobars die shot. Apart from the fact that the flash was moved off-chip, most likely also a much smaller CMOS technology node was used for the CH32V203 than for the V003.

Summary

It was quite surprising to find a two-die configuration in such a low-cost device. But obviously, it explains the oddities in the device specification, and it also explains why 144 MHz core clock is possible in this device without wait-states.

What are the repercussions?

Amazingly, it seems that, instead of only 32kb of flash, as listed for the smallest device, a total of 224kb can be used for code and data storage. The datasheet mentions a special “flash enhanced read mode” that can apparently be used to execute code from the extended flash space. It’s not entirely clear what the impact on speed is, though, but that’s certainly an area for exploration.

I also expect this MCU to be highly overclockable, similar to the RP2040.

{
"by": "camel-cdr",
"descendants": 1,
"id": 40227528,
"kids": [
40249194
],
"score": 37,
"time": 1714589210,
"title": "Decapsulating the CH32V203 Reveals a Separate Flash Die",
"type": "story",
"url": "https://cpldcpu.wordpress.com/2024/05/01/decapsulating-the-ch32v203-reveals-a-separate-flash-die/"
}
{
"author": "Skip to content",
"date": "2024-05-03T14:11:34.000Z",
"description": "The CH32V203 is a 32bit RISC-V microcontroller. In the produt portfolio of WCH it is the next step up from the CH32V003, sporting a much higher clock rate of 144 MHz and a more powerful RISC-V core…",
"image": "https://i0.wp.com/cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?ssl=1",
"logo": "https://logo.clearbit.com/wordpress.com",
"publisher": "WordPress.com",
"title": "Decapsulating the CH32V203 Reveals a Separate Flash Die",
"url": "https://cpldcpu.wordpress.com/2024/05/01/decapsulating-the-ch32v203-reveals-a-separate-flash-die/"
}
{
"url": "https://cpldcpu.wordpress.com/2024/05/01/decapsulating-the-ch32v203-reveals-a-separate-flash-die/",
"title": "Decapsulating the CH32V203 Reveals a Separate Flash Die",
"description": "The CH32V203 is a 32bit RISC-V microcontroller. In the produt portfolio of WCH it is the next step up from the CH32V003, sporting a much higher clock rate of 144 MHz and a more powerful RISC-V core with RV32IMAC instruction set architecture. The CH32V203 is also extremely affordable, starting at around 0.40 USD (>100 bracket),…",
"links": [
"https://cpldcpu.wordpress.com/2024/05/01/decapsulating-the-ch32v203-reveals-a-separate-flash-die/",
"https://wp.me/p3pzLu-qa"
],
"image": "https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=640",
"content": "<article>\n\t<div>\n<p>The CH32V203 is a 32bit RISC-V microcontroller. In the produt portfolio of WCH it is the next step up from the CH32V003, sporting a much higher clock rate of 144 MHz and a more powerful RISC-V core with RV32IMAC instruction set architecture. The CH32V203 is also extremely affordable, starting at around 0.40 USD (&gt;100 bracket), depending on configuration.</p>\n<p>An interesting remark on <a target=\"_blank\" href=\"https://twitter.com/bc12edd8ae23b21/status/1785087637306610059?t=ZJlTBE-r9VbZi8o374qEpw&amp;s=19\">twitter</a> piqued my interest: Supposedly the listed flash memory size only refers to a fraction that can be accessed with zero waitstate, while the total flash size is even 224kb. The datasheet indeed has a footnote claiming the same. In addition, the RB variant offers the option to reconfigure between RAM and flash, which is rather odd, considering that writing to flash is usually much slower than to RAM.</p>\n<figure>\n<figure><a target=\"_blank\" href=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png\"><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=1024\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=1024 1024w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png?w=768 768w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik.png 1049w\" /></a></figure>\n</figure>\n<figure>\n<figure><a target=\"_blank\" href=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png\"><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png?w=1024\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png?w=1024 1024w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png?w=768 768w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-1.png 1053w\" /></a></figure>\n</figure>\n<p>Then the 224kb number is mentioned in the memory map. Besides the code flash, there is also a 28Kb boot section and additional configurable space. 224 kbyte +28 kbyte+4=256kbyte, which suggests that the total available flash is 256 kbyte and is remapped to different locations of the memory.</p>\n<p>All of these are red flags for an architecture where a separate NOR flash die is used to store the code and the main CPU core has a small SRAM that is used as a cache. This configuration was pioneered by Gigadevice and is also famously used by the ESP32 and RP2040 more recently, although that latter two use an external NOR flash device.</p>\n<p>Flash memory is quite different from normal CMOS devices as it requires a special gate stack, isolation and much higher voltages. Therefore, integrating flash memory into a CMOS logic die usually requires extra process steps. The added complexity increases when going to smaller technologies nodes. Separating both dies offers the option of using a high density logic process (for example 45 nm) and pairing it with a low-cost off-the-shell NOR flash die.</p>\n<h2>Decapsulation and Die Images</h2>\n<p>To confirm my suspicions I decapsulated a CH32V203C8T6 sample, shown above. I heated the package to drive out the resin and then carefully broke the, now brittle, package apart. Already after removing the lead frame, we can cleary see that it contains two dies.</p>\n<figure>\n<figure><a target=\"_blank\" href=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg\"><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg?w=959\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg?w=959 959w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg?w=141 141w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg?w=281 281w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg?w=768 768w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/pxl_20240501_065213138.jpg 1023w\" /></a></figure>\n</figure>\n<p>The small die is around 0.5mm² in area. I wasn’t able to completely removed the remaining filler, but we can see that it is an IC with a smaller number of pads, fitting to a serial flash die.</p>\n<figure>\n<figure><a target=\"_blank\" href=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png\"><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png?w=860\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png 860w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/grafik-7.png?w=768 768w\" /></a></figure>\n</figure>\n<p>The microcontroller die came out really well. Unfortunately, the photos below are severely limited by my low-cost USB microscope. I hope Zeptobars or others will come up with nicer images at some point.</p>\n<figure>\n<figure><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_full.png?w=1009\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_full.png 1009w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_full.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_full.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_full.png?w=768 768w\" /></figure>\n<figure><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p1.png?w=776\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p1.png 776w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p1.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p1.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p1.png?w=768 768w\" /></figure>\n<figure><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p2.png?w=896\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p2.png 896w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p2.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p2.png?w=300 300w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die_p2.png?w=768 768w\" /></figure>\n<figure><img src=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die.png?w=703\" srcset=\"https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die.png 703w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die.png?w=150 150w, https://cpldcpu.wordpress.com/wp-content/uploads/2024/05/ch32v203_large_die.png?w=300 300w\" /></figure>\n</figure>\n<p>The die size of ~1.8 mm² is surprisingly small. In fact it is even smaller than the die of the CH32V003 with a die size of ~2.0 mm² according to <a target=\"_blank\" href=\"https://zeptobars.com/en/read/wch-ch32v003-risc-v-riscv-microcontroller-10-cent\">Zeptobars </a>die shot. Apart from the fact that the flash was moved off-chip, most likely also a much smaller CMOS technology node was used for the CH32V203 than for the V003.</p>\n<h2>Summary</h2>\n<p>It was quite surprising to find a two-die configuration in such a low-cost device. But obviously, it explains the oddities in the device specification, and it also explains why 144 MHz core clock is possible in this device without wait-states.</p>\n<p>What are the repercussions?</p>\n<p>Amazingly, it seems that, instead of only 32kb of flash, as listed for the smallest device, a total of 224kb can be used for code and data storage. The datasheet mentions a special “flash enhanced read mode” that can apparently be used to execute code from the extended flash space. It’s not entirely clear what the impact on speed is, though, but that’s certainly an area for exploration.</p>\n<p>I also expect this MCU to be highly overclockable, similar to the RP2040.</p>\n\t</div>\n</article>",
"author": "",
"favicon": "https://s1.wp.com/i/favicon.ico",
"source": "cpldcpu.wordpress.com",
"published": "2024-05-03T14:11:34+00:00",
"ttr": 125,
"type": "article"
}