Hacker News new | comments | show | ask | jobs | submit login
Reverse engineering a counterfeit 7805 voltage regulator (righto.com)
236 points by carloscm on Sept 6, 2014 | hide | past | web | favorite | 63 comments

Super informative post. Thanks for sharing.

One thing I didn't understand was the author's comment that "I bought the part off eBay, not from a reputable supplier, so it could have come from anywhere."

A 5-pack of quality 7805's can be found on Amazon for $5, including Prime shipping, (e.g. http://amzn.com/B00H7KTRO6), so what's the incentive to buy parts of unknown provenance on eBay or the like?

I ask not being a hardware guy myself, so genuinely curious, as I've heard stories like this before.

Again, fantastic overview of the chip, though. I learned a lot.

[Edit: spelling]

That is unknown providence too. If you want to be sure of getting an original chip, you need to buy it from one of the official distributors as recommended by the IC vendor, or one of the well-known distributors (Digikey, Mouser, Farnell, ...). The well-know distributors can have high shipping to some parts of the world, hence the appeal of ebay in some cases.

Funny story, I had a high % of a certain part that was causing rejects on the line. We traced the lot numbers with the manufacturer's help and...they had no information on the lot.

Now we had a big problem. Was counterfeit product getting into the mix? Our distributor claimed they were clean, the manufacturer claimed they were clean too.

Turns out that the manufacturer had temporarily moved production to a different plant during the Fukushima tsunami. There was some...confusion...during the move.

Dad worked for a firm that made tantalum capacitors, and one day the truck carrying the raw metal was hit by a train on the way to their plant.

Tantalum prices being the way they were, they had the workers out there along the tracks picking up the chunks of metal from the weeds, collecting the pieces in plastic bins.

It was sent back to the smelter to be reprocessed, but the temporary shortage caused real problems with their delivery schedules.

You have to be having a bad day as a truck driver to be hit by a train.

Thanks for the comments. I bought the parts off eBay for several reasons. First, I wanted the less common metal TO-3 package so I could open the chip with a hacksaw rather than nitric acid. Second, eBay parts are amazingly cheap: you can get 10 7805s for $1.33 from Hong Kong, shipping included. (Does anyone know how they can ship something that cheap?) Finally, since I'm cutting the chip open, I'm not exactly looking for quality :-)

Most Chinese sellers use a service called Epacket to send small items to the US. Epacket is a trilateral agreement between USPS, eBay and China Post that allows Chinese sellers to send items to the US in bulk at a low rate. Even without Epacket, Chinese postage is a lot lower than in the US.

I think there's more to it than that since the shipping is usually free worldwide, not just the US. I think most countries in the world have an agreement through the International Postal Union to pay by total weight for international packages, and the rate is low. In China/HK and some other places, they pass that low cost to the consumer, unlike the US.

Thanks for the fast reply, kens! Those reasons make a lot of sense.

And thanks again for the article itself. Very much enjoyed it.

Is the stuff from Amazon Marketplace sellers really any more reputable than professional traders on Ebay? In my mind they're about equal.

Are you so sure that those are not counterfeit? Even the "reputable" suppliers still end up with bad parts. It has become quite a problem/hassle in the last handful of years. Especially in the military industry.

On to your question about why: There are hundreds of electronics parts that are fairly standard and if people paid that much for them they would need a lot of money. Many /most people buying on ebay do it as a hobby.

A quick browse on digikey shows that <40 cents is easily found for a 7805 (http://www.digikey.com/product-detail/en/NCP7805TG/NCP7805TG...). Ebay would be even cheaper.

One problem with that reg is its a 1A reg. There is a pin compatible LM323T which is rated to 3 amps and is only about a buck and a half. Its not just fatter bonding wires and wider traces on the die, the thermal resistance from junction to package is ridiculously lower... how'd they do that? Obviously I know the theory of how to do that, but how'd they do it electrically pin compatible. Its like someone introducing in 2014 a ford model T that is blueprint compatible with every other model T except this one has 500 horsepower, somehow. I'm professionally semi-impressed by the 323T product.

There is a huge problem in the marketplace right now with LM323K series regs (basically a 3 amp die in a TO3 "big transistor" mounting case). The problem is old video game systems (not home systems, but video arcade) and some other old appliances use them, so you could modify the heatsink and stick a modern LM323T (aka TO-220 package) or hot wire in a COTS switching supply, but it wouldn't look "stock" anymore. So the market is getting flooded.

Its "well known" among CPU collectors that when you get a (insert obscure CPU here) from China, you're not really getting that CPU, you're getting some random 40 pin DIP with repainted markings. The only honest and reputable seller I'm personally aware of in China who doesn't do this is utsource, the stuff they ship actually works.

Its bad when they take a random chip like a 16550 or 8255 and remark it as a Z80 or 8086 for the collectors, but its actually worse when you really do need a 10 MHz rated Z80 or 6502 and you're sold a remarked 2 MHz part which kinda sorta sometimes works. Or if you want a real PITA some of the repainters are fairly ignorant and will ship repainted 6809 for 6809E and vice versa. Or another hilarious one, not all 6502 are pin compatible so you get a WDC product repainted to be sold as a rockwell product, which again doesn't work a lot of the time.

No, ebay in 2014 is not really fun at all for a retrocomputing enthusiast or whatever you call it.

I guess the closest HN sports analogy would be ebay is flooded with collectors items claiming to be the 1790 world series collectors plate or the 1925 football superbowl.

If you're just trying to regulate 600 mA for your rasp pi or whatever its no big deal but its a hassle for repair/restoration of old equipment.

I took a look at the LM323 datasheets out of curiosity. As with the 7805, there are multiple designs that are very different. ST Microelectronics' LM323 has almost the same circuit as the LM109/7805, with a bandgap reference. Motorola's LM323 is similar to the LM340, with a Zener reference and a comparator. So you have two LM323 chips that use not just different circuits but fundamentally different physics to regulate the voltage!

As for how the LM323 supports 3 amps, the datasheet attributes it to "new circuit design and processing techniques". I'm tempted to open one up and see what's different from the 7805 (I'm guessing a bigger output transistor), but I've already got too many chips I want to look at.

Price. You can find lots of cheapo regulators for pennies each: http://www.aliexpress.com/7805-voltage-regulator_reviews.htm... However you usually get what you pay for so it's worth getting a genuine part.

I tend to think of buying electronic components off of eBay as a form of low stakes gambling. If it shows up and works, you just got a killer deal. If it didn't, well, it was only $2.

This Amazon supplier sell cheap Chinese trinkets, he probably has his own ebay store too and is based in Taiwan/Shenzhen.

Habit? That said, many (most?) Amazon marketplace sellers are eBay sellers as well. I don't really think Amazon is "safer".

This is a beautiful post, and I am reluctant to try and say anything profound. Still, all of HN's a stage so I'll attempt a brief explanation for the general reader about why we need voltage regulators.

A logic chip like a microprocessor is designed for a particular supply voltage, if this voltage drops too much the logic circuitry will switch falsely. Say we had only a capacitor and we tried to power the logic chip with it. As the chip draws current the capacitor discharges - this is because current is movement of charge, so the charge (and energy) can come only by draining the capacitor. For an ideal capacitor the voltage is directly proportional to the charge across it, so as the charge drains the voltage falls. To hold the voltage constant we need to keep 'topping up' the capacitor with charge. This is what a voltage regulator does - it uses a negative feedback loop to sense the capacitor voltage and when that voltage falls the circuit provides just the right amount of charge 'juice' for the top-up.

As we take the foot off the clutch pedal in a car, the load gets engaged to the engine and if we sense a stall we press the gas pedal a bit. That's the imagery of a voltage regulator in action.

The capacitor plays a key role because the regulator feedback loop isn't very fast - one trouble with fast feedback circuits is chatter, or responding to every blip. Negative feedback circuits are designed to be more like ship wheels - they like to steer sedately and not respond to every excited cry from the mast. But what happens if a current blip arises because a logic circuit block turns on all at once (in response to some block of code)? That local current blip is provided by the capacitor, it acts like an ATM to provide local draws - but it still depends on the regulator to top it up.

In fact you can think of a battery as a capacitor that tops itself up via electrochemistry, it works as long as there are ions in the electrolyte. If instead of 'bandgap energy' we used the chemist's terminology of 'electrochemical potential difference', then the system similarity becomes evident.

Prior to reading this the only thing I knew with certainty about a 7805 was never to use it to pick up your PCB. They get a little toasty when shorted, and I've burned myself on them more often than on my soldering iron.

Ha. Right, as the article says with linear regulators unlike switching regulators all the extra energy ~(Vin-Vout)*I goes out as heat... They're so easy to use though. It's interesting someone would counterfeit them, so cheap and probably not as popular as they used to be back in the day...

They are so popular that almost every linear-IC manufacturer manufactures something that is drop-in replacement for 7805 (and usually calls that 7805, although sometimes other part names are used, i.e. that "2805" on the die shot in article. I vaguely remember that NEC uPD2805 is 5V linear regulator with same pinout as 7805).

Between different manufacturers there is easily an 10x difference in price of 7805, so counterfeiting is certainly worthwhile, even more so when 7805 is more of a description of function than of implementation. 7805 means three-pin linear regulator with dropout <= 2V, such and such accuracy, line/load regulation and noise and typical design uses these parameters, not actual parameters guaranteed by given name-brand manufacturer (which are sometimes significantly better than for original LM7805), so mostly no-one will notice if you take random Chinese 7805 and repackage it into name-brand package.

It's probably <<10 cents in quantity though and most mass produced electronics would use something smaller or more efficient (well, it has to be more efficient if you want to go smaller) if they even use a linear regulator at all. What would the total world wide market for 7805 be today? A few million parts a year? As a counterfeiter you'd have a few % of that market? Maybe worthwhile as part of a larger counterfeiting operation if you have the flexibility to make a lot of different chips in a lot of different packages but investing a lot of engineering effort in this specific single chip is almost certainly not worthwhile.

Why silkscreen your own brand when could silkscreen ST or National? I could move a whole lot more Nike than I could Mercury.

I'd really like to know if you have info on a "2805" regulator. I couldn't find anything about a NEC uPD2805. All I could find is a NJM2805 regulator, but it's a totally different 5-pin regulator.

I will try to look into it more, but I too haven't been able to find anything conclusive.

What I know, is that about 5 years ago I have found part marked NEC uPD2805 (or maybe 2905) in power supply for Canon fax machine and somehow found out that it is 7805-esque voltage regulator and used it in my bench power supply as such.

We use them in every circuit we build with our students. Most of our circuits use PIC chips and students have a habit of trying to chuck 12V through the things from their power supplies. Cheaper to add 7805s than constantly replace burned out chips.

It's an interesting notion to "counterfeit" a chip... I mean, the supposed counterfeit still has to perform the same duties as the "legit" chip does... maybe of less quality, stability or longevity... but nonetheless, it does the same job. It's like saying Hyundai is counterfeit cars because their quality is less than Honda or something.

Not at all. There are plenty of counterfeits that are not functional - some don't even have a die in them.

Also, these parts have a brand logo on them, but are not made by that manufacturer. If Hyundai sold cars with the word Honda and a Honda logo on them, without permission from Honda, they would indeed be counterfeits.

Counterfeit items may also have higher quality than the thing they are pretending to be. Pretending something it is not w/o permission.

counterfeits may not have the same tolerance specs, may not perform any special features (i.e. the shutdown control in over voltage conditions), may have spying functions (counterfeit cpu for example).

Linear regulators are also ideal for low noise applications.

Although not so much the 78xx parts. They're among the noisiest, by a couple of orders of magnitude.

But still, one of the most common applications for 78xx regulators outside of hobbyist and one-off applications is local regulation for some analog-ish noise sensitive-ish circuitry.

Yeah, still, if they're too hot to touch I believe it's being misused in the circuit (either missing a heat sink, or too much voltage drop across, or the circuit needs something more powerful)

But of course, this happens a lot in experimental circuits.

Not necessarily. The LM7805 has a maximum operating temperature of 125C, so a circuit can be operating nominally at a very high temperature.

Actually thats the junction temp so unless you have an infinitely thermally efficient package and heatsink, if you're boiling water the innards are way out of spec.

Also check out the temperature derating curves.

That series has a thermal shutdown ckt so "operating nominally" above boiling pt is kind of hard to define.

There are also non-regulator thermal issues, like most cases are not designed to operate continually at 125C internal temps, and the electrolytic caps nearby the reg have their lifetimes drop with some polynomial of temp above room temp so smoking hot reg isn't good for everything nearby even if isolated by itself it would be OK.

Finally the general idea is still true, that you can get a nice 2nd degree burn or think something is "really hot" at a temp well below rated.

There are plenty of high power transistors rated to 150C junction temp. Not impossible with a really good package and heatsink (low thermal resistance) and good assembly technique to be able to boil water on one of those. As a stunt in the lab everyone tries this sooner or later to see if their anti-thermal runaway ckt is good enough and their assembly technique is good enough.

"(either missing a heat sink, or too much voltage drop across, or the circuit needs something more powerful)"

Starting in the 80s Low Drop Out LDO regs started hitting the market, using mosfets as the pass transistor instead of bipolar trans (and a few other changes) means you can run with much lower voltage drops.

However, legendarily, the bipolar voltage drop automagically provided some oscillation dampening and the LDO regs are notorious for being unstable, almost as much of a PITA as using a switching reg, almost. So sometimes with reactive (usually inductive) load at certain currents and voltages, they turn into little RF oscillators. Sometimes the oscillation is too high of a freq to interest the overheating and other self protection ckts so they literally catch fire and so on.

These 80s stereotypes of LDO regs have been continually improved since the 80s so they're somewhat more stable now.

Part of the shocker of both the bad 7805s in the story and the oscillating 80s era LDOs is the 7805 series used to be legendarily bulletproof because they have a lot of self protection circuitry built in. Blowing one up is non-trivial compared to most other chips. Usually decent reverse current protection, some reverse polarity protection, overheating protection, short ckt protection, they're pretty touch chips, so its surprising when they aren't.

Ah very interesting story, I didn't know about those LDO problems.

I guess BJTs at that power level are slow, as opposed to mosfets, which are much faster, so there's that as well.

Very interesting. I really liked the interactive chip guide.

Thanks. The interactive guide turned out to be a bigger project than I planned, but I hope to reuse it for the 741 op amp. To generate the data for the guide, I ended up drawing boxes around all the components in Open Office, and then parsing the XML to extract the regions for each component and generate the JavaScript data.

The non-rectangular resistors were inconvenient to represent. Also, the 7805 has a lot of overlapping transistors (e.g. sharing the collector), which messed up my original system that assumed everything inside a box belonged to the box, so I ended up tagging each component with a different color. Maybe this is more than you wanted to know about the system :-)

You could use Inkscape for that -- it generates an SVG file that can be manipulated with javascript by adding a <script> tag. For an example, see: http://hausen.github.io/control.svg and http://hausen.github.io/control.js . No need to postprocess anything!

Very much appreciated. Was definitely my favorite part of an already excellent article. Please more.

Ken, If you're gonna write stuff like this, I'm gonna continue to offer to fund your eBay spelunking expeditions.

I know almost nothing about electronics - why don't the thin wires going to the die melt like a fuse, are they just made out of the right material?

Because the heat is not on them. They're built for the nominal current of the circuit, so if you go beyond that, they'll be toast, but again, your circuit will fry first

Fuses are a different alloy as well http://en.wikipedia.org/wiki/Fuse_%28electrical%29#Construct...

And partly maybe because resistance actually decreases in silicon as temperature increases.

Wow, people really went to town with that Fuse article! oO;

Until recently, almost all bond wires were made of gold. This is because low temperature ultrasonic welding can be done reliably between gold and aluminum, and because gold and aluminum are ductile enough that they act as a cushion during the welding process to prevent oxide cracking. (In CMOS, until the 0.18u node or so---1998ish---IC interconnect was aluminum; on more modern processes, interconnect is copper, but generally for wire bonded chips there is a plating layer added to the copper bond pads to enhance bonding reliability.)

Bond wire diameters are (for historical reasons) usually specified in mils. A common bond wire diameter is 1 mil, which, depending on length, can reliably handle a bit more than an ampere without fusing. (Shorter lengths and lower temperatures help this.) Note that this number is quite conservative, since this is the fusing current at 125 degrees Celcius, and there is a quasi-exponential dependence on temperature.

(Also note that multiple bond wires can be used in parallel to increase the fusing current; in one image from the linked article [1] it appears that there are two bond wires in parallel, but kens points out below that this is a force-sense arrangement and not a double bond.)

As a result, when running a chip at room temperature, very high currents will almost always blow up the circuit rather than the bond wire. In over ten years I've only once managed to melt bond wires without also causing the chip to crater, and that was on a power converter with gigantic transistors (like, "see them with the naked eye" big) that was designed to be quadruple bonded and was only double bonded in an engineering sample.

More recently, copper bonding has become increasingly common. This is driven by higher conductivity of copper (and thus lower bond wire resistance and higher fusing current) and substantially lower cost compared to gold. However, copper bonding requires special care. For example, the bond pad structure must be built to withstand much more bonding force without cracking.

For a technology as old as the one being used to build this 7805---a mid-80s bipolar or BiCMOS fab, 1 or 2 layers of aluminum interconnect---it would probably take substantial effort to redesign the bond system for copper bonds (and there may not be enough metal layers to provide cushioning, so it might just be impossible to reliably bond with copper). Beyond that, there are only four bond wires (see the aforementioned image), so the cost is minimal (and at most bonding houses, packages come with a number of "free" bonds built into the price of the package). In addition, redesigning the chip would involve substantial engineering effort (redesign the layout, redesign the package, redo all the reliability qualifications), the cost of which would probably not be recuperated via the price difference between copper and gold.

[1] https://plus.google.com/photos/+KenShirriff/albums/605050806...

EDIT: kens, good catch on the Kelvin connection. Now that I look at the die photo again, it's clear the left one is for sensing.

There's an interesting reason for the parallel bond wires to the output pin, and it's not to keep it from fusing. The problem is if you put 1A through a thin bond wire, there will be some voltage drop across the wire. So if the chip produces 5V at the die, it might be 4.9V at the 7805's pin, which is no good. So they run a second bond wire from the output pin to the regulator circuit. This sense wire has hardly any current through it, so it gives an accurate value of the output voltage. Thus, the 7805 can regulate the voltage on the output pin, rather than the voltage at the die pad.

TL;DR: one bond wire to the output carries the current and the second bond wire on the output senses the voltage.

They are usual ly planned to be more robust than what's on the IC.

I am compelled to echo the the first statements by quarterwave and kjs3. I was personally saved from a morning of mindlessness, and I will be soon opening up an IC or two to see for myself. You said I could do it. Thanks kens.

Well, the 7805 is sold by multiple vendors, so, it may be a counterfeit, or just a subcontracted part?

Very, very nice explanation of the 7805 though. This is the bread and butter of linear regulators.

Even if it was subcontracted it would have to match the diagram in ST's datasheet.

Not necessarily; the schematics of ICs in datasheets often can and do significantly differ from what's on the silicon, as to the user the important part is how the part performs in circuit, not its internal structure. (I suppose this is quite a non-leaky abstraction.)

ST's datasheet also has this standard disclaimer, so it's also perfectly acceptable for them to change it from a legal perspective:

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, modifications or improvements, to this document, and the products and services described herein at any time, without notice.

it continues to amaze me how such a little thing can generate so much heat while doing useful work and operating normally.

This is with all seriousness the most informative thing I read this week. Took me right back to my abortive flirtation with EE as an undergrad. If thing had been explained this clearly, I might have stuck with it.

This article exhibits the sort of passion that someone needs in order to become "really good" at something.

Maybe 90% or even 99% of designers would only be interested in taking a regulator, connecting input, output and ground, and perhaps some adding bypass caps, and stopping right there. Good enough to make it work in most situations.

But that final 1% are the really good engineers. They want to truly understand or grok what all the components of the circuit are doing. That's what lets them achieve so much more than the typical engineer.

From what I've seen (but I haven't really studied his designs in detail) Steve Wozniak was (is?) the epitome of a great design engineer. His designs were magical for their time. The article also mentions Bob Widlar, who was also truly one of the greats.

Well put. I think you're about 95% right about Woz. The difference is that looking something Widlar or Pease did, I go "holy shit, that's genius! I would never have thought of that!". Some of Woz stuff (I'm looking at you, Apple II disk controller) are just "that's demented. I wouldn't have wanted to think that up. Genius, but demented".

You can't thoroughly appreciate Woz's disk controller until you compare it to the abortion that was the C64's floppy disk system, nor his display circuitry until you compare it to the atrocity that was the IBM CGA adapter. That's when you realize that he wasn't a once-in-100 years fluke of engineering genetics, but the once-in-500 years kind.

The abysmal performance of the C64 floppy disk was due to a bug, but management went ahead and decided to ship it anyway. It was supposed to be 10x faster, thus the 3rd party ROM replacements.

The funny thing was, the same was true of Apple's DOS. With all the engineering talent including Woz's own, it never occurred to anyone there that they should have read the sectors in each track in descending rather than ascending order to save wasted disk rotations.

I'm with you, great article. I managed to finish my EE degree in 2002 from a top university, but it was a slog. I really wish articles like this were more prevalent back then.

Likewise - I graduated from a 50:50 EE:Computing degree in 1999, and the EE side was never more than diagrams and a great deal of maths.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact