Internet commentary
That old black magic [1]
Keywords: Internet, Electronics industry, Printed circuits
I have at last had a glance at Windows XP Service Pack 2. I cannot say that I like what I have seen. It can lull users into a false sense of security, while they are little more safe than beforehand. Why should this be? Well, let us start on a Microsoft feature called ActiveX; if you seek a definition of what this is, the Windows glossary tells us, “A set of technologies that allows software components to interact with one another in a networked environment,regardless of the language in which the components were created”. What does this mean? Let me narrowly rewrite this definition so that the potential danger it presents becomes more apparent. “A set of technologies that allows software components, such as viruses, Trojan Horses and other malware, to interact with others in an internet environment”. In other words, without ActiveX operating in the background, a PC would be less liable to have many forms of pests installed.
So, how can we avoid using ActiveX in our everyday activities? The biggest danger is with Microsoft Internet Explorer, which relies heavily on it for some of its features. Other browsers, such as Firefox, Netscape and Opera do not use ActiveX, so switching away from IE to one of the others (I recommend the free Firefox) is already a very positive action in favour of security. Nevertheless,in a corporate environment, sometimes one is forced to use IE. In this case,there is a way of disabling ActiveX. Open IE and go to Tools|internet options|security|custom level; you can choose a radio button labelled Disable under “Run ActiveX controls and plug-ins”. There is a downside to this: you may find some web sites displaying incorrectly, if they were written in such a way as to use non-standard features, but it also means that the authors of these sites can not force an install of any kind of malware. It is possible to overcome this difficulty if you add the URLs of sites you are 100 per cent sure of as being free of pests to IE's Trusted Site list and not requiring server verification to these sites.
You may argue that SP2 corrected all the ActiveX security issues. That is true, but only the security issues that were known to Microsoft some months before SP2 was issued. Since then, many others have been sought out by those whose joy it is to cause as much pain as possible to internet users.
Let me cite another weakness that SP2 has not corrected. There is a firewall system incorporated in XP. What is a software firewall? Basically, it is a system that is supposed to block unauthorised access to and from the internet. The TCP/IP system is a protocol that allows networking, including to the internet, by using ports, of which there are literally thousands. The firewall blocks access to ports that are not in use, so preventing third parties from cracking into your machine. For example, port 110 is, by default, the one that is used when you receive an e-mail, while port 25 is used to send one. Each application you have that uses the internet is allocated a port which has to be opened. Most of the commonly used ports are open, whether you use them or not. Now, no security system can ever be perfect and, if you opened a doubtful web site or opened an equally doubtful e-mail attachment, which installed a spyware system on your computer, using ActiveX, then you may be vulnerable. That spyware may use an open port to transmit your keystrokes to a third party. The XP firewall system, like hardware firewalls, does not block any ports to outgoing data so relying on it may lead you to all sorts of hazards, such as crooks finding out your passwords, credit card details and so on. The only way to minimise this risk is to install a firewall that blocks data in both directions. I use ZoneAlarm Pro (there is a free minimal version at www.zonelabs.com), which is regularly upgraded as new cracking methods become apparent. There are also a number of others, such as the Norton Personal Firewall or the Sygate Personal Firewall. However, it is essential to disable the Windows XP firewall before installing a third party one.
Spyware, adware, malware, viruses, Trojan horses, you name it, they are all there waiting for the unwary. I was recently asked to look at a friend's computer, which was badly functioning. The man is not the most computer-literate, although he likes to think he is. My first question was whether he had an anti-virus utility. He replied that he had the free AVG from Grisoft. I asked him whether it was up-to-date. He shrugged his shoulders. Sure enough, it was over 4 months since he had an update. I updated it and did a scan. As luck would have it, his machine was clean of viruses, so I then enquired whether he had an anti-malware utility. He replied that, yes, someone had recommended HijackThis so he installed it but could not understand how to use it. Not knowing the application, I had a quick look at it and did not understand it either! However, it was apparent that it detected a few thousand suspicious items, with long screeds of how to eliminate them. I thought a simpler utility would be more suitable so I installed the free Ad-Aware (I use PestPatrol, but this is not a freebie for removing the pests). I was rather surprised to find it detected only about half the number that HijackThis did, as I thought that it was reasonably good. I, therefore, installed the free PestPatrol, which detects but cannot eliminate. It detected about 95 per cent of those that HijackThis did. The latter gave an impressive detection performance,but I cannot really recommend it, unless you are a professor of information technology. Anyway, it became apparent that, as many of the bugs could not be removed automatically, it was going to be a very lengthy job cleaning up his machine, so we opted for backing up his essential data, reformatting all his drives, reinstalling all his applications and restoring his data. Having done this, the computer worked like a charm. He then went out and bought the Norton Internet Security suite, which comprised firewall, anti-virus, anti-spyware and anti-spam. Hopefully, he will be able to sleep on both ears, now.
I recently came across a superb programme for backing up data. It is called Filestream TurboBackup and a free trial can be downloaded. It has the advantage that it is easy to back up and restore anything you want, including the “System State” of the computer. Better than that, you can put the back-up on any hard disc you like on your network. Even better still, you can send it to a CD-R/RW drive, but you may argue that your system is more than a CD will hold. No matter, you still have two choices, a compressed back-up may be spanned over as many CD-Rs as it takes, or even over multiple DVD±Rs (I am now able to back up to double-layer DVD+Rs that hold about 8.5 Gb each, the equivalent of 13 1/2 CDs!). This does not sound very relevant to an article about the internet, but it is! I participate in a number of technical net lists, such as some of the IPC ones, and I like to archive potentially useful information. I have over a gigabyte of such archives. Previously, I backed up these files to a hard disc on another computer, which was not really convenient: I can now back them up, compressed, to a single CD-RW and add incremental updates. This is an excellent alternative, at www.filestream.com/turbobackup
Finally for my prologue, I should like to go completely off-topic, at least from the point of view of the subject matter of this journal. As you probably know, I live in the Republic of Cyprus. The Press and Information Office of the government of this island has recently inaugurated a good web site entitled the Aspects of Cyprus at www.aspectsofcyprus.com/and, from here, you can download and view a large number of Macromedia Flash files with text and over 300 stills and 4 videos, lasting about 90 min, on nearly a score of different subjects related to my adopted home. The site is superb, although the quality of the video does not do justice to the subject,but the necessary Flash compression to fit it into an internet-compatible format is a necessary compromise. If you are unable to download it, for any reas communications@pio.moi.gov.cy,they will send a copy to you on a CD, free of charge.
Some time ago, I reviewed sites with various mentions of OSP. Some will argue that HASL will die a natural death because of the combination of non-planarity with ever-smaller components and the introduction of lead-free techniques and their higher operating temperatures. This may be the case, I cannot judge; it is obviously market-driven. One option that is widely used is known as ENIG, an acronym for electroless nickel, immersion gold (please note that I use the word acronym correctly, unlike those who consider that PCB is an acronym,whereas it is an abbreviation!). I will not go into the technicalities of how it works, but let us have a look at a few web sites which mention it.
These two sites are the archives of the two most popular net lists run by the IPC. Do a search for ENIG on them and you will obtain respectively over 1,100 and 100 responses which contain probably as much information and practical advice on the subject as you will find anywhere on the internet, including the inevitable problems that may arise.
This page extols the virtues of using ENIG for via hole protection and either an OSP or immersion tin for the solderable surfaces. The manufacturer claims there is no cost increase with this double processing, but one can wonder, don't you think? I am not really in a position to say whether this is a marketing gimmick or a real advantageous technique, but a few lab tests should be able to validate the company's claims.
This company is offering a range of chemicals for an ENIG line. Unfortunately, they do not think it wise to give any more information than the trade name for their various brews and their basic functions. There are no details available on line, that I can find and, above all, no trace of an MSDS on the horizon. I am not saying that the products are not good but I would like to see some real technical data about them.
One of the problems of ENIG is “black pad” and is probably due to high levels of phosphorus in the underlying nickel. This can result in a less-than-ideal solderability with a corresponding loss of reliability. This is an interesting magazine article which discusses the role that the gold plays in preventing the problem and compares two gold bath compositions, whereby one gives a better corrosion-resistance than the other.
In case you are wondering, the “PF” in the URL stands for product finishing. This is another useful magazine article on the finishes for PCB, with quite a large part of it devoted to ENIG. The authors are, however, affiliated to a supplier of the chemicals, which gives them the strength of (probably!)knowing their subject and the weakness of a vested interest.
Kester is, of course, known for their soldering chemicals and products,rather than for being experts in surface finishes. However, as ENIG finishes do have to be soldered, they have every right to comment and this page describes the more popular finishes for PCBs and the potential problems that may be encountered. It is stated, “The gold (about 0.1 μ thick) dissolves instantly in the melted solder, and soldering is done to the underlying nickel. The amount of phosphorous [sic!] deposited with the nickel determines whether the soldering is going to be reliable or not”. In my opinion, this is a half truth. Yes, excess phosphorus will cause the “black pads”problem, which is a real no-no for soldering but it is not the only one. For example, the very thin gold layer (often much less than the 0.1 μm cited) is more or less porous and the underlying nickel can oxidise in time. Most fluxes,except halide activated water-soluble varieties, are simply not powerful enough to reduce the nickel oxide layer. The human problem is that many jump to the conclusion that the poor solderability is because of the phosphorus-related black pad phenomenon, when it may be just a simple oxidation.
Don't be afraid, this paper is in English, despite the German URL! It is a quite lengthy but detailed enquiry into the causes of the Black Death, oops!sorry, black pad problem. The author did a systematic series of tests to identify the phenomenon, then to tweak his baths to turn it on or off, at will,so as to make it reproducible in the laboratory. Subsequent analysis determined the causes but, unfortunately, he does not say what they are. Instead, he offers a process which he claims does not produce it.
I am at a loss here. The EMPF is a respected organisation and investigation of what is stated to be a “black pad” failure mechanism revealed a 7.2 per cent phosphorus co-deposit with the nickel. This is rather high, by any norm. Yet the EMPF have concluded that the problem was the solder “delaminating”from the nickel, while discounting the phosphorus as being causative. Puzzling!
This is a phenomenal analysis of ENIG failures, albeit several years old,conducted by a team from Hewlett- Packard in Palo Alto. Well illustrated and scientifically conducted, this 64 page study raises as many questions as it answers, especially when it raises issues such as the influence of the solder alloy on the failure of solder joints on ENIG- plated pads. For example, it is stated that lead-rich BGA balls solder more reliably than tin-rich solder joints and that indium-based alloys are better. The hypothesis is that the problem may be initially due to Ni3Sn4 intermetallic compounds but that aging may cause gold embrittlement. I wonder whether the very tin-rich lead-free alloys acerbate the problem, explaining the recent resurgence of so-called “black pad” problems.
Unlike Kester's contribution, this one from one of their main competitors, is a “reprint” of a magazine article, but going into much more technical detail. It explains the effects of too little and too much phosphorus in the nickel and the subsequent effect of the immersion gold. The implication is that the optimum phosphorus content is quite critical, at a somewhat higher level than some other authorities claim. The upshot is that the term “black pad” may be used indiscriminately to describe two, possibly three,different phenomena with different causes. However, I have a gut feeling that the optimum phosphorus level may vary from one maker's electroless nickel composition to another's, possibly as a function of temperature, pH or chelate content. (At least, phosphorus is correctly spelt in this paper! Having seen it spelt so many times in American sources as -ous, I was beginning to wonder whether our transatlantic friends had a “standard misspelling”, like aluminum. This constrained me to bring out my Merriam-Webster and how relieved I was to find that even Noah Webster did not attempt to distort this spelling!)
This is an ANSI site, advertising a standard for ENIG finishes, co- authored with the IPC. The abstract states, “This specification sts [sic!]the requirements for the use of Electroless Nickel/Immersion Gold (ENIG) [sic!]as a surface finish for printed circuit boards. This specification is intended to set requirements for ENIG deposit thicknesses based on performance criteria. It is intended for use by supplier, printed circuit manufacturer, electronics manufacturing Services (EMS) and original equipment manufacturers (OEM)”.
It is not unusual for references to this journal to show up in my searches. This is a reference to a paper, “Development of an electroless nickel immersion gold process for PCB final finishes”, which was published in March of last year. If your library archives past issues, you should have no difficulty in finding it. Otherwise, the abstract is here, along with the method of obtaining a copy. I have had a glance at the paper in my own archives. Interestingly, it cites the wait time between the EN bath and the first rinse as being significant. However, dare I say that Circuit World's proof-reader passed the adjective “phosphorous” as a noun? Just goes to show what happens when relying too heavily on spell-checkers! Shame on you, CW!
With that rebuke to our own publisher, I will conclude that there is much contradiction in the field of ENIG finishes and its problems. The second of my cited websites in this list is the only PCB manufacturer offering ENIG that I mentioned. I was not intending to include any, because most manufacturers offer it, but my own intention went by the board because of its unique process that avoids soldering problems by using ENIG only for vias. What is evident is that the dreaded black pad is not a simple problem and could become worse as more companies adopt lead-free soldering. Having read over 40 web pages and articles on the subject, I do not feel, as an ex-PCB fabricator, confident that the vast amount of information I have absorbed over the last few days would necessarily help me overcome any difficulties that arose, although I would have some very strong pointers where to look; there is no black magic, old or new, for black pads! If any readers are having an ENIG problem, I hope this paper will help them resolve it.
Note1 Title of a song by Johnny Mercer (1942)
Brian EllisCyprus
