Tuesday, July 3, 2012

Photobit PB-0100-5 teardown

Earlier today I was cleaning out a drawer in my lab and found a broken USB webcam. Before throwing it out I decided to desolder the sensor chip and have a look.

For those of you who aren't familiar with it, my friend John and I are the driving forces between the Silicon Pr0n project - a wiki dedicated to amassing knowledge about all things related to semiconductor RE. I haven't been doing as much work on it recently due to academic obligations but figured it was about time to post some more die photos!

Wiki page: http://siliconpr0n.org/archive/doku.php?id=azonenberg:photobit:pb0100

Map: http://siliconpr0n.org/map/photobit/pb-0100-5/neo5x/ 

Package shots after removing from the board:

Top view of sensor
Bottom view
The package is a ceramic LGA using gold ball bonding. I have so far made no attempt to remove the die from the package or delayer; all images were taken through the window on the front of the package.

Without even resorting to the microscope some structure is obvious:
  • The red and green area at the upper left of the die is the pixel array.
  • The remainder of the die is covered with a transparent blue material (which upon closer inspection looks exactly like the blue color filter in the pixels) to prevent photocurrents from messing up the control logic
  • The area below the sensor has a lot of fine detail and is irregular. It's probably an array of standard logic cells controlling the sensor readout.
  • The area to the right of the sensor looks very regular and is probably addressing logic, buffers, and the ADCs.
  • Several of the pins along the top and left edge have three bond wires instead of one. They're probably power/ground.
  • Not all bond pads are broken out to pins.
I made an imaging pass over the entire die with a 5x objective. Since I haven't had time to do a CNC mod on my microscope stage like John has, I have to move the stage and snap photos by hand. This makes high-magnification full-die imaging very time consuming so if I need that I'll usually send the chip to him for processing.

Without further ado here's the full-die image. Note that this is rotated 90 degrees clockwise from the package overview image so that the vendor logo is right side up.

Full-die image
Closer inspection reveals that the standard cell area at left has large spaces between rows of logic for interconnect, suggesting that this is a 2-metal design. As typical for 1999-era technology the metal layers are not planarized. Sub-pixels look to be about 5 μm across.

Random portion of the subpixel array
The bottom right of the die has the Photobit logo and copyright notice:

Vendor logo and copyright. Note probe scrub mark from wafer test on the upper right pad.
Right above the logo there were a bunch of ID markings from the individual masks. It's immediately obvious that several masks are not visible as there are gaps in the array. These are probably the implants.

Several metal layers are visible, along with at least one polysilicon and several whose purpose is not immediately obvious.

Mask ID markings
The most interesting feature observed was at the bottom left of the die - a little doodle of a panda bear snuck in by the layout engineer.

Mask art!


  1. Haha, I'm 99% sure that the panda is Sexual Harrassment Panda from South Park: http://static.tvfanatic.com/images/gallery/sexual-harassment-panda-picture.gif

    Love the nerd porn though, keep it up!

    1. Lol. Someone said "At least it's not Pedobear" when I showed him the pic. Guess its Pedobear's cousin instead...

    2. Aired 1999 (http://en.wikipedia.org/wiki/Sexual_Harassment_Panda) so likely