L-1 Identity Solutions PIER™ 2.3 Iris Scanner Teardown

updated by 13 min read #biometrics #teardown #hardware #reverse engineering

Contents

This is part 1 of three posts about the PIER™ 2.3: the hardware. Part 2 covers the software on its CompactFlash card, part 3 runs that software in an emulator and shows how an iris scan works.

Introduction#

The PIER™ (Portable Iris Enrollment and Recognition) is a rugged handheld device that enrols and identifies people by the patterns and texture of the iris. It was made by SecuriMetrics, Inc. of Martinez, California, which became part of L-1 Identity Solutions in 2006. SecuriMetrics claimed that the PIER 2.3 could store “up to 200,000 individuals (both left and right eye)” and, “tethered to a PC”, could match a person against a database of millions. Oddly, L-1’s later sheet for the PIER 2.4, which has twice the memory, gives the same figure as 200,000 templates, or 100,000 individuals.

The PIER line goes back further than the 2.3. According to SecuriMetrics, an advanced prototype of the PIER 2.2 was deployed with U.S. Special Operations Forces in Iraq in 2003. By February 2005 “thousands” of PIER 2.3 units were in use in Iraq, Afghanistan and other areas of conflict. In December 2005 the company delivered another 1,025 PIER 2.3 units to the U.S. Department of Defense, bringing the total to more than 1,800. L-1’s PIER 2.4 sheet from February 2008 speaks of “over 4,000 devices integrated or deployed” by the Army, Navy, Marines, other DoD and non-DoD agencies, and U.S. law enforcement and corrections.

In the field, the PIER was the iris camera of the Army’s Biometric Automated Toolset (BAT), a rugged laptop with an iris scanner, a fingerprint scanner and a camera. According to SecuriMetrics, BAT was used to register detainees, enemy prisoners of war and civilian internees, and the data was shared with intelligence, law enforcement and border-control databases. One of these was the DoD’s central Automated Biometric Identification System (ABIS). The photos below show the device in use in Iraq.

A US Navy sailor scans the iris of a fisherman with a PIER while a boy watches, on a riverbank in Iraq
Biometric scan of a fisherman on the Watah Peninsula near Rawah, Iraq, July 2008 (U.S. Marine Corps photo by Cpl. Seth Maggard, 080711-M-1391M-016, public domain)
A US Marine holds a PIER to the eye of an Iraqi civilian
Iris scan for the Biometric Analysis Tracking System in Fallujah, Iraq, January 2005 (USMC photo by SSgt Jonathan C. Knauth, public domain)
A US Marine sergeant holds a PIER iris scanner to the eye of a member of the Baghdaddi city council
A Marine sergeant identifies a member of the Baghdaddi city council before a meeting with local leaders, Iraq, 10 January 2007 (USMC photo by GySgt Michael Q. Retana, 070110-M-8213R-024, public domain)
Front of the PIER 2.3 with display and keypad
SecuriMetrics PIER 2.3
The PIER 2.3 iris scanner, front view
SecuriMetrics PIER 2.3, angled view

My device came without any accessories and was in battle-worn condition. After a long charge it switched on, and it turned out to work flawlessly.

How does it work?#

L-1 describes the device as having “state-of-the-art lenses, a high-resolution video sensor, dual band illumination, and a bright LCD screen”. The iris image is converted into a binary template by what L-1 calls the “L-1 Daugman 2Pi algorithm”, named after John Daugman [cam.ac.uk], whose iris recognition patent (US 5,291,560) was issued in 1994. A newly captured iris is then matched against the templates stored on the device. How that works step by step is the subject of part 3.

Specifications#

I compared the vendor specifications with the actual hardware.

ItemVendor specification (PIER 2.3)Found in my device
Dimensions, weight153 × 89 × 46 mm, 468 g–
CPU“133 MHz, x86”AMD Élan™ SC520-133AC (Am5x86 core, 133 MHz, 388-pin PBGA, commercial temperature grade)
Display240 × 320 LCD touch screenEpson S1D13706 LCD controller, Sharp LZ9FC22 TFT timing controller, TI TSC2003 touch controller
RAM128 MB (256 MB optional)2 × Samsung K4S511632B-TC75, 512 Mbit (32M × 16) SDRAM each = 128 MB
Storage256 MB flash (512 MB optional)SanDisk 256 MB CompactFlash, “Standard Grade”
Battery4000 mAh, 3 h use, 8 h standbyEAC Li-ion pack, 3.7 V 4.4 Ah (P/N 510001-089)
ConnectivityEthernet 10/100, serial (802.11b optional)Realtek RTL8139CL, Tyco MagJack RJ45, second modular jack for serial
Image sensor1/3" CMOS, 640 × 480, 8-bit greyscale, ~15 fpsOmniVision OV7120 (B/W), 16 mm lens (per the device’s MACHINE.INI)
Focal distance4"–6"–
Illuminators“IR & Near IR Illuminators (Safety tested)”Configuration names two LED bands, 780 and 860 (nm)
AccessoriesPower supply and cord, ballistic nylon casenot included with mine

Sources: the archived PIER™ 2.3 specification pages of L-1 [archive.org] and SecuriMetrics [archive.org], and the PIER™ 2.4 product sheet [pdf].

Teardown#

Many thanks to a good friend who took the photos in a really professional setting.

The device comes apart easily and non-destructively. Only the screen and the keypad are glued into the housing, presumably to keep out dust and water. I needed three tools: a Phillips screwdriver, a hex nut driver and a pair of tweezers. Four screws on the back hold the two housing shells together.

Rear view of the PIER with the four housing screws
Rear view

There are three connectors on the bottom:

  • a DC barrel jack for the power supply,
  • an RJ45 jack for 10/100 Ethernet,
  • a second modular jack for the serial port.
PIER with the back cover removed
Back cover removed

After carefully pulling the two shells apart, you can see the inside of the back shell. Two IR-transparent plastic windows are glued into it, one for the LED illumination and one for the camera.

The three circuit boards of the PIER stacked together after removal from the housing
Assembled boards removed from the housing

The device contains three circuit boards. Their part numbers are printed on the PCBs and also appear in the configuration file MACHINE.INI on the CF card: camera board PN20151RB, processor board PN20152RB and power board PN20153RB.

Power board#

The power board carries two Linear Technology LT1764A-3.3 [analog.com] low-dropout regulators (3 A, fixed 3.3 V). It also has a TI bq2057C [ti.com] linear charge controller for the single-cell lithium-ion battery. The bq2057C charges to 4.2 V; the 3.7 V on the pack label is the nominal cell voltage. A Maxim MAX1039 (12-channel, 8-bit ADC with I²C) measures voltages. The firmware has a “Cal AD” calibration for an “a/d on power board” and stores a 5 V calibration value in MACHINE.INI. The board connects to the processor board through a pin header and is held by three screws on brass hex spacers.

Power board with two LT1764A regulators and a bq2057C charger IC
Power board with the battery unplugged

The battery connector is on the back. There is also a large unpopulated footprint for a fine-pitch connector. That is probably a leftover from development or a provision for another variant, but I cannot say what it was meant for.

The battery pack is labelled “EAC Li-ion battery 3.7 V 4.4 AH 510001-089”. Its stick shape and 3.7 V / 4.4 Ah rating fit two cells of about 2.2 Ah in parallel, but I did not open it. The vendor’s PIER 2.3 page specifies 4000 mAh, while the later PIER 2.4 sheet says 4400 mAh, which matches my pack. The battery maker’s own page from 2007 is archived here: EAC.com: Battery Sizes [archive.org]

White EAC lithium-ion battery stick labelled 3.7V 4.4AH
EAC Li-ion battery pack, 3.7 V 4.4 Ah
Back of the power board with battery connector, DC jack and an unpopulated connector footprint
Power board, rear view

Processor board#

To separate the processor board from the camera board, three flat flex cables have to be unplugged from the top of the board. The two brass hex spacers in the middle of the board can stay in place; they are only nutted to the back for stiffness.

Front of the processor board with AMD Élan SC520, Xilinx FPGA, Epson and Sharp display chips
Processor board (PN20152RB)

The main processor is an AMD Élan™ SC520 microcontroller. It combines a 32-bit low-voltage Am5x86 CPU (2.5 V core) with a floating-point unit, a 16 KB write-back cache and PC/AT-compatible peripherals, including two 16550 UARTs and a real-time clock. It has a 33 MHz 32-bit PCI host bridge and an SDRAM controller for up to 256 MB in four banks. It has no on-chip ROM; it boots from external ROM or flash through its own ROM/flash controller. AMD sold three versions: ÉlanSC520-133AC (133 MHz, commercial), -100AC (100 MHz, commercial) and -100AI (100 MHz, industrial temperature range). The PIER uses the fast commercial part, specified for a case temperature of 0–85 °C. Interestingly, the firmware can switch the CPU between 100 and 133 MHz at run time; there is a menu item that prints “CPU speed now 100MHz”.

Datasheets and references:

Close-up of the AMD Élan SC520-133AC in a BGA package
AMD Élan™ SC520-133AC

Next to the CPU is a Xilinx Spartan™-II XC2S100 FPGA in a 144-pin TQFP package (marking “XC2S100 TQ144AMS0309”, speed grade -5, commercial). According to the datasheet, the XC2S100 has 2,700 logic cells (100,000 “system gates”), 40 Kbit of block RAM and 92 user I/Os in this package, and supports system speeds of up to 200 MHz. The core runs at 2.5 V, and LVTTL, LVCMOS2 and PCI inputs are 5 V tolerant. Xilinx Spartan-II architecture [archive.org], Xilinx Spartan-II DS001 (Datasheet) [pdf].

What does the FPGA do? Its configuration bitstream on the CF card (ISB8VERY.BIT) is a design called pci_top_routed.ncd, built on 21 November 2003, so the FPGA sits on the SC520’s PCI bus. It is the camera interface: a frame grabber that takes the sensor’s pixel stream and writes each frame into SDRAM as a PCI bus master. It does no image processing; finding pupil and iris, measuring focus, encoding and matching all run as x86 code on the SC520. Running the firmware in an emulator shows this directly; see part 3.

Close-up of the Xilinx Spartan XC2S100 FPGA in a TQFP-144 package
Xilinx Spartan-II XC2S100 FPGA

Since the board is essentially a PC, it has a BIOS: a PLCC-32 flash chip in a socket with a General Software sticker. The BIOS version in MACHINE.INI is Gsw112103, and the application can reflash the chip itself (part 2). I have not dumped the chip yet.

Socketed PLCC BIOS chip with General Software label next to the Epson LCD controller and Sharp timing controller
BIOS flash (General Software), Epson S1D13706 and Sharp LZ9FC22

The back of the processor board carries a Realtek RTL8139CL [pdf] 10/100 Ethernet controller on the PCI bus, which supports ACPI/PCI power management and Wake-on-LAN. It also carries two Samsung K4S511632B-TC75 [pdf] SDRAM chips. Each chip is a 512 Mbit (32M × 16, “B-die”) part in a 54-pin TSOP-II package rated for 133 MHz at CAS latency 3. Two x16 chips form the SC520’s 32-bit memory bus and add up to 128 MB. Next to them are two empty footprints for two more chips. That would give the 256 MB of the PIER 2.4, the SC520’s maximum, but I have not seen a 2.4 board to confirm it.

Back of the processor board with two Samsung SDRAM chips, two empty SDRAM footprints and the Realtek Ethernet chip
Processor board, rear view

At the top of the front side sits a Sharp LZ9FC22 [pdf]. Sharp’s specification describes it as a “Timing Control IC for TFT-LCD module” for QVGA panels, implemented as a gate array in a 72-pin QFP and rated from −30 to +85 °C. Under the display’s flex cable is an Epson SED1376F0A. That is the pre-2001 part number of the Epson S1D13706 [epson.com], an LCD controller with an embedded 80 KB SRAM display buffer. The firmware’s memory test for this chip writes exactly 81,920 bytes and prints “found S1D13706”. So the Epson chip is the graphics controller that holds the frame buffer, and the Sharp chip generates the panel timing signals. The firmware also still contains drivers for an Optrex display and probes for the smaller S1D13705, which suggests that an earlier design used a different screen. The touch panel is read by a TI TSC2003 [ti.com], a 4-wire resistive touch-screen controller with an I²C interface.

Camera board#

Camera board with the lens mount over the OmniVision OV7120 sensor
OmniVision OV7120 CMOS image sensor under the lens

The lens is screwed onto the camera board with two screws; according to MACHINE.INI it is a 16 mm lens. The sensor is an OmniVision OV7120 [pdf], the black-and-white version of the colour OV7620. It is a 1/3" CMOS sensor with 640 × 480 pixels and programmable 8-bit and 16-bit digital output. Its frame rate reaches 60 fps in QVGA mode, but the PIER’s specification says about 15 fps. The sensor is configured through OmniVision’s Serial Camera Control Bus (SCCB), a two- or three-wire bus similar to I²C, for gain, exposure, brightness and so on. The register settings are in the file CMSETUP.I2C on the CF card; they are written to the sensor’s SCCB address 0x42. That file, MACHINE.INI (CameraType=7120) and the network configuration (UseDigitalCamera=7120) told me which sensor sits behind the lens.

Close-up of the OV7120 image sensor die
OmniVision OV7120, close-up

Why black and white? A colour sensor has a filter over every pixel (a Bayer pattern of two green, one red and one blue per 2 × 2 block), so each pixel only receives part of the light. The monochrome OV7120 has no colour filters. The datasheet specifies a minimum illumination of less than 0.5 lux for the OV7120 versus less than 2.5 lux for the colour OV7620, both at f/1.4. For iris imaging in near-infrared light, colour is useless anyway.

The sensor only outputs a digital pixel stream; it cannot write to memory by itself. That is where the FPGA comes in, as a frame grabber (part 3). There is an 18 MHz oscillator on the camera board, matching CameraSpeed=18M in MACHINE.INI. The camera board also carries a Philips PCF8574T I²C port expander and unpopulated footprints for a large QFP and two TSOPs. The firmware talks to three PCF8574s: two for the keypad matrix and one that switches the camera power and takes the shutdown command (part 3).

Camera board front with lens, oscillator and unpopulated chip footprints
Camera board (PN20151RB)

On the back of the camera board is the CompactFlash slot holding a 256 MB SanDisk card labelled “Standard Grade”. A sticker on it reads “Ardence Realtime Phar Lap ETS® Kernel © 2005”. The card holds the complete system: boot files, operating system, application and the entire iris database. I dumped it and analysed it in the software post.

SanDisk Standard Grade 256 MB CompactFlash card with an Ardence Phar Lap ETS sticker in its slot
SanDisk 256 MB CompactFlash with Ardence ETS sticker
Back of the camera board with the CompactFlash slot
Camera board, rear view

I would have expected an industrial-grade CompactFlash card like the one below, because industrial cards are made for wider temperature ranges and heavier write loads.

SanDisk Industrial Grade CompactFlash card
SanDisk Industrial Grade CF card

Conclusion#

The device is tidy and very repairable: standard screws, little adhesive, three well-separated boards and a removable CF card that holds the whole system. The many unpopulated footprints and the leftover display drivers show an iterative development process. In fact the same CF card image contains splash screens for both the PIER 2.3 (128 MB) and the PIER 2.4 (256 MB).

The component choice is a mix. The CPU, the FPGA (speed grade -5, commercial) and the CF card are commercial grade. Other parts, such as the Sharp timing controller (−30 to +85 °C), the TI touch controller and the Maxim ADC (both −40 to +85 °C), are rated for wider ranges. Note that a commercial rating of 0–85 °C refers to the chip’s case temperature, not the air temperature. Still, for a device that was carried through deserts, I would have expected industrial parts throughout, especially the CF card. The vendor calls the PIER “rugged”; I could not find any source that claims a MIL-STD qualification.

How the software handles security, and why that matters more than the hardware, is covered in part 2; part 3 runs it in an emulator.

Disclaimer: All information in this article should be used responsibly.

Sources#

cd ~/projects