The Real Human Network

Tools for Humanity Open-Source Orb Documentation

Welcome to the open-source documentation for the latest version of the Orb. It cover the device’s electrical engineering and architecture by subsystem, and the individual repositories contain each PCB in the device which are browsable via Allspice.

We invite and encourage readers and interested parties to raise questions, address issues and continually interact with these repositories and each other to further advance Orb functionality, privacy and security.

What is the Orb
Overview Images
Interconnection Diagram
Architecture Diagram
Power
Security
Compute
Main MCU
Optics
Illumination
Summary / Feedback

What is the Orb

The Orb is a sophisticated imaging device for proving a person is a unique human. World's privacy-first ethos adds to the device's complexity because the Orb takes images but never stores them - any personal data is held only by the individual's own devices. A comprehensive description of the Orb software can be found here: https://world.org/blog/engineering/worldcoin-foundation-open-sources-core-components-orb-software

Overview Images

For the features visible externally, the golden "window" is for the main eye camera, which takes high-resolution infrared images of an individual’s eyes. The sensor bar below it houses multiple other optical sensors, which assist in focusing and locating the individual’s eyes and face - these are discussed in the Optics section. Finally, the slots at the bottom of the device are for airflow and cooling.

Now, let's get an idea of what the inside of the device looks like! The following annotated pictures show where the major components are located and how the device goes together.

Back

Depending on country of deployment and configuration, the Orb contains three wireless technologies — WiFi, LTE and GPS — all of which require antennas. To maximize performance, they are placed close to the inside surface of the shell.

Front

The main eye camera has a very narrow field of view and needs to be pointed at the individual's eyes to record images at the appropriate resolution. To address this challenge, the Orb uses a gimbal assembly (the golden window is actually the mirror surface) to steer the field of view. The gimbal aligns itself during boot and adjusts dynamically during interaction. The actual camera is located to the right of the gimbal assembly - see the Optics section for an illustration of the light path.

The sensor bar below the main camera contains the rest of the optical sensors: the wide angle camera, a thermal camera and two Time of Flight sensors for spoof detection and focusing.

Side

In this image, you can see the arrangement of the PCBs. The powerboard with the orange supercapacitors connects to the mainboard, which is stacked above it.

To see the main computing unit, (a Jetson Orin NX with the large heatsink), remove the antenna mount and cooling cover just below the fan. The cover assists with airflow through the device.

Bottom

In this view of the underside of the Orb, several external and internal features are visible. On the far left there is the small circular power button next to the large circular battery ejector button. Continuing from the left but inside the battery compartment, the vertical battery contacts are visible followed by the SD card slot and an external debug port. The latter is used for stationary installs and breaks out Ethernet and USB connectivity (see SD Interface repository).

Interconnection Diagram

The diagram below explains how the hardware components go together. It shows the arrangement of the major components by PCB (black boxes) or FPC (green boxes):

Architecture Diagram

Now that we are familiar with the physical connections between the Orb's components, we can take a look at the functional subsystems. At a high level, the Orb contains 5 subsystems, which are shown in the following block diagram and color-coded by approximate function:

Power Subsystem (Yellow)

One of the most complex parts of the Orb is the power distribution network. Below, we describe the main power supplies, excluding the dedicated ones for the security subsystem, which are covered in the security section. Illuminating the eye to capture the necessary detail requires a sufficiently bright (pulsed) IR light and, therefore energy, so TFH required a high-capacity battery in a custom form factor. For the previous version of the Orb, TFH designed the battery in-house, but for this latest version it was custom-designed by HighPower to our specifications.

The battery is a custom Li-Ion pack consisting of 8x 18650 cells with 3.6V nominal voltage in a 2P4S configuration (14.4V) and a capacity of close to 100Wh. This voltage is transformed into several main rails that power other components:

(Note: It is easier to follow the power tree description by consulting the architecture diagram. We recommend referencing the diagram when reading the below descriptions.)

+VBAT_SW: When the battery is inserted, VBAT_SW is supplied from that. When the battery is removed, VBAT_SW is supplied by +12V_CAPS for some time to allow a graceful shutdown and reduce the possibility of filesystem corruption. +VBAT_SW can also be turned off by the main MCU when the Orb is powered down.
+12V_CAPS: This rail is created from the +17V_CAPS rail, and is mainly used as a backup to +VBAT_SW when the battery is removed. It also supplies the stepper motors, the cooling fan and the liquid lens focusing.
+17V_CAPS: These supercapacitors provide the instantaneous current required to run all of the IR illumination LEDs and to provide +12V_CAPS. This rail is boosted from +VBAT_SW.
PVCC (31.5V): Derived from +17V_CAPS, this rail is used to actually run the IR and white LEDs. Using 31V supercapacitors would be impractical due to size constraints, so the 17V rail is boosted as needed.
5V: Directly powers the Nvidia Jetson, stepper motor driver logic, polarizer motor and front unit RGB LEDs. Switched down to several further rails:
- 3.3V: These power WiFi, LTE, SSD (now SD card), NFC, motor drivers, ALS, temperature sensors, IR & thermal cameras (these have internal LDOs for stability) and most glue logic (port expanders, comparators etc)
- 1.8V: TPM module, 2D Time of Flight logic, Jetson communication voltage levels
- 2.8V: Thermal camera coprocessor
- 3.6V_ILLU: 2D Time of Flight illumination
- 3.3V_LDO: 2D Time of Flight stable supply
5V_RGB: This powers the single RBG LED on the Operator Interface board
3.3V_UC: This rail powers the main microcontroller separately for power gating purposes. It is always on when the battery is inserted.

Hardware Security Subsystem (Pink)

The Orb performs a signature over signup data with keys resident in a protected hardware enclave. The architecture of this is covered here, and the physical hardening is shown in the PCB section.

Signing is performed by an NXP SE050 secure element. This chip is interfaced to its own dedicated security microcontroller, an STM32 that handles tamper detection for the Orb and has its own double-redundant power supply.

The main goal of the tamper detection is to erase the security keys in the event of an intrusion. This system consists of the following parts:

4.7V rail: This rail powers the security subsystem and is derived from +VBAT. This rail also charges the single-cell Li-Poly security backup battery. Note that it is NOT derived from +VBAT_SW but from +VBAT, so that the backup battery always gets charged even if the Orb is powered down (+VBAT_SW off).
Tamper detection: The Orb includes several physical tamper detection mechanisms intended to destroy key material upon intrusion. These systems detect abnormal environmental conditions, as well as direct intrusions into the Orb.

The security MCU is connected to the Nvidia Jetson for key exchange via a single-wire CAN bus, which uses a custom electrical implementation of the CAN-addressing protocol.

Compute (Nvidia Jetson Orin)

Most of the main application runs on an Nvidia Jetson Orin NX (16GB). It runs several ML models that perform image analysis and segmentation, as well as encrypting the PCP and general Orb connectivity.

Since the optical system will be discussed in detail in the next section, we will mention here only the non-imaging components connected to the Jetson.

WiFi: Orbs include PCIe-based WiFi cards in a M.2 slot. The current Diamond Orb uses a standard AX210 card.
LTE: For some Orbs, there is also a standard miniPCIe connector and will mount a Telit LE910C module.
SD Card: This is used to store OS images or external data.
Ethernet: Optional peripheral to get an Orb online in the case of fixed installations (Flagship locations etc).
HDMI: Used for internal debugging.
Audio: User-facing sounds are played from the Jetson. However, looking at the block diagram, there is also an option to play sounds from the Main MCU via an audio data multiplexer. We do not currently use this feature.
Hardware TPM: The Jetson is directly connected to an Optiga SLB9672 hardware TPM.
Main MCU: This MCU is responsible for controlling most Orb hardware aside from the imaging system. It communicates with the Jetson through a single-wire custom CAN implementation, and is discussed in the next section.
MIPI: This is a standard interface for most image sensors and is used as such in the Orb for communicating with the main face detection RGB-IR camera, eye camera and 2D time-of-flight sensor.
I2C: Another standard interface, this is used by the Jetson to configure the imagers including the 2D time-of-flight sensor.
USB: Several peripherals on the Orb are USB-based. These include the thermal imager, the BLE component of the WiFi card and the extra USB port that is brought out to the SD Card PCB for the stationary stand interface.

Main Microcontroller

Orb devices include two dedicated STM32 microcontrollers. The first handles the encryption as mentioned above, and the second “main” MCU controls the rest of the Orb hardware. This MCU is responsible for all power rails, sequencing and measurement, LED lighting and control of the imagers, cooling, internal sensors and operator interface. More specifically, these components are as follows:

Power Sequencing: The main MCU controls and sequences most power rails on the device. This includes sensor power, WiFi, LTE, main peripheral 3.3V, 1.8V.
NFC: The Orb provides an STMicro NFC reader for interfacing with operator and customer phones.
Sensors: The Orb contains many internal sensors, which are used for the device's health and status monitoring:
- Temperature sensors throughout the device for hot conditions and to adjust cooling.
- Voltage measurement on every rail to ensure the device’s power supply is operating correctly. Also used for switching between available power sources.
- Hardware version can be read as an analog voltage or binary GPIO sequence, depending on the PCB (industry standard practices).
Cooling: The main MCU controls the fan, which draws air through the whole device from near the front. This allows successive cooling of the supercapacitors, cameras and LEDs, the Jetson and high current regulators (in that order, approximately).
Liquid Lens: Part of the optical assembly includes a liquid lens for focusing. This is controlled from the main MCU.
LEDs: All LEDs on the Orb are driven from the main MCU, though most are located on the Front Unit. Control signals are routed through the Power Board to the Front Unit. There are several sets of LEDs:
- RGB: These are individually addressable (clock, data) and are used to indicate state and user positioning.
- White: The white LEDs illuminate the individual's face to acquire the full-frame image that is used to locate the eyes.
- IR: These infrared LEDs provide the main illumination for eye imaging. They are eye-safe, high power LEDs driven directly by a PWM signal through MOSFETs. The Orb uses two wavelengths: 850 nm and 940 nm, since different iris features can be resolved at separate wavelengths.
Gimbal: The eye camera sensor has a very narrow field of view. Therefore, the Orb includes an X-Y scanning gimbal which allows the device to locate the individual's eyes in the larger frame recorded by the RGB-IR (face) camera. This gimbal is driven by two stepper motors.
Polarizer: The third stepper motor controls the orientation of the polarizer wheel. This is used for recording IR images in two different light orientations, which helps resolve detail in iris structures.
Audio: The main MCU support playing sound through I2S using a TI TAS5805 DAC. As mentioned above, this connection is multiplexed with an I2S connection from the Jetson, so in theory sound can be played through both devices. The DAC is configured over I2C, which is only connected to the main MCU.

Optics

As the main purpose of the Orb is to capture photos of the face and eyes in a fraud-resistant manner, the device has multiple optical sensors to accomplish this task. A secondary goal is to ensure the scan is performed in a comfortable, flexible and simple manner (from a user point of view).

The sensors, along with their primary purpose, are the following:

Main eye camera - 1.8MP IMX296: Capture iris images

This diagram illustrates the optical path showing the positioning of the camera, the gimbal and its mirrors:

Sensor bar:
- Wide angle camera - 5MP Omnivision OX05B1S, on Leopard module with OAX4000 ISP: Captures face images
- Thermal camera - Seek MS201SP core: Anti-spoofing
- 2D ToF Depth camera - Infineon IRS2975C: Anti-spoofing
- 1D ToF distance sensor - STMicro VL53L1X: Distance measurement

The following image shows the arrangement of the sensors along the bar behind the outer casing (compare to the overview images above):

Functionally, the Orb software runs several asynchronous "agents" that execute tasks more or less in parallel. Thus, in order to take images of an individual’s eye, the following capture tasks run and deliver results to and from each other:

Use the RGB/IR wide angle camera to locate the individual's face and eyes within the frame
Control autoexposure of IR illumination, synchronized to the frame rate of the IR camera if the eyes are in the frame.
Steer the eye camera gimbal to the correct location based on the wide angle camera's continous model
Adjust focus and take photos in a random order.

Illumination

The main challenge with the technology is how to achieve a good image of the individual's eye at a distance. It turns out that photographing the iris with infrared light results in pictures with less specular reflections, and even more so when it is recorded with different polarizations.

Thus, the Orb contains infrared LEDs in two wavelengths (850nm and 940nm), which illuminate the individual's face and eyes during the imaging process described above and allow capturing high quality images at a comfortable distance.

Note: The Orb’s infra-red LEDs are certified eye safe and compliant with IEC 62471 - test results are available upon request.

The Orb also has several RGBs and white LEDs positioned around the main camera. They are used as a user interface of sorts, as well as for state indication. The white LEDs are further used to illuminate the user's face.

The following image shows the placement of all the LEDs inside the front unit. Please refer to the individual repository for further details.

Repositories

As you review the individual repositories, please feel free to raise questions and highlight any issues you encounter. Building the real human network and its hardware requires all of us working together, and we deeply value your contributions in making it a success.

You can follow our progress at Tools For Humanity

General questions and feedback

Please email us at hw-feedback@toolsforhumanity.com!

Think you’ve found a security issue?

We accept vulnerability reports in two ways: through our public bug bounty program or through our security disclosure email. Please note that only reports submitted through the HackerOne bug bounty program may be eligible for bounties.

1. (Preferred, bounty-eligible) Tools For Humanity Bug Bounty Program

Tools For Humanity manages the bug bounty program on behalf of World through the HackerOne platform. Reports submitted to this program may be eligible for rewards as governed by the bug bounty policy. This repository is within scope for the bounty program.

2. (Not bounty-eligible) Security mailing list `security@world.org`

We also accept vulnerability reports in multiple languages via email at security@world.org. If reporting via email, please encrypt the content and attachments using World PSIRT’s PGP Key (please see https://world.org/pgp-key.txt or check https://world.org/.well-known/security.txt for more info). The current fingerprint for this ECC curve25519 key is 45FE 2A09 90DD 7B04 EE51 1FEB 5F22 D67F 2C43 B48D.

Please include the following details in your report (if applicable):

Product/Repository and version/branch that contains the vulnerability
Type of vulnerability
Security impact of the vulnerability
Instructions for reproduction
Proof-of-concept (POC) demonstrating the vulnerability

Issues in third-party libraries or modules

Please report security bugs in third-party software to the original maintainers.

Responsible Disclosure

We believe that responsible disclosure is a net benefit for the community and subsequently encourage researchers to publish their findings after the issues have been remediated. We do ask, however, that you allow sufficient time for patches to be deployed globally, so please coordinate with World PSIRT prior to publishing, either through the bug bounty program or over email. For more information on responsible disclosure, please see Google Project Zero’s Vulnerability Disclosure policy as an example.