I have an old key fob from a 2005 Hyundai that has broken buttons so under the teardown knife and into the acid it goes
Visible on the board is just one ic a few passives and a metal can package (Which presumably contains a SAW filter). The single integrated circuit is an Omron 111 with a week 48 2004 date code.
A quick bit of googling and you can find out about the key fob at the FCC site This is the block diagram from the FCC disclosure (Complete with typo). The part uses FSK modulation, with a carrier frequency of 307.9MHz which is set by a SAW filter (Surface Acoustic Wave).
Measuring in at 4.0 mm x 2.5 mm it is clearly a microcontroller chip with memory arrays and lots of digital logic.
The second thing I noticed was the lack of any RF features, it is just a MCU and as the block diagram suggests the RF transmission circuit must be done off die with just the SAW filter and the passives to generate the 308MHz carrier with the MCU providing the FSK modulation signal.
The data sheet is dated 1995 and the technology involved looks consistent with a mid-90’s technology, with 3 levels of metal and what I estimate as a 1.25 μm process node. Here is an image of a general logic area showing transistor level and metals 1 & 3. (The black residue around metal 3 tracks is residual plastic from the depot. I am still working on trying to improve my die depot process).
To get this image with all layers in focus I have used a technique called focus stacking taking a composite of 5 images.
Here is a close up of the light blue area that visually jumps out of the die photo. It is a symetrical array of capacitors formed between metal 1 and metal 2 layers (The blue layer is metal 2.) I don’t know what the function of this block is.
On a generic MCU like this even with a data sheet identifying the circuit functions is difficult. I should at least be able to pick out the memory blocks.
The 32kb ROM in the center is very easy to spot.
I believe the array above that is the EEPROM array as it is the only other very regular array, but it seems very big for just 256 bits?
Similarly the area I think looks like an SRAM array seems large for just 512 bits.
The last thing I will show is some test structures that I find quite funny..(The funky patterns on the bond pad is from the depot where the acid has etched away the metal in the bond pads.) From left to right you have mask layer identification (These are common and useful check to ensure the process sequence was correct). The others are a couple of large transistors, a couple of resistors and two small contact chains. I find these funny in that there will have been sophisticated process control structures throughout the wafer placed in the scribe lanes. These on chip structures are redundant and I doubt were ever measured, yet they are taking up valuable real estate on the die. If you took them out, moved the die markings up and to the right you could shave 0.1-0.2 mm from the die length which would have given perhaps 3 or 4 more die per wafer (On a 150 mm diameter wafer).