Teardown: Blink XT security camera

In a recentblog post, I gave an architectural overview of Blink's security system; one or multiple Blink (indoor) and/or Blink XT (outdoor) cameras powered by dual AA lithium battery sets, each connected to the Internet over 2.4 GHz Wi-Fi and simultaneously connected to a common controlling Sync Module over a proprietary 900 MHz LFR (low-frequency radio) wireless link. And inlast month’s teardown, I dissected that very same Sync Module. This time, I'll take a look at the other end of the chain, a Blink XT camera (FCC documentation is here).

I'll begin (as usual) with some external packaging shots, taken after the clear plastic shrinkwrap was removed:

一个fter removing the cardboard packaging sleeve, the camera itself comes into view:

Underneath the package-contents “sandwich” are three scant pieces of documentation; a quick-start guide, a sticker to alert potential intruders of the camera's presence, and additional printed instructions on how to open the back cover, to enable/disable the blue recording indicator light, and to alternatively power the camera via microUSB (obviating waterproofing in the process, by the way):

The camera's packaged backside includes a removable sticker that replicates the “how to open the back cover” instructions … obviously, a common tech support question:

Underneath the camera, the other half of the package-contents sandwich contains a starter set of two AA lithium batteries, plus a plastic mounting bracket. Thecamera’s specificationsinclude dimensions of 71.2mm (wide) by 71.3 mm (high) by 34.1mm (thick), along with a weight of 88.1 grams (minus the batteries):

The visible (and infrared) light sensor's associated optics subsystem is obvious at the top center of the device, with the blue recording indicator LED to the right of the optics and the microphone to the left. And below it is the semi-hemispheric cover for thePIR (passive infrared sensor) motion-detection module.

下一个步骤;让电池盒,丐n access to the circuitry underneath. No screw heads under either sticker, alas. And no amount of screwdriver-as-lever action around the battery compartment edges did the trick, either. I was about ready to break out the hacksaw (reluctantly, as I'd really hoped to be able to return the unit to full functionality post-disassembly) when I looked closely one last time and noticed the two small water-resistant rubber gaskets with stealthy screw heads underneath them:

Here are a couple of overview shots of the two-PCB stack underneath:

In the latter shot, note (as I didn't) the metal clip (which I'm guessing is for shared ground interconnect purposes) spanning the two PCBs. When I removed the three screws holding the PCBs together and to the plastic case below them, and pulled the top PCB away from its sibling, the clip went flying … had I not been wearing reading glasses at the time, the clip might have ended up in my eye (and I also had to bend the ends back toward each other in order to restore sufficient tension during re-assembly):

Crisis averted; let's peruse some closeups. First is the topside of the upper PCB:

一个long the right side, toward the top, you'll see the hardware reset switch. Below it, about halfway down that side, is the switch that controls the blue recording indicator LED. Toward the bottom of that side is this particular PCB's conductive pad for the aforementioned clip. At the bottom is the micro-USB connectoroptionally used for power purposes. And along the left side are the through-hole vias for the connector between the two PCBs. Flip the PCB over and the connector's 34-pin male half comes into view:

一个t the top is the visible-plus-infrared image sensor's associated optics assembly. It lifts right off, now that the earlier mentioned screws have been removed, revealing the image sensor underneath:

In the middle of the PCB is the PIR module. Underneath it, partially visible sticking out of one corner, is Immedia's ISI-108A SoC. As mentioned in my earlier blog post, it's no longer available for commercial sale, now that Immedia has transitioned from being a semiconductor supplier to a retail system manufacturer, but a bit of Google searching produced overview documentation on it (on publicly exposed company test websites, no less)hereandhere. And in the lower left corner is aWinbond 25Q80DLNIG serial NOR flash memory(PDF), presumably containing code to run on the ISI-108A.

Before moving on, here's a focused view of the mini-PCB at the end, which contains two of the system's four battery terminals along with at least one embedded antenna. Wi-Fi? 900 MHz LFR? Both? Readers?

Now for the second PCB, complete with notable cutout holes for the earlier mentioned optics and PIR modules. Remove two more screws and the PCB lifts right out of the chassis:

一个long the bottom is the female half of the inter-PCB connector pair. Along the right side is a similar multi-hole (six this time) configuration to what we saw last time with the Sync Module, along with what seems to be another embedded antenna. In the upper left corner is a MEMS microphone (supplier unknown: two-line markings of S2242 and 8560). And along the top are two notable ICs: another Winbond serial NOR flash memory, and a mysterious chip with a cryptic sticker on top of it.

Peel off that sticker and you'll find the product markings forTexas Instruments’ CC3100R1(PDF), a “SimpleLink Wi-Fi Network Processor, Internet-of-Things Solution for MCU Applications” (whose associated software is likely stored in the Winbond IC right next to it).

Last but not least, let's flip this particular PCB over:

In one corner is a through-hole feeding the MEMS microphone, with a moisture-barrier gasket around it. Between the large holes for the optics assembly and PIR module is another LED, this one blinking only during initial setup and firmware update processes. Next to the PIR module hole is the850 nm infrared emitterused during “night vision” operating scenarios. And below the IR emitter, along the bottom edge of the PCB, is the other conductive pad for the inter-PCB clip.

一个bout that clip … restoring it to a semblance of its original shape and tautness, and getting it back in place, was by far the hardest part of the reassembly process. And I'm happy to say that, just as with the Sync Module that preceded it, the Blink XT still worked just fine after I put it back together. Speaking of the Sync Module, I'm left with the same core question I had last time: which IC(s) on the board, along with which antenna, implements the LFR function? Sound off with your thoughts on this or anything else related to this teardown in the comments, please!