Teardown: Security camera network module

Article By : Brian Dipert

Blink's Sync Module manages a connected camera network over both Wi-Fi and proprietary 900 MHz wireless links, and all at a consumer-friendly form factor and price point.

One of my recent blog posts gave an overview of the unique (at least to me) architecture of Blink's consumer security camera system. In summary (see the blog post for more product details) each of the cameras in a particular network implementation connects not only the common LAN/WAN router over Wi-Fi, but also to a separate and common piece of hardware, the Sync Module, over a proprietary long-range 900 MHz channel that Blink refers to as the LFR (low-frequency radio) beacon.

The Sync Module also connects to the router over Wi-Fi. And the cameras, which claim up-to-2 year operating life out of a set of two AA lithium batteries, are normally in low-power standby mode. If the cameras' PIR motion sensing is enabled, they'll alert the Sync Module over LFR when they're triggered, and the Sync Module will pass along the operating status to “cloud” servers to prepare them to capture the incoming video clip.

Similarly, when you want to view a live stream from a particular camera using the Blink app for Android or iOS, or over an Amazon Echo Show or Echo Spot (or through the Echo Show mode available in recent-edition Amazon Kindle Fire tablets), it's the Sync Module you'll be talking to first. The Sync Module will pass along the app's request and activate the selected camera, turning it back off again afterwards to preserve battery life. The Sync module itself is AC-powered, via a USB power adapter intermediary.

Today's teardown candidate is that very same Sync Module. The one currently in use with my Blink XT cameras matches their black color; this particular one was purchased standalone off Ebay specifically for teardown purposes and is white (and previously used). Color scheme deviations aside, the two models are functionally identical, a key factor in being able to mix together Blink (indoor) and XT and XT2 (outdoor) cameras within a common network, subject to signal strength/range and maximum-of-ten-cameras-per-module limitations.

I'll begin, as usual, with an exterior packaging shot:

Inside the box you'll find the Sync Module itself and underneath it the USB adapter, USB-to-micro USB cable, and a thin piece of usage overview documentation:

Following are top and bottom views of the out-of-box unit, with an Abraham Lincoln for comparison (exact specs are 62×59×18 mm in size, and 1.6 ounces in weight):

The Android and iOS apps can directly read the QR-encoded module ID information on the bottom sticker for ease of initial setup:

Two of the four sides of the unit are completely smooth. The third contains the micro USB power input, alongside a nonfunctional Ethernet port (which is completely absent in newer revisions of the hardware) and the fourth contains an equally nonfunctional USB port, supposedly originally intended for optional local storage of video clips via a flash drive but never (to date, at least) activated, alongside the hardware reset switch:

Time to dive in. I was pretty sure from preparatory feel that there were no screws underneath the sticker, and I was right. The only other way I could see to get inside was via the recessed gap around the top, and again I was right:

Note the Immedia Semiconductor (original name for Blink, back when it was a semiconductor chip supplier) stamp on the PCB:

Remove two screws and the PCB assembly lifts right out of the chassis. Boring (although note the extensive trace-implemented ground plane and antenna structures, along with the curious row of holes along the top) back-side view first:

Now for the front side:

The two-LED assembly in the upper right corner, when illuminated, indicates an active Wi-Fi connection (blue, at top) and active power (green, below it). The Wi-Fi module in the middle is removable, suggestive to me that the design was originally intended for wired Ethernet in the basis configuration with wireless connectivity as an optional add-on. Here's the module close-up:

That's an Atheros AR9331 Wi-Fi SoC in the center, with a Winbond SPI serial NOR flash memory alongside it. Note, too, the unused antenna connector.

Not much to see on the back aside from the volatile memory counterpart to the aforementioned nonvolatile flash memory, specifically a Zentel A3R12E40DBF (PDF) 512 Mbit DDR2 SDRAM.

Now for underneath the add-on module. Given how much of the total real estate (not to mention cost … see, for example, the Pulse transformer) was consumed by the unused wired Ethernet functionality, you can see why Blink stripped it out of later hardware revisions … begging the question of why the USB connector's still there!

The markings on the IC PCB-labeled U2 are too faint for photograph reproduction, but my inexpensive handheld magnifying glass indicates three rows of alphanumeric characters along with an unknown-to-me manufacturer mark in one corner.

455A
BA49
609

My suspicion is that it (plus surrounding circuitry) implements the proprietary 900 MHz LFR function, but I can't find reference to the chip online; the only “455A” I can come up with is a 4-bit microcontroller from Renesas whose pin count doesn't match this particular chip. Ideas, readers? Also of note is the unused three-pin connector in the lower left corner of the PCB, next to the Ethernet connector, along with, above the USB connector, the reset switch and, above that , an embedded blue LED of unknown function, periodically blinking during normal operation but unseen by the user.

Speaking of which … the only way that I noticed that last LED at all was by means of testing the device after putting it back together … it still works! And with the teardown complete, I'll now turn the microphone over to you for your comments!

Brian Dipert is Editor-in-Chief of the Embedded Vision Alliance, and a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the company's online newsletter .

Leave a comment